The Application Security Podcast

Latest Episodes:

Harshil Parikh -- Deep Environmental and Organizational Context in Application Security Sep 19, 2023

Show notes

Harshil Parikh is a seasoned security leader with experience building security and compliance functions from the ground up. He notably built the security and compliance team at Medallia from scratch and led it through several transitions. He is also a conference speaker, and, most recently, he co-founded Tromzo. Harshil shares insights about AppSec, running a startup, selling effectively, and provides justification for his mantra, "Context is king. Scaled the team globally, achieved compliance, SOC 2 ISO FedRAMP, went through an IPO, And secured seven mergers and acquisitions. Additionally, he's been a speaker at RSA Conference, AppSec USA, and CSX Europe. Harshil joins us to discuss developer first security, developer autonomy and guardrails, and challenges scaling AppSec programs.

Connect with Harshil Parikh:
→ The Metrics Manifesto by Richard Seiersen
→ Tromzo

Mentioned in this episode:
→ The Metrics Manifesto by Richard Seiersen
→ Tromzo

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Harshil Parikh: Deep Environmental and Organizational Context in Application Security
01:56 Yeah, that's good. That's, that's, uh, it's a good challenge or
04:47 Let's dive in a little bit to some of the work
06:57 What's your approach to get in front of the right people
10:35 It's a long, it's definitely a long term thing and that's
14:46 Mean, you don't really have to worry about having a good
20:42 Particular pushback did you get on that
23:30 Yeah, I was wondering about that in terms of guardrails. I
26:41 Does governance play in to that scaling problem that you just
33:49 There we go. All right, Harjul. Uh, so, first question is
35:06 Yeah. So, um, the next one we have is, uh, what

Jeff Williams -- The Tech of Runtime Security Sep 12, 2023

Show notes

Jeff Willams of Contrast Security joins Chris and Robert on the Application Security Podcast to discuss runtime security, emphasizing the significance of Interactive Application Security Testing (IAST) in the modern DevOps landscape. After reflecting on the history of OWASP, the conversation turns to the challenges organizations face in managing their application security (AppSec) backlogs. Jeff highlights the alarming number of unresolved issues that often pile up, emphasizing the inefficiencies of traditional security tools. Jeff Williams is a veteran application security expert who founded and led OWASP, Aspect Security, and Contrast Security. Jeff also created several highly successful open source projects, including jbom, jot, OWASP Top Ten, WebGoat, ESAPI, ASVS, and more.

Connect with Jeff Williams:
→ Jeff Williams on LinkedIn
→ Java Observability Toolkit (JOT)

Mentioned in this episode:
→ Jeff Williams on LinkedIn
→ Java Observability Toolkit (JOT)
→ Venture in Security: solving the circle sticker problem
→ Contrast Security
→ B09NRF399J
→ Brakeman

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Jeff Williams: The Tech of Runtime Security
03:51 What's the root of that problem
05:42 You're someone who's been around AppSec since the beginning of AppSec
07:27 Let's, uh, let's take a look at that. Um, what is
09:12 In your, in your AppSec program that you're building here, are
11:46 Okay. What about performance though
16:55 Hmm. So are you using the same detection and rule technology
22:15 About reachability
25:16 You think about these types of technologies, I'm curious from your
29:47 Yeah. And that's one of the things, um, one, one of
33:00 Hmm. It's funny that, that, that were the, those were the
34:56 Good. Um, next is, uh, what would it say if you
37:13 Yeah. Very cool. So Jeff, we always like to end with

Mark Curphey and John Viega -- Chalk Sep 05, 2023

Show notes

Development, operations, and security teams generate oceans of data yet still struggle to answer basic questions about what code is running, who owns it, and which findings matter. OWASP founder Mark Curphey and security veteran John Viega introduce Chalk, an open-source telemetry and observability tool designed to connect repositories, builds, deployments, and production systems. They explain how better provenance can eliminate irrelevant alerts, prioritize deployed software, trace incidents back to owners and commits, and confirm that fixes actually reached production. The conversation covers small-company and enterprise use cases, lessons from Log4Shell, performance overhead, supported platforms, and Chalk’s event model. Mark and John also discuss open-source sustainability and the Software Security Project before closing with candid views on where application security gets priorities wrong.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Mark Curphey and John Viega:
→ Mark Curphey on LinkedIn
→ John Viega on LinkedIn
→ Chalk
→ Crash Override

Mentioned in this episode:
→ Crash Override
→ Chalk
→ The Software Security Project
→ Atomic Habits
→ Start With Why
→ OWASP ZAP
→ Sigstore

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Mark Curphey and John Viega: Chalk
01:46 John’s path into application security
04:20 The de facto silos separating development and production
07:52 Chalk as telemetry for software engineering
12:12 Why startups also need production visibility
15:18 Log4Shell and the challenge of finding deployed software
17:08 How security teams can use Chalk
23:10 Chalk’s performance impact in production
25:00 Supported platforms and frameworks
28:00 Events, protocols, and outbound telemetry
42:18 Holding commercial users of open source accountable
46:32 Controversial opinions about AppSec
48:09 Industry messages, books, and closing thoughts

Maril Vernon -- You Get What You Inspect, Not What You Expect Aug 29, 2023

Show notes

Maril Vernon is passionate about Purple teaming and joins Robert and Chris to discuss the intricacies of purple teaming in cybersecurity. She underscores the significance of fostering a collaborative environment between developers and the security team. Drawing from her experiences, Maril shares the challenge of development overlooking her remediation recommendations. She engaged directly with the developers, understanding their perspective and learning to frame her remediations in developer-centric language. This approach made her recommendations actionable and bridged the communication gap between the two teams. Meryl Vernon is a senior application security architect and Purple Team program manager. Meryl is also co-host and co-founder of the Cyber Queens podcast, an all-female-led podcast aimed at increasing female and LGBTQ diversity in cybersecurity.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Meryl Vernon is a senior application security architect and Purple Team program manager.
→ Learn more about Security Journey

Connect with Maril Vernon:
→ Purple Team Exercise Framework
→ Scythe

Mentioned in this episode:
→ Purple Team Exercise Framework
→ Scythe
→ MITRE ATT&CK Framework
→ AttackIQ
→ SafeBreach
→ PlexTrac
→ Atomic Red Team
→ mitre-attack/attack-navigator
→ 9781260464009
→ The Pentester BluePrint: Starting A Career As An Ethical Hacker P 9781119684305
→ Watkins
→ The Pentester Blueprint: Starting a Career as an Ethical Hacker

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Maril Vernon: You Get What You Inspect, Not What You Expect
02:31 Yeah, I'm very, very glad to have you here. And as
04:08 Yeah, definitely. Congratulations. What sparked your interest and what led you
06:30 I think my understanding of purple teaming, I may not have
10:44 Writing your remediations in dev. I must understand... I know we're
13:13 You in the code as you're preparing your remediation
14:45 Yeah. Let's talk about collaborative methods of AppSec. So, that's sort
19:19 Can you take us through a story of purple teaming
23:36 Long is this process going
25:36 Continuing on about purple teaming, what are some— you talked a
27:30 From a vendor perspective, so you mentioned a couple of different
30:03 Do the tools, the purple team commercial tools, stack up against
31:32 Do you see purple teaming going in the future
34:32 All right. Well, Meryl, we really appreciate you joining us today
37:14 Excellent. And what's your top recommendation for those interested in security

Dan Küykendall -- Why All Application Security Products Suck Aug 22, 2023

Show notes

Dan Küykendall visits The Application Security Podcast to discuss his series "Why All AppSec Products Suck" and explain why software companies should understand the uses and limitations of any security tool. The series aims to highlight the limitations of each tool and to help users make informed decisions when selecting the right tools for their needs. In this field, there is no such thing as an expert; there is always something new to learn. Dan Küykendall is an industry leader in AppSec for 25 years with a total of 30 years in tech. He was the co-founder and CEO of NT OBJECTives until acquired by Rapid7 in 2015, where he served as Senior Director of Application Security Products until 2023.

Connect with Dan Küykendall:
→ Jeff Williams on LinkedIn
→ The Dan On Dev website

Mentioned in this episode:
→ The Dan On Dev website
→ Twitter (@dan_kuykendall)
→ Twitter (@Dan_On_Dev)
→ Instagram
→ Facebook
→ Fortify (OpenText)
→ Gary McGraw
→ Jeff Williams on LinkedIn

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Dan Küykendall: Why All Application Security Products Suck
01:55 Yeah. we got a, a, a special guest who's been doing
14:35 A good, that's a good level of curiosity though, right
21:29 Okay. So I'm gonna, I'm gonna, I'm gonna come at this
23:38 That would be, we, we can call that your kind of
29:41 Let me, let me bounce my, the reasons I don't like
42:29 Hey, Dan, let's, uh, take a look at what we have
45:30 You remember, uh, TCP/IP illustrated
47:05 Yeah. DNS doesn't use Port 80

Kevin Johnson -- Samurai Swords and Zap's Departure Aug 15, 2023

Show notes

Kevin Johnson is the CEO of Secure Ideas. He began his career as a developer but turned toward security when he discovered that the interface for an intrusion detection system, Snort, was out of date. This led him to create BASE (Basic Analysis and Security Engine), a testament to Kevin's proactive approach. Kevin came to security from a development and system administration background. He has many years of experience performing security services for Fortune 100 companies, and in his spare time, he contributes to many open source security projects. Kevin joins us to explain OWASP SamuraiWTF and how developers can successfully learn about AppSec and use AppSec web app pentest tools.

Connect with Kevin Johnson:
→ Secure Ideas
→ SamuraiWTF

Mentioned in this episode:
→ Secure Ideas
→ SamuraiWTF
→ OWASP ZAP
→ Mark Curphey
→ OWASP Top Ten
→ SANS Institute
→ SANS SEC542
→ RSA Conference
→ Black Hat
→ B-Sides
→ Kali Linux
→ Damn Vulnerable Web App (DVWA)

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Kevin Johnson: Samurai Swords and Zap's Departure
03:33 All right. We should probably talk about, uh, Kevin's security origin
13:14 Very cool. So you mentioned, uh, about, uh, open source projects
23:11 Let's, talk a little bit about, uh, SamuraiWTF a little bit
31:02 Many paid members
34:00 What, but what there, there's, there's not a clear value proposition
39:25 I mean, he had, he had, I mean, when we did
45:29 All right. Well, we can skip Robert, I think, right to
48:03 That's good. I get it. I get, I get what you're
49:33 Let's, um, let's go, let's, let's give you a chance here

Tony Quadros -- The Life of an AppSec Vendor Aug 08, 2023

Show notes

Tony Quadros, the AppSec Lumberjack, shares the unique career path that led him to find his passion in Application Security. The discussion delves into the work of an AppSec vendor, with Tony explaining his role and the responsibilities it entails. He emphasizes the importance of understanding the needs and environment of the customer, and whether the product he represents can fulfill their requirements. Tony also shares his philosophy of sales, centered around solving problems and providing business value. Tony Quadros, a cybersecurity veteran with over a decade of experience, has specialized in application security, aiding various enterprises including top social media and insurance companies in enhancing their application security programs.

Connect with Tony Quadros:
→ Chris Roberts (LinkedIn)
→ OWASP Maine

Mentioned in this episode:
→ OWASP Maine
→ OWASP Top 10 for LLM Applications
→ OWASP Slack
→ The Phoenix Project
→ Application Security Program Handbook
→ Chris Roberts (LinkedIn)
→ Contrast Security
→ Veracode
→ Steve Wilson -- OWASP Top Ten for LLMs

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Tony Quadros: The Life of an AppSec Vendor
02:22 It. That's gonna be the key. Like, I don't know how
05:16 Very cool. So you mentioned, uh, about sales and, uh, and
10:52 Yeah. And you're on, you're only as good as your last
13:42 In, in what you've seen, in your experience, what are salespeople
18:12 Uh, let's, uh, unpack this idea of building trust a little
26:35 Yeah. So let's, let's build a framework now as a vendor
31:04 Yeah. Any, uh, any other thoughts on the AE side as
33:18 Yeah. What about sales leadership
38:08 Often in startups, those numbers are hard and fast, and you
40:11 Sure. First question, what is your most controversial take on application
43:09 Very cool. Very cool. Well, let's, uh, why don't we conclude

Steve Giguere -- Cloud AppSec Jul 23, 2023

Show notes

Cloud security is on an evolutionary path, with newer platforms embracing secure-by-default settings. This has led to a significant improvement in security but also adds complexity as developers need to understand these defaults when deploying to the cloud. Steve Giguere has experienced a wide breadth of technologies throughout his career, spending the aero, telecoms, and automotive industries improving quality, safety, velocity, and efficiency. After spending many years as a solution architect, specializing in Kubernetes security and establishing DevSecOps best practices for enterprise CI/CD pipelines, he's currently a Cloud Security Advocate with Prisma Cloud by Palo Alto. Specializing in cloud and application security. Steve joins us to discuss cloud application security, the complexity that it brings, how it changes security, and predictions on how it will change the industry over the next five years.

Connect with Steve Giguere:
→ Wing programming language
→ Hacking Kubernetes (book)

Mentioned in this episode:
→ Wing programming language
→ Hacking Kubernetes (book)
→ The Web Application Hacker's Handbook
→ OWASP ZAP
→ Kubernetes
→ The Phoenix Project
→ Heartbleed
→ Robert Hurlbut

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Steve Giguere: Cloud AppSec
08:04 Yeah. So Steve, uh, this term, uh, you know, putting this
09:35 We think about complexity, you know, when I think cloud and
14:05 I was, I was working with a client and um, just
17:03 Going back for a moment to this, those terms, cloud and
19:33 You think about different organizations that you're interacting with these days
22:46 That kind of your, is that where you're directing us or
26:23 That's, I mean, that's always what we're trying to do. We're
28:02 ...retrospective on this, this cloud AppSec. Well, we'll do it from
30:07 Yeah, I was, I was, I I think there's gonna be
32:24 In vein of like, um, was it in the vein of
34:49 Nice. What would be, uh, your couple of recommendations of open

Paul McCarty -- The Burrito Analogy of the Software Supply Chain Jul 14, 2023

Show notes

"Visualizing the Software Supply Chain" is a project which aims to kick off a discussion about the scope and breadth of the software supply chain. Paul McCarty is a DevSecOps evangelist and the founder of Secure Stack, which helps software engineers and security teams collaborate better while building more secure applications. Paul is the author of several open source projects and is a collaborator on a number of others and helps run three meetups where he lives in Australia. Paul tried to be a professional snowboarder in the two thousands, but is now a skater dad who's passing his love of hacking software onto his kids.

Connect with Paul McCarty:
→ Visualizing the Software Supply Chain (GitHub)
→ DevSecOps Playbook (GitHub)

Mentioned in this episode:
→ Visualizing the Software Supply Chain (GitHub)
→ DevSecOps Playbook (GitHub)
→ SecureStack
→ OWASP DevSecOps Maturity Model (DSOMM)
→ OWASP CycloneDX
→ Minimum Viable Secure Product

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Paul McCarty: The Burrito Analogy of the Software Supply Chain
03:47 Were referred to. That. So how did, I mean, how'd you
04:53 Yeah, and I know we wanna talk about software. Supply chain
06:36 Have you thought about how software supply chain differs from other
09:52 You mentioned something that, uh, has been a bit of a
15:31 Making me super hungry for a burrito, by the. way. Like
17:33 SCV or is this source, yeah, sorry. S-C-V Source code. What's
21:00 You say, um, ser, when you say SaaS solutions there, can
22:05 And one of the things I found interesting, Paul, about this
25:20 This a project that other people could submit PRs against
27:28 I think we had, um, mentioned of the DevSecOps Playbook, and
30:33 Just to think about security some more. Um, And for developers
32:03 Paul, yeah. From a, uh, kind of a key takeaway call

Farshad Abasi -- Three Models for Deploying AppSec Resources Jul 09, 2023

Show notes

Application security teams rarely have enough specialists to embed one expert with every development team. Farshad Abasi joins Chris for a focused comparison of three staffing models he used while building enterprise AppSec programs: expert-led support, a federated risk-based model, and a security champion or deputy model. Farshad explains why dedicated experts struggle to scale, how application tiering concentrates attention on the systems that matter most, and how champions can take ownership of routine security work with coaching and escalation from AppSec. The episode offers a practical progression for organizations trying to expand coverage without pretending scarce specialists can attend every stand-up and review every user story.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Farshad Abasi:
→ Farshad Abasi on LinkedIn
→ Forward Security

Mentioned in this episode:
→ OWASP Security Champions Guide
→ Forward Security

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Three models for deploying AppSec resources
01:21 Farshad Abasi’s path from development to security
03:28 The expert-led AppSec model
05:45 A federated, risk-based model
07:31 The security champion or deputy model
08:41 Choosing a model that can scale

Our TOPPODCAST Picks

Follow Us

Stay Connected

The Application Security Podcast

Related Podcasts

Links

Stay Connected