The Application Security Podcast

Latest Episodes:

David Quisenberry -- Building Security, People, and Programs Jun 18, 2024

Show notes

David Quisenberry shares about his journey into the security world, insights on building AppSec programs in small to mid-sized companies, and the importance of data-driven decision-making. The conversation delves into the value of mentoring and why it's important to build real relationships with the people you work with, the vital role of trust with engineering teams, and the significance of mental health and community in the industry. David Quisenberry leads security teams at Capri Health, where he's the senior manager of information security. He's a lifetime OWASP member, former chapter president of the Portland, Oregon OWASP chapter, and co-founder of the OWASP AppSec Days PNW.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We provide diverse training content and easy-to-digest lessons to meet individual learner needs.
→ Learn more about Security Journey

Connect with David Quisenberry:
→ SRE Engineering
→ The Phoenix Project

Mentioned in this episode:
→ SRE Engineering
→ The Phoenix Project
→ Security Chaos Engineering
→ Wiring the Winning Organization
→ The Body Keeps the Score
→ Never Eat Alone
→ How Leaders Create and Use Networks
→ CISO Desk Reference Guide
→ Intelligence Driven Incident Response
→ Thinking Fast and Slow
→ Do Hard Things
→ BSIMM
→ OWASP Application Security Verification Standard (ASVS)
→ BSides

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet David Quisenberry: Building Security, People, and Programs
01:44 That's, uh, that's a t-shirt, t-shirt idea. I wish I had
04:45 Yeah. It's, it's one of those things where we're never going
06:56 Um, and I love that illustration you just made about comparing
12:43 In your experience then doing this a couple of times, do
17:28 I want to, I want to just acknowledge, I want to
19:42 That's just me. I, I, uh, yeah, I had, I had
22:52 Yeah. And I want to go there next. Um, I guess
24:08 This idea of trust with the engineering teams, because it seems
35:21 Let me, uh, let me, let me just summarize a couple
38:17 I never hear from him again. He's like, this was kind
40:54 About, let's just touch on this mental health point and just
44:29 I was just going to bring that up because it's something
47:30 We got to deal with this last one. Um, cause this
48:53 So I just kind of, the sociologist in me, this happens

Matt Rose -- Software Supply Chain Security Means Many Different Things to Different People Jun 11, 2024

Show notes

Matt Rose, an experienced technical AppSec testing leader discusses his career journey and significant contributions in AppSec. The conversation delves into the nuances of software supply chain security and exploring how different perceptions affect its understanding. Matt provides insights into the XZ compromise, critiques the buzzword 'shift left,' and discusses the role of digital twins and AI in enhancing the supply chain security. He emphasizes the need for a comprehensive approach beyond SCA, the relevance of threat modeling, and the potential risks and benefits of AI in security. Matt Rose is a technical AppSec testing leader with consistent accomplishments in sales and sales engineering management roles with more than 20 years of experience.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Our training includes theory and immersive learning that teaches the skills and knowledge needed to create a security-first mindset across your organization.
→ Learn more about Security Journey

Connect with Matt Rose:
→ LinkedIn
→ The Application Security Program Handbook by Derek Fisher

Mentioned in this episode:
→ The Application Security Program Handbook by Derek Fisher
→ ReversingLabs
→ YouTube video
→ Stephen E Ambrose
→ Mark Frost
→ Fortify (OpenText)
→ ChatGPT
→ Pixee
→ LinkedIn

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Matt Rose: Software Supply Chain Security Means Many Different Things to Different People
03:53 Let me ask you this question. How good are you at
04:45 That's true. That is so true. That's, that's a good way
11:33 Yeah, 100%. And I like to think of weaknesses in the
14:56 You're, you just made me think of something. About when you
17:12 Yeah, it seems like, it seems like there's a perfect storm
19:09 I want to double-click on something that you mentioned earlier. And
22:10 I mean, I think that's more of a startup growth problem
24:55 It the first, is it the first thing you would like
28:15 Yeah, I've never actually seen anybody do it. I've heard DJ
30:38 About, uh, AI
34:39 Yeah, I'm not, I'm not ready to embrace auto-remediation at this
37:32 Yeah. And we're starting to see a whole cottage industry of
40:14 Absolutely. The second question is, what would it say if you
41:54 Our 3rd question is, uh, what's your top book recommendation and

James Berthoty -- Is DAST Dead? And the future of API security May 31, 2024

Show notes

James Berthoty, a cloud security engineer with a diverse IT background, discusses his journey into application and product security. James highlights his career trajectory from IT operations to cloud security, his experiences with security tools like Snyk and StackHawk, and the evolving landscape of Dynamic Application Security Testing (DAST) and API security. They delve into the practical challenges of CVEs, reachability analysis, and the complexities of patching in mid-sized companies. James shares his views on the often misunderstood role of WAF and the importance of fixing issues over merely identifying them. James Berthoty has been in technology for over 10 years in engineering and security roles.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We provide application security training for not just your developers, but for all roles in your SDLC.
→ Learn more about Security Journey

Connect with James Berthoty:
→ AppSec Kool-Aid Statements I Disagree With
→ What is Art by Leo Tolstoy

Mentioned in this episode:
→ AppSec Kool-Aid Statements I Disagree With
→ What is Art by Leo Tolstoy
→ Snyk
→ StackHawk
→ AppSec Kool-Aid Statements I Disagree With
→ National Vulnerability Database (NVD)
→ eBPF
→ Kubernetes

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet James Berthoty: Is DAST Dead? And the future of API security
04:11 Mm-hmm. So when I think about your trajectory here, so you've
06:48 Let's start with this idea of DAST. And so anyone who's
10:02 So when you, when you're seeing these API scanners these days
13:07 You still using the term DAST or have you replaced it
14:49 What's your, what, what are your thoughts on this
16:42 Okay. That's helpful. What about reachability analysis
19:22 Patching really still that hard
22:43 The million dollar question then, is AI going to solve the
28:04 Yeah. I mean, fix it yourself and generate a PR, submit
32:22 I'm, I mean, let's, let's just talk about WAF and, and
36:12 Yeah, I think that's, uh, that's definitely true. Well, you got
38:01 Okay. Next. Like, celebration time. Yep. We passed. All right. So
41:29 Yeah. Yeah, definitely. So, all right, let's do a couple of
42:29 Question is, if you could have display a single message on

Mark Curphey and Simon Bennetts -- Riding the Coat Tails of ZAP, without Open Source Funding May 21, 2024

Show notes

ZAP supports an enormous share of the application security ecosystem, but who pays for the people keeping it reliable? Project founder Simon Bennetts and OWASP co-founder Mark Curphey join Chris to examine the uncomfortable economics of widely used open-source security tools. Simon describes the nontechnical work behind maintaining ZAP, from community support to managing companies that build commercial offerings on top of it. Mark explores funding structures, foundations, and the incentives that leave critical infrastructure dependent on too few people. They connect those pressures to the XZ backdoor and ask whether licenses can require commercial users to contribute. The episode makes the sustainability problem concrete: open source may be free to consume, but healthy projects still require money, time, governance, and long-term institutional support.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Mark Curphey and Simon Bennetts:
→ Mark Curphey on LinkedIn
→ Simon Bennetts on LinkedIn
→ ZAP
→ The Software Security Project

Mentioned in this episode:
→ ZAP
→ Linux Foundation
→ The Software Security Project
→ Crash Override
→ OpenSSL

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Sustaining ZAP and open-source security
00:35 From OWASP to the Linux Foundation and independence
08:48 Balancing CISO priorities with practitioner needs
11:42 Fifteen years of maintaining ZAP
12:21 The business challenges behind open-source projects
18:08 The XZ backdoor as a case study in underfunding
20:30 Commercial products built on top of ZAP
22:55 What a sustainable funding model could look like
27:56 Independent foundation or collaborative community
34:38 Can licensing require commercial users to contribute?
41:07 Final recommendations for open-source sustainability

Devin Rudnicki -- Expanding AppSec May 14, 2024

Show notes

Devon Rudnicki, the Chief Information Security Officer at Fitch Group, shares her journey of developing an application security program from scratch and advancing to the CISO role. She emphasizes the importance of collaboration, understanding the organization's business, and using metrics to drive positive change in the security program. Devin Rudnicki, the Chief Information Security Officer at Fitch Group, developed an application security program and advanced to the CISO role after years in security governance. She holds a BS in mathematics from DePaul University and multiple certifications, including CISSP, GSTRT, GSEC, and GCSA. Outside work, she enjoys group fitness, global travel, and mentoring in cybersecurity.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey is an enterprise-class solution with lessons that are built on learning science principles to deliver long-term measurable results.
→ Learn more about Security Journey

Connect with Devin Rudnicki:
→ Alice and Bob Learn Application Security
→ RSA Conference

Mentioned in this episode:
→ Alice and Bob Learn Application Security
→ RSA Conference
→ Black Hat
→ Walter Isaacson

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Devin Rudnicki: Expanding AppSec
03:05 Very cool. So the internship, security and governance, does that lead
05:03 Is that What's that approval look like as far as, is
07:28 What's the first thing that you focus on with this program
10:17 You're kind of, you're learning a little bit about the personalities
11:41 Yes, I think that's an important tactical thing that we can
14:54 Yeah. Okay. So when we, if we break the program, then
17:54 Okay. So, that's the vulnerability management side. How about developer education
20:23 In the past, I would say no to that question, and
21:18 That's, you know, you can minimize. But yeah, I mean, pen
24:49 Tracking the work. What metrics and KPIs did you use to
27:05 Yeah, and I had a similar situation in my previous time
30:03 Devin, we have 3 questions that we typically ask in the
32:59 The gene splicing therapy. We'll find it and put it in

Dustin Lehr -- Culture Change through Champions and Gamification Apr 16, 2024

Show notes

Dustin Lehr, Senior Director of Platform Security/Deputy CISO at Fivetran and Chief Solutions Officer at Katilyst Security, joins Robert and Chris to discuss security champions. Dustin explains the concept of security champions within the developer community, exploring the unique qualities and motivations behind developers becoming security advocates. He emphasizes the importance of fostering a security culture and leveraging gamification to engage developers effectively. They also cover the challenges of implementing security practices within the development process and how to justify the need for a champion program to engineering leadership. Dustin shares insights from his career transition from a developer to a cybersecurity professional, and he provides practical advice for organizations looking to enhance their security posture through community and culture-focused approaches.

Connect with Dustin Lehr:
→ Security Champion Success Guide
→ Katilyst

Mentioned in this episode:
→ Security Champion Success Guide
→ Katilyst
→ Makersschedule
→ Never Split The Difference Chris Vosstahl Raz

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Dustin Lehr: Culture Change through Champions and Gamification
02:50 Yeah, and you were, uh, on a previous episode entitled Advocating
06:29 I need you to tap back into your old development days
09:05 Cause a lot of times developers say you're living in an
11:56 Me think of, you guys ever seen the uh, Maker vs
14:47 Yeah, it's it makes me think about like the rise of
17:53 Can a developer become a champion with zero security knowledge
20:08 Yeah, I was, I was smiling a little bit when you
21:35 Does, um, what would a person who became a champion, where
24:26 Yeah, I can say one of the, one of the biggest
28:37 A little bit about, uh, on the, on the security side
35:17 You hearing anything different
40:07 Yeah, very cool. I've been, I've been following along. I've been
42:45 Perfect. And then the final question is, what's your top book

Francesco Cipollone -- Application Security Posture Management and the Power of Working with the Business Apr 09, 2024

Show notes

Francesco Cipollone, CEO of Phoenix Security, joins Chris and Robert to discuss security and explain Application Security Posture Management (ASPM). Francesco shares his journey from developer to cybersecurity leader, revealing the origins and importance of ASPM. The discussion covers the distinction between application security and product security, the evolution of ASPM from SIEM solutions, and ASPM's role in managing asset vulnerabilities and software security holistically. Francesco emphasizes the necessity of involving the business side in security decisions and explains how ASPM enables actionable, risk-based decision-making. The episode also touches on the impact of AI on ASPM. It concludes with Francesco advocating for a stronger integration between security, development, and business teams to effectively manage software security risks.

Connect with Francesco Cipollone:
→ Phoenix Security
→ Cyber For Builders

Mentioned in this episode:
→ Phoenix Security
→ Cyber For Builders

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Francesco Cipollone: Application Security Posture Management and the Power of Working with the Business
08:10 That's helpful. I'm, I'm asking this question of lots of people
10:25 Frank, today we're going to be talking about, uh, what is
13:06 You, let's, let's put the, the, let's go back in history
17:51 I want to, I want to explore another avenue that you've
23:06 Sure. Uh, so one question we wondered about in terms of
25:52 Yeah. So let's, um, let, let's kind of summarize. When we
27:31 I heard inventory was one big piece, so one of the
29:34 All right. Well, one other question we have is, I think
31:43 Yeah, I could see the kind of the pattern matching summarization
35:04 All right. Uh, our second question is, uh, what would it

Mukund Sarma -- Developer Tools that Solve Security Problems Apr 02, 2024

Show notes

Mukund Sarma, the Senior Director for Product Security at Chime, talks with Chris about his career path from being a software engineer to becoming a leader in application security. He explains how he focuses on building security tools that are easy for developers to use and stresses the importance of looking at application security as a part of the broader category of product security. Mukund highlights the role of collaboration over security mandates and the introduction of security scorecards for proactive risk management. He and Chris also discuss the strategic implementation of embedded security functions within development teams. Discover the potential of treating security as an enabling function for developers, fostering a culture of shared responsibility, and the innovative approaches Chime employs to secure its services with minimal friction for developers.

Connect with Mukund Sarma:
→ Monocle Part 1
→ Building Secure and Reliable Systems

Mentioned in this episode:
→ Monocle Part 1
→ Building Secure and Reliable Systems
→ Chime
→ Mitigating Risky Pull Requests With Monocle Risk Advisor Part 2 7013e1485bf2
→ YouTube video
→ Drive
→ Bandit

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Mukund Sarma: Developer Tools that Solve Security Problems
03:37 Yeah. Yeah. So did you, uh, start Chimes product security team
04:34 You use the words AppSec and ProdSec
08:21 I guess I want to ask kind of the, the other
10:17 That's the Overwatch. Was that the overwatch
13:26 I got to imagine they're loving it because you're making their
15:55 If I accidentally create a service that doesn't have a JSON
19:16 Yeah, John Doerr in the famous OKR book, Measure What Matters
23:03 Yeah, I mean, I think that's the ultimate gamification play, is
25:48 A big task, right
27:36 It has to be a motivational lever in the equation, right
32:43 Did you choose the order
35:18 Mm hmm. So if a, let's say somebody listening here is
37:41 Yeah, some, some more skill sets on the cross collaboration front
42:13 All right, let's do some lightning round questions. I could, we
45:12 Do you want to leave our audience with

Meghan Jacquot -- Assumed Breach Red Team Engagements for AppSec Mar 20, 2024

Show notes

AppSec specialist Megan Jacquot joins Chris and Robert for a compelling conversation about community, career paths, and productive red team exercises. Megan shares her unique cybersecurity origin story, tracing her interest in the field from childhood influences through her tenure as an educator and her formal return to academia to pivot into a tech-focused career. She delves into her roles in threat intelligence and application security, emphasizing her passion for technical work, penetration testing, and bug bounty programs. Additionally, Megan highlights the importance of mentorship, her involvement with the Women in Cybersecurity (WeCyS) community, and her dedication to fostering the next generation of cybersecurity professionals.

Connect with Meghan Jacquot:
→ WiCyS (Women in Cybersecurity)
→ Difficult Conversations

Mentioned in this episode:
→ WiCyS (Women in Cybersecurity)
→ Difficult Conversations
→ Being Henry Fonz And Beyond Henry Winkler
→ DEF CON
→ OWASP Application Security Verification Standard (ASVS)
→ ChatGPT
→ RSA Conference
→ The Phoenix Project

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Meghan Jacquot: Assumed Breach Red Team Engagements for AppSec
02:10 It there. I tried. I went all in. That was my
06:50 I'm just laughing because I, I asked, you know, college aged
10:42 Meghan, one of the things that, uh, you shared with us
13:50 It's something that happens more often than we would like to
19:14 A couple of couple of clarifying questions Do you think that
22:20 I have another scenario then, that I'm just, I don't know
24:15 I wonder about situations where you already have customers who can
26:01 I want to change, uh, topics a bit because I know
29:13 Yeah, I agree. I've had a chance to, to be on
32:51 It's for the, and I hope people are using it somewhere
35:39 You bet. Well, Meghan, our lightning round, we have three questions
36:57 Number three, uh, what's your top book recommendation and why do

Bill Sempf -- Development, Security, and Teaching the Next Generation Mar 12, 2024

Show notes

Robert is joined by Bill Sempf, an application security architect with over 20 years of experience in software development and security. Bill shares his security origins as a curious child immersed in technology, leading to his lifelong dedication to application security. They discuss CodeMash, a developer conference in Ohio, and recount Bill's presentation on the Veilid application framework, designed for privacy-driven mobile applications. Bill also explores his efforts in educating children about technology and programming, drawing on his experiences with Kidsmash and other initiatives. Additionally, they delve into the challenges of application security, particularly modern software development practices and the utility of languages like Rust for creating secure applications.

Connect with Bill Sempf:
→ Bill's homepage
→ CodeMash conference

Mentioned in this episode:
→ Bill's homepage
→ CodeMash conference
→ Veilid Application Framework
→ Math Without Numbers
→ Agile Manifesto
→ Rust
→ GitLab

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introduction
07:42 Giving Back: CodeMash and Other Conferences
12:27 Exploring Veilid: A Privacy-Driven Application Framework
16:17 Nurturing Tech-Savvy Kids
21:29 The Intersection of AppSec and Developer Conferences
26:36 Trends and Challenges in Application Security

Our TOPPODCAST Picks

Follow Us

Stay Connected

The Application Security Podcast

Related Podcasts

Links

Stay Connected