API SECURITY BEST PRACTICES 2022
In this episode of the Virtual Coffee with Ashish edition, we spoke with Corey Ball (Corey's Twitter) about what does API in a modern software stack looks like and how these can be attacked and protected Episode ShowNotes, Links and Transcript on Cloud Security Podcast: www.cloudsecuritypodcast.tv Host Twitter: Ashish Rajan (@hashishrajan) Guest Twitter: Corey Ball (Corey's Twitter) Podcast Twitter - @CloudSecPod @CloudSecureNews If you want to watch videos of this LIVE STREAMED episode and past episodes - Check out our other Cloud Security Social Channels: - Cloud Security News - Cloud Security Academy Spotify TimeStamp for Interview Questions (00:00) Ashish's Intro to the Episode (02:40) https://snyk.io/csp (02:51) Corey's professional background (03:11) Corey's journey to be cybersecurity author (04:36) What is API and why its important in 2022? (06:44) Is API is the backend or frontend pf applications? (08:36) What are people doing wrong with APIs? (12:16) Best Practice for API Security? (13:20) Most surprising things being seen in API Security? (14:35) How do you find API keys? (16:07) API gateway as a security control point (18:25) OWASP Top 10 API Security (20:00) Monitoring and detecting for API Security (20:57) How to approach pentesting APIs? (22:35) Learn about API hacking (25:22) API Security in the Cloud (29:05) Rest API vs GraphQL (34:27) Pentest by consuming application documentation (36:10) Which APIs should be public?