Apisecure, 14 & 15 March 2023 - Meenakshi Kaushik, Leader - Product Management at Cisco.
summary
Claim: API security prevents many breaches but stops short of protecting cloud‑native stacks and the software supply chain. Concrete steps shown: scan OpenAPI specs in CI, run attack‑simulation in staging, discover and catalog live APIs to find hidden zombie APIs, identify sensitive JSON fields with ML, enforce deployment gates that combine API and workload findings, and correlate an API to the Kubernetes pod/service so policies and anomalies map to runtime assets. A demo stitches CI plugins, discovery, risk scoring and runtime anomaly detection into a single pipeline for enforcement and continuous monitoring, enabling shift left remediation.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 0:46API security alone isn't enough
- 2:54Cloud-native attack surface
- 3:59Software supply chain risks
- 5:02Shifting security left
- 6:07Layers of API security
- 8:16CI/CD security policies
- 10:45Beyond APIs to application layer
- 14:18Correlating app stack security
- 15:22Multi-layer security summary
related talks
24mAPI Security in DevSecOps: Built-In, Not Bolted On
48mAPI Security for Enterprises fireside chat
31mAPI security
24mAPI security, mitigate API abuses using machine learning
42mAPI Security: Code-to-Cloud Context for Complete Protection
45mAPI Security: Acting Now to Enable Security Controls
26mAPI Lifecycle Management
16mDo the Right thing, shift Left!