The Application Security Podcast

*/ ?>

Latest Episodes:

How Agentic AI Fails—and Which Controls Actually Stop It Sep 14, 2026

Most fault trees get built on gut feeling. Petra Vukmirovic did something rarer: she borrowed the actual math from aviation and nuclear-plant safety engineering and pointed it at AI agents. Petra traded emergency medicine for application security and now heads information security at Numan — and she joins Chris Romeo and Robert Hurlbut to make the case for fault tree analysis (FTA), the deductive method that picks up exactly where threat modeling stops. Petra walks through a "wrong customer refund" AI agent scenario step by step, showing how AND/OR gates and minimal cut sets turn vague worry into ranked, data backed probabilities. They dig into where AI helps build a tree, and where garbage in, garbage out still applies, why "comprehensive test coverage" is a myth, and how attaching real dollar figures to failure paths makes it easier to sell security controls to leadership.

This episode is sponsored by Corgea. Design it. Build it. Ship it. Corgea secures it.

About Corgea
Corgea is an AI-native application security platform that secures software from design to production. It brings together security design reviews, AI SAST, dependency and IaC scanning, code quality checks, and autonomous pentesting—helping security and engineering teams find risk earlier, fix what matters, and ship securely.
→ Learn more about Corgea

Connect with Petra Vukmirovic:
→ Petra Vukmirovic on LinkedIn
→ OWASP Threat Model Library

Mentioned in this episode:
→ Adam Shostack: "Stop Trying to 'Manage Risk'" (keynote)
→ OWASP Global AppSec USA 2026 (San Francisco, Nov 5–6)

Follow the Application Security Podcast:
➜ Home: appsecpodcast.com
➜ X: @AppSecPodcast
➜ LinkedIn: The Application Security Podcast
➜ YouTube: @ApplicationSecurityPodcast
➜ Instagram: @appsecpodcast
➜ Facebook: Application Security Podcast

Chapters:
00:00 Cold open — the math behind where to put your controls
01:09 Meet Petra Vukmirovic
01:28 Petra's origin story: from ER doctor to AppSec
02:50 Career path: engineer to Head of InfoSec at Numan
04:18 What is fault tree analysis, and where threat modeling ends
06:22 Can AI actually do fault tree analysis?
08:12 Walking the "wrong customer refund" agent example
12:33 Storing your trees: JSON vs. Markdown
16:08 Why conjunctive failures trip up narrow thinking
17:27 Top 3 failure modes when agents touch downstream systems
19:29 Real story: an agent pushed code to main without approval
21:27 Testing: why "comprehensive coverage" is a myth
23:54 How rough is rough? Assigning probabilities
28:08 Getting started without a six week science project
31:35 Using FTA to sell controls and build credibility
33:43 The epiphany: FTA is about controls, not faults
34:48 The one thing every agentic team should add today
35:48 Closing thoughts and OWASP Global AppSec USA preview

Your AppSec Bottleneck Is a People Problem Sep 07, 2026

Most security champions programs don't fail on tooling — they fail on people. Lisi Hocke spent three years as a champion before moving fully into product security, which means she has argued both sides of this from inside the trenches. Drawing on the talk she and Mireia Cano gave at OWASP Global AppSec EU 2026, Lisi walks us through the four things that actually make these programs work: psychological safety first, then cognitive load, then influence when you hold no formal authority, then a champions community so the whole thing doesn't stall the week security goes on vacation. We also get into cutting security wait times, winning organizational support, what AI does and doesn't change here, and why she will tell you never to record the champions meeting.

This episode is sponsored by Corgea. Design it. Build it. Ship it. Corgea secures it.

Connect with Lisi Hocke:
→ Lisi Hocke on LinkedIn
→ A Tester's Journey — Lisi's blog

Mentioned in this episode:
→ Slides: Security Champions — Lessons from Opposite Trenches (with Mireia Cano)
→ OWASP Juice Shop

Chapters:
00:00 Cold open — what psychological safety actually means
00:56 Meet Lisi Hocke
02:25 Lisi's security origin story
05:42 "That place was taken" — becoming a champion anyway
07:39 Moving into a full-time product security role
08:39 Meeting Björn Kimminich, the Juice Shop project lead
09:23 Why role play instead of a normal conference talk
12:27 Security and development, disconnected
14:19 The first full-time security role
15:14 Making people wait is the real damage
17:10 Cutting the backlog and the turnaround time
19:31 What Lisi got dead wrong
20:08 What testing and quality work taught her
21:31 The four things that make champions programs work
22:07 One: fostering psychological safety
24:50 Champions without their manager's blessing
28:45 Two: managing cognitive load
29:46 Three kinds of load, and which one to cut
31:21 Three: power sources when you have no formal authority
33:03 Four: build a champions community
34:38 Keeping security people from burning out
36:37 How AI changes who you recruit and what you need
39:32 Should AI change champions programs at all?
40:33 Psychological safety when a bot joins the meeting
42:25 Don't record the champions meetings
43:26 Programs that outlive the person who started them
45:59 Key takeaway and homework
47:21 Closing thoughts

AI Pen Testing Killed Traditional DAST Aug 31, 2026

Is traditional DAST finally dead? James Berthoty came back to settle the argument that his last episode started. James is the founder and analyst behind Latio, and he argues that AI pentesting is a genuinely different animal — payloads generated with context about your actual application, agents that chase findings the way a human tester would, and results a scanner was never going to produce. We get into what it costs once tokens enter the picture, who pays for them, whether a pentest on every pull request is realistic, and what stops an autonomous tester from going further than it should. Then we look further out: the future of bug bounties, what happens when cloud and model providers absorb today's security tooling, and who is accountable when an agent deletes your production database.

This episode is sponsored by Corgea. Design it. Build it. Ship it. Corgea secures it.

Connect with James Berthoty:
→ James Berthoty on LinkedIn
→ Latio
→ Latio Pulse

Mentioned in this episode:
→ Latio's free reports
→ James on the podcast the first time: Is DAST Dead? And the future of API security

Chapters:
00:00 Cold open — the results speak for themselves
01:01 Meet James Berthoty and the "Is DAST dead?" fallout
01:31 Chickens, eggs, and getting away from screens
03:46 Why we're revisiting the DAST question
04:14 A working definition of AI pentesting
05:47 Contextual payloads and application awareness
06:47 Determinism, repeatability, and what buyers actually want
07:46 Can you run an AI pentest on every code change?
09:43 What it really costs
10:40 Incumbents vs. AI-native vendors
13:27 Who pays for the tokens?
14:29 Bundling, platforms, and competitive pressure
16:25 AI across the whole development workflow
18:22 Agents that run all the way to deployment
19:21 A pentest on every pull request
21:52 What stops a pentest from going too far?
23:10 Permission scoping and guardrails
26:07 Where the findings actually land
28:02 The future of bug bounties
30:50 Why pentests command more budget than DAST
31:45 Could the cloud providers absorb security tooling?
34:38 What model providers could build instead
36:36 The same story on the code scanning side
39:24 Accountability when the tool misses something
40:22 Shared responsibility when an agent deletes production
41:23 The verdict on DAST
42:19 Where to find Latio's free reports
43:15 Closing thoughts

AI Security: OWASP Meets Global Standards Aug 26, 2026

AI security has no shortage of standards — the problem is turning them into something a team can actually use. Rob van der Veer has spent 34 years in AI and security, founded the OWASP AI Exchange, and created MOSAIC, the agreement that brought eight standards bodies together with SANS to stop the fragmentation. Rob explains what responsible AI really means, what the EU AI Act actually asks of you, and why most AppSec teams are still missing the point on AI-generated code. We also get into agentic red teaming, what happens when agents quietly exceed their scope, and whether AI finally levels the playing field between attackers and defenders. If you build software with AI in it — or with AI — this one is worth your time.

This episode is sponsored by Corgea. Design it. Build it. Ship it. Corgea secures it.

About Corgea

Corgea is an AI-native application security platform that secures software from design to production. It brings together security design reviews, AI SAST, dependency and IaC scanning, code quality checks, and autonomous pentesting—helping security and engineering teams find risk earlier, fix what matters, and ship securely.
→ Learn more about Corgea

Connect with Rob van der Veer:
→ Rob van der Veer on LinkedIn
→ OWASP AI Exchange
→ MOSAIC

Mentioned in this episode:
→ OpenCRE
→ Luna and the Magic AI Paintbrush

Chapters:
00:00 Cold open — don't be surprised when the AI breaks out of the cage
01:15 Meet Rob van der Veer: music, cycling, and the Hoodoo 500
05:24 Defining responsible AI
07:41 Fairness, protected attributes, and transparency
09:34 The EU AI Act and what regulation actually asks of you
11:27 How AI changes every part of software development
13:23 Where responsibility lands
15:20 You're not defending your own data center
17:19 What traditional AppSec teams consistently miss about AI
18:18 Finding vulnerabilities in AI-generated code
19:19 Too many standards — and using AI to write them
20:51 MOSAIC: eight standards bodies, one agreement
22:09 One machine-readable taxonomy with OpenCRE
23:06 Can AI level the field between attackers and defenders?
25:59 When AI security becomes security theater
26:56 What agentic red teaming actually looks like
29:44 When agents exceed their scope
32:43 Luna and the Magic AI Paintbrush
33:40 Do we sandbox the agents?
34:40 Guardrails without killing creativity
36:39 Skill atrophy when AI is your only way forward
40:04 "How do we hit this quarter?" and the pressure to ship
43:16 Everyone is selling agentic security
45:07 Key takeaways and where to start with the AI Exchange
47:12 Closing thoughts

The Future of Open-Source Threat Modeling Aug 16, 2026

You don't have to let AI do the thinking for you. In this episode, Vikram Narayan shares why the smartest teams use AI as an accelerant — not a replacement — and why human judgment still matters most in threat modeling. Vikram created Precogly, an open-source threat modeling platform now running as an OWASP project, and he walks us through what it took to build a free tool on par with commercial vendors. We dig into the tension among speed, compliance, and real risk; whether the Threat Modeling Manifesto needs amending for AI; and what it means to "fight the AI" so critical thinking stays sharp. If you care about AppSec, AI, and the future of threat modeling, this conversation will give you a lot to think about.

This episode is sponsored by Corgea. Design it. Build it. Ship it. Corgea secures it.

Connect with Vikram Narayan:
→ Vikram Narayan on LinkedIn
→ Precogly — open-source threat modeling (OWASP project)

Mentioned in this episode:
→ Threat Modeling Manifesto
→ ThreatModCon

Chapters:
00:00 Cold open — the threat model that "feels wrong"
01:22 Welcome and introductions
02:17 Vikram's security origin story
05:43 From machine learning research into LLMs
06:42 Hospital chatbots, hallucination, and knowing when to escalate
07:51 ThreatModCon and the case for an open-source threat modeling tool
09:35 IoT, emergence, and the traffic-light problem
11:17 The OWASP Vienna talk and the Threat Modeling Manifesto
12:26 Why "AI, just do the threat model" falls apart
15:14 What AI is actually good at in threat modeling
18:07 Human discomfort vs. the machine's confident answer
20:29 Inside Precogly: accelerant, not replacement
20:58 Library packs and the skills layer
24:50 Where AI kicks in — and where it shouldn't
27:48 Should the Threat Modeling Manifesto be amended for AI?
30:28 Where Chris and Robert land
31:36 Wi-Fi sensing, privacy, and modeling what you can't see
33:15 If you can't explain it, can you trust it?
35:11 Beyond checklists — design-level questions
35:59 Fight the AI — Vikram's key takeaway
39:10 Closing thoughts

Isaac Evans - AppSec in the Age of AI Jul 28, 2026

AI is moving AppSec's control point out of CI and directly into the coding agent—but what happens when the model writing the code is also expected to secure it? Semgrep co-founder and CEO Isaac Evans explains why deep background analysis and real-time agent plugins may replace universal rule sets with organization-specific security controls. He and Chris explore how security engineering roles will change, why independent verification still matters, and where business-logic flaws may become the next major battleground. The conversation also covers vibe coding at enterprise scale, the limits of reasoning about model behavior, open source in an agent-built world, and why Isaac sees more opportunity than threat even as AI creates a fresh wave of vulnerabilities and cleanup work.

Connect with Isaac Evans:
→ Isaac Evans on LinkedIn
→ Semgrep

Mentioned in this episode:
→ Semgrep
→ DeepSeek
→ Cursor
→ OpenAI Codex
→ Claude Code
→ Boston Dynamics
→ DARPA Robotics Challenge
→ Reflections on Trusting Trust
→ uutils/coreutils
→ Rust

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Isaac Evans
01:11 From cryptography to the DARPA Robotics Challenge
03:43 Founding Semgrep
04:05 How AI is reshaping AppSec
06:15 Attackers, defenders, and model choice
08:02 Regenerating code until it clears the security bar
10:30 Organization-specific rules beat universal rules
14:18 The changing role of the security engineer
17:53 Career advice for security practitioners
19:47 Will foundation models absorb security vendors?
24:18 Getting secure changes across an enterprise
26:40 Trusting Trust becomes the easy problem
27:41 How much should we trust agent-generated code?
29:38 Independent verification and competing models
34:50 Business logic flaws after SQL injection
36:56 Protecting the new wave of citizen developers
39:40 Vibe coding and disposable software
42:05 Open source in an agent-built world
44:10 Can the exponential pace continue?
44:41 Key takeaways and calls to action

José Carlos Chávez - When Museums Get Hacked: OWASP Top 10 Lessons from Heists Jul 21, 2026

Why do broken access control and injection still dominate the OWASP Top 10 despite years of mature tooling? Okta's José Carlos Chávez joins Chris to explain what changed in the 2025 list—and what stubbornly did not. Drawing on his path from software engineering and observability into security, José examines why ownership and root causes matter more than another scanner. They explore the rise of supply-chain and software-integrity failures, the fragile security model around downloaded AI skills and agent permissions, and the continuing need for immutable, trustworthy logging. Along the way, José uses museum heists to make the Top 10 memorable and shows how its categories connect. The result is a practical look at where AppSec teams should focus when familiar vulnerabilities persist and autonomous tools gain more access.

Connect with José Carlos Chávez:
→ José Carlos Chávez on LinkedIn
→ OWASP Coraza

Mentioned in this episode:
→ OWASP Top 10:2025
→ OWASP Coraza
→ Traceable
→ tj-actions/changed-files advisory (CVE-2025-30066)
→ Apache Kafka
→ Istio
→ Falco
→ OpenTelemetry
→ lodash
→ The left-pad incident

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet José Carlos Chávez
01:19 From software engineering to application security
04:54 Observability as a security foundation
10:32 Museums, heists, and teaching the OWASP Top 10
13:50 What changed in the OWASP Top 10 for 2025
17:31 Why broken access control is still number one
24:59 Why injection refuses to disappear
30:05 Supply chain risk vs. software integrity failures
34:11 Can you trust downloaded AI skills?
35:13 When an agent quietly controls your computer
38:29 Immutable logging and incident evidence
43:46 Root causes across the Top 10
49:08 Ownership is the key takeaway
52:07 Closing thoughts

Michael Burch - AI-Enabled Citizen Developers Jun 16, 2026

When every employee can generate working software, who owns the risk? Michael Burch, VP of AI Enablement and Acceleration at Security Journey, explains how AI is turning nondevelopers into citizen developers faster than enterprises can build guardrails around them. He and the hosts examine rollouts that hand GitHub and Claude Code to hundreds of employees, the danger of measuring adoption instead of business value, and why prompt libraries alone do not meet people where they work. Michael argues for sandboxed workflows, automated security controls, clear limits, and AI champion programs that quietly carry security practices into every team. The discussion closes on evaluating generated code, token-cost incentives, and the need to define a measurable outcome before buying licenses or opening production access.

Connect with Michael Burch:
→ Michael Burch on LinkedIn
→ Security Journey

Mentioned in this episode:
→ SecureMyVibe
→ Manicode Security
→ The Security Champions Podcast
→ OWASP Low-Code/No-Code Top 10
→ Claude Code

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Michael Burch
02:12 From Army Ranger to AppSec education
05:40 What is an AI-era citizen developer?
06:52 When low-code guardrails disappear
08:49 Giving GitHub to 200 nondevelopers
12:16 The rollout is already underway
13:23 What happens outside the pipeline
17:20 Training gaps and adoption without outcomes
20:03 Measuring ROI instead of usage
22:28 Why prompt libraries are not enough
25:28 Sandboxing citizen developers
28:36 Are organizations waiting for a breach?
29:56 Turn security champions into AI champions
32:00 How AppSec teams need to change
34:58 Guardrails, expectations, and saying no
38:41 Can developers evaluate generated code?
42:40 Token pricing and platform lock-in
44:36 When token usage becomes the wrong incentive
46:17 A practical plan for citizen development
48:28 Closing thoughts

Josh Grossman--AI & SAST: Is it a match? Jun 02, 2026

Traditional SAST is deterministic but shallow; AI can reason about context but may answer differently every time. Can the two approaches make each other better? Bounce Security CTO Josh Grossman explains why he built AGHAST, an open-source framework that combines static discovery with LLM analysis to investigate authorization, business-logic, and organization-specific risks. He walks through reducing false positives, importing SARIF, controlling token costs, and deciding where AI-assisted checks belong in developer workflows and CI. Josh also shares how he used Claude Code to build most of the project while retaining the architecture, product judgment, and code-review responsibility himself. The episode closes with AGHAST's roadmap, supported languages, practical adoption advice, and a guided demonstration of the tool.

Connect with Josh Grossman:
→ Josh Grossman on LinkedIn
→ OWASP AGHAST

Mentioned in this episode:
→ OWASP AGHAST
→ Semgrep
→ Cursor
→ Claude Code
→ SARIF
→ NDC Security
→ Black Hat
→ DEF CON
→ ISACA
→ Manicode Security

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Josh Grossman
01:11 Why Josh built AGHAST
04:22 Will AI disrupt AppSec tooling?
06:09 How AGHAST combines static analysis and AI
08:48 Deterministic rules and pure AI checks
10:23 Reducing SAST false positives
11:49 Using SARIF from existing scanners
12:46 Building AGHAST with Claude Code
14:14 The product specification and human judgment
17:48 How much code did the AI write?
19:05 The architect and product-manager mindset
21:08 Token economics becomes its own industry
22:54 Authorization and business-logic checks
25:55 Context makes custom rules valuable
28:15 Where AGHAST belongs in the workflow
30:11 Languages, frameworks, and COBOL
32:10 The AGHAST roadmap
34:20 Key takeaway and call to action
36:56 Training and conference appearances
37:29 AGHAST demonstration

Dwayne McDaniel -- Secrets Sprawl and How AI is Impacting Secrets May 14, 2026

GitGuardian found 29 million hard-coded secrets in public GitHub commits in one year—a 34% increase and its largest jump yet. Why is a supposedly simple problem getting worse? Principal Developer Advocate Dwayne McDaniel explains what the 2026 State of Secrets Sprawl report reveals about public and private repositories, AI coding tools, MCP server templates, and developer-targeted supply-chain attacks. He and Chris unpack why standing credentials persist, how private repositories create false confidence, and why frontier models may improve without solving the organizational problem. The conversation moves from detection to governance: short-lived identity, ownership, feedback loops, and the political will to remove embedded keys. Dwayne's core challenge is blunt—organizations already have better authentication patterns, so what will make them finally use them?

Connect with Dwayne McDaniel:
→ Dwayne McDaniel on LinkedIn
→ State of Secrets Sprawl 2026

Mentioned in this episode:
→ GitGuardian State of Secrets Sprawl Report 2026
→ LangChain
→ OpenRouter
→ DeepSeek
→ Mistral AI
→ Perplexity
→ Ox Security
→ SPIFFE
→ CNCF
→ AWS STS
→ OpenID Connect
→ GitHub Octoverse
→ Claude Code

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Dwayne McDaniel
00:39 Dwayne's path into secrets security
02:23 How GitGuardian builds the report
05:10 Where the private-repository data comes from
06:20 Twenty-nine million leaked secrets
09:15 Why the problem persists
12:37 Secrets, identity, and standing privilege
15:21 Three ways AI makes leakage worse
16:39 Explosive growth in AI-service credentials
17:57 MCP templates teach insecure authentication
20:08 Is Claude Code getting safer?
22:55 Hope for frontier models
24:36 What will the OWASP Top 10 become?
27:27 AI-assisted attacks target developers
30:29 Old supply-chain attacks at machine speed
33:06 What are organizations protecting now?
35:39 Private repositories are six times riskier
38:48 Moving from the problem to solutions
39:21 Does the organization have the will to fix it?
40:53 Governance and short-lived credentials
44:51 Closing thoughts

Tanya Janca - Secure Vibe Coding Apr 30, 2026

If AI writes all the code and the developer barely reads it, where does AppSec fit? Tanya Janca returns to define vibe coding and explain why models trained on insecure public code do not understand secure design by default. She and the hosts build a practical secure-vibe-coding framework: explicit requirements, human-led threat modeling, reusable security prompts, iterative review, SAST, and independent testing. Tanya shares hard-earned examples of Claude removing error handling, models confidently reviewing their own insecure output, and developers accepting enormous finding backlogs for code they did not enjoy writing. The discussion also examines whether security tooling will consolidate into AI platforms, how AppSec must be reimagined, and why continuous, embedded guidance matters more than occasional training. Tanya closes by introducing her DevSecStation podcast.

Connect with Tanya Janca:
→ Tanya Janca on LinkedIn
→ SecureMyVibe
→ DevSecStation

Mentioned in this episode:
→ SecureMyVibe
→ OWASP Top 10
→ Burp Suite
→ OWASP ZAP
→ DevSecStation
→ Tanya Janca (SheHacksPurple)
→ ChatGPT
→ Stack Overflow
→ The Security Table podcast

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Tanya Janca returns
02:10 What vibe coding actually means
04:03 AI adoption and how developers prompt
05:57 Treating AI like an intern
07:28 Do AI systems need parental controls?
09:34 Security prompts for everyday development
11:47 Models, memory, and protecting sensitive data
14:11 What happens when Claude goes away?
16:02 The most dangerous vibe-coding misconception
18:06 Threat modeling before AI writes the code
22:48 Using AI throughout the development lifecycle
25:32 A reusable secure-prompt framework
29:09 Expose security assumptions and challenge flattery
32:30 Reviewing an AI-generated codebase
36:09 Will AI platforms absorb security tooling?
37:39 Five million findings for code nobody wrote
42:19 The remaining pieces of secure vibe coding
43:52 Reimagining AppSec
45:25 Continuous guidance beats occasional training
46:05 Introducing DevSecStation
47:12 Closing thoughts

Caroline Wong--The AI Cybersecurity Handbook Apr 21, 2026

AI is multiplying the amount of software organizations produce, but security teams are not multiplying with it. Caroline Wong, author of The AI Cybersecurity Handbook and Chief Strategy Officer at Axari, explains how AppSec must change when agents generate code, make decisions, and assemble systems at machine speed. She and the hosts examine the growing backlog, the need for architecture and visibility, and why trust must be evaluated through accuracy, reliability, explainability, and accountability. Caroline also describes AI-augmented security teams as a practical response to constrained headcount and budgets. The conversation closes on preserving foundational knowledge, identifying roles most likely to change, and preparing now for a future that is arriving faster than traditional security programs can absorb.

Connect with Caroline Wong:
→ Caroline Wong on LinkedIn
→ Axari

Mentioned in this episode:
→ The AI Cybersecurity Handbook
→ Security Metrics: A Beginner's Guide
→ Cobalt
→ BSIMM
→ PCI DSS
→ ChatGPT

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Caroline Wong
02:52 Competitive jiu-jitsu away from the screen
05:41 Learning through discomfort and failure
09:01 Writing The AI Cybersecurity Handbook
11:41 Why the AI shift is different
14:05 How AI-generated code changes AppSec
15:55 The security backlog grows faster
19:14 Do we need to re-architect everything?
21:34 Keeping visibility into agent-built systems
25:45 Trusting AI in security work
27:12 Criteria for evaluating trust
29:58 Explainability and losing foundational knowledge
34:00 AI-augmented security teams
36:25 Doing more with fewer people and dollars
39:24 Understand how the technology works
40:55 Which security roles change first?
43:36 Caroline's key takeaway
44:16 Closing thoughts

Steve Wilson--OpenClaw and Advanced AI Agents Apr 15, 2026

OpenClaw makes always-on personal AI agents feel inevitable—and exposes how poorly prepared most organizations are for their autonomy. Steve Wilson, Chief AI and Product Officer at Exabeam and founder of the OWASP GenAI Security Project, returns to explain how advanced agents differ from chatbots and why their permissions, memory, and ability to act create a radically larger blast radius. He and the hosts explore source-code exposure, prompt injection, supply-chain risk, and the uncomfortable gap between rapid adoption and meaningful oversight. Steve also discusses the OWASP Agentic Security Initiative, emerging guidance for builders, and the limits of treating an agent like an intern. The episode closes with a practical challenge: learn how these systems work before trusting them with consequential access.

Connect with Steve Wilson:
→ Steve Wilson on LinkedIn
→ OWASP GenAI Security Project

Mentioned in this episode:
→ OpenClaw
→ Peter Steinberger
→ Lex Fridman Podcast — Peter Steinberger on OpenClaw
→ NVIDIA NemoClaw
→ Claude Code source leak
→ Tay
→ OWASP GenAI Security Project — Get Involved
→ OWASP Agentic Security Initiative
→ The Developer's Playbook for Large Language Model Security
→ OWASP Top 10 for LLM Applications
→ Claude Code
→ The Security Table

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Steve Wilson
02:34 A fifth visit to the podcast
04:21 What is OpenClaw?
07:03 From chatbot to always-on agent
10:16 Why personal agents feel different
13:16 The expanding blast radius
16:29 Permissions, memory, and persistent access
18:43 Security catches up to agent adoption
21:28 New tension between security and development
24:09 When an agent exposes source code
26:12 Understanding consequential failures
29:59 Threats that keep defenders awake
32:41 Agentic security guidance from OWASP
35:45 Why the intern metaphor falls short
38:18 Supervision and human accountability
41:41 Where advanced agents are headed
45:28 The one thing practitioners should do now
48:48 Closing thoughts

Brad Geesaman - Redefining AppSec with AI: Shrinking Toil, Expanding Impact - How LLMs are able to reduce toil in triage-heavy AppSec workflows Oct 28, 2025

AppSec teams are drowning in repetitive triage while the work that requires judgment keeps piling up. Brad Geesaman, Principal Security Engineer at Ghost Security, explains how large language models can shrink that toil without handing security decisions to an unreliable black box. He walks through using LLMs for classification, evidence gathering, and contextual analysis, with humans retaining final authority. Brad and Chris examine prompt engineering, trust, market disruption, and the limits of incumbent tools built around producing ever-larger finding queues. They also explore AI-assisted remediation, code drift, and the changing day-to-day work of AppSec engineers. The result is a pragmatic model for gaining leverage from AI while preserving the expertise, accountability, and skepticism that effective security still demands.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We provide application security training for not just your developers, but for all roles in your SDLC.
→ Learn more about Security Journey

Connect with Brad Geesaman:
→ Brad Geesaman on LinkedIn
→ Ghost Security Reaper

Mentioned in this episode:
→ Ghost Security
→ Reaper
→ Security Compass
→ OWASP ZAP
→ Burp Suite Professional
→ SQL Slammer
→ Code Red
→ Nimda
→ Exodus Communications
→ NetWitness

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Brad Geesaman
03:01 What toil means in AppSec
05:20 Why triage drains security teams
06:13 Where AI can create leverage
09:29 Does an LLM need custom training?
11:51 Prompt engineering for useful results
13:33 Humans remain at the center
15:23 Trusting probabilistic systems
19:30 A seismic shift in AppSec tooling
20:18 Escaping the pile of findings
24:00 How incumbent vendors are responding
25:46 Why platform shifts leave openings
28:31 The AppSec engineer's changing day
33:04 Moving from triage to code changes
35:36 AI-generated code and application drift
38:49 What Brad hopes comes next
41:51 Closing thoughts

OWASP Candidate Debate - 2025 Edition Oct 15, 2025

What should OWASP become, and which leaders have a credible plan to get it there? In this special 2025 Board of Directors candidate debate, nine candidates present their qualifications and answer the same questions about OWASP's future. The discussion tests concrete ideas for expanding education, improving global and chapter outreach, strengthening project support, finding sustainable funding, and making the Foundation's impact easier to measure. Candidates identify where OWASP performs well, where it falls short, and how they would balance ambitious programs against limited staff and volunteer capacity. Closing statements give each participant a final opportunity to define their priorities. The result is a direct comparison designed to help OWASP members make an informed choice before voting.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We help enterprises reduce vulnerabilities through application security education for developers and everyone in the SDLC.
→ Learn more about Security Journey

Connect with OWASP:
→ OWASP Foundation
→ 2025 Global Board Elections

Mentioned in this episode:
→ OWASP 2025 Global Board Elections
→ OWASP Global Board Candidates
→ OWASP Foundation
→ OWASP Dependency-Check
→ OWASP Dependency-Track
→ OWASP CycloneDX
→ OWASP Nettacker
→ OWASP ASVS
→ OWASP Security Champions Guide

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 The 2025 OWASP candidate debate
01:22 Debate format and opening question
02:24 Candidates introduce themselves
13:50 Sam Stepanian's introduction
16:05 Arunesh Salhotra's introduction
18:17 Arvind Janardhanan's introduction
22:02 How should OWASP increase its impact?
28:12 Comparing ideas for greater impact
31:59 What is OWASP doing poorly?
35:27 Project support and Foundation operations
38:57 Using data to increase influence
41:19 Indexing projects and regional review
44:01 Should OWASP grow more chapters?
48:43 A regional ambassador program
51:50 How would candidates fund their plans?
55:03 Corporate support and new funding
58:52 Candidate closing statements
64:37 Education as an OWASP priority
68:05 Debate conclusion

Francesco Cipollone - Agentic AI Manifesto Sep 23, 2025

Most products labeled as AI agents are little more than chatbots with tools. Francesco Cipollone, founder and CEO of Phoenix Security, explains what makes an agent genuinely agentic and why his team uses multiple specialized models instead of one all-purpose system. He and the hosts unpack the Agentic AI Manifesto's principles, including responsible adoption, human augmentation, transparency, and resisting automation for its own sake. Francesco also shares the practical economics behind multi-agent systems and the difficulty of applying them safely to vulnerability remediation. The conversation cuts through inflated promises while preserving a realistic case for useful automation: agents should increase human capability, remain observable and bounded, and solve a defined problem instead of becoming another vague digital-transformation initiative.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey is an enterprise-class solution with lessons that are built on learning science principles to deliver long-term, measurable results.
→ Learn more about Security Journey

Connect with Francesco Cipollone:
→ Francesco Cipollone on LinkedIn
→ Phoenix Security

Mentioned in this episode:
→ Phoenix Security
→ Cursor
→ ChatGPT

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Francesco Cipollone
02:36 Are you sure Francesco is not a bot?
04:41 Why create an Agentic AI Manifesto?
07:08 Defining a true AI agent
09:21 The agent is not the LLM
09:43 Six models working as specialists
12:12 Why not use one super agent?
15:05 The manifesto's core principles
18:27 Augment people instead of replacing them
21:17 The emerging AI coach role
23:37 Escaping digital-transformation theater
24:23 Transformation never really ends
27:46 Agents and vulnerability remediation
31:27 Closing thoughts

Simon Gibbs & Devika Gibbs -- Building Bridges with Games Sep 16, 2025

Security education often struggles because the people in the room are being talked at instead of invited to participate. Simon and Devika Gibbs, the duo behind CyberSec Games, explain how tabletop games can turn abstract security concepts into shared experiences that connect developers, security practitioners, and business teams. They trace their path from agile stationery into threat-modeling games, describe what they learned from Elevation of Privilege and OWASP Cornucopia, and discuss the community that helped shape their work. The pair also introduce the Cybersecurity Game Challenge, including who can enter, how ideas are judged, and what winning makes possible. Their larger argument is simple: play lowers barriers, creates conversation, and can make difficult security lessons memorable enough to change behavior.

Today's episode is brought to you by Security Journey.

About Security Journey
Our education platform teaches valuable secure coding skills based on real-world vulnerabilities and threats, including the OWASP Top 10.
→ Learn more about Security Journey

Connect with Simon and Devika Gibbs:
→ Simon Gibbs on LinkedIn
→ Devika Gibbs on LinkedIn
→ CyberSec Games

Mentioned in this episode:
→ CyberSec Games
→ Cybersecurity Game Challenge
→ Elevation of Privilege
→ OWASP Cornucopia
→ Threat Modeling Manifesto
→ Adam Shostack
→ EU Cyber Resilience Act

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Simon and Devika Gibbs
02:39 From business analysis to game design
05:36 Printing the Threat Modeling Manifesto
06:27 What is CyberSec Games?
08:38 Games bring people together
11:13 A welcome from the security community
14:34 Building bridges across disciplines
18:00 Discovering Elevation of Privilege
19:35 The return on a simple card deck
22:45 How popular are security games?
26:21 The Cybersecurity Game Challenge
28:43 Judges and community contributors
30:33 What can the winner receive?
32:12 A future security-game reality show
33:29 How and when to enter
35:07 The audience homework assignment

Akansha Shukla - Modern AppSec: Securing APIs with Threat Modeling and DevSecOps Sep 02, 2025

APIs power modern applications, yet many AppSec programs still cannot reliably inventory them, model their threats, or enforce authorization. Akansha Shukla draws on more than a decade in application security and DevSecOps to explain why API security remains immature and what practitioners can do about it. She and the hosts examine the OWASP API Security Top 10, broken object-level authorization, API-specific threat modeling, and the role of posture management. The conversation also asks why foundational controls such as input validation remain difficult despite strong framework support, and whether declarations that shift left is dead reflect reality or marketing. Akansha closes with practical guidance for building developer understanding, integrating security throughout delivery, and treating APIs as first-class elements of architecture rather than invisible plumbing.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We provide diverse training content and easy-to-digest lessons to meet individual learner needs. Learners report improving their knowledge as much as 85% on AppSec topics.
→ Learn more about Security Journey

Connect with Akansha Shukla:
→ Akansha Shukla on LinkedIn
→ Women4Cyber Mentorship Programme

Mentioned in this episode:
→ OWASP API Security Top 10
→ Burp Suite Professional
→ Women4Cyber Mentorship Programme
→ OAuth 2.0

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Akansha Shukla
03:11 Moving from engineering into security
06:13 Why development knowledge matters
09:09 Using the OWASP API Security Top 10
11:55 Authorization and API guardrails
14:46 Threat modeling APIs
17:26 Why teams skip API threat models
18:49 Is the barrier knowledge or process?
21:15 The role of API security posture management
22:25 Why API inventory is still difficult
24:41 Framework support versus real adoption
27:43 Did security make the paved road too hard?
28:14 Why input validation remains unsolved
29:39 Is shift left dead?
33:04 Akansha's key takeaway
34:55 Closing thoughts

Getting Ready for the EU CRA Aug 20, 2025

The EU Cyber Resilience Act turns product security from a best practice into a market-access requirement, and its effects extend well beyond Europe. Application Security Architect and OWASP SAMM core team member Nariman Aga-Tagiyev explains what manufacturers need to know about product classes, conformity assessments, vulnerability handling, software components, and enforcement. He and the hosts explore why global software companies should care, how the rules apply to commercial uses of open source, and what implementation may look like as regulators and assessors mature. Nariman then connects compliance to practical improvement through OWASP SAMM, BSIMM, DSOMM, and openCRE. His recommendation is to start with a maturity assessment now, identify gaps team by team, and use the regulation as leverage for sustainable security rather than a last-minute paperwork exercise.

Connect with Nariman Aga-Tagiyev:
→ Nariman Aga-Tagiyev on LinkedIn
→ OWASP SAMM

Mentioned in this episode:
→ EU Cyber Resilience Act
→ OWASP SAMM
→ BSIMM
→ OWASP DevSecOps Maturity Model
→ openCRE
→ Linux Foundation

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Nariman Aga-Tagiyev
02:48 From competitive programming to AppSec
05:40 Learning security through software architecture
09:21 Nariman's work with OWASP
09:49 What the EU Cyber Resilience Act changes
13:12 Product classes and conformity assessment
16:15 Will certification work across Europe?
17:17 How complicated is CRA compliance?
18:49 Does the Act reference OWASP SAMM?
20:49 Why should companies care?
21:44 Three perspectives on the regulation
25:40 Assessing readiness team by team
28:20 How the CRA treats open source
30:04 Commercial activity in the supply chain
34:19 How enforcement may develop
36:37 Start with a maturity framework
38:27 Mapping requirements with openCRE
39:49 Closing thoughts

Marisa Fagan - Measuring Security Culture Aug 05, 2025

Security champions programs rarely fail because the idea is bad; they fail because organizations launch without management support, meaningful incentives, or a plan to prove value. Marisa Fagan, Head of Product at Katilyst and a veteran security-culture practitioner, shares a practical blueprint for piloting and scaling a program that lasts. She explains how to recruit and motivate champions using status, access, power, and stuff, why a pilot should produce both learning and a business case, and which anti-patterns quietly destroy trust. Marisa and the hosts also examine metrics for security culture, the role of qualitative evidence, and how champion models can extend to privacy and accessibility. The episode offers concrete guidance for building participation without turning volunteers into unpaid security staff.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We provide application security training for not just your developers, but for all roles in your SDLC.
→ Learn more about Security Journey

Connect with Marisa Fagan:
→ Marisa Fagan on LinkedIn
→ Katilyst

Mentioned in this episode:
→ Security Champion Success Guide
→ OWASP Security Champions Guide
→ People-Centric Security
→ Katilyst
→ Kim Wuyts

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Marisa Fagan
03:02 What security culture means
05:44 Why security champions programs matter
08:36 Starting with organizational context
11:26 Recruiting the right champions
14:58 The components of an effective pilot
18:00 Turning a pilot into a business case
18:52 Motivating champions with SAPS
22:06 Status, access, power, and stuff
25:30 Common program anti-patterns
29:16 Chris's biggest champions-program mistake
32:15 Metrics that demonstrate success
35:02 Qualitative evidence and culture change
37:32 How security careers shape the advice
41:33 Creating space to share challenges
46:10 Beyond security champions
49:04 Closing thoughts

Aram Hovsepyan -- Your Security Dashboard is Lying to You: The Science of Metrics Jul 22, 2025

A dashboard full of green indicators can still describe an insecure organization. Aram Hovsepyan, founder and CEO of Codific and an OWASP SAMM contributor, explains why vulnerability totals and unexamined CVSS scores often measure activity instead of security outcomes. He introduces the Goal Question Metric framework as a way to begin with an organizational goal, ask what must be understood, and choose measurements that answer those questions. Aram and the hosts distinguish precision, reliability, and accuracy, examine how metrics shape behavior, and identify overlooked indicators that show whether a program is actually moving. They also discuss redesigning executive dashboards and testing a long-standing metric from Chris. The takeaway: a useful metric must support a decision, reflect context, and make its limitations visible.

The Application Security Podcast is brought to you by Security Journey.

Connect with Aram Hovsepyan:
→ Aram Hovsepyan on LinkedIn
→ Codific

Mentioned in this episode:
→ Goal Question Metric framework
→ LINDDUN
→ Codific
→ OWASP SAMM
→ Kim Wuyts
→ Security Compass
→ Toreon

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Why your security dashboard may be lying
01:25 Meet Aram Hovsepyan
02:43 From privacy research to AppSec
06:30 The inspiration behind the talk
09:44 How common security metrics fail
11:35 If every metric is green, are you secure?
13:23 Metrics drive human behavior
16:48 Introducing Goal Question Metric
18:38 Precision, reliability, and accuracy
22:05 Good numbers can answer the wrong question
26:43 Why total vulnerability counts mislead
28:30 The metrics teams overlook
31:52 Measuring movement, not perfection
33:13 Redesigning a security dashboard
35:04 Testing Chris's long-standing metric
38:22 What a useful metric must reveal
40:09 Closing thoughts

Sean Varga -- OWASP Top 10 for AppSec Sales Jul 15, 2025

We’re discussing the intersections of application security (AppSec) and sales strategy with our guest, Sean Varga. Sean shares the unique challenges and best practices in AppSec sales, like the importance of empathy, understanding customer needs, and community participation. Learn about the OWASP top 10 for AppSec Sales and discover how to achieve success by aligning with customer goals, maintaining detailed living documents, and fostering strong partnerships. AppSec meets sales strategy. This is not your typical security podcast, but a glimpse into how sales work in AppSec. As security practitioners, we must practice empathy. This is our chance. We're unpacking the OWASP Top 10, not for vulnerabilities, but for what drives successful AppSec sales.

Today's episode is brought to you by Security Journey.

About Security Journey
Our education platform teaches valuable secure coding skills based on real-world vulnerabilities and threats, including OWASP Top 10.
→ Learn more about Security Journey

Connect with Sean Varga:
→ DevOpsDays
→ BSides

Mentioned in this episode:
→ DevOpsDays
→ BSides
→ Crossing the Chasm
→ Veracode
→ Secure Code Warrior

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Sean Varga: OWASP Top 10 for AppSec Sales
09:00 I guess I want to ask kind of another question on
18:00 Yeah, I have a kind of a different perspective on this
20:14 You hit on something that is part of the frustration. Right
28:15 You're describing in my mind what is a consultative approach to
30:11 Yeah. So then we get to know your solution. Wait, you
33:51 Right
34:46 Mm-hmm. Let's, uh, we can jump over the understand all stakeholders
44:25 I'm going to give you a second to think about your

Sarah-Jane Madden -- What AI means for AppSec Jul 09, 2025

Sarah-Jane Madden joins Chris and Robert to ask what AI actually changes in software development—and what foundational practices still matter. Drawing on her OWASP Global AppSec EU keynote, she challenges the idea that AI makes the SDLC obsolete or turns every prompt into production-ready software. The conversation examines vibe coding, the difficulty of operationalizing AI-generated prototypes, skill atrophy, hallucinations, and the quality problems hidden by code that merely passes generated tests. Sarah-Jane argues for treating AI as a useful assistant rather than an unquestioned authority: engineers must preserve critical thinking, understand their systems, and verify the output. The episode closes with practical guidance for engineering leaders who want teams to gain efficiency from AI without surrendering judgment, accountability, or software quality.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We provide diverse training content and easy-to-digest lessons to meet individual learner needs.
→ Learn more about Security Journey

Connect with Sarah-Jane Madden:
→ Sarah-Jane Madden on LinkedIn
→ Nemo Resideo keynote at OWASP Global AppSec EU

Mentioned in this episode:
→ Nemo Resideo keynote at OWASP Global AppSec EU
→ Sarah-Jane Madden — Threat Modeling to Established Teams
→ GitHub Copilot

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Sarah-Jane Madden: What AI Means for AppSec
02:35 From an OWASP keynote to AI in software development
04:59 The biggest misconception about AI-assisted development
07:13 Why AI will not eliminate software development
11:58 Vibe coding and the production-readiness gap
15:46 Operationalizing AI-generated prototypes
17:53 Where AI helps inside the SDLC
23:58 Over-reliance, skill atrophy, and engineering judgment
27:00 Using AI for grunt work without losing core skills
29:38 Can developers trust large language model output?
33:36 Practical guardrails for responsible AI use

Dag Flachet -- Kaizen for your Appsec Program Jun 17, 2025

Dag Flachet joins us to discuss the concept of Kaizen and its application in improving application security. Dag shares his journey into the world of security, emphasizing the importance of iterative, small-step improvements. The conversation delves into how organizations can effectively implement maturity models to enhance their security programs, the limitations of compliance-focused frameworks like ISO 27,000 and SOC 2, and the practical application of Kaizen principles. They also explore the evolution and future updates of OWASP SAM, and the importance of empowering development teams through a bottom-up approach in security enhancement. Dag is the co-founder of Codific, a professor and board member at the Geneva Business School, and an active member of the OWASP Barcelona Chapter and the OWASP SAMM community.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Our training includes theory and immersive learning that teaches the skills and knowledge needed to create a security-first mindset across your organization.
→ Learn more about Security Journey

Connect with Dag Flachet:
→ Codific
→ OWASP SAMM

Mentioned in this episode:
→ Codific
→ OWASP SAMM
→ OWASP SAMM
→ OWASP DevSecOps Maturity Model (DSOMM)
→ openCRE.org
→ EU Cyber Resilience Act

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Dag Flachet: Kaizen for your Appsec Program
01:39 The thing that we love. Well, uh, we're joined by Dag
06:54 That'd be funny if she sent a message yet. Like, hey
13:20 Yeah, very cool. Well, as we mentioned, we're going to be
17:08 Which is, is DSOM part of SAM now or are they
22:08 This is an interesting thing, but maturity models have also evolved
24:44 Let's wrap this whole thing together now. We introduced Kaizen. We've
27:00 If we were to kind of dive a little bit deeper

Javan Rasokat and Andra Lezza -- When Chatbots Go Rogue - Lessons Learned from Building and Defending LLM Applications Mar 18, 2025

What happens when teams add large language models to real applications and discover that familiar AppSec controls are no longer enough? Andra Lezza and Javan Rasokat share lessons from building, breaking, and defending LLM-enabled systems at Sage and presenting their findings at DEF CON. They compare prompt injection with SQL injection, explain AI red teaming, and unpack hallucinations, retrieval-augmented generation, grounding, and model safeguards. The conversation also examines corporate data leaking through prompts, the limits of trusting model providers, and how the OWASP Top 10 for LLM Applications complements issues observed in production. Andra and Javan close with practical advice for developers, data scientists, and security teams: treat AI systems as a new attack surface, establish clear data boundaries, and test controls against realistic abuse cases.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Andra Lezza and Javan Rasokat:
→ Andra Lezza on LinkedIn
→ Javan Rasokat on LinkedIn
→ Javan Rasokat
→ AppSec Village

Mentioned in this episode:
→ Adversarial Misuse of Generative AI (Javan's blog article)
→ TLDR newsletter
→ The Cuckoo's Egg by Cliff Stoll
→ AppSec Village
→ DEF CON
→ ChatGPT
→ DeepSeek
→ NIST AI Risk Management Framework
→ OWASP Top Ten for LLM Applications project homepage

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 When Chatbots Go Rogue with Andra Lezza and Javan Rasokat
01:49 Andra’s path into application security
02:56 Javan’s path into application security
04:38 Lessons from building and defending LLM applications
08:22 Prompt injection compared with SQL injection
11:46 Critical vulnerabilities found in real AI systems
12:19 What AI red teaming actually means
13:46 Hallucinations, RAG, and grounding
19:51 Model safeguards and harmful requests
20:35 Common AI development and deployment mistakes
23:20 Corporate data exposure through prompts
29:59 OWASP Top 10 for LLMs versus real-world findings
32:02 Practical security advice for AI developers
34:36 Bringing security practices to data scientists
45:37 Key takeaways for defending LLM applications

Jim Routh -- The CISO Transition to the rest of life Mar 11, 2025

Former CISO Jim Routh discusses his perspective on retirement and career fulfillment in cybersecurity. Rather than viewing retirement as simply stopping work, Routh describes his three-filter approach: working only with people he respects and admires, doing only work he finds fulfilling, and controlling when he works. He shares valuable lessons learned about which post-retirement opportunities truly bring satisfaction and explains why he avoids certain roles. Routh emphasizes the importance of cybersecurity professionals taking ownership of their career development, recommending they focus on developing two specific skills annually rather than using tenure to guide career moves. Jim Ralph is currently on the boards of Savvy Security, Accountable Digital Identity Association, and the Global Resiliency Federation.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We help enterprises reduce vulnerabilities through application security education for developers and everyone in the SDLC.
→ Learn more about Security Journey

Connect with Jim Routh:
→ CISO Transition (LinkedIn article by Jim Routh)
→ Jim Routh on Twitter

Mentioned in this episode:
→ CISO Transition (LinkedIn article by Jim Routh)
→ Jim Routh on Twitter

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Jim Routh: The CISO Transition to the rest of life
03:15 Hey, I'm happy to be here, Chris. Appreciate the kind words
04:50 Yeah, I was recently, I was introduced to pickleball this past
07:12 Of course, it wasn't offered in school when I went to
13:20 Jim, what does the word retirement mean to you
16:02 Why
16:58 There's a lot of inertia dealing with that resistance, and that's
19:34 Yeah, that's very helpful just to get this kind of your
32:16 I think this conversation is something that should be helpful for
34:40 For instance, I wanted to serve on boards. Why
38:16 Just listening to you as we've kind of gone through this
42:05 Yeah, that's helpful. Unfortunately, no one has invented this time machine
44:53 Like, you, as long as you, you know, performed well, you
47:24 Opportunity that's helping you, enabling you to learn the skills you

Henrik Plate -- OWASP Top 10 Open Source Risks Mar 04, 2025

Henrik Plate joins us to discuss the OWASP Top 10 Open Source Risks, a guide highlighting critical security and operational challenges in using open source dependencies. The list includes risks like known vulnerabilities, compromised legitimate packages, name confusion attacks, and unmaintained software, providing developers and organizations a framework to assess and mitigate potential threats. Henrik offers insights on how developers and AppSec professionals can implement the guidelines. Our discussion also includes the need for a dedicated open-source risk list, and the importance of addressing known vulnerabilities, unmaintained projects, immature software, and more. Henrik Plate is the principal security researcher at Endor Labs. He formerly worked for SAP Security Research, where he led the focus topic open source security starting in 2014.

The Application Security Podcast is brought to you by Security Journey.

Connect with Henrik Plate:
→ The OWASP Top 10 Open Source Risks
→ Endor Labs

Mentioned in this episode:
→ The OWASP Top 10 Open Source Risks
→ Endor Labs
→ OpenSSF

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Henrik Plate: OWASP Top 10 Open Source Risks
01:42 We're back on the world of OWASP. We've, we've been away
04:39 Yeah, Henrik, uh, just curious. So, uh, we're talking about the
08:17 The order in this list mean something, or are these all
10:29 Yeah. So if I'm a developer, what, how do I use
12:47 I wonder if we could start to walk through the list
19:43 This, XZ was a more modern example of this, right
22:13 Yeah. And that's, and that's a common problem in the open
24:28 All right, so what is 4
28:28 Okay. So Robert, why don't you, uh, pick one between 8
31:57 All right, Henrik, we have 3 questions that we typically ask
35:01 Uh, the 3rd question is, what's your top book recommendation and

Tanya Janca -- A Secure SDLC from a Developer's Perspective Feb 26, 2025

Security expert Tanya Janca discusses her new book "Alice and Bob Learn Secure Coding" and shares insights on making security accessible to developers. In this engaging conversation, she explores how security professionals can better Tanya Jenka, aka She Hacks Purple, is the bestselling author of Alice and Bob Learn Secure Coding, Alice and Bob Learn Application Security, and Cards Against AppSec. Over her 28-year IT career, she's won countless awards, including the OWASP Lifetime Distinguished Member and Hacker of the Year. She has spoken all over the planet and is a prolific blogger. Tanya has trained thousands of software developers and IT security pros via her online academies, We Hack Purple and Semigroup Academy, and her live training programs.

Today's episode is brought to you by Security Journey.

About Security Journey
Our education platform teaches valuable secure coding skills based on real-world vulnerabilities and threats, including OWASP Top 10.
→ Learn more about Security Journey

Connect with Tanya Janca:
→ Ranakhalil1
→ Alice & Bob Learn Secure Coding

Mentioned in this episode:
→ Alice & Bob Learn Secure Coding
→ Confidence Staveley
→ Ranakhalil1
→ Laurabellmain
→ Adam Shostack
→ Liran Tal
→ OWASP Application Security Verification Standard (ASVS)
→ Tanya Janca (SheHacksPurple)

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Tanya Janca: A Secure SDLC from a Developer's Perspective
02:28 Glad, glad to have you here. So we have an intro
06:50 This is definitely a needed piece of literature. I can, Robert
09:26 Really
11:23 Wow. Wow. So Robert, why don't you take us into that
23:26 I'm curious to see who comes to those talks. Is it
24:33 That's a— that's a view of the— the way what we're
28:10 See
30:46 It makes me, just made me think of something that I
35:05 About other areas
43:49 Put it on a t-shirt. That's good stuff. Well, that's, that's
46:03 Yeah, definitely. Definitely. Well, Tanya, how about a key takeaway for

Mehran Koushkebaghi -- Security as a Systemic Concern: How to develop Anti-Requirements Feb 11, 2025

Mehran Koushkebaghi, a seasoned engineering expert, delves into the intricacies of systemic security. He draws parallels between civil engineering and IT systems, and explains the importance of holistic thinking in security design. Discover the difference between semantic and syntactic vulnerabilities and understand how anti-requirements play a critical role in system resilience. This episode offers fresh perspectives on application security. Mehran Koushkebaghi has 15 years of engineering experience across multiple industries, beginning as a structural engineer before discovering his passion for security. He sees parallels between designing resilient buildings and robust IT systems, applying a holistic engineering mindset in his work. With a master's in computer science and self-taught expertise in applied cryptography and cloud, Mehran continues shaping dependable IT solutions.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We provide diverse training content and easy-to-digest lessons to meet individual learner needs.
→ Learn more about Security Journey

Connect with Mehran Koushkebaghi:
→ Peter Checkland
→ RSA Conference

Mentioned in this episode:
→ Peter Checkland
→ RSA Conference
→ Black Hat
→ Critical System Thinking Book
→ The Fifth Discipline
→ Understanding Complexity
→ Nassim Taleb books

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Mehran Koushkebaghi: Security as a Systemic Concern: How to develop Anti-Requirements
01:32 Yeah, we're going to explore a topic that we started a
07:31 Does resiliency mean in a civil engineering context
14:25 Because if you don't, if you don't understand that though, then
19:55 I did have a, I did have an odd question on
21:48 Yeah. Let me see if this— tell me if this works
24:11 Sure. So, Marin, let's take a look at semantic versus syntactic
40:39 Okay. Second one is, if you could display a single message
42:37 Yeah, they're dense. They're thick books. And there's a, you have

Kalyani Pawar -- Shaping AppSec at Startups Feb 04, 2025

Kalyani Pawar shares critical strategies for integrating security early and effectively in AppSec for startups. She recommends that startups begin focusing on AppSec around the 30-employee mark, with an ideal ratio of one AppSec professional per 10 engineers as the company grows. Pawar emphasizes the importance of building a security culture through "culture as code" - implementing automated guardrails and checkpoints that make security an integral part of the development process. She advises startups to prioritize visibility into their systems, conduct pentests, develop thoughtful policies, and carefully vet third-party tools and open-source solutions. Ultimately, Pawar's approach is about making security a collaborative, integrated effort that doesn't impede innovation but instead supports the startup's long-term success and safety.

The Application Security Podcast is brought to you by Security Journey.

Connect with Kalyani Pawar:
→ The Alignment Problem
→ ChatGPT

Mentioned in this episode:
→ The Alignment Problem
→ ChatGPT

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Kalyani Pawar: Shaping AppSec at Startups
01:24 Yeah, we're going to talk about AppSec and how it intersects
05:45 Then that's a conversation to be had, but you should absolutely
09:11 Because that's, that's the, that's the results of that. But coming
12:51 One of the things about startups, and we kind of hinted
15:34 As the startup matures over time, we kind of, you took
19:22 Okay. So, let's say now you've got an AppSec team at
22:06 At a startup, they'll just step on you if you try
24:44 Yeah. I want to double-click on this culture as code, because
27:43 The advantage in the startup world is you're starting from scratch
31:37 Here we go. All right, so we've got 3 questions, Kalyani
34:44 That's a good gauge, yeah. And the third question is, what's
37:55 Yeah, people always, always got to focus on the original, right

Milan Williams -- AppSec Metrics Jan 14, 2025

Milan Williams discusses the importance of application security metrics and how to make them both meaningful and actionable. She explains that metrics are crucial for tracking progress in what can often feel like an overwhelming security landscape, and they're valuable for career advancement and securing resources. We discuss metrics categories and several specific metrics that are good to track. Milan shares important principles on the importance of making metrics actionable through storytelling and relating security impacts to real-world consequences for users. Milan Williams is a senior product manager at Semgrep, where she helps security engineers and developers work together to ship secure software. She recently graduated from Harvard University with degrees in computer science and physics.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We provide application security training for not just your developers, but for all roles in your SDLC.
→ Learn more about Security Journey

Connect with Milan Williams:
→ Quiet Influence
→ Semgrep

Mentioned in this episode:
→ Quiet Influence
→ Semgrep

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Milan Williams: AppSec Metrics
02:58 I like that idea. So, all right, Robert, where are we
04:45 Do you think people associate metrics with boring
07:13 Yeah. It's all about OKRs, objectives and key results. And I
10:33 If you've got that perspective, because it's one of those things
12:00 For the metrics framework, could you walk us through that a
15:19 Then, is there, are there additional metrics in the framework
16:48 Before we go to any of the remaining categories, metrics, so
22:55 Yeah. So, I took a turn there in the middle. We
25:54 If it's simple and it's easily, easy to calculate, whichever thing
27:05 Because that's the one that it's easy to create metrics, but
30:41 All right, Lon, we have 3 questions to ask about in
32:23 Very cool. And the final question is around book recommendations. What's
34:19 Very cool. So, Milan, what do you want to leave our

MO Sadek -- Building an AppSec Program from Scratch Jan 08, 2025

Mo Sadek shares his unique journey of building an Application Security program from scratch at Roblox. Mo discusses his unconventional path, including temporarily joining the infrastructure team to truly understand engineering challenges. He emphasizes that security isn't about mandating rules, but about making processes easier and more secure by default. Mo shares his insights on how to build effective cross-team security relationships and approaches for gaining leadership buy-in. Mo Sadek is a security transformation leader, passionate about staying ahead of emerging threats. He's built and fine-tuned vulnerability programs, customized solutions through hands-on coding, and driven security-first approaches in AI initiatives. Known for translating complex security metrics into actionable insights, Mo excels at uniting engineers, executives, and cross-functional teams.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We help enterprises reduce vulnerabilities through application security education for developers and everyone in the SDLC.
→ Learn more about Security Journey

Connect with MO Sadek:
→ Roblox
→ I Have No Mouth and I Must Scream

Mentioned in this episode:
→ Roblox
→ I Have No Mouth and I Must Scream
→ Metasploit
→ GitHub Dependabot
→ Robert Hurlbut

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet MO Sadek: Building an AppSec Program from Scratch
01:33 I can see the snow in your background there from the
06:02 Way back to the beginning of the story. So, so, so
07:18 Very cool. So jumping into the AppSec program at Roblox, you
12:41 Then, how does that, your experience working on those different disciplines
14:18 What, what, quick refine the question. Were you dotted line to
20:39 Security. And now you mentioned incident response. Did you security engineering
21:46 Mo, when you talk about, you know, the different approaches in
25:16 You talked about the importance of partnership and, you know, listening
29:35 How, how do you communicate this with senior leadership
31:47 There metrics
36:38 You mentioned, you use the term security partnership. And we certainly
38:37 There's multiple partners then in the way that you think about
44:24 All right. So lightning round, we have 3 questions that we
47:15 All right, I'm going to check that one out. That's good

Brett Crawley -- Threat Modeling Gameplay with EoP Dec 10, 2024

Brett Crawley discusses the Elevation of Privilege (EoP) card game, a powerful tool for threat modeling in software development. The discussion explores recent extensions to the game including privacy-focused suits and TRIM (Transfer, Retention/Removal, Inference, Minimization) categories. Crawley emphasizes that threat modeling shouldn't end with the game but should be an ongoing process throughout an application's lifecycle, ideally starting before implementation. He also shares insights from his book, which provides detailed examples and guidance for teams new to threat modeling using EoP. On today's episode, we're excited to host Brett Crawley, a principal application security engineer with over 25 years in software engineering and more than a decade in AppSec.

The Application Security Podcast is brought to you by Security Journey.

Connect with Brett Crawley:
→ Brett on X
→ Threat Modeling Gameplay with EoP

Mentioned in this episode:
→ Brett on X
→ Threat Modeling Gameplay with EoP
→ Conscious Business by Fred Kofman
→ Elevation of Privilege
→ Adam Shostack
→ Threat Modeling Manifesto
→ MITRE CAPEC
→ The Security Table (podcast)

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Brett Crawley: Threat Modeling Gameplay with EoP
01:57 Yeah, it's like almost the only thing we ever talk about
05:16 Okay. Very cool. So diving into our topic today, to get
06:45 About the Elevation of Privilege card game
08:44 There a, just to clarify here, make sure I understand, we
13:26 Anybody win
15:20 Um, just to go back and revisit, uh, who created the
17:45 Well, insecure data flows or open data flows, for example, things
20:11 Then people can say, well, we've got TLS everywhere now, which
22:38 For example, privacy and trim, T-R-I-M. Could you describe those or
25:49 Can I take these cards that are extensions and put them
27:45 Um, so is the goal then that I finish the card
29:51 You mentioned from, as a key to success for a threat
38:45 All right, let's jump in the lightning round. So we have
41:06 Yes, thank you. So next question is, if you could display

Matin Mavaddat - Understanding Security as a Systemic Concern: The Role of Anti-Requirements Nov 12, 2024

Matin Mavaddat discusses his perspective on security as a systemic concern, developed from his background in requirements engineering and systems architecture. He introduces the concept of "anti-requirements" - defining what a system should not do - and distinguishes between "syntactic security" (addressing technical vulnerabilities that are always incorrect) and "semantic security" (context-dependent security emerging from system interactions). Mavaddat shares his perspective that security itself doesn't have independent existence but rather emerges from preventing undesirable states. The discussion concludes with practical implementation strategies, suggesting that while automated tools can handle syntactic security issues, organizations should focus more energy on semantic security by understanding business context and defining anti-requirements early in the development process.

Today's episode is brought to you by Security Journey.

About Security Journey
Our education platform teaches valuable secure coding skills based on real-world vulnerabilities and threats, including OWASP Top 10.
→ Learn more about Security Journey

Connect with Matin Mavaddat:
→ Matin's article: Reframing Security: Unveiling Power Anti-Requirements
→ Systems Thinking for Curious Managers by Russell Ackoff

Mentioned in this episode:
→ Matin's article: Reframing Security: Unveiling Power Anti-Requirements
→ Systems Thinking for Curious Managers by Russell Ackoff
→ Antifragile by Nassim Nicholas Taleb
→ The Black Swan by Nassim Nicholas Taleb
→ Nassim Taleb books

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Matin Mavaddat: Understanding Security as a Systemic Concern: The Role of Anti-Requirements
01:48 So I'm excited to have Mateen join us here. And Mateen
04:17 One, one follow-up question. I read the, the article that is
10:38 Mateen, can I give you a quick example
11:42 There like, what would you say
14:20 I like that example. I'm just imagining a pile of parts
20:59 There's independent choices that drive it, right
25:33 I'm going to ask you what I think of as the
29:48 I see the challenge here, Mateen, is people that aren't going
33:29 Happens, here's another million-dollar question. I often think about, in the
41:26 All right. Well, I think we gotta, we gotta move on
47:41 Yeah. Yeah, I agree. I, I've read some of, uh, Taleb's

Kayra Otaner -- DevSecOps Oct 29, 2024

Kayra Otaner joins the podcast today to discuss DevSecOps and answer the question, is it dead? Kayra is the Director of DevSecOps at Roche and is highly involved in the DevSecOps community. Kayra states that DevSecOps in its traditional form is “dead” and that each organization should approach its needs based on their size. Otaner introduces the concept of "security as code" and "policy as code" as more effective approaches, where security functions are codified rather than relying on traditional documentation and checklists. Finally, they discuss the emergence of Application Security Posture Management (ASPM) tools as the "SIM for AppSec," suggesting these tools, especially when enhanced with AI, could help manage the overwhelming number of security alerts and issues that currently plague development teams.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We provide diverse training content and easy-to-digest lessons to meet individual learner needs.
→ Learn more about Security Journey

Connect with Kayra Otaner:
→ Books by Yuval Noah Harari
→ Roche

Mentioned in this episode:
→ Books by Yuval Noah Harari
→ Roche
→ CISA Zero Trust Maturity Model
→ The Phoenix Project
→ OWASP DefectDojo
→ OWASP Dependency-Track
→ Phoenix Security

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Kayra Otaner: DevSecOps
01:47 I like to be controversial about our discipline. And there was
03:59 All right. Well, Kayra, I think we're going to dive right
09:28 Right
12:29 No, I agree with you there. I mean, there's definitely not
16:17 Can you gimme an example of a problem in which security
19:58 Makes sense. So what about zero trust
23:12 Yeah, so lightning round are 3 questions that we typically ask
25:34 Kero, what would be a key takeaway or a call to
27:09 Yeah. And Defect Dojo is a commercial entity now. So I
30:32 I'm going to disagree with you to some regard. I'm an

François Proulx - Arbitrary Code Execution 0-day in Build Pipeline of Popular Open Source Packages Oct 22, 2024

François Proulx shares his discovery of security vulnerabilities in build pipelines. Francois has found that attackers can exploit this often overlooked side of the software supply chain. To help address this, his team developed an open source scanner called Poutine that can identify vulnerable build pipelines at scale and provide remediation guidance. Francois has over 10 years of experience in building application security programs, he’s also the founder of the NorthSec conference in Montreal. François Proulx is a senior product security engineer at Boost Security, where he leads the supply chain research team. With over 10 years of experience building AppSec programs for companies like Intel and various startups, he's been instrumental in the DevSecOps movement, making numerous responsible disclosures to organizations such as AWS, Google, Red Hat, and ChainGuard, and speaking at conferences on the topic.

The Application Security Podcast is brought to you by Security Journey.

Connect with François Proulx:
→ LinkedIn
→ Poutine

Mentioned in this episode:
→ Poutine
→ Living Off the Pipeline
→ NorthSec
→ Cooking for Geeks
→ Grand Theft Actions Abusing Self Hosted GitHub Runners
→ LinkedIn
→ François Proulx -- Actionable Software Supply Chain Security
→ TLDR newsletter
→ CycloneDX

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet François Proulx: Arbitrary Code Execution 0-day in Build Pipeline of Popular Open Source Packages
01:51 We're joined by Francois Proulx, second-time visit slash visitor to the
04:39 It always, I mean, it raises your game to have to
06:46 Okay. Hey, Francois, I know you talked recently at a thing
12:44 Let me, let me read this back to you and make
15:53 So make sure, I wanna make sure I understand here. So
19:46 Game over, right
23:04 Okay. And then, yeah. So from there, the sky's the limit
25:17 Okay. So it seems like when I think about solutions, and
29:41 Yeah. I'm going to stick up for Microsoft for a minute
32:45 I think there's hope for the future that, that somebody will
35:13 Okay. So just to quickly touch on Poutine, if I am
40:59 All right. Yeah, we have 3 questions as well as we've
43:02 Great, very timely. Who is somebody that our listeners should know

Steve Wilson -- The Developer's Playbook for Large Language Model Security: Building Secure AI Applications Oct 01, 2024

Steve Wilson, the author of 'The Developer's Playbook for Large Language Model Security’ is back to dive into topics from his book like AI hallucinations, trust, and the future of AI. Steve has been at the forefront of the explosion of activity at the intersection of AppSec, LLM, and AI. We discuss the biggest fears surrounding LLMs and AI, and explore advanced concepts like Retrieval Augmented Generation and prompt injection. Steve Wilson is the author of The Developer's Playbook for Large Language Model Security: Building Secure AI Applications. Steve wrote a book, and we explored some of the topics from the book, like AI hallucinations, trust, and the future of AI.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We provide application security training for not just your developers, but for all roles in your SDLC.
→ Learn more about Security Journey

Connect with Steve Wilson:
→ Steve on LinkedIn
→ Chris Voss

Mentioned in this episode:
→ The Developer's Playbook for Large Language Model Security
→ Steve on LinkedIn
→ Steve Wilson -- OWASP Top Ten for LLMs
→ Steve Wilson and Gavin Klondike -- OWASP Top Ten for LLM Applications Release
→ Chris Voss
→ Arshan Dabirsiaghi
→ Never Split The Difference Chris Vosstahl Raz
→ Pixee
→ Jeff Williams on LinkedIn

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Steve Wilson: The Developer's Playbook for Large Language Model Security: Building Secure AI Applications
02:35 Very cool. Very cool. Which WTF, ITF, what federation
04:52 Well, let me mention the name of the book. Uh, we'll
10:42 The ability for the model slash the system that's providing the
12:36 Has there been any reported stories of that happening at scale
14:48 That's, that's, uh, thanks for sharing that perspective on hallucinations. Trust
18:19 Can we use agents to police themselves
20:22 Yeah. And it seems like people that are, that are spending
26:19 Most definitely. Most definitely. So, last chapter, I want to throw
29:51 All right. So yeah, new questions. The first one is shift
32:58 Then, uh, last question is, uh, who is someone that our
34:18 Very cool. Thanks for sharing that. So Steve, key takeaway, call

Jeff Williams -- Application Detection & Response (ADR) Sep 24, 2024

Jeff Williams, a renowned pioneer in the field of application security is with us to discuss Application Detection and Response (ADR), detailing its potential to revolutionize security in production environments. Jeff shares stories from his career, including the founding of OWASP, and his take on security assurance. We cover many topics including; security assurance, life, basketball and plenty of AppSec as well. Jeff Williams is a veteran application security expert who founded and led OWASP, Aspect Security, and Contrast Security. Jeff also created several highly successful open source projects, including JBomb, JOT, OWASP Top 10, WebGoat, ESAPI, ASVS, and more. Jeff serves as an advisor to NIST, CISA, PCI Council, Oasis Seraph, OWASP CycloneDX, OWASP Foundation, Eclipse Foundation, and advises many companies and agencies on AppSec.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We help enterprises reduce vulnerabilities through application security education for developers and everyone in the SDLC.
→ Learn more about Security Journey

Connect with Jeff Williams:
→ Jeff Williams on LinkedIn
→ The Tech of Runtime Security

Mentioned in this episode:
→ Jeff Williams on LinkedIn
→ The Tech of Runtime Security
→ Contrast Security
→ Log4j
→ OWASP ESAPI

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Jeff Williams: Application Detection & Response (ADR)
01:45 I mean, what's to talk about
05:18 Does the competitive firework when you're in a, like in a
13:12 You, has your thinking or your approach changed over the decades
16:05 I'm curious now, the comment you made about vulnerability scans and
17:39 Now to, to completely overturn the apple cart here, does AI
20:45 Yeah. I've had the same, I've drawn the same conclusion as
29:30 You're describing a world where the, the, what I would think
31:33 We think about the now classic technologies in a company's AppSec
34:59 There any, um, in terms of, you know, business problems, uh
38:56 Jeff, where do you see ADR going into the future
42:13 All right. Yeah. So, uh, first question is, um, shift left
46:23 Okay. Second question is a conference talk, or is there a
49:44 Very cool. Thanks for sharing that pointer. Definitely look Naomi up

Phillip Wylie -- Pen Testing from Somebody who Knows about Pen Testing Sep 17, 2024

Philip Wiley shares his unique journey from professional wrestling to being a renowned pen tester. We define pen testing and the role of social engineering in ethical hacking. We talk tools of the trade, share a favorite web app pentest hack and offer good advice on starting a career in cybersecurity. Philip shares some insights from his book, ‘The Pentester Blueprint: Starting a Career as an Ethical Hacker. ’ And we discuss the impact of AI on pen testing and where this field is headed in the next few years. Our guest in this episode is Phillip Wiley. We explore the definition of pentesting, its relationship with red team activities, and the role of social engineering in ethical hacking.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey is an enterprise-class solution with lessons that are built on learning science principles to deliver long-term measurable results.
→ Learn more about Security Journey

Connect with Phillip Wylie:
→ Phillipwylie
→ Ranakhalil1

Mentioned in this episode:
→ The Pentester Blueprint: Starting a Career as an Ethical Hacker
→ The Web Application Hacker's Handbook
→ The Hacker Maker
→ The Phillip Wylie Show
→ @PhillipWylie
→ Phillipwylie
→ The Web Application Hacker
→ The Pentester BluePrint: Starting A Career As An Ethical Hacker P 9781119684305
→ Burp Suite
→ OWASP ZAP
→ Metasploit
→ Nessus
→ sqlmap
→ Kali Linux
→ Bugcrowd
→ SANS Institute
→ Ranakhalil1
→ PCI DSS

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Phillip Wylie: Pen Testing from Somebody who Knows about Pen Testing
02:33 Right. Oh, the typical story. No, unfortunately, I wish it was
06:19 So one, one last wrestling question. This is quickly becoming the
09:31 I gotta imagine that there's a certain amount of improv though
11:19 Good decision there. So Phillip, how about security
15:13 Mm-hmm. So pen testing, I think, is the, is the primary
19:30 Yeah, that's a good, that's a good, good way to summarize
22:45 You mentioned SQL injection. I'm always curious to understand from somebody
24:12 Okay. So it's not something that's, uh, yeah, that's interesting that
27:03 I wanted to circle back on, you mentioned social engineering and
29:18 With payloads, like I said. Yeah. So if we think about
32:52 Let's shift a little bit. Uh, I know that you've done
35:47 We want to just mention and hear a little bit more
38:36 Yeah, that's really cool. And I want to, um, I want
39:31 I, and the pet peeve I have is Talk to a
46:46 Yeah. How is, um, another just off the top of my
50:11 Phillip, I want to just, I know you do podcasts and

Steve Springett -- Software and System Transparency Aug 29, 2024

Steve Springett, an expert in secure software development and a key figure in several OWASP projects is back. Steve unpacks CycloneDX and the value proposition of various BOMs. He gives us a rundown of the BOM landscape and unveils some new BOM projects that will continue to unify the security industry. Steve is a seasoned guest of the show so we learn a bit more about Steve's hobbies, providing a personal glimpse into his life outside of technology. Steve Springett educates teams on the strategy and specifics of developing secure software. He practices security at every development lifecycle stage by leading sessions on threat modeling, secure architecture and design, static dynamic component analysis, offensive research, and defensive programming techniques.

Today's episode is brought to you by Security Journey.

About Security Journey
Our education platform teaches valuable secure coding skills based on real-world vulnerabilities and threats, including OWASP Top 10.
→ Learn more about Security Journey

Connect with Steve Springett:
→ CycloneDX
→ Software Transparency: Supply Chain Security in an Era of a Software-Driven Society

Mentioned in this episode:
→ CycloneDX
→ Software Transparency: Supply Chain Security in an Era of a Software-Driven Society
→ JC Herz and Steve Springett -- SBOMs and software supply chain assurance
→ OWASP Dependency-Track
→ CycloneDX
→ OWASP Foundation
→ Log4j
→ Apache Struts
→ Open Threat Model (OTM)
→ OWASP Threat Dragon Project
→ LINDDUN
→ PCI Security Standards Council
→ Software Transparency: Supply Chain Security in an Era of a Software-Driven Society by Chris Hughes, Tony Turner
→ OWASP Dependency-Check

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Steve Springett: Software and System Transparency
02:04 It's, uh, well, the City of Brotherly Love, isn't that what
06:05 That's just, it's just another reminder that we all gotta find
07:44 Um, Robert, where are we, where are we going with Steve
11:00 And I think a lot of people in AppSec are going
12:21 Right
14:26 I'd love to get you kind of on the record giving
19:08 Based on the Log4j, Log4Shell example, let's have it, let's, let's
23:03 We've talked about some of the use cases, but are there
24:52 We think about All of these different capabilities and different, I
30:18 Let's say in relation to that transparency, but also, uh, commonalities
33:19 I know you've been doing some work, Steve, on this idea
36:32 I mean, it, it, I think if I, if I kind
42:47 Okay. Yeah. So we have 3 questions. Do we, have we
45:19 Last question, uh, what's your top book recommendation and why do

Irfaan Santoe -- The Power of Strategy in AppSec Jul 31, 2024

Irfaan Santoe joins us for an in-depth discussion on the power of strategy in Application Security. We delve into measuring AppSec maturity, return on investment, and communicating technical needs to business leaders. Irfaan shares his unique journey from consulting to becoming an AppSec professional, and addresses the gaps between CISOs and AppSec knowledge. Irfaan shares valuable insights for scaling AppSec programs and aligning them with business objectives. Irfaan Santoe joins us to discuss the power of strategy in AppSec. We go deep on this one, on AppSec program maturity, how we can measure maturity, and even some tips for success. We talk about measuring return on investment and how to speak the language of the business as a technical person.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We provide diverse training content and easy-to-digest lessons to meet individual learner needs.
→ Learn more about Security Journey

Connect with Irfaan Santoe:
→ OWASP SAMM
→ OWASP Security Champions Guide

Mentioned in this episode:
→ OWASP SAMM
→ OWASP Security Champions Guide
→ BSIMM
→ Jim Routh on Twitter
→ OWASP Netherlands Chapter
→ OWASP SAMM

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Irfaan Santoe: The Power of Strategy in AppSec
03:12 That's kind of the— it's almost the opposite of what a
06:35 A little bit about maturity. So, what is maturity within an
09:30 We think about measuring maturity then, so let me read back
12:20 Yeah. So, what is a part of that link then
17:16 Okay. So, we talked a little bit about, you know, how
20:59 I think there's a real disconnect between the business side and
27:03 Because that seems like, I mean, that's return on investment to
29:39 I've been waiting to ask this next question for a long
31:49 Yeah. And, if we use your car example and if I
33:51 Let's pull all this together. How do we scale an AppSec
38:12 All right. So, we have 3 questions that we usually ask

Andrew Van Der Stock -- The New OWASP Top Ten Jul 23, 2024

Andrew Van Der Stok, a leading web application security specialist and executive director at OWASP joins us for this episode. We discuss the latest with the OWASP Top 10 Project, the importance of data collection, and the need for developer engagement. Andrew gives us the methodology behind building the OWASP Top 10, the significance of framework security, and much more. Andrew Vanderstock is a seasoned web application security specialist and enterprise security architect. He's the executive director at OWASP, taking the foundation through organizational change and taking OWASP's mission to the next level. Andrew has worked in the IT industry for over 25 years, has researched and developed the web application security and architecture fields since 1998.

The Application Security Podcast is brought to you by Security Journey.

Connect with Andrew van der Stock:
→ The Crown Road by Iain Banks
→ Edward Tufte

Mentioned in this episode:
→ The Crown Road by Iain Banks
→ Edward Tufte
→ OWASP Top Ten Project
→ OWASP Developer Guide
→ PCI DSS
→ OWASP Top Ten for LLM Applications project homepage
→ RSA Conference

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Andrew van der Stock: The New OWASP Top Ten
01:41 We are about to go on a journey into the topic
04:10 Phone goes with you probably just for emergency purposes, but so
07:27 Probably get ways to deal with it, right
13:08 Help me, help me remember what, what, what is the connection
15:29 On the topic of OWASP Top 10, give us an update
17:16 We talk about data and the need for data, I don't
20:58 Then if— so the, the request for data is really more
21:56 Now I'm curious. I want to dig a little deeper on
26:00 Are the downsides of, potential downsides of this data collection approach
30:23 That data weighted different in the model if it comes from
33:33 Wrapping all of this kind of together, we've got the data
35:14 I mean, or it used to be. Yeah. Or it used
36:24 I can, I mean, just to second something you said a
40:38 Yeah. So you already jumped ahead to controversial opinion, but before
42:23 All right. Yes, we already talked about the controversial opinions. So
45:59 Great. Last question is, what's your top book recommendation and why
50:12 Andrew, what's, how about a key takeaway then

Derek Fisher -- Hiring in Cyber/AppSec Jul 16, 2024

Derek Fisher, an expert in hardware, software, and cybersecurity with over 25 years of experience is back on the podcast. Derek shares his advice on cybersecurity hiring, specifically in application security, and dives into the challenges of entry-level roles in the industry. We discuss the value of certifications, the necessity of lifelong learning, and the importance of networking. Listen along for good advice on getting noticed in cybersecurity, resume tips, and the evolving landscape of AppSec careers. Mentioned in this episode: The Application Security Handbook by Derek Fisher Derek Fisher brings over 25 years of hardware, software, and cybersecurity expertise across multiple industries, including healthcare and finance.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We provide application security training for not just your developers, but for all roles in your SDLC.
→ Learn more about Security Journey

Connect with Derek Fisher:
→ The Application Security Handbook by Derek Fisher
→ Cyber for Builders by Ross Haleliuk

Mentioned in this episode:
→ The Application Security Handbook by Derek Fisher
→ Cyber for Builders by Ross Haleliuk
→ Effective Vulnerability Management by Chris Hughes
→ With the Old Breed by E.B. Sledge
→ Derek Fisher – The Application Security Handbook
→ WiCyS (Women in Cybersecurity)
→ CISSP
→ BSides

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Derek Fisher: Hiring in Cyber/AppSec
01:35 Yeah, we're joined by someone who's been on the podcast before
03:48 What's your favorite thing to grow
06:21 It's the, as you said, it's the therapeutic value of getting
11:05 Which to your point, mid to senior level people are 100%
13:15 With that in mind, I mean, how are people getting into
17:32 I mean, if anything, it's the patterns, kind of the try
20:03 Reminds me of something about Billy the Kid. Like, do you
21:58 You mentioned resume reviews. I'm always curious. I've never participated in
26:18 The last, you know, 5, 7 years, all the hiring I've
33:16 I would say, you know, that's one way to stand out
35:43 One of the we got to blame the hiring companies though
37:00 You can apply something, yourself to something. And so that, I
39:57 That, that I look back and say, I didn't necessarily use
47:59 By doing a pen testing class and doing a forensics class
52:17 All right. So yeah, 3 questions that we have. First of
55:34 Makes sense. So number 3, what's your Top book recommendation and
57:24 Yeah, he just wrote a new book on, yeah, it's the
58:49 Excellent. Derek, what about a key takeaway or a call to

Tanya Janca -- Secure Guardrails Jul 09, 2024

Tanya Janka, also known as SheHacksPurple, discusses secure guardrails, the difference between guardrails and paved roads, and how to implement both in application security. Tanya is an award-winning public speaker and head of education at SEMGREP and the best-selling author of ‘Alice and Bob Learn Application Security’. Tanya shares her insights on creating secure software and teaching developers in this episode. Tanya Jenka, also known as She Hacks Purple, is the bestselling author of Alice and Bob Learn Application Security. She's also the head of education and community at Semgrep, sharing content and training around teaching everyone to create secure software. Tanya's been coding and working in IT for over 25 years.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We help enterprises reduce vulnerabilities through application security education for developers and everyone in the SDLC.
→ Learn more about Security Journey

Connect with Tanya Janca:
→ Tanya Janca on LinkedIn
→ Alice and Bob Learn Application Security

Mentioned in this episode:
→ Alice and Bob Learn Application Security
→ Semgrep
→ Tanya Janca – What Secure Coding Really Means
→ The Expanse Series
→ Alice and Bob Learn Application Security
→ Tanya Janca (SheHacksPurple)
→ Azure DevOps
→ Microsoft Security Response Center (MSRC)
→ Microsoft Defender for Cloud
→ Content-Security-Policy (MDN)
→ Scott Helme
→ Kim Wuyts
→ Executive Order 14028
→ OWASP SAMM

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Tanya Janca: Secure Guardrails
05:09 Oh, that's so cool. So what, what are you excited about
06:49 Oh, that's great. That's, yeah, it's a, that's a fun thing
10:05 I was like, no, no, I'm good. And it was like
12:05 So based on the example that you just shared there, Now
15:55 Would you like to use the wrapper library
17:36 Am I willing to break the build
19:41 Oh, actually, you know what
22:39 What's the role of making it easy with the paved road
24:58 Right
26:53 Makes sense. Makes sense. That's, that's, uh, it's helpful just to
30:18 I have to go rotate the secret, yada, yada, yada, right
32:58 Like, because getting into buildings when you should not is a
34:18 No, no, it's good. It's good. So I guess one more
37:48 Someone else told me she did that and it said, this
40:19 All right. One more guardrail topic. And this is one that
43:05 Right
46:24 It's time for her to come back again. She has been
47:38 No
50:13 We've all gotten those though for, for plenty of times in
53:34 Um, and so then we talked about it and I'm like
57:14 So I'm going to do the top programming frameworks as well
61:11 Oh, nice. Very cool. Very cool. So, just to kind of

Jahanzeb Farooq -- Launching and executing an AppSec program Jul 02, 2024

Jahanzeb Farooq discusses his journey in cybersecurity and the challenges of building AppSec programs from scratch. Jahanzeb shares his experience working in various industries, including Siemens, Novo Nordisk, and Danske Bank, highlighting the importance of understanding developer needs and implementing the right tools. The conversation covers the complexities of cybersecurity in the pharmaceutical and financial sectors, shedding light on regulatory requirements and the role of software in critical industries. Learn about prioritizing security education, threat modeling, and navigating digital transformation. Jan Zeb Farouk currently serves as the head of application security at Danske Bank, the largest bank in Denmark. Before this, he was with Novo Nordisk, where he played a key role in building their application security program from scratch and in securing their digital health solutions.

Today's episode is brought to you by Security Journey.

About Security Journey
Our education platform teaches valuable secure coding skills based on real-world vulnerabilities and threats, including OWASP Top 10.
→ Learn more about Security Journey

Connect with Jahanzeb Farooq:
→ The Power of Habit by Charles Duhigg
→ BSIMM

Mentioned in this episode:
→ The Power of Habit by Charles Duhigg
→ BSIMM
→ OWASP SAMM

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Jahanzeb Farooq: Launching and executing an AppSec program
01:57 You could have told me that you painted it. I would
07:12 From that perspective. So how do you get to AppSec then
09:08 AppSec
12:55 I have a question. I have a question about having never
15:57 There's no central, so like they don't share services or share
17:27 You're starting with these businesses that were non-IT. They made their
25:46 Do you, what are you, what's the equation you're using to
28:18 You mentioned maturity. Is that something that is based on, Are
29:20 A little question about some of the experiences that you've had
40:06 If I, if I kind of read that back to you
42:58 Yeah, I think a well-tuned SAST tool is a good assessment
45:29 Question 2, if you could display a single message on a
47:14 Yeah, I think really cool. We'll put a link to that

David Quisenberry -- Building Security, People, and Programs Jun 18, 2024

David Quisenberry shares about his journey into the security world, insights on building AppSec programs in small to mid-sized companies, and the importance of data-driven decision-making. The conversation delves into the value of mentoring and why it's important to build real relationships with the people you work with, the vital role of trust with engineering teams, and the significance of mental health and community in the industry. David Quisenberry leads security teams at Capri Health, where he's the senior manager of information security. He's a lifetime OWASP member, former chapter president of the Portland, Oregon OWASP chapter, and co-founder of the OWASP AppSec Days PNW.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We provide diverse training content and easy-to-digest lessons to meet individual learner needs.
→ Learn more about Security Journey

Connect with David Quisenberry:
→ SRE Engineering
→ The Phoenix Project

Mentioned in this episode:
→ SRE Engineering
→ The Phoenix Project
→ Security Chaos Engineering
→ Wiring the Winning Organization
→ The Body Keeps the Score
→ Never Eat Alone
→ How Leaders Create and Use Networks
→ CISO Desk Reference Guide
→ Intelligence Driven Incident Response
→ Thinking Fast and Slow
→ Do Hard Things
→ BSIMM
→ OWASP Application Security Verification Standard (ASVS)
→ BSides

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet David Quisenberry: Building Security, People, and Programs
01:44 That's, uh, that's a t-shirt, t-shirt idea. I wish I had
04:45 Yeah. It's, it's one of those things where we're never going
06:56 Um, and I love that illustration you just made about comparing
12:43 In your experience then doing this a couple of times, do
17:28 I want to, I want to just acknowledge, I want to
19:42 That's just me. I, I, uh, yeah, I had, I had
22:52 Yeah. And I want to go there next. Um, I guess
24:08 This idea of trust with the engineering teams, because it seems
35:21 Let me, uh, let me, let me just summarize a couple
38:17 I never hear from him again. He's like, this was kind
40:54 About, let's just touch on this mental health point and just
44:29 I was just going to bring that up because it's something
47:30 We got to deal with this last one. Um, cause this
48:53 So I just kind of, the sociologist in me, this happens

Matt Rose -- Software Supply Chain Security Means Many Different Things to Different People Jun 11, 2024

Matt Rose, an experienced technical AppSec testing leader discusses his career journey and significant contributions in AppSec. The conversation delves into the nuances of software supply chain security and exploring how different perceptions affect its understanding. Matt provides insights into the XZ compromise, critiques the buzzword 'shift left,' and discusses the role of digital twins and AI in enhancing the supply chain security. He emphasizes the need for a comprehensive approach beyond SCA, the relevance of threat modeling, and the potential risks and benefits of AI in security. Matt Rose is a technical AppSec testing leader with consistent accomplishments in sales and sales engineering management roles with more than 20 years of experience.

The Application Security Podcast is brought to you by Security Journey.

Connect with Matt Rose:
→ LinkedIn
→ The Application Security Program Handbook by Derek Fisher

Mentioned in this episode:
→ The Application Security Program Handbook by Derek Fisher
→ ReversingLabs
→ YouTube video
→ Stephen E Ambrose
→ Mark Frost
→ Fortify (OpenText)
→ ChatGPT
→ Pixee
→ LinkedIn

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Matt Rose: Software Supply Chain Security Means Many Different Things to Different People
03:53 Let me ask you this question. How good are you at
04:45 That's true. That is so true. That's, that's a good way
11:33 Yeah, 100%. And I like to think of weaknesses in the
14:56 You're, you just made me think of something. About when you
17:12 Yeah, it seems like, it seems like there's a perfect storm
19:09 I want to double-click on something that you mentioned earlier. And
22:10 I mean, I think that's more of a startup growth problem
24:55 It the first, is it the first thing you would like
28:15 Yeah, I've never actually seen anybody do it. I've heard DJ
30:38 About, uh, AI
34:39 Yeah, I'm not, I'm not ready to embrace auto-remediation at this
37:32 Yeah. And we're starting to see a whole cottage industry of
40:14 Absolutely. The second question is, what would it say if you
41:54 Our 3rd question is, uh, what's your top book recommendation and

James Berthoty -- Is DAST Dead? And the future of API security May 31, 2024

James Berthoty, a cloud security engineer with a diverse IT background, discusses his journey into application and product security. James highlights his career trajectory from IT operations to cloud security, his experiences with security tools like Snyk and StackHawk, and the evolving landscape of Dynamic Application Security Testing (DAST) and API security. They delve into the practical challenges of CVEs, reachability analysis, and the complexities of patching in mid-sized companies. James shares his views on the often misunderstood role of WAF and the importance of fixing issues over merely identifying them. James Berthoty has been in technology for over 10 years in engineering and security roles.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We provide application security training for not just your developers, but for all roles in your SDLC.
→ Learn more about Security Journey

Connect with James Berthoty:
→ AppSec Kool-Aid Statements I Disagree With
→ What is Art by Leo Tolstoy

Mentioned in this episode:
→ AppSec Kool-Aid Statements I Disagree With
→ What is Art by Leo Tolstoy
→ Snyk
→ StackHawk
→ AppSec Kool-Aid Statements I Disagree With
→ National Vulnerability Database (NVD)
→ eBPF
→ Kubernetes

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet James Berthoty: Is DAST Dead? And the future of API security
04:11 Mm-hmm. So when I think about your trajectory here, so you've
06:48 Let's start with this idea of DAST. And so anyone who's
10:02 So when you, when you're seeing these API scanners these days
13:07 You still using the term DAST or have you replaced it
14:49 What's your, what, what are your thoughts on this
16:42 Okay. That's helpful. What about reachability analysis
19:22 Patching really still that hard
22:43 The million dollar question then, is AI going to solve the
28:04 Yeah. I mean, fix it yourself and generate a PR, submit
32:22 I'm, I mean, let's, let's just talk about WAF and, and
36:12 Yeah, I think that's, uh, that's definitely true. Well, you got
38:01 Okay. Next. Like, celebration time. Yep. We passed. All right. So
41:29 Yeah. Yeah, definitely. So, all right, let's do a couple of
42:29 Question is, if you could have display a single message on

Mark Curphey and Simon Bennetts -- Riding the Coat Tails of ZAP, without Open Source Funding May 21, 2024

ZAP supports an enormous share of the application security ecosystem, but who pays for the people keeping it reliable? Project founder Simon Bennetts and OWASP co-founder Mark Curphey join Chris to examine the uncomfortable economics of widely used open-source security tools. Simon describes the nontechnical work behind maintaining ZAP, from community support to managing companies that build commercial offerings on top of it. Mark explores funding structures, foundations, and the incentives that leave critical infrastructure dependent on too few people. They connect those pressures to the XZ backdoor and ask whether licenses can require commercial users to contribute. The episode makes the sustainability problem concrete: open source may be free to consume, but healthy projects still require money, time, governance, and long-term institutional support.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Mark Curphey and Simon Bennetts:
→ Mark Curphey on LinkedIn
→ Simon Bennetts on LinkedIn
→ ZAP
→ The Software Security Project

Mentioned in this episode:
→ ZAP
→ Linux Foundation
→ The Software Security Project
→ Crash Override
→ OpenSSL

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Sustaining ZAP and open-source security
00:35 From OWASP to the Linux Foundation and independence
08:48 Balancing CISO priorities with practitioner needs
11:42 Fifteen years of maintaining ZAP
12:21 The business challenges behind open-source projects
18:08 The XZ backdoor as a case study in underfunding
20:30 Commercial products built on top of ZAP
22:55 What a sustainable funding model could look like
27:56 Independent foundation or collaborative community
34:38 Can licensing require commercial users to contribute?
41:07 Final recommendations for open-source sustainability

Devin Rudnicki -- Expanding AppSec May 14, 2024

Devon Rudnicki, the Chief Information Security Officer at Fitch Group, shares her journey of developing an application security program from scratch and advancing to the CISO role. She emphasizes the importance of collaboration, understanding the organization's business, and using metrics to drive positive change in the security program. Devin Rudnicki, the Chief Information Security Officer at Fitch Group, developed an application security program and advanced to the CISO role after years in security governance. She holds a BS in mathematics from DePaul University and multiple certifications, including CISSP, GSTRT, GSEC, and GCSA. Outside work, she enjoys group fitness, global travel, and mentoring in cybersecurity.

The Application Security Podcast is brought to you by Security Journey.

Connect with Devin Rudnicki:
→ Alice and Bob Learn Application Security
→ RSA Conference

Mentioned in this episode:
→ Alice and Bob Learn Application Security
→ RSA Conference
→ Black Hat
→ Walter Isaacson

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Devin Rudnicki: Expanding AppSec
03:05 Very cool. So the internship, security and governance, does that lead
05:03 Is that What's that approval look like as far as, is
07:28 What's the first thing that you focus on with this program
10:17 You're kind of, you're learning a little bit about the personalities
11:41 Yes, I think that's an important tactical thing that we can
14:54 Yeah. Okay. So when we, if we break the program, then
17:54 Okay. So, that's the vulnerability management side. How about developer education
20:23 In the past, I would say no to that question, and
21:18 That's, you know, you can minimize. But yeah, I mean, pen
24:49 Tracking the work. What metrics and KPIs did you use to
27:05 Yeah, and I had a similar situation in my previous time
30:03 Devin, we have 3 questions that we typically ask in the
32:59 The gene splicing therapy. We'll find it and put it in

Dustin Lehr -- Culture Change through Champions and Gamification Apr 16, 2024

Dustin Lehr, Senior Director of Platform Security/Deputy CISO at Fivetran and Chief Solutions Officer at Katilyst Security, joins Robert and Chris to discuss security champions. Dustin explains the concept of security champions within the developer community, exploring the unique qualities and motivations behind developers becoming security advocates. He emphasizes the importance of fostering a security culture and leveraging gamification to engage developers effectively. They also cover the challenges of implementing security practices within the development process and how to justify the need for a champion program to engineering leadership. Dustin shares insights from his career transition from a developer to a cybersecurity professional, and he provides practical advice for organizations looking to enhance their security posture through community and culture-focused approaches.

Connect with Dustin Lehr:
→ Security Champion Success Guide
→ Katilyst

Mentioned in this episode:
→ Security Champion Success Guide
→ Katilyst
→ Makersschedule
→ Never Split The Difference Chris Vosstahl Raz

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Dustin Lehr: Culture Change through Champions and Gamification
02:50 Yeah, and you were, uh, on a previous episode entitled Advocating
06:29 I need you to tap back into your old development days
09:05 Cause a lot of times developers say you're living in an
11:56 Me think of, you guys ever seen the uh, Maker vs
14:47 Yeah, it's it makes me think about like the rise of
17:53 Can a developer become a champion with zero security knowledge
20:08 Yeah, I was, I was smiling a little bit when you
21:35 Does, um, what would a person who became a champion, where
24:26 Yeah, I can say one of the, one of the biggest
28:37 A little bit about, uh, on the, on the security side
35:17 You hearing anything different
40:07 Yeah, very cool. I've been, I've been following along. I've been
42:45 Perfect. And then the final question is, what's your top book

Francesco Cipollone -- Application Security Posture Management and the Power of Working with the Business Apr 09, 2024

Francesco Cipollone, CEO of Phoenix Security, joins Chris and Robert to discuss security and explain Application Security Posture Management (ASPM). Francesco shares his journey from developer to cybersecurity leader, revealing the origins and importance of ASPM. The discussion covers the distinction between application security and product security, the evolution of ASPM from SIEM solutions, and ASPM's role in managing asset vulnerabilities and software security holistically. Francesco emphasizes the necessity of involving the business side in security decisions and explains how ASPM enables actionable, risk-based decision-making. The episode also touches on the impact of AI on ASPM. It concludes with Francesco advocating for a stronger integration between security, development, and business teams to effectively manage software security risks.

Connect with Francesco Cipollone:
→ Phoenix Security
→ Cyber For Builders

Mentioned in this episode:
→ Phoenix Security
→ Cyber For Builders

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Francesco Cipollone: Application Security Posture Management and the Power of Working with the Business
08:10 That's helpful. I'm, I'm asking this question of lots of people
10:25 Frank, today we're going to be talking about, uh, what is
13:06 You, let's, let's put the, the, let's go back in history
17:51 I want to, I want to explore another avenue that you've
23:06 Sure. Uh, so one question we wondered about in terms of
25:52 Yeah. So let's, um, let, let's kind of summarize. When we
27:31 I heard inventory was one big piece, so one of the
29:34 All right. Well, one other question we have is, I think
31:43 Yeah, I could see the kind of the pattern matching summarization
35:04 All right. Uh, our second question is, uh, what would it

Mukund Sarma -- Developer Tools that Solve Security Problems Apr 02, 2024

Mukund Sarma, the Senior Director for Product Security at Chime, talks with Chris about his career path from being a software engineer to becoming a leader in application security. He explains how he focuses on building security tools that are easy for developers to use and stresses the importance of looking at application security as a part of the broader category of product security. Mukund highlights the role of collaboration over security mandates and the introduction of security scorecards for proactive risk management. He and Chris also discuss the strategic implementation of embedded security functions within development teams. Discover the potential of treating security as an enabling function for developers, fostering a culture of shared responsibility, and the innovative approaches Chime employs to secure its services with minimal friction for developers.

Connect with Mukund Sarma:
→ Monocle Part 1
→ Building Secure and Reliable Systems

Mentioned in this episode:
→ Monocle Part 1
→ Building Secure and Reliable Systems
→ Chime
→ Mitigating Risky Pull Requests With Monocle Risk Advisor Part 2 7013e1485bf2
→ YouTube video
→ Drive
→ Bandit

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Mukund Sarma: Developer Tools that Solve Security Problems
03:37 Yeah. Yeah. So did you, uh, start Chimes product security team
04:34 You use the words AppSec and ProdSec
08:21 I guess I want to ask kind of the, the other
10:17 That's the Overwatch. Was that the overwatch
13:26 I got to imagine they're loving it because you're making their
15:55 If I accidentally create a service that doesn't have a JSON
19:16 Yeah, John Doerr in the famous OKR book, Measure What Matters
23:03 Yeah, I mean, I think that's the ultimate gamification play, is
25:48 A big task, right
27:36 It has to be a motivational lever in the equation, right
32:43 Did you choose the order
35:18 Mm hmm. So if a, let's say somebody listening here is
37:41 Yeah, some, some more skill sets on the cross collaboration front
42:13 All right, let's do some lightning round questions. I could, we
45:12 Do you want to leave our audience with

Meghan Jacquot -- Assumed Breach Red Team Engagements for AppSec Mar 20, 2024

AppSec specialist Megan Jacquot joins Chris and Robert for a compelling conversation about community, career paths, and productive red team exercises. Megan shares her unique cybersecurity origin story, tracing her interest in the field from childhood influences through her tenure as an educator and her formal return to academia to pivot into a tech-focused career. She delves into her roles in threat intelligence and application security, emphasizing her passion for technical work, penetration testing, and bug bounty programs. Additionally, Megan highlights the importance of mentorship, her involvement with the Women in Cybersecurity (WeCyS) community, and her dedication to fostering the next generation of cybersecurity professionals.

Connect with Meghan Jacquot:
→ WiCyS (Women in Cybersecurity)
→ Difficult Conversations

Mentioned in this episode:
→ WiCyS (Women in Cybersecurity)
→ Difficult Conversations
→ Being Henry Fonz And Beyond Henry Winkler
→ DEF CON
→ OWASP Application Security Verification Standard (ASVS)
→ ChatGPT
→ RSA Conference
→ The Phoenix Project

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Meghan Jacquot: Assumed Breach Red Team Engagements for AppSec
02:10 It there. I tried. I went all in. That was my
06:50 I'm just laughing because I, I asked, you know, college aged
10:42 Meghan, one of the things that, uh, you shared with us
13:50 It's something that happens more often than we would like to
19:14 A couple of couple of clarifying questions Do you think that
22:20 I have another scenario then, that I'm just, I don't know
24:15 I wonder about situations where you already have customers who can
26:01 I want to change, uh, topics a bit because I know
29:13 Yeah, I agree. I've had a chance to, to be on
32:51 It's for the, and I hope people are using it somewhere
35:39 You bet. Well, Meghan, our lightning round, we have three questions
36:57 Number three, uh, what's your top book recommendation and why do

Bill Sempf -- Development, Security, and Teaching the Next Generation Mar 12, 2024

Robert is joined by Bill Sempf, an application security architect with over 20 years of experience in software development and security. Bill shares his security origins as a curious child immersed in technology, leading to his lifelong dedication to application security. They discuss CodeMash, a developer conference in Ohio, and recount Bill's presentation on the Veilid application framework, designed for privacy-driven mobile applications. Bill also explores his efforts in educating children about technology and programming, drawing on his experiences with Kidsmash and other initiatives. Additionally, they delve into the challenges of application security, particularly modern software development practices and the utility of languages like Rust for creating secure applications.

Connect with Bill Sempf:
→ Bill's homepage
→ CodeMash conference

Mentioned in this episode:
→ Bill's homepage
→ CodeMash conference
→ Veilid Application Framework
→ Math Without Numbers
→ Agile Manifesto
→ Rust
→ GitLab

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introduction
07:42 Giving Back: CodeMash and Other Conferences
12:27 Exploring Veilid: A Privacy-Driven Application Framework
16:17 Nurturing Tech-Savvy Kids
21:29 The Intersection of AppSec and Developer Conferences
26:36 Trends and Challenges in Application Security

Hendrik Ewerlin -- Threat Modeling of Threat Modeling Mar 05, 2024

Robert and Chris talk with Hendrik Ewerlin, a threat modeling advocate and trainer. Hendrik believes you can threat model anything, and he recently applied threat modeling to the process of threat modeling itself. His conclusions are published in the document Threat Modeling of Threat Modeling, where he aims to help practitioners, in his own words, "tame the threats to the threat modeling process. Hendrik Ewerlin loves to build secure software and empower people to do so. He strongly believes in the power of threat modeling. He provides threat modeling training and helps software vendors who are new to threat modeling and want to improve the security of their systems.

Connect with Hendrik Ewerlin:
→ Hendrik Ewerlin
→ Threat Modeling of Threat Modeling

Mentioned in this episode:
→ Hendrik Ewerlin
→ Threat Modeling of Threat Modeling
→ Austin Kleon books
→ Adam Shostack
→ Threat Modeling Manifesto
→ OWASP SAMM

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Hendrik Ewerlin: Threat Modeling of Threat Modeling
02:44 Exciting adventure called application security
04:53 Let them build something when they're, when they're in their teens
07:21 Very meta, which I know is a word from a few
10:23 Is your approach, uh, to threat modeling and threat modeling programs
11:39 Yeah, I did notice that you, you took, you took various
14:51 And getting on the same plane. So, I know one of
18:11 There some other things that you discovered as you were working
20:39 Document. So one of the things, Hendrick, that I noticed about
25:01 Yeah, and I love where you went with that. One of
27:56 Enough people like me smile. You, so you wrote mitigation debt
30:36 All right, three questions. First one is, what's your most controversial
32:20 Okay. And the third question is, uh, what's your top book

Jason Nelson -- Three Pillars of Threat Modeling Success: Consistency, Repeatability, and Efficacy Feb 27, 2024

Jason Nelson, an accomplished expert in information security management, joins Chris to share insights on establishing successful threat modeling programs in data-intensive industries like finance and healthcare. Jason presents his three main pillars to consider when establishing a threat modeling program: consistency, repeatability, and efficacy. The discussion also provides a series of fascinating insights into security practices, regulatory environments, and the value of a threat modeling champion. As a threat modeling practitioner, Jason provides an essential perspective to anyone serious about application security. Jason Nelson is an information security executive focused on building programs and directing teams in highly regulated financial healthcare and insurance industries.

Connect with Jason Nelson:
→ FINOS Common Cloud Controls
→ NIST OSCAL

Mentioned in this episode:
→ FINOS Common Cloud Controls
→ NIST OSCAL
→ MITRE ATT&CK
→ Malware Analyst's Cookbook
→ Threat Modeling: A Practical Guide for Development Teams
→ Schneier on Security
→ The Security Table (podcast)
→ Start With Why

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introduction
02:13 Security Origin Story
07:48 Threat Modeling the Cloud
16:44 Threat Modeling Pillar One: Consistency
27:30 A Threat Modeling Champion
33:35 Threat Modeling Pillar Two: Repeatability
39:07 Threat Modeling Pillar Three: Efficacy
48:09 Lightning Round

Erik Cabetas -- Cracking Codes on Screen and in Contests: An Expert's View on Hacking, Vulnerabilities, and the Evolution of Cybersecurity Language Feb 17, 2024

Erik Cabetas joins Robert and Chris for a thought-provoking discussion about modern software security. They talk about the current state of vulnerabilities, the role of memory-safe languages in AppSec, and why IncludeSec takes a highly systematic approach to security assessments and bans OWASP language. Along the way, Erik shares his entry into cybersecurity and his experience consulting about hacking for TV shows and movies. The conversation doesn't end before they peek into threat modeling, software engineering architecture, and the nuances of running security programs. Eric Cabetas has more than two decades of experience in InfoSec. His previous posts include senior roles at Ernst Young, Fortify Software, and theladders.

Connect with Erik Cabetas:
→ Security Engineering by Ross Anderson
→ IncludeSec

Mentioned in this episode:
→ Security Engineering by Ross Anderson
→ IncludeSec
→ New School Of Information Security 9780132800280
→ DEF CON
→ OWASP Top Ten
→ Rust
→ Go
→ OpenSSF
→ RSA Conference

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introduction
01:32 Security Origin Story
04:28 Winning DEF CON CTF
08:36 Hollywood Hacking Consultant
15:05 The Current State of Vulnerabilities
26:45 Memory Safe Languages
35:19 Banning OWASP Language?
41:26 Lighting Round

Justin Collins -- Enabling the Business to Move Faster, Securely Feb 06, 2024

Justin Collins of Gusto joins Robert and Chris for a practical conversation about running security teams in an engineering-minded organization. Justin shares his experience leading product security teams, the importance of aligning security with business goals, and the challenges arising from the intersection of product security and emerging technologies like GenAI. Justin Collins currently heads up security at Gusto. In the past, he's been an AppSec engineer at SurveyMonkey, Twitter, and AT&T Interactive. He's also the primary author of Brakeman, a free static analysis security tool for Ruby on Rails. We explore security partners, GRC and privacy intersections, and the challenges that GenAI will bring to product security over the next five years.

Connect with Justin Collins:
→ The DevOps Handbook
→ Gusto

Mentioned in this episode:
→ The DevOps Handbook
→ Gusto
→ Brakeman
→ Ruby on Rails
→ Ruby
→ Content-Security-Policy (MDN)
→ The DevOps Handbook

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Justin Collins: Enabling the Business to Move Faster, Securely
04:23 Rest, as they say, is history, right
08:47 Hmm. Cool, thanks. Um, Robert, why don't you take us into
12:51 What's been the response from the business to this statement where
15:50 You think it's, do you think ProdSec is easier in a
20:51 Yeah. I think that's, that's, that's, that's advice worth gold right
23:58 You mentioned a couple things, uh, that sound like good keys
26:50 Hm, So in the last, uh, I guess, number of years
31:21 Yeah. that's true. I want to give a special shout out
35:43 It SQL injection. It's vulnerable or it's not. It's, we don't
38:31 All right. So the lightning round is three questions that we
40:33 I mean, we have to end the interview now, but other
42:43 Very cool. All right. And the final one is, uh, what's
44:51 Yeah, that's true. All right. Well, Justin, how about a key

Kyle Kelly -- The Dumpster Fire of Software Supply Chain Security Jan 30, 2024

Kyle Kelly joins Chris to explore the wild west of software supply chain security. Kyle, author of the CramHacks newsletter, sheds light on the complicated and often misunderstood world of software supply chain security. He brings unique insights into the challenges, issues, and potential solutions in this constantly growing field. From his experiences in sectors like cybersecurity and security research, he adapts a critical perspective on the state of the software supply chain, suggesting it is in a 'dumpster fire' state. We'll dissect that incendiary claim and discuss the influence of open-source policies, the role of GRC, and the importance of build reproducibility. From starters to experts, anyone with even a mild interest in software security and its future will find this conversation enlightening.

Connect with Kyle Kelly:
→ CramHacks
→ Solve for Happy by Mo Gawdat

Mentioned in this episode:
→ CramHacks
→ Solve for Happy by Mo Gawdat
→ Semgrep
→ Log4j
→ OWASP Dependency-Track
→ OpenSSF
→ OpenSSF Scorecard
→ GitHub Dependabot
→ ReversingLabs
→ Roblox
→ Black Hat

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Kyle Kelly: The Dumpster Fire of Software Supply Chain Security
04:23 Very cool. Very cool. So let's, let's, uh, engage on this
08:27 Yeah, I mean, so when you think about SolarWinds then, and
09:39 Yeah, I think at the end of the day, many of
11:43 Okay. And so let's come back around to the, to the
19:13 I think the reality is nobody actually does. Because it's not
23:09 I think that's a good way to get fired as well
24:30 Mean, that's a great, it's a great practice. If you have
30:11 Yeah. And that, that just, I mean, it gets to the
31:39 Yeah. And then you've got like the scorecard, right
34:13 Good luck with that. I think you will get zero total
37:11 Yeah, I mean, there's, there's some truth to that in the
40:14 Alright. How about a key takeaway or a call to action

Chris Hughes -- Software Transparency Jan 20, 2024

Chris Hughes, co-founder of Aquia, joins Chris and Robert on the Application Security Podcast to discuss points from his recent book Software Transparency: Supply Chain Security in an Era of a Software-Driven Society, co-authored with Tony Turner. The conversation touches on the U. government in the software supply chain, the definition and benefits of software transparency, the concept of a software bill of materials (SBOM), and the growth of open-source software. Chris Hughes is a proven cloud cybersecurity leader. with nearly 20 years of experience in the federal and commercial industries. Chris has a dynamic skill set with a blend of IT, cyber cloud security, and DevSecOps experience.

Connect with Chris Hughes:
→ Software Transparency: Supply Chain Security in an Era of a Software-Driven Society
→ Application Security Program Handbook

Mentioned in this episode:
→ Software Transparency: Supply Chain Security in an Era of a Software-Driven Society
→ Application Security Program Handbook
→ Agile Application Security
→ CNCF Catalog of Supply Chain Compromises
→ Aquia
→ Software Transparency: Supply Chain Security in an Era of a Software-Driven Society
→ OpenSSF
→ OpenSSL
→ Let's Encrypt
→ Sigstore
→ Minimum Viable Secure Product
→ Executive Order 14028
→ Agile Application Security: Enabling Security in a Continuous Delivery Pipeline
→ The Application Security Program Handbook by Derek Fisher

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Chris Hughes: Software Transparency
03:42 Yeah, and you're, uh, you're co author of the latest book
04:31 Yeah, one thing that I kind of went down the thought
08:13 Yeah, yeah, and I think it's going to become a bigger
09:37 I think we've got, uh, we've got a couple different angles
11:52 Yeah, that's, that's always, you know, security and privacy, not privacy
15:32 I mean, that's why, when you think about one of the
17:01 Yeah, we're talking about the funding of nation states. Right, they
20:10 Yeah. So I've, uh, you know, I've kind of been waiting
22:48 Yeah. This is a weird situation in the sense that, you
25:14 Yeah. I mean, it's definitely a real risk. Uh, I feel
28:54 Yeah, that's, that's, but that's the reality of the, the world
31:51 All right. Well, let's, uh, let's talk about the, the kind
35:23 A billboard, what would it say for a message if you
37:14 Then, uh, yeah, Derek, excuse me, Derek was a guest on

Jay Bobo & Darylynn Ross -- App Sec Is Dead. Product Security Is the Future. Jan 09, 2024

Is application security dead, or does it need to grow into something larger? CoverMyMeds security leaders Jay Bobo and Darylynn Ross challenge the traditional AppSec model and argue for product security that follows business risk across the whole product. They compare centralized security teams with security specialists embedded in engineering, explain where threat modeling and automated testing belong, and discuss how to give developers useful SAST findings without drowning them in tool output. The conversation then turns to communication: executives need risk, impact, and business context rather than raw vulnerability details. Jay and Darylynn also question the industry’s reflexive reliance on penetration testing and share practical advice for aligning security work with product outcomes, engineering workflows, and the people responsible for shipping software.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Darylynn Ross and Jay Bobo:
→ Darylynn Ross on LinkedIn
→ Jay Bobo on LinkedIn
→ CoverMyMeds

Mentioned in this episode:
→ How to Measure Anything in Cybersecurity Risk, 2nd Edition
→ Kristin Hannah
→ CoverMyMeds
→ GitHub Dependabot

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Is AppSec dead? Meet Darylynn Ross and Jay Bobo
03:11 Jay’s path from development into security
04:23 Why traditional AppSec needs to become product security
09:21 Embedding security expertise inside development teams
20:24 Product security compared with application security
23:46 Threat modeling and risk at the product level
26:49 Giving developers useful SAST results
34:46 Aligning security work with business value
36:44 Communicating vulnerabilities across the organization
40:18 Turning technical findings into executive risk
43:07 Controversial opinions about AppSec
44:53 Questioning the industry’s reliance on penetration tests
47:07 Book recommendations
49:27 Key takeaways from Darylynn and Jay

Eitan Worcel -- Is AI a Security Champion? Dec 19, 2023

Eitan Worcel joins the Application Security Podcast, to talk automated code fixes and the role of artificial intelligence in application security. We start with a thought-provoking discussion about the consistency and reliability of AI-generated responses in fixing vulnerabilities like Cross-Site Scripting (XSS). The conversation highlights a future where AI on one side writes code while AI on the other side fixes it, raising questions about the outcomes of such a scenario. We're thrilled to host Eitan Worcel, the co founder and CEO of Mobb, and a seasoned AppSec expert with 15 years of experience. From his early days as a developer to his current role as a business leader, Eitan has been at the forefront of detecting security issues.

Connect with Eitan Worcel:
→ The Hard Thing About Hard Things by Ben Horowitz
→ The Hard Thing About Hard Things Ben Horowitz

Mentioned in this episode:
→ The Hard Thing About Hard Things by Ben Horowitz
→ The Hard Thing About Hard Things Ben Horowitz
→ ChatGPT
→ AppScan Standard (HCL)
→ Carnegie Mellon University Software Engineering Institute
→ OWASP Juice Shop
→ GitHub Copilot
→ Veracode

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Eitan Worcel: Is AI a Security Champion?
02:29 Luckily it's, you know, it's not easy being me is what
03:54 Understood. Understood. So typically when, uh, somebody joins us in the
08:01 Yeah. I mean, I'm gonna let Robert go next though. So
13:34 It's about trust. It's about, it's about like with this, with
18:12 That a common thing that's happening behind the scenes in the
20:13 Right, let's, uh, let's wrap back around here and start talking
23:05 Then what's, how, how do things, how is it different from
25:42 I mean, it sounds like that's a human function still, like
28:37 I like what you just were saying about predictability because you're
30:42 About how do we prevent the introduction of new vulnerabilities with
32:58 Does the AI handle complex, multi layered security issues in the
34:08 Yeah. I mean, that's, that's my next question. So where, you
37:04 Uh, what advice would you give an organization that's trying to
40:23 Yeah. Yeah. There's a privacy angle in there, uh, for the
41:58 You see, um, a world in AI where we'll have the
45:30 Okay. Number two, billboard message. What would it say if you

Björn Kimminich -- OWASP Juice Shop Dec 12, 2023

Bjorn Kimminich, the driving force behind the OWASP Juice Shop project, joins Chris and Robert to discuss all things Juice Shop. The OWASP Juice Shop is a deliberately vulnerable web application that serves as an invaluable training tool for security professionals and enthusiasts. Bjorn provides a comprehensive overview of the latest features and challenges introduced in the Juice Shop, underscoring the project's commitment to simulating real-world security scenarios. We're excited to have Bjorn Kiminich with us, a prominent figure in the application security world. As the product group lead application ecosystem at Kuhn plus Nagel, Bjorn is pivotal in shaping the AppSec program within the corporate IT landscape.

Connect with Björn Kimminich:
→ OWASP Juice Shop
→ Pwning OWASP Juice Shop

Mentioned in this episode:
→ OWASP Juice Shop
→ Pwning OWASP Juice Shop
→ OWASP Juice Shop Jingle
→ MultiJuicer
→ multi-juicer GitHub
→ OWASP Cheat Sheet Series
→ MetaMask

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Björn Kimminich: OWASP Juice Shop
01:55 With Hoff, come on, we're, yeah, we're just kidding. This is
04:54 Wait, what do you mean by that
08:02 That's all in Great. On the Web3 side, you've built a
09:26 That a new dependency now
12:52 We talked about some of the user challenges and UI updates
17:08 Another, uh, thing from the list here, um, we've talked with
20:57 Yeah, and you mentioned coding challenges. Uh, we forgot to talk
24:20 How, uh, how big is the Juice Shop team these days
26:09 Yeah, definitely. And, and, uh, yes, I mean, thanks to you
29:17 Alright, so we have three questions that we ask. So the
32:41 Uh, so number three, uh, what's your top book recommendation and
34:14 Bjorn, we're, as we wrap up our conversation here, what's, uh

Arshan Dabirsiaghi -- Security Startups, AI Influencing AppSec, and Pixee/Codemodder.io Dec 05, 2023

Arshan Dabirsiaghi of Pixee joins Robert and Chris to discuss startups, AI in appsec, and Pixee's Codemodder. io. This leads to a lengthy and convoluted process for fixing security issues, a problem that Arshan and his team have been working to address through their open-source tool, Codemodder. Arshan's journey from co founding Contrast with Jeff Williams to his current endeavors is filled with invaluable insights and lessons that have shaped the cybersecurity landscape. This is Chris Romeo. I am the CEO of Devici and also a general partner at Kerr Ventures, joined as always by my partner in crime, even though we don't do any crime, but my partner in crime, Robert Hurlbut.

Connect with Arshan Dabirsiaghi:
→ Arshan Dabirsiaghi
→ Pixee

Mentioned in this episode:
→ Pixee
→ Pixee's Codemodder.io
→ Hacking: The Art of Exploitation, Vol. 2
→ Aleph One's "Smashing The Stack for Fun and Profit"
→ Tim Newsham's "Format String Attacks"
→ Matt Conover's "w00w00 on Heap Overflows"
→ Jeremiah Grossman
→ Justin Rosenstein's original codemod on GitHub
→ Contrast Security
→ Arshan Dabirsiaghi
→ Semgrep
→ GitHub Copilot
→ Stack Overflow
→ Fortify (OpenText)
→ Aquia
→ FindBugs

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Arshan Dabirsiaghi: Security Startups, AI Influencing AppSec, and Pixee/Codemodder.io
04:23 Yeah, that's definitely is a seminal work. That, uh, doesn't get
06:48 Uh, Arshan, you mentioned, uh, uh, some of the things that
09:17 You work with those guys at Aspect
13:53 Yeah, 100%. And, like, my, the, the practice that I've adopted
16:39 Yeah. Cause I mean, in the startup world, you're going to
25:31 Yeah. And my conclusion so far, when it comes to generative
29:25 Yeah, it makes me think of the, of the The previous
35:31 Mean, we have to approach the, the world of technology as
37:01 Arshan, you mentioned your company, Pixee, and some of the things
45:43 This is a framework that others can contribute to, given that
47:58 What's the, what's kind of the check and balance, I guess
51:24 Yeah, so we have three questions. Uh, so first one is
53:09 Makes sense. What would it say if you could display a
54:36 Last question. What's your top book recommendation and why do you

Dr. Jared Demott -- Cloud Security & Bug Bounty Nov 28, 2023

Chris and Robert are thrilled to have an insightful conversation with Dr. Jared Demott, a seasoned expert in the field of cybersecurity. The discussion traverses a range of topics, from controversial opinions on application security to the practical aspects of managing bug bounty programs in large corporations like Microsoft. Hey folks, we're thrilled to welcome Dr. Jared DeMott, a cybersecurity veteran who started his journey at the NSA and has since made significant contributions to the world of AppSec. From teaching at renowned conferences and universities to leading successful startups focused on malware, monitoring, and pen testing, Jared's done it all. Currently, he's making waves at Microsoft, leading a team dedicated to safeguarding products and customers by transforming bug bounty reports into crucial fixes for cloud services.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Hey folks, we're thrilled to welcome Dr.
→ Learn more about Security Journey

Connect with Jared Demott:
→ Microsoft Security Response Center (MSRC)
→ Content-Security-Policy (MDN)

Mentioned in this episode:
→ Microsoft Security Response Center (MSRC)
→ Content-Security-Policy (MDN)

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introduction and Background
03:06 Dr. Jared DeMott's Journey into Cybersecurity
10:46 The Role at Microsoft and the Bug Bounty Program
14:52 The Top Vulnerabilities in Cloud and Online Services
35:37 The Labor Shortage in Cybersecurity: A Hot Take
42:14 Conclusion and Key Takeaways

Katharina Koerner -- Security as Responsible AI Nov 20, 2023

Dr. Katarina Koerner, a renowned advisor and community builder with expertise in privacy by design and responsible AI, joins Chris and Robert to delve into the intricacies of responsible AI in this episode of the Application Security Podcast. She explores how security intersects with AI, discusses the ethical implications of AI's integration into daily life, and emphasizes the importance of educating ourselves about AI risk management frameworks. She also highlights the crucial role of AI security engineers, the ethical debates around using AI in education, and the significance of international AI governance. This discussion is a deep dive into the world of AI, privacy, security, and ethics, offering valuable insights for tech professionals, policy makers, and individuals alike.

Connect with Katharina Koerner:
→ UNESCO Recommendation on the Ethics of Artificial Intelligence
→ OECD AI Principles

Mentioned in this episode:
→ UNESCO Recommendation on the Ethics of Artificial Intelligence
→ OECD AI Principles
→ White House Blueprint for an AI Bill of Rights
→ NIST AI Risk Management Framework
→ Microsoft Responsible AI Standard, v2
→ ENISA Securing Machine Learning Algorithms
→ Google Secure AI Framework (SAIF)
→ Artificial Intelligence
→ Ipd
→ Failure Modes In Machine Learning
→ Google Ai Red Team Digital Final
→ The Ethical Algorithm 9780190948207

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introduction: Dr. Koerner and Responsible AI
02:22 Dr. Katarina Koerner's Journey into the World of Security
05:31 Understanding Responsible AI Principles
17:20 The Intersection of Privacy and AI
36:59 The Future of AI Security
47:06 Final Thoughts and Call to Action

Ray Espinoza -- The AppSec CISO, Vendor Relationships, and Mentoring Nov 15, 2023

What does an application security leader need to know before stepping into the CISO role? Ray Espinoza joins Chris and Robert to share lessons from becoming a first-time CISO, aligning security work with business priorities, and building a culture where developers take pride in secure craftsmanship. Ray explains how he evaluates tools without confusing activity for impact, what good vendor relationships look like from the buyer’s side, and why empathy and credibility matter when security teams ask engineering teams to change. The conversation closes with practical advice on mentorship, leadership, and measuring whether an AppSec program is actually helping the business.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Ray Espinoza:
→ Ray Espinoza on LinkedIn

Mentioned in this episode:
→ Extreme Ownership

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Ray Espinoza and the AppSec CISO
01:54 From eBay to security leadership
04:59 Lessons from becoming a first-time CISO
08:26 Learning from failure without repeating it
11:29 How much security knowledge a CISO needs
15:57 Leading security in a smaller company
20:49 Aligning AppSec with business priorities
26:45 Choosing tools and evaluating vendors
30:44 Measuring security outcomes instead of activity
38:54 Building productive vendor relationships
42:13 Mentorship and growing security leaders
47:34 The leadership lightning round

Chris John Riley -- MVSP: Minimum Viable Secure Product Nov 07, 2023

Chris John Riley joins Chris and Robert to discuss the Minimum Viable Secure Product. MVSP is a minimalistic security checklist for B2B software and business process outsourcing suppliers. It was designed by a team that included experts from Google, Salesforce, Okta, and Slack. The MVSP objectives are targeted at startups and other companies creating new applications, helping such organizations meet security standards expected by larger enterprises like Google. The MVSP is designed to be accessible for users, as a way to streamline the process of vendor assessment and procurement from the start to the contractual control stages. We're thrilled to have Chris John Reilly, the driving force behind Google's Minimum Viable Secure Product Initiative, MVSP for short.

Connect with Chris John Riley:
→ Minimum Viable Secure Product
→ Cybersecurity Myths and Misconceptions

Mentioned in this episode:
→ Minimum Viable Secure Product
→ Cybersecurity Myths and Misconceptions
→ Phantoms in the Brain: Probing the Mysteries of the Human Mind
→ Phantoms in the Brain: Probing the Mysteries of the Human Mind
→ SLSA
→ NIST SP 800-53
→ PCI DSS

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Chris John Riley: MVSP: Minimum Viable Secure Product
02:24 At one of your recording locations. I was so jealous. I'm
07:34 We want to dive in, Chris, on, on MVSP, uh, minimum
10:49 MVSP apply if I'm in Enterprise then
13:01 Can you take us through the kind of the origin story
17:15 Hmm. Mm hmm. You mentioned that, uh, a number of the
20:42 Let me read back then the use case for MVSP and
22:00 I mean, that's one of the key benefits there is really
24:48 Yeah, that makes sense. And, and, you know, you mentioned contractual
27:43 Yeah. So we try and break out the controls into four
35:11 Yeah, I don't see anything that's, that I'm looking at this
37:48 Okay. So you might have to, you might have to do
39:54 Right. And, and it's often, often a misconsideration where people look
42:26 MVSP is designed to be Evolutionary, not revolutionary, right
45:06 I don't know if my views are controversial. Um, I mean
46:48 Excellent. And then a third question is, uh, what's your top

Steve Wilson and Gavin Klondike -- OWASP Top Ten for LLM Release Oct 31, 2023

The first OWASP Top 10 for Large Language Model Applications gave developers and security teams a shared threat model for a rapidly changing technology. Project leaders Steve Wilson and Gavin Klondike walk through the inaugural list and explain why familiar controls need to be reconsidered around probabilistic systems. They cover prompt injection, insecure output handling, training-data poisoning, denial of service, supply-chain vulnerabilities, sensitive information disclosure, insecure plugin design, excessive agency, overreliance, and model theft. Along the way, they distinguish application risks from attacks on the underlying model and show how plugins and autonomous actions can enlarge the blast radius. The episode closes with what the project learned from community feedback and how the list would evolve as real-world LLM deployments exposed new failure modes.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Steve Wilson and Gavin Klondike:
→ Steve Wilson on LinkedIn
→ Gavin Klondike on LinkedIn
→ OWASP GenAI Security Project

Mentioned in this episode:
→ OWASP Top Ten for LLM Applications project homepage
→ OWASP Top 10 For LLMs 2023 Slides V1 1
→ ChatGPT
→ LangChain
→ Tay (Microsoft chatbot)
→ DEF CON

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introducing the OWASP Top 10 for LLM Applications
01:37 A threat model for large language models
05:39 Risk 1 — Prompt injection
09:00 Risk 2 — Insecure output handling
11:35 Risk 3 — Training-data poisoning
15:14 Risk 4 — Model denial of service
19:11 Risk 5 — Supply-chain vulnerabilities
28:16 Risk 6 — Sensitive information disclosure
33:28 Risk 7 — Insecure plugin design
38:27 Risk 8 — Excessive agency
42:39 Risk 9 — Overreliance
46:31 Risk 10 — Model theft
49:56 Lessons for the next release

Tanya Janca -- What Secure Coding Really Means Oct 24, 2023

Tanya Janca, also known as SheHacksPurple, joins the Application Security Podcast again to discuss secure coding, threat modeling, education, and other topics in the AppSec world. With a rich background spanning over 25 years in IT, coding, and championing cybersecurity, Tanya delves into the essence of secure coding. We're honored to host the remarkable Tanya Janca, widely recognized as SheHacksPurple. Tanya is a brilliant mind behind the best selling book, Alice and Bob Learn Application Security, and the founder of WeHackPurple, a comprehensive platform dedicated to teaching the art of creating secure software. With a rich journey spanning over 25 years in IT, coding, and championing cyber security, Tanya has donned many hats, from serving in public sectors to leading at tech giants, and from founding trailblazing companies to spearheading community initiatives.

Connect with Tanya Janca:
→ Tanya Janca on LinkedIn
→ Alice and Bob Learn Application Security

Mentioned in this episode:
→ Alice and Bob Learn Application Security
→ WeHackPurple
→ This is How They Tell Me the World Ends
→ Tanya Janca (SheHacksPurple)
→ Alice and Bob Learn Application Security
→ Semgrep
→ r2c / Semgrep Inc.
→ Rust
→ Ruby
→ Ruby on Rails
→ Node.js
→ Adam Shostack
→ OWASP DevSlop Project

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Tanya Janca: What Secure Coding Really Means
03:04 So I think, uh, we wanted to kind of start diving
05:23 Yeah, you can't get away with that, right
17:35 That's why they're not our ex staff. I like that one
22:34 This is a bit of a softball question But coding and
27:50 Yeah. And I, my experience, I've seen what I like to
37:29 Yeah, it's so cool. And I was checking in our archive
38:58 Intro into the lightning round. All right. Uh, Tanya, we have
43:15 Next question. Uh, what would it say if you could display

Hasan Yasar -- Actionable SBOM via DevSecOps Oct 16, 2023

Hasan Yasar believes that everyone shares the responsibility of creating a secure environment, and this can only be achieved by working collaboratively. He underscores the idea that security is not an isolated endeavor but a collective effort, urging everyone to come together and build a world where safety and security are paramount. We're honored to have Hasan Yasar, the technical director of the Continuous Deployment of Capability Group at the renowned Software Engineering Institute at Carnegie Mellon University. With over 25 years of experience in secure software development, Hasan is at the forefront of leveraging emerging tech like DevSecOps, AI, ML, and more to drive transformation in software development.

Connect with Hasan Yasar:
→ Software Transparency: Supply Chain Security in an Era of a Software-Driven Society
→ Cybersecurity First Principles: A Reboot of Strategy and Tactics

Mentioned in this episode:
→ Software Transparency: Supply Chain Security in an Era of a Software-Driven Society
→ Cybersecurity First Principles: A Reboot of Strategy and Tactics
→ Carnegie Mellon University Software Engineering Institute
→ Software Transparency: Supply Chain Security in an Era of a Software-Driven Society
→ Software Transparency
→ Software Transparency: Supply Chain Security in an Era of a Software-Driven Society by Chris Hughes, Tony Turner
→ SPDX
→ Log4j

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Hasan Yasar: Actionable SBOM via DevSecOps
02:17 Yeah, we're going to unpack SBOM, as our listeners know, one
05:30 Caught my attention when you mentioned F-16 simulators and Secure by
11:22 We're heading, we're heading towards a world where... There's, there's, you
17:12 Yeah. And I think, you know, I think there is a
21:07 No, it was great, great conversation. Uh, uh, just quick aside
23:47 I know we've heard in your history, you've talked about some
31:38 Uh, so Hasan, uh, you've talked about or mentioned the term
34:46 Does that work
37:34 Does that work from a speed perspective
43:09 All right. So Hasan, we have, we have three questions. So
45:06 Excellent. And what's your top book recommendation

Varun Badhwar -- The Developer Productivity Tax Oct 10, 2023

Varun Badhwar is a three-time founder, a luminary in the cyber security industry, and a clear communicator. He joins Chris and Robert on the Application Security Podcast to discuss scanning with context, SBOM plus VEX, and the developer productivity tax. The concept of a "Developer Productivity Tax" acknowledges the challenges developers face when bombarded with a plethora of vulnerabilities. This "tax" represents the drain on developers' time and resources as they navigate through a myriad of potential threats, many of which lack actionable context. The inefficiencies arising from this process can lead to significant delays in software development, emphasizing the need for more refined tools and techniques.

Connect with Varun Badhwar:
→ Endor Labs
→ The Hard Thing About Hard Things by Ben Horowitz

Mentioned in this episode:
→ Endor Labs
→ The Hard Thing About Hard Things by Ben Horowitz
→ Software Transparency: Supply Chain Security in an Era of a Software-Driven Society by Chris Hughes, Tony Turner
→ OWASP Dependency-Track

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Varun Badhwar: The Developer Productivity Tax
02:11 You got to broadcast from wherever you are. So Robert is
05:47 Yeah, very cool. So, let's, let's dive into that. You know
08:39 CVSS. Because I know you've written a lot about CVSS, and
11:51 Whenever I, whenever I hear about reachability, I'm always curious to
15:00 Okay. So, here's another question for you. Uh, we've heard this
19:13 So the perfect state in the future will be a tool
21:06 I mean, I think it's gotta be a hundred percent to
28:52 Yeah, you might as well have a result. You might, you
31:48 There a consolidation coming in our market
35:22 All right. Next question. Uh, what would it say if you
36:40 Cool. Yeah, Tony Turner's a past guest. Chris Hughes is a

OWASP Board of Directors Debate Oct 03, 2023

Six candidates for the 2023 OWASP Board of Directors debate the choices that shape the foundation and its community. Paulino Calderon, Steve Springett, Avi Douglen, Izar Tarandach, Sam Stepanyan, and Fred Donovan discuss the experience they would bring to the board, their priorities if elected, and how OWASP should support projects as open source changes. Chris and Robert press the candidates on declining membership, vendor neutrality, and the role of revenue from global events. The result is a direct comparison of competing ideas about governance, community growth, project health, and how the board can keep OWASP useful to practitioners around the world.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with OWASP:
→ OWASP Foundation
→ OWASP Global Board

Mentioned in this episode:
→ OWASP CycloneDX
→ OWASP Dependency-Track
→ OWASP DefectDojo
→ ZAP
→ OWASP ASVS
→ OWASP Developer Guide

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 The 2023 OWASP board candidate debate
01:37 Candidate introductions and governing experience
09:36 The candidates’ priorities for OWASP
17:49 The future of OWASP open source projects
25:48 Reversing the decline in OWASP membership
34:29 Protecting vendor neutrality
41:54 Using proceeds from global events
46:41 Candidate responses and points of disagreement
58:20 Closing statements from the candidates

Itzik Alvas -- Secrets Security and Management Sep 26, 2023

Itzik Alvas, Co-founder and CEO of Entro, is an expert on secrets security. Itzik joins Chris and Robert to discuss the significance of understanding and managing secrets, emphasizing the importance of knowing how many secrets an organization has, where they are located, and their potential impact. He elaborates on the three pillars of secrets management: listing and locating secrets, classifying and understanding their potential blast radius, and monitoring them for any abnormal behavior. Itzik Alvas started his cybersecurity journey 17 years ago, when he was selected to join the elite cybersecurity unit of the IDF, Israel Defense Forces. He was introduced to the cybersecurity ecosystem there and gained enormous knowledge and experience on a nation state level.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Itzik Alvas started his cybersecurity journey 17 years ago, when he was selected to join the elite cybersecurity unit of the IDF, Israel Defense Forces.
→ Learn more about Security Journey

Connect with Itzik Alvas:
→ Entro
→ Foundation by Isaac Asimov

Mentioned in this episode:
→ Entro
→ Foundation by Isaac Asimov
→ Ringworld by Larry Niven
→ Seveneves by Neal Stephenson
→ Azure Key Vault
→ Aquia

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Itzik Alvas: Secrets Security and Management
02:03 We are, we are the original application security podcast. Like we
04:28 I understand. I've never been a CISO, so I can't say
07:06 I can imagine. So just to dive into our topic today
09:35 That's a big, that's a big number. I'm still stuck on
13:07 I guess another, another part of the program is how you
16:02 Yeah. Yeah. So I feel like we've, we've kind of explored
19:16 Definitely make sure I keep aware, but I'm sure there is
21:33 That's true. That's true. I mean, the Lambdas of the world
24:32 You're, you're advocating for almost like a secrets workflow management approach
28:03 You talked about, um, deleting, so, you know, I think about
32:47 We'll do. All right. So, um, what's your most controversial opinion
35:02 Very cool. And then finally, what's your top book recommendation

Harshil Parikh -- Deep Environmental and Organizational Context in Application Security Sep 19, 2023

Harshil Parikh is a seasoned security leader with experience building security and compliance functions from the ground up. He notably built the security and compliance team at Medallia from scratch and led it through several transitions. He is also a conference speaker, and, most recently, he co-founded Tromzo. Harshil shares insights about AppSec, running a startup, selling effectively, and provides justification for his mantra, "Context is king. Scaled the team globally, achieved compliance, SOC 2 ISO FedRAMP, went through an IPO, And secured seven mergers and acquisitions. Additionally, he's been a speaker at RSA Conference, AppSec USA, and CSX Europe. Harshil joins us to discuss developer first security, developer autonomy and guardrails, and challenges scaling AppSec programs.

Connect with Harshil Parikh:
→ The Metrics Manifesto by Richard Seiersen
→ Tromzo

Mentioned in this episode:
→ The Metrics Manifesto by Richard Seiersen
→ Tromzo

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Harshil Parikh: Deep Environmental and Organizational Context in Application Security
01:56 Yeah, that's good. That's, that's, uh, it's a good challenge or
04:47 Let's dive in a little bit to some of the work
06:57 What's your approach to get in front of the right people
10:35 It's a long, it's definitely a long term thing and that's
14:46 Mean, you don't really have to worry about having a good
20:42 Particular pushback did you get on that
23:30 Yeah, I was wondering about that in terms of guardrails. I
26:41 Does governance play in to that scaling problem that you just
33:49 There we go. All right, Harjul. Uh, so, first question is
35:06 Yeah. So, um, the next one we have is, uh, what

Jeff Williams -- The Tech of Runtime Security Sep 12, 2023

Jeff Willams of Contrast Security joins Chris and Robert on the Application Security Podcast to discuss runtime security, emphasizing the significance of Interactive Application Security Testing (IAST) in the modern DevOps landscape. After reflecting on the history of OWASP, the conversation turns to the challenges organizations face in managing their application security (AppSec) backlogs. Jeff highlights the alarming number of unresolved issues that often pile up, emphasizing the inefficiencies of traditional security tools. Jeff Williams is a veteran application security expert who founded and led OWASP, Aspect Security, and Contrast Security. Jeff also created several highly successful open source projects, including jbom, jot, OWASP Top Ten, WebGoat, ESAPI, ASVS, and more.

Connect with Jeff Williams:
→ Jeff Williams on LinkedIn
→ Java Observability Toolkit (JOT)

Mentioned in this episode:
→ Jeff Williams on LinkedIn
→ Java Observability Toolkit (JOT)
→ Venture in Security: solving the circle sticker problem
→ Contrast Security
→ B09NRF399J
→ Brakeman

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Jeff Williams: The Tech of Runtime Security
03:51 What's the root of that problem
05:42 You're someone who's been around AppSec since the beginning of AppSec
07:27 Let's, uh, let's take a look at that. Um, what is
09:12 In your, in your AppSec program that you're building here, are
11:46 Okay. What about performance though
16:55 Hmm. So are you using the same detection and rule technology
22:15 About reachability
25:16 You think about these types of technologies, I'm curious from your
29:47 Yeah. And that's one of the things, um, one, one of
33:00 Hmm. It's funny that, that, that were the, those were the
34:56 Good. Um, next is, uh, what would it say if you
37:13 Yeah. Very cool. So Jeff, we always like to end with

Mark Curphey and John Viega -- Chalk Sep 05, 2023

Development, operations, and security teams generate oceans of data yet still struggle to answer basic questions about what code is running, who owns it, and which findings matter. OWASP founder Mark Curphey and security veteran John Viega introduce Chalk, an open-source telemetry and observability tool designed to connect repositories, builds, deployments, and production systems. They explain how better provenance can eliminate irrelevant alerts, prioritize deployed software, trace incidents back to owners and commits, and confirm that fixes actually reached production. The conversation covers small-company and enterprise use cases, lessons from Log4Shell, performance overhead, supported platforms, and Chalk’s event model. Mark and John also discuss open-source sustainability and the Software Security Project before closing with candid views on where application security gets priorities wrong.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Mark Curphey and John Viega:
→ Mark Curphey on LinkedIn
→ John Viega on LinkedIn
→ Chalk
→ Crash Override

Mentioned in this episode:
→ Crash Override
→ Chalk
→ The Software Security Project
→ Atomic Habits
→ Start With Why
→ OWASP ZAP
→ Sigstore

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Mark Curphey and John Viega: Chalk
01:46 John’s path into application security
04:20 The de facto silos separating development and production
07:52 Chalk as telemetry for software engineering
12:12 Why startups also need production visibility
15:18 Log4Shell and the challenge of finding deployed software
17:08 How security teams can use Chalk
23:10 Chalk’s performance impact in production
25:00 Supported platforms and frameworks
28:00 Events, protocols, and outbound telemetry
42:18 Holding commercial users of open source accountable
46:32 Controversial opinions about AppSec
48:09 Industry messages, books, and closing thoughts

Maril Vernon -- You Get What You Inspect, Not What You Expect Aug 29, 2023

Maril Vernon is passionate about Purple teaming and joins Robert and Chris to discuss the intricacies of purple teaming in cybersecurity. She underscores the significance of fostering a collaborative environment between developers and the security team. Drawing from her experiences, Maril shares the challenge of development overlooking her remediation recommendations. She engaged directly with the developers, understanding their perspective and learning to frame her remediations in developer-centric language. This approach made her recommendations actionable and bridged the communication gap between the two teams. Meryl Vernon is a senior application security architect and Purple Team program manager. Meryl is also co-host and co-founder of the Cyber Queens podcast, an all-female-led podcast aimed at increasing female and LGBTQ diversity in cybersecurity.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Meryl Vernon is a senior application security architect and Purple Team program manager.
→ Learn more about Security Journey

Connect with Maril Vernon:
→ Purple Team Exercise Framework
→ Scythe

Mentioned in this episode:
→ Purple Team Exercise Framework
→ Scythe
→ MITRE ATT&CK Framework
→ AttackIQ
→ SafeBreach
→ PlexTrac
→ Atomic Red Team
→ mitre-attack/attack-navigator
→ 9781260464009
→ The Pentester BluePrint: Starting A Career As An Ethical Hacker P 9781119684305
→ Watkins
→ The Pentester Blueprint: Starting a Career as an Ethical Hacker

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Maril Vernon: You Get What You Inspect, Not What You Expect
02:31 Yeah, I'm very, very glad to have you here. And as
04:08 Yeah, definitely. Congratulations. What sparked your interest and what led you
06:30 I think my understanding of purple teaming, I may not have
10:44 Writing your remediations in dev. I must understand... I know we're
13:13 You in the code as you're preparing your remediation
14:45 Yeah. Let's talk about collaborative methods of AppSec. So, that's sort
19:19 Can you take us through a story of purple teaming
23:36 Long is this process going
25:36 Continuing on about purple teaming, what are some— you talked a
27:30 From a vendor perspective, so you mentioned a couple of different
30:03 Do the tools, the purple team commercial tools, stack up against
31:32 Do you see purple teaming going in the future
34:32 All right. Well, Meryl, we really appreciate you joining us today
37:14 Excellent. And what's your top recommendation for those interested in security

Dan Küykendall -- Why All Application Security Products Suck Aug 22, 2023

Dan Küykendall visits The Application Security Podcast to discuss his series "Why All AppSec Products Suck" and explain why software companies should understand the uses and limitations of any security tool. The series aims to highlight the limitations of each tool and to help users make informed decisions when selecting the right tools for their needs. In this field, there is no such thing as an expert; there is always something new to learn. Dan Küykendall is an industry leader in AppSec for 25 years with a total of 30 years in tech. He was the co-founder and CEO of NT OBJECTives until acquired by Rapid7 in 2015, where he served as Senior Director of Application Security Products until 2023.

Connect with Dan Küykendall:
→ Jeff Williams on LinkedIn
→ The Dan On Dev website

Mentioned in this episode:
→ The Dan On Dev website
→ Twitter (@dan_kuykendall)
→ Twitter (@Dan_On_Dev)
→ Instagram
→ Facebook
→ Fortify (OpenText)
→ Gary McGraw
→ Jeff Williams on LinkedIn

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Dan Küykendall: Why All Application Security Products Suck
01:55 Yeah. we got a, a, a special guest who's been doing
14:35 A good, that's a good level of curiosity though, right
21:29 Okay. So I'm gonna, I'm gonna, I'm gonna come at this
23:38 That would be, we, we can call that your kind of
29:41 Let me, let me bounce my, the reasons I don't like
42:29 Hey, Dan, let's, uh, take a look at what we have
45:30 You remember, uh, TCP/IP illustrated
47:05 Yeah. DNS doesn't use Port 80

Kevin Johnson -- Samurai Swords and Zap's Departure Aug 15, 2023

Kevin Johnson is the CEO of Secure Ideas. He began his career as a developer but turned toward security when he discovered that the interface for an intrusion detection system, Snort, was out of date. This led him to create BASE (Basic Analysis and Security Engine), a testament to Kevin's proactive approach. Kevin came to security from a development and system administration background. He has many years of experience performing security services for Fortune 100 companies, and in his spare time, he contributes to many open source security projects. Kevin joins us to explain OWASP SamuraiWTF and how developers can successfully learn about AppSec and use AppSec web app pentest tools.

Connect with Kevin Johnson:
→ Secure Ideas
→ SamuraiWTF

Mentioned in this episode:
→ Secure Ideas
→ SamuraiWTF
→ OWASP ZAP
→ Mark Curphey
→ OWASP Top Ten
→ SANS Institute
→ SANS SEC542
→ RSA Conference
→ Black Hat
→ B-Sides
→ Kali Linux
→ Damn Vulnerable Web App (DVWA)

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Kevin Johnson: Samurai Swords and Zap's Departure
03:33 All right. We should probably talk about, uh, Kevin's security origin
13:14 Very cool. So you mentioned, uh, about, uh, open source projects
23:11 Let's, talk a little bit about, uh, SamuraiWTF a little bit
31:02 Many paid members
34:00 What, but what there, there's, there's not a clear value proposition
39:25 I mean, he had, he had, I mean, when we did
45:29 All right. Well, we can skip Robert, I think, right to
48:03 That's good. I get it. I get, I get what you're
49:33 Let's, um, let's go, let's, let's give you a chance here

Tony Quadros -- The Life of an AppSec Vendor Aug 08, 2023

Tony Quadros, the AppSec Lumberjack, shares the unique career path that led him to find his passion in Application Security. The discussion delves into the work of an AppSec vendor, with Tony explaining his role and the responsibilities it entails. He emphasizes the importance of understanding the needs and environment of the customer, and whether the product he represents can fulfill their requirements. Tony also shares his philosophy of sales, centered around solving problems and providing business value. Tony Quadros, a cybersecurity veteran with over a decade of experience, has specialized in application security, aiding various enterprises including top social media and insurance companies in enhancing their application security programs.

Connect with Tony Quadros:
→ Chris Roberts (LinkedIn)
→ OWASP Maine

Mentioned in this episode:
→ OWASP Maine
→ OWASP Top 10 for LLM Applications
→ OWASP Slack
→ The Phoenix Project
→ Application Security Program Handbook
→ Chris Roberts (LinkedIn)
→ Contrast Security
→ Veracode
→ Steve Wilson -- OWASP Top Ten for LLMs

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Tony Quadros: The Life of an AppSec Vendor
02:22 It. That's gonna be the key. Like, I don't know how
05:16 Very cool. So you mentioned, uh, about sales and, uh, and
10:52 Yeah. And you're on, you're only as good as your last
13:42 In, in what you've seen, in your experience, what are salespeople
18:12 Uh, let's, uh, unpack this idea of building trust a little
26:35 Yeah. So let's, let's build a framework now as a vendor
31:04 Yeah. Any, uh, any other thoughts on the AE side as
33:18 Yeah. What about sales leadership
38:08 Often in startups, those numbers are hard and fast, and you
40:11 Sure. First question, what is your most controversial take on application
43:09 Very cool. Very cool. Well, let's, uh, why don't we conclude

Steve Giguere -- Cloud AppSec Jul 23, 2023

Cloud security is on an evolutionary path, with newer platforms embracing secure-by-default settings. This has led to a significant improvement in security but also adds complexity as developers need to understand these defaults when deploying to the cloud. Steve Giguere has experienced a wide breadth of technologies throughout his career, spending the aero, telecoms, and automotive industries improving quality, safety, velocity, and efficiency. After spending many years as a solution architect, specializing in Kubernetes security and establishing DevSecOps best practices for enterprise CI/CD pipelines, he's currently a Cloud Security Advocate with Prisma Cloud by Palo Alto. Specializing in cloud and application security. Steve joins us to discuss cloud application security, the complexity that it brings, how it changes security, and predictions on how it will change the industry over the next five years.

Connect with Steve Giguere:
→ Wing programming language
→ Hacking Kubernetes (book)

Mentioned in this episode:
→ Wing programming language
→ Hacking Kubernetes (book)
→ The Web Application Hacker's Handbook
→ OWASP ZAP
→ Kubernetes
→ The Phoenix Project
→ Heartbleed
→ Robert Hurlbut

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Steve Giguere: Cloud AppSec
08:04 Yeah. So Steve, uh, this term, uh, you know, putting this
09:35 We think about complexity, you know, when I think cloud and
14:05 I was, I was working with a client and um, just
17:03 Going back for a moment to this, those terms, cloud and
19:33 You think about different organizations that you're interacting with these days
22:46 That kind of your, is that where you're directing us or
26:23 That's, I mean, that's always what we're trying to do. We're
28:02 ...retrospective on this, this cloud AppSec. Well, we'll do it from
30:07 Yeah, I was, I was, I I think there's gonna be
32:24 In vein of like, um, was it in the vein of
34:49 Nice. What would be, uh, your couple of recommendations of open

Paul McCarty -- The Burrito Analogy of the Software Supply Chain Jul 14, 2023

"Visualizing the Software Supply Chain" is a project which aims to kick off a discussion about the scope and breadth of the software supply chain. Paul McCarty is a DevSecOps evangelist and the founder of Secure Stack, which helps software engineers and security teams collaborate better while building more secure applications. Paul is the author of several open source projects and is a collaborator on a number of others and helps run three meetups where he lives in Australia. Paul tried to be a professional snowboarder in the two thousands, but is now a skater dad who's passing his love of hacking software onto his kids.

Connect with Paul McCarty:
→ Visualizing the Software Supply Chain (GitHub)
→ DevSecOps Playbook (GitHub)

Mentioned in this episode:
→ Visualizing the Software Supply Chain (GitHub)
→ DevSecOps Playbook (GitHub)
→ SecureStack
→ OWASP DevSecOps Maturity Model (DSOMM)
→ OWASP CycloneDX
→ Minimum Viable Secure Product

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Paul McCarty: The Burrito Analogy of the Software Supply Chain
03:47 Were referred to. That. So how did, I mean, how'd you
04:53 Yeah, and I know we wanna talk about software. Supply chain
06:36 Have you thought about how software supply chain differs from other
09:52 You mentioned something that, uh, has been a bit of a
15:31 Making me super hungry for a burrito, by the. way. Like
17:33 SCV or is this source, yeah, sorry. S-C-V Source code. What's
21:00 You say, um, ser, when you say SaaS solutions there, can
22:05 And one of the things I found interesting, Paul, about this
25:20 This a project that other people could submit PRs against
27:28 I think we had, um, mentioned of the DevSecOps Playbook, and
30:33 Just to think about security some more. Um, And for developers
32:03 Paul, yeah. From a, uh, kind of a key takeaway call

Farshad Abasi -- Three Models for Deploying AppSec Resources Jul 09, 2023

Application security teams rarely have enough specialists to embed one expert with every development team. Farshad Abasi joins Chris for a focused comparison of three staffing models he used while building enterprise AppSec programs: expert-led support, a federated risk-based model, and a security champion or deputy model. Farshad explains why dedicated experts struggle to scale, how application tiering concentrates attention on the systems that matter most, and how champions can take ownership of routine security work with coaching and escalation from AppSec. The episode offers a practical progression for organizations trying to expand coverage without pretending scarce specialists can attend every stand-up and review every user story.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Farshad Abasi:
→ Farshad Abasi on LinkedIn
→ Forward Security

Mentioned in this episode:
→ OWASP Security Champions Guide
→ Forward Security

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Three models for deploying AppSec resources
01:21 Farshad Abasi’s path from development to security
03:28 The expert-led AppSec model
05:45 A federated, risk-based model
07:31 The security champion or deputy model
08:41 Choosing a model that can scale

Kim Wuyts -- The Future of Privacy Threat Modeling Jun 29, 2023

Kim Wuyts discusses her work in privacy threat modeling with LINDDUN, a framework inspired by Microsoft's STRIDE for security threat modeling. LINDDUN provides a structure to analyze privacy threats across multiple categories such as linking, detecting data disclosure, and unawareness. The framework has been updated over the years to incorporate new knowledge and developments in privacy, and it has become recognized as a go-to approach for privacy threat modeling. Kim Wutz is a senior privacy researcher at the IMEC DISTRINET research group at KU Leuven, Belgium. She has more than 15 years of experience in security and privacy engineering. Kim is one of the driving forces behind the development and extension of Linden, a privacy threat modeling framework.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Kim Wutz is a senior privacy researcher at the IMEC DISTRINET research group at KU Leuven, Belgium.
→ Learn more about Security Journey

Connect with Kim Wuyts:
→ LINDDUN
→ Threat Modeling Manifesto

Mentioned in this episode:
→ LINDDUN
→ Threat Modeling Manifesto
→ Kim Wuyts

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Kim Wuyts: The Future of Privacy Threat Modeling
07:44 I think about how prolific STRIDE is in the world of
09:42 Kim, you even commented on this on LinkedIn. I was exchanging
13:51 I thought, I'm like, I'm gonna work this. I'm gonna try
19:57 You mentioned privacy by design. What's the— I've always legitimately always
23:45 I do privacy by design, like, I feel like security or
25:53 With privacy by design, do I start with a set of
27:35 It sounds like when you're describing an existing system, something that
30:37 You don't immediately start looking for, I don't know, some crypto
32:10 Very cool. So, when you think about emerging trends or new
36:00 And generally you have to do that anyway, right
37:21 Right. Okay. So, here's my final question, and then we'll go
40:18 About a key takeaway or a call to action then

François Proulx -- Actionable Software Supply Chain Security Jun 22, 2023

Software supply chain -- how deep does the problem go? François is here to help us realize how deep the rabbit hole of the supply chain is and enlighten us with strategies to get out of the hole. François is a senior product security engineer for Boost Security, where he leads the supply chain research team. With over 10 years of experience in building AppSec programs for large corporations such as Intel and small startups, he's been in the heat of the action as the DevSecOps movement took shape. François is one of the founders of NorthSec and was a challenge designer for the NorthSec CTF.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
François is a senior product security engineer for Boost Security, where he leads the supply chain research team.
→ Learn more about Security Journey

Connect with François Proulx:
→ François Proulx on LinkedIn
→ deps.dev

Mentioned in this episode:
→ deps.dev
→ Sigstore
→ OpenSSF Scorecard
→ SLSA
→ Attack Trees (Schneier)
→ Let's Encrypt
→ OpenSSF
→ Terraform
→ OpenID Connect
→ Brook S.E. Schoenfield
→ Jonathan Marcil

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet François Proulx: Actionable Software Supply Chain Security
02:18 I do, definitely. Okay. I was going to trademark it, but
12:20 I think about the complexity of the modern software supply chain
18:57 Okay. So, what are some of the lessons
25:36 Continuing on the ATT&CK tree perspective, I'm going to kind of
27:51 Okay. Thanks. Yeah, that was helpful to kind of, as I'm
33:20 Could we or should we create the same thing for the
39:46 François, we're coming to the end of our conversation, and I

Steve Wilson -- OWASP Top Ten for LLMs Jun 15, 2023

How do we do security in the world of AI and LLMs? A great place to start is with an OWASP project tasked with creating a standardized guideline for building secure AI applications with large language models such as ChatGPT. Enter OWASP Top Ten for LLMs, and Steve Wilson, the project leader. Steve Wilson is currently the Chief Product Officer at Contrast Security. Today, his team is responsible for engineering, product management, product marketing, and product design for all products. He's also currently leading the project at the Open Worldwide Application Security Project, or OWASP, creating a standardized guideline for building secure AI applications with large language models such as ChatGPT.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Steve Wilson is currently the Chief Product Officer at Contrast Security.
→ Learn more about Security Journey

Connect with Steve Wilson:
→ Steve Wilson on LinkedIn
→ Steve Wilson on LinkedIn

Mentioned in this episode:
→ OWASP Top 10 for LLM Applications
→ ChatGPT
→ Contrast Security
→ OWASP API Security Top 10
→ GitHub Copilot
→ Jeff Williams on LinkedIn
→ OWASP Slack
→ Steve on LinkedIn

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Steve Wilson: OWASP Top Ten for LLMs
01:47 Yeah, artificial intelligence seems to be the thing that's on everybody's
07:38 Is that
13:35 You've got this whole, you know, you got people that are
20:22 That's a really powerful use case to think about a SOC
29:45 ChatGPT and all these other services are using API as a
33:20 We think about mitigations now for prompt, I wanna come back
40:02 Yeah, that's great though. It's good to know that even all

JB Aviat -- The State of Application Security Jun 07, 2023

What is the state of application security? JB Aviat answered that question by creating the state of application security report based on data from Datadog customers using the application security and APM products. It provides insights into threat detection, vulnerability detection, prioritization, and general trends regarding the most significant risks. Jean dedicates to democratizing security by developing the security products of Datadog, leveraging the unique observability capabilities of the platform. Before this, JB was CTO and co-founder of Screen a cybersecurity company providing an automated SaaS solution to protect web applications without traffic redirection or code modification. Screen was acquired by Datadog in April, 2021.

Connect with JB Aviat:
→ Datadog State of Application Security report
→ Sqreen (now Datadog AAP)

Mentioned in this episode:
→ Datadog State of Application Security report
→ Sqreen (now Datadog AAP)
→ WordPress
→ Aquia

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet JB Aviat: The State of Application Security
02:31 Yeah, so tell us before we even get into the details
05:17 Yeah. One of the things that, that I really appreciate about
12:47 We, when I, when I think about this, like, is this
15:03 Getting, I'm, I'm tracking with you now. I'm I'm getting it
22:41 I mean, I, I think that's, that's consistent when, like, when
26:37 Were you, were you able to tra trace
29:03 Very cool. Very cool. All right. What's next
35:49 Cool. Let's keep going. What's number six
36:55 Yeah. Word WordPress rules the internet. We know it. That's why
40:19 I, I, I think of a couple of things on this

Joshua Wells -- Application Security in the Age of Zero Trust Jun 01, 2023

What is zero trust, and how does it impact the world of applications and application security? We dive deep into zero trust with Joshua Wells, a seasoned cybersecurity expert with over ten years of experience. Joshua explores the intricacies of zero trust, a cybersecurity model that dictates no user or machine is trusted by default and must be authenticated every time. Joshua Wells is a seasoned cybersecurity expert with over 10 years of experience leading teams and organizations through intricate cybersecurity situations. His extensive background includes working with various government bodies and private sector organizations, specializing in areas such as architectural security, endpoint detection, mobile device management, and risk assessment.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Joshua Wells is a seasoned cybersecurity expert with over 10 years of experience leading teams and organizations through intricate cybersecurity situations.
→ Learn more about Security Journey

Connect with Joshua Wells:
→ BeyondCorp
→ CISA Zero Trust Maturity Model

Mentioned in this episode:
→ BeyondCorp
→ CISA Zero Trust Maturity Model
→ NIST SP 800-53
→ Zscaler
→ LogRhythm
→ Sumo Logic
→ DISA STIG
→ OWASP Top 10
→ OWASP API Security Top 10
→ Cyber Vault Solutions

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Joshua Wells: Application Security in the Age of Zero Trust
02:59 How'd you get into security
06:18 As we were talking before the interview, I have to add
07:16 Like Superman, what was his name
10:51 With zero trust then, I primarily think of network architecture is
14:53 Everything is internet accessible. Everything is public IP addressable. All the
18:08 Back to the regularly scheduled programming here. When you think about
20:38 Thinking through that a little bit, for an organization when they've
23:10 All right, so we talked about the positive side. I mean
25:58 Yeah, and I've seen similar, and you probably have too, in
28:37 We think about areas of focus that an AppSec person should
32:14 As I'm listening to you talk about applications in a zero
35:24 In the deep end of the zero trust pool, what would
37:15 As far as a call to action, so let's just assume

Jeevan Singh -- The Future of Application Security Engineers May 15, 2023

Jeevan Singh, the director of product security at Twilio, discusses the future of application security engineers. Singh highlights the importance of embedding security into all aspects of software development and the need for a strong security culture within organizations. He also explains the skills required for a senior application security engineer, such as application security, software development, and teaching skills. Singh underscores the importance of empathy and influence, emphasizing that soft skills can significantly affect adequate application security. He also discusses the impact of AI, particularly OpenAI's GPT, in supporting the work of security engineers by providing valuable insights and information. Singh concludes by urging application security engineers to broaden their skills, particularly in software development, to ensure they can effectively handle the industry's evolving demands.

Connect with Jeevan Singh:
→ Twilio
→ ChatGPT

Mentioned in this episode:
→ Twilio
→ ChatGPT

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Jeevan Singh: The Future of Application Security Engineers
03:25 Would you describe the future of application security engineer
07:18 Yeah, I feel like there's, I mean, maybe 5,000 AppSec engineers
10:24 Hmm. Yeah. And you're talking to, to two owas lifetime members
12:43 Of those three, you know, so AppSec skills, software development skills
17:16 About the teaching skills
21:01 You tell stories about, you know, things you've done in, in
23:17 Yeah. Yeah. And I like, I like the, the, where you
25:03 I like that. I'm gonna use that going forward. That multiplier
32:38 Does it scale
35:26 Does that play, uh, in, so you talked sort of around
39:23 We just got a, there's a, there's a mini episode included
43:59 I've been thinking about this quite a bit, lately, as far

Tony Turner -- Threat Modeling and SBOM May 03, 2023

Have you ever considered using an SBOM to inform your threat modeling? Tony Turner has. Tony joins us to discuss SBOMs, threat modeling, and the importance of Cyber Informed Engineering. Tony Turner is the CEO and founder of Ops-Wright, a new type of cybersecurity company disrupting security engineering for critical infrastructure. I found Tony via a talk he did on threat modeling in SBOM. Topic caught my attention, so I reached out to have a conversation. We talk about threat modeling in SBOM, the value proposition of SBOM, security engineering in SBOM, and cyber-informed engineering. This is something you'll want to learn about. I'd never heard of it before, but it could also help us in building more secure applications and products both.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Tony Turner is the CEO and founder of Ops-Wright, a new type of cybersecurity company disrupting security engineering for critical infrastructure.
→ Learn more about Security Journey

Connect with Tony Turner:
→ Opswright
→ Cyber-Informed Engineering (INL)

Mentioned in this episode:
→ Opswright
→ Cyber-Informed Engineering (INL)
→ Consequence-driven Cyber-Informed Engineering (CCE)
→ Software Transparency
→ IriusRisk
→ Open Threat Model (OTM)
→ PyTM
→ Contrast Security
→ CycloneDX
→ VEX
→ National Vulnerability Database (NVD)
→ Software Transparency: Supply Chain Security in an Era of a Software-Driven Society by Chris Hughes, Tony Turner
→ OWASP pytm

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Tony Turner: Threat Modeling and SBOM
01:49 Yeah, I mean, getting into a style of threat modeling or
05:21 And so when you, when you mentioned kind of in the
06:51 To jump into our topic today, Tony, what's an SBOM
09:38 Tony, when you think of the value proposition of SBOM, like
13:39 Right
19:51 Yeah, this is the first time that I've ever bumped into
21:59 Makes sense. And OT, you mean operational technology, right
28:59 You think about, like, when we think about the process that
31:25 You also mentioned there were some tools that you used as
34:47 I'm going to— we had another question about CycloneDX, but I'm—
37:34 Yeah. Okay, cool. So I guess, Tony, from a key takeaway
39:17 Okay. So how about a key takeaway then, or a call
43:10 Very good. Well, Tony, thank you for being with us today

Christian Frichot -- Threat Modeling with hcltm Apr 18, 2023

Christian Frichot, an AppSec hacker, security leader, and developer of hcltm. He discusses the DevOps threat modeling tool he dreamed up and built. The tech was created to fit into developers' workflows and leverage tools they are familiar with. hcltm is designed to drive valuable change and be updated and maintained easily by software engineers. It is a developer-centric software product not heavily opinionated on diagramming, allowing users to employ their preferred methods for threat modeling. The solution is still evolving, and Frichot is open to user feedback and suggestions to improve it. He encourages people to try hcltm and see if it fits their threat modeling needs, as everyone approaches the process differently.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Here's a list of things that Christian Frichot is.
→ Learn more about Security Journey

Connect with Christian Frichot:
→ hcltm (now threatcl) on GitHub
→ Terraform

Mentioned in this episode:
→ hcltm (now threatcl) on GitHub
→ Terraform
→ Semgrep
→ Open Threat Model (OTM)
→ Microsoft Security Development Lifecycle (SDL)
→ OWASP AI Security and Privacy Guide

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Christian Frichot: Threat Modeling with hcltm
02:01 We're super excited to have Christian Frichot with us this evening
05:58 Yeah, excellent. So, I have so many questions, and we haven't
10:17 Yeah, so Christian, so this new tool that has been around
17:45 There a structured set of language and commands and things that
24:34 Yeah. And look, that's definitely a gap in the tool. Like
26:48 With that in mind, so there's an assumption, it sounds like
29:35 Yeah. I think this is the future, right
31:13 Yeah. And it is quite funny. I think that's the other
35:52 I kind of like those sorts of, you know, Unix philosophy
37:30 To past episodes, 'cause you were talking about Microsoft and them
40:28 You see it as a bidirectional communication or a unidirectional communication
42:42 Yeah. Yeah. We're starting to see them. I mean, I've started
45:27 Yeah. Have you— I was trying to figure out, have you
47:46 The best place for them to go is the GitHub repo

Zohar Shachar -- Bug Bounty from Both Sides Apr 03, 2023

Zohar Shachar joins us to discuss the bug bounty process from both sides. Zohar has spent time as a bug bounty hunter and shares wisdom on avoiding bug bounty-causing issues for your AppSec posture. We hope you enjoy this conversation with... Zohar spent time as a bug bounty hunter and shares wisdom on avoiding bug bounty causing issues for your application security posture. Keep security top of mind with continuous application security training for your developers. Security Journey offers bite-sized lessons with hands-on interactive training for all roles in the SDLC. Give your admins the ability to use pre-built or custom training paths with easy-to-use tracking and reporting.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Zohar Shachar joins us to discuss the bug bounty process from both sides of the equation.
→ Learn more about Security Journey

Connect with Zohar Shachar:
→ HackerOne
→ Google Abuse Vulnerability Reward Program

Mentioned in this episode:
→ HackerOne
→ Google Abuse Vulnerability Reward Program
→ Enso Security
→ Aquia

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Zohar Shachar: Bug Bounty from Both Sides
02:06 Let's get after it here. Super excited to have Zohar Shachar
05:42 Yeah. So I do have a question for you in regards
07:12 There is a lesson learned there, right
14:20 On the side of the researcher then, because I've heard other
17:57 You think about bug bounty versus pen testing, as since you're
21:01 Here's the million-dollar question. If you could only do one, what
24:42 Imagine if somebody invented a new service. It's lack of denial
28:24 Yeah. What are some other tips that you can offer to
33:58 That almost seems like a key takeaway, but I'll ask anyway

Sarah-jane Madden -- Threat Modeling to established teams Mar 23, 2023

Sarah-Jane Madden is the Chief Information Security Officer of Sensing Technology Group. - part of Fortive. She has over 20 years of software experience, from the most formal environments to ‘let’s fix it in production’ type teams. She has been a longtime advocate of deliberate application security as a partnership with product management and believes security does not have to be an overhead. Sarah-Jane joins us to discuss her talk at OWASP Dublin, "Far from green fields — introducing Threat Modeling to established teams. " She shares lessons learned from her 3-year journey and is transparent with the mistakes she made along the way. We hope you enjoy this conversation with...

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Arm your developers with engaging secure coding lessons developed with input from leading application security experts.
→ Learn more about Security Journey

Connect with Sarah-jane Madden:
→ Fortive
→ Microsoft Threat Modeling Tool

Mentioned in this episode:
→ Fortive
→ Microsoft Threat Modeling Tool

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Sarah-jane Madden: Threat Modeling to established teams
05:34 Yeah, very cool. So, when I think about bank security, everything
08:01 Yeah. So, I got a chance to catch your talk at
13:22 Yeah, yeah. And that's, you know, what you're describing here, I
19:10 A couple of questions that came to me as I was
22:51 Then you also mentioned kind of when you first were the
26:29 Yeah, and you mentioned the word tribal. And so, were there
38:00 I don't care what the actual answer is. I'm just trying
40:33 As we kind of come to the end of our conversation

Jet Anderson -- The AppSec Code Doctor Mar 16, 2023

Jet Anderson's passion is teaching today's software developers to write secure code as part of modern DevOps pipelines, at speed and scale, without missing a beat. He's been a software engineer for over 25 years and believes fixing security bugs is better than finding them. Jet joins us to discuss software or security engineer first, how fixing security bugs is better than just finding them, and the Code Doctor security training program he built and deployed. We hope you enjoy this conversation with... Jett Anderson's passion is teaching today's software developers to write secure code as part of modern DevOps pipelines at speed and at scale without missing a beat.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Jett Anderson's passion is teaching today's software developers to write secure code as part of modern DevOps pipelines at speed and at scale without missing a beat.
→ Learn more about Security Journey

Connect with Jet Anderson:
→ OWASP Top 10
→ CSSLP

Mentioned in this episode:
→ OWASP Top 10
→ CSSLP
→ CISSP
→ OWASP Dependency-Check
→ Content Security Policy Cheat Sheet
→ OAuth 2.0
→ OpenID Connect
→ Jim Manico
→ Gary McGraw
→ Content-Security-Policy (MDN)

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Jet Anderson: The AppSec Code Doctor
01:49 Yeah, but we're going to take a left turn or a
04:52 Do you define a vulnerability as then
07:54 Yeah, that's true. So, I want to hit play on that
14:31 There, you know, kind of a lesson within the way that
17:39 You should understand is the OWASP Top 10. But I'm curious
21:08 Yeah, I mean, it's empathy, right
25:28 Kind of what is it and what were the pieces that
35:02 Yeah, that's great. It's— I always love, like I said, I

James Mckee -- Developer Security Mar 09, 2023

James Mckee is a developer (MCPDEA) and security advocate (CISSP) whose biggest responsibility is leading developer security practices. He sets the standards and procedures for the practice's operations and leads all client engagement efforts concerning security. He also takes the lead in ensuring that company staff (developers specifically) are properly trained and following best practices concerning application security. Currently, he is responsible for training and providing product guidance for developers worldwide. James joins us to discuss offensive application security for developers. We also get into the role of security professionals in reaching developers outside of the security echo chamber. We hope you enjoy this conversation with...

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
James McKee is a developer, MCP-DEA, and a security advocate, CISSP, whose biggest responsibility is leading developer security practices.
→ Learn more about Security Journey

Connect with James Mckee:
→ Applied Cryptography
→ AppSec Village

Mentioned in this episode:
→ Applied Cryptography
→ AppSec Village
→ DEF CON
→ Start with Why
→ Stack Overflow
→ Information Security Stack Exchange
→ ChatGPT
→ GitHub Copilot
→ OWASP Top 10
→ OWASP ASVS
→ OWASP Proactive Controls
→ OWASP Cheat Sheet Series
→ BSides Boulder
→ OWASP Cheat Sheet Series

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet James Mckee: Developer Security
02:01 Yeah, and it's been, I don't know, 6 weeks, 2 months
07:13 Yeah, we hear that a lot in AppSec people. A lot
10:43 Great experience for me too. So I did a threat modeling
13:01 Yeah. Yeah. Let's, let's call an audible on our plan here
20:24 Which is not a great thing. And I remember one example
25:54 Are they training that
28:49 About, so you're talking about training the junior developers, but what
29:56 Right
32:05 We kind of went off on a bit of a tangent
35:00 Yeah, GitHub says there's 26 million developers on Earth right now

Derek Fisher -- The Application Security Handbook Mar 02, 2023

Derek is the author of “The Application Security Handbook. ” He is a university instructor at Temple University, where he teaches software development security to undergraduate and graduate students. He is a speaker on topics in the cybersecurity space and has led security teams, large and small, at organizations in the healthcare and financial industries. Derek joins us to unpack the goals of an application security program, what is cutting edge in application security programs today, the role of open source vs. commercial, and guidance such as "decentralized application security. " "enablement instead of gates; application security as a service," and "stop chasing the shiny new tool.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Derek Fisher is the author of The Application Security Handbook.
→ Learn more about Security Journey

Connect with Derek Fisher:
→ The Application Security Handbook
→ Application Security Program Handbook

Mentioned in this episode:
→ The Application Security Handbook
→ Application Security Program Handbook
→ Manning Publications
→ OWASP ModSecurity Core Rule Set

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Derek Fisher: The Application Security Handbook
02:04 Excellent. And I know you just wrote a book or just
04:27 Derek, you mentioned in our previous conversation getting ready for this
10:27 Rewind the tape here. That's not entry-level. If you have to
14:51 It's, I mean, I think there is value though, right
17:26 With that in mind, in thinking about application programs today, is
20:02 I think about, you know, across the innovation we've seen in
22:18 I think part of the challenge is there really hasn't been
25:38 Yeah, it kind of brings you to more of a culture
30:17 Or sound impressive, right
33:52 So you also, you know, you kind of mentioned this a
38:16 Yeah, no, that's helpful, helpful to have that perspective. Like, it's
39:22 My, I'm going to go first with a key takeaway here

Rob van der Veer -- OWASP AI Security & Privacy Guide Feb 23, 2023

Rob van der Veer has a 30-year background in software engineering, building AI businesses, creating software, and assessing software. He is a senior director at the Software Improvement Group, where he established practices for AI, security, and privacy. Rob is involved in several standardization initiatives like OWASP SAMM, ENISA, CIP, and AI security & privacy guide. He leads the writing group for the new ISO standard on AI engineering: 5338. Rob co-leads the OWASP integration project, with openCRE. org as a key result, aiming to create alignment in the standards landscape. Rob joins us to introduce the OWASP AI Security and Privacy Guide. We hope you enjoy this conversation with...

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Rob van der Veer has a 30-year background in software engineering, building AI businesses, creating software, and assessing software.
→ Learn more about Security Journey

Connect with Rob van der Veer:
→ OWASP AI Security and Privacy Guide
→ openCRE.org

Mentioned in this episode:
→ OWASP AI Security and Privacy Guide
→ openCRE.org
→ ChatGPT
→ Tay (Microsoft chatbot)
→ Gary McGraw
→ OWASP SAMM
→ ENISA
→ OWASP Project Spotlight Series
→ GitHub Copilot

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Rob van der Veer: OWASP AI Security & Privacy Guide
01:32 Hey folks, welcome to another episode of the Application Security Podcast
06:56 Yeah, no, it's helpful to understand because you're coming to the
09:22 We're thinking about, you know, in your experience and observations on
12:50 I've heard somebody say, I've heard people say, like, at a
15:19 You know, excuse my naivety here, but from when we're talking
16:48 That's helpful. So, I had another question. As you were talking
25:30 Looking back at the guide, the scope of the guide, how
32:20 Yeah, especially when you're thinking, you know, you mentioned earlier that
35:05 Thinking about organizations who are looking to build an AI system
38:59 Yeah, excellent. So, I certainly learned a lot through this short

Robyn Lundin -- Planning & organizing a penetration test as an AppSec team Jan 10, 2023

Robyn Lundin started working in tech after a coding boot camp as a developer for a small startup. She then discovered her passion for security, pivoted into pentesting for NCC Group, and now works as a Senior Product Security Engineer for Slack. Robyn joins us to discuss the role of penetration testing within the application security realm. Robyn provides actionable guidance that you can apply directly to your application pen testing program. We hope you enjoy this conversation with Robyn London. The conversation connects NCC Group, Slack, OWASP Juice Shop to practical choices that application security teams can make in their own programs.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We help enterprises reduce vulnerabilities through application security education for developers and everyone in the SDLC.
→ Learn more about Security Journey

Connect with Robyn Lundin:
→ NCC Group
→ Slack

Mentioned in this episode:
→ NCC Group
→ Slack
→ OWASP Juice Shop

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Robyn Lundin: Planning & organizing a penetration test as an AppSec team
03:37 Very, very cool. And that's, you know, one of the things
05:59 Very cool. And mentorship is such an important thing for us
07:17 Great advice. So Robyn, as we get started today in talking
08:55 To kind of dive into the deep end of our penetration
13:27 Yeah. So you mentioned low-hanging fruit, and I guess that's always
17:37 I've been away from pen testing for a long, long, long
20:16 Frequency. So let's say we have 1,000 apps. Do we test
22:07 Yeah, and just to let the record show, I think we
24:57 Would that also apply to, so if we had internal resources
26:48 Very good. So if you would, Robyn, just sort of wrapping

Michael Bargury -- Low Code / No Code Security and an OWASP Top Ten Jan 03, 2023

Michael Bargury is the Co-Founder and CTO of Zenity, where he helps companies secure their low-code/no-code apps. In the past, he headed security product efforts at Azure, focused on IoT, APIs and IaC. Michael's passionate about all things related to cloud, SaaS, and low-code security, and spends his time finding ways they could go wrong. He also leads the OWASP Low-Code Security Project and writes about it on Dark Reading. Michael's a regular conference speaker at OWASP BSides, DEF CON, Michael joins us to unpack low-code, no-code, and the new OWASP Top 10 that defines specific risks against low and no-code. We hope you enjoy this conversation with Michael Bargheri.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We help enterprises reduce vulnerabilities through application security education for developers and everyone in the SDLC.
→ Learn more about Security Journey

Connect with Michael Bargury:
→ Zenity
→ OWASP Low-Code/No-Code Top 10

Mentioned in this episode:
→ Zenity
→ OWASP Low-Code/No-Code Top 10
→ Robert Hurlbut

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Michael Bargury: Low Code / No Code Security and an OWASP Top Ten
01:33 Yeah. And you just got back from Global AppSec, right, in
04:13 Michael, so thanks again for joining us. As I mentioned, our
08:49 Yeah. So, just to And sure, I want to kind of
10:15 That's no-code then in that example, right
18:23 Wow. Yeah, it's a whole new avenue that nobody's really thought
20:16 With that in mind, you know, I was thinking about that
23:28 You have an example
26:46 You agree with that or is there something I'm missing
29:34 So, you've put together this new project, the OWASP Top 10
36:11 Michael, you have— I mean, I really love this list. It's
38:43 I look at these, you've got, you know, I'm looking at
42:56 Yeah. So, there's a lot more here to look at, and

Alex Olsen -- Security champions, empowering developers, and AppSec training Dec 20, 2022

Alex leads the Cyber Security Consulting Group, part of Rakuten's Cyber Security Defense Department. The group's dedication is to providing global security services, including security architecture, DevSecOps tooling and integration services, delivery of technical training, and running Rakuten's Security Champion community. His focus is on empowering teams to improve security throughout the development lifecycle. Alex Olsen leads the Cybersecurity Consulting Group, part of Rakuten's Cybersecurity Defense Department. The group is dedicated to providing global security services, including security architecture, DevSecOps tooling and integration services, delivery of technical training, and the running of Rakuten's Security Champion Community. Alex joins us to talk about security champions, one of the topics that's near and dear to my heart.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We help enterprises reduce vulnerabilities through application security education for developers and everyone in the SDLC.
→ Learn more about Security Journey

Connect with Alex Olsen:
→ Rakuten: Democratizing AppSec
→ OWASP Global AppSec APAC

Mentioned in this episode:
→ Rakuten: Democratizing AppSec
→ OWASP Global AppSec APAC

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Alex Olsen: Security champions, empowering developers, and AppSec training
03:54 There was a term that was used, democratizing AppSec. And it
07:00 Yeah. So, I guess what's the trade-off then when you— it
10:21 Like, they are the police because they can stop deployments, they
11:36 Yeah, so the kind of primary thing we want to talk
15:03 What's been your response or your experience with that
19:43 I'm listening to kind of— you're describing an onboarding process for
22:21 We think about, like, scope, cost, and effort, levels of effort
26:50 There's lots of excitement, right
35:21 Tactically or specifically about individual champions now. What have you seen
46:20 It was the return on investment. So, you know, what are
53:59 From a key takeaway perspective now, so let's kind of summarize

Mark Curphey -- The future of OWASP Dec 13, 2022

Mark Curphey is one of the creators of OWASP from the very early days. Mark worked in the background over the few decades of OWASP but has recently taken more to the spotlight. After running, he was elected and joined the OWASP Board of Directors. Hello, fine listeners from all over planet Earth. This is Chris Romeo, and I just wanted to let you know that you're in for a treat with this week's episode. This week we're joined by Mark Kerfe, and you may or may not have known, but Mark was involved in the creation of OWASP from the very early days. Now, Mark has been working in the background helping things happen over the few decades of OWASP, but he has recently run for and been elected to the OWASP Board of Directors.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We help enterprises reduce vulnerabilities through application security education for developers and everyone in the SDLC.
→ Learn more about Security Journey

Connect with Mark Curphey:
→ Jeff Williams on LinkedIn
→ OWASP

Mentioned in this episode:
→ OWASP
→ OWASP Top Ten
→ WebGoat
→ OWASP Juice Shop
→ ZAP
→ OpenSSF
→ Alpha-Omega
→ Sigstore
→ CycloneDX
→ OWASP ModSecurity Core Rule Set
→ Royal Holloway Information Security
→ Ward Cunningham
→ Linux Foundation
→ Mark Curphey
→ OWASP Top Ten
→ OpenSSL
→ Jeff Williams on LinkedIn
→ Christian Folini

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Mark Curphey: The future of OWASP
03:58 You're getting to university, you're in this kind of information security-focused
12:26 Would you say then was the first project
15:33 It definitely is fun to watch kind of where it's gotten
22:02 I think about, you know, kind of taking a different strategy
25:35 Yeah. No, that definitely makes sense. So, you know, when I
31:24 Cool. Let's transition and talk a little bit about the larger
35:06 There's a lot more moving pieces to it. So, When we
38:59 Yeah, that is a great goal for all of us to

Tiago Mendo -- How to scan at scale with OWASP ZAP Dec 06, 2022

Tiago Mendo is a co-founder and CTO of Probely. He has extensive experience in pentesting applications, training, and providing all-around security consultancy. Tiago Mendo is a co-founder and CTO of Probly. He has extensive experience in pen testing applications, training, and providing all-around security consultancy. He started working with security in the early 2000s with a tenure of 12 years at Portugal Telecom, where he built the web security team and worked with 150+ developers. He holds a master's in information technology, information security from Carnegie Mellon University, and a CISSP certification. He's also a qualified member of AP2SI, a nonprofit organization that promotes information security in Portugal, and co-leader of the Lisbon OWASP chapter.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We help enterprises reduce vulnerabilities through application security education for developers and everyone in the SDLC.
→ Learn more about Security Journey

Connect with Tiago Mendo:
→ OWASP ZAP
→ Probely

Mentioned in this episode:
→ OWASP ZAP
→ Probely
→ sqlmap
→ Jenkins
→ PCI DSS
→ Cobalt.io
→ LASCON

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Tiago Mendo: How to scan at scale with OWASP ZAP
02:23 One thing we like to do in our podcast is start
07:14 Very cool. And so from understanding and hearing about the talk
10:23 About in a DevOps context
12:56 Then, what are some of the challenges, Diego, from trying to
22:32 That's either hitting test environments or even production environments as well
28:55 As we think about, you know, for our listeners, what they

Wolfgang Goerlich -- Security beyond vulnerabilities Nov 29, 2022

J. Wolfgang Goerlich is an Advisory CISO for Cisco Secure. He has been responsible for IT and IT security in the healthcare and financial services verticals. Wolfgang has led advisory and assessment practices for cybersecurity consulting firms. Wolf challenged my thinking in this episode and pointed out a new area of threat modeling that I had never considered. The conversation connects Cisco Secure, Converge Detroit, LINDDUN to practical choices that application security teams can make in their own programs. The hosts press for concrete lessons, tradeoffs, and actions practitioners can carry into their next security decision. It closes with practical guidance for application security leaders.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We help enterprises reduce vulnerabilities through application security education for developers and everyone in the SDLC.
→ Learn more about Security Journey

Connect with Wolfgang Goerlich:
→ Cisco Secure
→ Converge Detroit

Mentioned in this episode:
→ Cisco Secure
→ Converge Detroit
→ LINDDUN
→ MITRE ATT&CK Framework

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Wolfgang Goerlich: Security beyond vulnerabilities
05:56 Very, very cool. It's funny, I have a very similar origin
09:10 I didn't even know, but they taught me the importance of
12:16 Yeah. Very cool. One of the things I learned from— it
14:47 This idea of security beyond vulnerabilities, because I'm really curious to
20:35 Criminal organizations able to use the transfer of funds liberally to
23:10 Yeah. And so, When I think about threat modeling from a
28:05 Why
32:12 That's really— that's great. That's great advice for just people building
37:58 From a key takeaway perspective or a call to action, We

Sam Stepanyan -- OWASP Nettacker Project Nov 08, 2022

Sam Stepanyan is an OWASP London Chapter Leader and an Independent Application Security Consultant with over 20 years of IT experience and a background in software engineering and web application development. Sam has worked for various financial services institutions in the City of London, specializing in Application Security consulting, Secure Software Development Lifecycle (SDLC), developer training, source code reviews and vulnerability management. He is also a Subject Matter Expert in Web Application Firewalls (WAF) and SIEM systems. Sam holds a Master’s degree in Software Engineering and a CISSP certification. Sam Stepanyan is an OWASP chapter leader and an independent application security consultant with over 20 years of experience in the IT industry with a background in software and web app development.

You are now listening to the Application Security Podcast brought to you by Security Journey.

About Security Journey
Hey folks, welcome to another episode of the Application Security Podcast, and this is Robert Hurlbut.
→ Learn more about Security Journey

Connect with Sam Stepanyan:
→ OWASP Nettacker
→ OWASP ZAP

Mentioned in this episode:
→ OWASP Nettacker
→ OWASP ZAP
→ Metasploit
→ Kali Linux
→ Jeremiah Grossman
→ OWASP Top Ten
→ Black Hat

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Sam Stepanyan: OWASP Nettacker Project
01:48 Like we typically do, we'd like to start off with your
05:34 Yeah, that was a great event to be a part of
13:36 The security team, that is one of the foundational tools that
16:44 About performance. So when I hear you describe it's written in
20:38 In terms of, you mentioned vulnerabilities and having a library of
26:01 They don't have a lot of commercial tools and things that
39:58 Yeah. So, what's a key takeaway then or a call to

Nick Aleks and Dolev Farhi -- GraphQL Security Nov 01, 2022

GraphQL gives clients remarkable flexibility, but that same flexibility can expose authorization gaps, denial-of-service paths, and unexpected routes to sensitive data. Black Hat GraphQL authors Nick Aleks and Dolev Farhi join Chris and Robert to explain how GraphQL differs from SQL and REST, why its schema and query model change the attacker’s workflow, and which familiar web risks still apply. They explore introspection, field-level authorization, query depth and complexity, batching, injection, and direct attacks against GraphQL endpoints. The discussion moves from reconnaissance and exploitation to practical mitigations, including strong server-side controls, input validation, output encoding, and deliberate limits on what clients may request. Nick and Dolev also introduce the vulnerable applications and tooling behind their book and offer a path for practitioners to build hands-on GraphQL security skills.

You are now listening to the Application Security Podcast brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Dolev Farhi and Nick Aleks:
→ Dolev Farhi on LinkedIn
→ Nick Aleks on LinkedIn
→ Black Hat GraphQL
→ Damn Vulnerable GraphQL Application

Mentioned in this episode:
→ Black Hat GraphQL (book)
→ CrackQL
→ Damn Vulnerable GraphQL Application
→ Wealthsimple
→ OWASP API Security Top 10

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Nick Aleks and Dolev Farhi: GraphQL Security
04:44 Dolev’s security origin story
07:01 Introducing Black Hat GraphQL
07:51 What GraphQL is and where teams use it
10:57 GraphQL compared with SQL
13:19 The GraphQL threat landscape
18:16 How familiar OWASP risks appear in GraphQL
20:59 How attackers discover and reach GraphQL endpoints
29:24 Mitigating authorization and denial-of-service risks
34:14 Server-side controls, validation, and output encoding
36:56 Why Nick and Dolev wrote the book
40:00 Practical GraphQL security takeaways

Guy Barhart-Magen -- Log4j and Incident Response Sep 23, 2022

With nearly 25 years of experience in the cyber-security industry, Guy held various positions in both corporates and startups. In his role as the CTO for the cyber crisis management firm Profero, his focus is making incident response fast and scalable, harnessing the latest technologies and a cloud-native approach. Guy is the BSidesTLV chairman and CTF lead, a Public speaker in well-known global security events (SAS, t2, 44CON, BSidesLV, and several DefCon villages, to name a few), and the recipient of the Cisco “black belt” security ninja honor – Cisco’s highest cybersecurity advocate rank. Guy joins us to explore his front-row seat for the incident response with Log4j.

You are now listening to the Application Security Podcast, brought to you by Security Journey.

About Security Journey
Hey folks, welcome to another episode of the Application Security Podcast.
→ Learn more about Security Journey

Connect with Guy Barhart-Magen:
→ Profero
→ Log4j

Mentioned in this episode:
→ Profero
→ Log4j
→ Aleph One's "Smashing The Stack for Fun and Profit"
→ Heartbleed
→ OpenSSL

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Guy Barhart-Magen: Log4j and Incident Response
02:18 I promise I'll be back for year 60 at least. for
07:40 That's really cool. I miss those days. There was a, there
10:10 From the kind of going back into the security realm, what
28:31 I mean, that's historically— when you think about some of the
31:06 Yeah. So here's a question for you as you kind of
36:02 Yeah, I mean, that's a common challenge though, right
39:01 Yeah. That's, that is definitely a challenging scenario. And as an

Brett Smith -- Security is a Necessary Evil Aug 30, 2022

Brett Smith is a Software Architect/Engineer/Developer with 20+ years of experience. Specialties: Automation, Continuous Integration/Delivery/Testing/Deployment Expertise: Linux, packaging, and tool design. Brett joins us to discuss why he hates security and shares his vast knowledge of building a secure and cutting-edge build pipeline. We hope you enjoy this conversation with... Brett Smith is a software architect, engineer, developer with 20+ years of experience. His specialties include automation, continuous integration, delivery, testing, deployment, plus he has expertise in Linux packaging and tool design. Now, don't hang up right now. There's a lot more to his thoughts on security. He also has vast knowledge building a secure and cutting-edge build pipeline, and so he's going to walk you through the different phases and things that you need to be thinking about when building a secure build pipeline.

You are now listening to the Application Security Podcast brought to you by Security Journey.

About Security Journey
Hey folks, welcome to another episode of the Application Security Podcast.
→ Learn more about Security Journey

Connect with Brett Smith:
→ SLSA
→ in-toto

Mentioned in this episode:
→ SLSA
→ in-toto
→ Rekor (Sigstore)
→ OpenVEX spec
→ OWASP Threat Dragon
→ eBPF
→ GitHub Dependabot
→ VEX
→ Jenkins
→ Snyk

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Brett Smith: Security is a Necessary Evil
01:19 I'm going to get to asking Brett his origin story in
08:30 So you wouldn't, you wouldn't give yourself the moniker or title
12:18 I mean, there is a weakest link, right
17:05 That's a good startup idea right there. Just follow somebody around
21:11 I mean, that's kind of like a bare minimum level of
23:14 Do you get to that exploitability and being able to measure
26:03 With eBPF, this is gonna be more from like, Linux-based applications
33:30 I've heard other people with that same idea. Back on the
38:10 Yeah, I mean, I think you've given us some different concepts
40:53 From a key takeaway perspective or a call to action, we've

Chen Gour-Arie -- The AppSec Map Aug 16, 2022

Chen Gour-Arie is the Chief Architect and Co-Founder of Enso Security. With over 15 years of hands-on experience in cybersecurity and software development, Chen demonstrably bolstered the software security of dozens of global enterprise organizations across multiple industry verticals. An enthusiastic builder, he has focused his career on building tools to optimize and accelerate security testing and all related workflows. Ken joins us to introduce the AppSec Map and provides a live demo of the catalog and what AppSec practitioners can use it for. We hope you enjoy this conversation with... Kahen Gour-Arie is the chief architect and co-founder of Enso Security. He's an enthusiastic builder, and he's focused his career on building tools to optimize and accelerate security testing and all related workflows.

You are now listening to the Application Security Podcast, brought to you by Security Journey.

About Security Journey
Hey folks, welcome to another episode of the Application Security Podcast.
→ Learn more about Security Journey

Connect with Chen Gour-Arie:
→ Enso Security
→ AppSec Village

Mentioned in this episode:
→ Enso Security
→ AppSec Village

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Chen Gour-Arie: The AppSec Map
02:09 Our guest today is Kahan Ghorarieh, and I probably just butchered
08:11 I do have a follow-up question in regards to the startup
10:14 Our topic today is, as we mentioned, AppSec Map. And so
11:51 You think about this project and the fact that it exists
15:44 Yeah. Yeah, so in terms of— so we talked about what
18:01 If— so I understand the different categories of kind of consumers
27:31 This is a good place to add tools into that can
30:20 Very cool. This has been great to get a perspective on

Dominique Righetto -- OWASP Secure Headers Aug 09, 2022

Dominique Righetto is an AppSec enthusiast and OWASP projects contributor. Dominique joins us to discuss the OWASP Secure Headers project. We discuss headers at a high level and then dive into all the goodies you'll find within the project, from awareness, guidance, and a test suite that can be integrated into your CI/CD pipeline to test your security headers. We hope you enjoy this conversation with... We talk about headers at a high level and then dive into all the goodies you'll find within the project, from awareness, guidance, and a test suite that can be integrated into your CI/CD pipeline to test your security headers.

You are now listening to the Application Security Podcast, brought to you by Security Journey.

About Security Journey
Hey folks, welcome to another episode of the Application Security Podcast.
→ Learn more about Security Journey

Connect with Dominique Righetto:
→ OWASP Secure Headers Project
→ OWASP Cheat Sheet Series

Mentioned in this episode:
→ OWASP Secure Headers Project
→ OWASP Cheat Sheet Series
→ OWASP Top 10
→ Venom (OVH)
→ Content-Security-Policy (MDN)

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Dominique Righetto: OWASP Secure Headers
02:13 I know I've seen your name attached to various things in
04:18 Okay. I'm just poking a little fun at the history of
07:58 Someday I hope to meet one of the 3 people that
12:36 Help us understand, if you could, an example. of, I have
14:21 Yeah, let's look at one of them specifically. So I'm looking
16:27 We talked about kind of the guidance side of this. What
20:35 Then the stats project, is this— so what would a developer
24:27 I know we were at our key takeaways, but I'm going

Hillel Solow -- How to do AppSec without a security team Jul 25, 2022

How can a startup build meaningful AppSec when it cannot hire a dedicated security specialist? Hillel Solow, a longtime security product builder and former ProtectOnce chairman, joins Chris and Robert to frame an application security program around what matters most: protecting availability, confidentiality, and integrity without crippling the product. They break the work into before, during, and after deployment; compare the constraints facing startups, midsize companies, and large enterprises; and explain why tools only help when developers understand their purpose. Hillel also argues that small companies need an incident plan, basic security architecture, and shared ownership early—not after the first enterprise security questionnaire arrives. The practical takeaway is simple: use what already exists, prioritize by risk, and make security part of everyone’s job.

You are now listening to the Application Security Podcast, brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Hillel Solow:
→ Hillel Solow on LinkedIn

Mentioned in this episode:
→ OWASP DevSecOps Guideline
→ AICPA SOC for Service Organizations overview

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Hillel Solow: AppSec Without a Security Team
03:03 From junior developer to security engineering
05:44 The building blocks of an AppSec program
10:28 Defense in depth across the application lifecycle
12:48 Why security tools need developer education
13:31 AppSec at startup, midsize, and enterprise scale
18:09 Advice for companies without a security specialist
23:41 A one-page incident response plan beats panic
27:01 Why small companies are still attractive targets
29:49 Making security everyone’s responsibility
30:33 Hillel’s practical call to action

Chris Romeo -- The Security Journey Story Jun 02, 2022

In this episode of the Application Security Podcast, Chris Romeo walks through the origin story of Security Journey and shares some experiences taking a security startup from bootstrap to acquisition. Chris talks about how and why he started the company, what defining factors made Security Journey successful and why they're being acquired now. He ends by giving an overview of what to expect from Security Journey moving forward. We hope you enjoy this conversation with…Chris Romeo. You're about to listen to AppSec Podcast. When you're done with this, be sure to check out our other show, High Five. Hey, welcome folks to another episode of the Application Security Podcast.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
You're about to listen to AppSec Podcast.
→ Learn more about Security Journey

Connect with Chris Romeo:
→ Chris Romeo on LinkedIn
→ Press Release: HackEDU Acquires Security Journey

Mentioned in this episode:
→ Press Release: HackEDU Acquires Security Journey
→ Joe's Blog Post
→ Hackedu Acquires Security Journey
→ Cisco Security Ninja
→ Threat Modeling Manifesto

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Chris Romeo: The Security Journey Story
02:03 In those early days, yeah, I remember meeting and talking about
10:43 So, I start telling the story of what we had accomplished
14:38 I barely had $10 when I started this thing. But what
16:01 Yeah, that's a great history. A lot of things going on
19:39 Yeah, she was in those modules in the early days when
23:26 Excellent. And so, going forward, what do you see for the

Kristen Tan and Vaibhav Garg -- Machine Assisted Threat Modeling May 10, 2022

Can machines make threat modeling faster without stripping away the judgment that makes it useful? Kristen Tan and Vaibhav Garg join Chris and Robert to discuss their analysis of open source automated threat modeling tools and what it reveals about automation, extensibility, security, and privacy. They explain why they studied the available tools, how they evaluated them, and where machine assistance can support rather than replace human reasoning. The conversation covers developer-friendly formats, privacy requirements, organizational fit, and the gap between generating threats and helping real working teams make better design decisions throughout the modern software development lifecycle in practice.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Kristen Tan and Vaibhav Garg:
→ Kristen Tan on LinkedIn
→ Vaibhav Garg on LinkedIn

Mentioned in this episode:
→ Analysis of open source automated threat modeling tools
→ OWASP pytm

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Machine-assisted threat modeling
01:44 Kristen Tan’s path to threat modeling research
03:29 Vaibhav Garg’s security and privacy background
06:49 Why analyze automated threat modeling tools
09:18 Security and privacy as connected disciplines
12:17 What motivated the research
14:37 Can machines automate threat modeling?
20:45 How the tools were evaluated
24:24 Open source tools and extensibility
28:59 Evaluation criteria and research results
35:14 Choosing a tool that fits the organization
37:00 YAML, developers, and usable workflows
39:00 Keeping threat modeling user-centered
45:00 Final takeaways

Patrick Dwyer -- CycloneDX and SBOMs May 03, 2022

Patrick is a Senior Product Security Engineer in the Application Security team at ServiceNow. He is also Co-Leader of the OWASP CycloneDX project. A lightweight Software Bill of Materials (SBOM) standard designed for use in application security contexts and supply chain component analysis. Patrick Dwyer is a senior product security engineer in the application security team at ServiceNow. He's also co-leader of the OWASP CycloneDX project, a lightweight software bill of materials standard designed for use in application security contexts and supply chain component analysis. Patrick joins us to help us understand how CycloneDX fits into the world of protecting your software supply chain. He explains why they started the project and what is the depth and breadth of it, how many people are using it, and what is the future for CycloneDX and software supply chain.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Patrick Dwyer is a senior product security engineer in the application security team at ServiceNow.
→ Learn more about Security Journey

Connect with Patrick Dwyer:
→ CycloneDX
→ ServiceNow

Mentioned in this episode:
→ CycloneDX
→ ServiceNow
→ CycloneDX
→ OWASP Dependency-Track
→ SPDX
→ Docker
→ JC Herz and Steve Springett -- SBOMs and software supply chain assurance

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Patrick Dwyer: CycloneDX and SBOMs
05:07 Awesome. So I want to, I want to transition into talking
07:36 I guess what was the need when this project was started
10:01 So, so they have kind of different functions then. So I
12:12 Cool. So let's back up for a second. I probably got
14:10 Yeah, I'm also seeing the value then of retrieving SBOMs in
18:41 How'd you get involved with this then, with the CycloneDX project
19:52 Very cool. Very cool. So I mentioned kind of at the—
23:21 Yeah, that's, that's great to hear. What do you see as
25:11 Yeah, I guess as the tooling continues to improve and the

Omer Gil and Daniel Krivelevich -- Top 10 CI/CD Security Risks Apr 25, 2022

CI/CD systems hold code, credentials, and production access, yet many organizations still treat them as internal plumbing rather than a critical attack surface. Omer Gil and Daniel Krivelevich join Chris and Robert to explain the research behind the Top 10 CI/CD Security Risks. They trace lessons from SolarWinds and Codecov, show why pipeline security often falls between AppSec and infrastructure teams, and describe how the list was built with community input. The discussion turns the risks into practical guidance for threat modeling pipelines, reducing exposure, assigning ownership, and using the intentionally vulnerable CI/CD Goat project to learn safely by doing.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Omer Gil and Daniel Krivelevich:
→ Omer Gil on LinkedIn
→ Daniel Krivelevich on LinkedIn
→ Top 10 CI/CD Security Risks

Mentioned in this episode:
→ Top 10 CI/CD Security Risks
→ Threat Modeling Manifesto
→ CI/CD Goat

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 The hidden attack surface in CI/CD
02:03 Why create a CI/CD security top ten
04:30 How the project began
11:17 Making the risks useful to developers
14:49 Lessons from SolarWinds and Codecov
21:26 Why CI/CD security falls through the cracks
27:17 Research and community collaboration
30:38 Building and ranking the risk list
35:20 Mitigations teams can apply
39:33 When internal build systems are exposed
44:18 Threat modeling the software pipeline
48:44 Learning with CI/CD Goat

Josh Grossman -- Building a High-Value AppSec Scanning Program Apr 19, 2022

Josh Grossman has over 15 years of experience in IT Risk and Application Security consulting, and he has also worked as a software developer. He currently works as CTO for Bounce Security, where he focuses on helping organizations build secure products by providing value-driven Application Security support and guidance. In his spare time, he is very involved with OWASP. He is on the OWASP Israel chapter board, he is a co-leader of the OWASP Application Security Verification Standard project, and he has contributed to various other projects as well, including the Top 10 Risks, Top Ten Proactive Controls and JuiceShop projects. We hope you enjoy this conversation with...

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Josh Grossman has over 15 years experience in IT risk and application security consulting, and he's also worked as a software developer.
→ Learn more about Security Journey

Connect with Josh Grossman:
→ OWASP Application Security Verification Standard (ASVS)
→ OWASP Juice Shop

Mentioned in this episode:
→ OWASP Application Security Verification Standard (ASVS)
→ OWASP Juice Shop
→ Alyssa Miller
→ Avi Douglen on Twitter
→ SAST, DAST, IAST, and RASP: Pros, cons and how to choose

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Josh Grossman: Building a High-Value AppSec Scanning Program
02:10 So our guest today is Josh Grossman. Josh is, this is
04:02 Yeah, no, that's cool. Avi's a good friend of ours and
07:46 Josh, today's topic, we're going to be focusing on something you
10:26 So before we dive deeper into this, I think it would
13:08 Would you lump IAST then, interactive application security testing, into kind
14:44 We got to put together a solid AppSec scanning program. Where'd
19:34 Josh, we've talked about the importance of these tools, and none
25:51 Specific definition in the world of OWASP, right
32:26 Yeah, I was going to say the sunk cost analysis is
34:35 I mean, push the envelope. I mean, I wouldn't buy an
37:01 That's another problem. When I think about, and that's a whole

Alex Mor -- Application Risk Profiling at Scale Mar 15, 2022

Alex Mor is a passionate cybersecurity defender or breaker depending on the time of day, providing expert technical guidance to product teams and building security in their platforms. Alex joins us to talk about application risk profiling. He defines what this concept is to help us understand it. Then we talk about how can you do application risk profiling at scale? Whether you have ten applications or 1500 applications? How do you bring this together and gain real true security value from this idea of profiling your applications? We hope you enjoyed this conversation with Alex Mor. Twitter: @nashcontrol Alex Moore is a passionate cybersecurity defender or breaker, depending on the time of day, providing expert technical guidance to product teams in building security in their platforms.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Alex Moore is a passionate cybersecurity defender or breaker, depending on the time of day, providing expert technical guidance to product teams in building security in their platforms.
→ Learn more about Security Journey

Connect with Alex Mor:
→ OWASP SAMM
→ Alyssa Miller

Mentioned in this episode:
→ OWASP SAMM
→ Alyssa Miller
→ Alyssa Miller

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Alex Mor: Application Risk Profiling at Scale
06:48 Given that you've had quite a bit of pen testing experience
09:04 Yeah, and it's interesting for me as I'm thinking about this
14:06 About what do you mean when you say application risk profiling
20:10 Knew Excel
24:07 Alex, who's answering those questions then
27:55 You got it as a low. So how do we govern
34:13 One of the things we like to do is, let's imagine

Brenna Leath -- Product Security Leads: A different way of approaching Security Champions Mar 09, 2022

Brenna Leath is currently the Head of Product Security for a data analytics company where she sets the application security strategy for R&D and leads a team of security architects. Brenna originally joined us to talk about EO 14028 and the implications for private sector programs, BUT, we were chatting about security champions and product security leads, and we changed our focus to cover these topics instead. We hope you enjoy this conversation with... Brenna originally joined us to talk about Executive Order 14028 and the implications for private sector programs. But as we were chatting about security champions and product security leads in the preamble to the interview, we decided to change our focus and cover these topics instead.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Brenna Leath is currently the head of product security for a data analytics company where she sets the application security strategy for research and development and leads a team of security architects.
→ Learn more about Security Journey

Connect with Brenna Leath:
→ Executive Order 14028
→ BSIMM

Mentioned in this episode:
→ Executive Order 14028
→ BSIMM
→ OWASP Cornucopia
→ Burp Suite
→ Log4j
→ OWASP Cornucopia

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Brenna Leath: Product Security Leads: A different way of approaching Security Champions
04:02 Film studies and English is a fascinating combination for me. And
16:14 Yeah. So you may— you use the word federated in regards
19:35 Yeah, there has to be some, some action that they can
25:49 We don't believe in scaring people with it. So, so I've

Will Ratner -- Centralized container scanning Feb 16, 2022

Will Ratner is a software security professional with extensive experience building and implementing security solutions across a myriad of industries including banking, media, construction, and information technology. In his current role at Atlassian, Will focuses on improving the vulnerability management process by building highly scalable and automated solutions for the enterprise. Will joins us to discuss a centralized approach he built for container scanning. We explore the challenges and lessons learned, building a scalable, enterprise-grade solution, and how to build something that developers will see value in. We hope you enjoy this conversation with... We also introduce the idea of container scanning and building secure images that are then used to generate containers.

Connect with Will Ratner:
→ Atlassian
→ Docker

Mentioned in this episode:
→ Atlassian
→ Docker
→ Kubernetes
→ Snyk
→ Go
→ Slack

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Will Ratner: Centralized container scanning
01:31 Yeah, and as we do that, let's turn over to Will
04:38 Very cool. And so again, we were talking about container scanning
06:59 Yeah, I love— I love that we're talking about something that's
10:12 If only everyone would start from scratch with their base image
14:53 Everything in your— is this— yeah, this whole thing is open
20:31 Yeah, that's, yeah, that's interesting. It's just, it's a, it's a
22:57 Was the, what was the amount of time, Will
29:45 So yeah, we talked a lot about tickets in this perspective
32:30 You've mentioned vulnerability funnel a couple of times, and I have
34:42 You've got great metrics, I'm guessing, coming out of that because
37:55 Will, what kind of resources would you recommend
41:12 Yeah, definitely. So, Will, thank you so much for sharing this

Neil Matatall -- AppSec at Scale Feb 09, 2022

Neil Matatall is an engineer with a background in security. He has previously worked at GitHub and Twitter and is a co-founder of Loco Moco Product Security Conference. Neil joins us for his second visit, to discuss account security at scale. He describes the underlying principles behind security at scale, how he worked to build a sign-in analysis feature, and how attacks were detected. We ended the conversation with an authentication lightning round, with Neil responding to various statements about authentication off the cuff! We hope you enjoy this episode with Neil Matatall. He's previously worked at GitHub and Twitter and is a co-founder of the LocoMoco Product Security Conference.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Neil Matatall is an engineer with a background in security.
→ Learn more about Security Journey

Connect with Neil Matatall:
→ Loco Moco Product Security Conference
→ Have I Been Pwned

Mentioned in this episode:
→ Loco Moco Product Security Conference
→ Have I Been Pwned

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Neil Matatall: AppSec at Scale
05:46 Any kind of other thoughts on that from that perspective about
07:28 Something like, well, I was going to borrow it and use
10:19 You've sort of, I think, spoken to this in terms of
13:13 Did you build this sign-in analysis piece
20:14 The thing I love that you're bringing out in this conversation
24:57 Do I need to change it now
27:20 You've talked about quite a few ways of detecting the different
30:18 Using the API example, let's play this one out a little
34:32 No, that's neat that GitHub detects that as they come in

Joern Freydank -- Security Design Anti Patterns Limit Security Debt Jan 25, 2022

Joern Freydank is a Lead Cyber Security Engineer with more than 20 years of experience. He is currently establishing the Threat Modeling Program at a major insurance company. Joern joins us to talk about security design anti-patterns. He defines the term, explains security debt, reviews the categories of anti-patterns, and walks us through the example of a common role misconception. We hope you enjoy this conversation with... Joern Freydank is a lead cybersecurity engineer with more than 20 years of experience. He's currently establishing the threat modeling program at a major insurance company. You're about to listen to AppSec Podcast. When you're done with this, be sure to check out our other show, High Five.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Joern Freydank is a lead cybersecurity engineer with more than 20 years of experience.
→ Learn more about Security Journey

Connect with Joern Freydank:
→ Security Design Anti-Patterns -- Creating Awareness to Limit Security Debt (YouTube talk)
→ Stack Overflow

Mentioned in this episode:
→ Security Design Anti-Patterns -- Creating Awareness to Limit Security Debt (YouTube talk)
→ Stack Overflow

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Joern Freydank: Security Design Anti Patterns Limit Security Debt
03:04 You came to security from more of the breaking perspective
04:37 One of our topics that we're going to be talking about
07:19 It's missing pieces versus bad architectural decisions that are being laid
10:53 That's one of the things that, you know, I think about
13:11 Yeah. And I was thinking a similar, the trade-off with also
17:58 Talking about roles, we mentioned roles. There's a malicious insider admin
20:15 Yeah. And you think about the couple of examples you shared
21:49 Yeah, occasionally. Certainly. I mean, like you said, mostly from the
25:04 What's the corresponding pattern, essentially
27:13 As we start to kind of bring this conversation towards a
31:04 There's an awareness— I mean, there's an awareness play in that

Ken Toler -- Blockchain, Cloud, and #AppSec Jan 18, 2022

Ken Toler is a principal consultant at Kudelski Security and is passionate about building and optimizing application security programs that stick through strong adoption and ease of use. Ken has spent considerable time on all sides of the security aisle from playing defense and managing security teams to offense by breaking applications and reviewing code. Ken is also the host and creator of the Relating to DevSecOps podcast that focuses on forging strong relationships between engineers, operations, and security through collaboration, understanding, skill-sharing, and healthy debate. Ken joins us to talk all things Blockchain and AppSec. We define Blockchain, discuss the connections between cloud, appsec, and blockchain, common architecture failures, pen testing, and even dive into smart contracts.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Ken Toler is a principal consultant at Katelski Security and is passionate about building and optimizing AppSec programs that stick through strong adoption and ease of use.
→ Learn more about Security Journey

Connect with Ken Toler:
→ Secureum Videos
→ The Rust Programming Language

Mentioned in this episode:
→ Secureum Videos
→ The Rust Programming Language
→ Blockchain Security @ Kudelski
→ Blockchain Security A Need For Todays Businesses Complete Guide For Beginners
→ Rust

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Ken Toler: Blockchain, Cloud, and AppSec
02:06 It was a place in Texas. And Ken and I happened
05:00 It's a term that we heard. I mean, certainly in the
06:31 At the end of the day, It's an immutable ledger of
12:05 That's helpful because I hadn't really thought of it. I guess
15:20 Yeah, that's, that's very helpful. And before we transition into thinking
18:53 Yeah. To draw a parallel from my AppSec history and experience
21:59 They can decide who they want to go after first. It's
24:45 I want to get into what kinds of surprising mistakes you've
26:52 Yeah, definitely a different set of skills than our classic, you
29:05 Can you pen test a blockchain
32:13 Smart contracts and secure coding, how these things fit together. When
34:14 Yeah, I think that's a good definition that takes away from
36:42 We have a smart contract that is written onto a blockchain
38:58 You look at the code
42:53 Yeah. Very cool. So what would be your key takeaway then

Jeroen Willemsen and Ben de Haan -- Dirty little secrets Jan 11, 2022

Secrets management fails in surprisingly ordinary ways: credentials land in code, deployment files, containers, and cloud resources, then quietly become part of the system’s attack surface. Jeroen Willemsen and Ben de Haan join Chris and Robert to introduce OWASP WrongSecrets, an intentionally vulnerable application built to teach those failure modes. They explain how the project grew from incident-response experience, why cloud services change the threat model, and how teams can reason about blast radius and maturity. The conversation closes with practical guidance for scaling secrets management across an organization and using hands-on challenges to turn abstract advice into memorable engineering lessons.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Jeroen Willemsen and Ben de Haan:
→ Jeroen Willemsen on LinkedIn
→ OWASP WrongSecrets

Mentioned in this episode:
→ OWASP WrongSecrets
→ WrongSecrets on GitHub
→ Secrets management deployment guidance
→ Terraform
→ Docker
→ Kubernetes

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 The dirty little secrets in software delivery
02:00 How incident response shaped the project
05:51 Introducing OWASP WrongSecrets
08:46 Why secrets management keeps failing
11:22 Cloud storage and common mistakes
16:33 Maturity, threat models, and blast radius
19:23 Turning real failures into challenges
23:03 Secrets hidden in containers and deployment files
27:36 Advice for security and engineering teams
30:02 Scaling secrets management
31:54 Written guidance and project resources
33:39 Final takeaways

Adam Shostack -- Fast, cheap and good threat models Dec 15, 2021

Adam is a leading expert on threat modeling, and a consultant, expert witness, author and game designer. He has decades of experience delivering security. His experience ranges across the business world from founding startups to nearly a decade at Microsoft. While not consulting or training, Shostack serves as an advisor to a variety of companies and academic institutions. Adam joins us to talk about fast, cheap, and good threat models. We discuss how Adam defines these categories, the weight of threat modeling, questionnaires/requirements, expertise, and how to make threat modeling conversational. We hope you enjoy this conversation with... Adam Shostack. You're about to listen to AppSec Podcast.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Adam Shostack is a leading expert on threat modeling and a consultant, expert witness, author, and game designer.
→ Learn more about Security Journey

Connect with Adam Shostack:
→ Shostack + Associates
→ Adam Shostack

Mentioned in this episode:
→ Shostack + Associates
→ Adam Shostack
→ Gary McGraw
→ OWASP Application Security Verification Standard (ASVS)
→ ATT&CK
→ MITRE ATT&CK Framework
→ Cyber Kill Chain (Lockheed Martin)

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Adam Shostack: Fast, cheap and good threat models
03:15 Yeah, I want to unpack these 3 words a little bit
04:47 You're thinking cheap, are you thinking from a resources and time
07:38 We keep talking about and using that term heavyweight. Is threat
09:17 Yeah, one of the things that I've said since I first
12:24 Yeah, I'm tracking with you now as well about the fact
15:11 You mean the 3 questions that are being asked
20:48 Oh, and I was thinking similar. I always think about requirements
22:48 That— have you ever looked at like the ATT&CK methodology, for
24:21 That makes sense. But let's talk about what do you need
27:07 To kind of bring all these things together, Adam, we, all
29:34 What's the call to action then that you would offer to

Loren Kohnfelder -- Designing Secure Software Dec 07, 2021

Ochaun Marshall is an Application Security Consultant. In his roles of secure ideas, he works on on-going development projects utilizing Amazon web services and breaks other people's web applications. Ochaun joins us to talk about SAST and IaC, static application security testing and infrastructure as code. We talk about what they are, how they work, the security benefits, some of the tools that make them possible, and we finish our conversation talking about developer empathy and why Ochaun has developer empathy as a result of some of the experiences that he has as a developer and as a security person. We hope that you enjoy this episode with...

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Loren Kohnfelder has over 20 years of experience in the security industry.
→ Learn more about Security Journey

Connect with Loren Kohnfelder:
→ Designing Secure Software
→ Ron Rivest

Mentioned in this episode:
→ Designing Secure Software
→ Ron Rivest
→ Robert Hurlbut

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Loren Kohnfelder: Designing Secure Software
01:46 For our listeners, we always start with our guest's security origin
07:29 I first started at Cisco learning about threat modeling and trying
09:17 As I was taking a look at the book and I
17:20 As I was reading through the book and looking at the
20:13 We do a good enough job to deal with this
26:26 So as we're coming towards the kind of the conclusion of
28:57 Yeah, we definitely agree with you on that. Like, we wanna

Ochaun Marshall -- IaC and SAST Nov 29, 2021

Infrastructure as code gives security teams something they have wanted for years: a readable description of the systems surrounding an application. Ochaun Marshall, a developer and application security consultant, explains how that visibility complements static analysis and penetration testing. He discusses where SAST belongs in development, what configuration files can reveal about cloud resources, and why deployed infrastructure still needs monitoring. The conversation covers Terraform, AWS development tools, open-source scanners, and using source access to make a penetration test more productive. Ochaun and Chris then connect those technical practices to developer empathy, explaining why overwhelming engineers with findings undermines trust and how a smaller, carefully tuned set of checks can make security genuinely useful.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Ochaun Marshall:
→ Ochaun Marshall on LinkedIn

Mentioned in this episode:
→ Semgrep
→ Bandit
→ Terraform

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Infrastructure as code and SAST with Ochaun Marshall
02:35 Returning to cloud application security
06:32 Where SAST fits in development
07:15 Scanning applications and their infrastructure
09:53 Configuration files versus deployed assets
12:19 Rebuilding infrastructure instead of changing it manually
14:23 Infrastructure programming with the AWS CDK
17:19 Using SAST during a penetration test
20:26 Open-source tools in the testing toolkit
25:06 The security benefits of infrastructure visibility
26:55 Tagging resources and monitoring changes
29:06 Developer empathy under delivery pressure
32:14 Introducing security checks without overwhelming developers

Simon Bennetts -- Using OWASP Zap across an Enterprise Nov 10, 2021

Simon Bennetts is the OWASP Zed Attack Proxy (ZAP) Project Leader and a Distinguished Engineer at StackHawk, a company that uses ZAP to help users fix application security bugs before they hit production. He has talked about and demonstrated ZAP at conferences all over the world. Prior to making a move into security, he was a developer for 25 years and strongly believes that you cannot build secure web applications without knowing how to attack them. He's talked about and demonstrated ZAP at conferences all over the world. Prior to making the move into security, he was a developer for 25 years and strongly believes that you cannot build secure web applications without knowing how to attack them.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Simon Bennetts is the OWASP Zed Attack Proxy, or ZAP, project leader and a distinguished engineer at StackHawk, a company that uses ZAP to help users fix application security bugs before they hit production.
→ Learn more about Security Journey

Connect with Simon Bennetts:
→ OWASP ZAP
→ StackHawk

Mentioned in this episode:
→ OWASP ZAP
→ StackHawk
→ ZAP Heads Up Display (HUD)
→ Burp Suite
→ OWASP Juice Shop
→ OWASP Juice Shop
→ OWASP Web Security Testing Guide (WSTG)
→ OWASP Triangle Chapter
→ Docker

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Simon Bennetts: Using OWASP Zap across an Enterprise
04:20 We think about the things that ZAP is looking for, is
10:10 One of the things that is a new feature since the
14:59 Were not OWASP people, were not security people, and we've set
20:43 One of the other, you know, when I think about the
24:14 I've always been so impressed with what OWASP projects such as
29:10 I use this, when I integrate Zap into my pipeline, then
31:41 This, this was one of those questions where, like, this is
36:54 People are using this in the enterprise would be really powerful

Timo Pagel -- DevSecOps Maturity Model Oct 27, 2021

Timo Pagel has been in the IT industry for over fifteen years. After a system administrator and web developer career, he advises customers as a DevSecOps consultant and trainer. His focus is on security test automation for software and infrastructure and assessment of complex applications in the cloud. In his spare time, he teaches “Web and Application Security” at various universities. Timo joins us to talk about the OWASP DevSecOps Maturity Model or DSOMM. We explore maturity models, this specific one, how you can use it, and how to get started. We hope you enjoy this conversation with... After a career as a system administrator and web developer, he advises customers as a DevSecOps consultant and trainer.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Timo Pagel has been in the IT industry for over 15 years.
→ Learn more about Security Journey

Connect with Timo Pagel:
→ OWASP DevSecOps Maturity Model (DSOMM)
→ OWASP SAMM

Mentioned in this episode:
→ OWASP DevSecOps Maturity Model (DSOMM)
→ OWASP SAMM
→ BSIMM
→ OWASP Application Security Verification Standard (ASVS)

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Timo Pagel: DevSecOps Maturity Model
03:23 I'm curious now, what was it that this mentor/professor, what did
07:37 We think about DevSecOps maturity model, here's one way that I
08:45 Timo, what is your recommendation for how someone can use the
12:03 For your specific levels then, can you walk us through the
15:48 Yeah. Let me trace through one with you just because I
17:45 Yeah, no problem. So thinking about DSOM and how it works
25:48 Yeah. Makes sense. So let me give you a scenario here
29:25 That's awesome. Yeah. And I'm sure you're making that— that's for

Mazin Ahmed -- Terraform Security Oct 06, 2021

Mazin Ahmed is a security engineer that specializes in AppSec and offensive security. He is passionate about information security and has previously found vulnerabilities in Facebook, Twitter, Linkedin, and Oracle, to name a few. Mazin is the developer of several popular open-source security tools that have been integrated into security testing frameworks and distributions. Mazin also built FullHunt. io, the next-generation continuous attack surface security platform. He is also passionate about cloud security, where he has been running dozens of experiments in the cloud security world. Mazin joins us to introduce Infrastructure as Code and TerraForm and discuss the security benefits IaC brings to our cloud environments.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Mazin Ahmed is a security engineer that specializes in AppSec and offensive security.
→ Learn more about Security Journey

Connect with Mazin Ahmed:
→ Terraform
→ FullHunt.io

Mentioned in this episode:
→ Terraform
→ FullHunt.io
→ Terraform
→ Bugcrowd

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Mazin Ahmed: Terraform Security
03:25 Were you doing bug bounties while you were in high school
05:31 Curious, Mason, that you have mentioned pen tests and working on
07:50 Just a follow-up question. When you said that, you know, more
09:22 You think cloud security issues, I'm curious as a pentester, What
14:46 We call it infrastructure as code, but is it better to
16:49 Very cool. What are the security benefits of IaC
20:02 Got to do step 75. And so, when I think about
23:38 Are the attack vectors on Terraform environments then
27:17 As an attacker then, if you can get into the infrastructure
30:00 That's helpful to understand how, you know, what IaC is, security

James Ransome and Brook Schoenfield -- trust and verify: Building in Security at Agile Speed Sep 24, 2021

Why do application security programs stall even after teams buy tools and define processes? James Ransome and Brook S. E. Schoenfield join Chris and Robert to discuss their book Building in Security at Agile Speed and the organizational work behind sustainable software security. They explain why practitioners need enough technical fluency to collaborate with developers, how leaders can recognize when a program is becoming self-sufficient, and which behaviors reveal that security has spread beyond a central team. The conversation returns repeatedly to people, trust, incentives, and measurement. It closes by challenging assumptions about penetration testing and showing how continuous delivery requires security practices that evolve with the development system rather than sit outside it.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with James Ransome and Brook S. E. Schoenfield:
→ James Ransome on LinkedIn
→ Brook Schoenfield on LinkedIn

Mentioned in this episode:
→ Building in Security at Agile Speed
→ Core Software Security

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Building security at agile speed
02:49 James Ransome’s security origin story
05:11 The book and the problem it addresses
08:08 Why this book and why now
15:59 Technical fluency for security leaders
21:36 When a security program becomes self-sufficient
24:48 Organic adoption and signs of maturity
30:36 Behaviors leaders can measure
34:19 People, process, and tools
37:07 Building trust across the organization
46:58 Penetration testing in continuous delivery
50:12 Final lessons from the authors

OWASP Top 10 2021 Peer Review Sep 17, 2021

Chris and Robert conduct a practitioner peer review of the 2021 OWASP Top 10, examining what changed, what moved, and what the new structure communicates to development teams. They compare the list with the 2017 edition, discuss the broader treatment of injection, and unpack additions such as insecure design, software and data integrity failures, and server-side request forgery. The review also questions how categories map to real weaknesses, CVEs, and verification practices. Along the way, they connect the Top 10 to ASVS, threat modeling, dependency analysis, and the difficult balance between a widely recognized awareness document and actionable engineering guidance.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with OWASP:
→ OWASP Top 10
→ OWASP Foundation

Mentioned in this episode:
→ OWASP Top 10:2021
→ OWASP ASVS
→ Threat Modeling Manifesto
→ OWASP Dependency-Check
→ CycloneDX

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Peer reviewing the OWASP Top 10:2021
03:00 Broken access control moves to number one
04:52 Injection and cross-site scripting are consolidated
07:46 Vulnerable and outdated components
10:50 Software and data integrity failures
12:42 Server-side request forgery joins the list
15:00 Does the new structure help practitioners?
18:00 Security logging and monitoring
20:00 Mapping categories to weaknesses and CVEs
21:52 Connecting the Top 10 to verification practices
27:00 Final observations

Anastasiia Voitova -- Encryption is easy, key management is hard Sep 14, 2021

Adding encryption is easy; designing a system that protects keys, metadata, and users is much harder. Anastasiia Voitova joins Chris and Robert to explain end-to-end encryption as a system property rather than a single cryptographic feature. She examines what encryption does and does not protect, how modern web and mobile architectures complicate trust boundaries, and why cloud storage creates difficult key-management choices. The discussion covers performance, recovery, usability, and the gap between marketing claims and honest threat models. Anastasiia closes with practical advice for product and security teams deciding whether end-to-end encryption fits their system and how to communicate its tradeoffs clearly.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Anastasiia Voitova:
→ Anastasiia Voitova on LinkedIn
→ Cossack Labs

Mentioned in this episode:
→ Cossack Labs

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Encryption is easy; key management is hard
02:44 Defining end-to-end encryption
06:28 What end-to-end encryption protects
09:15 Modern web and mobile trust boundaries
12:36 Cloud storage and key-management choices
14:00 The downsides of stronger encryption
16:38 Performance and operational costs
19:01 Usability and honest encryption claims
23:18 Can users trust messaging applications?
27:00 Choosing the right security tradeoffs
30:38 A call to action for product teams

Eran Kinsbruner -- DevSecOps Continuous Testing Aug 20, 2021

Mark Loveless - aka Simple Nomad - is a security researcher and hacker. He's spoken at numerous security and hacker conferences worldwide, including Blackhat, DEF CON, ShmooCon, and RSA. He's been quoted in the press including CNN, Washington Post, and the New York Times. Mark joins us to discuss his series of blog posts on Threat Modeling at GitLab. We discuss his philosophical approach, framework choice (spoiler alert, it's a pared-down version of PASTA), and success stories / best practices he's seen for threat modeling success. We hope you enjoy this conversation with... Aaron Kinsbruner is the Chief Evangelist and Senior Director at Perforce Software.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Aaron Kinsbruner is the Chief Evangelist and Senior Director at Perforce Software.
→ Learn more about Security Journey

Connect with Eran Kinsbruner:
→ Perforce Software
→ Jenkins

Mentioned in this episode:
→ Perforce Software
→ Jenkins
→ Alyssa Miller

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Eran Kinsbruner: DevSecOps Continuous Testing
03:00 Okay. So in your time focusing on DevOps and DevSecOps before
04:46 As we get into testing or talk about testing, before we
07:19 One of the, one of the comments, or one of the
16:30 As I'm listening to the way you're describing quality gates and
21:19 Eran, you mentioned the word quality. a few times. And, you
24:37 I got a follow-up question related to quality. And so this
27:04 I think we're both on board with the idea that quality
31:26 Yeah, definitely. And I think you covered people in the last
33:01 Definitely. Eran, it's been great to talk to you today. I

Mark Loveless -- Threat modeling in a DevSecOps environment. Aug 13, 2021

Threat modeling needs to fit the way developers work if it is going to survive a fast delivery cycle. Mark Loveless, also known as Simple Nomad, explains how GitLab adapted its approach for an asynchronous DevSecOps environment. He describes moving ownership toward the people building a project, introducing lightweight checkpoints, and making the process useful beyond engineering. The discussion explores a simplified version of PASTA, ordinary language instead of security jargon, and documentation that lives in familiar tools. Mark shares adoption tactics and examples of teams identifying risks for themselves. Throughout, he argues that security specialists should provide a usable framework and practical support while helping everyone develop the habit of asking what could go wrong.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Mark Loveless:
→ Mark Loveless’s website

Mentioned in this episode:
→ Mark’s GitLab threat modeling article
→ PASTA threat modeling
→ Mermaid diagrams

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Threat modeling at GitLab with Mark Loveless
01:44 Mark’s security origin story
05:04 The GitLab threat modeling article series
06:11 Adapting threat modeling to DevSecOps
08:58 Starting threat modeling without disrupting flow
10:33 Where modeling fits in developer workflows
13:09 Extending threat modeling beyond engineering
14:56 Encouraging teams to participate
19:03 Choosing and simplifying PASTA
23:19 Using plain language instead of jargon
25:12 Writing models with familiar tools
26:55 Adoption stories and signs of success
33:18 Key takeaways and getting started

Jeroen Willemsen -- Security automation with ci/cd Aug 06, 2021

Jeroen Willemsen is a Principal Security Architect at Xebia. Jeroen is more or less a jack of all trades with an interest in infrastructure security, risk management, and application security. With a love for mobile security, he enjoys sharing knowledge on various security topics. Jeroen joins us to unpack security automation in a DevOps world. We discuss categories of tools, typical quick wins, potential downsides, and how dependency management specifically plays into automation. We hope you enjoy this conversation with... We hope you enjoyed this conversation with Jeroen Willemsen. Are you trying to build a security champions program? Everyone is these days. One challenge of rolling out security champions is how do we educate all these new folks?

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Jeroen Willemsen is a Principal Security Architect at Zebia.
→ Learn more about Security Journey

Connect with Jeroen Willemsen:
→ Xebia
→ OWASP Dependency-Check

Mentioned in this episode:
→ Xebia
→ OWASP Dependency-Check

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Jeroen Willemsen: Security automation with ci/cd
02:21 We'll stay with your original name. No problem there. So we
04:54 Just diving in here, one of the things I think we're
07:35 Between SAST, DAST, SCA. You didn't even mention like IAST and
10:20 That's probably— they're probably stuck on that level of— and so
13:10 Yeah. And in the danger of creating a monster fight on
15:29 Like, yeah, yeah, too far back to even remember. Well, I
17:39 You mentioned one. I had heard most of the ones that
19:22 Let's flip the table a little bit now. So, we've talked
22:16 Yeah, I see that. You know, when you're talking about false
25:27 I have a whole talk on that exact topic on developers
27:14 I'm going to do something different here for the conclusion of
29:35 Yeah. All right, you heard our key takeaways, so now it's

Thinking back, Looking forward - A Balanced Approach to Securing our Software Future Jul 15, 2021

Software security has spent decades alternating between prevention, detection, and response. Kevin Greene joins Chris and Robert to ask what a balanced approach should look like now. Drawing on work at Parasoft and across government and industry, Kevin discusses secure development practices, standards, developer enablement, and the limits of relying on tools alone. The conversation connects supply-chain failures and the federal cybersecurity executive order to cyber resilience, penetration testing, red teams, and assurance. It closes by looking ahead to policy, software minimalism, and the changes organizations must make if they want secure software to become a repeatable engineering outcome rather than a late-stage scramble.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Kevin Greene:
→ Parasoft
→ Kevin Greene on API security testing

Mentioned in this episode:
→ Parasoft
→ OWASP Proactive Controls
→ MITRE ATT&CK
→ Threat Modeling Manifesto
→ Executive Order 14028
→ Apache Struts

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Looking back at software security
02:03 Kevin Greene’s path through AppSec
04:54 What a balanced security approach means
06:59 Prevention, detection, and response
09:52 Standards and repeatable engineering practices
12:38 Making secure development easier
15:42 Helping developers own security
18:40 The current state of software assurance
22:36 Guidance, governance, and accountability
24:46 Where security tools help—and where they do not
28:00 Supply-chain failures and SolarWinds
30:00 Why old software problems persist
33:00 The federal cybersecurity executive order
37:00 Adapting to rapid change
40:00 Building cyber resilience
42:00 The role of penetration testing
45:00 What red teams add
47:00 Standards, certification, and assurance
53:00 Looking toward the future
54:00 Goals for the next generation of software
56:00 Software minimalism and reducing attack surface
59:00 Policy as a driver for change
62:00 Closing thoughts

Jeevan Singh -- Threat modeling based in democracy Jun 11, 2021

Jeevan Singh is a Security Engineer Manager at Segment, where he is embedding security into all aspects of the software development process. Jeevan enjoys building security culture within organizations and educating staff on security best practices. Before life in the security space, Jeevan had a wide variety of development and leadership roles over the past 15 years. Jeevan joins us to speak about self-serve threat modeling at Segment or threat modeling based in democracy. We discuss their focus with the program, how it fits in their dev methodology and their ultimate goal with the threat modeling program. We hope you enjoy this conversation with... We discussed their focus with the program, how it fits in their development methodology, and their ultimate goal with threat modeling.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Jeevan Singh is a Security Engineer Manager at Segment, where he's embedding security into all aspects of the software development process.
→ Learn more about Security Journey

Connect with Jeevan Singh:
→ segmentio/threat-modeling-training
→ Redefining Threat Modeling (Segment blog)

Mentioned in this episode:
→ segmentio/threat-modeling-training
→ Redefining Threat Modeling (Segment blog)
→ Segment

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Jeevan Singh: Threat modeling based in democracy
01:16 Hey folks, welcome to another episode of the Application Security Podcast
04:59 The question I always ask folks that come from a development
07:24 Certainly, that's the model that I love as well, as far
09:37 The engineering teams start performing a threat model, what are some
12:51 You have any formal kind of way that you measure when
14:13 You mentioned threat modeling tickets. Is that a metric that you're
17:24 Then does your threat modeling, your self-serve threat modeling, does it
20:07 This is really an industry best practice. Not enough people are
25:22 Yeah, that's great. That is great. Okay, so tell me just
31:13 For folks out there that are building their own program, I
33:29 Awesome. Well, Jeevan, what would be a key takeaway or call

Dima Kotik -- Application Security and the Zen of Python May 21, 2021

Dima Kotik is an Application Security Engineer at Security Journey and has been programming in Python for years. As he was working on building out Security Journey's Secure Coding with Python content, he came across the Zen of Python, a set of guidelines for how to program in Python. He wrote a blog post about how to apply application security to the Zen of Python, and then we recorded this interview to talk about the concept in more depth. We hope you enjoy this interview with.... Dee Makotik is an application security engineer at Security Journey and has been programming in Python for years. We hope you enjoy this conversation with— Dima Kotik.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Dee Makotik is an application security engineer at Security Journey and has been programming in Python for years.
→ Learn more about Security Journey

Connect with Dima Kotik:
→ Zen of Python (PEP 20)
→ Dave Cheney: The Zen of Go

Mentioned in this episode:
→ Zen of Python (PEP 20)
→ Dave Cheney: The Zen of Go
→ Go
→ Rust
→ Node.js
→ Ruby
→ Flask
→ IronPython
→ Stackless Python
→ Zig
→ WireGuard
→ OpenSSL
→ NASA Ingenuity Mars Helicopter

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Dima Kotik: Application Security and the Zen of Python
02:02 That is, how did you get your start in application security
05:06 That consistent
06:45 Does Python fit into web applications
09:53 Yeah. So, you wrote a blog post about the Zen of
13:17 You wrote this article, you took the Zen of Python and
17:23 What's the security takeaway then in regards to readable code
21:15 That was readable, plus talking about the applicability of this whole
32:57 What's the security takeaway then on the singular
34:40 This has been very beneficial to understand the Python use cases

Dustin Lehr -- Advocating and being on the side of developers May 07, 2021

Before taking the plunge into information security leadership, Dustin Lehr spent over a decade as a software engineer and architect in a variety of industries, including retail, DoD, and even video games. This diverse background has helped him forge close partnerships with development teams, engineering leaders, and software security advocates while pursuing the organizational culture shift of building good security habits into daily work. Dustin joins us to talk about the challenges developers face with security and so much more. We hope you enjoy this conversation with... This diverse background helped him forge close partnerships with development teams, engineering leaders, and software security advocates while pursuing the organizational culture shift of building good security habits into daily work.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Before taking the plunge into information security leadership, Dustin Lehr spent over a decade as a software engineer and architect in a variety of industries, including retail, DoD, and even video games.
→ Learn more about Security Journey

Connect with Dustin Lehr:
→ OWASP
→ Alyssa Miller

Mentioned in this episode:
→ OWASP
→ Alyssa Miller
→ Aaron Rinehart (opensource.com)

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Dustin Lehr: Advocating and being on the side of developers
01:49 Yeah, and specifically Engaging the mind of the developer. I just
04:03 Architect, what— I'm curious now, what from an architecture perspective, like
06:54 Many questions come out of just what you said there. When
09:13 Actually, I want to make a statement. I can definitely identify
12:59 Some more about developers, but I want to ask a follow-up
14:55 Okay. So I'm going to offer kind of another opinion about
18:16 Totally agree that we don't want to put up any barriers
20:50 Because nobody knows. I mean, I've been in the security business
24:37 Yeah. I mean, imagine a day where we worked ourselves out
27:04 Yeah, I was doing an interview for the episode right before
31:05 A couple of things that I can think of that I've
34:19 I plead the Fifth, right, to not incriminate myself in a

Aaron Rinehart -- Security Chaos Engineering Apr 30, 2021

Aaron Rinehart is expanding the possibilities of chaos engineering to cybersecurity. He began pioneering security in chaos engineering when he released ChaoSlingr during his tenure as Chief Security Architect at UnitedHealth Group (UHG). Rinehart is the O'Reilly Author on Security Chaos Engineering and has recently founded a chaos engineering startup called Verica with Casey Rosenthal from Netflix. Aaron joins us to explain what the heck security chaos engineering is. We explore the origin story of chaos engineering and security chaos engineering, and how does a listener get started with this new techniques. We hope you enjoy this conversation with... Aaron Reinhardt is expanding the possibilities of chaos engineering to cybersecurity.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Aaron Reinhardt is expanding the possibilities of chaos engineering to cybersecurity.
→ Learn more about Security Journey

Connect with Aaron Rinehart:
→ ChaoSlingr
→ Verica

Mentioned in this episode:
→ ChaoSlingr
→ Verica
→ Security Chaos Engineering
→ Chaos Monkey
→ Kubernetes
→ Apache Kafka

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Aaron Rinehart: Security Chaos Engineering
03:46 Right
16:56 Yeah. Let me ask a couple of clarifying questions too, because
21:31 Yeah, but I mean, you think about how much time, money
26:05 You say it succeeds, you mean that the system detected an
28:59 Most people doing these manual right now
33:05 Let the record show I'm about to ask a product-related question
34:14 What
36:59 Yeah, that's helpful. So, I want to stop for a second
39:40 There's entropy too, right
42:30 I want to do is we're— as we're kind of coming
46:07 Great. So, um, one, one kind of last question. So What's

Izar Tarandach and Matt Coles-- Threat Modeling: A Practical Guide for Development Teams Apr 23, 2021

Threat modeling advice often sounds simple until a development team tries to apply it to a real system. Izar Tarandach and Matt Coles join Chris and Robert to discuss their book, Threat Modeling: A Practical Guide for Development Teams, and the collaboration behind it. They explain how the book organizes system modeling, threat discovery, and mitigation into a usable workflow without forcing teams into one methodology. The conversation covers attack trees, LINDDUN, pytm, writing for different experience levels, and the role of empathy when introducing security practices. Their goal is practical: help teams make threat modeling part of software development instead of a specialist exercise performed once and forgotten.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Izar Tarandach and Matt Coles:
→ Izar Tarandach on LinkedIn
→ Matt Coles on LinkedIn
→ Threat Modeling: A Practical Guide for Development Teams

Mentioned in this episode:
→ Threat Modeling: A Practical Guide for Development Teams
→ OWASP pytm
→ Attack Trees
→ LINDDUN
→ Threat Modeling Manifesto

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 A practical guide to threat modeling
02:00 How Izar and Matt approach the discipline
09:36 Why development teams needed this book
11:46 How the collaboration began
14:49 Writing practical guidance together
21:44 The book’s system-modeling foundation
26:03 Four parts of a repeatable workflow
29:17 Choosing methods without becoming dogmatic
31:38 Attack trees, LINDDUN, and other techniques
34:33 Applying the guidance to real teams
42:15 Empathy as a threat modeling skill
46:01 Using threat modeling beyond security

Charles Shirer -- The most positive person in security Apr 16, 2021

Charles is a Senior Security Consultant for Red Siege. He has over 18 years of experience in IT. In his spare time, Charles does retro gaming and works on the SECBSD open source project, a penetration testing distro. He currently works as Staff at several Security Conferences, podcasts (GrumpyHackers) (Positively Blue Team Cast), and is a part of the MentalHealthHackers DeadPixelSec NovaHackers and HackingisNotaCrime Family. Charles joins us to talk about positivity in InfoSec. If you've never seen Charle's videos, you're missing out. We'll unpack what drives his positivity and how we as infosec / appsec people can embrace a more positive approach to our world.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Charles Scherer is a senior security consultant for Red Siege.
→ Learn more about Security Journey

Connect with Charles Shirer:
→ Red Siege
→ SECBSD

Mentioned in this episode:
→ Red Siege
→ SECBSD
→ Kali Linux
→ Rust

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Charles Shirer: The most positive person in security
02:37 Oh, very cool. Well, as you know, then, as a frequent
03:47 Year was this
10:52 My C# question, how did you get C# to run in
13:03 Was the, uh, the use case there
16:32 All right, so now you've had a chance, audience, to hear
19:26 Many shirts
21:26 Do you get this positivity
26:06 Thing weighs like ten pounds. We're not born like what
27:43 I cared about what I— when I stand up to speak
30:43 Yeah, love to hear it. I'm gonna—I'm gonna check it out
33:19 Really cool. Well, Charles, we really appreciate you coming and visiting

Leif Dreizler -- Tactical tips to shift engineering right Apr 09, 2021

Leif Dreizler is the manager of the Product Security team at Segment. Leif got his start in the security industry at Redspin doing security consulting work and was later an early employee at Bugcrowd. He helps organize the Bay Area OWASP Chapter, the LocoMocoSec Conference, and the AppSec California conference. Leif caught our attention when he published an article called Shifting Engineering Right: What security engineers can learn from DevSecOps. In this interview, we focus in on the tactical tips and takeaways from the article, or how you as a security person can shift engineering right. We hope you enjoy this conversation with... Leif Driezler.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Leif Dreizler is the manager of the product security team at Segment.
→ Learn more about Security Journey

Connect with Leif Dreizler:
→ Shifting Engineering Right: What security engineers can learn from DevSecOps
→ Segment

Mentioned in this episode:
→ Shifting Engineering Right: What security engineers can learn from DevSecOps
→ Segment
→ Bugcrowd

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Leif Dreizler: Tactical tips to shift engineering right
01:49 We're going to talk about an article that I know a
05:32 It's funny, I was watching a debate yesterday on the OWASP
06:30 Let's jump into the article then. And I wanted to start
08:38 That's certainly what caught my attention when I started— when I
12:38 Sure, sure. So Leif, you have at the end of the
18:36 Leif, when you think stakeholders now, I'm curious, what's your definition
21:15 I got a question about this because I'm curious to get
39:05 What's the importance of empathy then
43:37 You've definitely given us lots of additional things to think about

Vandana Verma -- OWASP Spotlight Series Apr 02, 2021

Vandana Verma is the President of Infosec girls and Infosec Kids, a board of directors member for OWASP, and a leader for BSides Dehli. She joins us to introduce the OWASP Spotlight Series. With each video she creates, she highlights an OWASP project. We survey the projects she's covered and discuss a specific takeaway from each for the application security person. We hope you enjoy this conversation with... Hi, Vandana. At Security Journey, we believe security is every developer's job. We work with our customers to help them build long-term sustainable security culture amongst all their developers. Our approach is to provide security education that's conversational, quick, hands-on, and fun.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Vandana Verma is the president of InfoSec Girls and InfoSec Kids, a board of directors member for OWASP, and a leader for BSides Delhi.
→ Learn more about Security Journey

Connect with Vandana Verma:
→ OWASP ZAP
→ OWASP Top 10

Mentioned in this episode:
→ OWASP ZAP
→ OWASP Top 10
→ OWASP Web Security Testing Guide
→ OWASP Dependency-Check
→ OWASP ModSecurity Core Rule Set
→ Christian Folini
→ OWASP Cheat Sheet Series
→ OWASP Security RAT
→ OWASP ASVS
→ OWASP pytm
→ OWASP Security Knowledge Framework
→ OWASP Juice Shop
→ MultiJuicer
→ OWASP Threat Dragon
→ OWASP Proactive Controls
→ Dependency-Track
→ OWASP Project Spotlight Series
→ Vandana Verma (YouTube)
→ Vandana Verma
→ OWASP Proactive Controls

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Vandana Verma: OWASP Spotlight Series
04:05 Yeah, that's great. And I can share a quick story that
09:59 It a companion of ASVS
15:06 This is a great list of projects that you've assembled. And
21:01 Yeah, we'll definitely be looking forward to that. And we'll post

Dr. Anita D’Amico -- Do certain types of developers or teams write more secure code? Mar 25, 2021

Dr. Anita D’Amico is the CEO of Code Dx, which provides Application Security Orchestration and Correlation solutions to industry and government. Her roots are in experimental psychology and human factors. Her attention is now focused on enhancing the decisions and work processes of software developers and AppSec analysts to make code more secure. Anita joins us to discuss research she has done answering the question, "do certain types of developers or teams write more secure code? " Being a security culture fanatic, this topic is near and dear for me. We hope you enjoy this conversation with... Anita D’Amico is the CEO of CodeDx, which provides application security orchestration and correlation solutions to industry and government.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Dr.
→ Learn more about Security Journey

Connect with Anita D’Amico:
→ Secure Decisions
→ Maker's Schedule, Manager's Schedule

Mentioned in this episode:
→ Secure Decisions
→ Maker's Schedule, Manager's Schedule
→ Apache Struts
→ Chromium
→ Linux kernel
→ FMCSA Hours of Service

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Anita D’Amico: Do certain types of developers or teams write more secure code?
02:04 Over her time starting CodeDx and bringing that along. But Anita
09:44 You're thinking, is this an execution chamber
13:02 It's fascinating to me as someone who is focused much of
15:34 So how does those— when we think about quality and security
20:22 Was there surveys that went to these teams that they could
23:07 Yeah, and I definitely want to come back to that. Let's
25:59 That's interesting because when I think about, like, how would I
27:57 The data tell us that there's an impact on the quality
30:37 You're basically saying that we should be sleeping from 10:00 PM
45:00 Because these are the people that are out working on the

Alyssa Miller -- Bringing security to DevOps and the CI/CD pipeline Mar 18, 2021

Alyssa Miller is a life-long hacker, security advocate, and cybersecurity leader. She is the BISO for S&P Global ratings and has over 15 years of experience in security roles. She is heavily involved in the cybersecurity community as an international speaker, author, and advocate. Alyssa joins us to talk about bringing security to DevOps and the CI/CD pipeline. We talk about the success of the DevOps transformation, mistakes AppSec teams make with DevOps and explore the possible idea that DevSecOps is its own silo. We hope you enjoy this conversation with... She's the BISO for S&P Global Ratings and has over 15 years of experience in security roles.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Alyssa Miller is a lifelong hacker, security advocate, and cybersecurity leader.
→ Learn more about Security Journey

Connect with Alyssa Miller:
→ S&P Global Ratings
→ Alyssa Miller

Mentioned in this episode:
→ S&P Global Ratings
→ Alyssa Miller
→ Alyssa Miller
→ Alyssa Miller
→ Azure DevOps
→ DevOpsDays
→ Patrick Debois
→ Patrick DeBois
→ Snyk
→ WhiteSource (now Mend)

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Alyssa Miller: Bringing security to DevOps and the CI/CD pipeline
08:40 I love the way you came back to culture at the
09:58 I hear governance, I want to dive into this a little
13:23 I think. You mentioned about DevOps being culture and change. Now
17:13 You mentioned Netflix. I remember in the early days, there was
19:38 I want to switch gears a little bit, and as we
25:03 Yep, and this ties directly into, like the two of you
30:08 And we sort of already hit on a couple of aspects
33:44 Yeah, I think that's— I like that approach that you're describing
37:23 Tilt left, tilt left with the camera. Alyssa, as we're coming

Liran Tal — Cloud native application security, what’s a developer to do? Mar 09, 2021

Cloud-native development gives engineers control over more of the stack, but it also gives them more security decisions to get wrong. Liran Tal, an open-source contributor and developer advocate, joins Chris and Robert to explore that expanding responsibility. They define cloud-native applications, examine containers and infrastructure as code, and discuss how security ownership changes when developers choose runtimes, dependencies, and deployment configurations. Liran explains why vulnerability severity alone is a poor guide to remediation and why usable feedback matters more than another long list of findings. The conversation also covers practical container-building mistakes, production behavior, and the value of asking what could go wrong while writing code. His advice centers on awareness, helpful defaults, and tools that support developers.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Liran Tal:
→ Liran Tal’s website

Mentioned in this episode:
→ Node.js
→ Docker
→ Kubernetes
→ Snyk

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Cloud-native application security with Liran Tal
05:25 Defining cloud-native development
07:26 What is changing in the cloud-native stack
09:36 Who owns application and infrastructure security
13:32 Security in the local developer workflow
15:15 Threats in cloud-native applications
16:46 Infrastructure as code and security visibility
22:08 Least privilege and cloud configuration
24:12 Helping developers take on new responsibilities
27:27 AppSec practices in a cloud-native world
29:31 Prioritizing vulnerabilities beyond severity
31:49 Giving developers the tools to help themselves
33:08 Building safer Node.js container images
37:10 Differences between development and production
38:40 Practical takeaways and a threat modeling mindset

Chris Romeo — DevSecOps Fails Feb 17, 2021

Robert and I decided to talk about an article I wrote called "DevOps security culture: 12 fails your team can learn from". We hope you enjoy this walkthrough of the 12 fails. If we missed any, hit us up on Twitter and let us know what we should add to the list. At Security Journey, we believe security is every developer's job. We work with our customers to help them build long-term sustainable security culture amongst all their developers. Our approach is to provide security education that's conversational, Quick, hands-on, and fun. We don't do lectures. Instead, we let the experts talk about what's important.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Hey folks, for this episode, Robert and I decided to talk about an article I wrote called DevOps Security Culture: 12 Fails Your Team Can Learn From.
→ Learn more about Security Journey

Connect with Chris Romeo:
→ Chris Romeo on LinkedIn
→ OWASP Dependency-Check

Mentioned in this episode:
→ OWASP Dependency-Check
→ Threat Modeling Manifesto
→ Julien Vehent
→ TechBeacon
→ Matthew Coles
→ Jim Routh on Twitter

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Chris Romeo: Chris Romeo — DevSecOps Fails
02:15 Yeah, I got the opportunity to write this article for TechBeacon
05:30 That's okay. Yeah, I mean, that's in the article I talk
07:33 The other frustration I have with the infinity graph is I
09:55 I've come to the conclusion now that if you want to
13:02 Yeah. As I look across the industry, and I've used a
14:44 I mean, we've got shift left, we've got shift right. I
17:48 Overcomplicating anything sets you up for failure, right
20:12 Number 9, noisy security tools. How are they noisy
23:09 It's a fail if you don't do it. Can you believe
25:08 That's pretty— I mean, recently, that's, that's very relevant, right

Jim Routh — Secure software pipelines Feb 10, 2021

A secure software pipeline is more than a collection of scanners. Jim Routh joins Chris and Robert to explain how organizations can build repeatable controls into delivery systems while preserving the speed engineering teams need. From a CISO’s perspective, Jim describes the organizational and funding decisions behind pipeline transformation, the role of threat modeling, and the difference between application security, software security, and broader cyber risk. The discussion focuses on making controls consistent, measuring the value of automation, and structuring teams so secure delivery becomes a shared capability. Jim closes with lessons leaders can use when turning isolated security activities into an enterprise software assurance program.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Jim Routh:
→ Jim Routh on LinkedIn

Mentioned in this episode:
→ Threat Modeling Manifesto

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Building secure software pipelines
02:00 Jim Routh’s software security work
07:00 From DevSecOps activities to pipeline capabilities
13:00 The CISO perspective on software delivery
16:00 Embedding security controls in the pipeline
27:00 Application security, software security, and cyber risk
30:00 Organizational models for secure delivery
31:00 Funding a pipeline transformation
38:00 Practical takeaways for security leaders
43:00 Closing thoughts

Andrew van der Stock — Taking Application Security to the Masses Jan 20, 2021

How does a volunteer security community reach the millions of people who build software? Andrew van der Stock reflects on that challenge after becoming OWASP’s executive director in 2020. He traces his early application security work and contributions to OWASP projects, then explains the foundation’s purpose and the organizational work behind its public resources. Chris and Robert ask about membership, support from companies that use those resources, and ways to welcome people who are new to security. Andrew also discusses the disruption of 2020 and plans for OWASP’s twentieth anniversary. This archive conversation captures his ambitions for making practical application security knowledge more accessible while building a stronger, more sustainable community around it.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Andrew van der Stock:
→ Andrew van der Stock at OWASP

Mentioned in this episode:
→ OWASP Foundation
→ OWASP Developer Guide
→ OWASP Proactive Controls
→ ZAP

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Taking application security to the masses
02:42 Andrew’s early AppSec and OWASP work
06:17 Becoming OWASP’s executive director
10:35 OWASP’s mission and community
12:19 Application security beyond the web
13:47 Why individuals and companies join OWASP
18:07 Welcoming newcomers into security
20:32 How OWASP navigated 2020
23:25 A longer-term vision for the foundation
26:23 Planning OWASP’s twentieth anniversary
28:20 How listeners can participate

JC Herz and Steve Springett — SBOMs and software supply chain assurance Jan 12, 2021

Software bills of materials promise visibility into dependencies, but visibility alone does not create assurance. JC Herz and Steve Springett join Chris and Robert to explain what an SBOM contains, why machine-readable formats matter, and how CycloneDX and Dependency-Track help organizations reason about software composition. They compare automated inventories with spreadsheets and audits, examine the threats an SBOM can and cannot address, and discuss why regulation and supply-chain incidents pushed the topic into the spotlight. The conversation closes with adoption guidance, including how teams can connect SBOM data to vulnerability management and verification instead of treating it as another compliance artifact.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with JC Herz and Steve Springett:
→ JC Herz on LinkedIn
→ Steve Springett on LinkedIn
→ CycloneDX

Mentioned in this episode:
→ CycloneDX
→ Dependency-Track
→ National Vulnerability Database
→ The left-pad incident

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 SBOMs and software supply-chain assurance
01:47 Introducing the guests and the problem
06:51 Steve Springett and the CycloneDX ecosystem
10:00 What an SBOM contains
17:45 CMMC, audits, and assurance requirements
20:38 Understanding software composition
22:34 Why spreadsheets do not scale
25:00 Different consumers need different SBOM views
27:00 The threats SBOMs can help address
33:30 Why the industry is paying attention now
39:00 When and where to generate an SBOM
41:00 Adoption through OWASP and SCVS
44:46 Practical takeaways

Brian Reed — Mobile Appsec: The Good, the Bad and the Ugly as We Head into 2021 Jan 06, 2021

Brian Reed is Chief Mobility Officer at NowSecure. Brian has over 30 years in tech and 15 years in mobile, security, and apps dating back to the birth of mobile including BlackBerry, Good Technology, BoxTone, and MicroFocus. Brian joins us to discuss mobile application security, the good, the bad, and the ugly as we head into 2021. We discuss recent issues in mobile apps, mobile firewalls, mobile vs. web, and how AppSec is different in a mobile world. We hope you enjoy this conversation with... We discuss recent issues in mobile applications, mobile firewalls, mobile versus the web, and how application security is different in a mobile world.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Brian Reed is Chief Mobility Officer at NowSecure.
→ Learn more about Security Journey

Connect with Brian Reed:
→ NowSecure
→ Mobile Testing Guide

Mentioned in this episode:
→ NowSecure
→ Mobile Testing Guide
→ Snyk
→ Facebook

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Brian Reed: Brian Reed — Mobile Appsec: The Good, the Bad and the Ugly as We Head into 2021
03:28 It's funny when you think about the architecture underneath BlackBerry. Like
06:55 Let's jump into some of the recent issues that have occurred
11:54 A couple things that you mentioned that I want to dive
16:30 They've made a lot of changes since the days that I
18:57 That's part of the scary, you know, some of the scary
23:20 Yes, that's really easy. It's easy to do too, right
25:53 So when we think about kind of the core audience of
28:36 I mean, I couldn't find anything I disagree with, which, you
29:22 Are the things you should care about
32:22 That's great. It's good information for those people that are going

The Threat Modeling Manifesto – Part 2 Nov 24, 2020

How did a group of experienced practitioners turn months of disagreement into a usable Threat Modeling Manifesto? Part two follows the contributors as they refine principles, test language, and decide what belongs in the final document. The discussion compares recipes with adaptable patterns, examines the gap between documentation and shared understanding, and confronts the difficulty of proving threat modeling’s return on investment. Contributors including Alyssa Miller, Irene Michlin, Fraser Scott, Chris Romeo, and Robert Hurlbut debate whether guidance is essential or optional and whether patterns and anti-patterns can make it more actionable. The episode ends with the final principles and a complete acknowledgement of the people who created the Manifesto.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with the Threat Modeling Manifesto contributors:
→ Threat Modeling Manifesto
→ Chris Romeo on LinkedIn
→ Robert Hurlbut on LinkedIn

Mentioned in this episode:
→ Threat Modeling Manifesto
→ Zoe Braiterman
→ Adam Shostack
→ Jonathan Marcil
→ Stephen de Vries and IriusRisk
→ Irene Michlin
→ Kim Wuyts
→ Robert Hurlbut
→ Brook Schoenfield
→ Matthew Coles
→ Chris Romeo
→ Alyssa Miller
→ Izar Tarandach
→ Avi Douglen
→ Marc French
→ Agile Manifesto

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 From debate to a finished Manifesto
02:48 Recipes, patterns, and adaptable practice
05:04 Documentation versus shared understanding
08:14 The return on investment of threat modeling
09:49 Structure and systematic analysis
12:56 Refining the principles
13:34 Alyssa Miller’s perspective
14:43 Irene Michlin joins the debate
16:12 Essential guidance versus optional advice
17:55 Preserving the power of the principles
19:28 Patterns and anti-patterns
21:15 Helping teams become more effective
22:42 Reading the final principles
24:04 The Manifesto contributors

The Threat Modeling Manifesto – Part 1 Nov 17, 2020

What should threat modeling mean when practitioners use the term in very different ways? Part one of the Threat Modeling Manifesto documents a six-month collaboration among experienced practitioners trying to create a definition, values, and principles the community can support. The recording preserves real disagreements about people, design, privacy, tools, jargon, and how broad the practice should be. Contributors including Alyssa Miller, Fraser Scott, Brook Schoenfield, Matthew Coles, Chris Romeo, and Robert Hurlbut test individual words against years of teaching and consulting experience. Rather than presenting a polished result without context, the episode shows the difficult work of building consensus and deciding how a short public statement can remain precise without becoming inaccessible.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with the Threat Modeling Manifesto contributors:
→ Threat Modeling Manifesto
→ Chris Romeo on LinkedIn
→ Robert Hurlbut on LinkedIn

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Why the Threat Modeling Manifesto was created
01:25 Beginning the definition debate
02:57 Putting people at the center
04:16 Defining the boundaries of threat modeling
04:59 Alyssa Miller on security, privacy, and business
06:38 Building a definition the community can support
08:34 Fraser Scott on precise language
09:39 Brook Schoenfield on models and experience
12:09 Quality, buzz, and practitioner expectations
14:03 Short and long definitions
16:27 What counts as a threat modeling tool
18:25 Separating values from principles
20:35 Converging on the wording
23:09 Reviewing the remaining disagreements
25:04 How values become practice

Season 7 Guests — The best of Season 7 Oct 26, 2020

Which ideas from Season 7 deserve another listen? Chris and Robert assemble clips from across the season, creating a fast tour through secure development maturity, intentionally vulnerable applications, IoT security, static analysis, cloud risk, artificial intelligence, threat modeling, data protection, JavaScript supply-chain defense, penetration testing, API design, and Ruby on Rails. Each segment returns to the guest’s own explanation rather than reducing the episode to a host summary. The result is both a recap and a listening guide: Janek Hollenbach, Cindy Blake, Aaron Guzman, Drew Dennison, Ochaun Marshall, Graham Holmes, Elie Saad, Grant Ongers, Michael Furman, Anastasia Voitova, Aaron Davis, Caroline Wong, Dmitry Sotnikov, and Frank Rietta each contribute a distinct practical lesson.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Chris Romeo and Robert Hurlbut:
→ Chris Romeo on LinkedIn
→ Robert Hurlbut on LinkedIn

Mentioned in this episode:
→ OWASP SAMM
→ MultiJuicer
→ OWASP IoTGoat
→ Semgrep
→ OWASP Cornucopia
→ OWASP ASVS
→ LavaMoat
→ MetaMask
→ OWASP Top 10
→ OWASP SAMM
→ OWASP Cornucopia
→ Ruby on Rails

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Season 7 highlights
01:37 Sebastien Deleersnyder on OWASP SAMM
02:48 Janek Hollenbach on MultiJuicer
04:05 Cindy Blake on security in DevSecOps
05:59 Aaron Guzman on OWASP IoTGoat
07:11 Drew Dennison on how Semgrep works
10:39 Ochaun Marshall on AWS security frustration
13:10 Graham Holmes on trustworthy AI
16:34 Elie Saad’s introduction to OWASP
18:29 Grant Ongers on threat modeling games
22:16 Chris Romeo on the state of security
24:35 Michael Furman on SameSite cookies
25:53 Anastasia Voitova on data security
28:05 Aaron Davis on defending LavaMoat
29:38 Caroline Wong on modern penetration testing
32:04 Dmitry Sotnikov on REST API security
35:57 Frank Rietta on Ruby on Rails
39:22 Closing Season 7

Aviat Jean-Baptiste — The AppSec report Oct 13, 2020

Jb Aviat is CTO and co-founder at Sqreen. Prior to this, Jb worked at Apple as a reverse engineer, pentester and developer. Jb joins us to discuss the new Application Security Report that Sqreen has released. We review what the report contains, key takeaways and conclusions, and even consider which framework/language is the most secure. We hope you enjoy this conversation with.... JB Eviat is CTO and co-founder at Screen. You cannot hack yourself secure. Everyone wants to focus on the offensive side of the equation. The challenge is that developers get bored with hacking broken pieces of code after a while. Sure, it's a shiny, cool new thing in the beginning, but how about one year later?

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
JB Eviat is CTO and co-founder at Screen.
→ Learn more about Security Journey

Connect with Aviat Jean-Baptiste:
→ Sqreen (now Datadog AAP)
→ OWASP Top 10

Mentioned in this episode:
→ Sqreen (now Datadog AAP)
→ OWASP Top 10
→ HackerOne 2020 Hacker Report
→ Ruby on Rails
→ Symfony
→ Laravel
→ WordPress
→ Express
→ MongoDB
→ Node.js

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Aviat Jean-Baptiste: Aviat Jean-Baptiste — The AppSec report
01:34 We're going to talk today about a new report that has
04:38 Now I'm curious. It sounds like you came from a lot
10:52 Yeah. So, JP, that's what we're here for, is a report
13:00 So understanding a little bit more about what the report is
15:34 If we think about this from our audience's perspective, What would
19:18 With that in mind, and let's take— I know you give
21:30 We did talk about, we've already kind of mentioned a few
24:45 That's a great point about use of frameworks and making sure
27:47 As somebody who spends a good amount of time in Ruby

Frank Rietta — The convergence of Ruby on Rails and #AppSec Oct 06, 2020

Ruby on Rails can provide strong security defaults, but a framework cannot make every design decision for its developers. Frank Rietta, a security-focused Rails developer and business owner, explains where the framework helps and where teams still need to think carefully. He traces his path into application security, describes Rails beyond its startup reputation, and discusses testing, secure coding guidance, and the familiar threats facing web applications. Frank also shares his work on RubyGems typosquatting and the risks introduced through dependencies. The practical discussion turns to Brakeman, Bundler Audit, and building checks into everyday development. His recurring advice is to combine useful tooling with deliberate design, maintained dependencies, and an understanding of how attackers can misuse ordinary features.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Frank Rietta:
→ Frank Rietta’s website

Mentioned in this episode:
→ Rails security guide
→ Brakeman
→ Bundler Audit

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Ruby on Rails and AppSec with Frank Rietta
01:14 Frank’s path into application security
07:13 Helping developers build security skills
11:00 What Ruby on Rails provides
14:01 Rails beyond early-stage startups
17:15 Security defaults and their limits
22:23 Secure coding guidance for Rails developers
25:20 Testing culture and security checks
29:13 The main threats facing Rails applications
32:14 Typosquatting and the RubyGems supply chain
38:32 Brakeman, Bundler Audit, and the security toolkit
45:11 Key takeaways for secure Rails development

Dmitry Sotnikov – REST API Security – there is no silver bullet Sep 29, 2020

Dmitry Sotnikov serves as Chief Product Officer at 42Crunch – an enterprise API security company. He maintains a popular community site with daily API Security news and weekly newsletter API vulnerabilities, breaches, standards, best practices, regulations, and tools. Dmitry joins us to discuss REST API Security. We talk about the top API security threats, counters to those threats, and the details on APISecurity. We hope you enjoy this conversation with ... He's also the maintainer of apisecurity. io, a popular community site with daily API security news and weekly newsletters. At Security Journey, we believe security is every developer's job. We work with our customers to help them build long-term, sustainable security culture amongst all their developers.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Dmitry Sotnikov serves as Chief Product Officer at 42 Crunch, an enterprise API security company.
→ Learn more about Security Journey

Connect with Dmitry Sotnikov:
→ APISecurity.io
→ OWASP API Security Top 10

Mentioned in this episode:
→ APISecurity.io
→ OWASP API Security Top 10

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Dmitry Sotnikov: Dmitry Sotnikov – REST API Security – there is no silver bullet
02:02 Oh wait, so you, you want to talk about a technical
07:26 I'm curious though about your previous role from an API management
09:49 Our topic today is REST APIs. I remember back in the
12:37 We think about the differences in security then, we've acknowledged the
16:40 With that in mind, what are some of the top security
25:09 That points to counters, countering that kind of thing. I mean
26:44 Yeah, I mean, and I've even seen, I mean, I'm sure
30:27 We appreciate you joining us today, Dmitry. I was wondering if

Caroline Wong — The state of Penetration Testing Sep 22, 2020

Caroline Wong is the Chief Strategy Officer at Cobalt. io. You cannot hack yourself secure. The challenge is that developers get bored with hacking broken pieces of code after a while. Sure, it's a shiny, cool new thing in the beginning, but how about one year later? At Security Journey, we focus on long-term sustainable security culture with the developers as defenders. We believe that developers need hands-on experience, but not at the expense of fundamental knowledge. Visit www. securityjourney. com to sign up for a free trial of the Security Dojo or schedule a demo. This is Robert Hurlbut. Threat modeling architect. I'm also joined by my co-host Chris Romeo.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Caroline Wong is the Chief Strategy Officer at Cobalt.
→ Learn more about Security Journey

Connect with Caroline Wong:
→ Cobalt.io
→ BSIMM

Mentioned in this episode:
→ Cobalt.io
→ BSIMM
→ Burp Suite
→ HackerOne
→ Bugcrowd
→ PCI Security Standards Council

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Caroline Wong: Caroline Wong — The state of Penetration Testing
02:38 Absolutely. And so as Chris mentioned, today we're going to shift
05:03 Great. So another interesting thing that I hear, maybe some confusion
07:29 Sure, right. Okay, that makes sense. So let's talk about software
11:39 That okay
14:43 Caroline, that definitely makes sense. And I do have another question
16:49 Now we had a question about your company. Your company also
28:45 I have one more question, and this sort of— just thinking

Aaron Davis — LavaMoat — solving JavaScript software supply chain Sep 15, 2020

Aaron Davis is a founder, dev, and a lead security researcher at MetaMask, a popular Ethereum wallet. He introduces us to LavaMoat, an approach to solving javascript software supply chain security for node and the browser. The LavaMoat runtime prevents modifying JavaScript's primordials, limits access to the platform API, and prevents packages from corrupting other packages. We hope you enjoy this conversation with... Aaron Davis.

Connect with Aaron “kumavis” Davis:
→ Aaron “kumavis” Davis on GitHub
→ LavaMoat

Mentioned in this episode:
→ LavaMoat
→ MetaMask
→ npm event-stream incident
→ Snyk
→ Node.js

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Aaron “kumavis” Davis
02:10 Aaron’s security origin story
03:29 Security lessons from building MetaMask
05:20 Why tackle the JavaScript supply chain?
09:06 The problem reaches beyond JavaScript
10:40 Malicious updates and compromised maintainers
12:47 The hidden scale of transitive dependencies
14:52 Open source economics and critical packages
18:42 Is LavaMoat a firewall for JavaScript?
20:22 Could browsers make LavaMoat obsolete?
22:35 Runtime performance costs
25:11 Threat modeling LavaMoat itself
28:36 Static analysis and policy generation
30:07 Understanding LavaMoat policy files
33:01 Using LavaMoat in complex applications
37:36 How to get involved

Anastasiia Voitova — Use Cryptography; Don’t Learn It Sep 10, 2020

Developers need to protect data, but should they need to become cryptographers to do it safely? Anastasiia Voitova, a software engineer working on data security at Cossack Labs, makes the case for boring cryptography: dependable libraries with clear, high-level interfaces and fewer opportunities for misuse. She explains the practical tension between encryption and application features such as searching, then walks through common mistakes in choosing algorithms, handling keys, and copying examples from the internet. Chris and Robert ask how developers can evaluate libraries and find trustworthy guidance. Anastasiia’s answer is to focus on the protection the application needs, choose tools designed for that job, and make the secure path easier than assembling cryptographic primitives by hand.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Anastasiia Voitova:
→ Anastasiia Voitova at Cossack Labs

Mentioned in this episode:
→ Cossack Labs
→ OpenSSL
→ Go

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Use cryptography without becoming a cryptographer
01:43 Anastasiia’s route from development to data security
04:36 The practical appeal of cryptography
06:26 Data protection and searchable encryption
10:34 What use cryptography, don’t learn it means
12:07 Moving beyond don’t roll your own crypto
14:02 Common mistakes in cryptographic design
20:58 The risks of copying security examples
21:46 Defining boring cryptography
24:04 Choosing safer libraries and APIs
28:22 Finding useful cryptography resources
31:31 Practical advice for developers

Michael Furman — SameSite Cookies Sep 03, 2020

Michael Furman is the Lead Security Architect at Tufin, and is responsible for the security and Security Development Lifecycle (SDL) of Tufin software products. Michael is passionate about application security for over 13 years already and evangelizes about application security at various conferences (including OWASP conferences) and security meetups. Michael joins us to break down SameSite cookies, which are all the rage in browsers these days. He describes what they are, the threats they counter, and how SameSite + the Synchronizer Token Pattern work together to counter CSRF. We hope you enjoy this conversation with.... He's worked in this space for 13 years and evangelizes AppSec at various conferences, including OWASP and security meetups.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Michael Furman is the lead security architect at Tufin and is responsible for the security and secure development lifecycle of Tufin software products.
→ Learn more about Security Journey

Connect with Michael Furman:
→ Tufin
→ Chromium

Mentioned in this episode:
→ Tufin
→ Chromium

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Michael Furman: Michael Furman — SameSite Cookies
02:17 Excellent. And so to get started, what we usually do is
04:54 Yeah, and I'll definitely second what you're saying about application security
07:17 Okay. And so SameSite's been around then for just a couple
08:52 That makes sense in terms of some of the things that
11:19 Yeah, and I think the last I heard for the previous
14:37 So with the— what you're modeling in the test csrf.htm here
17:09 Yeah. So one of the patterns that we've used in the
19:14 It sounds like you could still use the synchronizer pattern, but
30:39 We can only hope and dream that that is a world
32:29 Yeah, that's great. That provides our users with some additional information

Chris Romeo — The State of Security and the Importance of Empathy Aug 27, 2020

Network engineers and application security teams depend on each other, yet often struggle to understand each other’s responsibilities. In this rebroadcast from The Hedge, Chris Romeo joins hosts Russ White and Tom Ammon to explore that divide. They discuss encrypted traffic, denial-of-service attacks, DNS, and the limits of relying on network controls to protect applications. Chris explains threat modeling as a repeatable way to question assumptions, including assumptions about cloud services and insider access. The conversation then turns to infrastructure automation, changing engineering roles, and the frustration created when security policies arrive without technical understanding. Their practical message is to learn one another’s language and build empathy through real experience with the systems other teams operate.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Chris Romeo:
→ Chris Romeo on LinkedIn

Mentioned in this episode:
→ The Hedge episode 48
→ National Vulnerability Database

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Chris joins The Hedge to discuss security
02:01 Where network and application security meet
04:29 Encrypted traffic and network responsibilities
06:04 Certificates, DNS, and interception threats
07:51 Threat modeling as a way of questioning assumptions
09:23 How denial-of-service defenses evolved
12:23 Revisiting models as threats change
17:45 Where network engineers can improve security
22:21 Helping developers and application teams
24:46 Routing, segmentation, and control-plane risks
28:18 Insider threats and shared control
31:11 Infrastructure as code and changing engineering roles
34:51 Empathy between network and security teams
39:39 Learning paths for network engineers

Neil Matatall — Content Security Policy Aug 04, 2020

Neil Matatall is a product security engineer at GitHub. He focuses on designing and engineering user experiences solutions related to authentication and account recovery. Working remotely from Hawaii, Neil is a strong believer in the future of remote work. Neil joins us for a deep-dive into Content Security Policy. We explore what it is, the purpose, and why it's so difficult to implement. Neil Madhatal is a product security engineer at GitHub. Neil joins us for a deep dive into content security policy. We hope you enjoy this conversation with— Neil Madhatal. Are you trying to build a security champions program? Everyone is these days.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Neil Madhatal is a product security engineer at GitHub.
→ Learn more about Security Journey

Connect with Neil Matatall:
→ github/secure_headers
→ Content-Security-Policy (MDN)

Mentioned in this episode:
→ github/secure_headers
→ Content-Security-Policy (MDN)
→ Scott Helme
→ Troy Hunt
→ Twilio
→ Sqreen (now Datadog AAP)

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Neil Matatall: Neil Matatall — Content Security Policy
01:56 So, you know, probably like me, enough to be dangerous, which
05:19 Yeah, that's very cool to hear that you, you know, were
09:50 So just to kind of summarize a little bit, when we're
11:58 So like, do you remember, it was about maybe a year
14:36 So I interrupted when we were in the middle of talking
20:25 Kind of going back to, you talked about the unsafe inline
22:18 Neil, when you're building a policy then, is that the steps
28:46 It just, this is not very easy to do
30:14 In the example you had where you're adding a button and
32:39 Yeah. Now, we talked about SRI earlier. One of the challenges
34:44 We mentioned secure headers as one potential resource. Are there any
36:07 Scott Helm had a, I think it's still out there, secureheaders.io
40:02 Great, thanks for sharing that with us and for sharing it

Grant Ongers — Gamification of threat modeling Jul 28, 2020

Grant Ongers (@rewtd) is co-founder of the bearded trio called Secure Delivery, with a philosophy and purpose for optimal delivery and security in one dynamic package. Grant's experience spans Dev, Ops, and Security, with over 30 years pushing the limits of (Info)Sec. Grant’s community involvement is global: Staff at BSides (London, Las Vegas, and Cape Town), Goon at DEF CON (USA) for nearly ten years and DC2721 co-founder, staff at BlackHat (USA and EU), and an OWASP Global Board member. Grant Ungers is co-founder of the bearded trio called Secure Delivery, with a philosophy and purpose for optimal delivery and security in one dynamic package.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Grant Ungers is co-founder of the bearded trio called Secure Delivery, with a philosophy and purpose for optimal delivery and security in one dynamic package.
→ Learn more about Security Journey

Connect with Grant Ongers:
→ Secure Delivery
→ OWASP Cornucopia

Mentioned in this episode:
→ Secure Delivery
→ OWASP Cornucopia
→ OWASP Cornucopia
→ Elevation of Privilege
→ OWASP Application Security Verification Standard (ASVS)

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Grant Ongers: Grant Ongers — Gamification of threat modeling
02:16 Uh, with that in mind, we, we do have a special
05:24 So, with that in mind, who should be doing the threat
07:21 There a particular methodology, Grant, that you would say is what
13:31 As I'm kind of listening to this, and I told you
17:48 It's basically taking this smaller idea, and when you have 25,000—
20:24 Yeah, I remember the first time I heard about it and
24:23 I think about threat modeling as— when I went teaching threat
27:08 That, that's great because that's what you want, right
32:17 Grant, well, thank you for joining us. Any last, maybe something

Elie Saad — OWASP WSTG, Cheat Sheets, and Integration Jul 20, 2020

Elie Saad is an application security engineer, leading three different OWASP projects. He focuses on helping developers own and champion security in their projects by providing guidance, tests, secure pipeline design and aiding them in applying external security measures. Eli Saad is an application security engineer leading 3 different OWASP projects. In this conversation, Eli educates us about the current happenings with WSTG, which is the testing guide, the Cheat Sheet project, and the integration standard. And he walks us through demos of each of these projects. We hope you enjoy this conversation with Eli Saad. At Security Journey, we believe security is every developer's job.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Eli Saad is an application security engineer leading 3 different OWASP projects.
→ Learn more about Security Journey

Connect with Elie Saad:
→ OWASP Web Security Testing Guide (WSTG)
→ OWASP Cheat Sheet Series

Mentioned in this episode:
→ OWASP Web Security Testing Guide (WSTG)
→ OWASP Cheat Sheet Series
→ OWASP Application Security Verification Standard (ASVS)
→ OWASP Password Storage Cheat Sheet
→ OWASP Proactive Controls
→ OWASP ZAP
→ Mobile Testing Guide

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Elie Saad: Elie Saad — OWASP WSTG, Cheat Sheets, and Integration
02:15 Great. We'll have to do another episode where we profile and
07:25 That's exciting, the different projects. I mean, Robert and I are
09:59 Yeah, I mean, you're doing a lot in the world of
13:46 If I remember correctly, there are also some tie-ins from the
19:08 Yeah, that's great. And it just, it shows the depth. That's
25:38 It's such a hard thing to actually do. Like, I couldn't
27:27 You probably, same thing, Chris, you hear that often. What's the
29:16 Let's, let's go ahead and transition over to the integration standards
35:24 Yeah, it's great. It's a piece that's been missing is the

Graham Holmes — Adversarial Machine Learning Jul 13, 2020

Graham Holmes is the founder and owner of AoP CyberSecurity, LLC whose mission is to enable organizations to “create scalable and effective strategies for trustworthy outcomes. ” His career includes over 22 years as a leader at Cisco Systems, where he infamously served as my boss for a period of time, and before that he served in the US Navy as a commissioned officer for 9 years. Graham joins us to discuss adversarial machine learning. We explore the threats and attacks in an AI/ML world, and review solutions to address these challenges using trust as a foundation. Please enjoy this conversation with Graham Holmes. We explore the threats and attacks in an artificial intelligence machine learning world and review solutions to address these challenges using trust as a foundation.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Graham Holmes is the founder and owner of AOP Cybersecurity, whose mission is to enable organizations to create scalable and effective strategies for trustworthy outcomes.
→ Learn more about Security Journey

Connect with Graham Holmes:
→ Life 3.0
→ Microsoft Security Development Lifecycle (SDL)

Mentioned in this episode:
→ Life 3.0
→ Microsoft Security Development Lifecycle (SDL)
→ Artificial Intelligence

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Graham Holmes: Graham Holmes — Adversarial Machine Learning
02:31 Yeah, that's awesome, and congratulations on that. And it's some, I
06:32 So our topic then is adversarial machine learning. And so I
08:53 It sounds like— and actually, I didn't even— I forgot to
13:44 Graham, is it full— can you reverse engineer Kind of what
25:21 Yeah, because when you think about a vulnerability in a modern
27:38 You know, we've talked about, uh, definitely importance of, of application
32:14 Since we've covered— I feel like we've covered the attacks well
35:41 So you've, uh, you're branching out on a new venture here
37:40 Here's a— and I know we're coming to the close here
40:54 Graham, are there any, uh, resources that you would recommend
43:31 That's, uh, great. Uh, Life 2.0, I'm gonna remember that. Check

Ochaun Marshall — Securing Web applications in AWS Jul 07, 2020

Ochaun Marshall is a developer and security consultant. In his roles at Secure Ideas, he works on ongoing development projects utilizing Amazon Web Services and breaks other people's web applications. Ochaun joins us to talk about the changing tide of serverless and frustrations with AWS security. Before we got to the actual topic, we talked about how he currently works as a developer some times, and a pen tester/security person the rest of the time, and the conflict that arises from this split role. Please enjoy this conversation with... O'Shawn Marshall is a developer and security consultant. O'Shawn joins us to talk about the changing tide of serverless and frustrations with AWS security.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
O'Shawn Marshall is a developer and security consultant.
→ Learn more about Security Journey

Connect with Ochaun Marshall:
→ Secure Ideas
→ OWASP Proactive Controls

Mentioned in this episode:
→ Secure Ideas
→ OWASP Proactive Controls

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Ochaun Marshall: Ochaun Marshall — Securing Web applications in AWS
03:29 Very cool. You survived that 60-year-old librarian coming after you. She
06:26 Yeah, that's, that's definitely good advice, something that we share as
11:13 Yeah, I'll tag on to something you said here about kind
14:19 Yeah, I guess there's some of that basic stuff. Like, when
18:59 Yeah, or you end up opening it, making it wide open
21:07 Yeah, that's good advice just for in general, for anything. Yeah
25:05 Yeah, that's definitely going to be a challenge as we move
29:35 Authorization. How are we ensuring that the right request, that the
34:26 It's not simple. It's so complicated. Like, I've been playing around

Drew Dennison – Security should make the computer sweat more Jun 30, 2020

Drew Dennison is the CTO & co-founder of r2c, a startup working to profoundly improve software security and reliability to safeguard human progress. Drew joins us to introduce a tool called semgrep. Semgrep is a fast source code analysis tool, potentially faster than anything you've seen before. Drew Dennison is the CTO and co-founder of R2C, a startup working to profoundly improve software security and reliability to safeguard human progress. If you want to see the live demo Drew does of Semgrep, head over to the Application Security Podcast YouTube channel to see the video. We hope you enjoy this conversation with Drew Dennison. At Security Journey, we believe security is every developer's job.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Drew Dennison is the CTO and co-founder of R2C, a startup working to profoundly improve software security and reliability to safeguard human progress.
→ Learn more about Security Journey

Connect with Drew Dennison:
→ Semgrep
→ r2c / Semgrep Inc.

Mentioned in this episode:
→ Semgrep
→ r2c / Semgrep Inc.
→ Applied Cryptography
→ Ron Rivest
→ John Nash's Declassified NSA Letters
→ Hack (programming language)
→ Flow
→ nodejsscan
→ Yoann Padioleau
→ Applied Cryptography
→ Hacking Exposed Web Applications
→ Tree-sitter

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Drew Dennison: Drew Dennison – Security should make the computer sweat more
01:42 All right, so the topic for today is something called Semgrep
07:24 I'm trying to think. You spoke about this tool, I think
12:22 This a replacement or a— I mean, is this designed to
15:21 Yeah. I mean, that's the whole DevOps approach to the world
18:09 Really neat way. So, GitHub Action pipelines— what other use cases
21:03 Yeah, you have patterns that still match certain code constructs as
22:16 That's very cool, that example you had earlier there about the
24:43 You're running Semgrep against anything you're building, so good luck. They're
27:58 If you had to leave our audience with one kind of

Aaron Guzman — IoTGoat Jun 23, 2020

Aaron Guzman specializes in IoT, embedded, and automotive security. Aaron is the Co-Author of “IoT Penetration Testing Cookbook”. He helps lead both OWASP’s Embedded Application Security and Internet of Things projects; providing practical guidance for addressing top security vulnerabilities to the embedded and IoT community. Aaron joins us to explore IoTGoat. IoTGoat is a deliberately insecure firmware created to educate software developers and security professionals with testing commonly found vulnerabilities in IoT devices. He describes what it is, where it comes from, and does a demo for us on how to put it to use. Aaron joins us to explore IoT Goat. IoT Goat is a deliberately insecure firmware created to educate software developers and security professionals with testing commonly found vulnerabilities in IoT devices.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Aaron Guzman specializes in IoT, embedded, and automotive security.
→ Learn more about Security Journey

Connect with Aaron Guzman:
→ IoTGoat
→ OWASP IoT Project

Mentioned in this episode:
→ IoTGoat
→ OWASP IoT Project
→ OWASP IoT Top 10
→ OWASP Juice Shop
→ OWASP Web Security Testing Guide (WSTG)
→ OWASP ISVS
→ Cloud Security Alliance (CSA)
→ CSA IoT Working Group
→ ENISA

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Aaron Guzman: Aaron Guzman — IoTGoat
02:09 All right, and our guest today is Aaron Guzman, who is
07:34 Aaron, I understand you are working on the project IoT Goat
10:15 Aaron, when I think about vulnerable apps, I think about like
11:51 Curious, where did it come from
14:48 March of what year
18:33 You mentioned the relationship to OWASP IoT, or at least it
21:55 Now if we kind of switch gears and get more practical
27:04 Just let me summarize to make sure I'm understanding correctly. So
28:40 As far as the future of IoT Goat, where do you
32:12 Yeah, definitely. Most definitely. So if you want to leave our

Adam Shostack — The Jenga View of Threat Modeling Jun 16, 2020

Adam Shostack is a leading expert on threat modeling, and consultant, entrepreneur, technologist, author and game designer. He has taught threat modeling at a wide range of commercial, non-profit and government organizations. Adam joins us to discuss his new white paper called the Jenga View of Threat Modeling. He's a member of the Black Hat Review Board, is the author of Threat Modeling: Designing for Security, and the co-author of The New School of Information Security. Adam joins us this week to discuss his new white paper called The Jenga View of Threat Modeling. We hope you enjoy this episode with Adam Shostack. You cannot hack yourself secure.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Adam Shostack is a leading expert on threat modeling and consultant, entrepreneur, technologist, author, and game designer.
→ Learn more about Security Journey

Connect with Adam Shostack:
→ Jenga View of Threat Modeling whitepaper
→ Adam Shostack

Mentioned in this episode:
→ Jenga View of Threat Modeling whitepaper
→ Adam Shostack
→ Threat Modeling: Designing for Security
→ New School Of Information Security 9780132800280
→ Robert Hurlbut

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Adam Shostack: Adam Shostack — The Jenga View of Threat Modeling
02:05 Yeah, thank you. And so you have some things you've been
05:22 You remember those Jenga commercials back from when those of us
07:54 Okay. Makes sense. Again, you don't want it to fall down
09:46 Adam, I'm looking at the white paper that you've written about
11:50 You had a few others there We don't have time right
16:49 One of them that actually has an asterisk next to it
22:15 Right
25:43 Okay. Now, with all the way we've talked about here today
27:23 I got another question about kind of a more general approach

Cindy Blake — Aligning security testing with Agile development Jun 09, 2020

Cindy Blake is the Senior Security Evangelist at GitLab. Cindy collaborates around best practices for integrated DevSecOps application security solutions with major enterprises. She is proud to introduce her new book, “10 Steps to Securing Next-Gen Software”. The book combines her cyber security experience with a background in lean and software development, and simplifies the complexities of today’s software evolution into pragmatic advice for security programs. Cindy joins us to discuss how to align security testing with Agile development. She's proud to introduce her new book, 10 Steps to Securing Next-Gen Software. The book combines her cybersecurity experience with a background in lean and software development and simplifies the complexities of today's software evolution into pragmatic advice for security programs.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Cindy Blake is the Senior Security Evangelist at GitLab.
→ Learn more about Security Journey

Connect with Cindy Blake:
→ GitLab
→ 10 Steps Every CISO Should Take to Secure Next-Gen Software

Mentioned in this episode:
→ GitLab
→ 10 Steps Every CISO Should Take to Secure Next-Gen Software
→ Fortify (OpenText)
→ ArcSight (OpenText)
→ TippingPoint (Trend Micro)

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Cindy Blake: Cindy Blake — Aligning security testing with Agile development
02:07 Awesome. And so our topic today is aligning security testing with
05:18 So do you think— is any of the code you wrote
08:29 Like, what are— when you're describing those tools, are they things
09:51 We had another question about why have so few succeeded in
11:21 Would you, when you're thinking about this kind of separation, I'm
16:10 In our own little startup here and looking at that and
17:59 Yeah, yeah. Robert, what's your experience been between kind of— as
19:58 Cindy, what do you think are the best practices that work
25:12 Yeah, yeah. We're in here in the— at the podcast, we're
27:31 Very, very cool. So if you, I guess, from a last

Jannik Hollenbach — Multijuicer: JuiceShop with a side of Kubernetes Jun 02, 2020

Jannik Hollenbach is a Security Automation Engineer at iteratec GmbH, working on and with open source security testing tools to continuously detect security vulnerabilities in the companies software and systems. He is also a member of the OWASP Juice Shop project team. Jannik joins us to discuss MultiJuicer, or how to run JuiceShop in a Kubernetes cluster, with a separate JuiceShop instance for each user. Yannick Hollenbach is a security automation engineer at Idera Tech GmbH, working on and with open-source security testing tools to continuously detect security vulnerabilities in the company's software and systems. He's also a member of the OWASP Juice Shop project team.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Yannick Hollenbach is a security automation engineer at Idera Tech GmbH, working on and with open-source security testing tools to continuously detect security vulnerabilities in the company's software and systems.
→ Learn more about Security Journey

Connect with Jannik Hollenbach:
→ multi-juicer GitHub
→ OWASP Juice Shop

Mentioned in this episode:
→ multi-juicer GitHub
→ OWASP Juice Shop
→ MultiJuicer
→ OWASP Juice Shop
→ Kubernetes
→ Terraform
→ Terraform
→ OWASP Slack

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Jannik Hollenbach: Jannik Hollenbach — Multijuicer: JuiceShop with a side of Kubernetes
01:53 We are joined by our first ever video-based guest here. This
04:28 Yeah, and there's a lot of cool things happening in the
06:39 Is— now, is MultiJuicer tied into Kubernetes, or can I use
09:44 With Multijuicer then, what do I get when I download Multijuicer
12:29 What's the largest number of Juice Shop instances you've seen anybody
14:39 Have you seen from the adoption perspective
17:33 Great. Yannick, any final words you would leave for our audience

Sebastien Deleersnyder and Bart De Win — OWASP SAMM May 26, 2020

How does an organization improve software security without reducing maturity to a checklist? Sebastien Deleersnyder and Bart De Win join Chris and Robert to explain OWASP SAMM, the open framework for assessing and evolving a software assurance program. They trace the project’s history, explain the model’s business functions, practices, streams, and maturity levels, and show how teams can turn an assessment into a realistic roadmap. The conversation also covers version 2, companion resources, education, community events, and how SAMM differs from commercial maturity models. The result is a practical introduction for organizations that want a shared language for improvement without prescribing one identical program for everyone.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Sebastien Deleersnyder and Bart De Win:
→ OWASP SAMM
→ Toreon

Mentioned in this episode:
→ OWASP SAMM
→ OWASP SAMM project
→ BSIMM
→ Gary McGraw

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introducing OWASP SAMM
02:07 Sebastien and Bart’s paths to the project
05:08 The name behind the model
06:22 How SAMM began
09:00 What SAMM measures
13:00 Using SAMM inside an organization
13:56 What changed in SAMM version 2
17:35 Turning an assessment into a roadmap
22:00 Business functions, practices, and streams
23:00 Companion projects and supporting resources
27:00 Education and community adoption
31:00 How SAMM versioning works
33:00 SAMM user days and community feedback
35:00 The cost of using an open model
37:00 Getting started with SAMM

Marc French, Steve Lipner, Maya Kaczorowski, DJ Schleen, Kim Wuyts — Season Six Wrap up May 13, 2020

Season six closes by revisiting five conversations that capture the breadth of application security. Chris and Robert return to Marc French on the AppSec CISO, Steve Lipner on the history and future of the Microsoft SDL, Maya Kaczorowski on container and orchestration security, DJ Schleen on DevOps and organizational change, and Kim Wuyts on privacy threat modeling. Each segment pulls forward a durable lesson from the original interview and points listeners back to the full discussion. Together they connect leadership, secure development, cloud-native infrastructure, culture, and privacy into a concise tour of the season’s most useful and enduring ideas for practitioners.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with the featured guests:
→ Marc French on X
→ Steve Lipner at SAFECode
→ Maya Kaczorowski
→ DJ Schleen
→ Kim Wuyts

Mentioned in this episode:
→ Microsoft Security Development Lifecycle
→ SAFECode
→ gVisor
→ Kata Containers
→ The Unicorn Project
→ LINDDUN

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Season six lessons worth revisiting
02:00 Marc French on becoming the AppSec CISO
06:07 Steve Lipner on the Microsoft SDL
10:31 Maya Kaczorowski on container security
15:30 DJ Schleen on DevOps and organizational change
22:00 Kim Wuyts on privacy threat modeling
24:30 Closing season six

Mark Merkow — Secure, Resilient, and Agile Software Development Apr 11, 2020

Mark Merkow works at WageWorks in Tempe, Arizona, leading application security architecture and engineering efforts in the office of the CISO. Mark has over 40 years of experience in IT in a variety of roles, including application development, systems analysis and design, security engineering, and security management. Mark has authored or co-authored 17 books on IT and has been a contributing editor to 4 others. Mark joins us to discuss how application security and agile software development methodology fit together. We hope you enjoy this conversation with Mark Merkow. At Security Journey, we believe security is every developer's job. We work with our customers to help them build long-term, sustainable security culture amongst all their developers.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Mark Merkow works at WageWorks in Tempe, Arizona, leading application security architecture and engineering efforts in the office of the CISO.
→ Learn more about Security Journey

Connect with Mark Merkow:
→ Secure, Resilient, and Agile Software Development
→ Security Assurance Using the Common Criteria

Mentioned in this episode:
→ Secure, Resilient, and Agile Software Development
→ Security Assurance Using the Common Criteria
→ Common Criteria Portal
→ OWASP SAMM
→ BSIMM
→ BSIMM

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Mark Merkow: Mark Merkow — Secure, Resilient, and Agile Software Development
02:04 I looked on Wikipedia. I looked at a picture on Wikipedia
06:32 How'd you get to AppSec then
12:52 High-level question then that is not directly from the book, but
15:59 Yeah. And so I want to kind of— I want to
17:28 Do we do that then
21:09 Yeah. And so when we think about One of the major
24:11 It's more about us kind of getting out of the way
26:44 What's the first thing in— what's the first part that you're
29:54 Yeah, I guess you can make all the plans that you
33:33 Last thing that I see as I'm kind of scanning the
37:47 Mark, what do you want to leave our audience with here

Zsolt Imre — Fuzz testing is easy Apr 05, 2020

Fuzz testing can sound specialized and difficult, but Zsolt Imre argues that teams can start small and learn quickly. He joins Chris and Robert to explain what fuzzers do, which defects they are good at finding, and how his path from offensive security to defensive engineering shaped GUARDARA. The conversation covers target selection, root-cause analysis, programming languages, protocol complexity, and why no single fuzzer fits every system. Zsolt offers a practical adoption path: choose a meaningful target, integrate feedback into development, and iterate. The result is an accessible guide for AppSec teams that want to add fuzzing without turning it into a research project.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Zsolt Imre:
→ GUARDARA

Mentioned in this episode:
→ GUARDARA

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Why fuzz testing is easier than it looks
02:00 Zsolt Imre’s path into security
04:00 Moving from offensive to defensive work
07:00 What fuzz testing actually does
09:00 Who benefits from fuzzing
13:00 Finding and understanding root causes
18:00 Choosing targets and programming languages
23:00 Complexity, protocols, and coverage
26:00 Why there is no one-size-fits-all fuzzer
29:00 A practical way to get started
34:00 Integrating fuzzing and iterating
36:00 Final takeaways

Adam Shostack — Remote Threat Modeling Mar 28, 2020

Adam joins us to discuss remote threat modeling, and we do a live threat modeling exercise to figure out how remote threat modeling actually works. On this episode of the Application Security Podcast, Robert and I are joined by Adam Shostack, and the topic we discuss is remote threat modeling. We're all living in this new world where we're working from home or we're sheltering at home, and the question we pose is, how are we still going to make progress on rolling out threat modeling when we can't meet with people face-to-face and work directly on a whiteboard? So we hope you enjoy this special episode of the Application Security Podcast with— Adam Shostack.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
On this episode of the Application Security Podcast, Robert and I are joined by Adam Shostack, and the topic we discuss is remote threat modeling.
→ Learn more about Security Journey

Connect with Adam Shostack:
→ Shostack + Associates
→ Adam Shostack

Mentioned in this episode:
→ Shostack + Associates
→ Adam Shostack
→ OWASP Threat Dragon Project
→ OWASP Slack

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Adam Shostack: Adam Shostack — Remote Threat Modeling
01:52 So we find ourselves right now recording this episode. The date
05:20 Are some of the tools What are some of the tools
07:57 So we'll— yeah, we can add in a couple of different
10:10 So then we have a lock activator. So it's making me
15:51 Yeah, so you're trying to minimize the friction of the tool
17:13 I think the takeaway there for our listeners that might be
19:35 Yeah, and I'm a fan of Aries Risk from Continuum as
22:08 Yeah. So let's come back around now to some of Robert's
24:20 Yeah, and I hear both. I hear sometimes, no, not so
26:12 That makes me think as a teacher of threat modeling, Something

Kim Wuyts — Privacy Threat Modeling Mar 23, 2020

A system can protect data from attackers and still violate the privacy of the people using it. Kim Wuyts, a privacy researcher and contributor to LINDDUN, explains why privacy deserves its own threat modeling questions. She distinguishes security goals from harms to individuals, then walks through the framework’s approach to finding privacy risks in software designs. The conversation explores how linking ordinary pieces of information can identify a person, why non-repudiation can be undesirable in a privacy context, and what disclosure, awareness, and compliance mean for a design. Kim also discusses the relationship with privacy by design and offers a practical starting point for teams that already use diagrams and security threat modeling.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Kim Wuyts:
→ Kim Wuyts on LinkedIn

Mentioned in this episode:
→ LINDDUN privacy threat modeling
→ LINDDUN research and publications

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Privacy threat modeling with Kim Wuyts
01:44 Kim’s research background and LINDDUN
04:08 How privacy differs from security
05:55 Modeling harm to the data subject
08:50 Using diagrams and the LINDDUN framework
10:50 Linkability and identifying people from data
14:32 Lessons from the AOL search-data release
15:43 Non-repudiation as a privacy threat
16:44 Detectability and privacy
17:52 Information disclosure and the remaining categories
20:14 The connection to privacy by design
21:06 Getting started with LINDDUN
23:46 Future directions for privacy threat modeling
25:57 Kim’s closing advice

John Martin — Preventing a Cyberpocalypse Mar 14, 2020

What happens when society’s dependence on software grows faster than its ability to make that software safe? John Martin, a commercial software security practitioner and SAFECode contributor, calls that widening gap a possible cyberpocalypse. He explains the combined pressures of vulnerable legacy code, expanding connectivity, and increasingly capable attackers. The hosts challenge his proposed responses, exploring software liability, standards, quality measurements, and the risk of constraining innovation. The discussion compares software assurance with product safety and building inspections, while questioning whether following a development process is enough evidence of a safe outcome. This is an exploratory debate about responsibility and incentives, with John urging the industry to confront systemic software risk before its consequences become harder to contain.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with John Martin:
→ John Martin on LinkedIn

Mentioned in this episode:
→ SAFECode
→ Cloud Security Alliance

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Preventing a cyberpocalypse with John Martin
01:45 John’s security origin story
04:26 Connecting breaking and building software
09:27 What John means by cyberpocalypse
12:28 Sudden catastrophe or accumulating harm
16:15 Technical debt and deferred responsibility
17:38 Ways to improve software outcomes
19:54 Measuring software quality
21:27 Liability and defining safe software
25:39 Could safety requirements constrain innovation?
27:51 The difficulty of a meaningful safety standard
31:29 Measuring process versus results
36:43 Software assurance and independent inspection
38:21 Where the industry conversation is happening

Jeremy Long — It’s dependency check, not checker Feb 20, 2020

How do you discover vulnerable libraries when the names developers use do not match the names in vulnerability databases? Jeremy Long, founder of OWASP Dependency-Check, explains the evidence-gathering and matching behind software composition analysis. He tells the project’s origin story, discusses accuracy and false positives, and describes how Dependency-Check fits alongside other dependency tools. The conversation explores delayed upgrades, automated update services, supply-chain integrity, and the limits of treating all vulnerabilities alike. Jeremy also explains how teams can begin with a local scan and move checks into their build pipelines. Along the way, he offers a maintainer’s perspective on a widely adopted open-source project and keeps one naming detail clear: it is Dependency-Check, not Dependency-Checker.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Jeremy Long:
→ Jeremy Long on GitHub

Mentioned in this episode:
→ OWASP Dependency-Check
→ OWASP Dependency-Track
→ National Vulnerability Database
→ Jenkins

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Dependency-Check with Jeremy Long
02:41 Jeremy’s path into security
06:38 The project’s origin story
09:43 How Dependency-Check identifies components
14:14 Turning component evidence into vulnerability findings
16:31 Accuracy and the limits of matching
19:49 Maintaining a widely used open-source project
21:25 Why available patches still go unapplied
26:28 Automated upgrades and the future of SCA
28:35 Build integrity and supply-chain security
31:17 Adoption and project reach
33:08 Local scans and build-pipeline integration
38:54 Dependency-Check, not Dependency-Checker
40:00 Jeremy’s final advice

Alyssa Miller — Experiences with DevOps + Automation and beyond Feb 13, 2020

Automating security tests is useful, but it does not by itself make a development team secure. Alyssa Miller, a former developer and application security practitioner, explains how DevOps changes the way security work should happen. She begins with her path into hacking and a striking penetration-test story in which a web application exposed domain-level privileges. The discussion then moves toward prevention: threat modeling during user-story development, reusable reference architectures, and feedback that helps engineers make better decisions early. Alyssa shares lessons about organizational change, realistic starting points, and the limits of adopting tools without changing habits. She also offers career advice for newcomers, emphasizing curiosity, clear interests, and the many paths that can lead into security.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Alyssa Miller:
→ Alyssa Miller’s website

Mentioned in this episode:
→ Threat Modeling: Designing for Security — first edition
→ Jenkins
→ BSides Las Vegas

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 DevOps, automation, and Alyssa Miller
02:30 Alyssa’s path from development into security
07:06 What makes application security compelling
08:19 Reaching domain admin through a web application
12:39 Defining DevOps through practical experience
15:21 Where security fits in DevOps
16:43 Threat modeling early in development
22:41 Asking security questions within user stories
25:46 Moving beyond automated scanning
30:35 Reference architectures that help developers
31:06 Organizational challenges in adopting DevOps
33:41 Choosing a realistic starting point
36:55 Career advice and finding your interests
41:27 The Blue Team Con community

Vandana Verma — Support each other Feb 07, 2020

Building a stronger security community means helping more kinds of people participate and succeed. Vandana Verma returns to discuss her early work on the OWASP board, her ideas for improving outreach, and the broader meaning of diversity in application security. Chris asks about neurodiversity, inclusion, hiring standards, and how managers can find capable candidates beyond familiar networks. Vandana explains why support and training matter alongside opportunity, and why a skills shortage cannot be solved simply by moving experienced people between companies. She also shares the story of InfoSecGirls and discusses Women in AppSec. Her message is practical and personal: actively welcome people, help them develop their strengths, and support each other as the community grows.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Vandana Verma:
→ Vandana Verma’s website
→ Vandana Verma on LinkedIn

Mentioned in this episode:
→ InfoSecGirls
→ OWASP Foundation

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Supporting the application security community
02:58 Vandana’s early experience on the OWASP board
04:25 Priorities for community outreach
07:01 Understanding the many forms of diversity
08:07 Neurodiversity and inclusion
09:11 Making diversity a shared effort
11:48 Hiring standards and developing potential
13:24 How diverse teams strengthen security
17:34 Advice for hiring managers
19:39 Reaching people beyond familiar networks
21:46 The story and growth of InfoSecGirls
24:41 Women in AppSec
27:14 Support each other

DJ Schleen — DevOps: The Sec is Silent Jan 30, 2020

What changes when security becomes part of delivering software instead of a separate gate? DJ Schleen joins Chris and Robert to explain why he prefers DevOps with a silent Sec, drawing on his journey from early programming and hacking to building delivery pipelines. They discuss the difference between genuine transformation and automating an existing process, why governance and compliance belong in the conversation, and how teams can grow their capabilities without adopting every tool at once. DJ walks through his DevSecOps reference architecture as an assembly line from idea to customer value. The conversation closes with learning Kubernetes through K3s, the tradeoffs of managed platforms, and the security thinking that matters more than a particular product.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with DJ Schleen:
→ LinkedIn
→ GitHub

Mentioned in this episode:
→ DevSecOps reference architecture
→ K3s
→ DevOpsDays
→ The Unicorn Project

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introduction
02:12 DJ's programming and hacking roots
06:33 What DevOps is trying to accomplish
09:44 Adoption beyond automating the old process
12:20 Will DevOps become ordinary software delivery?
15:15 Bringing compliance and governance along
18:17 Observers, stakeholders, and participants
19:48 Growing the team with the work
20:34 Why the Sec is silent
24:43 The DevSecOps reference architecture
28:54 Starting small and adding capabilities
31:23 Learning Kubernetes with K3s
33:49 Managed platforms and security tradeoffs
35:53 Closing thoughts

Niels Tanis — 3rd Party Risk in a .NET World Jan 24, 2020

How much behavior do you inherit when you add one library to a .NET application? Niels Tanis joins Chris and Robert to examine third-party risk beyond checking a dependency for known vulnerabilities. They revisit the event-stream compromise and Operation ShadowHammer, then look at NuGet packages, transitive dependencies, and functionality developers may never intend to use. A PDF library becomes a concrete example of why network access and other capabilities deserve scrutiny. Niels explores isolation, assembly loading, and constraining library behavior rather than trusting every dependency with the application's full privileges. He also describes using Mono.Cecil and his Fennec tooling to inspect calls, helping developers ask better questions about what their dependencies can actually do.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Niels Tanis:
→ LinkedIn
→ Niels's blog

Mentioned in this episode:
→ NuGet
→ iTextSharp
→ Operation ShadowHammer
→ Mono.Cecil
→ Fennec.CLI

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introduction
03:03 What third-party risk really includes
06:25 Compromised dependencies and event-stream
11:08 Operation ShadowHammer and trusted updates
14:04 Dependency risk in the .NET ecosystem
17:03 Hidden capabilities inside familiar libraries
21:51 Isolation and least privilege
23:48 Constraining libraries with assembly loading
28:42 Controlling behavior and micropatches
30:21 Inspecting calls with Mono.Cecil and Fennec
34:14 Making dependency reviews useful to developers

Maya Kaczorowski — Container and Orchestration Security Jan 16, 2020

Containers can improve your security story, but not simply because they are called containers. Maya Kaczorowski, working on container security at Google at the time of this conversation, joins Chris and Robert to separate packaging and orchestration benefits from the isolation guarantees people often assume. She explains how smaller services, consistent environments, and faster updates can help, then considers what an attacker wants from a compromised workload or cluster. The discussion covers image provenance, malicious images, permissions, and alternatives that strengthen isolation, including gVisor and Kata Containers. Maya also describes a practical progression for teams adopting Kubernetes: learn the environment, understand the risks, and build security into deployment decisions rather than treating the first working cluster as a finished system.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Maya Kaczorowski:
→ LinkedIn
→ Maya's website

Mentioned in this episode:
→ Kubernetes
→ gVisor
→ Kata Containers
→ Kubernetes admission controllers
→ Exploring container security

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introduction
01:29 From mathematics to security product work
03:42 Moving into container security
06:58 Containers and orchestration explained
09:12 Docker, runtimes, and orchestration choices
10:33 How containers can improve security
14:18 Stronger isolation with sandboxed runtimes
15:33 Threat modeling an attacker in a container
18:03 Where your images come from
20:03 Typosquatting and malicious images
21:50 Defending workloads and clusters
26:26 The container security learning journey
31:15 Resources for learning more

Geoff Hill — AppSec, DevSecOps, and Diplomacy Jan 09, 2020

Why can a technically sound DevSecOps initiative fail before it changes how anyone works? Geoff Hill joins Chris and Robert to discuss the diplomacy behind application security transformation. He describes security as an activity throughout delivery, not a product bolted onto a pipeline, and shares lessons from tool integration and organizational resistance. The conversation moves from security champions to the managers who control their time, showing why persuasion, listening, and political capital matter. Geoff explores the fears underneath resistance, including job security and breaking working systems, and the danger of moving faster than an organization can absorb. He closes with practical starting points: understand the existing workflow, establish repeatable development and deployment practices, and introduce security through achievable improvements.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Geoff Hill:
→ LinkedIn

Mentioned in this episode:
→ Veracode
→ Ansible
→ Splunk

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introduction
02:00 Defining DevSecOps across the lifecycle
04:57 Making security native to delivery
07:19 Lessons from failed integrations
12:17 Security champions and management support
16:34 Diplomacy, persuasion, and political capital
18:54 Listening before proposing change
20:16 Transformation in nonagile organizations
25:44 The fears behind resistance
29:46 Removing barriers through practical experiments
32:59 First steps toward a working pipeline

Erez Yalon — The OWASP API Security Project Jan 03, 2020

Why did APIs need a security Top 10 of their own? Erez Yalon joins Chris and Robert to explain the gaps that led to the OWASP API Security project and walk through its original 2019 list. He contrasts traditional web applications with APIs serving many kinds of clients, where authorization decisions and exposed data can become especially difficult to control. The conversation distinguishes broken object-level authorization from broken function-level authorization, then examines excessive data exposure, mass assignment, resource limits, and forgotten API versions. Erez also discusses the project's plans for practical learning materials and ways the community can contribute. This is a guided introduction to the original API Security Top 10, with concrete explanations of the design assumptions behind common failures.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Erez Yalon:
→ LinkedIn
→ OWASP API Security project

Mentioned in this episode:
→ OWASP API Security Top 10 — 2019
→ OWASP API Security repository
→ OWASP crAPI

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introduction
01:35 What an API is
05:50 Why API security differs from web security
09:25 Rapid change and the API attack surface
11:43 Why OWASP started the API Security project
14:52 Broken object-level authorization
17:22 Broken authentication
19:03 Excessive data exposure
20:42 Resource and rate limits
21:21 Broken function-level authorization
23:16 Mass assignment
24:55 Injection
26:34 Improper assets management
27:59 Logging and monitoring
30:05 Learning resources and the project roadmap
33:30 Contributing to API security

Steve Lipner — The Past, Present, and Future of SDL Dec 19, 2019

How did Microsoft's Security Development Lifecycle become a repeatable engineering practice rather than a one-time security push? Steve Lipner joins Chris and Robert to trace that history from early computer security work through security response, Trustworthy Computing, and the formalization of SDL. He explains why reviewing software at the end cannot scale, how threat modeling and testing became development activities, and what organizations learned as tooling and expectations evolved. The discussion connects that history to teams starting their own programs: establish a way to receive and respond to security reports, use the protections already available in development tools, and build from there. Steve closes with guidance for mature programs that need to keep learning instead of treating yesterday's process as finished.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Steve Lipner:
→ Steve's website
→ SAFECode

Mentioned in this episode:
→ Microsoft Security Development Lifecycle
→ Microsoft Security Response Center

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introduction
02:36 Early computer security at MITRE
04:32 A career spanning security products and practice
06:28 Joining Microsoft security response
08:40 Trustworthy Computing and the security push
14:29 Defining and sharing SDL
16:46 Why end-of-cycle audits do not scale
18:32 Formalizing the lifecycle in 2004
21:12 Threat modeling, tools, and security testing
25:12 How secure development keeps evolving
28:35 Advice for starting a security program
32:12 What mature programs should remember

David Kosorok — The Three Pillars of an AppSec Program: Prevent, Detect, and React Dec 15, 2019

Where should a small application security team begin when it cannot do everything? David Kosorok joins Chris and Robert with a practical framework: prevent, detect, and react. Drawing on his background in software testing, he maps the pillars to requirements and design, coding and testing, and deployment and feedback. These are parallel areas to develop, not three stages to finish in order. David explains how relationships with security champions make prevention possible, how testing expertise strengthens detection, and why external findings can make risk tangible for developers. The conversation also explores bug bounties, feedback loops, and meaningful recognition. His emphasis is on building a supportive security culture through partnerships and small, useful controls rather than overwhelming teams with a complete program at once.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with David Kosorok:
→ LinkedIn

Mentioned in this episode:
→ OWASP Triangle
→ SSL Labs Server Test
→ Hacker101
→ HackerOne
→ Bugcrowd

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introduction
02:33 From software testing to application security
03:56 What testers bring to security
07:07 Quality and security share a purpose
08:39 Prevent, detect, and react
09:56 Prevention through requirements and design
12:46 Partnerships and security champions
16:24 Detection during coding and testing
18:59 Working with quality engineers
20:36 Reacting to risk in deployed applications
23:49 Making external findings useful feedback
28:42 Recognition that encourages participation

Chris and Robert: A Taste of Hi-5 Dec 01, 2019

What happens when Chris and Robert trade a single interview topic for five current application security ideas? This experimental Hi-5 episode reviews articles about secure design, developer mentoring, OWASP Proactive Controls, web security practices, and layered testing. The hosts connect each article to work they have seen inside development and security teams, challenging simplistic advice and asking what makes a recommendation usable. They discuss deliberate mentoring, broader language for software security, automation, early design choices, multiple testing techniques, penetration testing, and the operational readiness required before launching a bug bounty. The format is lighter and faster than a standard interview, but the goal remains practical: identify ideas worth carrying into a real secure development program.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Chris Romeo and Robert Hurlbut:
→ Chris Romeo on LinkedIn
→ Robert Hurlbut on LinkedIn

Mentioned in this episode:
→ Interest In Secure Design Practices Is Increasing Leading To Two Predictions
→ Developers mentoring other developers: practices I've seen work well
→ 7 Web Application Security Best Practices
→ OWASP Proactive Controls

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introducing the Hi-5 format
02:01 Secure design predictions
05:23 Security and software development working together
07:05 Deliberate developer mentoring
10:04 Plans, follow-up, and mentoring habits
11:20 OWASP Proactive Controls
13:13 Who participates in secure development
14:38 Naming the broader discipline
15:55 Automating repeatable security work
17:10 Starting security practices early
18:36 Layering tools and testing methods
22:05 The role of penetration testing
25:36 Readiness before bug bounty programs

Bill Dougherty — INCLUDES NO DIRT, practical threat modeling for healthcare and beyond Nov 21, 2019

What happens when a threat model has to account for patient privacy and clinical harm as well as attackers? Bill Dougherty joins Chris and Robert to explain INCLUDES NO DIRT, the model he developed with Patrick Curry at Omada Health. They discuss why conventional security categories did not fully capture digital healthcare's competing security, privacy, and compliance needs, and how combining ideas from existing frameworks produced a memorable checklist. Bill walks through the practical workflow, from understanding a system and drawing data flows to asking targeted questions and prioritizing deeper review. The conversation also covers training product teams to use the model themselves, avoiding checkbox risk assessments, and adapting the published questionnaires to the risks an organization actually needs to understand.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Bill Dougherty:
→ LinkedIn
→ INCLUDES NO DIRT at Omada Health

Mentioned in this episode:
→ LINDDUN privacy threat modeling
→ Microsoft threat modeling

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introduction
02:17 Bill's path into security leadership
04:21 Security responsibilities at Omada Health
06:38 Why digital healthcare needed another threat model
10:20 The INCLUDES NO DIRT acronym
11:09 Security, privacy, and clinical threat categories
12:33 What makes healthcare different
14:07 Turning the categories into a practical process
18:21 Diagrams and understanding the system
21:08 Applying the checklist to data flows
23:35 Helping product teams become self-sufficient
25:11 Requirements and compliance considerations
27:00 Getting started with the questionnaires
30:07 Closing thoughts

Marc French — The AppSec CISO Nov 10, 2019

Is becoming a CISO the next technical promotion, or a fundamentally different job? Marc French joins Chris and Robert to discuss the role through the eyes of an application security leader. Drawing on experience running both product and security functions, he explains how delivery commitments change the way risk decisions look. The conversation examines the CISO's communication-heavy day, reporting relationships, alternative career paths, and the growing importance of application and product security as infrastructure becomes code. Marc offers practical advice for people pursuing leadership: understand the business, gain experience outside a narrow security role, and find mentors who will challenge your assumptions. He also discusses programming skills, developing future AppSec talent, and why a title alone is not a useful career plan.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Marc French:
→ LinkedIn

Mentioned in this episode:
→ Boston Application Security Conference

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introduction
02:09 How Marc's AppSec CISO perspective developed
05:30 Running application security inside product management
08:59 Balancing vulnerabilities and business commitments
10:37 Learning outside a security role
12:36 What a CISO actually does
14:24 Reporting relationships and the org chart
16:15 The limits of a purely technical career plan
18:26 Leadership paths beyond the CISO title
21:03 Breaches and leadership expectations
22:16 Where application security fits
25:02 Advice for aspiring CISOs
29:51 The rise of product security leadership
32:20 Advice for students entering security
35:32 Why programming skills matter
41:21 Finding a mentor

Season 5 Finale — A cross section of #AppSec Oct 26, 2019

Season 5 covered application security from tools and threat models to mentoring, self-care, coaching, dependency risk, and program design. Chris and Robert revisit the guests whose explanations best captured that range. Simon Bennetts introduces the ZAP Heads Up Display, Izar Tarandach explains pytm, Tanya Janca and Nancy Gariché discuss mentoring, Björn Kimminich presents Juice Shop, Caroline Wong addresses self-care, Adam Shostack examines the human layer of threat modeling, Matt McGrath defines security coaching, Steve Springett explains Dependency-Track, and Ronnie Flathers describes building sustainable programs. Organized as guest-level chapters, the finale works as a guide to the season and a reminder that effective AppSec combines technical capability with community, learning, and organizational change.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Chris Romeo and Robert Hurlbut:
→ Chris Romeo on LinkedIn
→ Robert Hurlbut on LinkedIn

Mentioned in this episode:
→ OWASP ZAP
→ ZAP Heads Up Display (HUD)
→ pytm
→ OWASP Juice Shop
→ Dependency-Track
→ Sonatype OSS Index
→ SPDX
→ #CyberMentoringMonday
→ OWASP Juice Shop

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Season 5 highlights
02:46 Simon Bennetts on the ZAP HUD
04:50 Izar Tarandach on pytm
07:32 Tanya Janca and Nancy Gariché on mentoring
11:29 Björn Kimminich on OWASP Juice Shop
15:43 Caroline Wong on self-care in security
18:00 Adam Shostack on threat modeling’s human layer
20:54 Matt McGrath on security coaching
24:06 Steve Springett on Dependency-Track
28:22 Brook Schoenfield on security architecture
31:12 Ronnie Flathers on building AppSec programs
35:28 Closing Season 5

Ronnie Flathers — Security programs big and small Sep 27, 2019

Which parts of an AppSec program should change as a company grows, and which should stay the same? Ronnie Flathers joins Chris and Robert to compare security work in a fast-moving smaller company with the challenges of a large enterprise. He explains the advantages of a consistent technology stack and close developer relationships, then explores what breaks when one team can no longer know every application or manager. The discussion covers developing security champions, meeting teams where they work, and making incremental improvements instead of chasing an overnight transformation. Ronnie grounds the comparison in four principles: visibility and transparency, enabling rather than hindering, iterative progress, and management through metrics. The starting point is understanding what exists before deciding how to secure it.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Ronnie Flathers:
→ LinkedIn
→ Ronnie's blog

Mentioned in this episode:
→ Darknet Diaries
→ OWASP Juice Shop
→ Agile Manifesto

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introduction
01:59 Xbox hacking and Ronnie's security beginnings
04:50 Consulting and early mentorship
08:44 Security catching up with software delivery
11:54 Growing security skills in developers
13:11 Champions who want to participate
16:52 Embedding security with engineering teams
18:37 Advantages of a smaller company's technology stack
22:52 Why large-company security cannot do everything
24:25 Working with development processes
25:47 First priorities in a smaller company
29:04 Making progress with resistant teams
30:55 Enterprise visibility and management through metrics
33:24 Four foundations of an AppSec program

Brook Schoenfield — Security is a messy problem Sep 15, 2019

Why doesn't an executive mandate and a scanning tool add up to a software security program? Brook Schoenfield joins Chris and Robert to unpack security as a human, technical, and organizational problem that crosses the whole development lifecycle. He describes the limits of policy and testing, then explains how noisy tools lose developer trust. His practical alternative is to begin with high-confidence checks developers can use themselves, supported by deeper specialist testing rather than an impossible promise to find everything. The conversation turns to culture hacking: sharing responsibility, helping teams work through the consequences of their own incidents, and using threat modeling to make security tangible. Brook closes by connecting those habits to iterative improvement and the security of the delivery pipeline itself.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Brook S.E. Schoenfield:
→ LinkedIn
→ Brook's website

Mentioned in this episode:
→ Securing Systems: Applied Security Architecture and Threat Models
→ IOActive

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introduction
05:03 Why a mandate is not a security program
08:32 The appeal and limits of simple answers
09:50 Security crosses every domain
11:41 Getting engineers to want security
16:59 Why security tools lose developer trust
24:10 Layering developer checks and specialist testing
25:55 Putting useful tools in developers' hands
29:15 Fast feedback while writing code
33:00 The program-building lessons so far
34:43 Culture hacking and shared responsibility
40:25 Continuous improvement and delivery-chain security
43:33 What's next in Brook's writing

Liran Tal — The state of open source software security Sep 05, 2019

Developers may want to own security, but what helps them turn that intention into safer software? Liran Tal joins Chris and Robert to examine Snyk's 2019 State of Open Source Security research. After sharing how running a bulletin board system sparked his curiosity, he explains the report's mix of survey responses, dependency data, and public ecosystem information. They discuss vulnerable libraries in popular container images, why updating a base image can matter, and the hesitation developers feel when dependency changes might break an application. Liran also explores how vulnerabilities can remain unnoticed for years. He closes with three priorities for improvement: make security accessible, treat it as part of product quality, and celebrate developers who find and fix problems.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Liran Tal:
→ LinkedIn
→ GitHub

Mentioned in this episode:
→ 2019 State of Open Source Security — developer ownership findings
→ Docker Hub
→ Node.js
→ Libraries.io

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introduction
01:23 BBS roots and early computing
04:38 Finding a path into application security
06:41 Curiosity and learning by building
11:00 The data behind the open-source report
12:11 Combining survey and ecosystem sources
12:40 Developers want to own security
15:13 Vulnerabilities in popular container images
17:32 Base images, trust, and practical fixes
20:13 Updating dependencies without breaking the application
23:59 Vulnerabilities that remain dormant for years
26:23 The window before discovery
27:52 Three priorities for improving open-source security
31:43 Connecting with Liran

Liran Tal — Open Source Security — 5 Minute AppSec Sep 03, 2019

Why should developers care about open source security when they already have features, testing, accessibility, and performance to manage? Liran Tal answers by framing security as part of the responsibility that comes with shipping software. Applications depend on libraries, protocols, and components that can age into exploitable weaknesses, so ownership extends beyond the code a team writes directly. Liran compares secure delivery to checking the doors and windows before leaving home: teams should consciously examine what they are putting into the world. This short episode argues that open source risk belongs inside the normal development workflow, even when its return on investment is difficult to quantify before an incident occurs.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Liran Tal:
→ Liran Tal on LinkedIn
→ Liran Tal’s website

Mentioned in this episode:
→ Node.js Security Working Group

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Why developers should care about open source security
00:10 Security as developer responsibility
01:13 Vulnerable dependencies and outdated cryptography
02:26 Continue with the full interview

Steve Springett — An insiders checklist for Software Composition Analysis Aug 27, 2019

An SCA tool can find vulnerable libraries and still leave important software supply-chain questions unanswered. Steve Springett, creator of Dependency-Track and CycloneDX, shares the detailed criteria he used to evaluate commercial and open-source tools. He starts with accurate component inventories, then examines package management, licenses, maintenance status, provenance, policy enforcement, and integration with real development environments. Steve cautions against treating an unconfirmed exploit path as proof that a dependency is safe and explains why project health belongs in risk decisions. The conversation also introduces software bills of materials and compares binary, manifest, and SBOM analysis. This archive discussion provides a concrete way to define requirements and test competing tools against the software an organization actually builds.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Steve Springett:
→ Steve Springett on GitHub

Mentioned in this episode:
→ OWASP Dependency-Track
→ CycloneDX
→ SPDX

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 An insider’s SCA checklist with Steve Springett
03:02 Understanding software supply-chain risk
06:16 What software composition analysis should provide
08:13 Risk intelligence beyond known vulnerabilities
09:33 Evaluating the SCA market at the time
13:57 Defining requirements for a tool comparison
14:50 Start with an accurate component inventory
15:41 Ecosystems, package management, provenance, and SBOM support
24:07 Testing tools against your organization’s needs
28:43 Policy enforcement and exploitability caveats
30:29 Onboarding, integration, and component age
33:08 Project health and limiting dependency sprawl
34:49 Reviewing the complete evaluation checklist
38:27 Software bills of materials explained
43:22 Using SBOMs to improve inventory accuracy
45:24 Combining binary, manifest, and SBOM analysis
47:45 Dependency-Track project update

Steve Springett — OWASP Dependency Track — 5 Minute AppSec Aug 25, 2019

What does OWASP Dependency-Track add beyond a conventional software composition analysis scanner? Steve Springett explains how the project continuously analyzes software bills of materials across an enterprise, correlates components with multiple vulnerability-intelligence sources, and helps teams identify affected assets when a new issue emerges. Its API-first design allows CI/CD pipelines to submit inventories automatically and lets downstream systems react through REST APIs and webhooks. Steve also covers outdated-component detection, package ecosystems, and license analysis through SPDX. This concise introduction presents Dependency-Track as a software supply-chain component analysis platform built to turn a constantly changing inventory into actionable risk information rather than a one-time list of dependencies.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Steve Springett:
→ Steve Springett on LinkedIn
→ OWASP Dependency-Track

Mentioned in this episode:
→ OWASP Dependency-Track
→ National Vulnerability Database
→ Sonatype OSS Index
→ SPDX
→ Heartbleed

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 What is OWASP Dependency-Track?
00:16 Analyzing components and SBOMs at enterprise scale
02:16 Vulnerability intelligence and outdated components
03:25 APIs, webhooks, and actionable intelligence
04:12 Continue with the full SCA interview

Elissa Shevinsky — Static Analysis early and often Aug 18, 2019

Security testing is more likely to happen when it fits the way developers already work. Elissa Shevinsky, then CEO of Faster Than Light, joins Chris and Robert to discuss static analysis, startup lessons, and making security easier to adopt. She explains how her entrepreneurial path led into security and how mentors helped her navigate unfamiliar problems. The conversation then turns to what static analysis can tell developers, when to run it, and why slow or confusing feedback limits its usefulness. Elissa connects security findings with code quality and describes the challenge of communicating their value to people outside security. Her practical theme is to test early and often while reducing the effort required to make testing routine.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Elissa Shevinsky:
→ Elissa Shevinsky on LinkedIn

Mentioned in this episode:
→ Faster Than Light — historical project repositories
→ FindBugs — historical Java analyzer
→ Techstars London

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Static analysis early and often with Elissa Shevinsky
02:01 Elissa’s path into software and security
06:26 Lessons from security startups
07:51 The value of mentoring
09:15 Paying mentoring forward
12:52 The Techstars London experience
14:15 What static analysis does
16:35 Making findings useful to developers
17:45 When to run static analysis
19:16 Testing in frequent deployment cycles
22:23 Making security fit everyday work
25:06 Security and code quality
25:42 Practical testing habits
26:41 Closing advice

Elissa Shevinsky — Be Kind, Security People — 5 Minute AppSec Aug 14, 2019

Why should kindness matter in an industry responsible for protecting money, systems, and sometimes lives? Elissa Shevinsky argues that high stakes do not justify gatekeeping, arrogance, or treating newcomers badly. Drawing on the community conversation around her SecretCon event and Rob Graham’s “InfoSec is Good People” post, she acknowledges why security practitioners value competence while rejecting meanness as a professional virtue. The field has more work than people available to do it, making a welcoming culture a practical necessity as well as an ethical one. Her message in this short episode is direct: hackers and defenders share one community, and that community becomes stronger when its members choose to be kind.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Elissa Shevinsky:
→ Elissa Shevinsky on LinkedIn

Mentioned in this episode:
→ InfoSec is Good People

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Why kindness matters in information security
00:20 Rejecting gatekeeping as a security virtue
02:07 Continue with the full interview

Matt McGrath — Security coaches Aug 05, 2019

Security programs improve when developers have someone who can help them want to get better, not merely tell them what they did wrong. Matt McGrath joins Chris and Robert to explain the security coach role and how it differs from both a wellness coach and a security champion. He describes the communication skills, technical credibility, and developer empathy that make coaching effective, then examines how coaching fits alongside training and other program controls. The discussion covers meeting cadence, part-time versus dedicated roles, measuring progress, and launching with a small group. Matt’s core advice is to partner with engineering teams and build their capability until they need less direct help from security.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Matt McGrath:
→ Security Coaches episode page

Mentioned in this episode:
→ OWASP Security Champions Guide

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introducing security coaching
02:20 Matt McGrath’s developer-to-security journey
07:09 What a security coach actually does
10:33 Helping developers choose to improve
13:54 The security coach job description
17:31 Communication, credibility, and technical skills
20:42 How coaching feels from the developer side
24:33 Working toward developer independence
28:24 Part-time and dedicated coaching roles
31:47 Choosing a useful coaching cadence
33:59 Security coaches versus security champions
38:31 How to launch a coaching program
41:49 Partner with engineering teams

Erez Yalon and Liora Herman – The Application Security Village @ DefCon Jul 29, 2019

What would an application security conference look like inside DEF CON? Erez Yalon and Liora Herman explain how a volunteer idea became the Application Security Village, a dedicated space for talks, workshops, demonstrations, and community at one of security’s largest gatherings. They describe the gap they saw between traditional DEF CON villages and the needs of AppSec practitioners, then discuss winning support, recruiting volunteers, and designing content for both newcomers and experienced professionals. The conversation covers workshops, project showcases, and the practical challenges of building an inclusive event from scratch. Erez and Liora close by inviting listeners to participate, contribute, and use the village as a place to learn directly from the people creating application security tools and practices.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Erez Yalon and Liora Herman:
→ Erez Yalon on LinkedIn
→ Liora Herman on LinkedIn
→ Application Security Village

Mentioned in this episode:
→ Application Security Village
→ DEF CON
→ OWASP Foundation

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Creating an Application Security Village
02:16 How Erez and Liora joined forces
05:51 Building a volunteer-driven event
08:42 Villages as conferences within DEF CON
10:48 Getting support from DEF CON
13:27 Designing content for the AppSec community
16:03 Workshops and hands-on topics
18:42 Where to find updates and participate
21:49 A village for newcomers and experts

Erez Yalon – AppSec Village – 5 Minute AppSec Jul 29, 2019

Why did DEF CON have villages for specialized security communities but no home dedicated to application security? Erez Yalon explains how that recurring question became AppSec Village. After several years of waiting for someone else to create it, he decided to act and invited Liora Herman, whose strength with operational details complemented his idea, to join the volunteer effort. Their partnership turned a missing conference space into a focused community for application security practitioners, researchers, and builders. This brief origin story captures a useful lesson about security communities: when an important forum does not exist, committed volunteers can stop asking why and build the place they want to attend.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Erez Yalon:
→ Erez Yalon on LinkedIn
→ AppSec Village

Mentioned in this episode:
→ AppSec Village
→ DEF CON
→ Black Hat

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Why create an AppSec Village?
00:20 The missing village at DEF CON
00:41 Turning the idea into a volunteer project
01:17 Continue with the full AppSec Village interview

Tommy Ross — The BSA Framework for Secure Software Jul 19, 2019

Software producers, customers, and policymakers need a common way to discuss security without pretending that one checklist fits every product. Tommy Ross, a policy leader at BSA and a drafter of its Framework for Secure Software, explains how the framework was created and who it is meant to help. He describes its outcome-focused structure, the relationship between functions and more specific categories, and the role of existing industry practices. The conversation uses software supply-chain requirements to show how a high-level goal can become a useful discussion about evidence and risk. Tommy also explores procurement questions, policy needs, and the process for collecting feedback. The result is an introduction to a shared vocabulary for evaluating software security.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Tommy Ross:
→ Tommy Ross at RSA Conference

Mentioned in this episode:
→ BSA Framework for Secure Software — PDF
→ Framework repository
→ SAFECode

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 The BSA Framework for Secure Software
01:24 Tommy’s path into security policy
04:17 What BSA does
06:09 Introducing the software security framework
10:27 Producers, buyers, and policymakers as audiences
14:24 A common vocabulary for customer requirements
20:10 How the framework was developed
24:05 Functions, categories, and outcomes
27:21 A software supply-chain example
28:17 Applying a requirement in practice
29:20 Questions policymakers can ask
32:51 Finding the document and contributing feedback

Adam Shostack — Threat modeling layer 8 and conflict modeling Jul 10, 2019

What if a system works exactly as designed but gives people new ways to harm one another? Adam Shostack explores threat modeling at layer eight: the human interactions that technical security reviews can overlook. He begins by defining success as better decisions and designs, then applies the familiar four threat modeling questions to social features and abuse. The conversation uses photo sharing, real-name policies, and content rules to show why context matters and why no single technical control settles every conflict. Adam introduces his conflict modeling project as a way to collect useful knowledge about those tradeoffs. He also asks who should participate, encouraging teams to bring broader expertise into decisions that affect people using their systems.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Adam Shostack:
→ Shostack + Associates

Mentioned in this episode:
→ Conflict Modeling project
→ Attack Trees by Bruce Schneier

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Threat modeling human conflict with Adam Shostack
02:35 Recent threat modeling work
04:32 What successful threat modeling looks like
07:26 What threat modeling layer eight means
11:38 Applying the four questions beyond technology
14:24 Social features, real names, and abuse
18:51 Building shared knowledge about conflict
21:01 Modeling threats to a photo-sharing feature
23:36 Who should make decisions about human harm?
27:44 Getting started with conflict modeling
29:41 The project’s intended resources and outcomes
31:42 Context-sensitive content rules
33:38 Closing thoughts and ways to contribute

Adam Shostack – Threat Modeling – 5 Minute AppSec Jul 09, 2019

Why threat model when AppSec teams already have scanners, checklists, and testing? Adam Shostack argues that threat modeling is what makes those activities structured, systematic, and comprehensive instead of a collection of guesses. In this rapid 5 Minute AppSec, he explains how asking what you are building and what can go wrong focuses attention on the right parts of a system. Approaches such as STRIDE, attack trees, and kill chains help teams examine each element methodically, then use the results to guide the rest of the security program. Skip that step, Adam warns, and you are shooting in the dark. Stay through the end for a candid recording outtake.

Connect with Adam Shostack:
→ Adam Shostack on LinkedIn
→ Shostack + Associates

Mentioned in this episode:
→ Adam Shostack
→ Attack Trees (Schneier)
→ Cyber Kill Chain (Lockheed Martin)

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Why threat model?
00:10 Structured, systematic, and comprehensive security
01:07 The promised full interview
01:33 A candid recording outtake

Zoe Braiterman — AI, ML, AppSec, and a dose of data protection Jul 01, 2019

Artificial intelligence can help analyze security data, but the systems using it also need protection themselves. Zoe Braiterman brings a background in data science, organizational thinking, and OWASP community work to an early conversation about that two-way relationship. Chris and Robert ask how artificial intelligence and machine learning differ, where automation is already appearing, and what pattern recognition might contribute to application security. The discussion moves from familiar examples such as fraud detection toward the data, models, and processes behind automated decisions. Zoe emphasizes the human role in understanding those systems and protecting the information they use. This archive episode captures exploratory thinking about AI and AppSec while encouraging practitioners to keep asking questions and learning together.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Zoe Braiterman:
→ Zoe Braiterman on LinkedIn

Mentioned in this episode:
→ OWASP Women in AppSec — project repository

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 AI, machine learning, and AppSec with Zoe Braiterman
02:03 Zoe’s path through data science into security
03:31 Community work with OWASP Women in AppSec
04:30 Distinguishing AI and machine learning
06:25 What autonomy means for a process
07:19 Examples of AI applications
10:18 Fraud detection and learning from data
14:25 Possible uses of AI in application security
16:19 Smarter tools and penetration testing
18:39 Pattern recognition in security data
21:08 Protecting the data and processes behind AI
23:45 Learning resources and closing advice

Caroline Wong — Self-care and self-aware for security people Jun 13, 2019

A successful security career can still become unsustainable when work crowds out everything else. Caroline Wong shares the experiences that changed how she thinks about self-care, boundaries, and professional growth. She traces her career through security leadership roles, then describes the costs of neglecting her own needs and the difficulty of recognizing a problem while caught in it. Chris and Robert ask about work-life balance, vacation policies, and how a manager’s response shapes the real culture behind a company’s promises. Caroline offers questions candidates can ask prospective teammates and discusses what happens when personal values and organizational priorities diverge. Her advice encourages both individuals and hiring managers to pay attention to people, communicate honestly, and make deliberate changes.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Caroline Wong:
→ Caroline Wong on LinkedIn

Mentioned in this episode:
→ Cobalt
→ Security Metrics: A Beginner’s Guide

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Self-care and self-awareness with Caroline Wong
02:19 Caroline’s path into security leadership
11:28 What self-care means and why it matters
18:29 Rethinking work-life balance
21:13 Vacation policies and real workplace culture
25:03 Questions to ask during interviews
26:13 Learning from prospective teammates
28:12 Other pressures that undermine well-being
31:34 When personal and organizational priorities conflict
32:55 Turning awareness into practical changes
33:27 Advice for hiring managers and individuals

Björn Kimminich — The new JuiceShop, GSOC, and Open Security Summit May 31, 2019

How do you keep an intentionally vulnerable application useful while its underlying frameworks keep fixing bugs? Björn Kimminich returns with an update on OWASP Juice Shop and the work required to maintain realistic security challenges. He describes new exercises involving promotional content, coupons, privacy, and two-factor authentication, then explains what happens when dependency or browser changes accidentally remove a vulnerability. The conversation also covers customization for different audiences, contributions through Google Summer of Code, and the balance between welcoming help and reviewing it carefully. Björn closes with plans for collaborative work at the 2019 Open Security Summit. This archive episode shows both the technical craft and community effort behind a widely used application security learning project.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Björn Kimminich:
→ Björn Kimminich on GitHub

Mentioned in this episode:
→ OWASP Juice Shop
→ Open Security Summit

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 What was new in OWASP Juice Shop
02:25 New features and hacking challenges
05:19 Working two-factor authentication with TOTP
07:21 Keeping the right parts intentionally vulnerable
08:15 When dependency updates remove a challenge
09:43 Privacy features and GDPR-related exercises
11:16 Customizing Juice Shop for different audiences
13:05 Google Summer of Code contributions
16:14 Reviewing contributions and sharing maintenance
17:09 Getting help and giving feedback
19:22 Introducing the 2019 Open Security Summit
21:42 Planned Juice Shop working sessions
24:50 Adapting the summit around participants’ needs
26:30 Where to find Juice Shop resources

Björn Kimminich — JuiceShop — 5 minute AppSec May 26, 2019

What makes OWASP Juice Shop useful to developers when many intentionally vulnerable applications feel dated? Project creator Björn Kimminich explains that he built Juice Shop because older training targets did not represent modern front ends, REST APIs, or the technologies his students used. The project turns web vulnerabilities, business-logic flaws, validation failures, and design problems into hands-on challenges with a scoreboard and gamification. Teams can use it for developer training, awareness demonstrations, capture-the-flag events, security-tool testing, and customized management exercises. This short introduction shows why learning through a realistic application can make the OWASP Top 10 and other security weaknesses more concrete, memorable, and relevant to everyday development work.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Björn Kimminich:
→ Björn Kimminich on LinkedIn
→ OWASP Juice Shop

Mentioned in this episode:
→ OWASP Juice Shop
→ OWASP Top 10
→ Open Security Summit

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 What is OWASP Juice Shop?
00:19 A modern vulnerable application for developers
01:36 Challenges, gamification, and hands-on learning
03:01 Training, CTFs, and management demonstrations
04:20 Continue with the full Juice Shop interview

Nancy Gariché and Tanya Janca — DevSlop, the movement May 21, 2019

How does an intentionally vulnerable application become a community learning movement? Nancy Gariché and Tanya Janca explain the evolution of OWASP DevSlop from a project into a live, collaborative way to teach application security. They describe the DevSlop Show, its deliberately imperfect demonstrations, and the value of learning in public without pretending every experiment will work. The conversation explores Pixi, Paddy the Pipeline, and integrations with free security tools including ZAP, dependency scanning, and web application firewalls. Nancy and Tanya also explain how contributors can start small, join broadcasts, document what they learn, and help expand the project. Their approach treats mistakes as useful teaching material and makes hands-on AppSec education more welcoming to developers and security newcomers.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Nancy Gariché and Tanya Janca:
→ Nancy Gariché and OWASP DevSlop
→ Tanya Janca on LinkedIn

Mentioned in this episode:
→ OWASP DevSlop
→ Pixi
→ OWASP ZAP
→ Burp Suite
→ Mend
→ OWASP ModSecurity Core Rule Set
→ Qualys SSL Labs

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 DevSlop as a movement
02:11 Meet Nancy Gariché and Tanya Janca
05:11 What OWASP DevSlop is
09:03 API security and the project’s scope
11:14 Learning through the DevSlop Show
16:15 Security tools in Paddy the Pipeline
18:47 Dependency scanning with Mend
21:36 Web application firewalls and ModSecurity
23:45 Making mistakes in public
27:47 How new contributors can begin
30:46 Community participation as the real output
32:51 DevSlop’s channels and identity
36:55 Closing thoughts

Tanya Janca — Mentoring Monday — 5 Minute AppSec May 19, 2019

Security needs more experienced practitioners, but people do not become senior without guidance, advocacy, and opportunities to learn. Tanya Janca explains how her own mentors accelerated her career and why she created Mentoring Monday when more people requested help than she could personally support. The weekly hashtag lets prospective mentors and mentees find one another by topic while allowing volunteers to choose relationships they can sustain. Tanya challenges the belief that someone must be an expert before mentoring: even a few years of experience can be valuable to a person just starting out. Her invitation is simple—search the community, offer what you know, and help another practitioner progress faster than they could alone.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Tanya Janca:
→ Tanya Janca on LinkedIn
→ Mentoring Monday

Mentioned in this episode:
→ Mentoring Monday
→ OWASP DevSlop

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Why mentoring matters to security
00:53 How Mentoring Monday began
02:08 Matching mentors and mentees by topic
03:25 You know enough to help someone
04:54 Continue with the full DevSlop interview

Matt Clapham — A perspective on appsec from the world of medical software May 13, 2019

Security teams learn something different when they leave their own conferences and listen to the industries using their products. Matt Clapham, a product security practitioner working with medical software, shares what he observed at the HIMSS healthcare technology conference. He describes the mix of established systems and newer cloud services, the sensitivity of medical information, and the questions vendors should be able to answer about secure development. Chris and Robert explore the gap between compliance claims and practical protection, including why adding security products cannot substitute for sound engineering. Matt also reflects on his path from testing into leadership. His closing challenge is to step outside the security echo chamber and understand how another industry sees risk.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Matt Clapham:
→ Matthew Clapham on LinkedIn

Mentioned in this episode:
→ HIMSS

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 AppSec through the lens of medical software
03:03 Matt’s path from testing to product security
05:34 Balancing leadership and hands-on work
06:43 What HIMSS brings together
08:45 Healthcare technology and security maturity
11:05 Cloud adoption in healthcare
12:16 Compliance and protecting medical information
15:57 What security vendors were offering
17:56 Asking how products are built securely
20:30 Responding to weak security explanations
21:21 Lessons beyond individual security products
25:07 Leaving the security echo chamber

Jon McCoy — Hacker outreach May 06, 2019

How can hackers and corporate security teams work together when each sees the other through a different set of assumptions? Jon McCoy explains hacker outreach as a way to connect people, share knowledge, and make security communities easier to enter. He describes DEF CON for newcomers, discusses its culture, and recalls a cautionary story about Robert’s connected wearable at the event. The conversation follows Jon’s journey into OWASP and his support for diversity initiatives, including Women in AppSec and conference scholarships. Chris asks how organizations can help and what a more welcoming community might look like. Jon’s message centers on practical generosity: introduce people, remove barriers, and help the next person find a place to contribute.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Jon Mccoy:
→ Jon McCoy on GitHub

Mentioned in this episode:
→ DEF CON
→ OWASP Women in AppSec — project repository
→ OWASP Foundation

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Hacker outreach with Jon McCoy
02:42 What hacker outreach means
05:12 Where outreach happens
06:11 Introducing DEF CON
07:42 What newcomers should expect
09:06 Robert’s connected-wearable cautionary tale
11:19 Jon’s journey from DEF CON to OWASP
13:05 Bringing hacker outreach into OWASP
15:18 Diversity initiatives and access to community
16:32 Women in AppSec
17:58 Conference diversity scholarships
18:31 How organizations can help
19:42 A more welcoming security community
23:05 Jon’s call to action

Omer Levi Hevroni — K8s can keep a secret? Apr 30, 2019

Putting an application in Kubernetes does not solve the problem of getting secrets to it safely. Omer Levi Hevroni, a developer and security champion, explains the risks that led his team to create Kamus. He starts with Kubernetes basics and the broader responsibilities of developers who own applications through deployment and operation. The discussion then follows secrets from source control into the cluster, comparing native mechanisms with encryption and external key-management options. Omer walks through the Kamus workflow, including how an encrypted secret is tied to the application allowed to decrypt it. He also discusses the threats the design addresses and the value of documenting assumptions. This archive conversation captures a practical approach to secrets management and its tradeoffs.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Omer Levi Hevroni:
→ Omer Levi Hevroni on GitHub

Mentioned in this episode:
→ Kamus — historical project repository
→ Kubernetes
→ Azure Key Vault

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Can Kubernetes keep a secret?
02:38 From developer to security champion
04:16 Learning to code and owning applications
06:32 Kubernetes basics
08:44 The challenge of handling application secrets
10:34 Developers responsible for the whole lifecycle
11:19 Keeping secrets usable and controlled
14:18 Secrets accidentally committed to source code
17:09 Options for secrets in Kubernetes
18:58 Recovery and consuming secrets in application code
21:08 Encryption and external key management
24:22 Why the team built Kamus
26:42 The Kamus encryption and decryption workflow
28:21 Where encrypted secrets and keys live
31:43 Threats addressed by the design
34:22 Documentation, threat model, and further resources

Izar Tarandach — Command line threat modeling with pytm Apr 23, 2019

What if developers could describe threats in the same place they describe their software? Izar Tarandach introduces pytm, a Python framework that turns a system description into diagrams and a starting list of threats. He explains why the team built a command line approach, how element attributes drive threat identification, and why small models belong beside the code they describe. Chris and Izar explore possible CI/CD integration, the knowledge developers need to get started, and the limits of automating a conversation about design. The episode offers a practical starting point: clone the sample model, make its diagram resemble your system, then use that shared picture to discover and discuss the risks automation cannot resolve alone.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Izar Tarandach:
→ Izar Tarandach on LinkedIn
→ OWASP pytm

Mentioned in this episode:
→ pytm source and examples
→ Microsoft Threat Modeling Tool
→ Graphviz

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Command line threat modeling with Izar Tarandach
01:10 Izar’s security origin story
05:26 What pytm does and why the team built it
10:54 Where the threat rules come from
12:57 How developers respond to modeling in code
14:47 Keeping threat models beside source code
15:38 Potential CI/CD integration
17:48 Small models and detecting design drift
18:43 How much security knowledge developers need
19:53 Where whiteboard conversations still matter
20:55 A graphical interface without losing the code
22:12 Using pytm with applications in other languages
25:21 Getting started with the sample model
26:25 Finding the project and community

Simon Bennetts — OWASP ZAP: past, present, and future Apr 13, 2019

How do you make a powerful security testing tool approachable to the developers who need it? ZAP project founder Simon Bennetts traces the project from his own experience of a penetration test to a community tool built for learning and automation. Speaking with Robert at CodeMash, he explains the origins of ZAP’s name, the thinking behind its browser-based Heads Up Display, and why usability matters as features multiply. They also discuss ZAP’s API, automated testing, volunteer contributions, and the difficulty of turning a long list of ideas into releases. This conversation captures the project’s direction at the time of recording and gives newcomers a clear picture of how to start using and contributing to ZAP.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Simon Bennetts:
→ Simon Bennetts on LinkedIn
→ ZAP

Mentioned in this episode:
→ ZAP Heads Up Display
→ ZAP API documentation
→ ZAP source code

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 ZAP’s past, present, and future with Simon Bennetts
01:51 A developer’s security wake-up call
04:24 How the ZAP project began
07:41 The story behind the name ZAP
09:44 Bringing security tools into the browser with the HUD
14:38 Browser support and the HUD’s implementation
15:32 How to contribute to ZAP
17:20 Too many ideas and too few contributors
17:56 Integrating OWASP guidance and explaining coverage
19:31 Automating testing through the ZAP API
21:47 Downloads and Docker adoption
23:00 Planning releases with a volunteer team
24:24 Where to find ZAP

Bill Sempf — Growing AppSec People and KidzMash Apr 07, 2019

The shortage of AppSec practitioners will not disappear just by posting more job openings. Bill Sempf joins Robert at CodeMash to discuss finding developers with curiosity and drive, then helping them grow into application security roles. He shares lessons from cultivating people inside several organizations and explains how capture-the-flag exercises can reveal an appetite for security problem solving. The conversation expands to KidzMash, where children explore technology through hands-on activities, and to the growing place of security at developer conferences. Bill also points aspiring practitioners toward OWASP meetings and projects as ways to learn with others. The common thread is practical exposure: give people a place to experiment, connect with a community, and discover what they want to pursue.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Bill Sempf:
→ Bill Sempf on LinkedIn

Mentioned in this episode:
→ KidzMash and the CodeMash experience
→ CodeMash
→ OWASP Security Shepherd

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Growing AppSec people with Bill Sempf
01:30 Meeting at CodeMash
02:29 Finding security talent among developers
05:33 Recognizing curiosity and drive
08:28 Capture the flag as a learning tool
09:20 Teaching children with Security Shepherd
10:40 How KidzMash began
11:57 Hands-on STEM activities for hundreds of children
12:46 Growing security at a developer conference
15:16 Helping developers find a starting point
17:17 Mentoring and connecting people to OWASP

Georgia Weidman — Mobile, IoT, and Pen Testing Mar 30, 2019

A secure mobile application can still sit on a compromised device or depend on an insecure cloud service. Penetration tester and author Georgia Weidman joins Robert at CodeMash to explain why enterprise mobile and IoT security requires a wider view. She describes phishing through mobile channels, a QR-code demonstration that delivered a modified restaurant app, and the infrastructure behind connected devices. Georgia also discusses testing the protections vendors promise, learning the fundamentals through her book Penetration Testing, and the business lessons that came with becoming an entrepreneur. Her path from mathematics to security provides the backdrop for a practical conversation about examining the whole environment and understanding what an attacker can actually reach, rather than stopping at an individual app.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Georgia Weidman:
→ Georgia Weidman on LinkedIn

Mentioned in this episode:
→ Penetration Testing: A Hands-On Introduction to Hacking
→ CodeMash

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Mobile and IoT security with Georgia Weidman
02:09 From mathematics to security
03:33 The competition that sparked an interest in hacking
05:28 Mobile and IoT in the enterprise
06:37 Why mobile phishing matters
07:45 A QR code and a modified restaurant app
08:43 Looking beyond the app to the whole device
10:10 Testing mobile security products and controls
11:39 Learning with Penetration Testing
13:43 Building a company and understanding business risk
17:04 Conferences and international readers

Conclusion: Season 4 Finale Feb 24, 2019

What stood out across a season spanning DevOps, pipelines, community, chaos engineering, dependency risk, and IoT? Chris and Robert revisit memorable explanations from Season 4 and let each guest define a core idea in their own words. Julien Vehent connects application security to DevOps, Matt Tesauro describes the OWASP AppSec Pipeline project, Jessica Robinson and Vandana Verma introduce Women in AppSec, Aaron Rinehart explains chaos engineering, Erlend Oftedal presents retire.js, Björn Kimminich explains Juice Shop, Travis McPeak defines SecOps, and Aaron Guzman discusses the OWASP IoT Top 10. The episode serves as a compact season index, with clip-level chapters that make it easy to return to the full conversations behind each concept.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Chris Romeo and Robert Hurlbut:
→ Chris Romeo on LinkedIn
→ Robert Hurlbut on LinkedIn

Mentioned in this episode:
→ Securing DevOps (Julien Vehent)
→ OWASP AppSec Pipeline Project
→ principlesofchaos.org
→ Chaos Monkey
→ retire.js
→ OWASP Juice Shop
→ OWASP IoT Top 10
→ OWASP Women in AppSec (WIA)
→ retire.js

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Julien Vehent on AppSec and DevOps
02:59 Matt Tesauro on the AppSec Pipeline project
04:33 Jessica Robinson and Vandana Verma on Women in AppSec
05:31 Aaron Rinehart on chaos engineering
08:33 Erlend Oftedal on retire.js
11:01 Björn Kimminich on OWASP Juice Shop
12:44 Travis McPeak on SecOps
14:57 Aaron Guzman on the OWASP IoT Top 10
17:42 Closing Season 4

Geoff Hill -- Rapid Threat Model Prototyping Process Feb 01, 2019

What happens when a threat model takes days to produce but the development team has already moved on? Geoff Hill describes the scaling problems that led him to Rapid Threat Model Prototyping, an approach that starts with the team’s existing design instead of a separate diagram built for security. He explains its just-in-time philosophy, how to rank components by criticality, and how simple rules reveal likely access-control and STRIDE issues. Chris challenges the approach with questions about inconsistent diagrams, trust boundaries, and developer judgment. They also explore automation using diagram metadata and threat libraries. The result is a detailed look at making threat modeling fast enough to support a real design conversation while retaining the context needed to identify meaningful risks.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Geoff Hill:
→ Geoff Hill on LinkedIn
→ Rapid Threat Model Prototyping slides

Mentioned in this episode:
→ Rapid Threat Model Prototyping documentation
→ Microsoft Security Development Lifecycle
→ MITRE CAPEC

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Rapid threat model prototyping with Geoff Hill
05:06 The scaling problem behind the approach
08:45 STRIDE, DREAD, and traditional diagrams
11:19 When threat modeling falls behind the sprint
15:15 The just-in-time, 80/20 philosophy
16:54 Using the team’s existing design
19:03 Handling inconsistent and incomplete diagrams
22:50 Prioritizing access control and system boundaries
26:17 Ranking components by criticality
29:28 Rules for authorization and privilege boundaries
33:10 Using the developers’ knowledge of the system
35:17 Spoofing and trust-zone rules
37:20 Tampering and repudiation
39:53 Information disclosure and denial of service
41:26 Automating analysis from diagram metadata
42:46 Adding a library of threats
44:44 Where to learn more

Bill Wilder -- Running Azure Securely Jan 25, 2019

Moving an application to Azure changes which security controls you operate yourself and which ones the platform can provide. Azure specialist Bill Wilder walks Chris through a practical set of cloud risks, from exposed management ports and missing patches to weak credentials, open database endpoints, and leaked secrets. They examine network protections, serverless and container responsibilities, testing integrations, multifactor authentication, and Azure Key Vault. Bill also explains how managed identities can reduce the need to pass credentials into applications and how Azure’s security monitoring brings configuration and threat signals together. This archive conversation uses the Azure product names and capabilities of its time, while highlighting the enduring questions developers should ask about defaults, shared responsibility, secret handling, and visibility.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Bill Wilder:
→ Bill Wilder on LinkedIn

Mentioned in this episode:
→ Azure Key Vault
→ Azure Kubernetes Service
→ Azure Functions
→ Microsoft Defender for Cloud (formerly Azure Security Center)
→ Azure Friday

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Running Azure securely with Bill Wilder
08:18 Protecting exposed RDP and SSH endpoints
11:05 Host firewalls, gateways, and defense in depth
14:11 Patching responsibilities and serverless
16:48 Containers, AKS, and trusted images
18:35 Web application protection and testing
20:02 Connecting security tools to Azure DevOps
23:45 Weak credentials and multifactor authentication
26:09 Restricting access to SQL endpoints
28:24 Protecting secrets with Azure Key Vault
30:03 Hardware security modules and private keys
34:44 Reducing credentials with managed identities
35:41 Security monitoring and logging
40:40 Resources for learning more about Azure

Matt Konda -- OWASP Glue Jan 18, 2019

Developers need useful findings in their workflow, not another collection of security tools to operate by hand. Matt Konda explains how OWASP Glue grew from that problem: run multiple tools, normalize their output, and make the results usable in a build or development process. He shares his path from software development into AppSec, the thinking behind Jemurai, and why OWASP’s community appealed to him. The technical discussion compares Glue with Gauntlt and DefectDojo, examines integrations and extensibility, and considers how open-source projects can work together. Matt closes with a straightforward way for an individual developer to try Glue. Throughout, the focus is on connecting security work to engineering habits and making automation produce information people can act on.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Matt Konda:
→ Matt Konda on LinkedIn
→ OWASP Glue source code

Mentioned in this episode:
→ Gauntlt
→ OWASP DefectDojo
→ Brakeman
→ ZAP

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Connecting security tools with Matt Konda
01:09 From software development into security
04:34 Bridging the gap with development teams
08:55 The story behind Jemurai
10:34 Tools, processes, and useful security signals
13:33 Finding a community in OWASP
17:08 Why OWASP Glue was created
19:52 Comparing Glue with Gauntlt and adding tools
26:01 How Glue relates to DefectDojo
29:48 Improving commercial tool integrations
31:59 The easiest way to start using Glue
34:47 Final thoughts

Josh Grossman, Avi Douglen, and Ofer Maor -- AppSec in Israel and Three Talks to watch from AppSec USA Jan 11, 2019

What can the wider AppSec community learn from Israel’s unusually dense security ecosystem? Josh Grossman, Avi Douglen, and Ofer Maor join Chris at AppSec USA to discuss how military experience, universities, startups, and a thriving OWASP chapter feed the local community. Each guest also introduces a conference talk with a practical lesson: getting better value from penetration tests, connecting threat modeling to business priorities, and automating security work alongside development. The conversation examines black-box testing, tester skill, clearer reporting, and feedback into engineering backlogs. Along the way, the guests explain how community events grow through consistent participation and shared ownership. It is both a snapshot of AppSec in Israel and a guide to three talks worth revisiting.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Josh Grossman, Avi Douglen, and Ofer Maor:
→ Josh Grossman on LinkedIn
→ Avi Douglen on LinkedIn
→ Ofer Maor on X

Mentioned in this episode:
→ OWASP Israel
→ OWASP Global AppSec conferences
→ Maker’s Schedule, Manager’s Schedule

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 AppSec in Israel and three conference talks
02:31 How security experience shapes AppSec work
04:20 Avi Douglen’s security origin story
07:16 Israel’s security ecosystem
08:52 Growing the OWASP Israel community
11:04 Universities and the security talent pipeline
14:00 Community lessons after the break
16:18 Getting value from penetration testing
19:07 Black-box testing and development teams
23:01 Value-driven threat modeling
25:23 Automating application security work
27:26 Feeding security results into the backlog
29:05 Talks and final recommendations

Daniel Miessler -- OWASP IoT Top 10 Jan 01, 2019

An IoT product’s attack surface extends well beyond the device in the box. Daniel Miessler explains that broader view while walking Chris and Robert through the 2018 OWASP IoT Top 10. Before reviewing the risks, he describes the project’s audience, how the team gathered and evaluated data, and the challenge of balancing recurring failures with emerging concerns. The list covers passwords, exposed services, ecosystem interfaces, updates, components, privacy, data protection, device management, defaults, and physical hardening. Real testing examples show how a secure-looking connection can hide other unprotected paths or services. Daniel closes with guidance for developers who want to understand their product’s full ecosystem and use the list as a starting point for better security decisions.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Daniel Miessler:
→ Daniel Miessler
→ OWASP Internet of Things project

Mentioned in this episode:
→ OWASP Application Security Verification Standard
→ OWASP Proactive Controls
→ National Vulnerability Database
→ Cloud Security Alliance

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 The 2018 IoT Top 10 with Daniel Miessler
01:27 Daniel’s security origin story
04:25 Why the IoT Top 10 exists
07:30 Manufacturers, developers, and other audiences
11:56 Gathering data and deciding the rankings
19:27 Historical findings and emerging risks
22:39 Passwords and insecure network services
24:23 Insecure ecosystem interfaces
26:13 Lack of secure update mechanisms
28:31 Insecure or outdated components
30:41 Privacy and unexpected connections
33:05 Data protection at rest and in transit
35:29 Device management and insecure defaults
37:45 Physical hardening
40:18 Takeaways for developers

Travis McPeak -- SecOps Makes Developers Lives Easier Dec 17, 2018

What if a security team measured success partly by making developers’ work easier? Travis McPeak explains that approach to SecOps through concrete examples from Netflix’s cloud environment. RepoKid removes unused AWS permissions, Lemur simplifies certificate provisioning, and Security Monkey provides visibility into assets and configuration changes. Chris asks how those capabilities fit with the secure development lifecycle, incident response, and traditional application testing. Travis describes finding repetitive work or problems that cannot scale manually, then deciding whether to use an existing solution or build automation. They also discuss learning paths, books, and OWASP involvement. The conversation makes the operational side of security tangible: give teams dependable controls and useful context while reducing the everyday friction of doing the right thing.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Travis McPeak:
→ Travis McPeak on LinkedIn

Mentioned in this episode:
→ RepoKid
→ Lemur
→ Security Monkey (archived project)
→ Bandit
→ The Tangled Web

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 SecOps that helps developers with Travis McPeak
01:17 Travis’s security origin story
03:25 A security book worth sharing
04:05 Defining SecOps and introducing RepoKid
05:16 Removing permissions and managing exceptions
06:20 Security signals and incident response
08:20 Making certificate provisioning easier with Lemur
10:29 Language-specific tools and broader controls
11:52 Asset visibility with Security Monkey
13:02 Automatically correcting cloud permissions
14:32 How an operational problem becomes a tool
15:51 Where application security testing fits
17:22 Learning SecOps through community and practice

Chris Romeo -- Security Culture Hacking: Disrupting the Security Status Quo Dec 10, 2018

Changing security culture requires more than distributing policies or buying another training platform. In this recorded AppSec USA presentation, Chris Romeo shares practical ways to influence how an organization thinks and acts about software security. He explains why every organization already has a security culture, how to assess it, and why the assessment must lead to action. The talk explores speaking the language of developers and executives, sharing information openly, building a champions community, and recognizing useful behavior. Chris also describes learning experiences that fit developers’ work and demonstrations that make application risk concrete for leaders. He closes by connecting culture change to observable outcomes, including whether teams resolve security problems more quickly over time.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Chris Romeo:
→ Chris Romeo on LinkedIn

Mentioned in this episode:
→ OWASP SAMM
→ OWASP Juice Shop
→ WebGoat
→ DevSlop

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Security culture hacking at AppSec USA
08:05 Every organization already has a security culture
09:53 Transparency and sharing security knowledge
10:07 Assessing and measuring the starting point
11:39 Turning assessment into an action strategy
12:34 Learning developers’ language and methods
13:49 Speaking to executives about risk and value
14:24 Communication and security’s own assumptions
17:37 Building a deliberate security community
18:06 Champions programs and learning sessions
19:57 Recognition and incentives for useful behavior
22:45 Developer-friendly learning and hands-on practice
27:43 Educating executives about application security
29:04 Demonstrating risk and measuring improvement

Jim Manico -- The Extremely Unabridged History of SQLi and XSS Dec 03, 2018

Why are SQL injection and cross-site scripting still with us after years of knowing how to prevent them? Jim Manico joins Chris for an informal journey through the history of both vulnerability classes and the defenses that changed application development. They discuss parameterized database APIs, output encoding, sanitization, framework defaults, and the long life of legacy software. The conversation then turns toward the future: what security libraries and language-specific analysis can do, where commercial testing tools fit, and who has an incentive to invest in stronger platforms. Jim’s recollections and predictions make this an opinionated archive conversation about progress and persistence, with a central challenge for developers and security teams: make protection a normal part of building software.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Jim Manico:
→ Jim Manico on LinkedIn

Mentioned in this episode:
→ DOMPurify
→ OWASP ESAPI
→ Go html/template
→ Brakeman
→ OWASP Top 10

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 The history of SQL injection and XSS with Jim Manico
01:33 How application security has changed
05:06 Parameterized queries and early defenses
07:20 Why injection remains on the Top 10
09:22 Could SQL injection disappear?
10:39 Tracing the history of cross-site scripting
17:21 Carrying secure defaults into new frameworks
19:34 Legacy applications and long software lifespans
20:47 The role of defensive technology
23:13 What happens to the security tool market?
24:52 Why language-specific analysis matters
26:26 Who pays for more secure platforms?

Jeff Williams -- The History of OWASP Nov 27, 2018

OWASP became a reference point for software security, but it began with people sharing knowledge and trying to solve problems together. Jeff Williams joins Chris to trace that early history, from their consulting roots to the first Top 10, the Foundation, and the growth of community events. He explains the tradeoffs behind an awareness list, the importance of independence, and why recognition alone does not make software safer. Their conversation also examines open-source project visibility, participation, and the difficulty of turning useful work into something more developers can discover and adopt. Jeff’s firsthand account offers both a history lesson and a challenge to the community: simplify security, communicate the value of its tools, and keep expanding who can contribute.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Jeff Williams:
→ Jeff Williams on LinkedIn
→ Contrast Security

Mentioned in this episode:
→ OWASP Foundation
→ OWASP Top 10
→ OWASP WebGoat
→ OWASP DefectDojo
→ OWASP Dependency-Check

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 OWASP’s history with Jeff Williams
01:39 Shared roots in security consulting
07:47 The early days of OWASP
11:13 Creating the first OWASP Top 10
14:22 Evidence, judgment, and the Top 10
17:48 Independence and outside interests
18:12 The Top 10’s growing influence
20:27 Simplifying the work of fixing vulnerabilities
23:15 Forming the Foundation and early conferences
29:46 Helping people discover OWASP projects
30:33 DefectDojo and communicating project value
33:20 Dependency-Check and broader adoption
35:49 Improving OWASP through participation

Bjorn Kimminich -- The Joy of the Vulnerable Web: JuiceShop Nov 19, 2018

Can an intentionally broken online shop help change an organization’s security culture? OWASP Juice Shop creator Björn Kimminich explains how a realistic application full of vulnerabilities gives developers, testers, and managers a shared way to experience security problems. He traces the project’s origins, describes how real incidents become challenges, and discusses the community that keeps adding new ideas. Chris asks about management awareness demonstrations, capture-the-flag events, deployment options, and the range of challenge difficulty. They also explore what was new in Juice Shop 8 and where Björn hoped to take the project next. The conversation shows how hands-on exploration can connect an abstract vulnerability to something people recognize in their own software, without requiring everyone to begin as an expert.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Björn Kimminich:
→ Björn Kimminich on GitHub
→ OWASP Juice Shop

Mentioned in this episode:
→ Juice Shop project website
→ Juice Shop source code
→ Node.js

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Learning security with Björn Kimminich and Juice Shop
01:37 Björn’s path from development into security
03:41 Why Juice Shop was created
04:51 What makes an intentionally broken application
05:41 Turning real vulnerabilities into challenges
07:42 The community behind the project
11:04 Who uses Juice Shop and why
13:08 Security awareness demonstrations for managers
14:56 How managers respond to seeing attacks
17:04 Running Juice Shop for capture-the-flag events
19:31 Deployment options
20:29 Trying the demo instance
23:24 Exploring with browser developer tools
25:17 What was new in Juice Shop 8
27:26 Challenges for different skill levels
29:03 The project’s future direction
33:42 Sharing ideas and getting involved

Swaroop Yermalkar -- iGoat and iOS Mobile Pen Testing Nov 13, 2018

Mobile apps can hide credentials, expose powerful backend access, and repeat familiar web security mistakes. OWASP iGoat project leader Swaroop Yermalkar joins Chris to explain how he approaches testing iOS and Swift applications, starting with understanding the business and following the data. They discuss hardcoded cloud keys, inspecting application classes, proxying traffic, and weaknesses in mobile service endpoints. Swaroop then introduces iGoat as a practical learning environment where people can exploit a flaw, understand the remediation, and rebuild the application with a fix. A cloud-storage exercise illustrates how client-side clues lead to a wider exposure. The episode closes with iGoat’s relationship to OWASP’s mobile guidance and why these skills matter across Apple’s expanding device ecosystem.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Swaroop Yermalkar:
→ Swaroop Yermalkar on LinkedIn
→ OWASP iGoat

Mentioned in this episode:
→ iGoat Swift
→ OWASP Mobile Application Security Testing Guide
→ Burp Suite
→ OWASP WebGoat

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 iOS security and iGoat with Swaroop Yermalkar
01:11 From Wi-Fi curiosity to application security
02:42 Mobile applications in bug bounty programs
03:44 Testing Swift applications
05:01 Hardcoded keys and excessive permissions
07:45 Understanding the business before testing
10:51 Inspecting and decrypting an iOS application
12:24 Static analysis and proxying mobile traffic
13:58 Why mobile backends deserve attention
15:53 What the iGoat learning environment contains
17:57 Fixing the vulnerability after exploiting it
19:13 A cloud-storage misconfiguration exercise
23:18 Future directions and new challenges
24:49 Connecting iGoat with OWASP mobile standards
26:24 Applying the skills across devices

Adam Bacchus and Jon Bottarini -- Two Sides to a Bug Bounty: The Researcher and The Program Nov 05, 2018

What does a bug bounty look like from both sides of the relationship? Adam Bacchus and Jon Bottarini of HackerOne compare the responsibilities of the program operator with the experience of the security researcher. They discuss safe-harbor language, where bounty programs fit alongside scanners and penetration tests, and why business-logic flaws still depend on human creativity. Adam explains response metrics, payout structures, public and private programs, and the maturity an organization needs before inviting researchers. Jon describes researcher profiles, reputation, learning paths, and the realities of earning money through vulnerability discovery. The conversation gives organizations a clearer picture of the operational commitment behind a bounty and gives aspiring researchers practical ways to begin building skill and credibility.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Adam Bacchus and Jon Bottarini:
→ Adam Bacchus on LinkedIn
→ Jon Bottarini on LinkedIn
→ HackerOne

Mentioned in this episode:
→ HackerOne
→ Hacker101
→ HackerOne Hacker Report

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Two sides of a bug bounty
02:33 A researcher’s security origin story
06:34 The size and scope of bounty programs
08:00 Safe harbor for security researchers
09:17 Where bug bounties fit in AppSec
11:09 A business-logic vulnerability example
12:57 Root causes and program improvement
14:43 Metrics for running a bounty
19:08 Response-time expectations
20:02 Payouts and program maturity
21:34 Who becomes a bug bounty researcher
23:10 How a new researcher can start
26:14 Reputation and private programs
26:54 The largest bounty payouts
27:54 Life as a security researcher
31:07 Full-time and part-time participation
34:47 Learning resources and final advice

Erlend Oftedal -- What You Require, You Must Also Retire Oct 29, 2018

A JavaScript library can keep working long after its security problems become public. Retire.js project leader Erlend Oftedal explains how developers can discover vulnerable dependencies and make that information part of everyday development. He describes the project’s origins, command line scanning, browser-based detection, and options for integrating checks into a build pipeline. Chris probes what happens after a finding, how exceptions can undermine the process, and how externally loaded libraries fit into the picture. They also discuss Retire.js alongside npm auditing, OWASP Dependency-Check, and Dependency-Track. Erlend’s experience leading an OWASP chapter adds a community perspective to the technical discussion. The practical message is to know which libraries you ship and make upgrading them a continuing engineering responsibility.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Erlend Oftedal:
→ Erlend Oftedal on LinkedIn
→ Retire.js

Mentioned in this episode:
→ Retire.js source code
→ OWASP Dependency-Check
→ OWASP Dependency-Track
→ OWASP Proactive Controls

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Finding vulnerable JavaScript with Erlend Oftedal
01:54 A developer’s path into security
07:07 Running an OWASP chapter
10:27 Why Retire.js was created
12:34 Scanning locally and in a pipeline
14:16 The danger of ignoring every finding
15:29 Reading scan results and the role of npm audit
17:45 Upgrading vulnerable libraries
19:05 Detecting libraries loaded from other sites
20:32 Passive discovery in the browser
22:05 Working with Dependency-Check and Dependency-Track
24:27 Open-source and commercial dependency tools
28:21 The limits of automated coverage

Abhay Bhargav -- Threat Modeling as Code Oct 23, 2018

A threat model that lives in an old document rarely keeps pace with the code it describes. Abhay Bhargav explains how threat modeling as code can connect user stories, abuse cases, threat scenarios, and specific controls inside an evolving development process. He describes choosing YAML as a familiar format, compares that approach with behavior-driven specifications, and shows how the result can help both engineering teams and security testers. The conversation introduces Threat Playbook and explores turning concrete mitigations into an attack model and useful testing direction. Abhay also discusses the challenge of automating tools with different interfaces, including ZAP and nodejsscan. The episode makes the case for keeping threat information actionable, versionable, and close to the people building the application.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Abhay Bhargav:
→ Abhay Bhargav on LinkedIn
→ we45

Mentioned in this episode:
→ Threat Playbook
→ ZAP
→ nodejsscan

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Threat modeling as code with Abhay Bhargav
01:51 Early work in PCI and security
03:37 Why traditional threat models become stale
06:48 From user stories to abuse cases and threats
08:32 Integrating the model into development
09:16 YAML specifications and alternative approaches
11:23 Benefits for DevOps and security teams
14:13 Attack models and specific mitigations
17:26 Introducing Threat Playbook
20:40 The challenge of automated security pipelines
22:54 Python and tool choices
23:26 ZAP, nodejsscan, and npm audit
26:37 Sharing the workshop materials

Tony UV -- Threat Libraries in the Cloud Oct 16, 2018

A list of weaknesses is not the same thing as an understanding of the threats facing a business. Tony UV returns to explain how a threat library can connect industry intelligence with evidence from an organization’s own systems. He distinguishes threats, attacks, and vulnerabilities, then describes how cloud logs and configuration signals can add context to a threat model. The conversation examines the feedback loop between modeling, detection, and real incidents, with examples involving sabotage, data loss, and extortion. Tony recommends starting with a manageable set of business concerns, substantiating them with evidence, and mapping the relevant attack paths and technologies. His approach gives teams a way to make threat modeling reflect what could actually harm the operation they support.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Tony UcedaVelez:
→ Tony UV on LinkedIn
→ VerSprite

Mentioned in this episode:
→ MITRE CAPEC
→ MITRE ATT&CK
→ AWS CloudTrail
→ FS-ISAC

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Threat libraries in the cloud with Tony UV
01:16 Continuing the threat modeling conversation
02:30 External intelligence and internal evidence
05:25 Validating threats in business context
08:12 How the library supports a threat model
12:09 Cloud platforms as sources of threat context
18:13 The feedback loop between models and incidents
18:55 Connecting business threats to attack patterns
22:23 Starting with a manageable threat library
23:14 Beyond STRIDE: evidence, extortion, and business impact

Aaron Rinehart -- Chaos Engineering and #AppSec Oct 08, 2018

How do you know a security control will work when the system around it fails? Aaron Rinehart introduces chaos engineering as a way to test assumptions about complex systems before an unexpected incident exposes them. He explains its relationship to good engineering, Netflix’s Chaos Monkey, and site reliability engineering, then brings the discussion into application security. Chris and Robert explore ChaoSlingr, the difference between testing a failure condition and introducing a vulnerability, and how experiments can reveal gaps in detection or response. Aaron also discusses a SOC-less model that connects security signals with the people best placed to act. Books and foundational resources round out an introduction to learning from controlled experiments and building confidence in how systems actually behave.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Aaron Rinehart:
→ Aaron Rinehart on LinkedIn

Mentioned in this episode:
→ Principles of Chaos Engineering
→ Chaos Monkey
→ ChaoSlingr
→ Release It! Second Edition
→ Google SRE books

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Chaos engineering and AppSec with Aaron Rinehart
03:31 Security as a reflection of good engineering
06:52 What chaos engineering means
09:57 How Chaos Monkey works
12:30 Principles and the wider movement
14:13 The relationship with site reliability engineering
15:56 Examples of complex-system failures
20:28 Applying chaos engineering to security
21:13 Introducing ChaoSlingr
24:50 Testing failure conditions rather than adding flaws
25:58 Resources for learning more
29:17 Release It and resilience lessons
31:33 The SOC-less model at Netflix
35:04 Aaron’s writing and further reading

Jessica Robinson and Vandana Verma-- WIA: Women in #AppSec Oct 01, 2018

How can application security become a field where more women enter, contribute, and advance? Jessica Robinson and Vandana Verma discuss OWASP Women in AppSec, its local committees, mentoring, training, and conference activities. They explain how chapters can create opportunities without isolating the initiative from the broader community, and why visible leaders and practical support matter. The conversation includes lessons from OWASP Bangalore, Nullcon, networking events, and the challenge of sustaining volunteer programs across geographies. Jessica and Vandana also offer concrete guidance to chapter leaders and allies who want to help: make an explicit commitment, create space for participation, and support people as they build expertise and confidence. The episode frames inclusion as community work that requires repeated action.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Jessica Robinson and Vandana Verma:
→ OWASP Women in AppSec
→ Vandana Verma

Mentioned in this episode:
→ OWASP Women in AppSec
→ OWASP Bangalore
→ Nullcon

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Women in application security
03:07 Vandana Verma’s path into security
05:19 The purpose of Women in AppSec
07:46 Local committees and chapter activities
12:48 Training events and Nullcon
16:13 Mentoring and community support
21:10 Building welcoming professional networks
25:47 Growing leaders across geographies
30:31 What chapter leaders and allies can do
32:49 Final recommendations

Karen Staley -- A Conversation with Karen Sep 25, 2018

What should OWASP members expect from the foundation’s executive leadership, and how can a global nonprofit remain connected to its volunteer community? Karen Staley joins Chris and Robert during AppSec Europe to discuss her early experience as OWASP’s executive director. She explains how her nonprofit background prepared her for a passionate technical community, how members and chapter leaders interact with the foundation, and why conferences, membership, and diverse participation matter to OWASP’s future. The conversation also explores fundraising, strategic priorities, and the challenge of supporting local chapters while preserving an open organization. Karen closes with a call for greater community engagement and partnership.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Karen Staley and OWASP:
→ OWASP Foundation

Mentioned in this episode:
→ OWASP Foundation
→ OWASP Chapters

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 A conversation with OWASP leadership
01:08 Karen Staley’s nonprofit background
02:16 Joining OWASP as executive director
05:26 How members connect with the foundation
08:52 Conferences, developers, and broader participation
10:26 Membership and supporting local chapters
12:23 Strategic priorities for OWASP
15:27 Building stronger community engagement
16:20 Closing thoughts

Mohammed Imran -- Back to the Lab Again with a DevOps Sep 18, 2018

Learning DevSecOps is hard when setting up the lab becomes a project of its own. Mohammed Imran introduces DevSecOps Studio, an environment designed to help people practice an automated delivery workflow and add security to it. He shares his transition from offensive security toward building defenses, explains why security practitioners need to understand developers’ tools, and describes the roles of Git, GitLab, containers, and automation. Chris asks how static and dynamic testing fit into the pipeline and how the lab connects with DevSlop. Their discussion keeps returning to hands-on experience: give learners working pieces they can inspect, change, and reconnect. The episode offers a route from knowing security concepts to understanding how those concepts operate inside a real development process.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Mohammed Imran:
→ Mohammed Imran on LinkedIn
→ DevSecOps Studio

Mentioned in this episode:
→ OWASP DevSlop
→ GitLab
→ Docker
→ Bandit

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Learning DevSecOps with Mohammed Imran
01:23 An offensive-security origin story
03:07 Moving from breaking systems to defending them
04:50 What a DevSecOps course needs to teach
06:30 Learning from established DevOps practices
10:15 Dynamic testing and vulnerability scanning
12:07 Bridging operations, coding, and security skills
14:40 Learning Git and CI/CD fundamentals
14:58 Why GitLab is a useful starting point
19:02 What the DevSecOps Studio lab provides
20:20 Teaching with a working environment
23:12 Cloud reference architectures and DevSlop
24:41 How to get started and find the documentation

Niels Tanis -- A Slice of the Razor with ASP.Net Core Sep 11, 2018

Framework defaults can prevent common vulnerabilities, but developers still need to understand when their code bypasses those protections. Niels Tanis joins the podcast at AppSecEU to unpack ASP.NET Core and Razor Pages from a security perspective. He explains the framework’s structure, dependency and package concerns, and the protections around request forgery and output encoding. The conversation explores why rendering raw HTML deserves scrutiny, how validation and model state work, and how overposting can expose fields that never appear in the interface. Niels also discusses tooling and ways to begin learning the platform. This archive episode gives .NET developers a practical way to reason about what the framework does for them and which responsibilities remain in their application code.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Niels Tanis:
→ Niels Tanis on LinkedIn

Mentioned in this episode:
→ ASP.NET Core Razor Pages documentation
→ ASP.NET Core documentation
→ NuGet
→ Scott Hanselman on overposting and mass assignment

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 ASP.NET Core and Razor security with Niels Tanis
01:25 Niels’s security origin story
03:44 The security implications of a changing .NET platform
05:57 Understanding ASP.NET Core and MVC
07:54 Framework and dependency challenges
12:41 Razor Pages and security defaults
14:16 Baseline protections and output encoding
16:16 Why raw HTML deserves extra review
17:26 Explicitly overriding secure defaults
19:52 Security tooling through NuGet
20:24 Input validation and model state
21:55 Overposting and mass assignment
26:23 Where new .NET developers can learn more

Ofer Maor -- A Pen Testers Transition to #AppSec: #VoteForOfer Sep 04, 2018

Finding vulnerabilities is only part of improving software security; the harder work is changing how people build and operate applications. Ofer Maor shares his transition from penetration testing into application security and the lessons he learned through security startups. He and Chris discuss culture, genuine risk management, and the industry’s attraction to offensive work. They explore delivering findings inside developers’ tools, the limits of dumping issues into a backlog, and the roles of interactive testing and runtime protection. Ofer explains how compensating controls can buy time without replacing the need to fix code. The episode closes with his OWASP involvement and board candidacy at the time of recording, connecting technical progress with the community needed to support it.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Ofer Maor:
→ Ofer Maor on LinkedIn

Mentioned in this episode:
→ OWASP Israel community
→ OWASP Top 10

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 From penetration testing to AppSec with Ofer Maor
01:08 Ofer’s security origin story
03:04 Why secure development is hard
03:46 Culture and risk management
06:30 Balancing offensive and defensive work
07:37 Persistent vulnerabilities and framework defenses
11:52 Making security actionable for developers
14:11 Delivering findings in the IDE
14:36 Why thousands of backlog tickets do not help
18:54 IAST, RASP, and the risk of overreliance
21:44 Using runtime protection while fixing the code
22:18 OWASP involvement and the historical board campaign
23:19 OWASP Israel and growing new leaders

Matt Tesauro -- #AppSec Pipeline as Toolbox Aug 28, 2018

How can a small AppSec team make sense of thousands of applications and a growing pile of security work? Matt Tesauro explains the AppSec Pipeline project as a toolbox for organizing and automating the work, rather than a single prescribed product. He describes the pressure that led him and Aaron Weaver to map intake, triage, testing, and delivery, then connect tools around those stages. The conversation examines DefectDojo’s role in tracking findings and effort, baseline testing across applications, and the value of reusable containers. Matt also explains how teams can adapt the pieces to their own development practices and where to begin. The result is a practical view of automation that supports decisions about both technical risk and limited team capacity.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Matt Tesauro:
→ Matt Tesauro on LinkedIn
→ OWASP AppSec Pipeline project

Mentioned in this episode:
→ OWASP DefectDojo
→ OWASP Dependency-Check
→ ZAP
→ Bandit

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 The AppSec Pipeline toolbox with Matt Tesauro
00:59 Matt’s security origin story
02:34 Discovering the OWASP community
04:31 Why the AppSec Pipeline project began
05:58 Scaling a small security team with automation
07:11 Tools that fit into the pipeline
08:59 Tracking work and resource tradeoffs
10:31 DefectDojo’s place in the process
12:18 Baseline testing across an application portfolio
14:14 A toolbox teams can adapt
15:30 Getting started: intake, triage, testing, and delivery
18:43 OWASP and sharing practical experience

Stephen de Vries -- Threat Modeling with a bit of #Startup Aug 20, 2018

What developers need from a threat model is often a clear set of requirements they can implement. Stephen de Vries explains how that perspective shaped IriusRisk and his move from security consulting into building a product company. He and Chris discuss reusable threats and countermeasures, the role of OWASP ASVS, and the need to translate guidance into instructions that make sense in an issue tracker. They also examine why spreadsheets and separate security systems create friction, and how existing testing and design habits can provide a bridge into security. Stephen’s startup experience frames a broader conversation about making threat modeling repeatable: reuse what is known, focus human attention on the difficult parts, and meet developers inside their normal workflow.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Stephen de Vries:
→ Stephen de Vries on LinkedIn
→ IriusRisk

Mentioned in this episode:
→ OWASP Application Security Verification Standard
→ OWASP Proactive Controls
→ OWASP Web Security Testing Guide

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Threat modeling and startup lessons with Stephen de Vries
00:34 Stephen’s development and security background
05:01 Starting a security product company
06:35 From building a product to building a company
07:48 Threat modeling as a route to security requirements
10:41 Reusing common threats and countermeasures
12:00 Connecting requirements management and threat modeling
13:43 Turning ASVS into actionable developer guidance
14:16 Meeting developers in their existing tools
15:33 Removing spreadsheet and email friction
17:00 Building on testing and design habits
18:41 Connecting everyday risk thinking to security
20:06 Behavior-driven testing and useful OWASP resources

Julien Vehent -- Securing DevOps Aug 14, 2018

Can security become a normal part of DevOps without turning every release into an audit? Julien Vehent, author of Securing DevOps, shares what his team learned protecting Firefox services at Mozilla. He explains why security engineers belong inside product teams, how short checklists translate large security requirements into work developers can actually complete, and where creativity still matters. Julien challenges the idea that everything must be automated, showing how automation frees specialists to investigate the problems that require judgment. The conversation follows real examples involving Content Security Policy, bug bounties, website security grades, and testing in delivery pipelines. He closes by describing continuous security as a feedback loop that turns operational lessons into better requirements, controls, and engineering practices.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Julien Vehent:
→ Julien Vehent’s website

Mentioned in this episode:
→ Securing DevOps by Julien Vehent
→ Mozilla HTTP Observatory
→ ZAP
→ SSL Labs Server Test

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Securing DevOps with Julien Vehent
01:54 Julien’s security origin story
04:51 Defining DevOps as engineering practices
06:33 The practical story behind Securing DevOps
07:32 Making security a natural part of building software
10:28 Putting security inside the product team
13:11 Turning security requirements into checklists
16:11 Leaving developers room for creativity
17:15 Where manual security work still belongs
21:23 Mozilla’s experience with CSP and bug bounties
25:12 Observatory, SSL Labs, and pipeline testing
26:35 Continuous security as a feedback loop
30:31 Learning security by building real systems
32:39 Room to improve DevOps security

Christian Folini -- CRS and an Abstraction Layer Aug 07, 2018

How can one open-source rule set protect applications across competing products and very different architectures? Christian Folini explains the relationship between the ModSecurity engine and the OWASP Core Rule Set, including the attacks generic rules can detect and the limits of a web application firewall. Recorded at AppSec Europe, the conversation explores a gathering of vendors and contributors working to improve compatibility, feedback, and the project’s future. Christian describes the proposed abstraction layer that could separate security rules from a particular engine and bring detection closer to application code. He also discusses funding, testing, false positives, and integrating protection into continuous delivery. The result is a practical look at both the engineering and community work behind widely deployed open-source defenses.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Christian Folini:
→ Christian Folini on LinkedIn
→ Christian Folini’s website

Mentioned in this episode:
→ OWASP Core Rule Set
→ ModSecurity

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Christian Folini and the Core Rule Set
01:38 From medieval history to application security
02:39 How CRS fits with the ModSecurity engine
03:42 Attack coverage and a WAF’s limits
06:06 Bringing vendors together at AppSec Europe
08:39 A common abstraction layer for security rules
12:57 Funding and contributing to open source
15:30 More outcomes from the CRS gathering
17:46 CRS in continuous integration and runtime protection
19:42 Could CRS run inside an application runtime?
20:40 Moving security decisions closer to the code
23:50 Where to learn more and contribute

Sean Wright -- Google Chrome and the Case of the Disappearing HTTP Jul 30, 2018

What changed when Chrome began labeling ordinary HTTP pages as not secure, and why did that decision provoke resistance? Application security practitioner Sean Wright explains the browser changes in their 2018 context and makes the case for protecting every website with TLS. He separates encrypted transport from trust in a website, examines how unencrypted traffic can be read or modified, and discusses the objections that complicated wider HTTPS adoption. The conversation covers accessible certificate options such as Let’s Encrypt, the role of Cloudflare, and the usability benefits of safer browser defaults. Sean also explains how HTTP Strict Transport Security and preload lists address downgrade opportunities. It is a useful historical discussion of the shift from optional encryption toward an HTTPS-first web.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Sean Wright:
→ Sean Wright’s blog
→ Sean Wright’s portfolio

Mentioned in this episode:
→ Let’s Encrypt
→ HSTS Preload List
→ HTTPS Everywhere — retired browser extension

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Chrome, HTTP, and Sean Wright
01:49 Sean’s route from development into security
03:23 What TLS protects
04:11 Why every website needs encrypted transport
05:34 The controversy around HTTP warnings
07:45 How unencrypted traffic can be modified
08:46 Misinformation and objections to HTTPS
10:34 Let’s Encrypt and accessible certificates
16:20 Safer defaults and usable security
20:22 HSTS headers and preload protection
22:38 Resources for understanding the change

Conclusion: All the Pieces You Need for an #AppSec Program Jun 12, 2018

Which practices belong in a complete application security program? The Season 3 finale answers by assembling clips that move from early development decisions through testing, resilience, and runtime detection. Kevin Greene explains shifting left, Robert Hurlbut defines security champions, Pete Chestna distinguishes SAST, DAST, IAST, and RASP, and Megan Wu describes burnout and its warning signs. Jim Manico presents the OWASP Cheat Sheet Series, David Habusha explains software composition analysis and the Equifax example, and John Melton closes with OWASP AppSensor. Chris and Robert use the clips to show that AppSec is not one tool or one team; it is a connected set of technical practices, community roles, and sustainable working habits.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Chris Romeo and Robert Hurlbut:
→ Chris Romeo on LinkedIn
→ Robert Hurlbut on LinkedIn

Mentioned in this episode:
→ OWASP Cheat Sheet Series
→ OWASP AppSensor
→ OWASP Dependency-Check
→ National Vulnerability Database
→ OWASP Cheat Sheet Series

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Building a complete AppSec program
00:50 Kevin Greene on shifting left
04:58 Robert Hurlbut on security champions
06:38 Pete Chestna on SAST, DAST, IAST, and RASP
10:16 Megan Wu on recognizing burnout
12:50 Jim Manico on the OWASP Cheat Sheet Series
17:35 David Habusha on software composition analysis
20:45 Could SCA have prevented Equifax?
22:44 John Melton on OWASP AppSensor
28:05 Closing Season 3

Martin Knobloch -- OWASP, Reach Out; We Are Known and Misunderstood Jun 05, 2018

OWASP is widely recognized, but do people understand the community behind its famous Top 10? Martin Knobloch, serving as the foundation’s board chair when this conversation was recorded in 2018, explains what the organization does and how volunteers make it work. He traces his journey from industrial control programming into software security, then describes board responsibilities, chapter leadership, and the educational value of OWASP projects. Chris and Robert explore how an open community handles disagreement, measures its impact, and reaches people outside its existing circle. Martin reflects on the organization’s growth, the role of staff, and the value of conferences for meeting contributors. His closing challenge is straightforward: reach out, share useful resources, and help more people participate in application security.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Martin Knobloch:
→ Martin Knobloch on LinkedIn

Mentioned in this episode:
→ OWASP Foundation
→ OWASP Web Security Testing Guide
→ OWASP ASVS

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Understanding the OWASP community
01:31 Martin’s security origin story
04:06 What the OWASP board chair does
07:53 OWASP’s mission and purpose
08:52 The educational value of the Testing Guide
11:04 The scale and passion of the volunteer community
14:48 Working through community disagreements
16:34 Measuring impact beyond OWASP
19:45 How OWASP changed as it grew
21:20 Supporting growth with staff and leadership
23:25 Projects Martin is working on
24:24 Why attend an OWASP conference?
28:44 A challenge to reach out

Devin McMasters -- Bug Bounty with a Side of Empathy May 29, 2018

A bug bounty can create a productive relationship with security researchers—or damage trust on both sides. Devin McMasters joins Chris to explain how organizations can design programs that produce useful findings while treating researchers fairly. He compares crowdsourced security with traditional penetration testing, discusses public and private programs, and describes the operational maturity required before inviting outside reports. The conversation covers vulnerability types, payout budgets, incident-response workflows, reputation, and common program mistakes. Devin repeatedly returns to empathy: companies may set the final rules, but researchers invest real time and may depend on rewards, so clear communication and respectful decisions are essential to a sustainable bug bounty program.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Devin McMasters:
→ Devin McMasters on LinkedIn

Mentioned in this episode:
→ Bugcrowd
→ HackerOne

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Bug bounties with empathy
01:41 Devin McMasters’s developer background
05:16 What a bug bounty program does
06:01 Why organizations run bug bounties
07:50 Building a relationship with researchers
09:57 Bug bounty versus penetration testing
12:21 The findings a bounty can uncover
14:37 Payouts and program budgets
17:20 Public and private bug bounties
18:08 Operational maturity before launch
19:59 Reputation in the researcher community
22:03 Incident response and remediation workflows
24:06 Common bug bounty mistakes
25:03 Applying empathy to program decisions
28:00 Final takeaways

Apollo Clark -- Malicious User Stories May 22, 2018

How do you turn a security requirement into something a development team can build and test? Apollo Clark explains malicious user stories: short descriptions of what a particular attacker should not be able to accomplish. Speaking at the Source Conference in Boston, he connects these stories to business goals, regulatory requirements, and automated tests in a delivery pipeline. Apollo then steps back to define DevOps through values, feedback, and continuous learning rather than a shopping list of tools. The discussion follows those ideas into practical automation with Gauntlt, reusable security checks, containers, and infrastructure deployment. He shares lessons from working with executives and engineers, arguing that security succeeds when teams agree on outcomes and translate them into repeatable technical practices.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Apollo Clark:
→ Apollo Clark on GitHub

Mentioned in this episode:
→ Gauntlt
→ The DevOps Handbook
→ Terraform

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Malicious user stories with Apollo Clark
01:41 Apollo’s security origin story
03:14 From user personas to malicious user stories
05:12 Writing testable attacker-focused outcomes
05:50 Translating regulations into security stories
07:22 Integrating the stories into DevOps
08:37 Defining DevOps through values and the three ways
11:59 Putting security into automated delivery
13:00 OWASP contributions and Gauntlt
15:35 Running security checks with containers
19:10 Gauntlt’s direction and practical limitations
19:39 Automating infrastructure deployment
20:38 Start with what your organization values

Megan Roddie -- Neurodiversity in Security May 15, 2018

Could familiar hiring and management practices be keeping talented people out of security? Megan Roddie draws on her own experience to discuss neurodiversity and the strengths autistic people can bring to security teams. Recorded at the Source Conference in Boston, the conversation explores deep focus, sustained curiosity, communication differences, and the assumptions that can shape interviews. Megan explains why rigid job descriptions may discourage capable applicants and why managers should learn how each person works rather than rely on a single model of a good employee. Robert also shares his perspective as a parent. Together they discuss clearer expectations, two-way communication, and recognizing individual strengths, offering a practical invitation to make security workplaces more welcoming and effective for different kinds of minds.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Megan Roddie:
→ Megan Roddie-Fonseca on LinkedIn

Mentioned in this episode:
→ DEF CON
→ Black Hat

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Neurodiversity in security with Megan Roddie
01:30 Why Megan brought this topic to the conference
02:08 Megan’s security origin story
03:29 Understanding neurodiversity and autism
05:14 Strengths that different minds bring to security
06:43 Addressing employers’ concerns
07:58 Supporting strengths and individual needs
09:54 Reaching candidates through better hiring practices
12:50 When rigid job descriptions discourage applicants
13:53 Managing through clear two-way communication
16:18 Final advice for inclusive teams

Chase Schultz -- AppSec and Hardware Apr 27, 2018

Where does application security end when software controls bootloaders, firmware, processors, and connected devices? Chase Schultz joins Chris for a wide-ranging discussion of the boundary between AppSec and hardware security. They examine secure coding in embedded systems, trusted boot, firmware signing, coprocessor supply chains, ASLR, and the no-execute bit before unpacking Meltdown and Spectre. Chris explains how speculative execution and processor caches created paths to sensitive memory, while Chase connects the mitigations to defense in depth and threat modeling. The episode shows that familiar software-security practices still matter near the hardware, even when vulnerabilities ultimately require changes to operating systems, microcode, or silicon.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Chase Schultz:
→ Chase Schultz on LinkedIn

Mentioned in this episode:
→ Meltdown and Spectre
→ U-Boot
→ Docker

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Where AppSec meets hardware
01:44 Chase Schultz’s security origin story
06:23 Old AppSec problems in new connected devices
07:47 Microarchitecture attacks and processor optimizations
08:48 Secure coding for hardware and firmware
11:20 Coprocessor supply chains and bootloaders
14:24 Trusted boot and firmware signing
16:37 ASLR, no-execute, and hardware defenses
17:20 How Meltdown and Spectre work
21:46 Speculative execution and access to memory
23:29 Kernel memory, containers, and cloud impact
24:46 Mitigating flaws that live in processors
26:11 Address space layout randomization
28:18 Could threat modeling have found the problem?
30:44 Closing thoughts

John Melton -- #OWASP AppSensor Apr 20, 2018

Your application knows when a user does something that should be impossible, but does that knowledge help stop an attack? John Melton explains OWASP AppSensor, a project that combines guidance with an implementation for detecting and responding to suspicious behavior inside applications. Using examples such as access to another customer’s bank account and unexpected jumps through a workflow, he shows how business context can reveal attacks that generic defenses miss. John describes detection points, event thresholds, response options, and integrations that connect applications to an AppSensor server. He also distinguishes the approach from conventional runtime protection tools and explains why threat modeling helps teams choose meaningful events. His practical starting point is a small proof of concept, built on centralized logging and tuned with real observations.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with John Melton:
→ John Melton on GitHub
→ AppSensor source code

Mentioned in this episode:
→ OWASP AppSensor
→ Spring Security
→ ModSecurity

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Building self-defending applications with AppSensor
04:40 What AppSensor is
07:03 Bank-account access as a detection example
09:13 Turning suspicious events into attack signals
11:07 Choosing a response to detected attacks
12:13 Server architecture and integration options
15:35 Supporting applications beyond Java
18:05 How AppSensor differs from RASP
22:03 Rules and event thresholds
24:01 Using threat modeling to choose detection points
25:49 Combining conditions with Boolean rules
26:43 Getting started with a small proof of concept

David Habusha -- Third Party Software is not a Cathedral, It’s a Bazaar Apr 13, 2018

An application can inherit serious vulnerabilities from code its developers never wrote. David Habusha, then a product leader at WhiteSource, explains the problem behind the 2017 OWASP Top 10 category on components with known vulnerabilities. He brings a product-management perspective to the discussion, connecting dependency choices to business outcomes and the realities of modern development. Chris and Robert ask why static and dynamic testing may miss this problem, what software composition analysis actually identifies, and how accurate component matching can be. The conversation uses Apache Struts and the Equifax breach to examine inventory, notification, and remediation. David closes by describing open source as a bazaar rather than a cathedral, where continuous awareness and maintenance matter more than expecting any component to remain permanently safe.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with David Habusha:
→ David Habusha on LinkedIn

Mentioned in this episode:
→ OWASP Top 10 2017 — Vulnerable Components
→ WhiteSource — now Mend.io
→ Apache Struts vulnerability CVE-2017-5638

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Understanding vulnerable third-party components
01:30 David’s security background
04:09 A product manager’s perspective on AppSec
08:48 What components with known vulnerabilities means
12:28 How much software comes from dependencies?
14:54 The consequences of vulnerable components
18:14 Why SAST and DAST are not enough
20:35 What software composition analysis does
24:02 Accuracy and component identification
27:29 What the Equifax breach teaches about SCA
32:58 Why dependency security is continuous work

Steve Springett -- Dependency Check and Dependency Track Apr 12, 2018

Finding a vulnerable library in one build is only the beginning: how do you find every affected application across an organization? Steve Springett explains how OWASP Dependency-Check and Dependency-Track complement each other in a software composition analysis program. He starts with the ingredients of modern applications, then distinguishes build-time analysis from maintaining a portfolio-wide inventory that can respond to newly disclosed vulnerabilities. The conversation covers language support, dependency updates, vulnerability data quality, and the differences between open-source and commercial tools. Steve offers practical guidance for integrating checks into build pipelines, triaging findings with developers, and making security part of engineering culture. He also looks beyond reactive vulnerability chasing toward software that is easier to maintain and update throughout its life.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Steve Springett:
→ Steve Springett on GitHub

Mentioned in this episode:
→ OWASP Dependency-Check
→ OWASP Dependency-Track
→ National Vulnerability Database
→ SPDX

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Dependency-Check and Dependency-Track with Steve Springett
04:29 Understanding software composition analysis
05:56 Why dependency visibility matters
08:31 Equifax and the challenge of upgrading components
11:58 The origins of Dependency-Check
15:32 Language support and build analysis
16:50 Why Dependency-Track was created
18:40 Tracking vulnerabilities across a portfolio
23:06 How the two projects work together
26:48 Open-source and commercial SCA tools
28:50 Vulnerability data quality and noise
33:08 Starting with build integration
36:01 Helping developers triage findings
38:12 Overcoming adoption objections
41:44 The future of dependency security
45:03 Toward continuously updated software

Steven Wierckx -- The #OWASP Threat Modeling Project Apr 06, 2018

Can a threat modeling community bring different methods together without forcing everyone into the same process? Steven Wierckx explains the goals of the OWASP Threat Modeling Project and the work that grew out of the security summit. He describes a vendor-neutral, methodology-neutral collection of knowledge organized around four questions: what are we building, what can go wrong, what will we do about it, and did we do enough? Chris and Robert explore how examples, reference models, and open discussion could help practitioners compare approaches and adapt them to agile development. Steven also explains the relationship between documentation and tools such as Threat Dragon. The episode closes with how working sessions and community contributions can turn shared experience into practical resources.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Steven Wierckx:
→ Steven Wierckx on LinkedIn

Mentioned in this episode:
→ OWASP Threat Modeling Project
→ OWASP Threat Dragon
→ Open Security Summit 2018 archive

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 The OWASP Threat Modeling Project
01:11 Steven’s security origin story
04:04 How the summit shaped the project
07:42 What methodology-neutral threat modeling means
10:46 The four common threat modeling questions
12:30 Building a community of practitioners
15:34 Example models and the project roadmap
20:05 How documentation and Threat Dragon fit together
24:15 Planning the Open Security Summit
27:48 Turning working sessions into published resources
30:28 How to participate in threat modeling

Jim Manico -- The #OWASP Cheat Sheet Project Apr 05, 2018

Developers need concrete security answers, but finding trustworthy guidance can take longer than writing the code. Jim Manico explains how the OWASP Cheat Sheet Series turns specialist knowledge into focused, practical references. He describes the project’s origins, the contributors who keep it useful, and how topics move from an idea to reviewed guidance. The conversation explores how developers can navigate subjects such as authentication, access control, and cross-site scripting, and how the cheat sheets complement the OWASP Proactive Controls. Jim also discusses maintenance, drafts, and the challenge of keeping recommendations accurate as technology changes. Alongside a look at his other OWASP work, he invites listeners to review, improve, or finish a resource rather than wait for somebody else to do it.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Jim Manico:
→ Jim Manico — Manicode Security

Mentioned in this episode:
→ OWASP Cheat Sheet Series
→ OWASP Proactive Controls
→ OWASP Java Encoder

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Practical security guidance with Jim Manico
01:54 Jim’s work across OWASP projects
07:08 Open-source projects are a team effort
08:18 What the Cheat Sheet Series provides
09:37 How the project started
11:16 Recruiting contributors and choosing topics
13:28 Keeping security recommendations current
15:50 How developers can use the cheat sheets
19:19 Understanding draft and beta guidance
21:43 Finding a useful way to contribute
23:55 The roadmap for new cheat sheets
26:40 A call to help improve OWASP guidance

Neil Smithline -- OWASP Top 10 #10: Logging Mar 23, 2018

A log file does little good if nobody can use it to detect or investigate an attack. Neil Smithline, a co-leader of the OWASP Top 10, explains why insufficient logging and monitoring became a new category in the 2017 edition. Chris and Robert explore the connection between application events, operational monitoring, and incident response, including what investigators lose when useful evidence is missing. Neil discusses security checklists, relevant OWASP guidance, and the difficult balance between recording enough context and exposing sensitive information. The conversation also considers automation, runtime instrumentation, and closer cooperation between development and response teams. Its central challenge is moving beyond a compliance checkbox toward logs that are protected, reviewed, and connected to meaningful action when something goes wrong.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Neil Smithline:
→ Neil Smithline on GitHub

Mentioned in this episode:
→ OWASP Top 10 project repository
→ OWASP Logging Cheat Sheet
→ OWASP ASVS
→ OWASP AppSensor

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Logging and monitoring in the OWASP Top 10
01:45 What insufficient logging and monitoring means
04:03 Generating useful events and reviewing them
05:58 Why incident response depends on logs
08:43 Assessing logging with a checklist
11:57 OWASP resources for better logging
12:57 Lessons from real incidents
15:47 Avoiding sensitive information in logs
18:15 Passwords, account identifiers, and data exposure
20:34 What better logging could look like
23:31 Could runtime instrumentation help?
27:14 Connecting developers and incident responders
31:13 Moving beyond compliance-only logging

Jim Routh -- Selling #AppSec Up The Chain Mar 15, 2018

What if the strongest argument for funding application security is better software delivery rather than fear of a breach? Jim Routh draws on building five software security programs to explain how he makes the case to executives. He connects security with quality, productivity, and the cost of fixing defects, then distinguishes the language that works with business leaders from the conversations practitioners have about risk. Chris and Robert ask how to put that case into practice, build developer participation, and use security champions to extend a program’s reach. Jim also explores board attention, industry crises, and the choices that determine whether a program scales. The conversation offers a leader’s perspective on earning investment by making secure development part of how the business succeeds.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Jim Routh:
→ Jim Routh on LinkedIn

Mentioned in this episode:
→ BSIMM
→ Meltdown and Spectre

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Making the executive case for AppSec
01:41 Jim’s route into security leadership
03:54 The state of enterprise software security
07:46 Connecting security with quality and productivity
08:27 How Jim wins funding for security programs
16:39 When to talk about risk
21:37 Turning the business case into a program
25:31 Software security and executive attention
29:40 Using industry crises to drive improvement
35:23 Why security champions help programs scale
36:17 The next challenges for software security

Chris and Robert -- #AppSec Recommendations Mar 09, 2018

Which books, sites, conferences, and communities are genuinely useful for learning application security? Chris and Robert compare their personal recommendations and explain what each resource offers. Their list moves from foundational software design and architecture books to secure development, threat modeling, web security, DevOps, checklists, blogs, recorded talks, and local conferences. They discuss learning from Irongeek and YouTube, following practitioners such as Troy Hunt, and using gatherings like BSides, SOURCE, and Black Hat to build relationships as well as technical knowledge. The episode is not a ranked shopping list; it is a guide to assembling a balanced learning practice from books, current writing, hands-on material, video, and community participation.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Chris Romeo and Robert Hurlbut:
→ Chris Romeo on LinkedIn
→ Robert Hurlbut on LinkedIn

Mentioned in this episode:
→ Agile Application Security: Enabling Security in a Continuous Delivery Pipeline
→ Iron Geek
→ The DevOps Handbook
→ Threat Modeling: Designing for Security
→ The Tangled Web: A Guide to Securing Modern Web Applications
→ Start with Why: How Great Leaders Inspire Everyone to Take Action
→ Books by Martin Fowler
→ Troy Hunt
→ Have I Been Pwned
→ Google Alerts
→ The Checklist Manifesto: How to Get Things Right
→ BSides
→ Black Hat

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Chris and Robert’s AppSec recommendations
01:25 Building a balanced learning list
02:47 Foundational design and architecture books
04:36 Secure development books
06:03 Core software security
07:35 Irongeek, YouTube, and recorded talks
09:25 Threat modeling books
12:07 Security blogs and current writing
13:58 AppSec conferences
15:19 SOURCE, BSides, and Black Hat
16:44 Why local conferences matter
19:45 Web application security references
21:40 Learning from practitioners
24:49 The Checklist Manifesto
27:01 Community and final recommendations

Magen Wu -- Hustle and Flow: Dealing With Burnout in Security Mar 02, 2018

In a profession that rewards constant vigilance, how do you recognize when dedication has become burnout? Magen Wu joins Chris and Robert to discuss chronic stress, workplace expectations, and the pressure security practitioners can put on themselves. Drawing on her personal experience and interest in psychology, she explains why always being available can become a team norm and why taking a real break can feel surprisingly difficult. The conversation explores boundaries around phones and email, sleep, hobbies away from computers, and the importance of recovery after intense work. Magen also describes changes that friends and colleagues might notice and ways to start a more useful conversation than simply asking whether someone is fine. It is a candid discussion about sustaining a career without sacrificing the person doing the work.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Magen Wu:
→ Magen Wu on LinkedIn

Mentioned in this episode:
→ DEF CON
→ Tim Ferriss’s blog

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Burnout in security with Magen Wu
02:00 Magen’s security origin story
04:35 What burnout can feel like
07:05 Why security work can amplify chronic stress
10:50 How company culture sets unhealthy expectations
12:39 Taking a real break from work
13:41 The pressure to feel indispensable
15:16 Sleep, boundaries, and recovery
18:12 Phones, social media, and attention
21:57 Hobbies and time away from computers
23:28 Recognizing changes in friends and coworkers
25:42 Starting a supportive conversation
29:48 Knowing when to hustle and when to recover

Katy Anton -- OWASP Top 10 #4 XXE Feb 23, 2018

A feature built into XML processing can become a path to file disclosure, internal requests, or denial of service. Katy Anton explains XML External Entities, the category added as A4 in the 2017 OWASP Top 10, and why developers need to understand their parser’s behavior. Chris and Robert ask how an XXE attack works, where the exposure appears in applications and web services, and how tools can help identify it. Katy walks through prevention options, including safer parser configuration and choosing simpler data formats when an application does not need XML’s capabilities. The discussion also considers legacy systems, developer education, and the difference between fixing an immediate configuration problem and reducing complexity over time. It is an accessible introduction to a frequently misunderstood vulnerability class.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Katy Anton:
→ Katy Anton on LinkedIn

Mentioned in this episode:
→ CWE-611 — XML External Entity Reference
→ OWASP XXE Prevention Cheat Sheet
→ OWASP Proactive Controls

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Understanding XXE with Katy Anton
01:42 OWASP Proactive Controls and community work
03:12 What XML External Entities means
06:07 When a parser feature becomes an attack
07:21 Parser defaults and affected applications
09:46 File disclosure and other XXE impacts
10:42 Denial of service and entity expansion
11:38 Finding XXE with testing and code review
13:14 Simpler data formats and JSON
15:52 Why applications still use XML
18:57 Preparing developers to address XXE
21:07 Hardening the XML parser
21:41 Immediate fixes and longer-term design choices

Pete Chestna -- SAST, DAST, and IAST. Oh My! Feb 15, 2018

Buying more scanners does not automatically create a better application security program. Pete Chestna explains SAST, DAST, IAST, runtime protection, and composition analysis, then connects those technologies to the developers who must use their results. Starting from a listener’s question about false positives, he explores speed, accuracy, workflow integration, and the difference between a real flaw and an accepted risk. Pete offers a gradual approach for a new program: understand the application inventory, establish a baseline, train developers, and improve one weakness category at a time. For more mature teams, he discusses combining metrics, preventing new vulnerabilities, and retaining human testing where tools fall short. His central argument is that effective programs develop secure developers, with secure software following from that capability.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Pete Chestna:
→ Pete Chestna on LinkedIn

Mentioned in this episode:
→ Veracode
→ Brakeman

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Making sense of AppSec testing tools
00:47 Pete’s security origin story
03:01 SAST, DAST, IAST, RASP, and SCA explained
07:25 Tool maturity and deployment models
09:08 Developer concerns: speed, accuracy, and integration
12:51 Compensating controls and risk decisions
14:18 Security knowledge and developer motivation
16:37 Starting a new AppSec program
18:05 Baseline measurement before enforcement
20:34 Improving one weakness category at a time
23:46 Preventing new vulnerabilities
25:06 The goal is secure developers
26:43 Combining data in a mature program
28:43 Where penetration testing still adds value
31:18 Open-source testing tools and tradeoffs

Irene Michlin -- We Are Not Making It Worse Feb 09, 2018

When a team is already ten sprints into a product, stopping to threat model everything can sound impossible. Irene Michlin explains an incremental approach: examine the next change, keep the discussion bounded, and make sure new work does not make the system worse. Drawing on her experience as a developer and security practitioner, she describes how short exercises build confidence and how threat modeling improves testing and shared architectural understanding. Chris and Robert explore what to do about existing security debt, how to record threats in the team’s normal work tracker, and where security stories and acceptance criteria fit. Irene also discusses whiteboards, the Microsoft Threat Modeling Tool, and STRIDE, emphasizing a repeatable thinking habit that can keep pace with agile development.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Irene Michlin:
→ Irene Michlin on LinkedIn

Mentioned in this episode:
→ Microsoft Threat Modeling Tool

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Incremental threat modeling with Irene Michlin
01:21 Irene’s path from development into AppSec
05:05 Security products still need product security
06:41 The wider benefits of threat modeling
09:04 Starting with the next sprint’s changes
11:24 Handling existing security debt
13:46 Teaching a lightweight modeling process
17:21 Using a timer to build confidence
18:28 Keeping threats in the team’s work tracker
20:19 Security stories and acceptance criteria
23:16 Defining done for security work
24:24 Choosing tools for fast threat modeling
27:06 Using STRIDE as a foundation
29:07 Adding context-specific threats

Bill Sempf -- Insecure Deserialization Feb 02, 2018

What happens when data arriving at an application is allowed to recreate objects and trigger unexpected behavior? Bill Sempf joins Chris and Robert to unpack insecure deserialization, a new category in the 2017 OWASP Top 10. He explains serialization through familiar programming examples and describes the research questions that drew him into the topic. The conversation follows attacks across language ecosystems, discusses the possible impact of accepting untrusted serialized objects, and considers ways to reduce exposure. Bill also shares how an assessor might recognize serialized data, investigate application behavior, and use an intercepting proxy during testing. Alongside his work in the .NET security community, this archive conversation captures practitioners working through a difficult vulnerability class and debating the limits of their tools and assumptions.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Bill Sempf:
→ Bill Sempf’s developer profile

Mentioned in this episode:
→ OWASP Top 10 project repository
→ ZAP
→ Burp Suite

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Insecure deserialization with Bill Sempf
01:14 Bill’s security origin story
06:54 Filling gaps in .NET security guidance
08:05 Why deserialization entered the 2017 Top 10
10:48 Researching examples across platforms
12:22 Serialization and deserialization explained
15:54 The impact of malicious serialized objects
17:35 Reducing deserialization risk
23:09 ViewState and framework considerations
24:37 Debating .NET and language-specific behavior
27:29 Recognizing serialized data during an assessment
28:53 Investigating with intercepting proxies
30:31 What testing tools can find

Chris and Robert -- Security Champions Jan 26, 2018

What is a security champion, and how can an organization build a program that lasts? Chris and Robert compare definitions, alternative titles, and the qualities that make a champion effective. They explain why interest and influence often matter more than formal authority, why champions can come from development, testing, product, or other roles, and how the network supports a secure development lifecycle. The conversation connects champions to security culture, two-way communication, and scalable expertise. It also covers program mechanics: role definitions, goals, training, recognition, management support, and a dependable operating cadence. Rather than treating champions as unpaid security staff, Chris and Robert describe a community that helps teams make better decisions while keeping responsibility shared across the organization.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Chris Romeo and Robert Hurlbut:
→ Chris Romeo on LinkedIn
→ Robert Hurlbut on LinkedIn

Mentioned in this episode:
→ Do you have Security Champions in your company?

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 All things security champions
01:18 How the idea has evolved
03:19 A programmatic definition
05:40 Champions in the secure development lifecycle
07:21 Alternative names and the meaning of champion
10:06 Who makes an effective champion
12:32 Start with genuine interest
14:15 Influence across teams
16:52 Champions as a driver of security culture
18:57 Two-way communication and community
21:04 Management support and recognition
23:30 Role definitions, goals, and training
25:05 Building a sustainable program

Kevin Greene -- Shifting left Jan 19, 2018

Moving a security scanner earlier in the pipeline is not the same as building security into development. Kevin Greene explains what shifting left should mean and why rapid delivery exposes weaknesses in both security strategy and testing tools. Drawing on his work across industry, government research, and MITRE, he argues for capturing practitioners’ experience so teams can apply it repeatedly rather than depend on individual intuition. Chris and Robert explore that idea through threat modeling, architectural decisions, and adversary knowledge. Kevin discusses the Common Architectural Weakness Enumeration, CAPEC, and ATT&CK as ways to connect design choices with realistic failure and attack scenarios. The conversation challenges teams to improve the thinking behind their automation and bring developers usable security knowledge before problems become expensive defects.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Kevin Greene:
→ Kevin E. Greene’s website

Mentioned in this episode:
→ MITRE CAPEC
→ MITRE ATT&CK

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Shifting left with Kevin Greene
02:05 Kevin’s security origin story
05:43 Security across government and industry
07:39 What shifting left should mean
11:42 Why DevOps security efforts struggle
12:40 Strategy and the limits of testing tools
17:04 What it means to codify intuition
22:02 Turning experience into threat modeling knowledge
24:24 Architectural decisions and CAWE
26:55 Using CAPEC and ATT&CK
29:00 Bringing adversary knowledge into development

Conclusion: OWASP is for everyone Dec 05, 2017

Why does OWASP matter beyond its famous Top 10 list? The Season 2 finale revisits guests who demonstrate the breadth of the foundation’s work. John Melton explains AppSensor, Andrew van der Stock and Brian Glas discuss Top 10 governance and data, Mike Goodwin walks through Threat Dragon, Jim Manico and Katy Anton explain Proactive Controls, Tanya Janca and Nicole Becher introduce DevSlop, and Tin Zaw describes ModSecurity. The clips connect guidance, tools, standards, training applications, and community participation. Chris and Robert frame the episode as an invitation: OWASP is not reserved for established security experts. Developers, testers, project leaders, documenters, and newcomers can all learn from the projects and contribute to making them more useful.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Chris Romeo and Robert Hurlbut:
→ Chris Romeo on LinkedIn
→ Robert Hurlbut on LinkedIn

Mentioned in this episode:
→ OWASP Top 10
→ OWASP AppSensor
→ OWASP Threat Dragon
→ OWASP Top 10 Proactive Controls
→ OWASP DevSlop
→ Pixi (DevSlop)
→ OWASP ModSecurity Core Rule Set
→ Microsoft Threat Modeling Tool

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Season 2 and the breadth of OWASP
00:50 John Melton on OWASP AppSensor
04:55 Andrew van der Stock and Brian Glas on Top 10 governance
09:54 Balancing data for the OWASP Top 10
12:55 Mike Goodwin on OWASP Threat Dragon
14:24 The Threat Dragon workflow
17:14 Jim Manico and Katy Anton on Proactive Controls
23:12 Tanya Janca and Nicole Becher on DevSlop
27:25 Tin Zaw on ModSecurity
30:19 OWASP is for everyone

Brian Andrzejewski -- Containers Again Oct 24, 2017

Containers make deployment repeatable, but insecure images, excessive privileges, and unmanaged secrets can travel with them. Brian Andrzejewski shares lessons from introducing containers in a government environment and developing a more deliberate security approach. He explains why early choices such as SSH access need reconsideration, how orchestration changes operations, and why teams need policies for the images they trust. Chris and Robert explore running without unnecessary privileges, read-only filesystems, vulnerability checks, and the difference between protecting the container infrastructure and the application inside it. Brian also discusses secrets, maturity models, and the role of benchmarks and guidance. The conversation offers a practical progression from experimenting with Docker to operating containers with consistent controls, visible dependencies, and a plan for ongoing maintenance.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Brian Andrzejewski:
→ Brian Andrzejewski on LinkedIn

Mentioned in this episode:
→ Docker
→ Docker Hub
→ CIS Docker Benchmark
→ NIST SP 800-190 — Application Container Security Guide

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Container security with Brian Andrzejewski
00:46 Brian’s security origin story
03:33 Introducing containers in a government environment
05:33 SSH access and disposable containers
06:28 Moving toward orchestration
07:47 Policies for trusted container images
11:30 Privileges and read-only filesystems
12:55 A maturity model for container security
16:43 Dependency inventory and CVE checks
17:56 Rebuilding and checking running containers
19:53 Application security inside containers
22:32 Handling secrets
23:36 Lessons for teams getting started
26:43 Benchmarks and resources

Tin Zaw -- ModSecurity and #AppSec Oct 17, 2017

A web application firewall can buy time during a vulnerability crisis, but only if somebody understands and maintains its rules. Tin Zaw explains ModSecurity and the Core Rule Set, starting with where a WAF sits between users and an application. He distinguishes the rule engine from the rules themselves, describes embedded and proxy deployments, and explains how detection, blocking, and logging serve different purposes. The conversation uses the Apache Struts vulnerabilities as an example of virtual patching while a team prepares a software update. Chris and Robert also ask about writing signatures, sharing rules, tuning false positives, and the risks of adding another component to the stack. Tin closes with practical starting points for learning and contributing to open-source application protection.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Tin Zaw:
→ Tin Zaw on LinkedIn

Mentioned in this episode:
→ ModSecurity
→ OWASP Core Rule Set
→ Apache Struts

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 ModSecurity and application security with Tin Zaw
01:11 Tin’s security origin story
02:33 Contributing to OWASP projects
03:59 What a web application firewall does
04:42 Embedded and proxy WAF deployments
06:32 The ModSecurity engine and Core Rule Set
08:27 Using and extending security rules
09:31 Detection, blocking, logging, and virtual patching
11:19 Responding to an Apache Struts vulnerability
13:18 Writing signatures from vulnerability information
14:40 Sharing rules with the community
15:36 Tuning false positives and maintaining the WAF
17:37 Why choose an open-source WAF?
18:30 Managing the WAF’s own attack surface
19:59 Getting started and finding resources

Aditya Gupta -- The Exploitation of IoT Oct 10, 2017

Why can an IoT product look secure in one component and still fail as a complete system? Aditya Gupta, founder of Attify, joins Chris and Robert at AppSec USA to examine the gaps between hardware, firmware, radio communications, mobile applications, and web dashboards. He explains how fragmented development teams and unfamiliar protocols create security blind spots, and why authentication and secure design need attention before devices ship. The conversation covers resource constraints, firmware updates, physical access, and the way extracting information from one device can enable attacks against many others. Aditya also discusses practical learning resources and encourages developers to understand their entire product architecture rather than assuming that securing individual pieces will secure the whole.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Aditya Gupta:
→ Aditya Gupta and Attify

Mentioned in this episode:
→ Attify
→ OWASP IoT Top 10

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 The exploitation of IoT with Aditya Gupta
00:46 Aditya’s path from mobile security to IoT
02:03 Defining the Internet of Things
02:58 Where IoT development goes wrong
04:03 Security gaps between components and teams
05:48 Authentication failures and secure design
07:03 Practical security steps for developers
07:58 Protocol fragmentation and resource constraints
09:10 Designing the complete IoT system
11:17 Updating devices after deployment
17:30 How physical access exposes larger attack paths
20:48 Resources for learning IoT security

Jim Manico and Katy Anton -- The Future of the OWASP Proactive Controls Oct 03, 2017

Where should the OWASP Proactive Controls go after giving developers a concise defensive counterpart to the Top 10? Project leaders Jim Manico and Katy Anton discuss the document’s origins, intended audience, and plans for its next version. They explore how much implementation guidance belongs in a short list, whether data should shape future priorities, and how the controls relate to ASVS, cheat sheets, and other OWASP resources. The guests consider language-specific guidance and a future in which developers can move from a high-level control to concrete examples for their platform. Chris also asks how the community can review and contribute. The conversation captures an open-source project deciding how to remain approachable while becoming more useful to practicing software engineers.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Jim Manico and Katy Anton:
→ Jim Manico on LinkedIn
→ Katy Anton on LinkedIn
→ OWASP Proactive Controls

Mentioned in this episode:
→ OWASP Proactive Controls
→ OWASP ASVS
→ OWASP Cheat Sheet Series
→ NIST Digital Identity Guidelines

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 The future of OWASP Proactive Controls
02:43 A defensive counterpart to the Top 10
04:46 The project’s origin story
06:10 Priorities for the next version
09:11 Whether data should shape the controls
12:39 Mapping to ASVS and other projects
14:25 A five-year vision for the project
16:24 Language-specific developer guidance
17:24 How the community can contribute
18:50 Final thanks and next steps

Andrew van der Stock and Brian Glas -- The Future of the OWASP Top 10 Sep 25, 2017

How should the OWASP Top 10 balance data, expert judgment, community feedback, and a format people can actually use? Andrew van der Stock and Brian Glas discuss the governance and research behind the project’s next release during a contentious revision cycle. They explain how public comments affect decisions, why a large share of contributed data came from one source, and how the team planned to compare findings across applications. The conversation covers scoring, release candidates, the familiar one-page format, and connections to ASVS, Proactive Controls, and the Web Security Testing Guide. Chris presses them on what the list should become in the future and how listeners can participate. The result is a candid view of maintaining a widely influential community standard.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Andrew van der Stock and Brian Glas:
→ Andrew van der Stock on LinkedIn
→ Brian Glas on LinkedIn
→ OWASP Top 10

Mentioned in this episode:
→ OWASP Top 10
→ OWASP ASVS
→ OWASP Proactive Controls
→ OWASP Web Security Testing Guide
→ OWASP ESAPI

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 The future of the OWASP Top 10
02:21 Andrew van der Stock’s security origin story
05:30 Experience maintaining the project
06:36 Governance and decision-making
08:13 How public comments affect the release
10:57 Data concentration in the first candidate
13:15 Comparing findings across applications
16:07 Scoring and understanding impact
19:30 The origins of ASVS
21:22 Connecting the Top 10 to other OWASP projects
23:06 The release-candidate schedule
26:21 Preserving the one-page format
28:58 What the Top 10 should become
33:16 How listeners can participate
34:26 Final thoughts

Robert Hurlbut -- Threat Modeling Sep 19, 2017

How do you find security problems in a design before they become expensive changes to running software? In this recorded conference presentation, Robert Hurlbut explains threat modeling as a collaborative way to understand a system, identify threats, choose mitigations, and follow through on the results. He distinguishes threats from vulnerabilities, connects security work to business goals, and shows why developers, testers, architects, and stakeholders all belong in the conversation. Robert covers data flow diagrams, trust boundaries, attack trees, threat libraries, and card games that help teams ask better questions. A configuration-file example makes the process concrete. The talk closes with risk decisions, documenting requirements and defects, and revisiting the model as the application changes.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Robert Hurlbut:
→ Robert Hurlbut
→ Robert’s threat modeling resources

Mentioned in this episode:
→ CAPEC
→ OWASP ASVS
→ OWASP Proactive Controls
→ Elevation of Privilege
→ Attack Trees (Schneier)
→ Microsoft Threat Modeling Tool
→ OWASP Cornucopia

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Threat modeling for secure software design
00:50 Why secure design matters
06:51 Design flaws and the connected-car example
09:47 Threats, business goals, and collaborative modeling
21:00 Diagrams, trust boundaries, and identifying threats
33:22 Threat modeling games and practical questions
37:00 The configuration-file trust problem
38:28 Choosing mitigations and evaluating risk
42:15 Documenting findings and following through

Chris and Robert -- Passwords, Identity, and #AppSec Sep 12, 2017

Password advice changes as attackers, hardware, and identity standards evolve. Chris and Robert examine how passwords are guessed, cracked, stored, and reused, then compare long-standing habits with updated NIST guidance. They discuss dictionary attacks, hashing, salts, password length, composition rules, password managers, and the risks of knowledge-based questions. The conversation also explores checking proposed passwords against known breach data through Have I Been Pwned and the operational cost of doing that safely. Throughout, they separate user-facing policy from the developer’s responsibility to store and verify credentials correctly. The result is a practical review of why familiar password rules often fail and how modern applications can make authentication both safer and more usable.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Chris Romeo and Robert Hurlbut:
→ Chris Romeo on LinkedIn
→ Robert Hurlbut on LinkedIn

Mentioned in this episode:
→ NIST SP 800-63B
→ OWASP Password Storage Cheat Sheet
→ Troy Hunt
→ Have I Been Pwned
→ Enpass

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Passwords, identity, and application security
01:30 The reality of hundreds of passwords
03:21 Hardware advances and password cracking
05:15 Dictionary attacks
07:34 Hashing and password storage
09:28 Cracking weak hashes
10:48 Knowledge-based questions and social engineering
13:11 Changes in NIST guidance
14:36 Supporting long passwords
16:03 Password managers
17:42 Evaluating password-manager risk
19:17 Retiring forced periodic changes
21:27 Checking passwords against breach data
23:37 Operational cost and implementation choices
26:19 Maximum length and denial-of-service concerns
28:11 Why every password needs a unique salt
29:43 Slow password hashing
31:15 Final recommendations

Tanya Janca and Nicole Becher -- Hacking APIs and Web Services with DevSlop Sep 05, 2017

APIs may lack a visible interface, but that does not make them hidden or safe. Tanya Janca and Nicole Becher use OWASP DevSlop and its Pixi application to explain how developers and testers can learn API security hands-on. They cover HTTP fundamentals, authentication, rate limiting, proxies, curl, ZAP, and Burp Suite before showing how intentionally vulnerable applications turn those concepts into experiments. The conversation explores Pixi’s microservices, containerized design, planned capture-the-flag mode, and inspiration from OWASP Juice Shop and WebGoat. Tanya and Nicole also discuss the limits of automated scanners and the value of beginner-friendly CTFs. Their central recommendation is simple: interact with real APIs, observe the traffic, and practice breaking safe targets.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Tanya Janca and Nicole Becher:
→ Tanya Janca on LinkedIn
→ Nicole Becher on LinkedIn
→ OWASP DevSlop

Mentioned in this episode:
→ OWASP DevSlop
→ Pixi
→ OWASP ZAP
→ Burp Suite
→ OWASP Juice Shop
→ OWASP WebGoat
→ Docker

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Hacking APIs and web services with DevSlop
02:15 Nicole Becher’s security origin story
04:12 Learning AppSec through vulnerable applications
06:04 APIs, web services, and HTTP basics
08:27 Why an API is not invisible
10:42 Discovering API traffic with a proxy
12:30 Rate limiting and common API weaknesses
17:15 Using curl, ZAP, and Burp Suite
22:12 Pixi and the DevSlop application family
24:05 Containers and future modules
26:11 Building a capture-the-flag mode
28:15 Scanner limitations and better test targets
30:44 Why developers should try a CTF
32:47 Hands-on learning at AppSec USA

Jon Mccoy and Jonathan Marcil -- Agile #AppSec Aug 29, 2017

Agile delivery promises fast feedback, but where does application security fit when teams are already moving continuously? Jon McCoy and Jonathan Marcil join Chris and Robert to separate Agile principles from inconsistent enterprise interpretations and identify practical starting points. They discuss dedicated AppSec leadership, security-minded developers, continuous integration, static analysis, shared knowledge, and reusable components. The guests challenge the idea of a late security sprint and examine the real cost of building defenses early. They also explain how responsibility can be distributed without asking every developer to become a cryptography specialist. The episode closes with learning recommendations, community participation, and the principle that a mature AppSec program should help teams avoid repeating the same security mistakes.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Jon McCoy and Jonathan Marcil:
→ Jon McCoy on X
→ Jonathan Marcil on X

Mentioned in this episode:
→ Agile Manifesto
→ OWASP Top 10
→ OWASP Montreal

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Agile application security
01:54 Security origin stories
05:41 Development experience and security work
08:52 The advantages of fast feedback
10:11 What organizations mean by Agile
13:24 Where security fits
16:44 Starting an Agile AppSec program
20:02 Continuous integration and static analysis
23:02 Building a security knowledge base
27:54 Why a late security sprint fails
28:05 The real cost of building security early
32:44 Reusable controls and specialized responsibility
35:33 Additional first-year priorities
37:34 Learning through local communities
43:18 Avoiding the same mistakes over time

Jay Beale -- Docker Security and AppSec Aug 22, 2017

Does moving an application into Docker make it safer, or simply change the risks you need to manage? Jay Beale of InGuardians joins Robert to explain containers, how they differ from virtual machines, and why sharing a Linux kernel matters for security. He examines container breakouts, the danger of assuming isolation is stronger than it is, and practical defenses using Linux security controls. The conversation then turns to patching: teams need to rebuild and replace images, track the software they contain, and test updates before deployment. Jay connects those responsibilities to third-party application libraries and explains why container convenience does not remove operational accountability. He closes with resources for keeping pace with Docker and Linux security.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Jay Beale:
→ Jay Beale on LinkedIn
→ InGuardians

Mentioned in this episode:
→ Docker
→ Kubernetes
→ Linux kernel
→ LXC

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Docker security with Jay Beale
01:50 From Linux hardening to security consulting
05:36 Containers compared with virtual machines
10:35 Sharing the Linux kernel
14:35 Why Docker changed the developer workflow
16:08 Container breakouts and new security risks
21:53 Controls that reduce breakout risk
26:51 Rebuilding images and keeping containers patched
28:29 Finding vulnerable software in containers
32:53 Third-party libraries and application security
36:31 Testing updates before deployment
39:09 Where to keep learning about Docker security
42:55 Final advice and training resources

Chris and Robert -- Proactive Controls, AppSec USA, and Gartners MQ on AppSec Testing Aug 17, 2017

What can practitioners learn from a new OWASP document, an upcoming conference, and an industry analyst report in one conversation? Chris and Robert test a multi-topic format by reviewing Proactive Controls 3.0, previewing AppSec USA, and discussing Gartner’s application security testing market analysis. They examine renamed controls, digital identity guidance, conference learning and hallway conversations, and the range of testing products covered by the report. The hosts compare static, dynamic, interactive, and runtime approaches while questioning predictions about adoption and unfamiliar vendors. The episode captures a moment in the market rather than offering timeless rankings, but its method remains useful: read frameworks and analyst material critically, understand what each category measures, and investigate tools in the context of your own development program.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Chris Romeo and Robert Hurlbut:
→ Chris Romeo on LinkedIn
→ Robert Hurlbut on LinkedIn

Mentioned in this episode:
→ OWASP Proactive Controls
→ OWASP Proactive Controls
→ OWASP Threat Dragon Project
→ Contrast Security

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Three AppSec topics in one episode
01:36 OWASP Proactive Controls 3.0
02:58 Renamed and reorganized controls
04:15 Strong digital identity
05:36 Why AppSec USA matters
08:19 Fundamentals and advanced conference content
11:01 Meeting the podcast community
12:52 Gartner’s application security testing report
14:13 Predictions about testing adoption
16:36 Interactive and runtime testing
18:46 Unfamiliar vendors in the market
20:27 Using analyst reports as a starting point
22:34 Closing thoughts

Robert Hurlbut -- Blackhat Security Conference Aug 08, 2017

What should an application security professional take away from a conference famous for spectacular hacks? Robert Hurlbut shares his experience at Black Hat, including the relationship between Black Hat and DEF CON and what each offers developers and people entering security. Chris and Robert unpack Alex Stamos’s keynote message about neglected fundamentals, the limits of celebrating only advanced attacks, and the importance of a more inclusive security community. They discuss welcoming newcomers, learning from people with different backgrounds, and making the most of hallway conversations. This episode captures a particular moment in the conferences’ history while offering practical advice about participation: come ready to learn, meet people, and bring useful ideas back to your everyday work.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Robert Hurlbut:
→ Robert Hurlbut

Mentioned in this episode:
→ Black Hat
→ DEF CON

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Robert’s Black Hat conference takeaways
02:05 Black Hat and DEF CON explained
03:52 What AppSec practitioners can learn at the conferences
05:55 Alex Stamos’s keynote and security fundamentals
09:41 Inclusion and diversity in the security community
12:28 Welcoming people who are new to security
14:19 The value of HallwayCon and new connections

Dave Ferguson -- The OWASP Top 10 Proactive Controls Jul 25, 2017

Developers hear plenty about vulnerabilities, but what should they actually build into their applications to prevent them? Dave Ferguson joins the podcast to walk through the OWASP Top 10 Proactive Controls as they stood at the time of this recording. The discussion covers early security testing, parameterized queries, output encoding, input validation, authentication, access control, data protection, logging, security frameworks, and error handling. Dave connects the controls to familiar application risks and explains how OWASP cheat sheets provide the implementation detail behind the high-level guidance. Chris and Dave also debate where intrusion detection belongs and why security features should be reusable. The result is a developer-focused conversation about turning awareness of common failures into concrete engineering practices.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Dave Ferguson:
→ Dave Ferguson on LinkedIn

Mentioned in this episode:
→ OWASP Proactive Controls
→ OWASP Cheat Sheet Series
→ OWASP Top 10

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Proactive security controls with Dave Ferguson
07:40 A developer-focused security baseline
08:40 Verify security early and often
12:34 Parameterize queries
15:01 Encode data for its output context
18:14 Validate all inputs
23:07 Identity, authentication, and session management
25:25 Implement access controls
29:03 Protect data at rest and in transit
32:18 Logging and intrusion detection
36:32 Use security frameworks and libraries
38:33 Handle errors and exceptions securely
41:18 Turning vulnerability awareness into action

Jim Manico -- MORE OWASP! Jul 04, 2017

How can developers turn OWASP’s many projects into practical help with the code they write? Jim Manico joins Chris and Robert to discuss the resources he helps build and the problems each is meant to solve. He traces his move from software development into security education, then explains the OWASP Java Encoder and how its focused approach differs from a larger security library such as ESAPI. The conversation also explores the debate surrounding the 2017 OWASP Top 10, the value of the Cheat Sheet Series, and the developer-oriented Proactive Controls. Jim shares lessons from writing Iron-Clad Java and from teaching application security. Throughout, he emphasizes accessible guidance, sound security APIs, and community work that helps developers put defenses into practice.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Jim Manico:
→ Jim Manico on LinkedIn
→ Manicode Security

Mentioned in this episode:
→ OWASP Java Encoder Project
→ OWASP ESAPI
→ OWASP Cheat Sheet Series
→ OWASP Proactive Controls

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 OWASP projects with Jim Manico
01:01 From software development to security education
02:27 Learning security as a developer
05:12 Joining and contributing to OWASP
10:32 The OWASP Java Encoder
11:56 Java Encoder compared with ESAPI
13:24 Bringing safer APIs into the platform
20:00 The debate around the OWASP Top 10
24:16 Collaboration at the OWASP Summit
25:33 How to use the Cheat Sheet Series
28:10 Proactive Controls for developers
29:25 Writing Iron-Clad Java
31:55 Life, teaching, and opportunities in AppSec

Mike Goodwin -- The OWASP Threat Dragon Jun 27, 2017

Threat modeling is easier to adopt when its tools fit the way developers already work. Mike Goodwin joins Chris and Robert to introduce the early OWASP Threat Dragon project and explain why he wanted an accessible alternative to tools tied to a single operating system. They walk through creating diagrams, recording threats, and keeping models alongside application code in GitHub. Mike describes his plans for automated threat suggestions, workflow integration, and reminders that keep models from becoming stale. The discussion also considers collaboration, combining feature-level models, and what new users need to understand about STRIDE. This archive conversation documents the project’s initial ambitions and invites developers to help shape a simpler, more integrated approach to threat modeling.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Mike Goodwin:
→ Mike Goodwin on GitHub
→ OWASP Threat Dragon

Mentioned in this episode:
→ Threat Dragon source code
→ Microsoft Threat Modeling Tool

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Mike Goodwin and OWASP Threat Dragon
01:19 A cloud migration sparks an interest in security
02:59 What Threat Dragon is designed to do
04:31 Why build another threat modeling tool?
06:17 The limitations of a Windows-only workflow
07:17 Creating a model in Threat Dragon
12:15 Threat generation and future capabilities
13:39 Keeping threat models beside code in GitHub
15:50 Connecting models to developer workflows
20:18 What organizations need from modeling tools
21:30 Concurrent editing and combining models
24:02 STRIDE and the knowledge new users need
25:00 The early roadmap toward beta and version one
27:18 Giving feedback and contributing

Mark Willis -- I Just Like Static Analysis. Static Analysis is My Favorite Jun 19, 2017

Static analysis can help developers find security flaws early, but buying a scanner does not create an effective program. Mark Willis joins Chris and Robert to explain how he fits testing into the software development lifecycle and works with developers to make results useful. They discuss choosing tools for the actual codebase, tuning recurring false positives, and evaluating products before committing to them. The conversation weighs scan coverage against the pace of DevOps and considers when dynamic testing and a deeper penetration test are appropriate. Mark also describes finding developers who want to become security champions and helping them build their skills. The recurring theme is collaboration: useful testing depends on context, timely feedback, and respect for the people fixing the code.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Mark Willis:
→ Mark Willis at RSA Conference

Mentioned in this episode:
→ OWASP
→ OWASP Testing Guide

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Static analysis and developer collaboration with Mark Willis
01:12 Mark’s journey from development into security
07:19 Empathy for the people writing the code
10:42 Placing static analysis in the SDLC
14:23 Tuning tools and reducing false positives
16:27 Evaluating scanners before buying
19:20 Static analysis at DevOps speed
23:02 What dynamic scanners can and cannot do
28:05 Working within the testing and release window
31:13 Choosing applications for deeper penetration testing
33:43 Helping developers move into security
36:51 Learning with the OWASP Testing Guide

Eric Johnson -- Continuous Integration in .NET Jun 14, 2017

Security testing loses value when its results arrive outside the developer’s normal workflow. Eric Johnson joins the podcast to explain how continuous integration can make security checks part of building and delivering software, with a particular focus on .NET. He discusses connecting automated tools to development pipelines and using feedback where engineers already work. Eric then introduces Puma Scan, an open-source security analyzer built on the Roslyn compiler platform, and describes how compiler-aware rules can identify insecure code while developers are editing it. The conversation compares that approach with older .NET analysis options and considers how the wider community can contribute. It is a practical look at reducing the distance between writing code, finding a flaw, and fixing it.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Eric Johnson:
→ Eric Johnson on LinkedIn
→ Puma Scan

Mentioned in this episode:
→ Roslyn (.NET Compiler Platform)
→ Jenkins
→ OWASP ZAP
→ Find Security Bugs
→ Brakeman

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Continuous integration and .NET security with Eric Johnson
02:53 Eric’s development and security background
04:57 Teaching application security
08:17 Bringing security checks into continuous integration
10:05 Using the tools developers already rely on
12:59 Why focus on .NET and Roslyn?
15:13 Building security rules and Puma Scan
18:26 Using Puma Scan inside Visual Studio
21:25 Filling the open-source .NET scanning gap

Matt Clapham -- The Technical Debt Ceiling Jun 06, 2017

Every software organization accumulates technical debt, but security debt raises the cost and risk of every future change. Matt Clapham joins Chris at the Converge conference to explain how startups and enterprises incur debt through rushed decisions, flawed architectures, outdated dependencies, and products that outlive their original assumptions. They distinguish general technical debt from security-specific consequences, examine the effect on development and operations, and discuss ways teams can keep the problem visible. Matt argues for deliberate limits—a technical debt ceiling—supported by refactoring, dependency maintenance, prioritization, and clear ownership. The goal is not zero debt, but a sustainable level that does not prevent teams from improving or securing the product.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Matt Clapham:
→ ProdSec on X
→ Converge Detroit

Mentioned in this episode:
→ Converge Detroit
→ OWASP Dependency-Check

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Defining the technical debt ceiling
01:41 Technical debt in IoT and application security
02:58 People, process, and technology causes
05:19 How enterprises accumulate debt
06:58 Technical debt versus security debt
08:08 The impact of a flawed foundation
09:59 Reducing and managing technical debt
12:16 Third-party software and dependency risk
13:30 Products that never update components
16:25 Additional strategies for sustainable systems
18:20 Setting a practical debt goal
19:17 Resources and final recommendations

Chris and Robert -- Controversy within the OWASP Top 10 RC May 30, 2017

Why did the 2017 OWASP Top 10 release candidate provoke such a strong reaction? Chris and Robert walk through the proposed categories, compare them with earlier editions, and examine the project’s role as both awareness document and de facto testing target. They discuss merged and removed risks, injection, authentication, sensitive data, XML external entities, access control, cross-site scripting, insecure deserialization, components with known vulnerabilities, and insufficient attack protection. The hosts question whether new categories are sufficiently general, whether tools and frameworks already address some risks, and how modern APIs and microservices affect the list. The episode preserves the uncertainty of a release-candidate debate while helping listeners understand the technical and governance questions behind a widely used standard.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Chris Romeo and Robert Hurlbut:
→ Chris Romeo on LinkedIn
→ Robert Hurlbut on LinkedIn

Mentioned in this episode:
→ OWASP Top 10
→ OWASP Top 10 2017
→ OWASP AppSensor Project
→ OWASP Top 10 A9 (Using Components with Known Vulnerabilities)

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 The controversial OWASP Top 10 candidate
01:25 The Top 10’s history and influence
03:17 How tools use the list
05:08 Reaction to the 2017 release candidate
06:36 Merged and renamed categories
08:01 Removed risks
09:20 Framework protections and remaining responsibility
11:13 Injection and authentication
13:47 Which risks apply beyond web applications
15:14 Cross-site scripting and browser defenses
16:46 Access control must be consistent
18:37 Automating security verification
20:20 Insufficient attack protection
22:01 Application-level detection and response
23:53 Insecure deserialization
25:48 Components with known vulnerabilities
27:09 APIs, microservices, and attack surface
29:00 Security through obscurity
31:00 Final assessment of the candidate

Brook S.E. Schoenfield -- Security in the Design and Architecture May 22, 2017

Fixing vulnerable code is only part of application security; a flawed design can survive every code-level check. Brook S. E. Schoenfield joins Chris and Robert at RSA Conference to explain what security architects do and how they reason about systems before and during implementation. He connects threat modeling to architecture, business priorities, and the practical limits on what a team can change. The discussion explores collaboration between architects and developers, the value of empowering engineering teams, and the communication skills needed to make security advice useful. Brook also reflects on learning from experience and offers a path for people who want to become security architects. The emphasis is on understanding the system and its people well enough to make better design decisions.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Brook S.E. Schoenfield:
→ Brook Schoenfield
→ Brook Schoenfield on LinkedIn

Mentioned in this episode:
→ IEEE Center for Secure Design
→ FAIR Institute
→ Cyber Kill Chain (Lockheed Martin)

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Security in design and architecture with Brook Schoenfield
02:41 Brook’s security origin story
06:23 Understanding the application security design problem
08:24 What a security architect does
11:24 Connecting architecture and threats
16:59 Turning experience into a better approach
26:08 Working within business priorities and constraints
33:08 Helping developers and architects collaborate
34:01 Organizational structures and shared ownership
43:28 Empowering teams with lightweight security practices
46:26 Becoming a security architect

Conclusion: The End…of Season 1 Jan 25, 2017

What defined the first season of the Application Security Podcast? Chris and Robert revisit clips that established the show’s early themes: thinking like an attacker, building security community, practicing threat modeling, collaborating during penetration testing, learning reverse engineering, and finding a path into the profession. Adam Shostack explains why “think like an attacker” can exclude developers, Chris describes internal security communities, Tony UcedaVélez introduces PASTA, and the hosts revisit lessons about testers working with development teams. Jon McCoy defines reverse engineering, while Tracy Maleeff shares career-transition advice and reading recommendations. The finale is both a retrospective and a statement of direction: application security improves when technical methods, empathy, learning, and community reinforce one another.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Chris Romeo and Robert Hurlbut:
→ Chris Romeo on LinkedIn
→ Robert Hurlbut on LinkedIn

Mentioned in this episode:
→ PASTA Threat Modeling
→ Cybersecurity Canon
→ The Cuckoo's Egg
→ Adam Shostack
→ Tony UcedaVelez
→ Jon McCoy
→ BSides

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Looking back at Season 1
02:00 Adam Shostack on thinking like an attacker
04:45 Why that phrase can exclude developers
06:38 Chris Romeo on security community
09:33 Tony UcedaVélez on PASTA threat modeling
11:05 Why penetration testing matters
12:26 Testers and developers working together
13:14 Jon McCoy on reverse engineering
15:19 Tracy Maleeff on entering security
16:39 Learning through books and history
17:17 The Cuckoo’s Egg and closing recommendations
18:21 Closing Season 1

Rafal Los, James Jardine, and Michael Santarcangelo -- #DtSR and What Makes a Good Security Consultant? Jan 12, 2017

What separates a useful security consultant from someone who merely arrives with answers? Rafal Los, James Jardine, and Michael Santarcangelo of the Down the Security Rabbit Hole podcast join Chris and Robert to examine consulting from external and internal perspectives. They compare technical ability with empathy, listening, confidence, communication, and the willingness to admit uncertainty. Each guest shares career lessons, including working yourself out of a role by making the client stronger, building durable relationships, and staying focused on the work you do best. The group also discusses specialization, referrals, and advice for people entering consulting. Their shared conclusion is that expertise matters, but a consultant creates value by understanding context, helping others succeed, and earning trust.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Rafal Los, James Jardine, and Michael Santarcangelo:
→ Rafal Los on X
→ James Jardine on X
→ Michael Santarcangelo on X

Mentioned in this episode:
→ Down the Security Rabbithole Podcast

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 What makes a good security consultant
02:20 Michael’s view of successful consulting
03:45 Rafal’s external-consultant perspective
05:22 James on consulting from inside organizations
07:26 Empathy as a professional skill
09:19 Technical skills versus soft skills
13:34 Career origin stories and second chances
16:00 Working yourself out of a job
18:12 Lessons from James Jardine
20:02 Listening, confidence, and handling uncertainty
22:11 Consulting across different client contexts
25:05 Focus, specialization, and referrals
29:27 Advice for people entering consulting
31:55 Creating opportunities for new talent
33:43 Final recommendations
36:25 Closing thoughts

Adam Shostack -- Think like an Attacker or Accountant? Jan 04, 2017

What does “think like an attacker” actually ask a developer to do? Adam Shostack joins Chris and Robert to challenge a familiar instruction that can leave capable engineers feeling excluded from security work. He describes an experience that changed his approach and explains why developers’ knowledge of their own systems should be the starting point for threat modeling. The conversation examines the difference between persuading people that security matters and giving them a concrete way to practice it. Chris and Robert add examples from development teams, while Adam extends the discussion to infrastructure and operations. They close with practical ways to ask better questions, build a shared understanding of a system, and make security thinking accessible without demanding a new identity.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Adam Shostack:
→ Adam Shostack

Mentioned in this episode:
→ Start With Why

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Rethinking “think like an attacker” with Adam Shostack
01:25 Adam’s security origin story
03:34 Why the hacker mindset instruction can fail
07:15 When security conversations make developers feel excluded
08:02 Rethinking how security is taught
11:22 Giving teams a practical way to participate
14:16 Treating developers as experts in their own systems
17:08 Explaining why security matters
20:37 A developer’s perspective on security thinking
22:26 Applying the approach beyond software teams
25:49 Practical actions for more inclusive security work

Jon McCoy -- The Mindset to Reverse Engineer Dec 21, 2016

How does a developer learn to take software apart and use that knowledge to build it more securely? Jon McCoy joins Chris and Robert to discuss reverse engineering, the habits of a breaker, and the connection between offensive research and everyday development. He explains what reverse engineering means, describes experiments with malware and .NET applications, and shows how familiar practices such as unit testing can incorporate security thinking. The conversation explores framework protections, how much coding knowledge penetration testers need, and the role of local developer and security communities. Jon’s advice for newcomers is practical: choose an application, inspect how it works, and learn by experimenting. The episode emphasizes curiosity and repeated hands-on work as foundations for deeper software understanding.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Jon Mccoy:
→ Jon McCoy on X
→ Jon McCoy on GitHub

Mentioned in this episode:
→ NDC Conferences
→ DEF CON
→ Metasploit

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Reverse engineering with Jon McCoy
01:53 Why a developer became interested in security
02:27 What reverse engineering means
03:24 Teaching security through familiar developer practices
04:06 Adding security thinking to unit tests
05:00 Malware experiments and the breaker mindset
07:56 Helping others learn to break software
11:22 Security in the .NET framework
14:39 How much code should a penetration tester know?
17:45 Learning through developer and security communities
19:47 A first month of learning to reverse engineer
21:26 Resources and hands-on experimentation

Chris Romeo -- AppSec Awareness: A Blue Print for Security Culture Change Dec 13, 2016

A security awareness program needs to change daily behavior, not simply record who completed a course. In this recorded conference talk, Chris Romeo shares lessons from building a large-scale application security education and culture program at Cisco. He explains why developers need practical knowledge, why security culture must be deliberate and sustainable, and how an organization’s own history can make lessons relevant. Chris walks through program design choices, including a recognizable theme, learning paths, activities, and ways to keep people involved. He also distinguishes useful gamification from superficial rewards and describes how visible achievements can reinforce learning. The talk offers a blueprint for connecting education, community, and repeated practice so security becomes part of how people develop software.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Chris Romeo:
→ Chris Romeo’s presentations

Mentioned in this episode:
→ Slides on SpeakerDeck
→ Cisco Security Ninja

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 AppSec awareness and sustainable security culture
01:16 Why application security matters when software is everywhere
05:11 Helping developers do the right thing
06:05 Teaching developers to think about security
10:26 Designing deliberate and sustainable culture change
14:06 Learning from organizational history and designing a program
27:42 Activities that turn learning into practice
41:21 Gamification and reinforcing security habits

Tracy Maleeff -- Natural Paranoia as a Career Path? A Transition to Security Dec 06, 2016

Can a career in library science become a foundation for information security? Tracy Maleeff joins Chris and Robert while making that transition, bringing research, organization, and communication skills into a field often defined by technical job titles. She explains how she explored possible directions, tested her interests, and used conversations with practitioners to understand the work before committing to it. The discussion focuses on networking as genuine relationship-building, asking for help, and finding welcoming communities at conferences and online. Tracy also shares a method for planning a career change and a book that helped shape her interest. Her story offers developers, testers, and people outside technology a concrete example of recognizing transferable skills and investigating a new path deliberately.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Tracy Maleeff:
→ Tracy Maleeff on LinkedIn
→ InfoSecSherpa

Mentioned in this episode:
→ The Cuckoo’s Egg by Clifford Stoll
→ Security BSides

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Tracy Maleeff’s transition into information security
08:33 Recognizing when it is time for a career change
11:51 Transferable lessons for developers and testers
13:35 Building genuine relationships in security
18:41 Unexpected benefits of making connections
21:31 Reaching out to people you admire
24:22 A process for exploring a new career
27:43 Testing your interest before committing
34:52 A book recommendation: The Cuckoo’s Egg

Chris Romeo -- Security Community at Any Scale Nov 29, 2016

How can a company build a security community when it has only a few interested people and little budget? Robert interviews Chris Romeo about lessons from growing an internal community at a large technology company and adapting those lessons to smaller organizations. Chris distinguishes security advocates from champions, explains how to recognize motivated contributors, and recommends a dependable rhythm of meetings and learning opportunities. They discuss lunch sessions, practical training, and the conditions that make an internal security conference worthwhile. Robert keeps the conversation grounded in what a small team can actually do, including learning from outside events and sharing that knowledge at work. The episode presents community as a sustained network of relationships that helps people learn and apply security together.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Chris Romeo:
→ Chris Romeo’s presentations

Mentioned in this episode:
→ OWASP Top 10
→ CSSLP (ISC2)
→ Black Hat
→ DEF CON
→ All Day DevOps

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Building a security community at any scale
01:19 What an internal security community does
02:14 Starting with a few interested people
10:09 Identifying security champions
12:02 Establishing a monthly learning cadence
13:53 Engaging more of the organization
15:10 Choosing useful training and learning resources
17:39 When to hold an internal security conference
22:06 Learning from external events on a smaller budget

Deidre Diamond -- The Soft Skills of AppSec Nov 15, 2016

Technical ability can open a door in security, but communication and relationships often determine what happens next. Deidre Diamond, founder of CyberSN, joins Chris and Robert to explain the human skills that developers and security professionals need to work effectively with colleagues and business leaders. She discusses listening, setting expectations, practicing difficult conversations, and building confidence through repeated speaking opportunities. The conversation also explores the application security job market as it looked at the time, the value of developers who understand security, and how companies evaluate candidates making a career transition. Deidre connects these skills to stronger teams and better opportunities, offering concrete first steps for people who want their technical work to have greater influence across an organization.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Deidre Diamond:
→ Deidre Diamond on LinkedIn
→ CyberSN

Mentioned in this episode:
→ CyberSN
→ Toastmasters International

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 The soft skills of AppSec with Deidre Diamond
01:50 Deidre’s path into cybersecurity
05:26 Defining strong communication and interpersonal skills
11:39 Bringing developers into business conversations
14:09 Practicing better communication
16:24 First steps for developers who want to improve
19:15 Toastmasters and speaking outside your comfort zone
24:20 The application security job market
28:20 Career opportunities for security-minded developers
30:47 Security as a business and investment differentiator
33:14 Moving into a security role
35:11 A call to practice and build relationships

Tony UcedaVelez -- PASTA: Not Just for Breakfast Anymore Nov 08, 2016

A useful threat model should explain how an attacker could harm the business, not just complete a checklist. Tony UcedaVélez joins Chris and Robert to introduce PASTA, the Process for Attack Simulation and Threat Analysis, and its risk-centered approach to application security. He explains how business context, threat intelligence, and attacker motivation shape the analysis, then connects those ideas to attack trees and cloud containers. The conversation explores where to find useful threat information, whether attack models can be reused, and how resources such as MITRE CAPEC can support the work. Tony also addresses the challenge of helping developers reason about adversaries. The episode closes with practical advice for making threat modeling an evidence-based part of understanding and protecting a system.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Tony UcedaVelez:
→ Tony UcedaVélez on LinkedIn
→ VerSprite

Mentioned in this episode:
→ PASTA threat modeling
→ Attack Trees (Schneier)
→ MITRE CAPEC
→ OWASP Threat Modeling Project
→ Microsoft Threat Modeling Tool
→ Docker

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 PASTA threat modeling with Tony UcedaVélez
01:22 Tony’s security origin story
05:00 What PASTA adds to threat modeling
08:48 Finding relevant threat intelligence
12:32 Helping teams reason about adversaries
15:07 Moving beyond security checklists
18:02 Attack trees and cloud containers
20:08 How attack trees describe paths to a goal
24:30 Reusing and sharing attack models
26:12 Connecting CAPEC and weakness information
34:27 Practical steps for risk-centered threat modeling

Glenn Leifheit -- An Inner Glimpse of the Microsoft SDL Nov 02, 2016

How do you keep a secure development lifecycle useful as products, teams, and delivery methods change? Glenn Leifheit joins Chris and Robert to share lessons from Microsoft’s SDL and its evolution beyond a rigid sequence of security tasks. He explains the importance of adapting the program to a product’s context, treating developers as customers, and making security help easy to access. The conversation covers community, practical learning, constraints that encourage creative solutions, and the need to evolve alongside development practices. Glenn also describes mentoring across roles and seeking ideas outside the security industry. His central message is that a sustainable SDL depends on partnership and repeatable habits, with processes simple enough to survive staffing changes and the pressures of everyday delivery.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Glenn Leifheit:
→ Glenn Leifheit on LinkedIn

Mentioned in this episode:
→ Microsoft Security Development Lifecycle (SDL)

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Inside the Microsoft SDL with Glenn Leifheit
02:48 Where the SDL came from
10:54 Adapting security to the product and business
13:55 Making developers want to ask for help
23:35 Evolving the SDL with development practices
31:36 Learning from constraints and outside influences
34:54 Treating developers as customers
35:30 Building a learning community
38:56 Mentoring across roles and experience levels
42:42 Learning from organizations outside security
46:28 Making security processes sustainable
47:07 Partnership, adaptability, and practical next steps

Mike Landeck -- Security Must Meet the Needs of the Business Oct 25, 2016

Security advice only helps when it connects to the needs of the people building and running the business. Mike Landeck joins Chris and Robert to discuss teaching developers, working with testers, and using breach stories without overwhelming an audience that already hears about incidents every day. He explains how practical examples can lead people toward resources such as the OWASP cheat sheets and how to choose stories that make risk understandable. The conversation then moves to business decisions, trust, and the limits of simply telling an organization what it should do. Mike argues for partnership and concrete assistance that helps teams improve over time. The episode offers ways to turn security knowledge into useful action for developers, QA staff, and business leaders.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Mike Landeck:
→ Mike Landeck on LinkedIn

Mentioned in this episode:
→ OWASP SQL Injection Prevention Cheat Sheet
→ Damn Vulnerable Web App (DVWA)
→ I Am The Cavalry
→ Krebs on Security
→ OWASP Cheat Sheet Series

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Connecting security to business needs with Mike Landeck
01:32 Mike’s path into application security
07:10 Teaching developers to use practical security resources
09:01 Breach fatigue and keeping the message relevant
13:28 Reaching people outside the security echo chamber
16:01 Choosing useful breach stories
19:24 Sources for understanding security incidents
20:06 Explaining security to a developer
23:10 Helping QA teams test for security
25:55 Understanding the business decision
30:15 Moving the organization toward better outcomes
34:23 Practical next steps for security practitioners

Daniel Ramsbrock -- Web Application Pen Testing – Part 2 Oct 17, 2016

Part two follows Daniel Ramsbrock into the practical workflow of a web application penetration test. He joins Chris and Robert to move from reconnaissance into active testing, explaining credentials, intercepting proxies, attack recording, automated scanners, and the human judgment required to interpret results. The conversation covers authorization failures, false positives, reporting, remediation, and retesting, then broadens into compliance and the feedback loops mature organizations build between testers and development teams. Daniel also offers a learning path through vulnerable applications, training, certifications, bug bounties, books, and hands-on practice. The episode makes clear that tools assist a penetration tester, but disciplined reasoning and communication create the lasting security improvement.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Daniel Ramsbrock:
→ Daniel Ramsbrock on LinkedIn

Mentioned in this episode:
→ Burp Suite
→ HCL AppScan
→ OWASP WebGoat
→ GIAC GWAPT
→ SANS SEC542
→ Bugcrowd
→ The Web Application Hacker’s Handbook
→ Kali Linux

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Continuing the web penetration testing process
01:54 Why testers need individual credentials
04:21 Moving from reconnaissance to active attack
05:41 Intercepting proxies and recording traffic
07:34 Choosing which attacks to attempt
09:20 Where automated scanners fit
10:27 Human judgment during active testing
11:40 Finding authorization failures
12:40 Interpreting false positives
13:47 Reporting findings and remediation
16:48 Retesting and proving fixes
18:53 Compliance versus meaningful security
20:44 Building feedback loops with development
22:20 Learning web application penetration testing
26:00 Bug bounties as controlled practice
28:11 Books and hands-on resources
30:52 Final advice

Daniel Ramsbrock -- Web Application Pen Testing – Part 1 Oct 17, 2016

What should developers and security teams understand before commissioning a web application penetration test? In part one, Daniel Ramsbrock joins Chris and Robert to establish the purpose, timing, and business value of testing an application from an attacker’s perspective. They compare penetration testing with earlier secure-development activities, explain why developers and testers benefit from working together, and consider how waterfall, agile, and DevOps delivery models change the engagement. Daniel discusses risk-based scoping, testing frequency, business goals, internal versus external testers, and the ethical “hat” terminology used in security. The episode ends by moving from program decisions toward the hands-on testing process continued in part two.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Daniel Ramsbrock:
→ Daniel Ramsbrock on LinkedIn

Mentioned in this episode:
→ RVAsec
→ DEF CON
→ Black Hat
→ Web Application Penetration Testing — Part 2

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Web application penetration testing, part one
01:41 Daniel Ramsbrock’s security origin story
03:23 What penetration testing is
04:23 Why attackers target applications
05:29 The developer perspective on testing
06:34 Developers and penetration testers working together
07:45 Where penetration testing fits the lifecycle
09:19 Why late testing creates problems
13:18 Waterfall, agile, and DevOps considerations
16:39 How often to run a full penetration test
18:41 Using risk to set the testing schedule
20:13 Scoping services and applications
21:14 Connecting business goals to testing
22:12 Building a testing capability
24:51 Internal and external testing tradeoffs
26:24 White, gray, and black hat terminology
30:24 Preparing for the hands-on process

Matt Clapham -- Development Security Maturity Oct 10, 2016

Can you learn enough about a development team’s security practices in an hour to give it useful direction? Matt Clapham joins Chris and Robert to explain his lightweight approach to estimating development security maturity through five key behaviors. They discuss preparing for the assessment, learning from defect records and existing artifacts, and holding a conversation that encourages honest answers rather than anxiety about being graded. Matt walks through scoring practices such as threat modeling and vulnerability response, then explains how the results can guide improvement. The discussion also examines the experience an assessor needs, the model’s limitations, and its relationship to broader approaches such as BSIMM and SAMM. The goal is an actionable view of how a team actually works.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Matt Clapham:
→ Matt Clapham on LinkedIn

Mentioned in this episode:
→ RSA slides: Estimating Development Security Maturity in About an Hour
→ BSIMM
→ OWASP SAMM

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Estimating development security maturity with Matt Clapham
01:32 Matt’s product security background
03:15 What development security maturity means
05:15 Why measurement can make developers anxious
08:20 Why a maturity assessment is useful
11:03 Preparing for the assessment
16:33 Understanding the application before the meeting
19:49 What defect records reveal about a team
21:10 Running the development-team conversation
22:30 Communication that encourages useful answers
26:38 Scoring security behaviors
29:54 Evaluating threat modeling practices
34:39 Vulnerability response as a maturity signal
37:52 Can a team outgrow the model?
42:12 Limitations and advantages of the approach
45:30 How the model relates to BSIMM and SAMM

Elena Elkina -- Privacy and Data Protection Oct 04, 2016

Protecting data from attackers does not answer every question about privacy. Elena Elkina joins Chris and Robert to explain the relationship between privacy, security, and customer data protection, drawing on her legal background and personal experience growing up under surveillance. She describes how different people and organizations understand privacy and why transparency about data use matters alongside technical safeguards. Robert brings a developer’s perspective, and Elena turns the conversation toward the influence engineers have on privacy through product design and requirements. They explore the communication gap between precise technical decisions and the contextual answers privacy teams often give. Elena’s closing advice is straightforward: build relationships with privacy and security colleagues so that protecting people’s information becomes a shared design responsibility.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Elena Elkina:
→ Elena Elkina on LinkedIn
→ Women in Security and Privacy

Mentioned in this episode:
→ Women in Security and Privacy
→ Leading Women in Technology
→ 23andMe

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Privacy and data protection with Elena Elkina
01:57 Elena’s path into privacy
03:48 How personal experience shaped her perspective
05:53 What privacy means to different people
07:26 Business use of data and transparency
11:02 Privacy compared with customer data protection
12:45 A developer’s view of privacy
15:45 How developers influence privacy through design
18:54 Bridging technical and privacy conversations
19:58 Building relationships with privacy and security teams

Chris and Robert -- Security in the Methodology Sep 26, 2016

How should application security change when a team moves from Waterfall to Agile? Chris and Robert compare the two development models and map security work onto each one. Waterfall makes phase gates, documentation, and specialized reviews visible, but often delays feedback. Agile breaks work into smaller increments, uses user stories and acceptance criteria, and creates opportunities to test security continuously. The hosts discuss stand-ups, sprints, continuous integration, threat modeling, abuse cases, reusable requirements, and the difficulty of defining “done” when security work spans multiple stories. Their conclusion is not that one methodology automatically produces secure software. Security succeeds when its activities fit the team’s real delivery process and provide useful feedback at the moment decisions are made.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Chris Romeo and Robert Hurlbut:
→ Chris Romeo on LinkedIn
→ Robert Hurlbut on LinkedIn

Mentioned in this episode:
→ Agile Manifesto
→ Microsoft SDL

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Security in development methodologies
02:33 Why organizations still use Waterfall
04:07 Documentation and predictable phase gates
06:01 Where Waterfall came from
07:19 Applying security to each Waterfall phase
08:40 Moving from Waterfall to Agile
10:25 Testing inside every sprint
12:09 User stories and acceptance criteria
13:25 Stand-ups, retrospectives, and feedback
15:00 Continuous integration and Agile
16:49 What it means for a story to be done
18:19 Fitting AppSec into Agile work
20:32 Turning security needs into stories
21:50 Testing authorization requirements
24:25 Threat modeling and abuse cases
27:21 Final methodology lessons

Chris and Robert -- The Activities of the Secure Development Lifecycle Sep 19, 2016

Which activities turn a secure development lifecycle from an aspiration into repeatable work? Chris and Robert walk through security requirements, authentication and authorization, threat modeling, coding standards, approved libraries, code review, static analysis, dependency management, dynamic scanning, penetration testing, and post-release response. For each activity, they explain who benefits, when it belongs in development, and what it can reveal that another control cannot. The conversation emphasizes shared ownership: architects, developers, testers, operations, and response teams each see different parts of the risk. Tools support the process but do not replace design judgment or human testing. The episode provides a practical map of the SDL and shows how its activities connect from initial requirements through production feedback.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Chris Romeo and Robert Hurlbut:
→ Chris Romeo on LinkedIn
→ Robert Hurlbut on LinkedIn

Mentioned in this episode:
→ OWASP Top 10
→ OWASP ESAPI
→ Microsoft Safe C Library
→ PSIRT Services Framework (FIRST.org)

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Activities of a secure development lifecycle
01:45 Security requirements
03:27 Authentication and authorization
05:24 Capturing requirements in development work
07:17 Threat modeling
09:12 Identifying threats systematically
12:14 How threat models help testers
14:09 Secure coding standards
15:52 Why developers need actionable guidance
17:44 Approved frameworks and cryptography
20:49 Code review and static analysis
23:53 Owning third-party dependency risk
25:18 Software composition analysis
26:53 Triage and false positives
29:38 Testing within the delivery process
31:26 Dynamic application security testing
33:07 Network versus application scanning
35:23 Comparing multiple tools
37:35 Why penetration testing still matters
40:45 Product security incident response
43:37 Secure software as a connected system

Chris and Robert -- Introductions and why #AppSec? Sep 13, 2016

In the inaugural episode of the Application Security Podcast, Chris Romeo and Robert Hurlbut introduce themselves, trace the experiences that brought them into security, and establish the question the show will keep answering: what is application security, and why should builders care? They walk through security requirements, threat modeling, secure development, testing, and release as connected parts of the software lifecycle. The conversation distinguishes application security from information security and the broader cybersecurity label, then makes the business case for treating AppSec as foundational work—a customer expectation and a worthwhile investment rather than optional overhead, driven by people and supported by tools.

Connect with Chris and Robert:
→ Chris Romeo on LinkedIn
→ Robert Hurlbut on LinkedIn

Mentioned in this episode:
→ Software Security: Building Security In
→ OWASP Top 10
→ Gary McGraw
→ Robert Hurlbut

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Welcome to the Application Security Podcast
02:21 Chris and Robert’s security origin stories
06:31 Defining application security
09:05 Security requirements in the development lifecycle
10:25 Design and threat modeling
11:17 Secure development and testing
13:35 Release and operational feedback
15:53 Building security in
16:56 Application security vs. information security
20:31 What does cybersecurity mean?
22:59 Why organizations need application security
24:53 Applications as the path to valuable data
27:24 The OWASP Top 10 as a starting point
28:23 Final thoughts and the future of the field

Our TOPPODCAST Picks

Follow Us

Stay Connected

The Application Security Podcast

Related Podcasts

Links

Stay Connected