33 mintranscript
Magen Wu -- Hustle and Flow: Dealing With Burnout in Security
In a profession that rewards constant vigilance, how do you recognize when dedication has become burnout?
Listen to the episodeEpisodes, page 12
310 episodes, going back to 2016.
25 mintranscript
Katy Anton -- OWASP Top 10 #4 XXE
A feature built into XML processing can become a path to file disclosure, internal requests, or denial of service.
Listen to the episode35 mintranscript
Pete Chestna -- SAST, DAST, and IAST. Oh My!
Buying more scanners does not automatically create a better application security program.
Listen to the episode33 mintranscript
Irene Michlin -- We Are Not Making It Worse
When a team is already ten sprints into a product, stopping to threat model everything can sound impossible.
Listen to the episode34 mintranscript
Bill Sempf -- Insecure Deserialization
What happens when data arriving at an application is allowed to recreate objects and trigger unexpected behavior?
Listen to the episode27 mintranscript
Chris and Robert -- Security Champions
What is a security champion, and how can an organization build a program that lasts? Chris and Robert compare definitions, alternative titles, and the qualities that make a champion effective.
Listen to the episode33 mintranscript
Kevin Greene -- Shifting left
Moving a security scanner earlier in the pipeline is not the same as building security into development.
Listen to the episode32 mintranscript
Conclusion: OWASP is for everyone
Why does OWASP matter beyond its famous Top 10 list? The Season 2 finale revisits guests who demonstrate the breadth of the foundation’s work.
Listen to the episode30 mintranscript
Brian Andrzejewski -- Containers Again
Containers make deployment repeatable, but insecure images, excessive privileges, and unmanaged secrets can travel with them.
Listen to the episode23 mintranscript
Tin Zaw -- ModSecurity and #AppSec
A web application firewall can buy time during a vulnerability crisis, but only if somebody understands and maintains its rules.
Listen to the episode24 mintranscript
Aditya Gupta -- The Exploitation of IoT
Why can an IoT product look secure in one component and still fail as a complete system?
Listen to the episode20 mintranscript
Jim Manico and Katy Anton -- The Future of the OWASP Proactive Controls
Where should the OWASP Proactive Controls go after giving developers a concise defensive counterpart to the Top 10?
Listen to the episode36 mintranscript
Andrew van der Stock and Brian Glas -- The Future of the OWASP Top 10
How should the OWASP Top 10 balance data, expert judgment, community feedback, and a format people can actually use?
Listen to the episode47 mintranscript
Robert Hurlbut -- Threat Modeling
How do you find security problems in a design before they become expensive changes to running software?
Listen to the episode32 mintranscript
Chris and Robert -- Passwords, Identity, and #AppSec
Password advice changes as attackers, hardware, and identity standards evolve. Chris and Robert examine how passwords are guessed, cracked, stored, and…
Listen to the episode35 mintranscript
Tanya Janca and Nicole Becher -- Hacking APIs and Web Services with DevSlop
APIs may lack a visible interface, but that does not make them hidden or safe. Tanya Janca and Nicole Becher use OWASP DevSlop and its Pixi application to…
Listen to the episode45 mintranscript
Jon Mccoy and Jonathan Marcil -- Agile #AppSec
Agile delivery promises fast feedback, but where does application security fit when teams are already moving continuously?
Listen to the episode45 mintranscript
Jay Beale -- Docker Security and AppSec
Does moving an application into Docker make it safer, or simply change the risks you need to manage?
Listen to the episode23 mintranscript
Chris and Robert -- Proactive Controls, AppSec USA, and Gartners MQ on AppSec Testing
What can practitioners learn from a new OWASP document, an upcoming conference, and an industry analyst report in one conversation?
Listen to the episode21 mintranscript
Robert Hurlbut -- Blackhat Security Conference
What should an application security professional take away from a conference famous for spectacular hacks?
Listen to the episode44 mintranscript
Dave Ferguson -- The OWASP Top 10 Proactive Controls
Developers hear plenty about vulnerabilities, but what should they actually build into their applications to prevent them?
Listen to the episode37 mintranscript
Jim Manico -- MORE OWASP!
How can developers turn OWASP’s many projects into practical help with the code they write?
Listen to the episode32 mintranscript
Mike Goodwin -- The OWASP Threat Dragon
Threat modeling is easier to adopt when its tools fit the way developers already work.
Listen to the episode40 mintranscript
Mark Willis -- I Just Like Static Analysis. Static Analysis is My Favorite
Static analysis can help developers find security flaws early, but buying a scanner does not create an effective program.
Listen to the episode