Will Ratner is a software security professional with extensive experience building and implementing security solutions across a myriad of industries including banking, media, construction, and information technology. In his current role at Atlassian, Will focuses on improving the vulnerability management process by building highly scalable and automated solutions for the enterprise. Will joins us to discuss a centralized approach he built for container scanning. We explore the challenges and lessons learned, building a scalable, enterprise-grade solution, and how to build something that developers will see value in. We hope you enjoy this conversation with... We also introduce the idea of container scanning and building secure images that are then used to generate containers.

Connect with Will Ratner:
→ Atlassian
→ Docker

Mentioned in this episode:
→ Atlassian
→ Docker
→ Kubernetes
→ Snyk
→ Go
→ Slack

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Will Ratner: Centralized container scanning
01:31 Yeah, and as we do that, let's turn over to Will
04:38 Very cool. And so again, we were talking about container scanning
06:59 Yeah, I love— I love that we're talking about something that's
10:12 If only everyone would start from scratch with their base image
14:53 Everything in your— is this— yeah, this whole thing is open
20:31 Yeah, that's, yeah, that's interesting. It's just, it's a, it's a
22:57 Was the, what was the amount of time, Will
29:45 So yeah, we talked a lot about tickets in this perspective
32:30 You've mentioned vulnerability funnel a couple of times, and I have
34:42 You've got great metrics, I'm guessing, coming out of that because
37:55 Will, what kind of resources would you recommend
41:12 Yeah, definitely. So, Will, thank you so much for sharing this

Neil Matatall is an engineer with a background in security. He has previously worked at GitHub and Twitter and is a co-founder of Loco Moco Product Security Conference. Neil joins us for his second visit, to discuss account security at scale. He describes the underlying principles behind security at scale, how he worked to build a sign-in analysis feature, and how attacks were detected. We ended the conversation with an authentication lightning round, with Neil responding to various statements about authentication off the cuff! We hope you enjoy this episode with Neil Matatall. He's previously worked at GitHub and Twitter and is a co-founder of the LocoMoco Product Security Conference.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Neil Matatall is an engineer with a background in security.
→ Learn more about Security Journey

Connect with Neil Matatall:
→ Loco Moco Product Security Conference
→ Have I Been Pwned

Mentioned in this episode:
→ Loco Moco Product Security Conference
→ Have I Been Pwned

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Neil Matatall: AppSec at Scale
05:46 Any kind of other thoughts on that from that perspective about
07:28 Something like, well, I was going to borrow it and use
10:19 You've sort of, I think, spoken to this in terms of
13:13 Did you build this sign-in analysis piece
20:14 The thing I love that you're bringing out in this conversation
24:57 Do I need to change it now
27:20 You've talked about quite a few ways of detecting the different
30:18 Using the API example, let's play this one out a little
34:32 No, that's neat that GitHub detects that as they come in

Joern Freydank is a Lead Cyber Security Engineer with more than 20 years of experience. He is currently establishing the Threat Modeling Program at a major insurance company. Joern joins us to talk about security design anti-patterns. He defines the term, explains security debt, reviews the categories of anti-patterns, and walks us through the example of a common role misconception. We hope you enjoy this conversation with... Joern Freydank is a lead cybersecurity engineer with more than 20 years of experience. He's currently establishing the threat modeling program at a major insurance company. You're about to listen to AppSec Podcast. When you're done with this, be sure to check out our other show, High Five.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Joern Freydank is a lead cybersecurity engineer with more than 20 years of experience.
→ Learn more about Security Journey

Connect with Joern Freydank:
→ Security Design Anti-Patterns -- Creating Awareness to Limit Security Debt (YouTube talk)
→ Stack Overflow

Mentioned in this episode:
→ Security Design Anti-Patterns -- Creating Awareness to Limit Security Debt (YouTube talk)
→ Stack Overflow

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Joern Freydank: Security Design Anti Patterns Limit Security Debt
03:04 You came to security from more of the breaking perspective
04:37 One of our topics that we're going to be talking about
07:19 It's missing pieces versus bad architectural decisions that are being laid
10:53 That's one of the things that, you know, I think about
13:11 Yeah. And I was thinking a similar, the trade-off with also
17:58 Talking about roles, we mentioned roles. There's a malicious insider admin
20:15 Yeah. And you think about the couple of examples you shared
21:49 Yeah, occasionally. Certainly. I mean, like you said, mostly from the
25:04 What's the corresponding pattern, essentially
27:13 As we start to kind of bring this conversation towards a
31:04 There's an awareness— I mean, there's an awareness play in that

Ken Toler is a principal consultant at Kudelski Security and is passionate about building and optimizing application security programs that stick through strong adoption and ease of use. Ken has spent considerable time on all sides of the security aisle from playing defense and managing security teams to offense by breaking applications and reviewing code. Ken is also the host and creator of the Relating to DevSecOps podcast that focuses on forging strong relationships between engineers, operations, and security through collaboration, understanding, skill-sharing, and healthy debate. Ken joins us to talk all things Blockchain and AppSec. We define Blockchain, discuss the connections between cloud, appsec, and blockchain, common architecture failures, pen testing, and even dive into smart contracts.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Ken Toler is a principal consultant at Katelski Security and is passionate about building and optimizing AppSec programs that stick through strong adoption and ease of use.
→ Learn more about Security Journey

Connect with Ken Toler:
→ Secureum Videos
→ The Rust Programming Language

Mentioned in this episode:
→ Secureum Videos
→ The Rust Programming Language
→ Blockchain Security @ Kudelski
→ Blockchain Security A Need For Todays Businesses Complete Guide For Beginners
→ Rust

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Ken Toler: Blockchain, Cloud, and AppSec
02:06 It was a place in Texas. And Ken and I happened
05:00 It's a term that we heard. I mean, certainly in the
06:31 At the end of the day, It's an immutable ledger of
12:05 That's helpful because I hadn't really thought of it. I guess
15:20 Yeah, that's, that's very helpful. And before we transition into thinking
18:53 Yeah. To draw a parallel from my AppSec history and experience
21:59 They can decide who they want to go after first. It's
24:45 I want to get into what kinds of surprising mistakes you've
26:52 Yeah, definitely a different set of skills than our classic, you
29:05 Can you pen test a blockchain
32:13 Smart contracts and secure coding, how these things fit together. When
34:14 Yeah, I think that's a good definition that takes away from
36:42 We have a smart contract that is written onto a blockchain
38:58 You look at the code
42:53 Yeah. Very cool. So what would be your key takeaway then

Secrets management fails in surprisingly ordinary ways: credentials land in code, deployment files, containers, and cloud resources, then quietly become part of the system’s attack surface. Jeroen Willemsen and Ben de Haan join Chris and Robert to introduce OWASP WrongSecrets, an intentionally vulnerable application built to teach those failure modes. They explain how the project grew from incident-response experience, why cloud services change the threat model, and how teams can reason about blast radius and maturity. The conversation closes with practical guidance for scaling secrets management across an organization and using hands-on challenges to turn abstract advice into memorable engineering lessons.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Jeroen Willemsen and Ben de Haan:
→ Jeroen Willemsen on LinkedIn
→ OWASP WrongSecrets

Mentioned in this episode:
→ OWASP WrongSecrets
→ WrongSecrets on GitHub
→ Secrets management deployment guidance
→ Terraform
→ Docker
→ Kubernetes

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 The dirty little secrets in software delivery
02:00 How incident response shaped the project
05:51 Introducing OWASP WrongSecrets
08:46 Why secrets management keeps failing
11:22 Cloud storage and common mistakes
16:33 Maturity, threat models, and blast radius
19:23 Turning real failures into challenges
23:03 Secrets hidden in containers and deployment files
27:36 Advice for security and engineering teams
30:02 Scaling secrets management
31:54 Written guidance and project resources
33:39 Final takeaways

Adam is a leading expert on threat modeling, and a consultant, expert witness, author and game designer. He has decades of experience delivering security. His experience ranges across the business world from founding startups to nearly a decade at Microsoft. While not consulting or training, Shostack serves as an advisor to a variety of companies and academic institutions. Adam joins us to talk about fast, cheap, and good threat models. We discuss how Adam defines these categories, the weight of threat modeling, questionnaires/requirements, expertise, and how to make threat modeling conversational. We hope you enjoy this conversation with... Adam Shostack. You're about to listen to AppSec Podcast.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Adam Shostack is a leading expert on threat modeling and a consultant, expert witness, author, and game designer.
→ Learn more about Security Journey

Connect with Adam Shostack:
→ Shostack + Associates
→ Adam Shostack

Mentioned in this episode:
→ Shostack + Associates
→ Adam Shostack
→ Gary McGraw
→ OWASP Application Security Verification Standard (ASVS)
→ ATT&CK
→ MITRE ATT&CK Framework
→ Cyber Kill Chain (Lockheed Martin)

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Adam Shostack: Fast, cheap and good threat models
03:15 Yeah, I want to unpack these 3 words a little bit
04:47 You're thinking cheap, are you thinking from a resources and time
07:38 We keep talking about and using that term heavyweight. Is threat
09:17 Yeah, one of the things that I've said since I first
12:24 Yeah, I'm tracking with you now as well about the fact
15:11 You mean the 3 questions that are being asked
20:48 Oh, and I was thinking similar. I always think about requirements
22:48 That— have you ever looked at like the ATT&CK methodology, for
24:21 That makes sense. But let's talk about what do you need
27:07 To kind of bring all these things together, Adam, we, all
29:34 What's the call to action then that you would offer to

Ochaun Marshall is an Application Security Consultant. In his roles of secure ideas, he works on on-going development projects utilizing Amazon web services and breaks other people's web applications. Ochaun joins us to talk about SAST and IaC, static application security testing and infrastructure as code. We talk about what they are, how they work, the security benefits, some of the tools that make them possible, and we finish our conversation talking about developer empathy and why Ochaun has developer empathy as a result of some of the experiences that he has as a developer and as a security person. We hope that you enjoy this episode with...

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Loren Kohnfelder has over 20 years of experience in the security industry.
→ Learn more about Security Journey

Connect with Loren Kohnfelder:
→ Designing Secure Software
→ Ron Rivest

Mentioned in this episode:
→ Designing Secure Software
→ Ron Rivest
→ Robert Hurlbut

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Loren Kohnfelder: Designing Secure Software
01:46 For our listeners, we always start with our guest's security origin
07:29 I first started at Cisco learning about threat modeling and trying
09:17 As I was taking a look at the book and I
17:20 As I was reading through the book and looking at the
20:13 We do a good enough job to deal with this
26:26 So as we're coming towards the kind of the conclusion of
28:57 Yeah, we definitely agree with you on that. Like, we wanna

Infrastructure as code gives security teams something they have wanted for years: a readable description of the systems surrounding an application. Ochaun Marshall, a developer and application security consultant, explains how that visibility complements static analysis and penetration testing. He discusses where SAST belongs in development, what configuration files can reveal about cloud resources, and why deployed infrastructure still needs monitoring. The conversation covers Terraform, AWS development tools, open-source scanners, and using source access to make a penetration test more productive. Ochaun and Chris then connect those technical practices to developer empathy, explaining why overwhelming engineers with findings undermines trust and how a smaller, carefully tuned set of checks can make security genuinely useful.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Ochaun Marshall:
→ Ochaun Marshall on LinkedIn

Mentioned in this episode:
→ Semgrep
→ Bandit
→ Terraform

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Infrastructure as code and SAST with Ochaun Marshall
02:35 Returning to cloud application security
06:32 Where SAST fits in development
07:15 Scanning applications and their infrastructure
09:53 Configuration files versus deployed assets
12:19 Rebuilding infrastructure instead of changing it manually
14:23 Infrastructure programming with the AWS CDK
17:19 Using SAST during a penetration test
20:26 Open-source tools in the testing toolkit
25:06 The security benefits of infrastructure visibility
26:55 Tagging resources and monitoring changes
29:06 Developer empathy under delivery pressure
32:14 Introducing security checks without overwhelming developers

Simon Bennetts is the OWASP Zed Attack Proxy (ZAP) Project Leader and a Distinguished Engineer at StackHawk, a company that uses ZAP to help users fix application security bugs before they hit production. He has talked about and demonstrated ZAP at conferences all over the world. Prior to making a move into security, he was a developer for 25 years and strongly believes that you cannot build secure web applications without knowing how to attack them. He's talked about and demonstrated ZAP at conferences all over the world. Prior to making the move into security, he was a developer for 25 years and strongly believes that you cannot build secure web applications without knowing how to attack them.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Simon Bennetts is the OWASP Zed Attack Proxy, or ZAP, project leader and a distinguished engineer at StackHawk, a company that uses ZAP to help users fix application security bugs before they hit production.
→ Learn more about Security Journey

Connect with Simon Bennetts:
→ OWASP ZAP
→ StackHawk

Mentioned in this episode:
→ OWASP ZAP
→ StackHawk
→ ZAP Heads Up Display (HUD)
→ Burp Suite
→ OWASP Juice Shop
→ OWASP Juice Shop
→ OWASP Web Security Testing Guide (WSTG)
→ OWASP Triangle Chapter
→ Docker

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Simon Bennetts: Using OWASP Zap across an Enterprise
04:20 We think about the things that ZAP is looking for, is
10:10 One of the things that is a new feature since the
14:59 Were not OWASP people, were not security people, and we've set
20:43 One of the other, you know, when I think about the
24:14 I've always been so impressed with what OWASP projects such as
29:10 I use this, when I integrate Zap into my pipeline, then
31:41 This, this was one of those questions where, like, this is
36:54 People are using this in the enterprise would be really powerful

Timo Pagel has been in the IT industry for over fifteen years. After a system administrator and web developer career, he advises customers as a DevSecOps consultant and trainer. His focus is on security test automation for software and infrastructure and assessment of complex applications in the cloud. In his spare time, he teaches “Web and Application Security” at various universities. Timo joins us to talk about the OWASP DevSecOps Maturity Model or DSOMM. We explore maturity models, this specific one, how you can use it, and how to get started. We hope you enjoy this conversation with... After a career as a system administrator and web developer, he advises customers as a DevSecOps consultant and trainer.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Timo Pagel has been in the IT industry for over 15 years.
→ Learn more about Security Journey

Connect with Timo Pagel:
→ OWASP DevSecOps Maturity Model (DSOMM)
→ OWASP SAMM

Mentioned in this episode:
→ OWASP DevSecOps Maturity Model (DSOMM)
→ OWASP SAMM
→ BSIMM
→ OWASP Application Security Verification Standard (ASVS)

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Timo Pagel: DevSecOps Maturity Model
03:23 I'm curious now, what was it that this mentor/professor, what did
07:37 We think about DevSecOps maturity model, here's one way that I
08:45 Timo, what is your recommendation for how someone can use the
12:03 For your specific levels then, can you walk us through the
15:48 Yeah. Let me trace through one with you just because I
17:45 Yeah, no problem. So thinking about DSOM and how it works
25:48 Yeah. Makes sense. So let me give you a scenario here
29:25 That's awesome. Yeah. And I'm sure you're making that— that's for