The Application Security Podcast

Latest Episodes:

John Melton -- #OWASP AppSensor Apr 20, 2018

Show notes

Your application knows when a user does something that should be impossible, but does that knowledge help stop an attack? John Melton explains OWASP AppSensor, a project that combines guidance with an implementation for detecting and responding to suspicious behavior inside applications. Using examples such as access to another customer’s bank account and unexpected jumps through a workflow, he shows how business context can reveal attacks that generic defenses miss. John describes detection points, event thresholds, response options, and integrations that connect applications to an AppSensor server. He also distinguishes the approach from conventional runtime protection tools and explains why threat modeling helps teams choose meaningful events. His practical starting point is a small proof of concept, built on centralized logging and tuned with real observations.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with John Melton:
→ John Melton on GitHub
→ AppSensor source code

Mentioned in this episode:
→ OWASP AppSensor
→ Spring Security
→ ModSecurity

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Building self-defending applications with AppSensor
04:40 What AppSensor is
07:03 Bank-account access as a detection example
09:13 Turning suspicious events into attack signals
11:07 Choosing a response to detected attacks
12:13 Server architecture and integration options
15:35 Supporting applications beyond Java
18:05 How AppSensor differs from RASP
22:03 Rules and event thresholds
24:01 Using threat modeling to choose detection points
25:49 Combining conditions with Boolean rules
26:43 Getting started with a small proof of concept

David Habusha -- Third Party Software is not a Cathedral, It’s a Bazaar Apr 13, 2018

Show notes

An application can inherit serious vulnerabilities from code its developers never wrote. David Habusha, then a product leader at WhiteSource, explains the problem behind the 2017 OWASP Top 10 category on components with known vulnerabilities. He brings a product-management perspective to the discussion, connecting dependency choices to business outcomes and the realities of modern development. Chris and Robert ask why static and dynamic testing may miss this problem, what software composition analysis actually identifies, and how accurate component matching can be. The conversation uses Apache Struts and the Equifax breach to examine inventory, notification, and remediation. David closes by describing open source as a bazaar rather than a cathedral, where continuous awareness and maintenance matter more than expecting any component to remain permanently safe.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with David Habusha:
→ David Habusha on LinkedIn

Mentioned in this episode:
→ OWASP Top 10 2017 — Vulnerable Components
→ WhiteSource — now Mend.io
→ Apache Struts vulnerability CVE-2017-5638

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Understanding vulnerable third-party components
01:30 David’s security background
04:09 A product manager’s perspective on AppSec
08:48 What components with known vulnerabilities means
12:28 How much software comes from dependencies?
14:54 The consequences of vulnerable components
18:14 Why SAST and DAST are not enough
20:35 What software composition analysis does
24:02 Accuracy and component identification
27:29 What the Equifax breach teaches about SCA
32:58 Why dependency security is continuous work

Steve Springett -- Dependency Check and Dependency Track Apr 12, 2018

Show notes

Finding a vulnerable library in one build is only the beginning: how do you find every affected application across an organization? Steve Springett explains how OWASP Dependency-Check and Dependency-Track complement each other in a software composition analysis program. He starts with the ingredients of modern applications, then distinguishes build-time analysis from maintaining a portfolio-wide inventory that can respond to newly disclosed vulnerabilities. The conversation covers language support, dependency updates, vulnerability data quality, and the differences between open-source and commercial tools. Steve offers practical guidance for integrating checks into build pipelines, triaging findings with developers, and making security part of engineering culture. He also looks beyond reactive vulnerability chasing toward software that is easier to maintain and update throughout its life.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Steve Springett:
→ Steve Springett on GitHub

Mentioned in this episode:
→ OWASP Dependency-Check
→ OWASP Dependency-Track
→ National Vulnerability Database
→ SPDX

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Dependency-Check and Dependency-Track with Steve Springett
04:29 Understanding software composition analysis
05:56 Why dependency visibility matters
08:31 Equifax and the challenge of upgrading components
11:58 The origins of Dependency-Check
15:32 Language support and build analysis
16:50 Why Dependency-Track was created
18:40 Tracking vulnerabilities across a portfolio
23:06 How the two projects work together
26:48 Open-source and commercial SCA tools
28:50 Vulnerability data quality and noise
33:08 Starting with build integration
36:01 Helping developers triage findings
38:12 Overcoming adoption objections
41:44 The future of dependency security
45:03 Toward continuously updated software

Steven Wierckx -- The #OWASP Threat Modeling Project Apr 06, 2018

Show notes

Can a threat modeling community bring different methods together without forcing everyone into the same process? Steven Wierckx explains the goals of the OWASP Threat Modeling Project and the work that grew out of the security summit. He describes a vendor-neutral, methodology-neutral collection of knowledge organized around four questions: what are we building, what can go wrong, what will we do about it, and did we do enough? Chris and Robert explore how examples, reference models, and open discussion could help practitioners compare approaches and adapt them to agile development. Steven also explains the relationship between documentation and tools such as Threat Dragon. The episode closes with how working sessions and community contributions can turn shared experience into practical resources.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Steven Wierckx:
→ Steven Wierckx on LinkedIn

Mentioned in this episode:
→ OWASP Threat Modeling Project
→ OWASP Threat Dragon
→ Open Security Summit 2018 archive

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 The OWASP Threat Modeling Project
01:11 Steven’s security origin story
04:04 How the summit shaped the project
07:42 What methodology-neutral threat modeling means
10:46 The four common threat modeling questions
12:30 Building a community of practitioners
15:34 Example models and the project roadmap
20:05 How documentation and Threat Dragon fit together
24:15 Planning the Open Security Summit
27:48 Turning working sessions into published resources
30:28 How to participate in threat modeling

Jim Manico -- The #OWASP Cheat Sheet Project Apr 05, 2018

Show notes

Developers need concrete security answers, but finding trustworthy guidance can take longer than writing the code. Jim Manico explains how the OWASP Cheat Sheet Series turns specialist knowledge into focused, practical references. He describes the project’s origins, the contributors who keep it useful, and how topics move from an idea to reviewed guidance. The conversation explores how developers can navigate subjects such as authentication, access control, and cross-site scripting, and how the cheat sheets complement the OWASP Proactive Controls. Jim also discusses maintenance, drafts, and the challenge of keeping recommendations accurate as technology changes. Alongside a look at his other OWASP work, he invites listeners to review, improve, or finish a resource rather than wait for somebody else to do it.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Jim Manico:
→ Jim Manico — Manicode Security

Mentioned in this episode:
→ OWASP Cheat Sheet Series
→ OWASP Proactive Controls
→ OWASP Java Encoder

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Practical security guidance with Jim Manico
01:54 Jim’s work across OWASP projects
07:08 Open-source projects are a team effort
08:18 What the Cheat Sheet Series provides
09:37 How the project started
11:16 Recruiting contributors and choosing topics
13:28 Keeping security recommendations current
15:50 How developers can use the cheat sheets
19:19 Understanding draft and beta guidance
21:43 Finding a useful way to contribute
23:55 The roadmap for new cheat sheets
26:40 A call to help improve OWASP guidance

Neil Smithline -- OWASP Top 10 #10: Logging Mar 23, 2018

Show notes

A log file does little good if nobody can use it to detect or investigate an attack. Neil Smithline, a co-leader of the OWASP Top 10, explains why insufficient logging and monitoring became a new category in the 2017 edition. Chris and Robert explore the connection between application events, operational monitoring, and incident response, including what investigators lose when useful evidence is missing. Neil discusses security checklists, relevant OWASP guidance, and the difficult balance between recording enough context and exposing sensitive information. The conversation also considers automation, runtime instrumentation, and closer cooperation between development and response teams. Its central challenge is moving beyond a compliance checkbox toward logs that are protected, reviewed, and connected to meaningful action when something goes wrong.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Neil Smithline:
→ Neil Smithline on GitHub

Mentioned in this episode:
→ OWASP Top 10 project repository
→ OWASP Logging Cheat Sheet
→ OWASP ASVS
→ OWASP AppSensor

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Logging and monitoring in the OWASP Top 10
01:45 What insufficient logging and monitoring means
04:03 Generating useful events and reviewing them
05:58 Why incident response depends on logs
08:43 Assessing logging with a checklist
11:57 OWASP resources for better logging
12:57 Lessons from real incidents
15:47 Avoiding sensitive information in logs
18:15 Passwords, account identifiers, and data exposure
20:34 What better logging could look like
23:31 Could runtime instrumentation help?
27:14 Connecting developers and incident responders
31:13 Moving beyond compliance-only logging

Jim Routh -- Selling #AppSec Up The Chain Mar 15, 2018

Show notes

What if the strongest argument for funding application security is better software delivery rather than fear of a breach? Jim Routh draws on building five software security programs to explain how he makes the case to executives. He connects security with quality, productivity, and the cost of fixing defects, then distinguishes the language that works with business leaders from the conversations practitioners have about risk. Chris and Robert ask how to put that case into practice, build developer participation, and use security champions to extend a program’s reach. Jim also explores board attention, industry crises, and the choices that determine whether a program scales. The conversation offers a leader’s perspective on earning investment by making secure development part of how the business succeeds.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Jim Routh:
→ Jim Routh on LinkedIn

Mentioned in this episode:
→ BSIMM
→ Meltdown and Spectre

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Making the executive case for AppSec
01:41 Jim’s route into security leadership
03:54 The state of enterprise software security
07:46 Connecting security with quality and productivity
08:27 How Jim wins funding for security programs
16:39 When to talk about risk
21:37 Turning the business case into a program
25:31 Software security and executive attention
29:40 Using industry crises to drive improvement
35:23 Why security champions help programs scale
36:17 The next challenges for software security

Chris and Robert -- #AppSec Recommendations Mar 09, 2018

Show notes

Which books, sites, conferences, and communities are genuinely useful for learning application security? Chris and Robert compare their personal recommendations and explain what each resource offers. Their list moves from foundational software design and architecture books to secure development, threat modeling, web security, DevOps, checklists, blogs, recorded talks, and local conferences. They discuss learning from Irongeek and YouTube, following practitioners such as Troy Hunt, and using gatherings like BSides, SOURCE, and Black Hat to build relationships as well as technical knowledge. The episode is not a ranked shopping list; it is a guide to assembling a balanced learning practice from books, current writing, hands-on material, video, and community participation.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Chris Romeo and Robert Hurlbut:
→ Chris Romeo on LinkedIn
→ Robert Hurlbut on LinkedIn

Mentioned in this episode:
→ Agile Application Security: Enabling Security in a Continuous Delivery Pipeline
→ Iron Geek
→ The DevOps Handbook
→ Threat Modeling: Designing for Security
→ The Tangled Web: A Guide to Securing Modern Web Applications
→ Start with Why: How Great Leaders Inspire Everyone to Take Action
→ Books by Martin Fowler
→ Troy Hunt
→ Have I Been Pwned
→ Google Alerts
→ The Checklist Manifesto: How to Get Things Right
→ BSides
→ Black Hat

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Chris and Robert’s AppSec recommendations
01:25 Building a balanced learning list
02:47 Foundational design and architecture books
04:36 Secure development books
06:03 Core software security
07:35 Irongeek, YouTube, and recorded talks
09:25 Threat modeling books
12:07 Security blogs and current writing
13:58 AppSec conferences
15:19 SOURCE, BSides, and Black Hat
16:44 Why local conferences matter
19:45 Web application security references
21:40 Learning from practitioners
24:49 The Checklist Manifesto
27:01 Community and final recommendations

Magen Wu -- Hustle and Flow: Dealing With Burnout in Security Mar 02, 2018

Show notes

In a profession that rewards constant vigilance, how do you recognize when dedication has become burnout? Magen Wu joins Chris and Robert to discuss chronic stress, workplace expectations, and the pressure security practitioners can put on themselves. Drawing on her personal experience and interest in psychology, she explains why always being available can become a team norm and why taking a real break can feel surprisingly difficult. The conversation explores boundaries around phones and email, sleep, hobbies away from computers, and the importance of recovery after intense work. Magen also describes changes that friends and colleagues might notice and ways to start a more useful conversation than simply asking whether someone is fine. It is a candid discussion about sustaining a career without sacrificing the person doing the work.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Magen Wu:
→ Magen Wu on LinkedIn

Mentioned in this episode:
→ DEF CON
→ Tim Ferriss’s blog

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Burnout in security with Magen Wu
02:00 Magen’s security origin story
04:35 What burnout can feel like
07:05 Why security work can amplify chronic stress
10:50 How company culture sets unhealthy expectations
12:39 Taking a real break from work
13:41 The pressure to feel indispensable
15:16 Sleep, boundaries, and recovery
18:12 Phones, social media, and attention
21:57 Hobbies and time away from computers
23:28 Recognizing changes in friends and coworkers
25:42 Starting a supportive conversation
29:48 Knowing when to hustle and when to recover

Katy Anton -- OWASP Top 10 #4 XXE Feb 23, 2018

Show notes

A feature built into XML processing can become a path to file disclosure, internal requests, or denial of service. Katy Anton explains XML External Entities, the category added as A4 in the 2017 OWASP Top 10, and why developers need to understand their parser’s behavior. Chris and Robert ask how an XXE attack works, where the exposure appears in applications and web services, and how tools can help identify it. Katy walks through prevention options, including safer parser configuration and choosing simpler data formats when an application does not need XML’s capabilities. The discussion also considers legacy systems, developer education, and the difference between fixing an immediate configuration problem and reducing complexity over time. It is an accessible introduction to a frequently misunderstood vulnerability class.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Katy Anton:
→ Katy Anton on LinkedIn

Mentioned in this episode:
→ CWE-611 — XML External Entity Reference
→ OWASP XXE Prevention Cheat Sheet
→ OWASP Proactive Controls

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Understanding XXE with Katy Anton
01:42 OWASP Proactive Controls and community work
03:12 What XML External Entities means
06:07 When a parser feature becomes an attack
07:21 Parser defaults and affected applications
09:46 File disclosure and other XXE impacts
10:42 Denial of service and entity expansion
11:38 Finding XXE with testing and code review
13:14 Simpler data formats and JSON
15:52 Why applications still use XML
18:57 Preparing developers to address XXE
21:07 Hardening the XML parser
21:41 Immediate fixes and longer-term design choices

Our TOPPODCAST Picks

Follow Us

Stay Connected

The Application Security Podcast

Related Podcasts

Links

Stay Connected