The Need for Automation in API Security
summary
Claims automated API discovery from load balancers, gateways and Kubernetes, then generates an automatically built OpenAPI and flags 30–80% undocumented endpoints during proofs of value. Platform classifies PII (email, IBAN, credit card, custom patterns like Brazilian SSN), tracks traffic over time, detects business‑logic attacks such as BOLA and correlates sessions across changing IPs — BOLA / OWASP API1 accounts for ~40% of blocked incidents — and can block IPs or user IDs and push remediation steps into DevOps tools.
AI-written summary · about
chapters (23)
- 0:00Introduction
- 0:43Software is eating the world
- 1:08Attackers target APIs
- 3:06How do we get here
- 6:26Questions to consider
- 10:02API specifications
- 12:15How Salt complements API gateways
- 14:26How Salt architected the platform
- 18:49Demo
- 20:29Endpoints
- 20:52Discovery
- 22:26Payment API
- 23:27Parameter Detection
- 24:25Sensitive Parameters
- 25:38Download API Specification
- 27:45Parameter
- 28:26Compliance
- 30:10Security Insight
- 33:00Attacker
- 35:43Timeline
- 36:26Response
- 38:48Remediation
- 39:34Wrapup
related talks
33mImproving API Security Posture.
31mAPI security
58mA Risk based Approach to API Security
24mAPI security, mitigate API abuses using machine learning
19mAvoid These API Security Pitfalls: Expert Insights
26mOffensive API Penetration Testing
30mAttack API Architecture
42mThe Secret Life of APIs: Latest Attack Data Shows What Your APIs Are Doing