The Application Security Podcast

Latest Episodes:

Marc French, Steve Lipner, Maya Kaczorowski, DJ Schleen, Kim Wuyts — Season Six Wrap up May 13, 2020

Show notes

Season six closes by revisiting five conversations that capture the breadth of application security. Chris and Robert return to Marc French on the AppSec CISO, Steve Lipner on the history and future of the Microsoft SDL, Maya Kaczorowski on container and orchestration security, DJ Schleen on DevOps and organizational change, and Kim Wuyts on privacy threat modeling. Each segment pulls forward a durable lesson from the original interview and points listeners back to the full discussion. Together they connect leadership, secure development, cloud-native infrastructure, culture, and privacy into a concise tour of the season’s most useful and enduring ideas for practitioners.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with the featured guests:
→ Marc French on X
→ Steve Lipner at SAFECode
→ Maya Kaczorowski
→ DJ Schleen
→ Kim Wuyts

Mentioned in this episode:
→ Microsoft Security Development Lifecycle
→ SAFECode
→ gVisor
→ Kata Containers
→ The Unicorn Project
→ LINDDUN

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Season six lessons worth revisiting
02:00 Marc French on becoming the AppSec CISO
06:07 Steve Lipner on the Microsoft SDL
10:31 Maya Kaczorowski on container security
15:30 DJ Schleen on DevOps and organizational change
22:00 Kim Wuyts on privacy threat modeling
24:30 Closing season six

Mark Merkow — Secure, Resilient, and Agile Software Development Apr 11, 2020

Show notes

Mark Merkow works at WageWorks in Tempe, Arizona, leading application security architecture and engineering efforts in the office of the CISO. Mark has over 40 years of experience in IT in a variety of roles, including application development, systems analysis and design, security engineering, and security management. Mark has authored or co-authored 17 books on IT and has been a contributing editor to 4 others. Mark joins us to discuss how application security and agile software development methodology fit together. We hope you enjoy this conversation with Mark Merkow. At Security Journey, we believe security is every developer's job. We work with our customers to help them build long-term, sustainable security culture amongst all their developers.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Mark Merkow works at WageWorks in Tempe, Arizona, leading application security architecture and engineering efforts in the office of the CISO.
→ Learn more about Security Journey

Connect with Mark Merkow:
→ Secure, Resilient, and Agile Software Development
→ Security Assurance Using the Common Criteria

Mentioned in this episode:
→ Secure, Resilient, and Agile Software Development
→ Security Assurance Using the Common Criteria
→ Common Criteria Portal
→ OWASP SAMM
→ BSIMM
→ BSIMM

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Mark Merkow: Mark Merkow — Secure, Resilient, and Agile Software Development
02:04 I looked on Wikipedia. I looked at a picture on Wikipedia
06:32 How'd you get to AppSec then
12:52 High-level question then that is not directly from the book, but
15:59 Yeah. And so I want to kind of— I want to
17:28 Do we do that then
21:09 Yeah. And so when we think about One of the major
24:11 It's more about us kind of getting out of the way
26:44 What's the first thing in— what's the first part that you're
29:54 Yeah, I guess you can make all the plans that you
33:33 Last thing that I see as I'm kind of scanning the
37:47 Mark, what do you want to leave our audience with here

Zsolt Imre — Fuzz testing is easy Apr 05, 2020

Show notes

Fuzz testing can sound specialized and difficult, but Zsolt Imre argues that teams can start small and learn quickly. He joins Chris and Robert to explain what fuzzers do, which defects they are good at finding, and how his path from offensive security to defensive engineering shaped GUARDARA. The conversation covers target selection, root-cause analysis, programming languages, protocol complexity, and why no single fuzzer fits every system. Zsolt offers a practical adoption path: choose a meaningful target, integrate feedback into development, and iterate. The result is an accessible guide for AppSec teams that want to add fuzzing without turning it into a research project.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Zsolt Imre:
→ GUARDARA

Mentioned in this episode:
→ GUARDARA

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Why fuzz testing is easier than it looks
02:00 Zsolt Imre’s path into security
04:00 Moving from offensive to defensive work
07:00 What fuzz testing actually does
09:00 Who benefits from fuzzing
13:00 Finding and understanding root causes
18:00 Choosing targets and programming languages
23:00 Complexity, protocols, and coverage
26:00 Why there is no one-size-fits-all fuzzer
29:00 A practical way to get started
34:00 Integrating fuzzing and iterating
36:00 Final takeaways

Adam Shostack — Remote Threat Modeling Mar 28, 2020

Show notes

Adam joins us to discuss remote threat modeling, and we do a live threat modeling exercise to figure out how remote threat modeling actually works. On this episode of the Application Security Podcast, Robert and I are joined by Adam Shostack, and the topic we discuss is remote threat modeling. We're all living in this new world where we're working from home or we're sheltering at home, and the question we pose is, how are we still going to make progress on rolling out threat modeling when we can't meet with people face-to-face and work directly on a whiteboard? So we hope you enjoy this special episode of the Application Security Podcast with— Adam Shostack.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
On this episode of the Application Security Podcast, Robert and I are joined by Adam Shostack, and the topic we discuss is remote threat modeling.
→ Learn more about Security Journey

Connect with Adam Shostack:
→ Shostack + Associates
→ Adam Shostack

Mentioned in this episode:
→ Shostack + Associates
→ Adam Shostack
→ OWASP Threat Dragon Project
→ OWASP Slack

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Adam Shostack: Adam Shostack — Remote Threat Modeling
01:52 So we find ourselves right now recording this episode. The date
05:20 Are some of the tools What are some of the tools
07:57 So we'll— yeah, we can add in a couple of different
10:10 So then we have a lock activator. So it's making me
15:51 Yeah, so you're trying to minimize the friction of the tool
17:13 I think the takeaway there for our listeners that might be
19:35 Yeah, and I'm a fan of Aries Risk from Continuum as
22:08 Yeah. So let's come back around now to some of Robert's
24:20 Yeah, and I hear both. I hear sometimes, no, not so
26:12 That makes me think as a teacher of threat modeling, Something

Kim Wuyts — Privacy Threat Modeling Mar 23, 2020

Show notes

A system can protect data from attackers and still violate the privacy of the people using it. Kim Wuyts, a privacy researcher and contributor to LINDDUN, explains why privacy deserves its own threat modeling questions. She distinguishes security goals from harms to individuals, then walks through the framework’s approach to finding privacy risks in software designs. The conversation explores how linking ordinary pieces of information can identify a person, why non-repudiation can be undesirable in a privacy context, and what disclosure, awareness, and compliance mean for a design. Kim also discusses the relationship with privacy by design and offers a practical starting point for teams that already use diagrams and security threat modeling.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Kim Wuyts:
→ Kim Wuyts on LinkedIn

Mentioned in this episode:
→ LINDDUN privacy threat modeling
→ LINDDUN research and publications

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Privacy threat modeling with Kim Wuyts
01:44 Kim’s research background and LINDDUN
04:08 How privacy differs from security
05:55 Modeling harm to the data subject
08:50 Using diagrams and the LINDDUN framework
10:50 Linkability and identifying people from data
14:32 Lessons from the AOL search-data release
15:43 Non-repudiation as a privacy threat
16:44 Detectability and privacy
17:52 Information disclosure and the remaining categories
20:14 The connection to privacy by design
21:06 Getting started with LINDDUN
23:46 Future directions for privacy threat modeling
25:57 Kim’s closing advice

John Martin — Preventing a Cyberpocalypse Mar 14, 2020

Show notes

What happens when society’s dependence on software grows faster than its ability to make that software safe? John Martin, a commercial software security practitioner and SAFECode contributor, calls that widening gap a possible cyberpocalypse. He explains the combined pressures of vulnerable legacy code, expanding connectivity, and increasingly capable attackers. The hosts challenge his proposed responses, exploring software liability, standards, quality measurements, and the risk of constraining innovation. The discussion compares software assurance with product safety and building inspections, while questioning whether following a development process is enough evidence of a safe outcome. This is an exploratory debate about responsibility and incentives, with John urging the industry to confront systemic software risk before its consequences become harder to contain.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with John Martin:
→ John Martin on LinkedIn

Mentioned in this episode:
→ SAFECode
→ Cloud Security Alliance

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Preventing a cyberpocalypse with John Martin
01:45 John’s security origin story
04:26 Connecting breaking and building software
09:27 What John means by cyberpocalypse
12:28 Sudden catastrophe or accumulating harm
16:15 Technical debt and deferred responsibility
17:38 Ways to improve software outcomes
19:54 Measuring software quality
21:27 Liability and defining safe software
25:39 Could safety requirements constrain innovation?
27:51 The difficulty of a meaningful safety standard
31:29 Measuring process versus results
36:43 Software assurance and independent inspection
38:21 Where the industry conversation is happening

Jeremy Long — It’s dependency check, not checker Feb 20, 2020

Show notes

How do you discover vulnerable libraries when the names developers use do not match the names in vulnerability databases? Jeremy Long, founder of OWASP Dependency-Check, explains the evidence-gathering and matching behind software composition analysis. He tells the project’s origin story, discusses accuracy and false positives, and describes how Dependency-Check fits alongside other dependency tools. The conversation explores delayed upgrades, automated update services, supply-chain integrity, and the limits of treating all vulnerabilities alike. Jeremy also explains how teams can begin with a local scan and move checks into their build pipelines. Along the way, he offers a maintainer’s perspective on a widely adopted open-source project and keeps one naming detail clear: it is Dependency-Check, not Dependency-Checker.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Jeremy Long:
→ Jeremy Long on GitHub

Mentioned in this episode:
→ OWASP Dependency-Check
→ OWASP Dependency-Track
→ National Vulnerability Database
→ Jenkins

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Dependency-Check with Jeremy Long
02:41 Jeremy’s path into security
06:38 The project’s origin story
09:43 How Dependency-Check identifies components
14:14 Turning component evidence into vulnerability findings
16:31 Accuracy and the limits of matching
19:49 Maintaining a widely used open-source project
21:25 Why available patches still go unapplied
26:28 Automated upgrades and the future of SCA
28:35 Build integrity and supply-chain security
31:17 Adoption and project reach
33:08 Local scans and build-pipeline integration
38:54 Dependency-Check, not Dependency-Checker
40:00 Jeremy’s final advice

Alyssa Miller — Experiences with DevOps + Automation and beyond Feb 13, 2020

Show notes

Automating security tests is useful, but it does not by itself make a development team secure. Alyssa Miller, a former developer and application security practitioner, explains how DevOps changes the way security work should happen. She begins with her path into hacking and a striking penetration-test story in which a web application exposed domain-level privileges. The discussion then moves toward prevention: threat modeling during user-story development, reusable reference architectures, and feedback that helps engineers make better decisions early. Alyssa shares lessons about organizational change, realistic starting points, and the limits of adopting tools without changing habits. She also offers career advice for newcomers, emphasizing curiosity, clear interests, and the many paths that can lead into security.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Alyssa Miller:
→ Alyssa Miller’s website

Mentioned in this episode:
→ Threat Modeling: Designing for Security — first edition
→ Jenkins
→ BSides Las Vegas

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 DevOps, automation, and Alyssa Miller
02:30 Alyssa’s path from development into security
07:06 What makes application security compelling
08:19 Reaching domain admin through a web application
12:39 Defining DevOps through practical experience
15:21 Where security fits in DevOps
16:43 Threat modeling early in development
22:41 Asking security questions within user stories
25:46 Moving beyond automated scanning
30:35 Reference architectures that help developers
31:06 Organizational challenges in adopting DevOps
33:41 Choosing a realistic starting point
36:55 Career advice and finding your interests
41:27 The Blue Team Con community

Vandana Verma — Support each other Feb 07, 2020

Show notes

Building a stronger security community means helping more kinds of people participate and succeed. Vandana Verma returns to discuss her early work on the OWASP board, her ideas for improving outreach, and the broader meaning of diversity in application security. Chris asks about neurodiversity, inclusion, hiring standards, and how managers can find capable candidates beyond familiar networks. Vandana explains why support and training matter alongside opportunity, and why a skills shortage cannot be solved simply by moving experienced people between companies. She also shares the story of InfoSecGirls and discusses Women in AppSec. Her message is practical and personal: actively welcome people, help them develop their strengths, and support each other as the community grows.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Vandana Verma:
→ Vandana Verma’s website
→ Vandana Verma on LinkedIn

Mentioned in this episode:
→ InfoSecGirls
→ OWASP Foundation

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Supporting the application security community
02:58 Vandana’s early experience on the OWASP board
04:25 Priorities for community outreach
07:01 Understanding the many forms of diversity
08:07 Neurodiversity and inclusion
09:11 Making diversity a shared effort
11:48 Hiring standards and developing potential
13:24 How diverse teams strengthen security
17:34 Advice for hiring managers
19:39 Reaching people beyond familiar networks
21:46 The story and growth of InfoSecGirls
24:41 Women in AppSec
27:14 Support each other

DJ Schleen — DevOps: The Sec is Silent Jan 30, 2020

Show notes

What changes when security becomes part of delivering software instead of a separate gate? DJ Schleen joins Chris and Robert to explain why he prefers DevOps with a silent Sec, drawing on his journey from early programming and hacking to building delivery pipelines. They discuss the difference between genuine transformation and automating an existing process, why governance and compliance belong in the conversation, and how teams can grow their capabilities without adopting every tool at once. DJ walks through his DevSecOps reference architecture as an assembly line from idea to customer value. The conversation closes with learning Kubernetes through K3s, the tradeoffs of managed platforms, and the security thinking that matters more than a particular product.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with DJ Schleen:
→ LinkedIn
→ GitHub

Mentioned in this episode:
→ DevSecOps reference architecture
→ K3s
→ DevOpsDays
→ The Unicorn Project

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introduction
02:12 DJ's programming and hacking roots
06:33 What DevOps is trying to accomplish
09:44 Adoption beyond automating the old process
12:20 Will DevOps become ordinary software delivery?
15:15 Bringing compliance and governance along
18:17 Observers, stakeholders, and participants
19:48 Growing the team with the work
20:34 Why the Sec is silent
24:43 The DevSecOps reference architecture
28:54 Starting small and adding capabilities
31:23 Learning Kubernetes with K3s
33:49 Managed platforms and security tradeoffs
35:53 Closing thoughts

Our TOPPODCAST Picks

Follow Us

Stay Connected

The Application Security Podcast

Related Podcasts

Links

Stay Connected