The Application Security Podcast

Latest Episodes:

Grant Ongers — Gamification of threat modeling Jul 28, 2020

Show notes

Grant Ongers (@rewtd) is co-founder of the bearded trio called Secure Delivery, with a philosophy and purpose for optimal delivery and security in one dynamic package. Grant's experience spans Dev, Ops, and Security, with over 30 years pushing the limits of (Info)Sec. Grant’s community involvement is global: Staff at BSides (London, Las Vegas, and Cape Town), Goon at DEF CON (USA) for nearly ten years and DC2721 co-founder, staff at BlackHat (USA and EU), and an OWASP Global Board member. Grant Ungers is co-founder of the bearded trio called Secure Delivery, with a philosophy and purpose for optimal delivery and security in one dynamic package.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Grant Ungers is co-founder of the bearded trio called Secure Delivery, with a philosophy and purpose for optimal delivery and security in one dynamic package.
→ Learn more about Security Journey

Connect with Grant Ongers:
→ Secure Delivery
→ OWASP Cornucopia

Mentioned in this episode:
→ Secure Delivery
→ OWASP Cornucopia
→ OWASP Cornucopia
→ Elevation of Privilege
→ OWASP Application Security Verification Standard (ASVS)

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Grant Ongers: Grant Ongers — Gamification of threat modeling
02:16 Uh, with that in mind, we, we do have a special
05:24 So, with that in mind, who should be doing the threat
07:21 There a particular methodology, Grant, that you would say is what
13:31 As I'm kind of listening to this, and I told you
17:48 It's basically taking this smaller idea, and when you have 25,000—
20:24 Yeah, I remember the first time I heard about it and
24:23 I think about threat modeling as— when I went teaching threat
27:08 That, that's great because that's what you want, right
32:17 Grant, well, thank you for joining us. Any last, maybe something

Elie Saad — OWASP WSTG, Cheat Sheets, and Integration Jul 20, 2020

Show notes

Elie Saad is an application security engineer, leading three different OWASP projects. He focuses on helping developers own and champion security in their projects by providing guidance, tests, secure pipeline design and aiding them in applying external security measures. Eli Saad is an application security engineer leading 3 different OWASP projects. In this conversation, Eli educates us about the current happenings with WSTG, which is the testing guide, the Cheat Sheet project, and the integration standard. And he walks us through demos of each of these projects. We hope you enjoy this conversation with Eli Saad. At Security Journey, we believe security is every developer's job.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Eli Saad is an application security engineer leading 3 different OWASP projects.
→ Learn more about Security Journey

Connect with Elie Saad:
→ OWASP Web Security Testing Guide (WSTG)
→ OWASP Cheat Sheet Series

Mentioned in this episode:
→ OWASP Web Security Testing Guide (WSTG)
→ OWASP Cheat Sheet Series
→ OWASP Application Security Verification Standard (ASVS)
→ OWASP Password Storage Cheat Sheet
→ OWASP Proactive Controls
→ OWASP ZAP
→ Mobile Testing Guide

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Elie Saad: Elie Saad — OWASP WSTG, Cheat Sheets, and Integration
02:15 Great. We'll have to do another episode where we profile and
07:25 That's exciting, the different projects. I mean, Robert and I are
09:59 Yeah, I mean, you're doing a lot in the world of
13:46 If I remember correctly, there are also some tie-ins from the
19:08 Yeah, that's great. And it just, it shows the depth. That's
25:38 It's such a hard thing to actually do. Like, I couldn't
27:27 You probably, same thing, Chris, you hear that often. What's the
29:16 Let's, let's go ahead and transition over to the integration standards
35:24 Yeah, it's great. It's a piece that's been missing is the

Graham Holmes — Adversarial Machine Learning Jul 13, 2020

Show notes

Graham Holmes is the founder and owner of AoP CyberSecurity, LLC whose mission is to enable organizations to “create scalable and effective strategies for trustworthy outcomes. ” His career includes over 22 years as a leader at Cisco Systems, where he infamously served as my boss for a period of time, and before that he served in the US Navy as a commissioned officer for 9 years. Graham joins us to discuss adversarial machine learning. We explore the threats and attacks in an AI/ML world, and review solutions to address these challenges using trust as a foundation. Please enjoy this conversation with Graham Holmes. We explore the threats and attacks in an artificial intelligence machine learning world and review solutions to address these challenges using trust as a foundation.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Graham Holmes is the founder and owner of AOP Cybersecurity, whose mission is to enable organizations to create scalable and effective strategies for trustworthy outcomes.
→ Learn more about Security Journey

Connect with Graham Holmes:
→ Life 3.0
→ Microsoft Security Development Lifecycle (SDL)

Mentioned in this episode:
→ Life 3.0
→ Microsoft Security Development Lifecycle (SDL)
→ Artificial Intelligence

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Graham Holmes: Graham Holmes — Adversarial Machine Learning
02:31 Yeah, that's awesome, and congratulations on that. And it's some, I
06:32 So our topic then is adversarial machine learning. And so I
08:53 It sounds like— and actually, I didn't even— I forgot to
13:44 Graham, is it full— can you reverse engineer Kind of what
25:21 Yeah, because when you think about a vulnerability in a modern
27:38 You know, we've talked about, uh, definitely importance of, of application
32:14 Since we've covered— I feel like we've covered the attacks well
35:41 So you've, uh, you're branching out on a new venture here
37:40 Here's a— and I know we're coming to the close here
40:54 Graham, are there any, uh, resources that you would recommend
43:31 That's, uh, great. Uh, Life 2.0, I'm gonna remember that. Check

Ochaun Marshall — Securing Web applications in AWS Jul 07, 2020

Show notes

Ochaun Marshall is a developer and security consultant. In his roles at Secure Ideas, he works on ongoing development projects utilizing Amazon Web Services and breaks other people's web applications. Ochaun joins us to talk about the changing tide of serverless and frustrations with AWS security. Before we got to the actual topic, we talked about how he currently works as a developer some times, and a pen tester/security person the rest of the time, and the conflict that arises from this split role. Please enjoy this conversation with... O'Shawn Marshall is a developer and security consultant. O'Shawn joins us to talk about the changing tide of serverless and frustrations with AWS security.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
O'Shawn Marshall is a developer and security consultant.
→ Learn more about Security Journey

Connect with Ochaun Marshall:
→ Secure Ideas
→ OWASP Proactive Controls

Mentioned in this episode:
→ Secure Ideas
→ OWASP Proactive Controls

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Ochaun Marshall: Ochaun Marshall — Securing Web applications in AWS
03:29 Very cool. You survived that 60-year-old librarian coming after you. She
06:26 Yeah, that's, that's definitely good advice, something that we share as
11:13 Yeah, I'll tag on to something you said here about kind
14:19 Yeah, I guess there's some of that basic stuff. Like, when
18:59 Yeah, or you end up opening it, making it wide open
21:07 Yeah, that's good advice just for in general, for anything. Yeah
25:05 Yeah, that's definitely going to be a challenge as we move
29:35 Authorization. How are we ensuring that the right request, that the
34:26 It's not simple. It's so complicated. Like, I've been playing around

Drew Dennison – Security should make the computer sweat more Jun 30, 2020

Show notes

Drew Dennison is the CTO & co-founder of r2c, a startup working to profoundly improve software security and reliability to safeguard human progress. Drew joins us to introduce a tool called semgrep. Semgrep is a fast source code analysis tool, potentially faster than anything you've seen before. Drew Dennison is the CTO and co-founder of R2C, a startup working to profoundly improve software security and reliability to safeguard human progress. If you want to see the live demo Drew does of Semgrep, head over to the Application Security Podcast YouTube channel to see the video. We hope you enjoy this conversation with Drew Dennison. At Security Journey, we believe security is every developer's job.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Drew Dennison is the CTO and co-founder of R2C, a startup working to profoundly improve software security and reliability to safeguard human progress.
→ Learn more about Security Journey

Connect with Drew Dennison:
→ Semgrep
→ r2c / Semgrep Inc.

Mentioned in this episode:
→ Semgrep
→ r2c / Semgrep Inc.
→ Applied Cryptography
→ Ron Rivest
→ John Nash's Declassified NSA Letters
→ Hack (programming language)
→ Flow
→ nodejsscan
→ Yoann Padioleau
→ Applied Cryptography
→ Hacking Exposed Web Applications
→ Tree-sitter

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Drew Dennison: Drew Dennison – Security should make the computer sweat more
01:42 All right, so the topic for today is something called Semgrep
07:24 I'm trying to think. You spoke about this tool, I think
12:22 This a replacement or a— I mean, is this designed to
15:21 Yeah. I mean, that's the whole DevOps approach to the world
18:09 Really neat way. So, GitHub Action pipelines— what other use cases
21:03 Yeah, you have patterns that still match certain code constructs as
22:16 That's very cool, that example you had earlier there about the
24:43 You're running Semgrep against anything you're building, so good luck. They're
27:58 If you had to leave our audience with one kind of

Aaron Guzman — IoTGoat Jun 23, 2020

Show notes

Aaron Guzman specializes in IoT, embedded, and automotive security. Aaron is the Co-Author of “IoT Penetration Testing Cookbook”. He helps lead both OWASP’s Embedded Application Security and Internet of Things projects; providing practical guidance for addressing top security vulnerabilities to the embedded and IoT community. Aaron joins us to explore IoTGoat. IoTGoat is a deliberately insecure firmware created to educate software developers and security professionals with testing commonly found vulnerabilities in IoT devices. He describes what it is, where it comes from, and does a demo for us on how to put it to use. Aaron joins us to explore IoT Goat. IoT Goat is a deliberately insecure firmware created to educate software developers and security professionals with testing commonly found vulnerabilities in IoT devices.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Aaron Guzman specializes in IoT, embedded, and automotive security.
→ Learn more about Security Journey

Connect with Aaron Guzman:
→ IoTGoat
→ OWASP IoT Project

Mentioned in this episode:
→ IoTGoat
→ OWASP IoT Project
→ OWASP IoT Top 10
→ OWASP Juice Shop
→ OWASP Web Security Testing Guide (WSTG)
→ OWASP ISVS
→ Cloud Security Alliance (CSA)
→ CSA IoT Working Group
→ ENISA

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Aaron Guzman: Aaron Guzman — IoTGoat
02:09 All right, and our guest today is Aaron Guzman, who is
07:34 Aaron, I understand you are working on the project IoT Goat
10:15 Aaron, when I think about vulnerable apps, I think about like
11:51 Curious, where did it come from
14:48 March of what year
18:33 You mentioned the relationship to OWASP IoT, or at least it
21:55 Now if we kind of switch gears and get more practical
27:04 Just let me summarize to make sure I'm understanding correctly. So
28:40 As far as the future of IoT Goat, where do you
32:12 Yeah, definitely. Most definitely. So if you want to leave our

Adam Shostack — The Jenga View of Threat Modeling Jun 16, 2020

Show notes

Adam Shostack is a leading expert on threat modeling, and consultant, entrepreneur, technologist, author and game designer. He has taught threat modeling at a wide range of commercial, non-profit and government organizations. Adam joins us to discuss his new white paper called the Jenga View of Threat Modeling. He's a member of the Black Hat Review Board, is the author of Threat Modeling: Designing for Security, and the co-author of The New School of Information Security. Adam joins us this week to discuss his new white paper called The Jenga View of Threat Modeling. We hope you enjoy this episode with Adam Shostack. You cannot hack yourself secure.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Adam Shostack is a leading expert on threat modeling and consultant, entrepreneur, technologist, author, and game designer.
→ Learn more about Security Journey

Connect with Adam Shostack:
→ Jenga View of Threat Modeling whitepaper
→ Adam Shostack

Mentioned in this episode:
→ Jenga View of Threat Modeling whitepaper
→ Adam Shostack
→ Threat Modeling: Designing for Security
→ New School Of Information Security 9780132800280
→ Robert Hurlbut

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Adam Shostack: Adam Shostack — The Jenga View of Threat Modeling
02:05 Yeah, thank you. And so you have some things you've been
05:22 You remember those Jenga commercials back from when those of us
07:54 Okay. Makes sense. Again, you don't want it to fall down
09:46 Adam, I'm looking at the white paper that you've written about
11:50 You had a few others there We don't have time right
16:49 One of them that actually has an asterisk next to it
22:15 Right
25:43 Okay. Now, with all the way we've talked about here today
27:23 I got another question about kind of a more general approach

Cindy Blake — Aligning security testing with Agile development Jun 09, 2020

Show notes

Cindy Blake is the Senior Security Evangelist at GitLab. Cindy collaborates around best practices for integrated DevSecOps application security solutions with major enterprises. She is proud to introduce her new book, “10 Steps to Securing Next-Gen Software”. The book combines her cyber security experience with a background in lean and software development, and simplifies the complexities of today’s software evolution into pragmatic advice for security programs. Cindy joins us to discuss how to align security testing with Agile development. She's proud to introduce her new book, 10 Steps to Securing Next-Gen Software. The book combines her cybersecurity experience with a background in lean and software development and simplifies the complexities of today's software evolution into pragmatic advice for security programs.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Cindy Blake is the Senior Security Evangelist at GitLab.
→ Learn more about Security Journey

Connect with Cindy Blake:
→ GitLab
→ 10 Steps Every CISO Should Take to Secure Next-Gen Software

Mentioned in this episode:
→ GitLab
→ 10 Steps Every CISO Should Take to Secure Next-Gen Software
→ Fortify (OpenText)
→ ArcSight (OpenText)
→ TippingPoint (Trend Micro)

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Cindy Blake: Cindy Blake — Aligning security testing with Agile development
02:07 Awesome. And so our topic today is aligning security testing with
05:18 So do you think— is any of the code you wrote
08:29 Like, what are— when you're describing those tools, are they things
09:51 We had another question about why have so few succeeded in
11:21 Would you, when you're thinking about this kind of separation, I'm
16:10 In our own little startup here and looking at that and
17:59 Yeah, yeah. Robert, what's your experience been between kind of— as
19:58 Cindy, what do you think are the best practices that work
25:12 Yeah, yeah. We're in here in the— at the podcast, we're
27:31 Very, very cool. So if you, I guess, from a last

Jannik Hollenbach — Multijuicer: JuiceShop with a side of Kubernetes Jun 02, 2020

Show notes

Jannik Hollenbach is a Security Automation Engineer at iteratec GmbH, working on and with open source security testing tools to continuously detect security vulnerabilities in the companies software and systems. He is also a member of the OWASP Juice Shop project team. Jannik joins us to discuss MultiJuicer, or how to run JuiceShop in a Kubernetes cluster, with a separate JuiceShop instance for each user. Yannick Hollenbach is a security automation engineer at Idera Tech GmbH, working on and with open-source security testing tools to continuously detect security vulnerabilities in the company's software and systems. He's also a member of the OWASP Juice Shop project team.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Yannick Hollenbach is a security automation engineer at Idera Tech GmbH, working on and with open-source security testing tools to continuously detect security vulnerabilities in the company's software and systems.
→ Learn more about Security Journey

Connect with Jannik Hollenbach:
→ multi-juicer GitHub
→ OWASP Juice Shop

Mentioned in this episode:
→ multi-juicer GitHub
→ OWASP Juice Shop
→ MultiJuicer
→ OWASP Juice Shop
→ Kubernetes
→ Terraform
→ Terraform
→ OWASP Slack

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Jannik Hollenbach: Jannik Hollenbach — Multijuicer: JuiceShop with a side of Kubernetes
01:53 We are joined by our first ever video-based guest here. This
04:28 Yeah, and there's a lot of cool things happening in the
06:39 Is— now, is MultiJuicer tied into Kubernetes, or can I use
09:44 With Multijuicer then, what do I get when I download Multijuicer
12:29 What's the largest number of Juice Shop instances you've seen anybody
14:39 Have you seen from the adoption perspective
17:33 Great. Yannick, any final words you would leave for our audience

Sebastien Deleersnyder and Bart De Win — OWASP SAMM May 26, 2020

Show notes

How does an organization improve software security without reducing maturity to a checklist? Sebastien Deleersnyder and Bart De Win join Chris and Robert to explain OWASP SAMM, the open framework for assessing and evolving a software assurance program. They trace the project’s history, explain the model’s business functions, practices, streams, and maturity levels, and show how teams can turn an assessment into a realistic roadmap. The conversation also covers version 2, companion resources, education, community events, and how SAMM differs from commercial maturity models. The result is a practical introduction for organizations that want a shared language for improvement without prescribing one identical program for everyone.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Sebastien Deleersnyder and Bart De Win:
→ OWASP SAMM
→ Toreon

Mentioned in this episode:
→ OWASP SAMM
→ OWASP SAMM project
→ BSIMM
→ Gary McGraw

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introducing OWASP SAMM
02:07 Sebastien and Bart’s paths to the project
05:08 The name behind the model
06:22 How SAMM began
09:00 What SAMM measures
13:00 Using SAMM inside an organization
13:56 What changed in SAMM version 2
17:35 Turning an assessment into a roadmap
22:00 Business functions, practices, and streams
23:00 Companion projects and supporting resources
27:00 Education and community adoption
31:00 How SAMM versioning works
33:00 SAMM user days and community feedback
35:00 The cost of using an open model
37:00 Getting started with SAMM

Our TOPPODCAST Picks

Follow Us

Stay Connected

The Application Security Podcast

Related Podcasts

Links

Stay Connected