INTERFACE by apidays 2023 - API Standards and Shift Left Security, Alex Savage, Advanced

INTERFACE by apidays 2023
APIs for a “Smart” economy. Embedding AI to deliver Smart APIs and turn into an exponential organization
June 28 & 29, 2023

API Standards and Shift Left Security
Alex Savage, Head of Integrations at Advanced

------

Check out our conferences at https://www.apidays.global/

Do you want to sponsor or talk at one of our conferences?
https://apidays.typeform.com/to/ILJeAaV8

Learn more on APIscene, the global media made by the community for the community:
https://www.apiscene.io

Explore the API ecosystem with the API Landscape:
https://apilandscape.apiscene.io/

Transcript

1. Software Powered Possibility API standards and shifting security left Alex Savage (He / Him) 6/28/2023
3. Software Powered Possibility About Me Leader of Platform Integrations Team (was API C4E) • Standards, tooling + enablement for 800+ global engineering staff Likes: • Adventures with young family • Cars • BBQ • Lego (especially Lego cars) • APIs Alex Savage (He / Him) Head of Integrations @ Advanced https://www.linkedin.com/in/alexandersavage/,
4. Software Powered Possibility • Safe • Consistent • Reliable • Good CX • Performant • Recognizable • Modern
5. Software Powered Possibility
6. Software Powered Possibility Consistency at Scale
7. Software Powered Possibility
8. Software Powered Possibility
9. Software Powered Possibility We were not the first https://apihandyman.io/toolbox/apistylebook/ https://dret.github.io/guidelines/
10. Software Powered Possibility Standardisation obsession Casing Pagination Sorting HTTP Methods HTTP Codes Errors Formats Tenancy Versioning Security ….
11. Software Powered Possibility API / Governance Team Dev Teams
12. Software Powered Possibility
13. Software Powered Possibility Good rules + Linter = Great security from design onwards Good security No Basic Auth, OAuth Password or Implicit flows… Versioning Request validation AuthN + AuthZ Rate limiting HTTPS Allowed response codes Resource Id formats Pagination Bonus: Casing Look + feel MUST have SHOULD have
14. Software Powered Possibility Don’t forget API reviews!!! Focused on: Outside in perspective Is it a “good” API? Is it safe/secure? What would a consumer think? What advice can I give this team? Review observations may be your next linter rule
15. Software Powered Possibility DESIGN Design in a language agnostic way supported by great standards VALIDATE + REVIEW Automate as much as possible. Don’t forget the human but make it constructive. AUTOMATE / CODE Great design + great code-gen or good prompts for devs TEST Great design = Good tests + Bonus for automation RELEASE + OBSERVE Check traffic vs design. Expect the unexpected 01 02 03 04 05 Summary
16. Software Powered Possibility Callouts: Security Linting rules https://github.com/stoplightio/spectra l-owasp-ruleset https://github.com/italia/api-oas- checker/ https://api.oneadvanced.com/rules/.spectr al.js
17. Software Powered Possibility