Join us as we explore the evolving application security landscape with Marius Poskus, VP of Glow Financial Services and a seasoned cybersecurity professional. In this episode, we delve into the increasing adoption of open-source code and AI in startup development, examining the potential impacts on code security amid rapid innovation pressures. Marius shares his insights on the cultural shifts required for effective DevSecOps practices, the prolonged timelines for meaningful change, and the disruptions caused by changing CISOs. We also touch on the challenges of maintaining consistent application security programs in a dynamic leadership environment, the proliferation of tools, and the importance of measuring their effectiveness. Listen in as we unravel the complexities of managing application security within development environments.

Sponsored by Phoenix Security: This episode is brought to you by Phoenix Security, leaders in vulnerability management from code to cloud. Take control of your security with Phoenix and see firsthand how to prioritize and act on critical vulnerabilities with a free 14-day license available at Phoenix Security - Request a Demo.

We highlight the significance of providing contextual insight and effective communication to address security issues meaningfully. By prioritizing critical issues that offer the most significant risk reduction, we advocate for a strategic approach to security management. Marius also emphasizes understanding the root causes of vulnerabilities to enhance overall practices and mitigate future risks. Finally, we discuss translating risk into business language, emphasizing temporality and criticality to align security efforts with business priorities.

• 00:00 - Introduction: Francesco Cipollone introduces the podcast and guest, Marius Poskus, VP at Glow Financial Services.

• LinkedIn: Marius Poskus

With over a decade of cybersecurity experience, I am the Global Vice President and Chief Information Security Officer at Glow Financial Services Limited, a leading fintech company that offers innovative and customer-centric solutions. My mission is to build and execute a comprehensive cybersecurity strategy that aligns with the business goals and enterprise risk management of Glow, while ensuring compliance with ISO27001 and other relevant standards.

I lead a high-performing team of cybersecurity professionals who deliver cutting-edge solutions across various domains, such as cloud security, DevSecOps, AppSec, threat hunting, penetration testing, and red and purple teaming. I have successfully implemented a 24/7 Security Operations Centre, a cloud adoption model, and an AppSec program that enhance the security posture and resilience of Glow's global operations. I am also passionate about sharing my knowledge and insights on cybersecurity topics as a public speaker, a non-executive director, and a mentor.

• Website: Cyber Security and Cloud Podcast

#Cybersecurity #AppSec #ProductSecurity #ProdSec #ASPM

Join us for an in-depth discussion on the challenges and strategies of Application Security Program Management (ASPM) in today's fast-evolving tech landscape. Francesco Cipollone welcomes guest Akira Brand, a seasoned application security engineer and cybersecurity consultant, to explore practical insights into securing applications in the cloud and beyond. We also examine the shift in terminology from AppSec to product security and delve into Akira's unique background in opera singing, which empowers her to convey complex technical subjects with remarkable clarity. 

Sponsored by Phoenix Security: This episode is brought to you by Phoenix Security, leaders in vulnerability management from code to cloud. Take control of your security with Phoenix and see firsthand how to prioritize and act on critical vulnerabilities with a free 14-day license available at Phoenix Security - Request a Demo.

In this engaging session, curiosity takes center stage as a catalyst for teaching and learning within the tech world. I share my personal experiences and the joy found in the creative struggle of technical writing and documentation. Akira and I discuss the importance of a systematic approach, whether in threat modeling or honing educational techniques. We celebrate the power of curiosity-driven engagement and invite you to reflect on your learning processes. Wrapping up with a focus on threat modeling, we emphasize its significance in application security programs and the importance of business engagement in the risk assessment process. We debate the effectiveness of various motivational strategies, from incentives to potential legal implications for security professionals. As we close, we challenge you to incorporate threat modeling practices into your security measures and participate in our social media challenge. Stay vigilant and join us for a discussion that blends practical insights with forward-thinking perspectives in the ever-evolving landscape of cybersecurity.

What's Inside This Episode:

• 00:04 - Sponsor Message: Phoenix Security Limited

Sponsored by Phoenix Security: This episode is brought to you by Phoenix Security, leaders in vulnerability management from code to cloud. Take control of your security with Phoenix and see firsthand how to prioritize and act on critical vulnerabilities with a free 14-day license available at Phoenix Security - Request a Demo.

Don't Miss This Engaging Discussion on Cybersecurity Trends and Strategies: Tune into this enlightening episode to equip yourself with the knowledge and insights needed to navigate the ever-changing landscape of cybersecurity. Whether you're a professional in the field, a business leader, or just keen on enhancing your cybersecurity awareness, this episode is packed with valuable information to help you understand the nuances of securing applications and infrastructures in a digitally-driven world.

• CIS Security Controls

• LinkedIn: https://www.linkedin.com/in/akirabrand/ 

Cyber Security and Cloud Podcast hosted by Francesco Cipollone

• Twitter @FrankSEC42

• Website: http://www.cybercloudpodcast.com/

#Cybersecurity, #appsec #productsecurity #prodsec  #aspm

Listen in as we navigate the crucial role of threat modeling in the landscape of application security with our esteemed guest, Irene Michlin, the application security lead at Neo4j. Together, we peel back the layers of integrating a developer's insight into the security process and how it fortifies the software development lifecycle. Irene's journey from coding to consulting paints a vivid picture of the security challenges and triumphs faced in today's agile environments.

Sponsored by Phoenix Security: This episode is brought to you by Phoenix Security, leaders in vulnerability management from code to cloud. Take control of your security with Phoenix and see firsthand how to prioritize and act on critical vulnerabilities with a free 14-day license available at Phoenix Security - Request a Demo.

We also dissect the often misunderstood concept of security theater and the varying impact of regulatory demands across businesses of different scales, all while highlighting the need for a risk-based approach to vulnerability management. During our conversation, we touch upon the symbiotic relationship between threat modeling and agile development, sharing anecdotes that demystify the practice and affirm its teachable nature.

With Irene's rich background, we discuss how embedding security prompts into daily engineering tasks can make threat modeling more actionable, seamlessly blending it with development workflows. Our chat is a testament to the evolution of generational AI, where its jack-of-all-trades persona is on the cusp of becoming a specialized force with proper data training—showcasing the multifaceted potential of AI in cybersecurity and beyond.

Wrapping up the episode, we share our admiration for an innovative Neo4j blog post that elegantly combines general AI with knowledge graphs, a read we highly recommend to those intrigued by the intersection of technology and security. The discussion reaffirms the importance of balancing agility with thoroughness in threat modeling to ensure robust cybersecurity postures.

As we conclude, we remind our listeners of the power of staying informed and proactive in the digital age, inviting them to engage with our community through our social media giveaway and to stay tuned for more insights on navigating the ever-evolving world of cybersecurity.

What's Inside This Episode:

• 00:01 - Introduction: Francesco Cipollone introduces the podcast and guest, Irene Michlin, application security lead at Neo4j.

• Connect with Irene Michlin: LinkedIn | Twitter (Legacy: X)

Cyber Security and Cloud Podcast hosted by Francesco Cipollone

• Twitter @FrankSEC42

• Website: http://www.cybercloudpodcast.com/

#Cybersecurity, #appsec #productsecurity #prodsec  #aspm

This episode features guest Izar Tarandach, a seasoned security architect with extensive experience in application security, cloud security, and the development of comprehensive security frameworks. Our discussion navigates through the latest trends in application security, the pivotal role of DevSecOps, and the strategic integration of security practices within modern business environments.

Sponsored by Phoenix Security: This episode is brought to you by Phoenix Security, leaders in vulnerability management from code to cloud. Take control of your security with Phoenix and see firsthand how to prioritize and act on critical vulnerabilities with a free 14-day license available at Phoenix Security - Request a Demo.

As our conversation progresses, we turn our focus to the critical issue of third-party risk in software development. Aizhar and I examine how high-profile cases have shone a light on the vulnerabilities in the software supply chain and the urgent need for developers to embrace secure coding practices. We discuss the shift toward a security-centric development culture and the importance of establishing business-driven security objectives and realistic service level agreements.

Tune in to hear our insights on how the industry is moving beyond the quest for a silver bullet in security tools to a more robust approach that ingrains security into the core responsibilities of developers. In our final chapter, Aizhar and I tackle the delicate balance between ethics, regulation, and business imperatives in cybersecurity. We delve into how regulations can drive security priorities, the risk of a false sense of security, and the vital role of threat modeling in the software development lifecycle. Our discussion highlights the need for a holistic approach that merges the foresight provided by threat modeling with adherence to regulations, fostering a security-conscious culture across all industries. Don't miss this engaging episode where we dissect the evolution of threat modeling and its integral role in protecting our digital world.

What's Inside This Episode:

• 00:02 - Introduction to Cybersecurity and Cloud Podcast: Francesco introduces the series and outlines what listeners can expect from this enlightening episode.

Sponsored by Phoenix Security: This episode is brought to you by Phoenix Security, leaders in vulnerability management from code to cloud. Take control of your security with Phoenix and see firsthand how to prioritize and act on critical vulnerabilities with a free 14-day license available at Phoenix Security - Request a Demo.

Don't Miss This Engaging Discussion on Cybersecurity Trends and Strategies: Tune into this enlightening episode to equip yourself with the knowledge and insights needed to navigate the ever-changing landscape of cybersecurity. Whether you're a professional in the field, a business leader, or just keen on enhancing your cybersecurity awareness, this episode is packed with valuable information to help you understand the nuances of securing applications and infrastructures in a digitally-driven world.

Izar Tarandach

• Linkedin: https://www.linkedin.com/in/izartarandach/ 

Cyber Security and Cloud Podcast hosted by Francesco Cipollone

• Twitter @FrankSEC42

• Social Media Links 
  

#Cybersecurity, #appsec #productsecurity #prodsec  #aspm

A dev perspective on application security:

Dive deep into the pivotal nexus of cybersecurity, application security, and software development in our latest podcast episode featuring Josh Goldberg, a renowned figure in the TypeScript ecosystem. This episode sheds light on the evolving realm of secure coding practices, acknowledging the progress achieved while recognizing the challenges that lie ahead. Join us as we unravel the nuanced role of artificial intelligence in software development, moving beyond the hype to establish grounded expectations for this sophisticated tool.

The episode is brought to you by Phoenix Security; get in control of your vulnerabilities from code to cloud with the power of Phoenix. ACT Now on the most important vulnerabilities and reduce your exposure to modern attacks. See it for yourself. Go to https://phoenix.security/request-a-demo/ for a free 14-day licence.

Our discussion ventures into the dynamic landscape of the tech job market, sparking a thought-provoking debate on the value of junior versus senior developers in building a resilient digital future. We also underscore the critical role of checklists in enhancing product development, inspired by insights from "The Checklist Manifesto." By integrating accessibility audits and security consultations, we reveal how checklists can transform development processes, ensuring products are secure and accessible from the start.

The conversation extends to the cutting-edge application of AI in threat modeling, highlighting the importance of strategic objectives that place security and accessibility at the forefront. We further explore the essential art of communication within organizations and its pivotal role in seamless security integration. This dialogue emphasizes the significance of leadership in cultivating an environment where trust and verification coalesce, promoting a culture of thorough security checks and balances.

As we dissect the concept of Service Level Agreements (SLAs), our discussion illuminates their dual function as both security mechanisms and corporate assurances, advocating for the early adoption of security measures in business strategies. Experience firsthand how security features, like multi-factor authentication, can serve not just as protective measures but as compelling marketing and product differentiators.

Don't miss this enriching conversation that bridges the gap between cybersecurity practices and software development, offering invaluable insights for professionals navigating the intricate landscape of tech innovation.

Tune in to this enlightening episode to equip yourself with the knowledge and insights needed to navigate the evolving landscape of cybersecurity.

• 00:02: Introduction and sponsorship message from Phoenix Security Limited.

Josh Goldberg

Hi, I’m Josh! I’m an independent full time open source developer. I work on projects in the TypeScript ecosystem, most notably typescript-eslint: the tooling that enables ESLint and Prettier to run on TypeScript code. I’m also the author of the O’Reilly Learning TypeScript book, a Microsoft MVP for developer technologies, and an active conference speaker. My personal projects range from static analysis to meta-languages to recreating retro games in the browser. Also cats.

Connect with Josh [bsky / GitHub / Mastodon / Twitter / Twitch / www]

• Cyber Security and Cloud Podcast hosted by Francesco Cipollone

• Social Media Links 
  

#Cybersecurity, #appsec #productsecurity #prodsec  #aspm

What does it take to get into application security from pentesting? Will AI replace the role of product security? How do you start an application security program and write a book about it? 

Join us on the Cybersecurity and Cloud Podcast as we welcome the insightful Raj Umadas, head of InfoSec at Ackblue, for a vibrant discussion on the varied pathways into the field of application security. Listen in as Raj shares his unique journey from networking to the realms of software and hardware design, ultimately leading to his passion for security. We debate whether a background in pentesting is a must for app sec success or if one can climb the ranks from the blue team, all while emphasizing the significance of team diversity over homogeneity.

The episode is brought to you by Phoenix Security; get in control of your vulnerabilities from code to cloud with the power of Phoenix. ACT Now on the most important vulnerabilities and reduce your exposure to modern attacks. See it for yourself. Go to https://phoenix.security/request-a-demo/ for a free 14-day licence.

Tune in to this enlightening episode to equip yourself with the knowledge and insights needed to navigate the evolving landscape of cybersecurity.

• 00:02: Introduction and sponsorship message from Phoenix Security Limited.

Raj Umadas

• Linkedin: https://www.linkedin.com/in/rajumadas/ 

• Cyber Security and Cloud Podcast hosted by Francesco Cipollone

• Social Media Links 
  

#Cybersecurity, #appsec #productsecurity #prodsec  #aspm

Will AI replace the role of product security? How do you start an application security program and write a book about it? One of the best Application Security mind Derek Fisher is with us today.

Join us on a captivating journey as Derek, a mastermind in product security and a prolific author, shares his expertise on setting up a fortified application security program. We start by unraveling the critical first steps, emphasizing the value of understanding your organization's current cybersecurity landscape and the unique risks it faces. Listen in as we discuss the significance of collaboration between security and engineering teams to pinpoint vulnerabilities and fortify our digital defenses.

The episode is brought to you by Phoenix Security; get in control of your vulnerabilities from code to cloud with the power of Phoenix. ACT Now on the most important vulnerabilities and reduce your exposure to modern attacks. See it for yourself. Go to https://phoenix.security/request-a-demo/ for a free 14-day licence.

Tune in to this enlightening episode to equip yourself with the knowledge and insights needed to navigate the evolving landscape of cybersecurity.

• 00:02: Introduction to Cybersecurity and Cloud Podcast

Derek Fisher

• Linkedin: https://www.linkedin.com/in/derek-fisher-sec-arch/ 

• Cyber Security and Cloud Podcast hosted by Francesco Cipollone

• Social Media Links 
  

#Cybersecurity, #appsec #productsecurity #prodsec  

Will AI replace the role of product security? This is an enlightening conversation with David Matousek exploring the intersection between automation and product security in application security.

The episode is brought to you by Phoenix Security; get in control of your vulnerabilities from code to cloud with the power of Phoenix. ACT Now on the most important vulnerabilities and reduce your exposure to modern attacks. See it for yourself. Go to https://phoenix.security/request-a-demo/ for a free 14-day licence.

Tune in to this enlightening episode to equip yourself with the knowledge and insights needed to navigate the evolving landscape of cybersecurity.

• 00:02: Introduction to Cybersecurity and Cloud Podcast

David Matousek

• Linkedin: https://www.linkedin.com/in/davidmatousek/

• Cyber Security and Cloud Podcast hosted by Francesco Cipollone

• Social Media Links 
  

#Cybersecurity, #appsec #productsecurity #prodsec  

This is an enlightening conversation with Michael Smith exploring the intersection between vulnerabilities, DDoS and WAF technologies. 

The episode is brought to you by Phoenix Security; get in control of your vulnerabilities from code to cloud with the power of Phoenix. ACT Now on the most important vulnerabilities and reduce your exposure to modern attacks. See it for yourself. Go to https://phoenix.security/request-a-demo/ for a free 14-day licence.

Tune in to this enlightening episode to equip yourself with the knowledge and insights needed to navigate the evolving landscape of cybersecurity.

• 00:02: Introduction to Cybersecurity and Cloud Podcast

• Micahel Smith

• Cyber Security and Cloud Podcast hosted by Francesco Cipollone

• Social Media Links 
  

#Cybersecurity, #appsec #waf 

This is an enlighting conversation with Jay Jacobs  - Exploring the Future of Vulnerability Management and Data Science

Unlock the secrets of cybersecurity's intricate dance with data science as I, Francesco Cipollone, sit down with tech wizard J Jacobs, co-founder of Cyanthia. Prepare to be captivated by J's inspiring tech odyssey, from his youthful fascination with computing to his trailblazing efforts in quantifying cyber risk. We navigate his professional voyage, spanning IT, pen testing and cryptography, revealing how his deep dive into data science has revolutionized our approach to cyber threats. J also imparts his wisdom on the crucial role of statistics and key management in cryptography, offering priceless insights for anyone invested in fortifying their digital defenses.

The episode is brought to you by Phoenix Security; get in control of your vulnerabilities from code to cloud with the power of Phoenix. ACT Now on the most important vulnerabilities and reduce your exposure to modern attacks. See it for yourself. Go to https://phoenix.security/request-a-demo/ for a free 14-day licence.

The journey of vulnerability assessment tools takes center stage as I recount the sophisticated evolution of the Exploit Prediction Scoring System (EPSS). From its humble beginnings as a logistic regression to becoming a powerful API, EPSS serves as a beacon for security professionals looking to quantify the once nebulous concept of risk. The discussion illuminates the delicate dance between utility and data privacy, the quest for a universal risk score, and the aspirational future of EPSS, incorporating additional variables to refine its predictive precision. Finally, J and I tackle the real-world implications of vulnerability management through the lens of EPSS.

We dissect the interplay between EPSS scores and CVSS ratings, using the Log4Shell incident to emphasize the critical need for broader threat intelligence. By acknowledging the system's limitations and the nuances within open-source vulnerability analysis, we champion the importance of narrative in data interpretation. With a call to action, we invite the cybersecurity community to join forces, enhancing our collective defense through dialogue and open-source innovation.

Tune in to this enlightening episode to equip yourself with the knowledge and insights needed to navigate the evolving landscape of cybersecurity.

• Jay Jacobs

• Cyber Security and Cloud Podcast hosted by Francesco Cipollone

• Social Media Links 
  

#Cybersecurity, #ai, #cloud, #appsec