FireTail at API Days Helsinki 2023 - Learning from Outliers

FireTail founder Jeremy Snyder discussed what we can learn from Malcolm Gladwell's 'Outliers' about API security at API Days Helsinki & North in Helsinki, Finland on June 5, 2023.

Malcolm Gladwell’s 2008 book, ‘Outliers’, sheds light on factors contributing to success. It also uses specific, real-world stories to highlight breakdowns that cause failure. From Gladwell we learn that major catastrophes don’t usually cause plane crashes; rather, a series of missteps and mistakes will lead to failure. Much like the disastrous crash of Korean Air Flight 801, API breaches are almost always the result of multiple, smaller failures - not just one fleeting security or IT mistake. This session will examine the misunderstood world of API security successes and failures. In a cyber attack, there is a primary breach vector and a secondary breach vector. When we hear about a big breach, it is typically because both of those vectors were successfully attacked. For example, an internal API with no authentication is not inherently bad; but if a network configuration change is made and that API suddenly goes public, then we have a problem. Again, lack of authentication didn’t cause the breach directly, it was a series of events and untracked network configuration changes. Every mobile app and IoT device, modern enterprise or cloud app, are all just frontend UIs talking to backend APIs. This framework is the backbone of the modern web, and when we consider the fact that we will have 1 trillion API endpoints very soon, the risk of API breaches is unmatched in cybersecurity. This presentation will offer suggestions on using a threat model to consider risk factors around your APIs, and best practices for blocking the most commonly breached attack vectors.

Here are the slides from the presentation.

Here's a recording of the session.