35 mintranscript
Jessica Robinson and Vandana Verma-- WIA: Women in #AppSec
How can application security become a field where more women enter, contribute, and advance?
Listen to the episodeEpisodes, page 11
310 episodes, going back to 2016.
17 mintranscript
Karen Staley -- A Conversation with Karen
What should OWASP members expect from the foundation’s executive leadership, and how can a global nonprofit remain connected to its volunteer community?
Listen to the episode27 mintranscript
Mohammed Imran -- Back to the Lab Again with a DevOps
Learning DevSecOps is hard when setting up the lab becomes a project of its own. Mohammed Imran introduces DevSecOps Studio, an environment designed to help…
Listen to the episode29 mintranscript
Niels Tanis -- A Slice of the Razor with ASP.Net Core
Framework defaults can prevent common vulnerabilities, but developers still need to understand when their code bypasses those protections.
Listen to the episode27 mintranscript
Ofer Maor -- A Pen Testers Transition to #AppSec: #VoteForOfer
Finding vulnerabilities is only part of improving software security; the harder work is changing how people build and operate applications.
Listen to the episode22 mintranscript
Matt Tesauro -- #AppSec Pipeline as Toolbox
How can a small AppSec team make sense of thousands of applications and a growing pile of security work?
Listen to the episode22 mintranscript
Stephen de Vries -- Threat Modeling with a bit of #Startup
What developers need from a threat model is often a clear set of requirements they can implement.
Listen to the episode34 mintranscript
Julien Vehent -- Securing DevOps
Can security become a normal part of DevOps without turning every release into an audit? Julien Vehent, author of Securing DevOps, shares what his team learned protecting Firefox services at Mozilla.
Listen to the episode25 mintranscript
Christian Folini -- CRS and an Abstraction Layer
How can one open-source rule set protect applications across competing products and very different architectures?
Listen to the episode25 mintranscript
Sean Wright -- Google Chrome and the Case of the Disappearing HTTP
What changed when Chrome began labeling ordinary HTTP pages as not secure, and why did that decision provoke resistance?
Listen to the episode29 mintranscript
Conclusion: All the Pieces You Need for an #AppSec Program
Which practices belong in a complete application security program? The Season 3 finale answers by assembling clips that move from early development…
Listen to the episode31 mintranscript
Martin Knobloch -- OWASP, Reach Out; We Are Known and Misunderstood
OWASP is widely recognized, but do people understand the community behind its famous Top 10?
Listen to the episode30 mintranscript
Devin McMasters -- Bug Bounty with a Side of Empathy
A bug bounty can create a productive relationship with security researchers—or damage trust on both sides.
Listen to the episode23 mintranscript
Apollo Clark -- Malicious User Stories
How do you turn a security requirement into something a development team can build and test?
Listen to the episode18 mintranscript
Megan Roddie -- Neurodiversity in Security
Could familiar hiring and management practices be keeping talented people out of security?
Listen to the episode31 mintranscript
Chase Schultz -- AppSec and Hardware
Where does application security end when software controls bootloaders, firmware, processors, and connected devices?
Listen to the episode30 mintranscript
John Melton -- #OWASP AppSensor
Your application knows when a user does something that should be impossible, but does that knowledge help stop an attack?
Listen to the episode37 mintranscript
David Habusha -- Third Party Software is not a Cathedral, It’s a Bazaar
An application can inherit serious vulnerabilities from code its developers never wrote.
Listen to the episode48 mintranscript
Steve Springett -- Dependency Check and Dependency Track
Finding a vulnerable library in one build is only the beginning: how do you find every affected application across an organization?
Listen to the episode33 mintranscript
Steven Wierckx -- The #OWASP Threat Modeling Project
Can a threat modeling community bring different methods together without forcing everyone into the same process?
Listen to the episode31 mintranscript
Jim Manico -- The #OWASP Cheat Sheet Project
Developers need concrete security answers, but finding trustworthy guidance can take longer than writing the code.
Listen to the episode34 mintranscript
Neil Smithline -- OWASP Top 10 #10: Logging
A log file does little good if nobody can use it to detect or investigate an attack.
Listen to the episode43 mintranscript
Jim Routh -- Selling #AppSec Up The Chain
What if the strongest argument for funding application security is better software delivery rather than fear of a breach?
Listen to the episode29 mintranscript
Chris and Robert -- #AppSec Recommendations
Which books, sites, conferences, and communities are genuinely useful for learning application security? Chris and Robert compare their personal recommendations and explain what each resource offers.
Listen to the episode