Running Orbital Commerce's API security program around the API security loop of eight arcs: inventory, governance, authentication and authorisation, schema and validation, gateway and edge, abuse and rate, testing and monitoring. Inside the loop, the inventory shows 40 APIs on the wiki against 137 found in gateway logs, and a broken object-level authorisation flaw — asking for the next order id returned another customer's order — is closed with an ownership check. Live monitoring then catches what only production shows: 340 sequential order ids in six minutes, 40,000 password guesses across 12,000 accounts, slow gift-card enumeration and an unbounded page size, with API alerts finally routed to the SOC.

CY-SENIOR-038Senior Level · API Security Program

API Security Program Leadership — The API Security Loop

A senior-level course that runs an organization-wide API security program, not a single API review, by working the API Security Loop - eight arcs from Inventory through Monitor - to find every API, set the standards they are built on, verify who is calling and what they may touch, enforce the contract, funnel every call through one gateway, stop abuse, prove defenses hold before release, and watch live traffic for what only production reveals, grounded throughout in the OWASP API Security Top 10.

15 hours8 chapters32 lessons225 activities8 labs

What you'll learn

Build and maintain a true, program-wide API inventory, and close shadow and zombie API exposure.
Publish and enforce org-wide API governance - a standard, a review gate, data classification, and ownership.
Get authentication and authorization right at the object and function level, closing BOLA and BFLA.
Enforce the API contract, centralize gateway policy, and unify abuse control, testing, and monitoring into one continuous program.

Price:৳10,000