The Secret Life of APIs: Latest Attack Data Shows What Your APIs Are Doing
summary
Akamai analyzes trillions of connections and finds 29% of web attacks target APIs, with EMEA showing the highest regional share; common incidents include carding via payment‑validation APIs that validate tens of thousands of cards, loyalty‑point theft that consolidates and cashes out ~$100k, BOLA exposure in airline APIs, and unauthenticated notification endpoints abused to send spam. The research stresses discovery/visibility, runtime detection plus shift‑left remediation, and expanding tooling through the Neosec work and the Noname acquisition.
AI-written summary · about
chapters (23)
- 0:00API security threats intro
- 1:08APIs in modern business
- 4:41Global API attack trends
- 7:09Regional API attack breakdown
- 8:12Industry API attack patterns
- 10:01API attack techniques (OWASP top 10)
- 11:04Top API security vulnerabilities
- 13:54Need for API visibility
- 16:44Shift left for API security
- 18:09Why WAFs fail on APIs
- 19:45Carding attacks via APIs
- 22:39Loyalty fraud in retail
- 25:14API abuse in SaaS
- 26:22BOLA risks in airlines
- 28:29Why you cannot protect what you cannot see
- 29:32API security tools overview
- 30:13API security remediation
- 32:02Five-step methodology to secure APIs
- 34:13API detection and response
- 35:39API risks in smart cities
- 37:51Building a stronger offense against API threats
- 38:33Closing and SOTI report
- 38:53Q&A
related talks
20mFrom Chaos to Calm: Navigating Emerging API Security Challenges.
33mSpotlight On Latest Web Application and API Attack Data
49mApisecure, 14 & 15 March 2023 - Sudhir Chepeni, Director Products and Technology at Akamai.
01h 01mApisecure, 14 & 15 March 2023 - Jeremy Ventura, CISO at ThreatX.
32mApisecure, 14 & 15 March 2023 - Shannon Wilkinson, Cybersecurity Founder | Women in Technology [...]
24mAPI security, mitigate API abuses using machine learning
19mProtect Your Digital Assets: Spot and Secure Open APIs Quickly
35mClosing Keynote Day 1 API First Hacking