The Application Security Podcast

Latest Episodes:

Season 7 Guests — The best of Season 7 Oct 26, 2020

Show notes

Which ideas from Season 7 deserve another listen? Chris and Robert assemble clips from across the season, creating a fast tour through secure development maturity, intentionally vulnerable applications, IoT security, static analysis, cloud risk, artificial intelligence, threat modeling, data protection, JavaScript supply-chain defense, penetration testing, API design, and Ruby on Rails. Each segment returns to the guest’s own explanation rather than reducing the episode to a host summary. The result is both a recap and a listening guide: Janek Hollenbach, Cindy Blake, Aaron Guzman, Drew Dennison, Ochaun Marshall, Graham Holmes, Elie Saad, Grant Ongers, Michael Furman, Anastasia Voitova, Aaron Davis, Caroline Wong, Dmitry Sotnikov, and Frank Rietta each contribute a distinct practical lesson.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Chris Romeo and Robert Hurlbut:
→ Chris Romeo on LinkedIn
→ Robert Hurlbut on LinkedIn

Mentioned in this episode:
→ OWASP SAMM
→ MultiJuicer
→ OWASP IoTGoat
→ Semgrep
→ OWASP Cornucopia
→ OWASP ASVS
→ LavaMoat
→ MetaMask
→ OWASP Top 10
→ OWASP SAMM
→ OWASP Cornucopia
→ Ruby on Rails

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Season 7 highlights
01:37 Sebastien Deleersnyder on OWASP SAMM
02:48 Janek Hollenbach on MultiJuicer
04:05 Cindy Blake on security in DevSecOps
05:59 Aaron Guzman on OWASP IoTGoat
07:11 Drew Dennison on how Semgrep works
10:39 Ochaun Marshall on AWS security frustration
13:10 Graham Holmes on trustworthy AI
16:34 Elie Saad’s introduction to OWASP
18:29 Grant Ongers on threat modeling games
22:16 Chris Romeo on the state of security
24:35 Michael Furman on SameSite cookies
25:53 Anastasia Voitova on data security
28:05 Aaron Davis on defending LavaMoat
29:38 Caroline Wong on modern penetration testing
32:04 Dmitry Sotnikov on REST API security
35:57 Frank Rietta on Ruby on Rails
39:22 Closing Season 7

Aviat Jean-Baptiste — The AppSec report Oct 13, 2020

Show notes

Jb Aviat is CTO and co-founder at Sqreen. Prior to this, Jb worked at Apple as a reverse engineer, pentester and developer. Jb joins us to discuss the new Application Security Report that Sqreen has released. We review what the report contains, key takeaways and conclusions, and even consider which framework/language is the most secure. We hope you enjoy this conversation with.... JB Eviat is CTO and co-founder at Screen. You cannot hack yourself secure. Everyone wants to focus on the offensive side of the equation. The challenge is that developers get bored with hacking broken pieces of code after a while. Sure, it's a shiny, cool new thing in the beginning, but how about one year later?

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
JB Eviat is CTO and co-founder at Screen.
→ Learn more about Security Journey

Connect with Aviat Jean-Baptiste:
→ Sqreen (now Datadog AAP)
→ OWASP Top 10

Mentioned in this episode:
→ Sqreen (now Datadog AAP)
→ OWASP Top 10
→ HackerOne 2020 Hacker Report
→ Ruby on Rails
→ Symfony
→ Laravel
→ WordPress
→ Express
→ MongoDB
→ Node.js

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Aviat Jean-Baptiste: Aviat Jean-Baptiste — The AppSec report
01:34 We're going to talk today about a new report that has
04:38 Now I'm curious. It sounds like you came from a lot
10:52 Yeah. So, JP, that's what we're here for, is a report
13:00 So understanding a little bit more about what the report is
15:34 If we think about this from our audience's perspective, What would
19:18 With that in mind, and let's take— I know you give
21:30 We did talk about, we've already kind of mentioned a few
24:45 That's a great point about use of frameworks and making sure
27:47 As somebody who spends a good amount of time in Ruby

Frank Rietta — The convergence of Ruby on Rails and #AppSec Oct 06, 2020

Show notes

Ruby on Rails can provide strong security defaults, but a framework cannot make every design decision for its developers. Frank Rietta, a security-focused Rails developer and business owner, explains where the framework helps and where teams still need to think carefully. He traces his path into application security, describes Rails beyond its startup reputation, and discusses testing, secure coding guidance, and the familiar threats facing web applications. Frank also shares his work on RubyGems typosquatting and the risks introduced through dependencies. The practical discussion turns to Brakeman, Bundler Audit, and building checks into everyday development. His recurring advice is to combine useful tooling with deliberate design, maintained dependencies, and an understanding of how attackers can misuse ordinary features.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Frank Rietta:
→ Frank Rietta’s website

Mentioned in this episode:
→ Rails security guide
→ Brakeman
→ Bundler Audit

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Ruby on Rails and AppSec with Frank Rietta
01:14 Frank’s path into application security
07:13 Helping developers build security skills
11:00 What Ruby on Rails provides
14:01 Rails beyond early-stage startups
17:15 Security defaults and their limits
22:23 Secure coding guidance for Rails developers
25:20 Testing culture and security checks
29:13 The main threats facing Rails applications
32:14 Typosquatting and the RubyGems supply chain
38:32 Brakeman, Bundler Audit, and the security toolkit
45:11 Key takeaways for secure Rails development

Dmitry Sotnikov – REST API Security – there is no silver bullet Sep 29, 2020

Show notes

Dmitry Sotnikov serves as Chief Product Officer at 42Crunch – an enterprise API security company. He maintains a popular community site with daily API Security news and weekly newsletter API vulnerabilities, breaches, standards, best practices, regulations, and tools. Dmitry joins us to discuss REST API Security. We talk about the top API security threats, counters to those threats, and the details on APISecurity. We hope you enjoy this conversation with ... He's also the maintainer of apisecurity. io, a popular community site with daily API security news and weekly newsletters. At Security Journey, we believe security is every developer's job. We work with our customers to help them build long-term, sustainable security culture amongst all their developers.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Dmitry Sotnikov serves as Chief Product Officer at 42 Crunch, an enterprise API security company.
→ Learn more about Security Journey

Connect with Dmitry Sotnikov:
→ APISecurity.io
→ OWASP API Security Top 10

Mentioned in this episode:
→ APISecurity.io
→ OWASP API Security Top 10

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Dmitry Sotnikov: Dmitry Sotnikov – REST API Security – there is no silver bullet
02:02 Oh wait, so you, you want to talk about a technical
07:26 I'm curious though about your previous role from an API management
09:49 Our topic today is REST APIs. I remember back in the
12:37 We think about the differences in security then, we've acknowledged the
16:40 With that in mind, what are some of the top security
25:09 That points to counters, countering that kind of thing. I mean
26:44 Yeah, I mean, and I've even seen, I mean, I'm sure
30:27 We appreciate you joining us today, Dmitry. I was wondering if

Caroline Wong — The state of Penetration Testing Sep 22, 2020

Show notes

Caroline Wong is the Chief Strategy Officer at Cobalt. io. You cannot hack yourself secure. The challenge is that developers get bored with hacking broken pieces of code after a while. Sure, it's a shiny, cool new thing in the beginning, but how about one year later? At Security Journey, we focus on long-term sustainable security culture with the developers as defenders. We believe that developers need hands-on experience, but not at the expense of fundamental knowledge. Visit www. securityjourney. com to sign up for a free trial of the Security Dojo or schedule a demo. This is Robert Hurlbut. Threat modeling architect. I'm also joined by my co-host Chris Romeo.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Caroline Wong is the Chief Strategy Officer at Cobalt.
→ Learn more about Security Journey

Connect with Caroline Wong:
→ Cobalt.io
→ BSIMM

Mentioned in this episode:
→ Cobalt.io
→ BSIMM
→ Burp Suite
→ HackerOne
→ Bugcrowd
→ PCI Security Standards Council

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Caroline Wong: Caroline Wong — The state of Penetration Testing
02:38 Absolutely. And so as Chris mentioned, today we're going to shift
05:03 Great. So another interesting thing that I hear, maybe some confusion
07:29 Sure, right. Okay, that makes sense. So let's talk about software
11:39 That okay
14:43 Caroline, that definitely makes sense. And I do have another question
16:49 Now we had a question about your company. Your company also
28:45 I have one more question, and this sort of— just thinking

Aaron Davis — LavaMoat — solving JavaScript software supply chain Sep 15, 2020

Show notes

Aaron Davis is a founder, dev, and a lead security researcher at MetaMask, a popular Ethereum wallet. He introduces us to LavaMoat, an approach to solving javascript software supply chain security for node and the browser. The LavaMoat runtime prevents modifying JavaScript's primordials, limits access to the platform API, and prevents packages from corrupting other packages. We hope you enjoy this conversation with... Aaron Davis.

Connect with Aaron “kumavis” Davis:
→ Aaron “kumavis” Davis on GitHub
→ LavaMoat

Mentioned in this episode:
→ LavaMoat
→ MetaMask
→ npm event-stream incident
→ Snyk
→ Node.js

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Aaron “kumavis” Davis
02:10 Aaron’s security origin story
03:29 Security lessons from building MetaMask
05:20 Why tackle the JavaScript supply chain?
09:06 The problem reaches beyond JavaScript
10:40 Malicious updates and compromised maintainers
12:47 The hidden scale of transitive dependencies
14:52 Open source economics and critical packages
18:42 Is LavaMoat a firewall for JavaScript?
20:22 Could browsers make LavaMoat obsolete?
22:35 Runtime performance costs
25:11 Threat modeling LavaMoat itself
28:36 Static analysis and policy generation
30:07 Understanding LavaMoat policy files
33:01 Using LavaMoat in complex applications
37:36 How to get involved

Anastasiia Voitova — Use Cryptography; Don’t Learn It Sep 10, 2020

Show notes

Developers need to protect data, but should they need to become cryptographers to do it safely? Anastasiia Voitova, a software engineer working on data security at Cossack Labs, makes the case for boring cryptography: dependable libraries with clear, high-level interfaces and fewer opportunities for misuse. She explains the practical tension between encryption and application features such as searching, then walks through common mistakes in choosing algorithms, handling keys, and copying examples from the internet. Chris and Robert ask how developers can evaluate libraries and find trustworthy guidance. Anastasiia’s answer is to focus on the protection the application needs, choose tools designed for that job, and make the secure path easier than assembling cryptographic primitives by hand.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Anastasiia Voitova:
→ Anastasiia Voitova at Cossack Labs

Mentioned in this episode:
→ Cossack Labs
→ OpenSSL
→ Go

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Use cryptography without becoming a cryptographer
01:43 Anastasiia’s route from development to data security
04:36 The practical appeal of cryptography
06:26 Data protection and searchable encryption
10:34 What use cryptography, don’t learn it means
12:07 Moving beyond don’t roll your own crypto
14:02 Common mistakes in cryptographic design
20:58 The risks of copying security examples
21:46 Defining boring cryptography
24:04 Choosing safer libraries and APIs
28:22 Finding useful cryptography resources
31:31 Practical advice for developers

Michael Furman — SameSite Cookies Sep 03, 2020

Show notes

Michael Furman is the Lead Security Architect at Tufin, and is responsible for the security and Security Development Lifecycle (SDL) of Tufin software products. Michael is passionate about application security for over 13 years already and evangelizes about application security at various conferences (including OWASP conferences) and security meetups. Michael joins us to break down SameSite cookies, which are all the rage in browsers these days. He describes what they are, the threats they counter, and how SameSite + the Synchronizer Token Pattern work together to counter CSRF. We hope you enjoy this conversation with.... He's worked in this space for 13 years and evangelizes AppSec at various conferences, including OWASP and security meetups.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Michael Furman is the lead security architect at Tufin and is responsible for the security and secure development lifecycle of Tufin software products.
→ Learn more about Security Journey

Connect with Michael Furman:
→ Tufin
→ Chromium

Mentioned in this episode:
→ Tufin
→ Chromium

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Michael Furman: Michael Furman — SameSite Cookies
02:17 Excellent. And so to get started, what we usually do is
04:54 Yeah, and I'll definitely second what you're saying about application security
07:17 Okay. And so SameSite's been around then for just a couple
08:52 That makes sense in terms of some of the things that
11:19 Yeah, and I think the last I heard for the previous
14:37 So with the— what you're modeling in the test csrf.htm here
17:09 Yeah. So one of the patterns that we've used in the
19:14 It sounds like you could still use the synchronizer pattern, but
30:39 We can only hope and dream that that is a world
32:29 Yeah, that's great. That provides our users with some additional information

Chris Romeo — The State of Security and the Importance of Empathy Aug 27, 2020

Show notes

Network engineers and application security teams depend on each other, yet often struggle to understand each other’s responsibilities. In this rebroadcast from The Hedge, Chris Romeo joins hosts Russ White and Tom Ammon to explore that divide. They discuss encrypted traffic, denial-of-service attacks, DNS, and the limits of relying on network controls to protect applications. Chris explains threat modeling as a repeatable way to question assumptions, including assumptions about cloud services and insider access. The conversation then turns to infrastructure automation, changing engineering roles, and the frustration created when security policies arrive without technical understanding. Their practical message is to learn one another’s language and build empathy through real experience with the systems other teams operate.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Chris Romeo:
→ Chris Romeo on LinkedIn

Mentioned in this episode:
→ The Hedge episode 48
→ National Vulnerability Database

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Chris joins The Hedge to discuss security
02:01 Where network and application security meet
04:29 Encrypted traffic and network responsibilities
06:04 Certificates, DNS, and interception threats
07:51 Threat modeling as a way of questioning assumptions
09:23 How denial-of-service defenses evolved
12:23 Revisiting models as threats change
17:45 Where network engineers can improve security
22:21 Helping developers and application teams
24:46 Routing, segmentation, and control-plane risks
28:18 Insider threats and shared control
31:11 Infrastructure as code and changing engineering roles
34:51 Empathy between network and security teams
39:39 Learning paths for network engineers

Neil Matatall — Content Security Policy Aug 04, 2020

Show notes

Neil Matatall is a product security engineer at GitHub. He focuses on designing and engineering user experiences solutions related to authentication and account recovery. Working remotely from Hawaii, Neil is a strong believer in the future of remote work. Neil joins us for a deep-dive into Content Security Policy. We explore what it is, the purpose, and why it's so difficult to implement. Neil Madhatal is a product security engineer at GitHub. Neil joins us for a deep dive into content security policy. We hope you enjoy this conversation with— Neil Madhatal. Are you trying to build a security champions program? Everyone is these days.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Neil Madhatal is a product security engineer at GitHub.
→ Learn more about Security Journey

Connect with Neil Matatall:
→ github/secure_headers
→ Content-Security-Policy (MDN)

Mentioned in this episode:
→ github/secure_headers
→ Content-Security-Policy (MDN)
→ Scott Helme
→ Troy Hunt
→ Twilio
→ Sqreen (now Datadog AAP)

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Neil Matatall: Neil Matatall — Content Security Policy
01:56 So, you know, probably like me, enough to be dangerous, which
05:19 Yeah, that's very cool to hear that you, you know, were
09:50 So just to kind of summarize a little bit, when we're
11:58 So like, do you remember, it was about maybe a year
14:36 So I interrupted when we were in the middle of talking
20:25 Kind of going back to, you talked about the unsafe inline
22:18 Neil, when you're building a policy then, is that the steps
28:46 It just, this is not very easy to do
30:14 In the example you had where you're adding a button and
32:39 Yeah. Now, we talked about SRI earlier. One of the challenges
34:44 We mentioned secure headers as one potential resource. Are there any
36:07 Scott Helm had a, I think it's still out there, secureheaders.io
40:02 Great, thanks for sharing that with us and for sharing it

Our TOPPODCAST Picks

Follow Us

Stay Connected

The Application Security Podcast

Related Podcasts

Links

Stay Connected