The Application Security Podcast

Latest Episodes:

Chris Romeo -- AppSec Awareness: A Blue Print for Security Culture Change Dec 13, 2016

Show notes

A security awareness program needs to change daily behavior, not simply record who completed a course. In this recorded conference talk, Chris Romeo shares lessons from building a large-scale application security education and culture program at Cisco. He explains why developers need practical knowledge, why security culture must be deliberate and sustainable, and how an organization’s own history can make lessons relevant. Chris walks through program design choices, including a recognizable theme, learning paths, activities, and ways to keep people involved. He also distinguishes useful gamification from superficial rewards and describes how visible achievements can reinforce learning. The talk offers a blueprint for connecting education, community, and repeated practice so security becomes part of how people develop software.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Chris Romeo:
→ Chris Romeo’s presentations

Mentioned in this episode:
→ Slides on SpeakerDeck
→ Cisco Security Ninja

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 AppSec awareness and sustainable security culture
01:16 Why application security matters when software is everywhere
05:11 Helping developers do the right thing
06:05 Teaching developers to think about security
10:26 Designing deliberate and sustainable culture change
14:06 Learning from organizational history and designing a program
27:42 Activities that turn learning into practice
41:21 Gamification and reinforcing security habits

Tracy Maleeff -- Natural Paranoia as a Career Path? A Transition to Security Dec 06, 2016

Show notes

Can a career in library science become a foundation for information security? Tracy Maleeff joins Chris and Robert while making that transition, bringing research, organization, and communication skills into a field often defined by technical job titles. She explains how she explored possible directions, tested her interests, and used conversations with practitioners to understand the work before committing to it. The discussion focuses on networking as genuine relationship-building, asking for help, and finding welcoming communities at conferences and online. Tracy also shares a method for planning a career change and a book that helped shape her interest. Her story offers developers, testers, and people outside technology a concrete example of recognizing transferable skills and investigating a new path deliberately.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Tracy Maleeff:
→ Tracy Maleeff on LinkedIn
→ InfoSecSherpa

Mentioned in this episode:
→ The Cuckoo’s Egg by Clifford Stoll
→ Security BSides

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Tracy Maleeff’s transition into information security
08:33 Recognizing when it is time for a career change
11:51 Transferable lessons for developers and testers
13:35 Building genuine relationships in security
18:41 Unexpected benefits of making connections
21:31 Reaching out to people you admire
24:22 A process for exploring a new career
27:43 Testing your interest before committing
34:52 A book recommendation: The Cuckoo’s Egg

Chris Romeo -- Security Community at Any Scale Nov 29, 2016

Show notes

How can a company build a security community when it has only a few interested people and little budget? Robert interviews Chris Romeo about lessons from growing an internal community at a large technology company and adapting those lessons to smaller organizations. Chris distinguishes security advocates from champions, explains how to recognize motivated contributors, and recommends a dependable rhythm of meetings and learning opportunities. They discuss lunch sessions, practical training, and the conditions that make an internal security conference worthwhile. Robert keeps the conversation grounded in what a small team can actually do, including learning from outside events and sharing that knowledge at work. The episode presents community as a sustained network of relationships that helps people learn and apply security together.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Chris Romeo:
→ Chris Romeo’s presentations

Mentioned in this episode:
→ OWASP Top 10
→ CSSLP (ISC2)
→ Black Hat
→ DEF CON
→ All Day DevOps

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Building a security community at any scale
01:19 What an internal security community does
02:14 Starting with a few interested people
10:09 Identifying security champions
12:02 Establishing a monthly learning cadence
13:53 Engaging more of the organization
15:10 Choosing useful training and learning resources
17:39 When to hold an internal security conference
22:06 Learning from external events on a smaller budget

Deidre Diamond -- The Soft Skills of AppSec Nov 15, 2016

Show notes

Technical ability can open a door in security, but communication and relationships often determine what happens next. Deidre Diamond, founder of CyberSN, joins Chris and Robert to explain the human skills that developers and security professionals need to work effectively with colleagues and business leaders. She discusses listening, setting expectations, practicing difficult conversations, and building confidence through repeated speaking opportunities. The conversation also explores the application security job market as it looked at the time, the value of developers who understand security, and how companies evaluate candidates making a career transition. Deidre connects these skills to stronger teams and better opportunities, offering concrete first steps for people who want their technical work to have greater influence across an organization.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Deidre Diamond:
→ Deidre Diamond on LinkedIn
→ CyberSN

Mentioned in this episode:
→ CyberSN
→ Toastmasters International

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 The soft skills of AppSec with Deidre Diamond
01:50 Deidre’s path into cybersecurity
05:26 Defining strong communication and interpersonal skills
11:39 Bringing developers into business conversations
14:09 Practicing better communication
16:24 First steps for developers who want to improve
19:15 Toastmasters and speaking outside your comfort zone
24:20 The application security job market
28:20 Career opportunities for security-minded developers
30:47 Security as a business and investment differentiator
33:14 Moving into a security role
35:11 A call to practice and build relationships

Tony UcedaVelez -- PASTA: Not Just for Breakfast Anymore Nov 08, 2016

Show notes

A useful threat model should explain how an attacker could harm the business, not just complete a checklist. Tony UcedaVélez joins Chris and Robert to introduce PASTA, the Process for Attack Simulation and Threat Analysis, and its risk-centered approach to application security. He explains how business context, threat intelligence, and attacker motivation shape the analysis, then connects those ideas to attack trees and cloud containers. The conversation explores where to find useful threat information, whether attack models can be reused, and how resources such as MITRE CAPEC can support the work. Tony also addresses the challenge of helping developers reason about adversaries. The episode closes with practical advice for making threat modeling an evidence-based part of understanding and protecting a system.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Tony UcedaVelez:
→ Tony UcedaVélez on LinkedIn
→ VerSprite

Mentioned in this episode:
→ PASTA threat modeling
→ Attack Trees (Schneier)
→ MITRE CAPEC
→ OWASP Threat Modeling Project
→ Microsoft Threat Modeling Tool
→ Docker

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 PASTA threat modeling with Tony UcedaVélez
01:22 Tony’s security origin story
05:00 What PASTA adds to threat modeling
08:48 Finding relevant threat intelligence
12:32 Helping teams reason about adversaries
15:07 Moving beyond security checklists
18:02 Attack trees and cloud containers
20:08 How attack trees describe paths to a goal
24:30 Reusing and sharing attack models
26:12 Connecting CAPEC and weakness information
34:27 Practical steps for risk-centered threat modeling

Glenn Leifheit -- An Inner Glimpse of the Microsoft SDL Nov 02, 2016

Show notes

How do you keep a secure development lifecycle useful as products, teams, and delivery methods change? Glenn Leifheit joins Chris and Robert to share lessons from Microsoft’s SDL and its evolution beyond a rigid sequence of security tasks. He explains the importance of adapting the program to a product’s context, treating developers as customers, and making security help easy to access. The conversation covers community, practical learning, constraints that encourage creative solutions, and the need to evolve alongside development practices. Glenn also describes mentoring across roles and seeking ideas outside the security industry. His central message is that a sustainable SDL depends on partnership and repeatable habits, with processes simple enough to survive staffing changes and the pressures of everyday delivery.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Glenn Leifheit:
→ Glenn Leifheit on LinkedIn

Mentioned in this episode:
→ Microsoft Security Development Lifecycle (SDL)

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Inside the Microsoft SDL with Glenn Leifheit
02:48 Where the SDL came from
10:54 Adapting security to the product and business
13:55 Making developers want to ask for help
23:35 Evolving the SDL with development practices
31:36 Learning from constraints and outside influences
34:54 Treating developers as customers
35:30 Building a learning community
38:56 Mentoring across roles and experience levels
42:42 Learning from organizations outside security
46:28 Making security processes sustainable
47:07 Partnership, adaptability, and practical next steps

Mike Landeck -- Security Must Meet the Needs of the Business Oct 25, 2016

Show notes

Security advice only helps when it connects to the needs of the people building and running the business. Mike Landeck joins Chris and Robert to discuss teaching developers, working with testers, and using breach stories without overwhelming an audience that already hears about incidents every day. He explains how practical examples can lead people toward resources such as the OWASP cheat sheets and how to choose stories that make risk understandable. The conversation then moves to business decisions, trust, and the limits of simply telling an organization what it should do. Mike argues for partnership and concrete assistance that helps teams improve over time. The episode offers ways to turn security knowledge into useful action for developers, QA staff, and business leaders.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Mike Landeck:
→ Mike Landeck on LinkedIn

Mentioned in this episode:
→ OWASP SQL Injection Prevention Cheat Sheet
→ Damn Vulnerable Web App (DVWA)
→ I Am The Cavalry
→ Krebs on Security
→ OWASP Cheat Sheet Series

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Connecting security to business needs with Mike Landeck
01:32 Mike’s path into application security
07:10 Teaching developers to use practical security resources
09:01 Breach fatigue and keeping the message relevant
13:28 Reaching people outside the security echo chamber
16:01 Choosing useful breach stories
19:24 Sources for understanding security incidents
20:06 Explaining security to a developer
23:10 Helping QA teams test for security
25:55 Understanding the business decision
30:15 Moving the organization toward better outcomes
34:23 Practical next steps for security practitioners

Daniel Ramsbrock -- Web Application Pen Testing – Part 2 Oct 17, 2016

Show notes

Part two follows Daniel Ramsbrock into the practical workflow of a web application penetration test. He joins Chris and Robert to move from reconnaissance into active testing, explaining credentials, intercepting proxies, attack recording, automated scanners, and the human judgment required to interpret results. The conversation covers authorization failures, false positives, reporting, remediation, and retesting, then broadens into compliance and the feedback loops mature organizations build between testers and development teams. Daniel also offers a learning path through vulnerable applications, training, certifications, bug bounties, books, and hands-on practice. The episode makes clear that tools assist a penetration tester, but disciplined reasoning and communication create the lasting security improvement.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Daniel Ramsbrock:
→ Daniel Ramsbrock on LinkedIn

Mentioned in this episode:
→ Burp Suite
→ HCL AppScan
→ OWASP WebGoat
→ GIAC GWAPT
→ SANS SEC542
→ Bugcrowd
→ The Web Application Hacker’s Handbook
→ Kali Linux

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Continuing the web penetration testing process
01:54 Why testers need individual credentials
04:21 Moving from reconnaissance to active attack
05:41 Intercepting proxies and recording traffic
07:34 Choosing which attacks to attempt
09:20 Where automated scanners fit
10:27 Human judgment during active testing
11:40 Finding authorization failures
12:40 Interpreting false positives
13:47 Reporting findings and remediation
16:48 Retesting and proving fixes
18:53 Compliance versus meaningful security
20:44 Building feedback loops with development
22:20 Learning web application penetration testing
26:00 Bug bounties as controlled practice
28:11 Books and hands-on resources
30:52 Final advice

Daniel Ramsbrock -- Web Application Pen Testing – Part 1 Oct 17, 2016

Show notes

What should developers and security teams understand before commissioning a web application penetration test? In part one, Daniel Ramsbrock joins Chris and Robert to establish the purpose, timing, and business value of testing an application from an attacker’s perspective. They compare penetration testing with earlier secure-development activities, explain why developers and testers benefit from working together, and consider how waterfall, agile, and DevOps delivery models change the engagement. Daniel discusses risk-based scoping, testing frequency, business goals, internal versus external testers, and the ethical “hat” terminology used in security. The episode ends by moving from program decisions toward the hands-on testing process continued in part two.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Daniel Ramsbrock:
→ Daniel Ramsbrock on LinkedIn

Mentioned in this episode:
→ RVAsec
→ DEF CON
→ Black Hat
→ Web Application Penetration Testing — Part 2

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Web application penetration testing, part one
01:41 Daniel Ramsbrock’s security origin story
03:23 What penetration testing is
04:23 Why attackers target applications
05:29 The developer perspective on testing
06:34 Developers and penetration testers working together
07:45 Where penetration testing fits the lifecycle
09:19 Why late testing creates problems
13:18 Waterfall, agile, and DevOps considerations
16:39 How often to run a full penetration test
18:41 Using risk to set the testing schedule
20:13 Scoping services and applications
21:14 Connecting business goals to testing
22:12 Building a testing capability
24:51 Internal and external testing tradeoffs
26:24 White, gray, and black hat terminology
30:24 Preparing for the hands-on process

Matt Clapham -- Development Security Maturity Oct 10, 2016

Show notes

Can you learn enough about a development team’s security practices in an hour to give it useful direction? Matt Clapham joins Chris and Robert to explain his lightweight approach to estimating development security maturity through five key behaviors. They discuss preparing for the assessment, learning from defect records and existing artifacts, and holding a conversation that encourages honest answers rather than anxiety about being graded. Matt walks through scoring practices such as threat modeling and vulnerability response, then explains how the results can guide improvement. The discussion also examines the experience an assessor needs, the model’s limitations, and its relationship to broader approaches such as BSIMM and SAMM. The goal is an actionable view of how a team actually works.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Matt Clapham:
→ Matt Clapham on LinkedIn

Mentioned in this episode:
→ RSA slides: Estimating Development Security Maturity in About an Hour
→ BSIMM
→ OWASP SAMM

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Estimating development security maturity with Matt Clapham
01:32 Matt’s product security background
03:15 What development security maturity means
05:15 Why measurement can make developers anxious
08:20 Why a maturity assessment is useful
11:03 Preparing for the assessment
16:33 Understanding the application before the meeting
19:49 What defect records reveal about a team
21:10 Running the development-team conversation
22:30 Communication that encourages useful answers
26:38 Scoring security behaviors
29:54 Evaluating threat modeling practices
34:39 Vulnerability response as a maturity signal
37:52 Can a team outgrow the model?
42:12 Limitations and advantages of the approach
45:30 How the model relates to BSIMM and SAMM

Our TOPPODCAST Picks

Follow Us

Stay Connected

The Application Security Podcast

Related Podcasts

Links

Stay Connected