The Application Security Podcast

Steve Wilson, the author of 'The Developer's Playbook for Large Language Model Security’ is back to dive into topics from his book like AI hallucinations, trust, and the future of AI. Steve has been at the forefront of the explosion of activity at the intersection of AppSec, LLM, and AI. We discuss the biggest fears surrounding LLMs and AI, and explore advanced concepts like Retrieval Augmented Generation and prompt injection. Steve Wilson is the author of The Developer's Playbook for Large Language Model Security: Building Secure AI Applications. Steve wrote a book, and we explored some of the topics from the book, like AI hallucinations, trust, and the future of AI.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We provide application security training for not just your developers, but for all roles in your SDLC.
→ Learn more about Security Journey

Connect with Steve Wilson:
→ Steve on LinkedIn
→ Chris Voss

Mentioned in this episode:
→ The Developer's Playbook for Large Language Model Security
→ Steve on LinkedIn
→ Steve Wilson -- OWASP Top Ten for LLMs
→ Steve Wilson and Gavin Klondike -- OWASP Top Ten for LLM Applications Release
→ Chris Voss
→ Arshan Dabirsiaghi
→ Never Split The Difference Chris Vosstahl Raz
→ Pixee
→ Jeff Williams on LinkedIn

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Steve Wilson: The Developer's Playbook for Large Language Model Security: Building Secure AI Applications
02:35 Very cool. Very cool. Which WTF, ITF, what federation
04:52 Well, let me mention the name of the book. Uh, we'll
10:42 The ability for the model slash the system that's providing the
12:36 Has there been any reported stories of that happening at scale
14:48 That's, that's, uh, thanks for sharing that perspective on hallucinations. Trust
18:19 Can we use agents to police themselves
20:22 Yeah. And it seems like people that are, that are spending
26:19 Most definitely. Most definitely. So, last chapter, I want to throw
29:51 All right. So yeah, new questions. The first one is shift
32:58 Then, uh, last question is, uh, who is someone that our
34:18 Very cool. Thanks for sharing that. So Steve, key takeaway, call

Jeff Williams, a renowned pioneer in the field of application security is with us to discuss Application Detection and Response (ADR), detailing its potential to revolutionize security in production environments. Jeff shares stories from his career, including the founding of OWASP, and his take on security assurance. We cover many topics including; security assurance, life, basketball and plenty of AppSec as well. Jeff Williams is a veteran application security expert who founded and led OWASP, Aspect Security, and Contrast Security. Jeff also created several highly successful open source projects, including JBomb, JOT, OWASP Top 10, WebGoat, ESAPI, ASVS, and more. Jeff serves as an advisor to NIST, CISA, PCI Council, Oasis Seraph, OWASP CycloneDX, OWASP Foundation, Eclipse Foundation, and advises many companies and agencies on AppSec.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We help enterprises reduce vulnerabilities through application security education for developers and everyone in the SDLC.
→ Learn more about Security Journey

Connect with Jeff Williams:
→ Jeff Williams on LinkedIn
→ The Tech of Runtime Security

Mentioned in this episode:
→ Jeff Williams on LinkedIn
→ The Tech of Runtime Security
→ Contrast Security
→ Log4j
→ OWASP ESAPI

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Jeff Williams: Application Detection & Response (ADR)
01:45 I mean, what's to talk about
05:18 Does the competitive firework when you're in a, like in a
13:12 You, has your thinking or your approach changed over the decades
16:05 I'm curious now, the comment you made about vulnerability scans and
17:39 Now to, to completely overturn the apple cart here, does AI
20:45 Yeah. I've had the same, I've drawn the same conclusion as
29:30 You're describing a world where the, the, what I would think
31:33 We think about the now classic technologies in a company's AppSec
34:59 There any, um, in terms of, you know, business problems, uh
38:56 Jeff, where do you see ADR going into the future
42:13 All right. Yeah. So, uh, first question is, um, shift left
46:23 Okay. Second question is a conference talk, or is there a
49:44 Very cool. Thanks for sharing that pointer. Definitely look Naomi up

Philip Wiley shares his unique journey from professional wrestling to being a renowned pen tester. We define pen testing and the role of social engineering in ethical hacking. We talk tools of the trade, share a favorite web app pentest hack and offer good advice on starting a career in cybersecurity. Philip shares some insights from his book, ‘The Pentester Blueprint: Starting a Career as an Ethical Hacker. ’ And we discuss the impact of AI on pen testing and where this field is headed in the next few years. Our guest in this episode is Phillip Wiley. We explore the definition of pentesting, its relationship with red team activities, and the role of social engineering in ethical hacking.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey is an enterprise-class solution with lessons that are built on learning science principles to deliver long-term measurable results.
→ Learn more about Security Journey

Connect with Phillip Wylie:
→ Phillipwylie
→ Ranakhalil1

Mentioned in this episode:
→ The Pentester Blueprint: Starting a Career as an Ethical Hacker
→ The Web Application Hacker's Handbook
→ The Hacker Maker
→ The Phillip Wylie Show
→ @PhillipWylie
→ Phillipwylie
→ The Web Application Hacker
→ The Pentester BluePrint: Starting A Career As An Ethical Hacker P 9781119684305
→ Burp Suite
→ OWASP ZAP
→ Metasploit
→ Nessus
→ sqlmap
→ Kali Linux
→ Bugcrowd
→ SANS Institute
→ Ranakhalil1
→ PCI DSS

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Phillip Wylie: Pen Testing from Somebody who Knows about Pen Testing
02:33 Right. Oh, the typical story. No, unfortunately, I wish it was
06:19 So one, one last wrestling question. This is quickly becoming the
09:31 I gotta imagine that there's a certain amount of improv though
11:19 Good decision there. So Phillip, how about security
15:13 Mm-hmm. So pen testing, I think, is the, is the primary
19:30 Yeah, that's a good, that's a good, good way to summarize
22:45 You mentioned SQL injection. I'm always curious to understand from somebody
24:12 Okay. So it's not something that's, uh, yeah, that's interesting that
27:03 I wanted to circle back on, you mentioned social engineering and
29:18 With payloads, like I said. Yeah. So if we think about
32:52 Let's shift a little bit. Uh, I know that you've done
35:47 We want to just mention and hear a little bit more
38:36 Yeah, that's really cool. And I want to, um, I want
39:31 I, and the pet peeve I have is Talk to a
46:46 Yeah. How is, um, another just off the top of my
50:11 Phillip, I want to just, I know you do podcasts and

Steve Springett, an expert in secure software development and a key figure in several OWASP projects is back. Steve unpacks CycloneDX and the value proposition of various BOMs. He gives us a rundown of the BOM landscape and unveils some new BOM projects that will continue to unify the security industry. Steve is a seasoned guest of the show so we learn a bit more about Steve's hobbies, providing a personal glimpse into his life outside of technology. Steve Springett educates teams on the strategy and specifics of developing secure software. He practices security at every development lifecycle stage by leading sessions on threat modeling, secure architecture and design, static dynamic component analysis, offensive research, and defensive programming techniques.

Today's episode is brought to you by Security Journey.

About Security Journey
Our education platform teaches valuable secure coding skills based on real-world vulnerabilities and threats, including OWASP Top 10.
→ Learn more about Security Journey

Connect with Steve Springett:
→ CycloneDX
→ Software Transparency: Supply Chain Security in an Era of a Software-Driven Society

Mentioned in this episode:
→ CycloneDX
→ Software Transparency: Supply Chain Security in an Era of a Software-Driven Society
→ JC Herz and Steve Springett -- SBOMs and software supply chain assurance
→ OWASP Dependency-Track
→ CycloneDX
→ OWASP Foundation
→ Log4j
→ Apache Struts
→ Open Threat Model (OTM)
→ OWASP Threat Dragon Project
→ LINDDUN
→ PCI Security Standards Council
→ Software Transparency: Supply Chain Security in an Era of a Software-Driven Society by Chris Hughes, Tony Turner
→ OWASP Dependency-Check

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Steve Springett: Software and System Transparency
02:04 It's, uh, well, the City of Brotherly Love, isn't that what
06:05 That's just, it's just another reminder that we all gotta find
07:44 Um, Robert, where are we, where are we going with Steve
11:00 And I think a lot of people in AppSec are going
12:21 Right
14:26 I'd love to get you kind of on the record giving
19:08 Based on the Log4j, Log4Shell example, let's have it, let's, let's
23:03 We've talked about some of the use cases, but are there
24:52 We think about All of these different capabilities and different, I
30:18 Let's say in relation to that transparency, but also, uh, commonalities
33:19 I know you've been doing some work, Steve, on this idea
36:32 I mean, it, it, I think if I, if I kind
42:47 Okay. Yeah. So we have 3 questions. Do we, have we
45:19 Last question, uh, what's your top book recommendation and why do

Irfaan Santoe joins us for an in-depth discussion on the power of strategy in Application Security. We delve into measuring AppSec maturity, return on investment, and communicating technical needs to business leaders. Irfaan shares his unique journey from consulting to becoming an AppSec professional, and addresses the gaps between CISOs and AppSec knowledge. Irfaan shares valuable insights for scaling AppSec programs and aligning them with business objectives. Irfaan Santoe joins us to discuss the power of strategy in AppSec. We go deep on this one, on AppSec program maturity, how we can measure maturity, and even some tips for success. We talk about measuring return on investment and how to speak the language of the business as a technical person.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We provide diverse training content and easy-to-digest lessons to meet individual learner needs.
→ Learn more about Security Journey

Connect with Irfaan Santoe:
→ OWASP SAMM
→ OWASP Security Champions Guide

Mentioned in this episode:
→ OWASP SAMM
→ OWASP Security Champions Guide
→ BSIMM
→ Jim Routh on Twitter
→ OWASP Netherlands Chapter
→ OWASP SAMM

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Irfaan Santoe: The Power of Strategy in AppSec
03:12 That's kind of the— it's almost the opposite of what a
06:35 A little bit about maturity. So, what is maturity within an
09:30 We think about measuring maturity then, so let me read back
12:20 Yeah. So, what is a part of that link then
17:16 Okay. So, we talked a little bit about, you know, how
20:59 I think there's a real disconnect between the business side and
27:03 Because that seems like, I mean, that's return on investment to
29:39 I've been waiting to ask this next question for a long
31:49 Yeah. And, if we use your car example and if I
33:51 Let's pull all this together. How do we scale an AppSec
38:12 All right. So, we have 3 questions that we usually ask

Andrew Van Der Stok, a leading web application security specialist and executive director at OWASP joins us for this episode. We discuss the latest with the OWASP Top 10 Project, the importance of data collection, and the need for developer engagement. Andrew gives us the methodology behind building the OWASP Top 10, the significance of framework security, and much more. Andrew Vanderstock is a seasoned web application security specialist and enterprise security architect. He's the executive director at OWASP, taking the foundation through organizational change and taking OWASP's mission to the next level. Andrew has worked in the IT industry for over 25 years, has researched and developed the web application security and architecture fields since 1998.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Our training includes theory and immersive learning that teaches the skills and knowledge needed to create a security-first mindset across your organization.
→ Learn more about Security Journey

Connect with Andrew van der Stock:
→ The Crown Road by Iain Banks
→ Edward Tufte

Mentioned in this episode:
→ The Crown Road by Iain Banks
→ Edward Tufte
→ OWASP Top Ten Project
→ OWASP Developer Guide
→ PCI DSS
→ OWASP Top Ten for LLM Applications project homepage
→ RSA Conference

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Andrew van der Stock: The New OWASP Top Ten
01:41 We are about to go on a journey into the topic
04:10 Phone goes with you probably just for emergency purposes, but so
07:27 Probably get ways to deal with it, right
13:08 Help me, help me remember what, what, what is the connection
15:29 On the topic of OWASP Top 10, give us an update
17:16 We talk about data and the need for data, I don't
20:58 Then if— so the, the request for data is really more
21:56 Now I'm curious. I want to dig a little deeper on
26:00 Are the downsides of, potential downsides of this data collection approach
30:23 That data weighted different in the model if it comes from
33:33 Wrapping all of this kind of together, we've got the data
35:14 I mean, or it used to be. Yeah. Or it used
36:24 I can, I mean, just to second something you said a
40:38 Yeah. So you already jumped ahead to controversial opinion, but before
42:23 All right. Yes, we already talked about the controversial opinions. So
45:59 Great. Last question is, what's your top book recommendation and why
50:12 Andrew, what's, how about a key takeaway then

Derek Fisher, an expert in hardware, software, and cybersecurity with over 25 years of experience is back on the podcast. Derek shares his advice on cybersecurity hiring, specifically in application security, and dives into the challenges of entry-level roles in the industry. We discuss the value of certifications, the necessity of lifelong learning, and the importance of networking. Listen along for good advice on getting noticed in cybersecurity, resume tips, and the evolving landscape of AppSec careers. Mentioned in this episode: The Application Security Handbook by Derek Fisher Derek Fisher brings over 25 years of hardware, software, and cybersecurity expertise across multiple industries, including healthcare and finance.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We provide application security training for not just your developers, but for all roles in your SDLC.
→ Learn more about Security Journey

Connect with Derek Fisher:
→ The Application Security Handbook by Derek Fisher
→ Cyber for Builders by Ross Haleliuk

Mentioned in this episode:
→ The Application Security Handbook by Derek Fisher
→ Cyber for Builders by Ross Haleliuk
→ Effective Vulnerability Management by Chris Hughes
→ With the Old Breed by E.B. Sledge
→ Derek Fisher – The Application Security Handbook
→ WiCyS (Women in Cybersecurity)
→ CISSP
→ BSides

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Derek Fisher: Hiring in Cyber/AppSec
01:35 Yeah, we're joined by someone who's been on the podcast before
03:48 What's your favorite thing to grow
06:21 It's the, as you said, it's the therapeutic value of getting
11:05 Which to your point, mid to senior level people are 100%
13:15 With that in mind, I mean, how are people getting into
17:32 I mean, if anything, it's the patterns, kind of the try
20:03 Reminds me of something about Billy the Kid. Like, do you
21:58 You mentioned resume reviews. I'm always curious. I've never participated in
26:18 The last, you know, 5, 7 years, all the hiring I've
33:16 I would say, you know, that's one way to stand out
35:43 One of the we got to blame the hiring companies though
37:00 You can apply something, yourself to something. And so that, I
39:57 That, that I look back and say, I didn't necessarily use
47:59 By doing a pen testing class and doing a forensics class
52:17 All right. So yeah, 3 questions that we have. First of
55:34 Makes sense. So number 3, what's your Top book recommendation and
57:24 Yeah, he just wrote a new book on, yeah, it's the
58:49 Excellent. Derek, what about a key takeaway or a call to

Tanya Janka, also known as SheHacksPurple, discusses secure guardrails, the difference between guardrails and paved roads, and how to implement both in application security. Tanya is an award-winning public speaker and head of education at SEMGREP and the best-selling author of ‘Alice and Bob Learn Application Security’. Tanya shares her insights on creating secure software and teaching developers in this episode. Tanya Jenka, also known as She Hacks Purple, is the bestselling author of Alice and Bob Learn Application Security. She's also the head of education and community at Semgrep, sharing content and training around teaching everyone to create secure software. Tanya's been coding and working in IT for over 25 years.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We help enterprises reduce vulnerabilities through application security education for developers and everyone in the SDLC.
→ Learn more about Security Journey

Connect with Tanya Janca:
→ Tanya Janca on LinkedIn
→ Alice and Bob Learn Application Security

Mentioned in this episode:
→ Alice and Bob Learn Application Security
→ Semgrep
→ Tanya Janca – What Secure Coding Really Means
→ The Expanse Series
→ Alice and Bob Learn Application Security
→ Tanya Janca (SheHacksPurple)
→ Azure DevOps
→ Microsoft Security Response Center (MSRC)
→ Microsoft Defender for Cloud
→ Content-Security-Policy (MDN)
→ Scott Helme
→ Kim Wuyts
→ Executive Order 14028
→ OWASP SAMM

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Tanya Janca: Secure Guardrails
05:09 Oh, that's so cool. So what, what are you excited about
06:49 Oh, that's great. That's, yeah, it's a, that's a fun thing
10:05 I was like, no, no, I'm good. And it was like
12:05 So based on the example that you just shared there, Now
15:55 Would you like to use the wrapper library
17:36 Am I willing to break the build
19:41 Oh, actually, you know what
22:39 What's the role of making it easy with the paved road
24:58 Right
26:53 Makes sense. Makes sense. That's, that's, uh, it's helpful just to
30:18 I have to go rotate the secret, yada, yada, yada, right
32:58 Like, because getting into buildings when you should not is a
34:18 No, no, it's good. It's good. So I guess one more
37:48 Someone else told me she did that and it said, this
40:19 All right. One more guardrail topic. And this is one that
43:05 Right
46:24 It's time for her to come back again. She has been
47:38 No
50:13 We've all gotten those though for, for plenty of times in
53:34 Um, and so then we talked about it and I'm like
57:14 So I'm going to do the top programming frameworks as well
61:11 Oh, nice. Very cool. Very cool. So, just to kind of

Jahanzeb Farooq discusses his journey in cybersecurity and the challenges of building AppSec programs from scratch. Jahanzeb shares his experience working in various industries, including Siemens, Novo Nordisk, and Danske Bank, highlighting the importance of understanding developer needs and implementing the right tools. The conversation covers the complexities of cybersecurity in the pharmaceutical and financial sectors, shedding light on regulatory requirements and the role of software in critical industries. Learn about prioritizing security education, threat modeling, and navigating digital transformation. Jan Zeb Farouk currently serves as the head of application security at Danske Bank, the largest bank in Denmark. Before this, he was with Novo Nordisk, where he played a key role in building their application security program from scratch and in securing their digital health solutions.

Today's episode is brought to you by Security Journey.

About Security Journey
Our education platform teaches valuable secure coding skills based on real-world vulnerabilities and threats, including OWASP Top 10.
→ Learn more about Security Journey

Connect with Jahanzeb Farooq:
→ The Power of Habit by Charles Duhigg
→ BSIMM

Mentioned in this episode:
→ The Power of Habit by Charles Duhigg
→ BSIMM
→ OWASP SAMM

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Jahanzeb Farooq: Launching and executing an AppSec program
01:57 You could have told me that you painted it. I would
07:12 From that perspective. So how do you get to AppSec then
09:08 AppSec
12:55 I have a question. I have a question about having never
15:57 There's no central, so like they don't share services or share
17:27 You're starting with these businesses that were non-IT. They made their
25:46 Do you, what are you, what's the equation you're using to
28:18 You mentioned maturity. Is that something that is based on, Are
29:20 A little question about some of the experiences that you've had
40:06 If I, if I kind of read that back to you
42:58 Yeah, I think a well-tuned SAST tool is a good assessment
45:29 Question 2, if you could display a single message on a
47:14 Yeah, I think really cool. We'll put a link to that

David Quisenberry shares about his journey into the security world, insights on building AppSec programs in small to mid-sized companies, and the importance of data-driven decision-making. The conversation delves into the value of mentoring and why it's important to build real relationships with the people you work with, the vital role of trust with engineering teams, and the significance of mental health and community in the industry. David Quisenberry leads security teams at Capri Health, where he's the senior manager of information security. He's a lifetime OWASP member, former chapter president of the Portland, Oregon OWASP chapter, and co-founder of the OWASP AppSec Days PNW.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
We provide diverse training content and easy-to-digest lessons to meet individual learner needs.
→ Learn more about Security Journey

Connect with David Quisenberry:
→ SRE Engineering
→ The Phoenix Project

Mentioned in this episode:
→ SRE Engineering
→ The Phoenix Project
→ Security Chaos Engineering
→ Wiring the Winning Organization
→ The Body Keeps the Score
→ Never Eat Alone
→ How Leaders Create and Use Networks
→ CISO Desk Reference Guide
→ Intelligence Driven Incident Response
→ Thinking Fast and Slow
→ Do Hard Things
→ BSIMM
→ OWASP Application Security Verification Standard (ASVS)
→ BSides

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet David Quisenberry: Building Security, People, and Programs
01:44 That's, uh, that's a t-shirt, t-shirt idea. I wish I had
04:45 Yeah. It's, it's one of those things where we're never going
06:56 Um, and I love that illustration you just made about comparing
12:43 In your experience then doing this a couple of times, do
17:28 I want to, I want to just acknowledge, I want to
19:42 That's just me. I, I, uh, yeah, I had, I had
22:52 Yeah. And I want to go there next. Um, I guess
24:08 This idea of trust with the engineering teams, because it seems
35:21 Let me, uh, let me, let me just summarize a couple
38:17 I never hear from him again. He's like, this was kind
40:54 About, let's just touch on this mental health point and just
44:29 I was just going to bring that up because it's something
47:30 We got to deal with this last one. Um, cause this
48:53 So I just kind of, the sociologist in me, this happens