Application Security Weekly (Video)

Latest Episodes:

Critical OpenSSL Vuln, SQLite Vuln, Apple Security Blog, Randomness & Shuffling - ASW #218 Nov 01, 2022

Show notes

A critical OpenSSL vuln is coming this Tuesday, a SQLite vuln, Apple blogs about memory safety and bug bounties, determining a random shuffle

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw218

Understanding Web3 Application Security - Sandy Carielli, Martha Bennett - ASW #218 Nov 01, 2022

Show notes

The Web3 ecosystem is chock full of applications and projects that have lost money (and their customers' money) due to breaches, code flaws, or outright fraud. How can security teams do a better job of protecting Web3 apps? Web3 applications (including NFTs) aren't just vulnerable to attack, they often present a broader attack surface (due to the distributed nature of blockchains) at the same time as being a desirable target because of the value association with tokens. Join us for a lively discussion about key threats to Web3 apps – both on-chain and off-chain - what we can do to mitigate them…and what we absolutely should not do.

Additional resources

- https://www.bloomberg.com/features/2022-the-crypto-story/

- https://web3isgoinggreat.com

- https://blog.trailofbits.com/2022/06/21/are-blockchains-decentralized/

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw218

Text4Shell, GUAC for SLSA, OpenSSF Scorecards, Toner Deaf, OWASP Elections - ASW #217 Oct 26, 2022

Show notes

Text4Shell isn't a new patching hell, using supply chain info with GUAC, OpenSSF Scorecards and metrics, Toner Deaf firmware persistence, upcoming OWASP Board Elections, Chrome browser exploitation

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw217

Kubernetes, Container and Cloud Best Practices for Securing Cloud Apps and Hardening - Kong Yew Chan - ASW #217 Oct 25, 2022

Show notes

Learn what keeps DevOps and SecOps up at night when securing Kubernetes, container, and cloud native applications, what tactics are best for developers and application architects to consider when securing your latest cloud application and hardening your CI/CD pipeline and processes.

This segment is sponsored by Qualys. Visit https://securityweekly.com/qualys to learn more about them!

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw217

FortiOS Exploit, Linux Kernel Wi-Fi Vulns, Infosec Communities, Secure Coding - ASW #216 Oct 18, 2022

Show notes

Exploiting FortiOS with HTTP client headers, mishandling memory in Linux kernel Wi-Fi stack, a field guide to security communities, secure coding resources from the OpenSSF, Linux kernel exploitation

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw216

How NVIDIA Uses AI to Address Cybersecurity Challenges - Jason Recla - ASW #216 Oct 18, 2022

Show notes

Cybersecurity is a data problem. Accelerated AI enables 100 percent data visibility and faster threat detection and remediation. Find out how NVIDIA used AI to reduce cybersecurity events from 100M per week to up to 10 actionable events per day, and accelerate threat detection from weeks to minutes.

Segment Resources:

Morpheus new digital fingerprinting GTC Fall 22 Demo Video: https://www.youtube.com/watch?v=8rEPkHRvDq0

Morpheus Web Page: https://developer.nvidia.com/morpheus-cybersecurity

Morpheus Digital Fingerprinting Blog: https://developer.nvidia.com/blog/fingerprinting-every-network-user-and-asset-with-morpheus/

Detecting Threats Faster with AI-Based Cybersecurity Blog: https://developer.nvidia.com/blog/detecting-threats-faster-with-ai-based-cybersecurity/

Enroll in our free, self-paced, 1-hour DLI course : https://courses.nvidia.com/courses/course-v1:DLI+T-DS-02+V1/

Try Morpheus in NVIDIA LaunchPad: https://www.nvidia.com/try-morpheus

Download Morpheus from NVIDIA GPU Cloud: https://catalog.ngc.nvidia.com/orgs/nvidia/teams/morpheus/collections/morpheus_

Get started with Morpheus in GitHub: https://github.com/nvidia/morpheus

This segment is sponsored by NVIDIA. Visit https://securityweekly.com/nvidia to learn more about them!

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw216

Rust in the Linux Kernel, Uber Security Verdict, Prototype Pollution, PHP Composer - ASW #215 Oct 11, 2022

Show notes

Rust arrives in the Linux Kernel, verdict in the Uber security case, overview(s) of JavaScript prototype pollution, flaws in PHP Composer and the NPM vm2 package, reading CloudSecDocs

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw215

Creating and Curating Educational Resources for Secure Coding - Akira Brand - ASW #215 Oct 11, 2022

Show notes

We talk with Akira Brand about appsec educational resources and crafting better resources for developers to learn about secure coding.

Segment Resources:

- www.akirabrand.com

- www.wehackpurple.com

- www.owasp.org

- www.brightsec.com/blog

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw215

Exchange RCE, Patching at Scale, DORA Metrics, USENIX Best Papers, Passkeys - ASW #214 Oct 04, 2022

Show notes

Exchange RCE, bulk pull requests to patch at scale, metrics from DORA, best papers from USENIX, implementing passkeys

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw214

Critical Requirements for Cloud Native Application Security - Dean Agron - ASW #214 Oct 04, 2022

Show notes

The core focus of this podcast is to provide the listeners with food for thoughts for what is required for releasing secured cloud native applications

- Continuous, Multi-layer, and Multi-service analysis and focusing not only on the code, but also on the runtime and the infrastructure.

- Focus on the vulnerabilities that matter. The critical, exploitable ones. Use Context.

- Choose the right remediation forms. It may come in different shapes

Segment Resources:

Oxeye Website for videos and content - www.oxeye.io

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw214