The Application Security Podcast

Latest Episodes:

Erlend Oftedal -- What You Require, You Must Also Retire Oct 29, 2018

Show notes

A JavaScript library can keep working long after its security problems become public. Retire.js project leader Erlend Oftedal explains how developers can discover vulnerable dependencies and make that information part of everyday development. He describes the project’s origins, command line scanning, browser-based detection, and options for integrating checks into a build pipeline. Chris probes what happens after a finding, how exceptions can undermine the process, and how externally loaded libraries fit into the picture. They also discuss Retire.js alongside npm auditing, OWASP Dependency-Check, and Dependency-Track. Erlend’s experience leading an OWASP chapter adds a community perspective to the technical discussion. The practical message is to know which libraries you ship and make upgrading them a continuing engineering responsibility.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Erlend Oftedal:
→ Erlend Oftedal on LinkedIn
→ Retire.js

Mentioned in this episode:
→ Retire.js source code
→ OWASP Dependency-Check
→ OWASP Dependency-Track
→ OWASP Proactive Controls

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Finding vulnerable JavaScript with Erlend Oftedal
01:54 A developer’s path into security
07:07 Running an OWASP chapter
10:27 Why Retire.js was created
12:34 Scanning locally and in a pipeline
14:16 The danger of ignoring every finding
15:29 Reading scan results and the role of npm audit
17:45 Upgrading vulnerable libraries
19:05 Detecting libraries loaded from other sites
20:32 Passive discovery in the browser
22:05 Working with Dependency-Check and Dependency-Track
24:27 Open-source and commercial dependency tools
28:21 The limits of automated coverage

Abhay Bhargav -- Threat Modeling as Code Oct 23, 2018

Show notes

A threat model that lives in an old document rarely keeps pace with the code it describes. Abhay Bhargav explains how threat modeling as code can connect user stories, abuse cases, threat scenarios, and specific controls inside an evolving development process. He describes choosing YAML as a familiar format, compares that approach with behavior-driven specifications, and shows how the result can help both engineering teams and security testers. The conversation introduces Threat Playbook and explores turning concrete mitigations into an attack model and useful testing direction. Abhay also discusses the challenge of automating tools with different interfaces, including ZAP and nodejsscan. The episode makes the case for keeping threat information actionable, versionable, and close to the people building the application.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Abhay Bhargav:
→ Abhay Bhargav on LinkedIn
→ we45

Mentioned in this episode:
→ Threat Playbook
→ ZAP
→ nodejsscan

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Threat modeling as code with Abhay Bhargav
01:51 Early work in PCI and security
03:37 Why traditional threat models become stale
06:48 From user stories to abuse cases and threats
08:32 Integrating the model into development
09:16 YAML specifications and alternative approaches
11:23 Benefits for DevOps and security teams
14:13 Attack models and specific mitigations
17:26 Introducing Threat Playbook
20:40 The challenge of automated security pipelines
22:54 Python and tool choices
23:26 ZAP, nodejsscan, and npm audit
26:37 Sharing the workshop materials

Tony UV -- Threat Libraries in the Cloud Oct 16, 2018

Show notes

A list of weaknesses is not the same thing as an understanding of the threats facing a business. Tony UV returns to explain how a threat library can connect industry intelligence with evidence from an organization’s own systems. He distinguishes threats, attacks, and vulnerabilities, then describes how cloud logs and configuration signals can add context to a threat model. The conversation examines the feedback loop between modeling, detection, and real incidents, with examples involving sabotage, data loss, and extortion. Tony recommends starting with a manageable set of business concerns, substantiating them with evidence, and mapping the relevant attack paths and technologies. His approach gives teams a way to make threat modeling reflect what could actually harm the operation they support.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Tony UcedaVelez:
→ Tony UV on LinkedIn
→ VerSprite

Mentioned in this episode:
→ MITRE CAPEC
→ MITRE ATT&CK
→ AWS CloudTrail
→ FS-ISAC

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Threat libraries in the cloud with Tony UV
01:16 Continuing the threat modeling conversation
02:30 External intelligence and internal evidence
05:25 Validating threats in business context
08:12 How the library supports a threat model
12:09 Cloud platforms as sources of threat context
18:13 The feedback loop between models and incidents
18:55 Connecting business threats to attack patterns
22:23 Starting with a manageable threat library
23:14 Beyond STRIDE: evidence, extortion, and business impact

Aaron Rinehart -- Chaos Engineering and #AppSec Oct 08, 2018

Show notes

How do you know a security control will work when the system around it fails? Aaron Rinehart introduces chaos engineering as a way to test assumptions about complex systems before an unexpected incident exposes them. He explains its relationship to good engineering, Netflix’s Chaos Monkey, and site reliability engineering, then brings the discussion into application security. Chris and Robert explore ChaoSlingr, the difference between testing a failure condition and introducing a vulnerability, and how experiments can reveal gaps in detection or response. Aaron also discusses a SOC-less model that connects security signals with the people best placed to act. Books and foundational resources round out an introduction to learning from controlled experiments and building confidence in how systems actually behave.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Aaron Rinehart:
→ Aaron Rinehart on LinkedIn

Mentioned in this episode:
→ Principles of Chaos Engineering
→ Chaos Monkey
→ ChaoSlingr
→ Release It! Second Edition
→ Google SRE books

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Chaos engineering and AppSec with Aaron Rinehart
03:31 Security as a reflection of good engineering
06:52 What chaos engineering means
09:57 How Chaos Monkey works
12:30 Principles and the wider movement
14:13 The relationship with site reliability engineering
15:56 Examples of complex-system failures
20:28 Applying chaos engineering to security
21:13 Introducing ChaoSlingr
24:50 Testing failure conditions rather than adding flaws
25:58 Resources for learning more
29:17 Release It and resilience lessons
31:33 The SOC-less model at Netflix
35:04 Aaron’s writing and further reading

Jessica Robinson and Vandana Verma-- WIA: Women in #AppSec Oct 01, 2018

Show notes

How can application security become a field where more women enter, contribute, and advance? Jessica Robinson and Vandana Verma discuss OWASP Women in AppSec, its local committees, mentoring, training, and conference activities. They explain how chapters can create opportunities without isolating the initiative from the broader community, and why visible leaders and practical support matter. The conversation includes lessons from OWASP Bangalore, Nullcon, networking events, and the challenge of sustaining volunteer programs across geographies. Jessica and Vandana also offer concrete guidance to chapter leaders and allies who want to help: make an explicit commitment, create space for participation, and support people as they build expertise and confidence. The episode frames inclusion as community work that requires repeated action.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Jessica Robinson and Vandana Verma:
→ OWASP Women in AppSec
→ Vandana Verma

Mentioned in this episode:
→ OWASP Women in AppSec
→ OWASP Bangalore
→ Nullcon

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Women in application security
03:07 Vandana Verma’s path into security
05:19 The purpose of Women in AppSec
07:46 Local committees and chapter activities
12:48 Training events and Nullcon
16:13 Mentoring and community support
21:10 Building welcoming professional networks
25:47 Growing leaders across geographies
30:31 What chapter leaders and allies can do
32:49 Final recommendations

Karen Staley -- A Conversation with Karen Sep 25, 2018

Show notes

What should OWASP members expect from the foundation’s executive leadership, and how can a global nonprofit remain connected to its volunteer community? Karen Staley joins Chris and Robert during AppSec Europe to discuss her early experience as OWASP’s executive director. She explains how her nonprofit background prepared her for a passionate technical community, how members and chapter leaders interact with the foundation, and why conferences, membership, and diverse participation matter to OWASP’s future. The conversation also explores fundraising, strategic priorities, and the challenge of supporting local chapters while preserving an open organization. Karen closes with a call for greater community engagement and partnership.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Karen Staley and OWASP:
→ OWASP Foundation

Mentioned in this episode:
→ OWASP Foundation
→ OWASP Chapters

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 A conversation with OWASP leadership
01:08 Karen Staley’s nonprofit background
02:16 Joining OWASP as executive director
05:26 How members connect with the foundation
08:52 Conferences, developers, and broader participation
10:26 Membership and supporting local chapters
12:23 Strategic priorities for OWASP
15:27 Building stronger community engagement
16:20 Closing thoughts

Mohammed Imran -- Back to the Lab Again with a DevOps Sep 18, 2018

Show notes

Learning DevSecOps is hard when setting up the lab becomes a project of its own. Mohammed Imran introduces DevSecOps Studio, an environment designed to help people practice an automated delivery workflow and add security to it. He shares his transition from offensive security toward building defenses, explains why security practitioners need to understand developers’ tools, and describes the roles of Git, GitLab, containers, and automation. Chris asks how static and dynamic testing fit into the pipeline and how the lab connects with DevSlop. Their discussion keeps returning to hands-on experience: give learners working pieces they can inspect, change, and reconnect. The episode offers a route from knowing security concepts to understanding how those concepts operate inside a real development process.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Mohammed Imran:
→ Mohammed Imran on LinkedIn
→ DevSecOps Studio

Mentioned in this episode:
→ OWASP DevSlop
→ GitLab
→ Docker
→ Bandit

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Learning DevSecOps with Mohammed Imran
01:23 An offensive-security origin story
03:07 Moving from breaking systems to defending them
04:50 What a DevSecOps course needs to teach
06:30 Learning from established DevOps practices
10:15 Dynamic testing and vulnerability scanning
12:07 Bridging operations, coding, and security skills
14:40 Learning Git and CI/CD fundamentals
14:58 Why GitLab is a useful starting point
19:02 What the DevSecOps Studio lab provides
20:20 Teaching with a working environment
23:12 Cloud reference architectures and DevSlop
24:41 How to get started and find the documentation

Niels Tanis -- A Slice of the Razor with ASP.Net Core Sep 11, 2018

Show notes

Framework defaults can prevent common vulnerabilities, but developers still need to understand when their code bypasses those protections. Niels Tanis joins the podcast at AppSecEU to unpack ASP.NET Core and Razor Pages from a security perspective. He explains the framework’s structure, dependency and package concerns, and the protections around request forgery and output encoding. The conversation explores why rendering raw HTML deserves scrutiny, how validation and model state work, and how overposting can expose fields that never appear in the interface. Niels also discusses tooling and ways to begin learning the platform. This archive episode gives .NET developers a practical way to reason about what the framework does for them and which responsibilities remain in their application code.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Niels Tanis:
→ Niels Tanis on LinkedIn

Mentioned in this episode:
→ ASP.NET Core Razor Pages documentation
→ ASP.NET Core documentation
→ NuGet
→ Scott Hanselman on overposting and mass assignment

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 ASP.NET Core and Razor security with Niels Tanis
01:25 Niels’s security origin story
03:44 The security implications of a changing .NET platform
05:57 Understanding ASP.NET Core and MVC
07:54 Framework and dependency challenges
12:41 Razor Pages and security defaults
14:16 Baseline protections and output encoding
16:16 Why raw HTML deserves extra review
17:26 Explicitly overriding secure defaults
19:52 Security tooling through NuGet
20:24 Input validation and model state
21:55 Overposting and mass assignment
26:23 Where new .NET developers can learn more

Ofer Maor -- A Pen Testers Transition to #AppSec: #VoteForOfer Sep 04, 2018

Show notes

Finding vulnerabilities is only part of improving software security; the harder work is changing how people build and operate applications. Ofer Maor shares his transition from penetration testing into application security and the lessons he learned through security startups. He and Chris discuss culture, genuine risk management, and the industry’s attraction to offensive work. They explore delivering findings inside developers’ tools, the limits of dumping issues into a backlog, and the roles of interactive testing and runtime protection. Ofer explains how compensating controls can buy time without replacing the need to fix code. The episode closes with his OWASP involvement and board candidacy at the time of recording, connecting technical progress with the community needed to support it.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Ofer Maor:
→ Ofer Maor on LinkedIn

Mentioned in this episode:
→ OWASP Israel community
→ OWASP Top 10

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 From penetration testing to AppSec with Ofer Maor
01:08 Ofer’s security origin story
03:04 Why secure development is hard
03:46 Culture and risk management
06:30 Balancing offensive and defensive work
07:37 Persistent vulnerabilities and framework defenses
11:52 Making security actionable for developers
14:11 Delivering findings in the IDE
14:36 Why thousands of backlog tickets do not help
18:54 IAST, RASP, and the risk of overreliance
21:44 Using runtime protection while fixing the code
22:18 OWASP involvement and the historical board campaign
23:19 OWASP Israel and growing new leaders

Matt Tesauro -- #AppSec Pipeline as Toolbox Aug 28, 2018

Show notes

How can a small AppSec team make sense of thousands of applications and a growing pile of security work? Matt Tesauro explains the AppSec Pipeline project as a toolbox for organizing and automating the work, rather than a single prescribed product. He describes the pressure that led him and Aaron Weaver to map intake, triage, testing, and delivery, then connect tools around those stages. The conversation examines DefectDojo’s role in tracking findings and effort, baseline testing across applications, and the value of reusable containers. Matt also explains how teams can adapt the pieces to their own development practices and where to begin. The result is a practical view of automation that supports decisions about both technical risk and limited team capacity.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Matt Tesauro:
→ Matt Tesauro on LinkedIn
→ OWASP AppSec Pipeline project

Mentioned in this episode:
→ OWASP DefectDojo
→ OWASP Dependency-Check
→ ZAP
→ Bandit

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 The AppSec Pipeline toolbox with Matt Tesauro
00:59 Matt’s security origin story
02:34 Discovering the OWASP community
04:31 Why the AppSec Pipeline project began
05:58 Scaling a small security team with automation
07:11 Tools that fit into the pipeline
08:59 Tracking work and resource tradeoffs
10:31 DefectDojo’s place in the process
12:18 Baseline testing across an application portfolio
14:14 A toolbox teams can adapt
15:30 Getting started: intake, triage, testing, and delivery
18:43 OWASP and sharing practical experience

Our TOPPODCAST Picks

Follow Us

Stay Connected

The Application Security Podcast

Related Podcasts

Links

Stay Connected