API World 2023

Francois Lascelles, Broadcom, Distinguished Engineer

Who is ultimately responsible for the security of an API? It turns out many stakeholders have to get it right. Long gone are the days when API security was about network perimeters and WAF. Today’s applications extend across clouds, the APIs that power them are secured using zero trust principles enabled by a distributed API infrastructure mesh.

This presentation will share lessons learned and best practices for strong API security in today’s cloud-native applications from multiple perspectives:

Identity security
Strong API authentication, phishing-proof subject confirmation, distributed enforcement of centrally-governed authorization rules
Input sanitization
Decode, enforce, and validate patterns from modern API standards such as GraphQL
Observability and AI
The right API activity data, producing the right insights, for keeping up with the latest detection evasion techniques

Learn how the ancient practice of API Security is evolving to protect modern applications from increasingly sophisticated attackers.