The Application Security Podcast

Latest Episodes:

Niels Tanis — 3rd Party Risk in a .NET World Jan 24, 2020

Show notes

How much behavior do you inherit when you add one library to a .NET application? Niels Tanis joins Chris and Robert to examine third-party risk beyond checking a dependency for known vulnerabilities. They revisit the event-stream compromise and Operation ShadowHammer, then look at NuGet packages, transitive dependencies, and functionality developers may never intend to use. A PDF library becomes a concrete example of why network access and other capabilities deserve scrutiny. Niels explores isolation, assembly loading, and constraining library behavior rather than trusting every dependency with the application's full privileges. He also describes using Mono.Cecil and his Fennec tooling to inspect calls, helping developers ask better questions about what their dependencies can actually do.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Niels Tanis:
→ LinkedIn
→ Niels's blog

Mentioned in this episode:
→ NuGet
→ iTextSharp
→ Operation ShadowHammer
→ Mono.Cecil
→ Fennec.CLI

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introduction
03:03 What third-party risk really includes
06:25 Compromised dependencies and event-stream
11:08 Operation ShadowHammer and trusted updates
14:04 Dependency risk in the .NET ecosystem
17:03 Hidden capabilities inside familiar libraries
21:51 Isolation and least privilege
23:48 Constraining libraries with assembly loading
28:42 Controlling behavior and micropatches
30:21 Inspecting calls with Mono.Cecil and Fennec
34:14 Making dependency reviews useful to developers

Maya Kaczorowski — Container and Orchestration Security Jan 16, 2020

Show notes

Containers can improve your security story, but not simply because they are called containers. Maya Kaczorowski, working on container security at Google at the time of this conversation, joins Chris and Robert to separate packaging and orchestration benefits from the isolation guarantees people often assume. She explains how smaller services, consistent environments, and faster updates can help, then considers what an attacker wants from a compromised workload or cluster. The discussion covers image provenance, malicious images, permissions, and alternatives that strengthen isolation, including gVisor and Kata Containers. Maya also describes a practical progression for teams adopting Kubernetes: learn the environment, understand the risks, and build security into deployment decisions rather than treating the first working cluster as a finished system.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Maya Kaczorowski:
→ LinkedIn
→ Maya's website

Mentioned in this episode:
→ Kubernetes
→ gVisor
→ Kata Containers
→ Kubernetes admission controllers
→ Exploring container security

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introduction
01:29 From mathematics to security product work
03:42 Moving into container security
06:58 Containers and orchestration explained
09:12 Docker, runtimes, and orchestration choices
10:33 How containers can improve security
14:18 Stronger isolation with sandboxed runtimes
15:33 Threat modeling an attacker in a container
18:03 Where your images come from
20:03 Typosquatting and malicious images
21:50 Defending workloads and clusters
26:26 The container security learning journey
31:15 Resources for learning more

Geoff Hill — AppSec, DevSecOps, and Diplomacy Jan 09, 2020

Show notes

Why can a technically sound DevSecOps initiative fail before it changes how anyone works? Geoff Hill joins Chris and Robert to discuss the diplomacy behind application security transformation. He describes security as an activity throughout delivery, not a product bolted onto a pipeline, and shares lessons from tool integration and organizational resistance. The conversation moves from security champions to the managers who control their time, showing why persuasion, listening, and political capital matter. Geoff explores the fears underneath resistance, including job security and breaking working systems, and the danger of moving faster than an organization can absorb. He closes with practical starting points: understand the existing workflow, establish repeatable development and deployment practices, and introduce security through achievable improvements.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Geoff Hill:
→ LinkedIn

Mentioned in this episode:
→ Veracode
→ Ansible
→ Splunk

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introduction
02:00 Defining DevSecOps across the lifecycle
04:57 Making security native to delivery
07:19 Lessons from failed integrations
12:17 Security champions and management support
16:34 Diplomacy, persuasion, and political capital
18:54 Listening before proposing change
20:16 Transformation in nonagile organizations
25:44 The fears behind resistance
29:46 Removing barriers through practical experiments
32:59 First steps toward a working pipeline

Erez Yalon — The OWASP API Security Project Jan 03, 2020

Show notes

Why did APIs need a security Top 10 of their own? Erez Yalon joins Chris and Robert to explain the gaps that led to the OWASP API Security project and walk through its original 2019 list. He contrasts traditional web applications with APIs serving many kinds of clients, where authorization decisions and exposed data can become especially difficult to control. The conversation distinguishes broken object-level authorization from broken function-level authorization, then examines excessive data exposure, mass assignment, resource limits, and forgotten API versions. Erez also discusses the project's plans for practical learning materials and ways the community can contribute. This is a guided introduction to the original API Security Top 10, with concrete explanations of the design assumptions behind common failures.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Erez Yalon:
→ LinkedIn
→ OWASP API Security project

Mentioned in this episode:
→ OWASP API Security Top 10 — 2019
→ OWASP API Security repository
→ OWASP crAPI

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introduction
01:35 What an API is
05:50 Why API security differs from web security
09:25 Rapid change and the API attack surface
11:43 Why OWASP started the API Security project
14:52 Broken object-level authorization
17:22 Broken authentication
19:03 Excessive data exposure
20:42 Resource and rate limits
21:21 Broken function-level authorization
23:16 Mass assignment
24:55 Injection
26:34 Improper assets management
27:59 Logging and monitoring
30:05 Learning resources and the project roadmap
33:30 Contributing to API security

Steve Lipner — The Past, Present, and Future of SDL Dec 19, 2019

Show notes

How did Microsoft's Security Development Lifecycle become a repeatable engineering practice rather than a one-time security push? Steve Lipner joins Chris and Robert to trace that history from early computer security work through security response, Trustworthy Computing, and the formalization of SDL. He explains why reviewing software at the end cannot scale, how threat modeling and testing became development activities, and what organizations learned as tooling and expectations evolved. The discussion connects that history to teams starting their own programs: establish a way to receive and respond to security reports, use the protections already available in development tools, and build from there. Steve closes with guidance for mature programs that need to keep learning instead of treating yesterday's process as finished.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Steve Lipner:
→ Steve's website
→ SAFECode

Mentioned in this episode:
→ Microsoft Security Development Lifecycle
→ Microsoft Security Response Center

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introduction
02:36 Early computer security at MITRE
04:32 A career spanning security products and practice
06:28 Joining Microsoft security response
08:40 Trustworthy Computing and the security push
14:29 Defining and sharing SDL
16:46 Why end-of-cycle audits do not scale
18:32 Formalizing the lifecycle in 2004
21:12 Threat modeling, tools, and security testing
25:12 How secure development keeps evolving
28:35 Advice for starting a security program
32:12 What mature programs should remember

David Kosorok — The Three Pillars of an AppSec Program: Prevent, Detect, and React Dec 15, 2019

Show notes

Where should a small application security team begin when it cannot do everything? David Kosorok joins Chris and Robert with a practical framework: prevent, detect, and react. Drawing on his background in software testing, he maps the pillars to requirements and design, coding and testing, and deployment and feedback. These are parallel areas to develop, not three stages to finish in order. David explains how relationships with security champions make prevention possible, how testing expertise strengthens detection, and why external findings can make risk tangible for developers. The conversation also explores bug bounties, feedback loops, and meaningful recognition. His emphasis is on building a supportive security culture through partnerships and small, useful controls rather than overwhelming teams with a complete program at once.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with David Kosorok:
→ LinkedIn

Mentioned in this episode:
→ OWASP Triangle
→ SSL Labs Server Test
→ Hacker101
→ HackerOne
→ Bugcrowd

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introduction
02:33 From software testing to application security
03:56 What testers bring to security
07:07 Quality and security share a purpose
08:39 Prevent, detect, and react
09:56 Prevention through requirements and design
12:46 Partnerships and security champions
16:24 Detection during coding and testing
18:59 Working with quality engineers
20:36 Reacting to risk in deployed applications
23:49 Making external findings useful feedback
28:42 Recognition that encourages participation

Chris and Robert: A Taste of Hi-5 Dec 01, 2019

Show notes

What happens when Chris and Robert trade a single interview topic for five current application security ideas? This experimental Hi-5 episode reviews articles about secure design, developer mentoring, OWASP Proactive Controls, web security practices, and layered testing. The hosts connect each article to work they have seen inside development and security teams, challenging simplistic advice and asking what makes a recommendation usable. They discuss deliberate mentoring, broader language for software security, automation, early design choices, multiple testing techniques, penetration testing, and the operational readiness required before launching a bug bounty. The format is lighter and faster than a standard interview, but the goal remains practical: identify ideas worth carrying into a real secure development program.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Chris Romeo and Robert Hurlbut:
→ Chris Romeo on LinkedIn
→ Robert Hurlbut on LinkedIn

Mentioned in this episode:
→ Interest In Secure Design Practices Is Increasing Leading To Two Predictions
→ Developers mentoring other developers: practices I've seen work well
→ 7 Web Application Security Best Practices
→ OWASP Proactive Controls

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introducing the Hi-5 format
02:01 Secure design predictions
05:23 Security and software development working together
07:05 Deliberate developer mentoring
10:04 Plans, follow-up, and mentoring habits
11:20 OWASP Proactive Controls
13:13 Who participates in secure development
14:38 Naming the broader discipline
15:55 Automating repeatable security work
17:10 Starting security practices early
18:36 Layering tools and testing methods
22:05 The role of penetration testing
25:36 Readiness before bug bounty programs

Bill Dougherty — INCLUDES NO DIRT, practical threat modeling for healthcare and beyond Nov 21, 2019

Show notes

What happens when a threat model has to account for patient privacy and clinical harm as well as attackers? Bill Dougherty joins Chris and Robert to explain INCLUDES NO DIRT, the model he developed with Patrick Curry at Omada Health. They discuss why conventional security categories did not fully capture digital healthcare's competing security, privacy, and compliance needs, and how combining ideas from existing frameworks produced a memorable checklist. Bill walks through the practical workflow, from understanding a system and drawing data flows to asking targeted questions and prioritizing deeper review. The conversation also covers training product teams to use the model themselves, avoiding checkbox risk assessments, and adapting the published questionnaires to the risks an organization actually needs to understand.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Bill Dougherty:
→ LinkedIn
→ INCLUDES NO DIRT at Omada Health

Mentioned in this episode:
→ LINDDUN privacy threat modeling
→ Microsoft threat modeling

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introduction
02:17 Bill's path into security leadership
04:21 Security responsibilities at Omada Health
06:38 Why digital healthcare needed another threat model
10:20 The INCLUDES NO DIRT acronym
11:09 Security, privacy, and clinical threat categories
12:33 What makes healthcare different
14:07 Turning the categories into a practical process
18:21 Diagrams and understanding the system
21:08 Applying the checklist to data flows
23:35 Helping product teams become self-sufficient
25:11 Requirements and compliance considerations
27:00 Getting started with the questionnaires
30:07 Closing thoughts

Marc French — The AppSec CISO Nov 10, 2019

Show notes

Is becoming a CISO the next technical promotion, or a fundamentally different job? Marc French joins Chris and Robert to discuss the role through the eyes of an application security leader. Drawing on experience running both product and security functions, he explains how delivery commitments change the way risk decisions look. The conversation examines the CISO's communication-heavy day, reporting relationships, alternative career paths, and the growing importance of application and product security as infrastructure becomes code. Marc offers practical advice for people pursuing leadership: understand the business, gain experience outside a narrow security role, and find mentors who will challenge your assumptions. He also discusses programming skills, developing future AppSec talent, and why a title alone is not a useful career plan.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Marc French:
→ LinkedIn

Mentioned in this episode:
→ Boston Application Security Conference

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introduction
02:09 How Marc's AppSec CISO perspective developed
05:30 Running application security inside product management
08:59 Balancing vulnerabilities and business commitments
10:37 Learning outside a security role
12:36 What a CISO actually does
14:24 Reporting relationships and the org chart
16:15 The limits of a purely technical career plan
18:26 Leadership paths beyond the CISO title
21:03 Breaches and leadership expectations
22:16 Where application security fits
25:02 Advice for aspiring CISOs
29:51 The rise of product security leadership
32:20 Advice for students entering security
35:32 Why programming skills matter
41:21 Finding a mentor

Season 5 Finale — A cross section of #AppSec Oct 26, 2019

Show notes

Season 5 covered application security from tools and threat models to mentoring, self-care, coaching, dependency risk, and program design. Chris and Robert revisit the guests whose explanations best captured that range. Simon Bennetts introduces the ZAP Heads Up Display, Izar Tarandach explains pytm, Tanya Janca and Nancy Gariché discuss mentoring, Björn Kimminich presents Juice Shop, Caroline Wong addresses self-care, Adam Shostack examines the human layer of threat modeling, Matt McGrath defines security coaching, Steve Springett explains Dependency-Track, and Ronnie Flathers describes building sustainable programs. Organized as guest-level chapters, the finale works as a guide to the season and a reminder that effective AppSec combines technical capability with community, learning, and organizational change.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Chris Romeo and Robert Hurlbut:
→ Chris Romeo on LinkedIn
→ Robert Hurlbut on LinkedIn

Mentioned in this episode:
→ OWASP ZAP
→ ZAP Heads Up Display (HUD)
→ pytm
→ OWASP Juice Shop
→ Dependency-Track
→ Sonatype OSS Index
→ SPDX
→ #CyberMentoringMonday
→ OWASP Juice Shop

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Season 5 highlights
02:46 Simon Bennetts on the ZAP HUD
04:50 Izar Tarandach on pytm
07:32 Tanya Janca and Nancy Gariché on mentoring
11:29 Björn Kimminich on OWASP Juice Shop
15:43 Caroline Wong on self-care in security
18:00 Adam Shostack on threat modeling’s human layer
20:54 Matt McGrath on security coaching
24:06 Steve Springett on Dependency-Track
28:22 Brook Schoenfield on security architecture
31:12 Ronnie Flathers on building AppSec programs
35:28 Closing Season 5

Our TOPPODCAST Picks

Follow Us

Stay Connected

The Application Security Podcast

Related Podcasts

Links

Stay Connected