The Application Security Podcast

Latest Episodes:

Kim Wuyts -- The Future of Privacy Threat Modeling Jun 29, 2023

Show notes

Kim Wuyts discusses her work in privacy threat modeling with LINDDUN, a framework inspired by Microsoft's STRIDE for security threat modeling. LINDDUN provides a structure to analyze privacy threats across multiple categories such as linking, detecting data disclosure, and unawareness. The framework has been updated over the years to incorporate new knowledge and developments in privacy, and it has become recognized as a go-to approach for privacy threat modeling. Kim Wutz is a senior privacy researcher at the IMEC DISTRINET research group at KU Leuven, Belgium. She has more than 15 years of experience in security and privacy engineering. Kim is one of the driving forces behind the development and extension of Linden, a privacy threat modeling framework.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Kim Wutz is a senior privacy researcher at the IMEC DISTRINET research group at KU Leuven, Belgium.
→ Learn more about Security Journey

Connect with Kim Wuyts:
→ LINDDUN
→ Threat Modeling Manifesto

Mentioned in this episode:
→ LINDDUN
→ Threat Modeling Manifesto
→ Kim Wuyts

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Kim Wuyts: The Future of Privacy Threat Modeling
07:44 I think about how prolific STRIDE is in the world of
09:42 Kim, you even commented on this on LinkedIn. I was exchanging
13:51 I thought, I'm like, I'm gonna work this. I'm gonna try
19:57 You mentioned privacy by design. What's the— I've always legitimately always
23:45 I do privacy by design, like, I feel like security or
25:53 With privacy by design, do I start with a set of
27:35 It sounds like when you're describing an existing system, something that
30:37 You don't immediately start looking for, I don't know, some crypto
32:10 Very cool. So, when you think about emerging trends or new
36:00 And generally you have to do that anyway, right
37:21 Right. Okay. So, here's my final question, and then we'll go
40:18 About a key takeaway or a call to action then

François Proulx -- Actionable Software Supply Chain Security Jun 22, 2023

Show notes

Software supply chain -- how deep does the problem go? François is here to help us realize how deep the rabbit hole of the supply chain is and enlighten us with strategies to get out of the hole. François is a senior product security engineer for Boost Security, where he leads the supply chain research team. With over 10 years of experience in building AppSec programs for large corporations such as Intel and small startups, he's been in the heat of the action as the DevSecOps movement took shape. François is one of the founders of NorthSec and was a challenge designer for the NorthSec CTF.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
François is a senior product security engineer for Boost Security, where he leads the supply chain research team.
→ Learn more about Security Journey

Connect with François Proulx:
→ François Proulx on LinkedIn
→ deps.dev

Mentioned in this episode:
→ deps.dev
→ Sigstore
→ OpenSSF Scorecard
→ SLSA
→ Attack Trees (Schneier)
→ Let's Encrypt
→ OpenSSF
→ Terraform
→ OpenID Connect
→ Brook S.E. Schoenfield
→ Jonathan Marcil

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet François Proulx: Actionable Software Supply Chain Security
02:18 I do, definitely. Okay. I was going to trademark it, but
12:20 I think about the complexity of the modern software supply chain
18:57 Okay. So, what are some of the lessons
25:36 Continuing on the ATT&CK tree perspective, I'm going to kind of
27:51 Okay. Thanks. Yeah, that was helpful to kind of, as I'm
33:20 Could we or should we create the same thing for the
39:46 François, we're coming to the end of our conversation, and I

Steve Wilson -- OWASP Top Ten for LLMs Jun 15, 2023

Show notes

How do we do security in the world of AI and LLMs? A great place to start is with an OWASP project tasked with creating a standardized guideline for building secure AI applications with large language models such as ChatGPT. Enter OWASP Top Ten for LLMs, and Steve Wilson, the project leader. Steve Wilson is currently the Chief Product Officer at Contrast Security. Today, his team is responsible for engineering, product management, product marketing, and product design for all products. He's also currently leading the project at the Open Worldwide Application Security Project, or OWASP, creating a standardized guideline for building secure AI applications with large language models such as ChatGPT.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Steve Wilson is currently the Chief Product Officer at Contrast Security.
→ Learn more about Security Journey

Connect with Steve Wilson:
→ Steve Wilson on LinkedIn
→ Steve Wilson on LinkedIn

Mentioned in this episode:
→ OWASP Top 10 for LLM Applications
→ ChatGPT
→ Contrast Security
→ OWASP API Security Top 10
→ GitHub Copilot
→ Jeff Williams on LinkedIn
→ OWASP Slack
→ Steve on LinkedIn

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Steve Wilson: OWASP Top Ten for LLMs
01:47 Yeah, artificial intelligence seems to be the thing that's on everybody's
07:38 Is that
13:35 You've got this whole, you know, you got people that are
20:22 That's a really powerful use case to think about a SOC
29:45 ChatGPT and all these other services are using API as a
33:20 We think about mitigations now for prompt, I wanna come back
40:02 Yeah, that's great though. It's good to know that even all

JB Aviat -- The State of Application Security Jun 07, 2023

Show notes

What is the state of application security? JB Aviat answered that question by creating the state of application security report based on data from Datadog customers using the application security and APM products. It provides insights into threat detection, vulnerability detection, prioritization, and general trends regarding the most significant risks. Jean dedicates to democratizing security by developing the security products of Datadog, leveraging the unique observability capabilities of the platform. Before this, JB was CTO and co-founder of Screen a cybersecurity company providing an automated SaaS solution to protect web applications without traffic redirection or code modification. Screen was acquired by Datadog in April, 2021.

Connect with JB Aviat:
→ Datadog State of Application Security report
→ Sqreen (now Datadog AAP)

Mentioned in this episode:
→ Datadog State of Application Security report
→ Sqreen (now Datadog AAP)
→ WordPress
→ Aquia

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet JB Aviat: The State of Application Security
02:31 Yeah, so tell us before we even get into the details
05:17 Yeah. One of the things that, that I really appreciate about
12:47 We, when I, when I think about this, like, is this
15:03 Getting, I'm, I'm tracking with you now. I'm I'm getting it
22:41 I mean, I, I think that's, that's consistent when, like, when
26:37 Were you, were you able to tra trace
29:03 Very cool. Very cool. All right. What's next
35:49 Cool. Let's keep going. What's number six
36:55 Yeah. Word WordPress rules the internet. We know it. That's why
40:19 I, I, I think of a couple of things on this

Joshua Wells -- Application Security in the Age of Zero Trust Jun 01, 2023

Show notes

What is zero trust, and how does it impact the world of applications and application security? We dive deep into zero trust with Joshua Wells, a seasoned cybersecurity expert with over ten years of experience. Joshua explores the intricacies of zero trust, a cybersecurity model that dictates no user or machine is trusted by default and must be authenticated every time. Joshua Wells is a seasoned cybersecurity expert with over 10 years of experience leading teams and organizations through intricate cybersecurity situations. His extensive background includes working with various government bodies and private sector organizations, specializing in areas such as architectural security, endpoint detection, mobile device management, and risk assessment.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Joshua Wells is a seasoned cybersecurity expert with over 10 years of experience leading teams and organizations through intricate cybersecurity situations.
→ Learn more about Security Journey

Connect with Joshua Wells:
→ BeyondCorp
→ CISA Zero Trust Maturity Model

Mentioned in this episode:
→ BeyondCorp
→ CISA Zero Trust Maturity Model
→ NIST SP 800-53
→ Zscaler
→ LogRhythm
→ Sumo Logic
→ DISA STIG
→ OWASP Top 10
→ OWASP API Security Top 10
→ Cyber Vault Solutions

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Joshua Wells: Application Security in the Age of Zero Trust
02:59 How'd you get into security
06:18 As we were talking before the interview, I have to add
07:16 Like Superman, what was his name
10:51 With zero trust then, I primarily think of network architecture is
14:53 Everything is internet accessible. Everything is public IP addressable. All the
18:08 Back to the regularly scheduled programming here. When you think about
20:38 Thinking through that a little bit, for an organization when they've
23:10 All right, so we talked about the positive side. I mean
25:58 Yeah, and I've seen similar, and you probably have too, in
28:37 We think about areas of focus that an AppSec person should
32:14 As I'm listening to you talk about applications in a zero
35:24 In the deep end of the zero trust pool, what would
37:15 As far as a call to action, so let's just assume

Jeevan Singh -- The Future of Application Security Engineers May 15, 2023

Show notes

Jeevan Singh, the director of product security at Twilio, discusses the future of application security engineers. Singh highlights the importance of embedding security into all aspects of software development and the need for a strong security culture within organizations. He also explains the skills required for a senior application security engineer, such as application security, software development, and teaching skills. Singh underscores the importance of empathy and influence, emphasizing that soft skills can significantly affect adequate application security. He also discusses the impact of AI, particularly OpenAI's GPT, in supporting the work of security engineers by providing valuable insights and information. Singh concludes by urging application security engineers to broaden their skills, particularly in software development, to ensure they can effectively handle the industry's evolving demands.

Connect with Jeevan Singh:
→ Twilio
→ ChatGPT

Mentioned in this episode:
→ Twilio
→ ChatGPT

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Jeevan Singh: The Future of Application Security Engineers
03:25 Would you describe the future of application security engineer
07:18 Yeah, I feel like there's, I mean, maybe 5,000 AppSec engineers
10:24 Hmm. Yeah. And you're talking to, to two owas lifetime members
12:43 Of those three, you know, so AppSec skills, software development skills
17:16 About the teaching skills
21:01 You tell stories about, you know, things you've done in, in
23:17 Yeah. Yeah. And I like, I like the, the, where you
25:03 I like that. I'm gonna use that going forward. That multiplier
32:38 Does it scale
35:26 Does that play, uh, in, so you talked sort of around
39:23 We just got a, there's a, there's a mini episode included
43:59 I've been thinking about this quite a bit, lately, as far

Tony Turner -- Threat Modeling and SBOM May 03, 2023

Show notes

Have you ever considered using an SBOM to inform your threat modeling? Tony Turner has. Tony joins us to discuss SBOMs, threat modeling, and the importance of Cyber Informed Engineering. Tony Turner is the CEO and founder of Ops-Wright, a new type of cybersecurity company disrupting security engineering for critical infrastructure. I found Tony via a talk he did on threat modeling in SBOM. Topic caught my attention, so I reached out to have a conversation. We talk about threat modeling in SBOM, the value proposition of SBOM, security engineering in SBOM, and cyber-informed engineering. This is something you'll want to learn about. I'd never heard of it before, but it could also help us in building more secure applications and products both.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Tony Turner is the CEO and founder of Ops-Wright, a new type of cybersecurity company disrupting security engineering for critical infrastructure.
→ Learn more about Security Journey

Connect with Tony Turner:
→ Opswright
→ Cyber-Informed Engineering (INL)

Mentioned in this episode:
→ Opswright
→ Cyber-Informed Engineering (INL)
→ Consequence-driven Cyber-Informed Engineering (CCE)
→ Software Transparency
→ IriusRisk
→ Open Threat Model (OTM)
→ PyTM
→ Contrast Security
→ CycloneDX
→ VEX
→ National Vulnerability Database (NVD)
→ Software Transparency: Supply Chain Security in an Era of a Software-Driven Society by Chris Hughes, Tony Turner
→ OWASP pytm

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Tony Turner: Threat Modeling and SBOM
01:49 Yeah, I mean, getting into a style of threat modeling or
05:21 And so when you, when you mentioned kind of in the
06:51 To jump into our topic today, Tony, what's an SBOM
09:38 Tony, when you think of the value proposition of SBOM, like
13:39 Right
19:51 Yeah, this is the first time that I've ever bumped into
21:59 Makes sense. And OT, you mean operational technology, right
28:59 You think about, like, when we think about the process that
31:25 You also mentioned there were some tools that you used as
34:47 I'm going to— we had another question about CycloneDX, but I'm—
37:34 Yeah. Okay, cool. So I guess, Tony, from a key takeaway
39:17 Okay. So how about a key takeaway then, or a call
43:10 Very good. Well, Tony, thank you for being with us today

Christian Frichot -- Threat Modeling with hcltm Apr 18, 2023

Show notes

Christian Frichot, an AppSec hacker, security leader, and developer of hcltm. He discusses the DevOps threat modeling tool he dreamed up and built. The tech was created to fit into developers' workflows and leverage tools they are familiar with. hcltm is designed to drive valuable change and be updated and maintained easily by software engineers. It is a developer-centric software product not heavily opinionated on diagramming, allowing users to employ their preferred methods for threat modeling. The solution is still evolving, and Frichot is open to user feedback and suggestions to improve it. He encourages people to try hcltm and see if it fits their threat modeling needs, as everyone approaches the process differently.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Here's a list of things that Christian Frichot is.
→ Learn more about Security Journey

Connect with Christian Frichot:
→ hcltm (now threatcl) on GitHub
→ Terraform

Mentioned in this episode:
→ hcltm (now threatcl) on GitHub
→ Terraform
→ Semgrep
→ Open Threat Model (OTM)
→ Microsoft Security Development Lifecycle (SDL)
→ OWASP AI Security and Privacy Guide

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Christian Frichot: Threat Modeling with hcltm
02:01 We're super excited to have Christian Frichot with us this evening
05:58 Yeah, excellent. So, I have so many questions, and we haven't
10:17 Yeah, so Christian, so this new tool that has been around
17:45 There a structured set of language and commands and things that
24:34 Yeah. And look, that's definitely a gap in the tool. Like
26:48 With that in mind, so there's an assumption, it sounds like
29:35 Yeah. I think this is the future, right
31:13 Yeah. And it is quite funny. I think that's the other
35:52 I kind of like those sorts of, you know, Unix philosophy
37:30 To past episodes, 'cause you were talking about Microsoft and them
40:28 You see it as a bidirectional communication or a unidirectional communication
42:42 Yeah. Yeah. We're starting to see them. I mean, I've started
45:27 Yeah. Have you— I was trying to figure out, have you
47:46 The best place for them to go is the GitHub repo

Zohar Shachar -- Bug Bounty from Both Sides Apr 03, 2023

Show notes

Zohar Shachar joins us to discuss the bug bounty process from both sides. Zohar has spent time as a bug bounty hunter and shares wisdom on avoiding bug bounty-causing issues for your AppSec posture. We hope you enjoy this conversation with... Zohar spent time as a bug bounty hunter and shares wisdom on avoiding bug bounty causing issues for your application security posture. Keep security top of mind with continuous application security training for your developers. Security Journey offers bite-sized lessons with hands-on interactive training for all roles in the SDLC. Give your admins the ability to use pre-built or custom training paths with easy-to-use tracking and reporting.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Zohar Shachar joins us to discuss the bug bounty process from both sides of the equation.
→ Learn more about Security Journey

Connect with Zohar Shachar:
→ HackerOne
→ Google Abuse Vulnerability Reward Program

Mentioned in this episode:
→ HackerOne
→ Google Abuse Vulnerability Reward Program
→ Enso Security
→ Aquia

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Zohar Shachar: Bug Bounty from Both Sides
02:06 Let's get after it here. Super excited to have Zohar Shachar
05:42 Yeah. So I do have a question for you in regards
07:12 There is a lesson learned there, right
14:20 On the side of the researcher then, because I've heard other
17:57 You think about bug bounty versus pen testing, as since you're
21:01 Here's the million-dollar question. If you could only do one, what
24:42 Imagine if somebody invented a new service. It's lack of denial
28:24 Yeah. What are some other tips that you can offer to
33:58 That almost seems like a key takeaway, but I'll ask anyway

Sarah-jane Madden -- Threat Modeling to established teams Mar 23, 2023

Show notes

Sarah-Jane Madden is the Chief Information Security Officer of Sensing Technology Group. - part of Fortive. She has over 20 years of software experience, from the most formal environments to ‘let’s fix it in production’ type teams. She has been a longtime advocate of deliberate application security as a partnership with product management and believes security does not have to be an overhead. Sarah-Jane joins us to discuss her talk at OWASP Dublin, "Far from green fields — introducing Threat Modeling to established teams. " She shares lessons learned from her 3-year journey and is transparent with the mistakes she made along the way. We hope you enjoy this conversation with...

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Arm your developers with engaging secure coding lessons developed with input from leading application security experts.
→ Learn more about Security Journey

Connect with Sarah-jane Madden:
→ Fortive
→ Microsoft Threat Modeling Tool

Mentioned in this episode:
→ Fortive
→ Microsoft Threat Modeling Tool

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Sarah-jane Madden: Threat Modeling to established teams
05:34 Yeah, very cool. So, when I think about bank security, everything
08:01 Yeah. So, I got a chance to catch your talk at
13:22 Yeah, yeah. And that's, you know, what you're describing here, I
19:10 A couple of questions that came to me as I was
22:51 Then you also mentioned kind of when you first were the
26:29 Yeah, and you mentioned the word tribal. And so, were there
38:00 I don't care what the actual answer is. I'm just trying
40:33 As we kind of come to the end of our conversation

Our TOPPODCAST Picks

Follow Us

Stay Connected

The Application Security Podcast

Related Podcasts

Links

Stay Connected