The Application Security Podcast

Latest Episodes:

Andrew van der Stock and Brian Glas -- The Future of the OWASP Top 10 Sep 25, 2017

Show notes

How should the OWASP Top 10 balance data, expert judgment, community feedback, and a format people can actually use? Andrew van der Stock and Brian Glas discuss the governance and research behind the project’s next release during a contentious revision cycle. They explain how public comments affect decisions, why a large share of contributed data came from one source, and how the team planned to compare findings across applications. The conversation covers scoring, release candidates, the familiar one-page format, and connections to ASVS, Proactive Controls, and the Web Security Testing Guide. Chris presses them on what the list should become in the future and how listeners can participate. The result is a candid view of maintaining a widely influential community standard.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Andrew van der Stock and Brian Glas:
→ Andrew van der Stock on LinkedIn
→ Brian Glas on LinkedIn
→ OWASP Top 10

Mentioned in this episode:
→ OWASP Top 10
→ OWASP ASVS
→ OWASP Proactive Controls
→ OWASP Web Security Testing Guide
→ OWASP ESAPI

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 The future of the OWASP Top 10
02:21 Andrew van der Stock’s security origin story
05:30 Experience maintaining the project
06:36 Governance and decision-making
08:13 How public comments affect the release
10:57 Data concentration in the first candidate
13:15 Comparing findings across applications
16:07 Scoring and understanding impact
19:30 The origins of ASVS
21:22 Connecting the Top 10 to other OWASP projects
23:06 The release-candidate schedule
26:21 Preserving the one-page format
28:58 What the Top 10 should become
33:16 How listeners can participate
34:26 Final thoughts

Robert Hurlbut -- Threat Modeling Sep 19, 2017

Show notes

How do you find security problems in a design before they become expensive changes to running software? In this recorded conference presentation, Robert Hurlbut explains threat modeling as a collaborative way to understand a system, identify threats, choose mitigations, and follow through on the results. He distinguishes threats from vulnerabilities, connects security work to business goals, and shows why developers, testers, architects, and stakeholders all belong in the conversation. Robert covers data flow diagrams, trust boundaries, attack trees, threat libraries, and card games that help teams ask better questions. A configuration-file example makes the process concrete. The talk closes with risk decisions, documenting requirements and defects, and revisiting the model as the application changes.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Robert Hurlbut:
→ Robert Hurlbut
→ Robert’s threat modeling resources

Mentioned in this episode:
→ CAPEC
→ OWASP ASVS
→ OWASP Proactive Controls
→ Elevation of Privilege
→ Attack Trees (Schneier)
→ Microsoft Threat Modeling Tool
→ OWASP Cornucopia

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Threat modeling for secure software design
00:50 Why secure design matters
06:51 Design flaws and the connected-car example
09:47 Threats, business goals, and collaborative modeling
21:00 Diagrams, trust boundaries, and identifying threats
33:22 Threat modeling games and practical questions
37:00 The configuration-file trust problem
38:28 Choosing mitigations and evaluating risk
42:15 Documenting findings and following through

Chris and Robert -- Passwords, Identity, and #AppSec Sep 12, 2017

Show notes

Password advice changes as attackers, hardware, and identity standards evolve. Chris and Robert examine how passwords are guessed, cracked, stored, and reused, then compare long-standing habits with updated NIST guidance. They discuss dictionary attacks, hashing, salts, password length, composition rules, password managers, and the risks of knowledge-based questions. The conversation also explores checking proposed passwords against known breach data through Have I Been Pwned and the operational cost of doing that safely. Throughout, they separate user-facing policy from the developer’s responsibility to store and verify credentials correctly. The result is a practical review of why familiar password rules often fail and how modern applications can make authentication both safer and more usable.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Chris Romeo and Robert Hurlbut:
→ Chris Romeo on LinkedIn
→ Robert Hurlbut on LinkedIn

Mentioned in this episode:
→ NIST SP 800-63B
→ OWASP Password Storage Cheat Sheet
→ Troy Hunt
→ Have I Been Pwned
→ Enpass

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Passwords, identity, and application security
01:30 The reality of hundreds of passwords
03:21 Hardware advances and password cracking
05:15 Dictionary attacks
07:34 Hashing and password storage
09:28 Cracking weak hashes
10:48 Knowledge-based questions and social engineering
13:11 Changes in NIST guidance
14:36 Supporting long passwords
16:03 Password managers
17:42 Evaluating password-manager risk
19:17 Retiring forced periodic changes
21:27 Checking passwords against breach data
23:37 Operational cost and implementation choices
26:19 Maximum length and denial-of-service concerns
28:11 Why every password needs a unique salt
29:43 Slow password hashing
31:15 Final recommendations

Tanya Janca and Nicole Becher -- Hacking APIs and Web Services with DevSlop Sep 05, 2017

Show notes

APIs may lack a visible interface, but that does not make them hidden or safe. Tanya Janca and Nicole Becher use OWASP DevSlop and its Pixi application to explain how developers and testers can learn API security hands-on. They cover HTTP fundamentals, authentication, rate limiting, proxies, curl, ZAP, and Burp Suite before showing how intentionally vulnerable applications turn those concepts into experiments. The conversation explores Pixi’s microservices, containerized design, planned capture-the-flag mode, and inspiration from OWASP Juice Shop and WebGoat. Tanya and Nicole also discuss the limits of automated scanners and the value of beginner-friendly CTFs. Their central recommendation is simple: interact with real APIs, observe the traffic, and practice breaking safe targets.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Tanya Janca and Nicole Becher:
→ Tanya Janca on LinkedIn
→ Nicole Becher on LinkedIn
→ OWASP DevSlop

Mentioned in this episode:
→ OWASP DevSlop
→ Pixi
→ OWASP ZAP
→ Burp Suite
→ OWASP Juice Shop
→ OWASP WebGoat
→ Docker

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Hacking APIs and web services with DevSlop
02:15 Nicole Becher’s security origin story
04:12 Learning AppSec through vulnerable applications
06:04 APIs, web services, and HTTP basics
08:27 Why an API is not invisible
10:42 Discovering API traffic with a proxy
12:30 Rate limiting and common API weaknesses
17:15 Using curl, ZAP, and Burp Suite
22:12 Pixi and the DevSlop application family
24:05 Containers and future modules
26:11 Building a capture-the-flag mode
28:15 Scanner limitations and better test targets
30:44 Why developers should try a CTF
32:47 Hands-on learning at AppSec USA

Jon Mccoy and Jonathan Marcil -- Agile #AppSec Aug 29, 2017

Show notes

Agile delivery promises fast feedback, but where does application security fit when teams are already moving continuously? Jon McCoy and Jonathan Marcil join Chris and Robert to separate Agile principles from inconsistent enterprise interpretations and identify practical starting points. They discuss dedicated AppSec leadership, security-minded developers, continuous integration, static analysis, shared knowledge, and reusable components. The guests challenge the idea of a late security sprint and examine the real cost of building defenses early. They also explain how responsibility can be distributed without asking every developer to become a cryptography specialist. The episode closes with learning recommendations, community participation, and the principle that a mature AppSec program should help teams avoid repeating the same security mistakes.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Jon McCoy and Jonathan Marcil:
→ Jon McCoy on X
→ Jonathan Marcil on X

Mentioned in this episode:
→ Agile Manifesto
→ OWASP Top 10
→ OWASP Montreal

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Agile application security
01:54 Security origin stories
05:41 Development experience and security work
08:52 The advantages of fast feedback
10:11 What organizations mean by Agile
13:24 Where security fits
16:44 Starting an Agile AppSec program
20:02 Continuous integration and static analysis
23:02 Building a security knowledge base
27:54 Why a late security sprint fails
28:05 The real cost of building security early
32:44 Reusable controls and specialized responsibility
35:33 Additional first-year priorities
37:34 Learning through local communities
43:18 Avoiding the same mistakes over time

Jay Beale -- Docker Security and AppSec Aug 22, 2017

Show notes

Does moving an application into Docker make it safer, or simply change the risks you need to manage? Jay Beale of InGuardians joins Robert to explain containers, how they differ from virtual machines, and why sharing a Linux kernel matters for security. He examines container breakouts, the danger of assuming isolation is stronger than it is, and practical defenses using Linux security controls. The conversation then turns to patching: teams need to rebuild and replace images, track the software they contain, and test updates before deployment. Jay connects those responsibilities to third-party application libraries and explains why container convenience does not remove operational accountability. He closes with resources for keeping pace with Docker and Linux security.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Jay Beale:
→ Jay Beale on LinkedIn
→ InGuardians

Mentioned in this episode:
→ Docker
→ Kubernetes
→ Linux kernel
→ LXC

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Docker security with Jay Beale
01:50 From Linux hardening to security consulting
05:36 Containers compared with virtual machines
10:35 Sharing the Linux kernel
14:35 Why Docker changed the developer workflow
16:08 Container breakouts and new security risks
21:53 Controls that reduce breakout risk
26:51 Rebuilding images and keeping containers patched
28:29 Finding vulnerable software in containers
32:53 Third-party libraries and application security
36:31 Testing updates before deployment
39:09 Where to keep learning about Docker security
42:55 Final advice and training resources

Chris and Robert -- Proactive Controls, AppSec USA, and Gartners MQ on AppSec Testing Aug 17, 2017

Show notes

What can practitioners learn from a new OWASP document, an upcoming conference, and an industry analyst report in one conversation? Chris and Robert test a multi-topic format by reviewing Proactive Controls 3.0, previewing AppSec USA, and discussing Gartner’s application security testing market analysis. They examine renamed controls, digital identity guidance, conference learning and hallway conversations, and the range of testing products covered by the report. The hosts compare static, dynamic, interactive, and runtime approaches while questioning predictions about adoption and unfamiliar vendors. The episode captures a moment in the market rather than offering timeless rankings, but its method remains useful: read frameworks and analyst material critically, understand what each category measures, and investigate tools in the context of your own development program.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Chris Romeo and Robert Hurlbut:
→ Chris Romeo on LinkedIn
→ Robert Hurlbut on LinkedIn

Mentioned in this episode:
→ OWASP Proactive Controls
→ OWASP Proactive Controls
→ OWASP Threat Dragon Project
→ Contrast Security

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Three AppSec topics in one episode
01:36 OWASP Proactive Controls 3.0
02:58 Renamed and reorganized controls
04:15 Strong digital identity
05:36 Why AppSec USA matters
08:19 Fundamentals and advanced conference content
11:01 Meeting the podcast community
12:52 Gartner’s application security testing report
14:13 Predictions about testing adoption
16:36 Interactive and runtime testing
18:46 Unfamiliar vendors in the market
20:27 Using analyst reports as a starting point
22:34 Closing thoughts

Robert Hurlbut -- Blackhat Security Conference Aug 08, 2017

Show notes

What should an application security professional take away from a conference famous for spectacular hacks? Robert Hurlbut shares his experience at Black Hat, including the relationship between Black Hat and DEF CON and what each offers developers and people entering security. Chris and Robert unpack Alex Stamos’s keynote message about neglected fundamentals, the limits of celebrating only advanced attacks, and the importance of a more inclusive security community. They discuss welcoming newcomers, learning from people with different backgrounds, and making the most of hallway conversations. This episode captures a particular moment in the conferences’ history while offering practical advice about participation: come ready to learn, meet people, and bring useful ideas back to your everyday work.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Robert Hurlbut:
→ Robert Hurlbut

Mentioned in this episode:
→ Black Hat
→ DEF CON

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Robert’s Black Hat conference takeaways
02:05 Black Hat and DEF CON explained
03:52 What AppSec practitioners can learn at the conferences
05:55 Alex Stamos’s keynote and security fundamentals
09:41 Inclusion and diversity in the security community
12:28 Welcoming people who are new to security
14:19 The value of HallwayCon and new connections

Dave Ferguson -- The OWASP Top 10 Proactive Controls Jul 25, 2017

Show notes

Developers hear plenty about vulnerabilities, but what should they actually build into their applications to prevent them? Dave Ferguson joins the podcast to walk through the OWASP Top 10 Proactive Controls as they stood at the time of this recording. The discussion covers early security testing, parameterized queries, output encoding, input validation, authentication, access control, data protection, logging, security frameworks, and error handling. Dave connects the controls to familiar application risks and explains how OWASP cheat sheets provide the implementation detail behind the high-level guidance. Chris and Dave also debate where intrusion detection belongs and why security features should be reusable. The result is a developer-focused conversation about turning awareness of common failures into concrete engineering practices.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Dave Ferguson:
→ Dave Ferguson on LinkedIn

Mentioned in this episode:
→ OWASP Proactive Controls
→ OWASP Cheat Sheet Series
→ OWASP Top 10

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Proactive security controls with Dave Ferguson
07:40 A developer-focused security baseline
08:40 Verify security early and often
12:34 Parameterize queries
15:01 Encode data for its output context
18:14 Validate all inputs
23:07 Identity, authentication, and session management
25:25 Implement access controls
29:03 Protect data at rest and in transit
32:18 Logging and intrusion detection
36:32 Use security frameworks and libraries
38:33 Handle errors and exceptions securely
41:18 Turning vulnerability awareness into action

Jim Manico -- MORE OWASP! Jul 04, 2017

Show notes

How can developers turn OWASP’s many projects into practical help with the code they write? Jim Manico joins Chris and Robert to discuss the resources he helps build and the problems each is meant to solve. He traces his move from software development into security education, then explains the OWASP Java Encoder and how its focused approach differs from a larger security library such as ESAPI. The conversation also explores the debate surrounding the 2017 OWASP Top 10, the value of the Cheat Sheet Series, and the developer-oriented Proactive Controls. Jim shares lessons from writing Iron-Clad Java and from teaching application security. Throughout, he emphasizes accessible guidance, sound security APIs, and community work that helps developers put defenses into practice.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Jim Manico:
→ Jim Manico on LinkedIn
→ Manicode Security

Mentioned in this episode:
→ OWASP Java Encoder Project
→ OWASP ESAPI
→ OWASP Cheat Sheet Series
→ OWASP Proactive Controls

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 OWASP projects with Jim Manico
01:01 From software development to security education
02:27 Learning security as a developer
05:12 Joining and contributing to OWASP
10:32 The OWASP Java Encoder
11:56 Java Encoder compared with ESAPI
13:24 Bringing safer APIs into the platform
20:00 The debate around the OWASP Top 10
24:16 Collaboration at the OWASP Summit
25:33 How to use the Cheat Sheet Series
28:10 Proactive Controls for developers
29:25 Writing Iron-Clad Java
31:55 Life, teaching, and opportunities in AppSec

Our TOPPODCAST Picks

Follow Us

Stay Connected

The Application Security Podcast

Related Podcasts

Links

Stay Connected