DevelopSec: Developing Security Awareness

In this episode, James talks about what Username Enumeration is, how it can be used by attackers, and some ways to help reduce the risk of it. 

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.  Check out our 30 day advantage.

Send us Fan Mail

For more info go to https://www.developsec.com or follow us on X (@developsec).

The DevelopSec podcast is brought to you by Jardine Software Inc. 

Interesting question was raised around changing a password and the need to invalidate all the access tokens for the associated mobile devices.  James talks about his view on the topic and how you can analyze your situation to determine the appropriate direction. 

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.  Check out our 30 day advantage.

Send us Fan Mail

For more info go to https://www.developsec.com or follow us on X (@developsec).

The DevelopSec podcast is brought to you by Jardine Software Inc. 

Pokemon Go has taken the world by storm and as always, it brings up some things to talk about regarding security.  In this episode James talks about some out of the box security thoughts regarding mobile applications including app permissions, fake apps, and scams. 

**Link to James' interview on News4Jax talking about Pokemon Go Security Concerns  http://www.news4jax.com/news/morning-show/pokemon-go-security-concerns **

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.  Check out our 30 day advantage.

Send us Fan Mail

For more info go to https://www.developsec.com or follow us on X (@developsec).

The DevelopSec podcast is brought to you by Jardine Software Inc. 

A question came in regarding auto-unlock of accounts and account lockout in general.  James discusses his thoughts on this process and how he approaches these types of questions.

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.  Check out our 30 day advantage.

Send us Fan Mail

For more info go to https://www.developsec.com or follow us on X (@developsec).

The DevelopSec podcast is brought to you by Jardine Software Inc. 

A question came in around the need for the password confirm box on registration screens and the security implications.  In this episode I respond to the question and give some insights on how to approach these types of questions from a security perspective.

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.  Check out our 30 day advantage.

Send us Fan Mail

For more info go to https://www.developsec.com or follow us on X (@developsec).

The DevelopSec podcast is brought to you by Jardine Software Inc. 

We are too quick to just give generic recommendations for resolving security vulnerabilities.  We need to make sure that the application teams understand why these are vulnerabilities and why they are important.  It all starts with Why is that functionality there.  James talks about the importance of understanding the WHY and how it is a building block for better secure applications.

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.  Check out our 30 day advantage.

Send us Fan Mail

For more info go to https://www.developsec.com or follow us on X (@developsec).

The DevelopSec podcast is brought to you by Jardine Software Inc. 

When a developer was presented with a but they tried to say that it wasn't an issue because it was found by a tester using a Mac.  "We don't support Macs"   James talks about how this is a fundamental misunderstanding about security and tries to clear it up. 

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.  Check out our 30 day advantage.

Send us Fan Mail

For more info go to https://www.developsec.com or follow us on X (@developsec).

The DevelopSec podcast is brought to you by Jardine Software Inc. 

James reflects on the current way we expect application teams to get security training and potential short falls.  Is there a better way?  Listen as I talk through some different points on the topic. 

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.  Check out our 30 day advantage.

Send us Fan Mail

For more info go to https://www.developsec.com or follow us on X (@developsec).

The DevelopSec podcast is brought to you by Jardine Software Inc. 

How do you get your secure coding information?  Do you pull code snippets from the internet?  Who doesn't.  How many of those actually use secure coding best practices.  We have a challenge where most of our books, tutorials, and even college classes don't show secure code examples, just code examples.  Everywhere we turn, the code we see is insecure.  James Talks about this issue and some things you can do to help change that. 

In the episode, James makes reference to the IT Hot Topics Conference (https://www.eiseverywhere.com/ehome/index.php?eventid=155122&).  James will be presenting on Friday morning.  If you are in the area, this may be a great conference to check out.  See the link included for registration info.

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.  Check out our 30 day advantage.

Send us Fan Mail

For more info go to https://www.developsec.com or follow us on X (@developsec).

The DevelopSec podcast is brought to you by Jardine Software Inc. 

Do you use an application inventory in your application security program?  James discusses what an application inventory is and why it is important.  Here is a list of a few tools that can be used to help identify some application details:

• Consider using OWASP Dependency Check (https://www.owasp.org/index.php/OWASP_Dependency_Check)
• Retire.js will help identify out dated javascript libraries (http://retirejs.github.io/retire.js/) - This is also a burp extension

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.  Check out our 30 day advantage. 

Send us Fan Mail

For more info go to https://www.developsec.com or follow us on X (@developsec).

The DevelopSec podcast is brought to you by Jardine Software Inc.