316 episodes, going back to 2016.
How much behavior do you inherit when you add one library to a .NET application? Niels Tanis joins Chris and Robert to examine third-party risk beyond checking a dependency for known vulnerabilities.
Listen to the episodeContainers can improve your security story, but not simply because they are called containers.
Listen to the episodeWhy can a technically sound DevSecOps initiative fail before it changes how anyone works? Geoff Hill joins Chris and Robert to discuss the diplomacy behind application security transformation.
Listen to the episodeWhy did APIs need a security Top 10 of their own? Erez Yalon joins Chris and Robert to explain the gaps that led to the OWASP API Security project and walk through its original 2019 list.
Listen to the episodeHow did Microsoft's Security Development Lifecycle become a repeatable engineering practice rather than a one-time security push?
Listen to the episodeWhere should a small application security team begin when it cannot do everything? David Kosorok joins Chris and Robert with a practical framework: prevent, detect, and react.
Listen to the episodeWhat happens when Chris and Robert trade a single interview topic for five current application security ideas?
Listen to the episodeWhat happens when a threat model has to account for patient privacy and clinical harm as well as attackers?
Listen to the episodeIs becoming a CISO the next technical promotion, or a fundamentally different job? Marc French joins Chris and Robert to discuss the role through the eyes of an application security leader.
Listen to the episodeSeason 5 covered application security from tools and threat models to mentoring, self-care, coaching, dependency risk, and program design.
Listen to the episodeWhich parts of an AppSec program should change as a company grows, and which should stay the same?
Listen to the episodeWhy doesn't an executive mandate and a scanning tool add up to a software security program?
Listen to the episodeDevelopers may want to own security, but what helps them turn that intention into safer software? Liran Tal joins Chris and Robert to examine Snyk's 2019 State of Open Source Security research.
Listen to the episodeWhy should developers care about open source security when they already have features, testing, accessibility, and performance to manage?
Listen to the episodeAn SCA tool can find vulnerable libraries and still leave important software supply-chain questions unanswered.
Listen to the episodeWhat does OWASP Dependency-Track add beyond a conventional software composition analysis scanner?
Listen to the episodeSecurity testing is more likely to happen when it fits the way developers already work.
Listen to the episodeWhy should kindness matter in an industry responsible for protecting money, systems, and sometimes lives?
Listen to the episodeSecurity programs improve when developers have someone who can help them want to get better, not merely tell them what they did wrong.
Listen to the episodeWhat would an application security conference look like inside DEF CON? Erez Yalon and Liora Herman explain how a volunteer idea became the Application…
Listen to the episodeWhy did DEF CON have villages for specialized security communities but no home dedicated to application security? Erez Yalon explains how that recurring question became AppSec Village.
Listen to the episodeSoftware producers, customers, and policymakers need a common way to discuss security without pretending that one checklist fits every product.
Listen to the episodeWhat if a system works exactly as designed but gives people new ways to harm one another?
Listen to the episodeWhy threat model when AppSec teams already have scanners, checklists, and testing?
Listen to the episode