Izar Tarandach and Matt Coles-- Threat Modeling: A Practical Guide for Development Teams
Threat modeling advice often sounds simple until a development team tries to apply it to a real system.
Listen to the episodeEpisodes, page 7
312 episodes, going back to 2016.
Charles Shirer -- The most positive person in security
Charles is a Senior Security Consultant for Red Siege. He has over 18 years of experience in IT.
Listen to the episodeLeif Dreizler -- Tactical tips to shift engineering right
Leif Dreizler is the manager of the Product Security team at Segment. Leif got his start in the security industry at Redspin doing security consulting work and was later an early employee at Bugcrowd.
Listen to the episodeVandana Verma -- OWASP Spotlight Series
Vandana Verma is the President of Infosec girls and Infosec Kids, a board of directors member for OWASP, and a leader for BSides Dehli. She joins us to introduce the OWASP Spotlight Series.
Listen to the episodeDr. Anita D’Amico -- Do certain types of developers or teams write more secure code?
Dr. Anita D’Amico is the CEO of Code Dx, which provides Application Security Orchestration and Correlation solutions to industry and government.
Listen to the episodeAlyssa Miller -- Bringing security to DevOps and the CI/CD pipeline
Alyssa Miller is a life-long hacker, security advocate, and cybersecurity leader. She is the BISO for S&P Global ratings and has over 15 years of experience in security roles.
Listen to the episode42 mintranscript
Liran Tal — Cloud native application security, what’s a developer to do?
Cloud-native development gives engineers control over more of the stack, but it also gives them more security decisions to get wrong.
Listen to the episodeChris Romeo — DevSecOps Fails
Robert and I decided to talk about an article I wrote called "DevOps security culture: 12 fails your team can learn from". We hope you enjoy this walkthrough of the 12 fails.
Listen to the episodeJim Routh — Secure software pipelines
A secure software pipeline is more than a collection of scanners. Jim Routh joins Chris and Robert to explain how organizations can build repeatable…
Listen to the episode31 mintranscript
Andrew van der Stock — Taking Application Security to the Masses
How does a volunteer security community reach the millions of people who build software? Andrew van der Stock reflects on that challenge after becoming OWASP’s executive director in 2020.
Listen to the episodeJC Herz and Steve Springett — SBOMs and software supply chain assurance
Software bills of materials promise visibility into dependencies, but visibility alone does not create assurance.
Listen to the episodeBrian Reed — Mobile Appsec: The Good, the Bad and the Ugly as We Head into 2021
Brian Reed is Chief Mobility Officer at NowSecure. Brian has over 30 years in tech and 15 years in mobile, security, and apps dating back to the birth of…
Listen to the episode25 mintranscript
The Threat Modeling Manifesto – Part 2
How did a group of experienced practitioners turn months of disagreement into a usable Threat Modeling Manifesto?
Listen to the episode25 mintranscript
The Threat Modeling Manifesto – Part 1
What should threat modeling mean when practitioners use the term in very different ways?
Listen to the episode40 mintranscript
Season 7 Guests — The best of Season 7
Which ideas from Season 7 deserve another listen? Chris and Robert assemble clips from across the season, creating a fast tour through secure development…
Listen to the episodeAviat Jean-Baptiste — The AppSec report
Jb Aviat is CTO and co-founder at Sqreen. Prior to this, Jb worked at Apple as a reverse engineer, pentester and developer.
Listen to the episode50 mintranscript
Frank Rietta — The convergence of Ruby on Rails and #AppSec
Ruby on Rails can provide strong security defaults, but a framework cannot make every design decision for its developers.
Listen to the episodeDmitry Sotnikov – REST API Security – there is no silver bullet
Dmitry Sotnikov serves as Chief Product Officer at 42Crunch – an enterprise API security company.
Listen to the episodeCaroline Wong — The state of Penetration Testing
Caroline Wong is the Chief Strategy Officer at Cobalt. io. You cannot hack yourself secure. The challenge is that developers get bored with hacking broken pieces of code after a while.
Listen to the episodeAaron Davis — LavaMoat — solving JavaScript software supply chain
Aaron Davis is a founder, dev, and a lead security researcher at MetaMask, a popular Ethereum wallet.
Listen to the episode35 mintranscript
Anastasiia Voitova — Use Cryptography; Don’t Learn It
Developers need to protect data, but should they need to become cryptographers to do it safely?
Listen to the episodeMichael Furman — SameSite Cookies
Michael Furman is the Lead Security Architect at Tufin, and is responsible for the security and Security Development Lifecycle (SDL) of Tufin software products.
Listen to the episode44 mintranscript
Chris Romeo — The State of Security and the Importance of Empathy
Network engineers and application security teams depend on each other, yet often struggle to understand each other’s responsibilities.
Listen to the episodeNeil Matatall — Content Security Policy
Neil Matatall is a product security engineer at GitHub. He focuses on designing and engineering user experiences solutions related to authentication and account recovery.
Listen to the episode