The Application Security Podcast

Latest Episodes:

Jim Routh -- The CISO Transition to the rest of life Mar 11, 2025

Show notes

Former CISO Jim Routh discusses his perspective on retirement and career fulfillment in cybersecurity. Rather than viewing retirement as simply stopping work, Routh describes his three-filter approach: working only with people he respects and admires, doing only work he finds fulfilling, and controlling when he works. He shares valuable lessons learned about which post-retirement opportunities truly bring satisfaction and explains why he avoids certain roles. Routh emphasizes the importance of cybersecurity professionals taking ownership of their career development, recommending they focus on developing two specific skills annually rather than using tenure to guide career moves. Jim Ralph is currently on the boards of Savvy Security, Accountable Digital Identity Association, and the Global Resiliency Federation.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We help enterprises reduce vulnerabilities through application security education for developers and everyone in the SDLC.
→ Learn more about Security Journey

Connect with Jim Routh:
→ CISO Transition (LinkedIn article by Jim Routh)
→ Jim Routh on Twitter

Mentioned in this episode:
→ CISO Transition (LinkedIn article by Jim Routh)
→ Jim Routh on Twitter

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Jim Routh: The CISO Transition to the rest of life
03:15 Hey, I'm happy to be here, Chris. Appreciate the kind words
04:50 Yeah, I was recently, I was introduced to pickleball this past
07:12 Of course, it wasn't offered in school when I went to
13:20 Jim, what does the word retirement mean to you
16:02 Why
16:58 There's a lot of inertia dealing with that resistance, and that's
19:34 Yeah, that's very helpful just to get this kind of your
32:16 I think this conversation is something that should be helpful for
34:40 For instance, I wanted to serve on boards. Why
38:16 Just listening to you as we've kind of gone through this
42:05 Yeah, that's helpful. Unfortunately, no one has invented this time machine
44:53 Like, you, as long as you, you know, performed well, you
47:24 Opportunity that's helping you, enabling you to learn the skills you

Henrik Plate -- OWASP Top 10 Open Source Risks Mar 04, 2025

Show notes

Henrik Plate joins us to discuss the OWASP Top 10 Open Source Risks, a guide highlighting critical security and operational challenges in using open source dependencies. The list includes risks like known vulnerabilities, compromised legitimate packages, name confusion attacks, and unmaintained software, providing developers and organizations a framework to assess and mitigate potential threats. Henrik offers insights on how developers and AppSec professionals can implement the guidelines. Our discussion also includes the need for a dedicated open-source risk list, and the importance of addressing known vulnerabilities, unmaintained projects, immature software, and more. Henrik Plate is the principal security researcher at Endor Labs. He formerly worked for SAP Security Research, where he led the focus topic open source security starting in 2014.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey is an enterprise-class solution with lessons that are built on learning science principles to deliver long-term, measurable results.
→ Learn more about Security Journey

Connect with Henrik Plate:
→ The OWASP Top 10 Open Source Risks
→ Endor Labs

Mentioned in this episode:
→ The OWASP Top 10 Open Source Risks
→ Endor Labs
→ OpenSSF

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Henrik Plate: OWASP Top 10 Open Source Risks
01:42 We're back on the world of OWASP. We've, we've been away
04:39 Yeah, Henrik, uh, just curious. So, uh, we're talking about the
08:17 The order in this list mean something, or are these all
10:29 Yeah. So if I'm a developer, what, how do I use
12:47 I wonder if we could start to walk through the list
19:43 This, XZ was a more modern example of this, right
22:13 Yeah. And that's, and that's a common problem in the open
24:28 All right, so what is 4
28:28 Okay. So Robert, why don't you, uh, pick one between 8
31:57 All right, Henrik, we have 3 questions that we typically ask
35:01 Uh, the 3rd question is, what's your top book recommendation and

Tanya Janca -- A Secure SDLC from a Developer's Perspective Feb 26, 2025

Show notes

Security expert Tanya Janca discusses her new book "Alice and Bob Learn Secure Coding" and shares insights on making security accessible to developers. In this engaging conversation, she explores how security professionals can better Tanya Jenka, aka She Hacks Purple, is the bestselling author of Alice and Bob Learn Secure Coding, Alice and Bob Learn Application Security, and Cards Against AppSec. Over her 28-year IT career, she's won countless awards, including the OWASP Lifetime Distinguished Member and Hacker of the Year. She has spoken all over the planet and is a prolific blogger. Tanya has trained thousands of software developers and IT security pros via her online academies, We Hack Purple and Semigroup Academy, and her live training programs.

Today's episode is brought to you by Security Journey.

About Security Journey
Our education platform teaches valuable secure coding skills based on real-world vulnerabilities and threats, including OWASP Top 10.
→ Learn more about Security Journey

Connect with Tanya Janca:
→ Ranakhalil1
→ Alice & Bob Learn Secure Coding

Mentioned in this episode:
→ Alice & Bob Learn Secure Coding
→ Confidence Staveley
→ Ranakhalil1
→ Laurabellmain
→ Adam Shostack
→ Liran Tal
→ OWASP Application Security Verification Standard (ASVS)
→ Tanya Janca (SheHacksPurple)

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Tanya Janca: A Secure SDLC from a Developer's Perspective
02:28 Glad, glad to have you here. So we have an intro
06:50 This is definitely a needed piece of literature. I can, Robert
09:26 Really
11:23 Wow. Wow. So Robert, why don't you take us into that
23:26 I'm curious to see who comes to those talks. Is it
24:33 That's a— that's a view of the— the way what we're
28:10 See
30:46 It makes me, just made me think of something that I
35:05 About other areas
43:49 Put it on a t-shirt. That's good stuff. Well, that's, that's
46:03 Yeah, definitely. Definitely. Well, Tanya, how about a key takeaway for

Mehran Koushkebaghi -- Security as a Systemic Concern: How to develop Anti-Requirements Feb 11, 2025

Show notes

Mehran Koushkebaghi, a seasoned engineering expert, delves into the intricacies of systemic security. He draws parallels between civil engineering and IT systems, and explains the importance of holistic thinking in security design. Discover the difference between semantic and syntactic vulnerabilities and understand how anti-requirements play a critical role in system resilience. This episode offers fresh perspectives on application security. Mehran Koushkebaghi has 15 years of engineering experience across multiple industries, beginning as a structural engineer before discovering his passion for security. He sees parallels between designing resilient buildings and robust IT systems, applying a holistic engineering mindset in his work. With a master's in computer science and self-taught expertise in applied cryptography and cloud, Mehran continues shaping dependable IT solutions.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We provide diverse training content and easy-to-digest lessons to meet individual learner needs.
→ Learn more about Security Journey

Connect with Mehran Koushkebaghi:
→ Peter Checkland
→ RSA Conference

Mentioned in this episode:
→ Peter Checkland
→ RSA Conference
→ Black Hat
→ Critical System Thinking Book
→ The Fifth Discipline
→ Understanding Complexity
→ Nassim Taleb books

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Mehran Koushkebaghi: Security as a Systemic Concern: How to develop Anti-Requirements
01:32 Yeah, we're going to explore a topic that we started a
07:31 Does resiliency mean in a civil engineering context
14:25 Because if you don't, if you don't understand that though, then
19:55 I did have a, I did have an odd question on
21:48 Yeah. Let me see if this— tell me if this works
24:11 Sure. So, Marin, let's take a look at semantic versus syntactic
40:39 Okay. Second one is, if you could display a single message
42:37 Yeah, they're dense. They're thick books. And there's a, you have

Kalyani Pawar -- Shaping AppSec at Startups Feb 04, 2025

Show notes

Kalyani Pawar shares critical strategies for integrating security early and effectively in AppSec for startups. She recommends that startups begin focusing on AppSec around the 30-employee mark, with an ideal ratio of one AppSec professional per 10 engineers as the company grows. Pawar emphasizes the importance of building a security culture through "culture as code" - implementing automated guardrails and checkpoints that make security an integral part of the development process. She advises startups to prioritize visibility into their systems, conduct pentests, develop thoughtful policies, and carefully vet third-party tools and open-source solutions. Ultimately, Pawar's approach is about making security a collaborative, integrated effort that doesn't impede innovation but instead supports the startup's long-term success and safety.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Our training includes theory and immersive learning that teaches the skills and knowledge needed to create a security-first mindset across your organization.
→ Learn more about Security Journey

Connect with Kalyani Pawar:
→ The Alignment Problem
→ ChatGPT

Mentioned in this episode:
→ The Alignment Problem
→ ChatGPT

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Kalyani Pawar: Shaping AppSec at Startups
01:24 Yeah, we're going to talk about AppSec and how it intersects
05:45 Then that's a conversation to be had, but you should absolutely
09:11 Because that's, that's the, that's the results of that. But coming
12:51 One of the things about startups, and we kind of hinted
15:34 As the startup matures over time, we kind of, you took
19:22 Okay. So, let's say now you've got an AppSec team at
22:06 At a startup, they'll just step on you if you try
24:44 Yeah. I want to double-click on this culture as code, because
27:43 The advantage in the startup world is you're starting from scratch
31:37 Here we go. All right, so we've got 3 questions, Kalyani
34:44 That's a good gauge, yeah. And the third question is, what's
37:55 Yeah, people always, always got to focus on the original, right

Milan Williams -- AppSec Metrics Jan 14, 2025

Show notes

Milan Williams discusses the importance of application security metrics and how to make them both meaningful and actionable. She explains that metrics are crucial for tracking progress in what can often feel like an overwhelming security landscape, and they're valuable for career advancement and securing resources. We discuss metrics categories and several specific metrics that are good to track. Milan shares important principles on the importance of making metrics actionable through storytelling and relating security impacts to real-world consequences for users. Milan Williams is a senior product manager at Semgrep, where she helps security engineers and developers work together to ship secure software. She recently graduated from Harvard University with degrees in computer science and physics.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We provide application security training for not just your developers, but for all roles in your SDLC.
→ Learn more about Security Journey

Connect with Milan Williams:
→ Quiet Influence
→ Semgrep

Mentioned in this episode:
→ Quiet Influence
→ Semgrep

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Milan Williams: AppSec Metrics
02:58 I like that idea. So, all right, Robert, where are we
04:45 Do you think people associate metrics with boring
07:13 Yeah. It's all about OKRs, objectives and key results. And I
10:33 If you've got that perspective, because it's one of those things
12:00 For the metrics framework, could you walk us through that a
15:19 Then, is there, are there additional metrics in the framework
16:48 Before we go to any of the remaining categories, metrics, so
22:55 Yeah. So, I took a turn there in the middle. We
25:54 If it's simple and it's easily, easy to calculate, whichever thing
27:05 Because that's the one that it's easy to create metrics, but
30:41 All right, Lon, we have 3 questions to ask about in
32:23 Very cool. And the final question is around book recommendations. What's
34:19 Very cool. So, Milan, what do you want to leave our

MO Sadek -- Building an AppSec Program from Scratch Jan 08, 2025

Show notes

Mo Sadek shares his unique journey of building an Application Security program from scratch at Roblox. Mo discusses his unconventional path, including temporarily joining the infrastructure team to truly understand engineering challenges. He emphasizes that security isn't about mandating rules, but about making processes easier and more secure by default. Mo shares his insights on how to build effective cross-team security relationships and approaches for gaining leadership buy-in. Mo Sadek is a security transformation leader, passionate about staying ahead of emerging threats. He's built and fine-tuned vulnerability programs, customized solutions through hands-on coding, and driven security-first approaches in AI initiatives. Known for translating complex security metrics into actionable insights, Mo excels at uniting engineers, executives, and cross-functional teams.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We help enterprises reduce vulnerabilities through application security education for developers and everyone in the SDLC.
→ Learn more about Security Journey

Connect with MO Sadek:
→ Roblox
→ I Have No Mouth and I Must Scream

Mentioned in this episode:
→ Roblox
→ I Have No Mouth and I Must Scream
→ Metasploit
→ GitHub Dependabot
→ Robert Hurlbut

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet MO Sadek: Building an AppSec Program from Scratch
01:33 I can see the snow in your background there from the
06:02 Way back to the beginning of the story. So, so, so
07:18 Very cool. So jumping into the AppSec program at Roblox, you
12:41 Then, how does that, your experience working on those different disciplines
14:18 What, what, quick refine the question. Were you dotted line to
20:39 Security. And now you mentioned incident response. Did you security engineering
21:46 Mo, when you talk about, you know, the different approaches in
25:16 You talked about the importance of partnership and, you know, listening
29:35 How, how do you communicate this with senior leadership
31:47 There metrics
36:38 You mentioned, you use the term security partnership. And we certainly
38:37 There's multiple partners then in the way that you think about
44:24 All right. So lightning round, we have 3 questions that we
47:15 All right, I'm going to check that one out. That's good

Brett Crawley -- Threat Modeling Gameplay with EoP Dec 10, 2024

Show notes

Brett Crawley discusses the Elevation of Privilege (EoP) card game, a powerful tool for threat modeling in software development. The discussion explores recent extensions to the game including privacy-focused suits and TRIM (Transfer, Retention/Removal, Inference, Minimization) categories. Crawley emphasizes that threat modeling shouldn't end with the game but should be an ongoing process throughout an application's lifecycle, ideally starting before implementation. He also shares insights from his book, which provides detailed examples and guidance for teams new to threat modeling using EoP. On today's episode, we're excited to host Brett Crawley, a principal application security engineer with over 25 years in software engineering and more than a decade in AppSec.

The Application Security Podcast is brought to you by Security Journey.

Connect with Brett Crawley:
→ Brett on X
→ Threat Modeling Gameplay with EoP

Mentioned in this episode:
→ Brett on X
→ Threat Modeling Gameplay with EoP
→ Conscious Business by Fred Kofman
→ Elevation of Privilege
→ Adam Shostack
→ Threat Modeling Manifesto
→ MITRE CAPEC
→ The Security Table (podcast)

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Brett Crawley: Threat Modeling Gameplay with EoP
01:57 Yeah, it's like almost the only thing we ever talk about
05:16 Okay. Very cool. So diving into our topic today, to get
06:45 About the Elevation of Privilege card game
08:44 There a, just to clarify here, make sure I understand, we
13:26 Anybody win
15:20 Um, just to go back and revisit, uh, who created the
17:45 Well, insecure data flows or open data flows, for example, things
20:11 Then people can say, well, we've got TLS everywhere now, which
22:38 For example, privacy and trim, T-R-I-M. Could you describe those or
25:49 Can I take these cards that are extensions and put them
27:45 Um, so is the goal then that I finish the card
29:51 You mentioned from, as a key to success for a threat
38:45 All right, let's jump in the lightning round. So we have
41:06 Yes, thank you. So next question is, if you could display

Matin Mavaddat - Understanding Security as a Systemic Concern: The Role of Anti-Requirements Nov 12, 2024

Show notes

Matin Mavaddat discusses his perspective on security as a systemic concern, developed from his background in requirements engineering and systems architecture. He introduces the concept of "anti-requirements" - defining what a system should not do - and distinguishes between "syntactic security" (addressing technical vulnerabilities that are always incorrect) and "semantic security" (context-dependent security emerging from system interactions). Mavaddat shares his perspective that security itself doesn't have independent existence but rather emerges from preventing undesirable states. The discussion concludes with practical implementation strategies, suggesting that while automated tools can handle syntactic security issues, organizations should focus more energy on semantic security by understanding business context and defining anti-requirements early in the development process.

Today's episode is brought to you by Security Journey.

About Security Journey
Our education platform teaches valuable secure coding skills based on real-world vulnerabilities and threats, including OWASP Top 10.
→ Learn more about Security Journey

Connect with Matin Mavaddat:
→ Matin's article: Reframing Security: Unveiling Power Anti-Requirements
→ Systems Thinking for Curious Managers by Russell Ackoff

Mentioned in this episode:
→ Matin's article: Reframing Security: Unveiling Power Anti-Requirements
→ Systems Thinking for Curious Managers by Russell Ackoff
→ Antifragile by Nassim Nicholas Taleb
→ The Black Swan by Nassim Nicholas Taleb
→ Nassim Taleb books

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Matin Mavaddat: Understanding Security as a Systemic Concern: The Role of Anti-Requirements
01:48 So I'm excited to have Mateen join us here. And Mateen
04:17 One, one follow-up question. I read the, the article that is
10:38 Mateen, can I give you a quick example
11:42 There like, what would you say
14:20 I like that example. I'm just imagining a pile of parts
20:59 There's independent choices that drive it, right
25:33 I'm going to ask you what I think of as the
29:48 I see the challenge here, Mateen, is people that aren't going
33:29 Happens, here's another million-dollar question. I often think about, in the
41:26 All right. Well, I think we gotta, we gotta move on
47:41 Yeah. Yeah, I agree. I, I've read some of, uh, Taleb's

Kayra Otaner -- DevSecOps Oct 29, 2024

Show notes

Kayra Otaner joins the podcast today to discuss DevSecOps and answer the question, is it dead? Kayra is the Director of DevSecOps at Roche and is highly involved in the DevSecOps community. Kayra states that DevSecOps in its traditional form is “dead” and that each organization should approach its needs based on their size. Otaner introduces the concept of "security as code" and "policy as code" as more effective approaches, where security functions are codified rather than relying on traditional documentation and checklists. Finally, they discuss the emergence of Application Security Posture Management (ASPM) tools as the "SIM for AppSec," suggesting these tools, especially when enhanced with AI, could help manage the overwhelming number of security alerts and issues that currently plague development teams.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We provide diverse training content and easy-to-digest lessons to meet individual learner needs.
→ Learn more about Security Journey

Connect with Kayra Otaner:
→ Books by Yuval Noah Harari
→ Roche

Mentioned in this episode:
→ Books by Yuval Noah Harari
→ Roche
→ CISA Zero Trust Maturity Model
→ The Phoenix Project
→ OWASP DefectDojo
→ OWASP Dependency-Track
→ Phoenix Security

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Kayra Otaner: DevSecOps
01:47 I like to be controversial about our discipline. And there was
03:59 All right. Well, Kayra, I think we're going to dive right
09:28 Right
12:29 No, I agree with you there. I mean, there's definitely not
16:17 Can you gimme an example of a problem in which security
19:58 Makes sense. So what about zero trust
23:12 Yeah, so lightning round are 3 questions that we typically ask
25:34 Kero, what would be a key takeaway or a call to
27:09 Yeah. And Defect Dojo is a commercial entity now. So I
30:32 I'm going to disagree with you to some regard. I'm an

Our TOPPODCAST Picks

Follow Us

Stay Connected

The Application Security Podcast

Related Podcasts

Links

Stay Connected