Cloud native applications are API driven and are based on distributed microservices. APIs are the gateway to your business and expose a lot of the business logic to the outside world. Legacy solutions to understand your applications security posture are not applicable to these modern continuously changing environments

1. Best Of The World In Security Conference
Best Of The World In Security
12-13 November 2020
Application Security for the
cloud-native era
Sanjay Nagaraj
Co-founder/CTO
Traceable.ai
@SanjayNSF

2. Best Of The World In Security Conference
Co-founder/CTO at Traceable.ai
Former VP Engineering, AppDynamics
Building products for 20+ years
Currently learning about GraphQL anomalies

3. Best Of The World In Security Conference
Cloud native services

4. Best Of The World In Security Conference
Cloud-Native Architectures - Complex & Ephemeral

5. Best Of The World In Security Conference
Where are all my APIs and risky APIs ?
5
- API Sprawl
- New APIs and Parameters
show up
- Shadow APIs
- Poor understanding of risk

6. Best Of The World In Security Conference
Where is all my sensitive data flowing in and out ?
6
- Data coming into
APIs
- Data in
databases, cloud
services, 3rd
party
- Compliance

7. Best Of The World In Security Conference
What are Business logic attacks
7
Threat
Actor
GET /api/receipts/5
Mary -
Rider
Mary’s
Receipt #5
Resource
Receipt
API
New Class of Attacks
OWASP Web
OWASP API

8. Best Of The World In Security Conference
How much can I catch early ?
8
- Are scanning tools enough ?
- Not everything gets tested
- How to scan for business logic
vulnerabilities ?
- SPA

9. Best Of The World In Security Conference
Modern App Security Requires Full Application Context
9
User Actions Edge APIs Internal APIs External Service
API ACTIVITY
Edge API Calls
Internal API Calls
Sequence of API Calls
USER BEHAVIOR
Identity & Devices
Roles & Permissions
Activity
DATA FLOW
Across Sequence of Calls
Between InternalServices
To External Services
CODE EXECUTION
API Parameters
Request/Response Data
Errors & Latency

10. Best Of The World In Security Conference
DevSecOps
10
- Shared responsibility
- Education
- Risk assessment & prioritization
- Collaborative issue handling, transparency / information
mgmt (unified pane of glass)

11. Best Of The World In Security Conference
Questions
@ : sanjay@traceable.ai
: @sanjaynsf
: linkedin.com/in/sanjaynagaraj/

12. Best Of The World In Security Conference
Win a t-shirt!
Question:
What is the top risk in
OWASP API Top 10?
the answer to
@traceableai
#cisoplatformquiz