Course Objective & Scope
Microservice architectures, mobile apps and partner integrations expose core business data directly through APIs. This course covers the OWASP API Security Top 10 risks (BOLA, BFLA, BOPLA, unrestricted resource consumption, SSRF and inventory gaps), OAuth 2.1/OIDC and JWT pitfalls, and securing REST, GraphQL and gRPC services.
In an authorised lab environment, participants test API endpoints, configure OpenAPI schema validation and rate-limiting policies, and build an internal pre-release API security checklist.
Who Should Attend?
- Backend and API developers, microservice architects
- Application security (AppSec) specialists and penetration testers
- DevOps/SRE teams managing API gateways and platform infrastructure
- Prerequisite: experience developing or operating REST APIs and solid HTTP fundamentals
Key Takeaways
- Detect and prevent object- and property-level authorization flaws (BOLA, BFLA, BOPLA)
- Configure OAuth 2.1, OIDC, JWT and mTLS authentication flows securely
- Block abuse using OpenAPI schema validation, rate limiting and payload size controls
- Apply targeted safeguards for GraphQL query depth/introspection and gRPC services
- Establish an API inventory and versioning checklist that eliminates shadow and zombie APIs
Curriculum
API Attack Surface and OWASP API Security Top 10
- How API security differs from traditional web security
- Analysing BOLA, BFLA and BOPLA (Excessive Data Exposure / Mass Assignment)
Authentication, OAuth 2.1, OIDC and JWT Security
- Authorization Code + PKCE, Client Credentials and token lifecycle management
- JWT signature validation pitfalls, key rotation and service-to-service mTLS
Schema Validation, Rate Limiting and Business Logic Protection
- Positive security modelling and input constraints with OpenAPI/JSON Schema
- Rate limiting, throttling, resource quotas and stopping automated abuse
GraphQL, gRPC and Third-Party API Integrations
- GraphQL introspection, batching attacks and query complexity limits
- Unsafe third-party API consumption, webhook signature verification and SSRF defense
API Gateways, Inventory Management and Security Testing
- Centralised security policies at the API gateway and discovering shadow/zombie APIs
- Automated API security testing in CI/CD and the pre-release checklist
Other Courses in This Category
-
Open-source dependency risks, SBOMs (CycloneDX/SPDX), the SLSA framework, artifact signing with Sigstore/Cosign and CI/CD hardening for DevSecOps and platform teams securing the software supply chain.
- Live Course
- 5 modules
-
MITRE ATT&CK-based adversary emulation, detection engineering and collaborative Purple Team exercises for offensive and defensive security teams closing visibility and detection gaps together.
- Live Course
- 5 modules
-
The NIST SP 800-61 lifecycle, incident triage, DFIR evidence collection, containment and root-cause analysis for security and IT teams managing cyber incidents under pressure.
- Live Course
- 5 modules
-
Log architecture, normalization, correlation rules, MITRE ATT&CK-based detection, alert triage and threat hunting for SOC analysts and security engineers reducing alert fatigue and catching real threats.
- Live Course
- 5 modules
-
SOAR playbooks, LLM and security agents for automated enrichment, alert triage, case summarization and human-in-the-loop response for SOC and security engineers scaling operations.
- Live Course
- 5 modules
-
Evasion, data poisoning, backdoors, model extraction and membership inference attacks and defenses under MITRE ATLAS for data science and security teams testing ML model robustness.
- Live Course
- 5 modules
Get in touch
