Workshop: The OWASP API Security Top Ten 2023 with Tanya Janca

Introduction & Setup

• • Brief overview of the workshop agenda

• • Instructions for downloading code from GitHub

• • Setting up VS Code and previewing the “Bad, Better, Best” examples

OWASP API Top Ten (Items 1-5)

• • Brief overview of each item, its associated risks, and remediation

• • Guided code review for each item:

    • • Bad: Reviewing an API with no defenses
    • • Better: Introducing one defense
    • • Best: Implementing multiple defenses

• • Open discussion: Key takeaways and questions

OWASP API Top Ten (Items 6-10)

• • Brief overview of each item, its associated risks, and remediation

• • Guided code review for each item:

    • • Bad: Reviewing an API with no defenses
    • • Better: Introducing one defense
    • • Best: Implementing multiple defenses

• • Open discussion: Lessons learned and practical applications

Wrap-Up & Q&A

• • List of free and Open Source API Security Tools

• • Conclusion and Questions

• • Suggestions for continued learning and resources