Is your API documentation telling the truth? In this episode, we dive into the uncomfortable reality that API documentation is often a "lie" because of the gap between Swagger files and what is actually running in production. We explore how attackers exploit this gap using advanced fuzzing techniques and JWT manipulation, and why a centralised defense strategy using Kong API Gateway is the only way to effectively secure modern microservices.

Key Topics Covered:

The JWT Illusion: We debunk the myth that JSON Web Tokens (JWTs) are inherently secure. Because JWTs are encoded rather than encrypted, anyone who intercepts a token can read its payload in seconds. We discuss how attackers exploit servers that "trust" whatever a token says without a second opinion, leading to unauthorized admin access through signature flaws or "alg: none" exploits.

The Power of API Fuzzing: Learn how attackers use the predictability of REST naming conventions to guess hidden routes. We highlight the use of high-speed tools like ffuf to fire tens of thousands of requests at a server to map out an application's shadow attack surface.

The 405 Signal: Discover the "single most useful technique" in API discovery: the 405 Method Not Allowed response. While many security teams ignore this, it tells an attacker exactly where hidden admin or registration endpoints exist, even if they are unauthorized to access them at that moment.

The Microservice Security Trap: Why writing security logic into every individual microservice is a "losing strategy". We explain how this creates a patchwork of inconsistent controls where one weak, legacy service can compromise the entire perimeter.

Centralising Defense with Kong Gateway: We break down how Kong acts as a gatekeeper, ensuring no request reaches the backend without passing through global security controls. Learn how to use rate limiting to kill automated attacks and the critical importance of disabling direct access to backend server IP addresses.

Featured Experts: This episode draws on a hands-on workshop led by Marudhamaran Gunasekaran, Principal Security Consultant, and insights from Aditya Patni, Security Research Writer at Practical DevSecOps.

Call to Action: Stop relying on optional security suggestions. If you want to build real-world API security skills, check out the Certified API Security Professional (CASP) program, which focuses on hands-on labs rather than multiple-choice theory. You can also watch the full API Security Workshop on the Practical DevSecOps YouTube channel to see these exploits and defenses in action.

Don't let an attacker find your hidden endpoints before you do.

https://www.linkedin.com/company/practical-devsecops/
https://www.youtube.com/@PracticalDevSecOps
https://twitter.com/pdevsecops

n this episode, we tackle the rapidly evolving landscape of artificial intelligence and the critical need for specialized security expertise. As Large Language Models (LLMs) and autonomous agents become integrated into the modern enterprise, they bring a new set of risks, including prompt injection, training data poisoning, and insecure plugin designs.

To help you navigate your career path in this high-demand field, we provide an in-depth comparison of two premier certifications: the Certified AI Security Professional (CAISP) from Practical DevSecOps and the Advanced AI Red Teaming (OSAI) from OffSec.

What You’ll Learn in This Episode:

The Full-Spectrum Defensive Path: We explore why CAISP is the top choice for security engineers, AppSec leads, and DevSecOps professionals. Discover how it covers the full AI security lifecycle, from threat modeling with STRIDE and StrideGPT to securing AI pipelines against "poisoned pipeline" attacks.

The Offensive Specialist Path: We dive into the OffSec OSAI, a certification designed for dedicated Red Teamers. Learn about its focus on adversarial operations, Retrieval Augmented Generation (RAG) abuse, and its grueling 48-hour endurance exam.

Practical Skills for the Real World: We discuss the importance of hands-on experience. CAISP offers browser-based labs that allow you to start practicing immediately, covering essential frameworks like the OWASP LLM Top 10 and MITRE ATLAS.

Career Growth and ROI: Understand the market demand that is driving a 15-20% salary increase for professionals who transition into AI-focused roles. We also explain how digital badges from platforms like Credly can help you prove your expertise to hiring managers.

The Ultimate Comparison: We break down the key differences in exam styles—CAISP’s 6-hour practical challenge versus OSAI’s 48-hour red team engagement—to help you decide which path aligns with your professional goals.

Which Certification is Right for You? Whether you are looking to build and defend production AI systems or specialize in high-level offensive exploitation, this episode provides the roadmap you need to stay relevant. CAISP is the industry favourite for those needing versatile, job-aligned skills to manage supply chain risks with AIBOMs and model signing, while OSAI is the definitive choice for full-time penetration testers.

Join us as we break down the complexities of AI security and help you take the next step in your cybersecurity journey.

https://www.linkedin.com/company/practical-devsecops/
https://www.youtube.com/@PracticalDevSecOps
https://twitter.com/pdevsecops

In this episode, we dive deep into the SLSA (Supply-chain Levels for Software Artifacts) framework, the definitive standard for securing your software supply chain. With software supply chain attacks increasing by 742% between 2019 and 2022, understanding frameworks like SLSA—pronounced "salsa"—is no longer optional; it is an operational reality.

We explore the origins of SLSA, which began at Google as "Binary Authorization for Borg" before being contributed to the Open Source Security Foundation (OpenSSF) in 2021. We break down what SLSA provides: a common vocabulary for security maturity, verifiable provenance metadata, and incremental security levels that align with NIST SSDF and EO 14028 requirements.

Join us as we dissect the four SLSA security levels, from Level 0 (the default state of no provenance) to Level 3, which mandates hardened builds with isolated and ephemeral environments. We discuss how these Level 3 protections could have potentially stopped major breaches like the SolarWinds attack by preventing persistent access to build environments and isolating signing keys. We also touch on other high-profile incidents like Codecov and Log4Shell that highlight the urgent need for artifact integrity.

The episode also covers the technical mechanics of SLSA, specifically "provenance"—the tamper-evident metadata that answers who built an artifact, what sources were used, and how it was constructed. We examine the Sigstore toolchain, including Cosign, Fulcio, and Rekor, which enables the "keyless" cryptographic signing essential for modern supply chain security.

For those ready to move from theory to practice, we outline a implementation roadmap starting from Level 1 (fully scripted builds) to Level 3 (enforced verification in production), a journey that typically takes between three to six months. We also highlight the critical roles of different stakeholders, from developers signing commits to organizations establishing policy enforcement at deployment boundaries.

Finally, we address the limitations of the framework—noting that it focuses on build integrity rather than code quality or runtime security—and point you toward the Certified Software Supply Chain Security Expert (CSSE) course for those ready to master these concepts through hands-on labs.

Whether you are an AppSec engineer, a security professional, or a cybersecurity analyst, this episode provides the practical, research-backed insights you need to defend against source tampering, dependency poisoning, and provenance forgery.

Key Topics Covered:

Defining SLSA and its role in the OpenSSF.

The 742% increase in supply chain attacks and lessons from SolarWinds.

The roadmap from Level 0 to Level 3 "Hardened Builds".

The power of Sigstore and cryptographic provenance.

Common implementation mistakes, such as skipping Level 1 or ignoring verification.

How to get certified as a Software Supply Chain Security Expert.

Upgrade your security career today by mastering the framework that secures the world's most critical workloads.

https://www.linkedin.com/company/practical-devsecops/
https://www.youtube.com/@PracticalDevSecOps
https://twitter.com/pdevsecops