Security Architecture, An Adventure?
summary
Describes a practical plan: create a custom security architecture framework aligned to business goals, enforce a standard Q&A assessment sent to every vendor and project, and apply shift left assessments as a preventative control. Insist on API hygiene: inventory APIs (ideally API inventory automation), require token expiry and refresh-token policies, and mandate immutable, centralized logs (log analytics workspaces, not public S3). Calls out real failures — unauthenticated APIs leaking ~400,000 phone numbers and 100 malicious models on Hugging Face — and recommends OAS, NIST/ISO, MITRE MRE and APISEC University guidance.
AI-written summary · about
chapters (12)
- 0:00Introduction and speaker intro
- 1:28Security architecture adventure overview
- 4:57Defining security architecture
- 9:11Core concepts in security architecture
- 11:18Starting with security architecture practice
- 14:54Building a security architecture framework
- 17:19Security architecture assessment basics
- 22:15API security in assessments
- 28:39AI security risks and controls
- 35:28AI in security assessments
- 36:30Actionable advice and summary
- 37:34Q&A session
related talks
43mSecurity By Design
32mThe Art of Secure Architecture
18mAPI Security Simplified: A 5-Pillar Approach
33mWhy Developers Struggle with API Security
24mAPI Security in DevSecOps: Built-In, Not Bolted On
17mAPI Security Simplified: Practical Tips & Tools
08mAPI Security Risks
24mMastering API Security: From Design to Deployment