28 mintranscript
Matt Clapham — A perspective on appsec from the world of medical software
Security teams learn something different when they leave their own conferences and listen to the industries using their products.
Listen to the episodeEpisodes, page 10
310 episodes, going back to 2016.
25 mintranscript
Jon McCoy — Hacker outreach
How can hackers and corporate security teams work together when each sees the other through a different set of assumptions?
Listen to the episode37 mintranscript
Omer Levi Hevroni — K8s can keep a secret?
Putting an application in Kubernetes does not solve the problem of getting secrets to it safely.
Listen to the episode29 mintranscript
Izar Tarandach — Command line threat modeling with pytm
What if developers could describe threats in the same place they describe their software?
Listen to the episode25 mintranscript
Simon Bennetts — OWASP ZAP: past, present, and future
How do you make a powerful security testing tool approachable to the developers who need it?
Listen to the episode20 mintranscript
Bill Sempf — Growing AppSec People and KidzMash
The shortage of AppSec practitioners will not disappear just by posting more job openings.
Listen to the episode19 mintranscript
Georgia Weidman — Mobile, IoT, and Pen Testing
A secure mobile application can still sit on a compromised device or depend on an insecure cloud service.
Listen to the episode19 mintranscript
Conclusion: Season 4 Finale
What stood out across a season spanning DevOps, pipelines, community, chaos engineering, dependency risk, and IoT?
Listen to the episode47 mintranscript
Geoff Hill -- Rapid Threat Model Prototyping Process
What happens when a threat model takes days to produce but the development team has already moved on?
Listen to the episode44 mintranscript
Bill Wilder -- Running Azure Securely
Moving an application to Azure changes which security controls you operate yourself and which ones the platform can provide.
Listen to the episode36 mintranscript
Matt Konda -- OWASP Glue
Developers need useful findings in their workflow, not another collection of security tools to operate by hand.
Listen to the episode31 mintranscript
Josh Grossman, Avi Douglen, and Ofer Maor -- AppSec in Israel and Three Talks to watch from AppSec USA
What can the wider AppSec community learn from Israel’s unusually dense security ecosystem?
Listen to the episode45 mintranscript
Daniel Miessler -- OWASP IoT Top 10
An IoT product’s attack surface extends well beyond the device in the box. Daniel Miessler explains that broader view while walking Chris and Robert through the 2018 OWASP IoT Top 10.
Listen to the episode22 mintranscript
Travis McPeak -- SecOps Makes Developers Lives Easier
What if a security team measured success partly by making developers’ work easier? Travis McPeak explains that approach to SecOps through concrete examples from Netflix’s cloud environment.
Listen to the episode32 mintranscript
Chris Romeo -- Security Culture Hacking: Disrupting the Security Status Quo
Changing security culture requires more than distributing policies or buying another training platform.
Listen to the episode30 mintranscript
Jim Manico -- The Extremely Unabridged History of SQLi and XSS
Why are SQL injection and cross-site scripting still with us after years of knowing how to prevent them?
Listen to the episode44 mintranscript
Jeff Williams -- The History of OWASP
OWASP became a reference point for software security, but it began with people sharing knowledge and trying to solve problems together.
Listen to the episode37 mintranscript
Bjorn Kimminich -- The Joy of the Vulnerable Web: JuiceShop
Can an intentionally broken online shop help change an organization’s security culture?
Listen to the episode28 mintranscript
Swaroop Yermalkar -- iGoat and iOS Mobile Pen Testing
Mobile apps can hide credentials, expose powerful backend access, and repeat familiar web security mistakes.
Listen to the episode36 mintranscript
Adam Bacchus and Jon Bottarini -- Two Sides to a Bug Bounty: The Researcher and The Program
What does a bug bounty look like from both sides of the relationship? Adam Bacchus and Jon Bottarini of HackerOne compare the responsibilities of the…
Listen to the episode31 mintranscript
Erlend Oftedal -- What You Require, You Must Also Retire
A JavaScript library can keep working long after its security problems become public.
Listen to the episode28 mintranscript
Abhay Bhargav -- Threat Modeling as Code
A threat model that lives in an old document rarely keeps pace with the code it describes.
Listen to the episode31 mintranscript
Tony UV -- Threat Libraries in the Cloud
A list of weaknesses is not the same thing as an understanding of the threats facing a business.
Listen to the episode37 mintranscript
Aaron Rinehart -- Chaos Engineering and #AppSec
How do you know a security control will work when the system around it fails? Aaron Rinehart introduces chaos engineering as a way to test assumptions about…
Listen to the episode