The Application Security Podcast

Latest Episodes:

Omer Gil and Daniel Krivelevich -- Top 10 CI/CD Security Risks Apr 25, 2022

Show notes

CI/CD systems hold code, credentials, and production access, yet many organizations still treat them as internal plumbing rather than a critical attack surface. Omer Gil and Daniel Krivelevich join Chris and Robert to explain the research behind the Top 10 CI/CD Security Risks. They trace lessons from SolarWinds and Codecov, show why pipeline security often falls between AppSec and infrastructure teams, and describe how the list was built with community input. The discussion turns the risks into practical guidance for threat modeling pipelines, reducing exposure, assigning ownership, and using the intentionally vulnerable CI/CD Goat project to learn safely by doing.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Omer Gil and Daniel Krivelevich:
→ Omer Gil on LinkedIn
→ Daniel Krivelevich on LinkedIn
→ Top 10 CI/CD Security Risks

Mentioned in this episode:
→ Top 10 CI/CD Security Risks
→ Threat Modeling Manifesto
→ CI/CD Goat

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 The hidden attack surface in CI/CD
02:03 Why create a CI/CD security top ten
04:30 How the project began
11:17 Making the risks useful to developers
14:49 Lessons from SolarWinds and Codecov
21:26 Why CI/CD security falls through the cracks
27:17 Research and community collaboration
30:38 Building and ranking the risk list
35:20 Mitigations teams can apply
39:33 When internal build systems are exposed
44:18 Threat modeling the software pipeline
48:44 Learning with CI/CD Goat

Josh Grossman -- Building a High-Value AppSec Scanning Program Apr 19, 2022

Show notes

Josh Grossman has over 15 years of experience in IT Risk and Application Security consulting, and he has also worked as a software developer. He currently works as CTO for Bounce Security, where he focuses on helping organizations build secure products by providing value-driven Application Security support and guidance. In his spare time, he is very involved with OWASP. He is on the OWASP Israel chapter board, he is a co-leader of the OWASP Application Security Verification Standard project, and he has contributed to various other projects as well, including the Top 10 Risks, Top Ten Proactive Controls and JuiceShop projects. We hope you enjoy this conversation with...

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Josh Grossman has over 15 years experience in IT risk and application security consulting, and he's also worked as a software developer.
→ Learn more about Security Journey

Connect with Josh Grossman:
→ OWASP Application Security Verification Standard (ASVS)
→ OWASP Juice Shop

Mentioned in this episode:
→ OWASP Application Security Verification Standard (ASVS)
→ OWASP Juice Shop
→ Alyssa Miller
→ Avi Douglen on Twitter
→ SAST, DAST, IAST, and RASP: Pros, cons and how to choose

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Josh Grossman: Building a High-Value AppSec Scanning Program
02:10 So our guest today is Josh Grossman. Josh is, this is
04:02 Yeah, no, that's cool. Avi's a good friend of ours and
07:46 Josh, today's topic, we're going to be focusing on something you
10:26 So before we dive deeper into this, I think it would
13:08 Would you lump IAST then, interactive application security testing, into kind
14:44 We got to put together a solid AppSec scanning program. Where'd
19:34 Josh, we've talked about the importance of these tools, and none
25:51 Specific definition in the world of OWASP, right
32:26 Yeah, I was going to say the sunk cost analysis is
34:35 I mean, push the envelope. I mean, I wouldn't buy an
37:01 That's another problem. When I think about, and that's a whole

Alex Mor -- Application Risk Profiling at Scale Mar 15, 2022

Show notes

Alex Mor is a passionate cybersecurity defender or breaker depending on the time of day, providing expert technical guidance to product teams and building security in their platforms. Alex joins us to talk about application risk profiling. He defines what this concept is to help us understand it. Then we talk about how can you do application risk profiling at scale? Whether you have ten applications or 1500 applications? How do you bring this together and gain real true security value from this idea of profiling your applications? We hope you enjoyed this conversation with Alex Mor. Twitter: @nashcontrol Alex Moore is a passionate cybersecurity defender or breaker, depending on the time of day, providing expert technical guidance to product teams in building security in their platforms.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Alex Moore is a passionate cybersecurity defender or breaker, depending on the time of day, providing expert technical guidance to product teams in building security in their platforms.
→ Learn more about Security Journey

Connect with Alex Mor:
→ OWASP SAMM
→ Alyssa Miller

Mentioned in this episode:
→ OWASP SAMM
→ Alyssa Miller
→ Alyssa Miller

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Alex Mor: Application Risk Profiling at Scale
06:48 Given that you've had quite a bit of pen testing experience
09:04 Yeah, and it's interesting for me as I'm thinking about this
14:06 About what do you mean when you say application risk profiling
20:10 Knew Excel
24:07 Alex, who's answering those questions then
27:55 You got it as a low. So how do we govern
34:13 One of the things we like to do is, let's imagine

Brenna Leath -- Product Security Leads: A different way of approaching Security Champions Mar 09, 2022

Show notes

Brenna Leath is currently the Head of Product Security for a data analytics company where she sets the application security strategy for R&D and leads a team of security architects. Brenna originally joined us to talk about EO 14028 and the implications for private sector programs, BUT, we were chatting about security champions and product security leads, and we changed our focus to cover these topics instead. We hope you enjoy this conversation with... Brenna originally joined us to talk about Executive Order 14028 and the implications for private sector programs. But as we were chatting about security champions and product security leads in the preamble to the interview, we decided to change our focus and cover these topics instead.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Brenna Leath is currently the head of product security for a data analytics company where she sets the application security strategy for research and development and leads a team of security architects.
→ Learn more about Security Journey

Connect with Brenna Leath:
→ Executive Order 14028
→ BSIMM

Mentioned in this episode:
→ Executive Order 14028
→ BSIMM
→ OWASP Cornucopia
→ Burp Suite
→ Log4j
→ OWASP Cornucopia

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Brenna Leath: Product Security Leads: A different way of approaching Security Champions
04:02 Film studies and English is a fascinating combination for me. And
16:14 Yeah. So you may— you use the word federated in regards
19:35 Yeah, there has to be some, some action that they can
25:49 We don't believe in scaring people with it. So, so I've

Will Ratner -- Centralized container scanning Feb 16, 2022

Show notes

Will Ratner is a software security professional with extensive experience building and implementing security solutions across a myriad of industries including banking, media, construction, and information technology. In his current role at Atlassian, Will focuses on improving the vulnerability management process by building highly scalable and automated solutions for the enterprise. Will joins us to discuss a centralized approach he built for container scanning. We explore the challenges and lessons learned, building a scalable, enterprise-grade solution, and how to build something that developers will see value in. We hope you enjoy this conversation with... We also introduce the idea of container scanning and building secure images that are then used to generate containers.

Connect with Will Ratner:
→ Atlassian
→ Docker

Mentioned in this episode:
→ Atlassian
→ Docker
→ Kubernetes
→ Snyk
→ Go
→ Slack

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Will Ratner: Centralized container scanning
01:31 Yeah, and as we do that, let's turn over to Will
04:38 Very cool. And so again, we were talking about container scanning
06:59 Yeah, I love— I love that we're talking about something that's
10:12 If only everyone would start from scratch with their base image
14:53 Everything in your— is this— yeah, this whole thing is open
20:31 Yeah, that's, yeah, that's interesting. It's just, it's a, it's a
22:57 Was the, what was the amount of time, Will
29:45 So yeah, we talked a lot about tickets in this perspective
32:30 You've mentioned vulnerability funnel a couple of times, and I have
34:42 You've got great metrics, I'm guessing, coming out of that because
37:55 Will, what kind of resources would you recommend
41:12 Yeah, definitely. So, Will, thank you so much for sharing this

Neil Matatall -- AppSec at Scale Feb 09, 2022

Show notes

Neil Matatall is an engineer with a background in security. He has previously worked at GitHub and Twitter and is a co-founder of Loco Moco Product Security Conference. Neil joins us for his second visit, to discuss account security at scale. He describes the underlying principles behind security at scale, how he worked to build a sign-in analysis feature, and how attacks were detected. We ended the conversation with an authentication lightning round, with Neil responding to various statements about authentication off the cuff! We hope you enjoy this episode with Neil Matatall. He's previously worked at GitHub and Twitter and is a co-founder of the LocoMoco Product Security Conference.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Neil Matatall is an engineer with a background in security.
→ Learn more about Security Journey

Connect with Neil Matatall:
→ Loco Moco Product Security Conference
→ Have I Been Pwned

Mentioned in this episode:
→ Loco Moco Product Security Conference
→ Have I Been Pwned

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Neil Matatall: AppSec at Scale
05:46 Any kind of other thoughts on that from that perspective about
07:28 Something like, well, I was going to borrow it and use
10:19 You've sort of, I think, spoken to this in terms of
13:13 Did you build this sign-in analysis piece
20:14 The thing I love that you're bringing out in this conversation
24:57 Do I need to change it now
27:20 You've talked about quite a few ways of detecting the different
30:18 Using the API example, let's play this one out a little
34:32 No, that's neat that GitHub detects that as they come in

Joern Freydank -- Security Design Anti Patterns Limit Security Debt Jan 25, 2022

Show notes

Joern Freydank is a Lead Cyber Security Engineer with more than 20 years of experience. He is currently establishing the Threat Modeling Program at a major insurance company. Joern joins us to talk about security design anti-patterns. He defines the term, explains security debt, reviews the categories of anti-patterns, and walks us through the example of a common role misconception. We hope you enjoy this conversation with... Joern Freydank is a lead cybersecurity engineer with more than 20 years of experience. He's currently establishing the threat modeling program at a major insurance company. You're about to listen to AppSec Podcast. When you're done with this, be sure to check out our other show, High Five.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Joern Freydank is a lead cybersecurity engineer with more than 20 years of experience.
→ Learn more about Security Journey

Connect with Joern Freydank:
→ Security Design Anti-Patterns -- Creating Awareness to Limit Security Debt (YouTube talk)
→ Stack Overflow

Mentioned in this episode:
→ Security Design Anti-Patterns -- Creating Awareness to Limit Security Debt (YouTube talk)
→ Stack Overflow

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Joern Freydank: Security Design Anti Patterns Limit Security Debt
03:04 You came to security from more of the breaking perspective
04:37 One of our topics that we're going to be talking about
07:19 It's missing pieces versus bad architectural decisions that are being laid
10:53 That's one of the things that, you know, I think about
13:11 Yeah. And I was thinking a similar, the trade-off with also
17:58 Talking about roles, we mentioned roles. There's a malicious insider admin
20:15 Yeah. And you think about the couple of examples you shared
21:49 Yeah, occasionally. Certainly. I mean, like you said, mostly from the
25:04 What's the corresponding pattern, essentially
27:13 As we start to kind of bring this conversation towards a
31:04 There's an awareness— I mean, there's an awareness play in that

Ken Toler -- Blockchain, Cloud, and #AppSec Jan 18, 2022

Show notes

Ken Toler is a principal consultant at Kudelski Security and is passionate about building and optimizing application security programs that stick through strong adoption and ease of use. Ken has spent considerable time on all sides of the security aisle from playing defense and managing security teams to offense by breaking applications and reviewing code. Ken is also the host and creator of the Relating to DevSecOps podcast that focuses on forging strong relationships between engineers, operations, and security through collaboration, understanding, skill-sharing, and healthy debate. Ken joins us to talk all things Blockchain and AppSec. We define Blockchain, discuss the connections between cloud, appsec, and blockchain, common architecture failures, pen testing, and even dive into smart contracts.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Ken Toler is a principal consultant at Katelski Security and is passionate about building and optimizing AppSec programs that stick through strong adoption and ease of use.
→ Learn more about Security Journey

Connect with Ken Toler:
→ Secureum Videos
→ The Rust Programming Language

Mentioned in this episode:
→ Secureum Videos
→ The Rust Programming Language
→ Blockchain Security @ Kudelski
→ Blockchain Security A Need For Todays Businesses Complete Guide For Beginners
→ Rust

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Ken Toler: Blockchain, Cloud, and AppSec
02:06 It was a place in Texas. And Ken and I happened
05:00 It's a term that we heard. I mean, certainly in the
06:31 At the end of the day, It's an immutable ledger of
12:05 That's helpful because I hadn't really thought of it. I guess
15:20 Yeah, that's, that's very helpful. And before we transition into thinking
18:53 Yeah. To draw a parallel from my AppSec history and experience
21:59 They can decide who they want to go after first. It's
24:45 I want to get into what kinds of surprising mistakes you've
26:52 Yeah, definitely a different set of skills than our classic, you
29:05 Can you pen test a blockchain
32:13 Smart contracts and secure coding, how these things fit together. When
34:14 Yeah, I think that's a good definition that takes away from
36:42 We have a smart contract that is written onto a blockchain
38:58 You look at the code
42:53 Yeah. Very cool. So what would be your key takeaway then

Jeroen Willemsen and Ben de Haan -- Dirty little secrets Jan 11, 2022

Show notes

Secrets management fails in surprisingly ordinary ways: credentials land in code, deployment files, containers, and cloud resources, then quietly become part of the system’s attack surface. Jeroen Willemsen and Ben de Haan join Chris and Robert to introduce OWASP WrongSecrets, an intentionally vulnerable application built to teach those failure modes. They explain how the project grew from incident-response experience, why cloud services change the threat model, and how teams can reason about blast radius and maturity. The conversation closes with practical guidance for scaling secrets management across an organization and using hands-on challenges to turn abstract advice into memorable engineering lessons.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Jeroen Willemsen and Ben de Haan:
→ Jeroen Willemsen on LinkedIn
→ OWASP WrongSecrets

Mentioned in this episode:
→ OWASP WrongSecrets
→ WrongSecrets on GitHub
→ Secrets management deployment guidance
→ Terraform
→ Docker
→ Kubernetes

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 The dirty little secrets in software delivery
02:00 How incident response shaped the project
05:51 Introducing OWASP WrongSecrets
08:46 Why secrets management keeps failing
11:22 Cloud storage and common mistakes
16:33 Maturity, threat models, and blast radius
19:23 Turning real failures into challenges
23:03 Secrets hidden in containers and deployment files
27:36 Advice for security and engineering teams
30:02 Scaling secrets management
31:54 Written guidance and project resources
33:39 Final takeaways

Adam Shostack -- Fast, cheap and good threat models Dec 15, 2021

Show notes

Adam is a leading expert on threat modeling, and a consultant, expert witness, author and game designer. He has decades of experience delivering security. His experience ranges across the business world from founding startups to nearly a decade at Microsoft. While not consulting or training, Shostack serves as an advisor to a variety of companies and academic institutions. Adam joins us to talk about fast, cheap, and good threat models. We discuss how Adam defines these categories, the weight of threat modeling, questionnaires/requirements, expertise, and how to make threat modeling conversational. We hope you enjoy this conversation with... Adam Shostack. You're about to listen to AppSec Podcast.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Adam Shostack is a leading expert on threat modeling and a consultant, expert witness, author, and game designer.
→ Learn more about Security Journey

Connect with Adam Shostack:
→ Shostack + Associates
→ Adam Shostack

Mentioned in this episode:
→ Shostack + Associates
→ Adam Shostack
→ Gary McGraw
→ OWASP Application Security Verification Standard (ASVS)
→ ATT&CK
→ MITRE ATT&CK Framework
→ Cyber Kill Chain (Lockheed Martin)

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Adam Shostack: Fast, cheap and good threat models
03:15 Yeah, I want to unpack these 3 words a little bit
04:47 You're thinking cheap, are you thinking from a resources and time
07:38 We keep talking about and using that term heavyweight. Is threat
09:17 Yeah, one of the things that I've said since I first
12:24 Yeah, I'm tracking with you now as well about the fact
15:11 You mean the 3 questions that are being asked
20:48 Oh, and I was thinking similar. I always think about requirements
22:48 That— have you ever looked at like the ATT&CK methodology, for
24:21 That makes sense. But let's talk about what do you need
27:07 To kind of bring all these things together, Adam, we, all
29:34 What's the call to action then that you would offer to

Our TOPPODCAST Picks

Follow Us

Stay Connected

The Application Security Podcast

Related Podcasts

Links

Stay Connected