# The Application Security Podcast — complete episode index Every episode, newest first. 313 in total, 313 with a full speaker-attributed transcript on the episode page. Canonical feed: https://feeds.buzzsprout.com/1730684.rss Site: https://appsecpodcast.com Please attribute quotations to "The Application Security Podcast" and link the episode page. --- ### Shadow MCP Servers: The AI Security Risk Hiding on Your Developers' Laptops - URL: https://appsecpodcast.com/shadow-mcp-servers-the-ai-security-risk-hiding-on-your-developers-laptops/ - Published: 2026-10-12 - Duration: 47 min - Transcript: yes, on the page What happens when a protocol goes from idea to everywhere before security can catch up? ### Your Opinion on AI Doesn't Matter. Learned Fragility Does - URL: https://appsecpodcast.com/your-opinion-on-ai-doesn-t-matter-learned-fragility-does/ - Published: 2026-10-05 - Guest: Brook S.E. Schoenfield - Duration: 53 min - Transcript: yes, on the page What happens when a tsunami of AI-written code meets a security industry that has spent decades chasing vulnerabilities? Brook S.E. ### Why AI Code Review Will Replace Human Review Faster Than You Think - URL: https://appsecpodcast.com/why-ai-code-review-will-replace-human-review-faster-than-you-think/ - Published: 2026-09-29 - Guest: Jim Manico - Duration: 49 min - Transcript: yes, on the page Jim Manico thinks the era of human code review is ending, and that clinging to it will hurt your company. ### Vulnerability Jail and the AI-Era AppSec Engineer - URL: https://appsecpodcast.com/vulnerability-jail-and-the-ai-era-appsec-engineer/ - Published: 2026-09-22 - Guest: Jeevan Singh - Duration: 45 min - Transcript: yes, on the page Three years ago, Jeevan Singh mapped out what an application security engineer needed to know. AI has rewritten the job since. ### How Agentic AI Fails—and Which Controls Actually Stop It - URL: https://appsecpodcast.com/how-agentic-ai-fails-and-which-controls-actually-stop-it/ - Published: 2026-09-15 - Guest: Petra Vukmirovic - Duration: 37 min - Transcript: yes, on the page Most fault trees get built on gut feeling. Petra Vukmirovic did something rarer: she borrowed the actual math from aviation and nuclear-plant safety engineering and pointed it at AI agents. ### Your AppSec Bottleneck Is a People Problem - URL: https://appsecpodcast.com/security-champions/ - Published: 2026-09-07 - Guest: Lisi Hocke - Duration: 48 min - Transcript: yes, on the page Most security champions programs don't fail on tooling — they fail on people. Lisi Hocke spent three years as a champion before moving fully into product… ### AI Pen Testing Killed Traditional DAST - URL: https://appsecpodcast.com/ai-pen-testing-killed-traditional-dast/ - Published: 2026-08-31 - Guest: James Berthoty - Duration: 44 min - Transcript: yes, on the page Is traditional DAST finally dead? James Berthoty came back to settle the argument that his last episode started. ### AI Security: OWASP Meets Global Standards - URL: https://appsecpodcast.com/ai-security-owasp-meets-global-standards/ - Published: 2026-08-26 - Guest: Rob van der Veer - Duration: 48 min - Transcript: yes, on the page AI security has no shortage of standards — the problem is turning them into something a team can actually use. ### The Future of Open-Source Threat Modeling - URL: https://appsecpodcast.com/the-future-of-open-source-threat-modeling/ - Published: 2026-08-17 - Guest: Vikramaditya Narayan - Duration: 40 min - Transcript: yes, on the page You don't have to let AI do the thinking for you. In this episode, Vikram Narayan shares why the smartest teams use AI as an accelerant — not a replacement… ### Isaac Evans - AppSec in the Age of AI - URL: https://appsecpodcast.com/isaac-evans-appsec-in-the-age-of-ai/ - Published: 2026-07-28 - Guest: Isaac Evans - Duration: 49 min - Transcript: yes, on the page AI is moving AppSec's control point out of CI and directly into the coding agent—but what happens when the model writing the code is also expected to secure it? ### José Carlos Chávez - When Museums Get Hacked: OWASP Top 10 Lessons from Heists - URL: https://appsecpodcast.com/jose-carlos-chavez-when-museums-get-hacked-owasp-top-10-lessons-from-heists/ - Published: 2026-07-21 - Guest: José Carlos Chávez - Duration: 53 min - Transcript: yes, on the page Why do broken access control and injection still dominate the OWASP Top 10 despite years of mature tooling? ### Michael Burch - AI-Enabled Citizen Developers - URL: https://appsecpodcast.com/michael-burch-ai-enabled-citizen-developers/ - Published: 2026-06-16 - Guest: Michael Burch - Duration: 49 min - Transcript: yes, on the page When every employee can generate working software, who owns the risk? Michael Burch, VP of AI Enablement and Acceleration at Security Journey, explains how… ### Josh Grossman--AI & SAST: Is it a match? - URL: https://appsecpodcast.com/josh-grossman-ai-sast-is-it-a-match/ - Published: 2026-06-02 - Guest: Josh Grossman - Duration: 40 min - Transcript: yes, on the page Traditional SAST is deterministic but shallow; AI can reason about context but may answer differently every time. Can the two approaches make each other better? ### Dwayne McDaniel -- Secrets Sprawl and How AI is Impacting Secrets - URL: https://appsecpodcast.com/dwayne-mcdaniel-secrets-sprawl-and-how-ai-is-impacting-secrets/ - Published: 2026-05-14 - Guest: Dwayne McDaniel - Duration: 45 min - Transcript: yes, on the page GitGuardian found 29 million hard-coded secrets in public GitHub commits in one year—a 34% increase and its largest jump yet. Why is a supposedly simple problem getting worse? ### Tanya Janca - Secure Vibe Coding - URL: https://appsecpodcast.com/tanya-janca-secure-vibe-coding/ - Published: 2026-04-30 - Guest: Tanya Janca - Duration: 48 min - Transcript: yes, on the page If AI writes all the code and the developer barely reads it, where does AppSec fit? ### Caroline Wong--The AI Cybersecurity Handbook - URL: https://appsecpodcast.com/caroline-wong-the-ai-cybersecurity-handbook/ - Published: 2026-04-21 - Guest: Caroline Wong - Duration: 45 min - Transcript: yes, on the page AI is multiplying the amount of software organizations produce, but security teams are not multiplying with it. ### Steve Wilson--OpenClaw and Advanced AI Agents - URL: https://appsecpodcast.com/steve-wilson-openclaw-and-advanced-ai-agents/ - Published: 2026-04-15 - Guest: Steve Wilson - Duration: 50 min - Transcript: yes, on the page OpenClaw makes always-on personal AI agents feel inevitable—and exposes how poorly prepared most organizations are for their autonomy. ### Brad Geesaman - Redefining AppSec with AI: Shrinking Toil, Expanding Impact - How LLMs are able to reduce toil in triage-heavy AppSec workflows - URL: https://appsecpodcast.com/brad-geesaman-redefining-appsec-with-ai-shrinking-toil-expanding-impact-how-llms-are-able-to-reduce-toil-in-triage-heavy-appsec-workflows/ - Published: 2025-10-28 - Guest: Brad Geesaman - Duration: 42 min - Transcript: yes, on the page AppSec teams are drowning in repetitive triage while the work that requires judgment keeps piling up. ### OWASP Candidate Debate - 2025 Edition - URL: https://appsecpodcast.com/owasp-candidate-debate-2025-edition/ - Published: 2025-10-15 - Duration: 68 min - Transcript: yes, on the page What should OWASP become, and which leaders have a credible plan to get it there? In this special 2025 Board of Directors candidate debate, nine candidates… ### Francesco Cipollone - Agentic AI Manifesto - URL: https://appsecpodcast.com/francesco-cipollone-agentic-ai-manifesto/ - Published: 2025-09-23 - Guest: Francesco Cipollone - Duration: 33 min - Transcript: yes, on the page Most products labeled as AI agents are little more than chatbots with tools. Francesco Cipollone, founder and CEO of Phoenix Security, explains what makes… ### Simon Gibbs & Devika Gibbs -- Building Bridges with Games - URL: https://appsecpodcast.com/simon-gibbs-devika-gibbs-building-bridges-with-games/ - Published: 2025-09-16 - Guests: Devika Gibbs, Simon Gibbs - Duration: 36 min - Transcript: yes, on the page Security education often struggles because the people in the room are being talked at instead of invited to participate. ### Akansha Shukla - Modern AppSec: Securing APIs with Threat Modeling and DevSecOps - URL: https://appsecpodcast.com/akansha-shukla-modern-appsec-securing-apis-with-threat-modeling-and-devsecops/ - Published: 2025-09-02 - Guest: Akansha Shukla - Duration: 36 min - Transcript: yes, on the page APIs power modern applications, yet many AppSec programs still cannot reliably inventory them, model their threats, or enforce authorization. ### Getting Ready for the EU CRA - URL: https://appsecpodcast.com/getting-ready-for-the-eu-cra/ - Published: 2025-08-20 - Guest: Nariman Aga-Tagiyev - Duration: 41 min - Transcript: yes, on the page The EU Cyber Resilience Act turns product security from a best practice into a market-access requirement, and its effects extend well beyond Europe. ### Marisa Fagan - Measuring Security Culture - URL: https://appsecpodcast.com/marisa-fagan-measuring-security-culture/ - Published: 2025-08-05 - Guest: Marisa Fagan - Duration: 50 min - Transcript: yes, on the page Security champions programs rarely fail because the idea is bad; they fail because organizations launch without management support, meaningful incentives, or a plan to prove value. ### Aram Hovsepyan -- Your Security Dashboard is Lying to You: The Science of Metrics - URL: https://appsecpodcast.com/aram-hovsepyan-your-security-dashboard-is-lying-to-you-the-science-of-metrics/ - Published: 2025-07-22 - Guest: Aram Hovsepyan - Duration: 41 min - Transcript: yes, on the page A dashboard full of green indicators can still describe an insecure organization. Aram Hovsepyan, founder and CEO of Codific and an OWASP SAMM contributor,… ### Sean Varga -- OWASP Top 10 for AppSec Sales - URL: https://appsecpodcast.com/sean-varga-owasp-top-10-for-appsec-sales/ - Published: 2025-07-15 - Guest: Sean Varga - Duration: 47 min - Transcript: yes, on the page We’re discussing the intersections of application security (AppSec) and sales strategy with our guest, Sean Varga. ### Sarah-Jane Madden -- What AI means for AppSec - URL: https://appsecpodcast.com/sarah-jane-madden-what-ai-means-for-appsec/ - Published: 2025-07-09 - Guest: Sarah-jane Madden - Duration: 38 min - Transcript: yes, on the page Sarah-Jane Madden joins Chris and Robert to ask what AI actually changes in software development—and what foundational practices still matter. ### Dag Flachet -- Kaizen for your Appsec Program - URL: https://appsecpodcast.com/dag-flachet-kaizen-for-your-appsec-program/ - Published: 2025-06-17 - Guest: Dag Flachet - Duration: 36 min - Transcript: yes, on the page Dag Flachet joins us to discuss the concept of Kaizen and its application in improving application security. ### Javan Rasokat and Andra Lezza -- When Chatbots Go Rogue - Lessons Learned from Building and Defending LLM Applications - URL: https://appsecpodcast.com/javan-rasokat-and-andra-lezza-when-chatbots-go-rogue-lessons-learned-from-building-and-defending-llm-applications/ - Published: 2025-03-18 - Guests: Andra Lezza, Javan Rasokat - Duration: 48 min - Transcript: yes, on the page What happens when teams add large language models to real applications and discover that familiar AppSec controls are no longer enough? ### Jim Routh -- The CISO Transition to the rest of life - URL: https://appsecpodcast.com/jim-routh-the-ciso-transition-to-the-rest-of-life/ - Published: 2025-03-11 - Guest: Jim Routh - Duration: 50 min - Transcript: yes, on the page Former CISO Jim Routh discusses his perspective on retirement and career fulfillment in cybersecurity. ### Henrik Plate -- OWASP Top 10 Open Source Risks - URL: https://appsecpodcast.com/henrik-plate-owasp-top-10-open-source-risks/ - Published: 2025-03-04 - Guest: Henrik Plate - Duration: 38 min - Transcript: yes, on the page Henrik Plate joins us to discuss the OWASP Top 10 Open Source Risks, a guide highlighting critical security and operational challenges in using open source dependencies. ### Tanya Janca -- A Secure SDLC from a Developer's Perspective - URL: https://appsecpodcast.com/tanya-janca-a-secure-sdlc-from-a-developer-s-perspective/ - Published: 2025-02-26 - Guest: Tanya Janca - Duration: 49 min - Transcript: yes, on the page Security expert Tanya Janca discusses her new book "Alice and Bob Learn Secure Coding" and shares insights on making security accessible to developers. ### Mehran Koushkebaghi -- Security as a Systemic Concern: How to develop Anti-Requirements - URL: https://appsecpodcast.com/mehran-koushkebaghi-security-as-a-systemic-concern-how-to-develop-anti-requirements/ - Published: 2025-02-11 - Guest: Mehran Koushkebaghi - Duration: 45 min - Transcript: yes, on the page Mehran Koushkebaghi, a seasoned engineering expert, delves into the intricacies of systemic security. ### Kalyani Pawar -- Shaping AppSec at Startups - URL: https://appsecpodcast.com/kalyani-pawar-shaping-appsec-at-startups/ - Published: 2025-02-04 - Guest: Kalyani Pawar - Duration: 40 min - Transcript: yes, on the page Kalyani Pawar shares critical strategies for integrating security early and effectively in AppSec for startups. ### Milan Williams -- AppSec Metrics - URL: https://appsecpodcast.com/milan-williams-appsec-metrics/ - Published: 2025-01-14 - Guest: Milan Williams - Duration: 36 min - Transcript: yes, on the page Milan Williams discusses the importance of application security metrics and how to make them both meaningful and actionable. ### MO Sadek -- Building an AppSec Program from Scratch - URL: https://appsecpodcast.com/mo-sadek-building-an-appsec-program-from-scratch/ - Published: 2025-01-08 - Guest: MO Sadek - Duration: 49 min - Transcript: yes, on the page Mo Sadek shares his unique journey of building an Application Security program from scratch at Roblox. ### Brett Crawley -- Threat Modeling Gameplay with EoP - URL: https://appsecpodcast.com/brett-crawley-threat-modeling-gameplay-with-eop/ - Published: 2024-12-10 - Guest: Brett Crawley - Duration: 45 min - Transcript: yes, on the page Brett Crawley discusses the Elevation of Privilege (EoP) card game, a powerful tool for threat modeling in software development. ### Matin Mavaddat - Understanding Security as a Systemic Concern: The Role of Anti-Requirements - URL: https://appsecpodcast.com/matin-mavaddat-understanding-security-as-a-systemic-concern-the-role-of-anti-requirements/ - Published: 2024-11-12 - Guest: Matin Mavaddat - Duration: 50 min - Transcript: yes, on the page Matin Mavaddat discusses his perspective on security as a systemic concern, developed from his background in requirements engineering and systems architecture. ### Kayra Otaner -- DevSecOps - URL: https://appsecpodcast.com/kayra-otaner-devsecops/ - Published: 2024-10-29 - Guest: Kayra Otaner - Duration: 33 min - Transcript: yes, on the page Kayra Otaner joins the podcast today to discuss DevSecOps and answer the question, is it dead? Kayra is the Director of DevSecOps at Roche and is highly involved in the DevSecOps community. ### François Proulx - Arbitrary Code Execution 0-day in Build Pipeline of Popular Open Source Packages - URL: https://appsecpodcast.com/francois-proulx-arbitrary-code-execution-0-day-in-build-pipeline-of-popular-open-source-packages/ - Published: 2024-10-22 - Guest: François Proulx - Duration: 46 min - Transcript: yes, on the page François Proulx shares his discovery of security vulnerabilities in build pipelines. Francois has found that attackers can exploit this often overlooked side of the software supply chain. ### Steve Wilson -- The Developer's Playbook for Large Language Model Security: Building Secure AI Applications - URL: https://appsecpodcast.com/steve-wilson-the-developer-s-playbook-for-large-language-model-security-building-secure-ai-applications/ - Published: 2024-10-01 - Guest: Steve Wilson - Duration: 37 min - Transcript: yes, on the page Steve Wilson, the author of 'The Developer's Playbook for Large Language Model Security’ is back to dive into topics from his book like AI hallucinations, trust, and the future of AI. ### Jeff Williams -- Application Detection & Response (ADR) - URL: https://appsecpodcast.com/jeff-williams-application-detection-response-adr/ - Published: 2024-09-24 - Guest: Jeff Williams - Duration: 51 min - Transcript: yes, on the page Jeff Williams, a renowned pioneer in the field of application security is with us to discuss Application Detection and Response (ADR), detailing its… ### Phillip Wylie -- Pen Testing from Somebody who Knows about Pen Testing - URL: https://appsecpodcast.com/phillip-wylie-pen-testing-from-somebody-who-knows-about-pen-testing/ - Published: 2024-09-17 - Guest: Phillip Wylie - Duration: 52 min - Transcript: yes, on the page Philip Wiley shares his unique journey from professional wrestling to being a renowned pen tester. We define pen testing and the role of social engineering in ethical hacking. ### Steve Springett -- Software and System Transparency - URL: https://appsecpodcast.com/steve-springett-software-and-system-transparency/ - Published: 2024-08-29 - Guest: Steve Springett - Duration: 48 min - Transcript: yes, on the page Steve Springett, an expert in secure software development and a key figure in several OWASP projects is back. Steve unpacks CycloneDX and the value proposition of various BOMs. ### Irfaan Santoe -- The Power of Strategy in AppSec - URL: https://appsecpodcast.com/irfaan-santoe-the-power-of-strategy-in-appsec/ - Published: 2024-07-31 - Guest: Irfaan Santoe - Duration: 40 min - Transcript: yes, on the page Irfaan Santoe joins us for an in-depth discussion on the power of strategy in Application Security. ### Andrew Van Der Stock -- The New OWASP Top Ten - URL: https://appsecpodcast.com/andrew-van-der-stock-the-new-owasp-top-ten/ - Published: 2024-07-23 - Guest: Andrew van der Stock - Duration: 52 min - Transcript: yes, on the page Andrew Van Der Stok, a leading web application security specialist and executive director at OWASP joins us for this episode. ### Derek Fisher -- Hiring in Cyber/AppSec - URL: https://appsecpodcast.com/derek-fisher-hiring-in-cyber-appsec/ - Published: 2024-07-16 - Guest: Derek Fisher - Duration: 62 min - Transcript: yes, on the page Derek Fisher, an expert in hardware, software, and cybersecurity with over 25 years of experience is back on the podcast. ### Tanya Janca -- Secure Guardrails - URL: https://appsecpodcast.com/tanya-janca-secure-guardrails/ - Published: 2024-07-09 - Guest: Tanya Janca - Duration: 65 min - Transcript: yes, on the page Tanya Janka, also known as SheHacksPurple, discusses secure guardrails, the difference between guardrails and paved roads, and how to implement both in application security. ### Jahanzeb Farooq -- Launching and executing an AppSec program - URL: https://appsecpodcast.com/jahanzeb-farooq-launching-and-executing-an-appsec-program/ - Published: 2024-07-02 - Guest: Jahanzeb Farooq - Duration: 50 min - Transcript: yes, on the page Jahanzeb Farooq discusses his journey in cybersecurity and the challenges of building AppSec programs from scratch. ### David Quisenberry -- Building Security, People, and Programs - URL: https://appsecpodcast.com/david-quisenberry-building-security-people-and-programs/ - Published: 2024-06-18 - Guest: David Quisenberry - Duration: 57 min - Transcript: yes, on the page David Quisenberry shares about his journey into the security world, insights on building AppSec programs in small to mid-sized companies, and the importance of data-driven decision-making. ### Matt Rose -- Software Supply Chain Security Means Many Different Things to Different People - URL: https://appsecpodcast.com/matt-rose-software-supply-chain-security-means-many-different-things-to-different-people/ - Published: 2024-06-11 - Guest: Matt Rose - Duration: 46 min - Transcript: yes, on the page Matt Rose, an experienced technical AppSec testing leader discusses his career journey and significant contributions in AppSec. ### James Berthoty -- Is DAST Dead? And the future of API security - URL: https://appsecpodcast.com/james-berthoty-is-dast-dead-and-the-future-of-api-security/ - Published: 2024-05-31 - Guest: James Berthoty - Duration: 45 min - Transcript: yes, on the page James Berthoty, a cloud security engineer with a diverse IT background, discusses his journey into application and product security. ### Mark Curphey and Simon Bennetts -- Riding the Coat Tails of ZAP, without Open Source Funding - URL: https://appsecpodcast.com/mark-curphey-and-simon-bennetts-riding-the-coat-tails-of-zap-without-open-source-funding/ - Published: 2024-05-21 - Guests: Mark Curphey, Simon Bennetts - Duration: 43 min - Transcript: yes, on the page ZAP supports an enormous share of the application security ecosystem, but who pays for the people keeping it reliable? ### Devin Rudnicki -- Expanding AppSec - URL: https://appsecpodcast.com/devin-rudnicki-expanding-appsec/ - Published: 2024-05-14 - Guest: Devin Rudnicki - Duration: 36 min - Transcript: yes, on the page Devon Rudnicki, the Chief Information Security Officer at Fitch Group, shares her journey of developing an application security program from scratch and advancing to the CISO role. ### Dustin Lehr -- Culture Change through Champions and Gamification - URL: https://appsecpodcast.com/dustin-lehr-culture-change-through-champions-and-gamification/ - Published: 2024-04-16 - Guest: Dustin Lehr - Duration: 45 min - Transcript: yes, on the page Dustin Lehr, Senior Director of Platform Security/Deputy CISO at Fivetran and Chief Solutions Officer at Katilyst Security, joins Robert and Chris to discuss security champions. ### Francesco Cipollone -- Application Security Posture Management and the Power of Working with the Business - URL: https://appsecpodcast.com/francesco-cipollone-application-security-posture-management-and-the-power-of-working-with-the-business/ - Published: 2024-04-09 - Guest: Francesco Cipollone - Duration: 38 min - Transcript: yes, on the page Francesco Cipollone, CEO of Phoenix Security, joins Chris and Robert to discuss security and explain Application Security Posture Management (ASPM). ### Mukund Sarma -- Developer Tools that Solve Security Problems - URL: https://appsecpodcast.com/mukund-sarma-developer-tools-that-solve-security-problems/ - Published: 2024-04-02 - Guest: Mukund Sarma - Duration: 47 min - Transcript: yes, on the page Mukund Sarma, the Senior Director for Product Security at Chime, talks with Chris about his career path from being a software engineer to becoming a leader in application security. ### Meghan Jacquot -- Assumed Breach Red Team Engagements for AppSec - URL: https://appsecpodcast.com/meghan-jacquot-assumed-breach-red-team-engagements-for-appsec/ - Published: 2024-03-20 - Guest: Meghan Jacquot - Duration: 41 min - Transcript: yes, on the page AppSec specialist Megan Jacquot joins Chris and Robert for a compelling conversation about community, career paths, and productive red team exercises. ### Bill Sempf -- Development, Security, and Teaching the Next Generation - URL: https://appsecpodcast.com/bill-sempf-development-security-and-teaching-the-next-generation/ - Published: 2024-03-12 - Guest: Bill Sempf - Duration: 40 min - Transcript: yes, on the page Robert is joined by Bill Sempf, an application security architect with over 20 years of experience in software development and security. ### Hendrik Ewerlin -- Threat Modeling of Threat Modeling - URL: https://appsecpodcast.com/hendrik-ewerlin-threat-modeling-of-threat-modeling/ - Published: 2024-03-05 - Guest: Hendrik Ewerlin - Duration: 34 min - Transcript: yes, on the page Robert and Chris talk with Hendrik Ewerlin, a threat modeling advocate and trainer. ### Jason Nelson -- Three Pillars of Threat Modeling Success: Consistency, Repeatability, and Efficacy - URL: https://appsecpodcast.com/jason-nelson-three-pillars-of-threat-modeling-success-consistency-repeatability-and-efficacy/ - Published: 2024-02-27 - Guest: Jason Nelson - Duration: 54 min - Transcript: yes, on the page Jason Nelson, an accomplished expert in information security management, joins Chris to share insights on establishing successful threat modeling programs… ### Erik Cabetas -- Cracking Codes on Screen and in Contests: An Expert's View on Hacking, Vulnerabilities, and the Evolution of Cybersecurity Language - URL: https://appsecpodcast.com/erik-cabetas-cracking-codes-on-screen-and-in-contests-an-expert-s-view-on-hacking-vulnerabilities-and-the-evolution-of-cybersecurity-language/ - Published: 2024-02-17 - Guest: Erik Cabetas - Duration: 51 min - Transcript: yes, on the page Erik Cabetas joins Robert and Chris for a thought-provoking discussion about modern software security. ### Justin Collins -- Enabling the Business to Move Faster, Securely - URL: https://appsecpodcast.com/justin-collins-enabling-the-business-to-move-faster-securely/ - Published: 2024-02-06 - Guest: Justin Collins - Duration: 47 min - Transcript: yes, on the page Justin Collins of Gusto joins Robert and Chris for a practical conversation about running security teams in an engineering-minded organization. ### Kyle Kelly -- The Dumpster Fire of Software Supply Chain Security - URL: https://appsecpodcast.com/kyle-kelly-the-dumpster-fire-of-software-supply-chain-security/ - Published: 2024-01-30 - Guest: Kyle Kelly - Duration: 41 min - Transcript: yes, on the page Kyle Kelly joins Chris to explore the wild west of software supply chain security. ### Chris Hughes -- Software Transparency - URL: https://appsecpodcast.com/chris-hughes-software-transparency/ - Published: 2024-01-20 - Guest: Chris Hughes - Duration: 39 min - Transcript: yes, on the page Chris Hughes, co-founder of Aquia, joins Chris and Robert on the Application Security Podcast to discuss points from his recent book Software Transparency:… ### Jay Bobo & Darylynn Ross -- App Sec Is Dead. Product Security Is the Future. - URL: https://appsecpodcast.com/jay-bobo-darylynn-ross-app-sec-is-dead-product-security-is-the-future/ - Published: 2024-01-09 - Guests: Darylynn Ross, Jay Bobo - Duration: 52 min - Transcript: yes, on the page Is application security dead, or does it need to grow into something larger? CoverMyMeds security leaders Jay Bobo and Darylynn Ross challenge the… ### Eitan Worcel -- Is AI a Security Champion? - URL: https://appsecpodcast.com/eitan-worcel-is-ai-a-security-champion/ - Published: 2023-12-19 - Guest: Eitan Worcel - Duration: 49 min - Transcript: yes, on the page Eitan Worcel joins the Application Security Podcast, to talk automated code fixes and the role of artificial intelligence in application security. ### Björn Kimminich -- OWASP Juice Shop - URL: https://appsecpodcast.com/bjorn-kimminich-owasp-juice-shop/ - Published: 2023-12-12 - Guest: Björn Kimminich - Duration: 39 min - Transcript: yes, on the page Bjorn Kimminich, the driving force behind the OWASP Juice Shop project, joins Chris and Robert to discuss all things Juice Shop. ### Arshan Dabirsiaghi -- Security Startups, AI Influencing AppSec, and Pixee/Codemodder.io - URL: https://appsecpodcast.com/arshan-dabirsiaghi-security-startups-ai-influencing-appsec-and-pixee-codemodder-io/ - Published: 2023-12-05 - Guest: Arshan Dabirsiaghi - Duration: 58 min - Transcript: yes, on the page Arshan Dabirsiaghi of Pixee joins Robert and Chris to discuss startups, AI in appsec, and Pixee's Codemodder. io. ### Dr. Jared Demott -- Cloud Security & Bug Bounty - URL: https://appsecpodcast.com/dr-jared-demott-cloud-security-bug-bounty/ - Published: 2023-11-28 - Guest: Jared Demott - Duration: 44 min - Transcript: yes, on the page Chris and Robert are thrilled to have an insightful conversation with Dr. Jared Demott, a seasoned expert in the field of cybersecurity. ### Katharina Koerner -- Security as Responsible AI - URL: https://appsecpodcast.com/katharina-koerner-security-as-responsible-ai/ - Published: 2023-11-21 - Guest: Katharina Koerner - Duration: 51 min - Transcript: yes, on the page Dr. Katarina Koerner, a renowned advisor and community builder with expertise in privacy by design and responsible AI, joins Chris and Robert to delve into… ### Ray Espinoza -- The AppSec CISO, Vendor Relationships, and Mentoring - URL: https://appsecpodcast.com/ray-espinoza-the-appsec-ciso-vendor-relationships-and-mentoring/ - Published: 2023-11-15 - Guest: Ray Espinoza - Duration: 51 min - Transcript: yes, on the page What does an application security leader need to know before stepping into the CISO role? ### Chris John Riley -- MVSP: Minimum Viable Secure Product - URL: https://appsecpodcast.com/chris-john-riley-mvsp-minimum-viable-secure-product/ - Published: 2023-11-07 - Guest: Chris John Riley - Duration: 50 min - Transcript: yes, on the page Chris John Riley joins Chris and Robert to discuss the Minimum Viable Secure Product. MVSP is a minimalistic security checklist for B2B software and business process outsourcing suppliers. ### Steve Wilson and Gavin Klondike -- OWASP Top Ten for LLM Release - URL: https://appsecpodcast.com/steve-wilson-and-gavin-klondike-owasp-top-ten-for-llm-release/ - Published: 2023-10-31 - Guests: Steve Wilson, Gavin Klondike - Duration: 52 min - Transcript: yes, on the page The first OWASP Top 10 for Large Language Model Applications gave developers and security teams a shared threat model for a rapidly changing technology. ### Tanya Janca -- What Secure Coding Really Means - URL: https://appsecpodcast.com/tanya-janca-what-secure-coding-really-means/ - Published: 2023-10-24 - Guest: Tanya Janca - Duration: 48 min - Transcript: yes, on the page Tanya Janca, also known as SheHacksPurple, joins the Application Security Podcast again to discuss secure coding, threat modeling, education, and other topics in the AppSec world. ### Hasan Yasar -- Actionable SBOM via DevSecOps - URL: https://appsecpodcast.com/hasan-yasar-actionable-sbom-via-devsecops/ - Published: 2023-10-16 - Guest: Hasan Yasar - Duration: 48 min - Transcript: yes, on the page Hasan Yasar believes that everyone shares the responsibility of creating a secure environment, and this can only be achieved by working collaboratively. ### Varun Badhwar -- The Developer Productivity Tax - URL: https://appsecpodcast.com/varun-badhwar-the-developer-productivity-tax/ - Published: 2023-10-10 - Guest: Varun Badhwar - Duration: 39 min - Transcript: yes, on the page Varun Badhwar is a three-time founder, a luminary in the cyber security industry, and a clear communicator. ### OWASP Board of Directors Debate - URL: https://appsecpodcast.com/owasp-board-of-directors-debate/ - Published: 2023-10-03 - Duration: 63 min - Transcript: yes, on the page Six candidates for the 2023 OWASP Board of Directors debate the choices that shape the foundation and its community. ### Itzik Alvas -- Secrets Security and Management - URL: https://appsecpodcast.com/itzik-alvas-secrets-security-and-management/ - Published: 2023-09-26 - Guest: Itzik Alvas - Duration: 37 min - Transcript: yes, on the page Itzik Alvas, Co-founder and CEO of Entro, is an expert on secrets security. Itzik joins Chris and Robert to discuss the significance of understanding and… ### Harshil Parikh -- Deep Environmental and Organizational Context in Application Security - URL: https://appsecpodcast.com/harshil-parikh-deep-environmental-and-organizational-context-in-application-security/ - Published: 2023-09-19 - Guest: Harshil Parikh - Duration: 38 min - Transcript: yes, on the page Harshil Parikh is a seasoned security leader with experience building security and compliance functions from the ground up. ### Jeff Williams -- The Tech of Runtime Security - URL: https://appsecpodcast.com/jeff-williams-the-tech-of-runtime-security/ - Published: 2023-09-12 - Guest: Jeff Williams - Duration: 39 min - Transcript: yes, on the page Jeff Willams of Contrast Security joins Chris and Robert on the Application Security Podcast to discuss runtime security, emphasizing the significance of… ### Mark Curphey and John Viega -- Chalk - URL: https://appsecpodcast.com/mark-curphey-and-john-viega-chalk/ - Published: 2023-09-05 - Guests: Mark Curphey, John Viega - Duration: 55 min - Transcript: yes, on the page Development, operations, and security teams generate oceans of data yet still struggle to answer basic questions about what code is running, who owns it, and which findings matter. ### Maril Vernon -- You Get What You Inspect, Not What You Expect - URL: https://appsecpodcast.com/maril-vernon-you-get-what-you-inspect-not-what-you-expect/ - Published: 2023-08-29 - Guest: Maril Vernon - Duration: 41 min - Transcript: yes, on the page Maril Vernon is passionate about Purple teaming and joins Robert and Chris to discuss the intricacies of purple teaming in cybersecurity. ### Dan Küykendall -- Why All Application Security Products Suck - URL: https://appsecpodcast.com/dan-kuykendall-why-all-application-security-products-suck/ - Published: 2023-08-22 - Guest: Dan Küykendall - Duration: 49 min - Transcript: yes, on the page Dan Küykendall visits The Application Security Podcast to discuss his series "Why All AppSec Products Suck" and explain why software companies should… ### Kevin Johnson -- Samurai Swords and Zap's Departure - URL: https://appsecpodcast.com/kevin-johnson-samurai-swords-and-zap-s-departure/ - Published: 2023-08-15 - Guest: Kevin Johnson - Duration: 51 min - Transcript: yes, on the page Kevin Johnson is the CEO of Secure Ideas. He began his career as a developer but turned toward security when he discovered that the interface for an intrusion detection system, Snort, was out of date. ### Tony Quadros -- The Life of an AppSec Vendor - URL: https://appsecpodcast.com/tony-quadros-the-life-of-an-appsec-vendor/ - Published: 2023-08-08 - Guest: Tony Quadros - Duration: 46 min - Transcript: yes, on the page Tony Quadros, the AppSec Lumberjack, shares the unique career path that led him to find his passion in Application Security. ### Steve Giguere -- Cloud AppSec - URL: https://appsecpodcast.com/steve-giguere-cloud-appsec/ - Published: 2023-07-24 - Guest: Steve Giguere - Duration: 37 min - Transcript: yes, on the page Cloud security is on an evolutionary path, with newer platforms embracing secure-by-default settings. ### Paul McCarty -- The Burrito Analogy of the Software Supply Chain - URL: https://appsecpodcast.com/paul-mccarty-the-burrito-analogy-of-the-software-supply-chain/ - Published: 2023-07-14 - Guest: Paul McCarty - Duration: 34 min - Transcript: yes, on the page "Visualizing the Software Supply Chain" is a project which aims to kick off a discussion about the scope and breadth of the software supply chain. ### Farshad Abasi -- Three Models for Deploying AppSec Resources - URL: https://appsecpodcast.com/farshad-abasi-three-models-for-deploying-appsec-resources/ - Published: 2023-07-09 - Guest: Farshad Abasi - Duration: 9 min - Transcript: yes, on the page Application security teams rarely have enough specialists to embed one expert with every development team. ### Kim Wuyts -- The Future of Privacy Threat Modeling - URL: https://appsecpodcast.com/kim-wuyts-the-future-of-privacy-threat-modeling/ - Published: 2023-06-29 - Guest: Kim Wuyts - Duration: 42 min - Transcript: yes, on the page Kim Wuyts discusses her work in privacy threat modeling with LINDDUN, a framework inspired by Microsoft's STRIDE for security threat modeling. ### François Proulx -- Actionable Software Supply Chain Security - URL: https://appsecpodcast.com/francois-proulx-actionable-software-supply-chain-security/ - Published: 2023-06-22 - Guest: François Proulx - Duration: 42 min - Transcript: yes, on the page Software supply chain -- how deep does the problem go? François is here to help us realize how deep the rabbit hole of the supply chain is and enlighten us with strategies to get out of the hole. ### Steve Wilson -- OWASP Top Ten for LLMs - URL: https://appsecpodcast.com/steve-wilson-owasp-top-ten-for-llms/ - Published: 2023-06-15 - Guest: Steve Wilson - Duration: 43 min - Transcript: yes, on the page How do we do security in the world of AI and LLMs? A great place to start is with an OWASP project tasked with creating a standardized guideline for… ### JB Aviat -- The State of Application Security - URL: https://appsecpodcast.com/jb-aviat-the-state-of-application-security/ - Published: 2023-06-07 - Guest: JB Aviat - Duration: 45 min - Transcript: yes, on the page What is the state of application security? JB Aviat answered that question by creating the state of application security report based on data from Datadog… ### Joshua Wells -- Application Security in the Age of Zero Trust - URL: https://appsecpodcast.com/joshua-wells-application-security-in-the-age-of-zero-trust/ - Published: 2023-06-01 - Guest: Joshua Wells - Duration: 40 min - Transcript: yes, on the page What is zero trust, and how does it impact the world of applications and application security? ### Jeevan Singh -- The Future of Application Security Engineers - URL: https://appsecpodcast.com/jeevan-singh-the-future-of-application-security-engineers/ - Published: 2023-05-15 - Guest: Jeevan Singh - Duration: 47 min - Transcript: yes, on the page Jeevan Singh, the director of product security at Twilio, discusses the future of application security engineers. ### Tony Turner -- Threat Modeling and SBOM - URL: https://appsecpodcast.com/tony-turner-threat-modeling-and-sbom/ - Published: 2023-05-03 - Guest: Tony Turner - Duration: 44 min - Transcript: yes, on the page Have you ever considered using an SBOM to inform your threat modeling? Tony Turner has. Tony joins us to discuss SBOMs, threat modeling, and the importance of Cyber Informed Engineering. ### Christian Frichot -- Threat Modeling with hcltm - URL: https://appsecpodcast.com/christian-frichot-threat-modeling-with-hcltm/ - Published: 2023-04-18 - Guest: Christian Frichot - Duration: 49 min - Transcript: yes, on the page Christian Frichot, an AppSec hacker, security leader, and developer of hcltm. He discusses the DevOps threat modeling tool he dreamed up and built. ### Zohar Shachar -- Bug Bounty from Both Sides - URL: https://appsecpodcast.com/zohar-shachar-bug-bounty-from-both-sides/ - Published: 2023-04-03 - Guest: Zohar Shachar - Duration: 36 min - Transcript: yes, on the page Zohar Shachar joins us to discuss the bug bounty process from both sides. Zohar has spent time as a bug bounty hunter and shares wisdom on avoiding bug bounty-causing issues for your AppSec posture. ### Sarah-jane Madden -- Threat Modeling to established teams - URL: https://appsecpodcast.com/sarah-jane-madden-threat-modeling-to-established-teams/ - Published: 2023-03-23 - Guest: Sarah-jane Madden - Duration: 43 min - Transcript: yes, on the page Sarah-Jane Madden is the Chief Information Security Officer of Sensing Technology Group. - part of Fortive. ### Jet Anderson -- The AppSec Code Doctor - URL: https://appsecpodcast.com/jet-anderson-the-appsec-code-doctor/ - Published: 2023-03-16 - Guest: Jet Anderson - Duration: 39 min - Transcript: yes, on the page Jet Anderson's passion is teaching today's software developers to write secure code as part of modern DevOps pipelines, at speed and scale, without missing a beat. ### James Mckee -- Developer Security - URL: https://appsecpodcast.com/james-mckee-developer-security/ - Published: 2023-03-09 - Guest: James Mckee - Duration: 38 min - Transcript: yes, on the page James Mckee is a developer (MCPDEA) and security advocate (CISSP) whose biggest responsibility is leading developer security practices. ### Derek Fisher -- The Application Security Handbook - URL: https://appsecpodcast.com/derek-fisher-the-application-security-handbook/ - Published: 2023-03-02 - Guest: Derek Fisher - Duration: 42 min - Transcript: yes, on the page Derek is the author of “The Application Security Handbook. ” He is a university instructor at Temple University, where he teaches software development security to undergraduate and graduate students. ### Rob van der Veer -- OWASP AI Security & Privacy Guide - URL: https://appsecpodcast.com/rob-van-der-veer-owasp-ai-security-privacy-guide/ - Published: 2023-02-23 - Guest: Rob van der Veer - Duration: 43 min - Transcript: yes, on the page Rob van der Veer has a 30-year background in software engineering, building AI businesses, creating software, and assessing software. ### Robyn Lundin -- Planning & organizing a penetration test as an AppSec team - URL: https://appsecpodcast.com/robyn-lundin-planning-organizing-a-penetration-test-as-an-appsec-team/ - Published: 2023-01-10 - Guest: Robyn Lundin - Duration: 29 min - Transcript: yes, on the page Robyn Lundin started working in tech after a coding boot camp as a developer for a small startup. ### Michael Bargury -- Low Code / No Code Security and an OWASP Top Ten - URL: https://appsecpodcast.com/michael-bargury-low-code-no-code-security-and-an-owasp-top-ten/ - Published: 2023-01-03 - Guest: Michael Bargury - Duration: 47 min - Transcript: yes, on the page Michael Bargury is the Co-Founder and CTO of Zenity, where he helps companies secure their low-code/no-code apps. ### Alex Olsen -- Security champions, empowering developers, and AppSec training - URL: https://appsecpodcast.com/alex-olsen-security-champions-empowering-developers-and-appsec-training/ - Published: 2022-12-20 - Guest: Alex Olsen - Duration: 59 min - Transcript: yes, on the page Alex leads the Cyber Security Consulting Group, part of Rakuten's Cyber Security Defense Department. ### Mark Curphey -- The future of OWASP - URL: https://appsecpodcast.com/mark-curphey-the-future-of-owasp/ - Published: 2022-12-13 - Guest: Mark Curphey - Duration: 41 min - Transcript: yes, on the page Mark Curphey is one of the creators of OWASP from the very early days. Mark worked in the background over the few decades of OWASP but has recently taken more to the spotlight. ### Tiago Mendo -- How to scan at scale with OWASP ZAP - URL: https://appsecpodcast.com/tiago-mendo-how-to-scan-at-scale-with-owasp-zap/ - Published: 2022-12-06 - Guest: Tiago Mendo - Duration: 32 min - Transcript: yes, on the page Tiago Mendo is a co-founder and CTO of Probely. He has extensive experience in pentesting applications, training, and providing all-around security consultancy. ### Wolfgang Goerlich -- Security beyond vulnerabilities - URL: https://appsecpodcast.com/wolfgang-goerlich-security-beyond-vulnerabilities/ - Published: 2022-11-29 - Guest: Wolfgang Goerlich - Duration: 40 min - Transcript: yes, on the page J. Wolfgang Goerlich is an Advisory CISO for Cisco Secure. He has been responsible for IT and IT security in the healthcare and financial services verticals. ### Sam Stepanyan -- OWASP Nettacker Project - URL: https://appsecpodcast.com/sam-stepanyan-owasp-nettacker-project/ - Published: 2022-11-08 - Guest: Sam Stepanyan - Duration: 47 min - Transcript: yes, on the page Sam Stepanyan is an OWASP London Chapter Leader and an Independent Application Security Consultant with over 20 years of IT experience and a background in… ### Nick Aleks and Dolev Farhi -- GraphQL Security - URL: https://appsecpodcast.com/nick-aleks-and-dolev-farhi-graphql-security/ - Published: 2022-11-01 - Guests: Dolev Farhi, Nick Aleks - Duration: 44 min - Transcript: yes, on the page GraphQL gives clients remarkable flexibility, but that same flexibility can expose authorization gaps, denial-of-service paths, and unexpected routes to sensitive data. ### Guy Barhart-Magen -- Log4j and Incident Response - URL: https://appsecpodcast.com/guy-barhart-magen-log4j-and-incident-response/ - Published: 2022-09-23 - Guest: Guy Barhart-Magen - Duration: 44 min - Transcript: yes, on the page With nearly 25 years of experience in the cyber-security industry, Guy held various positions in both corporates and startups. ### Brett Smith -- Security is a Necessary Evil - URL: https://appsecpodcast.com/brett-smith-security-is-a-necessary-evil/ - Published: 2022-08-30 - Guest: Brett Smith - Duration: 44 min - Transcript: yes, on the page Brett Smith is a Software Architect/Engineer/Developer with 20+ years of experience. ### Chen Gour-Arie -- The AppSec Map - URL: https://appsecpodcast.com/chen-gour-arie-the-appsec-map/ - Published: 2022-08-16 - Guest: Chen Gour-Arie - Duration: 34 min - Transcript: yes, on the page Chen Gour-Arie is the Chief Architect and Co-Founder of Enso Security. With over 15 years of hands-on experience in cybersecurity and software development,… ### Dominique Righetto -- OWASP Secure Headers - URL: https://appsecpodcast.com/dominique-righetto-owasp-secure-headers/ - Published: 2022-08-09 - Guest: Dominique Righetto - Duration: 28 min - Transcript: yes, on the page Dominique Righetto is an AppSec enthusiast and OWASP projects contributor. Dominique joins us to discuss the OWASP Secure Headers project. ### Hillel Solow -- How to do AppSec without a security team - URL: https://appsecpodcast.com/hillel-solow-how-to-do-appsec-without-a-security-team/ - Published: 2022-07-25 - Guest: Hillel Solow - Duration: 34 min - Transcript: yes, on the page How can a startup build meaningful AppSec when it cannot hire a dedicated security specialist? ### Chris Romeo -- The Security Journey Story - URL: https://appsecpodcast.com/chris-romeo-the-security-journey-story/ - Published: 2022-06-02 - Duration: 27 min - Transcript: yes, on the page In this episode of the Application Security Podcast, Chris Romeo walks through the origin story of Security Journey and shares some experiences taking a security startup from bootstrap to acquisition. ### Kristen Tan and Vaibhav Garg -- Machine Assisted Threat Modeling - URL: https://appsecpodcast.com/kristen-tan-and-vaibhav-garg-machine-assisted-threat-modeling/ - Published: 2022-05-10 - Guests: Kristen Tan, Vaibhav Garg - Duration: 46 min - Transcript: yes, on the page Can machines make threat modeling faster without stripping away the judgment that makes it useful? ### Patrick Dwyer -- CycloneDX and SBOMs - URL: https://appsecpodcast.com/patrick-dwyer-cyclonedx-and-sboms/ - Published: 2022-05-03 - Guest: Patrick Dwyer - Duration: 29 min - Transcript: yes, on the page Patrick is a Senior Product Security Engineer in the Application Security team at ServiceNow. He is also Co-Leader of the OWASP CycloneDX project. ### Omer Gil and Daniel Krivelevich -- Top 10 CI/CD Security Risks - URL: https://appsecpodcast.com/omer-gil-and-daniel-krivelevich-top-10-ci-cd-security-risks/ - Published: 2022-04-25 - Guests: Daniel Krivelevich, Omer Gil - Duration: 51 min - Transcript: yes, on the page CI/CD systems hold code, credentials, and production access, yet many organizations still treat them as internal plumbing rather than a critical attack surface. ### Josh Grossman -- Building a High-Value AppSec Scanning Program - URL: https://appsecpodcast.com/josh-grossman-building-a-high-value-appsec-scanning-program/ - Published: 2022-04-19 - Guest: Josh Grossman - Duration: 43 min - Transcript: yes, on the page Josh Grossman has over 15 years of experience in IT Risk and Application Security consulting, and he has also worked as a software developer. ### Alex Mor -- Application Risk Profiling at Scale - URL: https://appsecpodcast.com/alex-mor-application-risk-profiling-at-scale/ - Published: 2022-03-15 - Guest: Alex Mor - Duration: 43 min - Transcript: yes, on the page Alex Mor is a passionate cybersecurity defender or breaker depending on the time of day, providing expert technical guidance to product teams and building security in their platforms. ### Brenna Leath -- Product Security Leads: A different way of approaching Security Champions - URL: https://appsecpodcast.com/brenna-leath-product-security-leads-a-different-way-of-approaching-security-champions/ - Published: 2022-03-09 - Guest: Brenna Leath - Duration: 33 min - Transcript: yes, on the page Brenna Leath is currently the Head of Product Security for a data analytics company where she sets the application security strategy for R&D and leads a team of security architects. ### Will Ratner -- Centralized container scanning - URL: https://appsecpodcast.com/will-ratner-centralized-container-scanning/ - Published: 2022-02-16 - Guest: Will Ratner - Duration: 42 min - Transcript: yes, on the page Will Ratner is a software security professional with extensive experience building and implementing security solutions across a myriad of industries… ### Neil Matatall -- AppSec at Scale - URL: https://appsecpodcast.com/neil-matatall-appsec-at-scale/ - Published: 2022-02-09 - Guest: Neil Matatall - Duration: 39 min - Transcript: yes, on the page Neil Matatall is an engineer with a background in security. He has previously worked at GitHub and Twitter and is a co-founder of Loco Moco Product Security Conference. ### Joern Freydank -- Security Design Anti Patterns Limit Security Debt - URL: https://appsecpodcast.com/joern-freydank-security-design-anti-patterns-limit-security-debt/ - Published: 2022-01-25 - Guest: Joern Freydank - Duration: 37 min - Transcript: yes, on the page Joern Freydank is a Lead Cyber Security Engineer with more than 20 years of experience. He is currently establishing the Threat Modeling Program at a major insurance company. ### Ken Toler -- Blockchain, Cloud, and #AppSec - URL: https://appsecpodcast.com/ken-toler-blockchain-cloud-and-appsec/ - Published: 2022-01-18 - Guest: Ken Toler - Duration: 45 min - Transcript: yes, on the page Ken Toler is a principal consultant at Kudelski Security and is passionate about building and optimizing application security programs that stick through strong adoption and ease of use. ### Jeroen Willemsen and Ben de Haan -- Dirty little secrets - URL: https://appsecpodcast.com/jeroen-willemsen-and-ben-de-haan-dirty-little-secrets/ - Published: 2022-01-11 - Guests: Jeroen Willemsen, Ben de Haan - Duration: 35 min - Transcript: yes, on the page Secrets management fails in surprisingly ordinary ways: credentials land in code, deployment files, containers, and cloud resources, then quietly become part of the system’s attack surface. ### Adam Shostack -- Fast, cheap and good threat models - URL: https://appsecpodcast.com/adam-shostack-fast-cheap-and-good-threat-models/ - Published: 2021-12-15 - Guest: Adam Shostack - Duration: 31 min - Transcript: yes, on the page Adam is a leading expert on threat modeling, and a consultant, expert witness, author and game designer. He has decades of experience delivering security. ### Loren Kohnfelder -- Designing Secure Software - URL: https://appsecpodcast.com/loren-kohnfelder-designing-secure-software/ - Published: 2021-12-07 - Guest: Loren Kohnfelder - Duration: 34 min - Transcript: yes, on the page Ochaun Marshall is an Application Security Consultant. In his roles of secure ideas, he works on on-going development projects utilizing Amazon web services and breaks other people's web applications. ### Ochaun Marshall -- IaC and SAST - URL: https://appsecpodcast.com/ochaun-marshall-iac-and-sast/ - Published: 2021-11-29 - Guest: Ochaun Marshall - Duration: 36 min - Transcript: yes, on the page Infrastructure as code gives security teams something they have wanted for years: a readable description of the systems surrounding an application. ### Simon Bennetts -- Using OWASP Zap across an Enterprise - URL: https://appsecpodcast.com/simon-bennetts-using-owasp-zap-across-an-enterprise/ - Published: 2021-11-10 - Guest: Simon Bennetts - Duration: 40 min - Transcript: yes, on the page Simon Bennetts is the OWASP Zed Attack Proxy (ZAP) Project Leader and a Distinguished Engineer at StackHawk, a company that uses ZAP to help users fix… ### Timo Pagel -- DevSecOps Maturity Model - URL: https://appsecpodcast.com/timo-pagel-devsecops-maturity-model/ - Published: 2021-10-27 - Guest: Timo Pagel - Duration: 32 min - Transcript: yes, on the page Timo Pagel has been in the IT industry for over fifteen years. After a system administrator and web developer career, he advises customers as a DevSecOps consultant and trainer. ### Mazin Ahmed -- Terraform Security - URL: https://appsecpodcast.com/mazin-ahmed-terraform-security/ - Published: 2021-10-06 - Guest: Mazin Ahmed - Duration: 33 min - Transcript: yes, on the page Mazin Ahmed is a security engineer that specializes in AppSec and offensive security. ### James Ransome and Brook Schoenfield -- trust and verify: Building in Security at Agile Speed - URL: https://appsecpodcast.com/james-ransome-and-brook-schoenfield-trust-and-verify-building-in-security-at-agile-speed/ - Published: 2021-09-24 - Guests: Brook S.E. Schoenfield, James Ransome - Duration: 54 min - Transcript: yes, on the page Why do application security programs stall even after teams buy tools and define processes? James Ransome and Brook S. E. ### OWASP Top 10 2021 Peer Review - URL: https://appsecpodcast.com/owasp-top-10-2021-peer-review/ - Published: 2021-09-17 - Duration: 30 min - Transcript: yes, on the page Chris and Robert conduct a practitioner peer review of the 2021 OWASP Top 10, examining what changed, what moved, and what the new structure communicates to development teams. ### Anastasiia Voitova -- Encryption is easy, key management is hard - URL: https://appsecpodcast.com/anastasiia-voitova-encryption-is-easy-key-management-is-hard/ - Published: 2021-09-14 - Guest: Anastasiia Voitova - Duration: 34 min - Transcript: yes, on the page Adding encryption is easy; designing a system that protects keys, metadata, and users is much harder. ### Eran Kinsbruner -- DevSecOps Continuous Testing - URL: https://appsecpodcast.com/eran-kinsbruner-devsecops-continuous-testing/ - Published: 2021-08-20 - Guest: Eran Kinsbruner - Duration: 36 min - Transcript: yes, on the page Mark Loveless - aka Simple Nomad - is a security researcher and hacker. He's spoken at numerous security and hacker conferences worldwide, including Blackhat, DEF CON, ShmooCon, and RSA. ### Mark Loveless -- Threat modeling in a DevSecOps environment. - URL: https://appsecpodcast.com/mark-loveless-threat-modeling-in-a-devsecops-environment/ - Published: 2021-08-13 - Guest: Mark Loveless - Duration: 36 min - Transcript: yes, on the page Threat modeling needs to fit the way developers work if it is going to survive a fast delivery cycle. ### Jeroen Willemsen -- Security automation with ci/cd - URL: https://appsecpodcast.com/jeroen-willemsen-security-automation-with-ci-cd/ - Published: 2021-08-06 - Guest: Jeroen Willemsen - Duration: 32 min - Transcript: yes, on the page Jeroen Willemsen is a Principal Security Architect at Xebia. Jeroen is more or less a jack of all trades with an interest in infrastructure security, risk management, and application security. ### Thinking back, Looking forward - A Balanced Approach to Securing our Software Future - URL: https://appsecpodcast.com/thinking-back-looking-forward-a-balanced-approach-to-securing-our-software-future/ - Published: 2021-07-15 - Guest: Kevin Greene - Duration: 72 min - Transcript: yes, on the page Software security has spent decades alternating between prevention, detection, and response. Kevin Greene joins Chris and Robert to ask what a balanced approach should look like now. ### Jeevan Singh -- Threat modeling based in democracy - URL: https://appsecpodcast.com/jeevan-singh-threat-modeling-based-in-democracy/ - Published: 2021-06-11 - Guest: Jeevan Singh - Duration: 36 min - Transcript: yes, on the page Jeevan Singh is a Security Engineer Manager at Segment, where he is embedding security into all aspects of the software development process. ### Dima Kotik -- Application Security and the Zen of Python - URL: https://appsecpodcast.com/dima-kotik-application-security-and-the-zen-of-python/ - Published: 2021-05-21 - Guest: Dima Kotik - Duration: 39 min - Transcript: yes, on the page Dima Kotik is an Application Security Engineer at Security Journey and has been programming in Python for years. ### Dustin Lehr -- Advocating and being on the side of developers - URL: https://appsecpodcast.com/dustin-lehr-advocating-and-being-on-the-side-of-developers/ - Published: 2021-05-07 - Guest: Dustin Lehr - Duration: 37 min - Transcript: yes, on the page Before taking the plunge into information security leadership, Dustin Lehr spent over a decade as a software engineer and architect in a variety of… ### Aaron Rinehart -- Security Chaos Engineering - URL: https://appsecpodcast.com/aaron-rinehart-security-chaos-engineering/ - Published: 2021-04-30 - Guest: Aaron Rinehart - Duration: 49 min - Transcript: yes, on the page Aaron Rinehart is expanding the possibilities of chaos engineering to cybersecurity. ### Izar Tarandach and Matt Coles-- Threat Modeling: A Practical Guide for Development Teams - URL: https://appsecpodcast.com/izar-tarandach-and-matt-coles-threat-modeling-a-practical-guide-for-development-teams/ - Published: 2021-04-23 - Guests: Izar Tarandach, Matt Coles - Duration: 50 min - Transcript: yes, on the page Threat modeling advice often sounds simple until a development team tries to apply it to a real system. ### Charles Shirer -- The most positive person in security - URL: https://appsecpodcast.com/charles-shirer-the-most-positive-person-in-security/ - Published: 2021-04-16 - Guest: Charles Shirer - Duration: 36 min - Transcript: yes, on the page Charles is a Senior Security Consultant for Red Siege. He has over 18 years of experience in IT. ### Leif Dreizler -- Tactical tips to shift engineering right - URL: https://appsecpodcast.com/leif-dreizler-tactical-tips-to-shift-engineering-right/ - Published: 2021-04-09 - Guest: Leif Dreizler - Duration: 46 min - Transcript: yes, on the page Leif Dreizler is the manager of the Product Security team at Segment. Leif got his start in the security industry at Redspin doing security consulting work and was later an early employee at Bugcrowd. ### Vandana Verma -- OWASP Spotlight Series - URL: https://appsecpodcast.com/vandana-verma-owasp-spotlight-series/ - Published: 2021-04-02 - Guest: Vandana Verma - Duration: 24 min - Transcript: yes, on the page Vandana Verma is the President of Infosec girls and Infosec Kids, a board of directors member for OWASP, and a leader for BSides Dehli. She joins us to introduce the OWASP Spotlight Series. ### Dr. Anita D’Amico -- Do certain types of developers or teams write more secure code? - URL: https://appsecpodcast.com/dr-anita-d-amico-do-certain-types-of-developers-or-teams-write-more-secure-code/ - Published: 2021-03-25 - Guest: Anita D’Amico - Duration: 49 min - Transcript: yes, on the page Dr. Anita D’Amico is the CEO of Code Dx, which provides Application Security Orchestration and Correlation solutions to industry and government. ### Alyssa Miller -- Bringing security to DevOps and the CI/CD pipeline - URL: https://appsecpodcast.com/alyssa-miller-bringing-security-to-devops-and-the-ci-cd-pipeline/ - Published: 2021-03-18 - Guest: Alyssa Miller - Duration: 40 min - Transcript: yes, on the page Alyssa Miller is a life-long hacker, security advocate, and cybersecurity leader. She is the BISO for S&P Global ratings and has over 15 years of experience in security roles. ### Liran Tal — Cloud native application security, what’s a developer to do? - URL: https://appsecpodcast.com/liran-tal-cloud-native-application-security-what-s-a-developer-to-do/ - Published: 2021-03-09 - Guest: Liran Tal - Duration: 42 min - Transcript: yes, on the page Cloud-native development gives engineers control over more of the stack, but it also gives them more security decisions to get wrong. ### Chris Romeo — DevSecOps Fails - URL: https://appsecpodcast.com/chris-romeo-devsecops-fails/ - Published: 2021-02-17 - Duration: 28 min - Transcript: yes, on the page Robert and I decided to talk about an article I wrote called "DevOps security culture: 12 fails your team can learn from". We hope you enjoy this walkthrough of the 12 fails. ### Jim Routh — Secure software pipelines - URL: https://appsecpodcast.com/jim-routh-secure-software-pipelines/ - Published: 2021-02-10 - Guest: Jim Routh - Duration: 45 min - Transcript: yes, on the page A secure software pipeline is more than a collection of scanners. Jim Routh joins Chris and Robert to explain how organizations can build repeatable… ### Andrew van der Stock — Taking Application Security to the Masses - URL: https://appsecpodcast.com/andrew-van-der-stock-taking-application-security-to-the-masses/ - Published: 2021-01-20 - Guest: Andrew van der Stock - Duration: 31 min - Transcript: yes, on the page How does a volunteer security community reach the millions of people who build software? Andrew van der Stock reflects on that challenge after becoming OWASP’s executive director in 2020. ### JC Herz and Steve Springett — SBOMs and software supply chain assurance - URL: https://appsecpodcast.com/jc-herz-and-steve-springett-sboms-and-software-supply-chain-assurance/ - Published: 2021-01-12 - Guests: Steve Springett, JC Herz - Duration: 48 min - Transcript: yes, on the page Software bills of materials promise visibility into dependencies, but visibility alone does not create assurance. ### Brian Reed — Mobile Appsec: The Good, the Bad and the Ugly as We Head into 2021 - URL: https://appsecpodcast.com/brian-reed-mobile-appsec-the-good-the-bad-and-the-ugly-as-we-head-into-2021/ - Published: 2021-01-06 - Guest: Brian Reed - Duration: 35 min - Transcript: yes, on the page Brian Reed is Chief Mobility Officer at NowSecure. Brian has over 30 years in tech and 15 years in mobile, security, and apps dating back to the birth of… ### The Threat Modeling Manifesto – Part 2 - URL: https://appsecpodcast.com/the-threat-modeling-manifesto-part-2/ - Published: 2020-11-24 - Duration: 25 min - Transcript: yes, on the page How did a group of experienced practitioners turn months of disagreement into a usable Threat Modeling Manifesto? ### The Threat Modeling Manifesto – Part 1 - URL: https://appsecpodcast.com/the-threat-modeling-manifesto-part-1/ - Published: 2020-11-17 - Duration: 25 min - Transcript: yes, on the page What should threat modeling mean when practitioners use the term in very different ways? ### Season 7 Guests — The best of Season 7 - URL: https://appsecpodcast.com/season-7-guests-the-best-of-season-7/ - Published: 2020-10-26 - Duration: 40 min - Transcript: yes, on the page Which ideas from Season 7 deserve another listen? Chris and Robert assemble clips from across the season, creating a fast tour through secure development… ### Aviat Jean-Baptiste — The AppSec report - URL: https://appsecpodcast.com/aviat-jean-baptiste-the-appsec-report/ - Published: 2020-10-13 - Guest: Aviat Jean-Baptiste - Duration: 33 min - Transcript: yes, on the page Jb Aviat is CTO and co-founder at Sqreen. Prior to this, Jb worked at Apple as a reverse engineer, pentester and developer. ### Frank Rietta — The convergence of Ruby on Rails and #AppSec - URL: https://appsecpodcast.com/frank-rietta-the-convergence-of-ruby-on-rails-and-appsec/ - Published: 2020-10-06 - Guest: Frank Rietta - Duration: 50 min - Transcript: yes, on the page Ruby on Rails can provide strong security defaults, but a framework cannot make every design decision for its developers. ### Dmitry Sotnikov – REST API Security – there is no silver bullet - URL: https://appsecpodcast.com/dmitry-sotnikov-rest-api-security-there-is-no-silver-bullet/ - Published: 2020-09-30 - Guest: Dmitry Sotnikov - Duration: 33 min - Transcript: yes, on the page Dmitry Sotnikov serves as Chief Product Officer at 42Crunch – an enterprise API security company. ### Caroline Wong — The state of Penetration Testing - URL: https://appsecpodcast.com/caroline-wong-the-state-of-penetration-testing/ - Published: 2020-09-22 - Guest: Caroline Wong - Duration: 35 min - Transcript: yes, on the page Caroline Wong is the Chief Strategy Officer at Cobalt. io. You cannot hack yourself secure. The challenge is that developers get bored with hacking broken pieces of code after a while. ### Aaron Davis — LavaMoat — solving JavaScript software supply chain - URL: https://appsecpodcast.com/aaron-davis-lavamoat-solving-javascript-software-supply-chain/ - Published: 2020-09-15 - Guest: Aaron Davis - Duration: 40 min - Transcript: yes, on the page Aaron Davis is a founder, dev, and a lead security researcher at MetaMask, a popular Ethereum wallet. ### Anastasiia Voitova — Use Cryptography; Don’t Learn It - URL: https://appsecpodcast.com/anastasiia-voitova-use-cryptography-don-t-learn-it/ - Published: 2020-09-10 - Guest: Anastasiia Voitova - Duration: 35 min - Transcript: yes, on the page Developers need to protect data, but should they need to become cryptographers to do it safely? ### Michael Furman — SameSite Cookies - URL: https://appsecpodcast.com/michael-furman-samesite-cookies/ - Published: 2020-09-03 - Guest: Michael Furman - Duration: 36 min - Transcript: yes, on the page Michael Furman is the Lead Security Architect at Tufin, and is responsible for the security and Security Development Lifecycle (SDL) of Tufin software products. ### Chris Romeo — The State of Security and the Importance of Empathy - URL: https://appsecpodcast.com/chris-romeo-the-state-of-security-and-the-importance-of-empathy/ - Published: 2020-08-27 - Duration: 44 min - Transcript: yes, on the page Network engineers and application security teams depend on each other, yet often struggle to understand each other’s responsibilities. ### Neil Matatall — Content Security Policy - URL: https://appsecpodcast.com/neil-matatall-content-security-policy/ - Published: 2020-08-04 - Guest: Neil Matatall - Duration: 43 min - Transcript: yes, on the page Neil Matatall is a product security engineer at GitHub. He focuses on designing and engineering user experiences solutions related to authentication and account recovery. ### Grant Ongers — Gamification of threat modeling - URL: https://appsecpodcast.com/grant-ongers-gamification-of-threat-modeling/ - Published: 2020-07-28 - Guest: Grant Ongers - Duration: 38 min - Transcript: yes, on the page Grant Ongers (@rewtd) is co-founder of the bearded trio called Secure Delivery, with a philosophy and purpose for optimal delivery and security in one dynamic package. ### Elie Saad — OWASP WSTG, Cheat Sheets, and Integration - URL: https://appsecpodcast.com/elie-saad-owasp-wstg-cheat-sheets-and-integration/ - Published: 2020-07-21 - Guest: Elie Saad - Duration: 41 min - Transcript: yes, on the page Elie Saad is an application security engineer, leading three different OWASP projects. ### Graham Holmes — Adversarial Machine Learning - URL: https://appsecpodcast.com/graham-holmes-adversarial-machine-learning/ - Published: 2020-07-13 - Guest: Graham Holmes - Duration: 46 min - Transcript: yes, on the page Graham Holmes is the founder and owner of AoP CyberSecurity, LLC whose mission is to enable organizations to “create scalable and effective strategies for trustworthy outcomes. ### Ochaun Marshall — Securing Web applications in AWS - URL: https://appsecpodcast.com/ochaun-marshall-securing-web-applications-in-aws/ - Published: 2020-07-07 - Guest: Ochaun Marshall - Duration: 38 min - Transcript: yes, on the page Ochaun Marshall is a developer and security consultant. In his roles at Secure Ideas, he works on ongoing development projects utilizing Amazon Web Services and breaks other people's web applications. ### Drew Dennison – Security should make the computer sweat more - URL: https://appsecpodcast.com/drew-dennison-security-should-make-the-computer-sweat-more/ - Published: 2020-06-30 - Guest: Drew Dennison - Duration: 30 min - Transcript: yes, on the page Drew Dennison is the CTO & co-founder of r2c, a startup working to profoundly improve software security and reliability to safeguard human progress. ### Aaron Guzman — IoTGoat - URL: https://appsecpodcast.com/aaron-guzman-iotgoat/ - Published: 2020-06-23 - Guest: Aaron Guzman - Duration: 36 min - Transcript: yes, on the page Aaron Guzman specializes in IoT, embedded, and automotive security. Aaron is the Co-Author of “IoT Penetration Testing Cookbook”. ### Adam Shostack — The Jenga View of Threat Modeling - URL: https://appsecpodcast.com/adam-shostack-the-jenga-view-of-threat-modeling/ - Published: 2020-06-16 - Guest: Adam Shostack - Duration: 31 min - Transcript: yes, on the page Adam Shostack is a leading expert on threat modeling, and consultant, entrepreneur, technologist, author and game designer. ### Cindy Blake — Aligning security testing with Agile development - URL: https://appsecpodcast.com/cindy-blake-aligning-security-testing-with-agile-development/ - Published: 2020-06-09 - Guest: Cindy Blake - Duration: 30 min - Transcript: yes, on the page Cindy Blake is the Senior Security Evangelist at GitLab. Cindy collaborates around best practices for integrated DevSecOps application security solutions with major enterprises. ### Jannik Hollenbach — Multijuicer: JuiceShop with a side of Kubernetes - URL: https://appsecpodcast.com/jannik-hollenbach-multijuicer-juiceshop-with-a-side-of-kubernetes/ - Published: 2020-06-02 - Guest: Jannik Hollenbach - Duration: 20 min - Transcript: yes, on the page Jannik Hollenbach is a Security Automation Engineer at iteratec GmbH, working on and with open source security testing tools to continuously detect security… ### Sebastien Deleersnyder and Bart De Win — OWASP SAMM - URL: https://appsecpodcast.com/sebastien-deleersnyder-and-bart-de-win-owasp-samm/ - Published: 2020-05-26 - Guests: Bart De Win, Sebastien Deleersnyder - Duration: 40 min - Transcript: yes, on the page How does an organization improve software security without reducing maturity to a checklist? ### Marc French, Steve Lipner, Maya Kaczorowski, DJ Schleen, Kim Wuyts — Season Six Wrap up - URL: https://appsecpodcast.com/marc-french-steve-lipner-maya-kaczorowski-dj-schleen-kim-wuyts-season-six-wrap-up/ - Published: 2020-05-14 - Guests: Kim Wuyts, DJ Schleen, Marc French, Maya Kaczorowski, Steve Lipner - Duration: 25 min - Transcript: yes, on the page Season six closes by revisiting five conversations that capture the breadth of application security. ### Mark Merkow — Secure, Resilient, and Agile Software Development - URL: https://appsecpodcast.com/mark-merkow-secure-resilient-and-agile-software-development/ - Published: 2020-04-11 - Guest: Mark Merkow - Duration: 40 min - Transcript: yes, on the page Mark Merkow works at WageWorks in Tempe, Arizona, leading application security architecture and engineering efforts in the office of the CISO. ### Zsolt Imre — Fuzz testing is easy - URL: https://appsecpodcast.com/zsolt-imre-fuzz-testing-is-easy/ - Published: 2020-04-06 - Guest: Zsolt Imre - Duration: 38 min - Transcript: yes, on the page Fuzz testing can sound specialized and difficult, but Zsolt Imre argues that teams can start small and learn quickly. ### Adam Shostack — Remote Threat Modeling - URL: https://appsecpodcast.com/adam-shostack-remote-threat-modeling/ - Published: 2020-03-28 - Guest: Adam Shostack - Duration: 31 min - Transcript: yes, on the page Adam joins us to discuss remote threat modeling, and we do a live threat modeling exercise to figure out how remote threat modeling actually works. ### Kim Wuyts — Privacy Threat Modeling - URL: https://appsecpodcast.com/kim-wuyts-privacy-threat-modeling/ - Published: 2020-03-23 - Guest: Kim Wuyts - Duration: 28 min - Transcript: yes, on the page A system can protect data from attackers and still violate the privacy of the people using it. ### John Martin — Preventing a Cyberpocalypse - URL: https://appsecpodcast.com/john-martin-preventing-a-cyberpocalypse/ - Published: 2020-03-15 - Guest: John Martin - Duration: 42 min - Transcript: yes, on the page What happens when society’s dependence on software grows faster than its ability to make that software safe? ### Jeremy Long — It’s dependency check, not checker - URL: https://appsecpodcast.com/jeremy-long-it-s-dependency-check-not-checker/ - Published: 2020-02-20 - Guest: Jeremy Long - Duration: 41 min - Transcript: yes, on the page How do you discover vulnerable libraries when the names developers use do not match the names in vulnerability databases? ### Alyssa Miller — Experiences with DevOps + Automation and beyond - URL: https://appsecpodcast.com/alyssa-miller-experiences-with-devops-automation-and-beyond/ - Published: 2020-02-13 - Guest: Alyssa Miller - Duration: 44 min - Transcript: yes, on the page Automating security tests is useful, but it does not by itself make a development team secure. ### Vandana Verma — Support each other - URL: https://appsecpodcast.com/vandana-verma-support-each-other/ - Published: 2020-02-08 - Guest: Vandana Verma - Duration: 29 min - Transcript: yes, on the page Building a stronger security community means helping more kinds of people participate and succeed. ### DJ Schleen — DevOps: The Sec is Silent - URL: https://appsecpodcast.com/dj-schleen-devops-the-sec-is-silent/ - Published: 2020-01-30 - Guest: DJ Schleen - Duration: 38 min - Transcript: yes, on the page What changes when security becomes part of delivering software instead of a separate gate? ### Niels Tanis — 3rd Party Risk in a .NET World - URL: https://appsecpodcast.com/niels-tanis-3rd-party-risk-in-a-net-world/ - Published: 2020-01-24 - Guest: Niels Tanis - Duration: 36 min - Transcript: yes, on the page How much behavior do you inherit when you add one library to a .NET application? Niels Tanis joins Chris and Robert to examine third-party risk beyond checking a dependency for known vulnerabilities. ### Maya Kaczorowski — Container and Orchestration Security - URL: https://appsecpodcast.com/maya-kaczorowski-container-and-orchestration-security/ - Published: 2020-01-16 - Guest: Maya Kaczorowski - Duration: 34 min - Transcript: yes, on the page Containers can improve your security story, but not simply because they are called containers. ### Geoff Hill — AppSec, DevSecOps, and Diplomacy - URL: https://appsecpodcast.com/geoff-hill-appsec-devsecops-and-diplomacy/ - Published: 2020-01-09 - Guest: Geoff Hill - Duration: 37 min - Transcript: yes, on the page Why can a technically sound DevSecOps initiative fail before it changes how anyone works? Geoff Hill joins Chris and Robert to discuss the diplomacy behind application security transformation. ### Erez Yalon — The OWASP API Security Project - URL: https://appsecpodcast.com/erez-yalon-the-owasp-api-security-project/ - Published: 2020-01-03 - Guest: Erez Yalon - Duration: 37 min - Transcript: yes, on the page Why did APIs need a security Top 10 of their own? Erez Yalon joins Chris and Robert to explain the gaps that led to the OWASP API Security project and walk through its original 2019 list. ### Steve Lipner — The Past, Present, and Future of SDL - URL: https://appsecpodcast.com/steve-lipner-the-past-present-and-future-of-sdl/ - Published: 2019-12-20 - Guest: Steve Lipner - Duration: 34 min - Transcript: yes, on the page How did Microsoft's Security Development Lifecycle become a repeatable engineering practice rather than a one-time security push? ### David Kosorok — The Three Pillars of an AppSec Program: Prevent, Detect, and React - URL: https://appsecpodcast.com/david-kosorok-the-three-pillars-of-an-appsec-program-prevent-detect-and-react/ - Published: 2019-12-16 - Guest: David Kosorok - Duration: 31 min - Transcript: yes, on the page Where should a small application security team begin when it cannot do everything? David Kosorok joins Chris and Robert with a practical framework: prevent, detect, and react. ### Chris and Robert: A Taste of Hi-5 - URL: https://appsecpodcast.com/chris-and-robert-a-taste-of-hi-5/ - Published: 2019-12-01 - Duration: 28 min - Transcript: yes, on the page What happens when Chris and Robert trade a single interview topic for five current application security ideas? ### Bill Dougherty — INCLUDES NO DIRT, practical threat modeling for healthcare and beyond - URL: https://appsecpodcast.com/bill-dougherty-includes-no-dirt-practical-threat-modeling-for-healthcare-and-beyond/ - Published: 2019-11-21 - Guest: Bill Dougherty - Duration: 32 min - Transcript: yes, on the page What happens when a threat model has to account for patient privacy and clinical harm as well as attackers? ### Marc French — The AppSec CISO - URL: https://appsecpodcast.com/marc-french-the-appsec-ciso/ - Published: 2019-11-10 - Guest: Marc French - Duration: 44 min - Transcript: yes, on the page Is becoming a CISO the next technical promotion, or a fundamentally different job? Marc French joins Chris and Robert to discuss the role through the eyes of an application security leader. ### Season 5 Finale — A cross section of #AppSec - URL: https://appsecpodcast.com/season-5-finale-a-cross-section-of-appsec/ - Published: 2019-10-26 - Duration: 38 min - Transcript: yes, on the page Season 5 covered application security from tools and threat models to mentoring, self-care, coaching, dependency risk, and program design. ### Ronnie Flathers — Security programs big and small - URL: https://appsecpodcast.com/ronnie-flathers-security-programs-big-and-small/ - Published: 2019-09-28 - Guest: Ronnie Flathers - Duration: 38 min - Transcript: yes, on the page Which parts of an AppSec program should change as a company grows, and which should stay the same? ### Brook Schoenfield — Security is a messy problem - URL: https://appsecpodcast.com/brook-schoenfield-security-is-a-messy-problem/ - Published: 2019-09-15 - Guest: Brook S.E. Schoenfield - Duration: 45 min - Transcript: yes, on the page Why doesn't an executive mandate and a scanning tool add up to a software security program? ### Liran Tal — The state of open source software security - URL: https://appsecpodcast.com/liran-tal-the-state-of-open-source-software-security/ - Published: 2019-09-05 - Guest: Liran Tal - Duration: 34 min - Transcript: yes, on the page Developers may want to own security, but what helps them turn that intention into safer software? Liran Tal joins Chris and Robert to examine Snyk's 2019 State of Open Source Security research. ### Liran Tal — Open Source Security — 5 Minute AppSec - URL: https://appsecpodcast.com/liran-tal-open-source-security-5-minute-appsec/ - Published: 2019-09-03 - Guest: Liran Tal - Duration: 3 min - Transcript: yes, on the page Why should developers care about open source security when they already have features, testing, accessibility, and performance to manage? ### Steve Springett — An insiders checklist for Software Composition Analysis - URL: https://appsecpodcast.com/steve-springett-an-insiders-checklist-for-software-composition-analysis/ - Published: 2019-08-27 - Guest: Steve Springett - Duration: 51 min - Transcript: yes, on the page An SCA tool can find vulnerable libraries and still leave important software supply-chain questions unanswered. ### Steve Springett — OWASP Dependency Track — 5 Minute AppSec - URL: https://appsecpodcast.com/steve-springett-owasp-dependency-track-5-minute-appsec/ - Published: 2019-08-25 - Guest: Steve Springett - Duration: 5 min - Transcript: yes, on the page What does OWASP Dependency-Track add beyond a conventional software composition analysis scanner? ### Elissa Shevinsky — Static Analysis early and often - URL: https://appsecpodcast.com/elissa-shevinsky-static-analysis-early-and-often/ - Published: 2019-08-19 - Guest: Elissa Shevinsky - Duration: 29 min - Transcript: yes, on the page Security testing is more likely to happen when it fits the way developers already work. ### Elissa Shevinsky — Be Kind, Security People — 5 Minute AppSec - URL: https://appsecpodcast.com/elissa-shevinsky-be-kind-security-people-5-minute-appsec/ - Published: 2019-08-14 - Guest: Elissa Shevinsky - Duration: 2 min - Transcript: yes, on the page Why should kindness matter in an industry responsible for protecting money, systems, and sometimes lives? ### Matt McGrath — Security coaches - URL: https://appsecpodcast.com/matt-mcgrath-security-coaches/ - Published: 2019-08-05 - Guest: Matt McGrath - Duration: 44 min - Transcript: yes, on the page Security programs improve when developers have someone who can help them want to get better, not merely tell them what they did wrong. ### Erez Yalon and Liora Herman – The Application Security Village @ DefCon - URL: https://appsecpodcast.com/erez-yalon-and-liora-herman-the-application-security-village-defcon/ - Published: 2019-07-29 - Guests: Erez Yalon, Liora Herman - Duration: 23 min - Transcript: yes, on the page What would an application security conference look like inside DEF CON? Erez Yalon and Liora Herman explain how a volunteer idea became the Application… ### Erez Yalon – AppSec Village – 5 Minute AppSec - URL: https://appsecpodcast.com/erez-yalon-appsec-village-5-minute-appsec/ - Published: 2019-07-29 - Guest: Erez Yalon - Duration: 2 min - Transcript: yes, on the page Why did DEF CON have villages for specialized security communities but no home dedicated to application security? Erez Yalon explains how that recurring question became AppSec Village. ### Tommy Ross — The BSA Framework for Secure Software - URL: https://appsecpodcast.com/tommy-ross-the-bsa-framework-for-secure-software/ - Published: 2019-07-19 - Guest: Tommy Ross - Duration: 37 min - Transcript: yes, on the page Software producers, customers, and policymakers need a common way to discuss security without pretending that one checklist fits every product. ### Adam Shostack — Threat modeling layer 8 and conflict modeling - URL: https://appsecpodcast.com/adam-shostack-threat-modeling-layer-8-and-conflict-modeling/ - Published: 2019-07-10 - Guest: Adam Shostack - Duration: 36 min - Transcript: yes, on the page What if a system works exactly as designed but gives people new ways to harm one another? ### Adam Shostack – Threat Modeling – 5 Minute AppSec - URL: https://appsecpodcast.com/adam-shostack-threat-modeling-5-minute-appsec/ - Published: 2019-07-09 - Guest: Adam Shostack - Duration: 2 min - Transcript: yes, on the page Why threat model when AppSec teams already have scanners, checklists, and testing? ### Zoe Braiterman — AI, ML, AppSec, and a dose of data protection - URL: https://appsecpodcast.com/zoe-braiterman-ai-ml-appsec-and-a-dose-of-data-protection/ - Published: 2019-07-01 - Guest: Zoe Braiterman - Duration: 26 min - Transcript: yes, on the page Artificial intelligence can help analyze security data, but the systems using it also need protection themselves. ### Caroline Wong — Self-care and self-aware for security people - URL: https://appsecpodcast.com/caroline-wong-self-care-and-self-aware-for-security-people/ - Published: 2019-06-14 - Guest: Caroline Wong - Duration: 41 min - Transcript: yes, on the page A successful security career can still become unsustainable when work crowds out everything else. ### Björn Kimminich — The new JuiceShop, GSOC, and Open Security Summit - URL: https://appsecpodcast.com/bjorn-kimminich-the-new-juiceshop-gsoc-and-open-security-summit/ - Published: 2019-06-01 - Guest: Björn Kimminich - Duration: 29 min - Transcript: yes, on the page How do you keep an intentionally vulnerable application useful while its underlying frameworks keep fixing bugs? ### Björn Kimminich — JuiceShop — 5 minute AppSec - URL: https://appsecpodcast.com/bjorn-kimminich-juiceshop-5-minute-appsec/ - Published: 2019-05-26 - Guest: Björn Kimminich - Duration: 5 min - Transcript: yes, on the page What makes OWASP Juice Shop useful to developers when many intentionally vulnerable applications feel dated? ### Nancy Gariché and Tanya Janca — DevSlop, the movement - URL: https://appsecpodcast.com/nancy-gariche-and-tanya-janca-devslop-the-movement/ - Published: 2019-05-21 - Guests: Tanya Janca, Nancy Gariché - Duration: 38 min - Transcript: yes, on the page How does an intentionally vulnerable application become a community learning movement? ### Tanya Janca — Mentoring Monday — 5 Minute AppSec - URL: https://appsecpodcast.com/tanya-janca-mentoring-monday-5-minute-appsec/ - Published: 2019-05-20 - Guest: Tanya Janca - Duration: 5 min - Transcript: yes, on the page Security needs more experienced practitioners, but people do not become senior without guidance, advocacy, and opportunities to learn. ### Matt Clapham — A perspective on appsec from the world of medical software - URL: https://appsecpodcast.com/matt-clapham-a-perspective-on-appsec-from-the-world-of-medical-software/ - Published: 2019-05-13 - Guest: Matt Clapham - Duration: 28 min - Transcript: yes, on the page Security teams learn something different when they leave their own conferences and listen to the industries using their products. ### Jon McCoy — Hacker outreach - URL: https://appsecpodcast.com/jon-mccoy-hacker-outreach/ - Published: 2019-05-06 - Guest: Jon Mccoy - Duration: 25 min - Transcript: yes, on the page How can hackers and corporate security teams work together when each sees the other through a different set of assumptions? ### Omer Levi Hevroni — K8s can keep a secret? - URL: https://appsecpodcast.com/omer-levi-hevroni-k8s-can-keep-a-secret/ - Published: 2019-05-01 - Guest: Omer Levi Hevroni - Duration: 37 min - Transcript: yes, on the page Putting an application in Kubernetes does not solve the problem of getting secrets to it safely. ### Izar Tarandach — Command line threat modeling with pytm - URL: https://appsecpodcast.com/izar-tarandach-command-line-threat-modeling-with-pytm/ - Published: 2019-04-24 - Guest: Izar Tarandach - Duration: 29 min - Transcript: yes, on the page What if developers could describe threats in the same place they describe their software? ### Simon Bennetts — OWASP ZAP: past, present, and future - URL: https://appsecpodcast.com/simon-bennetts-owasp-zap-past-present-and-future/ - Published: 2019-04-13 - Guest: Simon Bennetts - Duration: 25 min - Transcript: yes, on the page How do you make a powerful security testing tool approachable to the developers who need it? ### Bill Sempf — Growing AppSec People and KidzMash - URL: https://appsecpodcast.com/bill-sempf-growing-appsec-people-and-kidzmash/ - Published: 2019-04-08 - Guest: Bill Sempf - Duration: 20 min - Transcript: yes, on the page The shortage of AppSec practitioners will not disappear just by posting more job openings. ### Georgia Weidman — Mobile, IoT, and Pen Testing - URL: https://appsecpodcast.com/georgia-weidman-mobile-iot-and-pen-testing/ - Published: 2019-03-31 - Guest: Georgia Weidman - Duration: 19 min - Transcript: yes, on the page A secure mobile application can still sit on a compromised device or depend on an insecure cloud service. ### Conclusion: Season 4 Finale - URL: https://appsecpodcast.com/conclusion-season-4-finale/ - Published: 2019-02-25 - Duration: 19 min - Transcript: yes, on the page What stood out across a season spanning DevOps, pipelines, community, chaos engineering, dependency risk, and IoT? ### Geoff Hill -- Rapid Threat Model Prototyping Process - URL: https://appsecpodcast.com/geoff-hill-rapid-threat-model-prototyping-process/ - Published: 2019-02-01 - Guest: Geoff Hill - Duration: 47 min - Transcript: yes, on the page What happens when a threat model takes days to produce but the development team has already moved on? ### Bill Wilder -- Running Azure Securely - URL: https://appsecpodcast.com/bill-wilder-running-azure-securely/ - Published: 2019-01-25 - Guest: Bill Wilder - Duration: 44 min - Transcript: yes, on the page Moving an application to Azure changes which security controls you operate yourself and which ones the platform can provide. ### Matt Konda -- OWASP Glue - URL: https://appsecpodcast.com/matt-konda-owasp-glue/ - Published: 2019-01-18 - Guest: Matt Konda - Duration: 36 min - Transcript: yes, on the page Developers need useful findings in their workflow, not another collection of security tools to operate by hand. ### Josh Grossman, Avi Douglen, and Ofer Maor -- AppSec in Israel and Three Talks to watch from AppSec USA - URL: https://appsecpodcast.com/josh-grossman-avi-douglen-and-ofer-maor-appsec-in-israel-and-three-talks-to-watch-from-appsec-usa/ - Published: 2019-01-11 - Guests: Josh Grossman, Ofer Maor, Avi Douglen - Duration: 31 min - Transcript: yes, on the page What can the wider AppSec community learn from Israel’s unusually dense security ecosystem? ### Daniel Miessler -- OWASP IoT Top 10 - URL: https://appsecpodcast.com/daniel-miessler-owasp-iot-top-10/ - Published: 2019-01-01 - Guest: Daniel Miessler - Duration: 45 min - Transcript: yes, on the page An IoT product’s attack surface extends well beyond the device in the box. Daniel Miessler explains that broader view while walking Chris and Robert through the 2018 OWASP IoT Top 10. ### Travis McPeak -- SecOps Makes Developers Lives Easier - URL: https://appsecpodcast.com/travis-mcpeak-secops-makes-developers-lives-easier/ - Published: 2018-12-18 - Guest: Travis McPeak - Duration: 22 min - Transcript: yes, on the page What if a security team measured success partly by making developers’ work easier? Travis McPeak explains that approach to SecOps through concrete examples from Netflix’s cloud environment. ### Chris Romeo -- Security Culture Hacking: Disrupting the Security Status Quo - URL: https://appsecpodcast.com/chris-romeo-security-culture-hacking-disrupting-the-security-status-quo/ - Published: 2018-12-10 - Duration: 32 min - Transcript: yes, on the page Changing security culture requires more than distributing policies or buying another training platform. ### Jim Manico -- The Extremely Unabridged History of SQLi and XSS - URL: https://appsecpodcast.com/jim-manico-the-extremely-unabridged-history-of-sqli-and-xss/ - Published: 2018-12-03 - Guest: Jim Manico - Duration: 30 min - Transcript: yes, on the page Why are SQL injection and cross-site scripting still with us after years of knowing how to prevent them? ### Jeff Williams -- The History of OWASP - URL: https://appsecpodcast.com/jeff-williams-the-history-of-owasp/ - Published: 2018-11-27 - Guest: Jeff Williams - Duration: 44 min - Transcript: yes, on the page OWASP became a reference point for software security, but it began with people sharing knowledge and trying to solve problems together. ### Bjorn Kimminich -- The Joy of the Vulnerable Web: JuiceShop - URL: https://appsecpodcast.com/bjorn-kimminich-the-joy-of-the-vulnerable-web-juiceshop/ - Published: 2018-11-19 - Guest: Björn Kimminich - Duration: 37 min - Transcript: yes, on the page Can an intentionally broken online shop help change an organization’s security culture? ### Swaroop Yermalkar -- iGoat and iOS Mobile Pen Testing - URL: https://appsecpodcast.com/swaroop-yermalkar-igoat-and-ios-mobile-pen-testing/ - Published: 2018-11-13 - Guest: Swaroop Yermalkar - Duration: 28 min - Transcript: yes, on the page Mobile apps can hide credentials, expose powerful backend access, and repeat familiar web security mistakes. ### Adam Bacchus and Jon Bottarini -- Two Sides to a Bug Bounty: The Researcher and The Program - URL: https://appsecpodcast.com/adam-bacchus-and-jon-bottarini-two-sides-to-a-bug-bounty-the-researcher-and-the-program/ - Published: 2018-11-05 - Guests: Adam Bacchus, Jon Bottarini - Duration: 36 min - Transcript: yes, on the page What does a bug bounty look like from both sides of the relationship? Adam Bacchus and Jon Bottarini of HackerOne compare the responsibilities of the… ### Erlend Oftedal -- What You Require, You Must Also Retire - URL: https://appsecpodcast.com/erlend-oftedal-what-you-require-you-must-also-retire/ - Published: 2018-10-30 - Guest: Erlend Oftedal - Duration: 31 min - Transcript: yes, on the page A JavaScript library can keep working long after its security problems become public. ### Abhay Bhargav -- Threat Modeling as Code - URL: https://appsecpodcast.com/abhay-bhargav-threat-modeling-as-code/ - Published: 2018-10-23 - Guest: Abhay Bhargav - Duration: 28 min - Transcript: yes, on the page A threat model that lives in an old document rarely keeps pace with the code it describes. ### Tony UV -- Threat Libraries in the Cloud - URL: https://appsecpodcast.com/tony-uv-threat-libraries-in-the-cloud/ - Published: 2018-10-16 - Guest: Tony UcedaVelez - Duration: 31 min - Transcript: yes, on the page A list of weaknesses is not the same thing as an understanding of the threats facing a business. ### Aaron Rinehart -- Chaos Engineering and #AppSec - URL: https://appsecpodcast.com/aaron-rinehart-chaos-engineering-and-appsec/ - Published: 2018-10-09 - Guest: Aaron Rinehart - Duration: 37 min - Transcript: yes, on the page How do you know a security control will work when the system around it fails? Aaron Rinehart introduces chaos engineering as a way to test assumptions about… ### Jessica Robinson and Vandana Verma-- WIA: Women in #AppSec - URL: https://appsecpodcast.com/jessica-robinson-and-vandana-verma-wia-women-in-appsec/ - Published: 2018-10-01 - Guests: Vandana Verma, Jessica Robinson - Duration: 35 min - Transcript: yes, on the page How can application security become a field where more women enter, contribute, and advance? ### Karen Staley -- A Conversation with Karen - URL: https://appsecpodcast.com/karen-staley-a-conversation-with-karen/ - Published: 2018-09-25 - Guest: Karen Staley - Duration: 17 min - Transcript: yes, on the page What should OWASP members expect from the foundation’s executive leadership, and how can a global nonprofit remain connected to its volunteer community? ### Mohammed Imran -- Back to the Lab Again with a DevOps - URL: https://appsecpodcast.com/mohammed-imran-back-to-the-lab-again-with-a-devops/ - Published: 2018-09-18 - Guest: Mohammed Imran - Duration: 27 min - Transcript: yes, on the page Learning DevSecOps is hard when setting up the lab becomes a project of its own. Mohammed Imran introduces DevSecOps Studio, an environment designed to help… ### Niels Tanis -- A Slice of the Razor with ASP.Net Core - URL: https://appsecpodcast.com/niels-tanis-a-slice-of-the-razor-with-asp-net-core/ - Published: 2018-09-11 - Guest: Niels Tanis - Duration: 29 min - Transcript: yes, on the page Framework defaults can prevent common vulnerabilities, but developers still need to understand when their code bypasses those protections. ### Ofer Maor -- A Pen Testers Transition to #AppSec: #VoteForOfer - URL: https://appsecpodcast.com/ofer-maor-a-pen-testers-transition-to-appsec-voteforofer/ - Published: 2018-09-04 - Guest: Ofer Maor - Duration: 27 min - Transcript: yes, on the page Finding vulnerabilities is only part of improving software security; the harder work is changing how people build and operate applications. ### Matt Tesauro -- #AppSec Pipeline as Toolbox - URL: https://appsecpodcast.com/matt-tesauro-appsec-pipeline-as-toolbox/ - Published: 2018-08-28 - Guest: Matt Tesauro - Duration: 22 min - Transcript: yes, on the page How can a small AppSec team make sense of thousands of applications and a growing pile of security work? ### Stephen de Vries -- Threat Modeling with a bit of #Startup - URL: https://appsecpodcast.com/stephen-de-vries-threat-modeling-with-a-bit-of-startup/ - Published: 2018-08-20 - Guest: Stephen de Vries - Duration: 22 min - Transcript: yes, on the page What developers need from a threat model is often a clear set of requirements they can implement. ### Julien Vehent -- Securing DevOps - URL: https://appsecpodcast.com/julien-vehent-securing-devops/ - Published: 2018-08-14 - Guest: Julien Vehent - Duration: 34 min - Transcript: yes, on the page Can security become a normal part of DevOps without turning every release into an audit? Julien Vehent, author of Securing DevOps, shares what his team learned protecting Firefox services at Mozilla. ### Christian Folini -- CRS and an Abstraction Layer - URL: https://appsecpodcast.com/christian-folini-crs-and-an-abstraction-layer/ - Published: 2018-08-07 - Guest: Christian Folini - Duration: 25 min - Transcript: yes, on the page How can one open-source rule set protect applications across competing products and very different architectures? ### Sean Wright -- Google Chrome and the Case of the Disappearing HTTP - URL: https://appsecpodcast.com/sean-wright-google-chrome-and-the-case-of-the-disappearing-http/ - Published: 2018-07-30 - Guest: Sean Wright - Duration: 25 min - Transcript: yes, on the page What changed when Chrome began labeling ordinary HTTP pages as not secure, and why did that decision provoke resistance? ### Conclusion: All the Pieces You Need for an #AppSec Program - URL: https://appsecpodcast.com/conclusion-all-the-pieces-you-need-for-an-appsec-program/ - Published: 2018-06-12 - Duration: 29 min - Transcript: yes, on the page Which practices belong in a complete application security program? The Season 3 finale answers by assembling clips that move from early development… ### Martin Knobloch -- OWASP, Reach Out; We Are Known and Misunderstood - URL: https://appsecpodcast.com/martin-knobloch-owasp-reach-out-we-are-known-and-misunderstood/ - Published: 2018-06-05 - Guest: Martin Knobloch - Duration: 31 min - Transcript: yes, on the page OWASP is widely recognized, but do people understand the community behind its famous Top 10? ### Devin McMasters -- Bug Bounty with a Side of Empathy - URL: https://appsecpodcast.com/devin-mcmasters-bug-bounty-with-a-side-of-empathy/ - Published: 2018-05-29 - Guest: Devin McMasters - Duration: 30 min - Transcript: yes, on the page A bug bounty can create a productive relationship with security researchers—or damage trust on both sides. ### Apollo Clark -- Malicious User Stories - URL: https://appsecpodcast.com/apollo-clark-malicious-user-stories/ - Published: 2018-05-22 - Guest: Apollo Clark - Duration: 23 min - Transcript: yes, on the page How do you turn a security requirement into something a development team can build and test? ### Megan Roddie -- Neurodiversity in Security - URL: https://appsecpodcast.com/megan-roddie-neurodiversity-in-security/ - Published: 2018-05-15 - Guest: Megan Roddie - Duration: 18 min - Transcript: yes, on the page Could familiar hiring and management practices be keeping talented people out of security? ### Chase Schultz -- AppSec and Hardware - URL: https://appsecpodcast.com/chase-schultz-appsec-and-hardware/ - Published: 2018-04-27 - Guest: Chase Schultz - Duration: 31 min - Transcript: yes, on the page Where does application security end when software controls bootloaders, firmware, processors, and connected devices? ### John Melton -- #OWASP AppSensor - URL: https://appsecpodcast.com/john-melton-owasp-appsensor/ - Published: 2018-04-20 - Guest: John Melton - Duration: 30 min - Transcript: yes, on the page Your application knows when a user does something that should be impossible, but does that knowledge help stop an attack? ### David Habusha -- Third Party Software is not a Cathedral, It’s a Bazaar - URL: https://appsecpodcast.com/david-habusha-third-party-software-is-not-a-cathedral-it-s-a-bazaar/ - Published: 2018-04-13 - Guest: David Habusha - Duration: 37 min - Transcript: yes, on the page An application can inherit serious vulnerabilities from code its developers never wrote. ### Steve Springett -- Dependency Check and Dependency Track - URL: https://appsecpodcast.com/steve-springett-dependency-check-and-dependency-track/ - Published: 2018-04-12 - Guest: Steve Springett - Duration: 48 min - Transcript: yes, on the page Finding a vulnerable library in one build is only the beginning: how do you find every affected application across an organization? ### Steven Wierckx -- The #OWASP Threat Modeling Project - URL: https://appsecpodcast.com/steven-wierckx-the-owasp-threat-modeling-project/ - Published: 2018-04-06 - Guest: Steven Wierckx - Duration: 33 min - Transcript: yes, on the page Can a threat modeling community bring different methods together without forcing everyone into the same process? ### Jim Manico -- The #OWASP Cheat Sheet Project - URL: https://appsecpodcast.com/jim-manico-the-owasp-cheat-sheet-project/ - Published: 2018-04-05 - Guest: Jim Manico - Duration: 31 min - Transcript: yes, on the page Developers need concrete security answers, but finding trustworthy guidance can take longer than writing the code. ### Neil Smithline -- OWASP Top 10 #10: Logging - URL: https://appsecpodcast.com/neil-smithline-owasp-top-10-10-logging/ - Published: 2018-03-23 - Guest: Neil Smithline - Duration: 34 min - Transcript: yes, on the page A log file does little good if nobody can use it to detect or investigate an attack. ### Jim Routh -- Selling #AppSec Up The Chain - URL: https://appsecpodcast.com/jim-routh-selling-appsec-up-the-chain/ - Published: 2018-03-16 - Guest: Jim Routh - Duration: 43 min - Transcript: yes, on the page What if the strongest argument for funding application security is better software delivery rather than fear of a breach? ### Chris and Robert -- #AppSec Recommendations - URL: https://appsecpodcast.com/chris-and-robert-appsec-recommendations/ - Published: 2018-03-09 - Duration: 29 min - Transcript: yes, on the page Which books, sites, conferences, and communities are genuinely useful for learning application security? Chris and Robert compare their personal recommendations and explain what each resource offers. ### Magen Wu -- Hustle and Flow: Dealing With Burnout in Security - URL: https://appsecpodcast.com/magen-wu-hustle-and-flow-dealing-with-burnout-in-security/ - Published: 2018-03-02 - Guest: Magen Wu - Duration: 33 min - Transcript: yes, on the page In a profession that rewards constant vigilance, how do you recognize when dedication has become burnout? ### Katy Anton -- OWASP Top 10 #4 XXE - URL: https://appsecpodcast.com/katy-anton-owasp-top-10-4-xxe/ - Published: 2018-02-23 - Guest: Katy Anton - Duration: 25 min - Transcript: yes, on the page A feature built into XML processing can become a path to file disclosure, internal requests, or denial of service. ### Pete Chestna -- SAST, DAST, and IAST. Oh My! - URL: https://appsecpodcast.com/pete-chestna-sast-dast-and-iast-oh-my/ - Published: 2018-02-16 - Guest: Pete Chestna - Duration: 35 min - Transcript: yes, on the page Buying more scanners does not automatically create a better application security program. ### Irene Michlin -- We Are Not Making It Worse - URL: https://appsecpodcast.com/irene-michlin-we-are-not-making-it-worse/ - Published: 2018-02-09 - Guest: Irene Michlin - Duration: 33 min - Transcript: yes, on the page When a team is already ten sprints into a product, stopping to threat model everything can sound impossible. ### Bill Sempf -- Insecure Deserialization - URL: https://appsecpodcast.com/bill-sempf-insecure-deserialization/ - Published: 2018-02-02 - Guest: Bill Sempf - Duration: 34 min - Transcript: yes, on the page What happens when data arriving at an application is allowed to recreate objects and trigger unexpected behavior? ### Chris and Robert -- Security Champions - URL: https://appsecpodcast.com/chris-and-robert-security-champions/ - Published: 2018-01-26 - Duration: 27 min - Transcript: yes, on the page What is a security champion, and how can an organization build a program that lasts? Chris and Robert compare definitions, alternative titles, and the qualities that make a champion effective. ### Kevin Greene -- Shifting left - URL: https://appsecpodcast.com/kevin-greene-shifting-left/ - Published: 2018-01-19 - Guest: Kevin Greene - Duration: 33 min - Transcript: yes, on the page Moving a security scanner earlier in the pipeline is not the same as building security into development. ### Conclusion: OWASP is for everyone - URL: https://appsecpodcast.com/conclusion-owasp-is-for-everyone/ - Published: 2017-12-05 - Duration: 32 min - Transcript: yes, on the page Why does OWASP matter beyond its famous Top 10 list? The Season 2 finale revisits guests who demonstrate the breadth of the foundation’s work. ### Brian Andrzejewski -- Containers Again - URL: https://appsecpodcast.com/brian-andrzejewski-containers-again/ - Published: 2017-10-24 - Guest: Brian Andrzejewski - Duration: 30 min - Transcript: yes, on the page Containers make deployment repeatable, but insecure images, excessive privileges, and unmanaged secrets can travel with them. ### Tin Zaw -- ModSecurity and #AppSec - URL: https://appsecpodcast.com/tin-zaw-modsecurity-and-appsec/ - Published: 2017-10-17 - Guest: Tin Zaw - Duration: 23 min - Transcript: yes, on the page A web application firewall can buy time during a vulnerability crisis, but only if somebody understands and maintains its rules. ### Aditya Gupta -- The Exploitation of IoT - URL: https://appsecpodcast.com/aditya-gupta-the-exploitation-of-iot/ - Published: 2017-10-10 - Guest: Aditya Gupta - Duration: 24 min - Transcript: yes, on the page Why can an IoT product look secure in one component and still fail as a complete system? ### Jim Manico and Katy Anton -- The Future of the OWASP Proactive Controls - URL: https://appsecpodcast.com/jim-manico-and-katy-anton-the-future-of-the-owasp-proactive-controls/ - Published: 2017-10-03 - Guests: Jim Manico, Katy Anton - Duration: 20 min - Transcript: yes, on the page Where should the OWASP Proactive Controls go after giving developers a concise defensive counterpart to the Top 10? ### Andrew van der Stock and Brian Glas -- The Future of the OWASP Top 10 - URL: https://appsecpodcast.com/andrew-van-der-stock-and-brian-glas-the-future-of-the-owasp-top-10/ - Published: 2017-09-25 - Guests: Andrew van der Stock, Brian Glas - Duration: 36 min - Transcript: yes, on the page How should the OWASP Top 10 balance data, expert judgment, community feedback, and a format people can actually use? ### Robert Hurlbut -- Threat Modeling - URL: https://appsecpodcast.com/robert-hurlbut-threat-modeling/ - Published: 2017-09-19 - Duration: 47 min - Transcript: yes, on the page How do you find security problems in a design before they become expensive changes to running software? ### Chris and Robert -- Passwords, Identity, and #AppSec - URL: https://appsecpodcast.com/chris-and-robert-passwords-identity-and-appsec/ - Published: 2017-09-12 - Duration: 32 min - Transcript: yes, on the page Password advice changes as attackers, hardware, and identity standards evolve. Chris and Robert examine how passwords are guessed, cracked, stored, and… ### Tanya Janca and Nicole Becher -- Hacking APIs and Web Services with DevSlop - URL: https://appsecpodcast.com/tanya-janca-and-nicole-becher-hacking-apis-and-web-services-with-devslop/ - Published: 2017-09-05 - Guests: Tanya Janca, Nicole Becher - Duration: 35 min - Transcript: yes, on the page APIs may lack a visible interface, but that does not make them hidden or safe. Tanya Janca and Nicole Becher use OWASP DevSlop and its Pixi application to… ### Jon Mccoy and Jonathan Marcil -- Agile #AppSec - URL: https://appsecpodcast.com/jon-mccoy-and-jonathan-marcil-agile-appsec/ - Published: 2017-08-29 - Guests: Jon Mccoy, Jonathan Marcil - Duration: 45 min - Transcript: yes, on the page Agile delivery promises fast feedback, but where does application security fit when teams are already moving continuously? ### Jay Beale -- Docker Security and AppSec - URL: https://appsecpodcast.com/jay-beale-docker-security-and-appsec/ - Published: 2017-08-22 - Guest: Jay Beale - Duration: 45 min - Transcript: yes, on the page Does moving an application into Docker make it safer, or simply change the risks you need to manage? ### Chris and Robert -- Proactive Controls, AppSec USA, and Gartners MQ on AppSec Testing - URL: https://appsecpodcast.com/chris-and-robert-proactive-controls-appsec-usa-and-gartners-mq-on-appsec-testing/ - Published: 2017-08-17 - Duration: 23 min - Transcript: yes, on the page What can practitioners learn from a new OWASP document, an upcoming conference, and an industry analyst report in one conversation? ### Robert Hurlbut -- Blackhat Security Conference - URL: https://appsecpodcast.com/robert-hurlbut-blackhat-security-conference/ - Published: 2017-08-08 - Duration: 21 min - Transcript: yes, on the page What should an application security professional take away from a conference famous for spectacular hacks? ### Dave Ferguson -- The OWASP Top 10 Proactive Controls - URL: https://appsecpodcast.com/dave-ferguson-the-owasp-top-10-proactive-controls/ - Published: 2017-07-25 - Guest: Dave Ferguson - Duration: 44 min - Transcript: yes, on the page Developers hear plenty about vulnerabilities, but what should they actually build into their applications to prevent them? ### Jim Manico -- MORE OWASP! - URL: https://appsecpodcast.com/jim-manico-more-owasp/ - Published: 2017-07-04 - Guest: Jim Manico - Duration: 37 min - Transcript: yes, on the page How can developers turn OWASP’s many projects into practical help with the code they write? ### Mike Goodwin -- The OWASP Threat Dragon - URL: https://appsecpodcast.com/mike-goodwin-the-owasp-threat-dragon/ - Published: 2017-06-27 - Guest: Mike Goodwin - Duration: 32 min - Transcript: yes, on the page Threat modeling is easier to adopt when its tools fit the way developers already work. ### Mark Willis -- I Just Like Static Analysis. Static Analysis is My Favorite - URL: https://appsecpodcast.com/mark-willis-i-just-like-static-analysis-static-analysis-is-my-favorite/ - Published: 2017-06-19 - Guest: Mark Willis - Duration: 40 min - Transcript: yes, on the page Static analysis can help developers find security flaws early, but buying a scanner does not create an effective program. ### Eric Johnson -- Continuous Integration in .NET - URL: https://appsecpodcast.com/eric-johnson-continuous-integration-in-net/ - Published: 2017-06-14 - Guest: Eric Johnson - Duration: 28 min - Transcript: yes, on the page Security testing loses value when its results arrive outside the developer’s normal workflow. ### Matt Clapham -- The Technical Debt Ceiling - URL: https://appsecpodcast.com/matt-clapham-the-technical-debt-ceiling/ - Published: 2017-06-06 - Guest: Matt Clapham - Duration: 22 min - Transcript: yes, on the page Every software organization accumulates technical debt, but security debt raises the cost and risk of every future change. ### Chris and Robert -- Controversy within the OWASP Top 10 RC - URL: https://appsecpodcast.com/chris-and-robert-controversy-within-the-owasp-top-10-rc/ - Published: 2017-05-30 - Duration: 31 min - Transcript: yes, on the page Why did the 2017 OWASP Top 10 release candidate provoke such a strong reaction? Chris and Robert walk through the proposed categories, compare them with… ### Brook S.E. Schoenfield -- Security in the Design and Architecture - URL: https://appsecpodcast.com/brook-s-e-schoenfield-security-in-the-design-and-architecture/ - Published: 2017-05-22 - Guest: Brook S.E. Schoenfield - Duration: 54 min - Transcript: yes, on the page Fixing vulnerable code is only part of application security; a flawed design can survive every code-level check. Brook S. E. ### Conclusion: The End…of Season 1 - URL: https://appsecpodcast.com/conclusion-the-end-of-season-1/ - Published: 2017-01-26 - Duration: 19 min - Transcript: yes, on the page What defined the first season of the Application Security Podcast? Chris and Robert revisit clips that established the show’s early themes: thinking like an… ### Rafal Los, James Jardine, and Michael Santarcangelo -- #DtSR and What Makes a Good Security Consultant? - URL: https://appsecpodcast.com/rafal-los-james-jardine-and-michael-santarcangelo-dtsr-and-what-makes-a-good-security-consultant/ - Published: 2017-01-12 - Guests: James Jardine, Michael Santarcangelo, Rafal Los - Duration: 37 min - Transcript: yes, on the page What separates a useful security consultant from someone who merely arrives with answers? ### Adam Shostack -- Think like an Attacker or Accountant? - URL: https://appsecpodcast.com/adam-shostack-think-like-an-attacker-or-accountant/ - Published: 2017-01-04 - Guest: Adam Shostack - Duration: 29 min - Transcript: yes, on the page What does “think like an attacker” actually ask a developer to do? Adam Shostack joins Chris and Robert to challenge a familiar instruction that can leave… ### Jon McCoy -- The Mindset to Reverse Engineer - URL: https://appsecpodcast.com/jon-mccoy-the-mindset-to-reverse-engineer/ - Published: 2016-12-21 - Guest: Jon Mccoy - Duration: 26 min - Transcript: yes, on the page How does a developer learn to take software apart and use that knowledge to build it more securely? ### Chris Romeo -- AppSec Awareness: A Blue Print for Security Culture Change - URL: https://appsecpodcast.com/chris-romeo-appsec-awareness-a-blue-print-for-security-culture-change/ - Published: 2016-12-13 - Duration: 47 min - Transcript: yes, on the page A security awareness program needs to change daily behavior, not simply record who completed a course. ### Tracy Maleeff -- Natural Paranoia as a Career Path? A Transition to Security - URL: https://appsecpodcast.com/tracy-maleeff-natural-paranoia-as-a-career-path-a-transition-to-security/ - Published: 2016-12-06 - Guest: Tracy Maleeff - Duration: 37 min - Transcript: yes, on the page Can a career in library science become a foundation for information security? Tracy Maleeff joins Chris and Robert while making that transition, bringing… ### Chris Romeo -- Security Community at Any Scale - URL: https://appsecpodcast.com/chris-romeo-security-community-at-any-scale/ - Published: 2016-11-29 - Duration: 27 min - Transcript: yes, on the page How can a company build a security community when it has only a few interested people and little budget? ### Deidre Diamond -- The Soft Skills of AppSec - URL: https://appsecpodcast.com/deidre-diamond-the-soft-skills-of-appsec/ - Published: 2016-11-16 - Guest: Deidre Diamond - Duration: 38 min - Transcript: yes, on the page Technical ability can open a door in security, but communication and relationships often determine what happens next. ### Tony UcedaVelez -- PASTA: Not Just for Breakfast Anymore - URL: https://appsecpodcast.com/tony-ucedavelez-pasta-not-just-for-breakfast-anymore/ - Published: 2016-11-08 - Guest: Tony UcedaVelez - Duration: 39 min - Transcript: yes, on the page A useful threat model should explain how an attacker could harm the business, not just complete a checklist. ### Glenn Leifheit -- An Inner Glimpse of the Microsoft SDL - URL: https://appsecpodcast.com/glenn-leifheit-an-inner-glimpse-of-the-microsoft-sdl/ - Published: 2016-11-02 - Guest: Glenn Leifheit - Duration: 50 min - Transcript: yes, on the page How do you keep a secure development lifecycle useful as products, teams, and delivery methods change? ### Mike Landeck -- Security Must Meet the Needs of the Business - URL: https://appsecpodcast.com/mike-landeck-security-must-meet-the-needs-of-the-business/ - Published: 2016-10-25 - Guest: Mike Landeck - Duration: 37 min - Transcript: yes, on the page Security advice only helps when it connects to the needs of the people building and running the business. ### Daniel Ramsbrock -- Web Application Pen Testing – Part 2 - URL: https://appsecpodcast.com/daniel-ramsbrock-web-application-pen-testing-part-2/ - Published: 2016-10-18 - Guest: Daniel Ramsbrock - Duration: 32 min - Transcript: yes, on the page Part two follows Daniel Ramsbrock into the practical workflow of a web application penetration test. ### Daniel Ramsbrock -- Web Application Pen Testing – Part 1 - URL: https://appsecpodcast.com/daniel-ramsbrock-web-application-pen-testing-part-1/ - Published: 2016-10-18 - Guest: Daniel Ramsbrock - Duration: 31 min - Transcript: yes, on the page What should developers and security teams understand before commissioning a web application penetration test? ### Matt Clapham -- Development Security Maturity - URL: https://appsecpodcast.com/matt-clapham-development-security-maturity/ - Published: 2016-10-11 - Guest: Matt Clapham - Duration: 48 min - Transcript: yes, on the page Can you learn enough about a development team’s security practices in an hour to give it useful direction? ### Elena Elkina -- Privacy and Data Protection - URL: https://appsecpodcast.com/elena-elkina-privacy-and-data-protection/ - Published: 2016-10-04 - Guest: Elena Elkina - Duration: 22 min - Transcript: yes, on the page Protecting data from attackers does not answer every question about privacy. Elena Elkina joins Chris and Robert to explain the relationship between… ### Chris and Robert -- Security in the Methodology - URL: https://appsecpodcast.com/chris-and-robert-security-in-the-methodology/ - Published: 2016-09-26 - Duration: 28 min - Transcript: yes, on the page How should application security change when a team moves from Waterfall to Agile? Chris and Robert compare the two development models and map security work onto each one. ### Chris and Robert -- The Activities of the Secure Development Lifecycle - URL: https://appsecpodcast.com/chris-and-robert-the-activities-of-the-secure-development-lifecycle/ - Published: 2016-09-20 - Duration: 44 min - Transcript: yes, on the page Which activities turn a secure development lifecycle from an aspiration into repeatable work? ### Chris and Robert -- Introductions and why #AppSec? - URL: https://appsecpodcast.com/chris-and-robert-introductions-and-why-appsec/ - Published: 2016-09-13 - Duration: 31 min - Transcript: yes, on the page In the inaugural episode of the Application Security Podcast, Chris Romeo and Robert Hurlbut introduce themselves, trace the experiences that brought them…