Mazin Ahmed is a security engineer that specializes in AppSec and offensive security. He is passionate about information security and has previously found vulnerabilities in Facebook, Twitter, Linkedin, and Oracle, to name a few. Mazin is the developer of several popular open-source security tools that have been integrated into security testing frameworks and distributions. Mazin also built FullHunt. io, the next-generation continuous attack surface security platform. He is also passionate about cloud security, where he has been running dozens of experiments in the cloud security world. Mazin joins us to introduce Infrastructure as Code and TerraForm and discuss the security benefits IaC brings to our cloud environments.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Mazin Ahmed is a security engineer that specializes in AppSec and offensive security.
→ Learn more about Security Journey

Connect with Mazin Ahmed:
→ Terraform
→ FullHunt.io

Mentioned in this episode:
→ Terraform
→ FullHunt.io
→ Terraform
→ Bugcrowd

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Mazin Ahmed: Terraform Security
03:25 Were you doing bug bounties while you were in high school
05:31 Curious, Mason, that you have mentioned pen tests and working on
07:50 Just a follow-up question. When you said that, you know, more
09:22 You think cloud security issues, I'm curious as a pentester, What
14:46 We call it infrastructure as code, but is it better to
16:49 Very cool. What are the security benefits of IaC
20:02 Got to do step 75. And so, when I think about
23:38 Are the attack vectors on Terraform environments then
27:17 As an attacker then, if you can get into the infrastructure
30:00 That's helpful to understand how, you know, what IaC is, security

Why do application security programs stall even after teams buy tools and define processes? James Ransome and Brook S. E. Schoenfield join Chris and Robert to discuss their book Building in Security at Agile Speed and the organizational work behind sustainable software security. They explain why practitioners need enough technical fluency to collaborate with developers, how leaders can recognize when a program is becoming self-sufficient, and which behaviors reveal that security has spread beyond a central team. The conversation returns repeatedly to people, trust, incentives, and measurement. It closes by challenging assumptions about penetration testing and showing how continuous delivery requires security practices that evolve with the development system rather than sit outside it.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with James Ransome and Brook S. E. Schoenfield:
→ James Ransome on LinkedIn
→ Brook Schoenfield on LinkedIn

Mentioned in this episode:
→ Building in Security at Agile Speed
→ Core Software Security

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Building security at agile speed
02:49 James Ransome’s security origin story
05:11 The book and the problem it addresses
08:08 Why this book and why now
15:59 Technical fluency for security leaders
21:36 When a security program becomes self-sufficient
24:48 Organic adoption and signs of maturity
30:36 Behaviors leaders can measure
34:19 People, process, and tools
37:07 Building trust across the organization
46:58 Penetration testing in continuous delivery
50:12 Final lessons from the authors

Chris and Robert conduct a practitioner peer review of the 2021 OWASP Top 10, examining what changed, what moved, and what the new structure communicates to development teams. They compare the list with the 2017 edition, discuss the broader treatment of injection, and unpack additions such as insecure design, software and data integrity failures, and server-side request forgery. The review also questions how categories map to real weaknesses, CVEs, and verification practices. Along the way, they connect the Top 10 to ASVS, threat modeling, dependency analysis, and the difficult balance between a widely recognized awareness document and actionable engineering guidance.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with OWASP:
→ OWASP Top 10
→ OWASP Foundation

Mentioned in this episode:
→ OWASP Top 10:2021
→ OWASP ASVS
→ Threat Modeling Manifesto
→ OWASP Dependency-Check
→ CycloneDX

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Peer reviewing the OWASP Top 10:2021
03:00 Broken access control moves to number one
04:52 Injection and cross-site scripting are consolidated
07:46 Vulnerable and outdated components
10:50 Software and data integrity failures
12:42 Server-side request forgery joins the list
15:00 Does the new structure help practitioners?
18:00 Security logging and monitoring
20:00 Mapping categories to weaknesses and CVEs
21:52 Connecting the Top 10 to verification practices
27:00 Final observations

Adding encryption is easy; designing a system that protects keys, metadata, and users is much harder. Anastasiia Voitova joins Chris and Robert to explain end-to-end encryption as a system property rather than a single cryptographic feature. She examines what encryption does and does not protect, how modern web and mobile architectures complicate trust boundaries, and why cloud storage creates difficult key-management choices. The discussion covers performance, recovery, usability, and the gap between marketing claims and honest threat models. Anastasiia closes with practical advice for product and security teams deciding whether end-to-end encryption fits their system and how to communicate its tradeoffs clearly.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Anastasiia Voitova:
→ Anastasiia Voitova on LinkedIn
→ Cossack Labs

Mentioned in this episode:
→ Cossack Labs

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Encryption is easy; key management is hard
02:44 Defining end-to-end encryption
06:28 What end-to-end encryption protects
09:15 Modern web and mobile trust boundaries
12:36 Cloud storage and key-management choices
14:00 The downsides of stronger encryption
16:38 Performance and operational costs
19:01 Usability and honest encryption claims
23:18 Can users trust messaging applications?
27:00 Choosing the right security tradeoffs
30:38 A call to action for product teams

Mark Loveless - aka Simple Nomad - is a security researcher and hacker. He's spoken at numerous security and hacker conferences worldwide, including Blackhat, DEF CON, ShmooCon, and RSA. He's been quoted in the press including CNN, Washington Post, and the New York Times. Mark joins us to discuss his series of blog posts on Threat Modeling at GitLab. We discuss his philosophical approach, framework choice (spoiler alert, it's a pared-down version of PASTA), and success stories / best practices he's seen for threat modeling success. We hope you enjoy this conversation with... Aaron Kinsbruner is the Chief Evangelist and Senior Director at Perforce Software.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Aaron Kinsbruner is the Chief Evangelist and Senior Director at Perforce Software.
→ Learn more about Security Journey

Connect with Eran Kinsbruner:
→ Perforce Software
→ Jenkins

Mentioned in this episode:
→ Perforce Software
→ Jenkins
→ Alyssa Miller

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Eran Kinsbruner: DevSecOps Continuous Testing
03:00 Okay. So in your time focusing on DevOps and DevSecOps before
04:46 As we get into testing or talk about testing, before we
07:19 One of the, one of the comments, or one of the
16:30 As I'm listening to the way you're describing quality gates and
21:19 Eran, you mentioned the word quality. a few times. And, you
24:37 I got a follow-up question related to quality. And so this
27:04 I think we're both on board with the idea that quality
31:26 Yeah, definitely. And I think you covered people in the last
33:01 Definitely. Eran, it's been great to talk to you today. I

Threat modeling needs to fit the way developers work if it is going to survive a fast delivery cycle. Mark Loveless, also known as Simple Nomad, explains how GitLab adapted its approach for an asynchronous DevSecOps environment. He describes moving ownership toward the people building a project, introducing lightweight checkpoints, and making the process useful beyond engineering. The discussion explores a simplified version of PASTA, ordinary language instead of security jargon, and documentation that lives in familiar tools. Mark shares adoption tactics and examples of teams identifying risks for themselves. Throughout, he argues that security specialists should provide a usable framework and practical support while helping everyone develop the habit of asking what could go wrong.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Mark Loveless:
→ Mark Loveless’s website

Mentioned in this episode:
→ Mark’s GitLab threat modeling article
→ PASTA threat modeling
→ Mermaid diagrams

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Threat modeling at GitLab with Mark Loveless
01:44 Mark’s security origin story
05:04 The GitLab threat modeling article series
06:11 Adapting threat modeling to DevSecOps
08:58 Starting threat modeling without disrupting flow
10:33 Where modeling fits in developer workflows
13:09 Extending threat modeling beyond engineering
14:56 Encouraging teams to participate
19:03 Choosing and simplifying PASTA
23:19 Using plain language instead of jargon
25:12 Writing models with familiar tools
26:55 Adoption stories and signs of success
33:18 Key takeaways and getting started

Jeroen Willemsen is a Principal Security Architect at Xebia. Jeroen is more or less a jack of all trades with an interest in infrastructure security, risk management, and application security. With a love for mobile security, he enjoys sharing knowledge on various security topics. Jeroen joins us to unpack security automation in a DevOps world. We discuss categories of tools, typical quick wins, potential downsides, and how dependency management specifically plays into automation. We hope you enjoy this conversation with... We hope you enjoyed this conversation with Jeroen Willemsen. Are you trying to build a security champions program? Everyone is these days. One challenge of rolling out security champions is how do we educate all these new folks?

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Jeroen Willemsen is a Principal Security Architect at Zebia.
→ Learn more about Security Journey

Connect with Jeroen Willemsen:
→ Xebia
→ OWASP Dependency-Check

Mentioned in this episode:
→ Xebia
→ OWASP Dependency-Check

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Jeroen Willemsen: Security automation with ci/cd
02:21 We'll stay with your original name. No problem there. So we
04:54 Just diving in here, one of the things I think we're
07:35 Between SAST, DAST, SCA. You didn't even mention like IAST and
10:20 That's probably— they're probably stuck on that level of— and so
13:10 Yeah. And in the danger of creating a monster fight on
15:29 Like, yeah, yeah, too far back to even remember. Well, I
17:39 You mentioned one. I had heard most of the ones that
19:22 Let's flip the table a little bit now. So, we've talked
22:16 Yeah, I see that. You know, when you're talking about false
25:27 I have a whole talk on that exact topic on developers
27:14 I'm going to do something different here for the conclusion of
29:35 Yeah. All right, you heard our key takeaways, so now it's

Software security has spent decades alternating between prevention, detection, and response. Kevin Greene joins Chris and Robert to ask what a balanced approach should look like now. Drawing on work at Parasoft and across government and industry, Kevin discusses secure development practices, standards, developer enablement, and the limits of relying on tools alone. The conversation connects supply-chain failures and the federal cybersecurity executive order to cyber resilience, penetration testing, red teams, and assurance. It closes by looking ahead to policy, software minimalism, and the changes organizations must make if they want secure software to become a repeatable engineering outcome rather than a late-stage scramble.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Kevin Greene:
→ Parasoft
→ Kevin Greene on API security testing

Mentioned in this episode:
→ Parasoft
→ OWASP Proactive Controls
→ MITRE ATT&CK
→ Threat Modeling Manifesto
→ Executive Order 14028
→ Apache Struts

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Looking back at software security
02:03 Kevin Greene’s path through AppSec
04:54 What a balanced security approach means
06:59 Prevention, detection, and response
09:52 Standards and repeatable engineering practices
12:38 Making secure development easier
15:42 Helping developers own security
18:40 The current state of software assurance
22:36 Guidance, governance, and accountability
24:46 Where security tools help—and where they do not
28:00 Supply-chain failures and SolarWinds
30:00 Why old software problems persist
33:00 The federal cybersecurity executive order
37:00 Adapting to rapid change
40:00 Building cyber resilience
42:00 The role of penetration testing
45:00 What red teams add
47:00 Standards, certification, and assurance
53:00 Looking toward the future
54:00 Goals for the next generation of software
56:00 Software minimalism and reducing attack surface
59:00 Policy as a driver for change
62:00 Closing thoughts

Jeevan Singh is a Security Engineer Manager at Segment, where he is embedding security into all aspects of the software development process. Jeevan enjoys building security culture within organizations and educating staff on security best practices. Before life in the security space, Jeevan had a wide variety of development and leadership roles over the past 15 years. Jeevan joins us to speak about self-serve threat modeling at Segment or threat modeling based in democracy. We discuss their focus with the program, how it fits in their dev methodology and their ultimate goal with the threat modeling program. We hope you enjoy this conversation with... We discussed their focus with the program, how it fits in their development methodology, and their ultimate goal with threat modeling.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Jeevan Singh is a Security Engineer Manager at Segment, where he's embedding security into all aspects of the software development process.
→ Learn more about Security Journey

Connect with Jeevan Singh:
→ segmentio/threat-modeling-training
→ Redefining Threat Modeling (Segment blog)

Mentioned in this episode:
→ segmentio/threat-modeling-training
→ Redefining Threat Modeling (Segment blog)
→ Segment

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Jeevan Singh: Threat modeling based in democracy
01:16 Hey folks, welcome to another episode of the Application Security Podcast
04:59 The question I always ask folks that come from a development
07:24 Certainly, that's the model that I love as well, as far
09:37 The engineering teams start performing a threat model, what are some
12:51 You have any formal kind of way that you measure when
14:13 You mentioned threat modeling tickets. Is that a metric that you're
17:24 Then does your threat modeling, your self-serve threat modeling, does it
20:07 This is really an industry best practice. Not enough people are
25:22 Yeah, that's great. That is great. Okay, so tell me just
31:13 For folks out there that are building their own program, I
33:29 Awesome. Well, Jeevan, what would be a key takeaway or call

Dima Kotik is an Application Security Engineer at Security Journey and has been programming in Python for years. As he was working on building out Security Journey's Secure Coding with Python content, he came across the Zen of Python, a set of guidelines for how to program in Python. He wrote a blog post about how to apply application security to the Zen of Python, and then we recorded this interview to talk about the concept in more depth. We hope you enjoy this interview with.... Dee Makotik is an application security engineer at Security Journey and has been programming in Python for years. We hope you enjoy this conversation with— Dima Kotik.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Dee Makotik is an application security engineer at Security Journey and has been programming in Python for years.
→ Learn more about Security Journey

Connect with Dima Kotik:
→ Zen of Python (PEP 20)
→ Dave Cheney: The Zen of Go

Mentioned in this episode:
→ Zen of Python (PEP 20)
→ Dave Cheney: The Zen of Go
→ Go
→ Rust
→ Node.js
→ Ruby
→ Flask
→ IronPython
→ Stackless Python
→ Zig
→ WireGuard
→ OpenSSL
→ NASA Ingenuity Mars Helicopter

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Dima Kotik: Application Security and the Zen of Python
02:02 That is, how did you get your start in application security
05:06 That consistent
06:45 Does Python fit into web applications
09:53 Yeah. So, you wrote a blog post about the Zen of
13:17 You wrote this article, you took the Zen of Python and
17:23 What's the security takeaway then in regards to readable code
21:15 That was readable, plus talking about the applicability of this whole
32:57 What's the security takeaway then on the singular
34:40 This has been very beneficial to understand the Python use cases