Episodes

  • Episode 269 - Security Conferences, What Sucks in (App)Sec

    Episode 269 - Security Conferences, What Sucks in (App)Sec
    Dec 17 2024
    The dynamic duo is back for another holiday special. Not that they reference the holidays, but dig into complaints about security conferences and how to build a conference network. Followed by a discussion inspired by a recent TL;DRSec post from Maya Kaczorowski on "What Sucks about Security" where security leaders were asked that specific question. This leads into the question "What Sucks in AppSec?", so the co-hosts give their responses.
    Show More Show Less
    Less than 1 minute
  • Episode 268 w/ Clint Gibler - Curating a Newsletter, Secure Defaults

    Episode 268 w/ Clint Gibler - Curating a Newsletter, Secure Defaults
    Dec 10 2024
    Seth and Ken are happy to announce that Clint Gibler (@clintgibler), the force behind TL;DRSec (tldrsec.com) and head of Security Research at Semgrep, will be coming on as a guest again on the Absolute AppSec podcast. The conversation starts with background on his experience with TL;DRSec and writing a newsletter. Followed up by an indepth discussion on secure defaults and how Semgrep and other tools help push security in organizations.
    Show More Show Less
    Less than 1 minute
  • Episode 267 - w/ Kinnaird McQuade - Building a Security Product

    Episode 267 - w/ Kinnaird McQuade - Building a Security Product
    Nov 19 2024
    Join us for an episode of Absolute AppSec with Kinnaird McQuade, founder and CTO of NightVision. Kinnaird developed NightVision as a security testing tool that combines codebase analysis with DAST features. Before NightVision, Kinnaird worked as lead security engineer at both Square and Salesforce. Additionally he worked at Synopsys as Cloud Security Consulting Practice Lead. Be sure to tune into the episode as Ken Johnson and Seth Law interview Kinnaird McQuade to gain insights from his experiences and thoughts on improving security for applications and developers.
    Show More Show Less
    Less than 1 minute
  • Episode 266 - Scope of Penetration Testing, Attack Modeling

    Episode 266 - Scope of Penetration Testing, Attack Modeling
    Nov 5 2024
    Seth (@sethlaw) and Ken (@cktricky) return for an in-depth discussion on penetration testing expectations, driven by recent posts and slack activity from Andrew Wilson. Essentially, certain clients expect that a single penetration test finds everything possible, whether or not those expectations are appropriate. The duo expounds on their experience with similar expectations and how its affected their respective careers and organizations. A followup on threat modeling and a new approach being coined as Attack Modeling.
    Show More Show Less
    Less than 1 minute
  • Episode 265 - w/ Scott Norberg - Static Analysis

    Episode 265 - w/ Scott Norberg - Static Analysis
    Oct 29 2024
    Scott Norberg joins Ken Johnson and Seth Law for an episode of Absolute AppSec all about SAST. Scott is an ASP.NET Security Consultant, Author, Researcher and Speaker. In addition to running his Opperis Technologies consultancy, Scott has recently begun working as lead application security architect at CDW. Before that he worked as Lead Application Security engineer at Gallagher and was a Senior Consultant with the AppSec team at Coalfire. He has been a web security specialist for nearly two decades, and holds several certifications, including Microsoft Certified Technology Specialist (MCTS), certifications for ASP.NET and SQL Server, and a Certified Information Systems Security Professional (CISSP) and CCSP certification. He also has an MBA from Indiana University. To find out more about Scott check out his website https://scottnorberg.com/ as well as his 2020 book Advanced ASP NET Core Security Vulnerabilities.
    Show More Show Less
    Less than 1 minute
  • Episode 264 - w/ Jeremy Long - Software Composition Analysis

    Episode 264 - w/ Jeremy Long - Software Composition Analysis
    Oct 17 2024
    Jeremy Long (@ctxt on social media), Principal Security Engineer at Service Now and project founder and lead for the OWASP Dependency Check project joins Ken Johnson (@cktricky) and Seth Law (@sethlaw). Jeremy spent a decade and a half as a lead application security engineer and principal engineer at Wells Fargo before joining ServiceNow. He has spent years developing processes for automated security analysis of software libraries and techniques for improving real-time application protection (RTAP) systems. Make sure to set time aside for a discussion on Jeremy's insights into improving security systems through dependency analysis and managing industry projects.
    Show More Show Less
    Less than 1 minute
  • Episode 263 - WebApp Fuzzing, Mobile Testing, Secrets Management

    Episode 263 - WebApp Fuzzing, Mobile Testing, Secrets Management
    Oct 8 2024
    Ken and Seth return for Episode #263 and start with a discussion around web application fuzzing and the deficiencies of vulnerability and exploit-focused dynamic testing, a common thread in Seth's ranting. This is followed by a discussion on mobile testing and attempting to control security through client-side controls, spurred by an article that compares security in the McDonald's Android app to various banking apps. The final topic is around secrets management and use of the dotenv (.env) file for storing secrets.
    Show More Show Less
    Less than 1 minute
  • Episode 262 - w/ Ariel Shin - Building a Security Program

    Episode 262 - w/ Ariel Shin - Building a Security Program
    Sep 30 2024
    Ariel Shin joins Ken Johnson (@cktricky on social media) and Seth Law (@sethlaw) for a special episode of Absolute AppSec. Ariel is currently a Security Engineering Manager at Datadog after a three-year stint at Twilio where she worked as an engineering manager in product security, a product security team lead, and a senior product security engineer. This year at Bsides SF 2024, she presented on her time at Twilio in a retrospective talk entitled “Six Years in Review: Transforming Company Culture to Embrace Risk.” The video from Bsides SF can be found here: https://www.youtube.com/watch?v=cQE1OqCpeI8. Before Twilio, Ariel worked at one medical as an appsec engineer as well as spending time as a Technology and Privacy consultant with Protiviti. She also helps build the professional appsec and prodsec communities as a frequent commenter and presenter at security conferences.
    Show More Show Less
    Less than 1 minute