About all things AppSec, DevOps, and DevSecOps. Hosted by Mike Shema and John Kinsella, the podcast focuses on helping its audience find and fix software flaws effectively.
…
continue reading
Applicationsecurityweekly Podcasts
About all things AppSec, DevOps, and DevSecOps. Hosted by Mike Shema and John Kinsella, the podcast focuses on helping its audience find and fix software flaws effectively.
…
continue reading
1
Secure By Design Is Better Than Secure By Myth - Bob Lord - ASW #365
53:33
53:33
Play later
Play later
Lists
Like
Liked
53:33
Not all infosec advice is helpful. Bad advice wastes time, makes people less secure, and takes focus away from making software more secure. Bob Lord talks about his efforts to tamp down hacklore -- the security myths and mistakes that crop up in news stories and advice to users. He talks about how these myths come about, why they're harmful, and ho…
…
continue reading
1
Secure By Design Is Better Than Secure By Myth - Bob Lord - ASW #365
53:33
53:33
Play later
Play later
Lists
Like
Liked
53:33
Not all infosec advice is helpful. Bad advice wastes time, makes people less secure, and takes focus away from making software more secure. Bob Lord talks about his efforts to tamp down hacklore -- the security myths and mistakes that crop up in news stories and advice to users. He talks about how these myths come about, why they're harmful, and ho…
…
continue reading
1
The Upsides and Downsides of LLM-Generated Code - Chris Wysopal - ASW #364
1:10:12
1:10:12
Play later
Play later
Lists
Like
Liked
1:10:12
Developers are adding LLMs to their code creation toolboxes, using them to assist with writing and reviewing code. Chris Wysopal talks about the security downsides of relying on LLMs and how appsec needs to adapt to dealing with more code at a faster pace. Resources https://www.veracode.com/blog/genai-code-security-report/ https://www.veracode.com/…
…
continue reading
1
The Upsides and Downsides of LLM-Generated Code - Chris Wysopal - ASW #364
1:10:12
1:10:12
Play later
Play later
Lists
Like
Liked
1:10:12
Developers are adding LLMs to their code creation toolboxes, using them to assist with writing and reviewing code. Chris Wysopal talks about the security downsides of relying on LLMs and how appsec needs to adapt to dealing with more code at a faster pace. Resources https://www.veracode.com/blog/genai-code-security-report/ https://www.veracode.com/…
…
continue reading
1
AI-Era AppSec: Transparency, Trust, and Risk Beyond the Firewall - Felipe Zipitria, Steve Springett, Aruneesh Salhotra, Ken Huang - ASW #363
1:06:43
1:06:43
Play later
Play later
Lists
Like
Liked
1:06:43
In an era dominated by AI-powered security tools and cloud-native architectures, are traditional Web Application Firewalls still relevant? Join us as we speak with Felipe Zipitria, co-leader of the OWASP Core Rule Set (CRS) project. Felipe has been at the forefront of open-source security, leading the development of one of the world's most widely d…
…
continue reading
1
AI-Era AppSec: Transparency, Trust, and Risk Beyond the Firewall - Felipe Zipitria, Steve Springett, Aruneesh Salhotra, Ken Huang - ASW #363
1:06:43
1:06:43
Play later
Play later
Lists
Like
Liked
1:06:43
In an era dominated by AI-powered security tools and cloud-native architectures, are traditional Web Application Firewalls still relevant? Join us as we speak with Felipe Zipitria, co-leader of the OWASP Core Rule Set (CRS) project. Felipe has been at the forefront of open-source security, leading the development of one of the world's most widely d…
…
continue reading
1
Modern AppSec: OWASP SAMM, AI Secure Coding, Threat Modeling & Champions - Sebastian Deleersnyder, Dustin Lehr, James Manico, Adam Shostack - ASW #362
1:07:52
1:07:52
Play later
Play later
Lists
Like
Liked
1:07:52
Using OWASP SAMM to assess and improve compliance with the Cyber Resilience Act (CRA) is an excellent strategy, as SAMM provides a framework for secure development practices such as secure by design principles and handling vulns. Segment Resources: https://owaspsamm.org/ https://cybersecuritycoalition.be/resource/a-strategic-approach-to-product-sec…
…
continue reading
1
Modern AppSec: OWASP SAMM, AI Secure Coding, Threat Modeling & Champions - Sebastian Deleersnyder, James Manico, Adam Shostack, Dustin Lehr - ASW #362
1:07:52
1:07:52
Play later
Play later
Lists
Like
Liked
1:07:52
Using OWASP SAMM to assess and improve compliance with the Cyber Resilience Act (CRA) is an excellent strategy, as SAMM provides a framework for secure development practices such as secure by design principles and handling vulns. Segment Resources: https://owaspsamm.org/ https://cybersecuritycoalition.be/resource/a-strategic-approach-to-product-sec…
…
continue reading
1
Developing Open Source Skills for Maintaining Projects - Kat Cosgrove - ASW #361
1:03:55
1:03:55
Play later
Play later
Lists
Like
Liked
1:03:55
Open source projects benefit from support that takes many shapes. Kat Cosgrove shares her experience across the Kubernetes project and the different ways people can make meaningful contributions to it. One of the underlying themes is that code is written for other people. That means PRs need to be understandable, discussions need to be enlightening…
…
continue reading
1
Developing Open Source Skills for Maintaining Projects - Kat Cosgrove - ASW #361
1:03:55
1:03:55
Play later
Play later
Lists
Like
Liked
1:03:55
Open source projects benefit from support that takes many shapes. Kat Cosgrove shares her experience across the Kubernetes project and the different ways people can make meaningful contributions to it. One of the underlying themes is that code is written for other people. That means PRs need to be understandable, discussions need to be enlightening…
…
continue reading
1
Making OAuth Scale Securely for MCPs - Aaron Parecki - ASW #360
1:07:43
1:07:43
Play later
Play later
Lists
Like
Liked
1:07:43
The MCP standard gave rise to dreams of interconnected agents and nightmares of what those interconnected agents would do with unfettered access to APIs, data, and local systems. Aaron Parecki explains how OAuth's new Client ID Metadata Documents spec provides more security for MCPs and the reasons why the behavior and design of MCPs required a new…
…
continue reading
1
Making OAuth Scale Securely for MCPs - Aaron Parecki - ASW #360
1:07:43
1:07:43
Play later
Play later
Lists
Like
Liked
1:07:43
The MCP standard gave rise to dreams of interconnected agents and nightmares of what those interconnected agents would do with unfettered access to APIs, data, and local systems. Aaron Parecki explains how OAuth's new Client ID Metadata Documents spec provides more security for MCPs and the reasons why the behavior and design of MCPs required a new…
…
continue reading
1
Making TN Critical Infrastructure the Most Secure in the Nation - T. Gwyddon 'Data' ("Gwee-thin") Owen, James Cotter - ASW #359
59:02
59:02
Play later
Play later
Lists
Like
Liked
59:02
For OT systems, uptime is paramount. That's a hard rule that makes maintaining, upgrading, and securing them a complex struggle. Tomas "Data" Owens and James Cotter discuss how Tennessee is tackling the organizational and technical challenges that come with hardening OT systems across the state. Those challenges range from old technology (like RS-2…
…
continue reading
1
Making TN Critical Infrastructure the Most Secure in the Nation - T. Gwyddon 'Data' ("Gwee-thin") Owen, James Cotter - ASW #359
59:02
59:02
Play later
Play later
Lists
Like
Liked
59:02
For OT systems, uptime is paramount. That's a hard rule that makes maintaining, upgrading, and securing them a complex struggle. Tomas "Data" Owens and James Cotter discuss how Tennessee is tackling the organizational and technical challenges that come with hardening OT systems across the state. Those challenges range from old technology (like RS-2…
…
continue reading
1
Figuring Out Where to Start with Secure Code - ASW #358
46:23
46:23
Play later
Play later
Lists
Like
Liked
46:23
What are your favorite resources for secure code? Co-hosts John Kinsella and Kalyani Pawar talk about the reality of bringing security into a business. We talk about the role of the OWASP Top 10 and the OWASP ASVS in crafting security programs. And balance that with a discussion in what's the best use of everyone's time -- developers and appsec fol…
…
continue reading
1
Figuring Out Where to Start with Secure Code - ASW #358
46:23
46:23
Play later
Play later
Lists
Like
Liked
46:23
What are your favorite resources for secure code? Co-hosts John Kinsella and Kalyani Pawar talk about the reality of bringing security into a business. We talk about the role of the OWASP Top 10 and the OWASP ASVS in crafting security programs. And balance that with a discussion in what's the best use of everyone's time -- developers and appsec fol…
…
continue reading
1
Secure Coding as Critical Thinking Instead of Vulnspotting - Matias Madou - ASW #357
1:03:41
1:03:41
Play later
Play later
Lists
Like
Liked
1:03:41
Secure code should be grounded more in concepts like secure by default and secure by design than by "spot the vuln" thinking. Matias Madou shares his experience in secure coding training and the importance of teaching critical thinking. He also discusses why critical thinking is so closely related to threat modeling and how LLMs can be a tool for h…
…
continue reading
1
Secure Coding as Critical Thinking Instead of Vulnspotting - Matias Madou - ASW #357
1:03:41
1:03:41
Play later
Play later
Lists
Like
Liked
1:03:41
Secure code should be grounded more in concepts like secure by default and secure by design than by "spot the vuln" thinking. Matias Madou shares his experience in secure coding training and the importance of teaching critical thinking. He also discusses why critical thinking is so closely related to threat modeling and how LLMs can be a tool for h…
…
continue reading
1
Ransomware, Defaults, and Proactive Defenses - Rob Allen - ASW #356
1:11:26
1:11:26
Play later
Play later
Lists
Like
Liked
1:11:26
Just how bad can things get if someone clicks on a link? Rob Allen joins us again to talk about ransomware, why putting too much attention on clicking links misses the larger picture of effective defenses, and what orgs can do to prepare for an influx of holiday-infused ransomware targeting. Segment resources https://www.bleepingcomputer.com/news/s…
…
continue reading
1
Ransomware, Defaults, and Proactive Defenses - Rob Allen - ASW #356
1:11:26
1:11:26
Play later
Play later
Lists
Like
Liked
1:11:26
Just how bad can things get if someone clicks on a link? Rob Allen joins us again to talk about ransomware, why putting too much attention on clicking links misses the larger picture of effective defenses, and what orgs can do to prepare for an influx of holiday-infused ransomware targeting. Segment resources https://www.bleepingcomputer.com/news/s…
…
continue reading
1
Researching and Remediating RCEs via GitHub Actions - Bar Kaduri, Roi Nisimi - ASW #355
1:08:08
1:08:08
Play later
Play later
Lists
Like
Liked
1:08:08
Pull requests are a core part of collaboration, whether in open or closed source. GitHub has documented some of the security consequences of misconfiguring how PRs can trigger actions. But what happens when repo owners don't read the docs? Bar Kaduri and Roi Nisimi walk through their experience in reading docs, finding vulns, demonstrating exploits…
…
continue reading
1
Researching and Remediating RCEs via GitHub Actions - Bar Kaduri, Roi Nisimi - ASW #355
1:08:08
1:08:08
Play later
Play later
Lists
Like
Liked
1:08:08
Pull requests are a core part of collaboration, whether in open or closed source. GitHub has documented some of the security consequences of misconfiguring how PRs can trigger actions. But what happens when repo owners don't read the docs? Bar Kaduri and Roi Nisimi walk through their experience in reading docs, finding vulns, demonstrating exploits…
…
continue reading
1
Quantum Computing Isn't A Threat To Blockchains - Yet - Sandy Carielli, Martha Bennett - ASW #354
58:52
58:52
Play later
Play later
Lists
Like
Liked
58:52
The post quantum encryption migration is going to be a challenge, but how much of a challenge? There are several reasons why it is different from every other protocol and cypher iteration in the past. Is today's hardware up to the task? Is it just swapping out a library, or is there more to it? What is the extent of software, systems, and architect…
…
continue reading
1
Quantum Computing Isn't A Threat To Blockchains - Yet - Martha Bennett, Sandy Carielli - ASW #354
58:52
58:52
Play later
Play later
Lists
Like
Liked
58:52
The post quantum encryption migration is going to be a challenge, but how much of a challenge? There are several reasons why it is different from every other protocol and cypher iteration in the past. Is today's hardware up to the task? Is it just swapping out a library, or is there more to it? What is the extent of software, systems, and architect…
…
continue reading
1
Reacting to Ransomware and Setting Secure Defaults - Rob Allen - ASW #353
1:03:39
1:03:39
Play later
Play later
Lists
Like
Liked
1:03:39
Ransomware attacks typically don't care about memory safety and dependency scanning, they often target old, unpatched vulns and too often they succeed. Rob Allen shares some of the biggest cases he's seen, what they have in common, and what appsec teams could do better to help them. Too much software still requires custom configuration to make it m…
…
continue reading
