Björn Kimminich — The new JuiceShop, GSOC, and Open Security Summit
Björn Kimminich is the project leader for OWASP JuiceShop. This is his second visit to the podcast, and we discuss new features in JuiceShop, including XSS in jingle promo video, marketing campaign coupon hacking, GDPR related features and challenges, working 2FA with TOTP, and the DLP failure challenges. Then we get into the cool new things that will come as a result of the GSoC, where a developer will add new functionality to the JS where new vulns can be hidden. We end discussing the upcoming Open Security Summit from OWASP.
Podcast: Play in new window | Download
Subscribe: Apple Podcasts | Android | Email | Google Podcasts | Stitcher | TuneIn | Spotify | RSS | More
Björn Kimminich — JuiceShop — 5 minute AppSec
Björn Kimminich is the project leader for OWASP JuiceShop. He created JuiceShop out of necessity, after reviewing all the available vulnerable web apps years ago, and not finding what he needed. OWASP Juice Shop is probably the most modern and sophisticated insecure web application! It can be used in security training, awareness demos, CTFs, and as a guinea pig for security tools! Juice Shop encompasses vulnerabilities from the entire OWASP Top Ten along with many other security flaws found in real-world applications!
Podcast: Play in new window | Download
Subscribe: Apple Podcasts | Android | Email | Google Podcasts | Stitcher | TuneIn | Spotify | RSS | More
Nancy Gariché and Tanya Janca — DevSlop, the movement
Nancy Gariché and Tanya Janca are two of the project leaders for the OWASP DevSlop Project. As we learn more about DevSlop, we realize that it is much more than a project: it’s a movement. DevSlop is about the learning and sharing of four awesome women and is a platform for them to share what they’ve learned with the community.
DevSlop consists of four different modules:
- Patty – An Azure DevSecOps pipeline
- Pixi-CRS & Pixi-CRS-ZAP are two Circle-CI pipelines that demonstrate adding a WAF to your pipeline for automatic tuning before moving your apps to prod
- Pixi is an intentionally vulnerable app and consists of a vulnerable web app and API service,
- The DevSlop Show, a video streaming series where project members build things live, interview members of the OWASP and InfoSec community, and learn where they fit into DevOps.
We hope you enjoy.
Find Nancy, Tanya, and DevSlop on Twitter.
Podcast: Play in new window | Download
Subscribe: Apple Podcasts | Android | Email | Google Podcasts | Stitcher | TuneIn | Spotify | RSS | More
Tanya Janca — Mentoring Monday — 5 Minute AppSec
Tanya Janca is excited about mentoring. She’s started a hashtag on Twitter for mentors to find mentee’s, and for mentee’s to search for mentors. Mentoring is such an essential part of growing our community, so if you are not mentoring anyone today, I can only ask, why not? Here is Tanya’s take on mentoring and her advice on how to get involved with #MentoringMonday.
5 Minute AppSec is an AppSec Podcast experiment with micro-content. Hit us up on Twitter and tell us what you think, @AppSecPodcast.
Podcast: Play in new window | Download
Subscribe: Apple Podcasts | Android | Email | Google Podcasts | Stitcher | TuneIn | Spotify | RSS | More
Matt Clapham — A perspective on appsec from the world of medical software
Matt Clapham is a product security person, as a developer, security engineer, advisor, and manager. He began his career as a software tester, which led him down the path of figuring out how to break things. Matt lives in the medical software world and visited the Healthcare Information and Management Systems Society (HIMSS) conference. Matt shares his perspectives on application/cybersecurity through the eyes of the healthcare industry. There is much for us to understand by viewing how other segments approach security and privacy. Matt believes in stepping outside the echo chamber and experiencing how other industries see security, and he achieved that by visiting this non-security conference and sharing his experiences with us. (And if he visits your booth at an event, you better know how your companies make a secure product or solution!)
Podcast: Play in new window | Download
Subscribe: Apple Podcasts | Android | Email | Google Podcasts | Stitcher | TuneIn | Spotify | RSS | More
Jon McCoy — Hacker outreach
Jon McCoy is a security engineer, a developer, and a hacker; and a passionate OWASP advocate. Maybe even a hacker first. Jon has a passion to connect people and break down barriers between hackers and corporate folks. Jon explains the idea of hacker outreach and breaks down what we can expect if we venture to the DefCon event in Las Vegas. Jon also remembered a cautionary tale of Robert’s Fitbit out at a DefCon event. Jon is someone we can all learn from about giving back to our community.
Podcast: Play in new window | Download
Subscribe: Apple Podcasts | Android | Email | Google Podcasts | Stitcher | TuneIn | Spotify | RSS | More
Omer Levi Hevroni — K8s can keep a secret?
Omer Levi Hevroni has written extensively on the topic of Kubernetes and secrets, and he’s a super dev. He’s the author of a tool for secrets management called Kamus. Kamus is an open source, GitOps, zero-trust secrets encryption and decryption solution for Kubernetes applications. Kamus enables users to easily encrypt secrets that can be decrypted only by the application running on Kubernetes. The encryption is done using strong encryption providers (currently supported: Azure KeyVault, Google Cloud KMS, and AES).
Find Omer on Twitter to converse about all things K8s and secrets.
Show notes:
https://blog.solutotlv.com/can-kubernetes-keep-a-secret/
https://github.com/Soluto/kamus
Podcast: Play in new window | Download
Subscribe: Apple Podcasts | Android | Email | Google Podcasts | Stitcher | TuneIn | Spotify | RSS | More
Izar Tarandach — Command line threat modeling with pytm
Izar Tarandach is a threat modeling pioneer, seen as one of the movers and shakers in the threat modeling world. Izar leads a small team that develops the pytm tool, which is self-described as a “A Pythonic framework for threat modeling”. The GitHub page goes on to say define your system in Python using the elements and properties described in the pytm framework. Based on your definition, pytm can generate, a Data Flow Diagram (DFD), a Sequence Diagram and most important of all, threats to your system.
Reach out to Izar on Twitter and visit the pytm GitHub page to download and try this tool out for yourself!
Podcast: Play in new window | Download
Subscribe: Apple Podcasts | Android | Email | Google Podcasts | Stitcher | TuneIn | Spotify | RSS | More
Simon Bennetts — OWASP ZAP: past, present, and future
Simon Bennetts is the project leader for OWASP ZAP. Simon joined Robert at CodeMash to talk about the origin of ZAP, the new heads up display, and ZAP API.
ZAP is an OWASP FlagShip Project and is available here: https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project
Podcast: Play in new window | Download
Subscribe: Apple Podcasts | Android | Email | Google Podcasts | Stitcher | TuneIn | Spotify | RSS | More
Bill Sempf — Growing AppSec People and KidzMash
Robert meets up with Bill Sempf at the CodeMash conference and discusses how to grow AppSec people. Developers can transform into application security people. They also cover how to inspire the next generation of cybersecurity people (kids) through the example of KidzMash.
Podcast: Play in new window | Download
Subscribe: Apple Podcasts | Android | Email | Google Podcasts | Stitcher | TuneIn | Spotify | RSS | More
Georgia Weidman — Mobile, IoT, and Pen Testing
Georgia Weidman (@georgiaweidman) met with Robert at CodeMash to discuss her origin story, mobile, IoT, penetration testing, and details about her various companies.
If you’ve never seen Georgia’s book on penetration testing, we recommend you grab a copy. http://www.nostarch.com/pentesting
To sign up for the <Hi/5> newsletter mentioned at the start of this week’s show, visit https://podcast.securityjourney.com/hi5
Podcast: Play in new window | Download
Subscribe: Apple Podcasts | Android | Email | Google Podcasts | Stitcher | TuneIn | Spotify | RSS | More
Season 4 Finale (S04E27)
Here it is. The finale of season four. Thanks to everyone who listens in and remember, if there’s any people you want us to interview on the podcast, tweet at us @AppSecPodcast
Podcast: Play in new window | Download
Subscribe: Apple Podcasts | Android | Email | Google Podcasts | Stitcher | TuneIn | Spotify | RSS | More
Rapid Threat Model Prototyping Process (S04E26)
On this episode, Chris and Robert are joined by Geoff Hill to talk about Rapid Threat Model Prototyping Process.
You can find Geoff on Twitter @Tutamantic_Sec
Podcast: Play in new window | Download
Subscribe: Apple Podcasts | Android | Email | Google Podcasts | Stitcher | TuneIn | Spotify | RSS | More
Running Azure Securely (S04E25)
On this episode, Chris and Robert are joined by Bill Wilder to talk about Running Azure Securely.
You can find Bill on Twitter @codingoutloud
Podcast: Play in new window | Download
Subscribe: Apple Podcasts | Android | Email | Google Podcasts | Stitcher | TuneIn | Spotify | RSS | More
OWASP Glue (S04E24)
On this episode, Chris and Robert are joined by Matt Konda to talk about what Glue is.
You can find Matt on Twitter @mkonda
Podcast: Play in new window | Download
Subscribe: Apple Podcasts | Android | Email | Google Podcasts | Stitcher | TuneIn | Spotify | RSS | More
AppSec in Israel and Three Talks to watch from AppSec USA(S04E23)
On this episode, Chris is joined by Josh Grossman, Avi Douglen, and Ofer Maor at AppSec USA. They discuss the AppSec group in Israel and a few important talks you should watch from AppSec USA this year.
You can find Josh on Twitter @JoshCGrossman
You can find Avi on Twitter @sec_tigger
You can find Ofer on Twitter @OferMaor
Podcast: Play in new window | Download
Subscribe: Apple Podcasts | Android | Email | Google Podcasts | Stitcher | TuneIn | Spotify | RSS | More
OWASP IoT Top 10 (S04E22)
On this episode, Chris and Robert are joined by Daniel Miessler to talk about the upcoming Top 10 list for IoT.
You can find Daniel on Twitter @DanielMiessler
Podcast: Play in new window | Download
Subscribe: Apple Podcasts | Android | Email | Google Podcasts | Stitcher | TuneIn | Spotify | RSS | More
SecOps Makes Developers Lives Easier (S04E21)
On this episode, Chris is joined by Travis McPeak to talk about SecOps and the ways it can help make a developers life easier.
You can find Travis on Twitter @travismcpeak
Podcast: Play in new window | Download
Subscribe: Apple Podcasts | Android | Email | Google Podcasts | Stitcher | TuneIn | Spotify | RSS | More
Security Culture Hacking: Disrupting the Security Status Quo (S04E20)
On this week, we listen in on the #AppSecUSA talk by Chris about Security Culture Hacking.
You can find Chris on Twitter @edgeroute
Podcast: Play in new window | Download
Subscribe: Apple Podcasts | Android | Email | Google Podcasts | Stitcher | TuneIn | Spotify | RSS | More
The Extremely Unabridged History of SQLi and XSS(S04E19)
On this episode, Jim Manico joins again to talk about the ways that AppSec has changed over the years and give us an in-depth look at the history of SQL Injection and XSS.
You can find Jim on Twitter @manicode
Podcast: Play in new window | Download
Subscribe: Apple Podcasts | Android | Email | Google Podcasts | Stitcher | TuneIn | Spotify | RSS | More
The History of OWASP (S04E18)
On this episode, Chris talks with Jeff Williams about the History of OWASP and where it came from.
You can find Jeff on Twitter @planetlevel
Podcast: Play in new window | Download
Subscribe: Apple Podcasts | Android | Email | Google Podcasts | Stitcher | TuneIn | Spotify | RSS | More
The Joy of the Vulnerable Web: JuiceShop(S04E17)
Bjorn Kimminich joins to talk about JuiceShop on this weeks episode. He dives into what JuiceShop is and some of the use cases for it.
You can find Bjorn on Twitter @bkimminich
Podcast: Play in new window | Download
Subscribe: Apple Podcasts | Android | Email | Google Podcasts | Stitcher | TuneIn | Spotify | RSS | More
iGoat and iOS Mobile Pen Testing (S04E16)
On this episode, Chris is at AppSec USA and is joined by Swaroop to talk about iGoat. They discuss how iGoat relates to WebGoat and how they can be used for pen testing.
You can find Swaroop on Twitter @swaroopsy
Podcast: Play in new window | Download
Subscribe: Apple Podcasts | Android | Email | Google Podcasts | Stitcher | TuneIn | Spotify | RSS | More
Two Sides to a Bug Bounty: The Researcher and The Program (S04E15)
On this episode, Chris and Robert talk with Adam and John from HackerOne about Bug Bounty. They dive into bug bounty from the programming side and the security researcher side to show how you can put these pieces together to be successful with bug bounty.
You can find Adam on Twitter @SushiHack and Jon @jon_bottarini
Podcast: Play in new window | Download
Subscribe: Apple Podcasts | Android | Email | Google Podcasts | Stitcher | TuneIn | Spotify | RSS | More
What You Require, You Must Also Retire (S04E14)
Chris talks with Erlend Oftedal about what the Norway Chapter of OWASP and continues on into what retire.js is and how it works.
You can find Erlend on Twitter @webtonull
Podcast: Play in new window | Download
Subscribe: Apple Podcasts | Android | Email | Google Podcasts | Stitcher | TuneIn | Spotify | RSS | More
