Канал: The Application Security Podcast

OWASP Candidate Board of Directors Debate for 2024

OWASP Candidate Board of Directors Debate for 2024

Steve Wilson -- The Developer's Playbook for Large Language Model Security Building Secure AI Appli

Steve Wilson -- The Developer's Playbook for Large Language Model Security Building Secure AI Appli

Jeff Williams -- Application Detection & Response ADR

Jeff Williams -- Application Detection & Response ADR

Phillip Wylie -- Pen Testing from Somebody Who Knows About Pen Testing

Phillip Wylie -- Pen Testing from Somebody Who Knows About Pen Testing

Steve Springett -- Software and System Transparency

Steve Springett -- Software and System Transparency

Irfaan Santoe -- The Power of Strategy in AppSec

Irfaan Santoe -- The Power of Strategy in AppSec

Andrew Van Der Stock -- The New OWASP Top Ten

Andrew Van Der Stock -- The New OWASP Top Ten

Derek Fisher -- Hiring in Cyber AppSec

Derek Fisher -- Hiring in Cyber AppSec

Tanya Janca -- Secure Guardrails

Tanya Janca -- Secure Guardrails

Jahanzeb Farooq -- Launching and Executing an AppSec Program

Jahanzeb Farooq -- Launching and Executing an AppSec Program

David Quisenberry -- Building Security, People, and Programs

David Quisenberry -- Building Security, People, and Programs

Matt Rose -- Software Supply Chain Security Means Many Different Things to Different People

Matt Rose -- Software Supply Chain Security Means Many Different Things to Different People

James Berthoty -- Is DAST Dead? And the future of API security

James Berthoty -- Is DAST Dead? And the future of API security

Mark Curphey and Simon Bennetts -- Riding the Coat Tails of ZAP, without Open Source Funding

Mark Curphey and Simon Bennetts -- Riding the Coat Tails of ZAP, without Open Source Funding

Devin Rudnicki -- Expanding AppSec

Devin Rudnicki -- Expanding AppSec

Dustin Lehr -- Culture Change through Champions and Gamification

Dustin Lehr -- Culture Change through Champions and Gamification

Francesco Cipollone -- Application Security Postures Management and Working with the Business

Francesco Cipollone -- Application Security Postures Management and Working with the Business

Mukund Sarma -- Developer Tools that Solve Security Problems

Mukund Sarma -- Developer Tools that Solve Security Problems

Meghan Jacquot -- Assumed Breach Red Team Engagements for AppSec

Meghan Jacquot -- Assumed Breach Red Team Engagements for AppSec

Bill Sempf -- Development, Security, and Teaching the Next Generation

Bill Sempf -- Development, Security, and Teaching the Next Generation

Hendrik Ewerlin -- Threat Modeling of Threat Modeling

Hendrik Ewerlin -- Threat Modeling of Threat Modeling

Jason Nelson -- Three Pillars of Threat Modeling Success: Consistency, Repeatability, and Efficacy

Jason Nelson -- Three Pillars of Threat Modeling Success: Consistency, Repeatability, and Efficacy

Erik Cabetas - Cracking Codes on Screen and in Contests: Hacking, Vulnerabilities, & Evolution of...

Erik Cabetas - Cracking Codes on Screen and in Contests: Hacking, Vulnerabilities, & Evolution of...

Justin Collins -- Enabling the Business to Move Faster, Securely

Justin Collins -- Enabling the Business to Move Faster, Securely

Kyle Kelly -- The Dumpster Fire of Software Supply Chain Security

Kyle Kelly -- The Dumpster Fire of Software Supply Chain Security

Chris Hughes -- Software Transparency

Chris Hughes -- Software Transparency

Jay Bobo & Darylynn Ross -- App Sec Is Dead. Product Security Is the Future.

Jay Bobo & Darylynn Ross -- App Sec Is Dead. Product Security Is the Future.

Eitan Worcel -- Is AI a Security Champion?

Eitan Worcel -- Is AI a Security Champion?

Björn Kimminich -- OWASP Juice Shop

Björn Kimminich -- OWASP Juice Shop

Arshan Dabirsiaghi -- Security Startups, AI Influencing AppSec, and Pixee/Codemodder.io

Arshan Dabirsiaghi -- Security Startups, AI Influencing AppSec, and Pixee/Codemodder.io

Dr. Jared Demott -- Cloud Security & Bug Bounty

Dr. Jared Demott -- Cloud Security & Bug Bounty

Katharina Koerner -- Security as Responsible AI

Katharina Koerner -- Security as Responsible AI

Ray Espinoza -- The AppSec CISO, Vendor Relationships, and Mentoring

Ray Espinoza -- The AppSec CISO, Vendor Relationships, and Mentoring

Chris John Riley -- MVSP: Minimum Viable Secure Product

Chris John Riley -- MVSP: Minimum Viable Secure Product

Steve Wilson and Gavin Klondike -- OWASP Top Ten for LLM Applications Release

Steve Wilson and Gavin Klondike -- OWASP Top Ten for LLM Applications Release

Tanya Janca -- What secure Coding Really Means

Tanya Janca -- What secure Coding Really Means

Hasan Yasar -- Actionable SBOM via DevSecOps

Hasan Yasar -- Actionable SBOM via DevSecOps

Varun Badhwar -- The Developer Productivity Tax

Varun Badhwar -- The Developer Productivity Tax

OWASP Board of Directors Debate

OWASP Board of Directors Debate

Itzik Alvas -- Secrets Security and Management

Itzik Alvas -- Secrets Security and Management

Harshil Parikh -- Deep Environmental and Organizational Context in Application Securit

Harshil Parikh -- Deep Environmental and Organizational Context in Application Securit

Jeff Williams -- The Tech of Runtime Security

Jeff Williams -- The Tech of Runtime Security

Mark Curphey and John Viega -- Chalk

Mark Curphey and John Viega -- Chalk

Maril Vernon -- You Get What You Inspect, Not What You Expect

Maril Vernon -- You Get What You Inspect, Not What You Expect

Dan Küykendall -- Why All Application Security Products Suck

Dan Küykendall -- Why All Application Security Products Suck

Kevin Johnson -- Samurai Swords and Zap's Departure

Kevin Johnson -- Samurai Swords and Zap's Departure

Tony Quadros -- The Life of an AppSec Vendor

Tony Quadros -- The Life of an AppSec Vendor

Steve Giguere -- Cloud AppSec

Steve Giguere -- Cloud AppSec

Paul McCarty -- The Burrito Analogy of the Software Supply Chain

Paul McCarty -- The Burrito Analogy of the Software Supply Chain

Kim Wuyts -- The Future of Privacy Threat Modeling

Kim Wuyts -- The Future of Privacy Threat Modeling

François Proulx -- Actionable Software Supply Chain Security

François Proulx -- Actionable Software Supply Chain Security

Steve Wilson -- OWASP Top Ten for LLMs

Steve Wilson -- OWASP Top Ten for LLMs

JB Aviat -- The State of Application Security

JB Aviat -- The State of Application Security

Joshua Wells -- Application Security in the Age of Zero Trust

Joshua Wells -- Application Security in the Age of Zero Trust

Jeevan Singh -- The Future of Application Security Engineers

Jeevan Singh -- The Future of Application Security Engineers

Tony Turner -- Threat Modeling and SBOM

Tony Turner -- Threat Modeling and SBOM

Christian Frichot -- Threat Modeling with hcltm

Christian Frichot -- Threat Modeling with hcltm

Zohar Shachar -- Bug Bounty from Both Sides

Zohar Shachar -- Bug Bounty from Both Sides

Sarah-jane Madden -- Threat Modeling to established teams

Sarah-jane Madden -- Threat Modeling to established teams

Jet Anderson -- The AppSec Code Doctor

Jet Anderson -- The AppSec Code Doctor

James Mckee -- Developer Security

James Mckee -- Developer Security

Derek Fisher -- The Application Security Handbook

Derek Fisher -- The Application Security Handbook

Rob van der Veer -- OWASP AI Security & Privacy Guide

Rob van der Veer -- OWASP AI Security & Privacy Guide

Robyn Lundin -- Planning & organizing a penetration test as an AppSec team

Robyn Lundin -- Planning & organizing a penetration test as an AppSec team

Michael Bargury -- Low Code / No Code Security and an OWASP Top Ten

Michael Bargury -- Low Code / No Code Security and an OWASP Top Ten

Alex Olsen -- Security champions, empowering developers, and AppSec training

Alex Olsen -- Security champions, empowering developers, and AppSec training

Mark Curphey -- The future of OWASP

Mark Curphey -- The future of OWASP

Tiago Mendo -- How to scan at scale with OWASP ZAP

Tiago Mendo -- How to scan at scale with OWASP ZAP

Wolfgang Goerlich -- Security beyond vulnerabilities

Wolfgang Goerlich -- Security beyond vulnerabilities

Sam Stepanyan -- OWASP Nettacker Project

Sam Stepanyan -- OWASP Nettacker Project

Nick Aleks and Dolev Farhi -- GraphQL Security

Nick Aleks and Dolev Farhi -- GraphQL Security

Guy Barhart-Magen -- Log4j and Incident Response

Guy Barhart-Magen -- Log4j and Incident Response

Brett Smith -- Security is a Necessary Evil

Brett Smith -- Security is a Necessary Evil

Chen Gour-Arie -- The AppSec Map

Chen Gour-Arie -- The AppSec Map

Dominique Righetto -- OWASP Secure Headers

Dominique Righetto -- OWASP Secure Headers

Hillel Solow -- How to do AppSec without a security team

Hillel Solow -- How to do AppSec without a security team

Chris Romeo -- The Security Journey Story

Chris Romeo -- The Security Journey Story

Kristen Tan & Vaibhav Garg -- Machine Assisted Threat Modeling

Kristen Tan & Vaibhav Garg -- Machine Assisted Threat Modeling

Patrick Dwyer -- CycloneDX and SBOMs

Patrick Dwyer -- CycloneDX and SBOMs

Omer Gil and Daniel Krivelevich -- Top 10 CI/CD Security Risks

Omer Gil and Daniel Krivelevich -- Top 10 CI/CD Security Risks

Josh Grossman -- Building a High-Value AppSec Scanning Program

Josh Grossman -- Building a High-Value AppSec Scanning Program

Alex Mor -- Application Risk Profiling at Scale

Alex Mor -- Application Risk Profiling at Scale

Brenna Leath -- Product Security Leads: A different way of approaching Security Champions

Brenna Leath -- Product Security Leads: A different way of approaching Security Champions

Will Ratner -- Centralized container scanning

Will Ratner -- Centralized container scanning

Neil Matatall -- AppSec at Scale

Neil Matatall -- AppSec at Scale

Joern Freydank -- Security Design Anti Patterns Limit Security Debt

Joern Freydank -- Security Design Anti Patterns Limit Security Debt

Ken Toler -- Blockchain, Cloud, and #AppSec

Ken Toler -- Blockchain, Cloud, and #AppSec

Jeroen Willemsen and Ben de Haan -- Dirty little secrets

Jeroen Willemsen and Ben de Haan -- Dirty little secrets

Adam Shostack -- Fast, cheap and good threat models

Adam Shostack -- Fast, cheap and good threat models

Loren Kohnfelder -- Designing Secure Software

Loren Kohnfelder -- Designing Secure Software

Ochaun Marshall -- IaC and SAST

Ochaun Marshall -- IaC and SAST

Simon Bennetts -- Using OWASP Zap across an Enterprise

Simon Bennetts -- Using OWASP Zap across an Enterprise

Timo Pagel -- DevSecOps Maturity Model

Timo Pagel -- DevSecOps Maturity Model

Mazin Ahmed -- Terraform Security

Mazin Ahmed -- Terraform Security

OWASP Top 10 2021 Peer Review

OWASP Top 10 2021 Peer Review

Anastasiia Voitova -- Encryption is easy, key management is hard

Anastasiia Voitova -- Encryption is easy, key management is hard

Eran Kinsbruner -- DevSecOps Continuous Testing

Eran Kinsbruner -- DevSecOps Continuous Testing

Mark Loveless -- Threat modeling in a DevSecOps environment

Mark Loveless -- Threat modeling in a DevSecOps environment

Jeroen Willemsen -- Security automation with ci/cd

Jeroen Willemsen -- Security automation with ci/cd

Kevin Greene -- Thinking back, Looking forward - A Balanced Approach to Securing our Software Future

Kevin Greene -- Thinking back, Looking forward - A Balanced Approach to Securing our Software Future

Jeevan Singh -- Threat modeling based in democracy

Jeevan Singh -- Threat modeling based in democracy

Dima Kotik -- Application Security and the Zen of Python

Dima Kotik -- Application Security and the Zen of Python

Dustin Lehr -- Advocating and being on the side of developers

Dustin Lehr -- Advocating and being on the side of developers

Aaron Rinehart -- Security Chaos Engineering

Aaron Rinehart -- Security Chaos Engineering

Izar Tarandach and Matt Coles-- Threat Modeling: A Practical Guide for Development Teams

Izar Tarandach and Matt Coles-- Threat Modeling: A Practical Guide for Development Teams

Charles Shirer -- The most positive person in security

Charles Shirer -- The most positive person in security

Leif Dreizler: Tactical tips to shift engineering right

Leif Dreizler: Tactical tips to shift engineering right

Vandana Verma -- OWASP Spotlight Series

Vandana Verma -- OWASP Spotlight Series

Dr. Anita D’Amico -- Do certain types of developers or teams write more secure code?

Dr. Anita D’Amico -- Do certain types of developers or teams write more secure code?

Alyssa Miller -- Bringing security to DevOps and the CI/CD pipeline

Alyssa Miller -- Bringing security to DevOps and the CI/CD pipeline

Chris Romeo -- DevSecOps Fails

Chris Romeo -- DevSecOps Fails

Jim Routh -- Secure software pipelines

Jim Routh -- Secure software pipelines

JC Herz and Steve Springett -- SBOMs and software supply chain assurance

JC Herz and Steve Springett -- SBOMs and software supply chain assurance

Brian Reed -- Mobile Appsec: The Good, the Bad and the Ugly as We Head into 2021

Brian Reed -- Mobile Appsec: The Good, the Bad and the Ugly as We Head into 2021

Aviat Jean-Baptiste -- The AppSec report

Aviat Jean-Baptiste -- The AppSec report

Dmitry Sotnikov - REST API Security - There is no silver bullet

Dmitry Sotnikov - REST API Security - There is no silver bullet

Caroline Wong -- The state of Penetration testing

Caroline Wong -- The state of Penetration testing

Aaron "kumavis" Davis -- LavaMoat -- solving JavaScript software supply chain

Aaron "kumavis" Davis -- LavaMoat -- solving JavaScript software supply chain

Anastasiia Voitova -- Use Cryptography; Don’t Learn It

Anastasiia Voitova -- Use Cryptography; Don’t Learn It

Michael Furman -- SameSite Cookies

Michael Furman -- SameSite Cookies

Neil Matatall -- Content Security Policy

Neil Matatall -- Content Security Policy

Grant Ongers -- Gamification of threat modeling

Grant Ongers -- Gamification of threat modeling

Elie Saad -- OWASP WSTG, Cheat Sheets, and Integration

Elie Saad -- OWASP WSTG, Cheat Sheets, and Integration

Graham Holmes -- Adversarial Machine Learning

Graham Holmes -- Adversarial Machine Learning

Ochaun Marshall -- Securing Web applications in AWS

Ochaun Marshall -- Securing Web applications in AWS

Drew Dennison - Security should make the computer sweat more

Drew Dennison - Security should make the computer sweat more

IoTGoat Demo

IoTGoat Demo

Aaron Guzman -- IoTGoat

Aaron Guzman -- IoTGoat

Adam Shostack -- The Jenga View of Threat Modeling

Adam Shostack -- The Jenga View of Threat Modeling

Cindy Blake -- Aligning security testing with Agile development

Cindy Blake -- Aligning security testing with Agile development

Jannik Hollenbach -- Multijuicer: JuiceShop with a side of Kubernetes

Jannik Hollenbach -- Multijuicer: JuiceShop with a side of Kubernetes

Sebastien Deleersnyder and Bart De Win -- OWASP SAMM

Sebastien Deleersnyder and Bart De Win -- OWASP SAMM

Marc French, Steve Lipner, Maya Kaczorowski, DJ Schleen, Kim Wuyts — Season Six Wrap up

Marc French, Steve Lipner, Maya Kaczorowski, DJ Schleen, Kim Wuyts — Season Six Wrap up

Mark Merkow — Secure, Resilient, and Agile Software Development

Mark Merkow — Secure, Resilient, and Agile Software Development

Zsolt Imre -- Fuzz testing is easy

Zsolt Imre -- Fuzz testing is easy

Adam Shostack — Remote Threat Modeling

Adam Shostack — Remote Threat Modeling