Making Your APIs Resilient

Presentation Deck shared by Richard Meeus on 14th September for the media Palmer Sport track day

Transcript

1. Making Your APIs Resilient “it ain't about how hard you hit, it is about how hard you can get hit” Richard Meeus Director of Security Technology and Strategy Akamai
2. Everything needs a plan B
3. A Fragile Ecosystem https://xkcd.com/2347/
6. Traditional vs Modern Apps GET /dashboard.aspx Fetch messages/notifications/news Returns HTML view GET /api/v2/messages GET /api/v2/notifications GET /api/v2/news Returns RAW data Fetch messages/notifications/news User Service
7. OWASP API Top 10
8. API Risks Visibility | Lack of Understanding Risk Posture API Top 10 Data Classification Risk Score Internal API erroneously open to the internet Loyalty program PII in the clear Credit card numbers in the clear
9. API Challenges Today’s Focus Tomorrow’s Focus Vulnerable APIs Prevent OWASP Top 10 vulnerabilities and misconfigurations from hitting production. Shadow APIs Discover your complete API footprint - including rogue, legacy, admin, zombie, etc. API Abuse Stop business logic abuse such as data scraping or data exfiltration using behavioral analytics. Continuous API Discovery Risk Audit & Posture Alerts Behavioral Alerts Detection & Response
10. API Security Platform DATA LAKE API DISCOVERY & RISK AUDIT 1 BEHAVIORAL DETECTION 2 INVESTIGATE & THREAT HUNT 4 MANAGED THREAT HUNTING API SECURITY NODE CUSTOMER PREMISES API SECURITY ANALYTICS YOUR THREAT HUNTING TEAM AUTOMATED RESPONSE 3 or API activity data Response & prevention
11. Challenges Our Platform Solves Protect the Application Protect the User Protect the Infrastructure Protect the Consumer Web Page / API Attacks API Attacks Bots Infrastructure / DNS DDoS Extortion Javascript Attacks / Client-side Hijacking (Magecart) Employee Access Attacks Ransomware Web interaction infections Services Training Compliance Intelligence Innovation Protect the Marketing Brand Domain Squatting / Brand Impersonation Browser Hijacking (plug-ins) Fraud / ATO PII exfiltration
12. Richard Meeus Akamai - Director of Security Technology and Strategy @rmeeus www.linkedin.com/in/richard-meeus