Addressing Compliance Concerns in Your API Security Strategy with Phil Horning скачать в хорошем качестве

Addressing Compliance Concerns in Your API Security Strategy with Phil Horning

Welcome to today's session on "Addressing Compliance Concerns in Your API Security Strategy." I'm Phil Horning is an Enterprise Security Architect at Aamay, specializing in abuse and fraud as well as API security. With extensive experience as both an external and internal auditor, he's here to guide you through the intricate world of compliance in API security. 🔒 Key Discussion Points: -The increasing targeting of APIs and the shift in compliance requirements to mitigate these threats. -Essential questions to evaluate your API environment and compliance status. -Strategies to simplify your API compliance approach. 📊 Highlights: -Over a third of web-based attacks now target APIs. -Common API vulnerabilities such as HTTP-based attacks, session abuse, and SQL injections. -The importance of accurate API inventory and the challenges many organizations face in maintaining it. -Real-world examples of API abuse and the critical need for robust API security measures. -Key compliance initiatives including PCI DSS, GDPR, HIPAA, and emerging standards in open banking. 📋 Top 10 Compliance Questions: -What data do we have? -Whose data is it? -Where is the data stored and transmitted? -How accurate is our API inventory? -Are we checking for shadow and zombie APIs? -What are our API vulnerabilities? -Are our APIs documented and following best practices? -Are we testing APIs before deployment? -Can we detect API abuse? -How do we respond and recover from API attacks? 🔧 Simplifying Your Strategy: -Continuous discovery and inventory of APIs. -Development and governance best practices. -Regular compliance reviews and audits. -Ensuring third-party integrations are secure. Timestamps: 0:00 - Introduction 1:00 - Increasing Targeting of APIs 2:00 - Common API Vulnerabilities 3:00 - Real-world Examples of API Abuse 4:00 - Key Compliance Initiatives 5:00 - Top 10 Compliance Questions 6:00 - Simplifying Your API Compliance Strategy 7:00 - Q&A Session