OWASP Candidate Debate - 2025 Edition
In this special episode of the Application Security Podcast we meet nine of the OWASP Board of Directors candidates.
Listen to the episodeTopic
OWASP Projects
The tools and standards that come out of OWASP — ZAP, ASVS, SAMM, Juice Shop, the Cheat Sheets, and the people who build them.
46 episodes
Steve Springett -- Software and System Transparency
Steve Springett, an expert in secure software development and a key figure in several OWASP projects is back. Steve unpacks CycloneDX and the value proposition of various BOMs.
Listen to the episodeMark Curphey and Simon Bennetts -- Riding the Coat Tails of ZAP, without Open Source Funding
Mark Curphey and Simon Bennetts, join Chris on the podcast to discuss the challenges of funding and sustaining major open source security projects like ZAP.
Listen to the episodeBjörn Kimminich -- OWASP Juice Shop
Bjorn Kimminich, the driving force behind the OWASP Juice Shop project, joins Chris and Robert to discuss all things Juice Shop.
Listen to the episodeOWASP Board of Directors Debate
The Application Security Podcast presents the OWASP Board of Directors Debate for the 2023 elections. This is a unique and engaging discussion among six candidates vying for a position on the board.
Listen to the episodeMark Curphey and John Viega -- Chalk
Mark Curphey and John Viega join Chris and Robert to explain the details of Chalk, Crash Override's new tool.
Listen to the episodeKevin Johnson -- Samurai Swords and Zap's Departure
Kevin Johnson is the CEO of Secure Ideas. He began his career as a developer but turned toward security when he discovered that the interface for an intrusion detection system, Snort, was out of date.
Listen to the episodeMark Curphey -- The future of OWASP
Mark Curphey is one of the creators of OWASP from the very early days. Mark worked in the background over the few decades of OWASP but has recently taken more to the spotlight.
Listen to the episodeTiago Mendo -- How to scan at scale with OWASP ZAP
Tiago Mendo is a co-founder and CTO of Probely. He has extensive experience in pentesting applications, training, and providing all-around security consultancy.
Listen to the episodeDominique Righetto -- OWASP Secure Headers
Dominique Righetto is an AppSec enthusiast and OWASP projects contributor. Dominique joins us to discuss the OWASP Secure Headers project.
Listen to the episodePatrick Dwyer -- CycloneDX and SBOMs
Patrick is a Senior Product Security Engineer in the Application Security team at ServiceNow. He is also Co-Leader of the OWASP CycloneDX project.
Listen to the episodeSimon Bennetts -- Using OWASP Zap across an Enterprise
Simon Bennetts is the OWASP Zed Attack Proxy (ZAP) Project Leader and a Distinguished Engineer at StackHawk, a company that uses ZAP to help users fix…
Listen to the episodeTimo Pagel -- DevSecOps Maturity Model
Timo Pagel has been in the IT industry for over fifteen years. After a system administrator and web developer career, he advises customers as a DevSecOps consultant and trainer.
Listen to the episodeVandana Verma -- OWASP Spotlight Series
Vandana Verma is the President of Infosec girls and Infosec Kids, a board of directors member for OWASP, and a leader for BSides Dehli. She joins us to introduce the OWASP Spotlight Series.
Listen to the episodeJC Herz and Steve Springett — SBOMs and software supply chain assurance
JC Herz is the COO of Ion Channel, a software logistics and supply chain assurance platform for critical infrastructure.
Listen to the episodeElie Saad — OWASP WSTG, Cheat Sheets, and Integration
Elie Saad is an application security engineer, leading three different OWASP projects.
Listen to the episodeJannik Hollenbach — Multijuicer: JuiceShop with a side of Kubernetes
Jannik Hollenbach is a Security Automation Engineer at iteratec GmbH, working on and with open source security testing tools to continuously detect security…
Listen to the episodeSebastien Deleersnyder and Bart De Win — OWASP SAMM
Sebastien Deleersnyder is co-founder, CEO of Toreon, and Bart De Win is a director within PwC Belgium. They work together to co-lead both the OWASP Belgium Chapter and the OWASP SAMM project.
Listen to the episode41 mintranscript
Jeremy Long — It’s dependency check, not checker
Jeremy Long is a principal engineer specializing in securing the SDLC. Jeremy is the founder and project lead for the OWASP dependency-check project; a…
Listen to the episode38 mintranscript
Season 5 Finale — A cross section of #AppSec
Threat modeling, secrets, mentoring, self-care, program building, and much more. Clips from Georgia Weidman, Simon Bennetts, Izar Tarandach, Omer Levi…
Listen to the episode51 mintranscript
Steve Springett — An insiders checklist for Software Composition Analysis
Steve Springett is a technologist, husband, father, entrepreneur, and tequila aficionado. He is the creator of the OWASP @DependencyTrack and @CycloneDX_Spec.
Listen to the episode5 mintranscript
Steve Springett — OWASP Dependency Track — 5 Minute AppSec
The question is for Steve Springett, in regards to Software Composition Analysis / Software Supply Chain and OWASP Dependency Track.
Listen to the episode29 mintranscript
Björn Kimminich — The new JuiceShop, GSOC, and Open Security Summit
Björn Kimminich is the project leader for OWASP JuiceShop. This is his second visit to the podcast, and we discuss new features in JuiceShop, including XSS…
Listen to the episode5 mintranscript
Björn Kimminich — JuiceShop — 5 minute AppSec
Björn Kimminich is the project leader for OWASP JuiceShop. He created JuiceShop out of necessity, after reviewing all the available vulnerable web apps years ago, and not finding what he needed.
Listen to the episode38 mintranscript
Nancy Gariché and Tanya Janca — DevSlop, the movement
Nancy Gariché and Tanya Janca are two of the project leaders for the OWASP DevSlop Project. As we learn more about DevSlop, we realize that it is much more than a project: it's a movement.
Listen to the episode25 mintranscript
Simon Bennetts — OWASP ZAP: past, present, and future
Simon Bennetts is the project leader for OWASP ZAP. Simon joined Robert at CodeMash to talk about the origin of ZAP, the new heads up display, and ZAP API.
Listen to the episode36 mintranscript
Matt Konda -- OWASP Glue
Matt Konda joins Chris and Robert to talk about what Glue is. You can find Matt on Twitter @mkonda OWASP Glue
Listen to the episode44 mintranscript
Jeff Williams -- The History of OWASP
Chris talks with Jeff Williams about the History of OWASP and where it came from. You can find Jeff on Twitter @planetlevel
Listen to the episode37 mintranscript
Bjorn Kimminich -- The Joy of the Vulnerable Web: JuiceShop
Bjorn Kimminich joins to talk about JuiceShop. He dives into what JuiceShop is and some of its use cases. You can find Bjorn on Twitter @bkimminich
Listen to the episode28 mintranscript
Swaroop Yermalkar -- iGoat and iOS Mobile Pen Testing
Chris is at AppSec USA and is joined by Swaroop to talk about iGoat. They discuss how iGoat relates to WebGoat and how they can be used for pen testing.
Listen to the episode31 mintranscript
Erlend Oftedal -- What You Require, You Must Also Retire
Chris talks with Erlend Oftedal about the Norway Chapter of OWASP and continues on to what retire.js is and how it works.
Listen to the episode22 mintranscript
Matt Tesauro -- #AppSec Pipeline as Toolbox
We're joined by Matt Tesauro, a co-lead for the AppSec Pipeline Project. He explains how they began building this project and some ways for you to start using this in your organization.
Listen to the episode22 mintranscript
Stephen de Vries -- Threat Modeling with a bit of #Startup
Stephen de Vries joins to discuss Threat Modeling and the unique approach that he takes by using tooling. We also discuss application security and startups.
Listen to the episode25 mintranscript
Christian Folini -- CRS and an Abstraction Layer
Christian Folini joins Chris at AppSec EU for this episode about ModSecurity and the Core Rule Set project from OWASP.
Listen to the episode29 mintranscript
Conclusion: All the Pieces You Need for an #AppSec Program
The conclusion of Season 3, all the best highlights, and some great advice from our guests on what you need to build an #AppSec Program.
Listen to the episode31 mintranscript
Martin Knobloch -- OWASP, Reach Out; We Are Known and Misunderstood
Martin Knobloch joins Chris and Robert to discuss all things OWASP. They dive into the history of OWASP and some of the plans for the future. You can find Martin on Twitter @knoblochmartin.
Listen to the episode30 mintranscript
John Melton -- #OWASP AppSensor
John Melton joins to discuss the #OWASP AppSensor project. He talks about how AppSensor works and how it can be used in your application.
Listen to the episode48 mintranscript
Steve Springett -- Dependency Check and Dependency Track
Steve Springett joins the show to talk about Dependency Check and Dependency Track. He also discusses how they can help prevent you from using components with known vulnerabilities.
Listen to the episode31 mintranscript
Jim Manico -- The #OWASP Cheat Sheet Project
Jim Manico joins us to discuss some of the changes with the OWASP Cheat Sheets and their plans for that project's future.
Listen to the episode23 mintranscript
Tin Zaw -- ModSecurity and #AppSec
Tin Zaw, an advocate for ModSecurity, joins Robert and Chris. He dives into its background, the use of rules, and the many advantages.
Listen to the episode20 mintranscript
Jim Manico and Katy Anton -- The Future of the OWASP Proactive Controls
Chris and Robert talk to Jim Manico and Katy Anton about the OWASP Proactive Controls project. We have discussed this before, and they are looking for feedback on the upcoming update.
Listen to the episode36 mintranscript
Andrew van der Stock and Brian Glas -- The Future of the OWASP Top 10
We talk about the future of the OWASP Top 10. We do this by meeting the new project leadership team, understanding the process for how they do governance…
Listen to the episode35 mintranscript
Tanya Janca and Nicole Becher -- Hacking APIs and Web Services with DevSlop
Tanya and Nicole join Chris and Robert. They talk about what APIs are, how they are used, and some of the threats involved with them.
Listen to the episode44 mintranscript
Dave Ferguson -- The OWASP Top 10 Proactive Controls
Dave Ferguson discusses the OWASP Top 10 Proactive Controls in this episode with Chris.
Listen to the episode37 mintranscript
Jim Manico -- MORE OWASP!
We’re here today with Jim Manico, a project lead with OWASP. We dive deep into some of the projects on his plate.
Listen to the episode32 mintranscript
Mike Goodwin -- The OWASP Threat Dragon
In this episode, we speak with Mike Goodwin, the founder of the OWASP Threat Dragon.
Listen to the episode