Application Security Weekly (Video)

Latest Episodes:

The ABCs of RFCs - Heather Flanagan - ASW #266 Dec 12, 2023

Show notes

We have a lot of questions about standards. How do standards emerge? How do standards encourage adoption? How do they stay relevant as development patterns change and security threats evolve?

We have standards for web appsec (HTML, HTTP), all sorts of protocols, and all sorts of authentication (OAuth, OpenID). Learning how these standards come about can also inform how your own org documents designs and decisions.

Segment resources

Show Notes: https://securityweekly.com/asw-266

Extracting Data from ChatGPT, Vulns Around AI, Secure AI Guidance, LogoFAIL, BLUFFS - ASW #265 Dec 06, 2023

Show notes

Repetition extracts data from ChatGPT, more vulns in the software that surrounds AI, guidelines for secure AI, LogoFAIL trips a boot, BLUFFS attack on Bluetooth, CISA's first secure by design alert, Okta's updated breach disclosure, and more!

Show Notes: https://securityweekly.com/asw-265

All the News -- Just Six Months Later - ASW #265 Dec 05, 2023

Show notes

We cover appsec news on a weekly basis, but sometimes that news is merely about the start of a new project, sometimes it's yet another example of a vuln class, and sometimes it's a topic we hope doesn't become a trend.

So, what themes have we seen and where do we see them going? Here are a few headline topics that have alternately generated yays and yawns.

CISA's Secure by Design and Secure by Default
CVSS 4.0
Generative AI
MFA mandates
Microsoft, Rust, and Memory Safety
New TLDs
OAuth
OpenSSF and OWASP

Show Notes: https://securityweekly.com/asw-265

Randstorm, Nothing Chats, Platform Engineering, PyPI Security Audit - ASW #264 Nov 28, 2023

Show notes

Weak randomness in old JavaScript crypto, lack of encryption in purported end-to-end encryption, a platform engineering maturity model, PyPI's first security audit, vision for a Rust specification, and more!

Show Notes: https://securityweekly.com/asw-264

Starting with Appsec -- Is It More of a Position or a Process? - ASW #264 Nov 28, 2023

Show notes

This year we've talked about vulns, clouds, breaches, presentations, and all the variations of Dev, Sec, and Ops. As we end the year, let's talk about starting things -- like starting an appsec program or an appsec career. But is there still a need for an appsec team? Or has it turned into specializations for areas like cloud security and bug bounty programs? We'll cover careers and coding, with an eye towards figuring out what modern software development looks like and where application (or product!) security fits in that model.

Segment resources

Show Notes: https://securityweekly.com/asw-264

Platform Firmware Security - Maggie Jauregui - ASW Vault Nov 20, 2023

Show notes

Firmware security is complex and continues to be an industry challenge. In this podcast we'll talk about the reasons firmware security remains a challenge and some best practices around platform security.

Segment Resources:

Hardware Hacking created by Maggie: https://securityweekly.com/wp-content/uploads/2021/08/eArt-2.png

Show Notes: https://securityweekly.com/vault-asw-5

Fuzzing Strategies, Responding to CISA's Open Source Security RFI, 35 Year Old Worm - ASW #263 Nov 14, 2023

Show notes

CNCF's releases a handbook on fuzzing, OpenSSF and OWASP respond to CISA's Open Source Software Security RFI, 14 years of Go, lessons for today from an internet worm from 35 years ago, and more!

Show Notes: https://securityweekly.com/asw-263

How 2023 Changed Application Security and What's to Come in 2024 - Karl Triebes - ASW #263 Nov 14, 2023

Show notes

In the rapidly evolving landscape of application security, 2023 brought significant changes with the rise of generative AI tools and an increase in automated threats. In this discussion, Karl Triebes takes a deep dive into the major trends of the past year, examining their impact on the industry and shedding light on what security professionals can anticipate moving forward into 2024.

This segment is sponsored by Imperva. Visit https://securityweekly.com/imperva to learn more about them!

Show Notes: https://securityweekly.com/asw-263

Citrix Bleed, Atlassian Authz Vuln, OpenJS & jQuery, Secure Future Initiative - ASW #262 Nov 07, 2023

Show notes

Details of the Citrix Bleed vuln, exploitation of the Atlassian improper authorization vuln, so many jQuery installations to upgrade, the price of bounties and the cost of fixes, Microsoft's Secure Future Initiative, and more!

Show Notes: https://securityweekly.com/asw-262

Security from a Developer's Perspective - Josh Goldberg - ASW #262 Nov 07, 2023

Show notes

A lot of appsec conferences have presentations for appsec audiences -- but that's not often the group that's building apps. What if more developer conferences had appsec content? We talk with Josh about security from the developer's point of view, both as an audience hearing about it and as a presenter talking about it. We discuss the importance of knowing your audience and finding the hooks in security tools and topics that can resonate with developers.

Segment resources:

https://www.joshuakgoldberg.com/speaking/

Show Notes: https://securityweekly.com/asw-262

Our TOPPODCAST Picks

Follow Us

Stay Connected

Application Security Weekly (Video)

Related Podcasts

Links

Stay Connected