The Application Security Podcast

Latest Episodes:

Ronnie Flathers — Security programs big and small Sep 27, 2019

Show notes

Which parts of an AppSec program should change as a company grows, and which should stay the same? Ronnie Flathers joins Chris and Robert to compare security work in a fast-moving smaller company with the challenges of a large enterprise. He explains the advantages of a consistent technology stack and close developer relationships, then explores what breaks when one team can no longer know every application or manager. The discussion covers developing security champions, meeting teams where they work, and making incremental improvements instead of chasing an overnight transformation. Ronnie grounds the comparison in four principles: visibility and transparency, enabling rather than hindering, iterative progress, and management through metrics. The starting point is understanding what exists before deciding how to secure it.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Ronnie Flathers:
→ LinkedIn
→ Ronnie's blog

Mentioned in this episode:
→ Darknet Diaries
→ OWASP Juice Shop
→ Agile Manifesto

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introduction
01:59 Xbox hacking and Ronnie's security beginnings
04:50 Consulting and early mentorship
08:44 Security catching up with software delivery
11:54 Growing security skills in developers
13:11 Champions who want to participate
16:52 Embedding security with engineering teams
18:37 Advantages of a smaller company's technology stack
22:52 Why large-company security cannot do everything
24:25 Working with development processes
25:47 First priorities in a smaller company
29:04 Making progress with resistant teams
30:55 Enterprise visibility and management through metrics
33:24 Four foundations of an AppSec program

Brook Schoenfield — Security is a messy problem Sep 15, 2019

Show notes

Why doesn't an executive mandate and a scanning tool add up to a software security program? Brook Schoenfield joins Chris and Robert to unpack security as a human, technical, and organizational problem that crosses the whole development lifecycle. He describes the limits of policy and testing, then explains how noisy tools lose developer trust. His practical alternative is to begin with high-confidence checks developers can use themselves, supported by deeper specialist testing rather than an impossible promise to find everything. The conversation turns to culture hacking: sharing responsibility, helping teams work through the consequences of their own incidents, and using threat modeling to make security tangible. Brook closes by connecting those habits to iterative improvement and the security of the delivery pipeline itself.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Brook S.E. Schoenfield:
→ LinkedIn
→ Brook's website

Mentioned in this episode:
→ Securing Systems: Applied Security Architecture and Threat Models
→ IOActive

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introduction
05:03 Why a mandate is not a security program
08:32 The appeal and limits of simple answers
09:50 Security crosses every domain
11:41 Getting engineers to want security
16:59 Why security tools lose developer trust
24:10 Layering developer checks and specialist testing
25:55 Putting useful tools in developers' hands
29:15 Fast feedback while writing code
33:00 The program-building lessons so far
34:43 Culture hacking and shared responsibility
40:25 Continuous improvement and delivery-chain security
43:33 What's next in Brook's writing

Liran Tal — The state of open source software security Sep 05, 2019

Show notes

Developers may want to own security, but what helps them turn that intention into safer software? Liran Tal joins Chris and Robert to examine Snyk's 2019 State of Open Source Security research. After sharing how running a bulletin board system sparked his curiosity, he explains the report's mix of survey responses, dependency data, and public ecosystem information. They discuss vulnerable libraries in popular container images, why updating a base image can matter, and the hesitation developers feel when dependency changes might break an application. Liran also explores how vulnerabilities can remain unnoticed for years. He closes with three priorities for improvement: make security accessible, treat it as part of product quality, and celebrate developers who find and fix problems.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Liran Tal:
→ LinkedIn
→ GitHub

Mentioned in this episode:
→ 2019 State of Open Source Security — developer ownership findings
→ Docker Hub
→ Node.js
→ Libraries.io

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introduction
01:23 BBS roots and early computing
04:38 Finding a path into application security
06:41 Curiosity and learning by building
11:00 The data behind the open-source report
12:11 Combining survey and ecosystem sources
12:40 Developers want to own security
15:13 Vulnerabilities in popular container images
17:32 Base images, trust, and practical fixes
20:13 Updating dependencies without breaking the application
23:59 Vulnerabilities that remain dormant for years
26:23 The window before discovery
27:52 Three priorities for improving open-source security
31:43 Connecting with Liran

Liran Tal — Open Source Security — 5 Minute AppSec Sep 03, 2019

Show notes

Why should developers care about open source security when they already have features, testing, accessibility, and performance to manage? Liran Tal answers by framing security as part of the responsibility that comes with shipping software. Applications depend on libraries, protocols, and components that can age into exploitable weaknesses, so ownership extends beyond the code a team writes directly. Liran compares secure delivery to checking the doors and windows before leaving home: teams should consciously examine what they are putting into the world. This short episode argues that open source risk belongs inside the normal development workflow, even when its return on investment is difficult to quantify before an incident occurs.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Liran Tal:
→ Liran Tal on LinkedIn
→ Liran Tal’s website

Mentioned in this episode:
→ Node.js Security Working Group

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Why developers should care about open source security
00:10 Security as developer responsibility
01:13 Vulnerable dependencies and outdated cryptography
02:26 Continue with the full interview

Steve Springett — An insiders checklist for Software Composition Analysis Aug 27, 2019

Show notes

An SCA tool can find vulnerable libraries and still leave important software supply-chain questions unanswered. Steve Springett, creator of Dependency-Track and CycloneDX, shares the detailed criteria he used to evaluate commercial and open-source tools. He starts with accurate component inventories, then examines package management, licenses, maintenance status, provenance, policy enforcement, and integration with real development environments. Steve cautions against treating an unconfirmed exploit path as proof that a dependency is safe and explains why project health belongs in risk decisions. The conversation also introduces software bills of materials and compares binary, manifest, and SBOM analysis. This archive discussion provides a concrete way to define requirements and test competing tools against the software an organization actually builds.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Steve Springett:
→ Steve Springett on GitHub

Mentioned in this episode:
→ OWASP Dependency-Track
→ CycloneDX
→ SPDX

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 An insider’s SCA checklist with Steve Springett
03:02 Understanding software supply-chain risk
06:16 What software composition analysis should provide
08:13 Risk intelligence beyond known vulnerabilities
09:33 Evaluating the SCA market at the time
13:57 Defining requirements for a tool comparison
14:50 Start with an accurate component inventory
15:41 Ecosystems, package management, provenance, and SBOM support
24:07 Testing tools against your organization’s needs
28:43 Policy enforcement and exploitability caveats
30:29 Onboarding, integration, and component age
33:08 Project health and limiting dependency sprawl
34:49 Reviewing the complete evaluation checklist
38:27 Software bills of materials explained
43:22 Using SBOMs to improve inventory accuracy
45:24 Combining binary, manifest, and SBOM analysis
47:45 Dependency-Track project update

Steve Springett — OWASP Dependency Track — 5 Minute AppSec Aug 25, 2019

Show notes

What does OWASP Dependency-Track add beyond a conventional software composition analysis scanner? Steve Springett explains how the project continuously analyzes software bills of materials across an enterprise, correlates components with multiple vulnerability-intelligence sources, and helps teams identify affected assets when a new issue emerges. Its API-first design allows CI/CD pipelines to submit inventories automatically and lets downstream systems react through REST APIs and webhooks. Steve also covers outdated-component detection, package ecosystems, and license analysis through SPDX. This concise introduction presents Dependency-Track as a software supply-chain component analysis platform built to turn a constantly changing inventory into actionable risk information rather than a one-time list of dependencies.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Steve Springett:
→ Steve Springett on LinkedIn
→ OWASP Dependency-Track

Mentioned in this episode:
→ OWASP Dependency-Track
→ National Vulnerability Database
→ Sonatype OSS Index
→ SPDX
→ Heartbleed

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 What is OWASP Dependency-Track?
00:16 Analyzing components and SBOMs at enterprise scale
02:16 Vulnerability intelligence and outdated components
03:25 APIs, webhooks, and actionable intelligence
04:12 Continue with the full SCA interview

Elissa Shevinsky — Static Analysis early and often Aug 18, 2019

Show notes

Security testing is more likely to happen when it fits the way developers already work. Elissa Shevinsky, then CEO of Faster Than Light, joins Chris and Robert to discuss static analysis, startup lessons, and making security easier to adopt. She explains how her entrepreneurial path led into security and how mentors helped her navigate unfamiliar problems. The conversation then turns to what static analysis can tell developers, when to run it, and why slow or confusing feedback limits its usefulness. Elissa connects security findings with code quality and describes the challenge of communicating their value to people outside security. Her practical theme is to test early and often while reducing the effort required to make testing routine.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Elissa Shevinsky:
→ Elissa Shevinsky on LinkedIn

Mentioned in this episode:
→ Faster Than Light — historical project repositories
→ FindBugs — historical Java analyzer
→ Techstars London

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Static analysis early and often with Elissa Shevinsky
02:01 Elissa’s path into software and security
06:26 Lessons from security startups
07:51 The value of mentoring
09:15 Paying mentoring forward
12:52 The Techstars London experience
14:15 What static analysis does
16:35 Making findings useful to developers
17:45 When to run static analysis
19:16 Testing in frequent deployment cycles
22:23 Making security fit everyday work
25:06 Security and code quality
25:42 Practical testing habits
26:41 Closing advice

Elissa Shevinsky — Be Kind, Security People — 5 Minute AppSec Aug 14, 2019

Show notes

Why should kindness matter in an industry responsible for protecting money, systems, and sometimes lives? Elissa Shevinsky argues that high stakes do not justify gatekeeping, arrogance, or treating newcomers badly. Drawing on the community conversation around her SecretCon event and Rob Graham’s “InfoSec is Good People” post, she acknowledges why security practitioners value competence while rejecting meanness as a professional virtue. The field has more work than people available to do it, making a welcoming culture a practical necessity as well as an ethical one. Her message in this short episode is direct: hackers and defenders share one community, and that community becomes stronger when its members choose to be kind.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Elissa Shevinsky:
→ Elissa Shevinsky on LinkedIn

Mentioned in this episode:
→ InfoSec is Good People

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Why kindness matters in information security
00:20 Rejecting gatekeeping as a security virtue
02:07 Continue with the full interview

Matt McGrath — Security coaches Aug 05, 2019

Show notes

Security programs improve when developers have someone who can help them want to get better, not merely tell them what they did wrong. Matt McGrath joins Chris and Robert to explain the security coach role and how it differs from both a wellness coach and a security champion. He describes the communication skills, technical credibility, and developer empathy that make coaching effective, then examines how coaching fits alongside training and other program controls. The discussion covers meeting cadence, part-time versus dedicated roles, measuring progress, and launching with a small group. Matt’s core advice is to partner with engineering teams and build their capability until they need less direct help from security.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Matt McGrath:
→ Security Coaches episode page

Mentioned in this episode:
→ OWASP Security Champions Guide

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introducing security coaching
02:20 Matt McGrath’s developer-to-security journey
07:09 What a security coach actually does
10:33 Helping developers choose to improve
13:54 The security coach job description
17:31 Communication, credibility, and technical skills
20:42 How coaching feels from the developer side
24:33 Working toward developer independence
28:24 Part-time and dedicated coaching roles
31:47 Choosing a useful coaching cadence
33:59 Security coaches versus security champions
38:31 How to launch a coaching program
41:49 Partner with engineering teams

Erez Yalon and Liora Herman – The Application Security Village @ DefCon Jul 29, 2019

Show notes

What would an application security conference look like inside DEF CON? Erez Yalon and Liora Herman explain how a volunteer idea became the Application Security Village, a dedicated space for talks, workshops, demonstrations, and community at one of security’s largest gatherings. They describe the gap they saw between traditional DEF CON villages and the needs of AppSec practitioners, then discuss winning support, recruiting volunteers, and designing content for both newcomers and experienced professionals. The conversation covers workshops, project showcases, and the practical challenges of building an inclusive event from scratch. Erez and Liora close by inviting listeners to participate, contribute, and use the village as a place to learn directly from the people creating application security tools and practices.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Erez Yalon and Liora Herman:
→ Erez Yalon on LinkedIn
→ Liora Herman on LinkedIn
→ Application Security Village

Mentioned in this episode:
→ Application Security Village
→ DEF CON
→ OWASP Foundation

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Creating an Application Security Village
02:16 How Erez and Liora joined forces
05:51 Building a volunteer-driven event
08:42 Villages as conferences within DEF CON
10:48 Getting support from DEF CON
13:27 Designing content for the AppSec community
16:03 Workshops and hands-on topics
18:42 Where to find updates and participate
21:49 A village for newcomers and experts

Our TOPPODCAST Picks

Follow Us

Stay Connected

The Application Security Podcast

Related Podcasts

Links

Stay Connected