The Application Security Podcast

Latest Episodes:

Loren Kohnfelder -- Designing Secure Software Dec 07, 2021

Show notes

Ochaun Marshall is an Application Security Consultant. In his roles of secure ideas, he works on on-going development projects utilizing Amazon web services and breaks other people's web applications. Ochaun joins us to talk about SAST and IaC, static application security testing and infrastructure as code. We talk about what they are, how they work, the security benefits, some of the tools that make them possible, and we finish our conversation talking about developer empathy and why Ochaun has developer empathy as a result of some of the experiences that he has as a developer and as a security person. We hope that you enjoy this episode with...

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Loren Kohnfelder has over 20 years of experience in the security industry.
→ Learn more about Security Journey

Connect with Loren Kohnfelder:
→ Designing Secure Software
→ Ron Rivest

Mentioned in this episode:
→ Designing Secure Software
→ Ron Rivest
→ Robert Hurlbut

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Loren Kohnfelder: Designing Secure Software
01:46 For our listeners, we always start with our guest's security origin
07:29 I first started at Cisco learning about threat modeling and trying
09:17 As I was taking a look at the book and I
17:20 As I was reading through the book and looking at the
20:13 We do a good enough job to deal with this
26:26 So as we're coming towards the kind of the conclusion of
28:57 Yeah, we definitely agree with you on that. Like, we wanna

Ochaun Marshall -- IaC and SAST Nov 29, 2021

Show notes

Infrastructure as code gives security teams something they have wanted for years: a readable description of the systems surrounding an application. Ochaun Marshall, a developer and application security consultant, explains how that visibility complements static analysis and penetration testing. He discusses where SAST belongs in development, what configuration files can reveal about cloud resources, and why deployed infrastructure still needs monitoring. The conversation covers Terraform, AWS development tools, open-source scanners, and using source access to make a penetration test more productive. Ochaun and Chris then connect those technical practices to developer empathy, explaining why overwhelming engineers with findings undermines trust and how a smaller, carefully tuned set of checks can make security genuinely useful.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Ochaun Marshall:
→ Ochaun Marshall on LinkedIn

Mentioned in this episode:
→ Semgrep
→ Bandit
→ Terraform

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Infrastructure as code and SAST with Ochaun Marshall
02:35 Returning to cloud application security
06:32 Where SAST fits in development
07:15 Scanning applications and their infrastructure
09:53 Configuration files versus deployed assets
12:19 Rebuilding infrastructure instead of changing it manually
14:23 Infrastructure programming with the AWS CDK
17:19 Using SAST during a penetration test
20:26 Open-source tools in the testing toolkit
25:06 The security benefits of infrastructure visibility
26:55 Tagging resources and monitoring changes
29:06 Developer empathy under delivery pressure
32:14 Introducing security checks without overwhelming developers

Simon Bennetts -- Using OWASP Zap across an Enterprise Nov 10, 2021

Show notes

Simon Bennetts is the OWASP Zed Attack Proxy (ZAP) Project Leader and a Distinguished Engineer at StackHawk, a company that uses ZAP to help users fix application security bugs before they hit production. He has talked about and demonstrated ZAP at conferences all over the world. Prior to making a move into security, he was a developer for 25 years and strongly believes that you cannot build secure web applications without knowing how to attack them. He's talked about and demonstrated ZAP at conferences all over the world. Prior to making the move into security, he was a developer for 25 years and strongly believes that you cannot build secure web applications without knowing how to attack them.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Simon Bennetts is the OWASP Zed Attack Proxy, or ZAP, project leader and a distinguished engineer at StackHawk, a company that uses ZAP to help users fix application security bugs before they hit production.
→ Learn more about Security Journey

Connect with Simon Bennetts:
→ OWASP ZAP
→ StackHawk

Mentioned in this episode:
→ OWASP ZAP
→ StackHawk
→ ZAP Heads Up Display (HUD)
→ Burp Suite
→ OWASP Juice Shop
→ OWASP Juice Shop
→ OWASP Web Security Testing Guide (WSTG)
→ OWASP Triangle Chapter
→ Docker

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Simon Bennetts: Using OWASP Zap across an Enterprise
04:20 We think about the things that ZAP is looking for, is
10:10 One of the things that is a new feature since the
14:59 Were not OWASP people, were not security people, and we've set
20:43 One of the other, you know, when I think about the
24:14 I've always been so impressed with what OWASP projects such as
29:10 I use this, when I integrate Zap into my pipeline, then
31:41 This, this was one of those questions where, like, this is
36:54 People are using this in the enterprise would be really powerful

Timo Pagel -- DevSecOps Maturity Model Oct 27, 2021

Show notes

Timo Pagel has been in the IT industry for over fifteen years. After a system administrator and web developer career, he advises customers as a DevSecOps consultant and trainer. His focus is on security test automation for software and infrastructure and assessment of complex applications in the cloud. In his spare time, he teaches “Web and Application Security” at various universities. Timo joins us to talk about the OWASP DevSecOps Maturity Model or DSOMM. We explore maturity models, this specific one, how you can use it, and how to get started. We hope you enjoy this conversation with... After a career as a system administrator and web developer, he advises customers as a DevSecOps consultant and trainer.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Timo Pagel has been in the IT industry for over 15 years.
→ Learn more about Security Journey

Connect with Timo Pagel:
→ OWASP DevSecOps Maturity Model (DSOMM)
→ OWASP SAMM

Mentioned in this episode:
→ OWASP DevSecOps Maturity Model (DSOMM)
→ OWASP SAMM
→ BSIMM
→ OWASP Application Security Verification Standard (ASVS)

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Timo Pagel: DevSecOps Maturity Model
03:23 I'm curious now, what was it that this mentor/professor, what did
07:37 We think about DevSecOps maturity model, here's one way that I
08:45 Timo, what is your recommendation for how someone can use the
12:03 For your specific levels then, can you walk us through the
15:48 Yeah. Let me trace through one with you just because I
17:45 Yeah, no problem. So thinking about DSOM and how it works
25:48 Yeah. Makes sense. So let me give you a scenario here
29:25 That's awesome. Yeah. And I'm sure you're making that— that's for

Mazin Ahmed -- Terraform Security Oct 06, 2021

Show notes

Mazin Ahmed is a security engineer that specializes in AppSec and offensive security. He is passionate about information security and has previously found vulnerabilities in Facebook, Twitter, Linkedin, and Oracle, to name a few. Mazin is the developer of several popular open-source security tools that have been integrated into security testing frameworks and distributions. Mazin also built FullHunt. io, the next-generation continuous attack surface security platform. He is also passionate about cloud security, where he has been running dozens of experiments in the cloud security world. Mazin joins us to introduce Infrastructure as Code and TerraForm and discuss the security benefits IaC brings to our cloud environments.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Mazin Ahmed is a security engineer that specializes in AppSec and offensive security.
→ Learn more about Security Journey

Connect with Mazin Ahmed:
→ Terraform
→ FullHunt.io

Mentioned in this episode:
→ Terraform
→ FullHunt.io
→ Terraform
→ Bugcrowd

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Mazin Ahmed: Terraform Security
03:25 Were you doing bug bounties while you were in high school
05:31 Curious, Mason, that you have mentioned pen tests and working on
07:50 Just a follow-up question. When you said that, you know, more
09:22 You think cloud security issues, I'm curious as a pentester, What
14:46 We call it infrastructure as code, but is it better to
16:49 Very cool. What are the security benefits of IaC
20:02 Got to do step 75. And so, when I think about
23:38 Are the attack vectors on Terraform environments then
27:17 As an attacker then, if you can get into the infrastructure
30:00 That's helpful to understand how, you know, what IaC is, security

James Ransome and Brook Schoenfield -- trust and verify: Building in Security at Agile Speed Sep 24, 2021

Show notes

Why do application security programs stall even after teams buy tools and define processes? James Ransome and Brook S. E. Schoenfield join Chris and Robert to discuss their book Building in Security at Agile Speed and the organizational work behind sustainable software security. They explain why practitioners need enough technical fluency to collaborate with developers, how leaders can recognize when a program is becoming self-sufficient, and which behaviors reveal that security has spread beyond a central team. The conversation returns repeatedly to people, trust, incentives, and measurement. It closes by challenging assumptions about penetration testing and showing how continuous delivery requires security practices that evolve with the development system rather than sit outside it.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with James Ransome and Brook S. E. Schoenfield:
→ James Ransome on LinkedIn
→ Brook Schoenfield on LinkedIn

Mentioned in this episode:
→ Building in Security at Agile Speed
→ Core Software Security

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Building security at agile speed
02:49 James Ransome’s security origin story
05:11 The book and the problem it addresses
08:08 Why this book and why now
15:59 Technical fluency for security leaders
21:36 When a security program becomes self-sufficient
24:48 Organic adoption and signs of maturity
30:36 Behaviors leaders can measure
34:19 People, process, and tools
37:07 Building trust across the organization
46:58 Penetration testing in continuous delivery
50:12 Final lessons from the authors

OWASP Top 10 2021 Peer Review Sep 17, 2021

Show notes

Chris and Robert conduct a practitioner peer review of the 2021 OWASP Top 10, examining what changed, what moved, and what the new structure communicates to development teams. They compare the list with the 2017 edition, discuss the broader treatment of injection, and unpack additions such as insecure design, software and data integrity failures, and server-side request forgery. The review also questions how categories map to real weaknesses, CVEs, and verification practices. Along the way, they connect the Top 10 to ASVS, threat modeling, dependency analysis, and the difficult balance between a widely recognized awareness document and actionable engineering guidance.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with OWASP:
→ OWASP Top 10
→ OWASP Foundation

Mentioned in this episode:
→ OWASP Top 10:2021
→ OWASP ASVS
→ Threat Modeling Manifesto
→ OWASP Dependency-Check
→ CycloneDX

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Peer reviewing the OWASP Top 10:2021
03:00 Broken access control moves to number one
04:52 Injection and cross-site scripting are consolidated
07:46 Vulnerable and outdated components
10:50 Software and data integrity failures
12:42 Server-side request forgery joins the list
15:00 Does the new structure help practitioners?
18:00 Security logging and monitoring
20:00 Mapping categories to weaknesses and CVEs
21:52 Connecting the Top 10 to verification practices
27:00 Final observations

Anastasiia Voitova -- Encryption is easy, key management is hard Sep 14, 2021

Show notes

Adding encryption is easy; designing a system that protects keys, metadata, and users is much harder. Anastasiia Voitova joins Chris and Robert to explain end-to-end encryption as a system property rather than a single cryptographic feature. She examines what encryption does and does not protect, how modern web and mobile architectures complicate trust boundaries, and why cloud storage creates difficult key-management choices. The discussion covers performance, recovery, usability, and the gap between marketing claims and honest threat models. Anastasiia closes with practical advice for product and security teams deciding whether end-to-end encryption fits their system and how to communicate its tradeoffs clearly.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Anastasiia Voitova:
→ Anastasiia Voitova on LinkedIn
→ Cossack Labs

Mentioned in this episode:
→ Cossack Labs

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Encryption is easy; key management is hard
02:44 Defining end-to-end encryption
06:28 What end-to-end encryption protects
09:15 Modern web and mobile trust boundaries
12:36 Cloud storage and key-management choices
14:00 The downsides of stronger encryption
16:38 Performance and operational costs
19:01 Usability and honest encryption claims
23:18 Can users trust messaging applications?
27:00 Choosing the right security tradeoffs
30:38 A call to action for product teams

Eran Kinsbruner -- DevSecOps Continuous Testing Aug 20, 2021

Show notes

Mark Loveless - aka Simple Nomad - is a security researcher and hacker. He's spoken at numerous security and hacker conferences worldwide, including Blackhat, DEF CON, ShmooCon, and RSA. He's been quoted in the press including CNN, Washington Post, and the New York Times. Mark joins us to discuss his series of blog posts on Threat Modeling at GitLab. We discuss his philosophical approach, framework choice (spoiler alert, it's a pared-down version of PASTA), and success stories / best practices he's seen for threat modeling success. We hope you enjoy this conversation with... Aaron Kinsbruner is the Chief Evangelist and Senior Director at Perforce Software.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Aaron Kinsbruner is the Chief Evangelist and Senior Director at Perforce Software.
→ Learn more about Security Journey

Connect with Eran Kinsbruner:
→ Perforce Software
→ Jenkins

Mentioned in this episode:
→ Perforce Software
→ Jenkins
→ Alyssa Miller

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Eran Kinsbruner: DevSecOps Continuous Testing
03:00 Okay. So in your time focusing on DevOps and DevSecOps before
04:46 As we get into testing or talk about testing, before we
07:19 One of the, one of the comments, or one of the
16:30 As I'm listening to the way you're describing quality gates and
21:19 Eran, you mentioned the word quality. a few times. And, you
24:37 I got a follow-up question related to quality. And so this
27:04 I think we're both on board with the idea that quality
31:26 Yeah, definitely. And I think you covered people in the last
33:01 Definitely. Eran, it's been great to talk to you today. I

Mark Loveless -- Threat modeling in a DevSecOps environment. Aug 13, 2021

Show notes

Threat modeling needs to fit the way developers work if it is going to survive a fast delivery cycle. Mark Loveless, also known as Simple Nomad, explains how GitLab adapted its approach for an asynchronous DevSecOps environment. He describes moving ownership toward the people building a project, introducing lightweight checkpoints, and making the process useful beyond engineering. The discussion explores a simplified version of PASTA, ordinary language instead of security jargon, and documentation that lives in familiar tools. Mark shares adoption tactics and examples of teams identifying risks for themselves. Throughout, he argues that security specialists should provide a usable framework and practical support while helping everyone develop the habit of asking what could go wrong.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Mark Loveless:
→ Mark Loveless’s website

Mentioned in this episode:
→ Mark’s GitLab threat modeling article
→ PASTA threat modeling
→ Mermaid diagrams

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Threat modeling at GitLab with Mark Loveless
01:44 Mark’s security origin story
05:04 The GitLab threat modeling article series
06:11 Adapting threat modeling to DevSecOps
08:58 Starting threat modeling without disrupting flow
10:33 Where modeling fits in developer workflows
13:09 Extending threat modeling beyond engineering
14:56 Encouraging teams to participate
19:03 Choosing and simplifying PASTA
23:19 Using plain language instead of jargon
25:12 Writing models with familiar tools
26:55 Adoption stories and signs of success
33:18 Key takeaways and getting started

Our TOPPODCAST Picks

Follow Us

Stay Connected

The Application Security Podcast

Related Podcasts

Links

Stay Connected