API Strategy & Practice Conference 2018

Securing the Full API Stack (Patrick Chipman, Vanick Digital): APIs open up new channels for sharing and consuming data, but whenever you open a new channel, new security risks emerge. Additionally, APIs often involve a variety of new components, such as API gateways, in-memory databases, edge caches, facade layers, and microservice-aligned data stores that can complicate the security landscape. How and where do you apply the right controls to ensure your API and your data are secure? In this session, we'll answer that question by identifying the different components commonly used in the delivery of API products. For each layer, we'll discuss the security risks that can and should be mitigated there, along with best practice approaches (including ABAC, OAuth2, and more) to implement those mitigations.