API SECURITY BEST PRACTICES 2022
Episode description
In this episode of the Virtual Coffee with Ashish edition, we spoke with Corey Ball (Corey's Twitter) about what does API in a modern software stack looks like and how these can be attacked and protected
Episode ShowNotes, Links and Transcript on Cloud Security Podcast: www.cloudsecuritypodcast.tv
Host Twitter: Ashish Rajan (@hashishrajan)
Guest Twitter: Corey Ball (Corey's Twitter)
Podcast Twitter - @CloudSecPod @CloudSecureNews
If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels:
Spotify TimeStamp for Interview Questions
(00:00) Ashish's Intro to the Episode
(02:40) https://snyk.io/csp
(02:51) Corey's professional background
(03:11) Corey's journey to be cybersecurity author
(04:36) What is API and why its important in 2022?
(06:44) Is API is the backend or frontend pf applications?
(08:36) What are people doing wrong with APIs?
(12:16) Best Practice for API Security?
(13:20) Most surprising things being seen in API Security?
(14:35) How do you find API keys?
(16:07) API gateway as a security control point
(18:25) OWASP Top 10 API Security
(20:00) Monitoring and detecting for API Security
(20:57) How to approach pentesting APIs?
(22:35) Learn about API hacking
(25:22) API Security in the Cloud
(29:05) Rest API vs GraphQL
(34:27) Pentest by consuming application documentation
(36:10) Which APIs should be public?