Application Security Weekly (Video)

Latest Episodes:

Abusing OAuth, State of DevOps, Nightshade and AI, iLeakage, Sandboxing Apps - ASW #261 Oct 31, 2023

Show notes

OAuth implementation failures, the State of DevOps report, data poisoning generative AIs with Nightshade, implementing spectre attacks with JavaScript and WebAssembly against WebKit, sandboxing apps

Show Notes: https://securityweekly.com/asw-261

How Security Tools Must Evolve - Dan Kuykendall - ASW #261 Oct 31, 2023

Show notes

The categories of security tools that we're most familiar with have struggled to keep up with how modern apps are designed and what modern devs need. What if instead of being beholden to categories, we created tools that solved problems devs have today in the types of apps they build today? And what if we had more dev leadership to influence security tools as well as secure by design? What would that leadership look like?

Segment Resources:

https://danondev.com/youtube

Show Notes: https://securityweekly.com/asw-261

Okta Breach, SolarWinds RCEs, CISOs and Boards, Crypto Business Logic, Secure Design - ASW #260 Oct 24, 2023

Show notes

Appsec lessons from the Okta breach, directory traversal (and appsec) lessons from SolarWinds, how CISOs and Boards rank factors around vulns and patching, revisiting cryptocurrency attacks for lessons in business logic and threat modeling, CISA and friends update guidance on Secure Design, and more!

Show Notes: https://securityweekly.com/asw-260

OAuth, WebAuthn, and the Impact of Design Choices - Dan Moore - ASW #260 Oct 24, 2023

Show notes

We return to discussions of OAuth and all sorts of authentication. This time around we're looking at the design of authentication protocols, the kinds of trade-offs they weigh for adoption and security, and how a standard evolves over time to keep pace with new attacks and put to rest old mistakes.

Segment resources:

Show Notes: https://securityweekly.com/asw-260

HTTP/2 Rapid Reset, Curl's SOCKS5 Bug, Standardizing CycloneDX, AI Bug Bounty - ASW #259 Oct 17, 2023

Show notes

How HTTP/2's rapid reset is abused for DDoS, a look at the fix for Curl's recent high severity bug, OWASP moves to make CycloneDX a standard, Microsoft deprecates NTLM, VBScript, and old TLS -- while also introducing an AI bug bounty program.

Show Notes: https://securityweekly.com/asw-259

OT Security - Huxley Barbee - ASW #259 Oct 17, 2023

Show notes

It's no surprise that OT security has fared poorly over the last 30+ years. To many appsec folks, these systems have uncommon programming languages, unfamiliar hardware, and brittle networking stacks. They also tend to have different threat scenarios. Many of these systems are designed, successfully, to maintain availability. But when a port scan can freeze or crash a device, that availability seems like it hasn't put enough consideration into adversarial environments. We chat about the common failures of OT design and discuss a few ways that systems designed today might still be secure 30 years from now.

Segment Resources: https://linktr.ee/huxley_barbee

BSidesNYC: LinkedIn: https://www.linkedin.com/company/bsidesnyc/ Mastodon: https://infosec.exchange/@BSidesNYC

runZero has a tool that can safely discover your entire OT network: Free trial: https://www.runzero.com/try/signup/

Show Notes: https://securityweekly.com/asw-259

Curl's Impending Patch, Glibc's Looney Tunables, ShellTorch, Another Top 10 List - ASW #258 Oct 10, 2023

Show notes

Anticipating Curl's upcoming patch for a high severity flaw, the Looney Tunables flaw in Glibc, ShellTorch flaw hits PyTorch and lots of AI, lessons from some X.Org security patches, eBPF security, and more!

Show Notes: https://securityweekly.com/asw-258

Shifting Focus to Make DevSecOps Successful - Janet Worthington - Janet Worthington - ASW #258 Oct 10, 2023

Show notes

What if all these recommendations to shift left were more about shifting focus? It's all too easy to become preoccupied with vulns, whether figuring out how to find them earlier in the SDLC or spending time fixing them within specific number of days. Successful DevSecOps approaches can be so much more than just vulns and so much more than just tools. Sure, tools are useful for identifying known vulns in dependencies and new vulns in code, but teams that emphasize people and culture will find it easier to shift their attention to the security of their product and creating secure designs.

Segment Resources: Shift Everywhere is the bullet-train to secure software: https://www.forrester.com/blogs/shift-everywhere-is-the-bullet-train-to-secure-software/?refsearch=35020611696872306356 Forrester Software Composition Analysis (SCA) Wave: https://www.forrester.com/report/the-forrester-wave-tm-software-composition-analysis-q2-2023/RES178483?refsearch=35020611696863504716 Forrester Static Analysis Security Testing (SAST) Wave: https://www.forrester.com/report/the-forrester-wave-tm-static-application-security-testing-q3-2023/RES178489?scrollTo=FHqjnkXmzX

Show Notes: https://securityweekly.com/asw-258

A Deceptive Dependabot, Insecure JWT, CISA Wants HBOMs, OpenSSF's Critical Projects - ASW #257 Oct 03, 2023

Show notes

Attackers impersonate Dependabot commits, an alg of "none" plagues a JWT, CISA calls for hardware bills of materials, OpenSSF lists its critical projects, Exim (finally! maybe?) has some patches, bug bounties and open source projects, and more!

Show Notes: https://securityweekly.com/asw-257

Creating Presentations and Training That Engage an Audience - Lina Lau - ASW #257 Oct 03, 2023

Show notes

Communication is a skill that doesn't appear on top 10 lists, rarely appears as a conference topic, and doesn't appear enough on job requirements. Yet communication is one of the critical ways that security teams influence developers, convey risk, and share knowledge with others. Even our own Security Weekly site falls a little short with only a podcast category for "Training" instead of more options around communication and collaboration.

Lina shares her experience presenting to executives and boards in high-stress situations, as well as training incident responders on real-world scenarios.

Segment resources

Show Notes: https://securityweekly.com/asw-257

Our TOPPODCAST Picks

Follow Us

Stay Connected

Application Security Weekly (Video)

Related Podcasts

Links

Stay Connected