Application Security Weekly (Video)

Latest Episodes:

Aviation ASCII Art, OpenSSH Double-Free, F5 Format String, OSC&R for Supply Chains - ASW #228 Feb 07, 2023

Show notes

The aviation equivalent of ASCII art, a memory safety issue in OpenSSH that might not be terrible, a format string in F5 that might be terrible, a new MITRE framework for supply chain security, programming languages and secure code

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw228

Myths and Lies in Infosec - Adrian Sanabria - ASW #228 Feb 07, 2023

Show notes

Most of the myths and lies in InfoSec take hold because they seem correct or sound logical. Similar cognitive biases make it possible for even the most preposterous conspiracy theories to become commonly accepted in some groups. This is a talk about the importance of critical thinking and checking sources in InfoSec. Our industry is relatively new and constantly changing. Too often, we operate more off faith and hope than fact or results. Exhausted and overworked defenders often don't have the time to seek direct evidence for claims, question sources, or test theories for themselves.

Resources

- https://www.usenix.org/conference/enigma2023/presentation/sanabria

- https://www.usenix.org/sites/default/files/conference/protected-files/enigma2023_slides_sanabria.pdf

- https://yourbias.is

- Discuss: What Makes a Good Breach Response? - ESW #303: https://www.youtube.com/watch?v=5RpZiVu3xEs

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw228

Source Leaks, BIND DoS, Refactoring Go to Typescript, Git Audit & Rust, SQL Slammer - ASW #227 Jan 31, 2023

Show notes

A $10M ransom demand to Riot Games, a DoS in BIND and why there's no version 10, an unexpected refactor at Twilio, insights in Rust from the git security audit, SQL Slammer 20 years later, the SQLMap tool

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw227

There Is No Average Behavior - Dr. David Movshovitz - ASW #227 Jan 31, 2023

Show notes

We speak with Dr. David Movshovitz about There Is No Average Behavior!

Segment Resources:

White paper: https://www.reveal.security/lp/white-paper/

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw227

Breach Disclosures, SSRF in Azure, Integer Flaws, Top 10 Web Hacking Techniques - ASW #226 Jan 25, 2023

Show notes

Breach disclosures from T-Mobile and PayPal, SSRF in Azure services, Google Threat Horizons report, integer overflows and more, Rust in Chromium, ML for web scanning, Top 10 web hacking techniques of 2022

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw226

Crafting Security Training for Secure Code and Security Culture - Marudhamaran Gunasekaran - ASW #226 Jan 24, 2023

Show notes

Developers write code. Ideally, secure code. But what do we mean by secure code? What should secure code training look like?

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw226

CircleCI Breach, Vulns in Auto Sites, Google Speaker Bugs, Office Space, S3 Defaults - ASW #225 Jan 10, 2023

Show notes

Exposed secrets from CircleCI, web hackers target the auto industry, $100K bounty for making Google smart speakers listen, inspiration from Office Space, AWS making better defaults for S3, resources for learning Rust

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw225

Securing your APIs using OAuth - Dan Moore - ASW #225 Jan 10, 2023

Show notes

This segment will discuss options for protecting your APIs. First, why protect them? Second, what are the options and the tradeoffs.

Segment Resources:

- https://stackoverflow.blog/2022/04/11/the-complete-guide-to-protecting-your-apis-with-oauth2/

- https://fusionauth.io/learn/expert-advice/

- https://fusionauth.io/learn/expert-advice/oauth/modern-guide-to-oauth

- https://oauth.net/2/

- https://tools.ietf.org/html/rfc6749

- https://datatracker.ietf.org/doc/id/draft-ietf-oauth-v2-1-07.html

- https://paseto.io

- https://securityboulevard.com/2021/11/biggest-api-security-attacks-of-2021-so-far/

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw225

Security Product Metrics, ML 101, PEACH for Cloud, Log4Shell Lookback, Appsec Tools - ASW #224 Jan 03, 2023

Show notes

Metrics for building a security product, hands-on image classification attacks, a proposed PEACH framework for cloud isolation, looking back at Log4Shell, building an appsec toolbox

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw224

DevSecOps Essentials - Keith Hoodlet - ASW #224 Jan 03, 2023

Show notes

How do you mature a team responsible for securing software? What are effective ways to prioritize investments? We'll discuss a set of posts on building talent, building capabilities, and what mature teams look like.

Segment resources:

- https://securing.dev/categories/essentials/

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw224