The Application Security Weekly podcast delivers interviews and news from the worlds of AppSec, DevOps, DevSecOps, and all the other ways people find and fix software flaws. Join hosts Mike Shema, John Kinsella, and Akira Brand on a journey through modern security practices for apps, clouds, containers, and more.
…
continue reading
A lively discussion of the threats affecting supply chain, specifically focused on firmware and low-level code that is a blind spot for many organizations. This podcast will feature guests from the cybersecurity industry discussing the problems surrounding supply chain-related issues and potential solutions.
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Changing the Course of IoT's Future from Its Insecure Past - Paddy Harrington - ASW #297
37:21
37:21
Play later
Play later
Lists
Like
Liked
37:21
IoT devices are notorious for weak designs, insecure implementations, and a lifecycle that mostly ignores patching. We look at external factors that might lead to change, like the FCC's cybersecurity labeling for IoT. We explore the constraints that often influence poor security on these devices, whether those constraints are as consequential given…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Navigating the Path to Maturity & AI is helping combat cyber threats - Shimon Modi, Boaz Barzel - ASW #296
39:21
39:21
Play later
Play later
Lists
Like
Liked
39:21
As development cycles shorten and more responsibilities shift to developers, application security (AppSec) is rapidly evolving. Organizations are increasingly building mature programs that automate and enhance AppSec, moving beyond manual processes. In this discussion, we explore how organizations are adapting their AppSec practices, highlighting t…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
The Fallout and Lessons Learned from the CrowdStrike Fiasco - Allie Mellen, Jeff Pollard - ASW #296
42:38
42:38
Play later
Play later
Lists
Like
Liked
42:38
This week, Jeff Pollard and Allie Mellen join us to discuss the fallout and lessons learned from the CrowdStrike fiasco. They explore the reasons behind running in the kernel, the challenges of software quality, and the distinction between a security incident and an IT incident. They also touch on the need to reduce the attack surface and the impor…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Supply Chain Policies - Stewart Scott, Trey Herr - BTS #36
59:37
59:37
Play later
Play later
Lists
Like
Liked
59:37
Stewart and Trey join us to talk about driving cybersecurity policies for the nation, what makes a good policy, what makes a bad policy, supply chain research and policies, and overall how we shape policies that benefit cybersecurity. Segment Resources: https://www.atlanticcouncil.org/in-depth-research-reports/report/broken-trust-lessons-from-sunbu…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Reducing Supply Chain Risk & What’s lurking in your phone? - Danny Jenkins, Nikos Kiourtis - ASW #295
34:30
34:30
Play later
Play later
Lists
Like
Liked
34:30
In complex software ecosystems, individual application risks are compounded. When it comes to mitigating supply chain risk, identifying backdoors or unintended vulnerabilities that can be exploited in your environment is just as critical as staying current with the latest hacking intel. Understand how to spot and reduce the risk to your environment…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
When Appsec Needs to Start Small - Kalyani Pawar - ASW #295
34:22
34:22
Play later
Play later
Lists
Like
Liked
34:22
Startups and small orgs don't have the luxury of massive budgets and large teams. How do you choose an appsec approach that complements a startup's needs while keeping it secure. Kalyani Pawar shares her experience at different ends of an appsec maturity spectrum. Show Notes: https://securityweekly.com/asw-295…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Dead Code, CrowdStrike's Kernel Lessons, VMs & Security Boundaries, SLUBStick Attack - ASW #294
33:55
33:55
Play later
Play later
Lists
Like
Liked
33:55
The code curation considerations of removing abandoned protocols in OpenSSL, kernel driver lessons from CrowdStrike's crash, choosing isolation primitives, cross-cache attacks made possible by SLUBStick, and more! Show Notes: https://securityweekly.com/asw-294
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Building Successful Security Champions Programs - Marisa Fagan - ASW #294
36:24
36:24
Play later
Play later
Lists
Like
Liked
36:24
Even though Security Champions programs look very different across organizations and maturity levels, they share core principles for becoming successful. Marisa shares her experience in building these programs to foster a positive security culture within companies. She explains the incentives and rewards that lead to more engagement from champions …
…
continue reading
![Artwork](/static/images/128pixel.png)
1
The Known Exploited Vulnerability catalogue, aka the KEV - Tod Beardsley - BTS #35
55:27
55:27
Play later
Play later
Lists
Like
Liked
55:27
Gain insights into the CISA KEV straight from one of the folks at CISA, Tod Beardsley. Learn how KEV was created, where the data comes from, and how you should use it in your environment. This segment is sponsored by Eclypsium. Visit https://securityweekly.com/eclypsium to learn more about them! Resource: https://cisa.gov/kev Show Notes: https://se…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
A CISO's Perspective on AI, Appsec, and Changing Behaviors - Paul Davis - ASW #293
45:18
45:18
Play later
Play later
Lists
Like
Liked
45:18
Modern appsec isn't modern because security tools got shifted in one direction or another, or because teams are finding and fixing more vulns. It's modern because appsec is meeting developer needs and supporting the business. Paul Davis talks about how AI is (and isn't) changing appsec, the KPIs that reflect outcomes rather than being busy, and the…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
SAPwned, Squarespace Domain Hijacks, AIs Fixing Code, Infosec Investments - ASW #292
28:57
28:57
Play later
Play later
Lists
Like
Liked
28:57
SAPwned demonstrates tenets of tenant isolation, a weak login flow puts Squarespace domains at risk, how AIs might (or might not) be useful for fixing code, getting buy-in for infosec investments, and more! Show Notes: https://securityweekly.com/asw-292
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Where Generative AI Can Actually Help Security (And Where It Doesn't) - Allie Mellen, Farshad Abasi - ASW #292
36:04
36:04
Play later
Play later
Lists
Like
Liked
36:04
Generative AI has produced impressive chatbots and content generation, but however fun or impressive those might be, they don't always translate to value for appsec. Allie brings some realistic expectations to how genAI is used by attackers and can be useful to defenders. Segment resources: https://www.forrester.com/blogs/generative-ai-will-not-ful…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
A 2024 Appsec Report, Preparing for the AIxCC, Secure Design and Post-Quantum Crypto - ASW #291
35:58
35:58
Play later
Play later
Lists
Like
Liked
35:58
Cloudflare's 2024 appsec report, reasoning about the Cyber Reasoning Systems for the upcoming AIxCC semifinals at DEF CON, lessons in secure design from post-quantum cryptography, and more! Show Notes: https://securityweekly.com/asw-291
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Producing Secure Code by Leveraging AI - Stuart McClure - ASW #291
33:06
33:06
Play later
Play later
Lists
Like
Liked
33:06
How can LLMs be valuable to developers as an assistant in finding and fixing insecure code? There are a lot of implications in trusting AI or LLMs to not only find vulns, but in producing code that fixes an underlying problem without changing an app's intended behavior. Stuart McClure explains how combining LLMs with agents and RAGs helps make AI-i…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
EPSS - The Exploit Prediction Scoring System - Jay Jacobs, Wade Baker - BTS #34
59:43
59:43
Play later
Play later
Lists
Like
Liked
59:43
Jay Jacobs Co-Founder and Data Scientist and Wade Baker Co-Founder; Data Storyteller from The Cyentia Institute come on the show to talk about The Exploit Prediction Scoring System (EPSS). This segment is sponsored by Eclypsium. Visit https://securityweekly.com/eclypsium to learn more about them! Show Notes: https://securityweekly.com/bts-34…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
State Of Application Security 2024 - Sandy Carielli, Janet Worthington - ASW #290
38:12
38:12
Play later
Play later
Lists
Like
Liked
38:12
Sandy Carielli and Janet Worthington, authors of the State Of Application Security 2024 report, join us to discuss their findings on trends this year! Old vulns, more bots, and more targeted supply chain attacks -- we should be better at this by now. We talk about where secure design fits into all this why appsec needs to accelerate to ludicrous sp…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Polyfill Empties Trust, regreSSHion, CocoaPods Vulns & Secure Design, LLM Bughunters - ASW #290
34:30
34:30
Play later
Play later
Lists
Like
Liked
34:30
Polyfill loses trust after CDN misuse, an OpenSSH flaw reappears, how to talk about secure design from some old CocoaPods vulns, using LLMs to find bugs, Burp Proxy gets more investment, and more! Show Notes: https://securityweekly.com/asw-290
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Securing OT Environments - Dr. Ed Harris - BTS #33
52:54
52:54
Play later
Play later
Lists
Like
Liked
52:54
Ed Harris joins us to discuss how to secure OT environments, implement effective air gaps, and more! This segment is sponsored by Eclypsium. Visit https://securityweekly.com/eclypsium to learn more about them! Show Notes: https://securityweekly.com/bts-33
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Shared Responsibility Models, AI in Offensive Security, Apple's Private Cloud Compute - ASW #289
24:10
24:10
Play later
Play later
Lists
Like
Liked
24:10
Thoughts on shared responsibility models after the Snowflake credential attacks, looking at AI's current and future role in offensive security, secure by design lessons from Apple's Private Cloud Computer, and more! Show Notes: https://securityweekly.com/asw-289
…
continue reading
![Artwork](/static/images/128pixel.png)
1
OAuth 2.0 from Protecting APIs to Supporting Authorization & Authentication - Aaron Parecki - ASW #289
37:01
37:01
Play later
Play later
Lists
Like
Liked
37:01
OAuth 2.0 is more than just a single spec and it's used to protect more than just APIs. We talk about challenges in maintaining a spec over a decade of changing technologies and new threat models. Not only can OAuth be challenging to secure by default, but it's not even always inter-operable. Segment Resources: https://oauth.net/2.1 https://oauth.n…
…
continue reading
We discuss the various aspects of Mitre Att&ck, including tools, techniques, supply chain aspects, and more! This segment is sponsored by Eclypsium. Visit https://securityweekly.com/eclypsium to learn more about them! Show Notes: https://securityweekly.com/bts-32
…
continue reading
Check out this interview from the ASW Vault, hand picked by main host Mike Shema! This segment was originally published on April 4, 2023. Following on from her successful title "Container Security", Liz has recently authored "Learning eBPF", published by O'Reilly. eBPF is a revolutionary kernel technology that is enabling a whole new generation of …
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Microsoft Recall's Security & Privacy, Hacking Web APIs, Secure Design Pledge - ASW #288
38:37
38:37
Play later
Play later
Lists
Like
Liked
38:37
Looking at use cases and abuse cases of Microsoft's Recall feature, examples of hacking web APIs, CISA's secure design pledge, what we look for in CVEs, a nod to PHP's history, and more! Show Notes: https://securityweekly.com/asw-288
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Managing Complex Digital Supply Chains - Cassie Crossley - BTS #31
1:03:06
1:03:06
Play later
Play later
Lists
Like
Liked
1:03:06
Cassie has a long history of successfully managing a variety of security programs. Today, she leads supply chain efforts for a very large product company. We will tackle topics such as software supply chain management, SBOMs, third-party supply chain challenges, asset management, and more! This segment is sponsored by Eclypsium. Visit https://secur…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Bots are Taking Over the Internet & Defining ASPM - Idan Plotnik, Erez Hasson - ASW #287
30:12
30:12
Play later
Play later
Lists
Like
Liked
30:12
Application security posture management has quickly become a hot commodity in the world of AppSec, but questions remain around what is defined by ASPM. Vendors have cropped up from different corners of the AppSec space to help security teams make their programs more effective, improve their security postures, and connect the dots between developers…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Open Source Software Supply Chain Security & The Real Crisis Behind XZ Utils - Luis Villa - ASW #287
42:04
42:04
Play later
Play later
Lists
Like
Liked
42:04
Open source has been a part of the software supply chain for decades, yet many projects and their maintainers remain undersupported by the companies that consume them. The security responsibilities for project owners has increased not only in dealing with security disclosures, but in maintaining secure processes backed by strong authentication and …
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Securing Shadow Apps & Protecting Data - Guy Guzner, Pranava Adduri - ASW Vault
30:32
30:32
Play later
Play later
Lists
Like
Liked
30:32
With hundreds or thousands of SaaS apps to secure with no traditional perimeter, Identity becomes the focal point for SaaS Security in the modern enterprise. Yet with Shadow IT, now recast as Business-Led IT, quickly becoming normal practice, it’s more complicated than trying to centralize all identities with an Identity Provider (IdP) for Single S…
…
continue reading
![Artwork](/static/images/128pixel.png)
1
Collecting Bounties and Building Communities - Ben Sadeghipour - ASW Vault
36:23
36:23
Play later
Play later
Lists
Like
Liked
36:23
Check out this interview from the ASW Vault, hand picked by main host Mike Shema! This segment was originally published on April 18, 2023. We talk with Ben about the rewards, hazards, and fun of bug bounty programs. Then we find out different ways to build successful and welcoming communities. Show Notes: https://securityweekly.com/vault-asw-9…
…
continue reading