The Application Security Podcast

Latest Episodes:

Dr. Anita D’Amico -- Do certain types of developers or teams write more secure code? Mar 25, 2021

Show notes

Dr. Anita D’Amico is the CEO of Code Dx, which provides Application Security Orchestration and Correlation solutions to industry and government. Her roots are in experimental psychology and human factors. Her attention is now focused on enhancing the decisions and work processes of software developers and AppSec analysts to make code more secure. Anita joins us to discuss research she has done answering the question, "do certain types of developers or teams write more secure code? " Being a security culture fanatic, this topic is near and dear for me. We hope you enjoy this conversation with... Anita D’Amico is the CEO of CodeDx, which provides application security orchestration and correlation solutions to industry and government.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Dr.
→ Learn more about Security Journey

Connect with Anita D’Amico:
→ Secure Decisions
→ Maker's Schedule, Manager's Schedule

Mentioned in this episode:
→ Secure Decisions
→ Maker's Schedule, Manager's Schedule
→ Apache Struts
→ Chromium
→ Linux kernel
→ FMCSA Hours of Service

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Anita D’Amico: Do certain types of developers or teams write more secure code?
02:04 Over her time starting CodeDx and bringing that along. But Anita
09:44 You're thinking, is this an execution chamber
13:02 It's fascinating to me as someone who is focused much of
15:34 So how does those— when we think about quality and security
20:22 Was there surveys that went to these teams that they could
23:07 Yeah, and I definitely want to come back to that. Let's
25:59 That's interesting because when I think about, like, how would I
27:57 The data tell us that there's an impact on the quality
30:37 You're basically saying that we should be sleeping from 10:00 PM
45:00 Because these are the people that are out working on the

Alyssa Miller -- Bringing security to DevOps and the CI/CD pipeline Mar 18, 2021

Show notes

Alyssa Miller is a life-long hacker, security advocate, and cybersecurity leader. She is the BISO for S&P Global ratings and has over 15 years of experience in security roles. She is heavily involved in the cybersecurity community as an international speaker, author, and advocate. Alyssa joins us to talk about bringing security to DevOps and the CI/CD pipeline. We talk about the success of the DevOps transformation, mistakes AppSec teams make with DevOps and explore the possible idea that DevSecOps is its own silo. We hope you enjoy this conversation with... She's the BISO for S&P Global Ratings and has over 15 years of experience in security roles.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Alyssa Miller is a lifelong hacker, security advocate, and cybersecurity leader.
→ Learn more about Security Journey

Connect with Alyssa Miller:
→ S&P Global Ratings
→ Alyssa Miller

Mentioned in this episode:
→ S&P Global Ratings
→ Alyssa Miller
→ Alyssa Miller
→ Alyssa Miller
→ Azure DevOps
→ DevOpsDays
→ Patrick Debois
→ Patrick DeBois
→ Snyk
→ WhiteSource (now Mend)

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Alyssa Miller: Bringing security to DevOps and the CI/CD pipeline
08:40 I love the way you came back to culture at the
09:58 I hear governance, I want to dive into this a little
13:23 I think. You mentioned about DevOps being culture and change. Now
17:13 You mentioned Netflix. I remember in the early days, there was
19:38 I want to switch gears a little bit, and as we
25:03 Yep, and this ties directly into, like the two of you
30:08 And we sort of already hit on a couple of aspects
33:44 Yeah, I think that's— I like that approach that you're describing
37:23 Tilt left, tilt left with the camera. Alyssa, as we're coming

Liran Tal — Cloud native application security, what’s a developer to do? Mar 09, 2021

Show notes

Cloud-native development gives engineers control over more of the stack, but it also gives them more security decisions to get wrong. Liran Tal, an open-source contributor and developer advocate, joins Chris and Robert to explore that expanding responsibility. They define cloud-native applications, examine containers and infrastructure as code, and discuss how security ownership changes when developers choose runtimes, dependencies, and deployment configurations. Liran explains why vulnerability severity alone is a poor guide to remediation and why usable feedback matters more than another long list of findings. The conversation also covers practical container-building mistakes, production behavior, and the value of asking what could go wrong while writing code. His advice centers on awareness, helpful defaults, and tools that support developers.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Liran Tal:
→ Liran Tal’s website

Mentioned in this episode:
→ Node.js
→ Docker
→ Kubernetes
→ Snyk

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Cloud-native application security with Liran Tal
05:25 Defining cloud-native development
07:26 What is changing in the cloud-native stack
09:36 Who owns application and infrastructure security
13:32 Security in the local developer workflow
15:15 Threats in cloud-native applications
16:46 Infrastructure as code and security visibility
22:08 Least privilege and cloud configuration
24:12 Helping developers take on new responsibilities
27:27 AppSec practices in a cloud-native world
29:31 Prioritizing vulnerabilities beyond severity
31:49 Giving developers the tools to help themselves
33:08 Building safer Node.js container images
37:10 Differences between development and production
38:40 Practical takeaways and a threat modeling mindset

Chris Romeo — DevSecOps Fails Feb 17, 2021

Show notes

Robert and I decided to talk about an article I wrote called "DevOps security culture: 12 fails your team can learn from". We hope you enjoy this walkthrough of the 12 fails. If we missed any, hit us up on Twitter and let us know what we should add to the list. At Security Journey, we believe security is every developer's job. We work with our customers to help them build long-term sustainable security culture amongst all their developers. Our approach is to provide security education that's conversational, Quick, hands-on, and fun. We don't do lectures. Instead, we let the experts talk about what's important.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Hey folks, for this episode, Robert and I decided to talk about an article I wrote called DevOps Security Culture: 12 Fails Your Team Can Learn From.
→ Learn more about Security Journey

Connect with Chris Romeo:
→ Chris Romeo on LinkedIn
→ OWASP Dependency-Check

Mentioned in this episode:
→ OWASP Dependency-Check
→ Threat Modeling Manifesto
→ Julien Vehent
→ TechBeacon
→ Matthew Coles
→ Jim Routh on Twitter

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Chris Romeo: Chris Romeo — DevSecOps Fails
02:15 Yeah, I got the opportunity to write this article for TechBeacon
05:30 That's okay. Yeah, I mean, that's in the article I talk
07:33 The other frustration I have with the infinity graph is I
09:55 I've come to the conclusion now that if you want to
13:02 Yeah. As I look across the industry, and I've used a
14:44 I mean, we've got shift left, we've got shift right. I
17:48 Overcomplicating anything sets you up for failure, right
20:12 Number 9, noisy security tools. How are they noisy
23:09 It's a fail if you don't do it. Can you believe
25:08 That's pretty— I mean, recently, that's, that's very relevant, right

Jim Routh — Secure software pipelines Feb 10, 2021

Show notes

A secure software pipeline is more than a collection of scanners. Jim Routh joins Chris and Robert to explain how organizations can build repeatable controls into delivery systems while preserving the speed engineering teams need. From a CISO’s perspective, Jim describes the organizational and funding decisions behind pipeline transformation, the role of threat modeling, and the difference between application security, software security, and broader cyber risk. The discussion focuses on making controls consistent, measuring the value of automation, and structuring teams so secure delivery becomes a shared capability. Jim closes with lessons leaders can use when turning isolated security activities into an enterprise software assurance program.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Jim Routh:
→ Jim Routh on LinkedIn

Mentioned in this episode:
→ Threat Modeling Manifesto

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Building secure software pipelines
02:00 Jim Routh’s software security work
07:00 From DevSecOps activities to pipeline capabilities
13:00 The CISO perspective on software delivery
16:00 Embedding security controls in the pipeline
27:00 Application security, software security, and cyber risk
30:00 Organizational models for secure delivery
31:00 Funding a pipeline transformation
38:00 Practical takeaways for security leaders
43:00 Closing thoughts

Andrew van der Stock — Taking Application Security to the Masses Jan 20, 2021

Show notes

How does a volunteer security community reach the millions of people who build software? Andrew van der Stock reflects on that challenge after becoming OWASP’s executive director in 2020. He traces his early application security work and contributions to OWASP projects, then explains the foundation’s purpose and the organizational work behind its public resources. Chris and Robert ask about membership, support from companies that use those resources, and ways to welcome people who are new to security. Andrew also discusses the disruption of 2020 and plans for OWASP’s twentieth anniversary. This archive conversation captures his ambitions for making practical application security knowledge more accessible while building a stronger, more sustainable community around it.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Andrew van der Stock:
→ Andrew van der Stock at OWASP

Mentioned in this episode:
→ OWASP Foundation
→ OWASP Developer Guide
→ OWASP Proactive Controls
→ ZAP

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Taking application security to the masses
02:42 Andrew’s early AppSec and OWASP work
06:17 Becoming OWASP’s executive director
10:35 OWASP’s mission and community
12:19 Application security beyond the web
13:47 Why individuals and companies join OWASP
18:07 Welcoming newcomers into security
20:32 How OWASP navigated 2020
23:25 A longer-term vision for the foundation
26:23 Planning OWASP’s twentieth anniversary
28:20 How listeners can participate

JC Herz and Steve Springett — SBOMs and software supply chain assurance Jan 12, 2021

Show notes

Software bills of materials promise visibility into dependencies, but visibility alone does not create assurance. JC Herz and Steve Springett join Chris and Robert to explain what an SBOM contains, why machine-readable formats matter, and how CycloneDX and Dependency-Track help organizations reason about software composition. They compare automated inventories with spreadsheets and audits, examine the threats an SBOM can and cannot address, and discuss why regulation and supply-chain incidents pushed the topic into the spotlight. The conversation closes with adoption guidance, including how teams can connect SBOM data to vulnerability management and verification instead of treating it as another compliance artifact.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with JC Herz and Steve Springett:
→ JC Herz on LinkedIn
→ Steve Springett on LinkedIn
→ CycloneDX

Mentioned in this episode:
→ CycloneDX
→ Dependency-Track
→ National Vulnerability Database
→ The left-pad incident

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 SBOMs and software supply-chain assurance
01:47 Introducing the guests and the problem
06:51 Steve Springett and the CycloneDX ecosystem
10:00 What an SBOM contains
17:45 CMMC, audits, and assurance requirements
20:38 Understanding software composition
22:34 Why spreadsheets do not scale
25:00 Different consumers need different SBOM views
27:00 The threats SBOMs can help address
33:30 Why the industry is paying attention now
39:00 When and where to generate an SBOM
41:00 Adoption through OWASP and SCVS
44:46 Practical takeaways

Brian Reed — Mobile Appsec: The Good, the Bad and the Ugly as We Head into 2021 Jan 06, 2021

Show notes

Brian Reed is Chief Mobility Officer at NowSecure. Brian has over 30 years in tech and 15 years in mobile, security, and apps dating back to the birth of mobile including BlackBerry, Good Technology, BoxTone, and MicroFocus. Brian joins us to discuss mobile application security, the good, the bad, and the ugly as we head into 2021. We discuss recent issues in mobile apps, mobile firewalls, mobile vs. web, and how AppSec is different in a mobile world. We hope you enjoy this conversation with... We discuss recent issues in mobile applications, mobile firewalls, mobile versus the web, and how application security is different in a mobile world.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Brian Reed is Chief Mobility Officer at NowSecure.
→ Learn more about Security Journey

Connect with Brian Reed:
→ NowSecure
→ Mobile Testing Guide

Mentioned in this episode:
→ NowSecure
→ Mobile Testing Guide
→ Snyk
→ Facebook

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Brian Reed: Brian Reed — Mobile Appsec: The Good, the Bad and the Ugly as We Head into 2021
03:28 It's funny when you think about the architecture underneath BlackBerry. Like
06:55 Let's jump into some of the recent issues that have occurred
11:54 A couple things that you mentioned that I want to dive
16:30 They've made a lot of changes since the days that I
18:57 That's part of the scary, you know, some of the scary
23:20 Yes, that's really easy. It's easy to do too, right
25:53 So when we think about kind of the core audience of
28:36 I mean, I couldn't find anything I disagree with, which, you
29:22 Are the things you should care about
32:22 That's great. It's good information for those people that are going

The Threat Modeling Manifesto – Part 2 Nov 24, 2020

Show notes

How did a group of experienced practitioners turn months of disagreement into a usable Threat Modeling Manifesto? Part two follows the contributors as they refine principles, test language, and decide what belongs in the final document. The discussion compares recipes with adaptable patterns, examines the gap between documentation and shared understanding, and confronts the difficulty of proving threat modeling’s return on investment. Contributors including Alyssa Miller, Irene Michlin, Fraser Scott, Chris Romeo, and Robert Hurlbut debate whether guidance is essential or optional and whether patterns and anti-patterns can make it more actionable. The episode ends with the final principles and a complete acknowledgement of the people who created the Manifesto.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with the Threat Modeling Manifesto contributors:
→ Threat Modeling Manifesto
→ Chris Romeo on LinkedIn
→ Robert Hurlbut on LinkedIn

Mentioned in this episode:
→ Threat Modeling Manifesto
→ Zoe Braiterman
→ Adam Shostack
→ Jonathan Marcil
→ Stephen de Vries and IriusRisk
→ Irene Michlin
→ Kim Wuyts
→ Robert Hurlbut
→ Brook Schoenfield
→ Matthew Coles
→ Chris Romeo
→ Alyssa Miller
→ Izar Tarandach
→ Avi Douglen
→ Marc French
→ Agile Manifesto

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 From debate to a finished Manifesto
02:48 Recipes, patterns, and adaptable practice
05:04 Documentation versus shared understanding
08:14 The return on investment of threat modeling
09:49 Structure and systematic analysis
12:56 Refining the principles
13:34 Alyssa Miller’s perspective
14:43 Irene Michlin joins the debate
16:12 Essential guidance versus optional advice
17:55 Preserving the power of the principles
19:28 Patterns and anti-patterns
21:15 Helping teams become more effective
22:42 Reading the final principles
24:04 The Manifesto contributors

The Threat Modeling Manifesto – Part 1 Nov 17, 2020

Show notes

What should threat modeling mean when practitioners use the term in very different ways? Part one of the Threat Modeling Manifesto documents a six-month collaboration among experienced practitioners trying to create a definition, values, and principles the community can support. The recording preserves real disagreements about people, design, privacy, tools, jargon, and how broad the practice should be. Contributors including Alyssa Miller, Fraser Scott, Brook Schoenfield, Matthew Coles, Chris Romeo, and Robert Hurlbut test individual words against years of teaching and consulting experience. Rather than presenting a polished result without context, the episode shows the difficult work of building consensus and deciding how a short public statement can remain precise without becoming inaccessible.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with the Threat Modeling Manifesto contributors:
→ Threat Modeling Manifesto
→ Chris Romeo on LinkedIn
→ Robert Hurlbut on LinkedIn

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Why the Threat Modeling Manifesto was created
01:25 Beginning the definition debate
02:57 Putting people at the center
04:16 Defining the boundaries of threat modeling
04:59 Alyssa Miller on security, privacy, and business
06:38 Building a definition the community can support
08:34 Fraser Scott on precise language
09:39 Brook Schoenfield on models and experience
12:09 Quality, buzz, and practitioner expectations
14:03 Short and long definitions
16:27 What counts as a threat modeling tool
18:25 Separating values from principles
20:35 Converging on the wording
23:09 Reviewing the remaining disagreements
25:04 How values become practice

Our TOPPODCAST Picks

Follow Us

Stay Connected

The Application Security Podcast

Related Podcasts

Links

Stay Connected