APIsecure 2023
2023-03-14..2023-03-15
-- online --
who it's for
security engineers, penetration testers, application developers, API product managers, security researchers, engineering managers, chief information security officers
topics
GraphQL multipart exploitation; Jackson deserialization vulnerabilities; Android API pentesting workflow; Frida dynamic instrumentation; Burp Suite and Postman tooling; XGBoost HTTP request classifier; runtime API WAFs and blocking; OAuth 2.0 token exchange (RFC 8693); secret scanning for repositories; OWASP API Security Top 10 (2023); service mesh east-west inspectors; broken object level authorization
| title | author | length |
|---|---|---|
| Welcome and Opening Remarks [Day1] | Alissa Knight, Melissa Knight | 07m |
Opening remarks outline conference structure: three focused tracks — red track for penetration testers, blue track for defenders, and new purple track for… | ||
| Opening Keynote – Dr. Katie Paxton-Fear | Dr. Katie Paxton-Fear | 53m |
Shows concrete bugs and payouts: a graphql multipart endpoint reveals server tech, a Jackson deserialization chain triggers an application‑level DoS and nets a… | ||
| Apisecure, 14 & 15 March 2023 - Sagar Bhure, Security Engineer at F5. | Sagar Bhure | 55m |
Claims that a machine learning layer can detect API threats in near real time using a XGBoost binary classifier trained on 5 million labeled HTTP requests and… | ||
| Apisecure, 14 & 15 March 2023 - Gabrielle Botbol, Ethical Hacker | Award-winning Pentester [...] | Gabrielle Botbol | 56m |
Step-by-step Android API pentest workflow: build an Ubuntu lab with Android Studio emulator, ADB, Burp Suite, JADX and APKTool; import Burp CA into the VM and… | ||
| Apisecure, 14 & 15 March 2023 - Yoshiyuki Tabata, Software Engineer at Hitachi Ltd. | Yoshiyuki Tabata | 44m |
Proposes an API Gateway aggregator that lets clients call many backend gateways while moving policy enforcement to one layer, reducing per-gateway policy ops… | ||
| Apisecure, 14 & 15 March 2023 - Jose Palafox, Director of Business Development at GitHub. | Jose Palafox | 39m |
GitHub reports running secret scanning across public and private repos, detecting millions of leaked tokens as the platform reaches 100 million developers. A… | ||
| Apisecure, 14 & 15 March 2023 - Brian Joe, Co-Founder, Product at Impart Security. | Brian Joe | 43m |
Claims that APIs drive 83% of internet traffic and enterprises run >15,000 APIs lead to a combined approach: full runtime protection that inspects inbound and… | ||
| Apisecure, 14 & 15 March 2023 - Carolina Ruiz, CEO at Brier & Thorn By AI in API Security. | Carolina Ruiz | 44m |
Claims that ChatGPT public release Nov 2022 suddenly enables low-skill attackers to generate weaponizable code, with a demonstrated case of a user-created… | ||
| Apisecure, 14 & 15 March 2023 - Inon Shkedy, Co-Author of OWASP API Security Top 10. | Inon Shkedy | 01h 02m |
OWASP API Security Top 10 publishes a 2023 release candidate built from HackerOne and industry reports plus expert interviews and asks for community feedback… | ||
| Apisecure, 14 & 15 March 2023 - Giora Engel, CEO at NeosecDiscovery. | Giora Engel | 41m |
Claims that API counts have exploded — roughly 10x more APIs than legacy apps — and that common controls miss most of them: WAFs and gateways don’t see… | ||
| Apisecure, 14 & 15 March 2023 - Jeremy Snyder, CEO at Firetail. | Jeremy Snyder | 58m |
Firetail presents a decade-long breach analysis: 43 documented API incidents totalling 577 million records and an 13 million average per breach, with… | ||
| Apisecure, 14 & 15 March 2023 - Shannon Wilkinson, Cybersecurity Founder | Women in Technology [...] | Shannon Wilkinson | 32m |
APIs enable fast credential stuffing attacks and bot-driven buying (example: PlayStation scalpers), so defenses start with inventory, SBOMs and baselines of… | ||
| Apisecure, 14 & 15 March 2023 - Jean Burellier, Principal Software Engineer at Allianz Trade. | Jean Burellier | 57m |
Argues that an OpenAPI as source of truth lets teams generate TypeScript types and runtime validators so contracts are enforced everywhere, using tools like… | ||
| Apisecure, 14 & 15 March 2023 - Edmund Olson Morgan at Marsh McLennanOAuth. | Edmund Olson Morgan | 56m |
Enterprise use case: long‑lived vendor credentials get removed behind a proxy so third parties never hold service secrets. Implementation uses OAuth2… | ||
| Apisecure, 14 & 15 March 2023 - Megan Bell, CISO Contra Costa Health Services. | Megan Bell | 01h 01m |
Argues for incremental, repeatable security: use encryption as safe harbor, API gateways, tokens, Swagger validation, Docker golden images, dependency… | ||
| Escape Workshop: Discovering GraphQL Vulnerabilities in the Wild | Tristan Kalos, Alissa Knight | 38m |
A team scans 1.2 million domains (filtered for API or graphql), validates ~2,450 public GraphQL endpoints and fully scans ~1,600+, finding an average of ~30… | ||
| Apisecure, 14 & 15 March 2023 - Meenakshi Kaushik, Leader - Product Management at Cisco. | Meenakshi Kaushik | 16m |
Claim: API security prevents many breaches but stops short of protecting cloud‑native stacks and the software supply chain. Concrete steps shown: scan OpenAPI… | ||
| Apisecure, 14 & 15 March 2023 - Ted Miracco, CEO at Approov & Attestation. | Ted Miracco | 01h 02m |
Static analysis of 650 Android apps finds only 5 clean apps and 23% exposed high-value secrets; obfuscation shows negligible benefit and only 4% use… | ||
| Apisecure, 14 & 15 March 2023 - Nir Paz, Product Management at Standard.ai API Security. | Nir Paz | 01h 00m |
Practical checklist for securing APIs at small teams: identify concrete failures like open or broken authentication, object-level authorization and… | ||
| Apisecure, 14 & 15 March 2023 - Sudhir Chepeni, Director Products and Technology at Akamai. | Sudhir Chepeni | 49m |
Akamai data shows 6 billion web attacks per quarter and analysts report 80% of organizations building public-facing APIs, so API volume and risk are exploding… | ||
| Opening Keynote – Tushar Kulkarni | Tushar Kulkarni | 45m |
Open-source vapi demonstrates concrete API failures: a Dockerized Laravel + MySQL app with a Postman collection, Kubernetes support and live instance at… | ||
| Welcome and Opening Remarks [day2] | Alissa Knight, Melissa Knight | 06m |
Morning welcome notes announce a post-conference screening of Scorched Earth about an API hacker, confirm sessions on FHIR / HL7 healthcare security (with… | ||
| Apisecure, 14 & 15 March 2023 - Vaishali Nagori, Security Researcher at Appknox. | Vaishali Nagori | 30m |
Covers concrete business‑logic exploits and fixes: examples include unlimited Pro access by editing duration (changed 30→365 in the request), an API that… | ||
| Princess of Thieves: How I Robbed 30 Banks | Alissa Knight | 01h 01m |
Claims successful compromise of about 50 mobile banking and crypto apps, exposing hard‑coded production keys and credentials and leaving BOLA (broken object… | ||
| Apisecure, 14 & 15 March 2023 - Mike McCabe, President at Cloud Security Partners. | mike mccabe | 52m |
Shows how Terraform features let an attacker escalate from CI/CD to cloud: examples include remote-exec/netcat shell to get host access, local-exec or data… | ||
| Apisecure, 14 & 15 March 2023 - Parth Shukla, Security Analyst at Cequence Security. | Parth Shukla | 33m |
Demonstrates concrete GraphQL attacks and fixes: uses ffuf to find endpoints, GraphQL Voyager to map introspection output, and a batch testing tool to show how… | ||
| Apisecure, 14 & 15 March 2023 - Topher Marie, CTO and Cofounder at Strata Identity. | Topher Marie | 33m |
Proposes wrapping legacy APIs with a facade proxy that first routes raw traffic, then incrementally applies security, protocol transforms and externalized… | ||
| Apisecure, 14 & 15 March 2023 - John Moehrke, Co-Chair at Security Working Group. | John Moehrke | 45m |
FHIR (HL7) is a RESTful JSON/XML API spec that requires a published capability statement metadata endpoint telling exactly which resources and search… | ||
| Conference Closing Keynote [Day2] | Mehdi Medjaoui, Melissa Knight | 07m |
Organizers assert that API security as a standalone community emerges from an overlap of API practitioners and security ops, backed by concrete content: a new… | ||
| Closing Keynote Day 1 API First Hacking | Corey Ball | 35m |
Claim: APIs are the easiest path to data breaches, with attackers using endpoints rather than pivoting through networks. Cited breaches: T‑Mobile ~37M… | ||
| Apisecure, 14 & 15 March 2023 - Arik Atar, Threat Intelligence Researcher at Human Security. | Arik Atar | 01h 00m |
Claims that API endpoints become the preferred vector for credential stuffing, with observables showing a 72% increase in API-focused stuffing scripts; a… | ||
| Apisecure, 14 & 15 March 2023 - Jeremy Ventura, CISO at ThreatX. | Jeremy Ventura | 01h 01m |
Claims that APIs power at least 50% of B2B traffic and that assessments find 8–10x more APIs than teams expect; attackers use low‑cost solver services (<$500)… | ||
| Apisecure, 14 & 15 March 2023 - Brenton House, Vice President, Digital Evangelism at Software AG. | Brenton House | 43m |
Walks through the draft OWASP API Top 10 2023, names BOLA as still #1 and introduces new entries like broken object property level authorization, unsafe… | ||
| Apisecure, 14 & 15 March 2023 - Meenakshi Kaushik, Leader - Product Management at Cisco. | Meenakshi Kaushik | 32m |
Compares straightforward JSON regex scanning against a trained sequence model and shows tradeoffs: a hand‑built loop of pattern checks masks values quickly for… | ||
| Closing Remarks [day2] | Alissa Knight, Melissa Knight | 17m |
House rules: zero tolerance for product pitches with immediate ejection for salesy content. Announcements include Night TV Plus approved on Amazon Fire (Apple… | ||
| Apisecure, 14 & 15 March 2023 - Ian Douglas, Senior Developer Advocate at Postman. | Ian Douglas | 40m |
Shows how to turn an Open API v3 YAML spec into automated checks that catch spec errors and common API flaws. Uses Postman: fork the contract test generator… | ||
| Apisecure, 14 & 15 March 2023 - Christine Bevilacqua, Head Of Marketing at APIsec. | Christine Bevilacqua | 01h 06m |
Argues that API security moves left by auto-generating tests at the gateway, analyzing definitions and creating thousands of API-specific attack playbooks in… | ||
| Apisecure, 14 & 15 March 2023 - David Linthicum, Chief Cloud Strategy Officer at Deloitte Consulting | David Linthicum | 36m |
Argues that a meta‑cloud/supercloud — an abstraction and orchestration layer that maps thousands of heterogeneous APIs down to native cloud primitives — cuts… | ||
| Apisecure, 14 & 15 March 2023 - Grahame Grieve, Principal at Health Intersections Pty Ltd. | Grahame Grieve | 01h 04m |
FHIR is a JSON/REST standard that leaves security choices to implementers, so real-world deployments use the SMART on FHIR profile (OAuth2/OpenID) for auth… | ||
| Apisecure, 14 & 15 March 2023 - Rahul Dhawan, Senior Security Engineer at Postman. | Rahul Dhawan | 01h 01m |
Workshop shows automated detection and exploitation of OWASP API risks using Postman Interceptor and the Postman app against Juice Shop and VAPI labs. Concrete… | ||
| Apisecure, 14 & 15 March 2023 - Sean Falconer, Head of Marketing at SkyflowWhat. | Sean Falconer | 58m |
Argues that privacy is implementable as an API by isolating sensitive records into a data privacy vault that issues tokens instead of raw values. Describes a… | ||
| Apisecure, 14 & 15 March 2023 - Pieter Philippaerts, Research Manager at KU Leuven . | Pieter Philippaerts | 01h 00m |
An open source automated tester runs 113 test cases derived from 10 RFCs to map OAuth 2.0 server behavior, then projects results onto the RFC 6819 threat… | ||
| Apisecure, 14 & 15 March 2023 - Cherish Santoshi, Sr. Developer Relations Engineer at Orkes. | Cherish Santoshi | 35m |
API orchestration centralizes data transformation, runtime policies, RBAC and observability so distributed APIs become more resilient, secure and debuggable… | ||
| nothing matches | ||