Apisecure, 14 & 15 March 2023 - Megan Bell, CISO Contra Costa Health Services.
summary
Argues for incremental, repeatable security: use encryption as safe harbor, API gateways, tokens, Swagger validation, Docker golden images, dependency scanners, pen tests and bug bounties to reduce tech debt. Calls out common failures — excessive developer permissions, misconfiguration, and ungoverned data copies — and recommends at least an annual access review with real‑time checks for high‑risk users, plus threat‑forward monitoring. Emphasizes build vs buy decisions, automate monitoring but “automate doesn’t mean forget,” and prioritize small daily improvements.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 3:19Structured security forward
- 8:42API security oversights
- 15:24Cost of lean security
- 22:04Security mindset lessons
- 28:02Design quality governance
- 36:27Data purpose security
- 41:03Security as safety
- 46:24Security patterns responsibility
- 49:13Q&A permissions AI
- 57:01Business resistance security
related talks
29mAPI Security in 2017
45mSecurity Architecture, An Adventure?
24mAPI Security in DevSecOps: Built-In, Not Bolted On
51mSecurity & Privacy in Digital First Businesses (Panel)
10mBe Agile with Security
48mAPI Security for Enterprises fireside chat
57mHow Do I Secure My Micro-Services?
27mSecurity: The Thing That Everyone...