Bullet-Proof APIs: The OWASP API Security Top Ten

The OWASP Top Ten as a list of the ten biggest security risks for web applications has been a de facto standard for over ten years. Somewhat out of the limelight, however, there are other lists. The OWASP API Security Top Ten was last updated in 2023 and highlights risks for APIs. Since arguably almost every web application relies on APIs these days, it’s imperative that we address them. In the talk, we’ll take a look at how the list came about and then go through all the points, showcasing common attacks. In particular, we are interested in what this means for modern stacks. Which points are relevant, and how can we take technology-specific countermeasures?