28 mintranscript
Chris and Robert: A Taste of Hi-5
What happens when Chris and Robert trade a single interview topic for five current application security ideas?
Listen to the episodeEpisodes, page 9
310 episodes, going back to 2016.
32 mintranscript
Bill Dougherty — INCLUDES NO DIRT, practical threat modeling for healthcare and beyond
What happens when a threat model has to account for patient privacy and clinical harm as well as attackers?
Listen to the episode44 mintranscript
Marc French — The AppSec CISO
Is becoming a CISO the next technical promotion, or a fundamentally different job? Marc French joins Chris and Robert to discuss the role through the eyes of an application security leader.
Listen to the episode38 mintranscript
Season 5 Finale — A cross section of #AppSec
Season 5 covered application security from tools and threat models to mentoring, self-care, coaching, dependency risk, and program design.
Listen to the episode38 mintranscript
Ronnie Flathers — Security programs big and small
Which parts of an AppSec program should change as a company grows, and which should stay the same?
Listen to the episode45 mintranscript
Brook Schoenfield — Security is a messy problem
Why doesn't an executive mandate and a scanning tool add up to a software security program?
Listen to the episode34 mintranscript
Liran Tal — The state of open source software security
Developers may want to own security, but what helps them turn that intention into safer software? Liran Tal joins Chris and Robert to examine Snyk's 2019 State of Open Source Security research.
Listen to the episode3 mintranscript
Liran Tal — Open Source Security — 5 Minute AppSec
Why should developers care about open source security when they already have features, testing, accessibility, and performance to manage?
Listen to the episode51 mintranscript
Steve Springett — An insiders checklist for Software Composition Analysis
An SCA tool can find vulnerable libraries and still leave important software supply-chain questions unanswered.
Listen to the episode5 mintranscript
Steve Springett — OWASP Dependency Track — 5 Minute AppSec
What does OWASP Dependency-Track add beyond a conventional software composition analysis scanner?
Listen to the episode29 mintranscript
Elissa Shevinsky — Static Analysis early and often
Security testing is more likely to happen when it fits the way developers already work.
Listen to the episode2 mintranscript
Elissa Shevinsky — Be Kind, Security People — 5 Minute AppSec
Why should kindness matter in an industry responsible for protecting money, systems, and sometimes lives?
Listen to the episode44 mintranscript
Matt McGrath — Security coaches
Security programs improve when developers have someone who can help them want to get better, not merely tell them what they did wrong.
Listen to the episode23 mintranscript
Erez Yalon and Liora Herman – The Application Security Village @ DefCon
What would an application security conference look like inside DEF CON? Erez Yalon and Liora Herman explain how a volunteer idea became the Application…
Listen to the episode2 mintranscript
Erez Yalon – AppSec Village – 5 Minute AppSec
Why did DEF CON have villages for specialized security communities but no home dedicated to application security? Erez Yalon explains how that recurring question became AppSec Village.
Listen to the episode37 mintranscript
Tommy Ross — The BSA Framework for Secure Software
Software producers, customers, and policymakers need a common way to discuss security without pretending that one checklist fits every product.
Listen to the episode36 mintranscript
Adam Shostack — Threat modeling layer 8 and conflict modeling
What if a system works exactly as designed but gives people new ways to harm one another?
Listen to the episode2 mintranscript
Adam Shostack – Threat Modeling – 5 Minute AppSec
Why threat model when AppSec teams already have scanners, checklists, and testing?
Listen to the episode26 mintranscript
Zoe Braiterman — AI, ML, AppSec, and a dose of data protection
Artificial intelligence can help analyze security data, but the systems using it also need protection themselves.
Listen to the episode41 mintranscript
Caroline Wong — Self-care and self-aware for security people
A successful security career can still become unsustainable when work crowds out everything else.
Listen to the episode29 mintranscript
Björn Kimminich — The new JuiceShop, GSOC, and Open Security Summit
How do you keep an intentionally vulnerable application useful while its underlying frameworks keep fixing bugs?
Listen to the episode5 mintranscript
Björn Kimminich — JuiceShop — 5 minute AppSec
What makes OWASP Juice Shop useful to developers when many intentionally vulnerable applications feel dated?
Listen to the episode38 mintranscript
Nancy Gariché and Tanya Janca — DevSlop, the movement
How does an intentionally vulnerable application become a community learning movement?
Listen to the episode5 mintranscript
Tanya Janca — Mentoring Monday — 5 Minute AppSec
Security needs more experienced practitioners, but people do not become senior without guidance, advocacy, and opportunities to learn.
Listen to the episode