apidays Paris 2024 - Why We Should All Be API Hackers, Desz Lamptey, Capital One

Why We Should All Be API Hackers
Desz Lamptey, Lead Software Engineer at Capital One

apidays Paris 2024 - The Future API Stack for Mass Innovation
December 3 - 5, 2024

------

Check out our conferences at https://www.apidays.global/

Do you want to sponsor or talk at one of our conferences?
https://apidays.typeform.com/to/ILJeAaV8

Learn more on APIscene, the global media made by the community for the community:
https://www.apiscene.io

Explore the API ecosystem with the API Landscape:
https://apilandscape.apiscene.io/

Transcript

1. Why We Should All Be Hackers * the mindset change we all need * Desz Lamptey Lead Software Engineer, Certified Ethical Hacker, One-Day-at-a-Time Dad
2. What Happened?
4. Elements of a Hacker Persistent Patient Resourceful Curious Creative Ethical Hacker Malicious Hacker
6. Security Misconfiguration (API8:2023) - Chatbot using LLM APIs
7. Threat Mitigation Follow Best Practices and Standards Use Server-side Validation Implement Proper Authorization & Authentication Create a Fast Reaction Strategy Use strong encryption Understand Attack Fundamentals Automate Security Checks Automate security patches & dependency updates Enhance Access Controls Monitor and Log Everything Train on Secure Coding
8. For illustrative purposes only
9. 1. function calculateApplicableDiscount (basket: BasketModel, req: Request) { 2. if (security.discountFromCoupon(basket.coupon)) { 3. const discount = security.discountFromCoupon(basket.coupon) 4. return discount 5. } else if (req.body.couponData) { . . . 6. if (campaign && campaign.validOn < new Date().getTime()){ 7. return campaign.discount 8. } 9. } 10. return 0 11. } 12. const campaign = {5_OFF:{validOn: new Date('Mar 8, 2024 00:00:00 GMT+0100').getTime(), discount: 5}} #validate-coupon
10. Let’s Dive in Together Lambda Application
11. Creativity Productivity Security
12. Are we ready for change?
13. Resources to hack responsibly