apidays LIVE India 2022 - The Future of API’s Security.pptx

•Download as PPTX, PDF•

0 likes•193 views

This document summarizes Vandana Verma Sehgal's upcoming API conference schedule and background. The conferences will take place in various global cities between March and December 2022, both virtually and in-hybrid format. Sehgal is a cybersecurity leader who focuses on inclusion and empowering developers to build secure applications. Her work involves highlighting security risks like API breaches and the role of developers in incidents. She advocates shifting security left in the development process.

Technology

The Future of API’s
Vandana Verma Sehgal

2022 SERIES OF EVENTS
New York
JULY
(HYBRID)
Australia
SEPTEMBER
(HYBRID)
Singapore
APRIL
(VIRTUAL)
Helsinki & North
MARCH
(VIRTUAL)
Paris
DECEMBER
(HYBRID)
London
OCTOBER
(HYBRID)
Hong Kong
AUGUST
(VIRTUAL)
JUNE (VIRTUAL)
India
MAY
(VIRTUAL)
APRIL (VIRTUAL)
Dubai & Middle East
JUNE
(VIRTUAL)
Check out our API Conferences
www.apidays.global
Want to talk at one of our conferences?
apidays.typeform.com/to/ILJeAaV8

Vandana Verma Sehgal
● Security Relations Leader - Snyk
● OWASP Global Board of Directors – Chair
● President of InfosecGirls, InfosecKids and InfosecDiversity
● Award-winning Cybersecurity Professional
● Keynote Speaker, Inclusion Advocate
● Member of Review Board at Grace Hopper, BSides Conferences,
• Global AppSec, etc.
About Me

How developers play a role in security
incidents
What does the software supply chain
landscape looks like today
You care about Software Security

Developers as a
Malware Distribution Vehicle

The event-stream incident
source: http://bit.ly/es-incident

How API Based Apps are Different?
● The server is used more as a proxy for data
● The rendering component is the client, not the server
● Clients consume raw data
● APIs expose the underlying implementation of the app
● The user’s state is usually maintained and monitored by the client
● More parameters are sent in each HTTP request (object ID’s, filters)

API1:2019 Broken Object Level Authorization
API2:2019 Broken User Authentication
API3:2019 Excessive Data Exposure
API4:2019 Lack of Resources & Rate Limiting
API5:2019 Broken Function Level Authorization
API6:2019 Mass Assignment
API7:2019 Security Misconfiguration
API8:2019 Injection
API9:2019 Improper Assets Management
API10:2019 Insufficient Logging & Monitoring
API Security Top 10 2019

How API Based Apps are Different?
Traditional vulnerabilities are less common in API-Based apps:
•SQLi – Increasing use of ORMs
•CSRF – Authorization headers instead of cookies
•Path Manipulations – Cloud-Based storage
•Classic IT Security Issues - SaaS

API Security Checklist
• Apply Multi-factor Authentication
• Encrypt Your Data
• Right authorizations for the API’s
•Just In-time access

“Shift Left” is
not enough
Empowering developers to build
applications securely within the entire
development process
Empower
developers
Enable
security
team

The OWASP Community
• OWASP is a worldwide free and
open community focused on
improving the security of
application software.
• Our mission is to make
application security visible so
that people and organisations
can make informed decisions
about application security risks. Session at Global AppSec Amsterdam

apidays LIVE India 2022: Accelerating India’s digitisation with APIs May 11 & 12, 2022 Offensive API Penetration Testing Sunny Singh, Lead Security Engineer at Calibo ------------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/ Deep dive into the API industry with our reports: https://www.apidays.global/industry-reports/ Subscribe to our global newsletter: https://apidays.typeform.com/to/i1MPEW

INTERFACE, by apidays - 7 steps to select the right standard to design your A...

apidays

INTERFACE, by apidays - APIs: the next 10 years June 8, 9 & 10 2022 7 steps to select the right standard to Design your API ! Patrick Brosse, Senior Expert : API & Data modeling Design at Amadeus ------------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/ Deep dive into the API industry with our reports: https://www.apidays.global/industry-reports/ Subscribe to our global newsletter: https://apidays.typeform.com/to/i1MPEW

apidays LIVE London 2021 - Application to API Security, drivers to the Shift ...

apidays

2022 APIsecure_From Shift Left to Full Circle - A Pragmatic Approach to Catch...

APIsecure_ Official

INTERFACE, by apidays - API Discovery: First step towards API Security

apidays

INTERFACE, by apidays - APIs: the next 10 years June 8, 9 & 10 2022 Automatically discover and improve API security posture with Traceable's API Catalog Sudeep Padiyar, Founding Member, Product Management at Traceable AI ------------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/ Deep dive into the API industry with our reports: https://www.apidays.global/industry-reports/ Subscribe to our global newsletter: https://apidays.typeform.com/to/i1MPEW

INTERFACE, by apidays - Driving the business via APIs.pptx

apidays

INTERFACE, by apidays - APIs: the next 10 years June 8, 9 & 10 2022 Driving the business through secure APIs Gil Shulman, VP Product at Wib ------------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/ Deep dive into the API industry with our reports: https://www.apidays.global/industry-reports/ Subscribe to our global newsletter: https://apidays.typeform.com/to/i1MPEW

2022 apidays LIVE Helsinki & North_Why webhook APIs are REST APIs perfect sid...

apidays

On the shoulders of giants Learning About API Design by Looking Backwards

CA API Management

Apidays Paris 2023 - Software and APIs for Smart, Sustainable and Sovereign Societies December 6, 7 & 8, 2023 API Observability: Improving Governance, Security and Operations Jose Haro Peralta, Founder, Author, Instructor at microapis.io ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

What Hackers Don’t Want You To Know: How to Maximize Your API Security

AaronLieberman5

With the number of APIs increasing constantly right along with the number of cyber attacks, API security has never been so important to success in an enterprise. This MuleSoft Meetup was a co-presentation from Big Compass and PingIntelligence by Ping Identity. We looked at how API security works with MuleSoft including the API development lifecycle and implementing security policies on a live API from Anypoint Platform API Manager. We also displayed the monitoring capabilities from API Manager and what a policy violation might look like. Then, we had some fun by simulating hacks on our own API. We simulated some common attacks and how API Manager and/or a WAF can block these common attacks. From there, we dove even deeper by simulating very advanced attacks like OAuth token hijacking, data theft, and DoS attacks that fly under the SLA radar. This is where we implemented PingIntelligence’s Anypoint integration custom API policy, showed how a MuleSoft API can connect with PingIntelligence, and how PingIntelligence uses AI to discover and model normal behavior and learn about your APIs to prevent and report on advanced attacks and instruct Anypoint Platform to stop these requesters.

Checkmarx meetup API Security - API Security top 10 - Erez Yalon

Adar Weidman

The document summarizes API security topics presented by Erez Yalon at a Checkmarx Meetup event. Yalon discusses how API-based applications are different from traditional apps and deserve their own security focus. He outlines the OWASP API Security Project and the proposed API Security Top 10 risks, including broken object level authorization, excessive data exposure, lack of resources/rate limiting, and improper asset management. Yalon calls for community contributions to further develop the Top 10 and other API security resources.

apidays LIVE New York 2021 - API Security & AI by Deb Roy, Accenture

apidays

This document discusses the importance of API security and how AI can be used to augment API security. It notes that cyber threats are evolving quickly and becoming more sophisticated. API usage has increased access points for potential hackers. The document then outlines how the Accenture APIQ platform uses AI and machine learning for automated API assessment and security. It analyzes API configurations and behavior patterns to provide insights, detect anomalies, monitor APIs, and provide real-time remediation to protect digital assets.

apidays London 2023 - APIs: The Attack Surface That Connects Us All, Stefan M...

apidays

apidays London 2023 - APIs for Smarter Platforms and Business Processes September 13 & 14, 2023 APIs: The Attack Surface That Connects Us All Stefan Mardak Enterpise Security Architect, Principal at Akamai Technologies ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays Paris 2023 - Building an Inventory, Maria Teresa Pereira, KPMG Portugal

apidays

Apidays Paris 2023 - Software and APIs for Smart, Sustainable and Sovereign Societies December 6, 7 & 8, 2023 Building an Inventory: How to identify all the APIs hidden in plain sight? Maria Teresa Pereira, Senior IT Advisor / Pentester - Cybersecurity Services at KPMG Portugal ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

APIsecure 2023 - API First Hacking, Corey Ball, Author of Hacking APIs

apidays

APIsecure 2023 - The world's first and only API security conference March 14 & 15, 2023 Closing Keynote: API First Hacking Corey Ball, Chief Hacking Officer APIsec University| Author of Hacking APIs ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

apidays New York 2022 - Supercharge digital democracy with API first approach...

apidays

apidays New York 2022 - Beyond API Regulations for Finance, Insurance, and Healthcare July 27 & 28, 2022 Supercharge digital democracy with API first approach Luke Lipan, Sales Manager Americas at Gravitee IO ------------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/ Deep dive into the API industry with our reports: https://www.apidays.global/industry-reports/ Subscribe to our global newsletter: https://apidays.typeform.com/to/i1MPEW

Security as an Enabler for the Digital World - CISO Perspective

Apigee | Google Cloud

A successful API strategy requires a strong partnership between the business, IT, and security functions. Rather than as a hindrance, security increasingly is viewed as a business enabler, with CISOs and CSOs playing a critical role in implementing “guardrails” for safe, secure and compliant API services and security architectures free of unnecessary complexity. Ultimately, a secure API platform enables developers and DevOps to focus on innovation—by improving the mobile user experience and deploying apps in the cloud, with appropriate security controls built-in. In this webcast, Apigee’s Subra Kumaraswamy and Saba Software CSO Randy Barr will explore how CISOs and CSOs partner with IT and business leaders for a safe and secure journey to cloud, SaaS, and mobile services. Join to learn about: - The role of the security officer in helping IT and business meet objectives - How smart and secure API guardrails remove friction in consuming APIs while protecting sensitive data exposed via APIs. - Best practices that work for an API centric enterprise Download podcast: http://bit.ly/1B6h3TR

Adapt or Die Sydney - API Security

Apigee | Google Cloud

INTERFACE, by apidays - Securing PII

apidays

This document discusses strategies for discovering and securing personally identifiable information (PII) at runtime. It outlines some common anti-patterns for PII security like assuming no PII exists or that all data is PII. The document then provides strategies like enforcing narrow permissions, automatically expiring data, monitoring PII transfers, and virtualizing access to data through query layers. It describes how the Resurface platform can be used for API monitoring and detecting PII leaks in real-time. Finally, it discusses using Trino for distributed queries across data sources and Resurface for the API system of record, with views applying retroactive access controls without changing databases.

[WSO2 Integration Summit San Francisco 2019] Protecting API Infrastructures —...

WSO2

What do Google, Facebook, Paypal, IRS, T-mobile, and USPS have in common? Answer -- hackers used their APIs to access sensitive customer information. Although these API attacks were exposed, most API-based attacks go undetected these days. This deck will discuss today’s evolving API threat landscape and explore what you can do to both detect and block cyberattacks from authenticated users and hackers who have reverse engineered your API with an integrated solution from WSO2 and PingIntelligence.

Intro to Azure Api Management - With Cats

Xamariners

This document provides an introduction to API management. It defines an API as a set of requirements that enables one application to communicate with another. A Web API is specified as using HTTP/HTTPS, being RESTful, and using JSON or XML. API management platforms provide services like authentication, analytics, policy enforcement, and developer engagement. They allow organizations to publish and manage APIs to external developers. The document discusses how APIs have enabled companies like Uber and Airbnb to build large businesses without direct ownership of core assets. It presents Azure API Management as an example of an API management platform and demonstrates its capabilities like provisioning, analytics, testing, policies, and security features.

Mining API Traffic Metadata

Nordic APIs

Layered API Security: What Hackers Don't Want You To Know

AaronLieberman5

What do Google, Facebook, Paypal, IRS, and USPS have in common? The answer is hackers exploited their APIs to access sensitive customer information. Although these API attacks were detected and exposed, most API-based attacks go undetected in today's technologically sophisticated world – particularly attacks that come from authenticated sources. With the number of APIs increasing constantly right along with the number of API attacks, API security has never been so important to an organization's success. YOU MUST REGISTER HERE TO GET THE CONFERENCE LINK: https://bigcompass.typeform.com/to/emg9DO Ping Identity and Azure have partnered together with a market-leading solution to tackle the complexities and nuances of protecting API infrastructures and the digital assets that they connect. This session will discuss today’s API threat landscape and explore what you can do to both detect and block advanced attacks on APIs. The presentation will first dive into the API development lifecycle using a live API built with Azure. We will look at some common monitoring capabilities on the Azure API and what a security violation would look like. Then, we will have some fun by simulating attacks on our own API. In this phase of the presentation, we will simulate some basic attacks and show how security policies or a web application firewall can block these common attacks. From there, we will dive even deeper by simulating more advanced attacks from authenticated users (data theft and API takeover), hackers who have reverse engineered an API, and layer 7 DoS attacks that fly under the SLA radar. This is where we will showcase PingIntelligence’s advanced capabilities by showing how a Azure API (or any other API) can connect with PingIntelligence to detect and prevent sophisticated attacks. This will allow the audience to see how the PingIntelligence software uses AI to discover and model normal behavior on an API to block and report on advanced attacks.

apidays LIVE Paris 2021 - Addressing OWASP API Security Top 10 by Isabelle Ma...

apidays

API breaches are increasing, with over 350 reported publicly since October 2018. The top causes are lack of input validation, rate limiting, data/exception leakage, and authorization and authentication issues. These map to the OWASP API Security Top 10 risks. API-centric architectures expand the attack surface. To address this, security needs to be considered at design time through the API contract, which defines data constraints, authorization policies, logging, and rate limiting. Following best practices like this helps avoid vulnerabilities that are costly to fix later.

APIs: The New Security Layer

Apigee | Google Cloud

The document discusses API security fundamentals and how to effectively secure APIs. It notes that many past API breaches were due to a lack of authentication on APIs, no rate limiting of requests, and other basic security issues. It emphasizes that every system with a URI has an API and outlines steps like applying authentication, authorization, rate limiting, validating requests to prevent attacks. The document argues that APIs with well-defined contracts that specify URIs, input/output formats and authentication models are easier to securely implement and test compared to more complex, dynamic APIs.

WEBINAR: OWASP API Security Top 10

42Crunch

WATCH WEBINAR: https://youtu.be/zTkv_9ChVPY In recent years, large reputable companies such as Facebook, Google and Equifax have suffered major data breaches that combined exposed the personal information of hundreds of millions of people worldwide. The common vector linking these breaches – APIs. The scale and magnitude of these breaches are the reason API security has been launched into the forefront of enterprise security concerns – now forcing us to rethink the way we approach API security as a whole. OWASP Top 10 project has for a long time been the standard list of top vulnerabilities to look for and mitigate in the world of web applications. APIs represent a significantly different set of threats, attack vectors, and security best practices. This caused the OWASP community to launch OWASP API Security project earlier this year. In this session we’ll discuss: What makes API Security different from web application security The OWASP API Security Top 10 Real world breaches and mitigation strategies for each of the risks

Best Practices You Must Apply to Secure Your APIs - Scott Morrison, SVP & Dis...

CA API Management

The document discusses best practices for securing APIs and identifies three key areas: parameterization, identity, and cryptography. It notes that APIs have a larger attack surface than traditional web apps due to more direct parameterization. It recommends rigorous input and output validation, schema validation, and constraining HTTP methods and URIs. For identity, it advises using real security tokens like OAuth instead of API keys alone. It also stresses the importance of proper cryptography, like using SSL everywhere and following best practices for key management and PKI. The overall message is that APIs require different security practices than traditional web apps.

WSO2Con Asia 2014 - Building the API-Centric Enterprise

WSO2

WSO2 helps businesses become API-centric by providing tools and infrastructure to support the entire API lifecycle from creation to management to hosting. The platform supports developing RESTful and SOAP APIs and hosting them scalably. It also offers an API management solution, tools for creating and testing APIs, and capabilities for collecting data from user interactions and performing analytics. WSO2 aims to make user interactions with apps and APIs as smooth as possible through features like single sign-on, app marketplaces, and support for hybrid cloud deployments.

Apidays Helsinki 2024 - Sustainable IT and API Performance - How to Bring The...

apidays

Sustainable IT and API Performance - How to Bring Them Together Merja Kajava, Founder - Aavista Oy Apidays Helsinki & North 2024 - Connecting Physical and Digital: Sustainable APIs for the Era of AI, Super and Quantum Computing (May 28 and 29, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays Helsinki 2024 - APIs ahoy, the case of Customer Booking APIs in Finn...

apidays

Keynote 1: APIs ahoy, the case of Customer Booking APIs in Finnlines and Grimaldi Lines, ShortSea Vesa Vähämaa, Head of Group IT, Software at Finnlines Plc Apidays Helsinki & North 2024 - Connecting Physical and Digital: Sustainable APIs for the Era of AI, Super and Quantum Computing (May 28 and 29, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Similar to apidays LIVE India 2022 - The Future of API’s Security.pptx

Apidays Paris 2023 - API Observability: Improving Governance, Security and Op...

apidays

What Hackers Don’t Want You To Know: How to Maximize Your API Security

AaronLieberman5

Checkmarx meetup API Security - API Security top 10 - Erez Yalon

Adar Weidman

apidays LIVE New York 2021 - API Security & AI by Deb Roy, Accenture

apidays

apidays London 2023 - APIs: The Attack Surface That Connects Us All, Stefan M...

apidays

Apidays Paris 2023 - Building an Inventory, Maria Teresa Pereira, KPMG Portugal

apidays

APIsecure 2023 - API First Hacking, Corey Ball, Author of Hacking APIs

apidays

apidays New York 2022 - Supercharge digital democracy with API first approach...

apidays

Security as an Enabler for the Digital World - CISO Perspective

Apigee | Google Cloud

Adapt or Die Sydney - API Security

Apigee | Google Cloud

INTERFACE, by apidays - Securing PII

apidays

[WSO2 Integration Summit San Francisco 2019] Protecting API Infrastructures —...

WSO2

Intro to Azure Api Management - With Cats

Xamariners

Mining API Traffic Metadata

Nordic APIs

Layered API Security: What Hackers Don't Want You To Know

AaronLieberman5

apidays LIVE Paris 2021 - Addressing OWASP API Security Top 10 by Isabelle Ma...

apidays

APIs: The New Security Layer

Apigee | Google Cloud

WEBINAR: OWASP API Security Top 10

42Crunch

Best Practices You Must Apply to Secure Your APIs - Scott Morrison, SVP & Dis...

CA API Management

WSO2Con Asia 2014 - Building the API-Centric Enterprise

WSO2

Similar to apidays LIVE India 2022 - The Future of API’s Security.pptx (20)