API Security: Is it the new application attack surface and how to secure at enterprise scale?

The talk opens with how modern web apps are built. Single-page apps make many API calls to back-end services, which return raw JSON that the browser assembles. The speaker argues this moves data handling toward the server and widens the attack surface through more endpoints, microservices reused across use cases, weak object-level authorization, and filtering spread across many layers. Classic issues such as CSRF matter less for stateless calls, while rate limiting becomes more important.

Two real incidents anchor the discussion. A social network's contact-lookup API let callers enumerate phone numbers without rate limits and returned far more personal data than the feature needed. A search company left a staging server connected to production data reachable from the internet, with no inventory of its APIs. Both map to OWASP API Top 10 themes such as broken authorization, excessive data exposure and improper asset management. The protection model classifies APIs by audience and data sensitivity, then applies baseline controls: strong authentication, object-level authorization, key rotation, rate limits, payload encryption, secrets management, bot detection, content inspection, logging and file upload protection.

The closing advice is to design security in from the start. Teams should document abuse cases, return only the data each consumer needs, know who consumes each API, and tailor testing and gateway or WAF policies to sensitive endpoints. Anomaly monitoring complements fixed rate limits, since static thresholds are hard to set well.