The Application Security Podcast

Latest Episodes:

Dr. Jared Demott -- Cloud Security & Bug Bounty Nov 28, 2023

Show notes

Chris and Robert are thrilled to have an insightful conversation with Dr. Jared Demott, a seasoned expert in the field of cybersecurity. The discussion traverses a range of topics, from controversial opinions on application security to the practical aspects of managing bug bounty programs in large corporations like Microsoft. Hey folks, we're thrilled to welcome Dr. Jared DeMott, a cybersecurity veteran who started his journey at the NSA and has since made significant contributions to the world of AppSec. From teaching at renowned conferences and universities to leading successful startups focused on malware, monitoring, and pen testing, Jared's done it all. Currently, he's making waves at Microsoft, leading a team dedicated to safeguarding products and customers by transforming bug bounty reports into crucial fixes for cloud services.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Hey folks, we're thrilled to welcome Dr.
→ Learn more about Security Journey

Connect with Jared Demott:
→ Microsoft Security Response Center (MSRC)
→ Content-Security-Policy (MDN)

Mentioned in this episode:
→ Microsoft Security Response Center (MSRC)
→ Content-Security-Policy (MDN)

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introduction and Background
03:06 Dr. Jared DeMott's Journey into Cybersecurity
10:46 The Role at Microsoft and the Bug Bounty Program
14:52 The Top Vulnerabilities in Cloud and Online Services
35:37 The Labor Shortage in Cybersecurity: A Hot Take
42:14 Conclusion and Key Takeaways

Katharina Koerner -- Security as Responsible AI Nov 20, 2023

Show notes

Dr. Katarina Koerner, a renowned advisor and community builder with expertise in privacy by design and responsible AI, joins Chris and Robert to delve into the intricacies of responsible AI in this episode of the Application Security Podcast. She explores how security intersects with AI, discusses the ethical implications of AI's integration into daily life, and emphasizes the importance of educating ourselves about AI risk management frameworks. She also highlights the crucial role of AI security engineers, the ethical debates around using AI in education, and the significance of international AI governance. This discussion is a deep dive into the world of AI, privacy, security, and ethics, offering valuable insights for tech professionals, policy makers, and individuals alike.

Connect with Katharina Koerner:
→ UNESCO Recommendation on the Ethics of Artificial Intelligence
→ OECD AI Principles

Mentioned in this episode:
→ UNESCO Recommendation on the Ethics of Artificial Intelligence
→ OECD AI Principles
→ White House Blueprint for an AI Bill of Rights
→ NIST AI Risk Management Framework
→ Microsoft Responsible AI Standard, v2
→ ENISA Securing Machine Learning Algorithms
→ Google Secure AI Framework (SAIF)
→ Artificial Intelligence
→ Ipd
→ Failure Modes In Machine Learning
→ Google Ai Red Team Digital Final
→ The Ethical Algorithm 9780190948207

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introduction: Dr. Koerner and Responsible AI
02:22 Dr. Katarina Koerner's Journey into the World of Security
05:31 Understanding Responsible AI Principles
17:20 The Intersection of Privacy and AI
36:59 The Future of AI Security
47:06 Final Thoughts and Call to Action

Ray Espinoza -- The AppSec CISO, Vendor Relationships, and Mentoring Nov 15, 2023

Show notes

What does an application security leader need to know before stepping into the CISO role? Ray Espinoza joins Chris and Robert to share lessons from becoming a first-time CISO, aligning security work with business priorities, and building a culture where developers take pride in secure craftsmanship. Ray explains how he evaluates tools without confusing activity for impact, what good vendor relationships look like from the buyer’s side, and why empathy and credibility matter when security teams ask engineering teams to change. The conversation closes with practical advice on mentorship, leadership, and measuring whether an AppSec program is actually helping the business.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Ray Espinoza:
→ Ray Espinoza on LinkedIn

Mentioned in this episode:
→ Extreme Ownership

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Ray Espinoza and the AppSec CISO
01:54 From eBay to security leadership
04:59 Lessons from becoming a first-time CISO
08:26 Learning from failure without repeating it
11:29 How much security knowledge a CISO needs
15:57 Leading security in a smaller company
20:49 Aligning AppSec with business priorities
26:45 Choosing tools and evaluating vendors
30:44 Measuring security outcomes instead of activity
38:54 Building productive vendor relationships
42:13 Mentorship and growing security leaders
47:34 The leadership lightning round

Chris John Riley -- MVSP: Minimum Viable Secure Product Nov 07, 2023

Show notes

Chris John Riley joins Chris and Robert to discuss the Minimum Viable Secure Product. MVSP is a minimalistic security checklist for B2B software and business process outsourcing suppliers. It was designed by a team that included experts from Google, Salesforce, Okta, and Slack. The MVSP objectives are targeted at startups and other companies creating new applications, helping such organizations meet security standards expected by larger enterprises like Google. The MVSP is designed to be accessible for users, as a way to streamline the process of vendor assessment and procurement from the start to the contractual control stages. We're thrilled to have Chris John Reilly, the driving force behind Google's Minimum Viable Secure Product Initiative, MVSP for short.

Connect with Chris John Riley:
→ Minimum Viable Secure Product
→ Cybersecurity Myths and Misconceptions

Mentioned in this episode:
→ Minimum Viable Secure Product
→ Cybersecurity Myths and Misconceptions
→ Phantoms in the Brain: Probing the Mysteries of the Human Mind
→ Phantoms in the Brain: Probing the Mysteries of the Human Mind
→ SLSA
→ NIST SP 800-53
→ PCI DSS

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Chris John Riley: MVSP: Minimum Viable Secure Product
02:24 At one of your recording locations. I was so jealous. I'm
07:34 We want to dive in, Chris, on, on MVSP, uh, minimum
10:49 MVSP apply if I'm in Enterprise then
13:01 Can you take us through the kind of the origin story
17:15 Hmm. Mm hmm. You mentioned that, uh, a number of the
20:42 Let me read back then the use case for MVSP and
22:00 I mean, that's one of the key benefits there is really
24:48 Yeah, that makes sense. And, and, you know, you mentioned contractual
27:43 Yeah. So we try and break out the controls into four
35:11 Yeah, I don't see anything that's, that I'm looking at this
37:48 Okay. So you might have to, you might have to do
39:54 Right. And, and it's often, often a misconsideration where people look
42:26 MVSP is designed to be Evolutionary, not revolutionary, right
45:06 I don't know if my views are controversial. Um, I mean
46:48 Excellent. And then a third question is, uh, what's your top

Steve Wilson and Gavin Klondike -- OWASP Top Ten for LLM Release Oct 31, 2023

Show notes

The first OWASP Top 10 for Large Language Model Applications gave developers and security teams a shared threat model for a rapidly changing technology. Project leaders Steve Wilson and Gavin Klondike walk through the inaugural list and explain why familiar controls need to be reconsidered around probabilistic systems. They cover prompt injection, insecure output handling, training-data poisoning, denial of service, supply-chain vulnerabilities, sensitive information disclosure, insecure plugin design, excessive agency, overreliance, and model theft. Along the way, they distinguish application risks from attacks on the underlying model and show how plugins and autonomous actions can enlarge the blast radius. The episode closes with what the project learned from community feedback and how the list would evolve as real-world LLM deployments exposed new failure modes.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Steve Wilson and Gavin Klondike:
→ Steve Wilson on LinkedIn
→ Gavin Klondike on LinkedIn
→ OWASP GenAI Security Project

Mentioned in this episode:
→ OWASP Top Ten for LLM Applications project homepage
→ OWASP Top 10 For LLMs 2023 Slides V1 1
→ ChatGPT
→ LangChain
→ Tay (Microsoft chatbot)
→ DEF CON

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introducing the OWASP Top 10 for LLM Applications
01:37 A threat model for large language models
05:39 Risk 1 — Prompt injection
09:00 Risk 2 — Insecure output handling
11:35 Risk 3 — Training-data poisoning
15:14 Risk 4 — Model denial of service
19:11 Risk 5 — Supply-chain vulnerabilities
28:16 Risk 6 — Sensitive information disclosure
33:28 Risk 7 — Insecure plugin design
38:27 Risk 8 — Excessive agency
42:39 Risk 9 — Overreliance
46:31 Risk 10 — Model theft
49:56 Lessons for the next release

Tanya Janca -- What Secure Coding Really Means Oct 24, 2023

Show notes

Tanya Janca, also known as SheHacksPurple, joins the Application Security Podcast again to discuss secure coding, threat modeling, education, and other topics in the AppSec world. With a rich background spanning over 25 years in IT, coding, and championing cybersecurity, Tanya delves into the essence of secure coding. We're honored to host the remarkable Tanya Janca, widely recognized as SheHacksPurple. Tanya is a brilliant mind behind the best selling book, Alice and Bob Learn Application Security, and the founder of WeHackPurple, a comprehensive platform dedicated to teaching the art of creating secure software. With a rich journey spanning over 25 years in IT, coding, and championing cyber security, Tanya has donned many hats, from serving in public sectors to leading at tech giants, and from founding trailblazing companies to spearheading community initiatives.

Connect with Tanya Janca:
→ Tanya Janca on LinkedIn
→ Alice and Bob Learn Application Security

Mentioned in this episode:
→ Alice and Bob Learn Application Security
→ WeHackPurple
→ This is How They Tell Me the World Ends
→ Tanya Janca (SheHacksPurple)
→ Alice and Bob Learn Application Security
→ Semgrep
→ r2c / Semgrep Inc.
→ Rust
→ Ruby
→ Ruby on Rails
→ Node.js
→ Adam Shostack
→ OWASP DevSlop Project

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Tanya Janca: What Secure Coding Really Means
03:04 So I think, uh, we wanted to kind of start diving
05:23 Yeah, you can't get away with that, right
17:35 That's why they're not our ex staff. I like that one
22:34 This is a bit of a softball question But coding and
27:50 Yeah. And I, my experience, I've seen what I like to
37:29 Yeah, it's so cool. And I was checking in our archive
38:58 Intro into the lightning round. All right. Uh, Tanya, we have
43:15 Next question. Uh, what would it say if you could display

Hasan Yasar -- Actionable SBOM via DevSecOps Oct 16, 2023

Show notes

Hasan Yasar believes that everyone shares the responsibility of creating a secure environment, and this can only be achieved by working collaboratively. He underscores the idea that security is not an isolated endeavor but a collective effort, urging everyone to come together and build a world where safety and security are paramount. We're honored to have Hasan Yasar, the technical director of the Continuous Deployment of Capability Group at the renowned Software Engineering Institute at Carnegie Mellon University. With over 25 years of experience in secure software development, Hasan is at the forefront of leveraging emerging tech like DevSecOps, AI, ML, and more to drive transformation in software development.

Connect with Hasan Yasar:
→ Software Transparency: Supply Chain Security in an Era of a Software-Driven Society
→ Cybersecurity First Principles: A Reboot of Strategy and Tactics

Mentioned in this episode:
→ Software Transparency: Supply Chain Security in an Era of a Software-Driven Society
→ Cybersecurity First Principles: A Reboot of Strategy and Tactics
→ Carnegie Mellon University Software Engineering Institute
→ Software Transparency: Supply Chain Security in an Era of a Software-Driven Society
→ Software Transparency
→ Software Transparency: Supply Chain Security in an Era of a Software-Driven Society by Chris Hughes, Tony Turner
→ SPDX
→ Log4j

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Hasan Yasar: Actionable SBOM via DevSecOps
02:17 Yeah, we're going to unpack SBOM, as our listeners know, one
05:30 Caught my attention when you mentioned F-16 simulators and Secure by
11:22 We're heading, we're heading towards a world where... There's, there's, you
17:12 Yeah. And I think, you know, I think there is a
21:07 No, it was great, great conversation. Uh, uh, just quick aside
23:47 I know we've heard in your history, you've talked about some
31:38 Uh, so Hasan, uh, you've talked about or mentioned the term
34:46 Does that work
37:34 Does that work from a speed perspective
43:09 All right. So Hasan, we have, we have three questions. So
45:06 Excellent. And what's your top book recommendation

Varun Badhwar -- The Developer Productivity Tax Oct 10, 2023

Show notes

Varun Badhwar is a three-time founder, a luminary in the cyber security industry, and a clear communicator. He joins Chris and Robert on the Application Security Podcast to discuss scanning with context, SBOM plus VEX, and the developer productivity tax. The concept of a "Developer Productivity Tax" acknowledges the challenges developers face when bombarded with a plethora of vulnerabilities. This "tax" represents the drain on developers' time and resources as they navigate through a myriad of potential threats, many of which lack actionable context. The inefficiencies arising from this process can lead to significant delays in software development, emphasizing the need for more refined tools and techniques.

Connect with Varun Badhwar:
→ Endor Labs
→ The Hard Thing About Hard Things by Ben Horowitz

Mentioned in this episode:
→ Endor Labs
→ The Hard Thing About Hard Things by Ben Horowitz
→ Software Transparency: Supply Chain Security in an Era of a Software-Driven Society by Chris Hughes, Tony Turner
→ OWASP Dependency-Track

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Varun Badhwar: The Developer Productivity Tax
02:11 You got to broadcast from wherever you are. So Robert is
05:47 Yeah, very cool. So, let's, let's dive into that. You know
08:39 CVSS. Because I know you've written a lot about CVSS, and
11:51 Whenever I, whenever I hear about reachability, I'm always curious to
15:00 Okay. So, here's another question for you. Uh, we've heard this
19:13 So the perfect state in the future will be a tool
21:06 I mean, I think it's gotta be a hundred percent to
28:52 Yeah, you might as well have a result. You might, you
31:48 There a consolidation coming in our market
35:22 All right. Next question. Uh, what would it say if you
36:40 Cool. Yeah, Tony Turner's a past guest. Chris Hughes is a

OWASP Board of Directors Debate Oct 03, 2023

Show notes

Six candidates for the 2023 OWASP Board of Directors debate the choices that shape the foundation and its community. Paulino Calderon, Steve Springett, Avi Douglen, Izar Tarandach, Sam Stepanyan, and Fred Donovan discuss the experience they would bring to the board, their priorities if elected, and how OWASP should support projects as open source changes. Chris and Robert press the candidates on declining membership, vendor neutrality, and the role of revenue from global events. The result is a direct comparison of competing ideas about governance, community growth, project health, and how the board can keep OWASP useful to practitioners around the world.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with OWASP:
→ OWASP Foundation
→ OWASP Global Board

Mentioned in this episode:
→ OWASP CycloneDX
→ OWASP Dependency-Track
→ OWASP DefectDojo
→ ZAP
→ OWASP ASVS
→ OWASP Developer Guide

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 The 2023 OWASP board candidate debate
01:37 Candidate introductions and governing experience
09:36 The candidates’ priorities for OWASP
17:49 The future of OWASP open source projects
25:48 Reversing the decline in OWASP membership
34:29 Protecting vendor neutrality
41:54 Using proceeds from global events
46:41 Candidate responses and points of disagreement
58:20 Closing statements from the candidates

Itzik Alvas -- Secrets Security and Management Sep 26, 2023

Show notes

Itzik Alvas, Co-founder and CEO of Entro, is an expert on secrets security. Itzik joins Chris and Robert to discuss the significance of understanding and managing secrets, emphasizing the importance of knowing how many secrets an organization has, where they are located, and their potential impact. He elaborates on the three pillars of secrets management: listing and locating secrets, classifying and understanding their potential blast radius, and monitoring them for any abnormal behavior. Itzik Alvas started his cybersecurity journey 17 years ago, when he was selected to join the elite cybersecurity unit of the IDF, Israel Defense Forces. He was introduced to the cybersecurity ecosystem there and gained enormous knowledge and experience on a nation state level.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Itzik Alvas started his cybersecurity journey 17 years ago, when he was selected to join the elite cybersecurity unit of the IDF, Israel Defense Forces.
→ Learn more about Security Journey

Connect with Itzik Alvas:
→ Entro
→ Foundation by Isaac Asimov

Mentioned in this episode:
→ Entro
→ Foundation by Isaac Asimov
→ Ringworld by Larry Niven
→ Seveneves by Neal Stephenson
→ Azure Key Vault
→ Aquia

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Itzik Alvas: Secrets Security and Management
02:03 We are, we are the original application security podcast. Like we
04:28 I understand. I've never been a CISO, so I can't say
07:06 I can imagine. So just to dive into our topic today
09:35 That's a big, that's a big number. I'm still stuck on
13:07 I guess another, another part of the program is how you
16:02 Yeah. Yeah. So I feel like we've, we've kind of explored
19:16 Definitely make sure I keep aware, but I'm sure there is
21:33 That's true. That's true. I mean, the Lambdas of the world
24:32 You're, you're advocating for almost like a secrets workflow management approach
28:03 You talked about, um, deleting, so, you know, I think about
32:47 We'll do. All right. So, um, what's your most controversial opinion
35:02 Very cool. And then finally, what's your top book recommendation

Our TOPPODCAST Picks

Follow Us

Stay Connected

The Application Security Podcast

Related Podcasts

Links

Stay Connected