Главная
Study mode:
on
1
Introduction
2
Is software security getting better
3
We have a big pile of code
4
We know we have a lot of bugs
5
We try to educate them
6
We really need to do better
7
What else do we do
8
Training
9
Developers release vulnerabilities faster
10
Importance of contesting
11
Focus on external code
12
Build better platforms
13
Language lawyers
14
Counterexamples
15
LDAP Filter Injection
16
Cold Fusion
17
Encoding
18
Adobe API
19
ColdFusion
20
Example Code
21
Sequel Injection
22
PHP Abstract API
23
Apache Foundation
24
API Security
25
How do we convince vendors
26
Standardization
27
Conclusion
28
Questions
Description:
Explore the critical importance of API design in securing software's future through this insightful conference talk from OWASP AppSec California 2015. Delve into Timothy D. Morgan's examination of why traditional security training methods fall short and discover innovative approaches to prevent vulnerabilities. Learn about the properties of safe development environments and gain valuable insights into guiding principles for API designers. Understand how well-designed APIs can subtly guide developers towards secure implementations, potentially preventing entire classes of vulnerabilities. Examine real-world examples of both problematic and secure API designs, including discussions on LDAP Filter Injection, ColdFusion, and SQL Injection. Consider the role of standardization in convincing vendors to prioritize API security and explore strategies for building better platforms that inherently promote secure coding practices.

Securing Software's Future: Why API Design Matters

OWASP Foundation
Add to list
0:00 / 0:00