09:43 Only expose the interfaces that we need 10:02 Only collect and share the data that we need 11:58 legal 14:12 bad guy wants to have 14:38 no authentication or authorization 15:09 customized developed authentication and authorization system 15:58 API Gateway 16:50 some sort access management, OAuth 17:19 Consumption 17:23 smarter about our data 18:53 OAuth, OpenID standards 21:20 When the bad news comes, they don't go to the developers and blame them, they go to the security team, what API ?