The Application Security Podcast

Latest Episodes:

Jeroen Willemsen -- Security automation with ci/cd Aug 06, 2021

Show notes

Jeroen Willemsen is a Principal Security Architect at Xebia. Jeroen is more or less a jack of all trades with an interest in infrastructure security, risk management, and application security. With a love for mobile security, he enjoys sharing knowledge on various security topics. Jeroen joins us to unpack security automation in a DevOps world. We discuss categories of tools, typical quick wins, potential downsides, and how dependency management specifically plays into automation. We hope you enjoy this conversation with... We hope you enjoyed this conversation with Jeroen Willemsen. Are you trying to build a security champions program? Everyone is these days. One challenge of rolling out security champions is how do we educate all these new folks?

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Jeroen Willemsen is a Principal Security Architect at Zebia.
→ Learn more about Security Journey

Connect with Jeroen Willemsen:
→ Xebia
→ OWASP Dependency-Check

Mentioned in this episode:
→ Xebia
→ OWASP Dependency-Check

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Jeroen Willemsen: Security automation with ci/cd
02:21 We'll stay with your original name. No problem there. So we
04:54 Just diving in here, one of the things I think we're
07:35 Between SAST, DAST, SCA. You didn't even mention like IAST and
10:20 That's probably— they're probably stuck on that level of— and so
13:10 Yeah. And in the danger of creating a monster fight on
15:29 Like, yeah, yeah, too far back to even remember. Well, I
17:39 You mentioned one. I had heard most of the ones that
19:22 Let's flip the table a little bit now. So, we've talked
22:16 Yeah, I see that. You know, when you're talking about false
25:27 I have a whole talk on that exact topic on developers
27:14 I'm going to do something different here for the conclusion of
29:35 Yeah. All right, you heard our key takeaways, so now it's

Thinking back, Looking forward - A Balanced Approach to Securing our Software Future Jul 15, 2021

Show notes

Software security has spent decades alternating between prevention, detection, and response. Kevin Greene joins Chris and Robert to ask what a balanced approach should look like now. Drawing on work at Parasoft and across government and industry, Kevin discusses secure development practices, standards, developer enablement, and the limits of relying on tools alone. The conversation connects supply-chain failures and the federal cybersecurity executive order to cyber resilience, penetration testing, red teams, and assurance. It closes by looking ahead to policy, software minimalism, and the changes organizations must make if they want secure software to become a repeatable engineering outcome rather than a late-stage scramble.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Kevin Greene:
→ Parasoft
→ Kevin Greene on API security testing

Mentioned in this episode:
→ Parasoft
→ OWASP Proactive Controls
→ MITRE ATT&CK
→ Threat Modeling Manifesto
→ Executive Order 14028
→ Apache Struts

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Looking back at software security
02:03 Kevin Greene’s path through AppSec
04:54 What a balanced security approach means
06:59 Prevention, detection, and response
09:52 Standards and repeatable engineering practices
12:38 Making secure development easier
15:42 Helping developers own security
18:40 The current state of software assurance
22:36 Guidance, governance, and accountability
24:46 Where security tools help—and where they do not
28:00 Supply-chain failures and SolarWinds
30:00 Why old software problems persist
33:00 The federal cybersecurity executive order
37:00 Adapting to rapid change
40:00 Building cyber resilience
42:00 The role of penetration testing
45:00 What red teams add
47:00 Standards, certification, and assurance
53:00 Looking toward the future
54:00 Goals for the next generation of software
56:00 Software minimalism and reducing attack surface
59:00 Policy as a driver for change
62:00 Closing thoughts

Jeevan Singh -- Threat modeling based in democracy Jun 11, 2021

Show notes

Jeevan Singh is a Security Engineer Manager at Segment, where he is embedding security into all aspects of the software development process. Jeevan enjoys building security culture within organizations and educating staff on security best practices. Before life in the security space, Jeevan had a wide variety of development and leadership roles over the past 15 years. Jeevan joins us to speak about self-serve threat modeling at Segment or threat modeling based in democracy. We discuss their focus with the program, how it fits in their dev methodology and their ultimate goal with the threat modeling program. We hope you enjoy this conversation with... We discussed their focus with the program, how it fits in their development methodology, and their ultimate goal with threat modeling.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Jeevan Singh is a Security Engineer Manager at Segment, where he's embedding security into all aspects of the software development process.
→ Learn more about Security Journey

Connect with Jeevan Singh:
→ segmentio/threat-modeling-training
→ Redefining Threat Modeling (Segment blog)

Mentioned in this episode:
→ segmentio/threat-modeling-training
→ Redefining Threat Modeling (Segment blog)
→ Segment

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Jeevan Singh: Threat modeling based in democracy
01:16 Hey folks, welcome to another episode of the Application Security Podcast
04:59 The question I always ask folks that come from a development
07:24 Certainly, that's the model that I love as well, as far
09:37 The engineering teams start performing a threat model, what are some
12:51 You have any formal kind of way that you measure when
14:13 You mentioned threat modeling tickets. Is that a metric that you're
17:24 Then does your threat modeling, your self-serve threat modeling, does it
20:07 This is really an industry best practice. Not enough people are
25:22 Yeah, that's great. That is great. Okay, so tell me just
31:13 For folks out there that are building their own program, I
33:29 Awesome. Well, Jeevan, what would be a key takeaway or call

Dima Kotik -- Application Security and the Zen of Python May 21, 2021

Show notes

Dima Kotik is an Application Security Engineer at Security Journey and has been programming in Python for years. As he was working on building out Security Journey's Secure Coding with Python content, he came across the Zen of Python, a set of guidelines for how to program in Python. He wrote a blog post about how to apply application security to the Zen of Python, and then we recorded this interview to talk about the concept in more depth. We hope you enjoy this interview with.... Dee Makotik is an application security engineer at Security Journey and has been programming in Python for years. We hope you enjoy this conversation with— Dima Kotik.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Dee Makotik is an application security engineer at Security Journey and has been programming in Python for years.
→ Learn more about Security Journey

Connect with Dima Kotik:
→ Zen of Python (PEP 20)
→ Dave Cheney: The Zen of Go

Mentioned in this episode:
→ Zen of Python (PEP 20)
→ Dave Cheney: The Zen of Go
→ Go
→ Rust
→ Node.js
→ Ruby
→ Flask
→ IronPython
→ Stackless Python
→ Zig
→ WireGuard
→ OpenSSL
→ NASA Ingenuity Mars Helicopter

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Dima Kotik: Application Security and the Zen of Python
02:02 That is, how did you get your start in application security
05:06 That consistent
06:45 Does Python fit into web applications
09:53 Yeah. So, you wrote a blog post about the Zen of
13:17 You wrote this article, you took the Zen of Python and
17:23 What's the security takeaway then in regards to readable code
21:15 That was readable, plus talking about the applicability of this whole
32:57 What's the security takeaway then on the singular
34:40 This has been very beneficial to understand the Python use cases

Dustin Lehr -- Advocating and being on the side of developers May 07, 2021

Show notes

Before taking the plunge into information security leadership, Dustin Lehr spent over a decade as a software engineer and architect in a variety of industries, including retail, DoD, and even video games. This diverse background has helped him forge close partnerships with development teams, engineering leaders, and software security advocates while pursuing the organizational culture shift of building good security habits into daily work. Dustin joins us to talk about the challenges developers face with security and so much more. We hope you enjoy this conversation with... This diverse background helped him forge close partnerships with development teams, engineering leaders, and software security advocates while pursuing the organizational culture shift of building good security habits into daily work.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Before taking the plunge into information security leadership, Dustin Lehr spent over a decade as a software engineer and architect in a variety of industries, including retail, DoD, and even video games.
→ Learn more about Security Journey

Connect with Dustin Lehr:
→ OWASP
→ Alyssa Miller

Mentioned in this episode:
→ OWASP
→ Alyssa Miller
→ Aaron Rinehart (opensource.com)

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Dustin Lehr: Advocating and being on the side of developers
01:49 Yeah, and specifically Engaging the mind of the developer. I just
04:03 Architect, what— I'm curious now, what from an architecture perspective, like
06:54 Many questions come out of just what you said there. When
09:13 Actually, I want to make a statement. I can definitely identify
12:59 Some more about developers, but I want to ask a follow-up
14:55 Okay. So I'm going to offer kind of another opinion about
18:16 Totally agree that we don't want to put up any barriers
20:50 Because nobody knows. I mean, I've been in the security business
24:37 Yeah. I mean, imagine a day where we worked ourselves out
27:04 Yeah, I was doing an interview for the episode right before
31:05 A couple of things that I can think of that I've
34:19 I plead the Fifth, right, to not incriminate myself in a

Aaron Rinehart -- Security Chaos Engineering Apr 30, 2021

Show notes

Aaron Rinehart is expanding the possibilities of chaos engineering to cybersecurity. He began pioneering security in chaos engineering when he released ChaoSlingr during his tenure as Chief Security Architect at UnitedHealth Group (UHG). Rinehart is the O'Reilly Author on Security Chaos Engineering and has recently founded a chaos engineering startup called Verica with Casey Rosenthal from Netflix. Aaron joins us to explain what the heck security chaos engineering is. We explore the origin story of chaos engineering and security chaos engineering, and how does a listener get started with this new techniques. We hope you enjoy this conversation with... Aaron Reinhardt is expanding the possibilities of chaos engineering to cybersecurity.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Aaron Reinhardt is expanding the possibilities of chaos engineering to cybersecurity.
→ Learn more about Security Journey

Connect with Aaron Rinehart:
→ ChaoSlingr
→ Verica

Mentioned in this episode:
→ ChaoSlingr
→ Verica
→ Security Chaos Engineering
→ Chaos Monkey
→ Kubernetes
→ Apache Kafka

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Aaron Rinehart: Security Chaos Engineering
03:46 Right
16:56 Yeah. Let me ask a couple of clarifying questions too, because
21:31 Yeah, but I mean, you think about how much time, money
26:05 You say it succeeds, you mean that the system detected an
28:59 Most people doing these manual right now
33:05 Let the record show I'm about to ask a product-related question
34:14 What
36:59 Yeah, that's helpful. So, I want to stop for a second
39:40 There's entropy too, right
42:30 I want to do is we're— as we're kind of coming
46:07 Great. So, um, one, one kind of last question. So What's

Izar Tarandach and Matt Coles-- Threat Modeling: A Practical Guide for Development Teams Apr 23, 2021

Show notes

Threat modeling advice often sounds simple until a development team tries to apply it to a real system. Izar Tarandach and Matt Coles join Chris and Robert to discuss their book, Threat Modeling: A Practical Guide for Development Teams, and the collaboration behind it. They explain how the book organizes system modeling, threat discovery, and mitigation into a usable workflow without forcing teams into one methodology. The conversation covers attack trees, LINDDUN, pytm, writing for different experience levels, and the role of empathy when introducing security practices. Their goal is practical: help teams make threat modeling part of software development instead of a specialist exercise performed once and forgotten.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Izar Tarandach and Matt Coles:
→ Izar Tarandach on LinkedIn
→ Matt Coles on LinkedIn
→ Threat Modeling: A Practical Guide for Development Teams

Mentioned in this episode:
→ Threat Modeling: A Practical Guide for Development Teams
→ OWASP pytm
→ Attack Trees
→ LINDDUN
→ Threat Modeling Manifesto

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 A practical guide to threat modeling
02:00 How Izar and Matt approach the discipline
09:36 Why development teams needed this book
11:46 How the collaboration began
14:49 Writing practical guidance together
21:44 The book’s system-modeling foundation
26:03 Four parts of a repeatable workflow
29:17 Choosing methods without becoming dogmatic
31:38 Attack trees, LINDDUN, and other techniques
34:33 Applying the guidance to real teams
42:15 Empathy as a threat modeling skill
46:01 Using threat modeling beyond security

Charles Shirer -- The most positive person in security Apr 16, 2021

Show notes

Charles is a Senior Security Consultant for Red Siege. He has over 18 years of experience in IT. In his spare time, Charles does retro gaming and works on the SECBSD open source project, a penetration testing distro. He currently works as Staff at several Security Conferences, podcasts (GrumpyHackers) (Positively Blue Team Cast), and is a part of the MentalHealthHackers DeadPixelSec NovaHackers and HackingisNotaCrime Family. Charles joins us to talk about positivity in InfoSec. If you've never seen Charle's videos, you're missing out. We'll unpack what drives his positivity and how we as infosec / appsec people can embrace a more positive approach to our world.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Charles Scherer is a senior security consultant for Red Siege.
→ Learn more about Security Journey

Connect with Charles Shirer:
→ Red Siege
→ SECBSD

Mentioned in this episode:
→ Red Siege
→ SECBSD
→ Kali Linux
→ Rust

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Charles Shirer: The most positive person in security
02:37 Oh, very cool. Well, as you know, then, as a frequent
03:47 Year was this
10:52 My C# question, how did you get C# to run in
13:03 Was the, uh, the use case there
16:32 All right, so now you've had a chance, audience, to hear
19:26 Many shirts
21:26 Do you get this positivity
26:06 Thing weighs like ten pounds. We're not born like what
27:43 I cared about what I— when I stand up to speak
30:43 Yeah, love to hear it. I'm gonna—I'm gonna check it out
33:19 Really cool. Well, Charles, we really appreciate you coming and visiting

Leif Dreizler -- Tactical tips to shift engineering right Apr 09, 2021

Show notes

Leif Dreizler is the manager of the Product Security team at Segment. Leif got his start in the security industry at Redspin doing security consulting work and was later an early employee at Bugcrowd. He helps organize the Bay Area OWASP Chapter, the LocoMocoSec Conference, and the AppSec California conference. Leif caught our attention when he published an article called Shifting Engineering Right: What security engineers can learn from DevSecOps. In this interview, we focus in on the tactical tips and takeaways from the article, or how you as a security person can shift engineering right. We hope you enjoy this conversation with... Leif Driezler.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Leif Dreizler is the manager of the product security team at Segment.
→ Learn more about Security Journey

Connect with Leif Dreizler:
→ Shifting Engineering Right: What security engineers can learn from DevSecOps
→ Segment

Mentioned in this episode:
→ Shifting Engineering Right: What security engineers can learn from DevSecOps
→ Segment
→ Bugcrowd

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Leif Dreizler: Tactical tips to shift engineering right
01:49 We're going to talk about an article that I know a
05:32 It's funny, I was watching a debate yesterday on the OWASP
06:30 Let's jump into the article then. And I wanted to start
08:38 That's certainly what caught my attention when I started— when I
12:38 Sure, sure. So Leif, you have at the end of the
18:36 Leif, when you think stakeholders now, I'm curious, what's your definition
21:15 I got a question about this because I'm curious to get
39:05 What's the importance of empathy then
43:37 You've definitely given us lots of additional things to think about

Vandana Verma -- OWASP Spotlight Series Apr 02, 2021

Show notes

Vandana Verma is the President of Infosec girls and Infosec Kids, a board of directors member for OWASP, and a leader for BSides Dehli. She joins us to introduce the OWASP Spotlight Series. With each video she creates, she highlights an OWASP project. We survey the projects she's covered and discuss a specific takeaway from each for the application security person. We hope you enjoy this conversation with... Hi, Vandana. At Security Journey, we believe security is every developer's job. We work with our customers to help them build long-term sustainable security culture amongst all their developers. Our approach is to provide security education that's conversational, quick, hands-on, and fun.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Vandana Verma is the president of InfoSec Girls and InfoSec Kids, a board of directors member for OWASP, and a leader for BSides Delhi.
→ Learn more about Security Journey

Connect with Vandana Verma:
→ OWASP ZAP
→ OWASP Top 10

Mentioned in this episode:
→ OWASP ZAP
→ OWASP Top 10
→ OWASP Web Security Testing Guide
→ OWASP Dependency-Check
→ OWASP ModSecurity Core Rule Set
→ Christian Folini
→ OWASP Cheat Sheet Series
→ OWASP Security RAT
→ OWASP ASVS
→ OWASP pytm
→ OWASP Security Knowledge Framework
→ OWASP Juice Shop
→ MultiJuicer
→ OWASP Threat Dragon
→ OWASP Proactive Controls
→ Dependency-Track
→ OWASP Project Spotlight Series
→ Vandana Verma (YouTube)
→ Vandana Verma
→ OWASP Proactive Controls

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Vandana Verma: OWASP Spotlight Series
04:05 Yeah, that's great. And I can share a quick story that
09:59 It a companion of ASVS
15:06 This is a great list of projects that you've assembled. And
21:01 Yeah, we'll definitely be looking forward to that. And we'll post

Our TOPPODCAST Picks

Follow Us

Stay Connected

The Application Security Podcast

Related Podcasts

Links

Stay Connected