Global AppSec Dublin: Hacking And Defending APIs: Red And Blue Make Purple
Outlines global AppSec Dublin: Hacking And Defending APIs: Red And Blue Make Purple and evaluates key implications for security practitioners.
Summary
Talk framing
An OWASP Global AppSec session on Hacking and Defending APIs (red + blue = purple) promises a dense walkthrough of why APIs are high-value targets and how to test and defend them.
Why APIs matter
Production APIs sit behind WAFs, IDPs, mobile clients, and third-party backends—far from Wikipedia-simple RPC. Data-as-oil metaphors cast APIs as the pipelines attackers prefer when web login hardens.
Defense gaps
Strong appsec programs may lack API-specific posture, runtime monitoring, and dynamic testing; GitHub reportedly saw attack shifts to APIs—and even removed login from APIs when web controls tightened.
Security model
Effective API security needs inventory (posture), traffic anomaly response (runtime), and interactive testing; controls must be granular per hostname, path, and HTTP method because GET /users vs DELETE /users differ radically.
Methodology preview
The speaker begins pen-test recon—passive OSINT (Google dorks, DNS, Shodan, GitHub issues)—noting defenders rarely detect such pre-attack research.
Related talks
Hackers of CypherCon·40 min
Robert Wagner | CypherCon 6.0
Robert Wagner | CypherCon 6.0 examines Hacking and Defending APIs.
Videos·26 min
Yaron King
Yaron King examines Low Hanging Blue Fruit: Defending With Open-Source Tools.
OWASP Global AppSec Dublin·51 min
Analyzes global AppSec Dublin: A Taste Of Privacy Threat Modeling by Kim Wuyts and evaluates key implications for security practitioners.