The Application Security Podcast

Latest Episodes:

Jet Anderson -- The AppSec Code Doctor Mar 16, 2023

Show notes

Jet Anderson's passion is teaching today's software developers to write secure code as part of modern DevOps pipelines, at speed and scale, without missing a beat. He's been a software engineer for over 25 years and believes fixing security bugs is better than finding them. Jet joins us to discuss software or security engineer first, how fixing security bugs is better than just finding them, and the Code Doctor security training program he built and deployed. We hope you enjoy this conversation with... Jett Anderson's passion is teaching today's software developers to write secure code as part of modern DevOps pipelines at speed and at scale without missing a beat.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Jett Anderson's passion is teaching today's software developers to write secure code as part of modern DevOps pipelines at speed and at scale without missing a beat.
→ Learn more about Security Journey

Connect with Jet Anderson:
→ OWASP Top 10
→ CSSLP

Mentioned in this episode:
→ OWASP Top 10
→ CSSLP
→ CISSP
→ OWASP Dependency-Check
→ Content Security Policy Cheat Sheet
→ OAuth 2.0
→ OpenID Connect
→ Jim Manico
→ Gary McGraw
→ Content-Security-Policy (MDN)

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Jet Anderson: The AppSec Code Doctor
01:49 Yeah, but we're going to take a left turn or a
04:52 Do you define a vulnerability as then
07:54 Yeah, that's true. So, I want to hit play on that
14:31 There, you know, kind of a lesson within the way that
17:39 You should understand is the OWASP Top 10. But I'm curious
21:08 Yeah, I mean, it's empathy, right
25:28 Kind of what is it and what were the pieces that
35:02 Yeah, that's great. It's— I always love, like I said, I

James Mckee -- Developer Security Mar 09, 2023

Show notes

James Mckee is a developer (MCPDEA) and security advocate (CISSP) whose biggest responsibility is leading developer security practices. He sets the standards and procedures for the practice's operations and leads all client engagement efforts concerning security. He also takes the lead in ensuring that company staff (developers specifically) are properly trained and following best practices concerning application security. Currently, he is responsible for training and providing product guidance for developers worldwide. James joins us to discuss offensive application security for developers. We also get into the role of security professionals in reaching developers outside of the security echo chamber. We hope you enjoy this conversation with...

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
James McKee is a developer, MCP-DEA, and a security advocate, CISSP, whose biggest responsibility is leading developer security practices.
→ Learn more about Security Journey

Connect with James Mckee:
→ Applied Cryptography
→ AppSec Village

Mentioned in this episode:
→ Applied Cryptography
→ AppSec Village
→ DEF CON
→ Start with Why
→ Stack Overflow
→ Information Security Stack Exchange
→ ChatGPT
→ GitHub Copilot
→ OWASP Top 10
→ OWASP ASVS
→ OWASP Proactive Controls
→ OWASP Cheat Sheet Series
→ BSides Boulder
→ OWASP Cheat Sheet Series

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet James Mckee: Developer Security
02:01 Yeah, and it's been, I don't know, 6 weeks, 2 months
07:13 Yeah, we hear that a lot in AppSec people. A lot
10:43 Great experience for me too. So I did a threat modeling
13:01 Yeah. Yeah. Let's, let's call an audible on our plan here
20:24 Which is not a great thing. And I remember one example
25:54 Are they training that
28:49 About, so you're talking about training the junior developers, but what
29:56 Right
32:05 We kind of went off on a bit of a tangent
35:00 Yeah, GitHub says there's 26 million developers on Earth right now

Derek Fisher -- The Application Security Handbook Mar 02, 2023

Show notes

Derek is the author of “The Application Security Handbook. ” He is a university instructor at Temple University, where he teaches software development security to undergraduate and graduate students. He is a speaker on topics in the cybersecurity space and has led security teams, large and small, at organizations in the healthcare and financial industries. Derek joins us to unpack the goals of an application security program, what is cutting edge in application security programs today, the role of open source vs. commercial, and guidance such as "decentralized application security. " "enablement instead of gates; application security as a service," and "stop chasing the shiny new tool.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Derek Fisher is the author of The Application Security Handbook.
→ Learn more about Security Journey

Connect with Derek Fisher:
→ The Application Security Handbook
→ Application Security Program Handbook

Mentioned in this episode:
→ The Application Security Handbook
→ Application Security Program Handbook
→ Manning Publications
→ OWASP ModSecurity Core Rule Set

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Derek Fisher: The Application Security Handbook
02:04 Excellent. And I know you just wrote a book or just
04:27 Derek, you mentioned in our previous conversation getting ready for this
10:27 Rewind the tape here. That's not entry-level. If you have to
14:51 It's, I mean, I think there is value though, right
17:26 With that in mind, in thinking about application programs today, is
20:02 I think about, you know, across the innovation we've seen in
22:18 I think part of the challenge is there really hasn't been
25:38 Yeah, it kind of brings you to more of a culture
30:17 Or sound impressive, right
33:52 So you also, you know, you kind of mentioned this a
38:16 Yeah, no, that's helpful, helpful to have that perspective. Like, it's
39:22 My, I'm going to go first with a key takeaway here

Rob van der Veer -- OWASP AI Security & Privacy Guide Feb 23, 2023

Show notes

Rob van der Veer has a 30-year background in software engineering, building AI businesses, creating software, and assessing software. He is a senior director at the Software Improvement Group, where he established practices for AI, security, and privacy. Rob is involved in several standardization initiatives like OWASP SAMM, ENISA, CIP, and AI security & privacy guide. He leads the writing group for the new ISO standard on AI engineering: 5338. Rob co-leads the OWASP integration project, with openCRE. org as a key result, aiming to create alignment in the standards landscape. Rob joins us to introduce the OWASP AI Security and Privacy Guide. We hope you enjoy this conversation with...

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Rob van der Veer has a 30-year background in software engineering, building AI businesses, creating software, and assessing software.
→ Learn more about Security Journey

Connect with Rob van der Veer:
→ OWASP AI Security and Privacy Guide
→ openCRE.org

Mentioned in this episode:
→ OWASP AI Security and Privacy Guide
→ openCRE.org
→ ChatGPT
→ Tay (Microsoft chatbot)
→ Gary McGraw
→ OWASP SAMM
→ ENISA
→ OWASP Project Spotlight Series
→ GitHub Copilot

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Rob van der Veer: OWASP AI Security & Privacy Guide
01:32 Hey folks, welcome to another episode of the Application Security Podcast
06:56 Yeah, no, it's helpful to understand because you're coming to the
09:22 We're thinking about, you know, in your experience and observations on
12:50 I've heard somebody say, I've heard people say, like, at a
15:19 You know, excuse my naivety here, but from when we're talking
16:48 That's helpful. So, I had another question. As you were talking
25:30 Looking back at the guide, the scope of the guide, how
32:20 Yeah, especially when you're thinking, you know, you mentioned earlier that
35:05 Thinking about organizations who are looking to build an AI system
38:59 Yeah, excellent. So, I certainly learned a lot through this short

Robyn Lundin -- Planning & organizing a penetration test as an AppSec team Jan 10, 2023

Show notes

Robyn Lundin started working in tech after a coding boot camp as a developer for a small startup. She then discovered her passion for security, pivoted into pentesting for NCC Group, and now works as a Senior Product Security Engineer for Slack. Robyn joins us to discuss the role of penetration testing within the application security realm. Robyn provides actionable guidance that you can apply directly to your application pen testing program. We hope you enjoy this conversation with Robyn London. The conversation connects NCC Group, Slack, OWASP Juice Shop to practical choices that application security teams can make in their own programs.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We help enterprises reduce vulnerabilities through application security education for developers and everyone in the SDLC.
→ Learn more about Security Journey

Connect with Robyn Lundin:
→ NCC Group
→ Slack

Mentioned in this episode:
→ NCC Group
→ Slack
→ OWASP Juice Shop

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Robyn Lundin: Planning & organizing a penetration test as an AppSec team
03:37 Very, very cool. And that's, you know, one of the things
05:59 Very cool. And mentorship is such an important thing for us
07:17 Great advice. So Robyn, as we get started today in talking
08:55 To kind of dive into the deep end of our penetration
13:27 Yeah. So you mentioned low-hanging fruit, and I guess that's always
17:37 I've been away from pen testing for a long, long, long
20:16 Frequency. So let's say we have 1,000 apps. Do we test
22:07 Yeah, and just to let the record show, I think we
24:57 Would that also apply to, so if we had internal resources
26:48 Very good. So if you would, Robyn, just sort of wrapping

Michael Bargury -- Low Code / No Code Security and an OWASP Top Ten Jan 03, 2023

Show notes

Michael Bargury is the Co-Founder and CTO of Zenity, where he helps companies secure their low-code/no-code apps. In the past, he headed security product efforts at Azure, focused on IoT, APIs and IaC. Michael's passionate about all things related to cloud, SaaS, and low-code security, and spends his time finding ways they could go wrong. He also leads the OWASP Low-Code Security Project and writes about it on Dark Reading. Michael's a regular conference speaker at OWASP BSides, DEF CON, Michael joins us to unpack low-code, no-code, and the new OWASP Top 10 that defines specific risks against low and no-code. We hope you enjoy this conversation with Michael Bargheri.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We help enterprises reduce vulnerabilities through application security education for developers and everyone in the SDLC.
→ Learn more about Security Journey

Connect with Michael Bargury:
→ Zenity
→ OWASP Low-Code/No-Code Top 10

Mentioned in this episode:
→ Zenity
→ OWASP Low-Code/No-Code Top 10
→ Robert Hurlbut

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Michael Bargury: Low Code / No Code Security and an OWASP Top Ten
01:33 Yeah. And you just got back from Global AppSec, right, in
04:13 Michael, so thanks again for joining us. As I mentioned, our
08:49 Yeah. So, just to And sure, I want to kind of
10:15 That's no-code then in that example, right
18:23 Wow. Yeah, it's a whole new avenue that nobody's really thought
20:16 With that in mind, you know, I was thinking about that
23:28 You have an example
26:46 You agree with that or is there something I'm missing
29:34 So, you've put together this new project, the OWASP Top 10
36:11 Michael, you have— I mean, I really love this list. It's
38:43 I look at these, you've got, you know, I'm looking at
42:56 Yeah. So, there's a lot more here to look at, and

Alex Olsen -- Security champions, empowering developers, and AppSec training Dec 20, 2022

Show notes

Alex leads the Cyber Security Consulting Group, part of Rakuten's Cyber Security Defense Department. The group's dedication is to providing global security services, including security architecture, DevSecOps tooling and integration services, delivery of technical training, and running Rakuten's Security Champion community. His focus is on empowering teams to improve security throughout the development lifecycle. Alex Olsen leads the Cybersecurity Consulting Group, part of Rakuten's Cybersecurity Defense Department. The group is dedicated to providing global security services, including security architecture, DevSecOps tooling and integration services, delivery of technical training, and the running of Rakuten's Security Champion Community. Alex joins us to talk about security champions, one of the topics that's near and dear to my heart.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We help enterprises reduce vulnerabilities through application security education for developers and everyone in the SDLC.
→ Learn more about Security Journey

Connect with Alex Olsen:
→ Rakuten: Democratizing AppSec
→ OWASP Global AppSec APAC

Mentioned in this episode:
→ Rakuten: Democratizing AppSec
→ OWASP Global AppSec APAC

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Alex Olsen: Security champions, empowering developers, and AppSec training
03:54 There was a term that was used, democratizing AppSec. And it
07:00 Yeah. So, I guess what's the trade-off then when you— it
10:21 Like, they are the police because they can stop deployments, they
11:36 Yeah, so the kind of primary thing we want to talk
15:03 What's been your response or your experience with that
19:43 I'm listening to kind of— you're describing an onboarding process for
22:21 We think about, like, scope, cost, and effort, levels of effort
26:50 There's lots of excitement, right
35:21 Tactically or specifically about individual champions now. What have you seen
46:20 It was the return on investment. So, you know, what are
53:59 From a key takeaway perspective now, so let's kind of summarize

Mark Curphey -- The future of OWASP Dec 13, 2022

Show notes

Mark Curphey is one of the creators of OWASP from the very early days. Mark worked in the background over the few decades of OWASP but has recently taken more to the spotlight. After running, he was elected and joined the OWASP Board of Directors. Hello, fine listeners from all over planet Earth. This is Chris Romeo, and I just wanted to let you know that you're in for a treat with this week's episode. This week we're joined by Mark Kerfe, and you may or may not have known, but Mark was involved in the creation of OWASP from the very early days. Now, Mark has been working in the background helping things happen over the few decades of OWASP, but he has recently run for and been elected to the OWASP Board of Directors.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We help enterprises reduce vulnerabilities through application security education for developers and everyone in the SDLC.
→ Learn more about Security Journey

Connect with Mark Curphey:
→ Jeff Williams on LinkedIn
→ OWASP

Mentioned in this episode:
→ OWASP
→ OWASP Top Ten
→ WebGoat
→ OWASP Juice Shop
→ ZAP
→ OpenSSF
→ Alpha-Omega
→ Sigstore
→ CycloneDX
→ OWASP ModSecurity Core Rule Set
→ Royal Holloway Information Security
→ Ward Cunningham
→ Linux Foundation
→ Mark Curphey
→ OWASP Top Ten
→ OpenSSL
→ Jeff Williams on LinkedIn
→ Christian Folini

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Mark Curphey: The future of OWASP
03:58 You're getting to university, you're in this kind of information security-focused
12:26 Would you say then was the first project
15:33 It definitely is fun to watch kind of where it's gotten
22:02 I think about, you know, kind of taking a different strategy
25:35 Yeah. No, that definitely makes sense. So, you know, when I
31:24 Cool. Let's transition and talk a little bit about the larger
35:06 There's a lot more moving pieces to it. So, When we
38:59 Yeah, that is a great goal for all of us to

Tiago Mendo -- How to scan at scale with OWASP ZAP Dec 06, 2022

Show notes

Tiago Mendo is a co-founder and CTO of Probely. He has extensive experience in pentesting applications, training, and providing all-around security consultancy. Tiago Mendo is a co-founder and CTO of Probly. He has extensive experience in pen testing applications, training, and providing all-around security consultancy. He started working with security in the early 2000s with a tenure of 12 years at Portugal Telecom, where he built the web security team and worked with 150+ developers. He holds a master's in information technology, information security from Carnegie Mellon University, and a CISSP certification. He's also a qualified member of AP2SI, a nonprofit organization that promotes information security in Portugal, and co-leader of the Lisbon OWASP chapter.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We help enterprises reduce vulnerabilities through application security education for developers and everyone in the SDLC.
→ Learn more about Security Journey

Connect with Tiago Mendo:
→ OWASP ZAP
→ Probely

Mentioned in this episode:
→ OWASP ZAP
→ Probely
→ sqlmap
→ Jenkins
→ PCI DSS
→ Cobalt.io
→ LASCON

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Tiago Mendo: How to scan at scale with OWASP ZAP
02:23 One thing we like to do in our podcast is start
07:14 Very cool. And so from understanding and hearing about the talk
10:23 About in a DevOps context
12:56 Then, what are some of the challenges, Diego, from trying to
22:32 That's either hitting test environments or even production environments as well
28:55 As we think about, you know, for our listeners, what they

Wolfgang Goerlich -- Security beyond vulnerabilities Nov 29, 2022

Show notes

J. Wolfgang Goerlich is an Advisory CISO for Cisco Secure. He has been responsible for IT and IT security in the healthcare and financial services verticals. Wolfgang has led advisory and assessment practices for cybersecurity consulting firms. Wolf challenged my thinking in this episode and pointed out a new area of threat modeling that I had never considered. The conversation connects Cisco Secure, Converge Detroit, LINDDUN to practical choices that application security teams can make in their own programs. The hosts press for concrete lessons, tradeoffs, and actions practitioners can carry into their next security decision. It closes with practical guidance for application security leaders.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We help enterprises reduce vulnerabilities through application security education for developers and everyone in the SDLC.
→ Learn more about Security Journey

Connect with Wolfgang Goerlich:
→ Cisco Secure
→ Converge Detroit

Mentioned in this episode:
→ Cisco Secure
→ Converge Detroit
→ LINDDUN
→ MITRE ATT&CK Framework

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Wolfgang Goerlich: Security beyond vulnerabilities
05:56 Very, very cool. It's funny, I have a very similar origin
09:10 I didn't even know, but they taught me the importance of
12:16 Yeah. Very cool. One of the things I learned from— it
14:47 This idea of security beyond vulnerabilities, because I'm really curious to
20:35 Criminal organizations able to use the transfer of funds liberally to
23:10 Yeah. And so, When I think about threat modeling from a
28:05 Why
32:12 That's really— that's great. That's great advice for just people building
37:58 From a key takeaway perspective or a call to action, We

Our TOPPODCAST Picks

Follow Us

Stay Connected

The Application Security Podcast

Related Podcasts

Links

Stay Connected