Кращі подкасти про Application Security (2024)

1
EP 59 - Nat Mokry on Advancing Application Security in the Gaming Industry 26:55

1d ago26:55

26:55

In our latest episode of the Future of Application Security podcast, Nat Mokry, VP of Application & Product Security at Xbox (formerly of Activision Blizzard at the time of recording), shares valuable insights into the world of application security, from the mission of defending player trust to emphasizing the importance of technical skills in cybe…

1
XZ & Open Source, PuTTY's Private Keys, LeakyCLI, LLMs Writing Exploits - ASW #282 38:28

2d ago38:28

38:28

CISA chimes in on the XZ Utils backdoor, PuTTY's private keys and maintaining a secure design, LeakyCLI and maintaining secure secrets in CSPs, LLMs and exploit generation, and more! Show Notes: https://securityweekly.com/asw-282

1
Sustainable Funding of Open Source Tools - Mark Curphey, Simon Bennetts - ASW #282 1:17:57

2d ago1:17:57

1:17:57

How can open source projects find a funding model that works for them? What are the implications with different sources of funding? Simon Bennetts talks about his stewardship of Zed Attack Proxy and its journey from OWASP to OpenSSF to an Open Source Fellowship with Crash Override. Mark Curphy adds how his experience with OWASP and the appsec commu…

1
Dustin Lehr -- Culture Change through Champions and Gamification 45:10

9d ago45:10

45:10

Dustin Lehr, Senior Director of Platform Security/Deputy CISO at Fivetran and Chief Solutions Officer at Katilyst Security, joins Robert and Chris to discuss security champions. Dustin explains the concept of security champions within the developer community, exploring the unique qualities and motivations behind developers becoming security advocat…

1
Sustainable Funding of Open Source Tools - Simon Bennetts, Mark Curphey - ASW #282 39:29

2d ago39:29

39:29

How can open source projects find a funding model that works for them? What are the implications with different sources of funding? Simon Bennetts talks about his stewardship of Zed Attack Proxy and its journey from OWASP to OpenSSF to an Open Source Fellowship with Crash Override. Mark Curphy adds how his experience with OWASP and the appsec commu…

1
Arg Parsing in Rust, End of Life Hardware, CSRB & MS, Chrome’s V8 Sandbox - ASW #281 28:12

9d ago28:12

28:12

A Rust advisory highlights the perils of parsing and problems of inconsistent approaches, D-Link (sort of) deals with end of life hardware, CSRB recommends practices and processes for Microsoft, Chrome’s V8 Sandbox increases defense, and more! Show Notes: https://securityweekly.com/asw-281

1
Demystifying Security Engineering Career Tracks - Karan Dwivedi - ASW #281 35:17

9d ago35:17

35:17

There are as many paths into infosec as there are disciplines within infosec to specialize in. Karan Dwivedi talks about the recent book he and co-author Raaghav Srinivasan wrote about security engineering. There's an appealing future to security taking on engineering roles and creating solutions to problems that orgs face. We talk about the breadt…

1
Demystifying Security Engineering Career Tracks - Karan Dwivedi - ASW #281 1:03:23

10d ago1:03:23

1:03:23

There are as many paths into infosec as there are disciplines within infosec to specialize in. Karan Dwivedi talks about the recent book he and co-author Raaghav Srinivasan wrote about security engineering. There's an appealing future to security taking on engineering roles and creating solutions to problems that orgs face. We talk about the breadt…

1
EP 58 — Asana's Felix Matenaar on Building Resilient Security Practices for the Future 32:45

15d ago32:45

32:45

In this episode of the Future of Application Security podcast, Harshil interviews Felix Matenaar, Head of Product Security at Asana. Felix shares insights into his journey from Germany to Silicon Valley, where he transitioned from mobile security to leading Asana's product security efforts. The conversation highlights Felix's experience in creating…

1
OWASP Breach, Types of Prompt Injection, Device-Bound Sessions, ASVS & APIs - ASW #280 28:30

16d ago28:30

28:30

OWASP leaks resumes, defining different types of prompt injection, a secure design example in device-bound sessions, turning an ASVS requirement into practice, Ivanti has its 2000s-era Microsoft moment, HTTP/2 CONTINUATION flood, and more! Show Notes: https://securityweekly.com/asw-280

1
Lessons That The XZ Utils Backdoor Spells Out - Farshad Abasi - ASW #280 1:00:18

16d ago1:00:18

1:00:18

We look into the supply chain saga of the XZ Utils backdoor. It's a wild story of a carefully planned long con to add malicious code to a commonly used package that many SSH connections rely on. It hits themes from social engineering and abuse of trust to obscuring the changes and suppressing warnings. It also has a few lessons about software devel…

1
Lessons That The XZ Utils Backdoor Spells Out - Farshad Abasi - ASW #280 31:53

16d ago31:53

31:53

We look into the supply chain saga of the XZ Utils backdoor. It's a wild story of a carefully planned long con to add malicious code to a commonly used package that many SSH connections rely on. It hits themes from social engineering and abuse of trust to obscuring the changes and suppressing warnings. It also has a few lessons about software devel…

1
Francesco Cipollone -- Application Security Posture Management and the Power of Working with the Business 38:11

16d ago38:11

38:11

Francesco Cipollone, CEO of Phoenix Security, joins Chris and Robert to discuss security and explain Application Security Posture Management (ASPM). Francesco shares his journey from developer to cybersecurity leader, revealing the origins and importance of ASPM. The discussion covers the distinction between application security and product securit…

1
Top 10's First Update, Metasploit's Second Update, PHP Prepares Statements, RSA & MS - ASW #279 26:34

23d ago26:34

26:34

The OWASP Top 10 gets its first update after a year, Metasploit gets its first rewrite (but it's still in Perl), PHP adds support for prepared statements, RSA Conference puts passwords on notice while patching remains hard, and more! Show Notes: https://securityweekly.com/asw-279

1
Infosec Myths, Mistakes, and Misconceptions - Adrian Sanabria - ASW #279 1:00:57

23d ago1:00:57

1:00:57

Sometimes infosec problems can be summarized succinctly, like "patching is hard". Sometimes a succinct summary sounds convincing, but is based on old data, irrelevant data, or made up data. Adrian Sanabria walks through some of the archeological work he's done to dig up the source of some myths. We talk about some of our favorite (as in most dislik…

1
Infosec Myths, Mistakes, and Misconceptions - Adrian Sanabria - ASW #279 34:27

23d ago34:27

34:27

Sometimes infosec problems can be summarized succinctly, like "patching is hard". Sometimes a succinct summary sounds convincing, but is based on old data, irrelevant data, or made up data. Adrian Sanabria walks through some of the archeological work he's done to dig up the source of some myths. We talk about some of our favorite (as in most dislik…

1
Mukund Sarma -- Developer Tools that Solve Security Problems 46:32

23d ago46:32

46:32

Mukund Sarma, the Senior Director for Product Security at Chime, talks with Chris about his career path from being a software engineer to becoming a leader in application security. He explains how he focuses on building security tools that are easy for developers to use and stresses the importance of looking at application security as a part of the…

1
EP 57 — Clari's Steve Lukose on Using SLAs as Benchmarks for Businesses 27:05

29d ago27:05

27:05

In this episode of the Future of Application Security, Harshil speaks with Steve Lukose, Vice President of Security at Clari, about how security is becoming a business enabler rather than just an organization. Steve explains why SLAs will become one of the benchmarks for security experts to use, but that it won’t necessarily be for all aspects of s…

1
Successful Security Needs a Streamlined UX - Benedek Gagyi - ASW #278 36:36

1M ago36:36

36:36

One of the biggest failures in appsec is an attitude that blames users for security problems. A lot of processes and workflows break down because of an insecure design or insecure defaults. Benedek Gagyi chats with us about the impact of the user experience (UX) on security and why it's not only important to understand how to make a user's life eas…

1
Successful Security Needs a Streamlined UX - Benedek Gagyi - ASW #278 1:09:03

1M ago1:09:03

1:09:03

One of the biggest failures in appsec is an attitude that blames users for security problems. A lot of processes and workflows break down because of an insecure design or insecure defaults. Benedek Gagyi chats with us about the impact of the user experience (UX) on security and why it's not only important to understand how to make a user's life eas…

1
GoFetch Side Channel, OpenSSF & Security Education, Fuzzing vs. Formal Verification - ASW #278 32:33

1M ago32:33

32:33

The GoFetch side channel in Apple CPUs, OpenSSF's plan for secure software developer education, fuzzing vs. formal verification as a security strategy, hard problems in InfoSec (and AppSec), and more! Show Notes: https://securityweekly.com/asw-278

1
Meghan Jacquot -- Assumed Breach Red Team Engagements for AppSec 40:55

1M ago40:55

40:55

AppSec specialist Megan Jacquot joins Chris and Robert for a compelling conversation about community, career paths, and productive red team exercises. Megan shares her unique cybersecurity origin story, tracing her interest in the field from childhood influences through her tenure as an educator and her formal return to academia to pivot into a tec…

1
Vulns in Smart Locks, FCC labels for IoT, ZAP's New Home - ASW #277 38:20

1M ago38:20

38:20

Insecure defaults and insecure design in smart locks, FCC adopts Cyber Trust Mark labels for IoT devices, the ZAP project gets a new home, and more! Show Notes: https://securityweekly.com/asw-277

1
Figuring Out Where Appsec Fits When Starting a Cybersecurity Program - Tyler VonMoll - ASW #277 1:13:20

1M ago1:13:20

1:13:20

Lots of companies need cybersecurity programs, as do non-profits. Tyler Von Moll talks about how to get small organizations started on security and how to prioritize initial investments. While an appsec program likely isn't going to be one of the first steps, it's going to be an early one. What decisions can you make at the start that will benefit …

1
Figuring Out Where Appsec Fits When Starting a Cybersecurity Program - Tyler VonMoll - ASW #277 35:06

1M ago35:06

35:06

Lots of companies need cybersecurity programs, as do non-profits. Tyler Von Moll talks about how to get small organizations started on security and how to prioritize initial investments. While an appsec program likely isn't going to be one of the first steps, it's going to be an early one. What decisions can you make at the start that will benefit …

Подкасти, які варто послухати

Подкасти на тему Application Security

Подкасти, які варто послухати

1
Application Security Weekly (Audio)

Security Weekly Productions

1
Application Security Weekly (Video)

Security Weekly

1
Future of Application Security

Tromzo

1
The Application Security Podcast

Chris Romeo and Robert Hurlbut

1
Open Web Application Security Project (OWASP) - Portland, Oregon Chapter

OWASP PDX

1
EP 59 - Nat Mokry on Advancing Application Security in the Gaming Industry 26:55

1
XZ & Open Source, PuTTY's Private Keys, LeakyCLI, LLMs Writing Exploits - ASW #282 38:28

1
Sustainable Funding of Open Source Tools - Mark Curphey, Simon Bennetts - ASW #282 1:17:57

1
Dustin Lehr -- Culture Change through Champions and Gamification 45:10

1
Sustainable Funding of Open Source Tools - Simon Bennetts, Mark Curphey - ASW #282 39:29

1
Arg Parsing in Rust, End of Life Hardware, CSRB & MS, Chrome’s V8 Sandbox - ASW #281 28:12

1
Demystifying Security Engineering Career Tracks - Karan Dwivedi - ASW #281 35:17

1
Demystifying Security Engineering Career Tracks - Karan Dwivedi - ASW #281 1:03:23

1
EP 58 — Asana's Felix Matenaar on Building Resilient Security Practices for the Future 32:45

1
OWASP Breach, Types of Prompt Injection, Device-Bound Sessions, ASVS & APIs - ASW #280 28:30

1
Lessons That The XZ Utils Backdoor Spells Out - Farshad Abasi - ASW #280 1:00:18

1
Lessons That The XZ Utils Backdoor Spells Out - Farshad Abasi - ASW #280 31:53

1
Francesco Cipollone -- Application Security Posture Management and the Power of Working with the Business 38:11

1
Top 10's First Update, Metasploit's Second Update, PHP Prepares Statements, RSA & MS - ASW #279 26:34

1
Infosec Myths, Mistakes, and Misconceptions - Adrian Sanabria - ASW #279 1:00:57

1
Infosec Myths, Mistakes, and Misconceptions - Adrian Sanabria - ASW #279 34:27

1
Mukund Sarma -- Developer Tools that Solve Security Problems 46:32

1
EP 57 — Clari's Steve Lukose on Using SLAs as Benchmarks for Businesses 27:05

1
Successful Security Needs a Streamlined UX - Benedek Gagyi - ASW #278 36:36

1
Successful Security Needs a Streamlined UX - Benedek Gagyi - ASW #278 1:09:03

1
GoFetch Side Channel, OpenSSF & Security Education, Fuzzing vs. Formal Verification - ASW #278 32:33

1
Meghan Jacquot -- Assumed Breach Red Team Engagements for AppSec 40:55

1
Vulns in Smart Locks, FCC labels for IoT, ZAP's New Home - ASW #277 38:20

1
Figuring Out Where Appsec Fits When Starting a Cybersecurity Program - Tyler VonMoll - ASW #277 1:13:20

1
Figuring Out Where Appsec Fits When Starting a Cybersecurity Program - Tyler VonMoll - ASW #277 35:06

Короткий довідник