The Application Security Podcast

Latest Episodes:

Erez Yalon – AppSec Village – 5 Minute AppSec Jul 29, 2019

Show notes

Why did DEF CON have villages for specialized security communities but no home dedicated to application security? Erez Yalon explains how that recurring question became AppSec Village. After several years of waiting for someone else to create it, he decided to act and invited Liora Herman, whose strength with operational details complemented his idea, to join the volunteer effort. Their partnership turned a missing conference space into a focused community for application security practitioners, researchers, and builders. This brief origin story captures a useful lesson about security communities: when an important forum does not exist, committed volunteers can stop asking why and build the place they want to attend.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Erez Yalon:
→ Erez Yalon on LinkedIn
→ AppSec Village

Mentioned in this episode:
→ AppSec Village
→ DEF CON
→ Black Hat

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Why create an AppSec Village?
00:20 The missing village at DEF CON
00:41 Turning the idea into a volunteer project
01:17 Continue with the full AppSec Village interview

Tommy Ross — The BSA Framework for Secure Software Jul 19, 2019

Show notes

Software producers, customers, and policymakers need a common way to discuss security without pretending that one checklist fits every product. Tommy Ross, a policy leader at BSA and a drafter of its Framework for Secure Software, explains how the framework was created and who it is meant to help. He describes its outcome-focused structure, the relationship between functions and more specific categories, and the role of existing industry practices. The conversation uses software supply-chain requirements to show how a high-level goal can become a useful discussion about evidence and risk. Tommy also explores procurement questions, policy needs, and the process for collecting feedback. The result is an introduction to a shared vocabulary for evaluating software security.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Tommy Ross:
→ Tommy Ross at RSA Conference

Mentioned in this episode:
→ BSA Framework for Secure Software — PDF
→ Framework repository
→ SAFECode

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 The BSA Framework for Secure Software
01:24 Tommy’s path into security policy
04:17 What BSA does
06:09 Introducing the software security framework
10:27 Producers, buyers, and policymakers as audiences
14:24 A common vocabulary for customer requirements
20:10 How the framework was developed
24:05 Functions, categories, and outcomes
27:21 A software supply-chain example
28:17 Applying a requirement in practice
29:20 Questions policymakers can ask
32:51 Finding the document and contributing feedback

Adam Shostack — Threat modeling layer 8 and conflict modeling Jul 10, 2019

Show notes

What if a system works exactly as designed but gives people new ways to harm one another? Adam Shostack explores threat modeling at layer eight: the human interactions that technical security reviews can overlook. He begins by defining success as better decisions and designs, then applies the familiar four threat modeling questions to social features and abuse. The conversation uses photo sharing, real-name policies, and content rules to show why context matters and why no single technical control settles every conflict. Adam introduces his conflict modeling project as a way to collect useful knowledge about those tradeoffs. He also asks who should participate, encouraging teams to bring broader expertise into decisions that affect people using their systems.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Adam Shostack:
→ Shostack + Associates

Mentioned in this episode:
→ Conflict Modeling project
→ Attack Trees by Bruce Schneier

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Threat modeling human conflict with Adam Shostack
02:35 Recent threat modeling work
04:32 What successful threat modeling looks like
07:26 What threat modeling layer eight means
11:38 Applying the four questions beyond technology
14:24 Social features, real names, and abuse
18:51 Building shared knowledge about conflict
21:01 Modeling threats to a photo-sharing feature
23:36 Who should make decisions about human harm?
27:44 Getting started with conflict modeling
29:41 The project’s intended resources and outcomes
31:42 Context-sensitive content rules
33:38 Closing thoughts and ways to contribute

Adam Shostack – Threat Modeling – 5 Minute AppSec Jul 09, 2019

Show notes

Why threat model when AppSec teams already have scanners, checklists, and testing? Adam Shostack argues that threat modeling is what makes those activities structured, systematic, and comprehensive instead of a collection of guesses. In this rapid 5 Minute AppSec, he explains how asking what you are building and what can go wrong focuses attention on the right parts of a system. Approaches such as STRIDE, attack trees, and kill chains help teams examine each element methodically, then use the results to guide the rest of the security program. Skip that step, Adam warns, and you are shooting in the dark. Stay through the end for a candid recording outtake.

Connect with Adam Shostack:
→ Adam Shostack on LinkedIn
→ Shostack + Associates

Mentioned in this episode:
→ Adam Shostack
→ Attack Trees (Schneier)
→ Cyber Kill Chain (Lockheed Martin)

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Why threat model?
00:10 Structured, systematic, and comprehensive security
01:07 The promised full interview
01:33 A candid recording outtake

Zoe Braiterman — AI, ML, AppSec, and a dose of data protection Jul 01, 2019

Show notes

Artificial intelligence can help analyze security data, but the systems using it also need protection themselves. Zoe Braiterman brings a background in data science, organizational thinking, and OWASP community work to an early conversation about that two-way relationship. Chris and Robert ask how artificial intelligence and machine learning differ, where automation is already appearing, and what pattern recognition might contribute to application security. The discussion moves from familiar examples such as fraud detection toward the data, models, and processes behind automated decisions. Zoe emphasizes the human role in understanding those systems and protecting the information they use. This archive episode captures exploratory thinking about AI and AppSec while encouraging practitioners to keep asking questions and learning together.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Zoe Braiterman:
→ Zoe Braiterman on LinkedIn

Mentioned in this episode:
→ OWASP Women in AppSec — project repository

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 AI, machine learning, and AppSec with Zoe Braiterman
02:03 Zoe’s path through data science into security
03:31 Community work with OWASP Women in AppSec
04:30 Distinguishing AI and machine learning
06:25 What autonomy means for a process
07:19 Examples of AI applications
10:18 Fraud detection and learning from data
14:25 Possible uses of AI in application security
16:19 Smarter tools and penetration testing
18:39 Pattern recognition in security data
21:08 Protecting the data and processes behind AI
23:45 Learning resources and closing advice

Caroline Wong — Self-care and self-aware for security people Jun 13, 2019

Show notes

A successful security career can still become unsustainable when work crowds out everything else. Caroline Wong shares the experiences that changed how she thinks about self-care, boundaries, and professional growth. She traces her career through security leadership roles, then describes the costs of neglecting her own needs and the difficulty of recognizing a problem while caught in it. Chris and Robert ask about work-life balance, vacation policies, and how a manager’s response shapes the real culture behind a company’s promises. Caroline offers questions candidates can ask prospective teammates and discusses what happens when personal values and organizational priorities diverge. Her advice encourages both individuals and hiring managers to pay attention to people, communicate honestly, and make deliberate changes.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Caroline Wong:
→ Caroline Wong on LinkedIn

Mentioned in this episode:
→ Cobalt
→ Security Metrics: A Beginner’s Guide

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Self-care and self-awareness with Caroline Wong
02:19 Caroline’s path into security leadership
11:28 What self-care means and why it matters
18:29 Rethinking work-life balance
21:13 Vacation policies and real workplace culture
25:03 Questions to ask during interviews
26:13 Learning from prospective teammates
28:12 Other pressures that undermine well-being
31:34 When personal and organizational priorities conflict
32:55 Turning awareness into practical changes
33:27 Advice for hiring managers and individuals

Björn Kimminich — The new JuiceShop, GSOC, and Open Security Summit May 31, 2019

Show notes

How do you keep an intentionally vulnerable application useful while its underlying frameworks keep fixing bugs? Björn Kimminich returns with an update on OWASP Juice Shop and the work required to maintain realistic security challenges. He describes new exercises involving promotional content, coupons, privacy, and two-factor authentication, then explains what happens when dependency or browser changes accidentally remove a vulnerability. The conversation also covers customization for different audiences, contributions through Google Summer of Code, and the balance between welcoming help and reviewing it carefully. Björn closes with plans for collaborative work at the 2019 Open Security Summit. This archive episode shows both the technical craft and community effort behind a widely used application security learning project.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Björn Kimminich:
→ Björn Kimminich on GitHub

Mentioned in this episode:
→ OWASP Juice Shop
→ Open Security Summit

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 What was new in OWASP Juice Shop
02:25 New features and hacking challenges
05:19 Working two-factor authentication with TOTP
07:21 Keeping the right parts intentionally vulnerable
08:15 When dependency updates remove a challenge
09:43 Privacy features and GDPR-related exercises
11:16 Customizing Juice Shop for different audiences
13:05 Google Summer of Code contributions
16:14 Reviewing contributions and sharing maintenance
17:09 Getting help and giving feedback
19:22 Introducing the 2019 Open Security Summit
21:42 Planned Juice Shop working sessions
24:50 Adapting the summit around participants’ needs
26:30 Where to find Juice Shop resources

Björn Kimminich — JuiceShop — 5 minute AppSec May 26, 2019

Show notes

What makes OWASP Juice Shop useful to developers when many intentionally vulnerable applications feel dated? Project creator Björn Kimminich explains that he built Juice Shop because older training targets did not represent modern front ends, REST APIs, or the technologies his students used. The project turns web vulnerabilities, business-logic flaws, validation failures, and design problems into hands-on challenges with a scoreboard and gamification. Teams can use it for developer training, awareness demonstrations, capture-the-flag events, security-tool testing, and customized management exercises. This short introduction shows why learning through a realistic application can make the OWASP Top 10 and other security weaknesses more concrete, memorable, and relevant to everyday development work.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Björn Kimminich:
→ Björn Kimminich on LinkedIn
→ OWASP Juice Shop

Mentioned in this episode:
→ OWASP Juice Shop
→ OWASP Top 10
→ Open Security Summit

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 What is OWASP Juice Shop?
00:19 A modern vulnerable application for developers
01:36 Challenges, gamification, and hands-on learning
03:01 Training, CTFs, and management demonstrations
04:20 Continue with the full Juice Shop interview

Nancy Gariché and Tanya Janca — DevSlop, the movement May 21, 2019

Show notes

How does an intentionally vulnerable application become a community learning movement? Nancy Gariché and Tanya Janca explain the evolution of OWASP DevSlop from a project into a live, collaborative way to teach application security. They describe the DevSlop Show, its deliberately imperfect demonstrations, and the value of learning in public without pretending every experiment will work. The conversation explores Pixi, Paddy the Pipeline, and integrations with free security tools including ZAP, dependency scanning, and web application firewalls. Nancy and Tanya also explain how contributors can start small, join broadcasts, document what they learn, and help expand the project. Their approach treats mistakes as useful teaching material and makes hands-on AppSec education more welcoming to developers and security newcomers.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Nancy Gariché and Tanya Janca:
→ Nancy Gariché and OWASP DevSlop
→ Tanya Janca on LinkedIn

Mentioned in this episode:
→ OWASP DevSlop
→ Pixi
→ OWASP ZAP
→ Burp Suite
→ Mend
→ OWASP ModSecurity Core Rule Set
→ Qualys SSL Labs

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 DevSlop as a movement
02:11 Meet Nancy Gariché and Tanya Janca
05:11 What OWASP DevSlop is
09:03 API security and the project’s scope
11:14 Learning through the DevSlop Show
16:15 Security tools in Paddy the Pipeline
18:47 Dependency scanning with Mend
21:36 Web application firewalls and ModSecurity
23:45 Making mistakes in public
27:47 How new contributors can begin
30:46 Community participation as the real output
32:51 DevSlop’s channels and identity
36:55 Closing thoughts

Tanya Janca — Mentoring Monday — 5 Minute AppSec May 19, 2019

Show notes

Security needs more experienced practitioners, but people do not become senior without guidance, advocacy, and opportunities to learn. Tanya Janca explains how her own mentors accelerated her career and why she created Mentoring Monday when more people requested help than she could personally support. The weekly hashtag lets prospective mentors and mentees find one another by topic while allowing volunteers to choose relationships they can sustain. Tanya challenges the belief that someone must be an expert before mentoring: even a few years of experience can be valuable to a person just starting out. Her invitation is simple—search the community, offer what you know, and help another practitioner progress faster than they could alone.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Tanya Janca:
→ Tanya Janca on LinkedIn
→ Mentoring Monday

Mentioned in this episode:
→ Mentoring Monday
→ OWASP DevSlop

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Why mentoring matters to security
00:53 How Mentoring Monday began
02:08 Matching mentors and mentees by topic
03:25 You know enough to help someone
04:54 Continue with the full DevSlop interview

Our TOPPODCAST Picks

Follow Us

Stay Connected

The Application Security Podcast

Related Podcasts

Links

Stay Connected