The Application Security Podcast

Latest Episodes:

Sam Stepanyan -- OWASP Nettacker Project Nov 08, 2022

Show notes

Sam Stepanyan is an OWASP London Chapter Leader and an Independent Application Security Consultant with over 20 years of IT experience and a background in software engineering and web application development. Sam has worked for various financial services institutions in the City of London, specializing in Application Security consulting, Secure Software Development Lifecycle (SDLC), developer training, source code reviews and vulnerability management. He is also a Subject Matter Expert in Web Application Firewalls (WAF) and SIEM systems. Sam holds a Master’s degree in Software Engineering and a CISSP certification. Sam Stepanyan is an OWASP chapter leader and an independent application security consultant with over 20 years of experience in the IT industry with a background in software and web app development.

You are now listening to the Application Security Podcast brought to you by Security Journey.

About Security Journey
Hey folks, welcome to another episode of the Application Security Podcast, and this is Robert Hurlbut.
→ Learn more about Security Journey

Connect with Sam Stepanyan:
→ OWASP Nettacker
→ OWASP ZAP

Mentioned in this episode:
→ OWASP Nettacker
→ OWASP ZAP
→ Metasploit
→ Kali Linux
→ Jeremiah Grossman
→ OWASP Top Ten
→ Black Hat

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Sam Stepanyan: OWASP Nettacker Project
01:48 Like we typically do, we'd like to start off with your
05:34 Yeah, that was a great event to be a part of
13:36 The security team, that is one of the foundational tools that
16:44 About performance. So when I hear you describe it's written in
20:38 In terms of, you mentioned vulnerabilities and having a library of
26:01 They don't have a lot of commercial tools and things that
39:58 Yeah. So, what's a key takeaway then or a call to

Nick Aleks and Dolev Farhi -- GraphQL Security Nov 01, 2022

Show notes

GraphQL gives clients remarkable flexibility, but that same flexibility can expose authorization gaps, denial-of-service paths, and unexpected routes to sensitive data. Black Hat GraphQL authors Nick Aleks and Dolev Farhi join Chris and Robert to explain how GraphQL differs from SQL and REST, why its schema and query model change the attacker’s workflow, and which familiar web risks still apply. They explore introspection, field-level authorization, query depth and complexity, batching, injection, and direct attacks against GraphQL endpoints. The discussion moves from reconnaissance and exploitation to practical mitigations, including strong server-side controls, input validation, output encoding, and deliberate limits on what clients may request. Nick and Dolev also introduce the vulnerable applications and tooling behind their book and offer a path for practitioners to build hands-on GraphQL security skills.

You are now listening to the Application Security Podcast brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Dolev Farhi and Nick Aleks:
→ Dolev Farhi on LinkedIn
→ Nick Aleks on LinkedIn
→ Black Hat GraphQL
→ Damn Vulnerable GraphQL Application

Mentioned in this episode:
→ Black Hat GraphQL (book)
→ CrackQL
→ Damn Vulnerable GraphQL Application
→ Wealthsimple
→ OWASP API Security Top 10

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Nick Aleks and Dolev Farhi: GraphQL Security
04:44 Dolev’s security origin story
07:01 Introducing Black Hat GraphQL
07:51 What GraphQL is and where teams use it
10:57 GraphQL compared with SQL
13:19 The GraphQL threat landscape
18:16 How familiar OWASP risks appear in GraphQL
20:59 How attackers discover and reach GraphQL endpoints
29:24 Mitigating authorization and denial-of-service risks
34:14 Server-side controls, validation, and output encoding
36:56 Why Nick and Dolev wrote the book
40:00 Practical GraphQL security takeaways

Guy Barhart-Magen -- Log4j and Incident Response Sep 23, 2022

Show notes

With nearly 25 years of experience in the cyber-security industry, Guy held various positions in both corporates and startups. In his role as the CTO for the cyber crisis management firm Profero, his focus is making incident response fast and scalable, harnessing the latest technologies and a cloud-native approach. Guy is the BSidesTLV chairman and CTF lead, a Public speaker in well-known global security events (SAS, t2, 44CON, BSidesLV, and several DefCon villages, to name a few), and the recipient of the Cisco “black belt” security ninja honor – Cisco’s highest cybersecurity advocate rank. Guy joins us to explore his front-row seat for the incident response with Log4j.

You are now listening to the Application Security Podcast, brought to you by Security Journey.

About Security Journey
Hey folks, welcome to another episode of the Application Security Podcast.
→ Learn more about Security Journey

Connect with Guy Barhart-Magen:
→ Profero
→ Log4j

Mentioned in this episode:
→ Profero
→ Log4j
→ Aleph One's "Smashing The Stack for Fun and Profit"
→ Heartbleed
→ OpenSSL

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Guy Barhart-Magen: Log4j and Incident Response
02:18 I promise I'll be back for year 60 at least. for
07:40 That's really cool. I miss those days. There was a, there
10:10 From the kind of going back into the security realm, what
28:31 I mean, that's historically— when you think about some of the
31:06 Yeah. So here's a question for you as you kind of
36:02 Yeah, I mean, that's a common challenge though, right
39:01 Yeah. That's, that is definitely a challenging scenario. And as an

Brett Smith -- Security is a Necessary Evil Aug 30, 2022

Show notes

Brett Smith is a Software Architect/Engineer/Developer with 20+ years of experience. Specialties: Automation, Continuous Integration/Delivery/Testing/Deployment Expertise: Linux, packaging, and tool design. Brett joins us to discuss why he hates security and shares his vast knowledge of building a secure and cutting-edge build pipeline. We hope you enjoy this conversation with... Brett Smith is a software architect, engineer, developer with 20+ years of experience. His specialties include automation, continuous integration, delivery, testing, deployment, plus he has expertise in Linux packaging and tool design. Now, don't hang up right now. There's a lot more to his thoughts on security. He also has vast knowledge building a secure and cutting-edge build pipeline, and so he's going to walk you through the different phases and things that you need to be thinking about when building a secure build pipeline.

You are now listening to the Application Security Podcast brought to you by Security Journey.

About Security Journey
Hey folks, welcome to another episode of the Application Security Podcast.
→ Learn more about Security Journey

Connect with Brett Smith:
→ SLSA
→ in-toto

Mentioned in this episode:
→ SLSA
→ in-toto
→ Rekor (Sigstore)
→ OpenVEX spec
→ OWASP Threat Dragon
→ eBPF
→ GitHub Dependabot
→ VEX
→ Jenkins
→ Snyk

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Brett Smith: Security is a Necessary Evil
01:19 I'm going to get to asking Brett his origin story in
08:30 So you wouldn't, you wouldn't give yourself the moniker or title
12:18 I mean, there is a weakest link, right
17:05 That's a good startup idea right there. Just follow somebody around
21:11 I mean, that's kind of like a bare minimum level of
23:14 Do you get to that exploitability and being able to measure
26:03 With eBPF, this is gonna be more from like, Linux-based applications
33:30 I've heard other people with that same idea. Back on the
38:10 Yeah, I mean, I think you've given us some different concepts
40:53 From a key takeaway perspective or a call to action, we've

Chen Gour-Arie -- The AppSec Map Aug 16, 2022

Show notes

Chen Gour-Arie is the Chief Architect and Co-Founder of Enso Security. With over 15 years of hands-on experience in cybersecurity and software development, Chen demonstrably bolstered the software security of dozens of global enterprise organizations across multiple industry verticals. An enthusiastic builder, he has focused his career on building tools to optimize and accelerate security testing and all related workflows. Ken joins us to introduce the AppSec Map and provides a live demo of the catalog and what AppSec practitioners can use it for. We hope you enjoy this conversation with... Kahen Gour-Arie is the chief architect and co-founder of Enso Security. He's an enthusiastic builder, and he's focused his career on building tools to optimize and accelerate security testing and all related workflows.

You are now listening to the Application Security Podcast, brought to you by Security Journey.

About Security Journey
Hey folks, welcome to another episode of the Application Security Podcast.
→ Learn more about Security Journey

Connect with Chen Gour-Arie:
→ Enso Security
→ AppSec Village

Mentioned in this episode:
→ Enso Security
→ AppSec Village

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Chen Gour-Arie: The AppSec Map
02:09 Our guest today is Kahan Ghorarieh, and I probably just butchered
08:11 I do have a follow-up question in regards to the startup
10:14 Our topic today is, as we mentioned, AppSec Map. And so
11:51 You think about this project and the fact that it exists
15:44 Yeah. Yeah, so in terms of— so we talked about what
18:01 If— so I understand the different categories of kind of consumers
27:31 This is a good place to add tools into that can
30:20 Very cool. This has been great to get a perspective on

Dominique Righetto -- OWASP Secure Headers Aug 09, 2022

Show notes

Dominique Righetto is an AppSec enthusiast and OWASP projects contributor. Dominique joins us to discuss the OWASP Secure Headers project. We discuss headers at a high level and then dive into all the goodies you'll find within the project, from awareness, guidance, and a test suite that can be integrated into your CI/CD pipeline to test your security headers. We hope you enjoy this conversation with... We talk about headers at a high level and then dive into all the goodies you'll find within the project, from awareness, guidance, and a test suite that can be integrated into your CI/CD pipeline to test your security headers.

You are now listening to the Application Security Podcast, brought to you by Security Journey.

About Security Journey
Hey folks, welcome to another episode of the Application Security Podcast.
→ Learn more about Security Journey

Connect with Dominique Righetto:
→ OWASP Secure Headers Project
→ OWASP Cheat Sheet Series

Mentioned in this episode:
→ OWASP Secure Headers Project
→ OWASP Cheat Sheet Series
→ OWASP Top 10
→ Venom (OVH)
→ Content-Security-Policy (MDN)

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Dominique Righetto: OWASP Secure Headers
02:13 I know I've seen your name attached to various things in
04:18 Okay. I'm just poking a little fun at the history of
07:58 Someday I hope to meet one of the 3 people that
12:36 Help us understand, if you could, an example. of, I have
14:21 Yeah, let's look at one of them specifically. So I'm looking
16:27 We talked about kind of the guidance side of this. What
20:35 Then the stats project, is this— so what would a developer
24:27 I know we were at our key takeaways, but I'm going

Hillel Solow -- How to do AppSec without a security team Jul 25, 2022

Show notes

How can a startup build meaningful AppSec when it cannot hire a dedicated security specialist? Hillel Solow, a longtime security product builder and former ProtectOnce chairman, joins Chris and Robert to frame an application security program around what matters most: protecting availability, confidentiality, and integrity without crippling the product. They break the work into before, during, and after deployment; compare the constraints facing startups, midsize companies, and large enterprises; and explain why tools only help when developers understand their purpose. Hillel also argues that small companies need an incident plan, basic security architecture, and shared ownership early—not after the first enterprise security questionnaire arrives. The practical takeaway is simple: use what already exists, prioritize by risk, and make security part of everyone’s job.

You are now listening to the Application Security Podcast, brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Hillel Solow:
→ Hillel Solow on LinkedIn

Mentioned in this episode:
→ OWASP DevSecOps Guideline
→ AICPA SOC for Service Organizations overview

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Hillel Solow: AppSec Without a Security Team
03:03 From junior developer to security engineering
05:44 The building blocks of an AppSec program
10:28 Defense in depth across the application lifecycle
12:48 Why security tools need developer education
13:31 AppSec at startup, midsize, and enterprise scale
18:09 Advice for companies without a security specialist
23:41 A one-page incident response plan beats panic
27:01 Why small companies are still attractive targets
29:49 Making security everyone’s responsibility
30:33 Hillel’s practical call to action

Chris Romeo -- The Security Journey Story Jun 02, 2022

Show notes

In this episode of the Application Security Podcast, Chris Romeo walks through the origin story of Security Journey and shares some experiences taking a security startup from bootstrap to acquisition. Chris talks about how and why he started the company, what defining factors made Security Journey successful and why they're being acquired now. He ends by giving an overview of what to expect from Security Journey moving forward. We hope you enjoy this conversation with…Chris Romeo. You're about to listen to AppSec Podcast. When you're done with this, be sure to check out our other show, High Five. Hey, welcome folks to another episode of the Application Security Podcast.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
You're about to listen to AppSec Podcast.
→ Learn more about Security Journey

Connect with Chris Romeo:
→ Chris Romeo on LinkedIn
→ Press Release: HackEDU Acquires Security Journey

Mentioned in this episode:
→ Press Release: HackEDU Acquires Security Journey
→ Joe's Blog Post
→ Hackedu Acquires Security Journey
→ Cisco Security Ninja
→ Threat Modeling Manifesto

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Chris Romeo: The Security Journey Story
02:03 In those early days, yeah, I remember meeting and talking about
10:43 So, I start telling the story of what we had accomplished
14:38 I barely had $10 when I started this thing. But what
16:01 Yeah, that's a great history. A lot of things going on
19:39 Yeah, she was in those modules in the early days when
23:26 Excellent. And so, going forward, what do you see for the

Kristen Tan and Vaibhav Garg -- Machine Assisted Threat Modeling May 10, 2022

Show notes

Can machines make threat modeling faster without stripping away the judgment that makes it useful? Kristen Tan and Vaibhav Garg join Chris and Robert to discuss their analysis of open source automated threat modeling tools and what it reveals about automation, extensibility, security, and privacy. They explain why they studied the available tools, how they evaluated them, and where machine assistance can support rather than replace human reasoning. The conversation covers developer-friendly formats, privacy requirements, organizational fit, and the gap between generating threats and helping real working teams make better design decisions throughout the modern software development lifecycle in practice.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Kristen Tan and Vaibhav Garg:
→ Kristen Tan on LinkedIn
→ Vaibhav Garg on LinkedIn

Mentioned in this episode:
→ Analysis of open source automated threat modeling tools
→ OWASP pytm

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Machine-assisted threat modeling
01:44 Kristen Tan’s path to threat modeling research
03:29 Vaibhav Garg’s security and privacy background
06:49 Why analyze automated threat modeling tools
09:18 Security and privacy as connected disciplines
12:17 What motivated the research
14:37 Can machines automate threat modeling?
20:45 How the tools were evaluated
24:24 Open source tools and extensibility
28:59 Evaluation criteria and research results
35:14 Choosing a tool that fits the organization
37:00 YAML, developers, and usable workflows
39:00 Keeping threat modeling user-centered
45:00 Final takeaways

Patrick Dwyer -- CycloneDX and SBOMs May 03, 2022

Show notes

Patrick is a Senior Product Security Engineer in the Application Security team at ServiceNow. He is also Co-Leader of the OWASP CycloneDX project. A lightweight Software Bill of Materials (SBOM) standard designed for use in application security contexts and supply chain component analysis. Patrick Dwyer is a senior product security engineer in the application security team at ServiceNow. He's also co-leader of the OWASP CycloneDX project, a lightweight software bill of materials standard designed for use in application security contexts and supply chain component analysis. Patrick joins us to help us understand how CycloneDX fits into the world of protecting your software supply chain. He explains why they started the project and what is the depth and breadth of it, how many people are using it, and what is the future for CycloneDX and software supply chain.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Patrick Dwyer is a senior product security engineer in the application security team at ServiceNow.
→ Learn more about Security Journey

Connect with Patrick Dwyer:
→ CycloneDX
→ ServiceNow

Mentioned in this episode:
→ CycloneDX
→ ServiceNow
→ CycloneDX
→ OWASP Dependency-Track
→ SPDX
→ Docker
→ JC Herz and Steve Springett -- SBOMs and software supply chain assurance

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Patrick Dwyer: CycloneDX and SBOMs
05:07 Awesome. So I want to, I want to transition into talking
07:36 I guess what was the need when this project was started
10:01 So, so they have kind of different functions then. So I
12:12 Cool. So let's back up for a second. I probably got
14:10 Yeah, I'm also seeing the value then of retrieving SBOMs in
18:41 How'd you get involved with this then, with the CycloneDX project
19:52 Very cool. Very cool. So I mentioned kind of at the—
23:21 Yeah, that's, that's great to hear. What do you see as
25:11 Yeah, I guess as the tooling continues to improve and the

Our TOPPODCAST Picks

Follow Us

Stay Connected

The Application Security Podcast

Related Podcasts

Links

Stay Connected