Marisa Fagan - Measuring Security Culture
Marisa Fagan, Head of Product at Katilyst and veteran security culture expert joins us today to share practical strategies for building and scaling security…
Listen to the episodeTopic
Building an AppSec Program
Standing up and growing an application security function — maturity models, champions, metrics, and getting the budget.
35 episodes
Aram Hovsepyan -- Your Security Dashboard is Lying to You: The Science of Metrics
Aram Hovsepyan joins the podcast today to chat about the misconceptions behind common security metrics.
Listen to the episodeDag Flachet -- Kaizen for your Appsec Program
Dag Flachet joins us to discuss the concept of Kaizen and its application in improving application security.
Listen to the episodeKalyani Pawar -- Shaping AppSec at Startups
Kalyani Pawar shares critical strategies for integrating security early and effectively in AppSec for startups.
Listen to the episodeMilan Williams -- AppSec Metrics
Milan Williams discusses the importance of application security metrics and how to make them both meaningful and actionable.
Listen to the episodeMO Sadek -- Building an AppSec Program from Scratch
Mo Sadek shares his unique journey of building an Application Security program from scratch at Roblox.
Listen to the episodeIrfaan Santoe -- The Power of Strategy in AppSec
Irfaan Santoe joins us for an in-depth discussion on the power of strategy in Application Security.
Listen to the episodeJahanzeb Farooq -- Launching and executing an AppSec program
Jahanzeb Farooq discusses his journey in cybersecurity and the challenges of building AppSec programs from scratch.
Listen to the episodeDevin Rudnicki -- Expanding AppSec
Devon Rudnicki, the Chief Information Security Officer at Fitch Group, shares her journey of developing an application security program from scratch and advancing to the CISO role.
Listen to the episodeDustin Lehr -- Culture Change through Champions and Gamification
Dustin Lehr, Senior Director of Platform Security/Deputy CISO at Fivetran and Chief Solutions Officer at Katilyst Security, joins Robert and Chris to discuss security champions.
Listen to the episodeJay Bobo & Darylynn Ross -- App Sec Is Dead. Product Security Is the Future.
Jay Bobo and Darylynn Ross from CoverMyMeds join Chris to explain their assertion that 'AppSec is Dead.' They discuss the differences between product and…
Listen to the episodeEitan Worcel -- Is AI a Security Champion?
Eitan Worcel joins the Application Security Podcast, to talk automated code fixes and the role of artificial intelligence in application security.
Listen to the episodeRay Espinoza -- The AppSec CISO, Vendor Relationships, and Mentoring
For Security Pros & Business Leaders | Strategic Insights & Leadership Lessons 🔒🌟 When Ray Espinoza joined Chris and Robert on the Application…
Listen to the episodeJeff Williams -- The Tech of Runtime Security
Jeff Willams of Contrast Security joins Chris and Robert on the Application Security Podcast to discuss runtime security, emphasizing the significance of…
Listen to the episode9 mintranscript
Farshad Abasi -- Three Models for Deploying AppSec Resources
Farshad Abasi shares three models for deploying resources within application security teams: The Dedicated AppSec Person Model involves assigning an AppSec person to work with each team.
Listen to the episodeJeevan Singh -- The Future of Application Security Engineers
Jeevan Singh, the director of product security at Twilio, discusses the future of application security engineers.
Listen to the episodeDerek Fisher -- The Application Security Handbook
Derek is the author of “The Application Security Handbook.” He is a university instructor at Temple University, where he teaches software development security to undergraduate and graduate students.
Listen to the episodeAlex Olsen -- Security champions, empowering developers, and AppSec training
Alex leads the Cyber Security Consulting Group, part of Rakuten's Cyber Security Defense Department.
Listen to the episodeBrenna Leath -- Product Security Leads: A different way of approaching Security Champions
Brenna Leath is currently the Head of Product Security for a data analytics company where she sets the application security strategy for R&D and leads a team of security architects.
Listen to the episodeTimo Pagel -- DevSecOps Maturity Model
Timo Pagel has been in the IT industry for over fifteen years. After a system administrator and web developer career, he advises customers as a DevSecOps consultant and trainer.
Listen to the episodeDustin Lehr -- Advocating and being on the side of developers
Before taking the plunge into information security leadership, Dustin Lehr spent over a decade as a software engineer and architect in a variety of…
Listen to the episodeJim Routh — Secure software pipelines
Jim Routh has built software security programs at some of the biggest brands in the world.
Listen to the episodeSebastien Deleersnyder and Bart De Win — OWASP SAMM
Sebastien Deleersnyder is co-founder, CEO of Toreon, and Bart De Win is a director within PwC Belgium. They work together to co-lead both the OWASP Belgium Chapter and the OWASP SAMM project.
Listen to the episodeMark Merkow — Secure, Resilient, and Agile Software Development
Mark Merkow works at WageWorks in Tempe, Arizona, leading application security architecture and engineering efforts in the office of the CISO.
Listen to the episode37 mintranscript
Geoff Hill — AppSec, DevSecOps, and Diplomacy
Geoffrey Hill is an AppSec DevSecOps leader and Architect. Geoff joins us to discuss his experiences rolling out DevSecOps in both Agile and non-Agile practicing shops.
Listen to the episode31 mintranscript
David Kosorok — The Three Pillars of an AppSec Program: Prevent, Detect, and React
David Kosorok is a code security expert, software tester, father of 9, and a self-described major nerd.
Listen to the episode38 mintranscript
Ronnie Flathers — Security programs big and small
Ronnie Flathers is a security guy, a pentester, and a researcher. In this conversation, we explore his experiences in building application security programs.
Listen to the episode44 mintranscript
Matt McGrath — Security coaches
Matt McGrath is an old school Java developer that made the transition into security. Matt has had success in rolling out a programmatic approach to security improvement called security coaching.
Listen to the episode32 mintranscript
Chris Romeo -- Security Culture Hacking: Disrupting the Security Status Quo
We listen in on the #AppSecUSA talk by Chris about Security Culture Hacking. You can find Chris on Twitter @edgeroute
Listen to the episode36 mintranscript
Adam Bacchus and Jon Bottarini -- Two Sides to a Bug Bounty: The Researcher and The Program
Chris and Robert talk with Adam and John from HackerOne about Bug Bounty. They dive into bug bounty from the programming and security researcher sides to…
Listen to the episode29 mintranscript
Conclusion: All the Pieces You Need for an #AppSec Program
The conclusion of Season 3, all the best highlights, and some great advice from our guests on what you need to build an #AppSec Program.
Listen to the episode43 mintranscript
Jim Routh -- Selling #AppSec Up The Chain
Jim Routh joins the podcast to discuss selling #AppSec up the chain. Jim has built five successful software security programs in his career and serves as a CISO now.
Listen to the episode35 mintranscript
Pete Chestna -- SAST, DAST, and IAST. Oh My!
Pete Chestna is an advocate for SAST, DAST, and IAST tools and a passionate #AppSec enthusiast.
Listen to the episode27 mintranscript
Chris and Robert -- Security Champions
Security champions are the hands and feet of any well-equipped product security team.
Listen to the episode22 mintranscript
Matt Clapham -- The Technical Debt Ceiling
Our topic today is technical debt and how security plays into it. Chris was at Converge Conference 2017 in Detroit, Michigan (which he says is the best…
Listen to the episode