ASC 2022 - API Specifications Conference

Everyday, hundreds of APIs are created or updated. What do they do? Which data do they access ? Are they secure ? Do they comply to the security requirements of the company?

In this session, I want to propose an approach to describing security requirements and policies so that APIs can be reliably protected and tested each time they are deployed.

By relying on standard API descriptions like OpenAPI, we can today leverage many different tools, many of them OpenSource, to profile the API contract, automatically test for vulnerabilities, and even automatically inject security policies.

This session will introduce the API security as code concept and describe what can be achieved with current tooling as well as introduce current/future OpenAPI extensions that can be used for security.