API IN(SECURITY)

•

1 j'aime•248 vues

What are APIs? Why are they important in our life? What can go wrong if they were mishandled? How can we make them more secure? Our Speaker Asim Jaweesh answers these questions in his presentation on API Insecurity.

Technologie

API IN(SECURITY)
Asim Jaweesh
Asim [dot] Jaweesh (at) owasp [dot] org

AGENDA and technical knowledge
History Rank Issues? defense resource Finish

BRIEF HISTORY
0
1
2
3
4
5
6
7
E-Commerce Social Mobile IoT
Time

IMPORTANCE
• Integration with other systems.
• Control of UI/UX.
• Cheap tweaks and change requests.
• Saving time and effort.

THINK LIKE A HACKER PROTECTOR
• Access control
• Input validation
• Output encoding
• Cryptography
• Message integrity
• confidentiality

ACCESS CONTROLS
• Anti-framing
• Protect HTTP methods
• Whitelist allowable methods
• Protect privileged actions.
• Protect against CSRF
• Protect against IDOR
• API rate limits

INPUT VALIDATION
• Input sanitization
• Secure parsing
• Strong typing
• Validate incoming content-type
• Validate response-type
• XML input validation
• Framework-Provided validation

OUTPUT ENCODING
• Send secure headers
• JSON encoding
• XML encoding

CRYPTOGRAPHY
• Data in transit
• Data in storage

MESSAGE INTEGRITY
• In addition to HTTPS, JSON Web Token (JWT)
• JWT guarantee message integrity and authenticate both
sender/ receiver

CONFIDENTIALITY
• RESTful web services can leak credentials, tokens and API keys
• https://example.com/resourceCollection/<id>/action
• https://Twitter.com/Jaweesh/lists
• https://example.com/controller/<id>/action?apikey=12345678
• http://example.com/controller/<id>/action?apikey=987654321

RESOURCES
• OWASP cheat sheet
• History of API
• Internet of things definition
• SmartBear Practical tips for API
security

RECAP
• API new business technology.
• Gaining popularity and trending.
• Can easily wreck your business.
• Good API helps your business.
• Integrate security in development.
• Do periodic security tests.
• Spread awareness.

THANK YOU
Asim [dot] Jaweesh (at) owasp [dot] org
@jaw33sh

Contenu connexe

Tendances

WSO2Con EU 2015: Securing, Monitoring and Monetizing APIs Businesses today are rapidly moving from being service enabled to being API enabled. Moving into the world of APIs brings together its own set of complexities and challenges that are tough to tackle. API security, performance, scalability, monitoring and notifications are key areas to be focusing your engineering efforts on. The WSO2 Carbon platform is a complete open source enterprise middleware platform which includes products catering to your various different enterprise needs. This talk will focus on leveraging the extensive feature set and extensible nature of the WSO2 platform to secure, monitor and monetize your APIs. It will also touch upon some of WSO2’s experiences with customers in building API ecosystems that suit modern day enterprises. Presenter: Nuwan Dias Technical Lead, WSO2

WSO2Con EU 2015: Securing, Monitoring and Monetizing APIs

WSO2

NYC Identity Summit Tech Day: ForgeRock DevOps/Cloud Strategy

ForgeRock

Pimping the ForgeRock Identity Platform for a Billion Users

ForgeRock

AWS Security

Vijayendra Bhati

Introduction to Web Security

Kamil Lelonek

OpenAM as Flexible Integration Component

ForgeRock

CIS14: PingAccess 101

CloudIDSummit

Secure API Services in Node with Basic Auth and OAuth2

Stormpath

OpenAM: An Introduction

ForgeRock

Save 10% off ANY FITC event with discount code 'slideshare' See our upcoming events at www.fitc.ca Yuri will discuss the challenges of authentication and authorization in the MEAN stack. Topics include architecture, best practices for determining client and server responsibilities, and the importance of sharing authorization context with the client logic in order to build an effective user experience. Angular and Node code samples will be used to illustrate. Presented live at FITC's Spotlight: MEAN Stack event held on March 28th, 2014 More info at FITC.ca

Authentication and Authorization Architecture in the MEAN Stack

FITC

Security components in mule esb

himajareddys

Presented by Ludovic Poitou, OpenDJ Product Manager, ForgeRock, Anders Askasen OpenIDM Product Manager, ForgeRock, and Victor Ake, OpenAM Product Manager and ForgeRock CoFounder, on June 13, 2013 at ForgeRock Open Identity Stack Summit Learn more about ForgeRock Access Management: https://www.forgerock.com/platform/access-management/ Learn more about ForgeRock Identity Management: https://www.forgerock.com/platform/identity-management/

Open Identity Stack Roadmap

ForgeRock

Adding layers of security to an API in real-time

Rogue Wave Software

SSO with the WSO2 Identity Server

WSO2

IDP Proxy Concept: Accessing Identity Data Sources Everywhere!

ForgeRock

The cloud is rapidly becoming the de-facto standard for deploying enterprise applications. Microservices are at the core of building cloud-native applications due to its proven advantages such as granularity, cloud-native deployment, and scalability. With the exponential growth of the consumer base of these service offerings, enforcing microservice/API security has become one of the biggest challenges to overcome. In this deck, we discuss: - The need for API/Microservices Security - The importance of delegating security enforcement to an API Gateway - API Authentication and Authorization methodologies - OAuth2 - The de-facto standard of API Authentication - Protection against cyber attacks and anomalies - Security aspects to consider when designing Single Page Applications (SPAs) Watch the webinar on-demand here - https://wso2.com/library/webinars/2019/11/api-security-in-a-cloud-native-era/

API Security In Cloud Native Era

WSO2

Privacy and Security

Vishal Chavan

Gateway/APIC security

Shiu-Fun Poon

Android secure coding

Blueinfy Solutions

Join Stormpath Developer Evangelist, Robert Damphousse, to dive deep into browser security. Robert will explain how Session IDs, Man in the Middle (MITM), Cross-Site Scripting (XSS), and Cross-Site Request Forgery (CSRF) attacks work, and how to use cookies to support security best practices. Topics Covered: - Security concerns for modern web apps - Cookies, the right way - MITM, XSS, and CSRF attacks - Session ID problems - Examples in an Angular app

Browser Security 101

Stormpath

Tendances (20)

WSO2Con EU 2015: Securing, Monitoring and Monetizing APIs

NYC Identity Summit Tech Day: ForgeRock DevOps/Cloud Strategy

Pimping the ForgeRock Identity Platform for a Billion Users

AWS Security

Introduction to Web Security

OpenAM as Flexible Integration Component

CIS14: PingAccess 101

Secure API Services in Node with Basic Auth and OAuth2

OpenAM: An Introduction

Authentication and Authorization Architecture in the MEAN Stack

Security components in mule esb

Open Identity Stack Roadmap

Adding layers of security to an API in real-time

SSO with the WSO2 Identity Server

IDP Proxy Concept: Accessing Identity Data Sources Everywhere!

API Security In Cloud Native Era

Privacy and Security

Gateway/APIC security

Android secure coding

Browser Security 101

Similaire à API IN(SECURITY)

APIsecure 2023 - Understanding and Identifying Threats Against APIs, Shannon ...

apidays

Here you can find the slides that accompany my “SPA Secure Coding Guide”, this presentation go through a set of security best practices specially targeted towards developing Angular applications with ASP.Net Web Api backends. It comes with a WebApi example project available on GitHub that provides several code examples of how to defend yourself. The example app is based on the famous "Tour of Heroes" Angular app used throughout the Angular documentation. It first introduce general threat modelling before explaining the most current type of attacks Asp.Net Web API are vulnerable to . It is designed to serve as a secure coding reference guide, to help development teams quickly understand Asp.Net Core secure coding practices.

Spa Secure Coding Guide

Geoffrey Vandiest

Threat protection and application access controls are key security mechanisms that protect APIs when exposed to internal or external users and developers. In this technical deep-dive webcast, Apigee's security team, led by Subra Kumaraswamy, will discuss API threats and the protection mechanisms that every API and app developer must implement for safe and secure API management. This webcast will cover: - the API threat model - how to design and implement appropriate guardrails for API security using build-in policies and configuration - a demo of Apigee Edge threat protection features, including TLS encryption, XML/JSON/SQL injection attacks, and rate limiting Whether you're an IT security architect or an API or app developer, this webcast will help you understand secure API management. Download Podcast: http://bit.ly/1biiJQS Watch Video: http://youtu.be/ffs35w1RYRI

Deep-Dive: Secure API Management

Apigee | Google Cloud

Web security and OWASP

Isuru Samaraweera

With the rise of micro-services, REST communication is more popular than ever. But the communication between the different parts must also be performed in a secure way. First, we need to know if the user or system is allowed to call the JAX-RS endpoint. For this authentication part, self-contained tokens are the best option to not overload any of our services in the system. JWT which contains the authentication but also can contain the authorization info is ideal for this use-case. And secondly, we need guarantees that the message isn't altered, that we can have message integrity. For that part, we can use signatures as specified in the HTTP signature draft specification.

Secure JAX-RS

Payara

Speech of Dmytro Shapovalov, Infrastructure Engineer at Cossack Labs, at Ruby Meditation #25 Kyiv 08.12.2018 Next conference - http://www.rubymeditation.com/ Making secure applications is not easy, especially when encryption tools are difficult and incomprehensible. We will talk about typical data security problems in web apps and how to implement encryption properly. We will review cryptographic approaches and exact tools that ensure that no sensitive data leaks from the application or database. Announcements and conference materials https://www.fb.me/RubyMeditation News https://twitter.com/RubyMeditation Photos https://www.instagram.com/RubyMeditation The stream of Ruby conferences (not just ours) https://t.me/RubyMeditation

Data encryption for Ruby web applications - Dmytro Shapovalov (RUS) | Ruby Me...

Ruby Meditation

APIs accelerate agility, empower developers, and enable innovative business strategies. But how do you ensure the security of your API architecture as you expose your corporate data to mobile apps, developers, and partners? Does your API security framework enable DevOps agility and a scalable security model for IT? Join Apigee’s Tim Mather and Subra Kumaraswamy as they discuss API security considerations for DevOps, CSOs, and security professionals. Learn about API security, threat protection, identity capabilities, infrastructure security, and compliance.

API Security from the DevOps and CSO Perspectives (Webcast)

Apigee | Google Cloud

What do Google, Facebook, Paypal, IRS, and USPS have in common? The answer is hackers exploited their APIs to access sensitive customer information. Although these API attacks were detected and exposed, most API-based attacks go undetected in today's technologically sophisticated world – particularly attacks that come from authenticated sources. With the number of APIs increasing constantly right along with the number of API attacks, API security has never been so important to an organization's success. YOU MUST REGISTER HERE TO GET THE CONFERENCE LINK: https://bigcompass.typeform.com/to/emg9DO Ping Identity and Azure have partnered together with a market-leading solution to tackle the complexities and nuances of protecting API infrastructures and the digital assets that they connect. This session will discuss today’s API threat landscape and explore what you can do to both detect and block advanced attacks on APIs. The presentation will first dive into the API development lifecycle using a live API built with Azure. We will look at some common monitoring capabilities on the Azure API and what a security violation would look like. Then, we will have some fun by simulating attacks on our own API. In this phase of the presentation, we will simulate some basic attacks and show how security policies or a web application firewall can block these common attacks. From there, we will dive even deeper by simulating more advanced attacks from authenticated users (data theft and API takeover), hackers who have reverse engineered an API, and layer 7 DoS attacks that fly under the SLA radar. This is where we will showcase PingIntelligence’s advanced capabilities by showing how a Azure API (or any other API) can connect with PingIntelligence to detect and prevent sophisticated attacks. This will allow the audience to see how the PingIntelligence software uses AI to discover and model normal behavior on an API to block and report on advanced attacks.

Layered API Security: What Hackers Don't Want You To Know

AaronLieberman5

APIConnect Security Best Practice

Shiu-Fun Poon

WebApp_to_Container_Security.pdf

Anna Pasupathy, CISSP

API's are everywhere now. SOA, IoT, Mobile, and Thick clients all heavily rely on web services and API's. This talk will present a primer on how to assess these services/interfaces for developers and testers alike. The introduction will include topics such as API identification, common implementations and frameworks. The bulk of the talk will focus on a assessment checklist that anyone can use to test these technologies for security flaws covering topics such as: Authentication Verbose-ness Hidden Functions Lack of Access Control Transport Security Tampering/Trust Injection

The API Primer (OWASP AppSec Europe, May 2015)

Greg Patton

APIsecure 2023 - The world's first and only API security conference March 14 & 15, 2023 API orchestration: to build resilient applications Cherish Santoshi, Sr. Developer Relations Engineer at Orkes ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

APIsecure 2023 - API orchestration: to build resilient applications, Cherish ...

apidays

Web Application Security session conducted by Lightracers Consulting for web developers. In this learning presentation, we will look at - What is Cyber Crime, Types of Cyber crime, What is Cyber Security, Types of Threats, Overview of OWASP, OWASP Top 10 Vulnerabilities (SQL Injection, Cross Site Scripting, Cross Site Request Forgery, Security Misconfiguration, Sensitive Data exposure, etc.) and Protection measures.

Web Application Security Session for Web Developers

Krishna Srikanth Manda

As organizations shift control of their infrastructure and data to the cloud, it is critical that they rethink their application security efforts. This can be accomplished by ensuring applications are designed to take advantage of built-in cloud security controls and configured properly in deployment. Attend this webcast to gain insight into the security nuances of the cloud platform and risk mitigation techniques. Topics include: • Common cloud threats and vulnerabilities • Exposing data with insufficient Authorization and Authentication • The danger of relying on untrusted components • Distributed Denial of Service (DDoS) and other application attacks • Securing APIs and other defensive measures

Securing Applications in the Cloud

Security Innovation

The presentation describes the basics of web applications and learning different ways to detect and analyse security issues related to the same. DVWA has been used as vulnerable web application to practice different critical vulnerabilities and hence, analysing and exploiting them. The training was conducted on 18th-19th Jan at Cummins College. https://www.meetup.com/WoSEC-India-Women-of-Security/events/267828816/?_xtd=gatlbWFpbF9jbGlja9oAJGRhYjRiZTA0LTI5NTUtNDAzNi1iNTU5LTEzYmEyODY1Yzk1Yg

Infosec girls training-hackcummins-college-jan-2020(v0.1)

Shrutirupa Banerjiee

OWASP - Open Web Applications Security Project to fundacja której celem jest eliminacja problemów bezpieczeństwa aplikacji. OWASP działa w duchu "open source" i dostarcza narzędzi, informacji i wiedzy pozwalających podnieść poziom bezpieczeństwa aplikacji. W trakcie wykładu przedstawię krótko OWASP Top 10 w wydaniu dla programistów, czyli "Top 10 Proactive Controls" a więc najważniejsze zalecenia pozwalające na uniknięcie kluczowych błędów bezpieczeństwa.

Ten Commandments of Secure Coding - OWASP Top Ten Proactive Controls

SecuRing

Ten Commandments of Secure Coding

Mateusz Olejarka

OWASP Top Ten 2017

Michael Furman

PaaS security challenges and solutions (salesforce vision)

Olga Lavrentieva

Consuming REST in .NET

Aaron Stannard

Similaire à API IN(SECURITY) (20)

APIsecure 2023 - Understanding and Identifying Threats Against APIs, Shannon ...

Spa Secure Coding Guide

Deep-Dive: Secure API Management

Web security and OWASP

Secure JAX-RS

Data encryption for Ruby web applications - Dmytro Shapovalov (RUS) | Ruby Me...

API Security from the DevOps and CSO Perspectives (Webcast)

Layered API Security: What Hackers Don't Want You To Know

APIConnect Security Best Practice

WebApp_to_Container_Security.pdf

The API Primer (OWASP AppSec Europe, May 2015)

APIsecure 2023 - API orchestration: to build resilient applications, Cherish ...

Web Application Security Session for Web Developers

Securing Applications in the Cloud

Infosec girls training-hackcummins-college-jan-2020(v0.1)

Ten Commandments of Secure Coding - OWASP Top Ten Proactive Controls

Ten Commandments of Secure Coding

OWASP Top Ten 2017

PaaS security challenges and solutions (salesforce vision)

Consuming REST in .NET

Plus de OWASP Khartoum

Cryptocurrency, a deep dive

OWASP Khartoum

Usable Security: Tips for Daily Life

OWASP Khartoum

SSH - From Zero to Hero

OWASP Khartoum

OWASP Khartoum Cyber Security Session

OWASP Khartoum

Computer forensic 101 - OWASP Khartoum

OWASP Khartoum

Welcome to OWASP World

OWASP Khartoum

Cross Site Scripting (XSS)

OWASP Khartoum

OWASP Khartoum - Top 10 A5 - 7th meeting - Cross Site Request Forgery

OWASP Khartoum

OWASP Khartoum Top 10 A3 - 6th meeting

OWASP Khartoum

OWASP Khartoum - Top 10 A6 - 8th meeting - Security Misconfiguration

OWASP Khartoum

OWASP Khartoum Top 10 A4 - 7th meeting

OWASP Khartoum

Plus de OWASP Khartoum (11)

Cryptocurrency, a deep dive

Usable Security: Tips for Daily Life

SSH - From Zero to Hero

OWASP Khartoum Cyber Security Session

Computer forensic 101 - OWASP Khartoum

Welcome to OWASP World

Cross Site Scripting (XSS)

OWASP Khartoum - Top 10 A5 - 7th meeting - Cross Site Request Forgery

OWASP Khartoum Top 10 A3 - 6th meeting

OWASP Khartoum - Top 10 A6 - 8th meeting - Security Misconfiguration

OWASP Khartoum Top 10 A4 - 7th meeting

Dernier

💉💊+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHABI}}+971581248768 +971581248768 Mtp-Kit (500MG) Prices » Dubai [(+971581248768**)] Abortion Pills For Sale In Dubai, UAE, Mifepristone and Misoprostol Tablets Available In Dubai, UAE CONTACT DR.Maya Whatsapp +971581248768 We Have Abortion Pills / Cytotec Tablets /Mifegest Kit Available in Dubai, Sharjah, Abudhabi, Ajman, Alain, Fujairah, Ras Al Khaimah, Umm Al Quwain, UAE, Buy cytotec in Dubai +971581248768''''Abortion Pills near me DUBAI | ABU DHABI|UAE. Price of Misoprostol, Cytotec” +971581248768' Dr.DEEM ''BUY ABORTION PILLS MIFEGEST KIT, MISOPROTONE, CYTOTEC PILLS IN DUBAI, ABU DHABI,UAE'' Contact me now via What's App…… abortion Pills Cytotec also available Oman Qatar Doha Saudi Arabia Bahrain Above all, Cytotec Abortion Pills are Available In Dubai / UAE, you will be very happy to do abortion in Dubai we are providing cytotec 200mg abortion pill in Dubai, UAE. Medication abortion offers an alternative to Surgical Abortion for women in the early weeks of pregnancy. We only offer abortion pills from 1 week-6 Months. We then advise you to use surgery if its beyond 6 months. Our Abu Dhabi, Ajman, Al Ain, Dubai, Fujairah, Ras Al Khaimah (RAK), Sharjah, Umm Al Quwain (UAQ) United Arab Emirates Abortion Clinic provides the safest and most advanced techniques for providing non-surgical, medical and surgical abortion methods for early through late second trimester, including the Abortion By Pill Procedure (RU 486, Mifeprex, Mifepristone, early options French Abortion Pill), Tamoxifen, Methotrexate and Cytotec (Misoprostol). The Abu Dhabi, United Arab Emirates Abortion Clinic performs Same Day Abortion Procedure using medications that are taken on the first day of the office visit and will cause the abortion to occur generally within 4 to 6 hours (as early as 30 minutes) for patients who are 3 to 12 weeks pregnant. When Mifepristone and Misoprostol are used, 50% of patients complete in 4 to 6 hours; 75% to 80% in 12 hours; and 90% in 24 hours. We use a regimen that allows for completion without the need for surgery 99% of the time. All advanced second trimester and late term pregnancies at our Tampa clinic (17 to 24 weeks or greater) can be completed within 24 hours or less 99% of the time without the need surgery. The procedure is completed with minimal to no complications. Our Women's Health Center located in Abu Dhabi, United Arab Emirates, uses the latest medications for medical abortions (RU-486, Mifeprex, Mifegyne, Mifepristone, early options French abortion pill), Methotrexate and Cytotec (Misoprostol). The safety standards of our Abu Dhabi, United Arab Emirates Abortion Doctors remain unparalleled. They consistently maintain the lowest complication rates throughout the nation. Our Physicians and staff are always available to answer questions and care for women in one of the most difficult times in their lives. The decision to have an abortion at the Abortion Cl

+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...

?#DUbAI#??##{{(☎️+971_581248768%)**%*]'#abortion pills for sale in dubai@

Discover the innovative features and strategic vision that keep WSO2 an industry leader. Explore the exciting 2024 roadmap of WSO2 API management, showcasing innovations, unified APIM/APK control plane, natural language API interaction, and cloud native agility. Discover how open source solutions, microservices architecture, and cloud native technologies unlock seamless API management in today's dynamic landscapes. Leave with a clear blueprint to revolutionize your API journey and achieve industry success!

WSO2's API Vision: Unifying Control, Empowering Developers

WSO2

Dubai, known for its towering skyscrapers, luxurious lifestyle, and relentless pursuit of innovation, often finds itself in the global spotlight. However, amidst the glitz and glamour, the emirate faces its own set of challenges, including the occasional threat of flooding. In recent years, Dubai has experienced sporadic but significant floods, disrupting normalcy and posing unique challenges to its infrastructure. Among the critical nodes in this bustling metropolis is the Dubai International Airport, a vital hub connecting the world. This article delves into the intersection of Dubai flood events and the resilience demonstrated by the Dubai International Airport in the face of such challenges.

Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdf

Orbitshub

Corporate and higher education. Two industries that, in the past, have had a clear divide with very little crossover. The difference in goals, learning styles and objectives paved the way for differing learning technologies platforms to evolve. Now, those stark lines are blurring as both sides are discovering they have content that’s relevant to the other. Join Tammy Rutherford as she walks through the pros and cons of corporate and higher ed collaborating. And the challenges of these different technology platforms working together for a brighter future.

Corporate and higher education May webinar.pptx

Rustici Software

Scaling API-first – The story of a global engineering organization Ian Reasor, Senior Computer Scientist - Adobe Radu Cotescu, Senior Computer Scientist - Adobe Apidays New York 2024: The API Economy in the AI Era (April 30 & May 1, 2024) ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe

apidays

FWD Group - Insurer Innovation Award 2024

The Digital Insurer

Sidekick Solutions uses Bonterra Impact Management (fka Social Solutions Apricot) and automation solutions to integrate data for business workflows. We believe integration and automation are essential to user experience and the promise of efficient work through technology. Automation is the critical ingredient to realizing that full vision. We develop integration products and services for Bonterra Case Management software to support the deployment of automations for a variety of use cases. This video focuses on the deployment of external web forms using Jotform for Bonterra Impact Management. This solution can be customized to your organization’s needs and deployed to support the common use cases below: - Intake and consent - Assessments - Surveys - Applications - Program registration Interested in deploying web form automations for Bonterra Impact Management? Contact us at sales@sidekicksolutionsllc.com to discuss next steps.

Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...

Jeffrey Haguewood

Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving

Edi Saputra

Vector Search -An Introduction in Oracle Database 23ai.pptx

Remote DBA Services

Webinar Recording: https://www.panagenda.com/webinars/why-teams-call-analytics-is-critical-to-your-entire-business Nothing is as frustrating and noticeable as being in an important call and being unable to see or hear the other person. Not surprising then, that issues with Teams calls are among the most common problems users call their helpdesk for. Having in depth insight into everything relevant going on at the user’s device, local network, ISP and Microsoft itself during the call is crucial for good Microsoft Teams Call quality support. To ensure a quick and adequate solution and to ensure your users get the most out of their Microsoft 365. But did you know that ‘bad calls’ are also an excellent indicator of other problems arising? Precisely because it is so noticeable!? Like the canary in the mine, bad calls can be early indicators of problems. Problems that might otherwise not have been noticed for a while but can have a big impact on productivity and satisfaction. Join this session by Christoph Adler to learn how true Microsoft Teams call quality analytics helped other organizations troubleshoot bad calls and identify and fix problems that impacted Teams calls or the use of Microsoft365 in general. See what it can do to keep your users happy and productive! In this session we will cover - Why CQD data alone is not enough to troubleshoot call problems - The importance of attributing call problems to the right call participant - What call quality analytics can do to help you quickly find, fix-, and prevent problems - Why having retrospective detailed insights matters - Real life examples of how others have used Microsoft Teams call quality monitoring to problem shoot problems with their ISP, network, device health and more.

Why Teams call analytics are critical to your entire business

panagenda

Following the popularity of “Cloud Revolution: Exploring the New Wave of Serverless Spatial Data,” we’re thrilled to announce this much-anticipated encore webinar. In this sequel, we’ll dive deeper into the Cloud-Native realm by uncovering practical applications and FME support for these new formats, including COGs, COPC, FlatGeoBuf, GeoParquet, STAC, and ZARR. Building on the foundation laid by industry leaders Michelle Roby of Radiant Earth and Chris Holmes of Planet in the first webinar, this second part offers an in-depth look at the real-world application and behind-the-scenes dynamics of these cutting-edge formats. We will spotlight specific use-cases and workflows, showcasing their efficiency and relevance in practical scenarios. Discover the vast possibilities each format holds, highlighted through detailed discussions and demonstrations. Our expert speakers will dissect the key aspects and provide critical takeaways for effective use, ensuring attendees leave with a thorough understanding of how to apply these formats in their own projects. Elevate your understanding of how FME supports these cutting-edge technologies, enhancing your ability to manage, share, and analyze spatial data. Whether you’re building on knowledge from our initial session or are new to the serverless spatial data landscape, this webinar is your gateway to mastering cloud-native formats in your workflows.

Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME

Safe Software

[BuildWithAI] Introduction to Gemini.pdf

Sandro Moreira

Tracing the root cause of a performance issue requires a lot of patience, experience, and focus. It’s so hard that we sometimes attempt to guess by trying out tentative fixes, but that usually results in frustration, messy code, and a considerable waste of time and money. This talk explains how to correctly zoom in on a performance bottleneck using three levels of profiling: distributed tracing, metrics, and method profiling. After we learn to read the JVM profiler output as a flame graph, we explore a series of bottlenecks typical for backend systems, like connection/thread pool starvation, invisible aspects, blocking code, hot CPU methods, lock contention, and Virtual Thread pinning, and we learn to trace them even if they occur in library code you are not familiar with. Attend this talk and prepare for the performance issues that will eventually hit any successful system. About authorWith two decades of experience, Victor is a Java Champion working as a trainer for top companies in Europe. Five thousands developers in 120 companies attended his workshops, so he gets to debate every week the challenges that various projects struggle with. In return, Victor summarizes key points from these workshops in conference talks and online meetups for the European Software Crafters, the world’s largest developer community around architecture, refactoring, and testing. Discover how Victor can help you on victorrentea.ro : company training catalog, consultancy and YouTube playlists.

Finding Java's Hidden Performance Traps @ DevoxxUK 2024

Victor Rentea

The microservices honeymoon is over. When starting a new project or revamping a legacy monolith, teams started looking for alternatives to microservices. The Modular Monolith, or 'Modulith', is an architecture that reaps the benefits of (vertical) functional decoupling without the high costs associated with separate deployments. This talk will delve into the advantages and challenges of this progressive architecture, beginning with exploring the concept of a 'module', its internal structure, public API, and inter-module communication patterns. Supported by spring-modulith, the talk provides practical guidance on addressing the main challenges of a Modultith Architecture: finding and guarding module boundaries, data decoupling, and integration module-testing. You should not miss this talk if you are a software architect or tech lead seeking practical, scalable solutions. About the author With two decades of experience, Victor is a Java Champion working as a trainer for top companies in Europe. Five thousands developers in 120 companies attended his workshops, so he gets to debate every week the challenges that various projects struggle with. In return, Victor summarizes key points from these workshops in conference talks and online meetups for the European Software Crafters, the world’s largest developer community around architecture, refactoring, and testing. Discover how Victor can help you on victorrentea.ro : company training catalog, consultancy and YouTube playlists.

Modular Monolith - a Practical Alternative to Microservices @ Devoxx UK 2024

Victor Rentea

In this keynote, Asanka Abeysinghe, CTO,WSO2 will explore the shift towards platformless technology ecosystems and their importance in driving digital adaptability and innovation. We will discuss strategies for leveraging decentralized architectures and integrating diverse technologies, with a focus on building resilient, flexible, and future-ready IT infrastructures. We will also highlight WSO2's roadmap, emphasizing our commitment to supporting this transformative journey with our evolving product suite.

Platformless Horizons for Digital Adaptability

WSO2

AWS Community Day CPH - Three problems of Terraform

Andrey Devyatkin

Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood

Juan lago vázquez

Angeliki Cooney has spent over twenty years at the forefront of the life sciences industry, working out of Wynantskill, NY. She is highly regarded for her dedication to advancing the development and accessibility of innovative treatments for chronic diseases, rare disorders, and cancer. Her professional journey has centered on strategic consulting for biopharmaceutical companies, facilitating digital transformation, enhancing omnichannel engagement, and refining strategic commercial practices. Angeliki's innovative contributions include pioneering several software-as-a-service (SaaS) products for the life sciences sector, earning her three patents. As the Senior Vice President of Life Sciences at Avenga, Angeliki orchestrated the firm's strategic entry into the U.S. market. Avenga, a renowned digital engineering and consulting firm, partners with significant entities in the pharmaceutical and biotechnology fields. Her leadership was instrumental in expanding Avenga's client base and establishing its presence in the competitive U.S. market.

Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...

Angeliki Cooney

Strategies for Landing an Oracle DBA Job as a Fresher

Remote DBA Services

Following the popularity of "Cloud Revolution: Exploring the New Wave of Serverless Spatial Data," we're thrilled to announce this much-anticipated encore webinar. In this sequel, we'll dive deeper into the Cloud-Native realm by uncovering practical applications and FME support for these new formats, including COGs, COPC, FlatGeoBuf, GeoParquet, STAC, and ZARR. Building on the foundation laid by industry leaders Michelle Roby of Radiant Earth and Chris Holmes of Planet in the first webinar, this second part offers an in-depth look at the real-world application and behind-the-scenes dynamics of these cutting-edge formats. We will spotlight specific use-cases and workflows, showcasing their efficiency and relevance in practical scenarios. Discover the vast possibilities each format holds, highlighted through detailed discussions and demonstrations. Our expert speakers will dissect the key aspects and provide critical takeaways for effective use, ensuring attendees leave with a thorough understanding of how to apply these formats in their own projects. Elevate your understanding of how FME supports these cutting-edge technologies, enhancing your ability to manage, share, and analyze spatial data. Whether you're building on knowledge from our initial session or are new to the serverless spatial data landscape, this webinar is your gateway to mastering cloud-native formats in your workflows.

Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME

Safe Software

Dernier (20)

+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...

WSO2's API Vision: Unifying Control, Empowering Developers

Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdf

Corporate and higher education May webinar.pptx

Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe

FWD Group - Insurer Innovation Award 2024

Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...

Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving

Vector Search -An Introduction in Oracle Database 23ai.pptx

Why Teams call analytics are critical to your entire business

Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME

[BuildWithAI] Introduction to Gemini.pdf

Finding Java's Hidden Performance Traps @ DevoxxUK 2024

Modular Monolith - a Practical Alternative to Microservices @ Devoxx UK 2024

Platformless Horizons for Digital Adaptability

AWS Community Day CPH - Three problems of Terraform

Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood

Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...

Strategies for Landing an Oracle DBA Job as a Fresher

Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME

API IN(SECURITY)

1. API IN(SECURITY) Asim Jaweesh Asim [dot] Jaweesh (at) owasp [dot] org

2. AGENDA and technical knowledge History Rank Issues? defense resource Finish

3. BRIEF HISTORY 0 1 2 3 4 5 6 7 E-Commerce Social Mobile IoT Time

4. IMPORTANCE • Integration with other systems. • Control of UI/UX. • Cheap tweaks and change requests. • Saving time and effort.

5. WHAT COULD GO WRONG?

6. MOST VULNERABLE TO HAX

7. COMMON API HACKS OF 2014

8. THINK LIKE A HACKER PROTECTOR • Access control • Input validation • Output encoding • Cryptography • Message integrity • confidentiality

9. ACCESS CONTROLS • Anti-framing • Protect HTTP methods • Whitelist allowable methods • Protect privileged actions. • Protect against CSRF • Protect against IDOR • API rate limits

10. INPUT VALIDATION • Input sanitization • Secure parsing • Strong typing • Validate incoming content-type • Validate response-type • XML input validation • Framework-Provided validation

11. OUTPUT ENCODING • Send secure headers • JSON encoding • XML encoding

12. CRYPTOGRAPHY • Data in transit • Data in storage

13. MESSAGE INTEGRITY • In addition to HTTPS, JSON Web Token (JWT) • JWT guarantee message integrity and authenticate both sender/ receiver

14. CONFIDENTIALITY • RESTful web services can leak credentials, tokens and API keys • https://example.com/resourceCollection/<id>/action • https://Twitter.com/Jaweesh/lists • https://example.com/controller/<id>/action?apikey=12345678 • http://example.com/controller/<id>/action?apikey=987654321

15. RESOURCES • OWASP cheat sheet • History of API • Internet of things definition • SmartBear Practical tips for API security

16. RECAP • API new business technology. • Gaining popularity and trending. • Can easily wreck your business. • Good API helps your business. • Integrate security in development. • Do periodic security tests. • Spread awareness.

17. THANK YOU Asim [dot] Jaweesh (at) owasp [dot] org @jaw33sh

API IN(SECURITY)

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (20)

Similaire à API IN(SECURITY)

Similaire à API IN(SECURITY) (20)

Plus de OWASP Khartoum

Plus de OWASP Khartoum (11)

Dernier

Dernier (20)

API IN(SECURITY)