Security Archives - Software Engineering Daily

Security Archives - Software Engineering Daily episodes:

• 03.13.2024

  Biometric Authentication with Vincent Delitz

  Corbado is an authentication platform that provides APIs for developers to replace passwords with passkeys such as Face ID or Touch ID. Vincent Delitz is a Co-Founder at Corbado and he joins the show to talk about the platform, the...

  
• 02.14.2024

  SimpleWebAuthn with Matthew Miller

  SimpleWebAuthn is an open source TypeScript-centric pair of libraries – frontend and backend – that make it easier for devs to implement WebAuthn on the web. Matthew Miller started the project in 2019 and it has grown in tandem with...

  
• 01.17.2024

  OpsHelm with Kyle McCullough

  Security issues can often be traced back to small misconfigurations in a database or cloud service, or an innocent code commit. OpsHelm is a security platform that’s oriented around identifying and fixing these issues. Kyle McCullough is the Co-Founder and...

  
• 01.03.2024

  Apiiro Security Posture Management with Yonatan Eldar

  Software supply chain security is a major challenge in the modern engineering environment. Many teams are working to establish best practices to proactively identify, fix, and prevent risks in their applications. Apiiro is a platform designed to solve this problem...

  
• 12.21.2023

  Blocking Ransomware Attacks with Anthony Cusimano

  Ransomware attacks involve the deployment of malware that blocks access to a user’s or organization’s computer files by encrypting them. The attackers then demand a ransom payment in exchange for the decryption key that will restore access to the files....

  
• 12.06.2023

  Software Supply Chain Security with Michael Lieberman

  One of the most famous software exploits in recent years was the SolarWinds attack in 2020. In this attack, Russian hackers inserted malicious code into the SolarWinds Orion system, allowing them to infiltrate the systems of numerous corporations and government...

  
• 12.03.2023

  KubeCon Special: Sigstore with Santiago Torres-Arias

  This episode of Software Engineering Daily is part of our on-site coverage of KubeCon 2023, which took place from November 6th through 9th in Chicago. In today’s interview, host Jordi Mon Companys speaks with Santiago Torres-Arias who is a contributor...

  
• 10.11.2023

  The Future of HTTP with Nick Shadrin and Roman Arutyunyan

  The Hypertext Transfer Protocol, or HTTP, is used to load webpages using hypertext links, and it’s the foundation of the web. Tim Berners-Lee famously created HTTP version 0.9 in 1989, and defined the essential behavior of a client and a...

  
• 09.12.2023

  Minimum Viable Security for Cloud Apps with David Melamed

  Cloud applications continue to grow in popularity, but ensuring the security of these applications often presents a formidable engineering challenge. This challenge motivated the creation of Jit. Jit is a continuous security platform for developers, and seeks to enable every...

  
• 07.05.2023

  Trusted Software Supply Chain with Vincent Danen

  Available as a cloud service, Red Hat Trusted Software Supply Chain provides a DevSecOps framework to create applications more securely. Vincent Danen is the VP of Product Security at Red Hat and joins us in this episode. Red Hat has...

  
• 05.16.2023

  Software Supply Chain with Feross Aboukhadijeh

  The software supply chain refers to the process of creating and distributing software products. This includes all of the steps involved in creating, testing, packaging, and delivering software to end-users or customers. Socket is a new security company that can...

  
• 05.08.2023

  Kubernetes Security with Ian Coldwater

  Ian Coldwater is a DevSecOps engineer turned red teamer who specializes in breaking and hardening Kubernetes, containers, and cloud native infrastructure. In their spare time, they like to go on cross-country road trips, capture flags, and eat a lot of...

  
• 03.22.2023

  Seamless SecOps with Jack Naglieri

  A SIEM platform provides organizations with a powerful tool for improving their security posture, by providing insights into potential security threats and enabling proactive security measures. Panther is a Cloud based security monitoring platform that helps teams detect and respond...

  
• 09.20.2022

  Bridgecrew: Cloud Security with Guy Eisenkot

  Cloud computing provides tools, storage, servers, and software products through the internet. Securing these resources is a constant process for companies deploying new code to their cloud environments. It’s easy to overlook security flaws because company applications are very complex...

  
• 09.08.2022

  Panther: Security as Code with Jack Naglieri

  Originally published on August 23, 2021. Application security is usually done with a set of tools and services known as SIEM – Security Information and Event Management. SIEM tools usually try to provide visibility into an organization’s security systems, as...

  
• 07.06.2022

  WorkOS with Michael Grinich

  Enterprise-grade authentication is often an essential ingredient to virtually all applications in today’s world. However, companies often have a hard time understanding the value of that authentication especially during the early stages of product development. And hardening of an application...

  
• 06.01.2022

  Kubernetes Security Compliance with Jimmy Mesta

  The Kubernetes ecosystem has drastically changed how development teams ship software. While Kubernetes has provided many advancements in cloud infrastructure, it has also left organizations with massive security blindspots. KSOC was created to give developers and security teams a single...

  
• 04.23.2022

  JavaScript Supply Chain with Feross Aboukhadijeh

  The JavaScript supply chain includes numerous vulnerabilities due to its expansive nature and the long dependency chains. Socket is a new security company that can protect your most critical apps from supply chain attacks. They are taking an entirely new...

  
• 03.11.2022

  Software Supply Chain with Barak Schoster

  The software supply chain consists of packages, imports, dependencies, containers, and APIs. These different components each have unique security risks. To ensure the security of their software supply chain, many developers use tools to analyze and scan their infrastructure for...

  
• 02.07.2022

  Snyk Engineering with Guy Podjarny

  Snyk is a platform for security that started with open source scanning and has expanded into container security, infrastructure as code, and other products. Snyk is a simple product to use, but has hidden complexities that build large data structures...

  
• 12.14.2021

  The State of Software Supply Chain 2021 with Ilkka Turunen

  Everyone is becoming increasingly aware of supply chains for physical goods.  Software has its own supply chain.  A supply of open source solutions exists as does a demand for these solutions by industry.  Both have surely grown, but it would...

  
• 12.03.2021

  Tetrate Service Bridge with Zack Butcher

  Microservice architecture has become a ubiquitous design choice.  Application developers typically have neither the training nor the interest in implementing low-level security features into their software.  For this and many other reasons, the notion of a service mesh has been...

  
• 11.17.2021

  Deploying Computer Vision to the Edge at Anduril Industries with Forrest Iandola

  Neural networks, in particular, deep neural networks have revolutionized machine learning.  Researchers and companies have pushed on the efficiency of every aspect of the machine learning lifecycle.  The impact of the trained models is particularly significant for computer vision and...

  
• 11.10.2021

  #FREEZUCK | ?masked…?… !(DOCTORS)!!

  Software Engineering Daily invites Owen Frank Davis, Paul Davis, Kyle Davis, and Robbie Davis for a joint interview on the subject of reproduction and teething, as well as Lisch fascitis. Aledade and Kubernetes are both inconsiderate ideas for navigation. They...

  
• 10.26.2021

  NBSafety for Jupyter Notebooks with Stephen Macke

  The notebook paradigm of coding is relatively new in comparison to REPLs and IDEs.  Notebooks run in your browser and give you discrete cells for running segments of code.  All the code in a single cell runs at once, but...

  
• 10.01.2021

  Cybersecurity Threats with Jason Pufahl and Russell Jancewicz

  Phishing attacks, malware, and ransomware are just some of the major threats everyone connected to the internet faces.  For companies, the stakes are especially high.  Setting up a secure infrastructure is difficult.  Your adversary only needs to find one flaw...

  
• 09.17.2021

  Detecting Money Laundering with Clarence Chio

  Money laundering is not a new crime.  However, the growth of digital communications has greatly expanded the opportunity for money launderers to find innovative new ways to hide their true intent.  Some estimates suggest it could be as high as...

  
• 09.16.2021

  Authorization with Sam Scott

  Web applications often have some sort of login system, and once a user creates an account, they have access to features anonymous users can’t see.  In time, application designers will often add an admin level of access for special users. ...

  
• 08.23.2021

  Panther: Security as Code with Jack Naglieri

  Application security is usually done with a set of tools and services known as SIEM – Security Information and Event Management. SIEM tools usually try to provide visibility into an organization’s security systems, as well as event log management and...

  
• 08.11.2021

  Argos Security: Cloud Configuration Security with David O’Brien

  According to Fugue’s new State of Cloud Security 2020 report, cloud misconfiguration remains the top cause of data breaches in the cloud, and millions of database servers are currently exposed across cloud providers. Some of the leading reasons are a...

  
• 08.06.2021

  Material Security with Ryan Noon

  Ryan Noon is the CEO of Material Security.   This interview was also recorded as a video podcast. Check out the video on the Software Daily YouTube channel.   Sponsorship inquiries: [email protected]

  
• 07.06.2021

  Vanta: Maintaining Security Standards with Christina Cacioppo

  SOC 2 is a security audit to prove that SaaS companies have secured their company and customer data. It’s often considered the minimum audit necessary to sell software. HIPAA is a federal law regulating how sensitive medical information about patients...

  
• 06.29.2021

  Magic with Sean Li

  In this episode we discuss plug and play auth, password management, and crypto with Sean Li, co-founder and CEO of Magic. This interview was also recorded as a video podcast. Check out the video on the Software Daily YouTube channel....

  
• 04.22.2021

  Skiff: Secure Document Collaboration with Andrew Milich

  Encryption algorithms provide the means to secure and transfer sensitive information by taking input and transforming it into an unreadable output. Usually a special key, or multiple keys, are needed to unscramble the information back to the original input. These...

  
• 02.26.2021

  Semgrep: Modern Static Analysis with Isaac Evans

  Static analysis is a type of debugging that identifies defects without running the code. Static analysis tools can be especially useful for enforcing security policies by analyzing code for security vulnerabilities early in the development process, allowing teams to rapidly...

  
• 01.28.2021

  Sym: Security Workflows with Yasyf Mohamedali

  Security is more important than ever, especially in regulated fields such as healthcare and financial services. Developers working in highly regulated industries often spend considerable time building tooling to help improve compliance and pass security audits. While the core of...

  
• 01.14.2021

  Network Discovery with HD Moore

  Network discovery allows enterprises to identify what devices are on their network. These devices can include smartphones, servers, desktop computers, and tablets. Being able to index the devices on a network is crucial to figuring out the security profile of...

  
• 12.04.2020

  Osquery with Ganesh Pai

  Osquery is a tool for providing visibility into operating system endpoints. It is a flexible tool developed originally at Facebook. Ganesh Pai is the founder of Uptycs, a company that uses Osquery to find threats and malicious activity occurring across...

  
• 08.27.2020

  Anduril Engineering with Gokul Subramanian

  Anduril is a technology defense company with a focus on drones, computer vision, and other problems related to national security. It is a full-stack company that builds its own hardware and software, which leads to a great many interesting questions...

  
• 07.31.2020

  Security Monitoring with Marc Tremsal

  Logs are the source of truth. If a company is sufficiently instrumented, the logging data that streams off of the internal infrastructure can be refined to tell a comprehensive story for what is changing across that infrastructure in real time....

  
• 05.13.2020

  Grapl: Graph-Based Detection and Response with Colin O’Brien

  A large software company such as Dropbox is at a constant risk of security breaches. These security breaches can take the form of social engineering attacks, network breaches, and other malicious adversarial behavior. This behavior can be surfaced by analyzing...

  
• 05.12.2020

  Static Analysis for Infrastructure with Guy Eisenkot

  Infrastructure-as-code tools are used to define the architecture of software systems. Common infrastructure-as-code tools include Terraform and AWS CloudFormation.  When infrastructure is defined as code, we can use static analysis tools to analyze that code for configuration mistakes, just as...

  
• 04.20.2020

  Zoom Vulnerabilities with Patrick Wardle

  Zoom video chat has become an indispensable part of our lives. In a crowded market of video conferencing apps, Zoom managed to build a product that performs better than the competition, scaling with high quality to hundreds of meeting participants,...

  
• 01.29.2020

  Cloud Log Analysis with Jack Naglieri

  Large software companies have lots of users, and the activity from those users results in high volumes of traffic. These companies also have a large surface area across the enterprise.  There are hundreds of services and databases that are fulfilling...

  
• 12.16.2019

  Snyk: Open Source Security with Guy Podjarny

  The software supply chain includes cloud infrastructure, on-prem proprietary solutions, APIs, programming languages, networking products, and open source software.  Each of these software categories has its own security vulnerabilities, and each category has tools that can help protect a company...

  
• 05.02.2019

  Security Monitoring with Jeff Williams

  The modern software supply chain contains many different points of distribution: JavaScript frameworks, npm modules, Docker containers, open source repositories, cloud providers, on-prem firmware, IoT, networking proxies, and so much more. With so much attack surface, securing a large enterprise...

  
• 04.30.2019

  Container Platform Security with Maya Kaczorowski

  A Kubernetes instance occupies a wide footprint of multiple servers, creating an appealing target to an attacker, due to its access to a large pool of compute resources. A common attack against an exposed Kubernetes cluster is to take it...

  
• 03.26.2019

  Security Businesses with Steve Herrod

  Upcoming events: A Conversation with Haseeb Qureshi at Cloudflare on April 3, 2019 FindCollabs Hackathon at App Academy on April 6, 2019 Steve Herrod was the CTO at VMware and now works as a managing director at General Catalyst, where...

  
• 03.04.2019

  StarkWare: Transparent Computational Integrity with Eli Ben Sasson

  Computational integrity is a property that is required for financial transactions on the Internet. Computational integrity means that the output of a certain computation is correct. If I deposit money into my bank, my bank sends me a number that...

  
• 02.18.2019

  Policy Enforcement with Shimon Tolts

  The nature of software projects is changing. Projects are using a wider variety of cloud providers and SaaS tools. Projects are being broken up into more git repositories, and the code in those repositories are being deployed into small microservices....