Alissa Knight, partner at Knight Inc Media, shares her insights into how to protect your APIs and what's in store with the latest version of FHIR.

Specifically, we cover:

• Avoid prison yellow and become an ethical hacker

• Authentication doesn’t equal authorization

• Protect against BOLA with scopes

• Don’t use WAFs to protect your APIs

• Know what traffic is going to your API

• Shift left security. Shield right.

• PHI is worth 1,000X credit card info

• APIs are the weakest link in healthcare

• APIs have multiple attack surfaces

• Banning apps from jail-broken phones doesn’t help

• Use MobSF to find API keys

• APIs need to comply with FHIR

• Implement FHIR correctly

• Get FHIR certified

• FHIR certification versus HIPAA compliance

• There’s no one right solution for API security

• Instrument your APIs