Application Security Weekly (Video)

Latest Episodes:

Equifax's Breach, CISA's 1,000 Vulns, Rust's TLS Library, Complexity vs. Design - ASW #256 Sep 26, 2023

Show notes

A stroll back through the Apache Struts breach of Equifax, CISA's list of Known Exploited Vulnerabilities, Rust's replacement for OpenSSL, Go no longer throws programmers for a loop, complexity vs. design (that leads to better security).

Show Notes: https://securityweekly.com/asw-256

Supply Chain Security Security with Containers and CI/CD Systems - Kirsten Newcomer - ASW #256 Sep 26, 2023

Show notes

Supply chain has been a hot topic for a few years now, but so many things we need to do for a secure supply chain aren't new at all. We'll cover SBOMs, vuln management, and putting together a secure pipeline.

Segment resources:

Show Notes: https://securityweekly.com/asw-256

Azure's Eight XSS Vulns, CNCF's Two Security Audits, CISA's OSS Roadmap, Repojacking - ASW #255 Sep 19, 2023

Show notes

A slew of XSS in Azure's HDInsights, CNCF releases fuzzing and security audits on Kyverno and Dragonfly2, CISA shares a roadmap for security open source software, race conditions and repojacking in GitHub, and more!

Show Notes: https://securityweekly.com/asw-255

Stopping Business Logic Attacks: Why a WAF is no Longer Enough - Karl Triebes - ASW #255 Sep 19, 2023

Show notes

The majority of attacks are now automated, with a growing number of attacks targeting business logic via APIs, which is unique to every organization. This shift makes traditional signature-based defenses insufficient to stop targeted business logic attacks on their own. In this discussion, Karl Triebes shares how flaws in business logic design can leave applications and APIs open to attack and what tools organizations need to effectively mitigate these threats.

This segment is sponsored by Imperva. Visit https://securityweekly.com/imperva to learn more about them!

Show Notes: https://securityweekly.com/asw-255

Microsoft Dumps a Key, Grafana Logs a Key, URL Parsers Disagree, Old Bug in Ubuntu - ASW #254 Sep 12, 2023

Show notes

A key compromised from a crash dump (and the many, many lessons that followed), more examples of mishandling secrets, URL parsing mismatches show path traversal works well in Rust, an old Linux kernel bug shows how brittle code can be (even when it's heavily audited), an example of keeping OSS projects alive, a quick note on BLASTPASS, and a look at privacy in cars, and more!

Show Notes: https://securityweekly.com/asw-254

Building a Scanner and a Community with Zed Attack Proxy - Simon Bennetts - ASW #254 Sep 12, 2023

Show notes

Zed Attack Proxy is an essential tool for web app pentesting. The project just recently moved from OWASP to the Secure Software Project. Hear about the challenges of running an OSS security project, why Simon got involved in the first place, and why successful projects are about more than just code.

Segment Resources:

Show Notes: https://securityweekly.com/asw-254

Broadening What We Call AppSec - Christien Rioux - ASW Vault Sep 05, 2023

Show notes

Check out this interview from the ASW Vault, hand picked by main host Mike Shema! This segment was originally published on January 10, 2022. There's an understandable focus on "shift left" in modern DevOps and appsec discussions. So what does it take to broaden what we call appsec into something effective for modern apps, whether they're on the web, mobile, or cloud? We'll talk about moving on from niche offerings into successful appsec programs.

Show Notes: https://securityweekly.com/vault-asw-4

Go Crypto in Practice, Excel Executes Python, Protecting Users, DARPA Distills - ASW #253 Aug 29, 2023

Show notes

A Go Crypto presentation from Real World Crypto, Excel releases support for Python, protecting users from malware like the Luna Grabber and WinRAR RCE, DARPA's V-SPELLS project, and more!

Show Notes: https://securityweekly.com/asw-253

How Can Security Be Smart About Using AI? - Jeff Pollard - ASW #253 Aug 29, 2023

Show notes

We go deep on LLMs and generative AIs to shine a light on areas that security leaders should focus on. There are technical concerns like prompt injection and access controls, and privacy concerns in training and usage. But there are also areas where security tools are starting to address these concerns as well as areas where security tools are adopting AI themselves. We'll share where we see AI showing promise, as well as where we suspect it's still premature.

Segment resources:

https://www.forrester.com/blogs/defending-ai-models-from-soon-to-yesterday/
https://www.forrester.com/blogs/generative-ai-goes-mainstream-in-security-with-microsoft-security-copilot/
https://www.forrester.com/blogs/chatgpt-cybersecurity-ramifications-beyond-malware/
https://www.forrester.com/report/securing-generative-ai/RES179497
https://www.forrester.com/report/generative-ai-what-it-means-for-security/RES179522

Show Notes: https://securityweekly.com/asw-253

Discord.io Stops, Azure AD Pops, Zoom AI Drops, Model Confusion Attacks, Early XSS - ASW #252 Aug 22, 2023

Show notes

Discord.io ceases to be, Azure AD breach to get scrutiny from the CSRB, Zoom's AI stumbles show security concerns, model confusion attacks, a look at how far we have -- and haven't -- come with XSS flaws, an approachable article on AI, and more!

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw-252

Our TOPPODCAST Picks

Follow Us

Stay Connected

Application Security Weekly (Video)

Related Podcasts

Links

Stay Connected