Name: Telemetry for Observability
Start: 2021-07-21T16:00:00Z
End: 2021-07-21T16:29:42.000Z
Location: BrightTALK

Traceable enables security to keep up with engineering and the continuous pace of change and protect modern applications from modern threats.  Traceable applies the power of machine learning and distributed tracing to understand the DNA of your APIs, how they are changing, and where there are anomalies in order to detect and block threats, making businesses more secure and resilient.

In this 4-part webinar series, Inon Shkedy (Head of Security Research at Traceable AI; co-author OWASP API Top 10) explores the OWASP API Top 10 project and provides detailed explanations about the API threats documented in the OWASP project.

In this episode, Inon reviews and explains API Penetration Testing:
- How to approach API pentesting
- How to find OWASP API Vulnerabilities
- How to leverage the predictable nature of REST APIs
- What to do if you get stuck during a pentest

API Security Webinar Series:
Episode 1 - Why OWASP API & #1 BOLA
Episode 2 - OWASP API Top 10 #'s 2 - 5
Episode 3 - OWASP API Top 10 #'s 6 - 10
Episode 4 - API Penetration Testing - This one!

To learn more about Traceable AI | https://traceable.ai
To request a live demo or meeting | https://www.traceable.ai/request-demo

API Security & the OWASP API Top10 - API Penetration Testing (Part 4 of 4)

In this 4-part webinar series, Inon Shkedy (Head of Security Research at Traceable AI; co-author OWASP API Top 10) explores the OWASP API Top 10 project and provides detailed explanations about the API threats documented in the OWASP project.

In this episode, Inon provides details about 5 additional API vulnerabilities:
- Mass Assignment
- Security Misconfiguration
- Injection
- Improper Assets Management
- Insufficient Logging & Monitoring 

Inon explains how these vulnerabilities have been exploited in the wild, why developers write code that is vulnerable to them, and how attackers can take advantage of the situation for their own profit.

API Security Webinar Series:
Episode 1 - Why OWASP API & #1 BOLA 
Episode 2 - OWASP API Top 10 #'s 2 - 5 
Episode 3 - OWASP API Top 10 #'s 6 - 10 - This one!
Episode 4 - API Penetration Testing 

To learn more about Traceable AI | https://traceable.ai
To request a live demo or meeting | https://www.traceable.ai/request-demo

API Security & the OWASP API Top10 (#6 - #10) - Part 3 of 4

In this 4-part webinar series, Inon Shkedy (Head of Security Research at Traceable AI; co-author OWASP API Top 10) explores the OWASP API Top 10 project and provides detailed explanations about the API threats documented in the OWASP project.

In this episode, Inon provides details about 4 API vulnerabilities:
- Broken User Authentication
- Excessive Data Exposure
- Lack of Resources & Rate Limiting
- Broken Function Level Authorization 

Inon explains how these vulnerabilities have been exploited in the wild, why developers write code that is vulnerable to them, and how attackers can take advantage of the situation for their own profit.

API Security Webinar Series:
Episode 1 - Why OWASP API & #1 BOLA
Episode 2 - OWASP API Top 10 #'s 2 - 5 - This one!
Episode 3 - OWASP API Top 10 #'s 6 - 10
Episode 4 - API Penetration Testing

To learn more about Traceable AI | https://traceable.ai
To request a live demo or meeting | https://www.traceable.ai/request-demo

API Security & the OWASP API Top10 (BUA - BFLA) - 2 of 4

In this 4-part webinar series, Inon Shkedy (Head of Security Research at Traceable AI; co-author OWASP API Top 10) explores the OWASP API Top 10 project and provides detailed explanations about the API threats documented in the OWASP project.

In the first episode in the series, Inon shares the motivation behind the project and answers the following questions: 

- Why is there a need for a new OWASP project for APIs?
- How has application security changed in the last few years? 
- Why have APIs become such an attractive target for attackers? 

He also covers the most critical API vulnerability - Broken Object Level Authorization (BOLA) and explains how attackers have managed to exploit it in many large companies like Uber, Facebook, and Verizon.

API Security Webinar Series:
Episode 1 - Why OWASP API & #1-BOLA - This one!
Episode 2 - OWASP API Top 10 #2 - #5
Episode 3 - OWASP API Top 10 #6 - #10
Episode 4 - API Penetration Testing

To learn more about Traceable AI | https://traceable.ai
To request a live demo or meeting | https://www.traceable.ai/request-demo

API Security & the OWASP API Top10 (BOLA/IDOR) - Part 1 of 4

Digital transformation is driving applications and data to the cloud, where cloud-native applications enable innovation, growth, and opportunity. Protecting cloud-native applications is fundamentally different from protecting traditional IT systems. There is no fixed perimeter in the cloud, as microservices and applications connect through APIs. In the cloud, containers are created and destroyed depending on business demand, your infrastructure isn’t permanent, rather it’s ephemeral. A security professional looking at how to protect cloud-native applications must feel like Dorothy in the Wizard of Oz –  “Toto, I’ve got a feeling we’re not in Kansas anymore.”
 
This interactive discussion between Dana Gardner (Market Analyst @ Traceable AI), Steve Coplan (Strategic Product Marketing @ Aqua Security), and Sudeep Padiyar (Product Manager @ Traceable AI) explores the new challenges that security is facing, and helps viewers find their path to the yellow brick road that leads to a more robust cloud-native security posture.

This webinar will help you understand:
- How cloud-native is fundamentally different
- Overview of security options
- Ways to get started on your security posture

A New Perspective from Log4shell: Exploit Prevention from Containers to APIs

A software bill of materials (SBOM), like any other security feature, won't solve all our problems. 

But greater transparency in the software supply chain will:
1.) Support more secure software development
2.) Enable more informed decisions around software selection and purchase
3.) Allow organizations to respond much more quickly and efficiently respond to new vulnerabilities

This webinar will review the basics of SBOM, and use the recent log4j vulnerability to understand how SBOM can help—and also understand its limits. We'll close by offering some perspectives on how SBOM and related transparency efforts will grow and evolve in 2022 and beyond.

SBOM, Log4j, and the Future of Transparency in the Software Supply Chain

Join John Jeremiah, DevSecOps Evangelist, and Sudeep Padiyar, Product Manager, for a brief discussion on the Log4j / Log4shell Vulnerability and how Traceable can detect and protect you, and your organization, from the Log4shell vulnerability - introducing Traceable AI's QuickStart Protection Guide.

Log4shell Exploit Protection & QuickStart Guide with Traceable AI

Learn how to detect and prevent the Log4shell/Log4j vulnerability. 

In early Dec 2021, a new and severe vulnerability (​​CVE-2021-44228) has been identified in the widely used Apache Log4shell / Log4j Java logging package which gives the attacker the ability to run unauthenticated remote code execution on a targeted server. 

This vulnerability is actively being exploited. Well-known web services and applications such as Apple iCloud, Twitter, Amazon, Baidu, and Minecraft are reported to have all been targeted.

This webinar will help you understand:
 - How the Log4shell / Log4j vulnerability creates significant risk
 - Overview of mitigation strategies
 - How Traceable AI can detect and block the exploit
 - Extended Q&A

Detecting and Protecting the Log4shell Vulnerability

Do you really know how secure your cloud applications are? You have a web application firewall in place, an API gateway in place, and are using a cloud identity and access management service. So you’re goof right?

In this session we’ll learn about the top API vulnerabilities and see live how to find them and protect yourself against them.

We will explore the OWASP API Top 10 and the new security challenges and strategies to understand the application, how it is changing, and how to detect anomalies to block threats, making businesses more secure and resilient.

Join Inon Shkedy, Co-Leader of OWASP API Top 10 project and Traceable AI Security Researcher, and Anoop Kartha, API Security Evangelist to learn:
 - Why API vulnerabilities are different from traditional web application vulnerabilities
 - Why your traditional application security solutions aren’t enough
 - What are the top vulnerabilities you should be concerned about
 - How to detect and block bad actors from using these vulnerabilities against you

Hunting Down the Top API Security Threats to Your Applications

Please join us as Dana Gardner, Principal Analyst at Interarbor Solutions, and Sanjay Nagaraj, Co-Founder & CTO at Traceable AI, as they discuss the evolution of application security – and where it’s heading, the purpose for starting Traceable AI and how Traceable AI’s new platform is aiming to make APIs reach their enormous potential safely and securely. Traceable AI’s new platform is designed specifically to define, manage, secure and optimize the API underpinnings for so much of what drives today’s digital business.

How To Detect & Thwart API Vulnerabilities

The business demanded rapid innovation. Software development and IT figured out how to provide it. But now we have a whole host of new problems. In the resulting world of cloud-native apps, micro-services, and API-driven applications, what we came to rely on for keeping it all running and secure is no longer enough.

In this new fog, we are basically “flying blind”. Modern applications are extremely hard to secure and protect as they are complex and continuously changing. Our visibility of what we have, how it is behaving, and how it is being used (and abused) has diminished tremendously. So how do we begin to see through the fog once again?

In this session you’ll learn:
- Why are we flying blind
- 4 key areas to focus on to stop flying blind
- A way to get started quickly (for free!)

Flying Blind? The Case for API Security & Observability - SANS Cyber Fest 2021

Speaker bio: 
Ran Ribenzaft is the CTO at Epsagon, an AWS Advanced Technology Partner that specializes in monitoring and tracing for serverless applications. Ran is a passionate developer that loves sharing open-source tools to make everyone’s lives easier and writing technical blog posts on the topics of serverless, microservices, cloud, and AWS on Medium and the Epsagon blog.

Host:
Jayesh Ahire (@Jayesh_Ahire1) is Founding Engineer/ Product Manager at Traceable where he primarily works on Hypertrace. Jayesh is first AWS ML Hero in India and youngest one to receive the title to date. He is the Organizer of AWS UG, Elastic UG, TensorFlow UG and Microsoft AI community and many other communities in India. His research interest involved Distributed neural computer and DeFi. He is also one of the few Twilio Champions and MVB at Dzone.

Observability: Correlation is the key!

Join industry leader and serial entrepreneur, Jyoti Bansal, and Hacker turned CISO, Alissa Knight in an engaging discussion about the emerging challenges businesses face shipping and managing risks of Cloud-Native applications. Modern applications are built to run in the cloud, built to connect to other applications, and architected as resilient micro-services. What about security? How do Engineering leaders and Security leaders address the new risks that lurk under the covers of modern applications?

Speakers:
- Alissa Knight, as a white hat API hacker has discovered API vulnerabilities in banks, healthcare, and vehicles, she is also an experienced CISO, helping to manage risks and security at Qontic Bank.
- Jyoti Bansal, as a serial entrepreneur - founder of AppDynamics, Harness, and Traceable AI, uniquely understands the megatrends facing IT, Engineering, and Security as cloud-native applications become the standard.

Securing the Future of Cloud-Native Development

APIs have long become central to developing, running, and consuming on-line digital services. Still, operationally the management and  governance of the APIs is often far behind other corporate governance practices or IT operational controls we have enjoyed in the era of on-premise data centers. In this webinar, Renata Budko, Head of Product at Traceable AI, offers her viewpoint on some simple principles you can follow to start an API Governance program.  With API Governance you can reduce risk, get better at compliance, and help your development efficiency with an eye on APIs. Learn how the new technologies of micro services, APIs, and cloud-native architectures have created new attack surfaces and potential vulnerabilities, and the things we are doing to help close the gaps.

What we'll cover:
- Examples and consequences of good and bad API governance
- Gaps in IT governance created by new attack surfaces and potential vulnerabilities in distributed API-driven architectures
- Principles needed to control APIs in the era of new technologies of micro services and cloud-native architectures
- How Traceable can help
- Interactive Q&A

Four Simple Principles to get Your API Governance Program Off the Ground

Bringing broader awareness of security risks and building a security-minded culture within any public or private organization has been a top priority for years. Yet halfway through 2021, IT security remains as much a threat as ever -- with multiple major breaches and attacks costing tens of millions of dollars occurring nearly weekly.

Why are the threat vectors not declining? Why, with all the tools and investment, are businesses still regularly being held up for ransom or having their data breached? To what degree are behavior, culture, attitude, and organizational dissonance to blame?

Please join us as Dana Gardner, Principal Analyst at Interarbor Solutions, and Adrian Ludwig, CISO at Atlassian, dive deeper into these more human elements of IT security and discuss how adjusting the culture of security within the organization is imperative in order to be resilient.

How to Migrate Your Organization to a More Security-Minded Culture

As the API economy accelerates, providing business services are increasingly being built using microservices and APIs. Join us on this webinar to learn how to manage your application APIs - understand the difference between internal, external and backend APIs, learn what API technology is right for your products and services and how to understand and manage the underlying performance implications and media transmissions, API security, and what you need to know about API compatibility and versions.

Managing API Driven Applications

So we know the basics of API hacking, now it's time to go deeper, in this webinar we'll move from beginner introductions to a checklist that you can follow when you conduct API testing. In addition, we'll also start to talk about API tools and what tools hackers use to test APIs from the outside. This webinar will provide a checklist for those who are familiar with API testing already and just want to focus on actionable testing

API Testing Methodology

One of the biggest problems API hackers face is attack surface, while developers know the API endpoints, external testers do not. In this webinar, we'll discuss how you perform recon on an API in order to find new routes, parameters. Exploring an APIs attack surface from the outside and some of the API tools available to help you do this.

API Recon Explained

Observability, for applications, is the design and delivery of data from telemetry signals to provide the ability to infer and discover how the applications (and subsequently, their infrastructure) are behaving. Collecting this telemetry data is one of the most important things when it comes to Observability. In this episode of talkin’ Observability, we will be talking with Pavol Loffay who is one of creators of Hypertrace Java Agent and worked significantly on projects like OpenTelemetry, Jaeger and, Hypertrace, about telemetry data collection, OpenTelemetry project and hear his advice for people who are getting started with Observability.

Telemetry for Observability

Application Management

Observability

Telemetry

App Analytics

Cloud computing has exploded over the past few years, delivering a previously unimagined level of workplace mobility and flexibility. The cloud computing community on BrightTALK is made up of thousands of engaged professionals learning from the latest cloud computing research and resources. Join the community to expand your cloud computing knowledge and have your questions answered in live sessions with industry experts and vendor representatives.

Cloud Computing

Increasing expectations for good governance, effective risk management and complex demands for corporate compliance are presenting a growing challenge for organizations of all sizes. Join industry thought leaders as they provide you with practical advice on how to implement successful risk and compliance management strategies across your organization. Browse risk management resources in the form of interactive webinars and videos and ask questions of expert GRC professionals.

IT Governance, Risk and Compliance

The application development community features top thought leadership focusing on optimal practices in software development, SDLC methodology, mobile app development and application development platforms and tools. Join top software engineers and coders as they cover emerging trends in everything from enterprise app development to developing for mobile platforms such as Android and iOS.

Application Development

Enterprise applications have become a crucial piece of infrastructure for many businesses. The enterprise applications community on BrightTALK features the latest insights in enterprise application integration, enterprise application architecture and EAS software. Join the community to gain access to thousands of videos and webinars presented by recognized enterprise information systems experts and arm yourself with the knowledge you need to succeed.

Enterprise Applications

Join thousands of engaged IT professionals in the application management community on BrightTALK. Interact with your peers in relevant webinars and videos on the latest trends and best practices for application lifecycle management, application performance management and application development.

As an IT professional, many of the problems you face are multifaceted, complex and don’t lend themselves to simple solutions. The information technology community features useful and free information technology resources. Join to browse thousands of videos and webinars on ITIL best practices, IT security strategy and more presented by leading CTOs, CIOs and other technology experts.

Telemetry for Observability

Presented by

About this talk

More from this channel