Application Security Weekly (Video)

Latest Episodes:

Dead Code, CrowdStrike's Kernel Lessons, VMs & Security Boundaries, SLUBStick Attack - ASW #294 Aug 06, 2024

Show notes

The code curation considerations of removing abandoned protocols in OpenSSL, kernel driver lessons from CrowdStrike's crash, choosing isolation primitives, cross-cache attacks made possible by SLUBStick, and more!

Show Notes: https://securityweekly.com/asw-294

Building Successful Security Champions Programs - Marisa Fagan - ASW #294 Aug 06, 2024

Show notes

Even though Security Champions programs look very different across organizations and maturity levels, they share core principles for becoming successful. Marisa shares her experience in building these programs to foster a positive security culture within companies. She explains the incentives and rewards that lead to more engagement from champions and the benefits that come from so many people being engaged with security.

Segment Resources:

OWASP Security Champions Guide - Get Involved! - https://owasp.org/www-project-security-champions-guidebook/#div-getinvolved
OWASP Security Champions Guide - LinkedIn page - https://www.linkedin.com/company/owasp-security-champions-guide/
The Security Champions Success Guide - https://securitychampionsuccessguide.org/
"Building a Successful Security Champions Program... What Does it Take?" - https://www.katilyst.com/post/building-a-successful-security-champions-program-what-does-it-take

Show Notes: https://securityweekly.com/asw-294

A CISO's Perspective on AI, Appsec, and Changing Behaviors - Paul Davis - ASW #293 Jul 30, 2024

Show notes

Modern appsec isn't modern because security tools got shifted in one direction or another, or because teams are finding and fixing more vulns. It's modern because appsec is meeting developer needs and supporting the business. Paul Davis talks about how AI is (and isn't) changing appsec, the KPIs that reflect outcomes rather than being busy, and the importance of communication for security teams.

This segment is sponsored by JFrog. Visit https://securityweekly.com/jfrog to learn more about them!

Show Notes: https://securityweekly.com/asw-293

SAPwned, Squarespace Domain Hijacks, AIs Fixing Code, Infosec Investments - ASW #292 Jul 23, 2024

Show notes

SAPwned demonstrates tenets of tenant isolation, a weak login flow puts Squarespace domains at risk, how AIs might (or might not) be useful for fixing code, getting buy-in for infosec investments, and more!

Show Notes: https://securityweekly.com/asw-292

Where Generative AI Can Actually Help Security (And Where It Doesn't) - Allie Mellen, Farshad Abasi - ASW #292 Jul 23, 2024

Show notes

Generative AI has produced impressive chatbots and content generation, but however fun or impressive those might be, they don't always translate to value for appsec. Allie brings some realistic expectations to how genAI is used by attackers and can be useful to defenders.

Segment resources:

Show Notes: https://securityweekly.com/asw-292

A 2024 Appsec Report, Preparing for the AIxCC, Secure Design and Post-Quantum Crypto - ASW #291 Jul 16, 2024

Show notes

Cloudflare's 2024 appsec report, reasoning about the Cyber Reasoning Systems for the upcoming AIxCC semifinals at DEF CON, lessons in secure design from post-quantum cryptography, and more!

Show Notes: https://securityweekly.com/asw-291

Producing Secure Code by Leveraging AI - Stuart McClure - ASW #291 Jul 16, 2024

Show notes

How can LLMs be valuable to developers as an assistant in finding and fixing insecure code? There are a lot of implications in trusting AI or LLMs to not only find vulns, but in producing code that fixes an underlying problem without changing an app's intended behavior. Stuart McClure explains how combining LLMs with agents and RAGs helps make AI-influenced tools more effective and useful in the context that developers need -- writing secure code.

Show Notes: https://securityweekly.com/asw-291

State Of Application Security 2024 - Sandy Carielli, Janet Worthington - ASW #290 Jul 09, 2024

Show notes

Sandy Carielli and Janet Worthington, authors of the State Of Application Security 2024 report, join us to discuss their findings on trends this year! Old vulns, more bots, and more targeted supply chain attacks -- we should be better at this by now. We talk about where secure design fits into all this why appsec needs to accelerate to ludicrous speed.

Segment resources

https://www.forrester.com/blogs/ludicrous-speed-because-light-speed-is-too-slow-to-secure-your-apps/
They're also conducting a survey on how orgs use Top 10 lists. Provide your response at https://forrester.co1.qualtrics.com/jfe/form/SV_9Z7ARUQjuzNQf0q

Show Notes: https://securityweekly.com/asw-290

Polyfill Empties Trust, regreSSHion, CocoaPods Vulns & Secure Design, LLM Bughunters - ASW #290 Jul 09, 2024

Show notes

Polyfill loses trust after CDN misuse, an OpenSSH flaw reappears, how to talk about secure design from some old CocoaPods vulns, using LLMs to find bugs, Burp Proxy gets more investment, and more!

Show Notes: https://securityweekly.com/asw-290

Shared Responsibility Models, AI in Offensive Security, Apple's Private Cloud Compute - ASW #289 Jun 25, 2024

Show notes

Thoughts on shared responsibility models after the Snowflake credential attacks, looking at AI's current and future role in offensive security, secure by design lessons from Apple's Private Cloud Computer, and more!

Show Notes: https://securityweekly.com/asw-289

Our TOPPODCAST Picks

Follow Us

Stay Connected

Application Security Weekly (Video)

Related Podcasts

Links

Stay Connected