Apisecure, 14 & 15 March 2023 - Shannon Wilkinson, Cybersecurity Founder | Women in Technology [...]
summary
APIs enable fast credential stuffing attacks and bot-driven buying (example: PlayStation scalpers), so defenses start with inventory, SBOMs and baselines of normal traffic (expect ~1–5% error rates). Detect anomalies by traffic spikes, sustained unusual calls, repeated failed auths and extraordinary traveler login patterns; enforce rate limits, schema validation, file scanning, WAF/EDR/AV and API-specific rules. Correlate API logs into a SIM or data lake with threat intelligence — historical median detection exceeds 200 days detection unless monitored. Prioritize by data sensitivity (PCI/HIPAA) and use DREAD/PASTA for threat modeling.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 0:46About speaker and Tego Cyber
- 1:30APIs as attack targets
- 3:17OWASP API Top 10 2019 vs 2023
- 5:02Common API threats
- 6:25Discovering and documenting APIs
- 7:49Normal API behavior
- 9:17Detecting API traffic anomalies
- 11:04API-specific security rules
- 13:32Developer API security duties
- 16:21Shared security model
- 18:29Logging and monitoring APIs
- 20:56Q&A threat modeling
- 24:52Detecting bad actors and botnets
- 26:15API threat detection tools
- 27:38API security maturity roadmap
- 28:20Low-and-slow APT attacks
- 30:50Closing thoughts
related talks
31mAPI security
42mThe Secret Life of APIs: Latest Attack Data Shows What Your APIs Are Doing
24mAPI security, mitigate API abuses using machine learning
20mFrom Chaos to Calm: Navigating Emerging API Security Challenges.
24mAPI Security in DevSecOps: Built-In, Not Bolted On
19mAvoid These API Security Pitfalls: Expert Insights
22mLayered Approach of API Security Strategies and its Business Impact
48mAPI Security for Enterprises fireside chat