The Application Security Podcast

Latest Episodes:

Matt Clapham — A perspective on appsec from the world of medical software May 13, 2019

Show notes

Security teams learn something different when they leave their own conferences and listen to the industries using their products. Matt Clapham, a product security practitioner working with medical software, shares what he observed at the HIMSS healthcare technology conference. He describes the mix of established systems and newer cloud services, the sensitivity of medical information, and the questions vendors should be able to answer about secure development. Chris and Robert explore the gap between compliance claims and practical protection, including why adding security products cannot substitute for sound engineering. Matt also reflects on his path from testing into leadership. His closing challenge is to step outside the security echo chamber and understand how another industry sees risk.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Matt Clapham:
→ Matthew Clapham on LinkedIn

Mentioned in this episode:
→ HIMSS

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 AppSec through the lens of medical software
03:03 Matt’s path from testing to product security
05:34 Balancing leadership and hands-on work
06:43 What HIMSS brings together
08:45 Healthcare technology and security maturity
11:05 Cloud adoption in healthcare
12:16 Compliance and protecting medical information
15:57 What security vendors were offering
17:56 Asking how products are built securely
20:30 Responding to weak security explanations
21:21 Lessons beyond individual security products
25:07 Leaving the security echo chamber

Jon McCoy — Hacker outreach May 06, 2019

Show notes

How can hackers and corporate security teams work together when each sees the other through a different set of assumptions? Jon McCoy explains hacker outreach as a way to connect people, share knowledge, and make security communities easier to enter. He describes DEF CON for newcomers, discusses its culture, and recalls a cautionary story about Robert’s connected wearable at the event. The conversation follows Jon’s journey into OWASP and his support for diversity initiatives, including Women in AppSec and conference scholarships. Chris asks how organizations can help and what a more welcoming community might look like. Jon’s message centers on practical generosity: introduce people, remove barriers, and help the next person find a place to contribute.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Jon Mccoy:
→ Jon McCoy on GitHub

Mentioned in this episode:
→ DEF CON
→ OWASP Women in AppSec — project repository
→ OWASP Foundation

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Hacker outreach with Jon McCoy
02:42 What hacker outreach means
05:12 Where outreach happens
06:11 Introducing DEF CON
07:42 What newcomers should expect
09:06 Robert’s connected-wearable cautionary tale
11:19 Jon’s journey from DEF CON to OWASP
13:05 Bringing hacker outreach into OWASP
15:18 Diversity initiatives and access to community
16:32 Women in AppSec
17:58 Conference diversity scholarships
18:31 How organizations can help
19:42 A more welcoming security community
23:05 Jon’s call to action

Omer Levi Hevroni — K8s can keep a secret? Apr 30, 2019

Show notes

Putting an application in Kubernetes does not solve the problem of getting secrets to it safely. Omer Levi Hevroni, a developer and security champion, explains the risks that led his team to create Kamus. He starts with Kubernetes basics and the broader responsibilities of developers who own applications through deployment and operation. The discussion then follows secrets from source control into the cluster, comparing native mechanisms with encryption and external key-management options. Omer walks through the Kamus workflow, including how an encrypted secret is tied to the application allowed to decrypt it. He also discusses the threats the design addresses and the value of documenting assumptions. This archive conversation captures a practical approach to secrets management and its tradeoffs.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Omer Levi Hevroni:
→ Omer Levi Hevroni on GitHub

Mentioned in this episode:
→ Kamus — historical project repository
→ Kubernetes
→ Azure Key Vault

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Can Kubernetes keep a secret?
02:38 From developer to security champion
04:16 Learning to code and owning applications
06:32 Kubernetes basics
08:44 The challenge of handling application secrets
10:34 Developers responsible for the whole lifecycle
11:19 Keeping secrets usable and controlled
14:18 Secrets accidentally committed to source code
17:09 Options for secrets in Kubernetes
18:58 Recovery and consuming secrets in application code
21:08 Encryption and external key management
24:22 Why the team built Kamus
26:42 The Kamus encryption and decryption workflow
28:21 Where encrypted secrets and keys live
31:43 Threats addressed by the design
34:22 Documentation, threat model, and further resources

Izar Tarandach — Command line threat modeling with pytm Apr 23, 2019

Show notes

What if developers could describe threats in the same place they describe their software? Izar Tarandach introduces pytm, a Python framework that turns a system description into diagrams and a starting list of threats. He explains why the team built a command line approach, how element attributes drive threat identification, and why small models belong beside the code they describe. Chris and Izar explore possible CI/CD integration, the knowledge developers need to get started, and the limits of automating a conversation about design. The episode offers a practical starting point: clone the sample model, make its diagram resemble your system, then use that shared picture to discover and discuss the risks automation cannot resolve alone.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Izar Tarandach:
→ Izar Tarandach on LinkedIn
→ OWASP pytm

Mentioned in this episode:
→ pytm source and examples
→ Microsoft Threat Modeling Tool
→ Graphviz

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Command line threat modeling with Izar Tarandach
01:10 Izar’s security origin story
05:26 What pytm does and why the team built it
10:54 Where the threat rules come from
12:57 How developers respond to modeling in code
14:47 Keeping threat models beside source code
15:38 Potential CI/CD integration
17:48 Small models and detecting design drift
18:43 How much security knowledge developers need
19:53 Where whiteboard conversations still matter
20:55 A graphical interface without losing the code
22:12 Using pytm with applications in other languages
25:21 Getting started with the sample model
26:25 Finding the project and community

Simon Bennetts — OWASP ZAP: past, present, and future Apr 13, 2019

Show notes

How do you make a powerful security testing tool approachable to the developers who need it? ZAP project founder Simon Bennetts traces the project from his own experience of a penetration test to a community tool built for learning and automation. Speaking with Robert at CodeMash, he explains the origins of ZAP’s name, the thinking behind its browser-based Heads Up Display, and why usability matters as features multiply. They also discuss ZAP’s API, automated testing, volunteer contributions, and the difficulty of turning a long list of ideas into releases. This conversation captures the project’s direction at the time of recording and gives newcomers a clear picture of how to start using and contributing to ZAP.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Simon Bennetts:
→ Simon Bennetts on LinkedIn
→ ZAP

Mentioned in this episode:
→ ZAP Heads Up Display
→ ZAP API documentation
→ ZAP source code

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 ZAP’s past, present, and future with Simon Bennetts
01:51 A developer’s security wake-up call
04:24 How the ZAP project began
07:41 The story behind the name ZAP
09:44 Bringing security tools into the browser with the HUD
14:38 Browser support and the HUD’s implementation
15:32 How to contribute to ZAP
17:20 Too many ideas and too few contributors
17:56 Integrating OWASP guidance and explaining coverage
19:31 Automating testing through the ZAP API
21:47 Downloads and Docker adoption
23:00 Planning releases with a volunteer team
24:24 Where to find ZAP

Bill Sempf — Growing AppSec People and KidzMash Apr 07, 2019

Show notes

The shortage of AppSec practitioners will not disappear just by posting more job openings. Bill Sempf joins Robert at CodeMash to discuss finding developers with curiosity and drive, then helping them grow into application security roles. He shares lessons from cultivating people inside several organizations and explains how capture-the-flag exercises can reveal an appetite for security problem solving. The conversation expands to KidzMash, where children explore technology through hands-on activities, and to the growing place of security at developer conferences. Bill also points aspiring practitioners toward OWASP meetings and projects as ways to learn with others. The common thread is practical exposure: give people a place to experiment, connect with a community, and discover what they want to pursue.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Bill Sempf:
→ Bill Sempf on LinkedIn

Mentioned in this episode:
→ KidzMash and the CodeMash experience
→ CodeMash
→ OWASP Security Shepherd

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Growing AppSec people with Bill Sempf
01:30 Meeting at CodeMash
02:29 Finding security talent among developers
05:33 Recognizing curiosity and drive
08:28 Capture the flag as a learning tool
09:20 Teaching children with Security Shepherd
10:40 How KidzMash began
11:57 Hands-on STEM activities for hundreds of children
12:46 Growing security at a developer conference
15:16 Helping developers find a starting point
17:17 Mentoring and connecting people to OWASP

Georgia Weidman — Mobile, IoT, and Pen Testing Mar 30, 2019

Show notes

A secure mobile application can still sit on a compromised device or depend on an insecure cloud service. Penetration tester and author Georgia Weidman joins Robert at CodeMash to explain why enterprise mobile and IoT security requires a wider view. She describes phishing through mobile channels, a QR-code demonstration that delivered a modified restaurant app, and the infrastructure behind connected devices. Georgia also discusses testing the protections vendors promise, learning the fundamentals through her book Penetration Testing, and the business lessons that came with becoming an entrepreneur. Her path from mathematics to security provides the backdrop for a practical conversation about examining the whole environment and understanding what an attacker can actually reach, rather than stopping at an individual app.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Georgia Weidman:
→ Georgia Weidman on LinkedIn

Mentioned in this episode:
→ Penetration Testing: A Hands-On Introduction to Hacking
→ CodeMash

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Mobile and IoT security with Georgia Weidman
02:09 From mathematics to security
03:33 The competition that sparked an interest in hacking
05:28 Mobile and IoT in the enterprise
06:37 Why mobile phishing matters
07:45 A QR code and a modified restaurant app
08:43 Looking beyond the app to the whole device
10:10 Testing mobile security products and controls
11:39 Learning with Penetration Testing
13:43 Building a company and understanding business risk
17:04 Conferences and international readers

Conclusion: Season 4 Finale Feb 24, 2019

Show notes

What stood out across a season spanning DevOps, pipelines, community, chaos engineering, dependency risk, and IoT? Chris and Robert revisit memorable explanations from Season 4 and let each guest define a core idea in their own words. Julien Vehent connects application security to DevOps, Matt Tesauro describes the OWASP AppSec Pipeline project, Jessica Robinson and Vandana Verma introduce Women in AppSec, Aaron Rinehart explains chaos engineering, Erlend Oftedal presents retire.js, Björn Kimminich explains Juice Shop, Travis McPeak defines SecOps, and Aaron Guzman discusses the OWASP IoT Top 10. The episode serves as a compact season index, with clip-level chapters that make it easy to return to the full conversations behind each concept.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Chris Romeo and Robert Hurlbut:
→ Chris Romeo on LinkedIn
→ Robert Hurlbut on LinkedIn

Mentioned in this episode:
→ Securing DevOps (Julien Vehent)
→ OWASP AppSec Pipeline Project
→ principlesofchaos.org
→ Chaos Monkey
→ retire.js
→ OWASP Juice Shop
→ OWASP IoT Top 10
→ OWASP Women in AppSec (WIA)
→ retire.js

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Julien Vehent on AppSec and DevOps
02:59 Matt Tesauro on the AppSec Pipeline project
04:33 Jessica Robinson and Vandana Verma on Women in AppSec
05:31 Aaron Rinehart on chaos engineering
08:33 Erlend Oftedal on retire.js
11:01 Björn Kimminich on OWASP Juice Shop
12:44 Travis McPeak on SecOps
14:57 Aaron Guzman on the OWASP IoT Top 10
17:42 Closing Season 4

Geoff Hill -- Rapid Threat Model Prototyping Process Feb 01, 2019

Show notes

What happens when a threat model takes days to produce but the development team has already moved on? Geoff Hill describes the scaling problems that led him to Rapid Threat Model Prototyping, an approach that starts with the team’s existing design instead of a separate diagram built for security. He explains its just-in-time philosophy, how to rank components by criticality, and how simple rules reveal likely access-control and STRIDE issues. Chris challenges the approach with questions about inconsistent diagrams, trust boundaries, and developer judgment. They also explore automation using diagram metadata and threat libraries. The result is a detailed look at making threat modeling fast enough to support a real design conversation while retaining the context needed to identify meaningful risks.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Geoff Hill:
→ Geoff Hill on LinkedIn
→ Rapid Threat Model Prototyping slides

Mentioned in this episode:
→ Rapid Threat Model Prototyping documentation
→ Microsoft Security Development Lifecycle
→ MITRE CAPEC

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Rapid threat model prototyping with Geoff Hill
05:06 The scaling problem behind the approach
08:45 STRIDE, DREAD, and traditional diagrams
11:19 When threat modeling falls behind the sprint
15:15 The just-in-time, 80/20 philosophy
16:54 Using the team’s existing design
19:03 Handling inconsistent and incomplete diagrams
22:50 Prioritizing access control and system boundaries
26:17 Ranking components by criticality
29:28 Rules for authorization and privilege boundaries
33:10 Using the developers’ knowledge of the system
35:17 Spoofing and trust-zone rules
37:20 Tampering and repudiation
39:53 Information disclosure and denial of service
41:26 Automating analysis from diagram metadata
42:46 Adding a library of threats
44:44 Where to learn more

Bill Wilder -- Running Azure Securely Jan 25, 2019

Show notes

Moving an application to Azure changes which security controls you operate yourself and which ones the platform can provide. Azure specialist Bill Wilder walks Chris through a practical set of cloud risks, from exposed management ports and missing patches to weak credentials, open database endpoints, and leaked secrets. They examine network protections, serverless and container responsibilities, testing integrations, multifactor authentication, and Azure Key Vault. Bill also explains how managed identities can reduce the need to pass credentials into applications and how Azure’s security monitoring brings configuration and threat signals together. This archive conversation uses the Azure product names and capabilities of its time, while highlighting the enduring questions developers should ask about defaults, shared responsibility, secret handling, and visibility.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Bill Wilder:
→ Bill Wilder on LinkedIn

Mentioned in this episode:
→ Azure Key Vault
→ Azure Kubernetes Service
→ Azure Functions
→ Microsoft Defender for Cloud (formerly Azure Security Center)
→ Azure Friday

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Running Azure securely with Bill Wilder
08:18 Protecting exposed RDP and SSH endpoints
11:05 Host firewalls, gateways, and defense in depth
14:11 Patching responsibilities and serverless
16:48 Containers, AKS, and trusted images
18:35 Web application protection and testing
20:02 Connecting security tools to Azure DevOps
23:45 Weak credentials and multifactor authentication
26:09 Restricting access to SQL endpoints
28:24 Protecting secrets with Azure Key Vault
30:03 Hardware security modules and private keys
34:44 Reducing credentials with managed identities
35:41 Security monitoring and logging
40:40 Resources for learning more about Azure

Our TOPPODCAST Picks

Follow Us

Stay Connected

The Application Security Podcast

Related Podcasts

Links

Stay Connected