Application Security Weekly (Video)

Latest Episodes:

Microsoft Bounties & Edge Security, Strategic Bounty Programs, HTTP Desync Attacks - ASW #208 Aug 18, 2022

Show notes

Microsoft fixes an old bounty from 2019, rewards almost $14M on bounties in the past year, and releases a security layer for Edge; Black Hat talks on bounties and desync attacks, Google's bounties for the Linux kernel, modifying browser behavior, and the Excel championships.

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw208

Good, Not Perfect, AppSec - Tanya Janca - ASW #208 Aug 18, 2022

Show notes

Let's talk about adding security tools to a CI/CD, the difference between "perfect" and "good" appsec, and my upcoming book.

Segment Resources:

https://community.wehackpurple.com

#CyberMentoringMonday on Twitter

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw208

Auth Problems from Parsing, Slack's Password Hashes, Twitter's Info Breach - ASW #207 Aug 09, 2022

Show notes

Nextauth.js account takeover due to parsing flaw, URL parsing flaw in Go's net/url, another path traversal, Slack exposes password hashes (whaaat!?), Twitter exposes 5.4 million accounts, ransomware and research against PyPI and GitHub, videos from fwd:cloudsec 2022.

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw207

Agility Broke AppSec. Now It's Going to Fix It - Chen Gour Arie - ASW #207 Aug 09, 2022

Show notes

In today's high-tech industries, security is struggling to keep up with rapidly changing production systems and the chaos that agile development introduces into workflows. Application security (AppSec) teams are fighting an uphill battle to gain visibility and control over their environments. Rather than invest their time in critical activities, teams are overwhelmed by gaps in visibility and tools to govern the process. As a result, many digital services remain improperly protected. In this episode, we plan to address and discuss the current state of AppSec, and point out a few common failure points. Afterwards we plan to discuss what agile AppSec looks like, and how a reorganization, and a shift in management strategy could greatly transform the field, and allow business to truly address the risk of under-protected software.

Segment Resources:

https://appsecmap.com/

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw207

Smart Lock and Simple Vulns, Macros and Secure Defaults, Breaches and Costs - ASW #206 Aug 05, 2022

Show notes

Multiple vulns in a smart lock, Office Macros finally disabled by default, data breach costs and threat modeling, designing migration paths for 2FA

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw206

Reachability & Attackability - Manish Gupta - ASW #206 Aug 05, 2022

Show notes

A discussion of how the changes and advancements in static application security testing (SAST) and intelligent software composition analysis (SCA) have helped development and DevSecOps teams work better together to fix security issues faster.

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw206

Atlassian Vuln, Attacking OAuth, OpenSSF Security Audits, Tabletop Exercises - ASW #205 Jul 29, 2022

Show notes

Vuln in an Atlassian Confluence app, "Dirty Dancing" in OAuth flows, security audits of sigstore and slf4j, flaws in fleet management app, conducting tabletop exercises.

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw205

How to Build a Successful Continuous Application Security Program - Ferruh Mavituna - ASW #205 Jul 29, 2022

Show notes

Pressured by the speed of innovation, organizations are struggling to achieve the continuous web application security they need in the face of mounting threats and compliance requirements. What does it take in order for your AppSec program to be both effective and agile? In this segment, Ferruh Mavituna, founder and strategic advisor of Invicti Security, discusses best practices to help you implement an effective, agile, and – most importantly – continuous approach to application security.

This segment is sponsored by Invicti. Visit https://securityweekly.com/invicti to learn more about them!

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw205

0-Day Vulnerabilities & What's Next - Larry Maccherone - ASW #204 Jul 25, 2022

Show notes

0-day vulnerabilities pose a high risk because cybercriminals race to exploit them and vulnerable systems are exposed until a patch is issued & installed. These types of software vulnerabilities can be found through continuous detection but even then may not always have a patch available. It's important for software teams to set up tools that continually look for these types of flaws, as well as defenses that let software adapt itself to an evolving threat landscape. In this episode, we will discuss the ins and outs of 0-day vulnerabilities and what the future of managing them looks like.

Segment Resources:

Recent 0-day blog: https://www.contrastsecurity.com/security-influencers/contrast-protect-eliminates-another-zero-day-headache

What is Contrast Security video: https://www.youtube.com/watch?v=8FwY6zJX1ms

The Contrast Secure Code Platform video: https://www.youtube.com/watch?v=k5CycR4R6bg

This segment is sponsored by Contrast Security. Visit https://securityweekly.com/contrast to learn more about them!

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw204

Retbleed, CSRB's First Report, a Case-Sensitive Action, Mac Malware Book - ASW #204 Jul 19, 2022

Show notes

New speculative execution attack with retbleed, CSRB's report on log4j, one-line lowercase action leads to a vuln, approaching SOC2 with secure engineering principles, free online Mac Malware book

Visit https://www.securityweekly.com/asw for all the latest episodes!

Show Notes: https://securityweekly.com/asw204