Apisecure, 14 & 15 March 2023 - Jeremy Ventura, CISO at ThreatX.
summary
Claims that APIs power at least 50% of B2B traffic and that assessments find 8–10x more APIs than teams expect; attackers use low‑cost solver services (<$500) and multi‑vector campaigns combining micro‑DDoS, credential stuffing and reconnaissance. Examples: a retailer saw periodic probes then surges of login failures and rebate fraud; a game studio endured botnet ATOs after dev APIs were probed. Defenses that worked: reverse‑proxy WAF plus a managed SOC using TLS/IP fingerprinting, tarpit/rate‑limits, behavioral risk‑scoring and real‑time blocking to correlate attackers and cut false positives.
AI-written summary · about
chapters (23)
- 0:00API security talk welcome
- 1:06Speaker background
- 2:31Focus on real-time API protection
- 6:04APIs prime attack targets
- 9:13API security visibility challenges
- 12:43API breaches happening globally
- 13:28Attackers evolving with solver services
- 15:54Beyond OWASP Top 10
- 16:56Rogue and zombie APIs problem
- 18:43Multi-vector API attacks
- 22:53Bot attacks on APIs growing
- 24:37ThreatX case study: Retailer under siege
- 29:48Correlating attack data for blocking
- 30:09ThreatX case study: Video game attack
- 33:40Risk scoring and attacker profiling
- 37:08Shift left vs shift right
- 40:34Key API security capabilities
- 43:21Q&A: Automated tools and pen testing
- 46:32Q&A: Training analysts and alert fatigue
- 50:00Q&A: API incident response playbooks
- 53:10Q&A: Developer engagement
- 56:20Q&A: Learning API security
- 59:29Q&A: Speaker contact
related talks
31mAPI security
20mFrom Chaos to Calm: Navigating Emerging API Security Challenges.
24mSecurity in 2023 and Beyond: Automation, Analytics and Architecture
42mThe Secret Life of APIs: Latest Attack Data Shows What Your APIs Are Doing
25mThe New API Vulnerability Frontier
19mAvoid These API Security Pitfalls: Expert Insights
42mAPI Security: Code-to-Cloud Context for Complete Protection
51mThe Next Application Security Frontier: AI-Ready API Defense