Downloaded 10 times
Uploaded byNordic APIs
Applying API Security at Scale
Isabelle Mauny, the Chief Product Officer and co-founder of 42Crunch, addresses concerns about recent API breaches and emphasizes the importance of integrating security early in application development. She advocates for adopting a 'shift left' approach, teaching API security across teams, and automating security measures. The document also provides resources and best practices for effective API security management.
More Related Content
Similar to Applying API Security at Scale
![20260201 [FOSDEM] gomodjail - library sandboxing for Go modules.pdf](https://cdn.slidesharecdn.com/ss_thumbnails/20260201fosdemgomodjail-librarysandboxingforgomodules-260201225659-76609ec4-thumbnail.jpg?width=640&height=640&fit=bounds)
![谷歌留痕技术教程[ 𝙩𝙤𝙥 𝟮𝟯𝟯. 𝙘 𝙤𝙢 ]](https://cdn.slidesharecdn.com/ss_thumbnails/top233-260130173900-2eb784f9-thumbnail.jpg?width=640&height=640&fit=bounds)
Applying API Security at Scale
- 1. ISABELLE MAUNY -CHIEF PRODUCT OFFICER & CO-FOUNDER ISABELLE@42CRUNCH.COM APPLYING API SECURITY AT SCALE
- 2. 2 API BREACHES REPORTED THISJUNE ON APISECURITY.IO
- 3.
- 4.
- 5. TITLE TEXTDIGITAL TRANSFORMATIONMADNESS…. 5 APPLICATION DEVELOPMENT APPLICATION SECURITY
- 6. HOW DO WE ADDRESSTHE ISSUE? 6
- 7. CONSIDER SECURITY EARLY:SHIFT LEFT ! 7 DeploymentTestingDevelopmentRequirements Design 1 10 100 1000 Vulnerability Fixing Cost:
- 8.
- 9.
- 10. ONE SIZE DOESNOT FIT ALL KNOW YOUR APIS AND THE RISKS THEY BRING 10See: https://www.owasp.org/index.php/Application_Threat_Modeling
- 11. IMPLEMENTATION PRINCIPLES 11 ZERO TRUST DON’T RE-INVENTTHE WHEEL PROTECT SENSITIVE DATA SECURE ERROR HANDLING SECURE LOGGING 2
- 12. The one thingthat you should always remember when coding defensively is that you need to assume that users will do something that you did not plan on. 12
- 13. IMPLEMENT SELF-HACKING 13 Automatic analysis first! Code/Libraries/Dockerimages/ Transport settings Test the Hacky path ! Then manual Bug bounty, Pen testing 3
- 14. 14 DEPLOYMENT PRINCIPLES 4 Front Process Data DEFENSEIN DEPTH - SECURITY ZONES - LEAST PRIVILEGE PRINCIPLES
- 15. •Vulnerabilities are bugs:use development ticketing system to track issues •Analyse runtime behaviour and raise alerts automatically 15 YOU CAN’T FIX WHAT YOU DON’T KNOW 5
- 16. ➤ INTRODUCE APISECURITY EARLY ON ➤ TEACH API SECURITY ACROSS DEV/SEC/OPS TEAMS ➤ AUTOMATE API SECURITY ➤ MONITOR AND LEARN 16 CALL TO ACTION
- 17. NEWS AND TOOLSFOR BETTER API SECURITY
- 18. RESOURCES OWASP Top 10for applications ✓ https://www.owasp.org/index.php/Category:OWASP_Top_Ten_2017_Project OWASP DevSlop Project ✓ https://www.owasp.org/index.php/OWASP_DevSlop_Project Chaos Engineering ✓ http://principlesofchaos.org ✓ https://github.com/dastergon/awesome-chaos-engineering OWASP ZAP ✓ https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project Source Code Analysis ✓ https://www.owasp.org/index.php/Source_Code_Analysis_Tools Code Security reviews ✓ https://www.owasp.org/index.php/Code_Review_Introduction Systems Scans ✓ https://www.owasp.org/index.php/Category:Vulnerability_Scanning_Tools Security Methodology ✓ https://developer.rackspace.com/blog/fanatical-security-delivered-by-quality-engineering-security-team/ 18
- 19. RESOURCES SSL Setup Scan ✓https://hardenize.com ✓ https://securityheaders.io ✓ https://www.ssllabs.com/ssltest/ Threat Modelling ✓ https://www.owasp.org/index.php/Application_Threat_Modeling Attacks Type Information ✓ XSS: https://excess-xss.com ✓ Buffer Overflow: https://www.youtube.com/watch?v=1S0aBV-Waeo ✓ SQL injection: https://www.youtube.com/watch?v=ciNHn38EyRc ✓ Cookie stealing /XSS: https://www.youtube.com/watch?v=T1QEs3mdJoc Pixi / DevSlop ✓ https://github.com/DevSlop/Pixi ✓ https://devslop.co JWT as session data ✓ https://dzone.com/articles/stop-using-jwts-as-session-tokens 19