Protecting financial grade API: adopting the right security stack
summary
Platform has cataloged 300+ public breaches and shows repeat root causes: exposed data via oversized JSON responses, leaked JWT payloads, guessable IDs leading to Broken Object Level Authorization (IDOR), missing or misapplied rate limiting, and poor dependency/image hygiene (npm/docker). Recommended stack items are service mesh for communication, app-level validation, short‑lived tokens or authorization code grant, mutual TLS for partners, and automated negative testing and supply‑chain validation; fixes are preventive, automated, and much cheaper before production.
AI-written summary · about
chapters (12)
- 0:00Intro
- 1:19API Breaches are on the rise!
- 3:17Applications Architecture has changed!
- 6:24API Security Applies at Multiple Levels
- 9:21UBER (SEPT 2019)
- 10:38Leaking Mobile Token
- 11:10AP11 (BOLA) MITIGATION
- 16:36FACEBOOK (FEB 2018)
- 17:35API2 (BROKEN AUTH) MITIGATION
- 20:10AP14 (RATE LIMITING) MITIGATION
- 22:02API 7 MITIGATION malware with Bledbindi trojan
- 22:55LOGS, LOGS, LOGS!
related talks
22mLayered Approach of API Security Strategies and its Business Impact
22mHow to Fortify Your API Against Multi-Vector Threats
59mInsecure Transit - Microservice Security
01h 29mAPI Vulnerabilities and What to Do About Them
08mAPI Security Risks
25mAPI Security Deep Dive: Safeguard Your Digital Assets
29mAPI Security in 2017
50mCommon API security pitfalls