The Application Security Podcast

Latest Episodes:

Hendrik Ewerlin -- Threat Modeling of Threat Modeling Mar 05, 2024

Show notes

Robert and Chris talk with Hendrik Ewerlin, a threat modeling advocate and trainer. Hendrik believes you can threat model anything, and he recently applied threat modeling to the process of threat modeling itself. His conclusions are published in the document Threat Modeling of Threat Modeling, where he aims to help practitioners, in his own words, "tame the threats to the threat modeling process. Hendrik Ewerlin loves to build secure software and empower people to do so. He strongly believes in the power of threat modeling. He provides threat modeling training and helps software vendors who are new to threat modeling and want to improve the security of their systems.

Connect with Hendrik Ewerlin:
→ Hendrik Ewerlin
→ Threat Modeling of Threat Modeling

Mentioned in this episode:
→ Hendrik Ewerlin
→ Threat Modeling of Threat Modeling
→ Austin Kleon books
→ Adam Shostack
→ Threat Modeling Manifesto
→ OWASP SAMM

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Hendrik Ewerlin: Threat Modeling of Threat Modeling
02:44 Exciting adventure called application security
04:53 Let them build something when they're, when they're in their teens
07:21 Very meta, which I know is a word from a few
10:23 Is your approach, uh, to threat modeling and threat modeling programs
11:39 Yeah, I did notice that you, you took, you took various
14:51 And getting on the same plane. So, I know one of
18:11 There some other things that you discovered as you were working
20:39 Document. So one of the things, Hendrick, that I noticed about
25:01 Yeah, and I love where you went with that. One of
27:56 Enough people like me smile. You, so you wrote mitigation debt
30:36 All right, three questions. First one is, what's your most controversial
32:20 Okay. And the third question is, uh, what's your top book

Jason Nelson -- Three Pillars of Threat Modeling Success: Consistency, Repeatability, and Efficacy Feb 27, 2024

Show notes

Jason Nelson, an accomplished expert in information security management, joins Chris to share insights on establishing successful threat modeling programs in data-intensive industries like finance and healthcare. Jason presents his three main pillars to consider when establishing a threat modeling program: consistency, repeatability, and efficacy. The discussion also provides a series of fascinating insights into security practices, regulatory environments, and the value of a threat modeling champion. As a threat modeling practitioner, Jason provides an essential perspective to anyone serious about application security. Jason Nelson is an information security executive focused on building programs and directing teams in highly regulated financial healthcare and insurance industries.

Connect with Jason Nelson:
→ FINOS Common Cloud Controls
→ NIST OSCAL

Mentioned in this episode:
→ FINOS Common Cloud Controls
→ NIST OSCAL
→ MITRE ATT&CK
→ Malware Analyst's Cookbook
→ Threat Modeling: A Practical Guide for Development Teams
→ Schneier on Security
→ The Security Table (podcast)
→ Start With Why

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introduction
02:13 Security Origin Story
07:48 Threat Modeling the Cloud
16:44 Threat Modeling Pillar One: Consistency
27:30 A Threat Modeling Champion
33:35 Threat Modeling Pillar Two: Repeatability
39:07 Threat Modeling Pillar Three: Efficacy
48:09 Lightning Round

Erik Cabetas -- Cracking Codes on Screen and in Contests: An Expert's View on Hacking, Vulnerabilities, and the Evolution of Cybersecurity Language Feb 17, 2024

Show notes

Erik Cabetas joins Robert and Chris for a thought-provoking discussion about modern software security. They talk about the current state of vulnerabilities, the role of memory-safe languages in AppSec, and why IncludeSec takes a highly systematic approach to security assessments and bans OWASP language. Along the way, Erik shares his entry into cybersecurity and his experience consulting about hacking for TV shows and movies. The conversation doesn't end before they peek into threat modeling, software engineering architecture, and the nuances of running security programs. Eric Cabetas has more than two decades of experience in InfoSec. His previous posts include senior roles at Ernst Young, Fortify Software, and theladders.

Connect with Erik Cabetas:
→ Security Engineering by Ross Anderson
→ IncludeSec

Mentioned in this episode:
→ Security Engineering by Ross Anderson
→ IncludeSec
→ New School Of Information Security 9780132800280
→ DEF CON
→ OWASP Top Ten
→ Rust
→ Go
→ OpenSSF
→ RSA Conference

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introduction
01:32 Security Origin Story
04:28 Winning DEF CON CTF
08:36 Hollywood Hacking Consultant
15:05 The Current State of Vulnerabilities
26:45 Memory Safe Languages
35:19 Banning OWASP Language?
41:26 Lighting Round

Justin Collins -- Enabling the Business to Move Faster, Securely Feb 06, 2024

Show notes

Justin Collins of Gusto joins Robert and Chris for a practical conversation about running security teams in an engineering-minded organization. Justin shares his experience leading product security teams, the importance of aligning security with business goals, and the challenges arising from the intersection of product security and emerging technologies like GenAI. Justin Collins currently heads up security at Gusto. In the past, he's been an AppSec engineer at SurveyMonkey, Twitter, and AT&T Interactive. He's also the primary author of Brakeman, a free static analysis security tool for Ruby on Rails. We explore security partners, GRC and privacy intersections, and the challenges that GenAI will bring to product security over the next five years.

Connect with Justin Collins:
→ The DevOps Handbook
→ Gusto

Mentioned in this episode:
→ The DevOps Handbook
→ Gusto
→ Brakeman
→ Ruby on Rails
→ Ruby
→ Content-Security-Policy (MDN)
→ The DevOps Handbook

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Justin Collins: Enabling the Business to Move Faster, Securely
04:23 Rest, as they say, is history, right
08:47 Hmm. Cool, thanks. Um, Robert, why don't you take us into
12:51 What's been the response from the business to this statement where
15:50 You think it's, do you think ProdSec is easier in a
20:51 Yeah. I think that's, that's, that's, that's advice worth gold right
23:58 You mentioned a couple things, uh, that sound like good keys
26:50 Hm, So in the last, uh, I guess, number of years
31:21 Yeah. that's true. I want to give a special shout out
35:43 It SQL injection. It's vulnerable or it's not. It's, we don't
38:31 All right. So the lightning round is three questions that we
40:33 I mean, we have to end the interview now, but other
42:43 Very cool. All right. And the final one is, uh, what's
44:51 Yeah, that's true. All right. Well, Justin, how about a key

Kyle Kelly -- The Dumpster Fire of Software Supply Chain Security Jan 30, 2024

Show notes

Kyle Kelly joins Chris to explore the wild west of software supply chain security. Kyle, author of the CramHacks newsletter, sheds light on the complicated and often misunderstood world of software supply chain security. He brings unique insights into the challenges, issues, and potential solutions in this constantly growing field. From his experiences in sectors like cybersecurity and security research, he adapts a critical perspective on the state of the software supply chain, suggesting it is in a 'dumpster fire' state. We'll dissect that incendiary claim and discuss the influence of open-source policies, the role of GRC, and the importance of build reproducibility. From starters to experts, anyone with even a mild interest in software security and its future will find this conversation enlightening.

Connect with Kyle Kelly:
→ CramHacks
→ Solve for Happy by Mo Gawdat

Mentioned in this episode:
→ CramHacks
→ Solve for Happy by Mo Gawdat
→ Semgrep
→ Log4j
→ OWASP Dependency-Track
→ OpenSSF
→ OpenSSF Scorecard
→ GitHub Dependabot
→ ReversingLabs
→ Roblox
→ Black Hat

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Kyle Kelly: The Dumpster Fire of Software Supply Chain Security
04:23 Very cool. Very cool. So let's, let's, uh, engage on this
08:27 Yeah, I mean, so when you think about SolarWinds then, and
09:39 Yeah, I think at the end of the day, many of
11:43 Okay. And so let's come back around to the, to the
19:13 I think the reality is nobody actually does. Because it's not
23:09 I think that's a good way to get fired as well
24:30 Mean, that's a great, it's a great practice. If you have
30:11 Yeah. And that, that just, I mean, it gets to the
31:39 Yeah. And then you've got like the scorecard, right
34:13 Good luck with that. I think you will get zero total
37:11 Yeah, I mean, there's, there's some truth to that in the
40:14 Alright. How about a key takeaway or a call to action

Chris Hughes -- Software Transparency Jan 20, 2024

Show notes

Chris Hughes, co-founder of Aquia, joins Chris and Robert on the Application Security Podcast to discuss points from his recent book Software Transparency: Supply Chain Security in an Era of a Software-Driven Society, co-authored with Tony Turner. The conversation touches on the U. government in the software supply chain, the definition and benefits of software transparency, the concept of a software bill of materials (SBOM), and the growth of open-source software. Chris Hughes is a proven cloud cybersecurity leader. with nearly 20 years of experience in the federal and commercial industries. Chris has a dynamic skill set with a blend of IT, cyber cloud security, and DevSecOps experience.

Connect with Chris Hughes:
→ Software Transparency: Supply Chain Security in an Era of a Software-Driven Society
→ Application Security Program Handbook

Mentioned in this episode:
→ Software Transparency: Supply Chain Security in an Era of a Software-Driven Society
→ Application Security Program Handbook
→ Agile Application Security
→ CNCF Catalog of Supply Chain Compromises
→ Aquia
→ Software Transparency: Supply Chain Security in an Era of a Software-Driven Society
→ OpenSSF
→ OpenSSL
→ Let's Encrypt
→ Sigstore
→ Minimum Viable Secure Product
→ Executive Order 14028
→ Agile Application Security: Enabling Security in a Continuous Delivery Pipeline
→ The Application Security Program Handbook by Derek Fisher

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Chris Hughes: Software Transparency
03:42 Yeah, and you're, uh, you're co author of the latest book
04:31 Yeah, one thing that I kind of went down the thought
08:13 Yeah, yeah, and I think it's going to become a bigger
09:37 I think we've got, uh, we've got a couple different angles
11:52 Yeah, that's, that's always, you know, security and privacy, not privacy
15:32 I mean, that's why, when you think about one of the
17:01 Yeah, we're talking about the funding of nation states. Right, they
20:10 Yeah. So I've, uh, you know, I've kind of been waiting
22:48 Yeah. This is a weird situation in the sense that, you
25:14 Yeah. I mean, it's definitely a real risk. Uh, I feel
28:54 Yeah, that's, that's, but that's the reality of the, the world
31:51 All right. Well, let's, uh, let's talk about the, the kind
35:23 A billboard, what would it say for a message if you
37:14 Then, uh, yeah, Derek, excuse me, Derek was a guest on

Jay Bobo & Darylynn Ross -- App Sec Is Dead. Product Security Is the Future. Jan 09, 2024

Show notes

Is application security dead, or does it need to grow into something larger? CoverMyMeds security leaders Jay Bobo and Darylynn Ross challenge the traditional AppSec model and argue for product security that follows business risk across the whole product. They compare centralized security teams with security specialists embedded in engineering, explain where threat modeling and automated testing belong, and discuss how to give developers useful SAST findings without drowning them in tool output. The conversation then turns to communication: executives need risk, impact, and business context rather than raw vulnerability details. Jay and Darylynn also question the industry’s reflexive reliance on penetration testing and share practical advice for aligning security work with product outcomes, engineering workflows, and the people responsible for shipping software.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Darylynn Ross and Jay Bobo:
→ Darylynn Ross on LinkedIn
→ Jay Bobo on LinkedIn
→ CoverMyMeds

Mentioned in this episode:
→ How to Measure Anything in Cybersecurity Risk, 2nd Edition
→ Kristin Hannah
→ CoverMyMeds
→ GitHub Dependabot

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Is AppSec dead? Meet Darylynn Ross and Jay Bobo
03:11 Jay’s path from development into security
04:23 Why traditional AppSec needs to become product security
09:21 Embedding security expertise inside development teams
20:24 Product security compared with application security
23:46 Threat modeling and risk at the product level
26:49 Giving developers useful SAST results
34:46 Aligning security work with business value
36:44 Communicating vulnerabilities across the organization
40:18 Turning technical findings into executive risk
43:07 Controversial opinions about AppSec
44:53 Questioning the industry’s reliance on penetration tests
47:07 Book recommendations
49:27 Key takeaways from Darylynn and Jay

Eitan Worcel -- Is AI a Security Champion? Dec 19, 2023

Show notes

Eitan Worcel joins the Application Security Podcast, to talk automated code fixes and the role of artificial intelligence in application security. We start with a thought-provoking discussion about the consistency and reliability of AI-generated responses in fixing vulnerabilities like Cross-Site Scripting (XSS). The conversation highlights a future where AI on one side writes code while AI on the other side fixes it, raising questions about the outcomes of such a scenario. We're thrilled to host Eitan Worcel, the co founder and CEO of Mobb, and a seasoned AppSec expert with 15 years of experience. From his early days as a developer to his current role as a business leader, Eitan has been at the forefront of detecting security issues.

Connect with Eitan Worcel:
→ The Hard Thing About Hard Things by Ben Horowitz
→ The Hard Thing About Hard Things Ben Horowitz

Mentioned in this episode:
→ The Hard Thing About Hard Things by Ben Horowitz
→ The Hard Thing About Hard Things Ben Horowitz
→ ChatGPT
→ AppScan Standard (HCL)
→ Carnegie Mellon University Software Engineering Institute
→ OWASP Juice Shop
→ GitHub Copilot
→ Veracode

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Eitan Worcel: Is AI a Security Champion?
02:29 Luckily it's, you know, it's not easy being me is what
03:54 Understood. Understood. So typically when, uh, somebody joins us in the
08:01 Yeah. I mean, I'm gonna let Robert go next though. So
13:34 It's about trust. It's about, it's about like with this, with
18:12 That a common thing that's happening behind the scenes in the
20:13 Right, let's, uh, let's wrap back around here and start talking
23:05 Then what's, how, how do things, how is it different from
25:42 I mean, it sounds like that's a human function still, like
28:37 I like what you just were saying about predictability because you're
30:42 About how do we prevent the introduction of new vulnerabilities with
32:58 Does the AI handle complex, multi layered security issues in the
34:08 Yeah. I mean, that's, that's my next question. So where, you
37:04 Uh, what advice would you give an organization that's trying to
40:23 Yeah. Yeah. There's a privacy angle in there, uh, for the
41:58 You see, um, a world in AI where we'll have the
45:30 Okay. Number two, billboard message. What would it say if you

Björn Kimminich -- OWASP Juice Shop Dec 12, 2023

Show notes

Bjorn Kimminich, the driving force behind the OWASP Juice Shop project, joins Chris and Robert to discuss all things Juice Shop. The OWASP Juice Shop is a deliberately vulnerable web application that serves as an invaluable training tool for security professionals and enthusiasts. Bjorn provides a comprehensive overview of the latest features and challenges introduced in the Juice Shop, underscoring the project's commitment to simulating real-world security scenarios. We're excited to have Bjorn Kiminich with us, a prominent figure in the application security world. As the product group lead application ecosystem at Kuhn plus Nagel, Bjorn is pivotal in shaping the AppSec program within the corporate IT landscape.

Connect with Björn Kimminich:
→ OWASP Juice Shop
→ Pwning OWASP Juice Shop

Mentioned in this episode:
→ OWASP Juice Shop
→ Pwning OWASP Juice Shop
→ OWASP Juice Shop Jingle
→ MultiJuicer
→ multi-juicer GitHub
→ OWASP Cheat Sheet Series
→ MetaMask

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Björn Kimminich: OWASP Juice Shop
01:55 With Hoff, come on, we're, yeah, we're just kidding. This is
04:54 Wait, what do you mean by that
08:02 That's all in Great. On the Web3 side, you've built a
09:26 That a new dependency now
12:52 We talked about some of the user challenges and UI updates
17:08 Another, uh, thing from the list here, um, we've talked with
20:57 Yeah, and you mentioned coding challenges. Uh, we forgot to talk
24:20 How, uh, how big is the Juice Shop team these days
26:09 Yeah, definitely. And, and, uh, yes, I mean, thanks to you
29:17 Alright, so we have three questions that we ask. So the
32:41 Uh, so number three, uh, what's your top book recommendation and
34:14 Bjorn, we're, as we wrap up our conversation here, what's, uh

Arshan Dabirsiaghi -- Security Startups, AI Influencing AppSec, and Pixee/Codemodder.io Dec 05, 2023

Show notes

Arshan Dabirsiaghi of Pixee joins Robert and Chris to discuss startups, AI in appsec, and Pixee's Codemodder. io. This leads to a lengthy and convoluted process for fixing security issues, a problem that Arshan and his team have been working to address through their open-source tool, Codemodder. Arshan's journey from co founding Contrast with Jeff Williams to his current endeavors is filled with invaluable insights and lessons that have shaped the cybersecurity landscape. This is Chris Romeo. I am the CEO of Devici and also a general partner at Kerr Ventures, joined as always by my partner in crime, even though we don't do any crime, but my partner in crime, Robert Hurlbut.

Connect with Arshan Dabirsiaghi:
→ Arshan Dabirsiaghi
→ Pixee

Mentioned in this episode:
→ Pixee
→ Pixee's Codemodder.io
→ Hacking: The Art of Exploitation, Vol. 2
→ Aleph One's "Smashing The Stack for Fun and Profit"
→ Tim Newsham's "Format String Attacks"
→ Matt Conover's "w00w00 on Heap Overflows"
→ Jeremiah Grossman
→ Justin Rosenstein's original codemod on GitHub
→ Contrast Security
→ Arshan Dabirsiaghi
→ Semgrep
→ GitHub Copilot
→ Stack Overflow
→ Fortify (OpenText)
→ Aquia
→ FindBugs

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Arshan Dabirsiaghi: Security Startups, AI Influencing AppSec, and Pixee/Codemodder.io
04:23 Yeah, that's definitely is a seminal work. That, uh, doesn't get
06:48 Uh, Arshan, you mentioned, uh, uh, some of the things that
09:17 You work with those guys at Aspect
13:53 Yeah, 100%. And, like, my, the, the practice that I've adopted
16:39 Yeah. Cause I mean, in the startup world, you're going to
25:31 Yeah. And my conclusion so far, when it comes to generative
29:25 Yeah, it makes me think of the, of the The previous
35:31 Mean, we have to approach the, the world of technology as
37:01 Arshan, you mentioned your company, Pixee, and some of the things
45:43 This is a framework that others can contribute to, given that
47:58 What's the, what's kind of the check and balance, I guess
51:24 Yeah, so we have three questions. Uh, so first one is
53:09 Makes sense. What would it say if you could display a
54:36 Last question. What's your top book recommendation and why do you

Our TOPPODCAST Picks

Follow Us

Stay Connected

The Application Security Podcast

Related Podcasts

Links

Stay Connected