Apisecure, 14 & 15 March 2023 - Brian Joe, Co-Founder, Product at Impart Security.
summary
Claims that APIs drive 83% of internet traffic and enterprises run >15,000 APIs lead to a combined approach: full runtime protection that inspects inbound and outbound traffic, inspectors in service mesh that profile East‑West calls and auto‑generate specs, and dynamic schema thresholds that allow e.g. 10% nonconforming traffic to enable a positive security model over time. A reinforcement‑learning loop connects runtime context with developer tooling, and a programmable penalty boxes rule language enforces flexible responses (rate limit, redirect, quarantine) in production.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 0:46API security challenges overview
- 2:32Gate-based security approach
- 5:41Limitations of developer guardrails
- 7:05Why appsec assumptions fail for APIs
- 9:29Problems with WAFs or guardrails
- 12:20Gates and guardrails combined
- 13:43Three pillars for API security
- 16:34Spec learning for East-West APIs
- 19:24Schema validation thresholds
- 23:11Kubernetes security annotations
- 26:03Getting started with API security
- 29:56Measuring security success
- 30:17Q&A: Dynamic thresholding
- 34:26Q&A: Security vs timelines
- 37:37Q&A: False positives handling
- 39:24Q&A: Developer annotations
- 42:52Closing remarks
related talks
42mAPI Security: Code-to-Cloud Context for Complete Protection
31mAPI security
24mAPI Security in DevSecOps: Built-In, Not Bolted On
48mAPI Security for Enterprises fireside chat
24mAPI security, mitigate API abuses using machine learning
21mMonitoring the API Ecosystems at Global Scale
25mThe New API Vulnerability Frontier
19mAvoid These API Security Pitfalls: Expert Insights