Devon Rudnicki, the Chief Information Security Officer at Fitch Group, shares her journey of developing an application security program from scratch and advancing to the CISO role. She emphasizes the importance of collaboration, understanding the organization's business, and using metrics to drive positive change in the security program. Devin Rudnicki, the Chief Information Security Officer at Fitch Group, developed an application security program and advanced to the CISO role after years in security governance. She holds a BS in mathematics from DePaul University and multiple certifications, including CISSP, GSTRT, GSEC, and GCSA. Outside work, she enjoys group fitness, global travel, and mentoring in cybersecurity.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey is an enterprise-class solution with lessons that are built on learning science principles to deliver long-term measurable results.
→ Learn more about Security Journey

Connect with Devin Rudnicki:
→ Alice and Bob Learn Application Security
→ RSA Conference

Mentioned in this episode:
→ Alice and Bob Learn Application Security
→ RSA Conference
→ Black Hat
→ Walter Isaacson

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Devin Rudnicki: Expanding AppSec
03:05 Very cool. So the internship, security and governance, does that lead
05:03 Is that What's that approval look like as far as, is
07:28 What's the first thing that you focus on with this program
10:17 You're kind of, you're learning a little bit about the personalities
11:41 Yes, I think that's an important tactical thing that we can
14:54 Yeah. Okay. So when we, if we break the program, then
17:54 Okay. So, that's the vulnerability management side. How about developer education
20:23 In the past, I would say no to that question, and
21:18 That's, you know, you can minimize. But yeah, I mean, pen
24:49 Tracking the work. What metrics and KPIs did you use to
27:05 Yeah, and I had a similar situation in my previous time
30:03 Devin, we have 3 questions that we typically ask in the
32:59 The gene splicing therapy. We'll find it and put it in

Dustin Lehr, Senior Director of Platform Security/Deputy CISO at Fivetran and Chief Solutions Officer at Katilyst Security, joins Robert and Chris to discuss security champions. Dustin explains the concept of security champions within the developer community, exploring the unique qualities and motivations behind developers becoming security advocates. He emphasizes the importance of fostering a security culture and leveraging gamification to engage developers effectively. They also cover the challenges of implementing security practices within the development process and how to justify the need for a champion program to engineering leadership. Dustin shares insights from his career transition from a developer to a cybersecurity professional, and he provides practical advice for organizations looking to enhance their security posture through community and culture-focused approaches.

Connect with Dustin Lehr:
→ Security Champion Success Guide
→ Katilyst

Mentioned in this episode:
→ Security Champion Success Guide
→ Katilyst
→ Makersschedule
→ Never Split The Difference Chris Vosstahl Raz

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Dustin Lehr: Culture Change through Champions and Gamification
02:50 Yeah, and you were, uh, on a previous episode entitled Advocating
06:29 I need you to tap back into your old development days
09:05 Cause a lot of times developers say you're living in an
11:56 Me think of, you guys ever seen the uh, Maker vs
14:47 Yeah, it's it makes me think about like the rise of
17:53 Can a developer become a champion with zero security knowledge
20:08 Yeah, I was, I was smiling a little bit when you
21:35 Does, um, what would a person who became a champion, where
24:26 Yeah, I can say one of the, one of the biggest
28:37 A little bit about, uh, on the, on the security side
35:17 You hearing anything different
40:07 Yeah, very cool. I've been, I've been following along. I've been
42:45 Perfect. And then the final question is, what's your top book

Francesco Cipollone, CEO of Phoenix Security, joins Chris and Robert to discuss security and explain Application Security Posture Management (ASPM). Francesco shares his journey from developer to cybersecurity leader, revealing the origins and importance of ASPM. The discussion covers the distinction between application security and product security, the evolution of ASPM from SIEM solutions, and ASPM's role in managing asset vulnerabilities and software security holistically. Francesco emphasizes the necessity of involving the business side in security decisions and explains how ASPM enables actionable, risk-based decision-making. The episode also touches on the impact of AI on ASPM. It concludes with Francesco advocating for a stronger integration between security, development, and business teams to effectively manage software security risks.

Connect with Francesco Cipollone:
→ Phoenix Security
→ Cyber For Builders

Mentioned in this episode:
→ Phoenix Security
→ Cyber For Builders

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Francesco Cipollone: Application Security Posture Management and the Power of Working with the Business
08:10 That's helpful. I'm, I'm asking this question of lots of people
10:25 Frank, today we're going to be talking about, uh, what is
13:06 You, let's, let's put the, the, let's go back in history
17:51 I want to, I want to explore another avenue that you've
23:06 Sure. Uh, so one question we wondered about in terms of
25:52 Yeah. So let's, um, let, let's kind of summarize. When we
27:31 I heard inventory was one big piece, so one of the
29:34 All right. Well, one other question we have is, I think
31:43 Yeah, I could see the kind of the pattern matching summarization
35:04 All right. Uh, our second question is, uh, what would it

Mukund Sarma, the Senior Director for Product Security at Chime, talks with Chris about his career path from being a software engineer to becoming a leader in application security. He explains how he focuses on building security tools that are easy for developers to use and stresses the importance of looking at application security as a part of the broader category of product security. Mukund highlights the role of collaboration over security mandates and the introduction of security scorecards for proactive risk management. He and Chris also discuss the strategic implementation of embedded security functions within development teams. Discover the potential of treating security as an enabling function for developers, fostering a culture of shared responsibility, and the innovative approaches Chime employs to secure its services with minimal friction for developers.

Connect with Mukund Sarma:
→ Monocle Part 1
→ Building Secure and Reliable Systems

Mentioned in this episode:
→ Monocle Part 1
→ Building Secure and Reliable Systems
→ Chime
→ Mitigating Risky Pull Requests With Monocle Risk Advisor Part 2 7013e1485bf2
→ YouTube video
→ Drive
→ Bandit

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Mukund Sarma: Developer Tools that Solve Security Problems
03:37 Yeah. Yeah. So did you, uh, start Chimes product security team
04:34 You use the words AppSec and ProdSec
08:21 I guess I want to ask kind of the, the other
10:17 That's the Overwatch. Was that the overwatch
13:26 I got to imagine they're loving it because you're making their
15:55 If I accidentally create a service that doesn't have a JSON
19:16 Yeah, John Doerr in the famous OKR book, Measure What Matters
23:03 Yeah, I mean, I think that's the ultimate gamification play, is
25:48 A big task, right
27:36 It has to be a motivational lever in the equation, right
32:43 Did you choose the order
35:18 Mm hmm. So if a, let's say somebody listening here is
37:41 Yeah, some, some more skill sets on the cross collaboration front
42:13 All right, let's do some lightning round questions. I could, we
45:12 Do you want to leave our audience with

AppSec specialist Megan Jacquot joins Chris and Robert for a compelling conversation about community, career paths, and productive red team exercises. Megan shares her unique cybersecurity origin story, tracing her interest in the field from childhood influences through her tenure as an educator and her formal return to academia to pivot into a tech-focused career. She delves into her roles in threat intelligence and application security, emphasizing her passion for technical work, penetration testing, and bug bounty programs. Additionally, Megan highlights the importance of mentorship, her involvement with the Women in Cybersecurity (WeCyS) community, and her dedication to fostering the next generation of cybersecurity professionals.

Connect with Meghan Jacquot:
→ WiCyS (Women in Cybersecurity)
→ Difficult Conversations

Mentioned in this episode:
→ WiCyS (Women in Cybersecurity)
→ Difficult Conversations
→ Being Henry Fonz And Beyond Henry Winkler
→ DEF CON
→ OWASP Application Security Verification Standard (ASVS)
→ ChatGPT
→ RSA Conference
→ The Phoenix Project

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Meghan Jacquot: Assumed Breach Red Team Engagements for AppSec
02:10 It there. I tried. I went all in. That was my
06:50 I'm just laughing because I, I asked, you know, college aged
10:42 Meghan, one of the things that, uh, you shared with us
13:50 It's something that happens more often than we would like to
19:14 A couple of couple of clarifying questions Do you think that
22:20 I have another scenario then, that I'm just, I don't know
24:15 I wonder about situations where you already have customers who can
26:01 I want to change, uh, topics a bit because I know
29:13 Yeah, I agree. I've had a chance to, to be on
32:51 It's for the, and I hope people are using it somewhere
35:39 You bet. Well, Meghan, our lightning round, we have three questions
36:57 Number three, uh, what's your top book recommendation and why do

Robert is joined by Bill Sempf, an application security architect with over 20 years of experience in software development and security. Bill shares his security origins as a curious child immersed in technology, leading to his lifelong dedication to application security. They discuss CodeMash, a developer conference in Ohio, and recount Bill's presentation on the Veilid application framework, designed for privacy-driven mobile applications. Bill also explores his efforts in educating children about technology and programming, drawing on his experiences with Kidsmash and other initiatives. Additionally, they delve into the challenges of application security, particularly modern software development practices and the utility of languages like Rust for creating secure applications.

Connect with Bill Sempf:
→ Bill's homepage
→ CodeMash conference

Mentioned in this episode:
→ Bill's homepage
→ CodeMash conference
→ Veilid Application Framework
→ Math Without Numbers
→ Agile Manifesto
→ Rust
→ GitLab

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introduction
07:42 Giving Back: CodeMash and Other Conferences
12:27 Exploring Veilid: A Privacy-Driven Application Framework
16:17 Nurturing Tech-Savvy Kids
21:29 The Intersection of AppSec and Developer Conferences
26:36 Trends and Challenges in Application Security

Robert and Chris talk with Hendrik Ewerlin, a threat modeling advocate and trainer. Hendrik believes you can threat model anything, and he recently applied threat modeling to the process of threat modeling itself. His conclusions are published in the document Threat Modeling of Threat Modeling, where he aims to help practitioners, in his own words, "tame the threats to the threat modeling process. Hendrik Ewerlin loves to build secure software and empower people to do so. He strongly believes in the power of threat modeling. He provides threat modeling training and helps software vendors who are new to threat modeling and want to improve the security of their systems.

Connect with Hendrik Ewerlin:
→ Hendrik Ewerlin
→ Threat Modeling of Threat Modeling

Mentioned in this episode:
→ Hendrik Ewerlin
→ Threat Modeling of Threat Modeling
→ Austin Kleon books
→ Adam Shostack
→ Threat Modeling Manifesto
→ OWASP SAMM

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Hendrik Ewerlin: Threat Modeling of Threat Modeling
02:44 Exciting adventure called application security
04:53 Let them build something when they're, when they're in their teens
07:21 Very meta, which I know is a word from a few
10:23 Is your approach, uh, to threat modeling and threat modeling programs
11:39 Yeah, I did notice that you, you took, you took various
14:51 And getting on the same plane. So, I know one of
18:11 There some other things that you discovered as you were working
20:39 Document. So one of the things, Hendrick, that I noticed about
25:01 Yeah, and I love where you went with that. One of
27:56 Enough people like me smile. You, so you wrote mitigation debt
30:36 All right, three questions. First one is, what's your most controversial
32:20 Okay. And the third question is, uh, what's your top book

Jason Nelson, an accomplished expert in information security management, joins Chris to share insights on establishing successful threat modeling programs in data-intensive industries like finance and healthcare. Jason presents his three main pillars to consider when establishing a threat modeling program: consistency, repeatability, and efficacy. The discussion also provides a series of fascinating insights into security practices, regulatory environments, and the value of a threat modeling champion. As a threat modeling practitioner, Jason provides an essential perspective to anyone serious about application security. Jason Nelson is an information security executive focused on building programs and directing teams in highly regulated financial healthcare and insurance industries.

Connect with Jason Nelson:
→ FINOS Common Cloud Controls
→ NIST OSCAL

Mentioned in this episode:
→ FINOS Common Cloud Controls
→ NIST OSCAL
→ MITRE ATT&CK
→ Malware Analyst's Cookbook
→ Threat Modeling: A Practical Guide for Development Teams
→ Schneier on Security
→ The Security Table (podcast)
→ Start With Why

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introduction
02:13 Security Origin Story
07:48 Threat Modeling the Cloud
16:44 Threat Modeling Pillar One: Consistency
27:30 A Threat Modeling Champion
33:35 Threat Modeling Pillar Two: Repeatability
39:07 Threat Modeling Pillar Three: Efficacy
48:09 Lightning Round

Erik Cabetas joins Robert and Chris for a thought-provoking discussion about modern software security. They talk about the current state of vulnerabilities, the role of memory-safe languages in AppSec, and why IncludeSec takes a highly systematic approach to security assessments and bans OWASP language. Along the way, Erik shares his entry into cybersecurity and his experience consulting about hacking for TV shows and movies. The conversation doesn't end before they peek into threat modeling, software engineering architecture, and the nuances of running security programs. Eric Cabetas has more than two decades of experience in InfoSec. His previous posts include senior roles at Ernst Young, Fortify Software, and theladders.

Connect with Erik Cabetas:
→ Security Engineering by Ross Anderson
→ IncludeSec

Mentioned in this episode:
→ Security Engineering by Ross Anderson
→ IncludeSec
→ New School Of Information Security 9780132800280
→ DEF CON
→ OWASP Top Ten
→ Rust
→ Go
→ OpenSSF
→ RSA Conference

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introduction
01:32 Security Origin Story
04:28 Winning DEF CON CTF
08:36 Hollywood Hacking Consultant
15:05 The Current State of Vulnerabilities
26:45 Memory Safe Languages
35:19 Banning OWASP Language?
41:26 Lighting Round

Justin Collins of Gusto joins Robert and Chris for a practical conversation about running security teams in an engineering-minded organization. Justin shares his experience leading product security teams, the importance of aligning security with business goals, and the challenges arising from the intersection of product security and emerging technologies like GenAI. Justin Collins currently heads up security at Gusto. In the past, he's been an AppSec engineer at SurveyMonkey, Twitter, and AT&T Interactive. He's also the primary author of Brakeman, a free static analysis security tool for Ruby on Rails. We explore security partners, GRC and privacy intersections, and the challenges that GenAI will bring to product security over the next five years.

Connect with Justin Collins:
→ The DevOps Handbook
→ Gusto

Mentioned in this episode:
→ The DevOps Handbook
→ Gusto
→ Brakeman
→ Ruby on Rails
→ Ruby
→ Content-Security-Policy (MDN)
→ The DevOps Handbook

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Meet Justin Collins: Enabling the Business to Move Faster, Securely
04:23 Rest, as they say, is history, right
08:47 Hmm. Cool, thanks. Um, Robert, why don't you take us into
12:51 What's been the response from the business to this statement where
15:50 You think it's, do you think ProdSec is easier in a
20:51 Yeah. I think that's, that's, that's, that's advice worth gold right
23:58 You mentioned a couple things, uh, that sound like good keys
26:50 Hm, So in the last, uh, I guess, number of years
31:21 Yeah. that's true. I want to give a special shout out
35:43 It SQL injection. It's vulnerable or it's not. It's, we don't
38:31 All right. So the lightning round is three questions that we
40:33 I mean, we have to end the interview now, but other
42:43 Very cool. All right. And the final one is, uh, what's
44:51 Yeah, that's true. All right. Well, Justin, how about a key