AI Pen Testing Killed Traditional DAST
Is traditional DAST finally dead? James Berthoty came back to settle the argument that his last episode started.
Listen to the episodeTopic
Cloud and Infrastructure
Containers, Kubernetes, infrastructure as code and the misconfigurations that make cloud its own discipline.
36 episodes
Matin Mavaddat - Understanding Security as a Systemic Concern: The Role of Anti-Requirements
Matin Mavaddat discusses his perspective on security as a systemic concern, developed from his background in requirements engineering and systems architecture.
Listen to the episodeFrançois Proulx - Arbitrary Code Execution 0-day in Build Pipeline of Popular Open Source Packages
François Proulx shares his discovery of security vulnerabilities in build pipelines. Francois has found that attackers can exploit this often overlooked side of the software supply chain.
Listen to the episodeTanya Janca -- Secure Guardrails
Tanya Janka, also known as SheHacksPurple, discusses secure guardrails, the difference between guardrails and paved roads, and how to implement both in application security.
Listen to the episodeHasan Yasar -- Actionable SBOM via DevSecOps
Hasan Yasar believes that everyone shares the responsibility of creating a secure environment, and this can only be achieved by working collaboratively.
Listen to the episodeItzik Alvas -- Secrets Security and Management
Itzik Alvas, Co-founder and CEO of Entro, is an expert on secrets security. Itzik joins Chris and Robert to discuss the significance of understanding and…
Listen to the episodeMark Curphey and John Viega -- Chalk
Development, operations, and security teams generate oceans of data yet still struggle to answer basic questions about what code is running, who owns it, and which findings matter.
Listen to the episodeSteve Giguere -- Cloud AppSec
Cloud security is on an evolutionary path, with newer platforms embracing secure-by-default settings.
Listen to the episodeChristian Frichot -- Threat Modeling with hcltm
Christian Frichot, an AppSec hacker, security leader, and developer of hcltm. He discusses the DevOps threat modeling tool he dreamed up and built.
Listen to the episodeOmer Gil and Daniel Krivelevich -- Top 10 CI/CD Security Risks
CI/CD systems hold code, credentials, and production access, yet many organizations still treat them as internal plumbing rather than a critical attack surface.
Listen to the episodeJosh Grossman -- Building a High-Value AppSec Scanning Program
Josh Grossman has over 15 years of experience in IT Risk and Application Security consulting, and he has also worked as a software developer.
Listen to the episodeWill Ratner -- Centralized container scanning
Will Ratner is a software security professional with extensive experience building and implementing security solutions across a myriad of industries…
Listen to the episodeJeroen Willemsen and Ben de Haan -- Dirty little secrets
Secrets management fails in surprisingly ordinary ways: credentials land in code, deployment files, containers, and cloud resources, then quietly become part of the system’s attack surface.
Listen to the episode36 mintranscript
Ochaun Marshall -- IaC and SAST
Infrastructure as code gives security teams something they have wanted for years: a readable description of the systems surrounding an application.
Listen to the episodeMazin Ahmed -- Terraform Security
Mazin Ahmed is a security engineer that specializes in AppSec and offensive security.
Listen to the episodeJeroen Willemsen -- Security automation with ci/cd
Jeroen Willemsen is a Principal Security Architect at Xebia. Jeroen is more or less a jack of all trades with an interest in infrastructure security, risk management, and application security.
Listen to the episodeAaron Rinehart -- Security Chaos Engineering
Aaron Rinehart is expanding the possibilities of chaos engineering to cybersecurity.
Listen to the episodeAlyssa Miller -- Bringing security to DevOps and the CI/CD pipeline
Alyssa Miller is a life-long hacker, security advocate, and cybersecurity leader. She is the BISO for S&P Global ratings and has over 15 years of experience in security roles.
Listen to the episode42 mintranscript
Liran Tal — Cloud native application security, what’s a developer to do?
Cloud-native development gives engineers control over more of the stack, but it also gives them more security decisions to get wrong.
Listen to the episodeAaron Davis — LavaMoat — solving JavaScript software supply chain
Aaron Davis is a founder, dev, and a lead security researcher at MetaMask, a popular Ethereum wallet.
Listen to the episodeOchaun Marshall — Securing Web applications in AWS
Ochaun Marshall is a developer and security consultant. In his roles at Secure Ideas, he works on ongoing development projects utilizing Amazon Web Services and breaks other people's web applications.
Listen to the episodeJannik Hollenbach — Multijuicer: JuiceShop with a side of Kubernetes
Jannik Hollenbach is a Security Automation Engineer at iteratec GmbH, working on and with open source security testing tools to continuously detect security…
Listen to the episodeMarc French, Steve Lipner, Maya Kaczorowski, DJ Schleen, Kim Wuyts — Season Six Wrap up
Season six closes by revisiting five conversations that capture the breadth of application security.
Listen to the episode38 mintranscript
DJ Schleen — DevOps: The Sec is Silent
What changes when security becomes part of delivering software instead of a separate gate?
Listen to the episode36 mintranscript
Niels Tanis — 3rd Party Risk in a .NET World
How much behavior do you inherit when you add one library to a .NET application? Niels Tanis joins Chris and Robert to examine third-party risk beyond checking a dependency for known vulnerabilities.
Listen to the episode34 mintranscript
Maya Kaczorowski — Container and Orchestration Security
Containers can improve your security story, but not simply because they are called containers.
Listen to the episode34 mintranscript
Liran Tal — The state of open source software security
Developers may want to own security, but what helps them turn that intention into safer software? Liran Tal joins Chris and Robert to examine Snyk's 2019 State of Open Source Security research.
Listen to the episode37 mintranscript
Omer Levi Hevroni — K8s can keep a secret?
Putting an application in Kubernetes does not solve the problem of getting secrets to it safely.
Listen to the episode44 mintranscript
Bill Wilder -- Running Azure Securely
Moving an application to Azure changes which security controls you operate yourself and which ones the platform can provide.
Listen to the episode28 mintranscript
Swaroop Yermalkar -- iGoat and iOS Mobile Pen Testing
Mobile apps can hide credentials, expose powerful backend access, and repeat familiar web security mistakes.
Listen to the episode31 mintranscript
Tony UV -- Threat Libraries in the Cloud
A list of weaknesses is not the same thing as an understanding of the threats facing a business.
Listen to the episode27 mintranscript
Mohammed Imran -- Back to the Lab Again with a DevOps
Learning DevSecOps is hard when setting up the lab becomes a project of its own. Mohammed Imran introduces DevSecOps Studio, an environment designed to help…
Listen to the episode31 mintranscript
Chase Schultz -- AppSec and Hardware
Where does application security end when software controls bootloaders, firmware, processors, and connected devices?
Listen to the episode30 mintranscript
Brian Andrzejewski -- Containers Again
Containers make deployment repeatable, but insecure images, excessive privileges, and unmanaged secrets can travel with them.
Listen to the episode35 mintranscript
Tanya Janca and Nicole Becher -- Hacking APIs and Web Services with DevSlop
APIs may lack a visible interface, but that does not make them hidden or safe. Tanya Janca and Nicole Becher use OWASP DevSlop and its Pixi application to…
Listen to the episode45 mintranscript
Jay Beale -- Docker Security and AppSec
Does moving an application into Docker make it safer, or simply change the risks you need to manage?
Listen to the episode