26 mintranscript
Zoe Braiterman — AI, ML, AppSec, and a dose of data protection
Artificial intelligence can help analyze security data, but the systems using it also need protection themselves.
Listen to the episodeEpisodes, page 10
316 episodes, going back to 2016.
41 mintranscript
Caroline Wong — Self-care and self-aware for security people
A successful security career can still become unsustainable when work crowds out everything else.
Listen to the episode29 mintranscript
Björn Kimminich — The new JuiceShop, GSOC, and Open Security Summit
How do you keep an intentionally vulnerable application useful while its underlying frameworks keep fixing bugs?
Listen to the episode5 mintranscript
Björn Kimminich — JuiceShop — 5 minute AppSec
What makes OWASP Juice Shop useful to developers when many intentionally vulnerable applications feel dated?
Listen to the episode38 mintranscript
Nancy Gariché and Tanya Janca — DevSlop, the movement
How does an intentionally vulnerable application become a community learning movement?
Listen to the episode5 mintranscript
Tanya Janca — Mentoring Monday — 5 Minute AppSec
Security needs more experienced practitioners, but people do not become senior without guidance, advocacy, and opportunities to learn.
Listen to the episode28 mintranscript
Matt Clapham — A perspective on appsec from the world of medical software
Security teams learn something different when they leave their own conferences and listen to the industries using their products.
Listen to the episode25 mintranscript
Jon McCoy — Hacker outreach
How can hackers and corporate security teams work together when each sees the other through a different set of assumptions?
Listen to the episode37 mintranscript
Omer Levi Hevroni — K8s can keep a secret?
Putting an application in Kubernetes does not solve the problem of getting secrets to it safely.
Listen to the episode29 mintranscript
Izar Tarandach — Command line threat modeling with pytm
What if developers could describe threats in the same place they describe their software?
Listen to the episode25 mintranscript
Simon Bennetts — OWASP ZAP: past, present, and future
How do you make a powerful security testing tool approachable to the developers who need it?
Listen to the episode20 mintranscript
Bill Sempf — Growing AppSec People and KidzMash
The shortage of AppSec practitioners will not disappear just by posting more job openings.
Listen to the episode19 mintranscript
Georgia Weidman — Mobile, IoT, and Pen Testing
A secure mobile application can still sit on a compromised device or depend on an insecure cloud service.
Listen to the episode19 mintranscript
Conclusion: Season 4 Finale
What stood out across a season spanning DevOps, pipelines, community, chaos engineering, dependency risk, and IoT?
Listen to the episode47 mintranscript
Geoff Hill -- Rapid Threat Model Prototyping Process
What happens when a threat model takes days to produce but the development team has already moved on?
Listen to the episode44 mintranscript
Bill Wilder -- Running Azure Securely
Moving an application to Azure changes which security controls you operate yourself and which ones the platform can provide.
Listen to the episode36 mintranscript
Matt Konda -- OWASP Glue
Developers need useful findings in their workflow, not another collection of security tools to operate by hand.
Listen to the episode31 mintranscript
Josh Grossman, Avi Douglen, and Ofer Maor -- AppSec in Israel and Three Talks to watch from AppSec USA
What can the wider AppSec community learn from Israel’s unusually dense security ecosystem?
Listen to the episode45 mintranscript
Daniel Miessler -- OWASP IoT Top 10
An IoT product’s attack surface extends well beyond the device in the box. Daniel Miessler explains that broader view while walking Chris and Robert through the 2018 OWASP IoT Top 10.
Listen to the episode22 mintranscript
Travis McPeak -- SecOps Makes Developers Lives Easier
What if a security team measured success partly by making developers’ work easier? Travis McPeak explains that approach to SecOps through concrete examples from Netflix’s cloud environment.
Listen to the episode32 mintranscript
Chris Romeo -- Security Culture Hacking: Disrupting the Security Status Quo
Changing security culture requires more than distributing policies or buying another training platform.
Listen to the episode30 mintranscript
Jim Manico -- The Extremely Unabridged History of SQLi and XSS
Why are SQL injection and cross-site scripting still with us after years of knowing how to prevent them?
Listen to the episode44 mintranscript
Jeff Williams -- The History of OWASP
OWASP became a reference point for software security, but it began with people sharing knowledge and trying to solve problems together.
Listen to the episode37 mintranscript
Bjorn Kimminich -- The Joy of the Vulnerable Web: JuiceShop
Can an intentionally broken online shop help change an organization’s security culture?
Listen to the episode