How to Fortify Your API Against Multi-Vector Threats
summary
Analyzes decade-plus breach data and gives concrete failures: Peloton leaks allow scraping 30,000 profiles because of sequential IDs and swapped authentication/authorization; Lemonade surfaces a public, indexable API that permits read/write operations; a Starbucks misconfigured GraphQL endpoint exposes 100 million records; a telco makes a private API public via DNS/network change. Recommends threat modeling at design time, centralized API audit trail, app-layer logging, governance and discovery to prevent multi-vector stacks that amplify damage.
AI-written summary · about
chapters (11)
- 0:00Start
- 0:21Data Breach Prevention
- 1:46Korean Air Flight 801
- 9:00Peloton Insights
- 11:23Lemonade Startup
- 12:38Starbucks Strategy
- 14:41Telco Industry Analysis
- 18:01Key Learnings & Recommendations
- 19:22Lessons from Outliers
- 21:27Thank You Note
- 21:46Farewell Message
related talks
24mLessons from API Breaches: Securing Your Digital Infrastructure
22mLayered Approach of API Security Strategies and its Business Impact
29mDecoding a Decade of API Breaches: Key Learnings Unveiled
01h 29mAPI Vulnerabilities and What to Do About Them
31mStandard Classification: API Security Top 10 - A Beginner's Guide to Mitigation
25mAPI Security Deep Dive: Safeguard Your Digital Assets
48mAPI Security for Enterprises fireside chat
35mClosing Keynote Day 1 API First Hacking