Apisecure, 14 & 15 March 2023 - Giora Engel, CEO at NeosecDiscovery.
summary
Claims that API counts have exploded — roughly 10x more APIs than legacy apps — and that common controls miss most of them: WAFs and gateways don’t see east‑west or non‑gateway endpoints. EMA research shows less than half documented APIs for many orgs and ~25% have no visibility into sensitive data. Real incidents include an unauthenticated loyalty scrape, sensitive data in URLs, long automated gaming sessions and geolocation spoofing. Proposed solution is continuous discovery and behavioral detection feeding posture, risk audit, response and investigation.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 1:09API Discovery first step
- 2:34The explosion of APIs in modern architectures
- 5:21API discovery misconceptions
- 7:25WAF, gateways and API security roles
- 10:39Key API security capabilities
- 12:52Shadow APIs and asset inventory
- 13:35Finding vulnerable APIs
- 14:57Continuous monitoring for abuse
- 17:27Real API security incidents
- 19:58Business logic abuse
- 25:14Abuse case analysis framework
- 28:28Investigation and threat hunting
- 30:14API security maturity model
- 37:23Neosec platform for API security
- 39:28Q&A
related talks
19mAvoid These API Security Pitfalls: Expert Insights
48mAPI Security for Enterprises fireside chat
42mThe Secret Life of APIs: Latest Attack Data Shows What Your APIs Are Doing
24mAPI security, mitigate API abuses using machine learning
25mThe New API Vulnerability Frontier
31mAPI security
42mAPI Security: Code-to-Cloud Context for Complete Protection
21mMonitoring the API Ecosystems at Global Scale