Chasing Shadows: Securing APIs in a Digital Economy
summary
Research finds API security awareness is surprisingly low across finance and fintech: an Aite Group study assesses 31 companies, finds only one has a designated API security contact, 26 do not test APIs specifically, 15 publish no API catalog and none provide no API-specific training. The ecosystem is large—estimates range to 100,000+ APIs and Akamai reports 83% of internet traffic tied to APIs. A case study shows deploying an AI-based traffic analysis sideband to an API gateway and forwarding alerts to Splunk reveals credential-stuffing, token abuse and hidden operational issues, and materially improves detection and response.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 2:40Initial research
- 5:08What are the threats
- 6:14What are the tools
- 9:09Uber Example
- 10:42Solutions
- 11:55Case Study
- 15:19Methodology
- 17:57No API Security Points of Contact
- 19:04Lack of API Visibility
- 20:35Lack of Controls
- 21:45Application Security Testing
- 22:52API Catalogs
- 24:12Training
- 25:30Methods
- 26:55Recommendations
related talks
20mFrom Chaos to Calm: Navigating Emerging API Security Challenges.
19mAvoid These API Security Pitfalls: Expert Insights
26mAPI and Application Security - The Future
15mDo not live in the Shadow (APIs)
58mA Risk based Approach to API Security
42mThe Secret Life of APIs: Latest Attack Data Shows What Your APIs Are Doing
31mWhy securing models without securing APIs creates a false sense of control
24mAPI security, mitigate API abuses using machine learning