The Application Security Podcast

Latest Episodes:

Matt Konda -- OWASP Glue Jan 18, 2019

Show notes

Developers need useful findings in their workflow, not another collection of security tools to operate by hand. Matt Konda explains how OWASP Glue grew from that problem: run multiple tools, normalize their output, and make the results usable in a build or development process. He shares his path from software development into AppSec, the thinking behind Jemurai, and why OWASP’s community appealed to him. The technical discussion compares Glue with Gauntlt and DefectDojo, examines integrations and extensibility, and considers how open-source projects can work together. Matt closes with a straightforward way for an individual developer to try Glue. Throughout, the focus is on connecting security work to engineering habits and making automation produce information people can act on.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Matt Konda:
→ Matt Konda on LinkedIn
→ OWASP Glue source code

Mentioned in this episode:
→ Gauntlt
→ OWASP DefectDojo
→ Brakeman
→ ZAP

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Connecting security tools with Matt Konda
01:09 From software development into security
04:34 Bridging the gap with development teams
08:55 The story behind Jemurai
10:34 Tools, processes, and useful security signals
13:33 Finding a community in OWASP
17:08 Why OWASP Glue was created
19:52 Comparing Glue with Gauntlt and adding tools
26:01 How Glue relates to DefectDojo
29:48 Improving commercial tool integrations
31:59 The easiest way to start using Glue
34:47 Final thoughts

Josh Grossman, Avi Douglen, and Ofer Maor -- AppSec in Israel and Three Talks to watch from AppSec USA Jan 11, 2019

Show notes

What can the wider AppSec community learn from Israel’s unusually dense security ecosystem? Josh Grossman, Avi Douglen, and Ofer Maor join Chris at AppSec USA to discuss how military experience, universities, startups, and a thriving OWASP chapter feed the local community. Each guest also introduces a conference talk with a practical lesson: getting better value from penetration tests, connecting threat modeling to business priorities, and automating security work alongside development. The conversation examines black-box testing, tester skill, clearer reporting, and feedback into engineering backlogs. Along the way, the guests explain how community events grow through consistent participation and shared ownership. It is both a snapshot of AppSec in Israel and a guide to three talks worth revisiting.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Josh Grossman, Avi Douglen, and Ofer Maor:
→ Josh Grossman on LinkedIn
→ Avi Douglen on LinkedIn
→ Ofer Maor on X

Mentioned in this episode:
→ OWASP Israel
→ OWASP Global AppSec conferences
→ Maker’s Schedule, Manager’s Schedule

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 AppSec in Israel and three conference talks
02:31 How security experience shapes AppSec work
04:20 Avi Douglen’s security origin story
07:16 Israel’s security ecosystem
08:52 Growing the OWASP Israel community
11:04 Universities and the security talent pipeline
14:00 Community lessons after the break
16:18 Getting value from penetration testing
19:07 Black-box testing and development teams
23:01 Value-driven threat modeling
25:23 Automating application security work
27:26 Feeding security results into the backlog
29:05 Talks and final recommendations

Daniel Miessler -- OWASP IoT Top 10 Jan 01, 2019

Show notes

An IoT product’s attack surface extends well beyond the device in the box. Daniel Miessler explains that broader view while walking Chris and Robert through the 2018 OWASP IoT Top 10. Before reviewing the risks, he describes the project’s audience, how the team gathered and evaluated data, and the challenge of balancing recurring failures with emerging concerns. The list covers passwords, exposed services, ecosystem interfaces, updates, components, privacy, data protection, device management, defaults, and physical hardening. Real testing examples show how a secure-looking connection can hide other unprotected paths or services. Daniel closes with guidance for developers who want to understand their product’s full ecosystem and use the list as a starting point for better security decisions.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Daniel Miessler:
→ Daniel Miessler
→ OWASP Internet of Things project

Mentioned in this episode:
→ OWASP Application Security Verification Standard
→ OWASP Proactive Controls
→ National Vulnerability Database
→ Cloud Security Alliance

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 The 2018 IoT Top 10 with Daniel Miessler
01:27 Daniel’s security origin story
04:25 Why the IoT Top 10 exists
07:30 Manufacturers, developers, and other audiences
11:56 Gathering data and deciding the rankings
19:27 Historical findings and emerging risks
22:39 Passwords and insecure network services
24:23 Insecure ecosystem interfaces
26:13 Lack of secure update mechanisms
28:31 Insecure or outdated components
30:41 Privacy and unexpected connections
33:05 Data protection at rest and in transit
35:29 Device management and insecure defaults
37:45 Physical hardening
40:18 Takeaways for developers

Travis McPeak -- SecOps Makes Developers Lives Easier Dec 17, 2018

Show notes

What if a security team measured success partly by making developers’ work easier? Travis McPeak explains that approach to SecOps through concrete examples from Netflix’s cloud environment. RepoKid removes unused AWS permissions, Lemur simplifies certificate provisioning, and Security Monkey provides visibility into assets and configuration changes. Chris asks how those capabilities fit with the secure development lifecycle, incident response, and traditional application testing. Travis describes finding repetitive work or problems that cannot scale manually, then deciding whether to use an existing solution or build automation. They also discuss learning paths, books, and OWASP involvement. The conversation makes the operational side of security tangible: give teams dependable controls and useful context while reducing the everyday friction of doing the right thing.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Travis McPeak:
→ Travis McPeak on LinkedIn

Mentioned in this episode:
→ RepoKid
→ Lemur
→ Security Monkey (archived project)
→ Bandit
→ The Tangled Web

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 SecOps that helps developers with Travis McPeak
01:17 Travis’s security origin story
03:25 A security book worth sharing
04:05 Defining SecOps and introducing RepoKid
05:16 Removing permissions and managing exceptions
06:20 Security signals and incident response
08:20 Making certificate provisioning easier with Lemur
10:29 Language-specific tools and broader controls
11:52 Asset visibility with Security Monkey
13:02 Automatically correcting cloud permissions
14:32 How an operational problem becomes a tool
15:51 Where application security testing fits
17:22 Learning SecOps through community and practice

Chris Romeo -- Security Culture Hacking: Disrupting the Security Status Quo Dec 10, 2018

Show notes

Changing security culture requires more than distributing policies or buying another training platform. In this recorded AppSec USA presentation, Chris Romeo shares practical ways to influence how an organization thinks and acts about software security. He explains why every organization already has a security culture, how to assess it, and why the assessment must lead to action. The talk explores speaking the language of developers and executives, sharing information openly, building a champions community, and recognizing useful behavior. Chris also describes learning experiences that fit developers’ work and demonstrations that make application risk concrete for leaders. He closes by connecting culture change to observable outcomes, including whether teams resolve security problems more quickly over time.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Chris Romeo:
→ Chris Romeo on LinkedIn

Mentioned in this episode:
→ OWASP SAMM
→ OWASP Juice Shop
→ WebGoat
→ DevSlop

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Security culture hacking at AppSec USA
08:05 Every organization already has a security culture
09:53 Transparency and sharing security knowledge
10:07 Assessing and measuring the starting point
11:39 Turning assessment into an action strategy
12:34 Learning developers’ language and methods
13:49 Speaking to executives about risk and value
14:24 Communication and security’s own assumptions
17:37 Building a deliberate security community
18:06 Champions programs and learning sessions
19:57 Recognition and incentives for useful behavior
22:45 Developer-friendly learning and hands-on practice
27:43 Educating executives about application security
29:04 Demonstrating risk and measuring improvement

Jim Manico -- The Extremely Unabridged History of SQLi and XSS Dec 03, 2018

Show notes

Why are SQL injection and cross-site scripting still with us after years of knowing how to prevent them? Jim Manico joins Chris for an informal journey through the history of both vulnerability classes and the defenses that changed application development. They discuss parameterized database APIs, output encoding, sanitization, framework defaults, and the long life of legacy software. The conversation then turns toward the future: what security libraries and language-specific analysis can do, where commercial testing tools fit, and who has an incentive to invest in stronger platforms. Jim’s recollections and predictions make this an opinionated archive conversation about progress and persistence, with a central challenge for developers and security teams: make protection a normal part of building software.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Jim Manico:
→ Jim Manico on LinkedIn

Mentioned in this episode:
→ DOMPurify
→ OWASP ESAPI
→ Go html/template
→ Brakeman
→ OWASP Top 10

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 The history of SQL injection and XSS with Jim Manico
01:33 How application security has changed
05:06 Parameterized queries and early defenses
07:20 Why injection remains on the Top 10
09:22 Could SQL injection disappear?
10:39 Tracing the history of cross-site scripting
17:21 Carrying secure defaults into new frameworks
19:34 Legacy applications and long software lifespans
20:47 The role of defensive technology
23:13 What happens to the security tool market?
24:52 Why language-specific analysis matters
26:26 Who pays for more secure platforms?

Jeff Williams -- The History of OWASP Nov 27, 2018

Show notes

OWASP became a reference point for software security, but it began with people sharing knowledge and trying to solve problems together. Jeff Williams joins Chris to trace that early history, from their consulting roots to the first Top 10, the Foundation, and the growth of community events. He explains the tradeoffs behind an awareness list, the importance of independence, and why recognition alone does not make software safer. Their conversation also examines open-source project visibility, participation, and the difficulty of turning useful work into something more developers can discover and adopt. Jeff’s firsthand account offers both a history lesson and a challenge to the community: simplify security, communicate the value of its tools, and keep expanding who can contribute.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Jeff Williams:
→ Jeff Williams on LinkedIn
→ Contrast Security

Mentioned in this episode:
→ OWASP Foundation
→ OWASP Top 10
→ OWASP WebGoat
→ OWASP DefectDojo
→ OWASP Dependency-Check

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 OWASP’s history with Jeff Williams
01:39 Shared roots in security consulting
07:47 The early days of OWASP
11:13 Creating the first OWASP Top 10
14:22 Evidence, judgment, and the Top 10
17:48 Independence and outside interests
18:12 The Top 10’s growing influence
20:27 Simplifying the work of fixing vulnerabilities
23:15 Forming the Foundation and early conferences
29:46 Helping people discover OWASP projects
30:33 DefectDojo and communicating project value
33:20 Dependency-Check and broader adoption
35:49 Improving OWASP through participation

Bjorn Kimminich -- The Joy of the Vulnerable Web: JuiceShop Nov 19, 2018

Show notes

Can an intentionally broken online shop help change an organization’s security culture? OWASP Juice Shop creator Björn Kimminich explains how a realistic application full of vulnerabilities gives developers, testers, and managers a shared way to experience security problems. He traces the project’s origins, describes how real incidents become challenges, and discusses the community that keeps adding new ideas. Chris asks about management awareness demonstrations, capture-the-flag events, deployment options, and the range of challenge difficulty. They also explore what was new in Juice Shop 8 and where Björn hoped to take the project next. The conversation shows how hands-on exploration can connect an abstract vulnerability to something people recognize in their own software, without requiring everyone to begin as an expert.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Björn Kimminich:
→ Björn Kimminich on GitHub
→ OWASP Juice Shop

Mentioned in this episode:
→ Juice Shop project website
→ Juice Shop source code
→ Node.js

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Learning security with Björn Kimminich and Juice Shop
01:37 Björn’s path from development into security
03:41 Why Juice Shop was created
04:51 What makes an intentionally broken application
05:41 Turning real vulnerabilities into challenges
07:42 The community behind the project
11:04 Who uses Juice Shop and why
13:08 Security awareness demonstrations for managers
14:56 How managers respond to seeing attacks
17:04 Running Juice Shop for capture-the-flag events
19:31 Deployment options
20:29 Trying the demo instance
23:24 Exploring with browser developer tools
25:17 What was new in Juice Shop 8
27:26 Challenges for different skill levels
29:03 The project’s future direction
33:42 Sharing ideas and getting involved

Swaroop Yermalkar -- iGoat and iOS Mobile Pen Testing Nov 13, 2018

Show notes

Mobile apps can hide credentials, expose powerful backend access, and repeat familiar web security mistakes. OWASP iGoat project leader Swaroop Yermalkar joins Chris to explain how he approaches testing iOS and Swift applications, starting with understanding the business and following the data. They discuss hardcoded cloud keys, inspecting application classes, proxying traffic, and weaknesses in mobile service endpoints. Swaroop then introduces iGoat as a practical learning environment where people can exploit a flaw, understand the remediation, and rebuild the application with a fix. A cloud-storage exercise illustrates how client-side clues lead to a wider exposure. The episode closes with iGoat’s relationship to OWASP’s mobile guidance and why these skills matter across Apple’s expanding device ecosystem.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Swaroop Yermalkar:
→ Swaroop Yermalkar on LinkedIn
→ OWASP iGoat

Mentioned in this episode:
→ iGoat Swift
→ OWASP Mobile Application Security Testing Guide
→ Burp Suite
→ OWASP WebGoat

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 iOS security and iGoat with Swaroop Yermalkar
01:11 From Wi-Fi curiosity to application security
02:42 Mobile applications in bug bounty programs
03:44 Testing Swift applications
05:01 Hardcoded keys and excessive permissions
07:45 Understanding the business before testing
10:51 Inspecting and decrypting an iOS application
12:24 Static analysis and proxying mobile traffic
13:58 Why mobile backends deserve attention
15:53 What the iGoat learning environment contains
17:57 Fixing the vulnerability after exploiting it
19:13 A cloud-storage misconfiguration exercise
23:18 Future directions and new challenges
24:49 Connecting iGoat with OWASP mobile standards
26:24 Applying the skills across devices

Adam Bacchus and Jon Bottarini -- Two Sides to a Bug Bounty: The Researcher and The Program Nov 05, 2018

Show notes

What does a bug bounty look like from both sides of the relationship? Adam Bacchus and Jon Bottarini of HackerOne compare the responsibilities of the program operator with the experience of the security researcher. They discuss safe-harbor language, where bounty programs fit alongside scanners and penetration tests, and why business-logic flaws still depend on human creativity. Adam explains response metrics, payout structures, public and private programs, and the maturity an organization needs before inviting researchers. Jon describes researcher profiles, reputation, learning paths, and the realities of earning money through vulnerability discovery. The conversation gives organizations a clearer picture of the operational commitment behind a bounty and gives aspiring researchers practical ways to begin building skill and credibility.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Adam Bacchus and Jon Bottarini:
→ Adam Bacchus on LinkedIn
→ Jon Bottarini on LinkedIn
→ HackerOne

Mentioned in this episode:
→ HackerOne
→ Hacker101
→ HackerOne Hacker Report

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Two sides of a bug bounty
02:33 A researcher’s security origin story
06:34 The size and scope of bounty programs
08:00 Safe harbor for security researchers
09:17 Where bug bounties fit in AppSec
11:09 A business-logic vulnerability example
12:57 Root causes and program improvement
14:43 Metrics for running a bounty
19:08 Response-time expectations
20:02 Payouts and program maturity
21:34 Who becomes a bug bounty researcher
23:10 How a new researcher can start
26:14 Reputation and private programs
26:54 The largest bounty payouts
27:54 Life as a security researcher
31:07 Full-time and part-time participation
34:47 Learning resources and final advice

Our TOPPODCAST Picks

Follow Us

Stay Connected

The Application Security Podcast

Related Podcasts

Links

Stay Connected