Decoding a Decade of API Breaches: Key Learnings Unveiled
summary
A decade-long breach tracker (43 documented API events, 577 million proven records, ~13M records per event) comes from Google/RSS alerts, public disclosures and lab probing, and aligns to the 2019 OAS API Top 10. Findings: authentication and authorization failures dominate, breaches are multi-vector (auth + misconfiguration or data exposure), injection appears in ~10% of cases, private APIs get exposed by security group/IP changes, sequential IDs enable mass enumeration so use UUID and the team uses return-caller identification (IP+user agent) for detection. Report and dataset on firetail.io.
AI-written summary · about
chapters (14)
- 0:00Welcome to API Days 2023
- 0:50API Methodology Overview
- 3:58API Limitations Discussion
- 5:55Importance of API Security
- 7:36Rise in API Attacks
- 8:45Common API Attack Vectors
- 10:52API Authorization Issues
- 16:42Multi-vector API Breaches
- 20:02Weaknesses in MFA
- 20:41API Security Real World Examples
- 24:55API Security Best Practices
- 26:15Launching an API Security Program
- 27:50API Security in CI/CD Pipeline
- 28:34Closing Remarks
related talks
24mLessons from API Breaches: Securing Your Digital Infrastructure
35mClosing Keynote Day 1 API First Hacking
01h 29mAPI Vulnerabilities and What to Do About Them
22mHow to Fortify Your API Against Multi-Vector Threats
30mDon’t Worry, Be API: Addressing AppSec’s Newest Challenge
42mThe Secret Life of APIs: Latest Attack Data Shows What Your APIs Are Doing
19mAvoid These API Security Pitfalls: Expert Insights
25mOWASP Top 10 for APIs