Apisecure, 14 & 15 March 2023 - Brenton House, Vice President, Digital Evangelism at Software AG.
summary
Walks through the draft OWASP API Top 10 2023, names BOLA as still #1 and introduces new entries like broken object property level authorization, unsafe consumption of APIs, SSRF and automated-bot threats, cites Twitter’s rumored ~400 million-record API leak and Peloton and Clubhouse incidents, and argues the first line of defense is an API Gateway augmented by WAFs, dedicated API security tools and AI/ML detection; recommends shift-left design, schema validation for third‑party integrations, inventorying shadow APIs and protecting developer credentials.
AI-written summary · about
chapters (20)
- 0:00Welcome
- 0:45API security importance
- 3:36Stark Industries strategy
- 4:39OWASP Top 10 explained
- 6:042023 OWASP updates
- 13:51Human risks in API security
- 15:58AI in cybersecurity
- 18:49API Gateway role
- 20:35Beyond API Gateway tools
- 21:58Strong API security strategy
- 23:24Open source intelligence
- 25:38API breaches lessons
- 26:44Tony Stark's approach
- 29:12Collaborative API security
- 30:15Resources and contact
- 31:41Q&A OWASP 2023
- 33:50Third-party API security
- 35:58API vulnerabilities beyond OWASP
- 39:27Convincing leadership
- 41:33Q&A security superheroes
related talks
01h 29mAPI Vulnerabilities and What to Do About Them
30mDon’t Worry, Be API: Addressing AppSec’s Newest Challenge
31mOWASP API Security Project
27mAddressing OWASP API Security Top 10 starts at design time
51mHarmonizing the OWASP API and Application Top 10 Lists
25mOWASP Top 10 for APIs
35mSecuring Your API: The OWASP Top 10
26mOffensive API Penetration Testing