Apisecure, 14 & 15 March 2023 - Inon Shkedy, Co-Author of OWASP API Security Top 10.
summary
OWASP API Security Top 10 publishes a 2023 release candidate built from HackerOne and industry reports plus expert interviews and asks for community feedback before finalizing. Changes: injection and insufficient logging drop from the list; broken object property level authorization now merges mass assignment and excessive data exposure; new entries include SSRF, lack of automated threat protection (bots/scalping), unrestricted resource consumption and unsafe consumption of third‑party APIs. Concrete attack examples: changing reservation IDs or prices, SSRF fetching cloud metadata, bots buying out stock; mitigations: rate limits, IP/device restrictions, captchas and in‑code authorization checks.
AI-written summary · about
chapters (15)
- 0:00API Security Top 10 intro
- 1:08Speaker intro and session
- 3:38OWASP and API Security Top 10
- 6:08Why API Security needs Top 10
- 9:16Traditional vs modern APIs
- 13:31API changes impact security
- 17:182023 Top 10 updates
- 18:43Authorization vulnerabilities
- 25:50Resource consumption risks
- 26:32Automated threat protection
- 33:17Server-side request forgery
- 36:07Shadow APIs and blind spots
- 42:13Unsafe consumption of third-party APIs
- 43:18GraphQL & WebSockets security
- 43:59Q&A
related talks
31mOWASP API Security Project
51mHarmonizing the OWASP API and Application Top 10 Lists
01h 29mAPI Vulnerabilities and What to Do About Them
01h 00mWeb Application Security Risks: A Look at OWASP Top Ten 2017
30mDon’t Worry, Be API: Addressing AppSec’s Newest Challenge
26mOffensive API Penetration Testing
25mOWASP Top 10 for APIs
30mDon’t Worry, Be API Addressing AppSec’s Modern Challenge