316 episodes, going back to 2016.
What can practitioners learn from a new OWASP document, an upcoming conference, and an industry analyst report in one conversation?
Listen to the episodeWhat should an application security professional take away from a conference famous for spectacular hacks?
Listen to the episodeDevelopers hear plenty about vulnerabilities, but what should they actually build into their applications to prevent them?
Listen to the episodeHow can developers turn OWASP’s many projects into practical help with the code they write?
Listen to the episodeThreat modeling is easier to adopt when its tools fit the way developers already work.
Listen to the episodeStatic analysis can help developers find security flaws early, but buying a scanner does not create an effective program.
Listen to the episodeSecurity testing loses value when its results arrive outside the developer’s normal workflow.
Listen to the episodeEvery software organization accumulates technical debt, but security debt raises the cost and risk of every future change.
Listen to the episodeWhy did the 2017 OWASP Top 10 release candidate provoke such a strong reaction? Chris and Robert walk through the proposed categories, compare them with…
Listen to the episodeFixing vulnerable code is only part of application security; a flawed design can survive every code-level check. Brook S. E.
Listen to the episodeWhat defined the first season of the Application Security Podcast? Chris and Robert revisit clips that established the show’s early themes: thinking like an…
Listen to the episodeWhat separates a useful security consultant from someone who merely arrives with answers?
Listen to the episodeWhat does “think like an attacker” actually ask a developer to do? Adam Shostack joins Chris and Robert to challenge a familiar instruction that can leave…
Listen to the episodeHow does a developer learn to take software apart and use that knowledge to build it more securely?
Listen to the episodeA security awareness program needs to change daily behavior, not simply record who completed a course.
Listen to the episodeCan a career in library science become a foundation for information security? Tracy Maleeff joins Chris and Robert while making that transition, bringing…
Listen to the episodeHow can a company build a security community when it has only a few interested people and little budget?
Listen to the episodeTechnical ability can open a door in security, but communication and relationships often determine what happens next.
Listen to the episodeA useful threat model should explain how an attacker could harm the business, not just complete a checklist.
Listen to the episodeHow do you keep a secure development lifecycle useful as products, teams, and delivery methods change?
Listen to the episodeSecurity advice only helps when it connects to the needs of the people building and running the business.
Listen to the episodePart two follows Daniel Ramsbrock into the practical workflow of a web application penetration test.
Listen to the episodeWhat should developers and security teams understand before commissioning a web application penetration test?
Listen to the episodeCan you learn enough about a development team’s security practices in an hour to give it useful direction?
Listen to the episode