Kristen Tan and Vaibhav Garg -- Machine Assisted Threat Modeling
Can machines make threat modeling faster without stripping away the judgment that makes it useful?
Listen to the episodeEpisodes, page 6
316 episodes, going back to 2016.
Patrick Dwyer -- CycloneDX and SBOMs
Patrick is a Senior Product Security Engineer in the Application Security team at ServiceNow. He is also Co-Leader of the OWASP CycloneDX project.
Listen to the episodeOmer Gil and Daniel Krivelevich -- Top 10 CI/CD Security Risks
CI/CD systems hold code, credentials, and production access, yet many organizations still treat them as internal plumbing rather than a critical attack surface.
Listen to the episodeJosh Grossman -- Building a High-Value AppSec Scanning Program
Josh Grossman has over 15 years of experience in IT Risk and Application Security consulting, and he has also worked as a software developer.
Listen to the episodeAlex Mor -- Application Risk Profiling at Scale
Alex Mor is a passionate cybersecurity defender or breaker depending on the time of day, providing expert technical guidance to product teams and building security in their platforms.
Listen to the episodeBrenna Leath -- Product Security Leads: A different way of approaching Security Champions
Brenna Leath is currently the Head of Product Security for a data analytics company where she sets the application security strategy for R&D and leads a team of security architects.
Listen to the episodeWill Ratner -- Centralized container scanning
Will Ratner is a software security professional with extensive experience building and implementing security solutions across a myriad of industries…
Listen to the episodeNeil Matatall -- AppSec at Scale
Neil Matatall is an engineer with a background in security. He has previously worked at GitHub and Twitter and is a co-founder of Loco Moco Product Security Conference.
Listen to the episodeJoern Freydank -- Security Design Anti Patterns Limit Security Debt
Joern Freydank is a Lead Cyber Security Engineer with more than 20 years of experience. He is currently establishing the Threat Modeling Program at a major insurance company.
Listen to the episodeKen Toler -- Blockchain, Cloud, and #AppSec
Ken Toler is a principal consultant at Kudelski Security and is passionate about building and optimizing application security programs that stick through strong adoption and ease of use.
Listen to the episodeJeroen Willemsen and Ben de Haan -- Dirty little secrets
Secrets management fails in surprisingly ordinary ways: credentials land in code, deployment files, containers, and cloud resources, then quietly become part of the system’s attack surface.
Listen to the episodeAdam Shostack -- Fast, cheap and good threat models
Adam is a leading expert on threat modeling, and a consultant, expert witness, author and game designer. He has decades of experience delivering security.
Listen to the episodeLoren Kohnfelder -- Designing Secure Software
Ochaun Marshall is an Application Security Consultant. In his roles of secure ideas, he works on on-going development projects utilizing Amazon web services and breaks other people's web applications.
Listen to the episode36 mintranscript
Ochaun Marshall -- IaC and SAST
Infrastructure as code gives security teams something they have wanted for years: a readable description of the systems surrounding an application.
Listen to the episodeSimon Bennetts -- Using OWASP Zap across an Enterprise
Simon Bennetts is the OWASP Zed Attack Proxy (ZAP) Project Leader and a Distinguished Engineer at StackHawk, a company that uses ZAP to help users fix…
Listen to the episodeTimo Pagel -- DevSecOps Maturity Model
Timo Pagel has been in the IT industry for over fifteen years. After a system administrator and web developer career, he advises customers as a DevSecOps consultant and trainer.
Listen to the episodeMazin Ahmed -- Terraform Security
Mazin Ahmed is a security engineer that specializes in AppSec and offensive security.
Listen to the episode54 mintranscript
James Ransome and Brook Schoenfield -- trust and verify: Building in Security at Agile Speed
Why do application security programs stall even after teams buy tools and define processes? James Ransome and Brook S. E.
Listen to the episodeOWASP Top 10 2021 Peer Review
Chris and Robert conduct a practitioner peer review of the 2021 OWASP Top 10, examining what changed, what moved, and what the new structure communicates to development teams.
Listen to the episodeAnastasiia Voitova -- Encryption is easy, key management is hard
Adding encryption is easy; designing a system that protects keys, metadata, and users is much harder.
Listen to the episodeEran Kinsbruner -- DevSecOps Continuous Testing
Mark Loveless - aka Simple Nomad - is a security researcher and hacker. He's spoken at numerous security and hacker conferences worldwide, including Blackhat, DEF CON, ShmooCon, and RSA.
Listen to the episode36 mintranscript
Mark Loveless -- Threat modeling in a DevSecOps environment.
Threat modeling needs to fit the way developers work if it is going to survive a fast delivery cycle.
Listen to the episodeJeroen Willemsen -- Security automation with ci/cd
Jeroen Willemsen is a Principal Security Architect at Xebia. Jeroen is more or less a jack of all trades with an interest in infrastructure security, risk management, and application security.
Listen to the episodeThinking back, Looking forward - A Balanced Approach to Securing our Software Future
Software security has spent decades alternating between prevention, detection, and response. Kevin Greene joins Chris and Robert to ask what a balanced approach should look like now.
Listen to the episode