Application Security Weekly

Mar 05 2024 109 ep. 63 mins 10

Application Security Weekly Podcast artwork

Copy RSS

Subscribe on Podcast Addict

The Simple Mistakes and Complex Seeds of a Vulnerability Management Program - Emily Fox - ASW #275

Mar 05 2024 79 mins

The need for vuln management programs has been around since the first bugs -- but lots of programs remain stuck in the past. We talk about the traps to avoid in VM programs, the easy-to-say yet hard-to-do foundations that VM programs need, and smarter ways to approach vulns based in modern app development. We also explore the ecosystem of acronyms around vulns and figure out what's

Creating the Secure Pipeline Verification Standard - Farshad Abasi - ASW #274

Feb 27 2024 57 mins

Farshad Abasi joins us again to talk about creating a new OWASP project, the Secure Pipeline Verification Standard. (Bonus points for not being a top ten list!) We talk about what it takes to pitch a new project and the problems that this new project is trying to solve. For this kind of project to be successful -- as in making a positive impact to how software is built -- it's impo

Redefining Threat Modeling - Security Team Goes on Vacation - Jeevan Singh - ASW Vault

Feb 20 2024 38 mins

Check out this interview from the ASW Vault, hand picked by main host Mike Shema! This segment was originally published on Dec 13, 2022. Threat modeling is an important part of a security program, but as companies grow you will choose which features you want to threat model or become a bottleneck. What if I told you, you can have your cake and eat it too. It is possible to scale yo

Creating Code Security Through Better Visibility - Christien Rioux - ASW #273

Feb 13 2024 83 mins

We've been scanning code for decades. Sometimes scanning works well -- it finds meaningful flaws to fix. Sometimes it distracts us with false positives. Sometimes it burdens us with too many issues. We talk about finding a scanning strategy that works well and what the definition of "works well" should even be. Segment Resources: LLMs improve fuzzing coverage, the Shim vuln threate

Starting an OWASP Project (That's Not a List!) - Grant Ongers - ASW #272

Feb 06 2024 74 mins

We can't talk about OWASP without talking about lists, but we go beyond the lists to talk about a product security framework. Grant shares his insights on what makes lists work (and not work). More importantly, he shares the work he's doing to spearhead a new OWASP project to help scale the creation of appsec programs, whether you're on your own or part of a global org. Segment Res

Getting Your First Conference Presentation - Sarah Harvey - ASW #271

Jan 30 2024 79 mins

We return to the practice of presentations, this time with a perspective from a conference organizer. And we have tons of questions! What makes a topic stand out? How can an old, boring topic be given new life? How do you prepare as a first-time presenter? What can conferences do to foster better presentations and new voices? Segment resources: Vulns in Jenkins code and Cisco devic

Dealing with the Burden of Bad Bots - Sandy Carielli - ASW #270

Jan 23 2024 68 mins

Where apps provide something of value, bots are sure to follow. Modern threat models need to include scenarios for bad bots that not only target user credentials, but that will also hoard inventory and increase fraud. Sandy shares her recent research as we talk about bots, API security, and what developers can do to deal with these. Segment resources In the news, vulns throw a wren

Communicating Technical Topics Without Being Boring - Eve Maler - ASW #269

Jan 16 2024 35 mins

It's time to start thinking about CFPs and presentations for 2024! Eve shares advice on delivering technical topics so that an audience can understand the points you want to make. Then we show how developing these presentation skills for conferences helps with presentations within orgs and why these are useful skills to build for your career. Visit for all the latest episodes! Foll

What's in Store for 2024? - ASW #268

Jan 09 2024 71 mins

We kick off the new year with a discussion of what we're looking forward to and what we're not looking forward to. Then we pick our favorite responses to "appsec in three words" and set our sights on a new theme for 2024. In the news, 23andMe shifts blame to users for poor password practices, abusing Google's OAuth2 through a MultiLogin endpoint, Rustls is memory safe and fast, AI

HTTP RFCs Have Evolved, Breaking Into Cloud, Scaling AppSec at Netflix, & Confluence - Keith Hoodlet - ASW Vault

Jan 01 2024 33 mins

HTTP RFCs have evolved: A Cloudflare view of HTTP usage trends, Career Advice and Professional Development, Active Exploitation of Confluence CVE-2022-26134 Visit for all the latest episodes! Follow us on Twitter: Like us on Facebook: Show Notes: