-
February brought us the Lunar New Year, a Leap Day, and more OWASP projects than we expected!
Grant Ongers kicked off our February shows with a preview of his new OWASP project – the Product Security Capability Framework. He explains how it relates to efforts like ASVS and SAMM and, importantly, why it’s not just another top 10 list.
Then Christien Rioux talked about code scanning strategies and how better visibility into code translates to more meaningful flaws to pay attention to. He shares how seeing what’s running in prod and what prod systems are talking to helps dev teams far more than a long list of potential vulns.
Episode 223 (from the vault)
We went back to the vault for week three, bringing back a discussion on successful threat modeling with Jeevan Singh. Our focus wasn’t so much on the nuances of threat models, but the adjectives around them – successful and scalable. All too often appsec teams say “do threat modeling” and mistake an approach that works once with a process that needs to scale.
As a mirror to the start of the month, Farshad Abasi to talk about his upcoming OWASP project – the Secure Pipeline Verification Standard. One of the motivations for this was that, sure, there’s a top 10 list, but there are no solutions. It’s great to see more projects focusing on frameworks and design patterns that dev teams can follow to secure how code is compiled into artifacts and artifacts are sent to prod.
Subscribe to ASW to find these episodes and more! Also check out the January 2024 recap.
-480x320.png)
• • • -
January brings a new year and a new vision for appsec. Let’s leave behind lists and think less about shifting and more about expanding security.
Episode 200 (from the vault)
The first show we posted for 2024 came from the vault. Back in July 2022 Keith Hoodlet came by to help celebrate the 200th episode. Keith started the show with episode 0. Since then he’s been blogging at securing.dev about #appsec (of course) and DevOps. Even though this is a news segment, two of the articles were about careers and career development – and surely still relevant today.
In the first show we recorded for 2024, John Kinsella shared his take on “appsec in three words” along with a few favorite responses from last year’s guests. Then we talked about where we hope this year takes appsec and some topics that we hope to move on from. It’ll be no surprise to see more AI and supply chain items in the news. It’ll be even better if those items aren’t about more prompt injection or more shift left – some things can stay in 2023.
Eve Maler returned with recommendations for communicating technical topics to different audiences. It’s part of the theme of presentations that we covered quite a bit in 2023. This time we focused on the importance of communication skills at work.
Sandy Carielli is another guest we always love to have on the show. We talked about bad bots and their impact on products and the user experience – where there are items of value there are bots. Sandy also makes the point that value isn’t always in obvious items like concert tickets, limited edition clothing, and credentials. Bots can also drive inauthentic reviews and artificial popularity, which is as relevant to products as it is to politics.
We wrapped up January with one last discussion on delivering presentations. This time Sarah Harvey gave a conference organizer’s perspective. Sarah shared some of her own techniques for crafting slides and giving a coherent conference talk. She also explained how conferences like BSides SF actively support new speakers by offering practice sessions and constructive feedback. Giving constructive feedback is its own skill and one that’s relevant to corporate environments in addition to conferences.
Subscribe to ASW to find these episodes and more! Also check out the December 2023 recap.
• • • -
December closed out another year of Application Security Weekly. Thank you to everyone who’s listened! We have more news, more guests, and more fun intros coming in 2024.
John Kinsella keeps a list of news articles and topics to revisit six months later and the end of 2023 seemed like the right time to check that list out. We reviewed several articles from the past year to see if they elicited a yay or a yawn. Not surprisingly, LLMs were pretty common, followed by memory safety and projects adopting Rust.
We dipped into documentation in a conversation with Heather Flanagan about RFCs. She has deep experience with various standards processes and shared her insights on how standards come about, security considerations, and how standards try to avoid ambiguity. Even if you’re not usually reading RFCs (they’re not all dry and boring!), there are lessons here for all sorts of documentation related to software. Check out the show notes for some of our favorite RFCs.
On our last recorded show of the year Idit Levine talked about making service meshes work for people – primarily as a means to increase observability for SREs, developers, and appsec teams. We talked about when and why organizations move from monorepos to service meshes, as well as when a monorepo should remain a monorepo.
Since there was one more Monday in December, we squeezed in an episode from the vault. In June 2021 Seba Deleersnyder joined us to talk about the OWASP Software Assurance Maturity Model. It can be especially useful to small orgs and orgs trying to figure out a roadmap for building secure software.
Subscribe to ASW to find these episodes and more! Also check out the November 2023 recap.
• • •