The Application Security Podcast

Latest Episodes:

Elena Elkina -- Privacy and Data Protection Oct 04, 2016

Show notes

Protecting data from attackers does not answer every question about privacy. Elena Elkina joins Chris and Robert to explain the relationship between privacy, security, and customer data protection, drawing on her legal background and personal experience growing up under surveillance. She describes how different people and organizations understand privacy and why transparency about data use matters alongside technical safeguards. Robert brings a developer’s perspective, and Elena turns the conversation toward the influence engineers have on privacy through product design and requirements. They explore the communication gap between precise technical decisions and the contextual answers privacy teams often give. Elena’s closing advice is straightforward: build relationships with privacy and security colleagues so that protecting people’s information becomes a shared design responsibility.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Elena Elkina:
→ Elena Elkina on LinkedIn
→ Women in Security and Privacy

Mentioned in this episode:
→ Women in Security and Privacy
→ Leading Women in Technology
→ 23andMe

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Privacy and data protection with Elena Elkina
01:57 Elena’s path into privacy
03:48 How personal experience shaped her perspective
05:53 What privacy means to different people
07:26 Business use of data and transparency
11:02 Privacy compared with customer data protection
12:45 A developer’s view of privacy
15:45 How developers influence privacy through design
18:54 Bridging technical and privacy conversations
19:58 Building relationships with privacy and security teams

Chris and Robert -- Security in the Methodology Sep 26, 2016

Show notes

How should application security change when a team moves from Waterfall to Agile? Chris and Robert compare the two development models and map security work onto each one. Waterfall makes phase gates, documentation, and specialized reviews visible, but often delays feedback. Agile breaks work into smaller increments, uses user stories and acceptance criteria, and creates opportunities to test security continuously. The hosts discuss stand-ups, sprints, continuous integration, threat modeling, abuse cases, reusable requirements, and the difficulty of defining “done” when security work spans multiple stories. Their conclusion is not that one methodology automatically produces secure software. Security succeeds when its activities fit the team’s real delivery process and provide useful feedback at the moment decisions are made.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Chris Romeo and Robert Hurlbut:
→ Chris Romeo on LinkedIn
→ Robert Hurlbut on LinkedIn

Mentioned in this episode:
→ Agile Manifesto
→ Microsoft SDL

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Security in development methodologies
02:33 Why organizations still use Waterfall
04:07 Documentation and predictable phase gates
06:01 Where Waterfall came from
07:19 Applying security to each Waterfall phase
08:40 Moving from Waterfall to Agile
10:25 Testing inside every sprint
12:09 User stories and acceptance criteria
13:25 Stand-ups, retrospectives, and feedback
15:00 Continuous integration and Agile
16:49 What it means for a story to be done
18:19 Fitting AppSec into Agile work
20:32 Turning security needs into stories
21:50 Testing authorization requirements
24:25 Threat modeling and abuse cases
27:21 Final methodology lessons

Chris and Robert -- The Activities of the Secure Development Lifecycle Sep 19, 2016

Show notes

Which activities turn a secure development lifecycle from an aspiration into repeatable work? Chris and Robert walk through security requirements, authentication and authorization, threat modeling, coding standards, approved libraries, code review, static analysis, dependency management, dynamic scanning, penetration testing, and post-release response. For each activity, they explain who benefits, when it belongs in development, and what it can reveal that another control cannot. The conversation emphasizes shared ownership: architects, developers, testers, operations, and response teams each see different parts of the risk. Tools support the process but do not replace design judgment or human testing. The episode provides a practical map of the SDL and shows how its activities connect from initial requirements through production feedback.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Chris Romeo and Robert Hurlbut:
→ Chris Romeo on LinkedIn
→ Robert Hurlbut on LinkedIn

Mentioned in this episode:
→ OWASP Top 10
→ OWASP ESAPI
→ Microsoft Safe C Library
→ PSIRT Services Framework (FIRST.org)

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Activities of a secure development lifecycle
01:45 Security requirements
03:27 Authentication and authorization
05:24 Capturing requirements in development work
07:17 Threat modeling
09:12 Identifying threats systematically
12:14 How threat models help testers
14:09 Secure coding standards
15:52 Why developers need actionable guidance
17:44 Approved frameworks and cryptography
20:49 Code review and static analysis
23:53 Owning third-party dependency risk
25:18 Software composition analysis
26:53 Triage and false positives
29:38 Testing within the delivery process
31:26 Dynamic application security testing
33:07 Network versus application scanning
35:23 Comparing multiple tools
37:35 Why penetration testing still matters
40:45 Product security incident response
43:37 Secure software as a connected system

Chris and Robert -- Introductions and why #AppSec? Sep 13, 2016

Show notes

In the inaugural episode of the Application Security Podcast, Chris Romeo and Robert Hurlbut introduce themselves, trace the experiences that brought them into security, and establish the question the show will keep answering: what is application security, and why should builders care? They walk through security requirements, threat modeling, secure development, testing, and release as connected parts of the software lifecycle. The conversation distinguishes application security from information security and the broader cybersecurity label, then makes the business case for treating AppSec as foundational work—a customer expectation and a worthwhile investment rather than optional overhead, driven by people and supported by tools.

Connect with Chris and Robert:
→ Chris Romeo on LinkedIn
→ Robert Hurlbut on LinkedIn

Mentioned in this episode:
→ Software Security: Building Security In
→ OWASP Top 10
→ Gary McGraw
→ Robert Hurlbut

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Welcome to the Application Security Podcast
02:21 Chris and Robert’s security origin stories
06:31 Defining application security
09:05 Security requirements in the development lifecycle
10:25 Design and threat modeling
11:17 Secure development and testing
13:35 Release and operational feedback
15:53 Building security in
16:56 Application security vs. information security
20:31 What does cybersecurity mean?
22:59 Why organizations need application security
24:53 Applications as the path to valuable data
27:24 The OWASP Top 10 as a starting point
28:23 Final thoughts and the future of the field

Our TOPPODCAST Picks

Follow Us

Stay Connected

The Application Security Podcast

Related Podcasts

Links

Stay Connected