28 mintranscript
Eric Johnson -- Continuous Integration in .NET
Security testing loses value when its results arrive outside the developer’s normal workflow.
Listen to the episodeEpisodes, page 13
310 episodes, going back to 2016.
22 mintranscript
Matt Clapham -- The Technical Debt Ceiling
Every software organization accumulates technical debt, but security debt raises the cost and risk of every future change.
Listen to the episode31 mintranscript
Chris and Robert -- Controversy within the OWASP Top 10 RC
Why did the 2017 OWASP Top 10 release candidate provoke such a strong reaction? Chris and Robert walk through the proposed categories, compare them with…
Listen to the episode54 mintranscript
Brook S.E. Schoenfield -- Security in the Design and Architecture
Fixing vulnerable code is only part of application security; a flawed design can survive every code-level check. Brook S. E.
Listen to the episode19 mintranscript
Conclusion: The End…of Season 1
What defined the first season of the Application Security Podcast? Chris and Robert revisit clips that established the show’s early themes: thinking like an…
Listen to the episode37 mintranscript
Rafal Los, James Jardine, and Michael Santarcangelo -- #DtSR and What Makes a Good Security Consultant?
What separates a useful security consultant from someone who merely arrives with answers?
Listen to the episode29 mintranscript
Adam Shostack -- Think like an Attacker or Accountant?
What does “think like an attacker” actually ask a developer to do? Adam Shostack joins Chris and Robert to challenge a familiar instruction that can leave…
Listen to the episode26 mintranscript
Jon McCoy -- The Mindset to Reverse Engineer
How does a developer learn to take software apart and use that knowledge to build it more securely?
Listen to the episode47 mintranscript
Chris Romeo -- AppSec Awareness: A Blue Print for Security Culture Change
A security awareness program needs to change daily behavior, not simply record who completed a course.
Listen to the episode37 mintranscript
Tracy Maleeff -- Natural Paranoia as a Career Path? A Transition to Security
Can a career in library science become a foundation for information security? Tracy Maleeff joins Chris and Robert while making that transition, bringing…
Listen to the episode27 mintranscript
Chris Romeo -- Security Community at Any Scale
How can a company build a security community when it has only a few interested people and little budget?
Listen to the episode38 mintranscript
Deidre Diamond -- The Soft Skills of AppSec
Technical ability can open a door in security, but communication and relationships often determine what happens next.
Listen to the episode39 mintranscript
Tony UcedaVelez -- PASTA: Not Just for Breakfast Anymore
A useful threat model should explain how an attacker could harm the business, not just complete a checklist.
Listen to the episode50 mintranscript
Glenn Leifheit -- An Inner Glimpse of the Microsoft SDL
How do you keep a secure development lifecycle useful as products, teams, and delivery methods change?
Listen to the episode37 mintranscript
Mike Landeck -- Security Must Meet the Needs of the Business
Security advice only helps when it connects to the needs of the people building and running the business.
Listen to the episode32 mintranscript
Daniel Ramsbrock -- Web Application Pen Testing – Part 2
Part two follows Daniel Ramsbrock into the practical workflow of a web application penetration test.
Listen to the episode31 mintranscript
Daniel Ramsbrock -- Web Application Pen Testing – Part 1
What should developers and security teams understand before commissioning a web application penetration test?
Listen to the episode48 mintranscript
Matt Clapham -- Development Security Maturity
Can you learn enough about a development team’s security practices in an hour to give it useful direction?
Listen to the episode22 mintranscript
Elena Elkina -- Privacy and Data Protection
Protecting data from attackers does not answer every question about privacy. Elena Elkina joins Chris and Robert to explain the relationship between…
Listen to the episode28 mintranscript
Chris and Robert -- Security in the Methodology
How should application security change when a team moves from Waterfall to Agile? Chris and Robert compare the two development models and map security work onto each one.
Listen to the episode44 mintranscript
Chris and Robert -- The Activities of the Secure Development Lifecycle
Which activities turn a secure development lifecycle from an aspiration into repeatable work?
Listen to the episode31 mintranscript
Chris and Robert -- Introductions and why #AppSec?
In the inaugural episode of the Application Security Podcast, Chris Romeo and Robert Hurlbut introduce themselves, trace the experiences that brought them…
Listen to the episode