Katie Paxton-Fear
speaker
37 appearances
1 recordings
1 series
first heard Oct 2024
last heard Oct 2024
Katie Paxton-Fear’s voice in public audio — every appearance, attributed to the second.
Trend
recordings per month · last 12 monthsNo recordings in the last 12 months.Older appearances are listed below; set an alert to hear about the next one.
Appearances
Thank you so much for having me. It's a pleasure to be here.
Hi, my name is Katie. I'm also known by my handle Insider PhD. I am a cybersecurity YouTuber, a lecturer and an API hacker. I find the vulnerabilities and APIs before the bad guys do. And then I go on YouTube and teach other people how to do the same thing.
I've found vulnerabilities in companies all over the world that you've definitely heard of that I can't talk about because I've got an NDA, but there are certainly companies there. I have been to like tons of live hacking events. So that's where companies fly out some of the best hackers in the world just to focus on their software.
And I work at a company called Traceable that sells an API security solution. And I work in technical marketing, which means I write technical content. I get to be a professional API security influencer, which doesn't sound like it's a real job title, but I promise.
Knit.
I'm a huge crafter. I spend so long on the computer. I work so much and I'm a very creative person. And I'm very creative. I love making stuff. I love being able to build something. I was a software engineer before I went into cybersecurity and became more of a breaker than a builder.
But I always felt with working so much on a computer that it's so digital, it's so intangible that I wasn't feeling that fulfilled by it. So when I was at university, I decided to get a hobby that had absolutely nothing to do with computers. So I learned how to knit. I knit, I crochet, I sew, I do embroidery because this is an audio podcast.
You can't see it, but behind me, I have a giant Cthulhu that I crocheted in my office that I use as office decor.
Yeah, I think it's very easy to, you know, you don't get the same reward when you deploy code as you do when you physically can see something that's taken 30 hours of your life to produce and you can touch it and you can interact with it. It's why I think security people love lockpicking. Like everybody's hobby is lockpicking because we crave the material.
for people unaware an api is just a piece of software that isn't designed for humans to consume it's actually designed for other pieces of software to consume the results of so it means that apis are mainly used in integrated things so you want to connect your facebook up to your i don't know smart home That's an API.
If you have a mobile app that you want to share the same code base as a desktop app, you're going to use an API. APIs are so ubiquitous and they're such like an everyday thing. We could probably name one that you've used today. If you have a smart home, you use APIs.
if you have an app on your phone it's api everything is apis now because everything is apis and everything is interconnected they just get forgotten eventually all knowledge dies out as especially in technology when we've got the next big thing happening what happens to the old next big thing Everybody has jumped on AI and replacing everything with chat GPT.
But what is going to happen to everything else? The answer is the last developer who worked on it leaves the company and the company has no idea this API exists. The only record of this API ever existing was in the developer's head. Now that they're gone, they have no idea. And this creates such a massive security hole because maybe that API is written really well.
Maybe they were on the ball and that API is going to work for years More likely, though, it's going to be insecure and it's going to be the way that a bad guy gets in and actually manages to exploit the API. A lot of the time we hear things like shadow APIs, rogue APIs. We've even got threat actors publishing their own APIs now. So we've got evil APIs and just APIs that are undocumented.
There's very much a... While developers are trying to solve their regular technical debt, we've just added an extra layer on here for something else entirely.
first of all, is just how common they are. And the second thing is usually the amount of autonomy developers have. Developers can often produce whatever they need to get their job done. They don't have any guidelines. They don't necessarily have really strict ways of doing things. They work fairly autonomously. So if they need a new API, they'll just make it and put it up. So it's convenient.
Or potentially they make an API that they use for one project or they think they might use in the future. And then it never actually ends up being used as part of the main production hardware. There's a lot of different ways that these APIs get created. My favorite is one that I did when I was a developer. I installed a piece of software onto our server. And we never ended up using the software.
We never ended up buying it. The API is still out there to this day. I checked like last year and I left the company four years ago, more than six years ago. Six years ago, I left that company and the API is still up. It just gets forgotten.
A company has so many assets to worry about and developers have so much autonomy that they don't need to document everything they produce during their workday because that would be
crazy amount of work that would be and so you have this situation where you've got these apis that just created for the sake of convenience that they might be useful later they just end up never really getting decommissioned deleted or even disconnected from like a database
Showing 1–20 of 37 · page 1 of 2
Next →