The Elephant in AppSec

By The Elephant in AppSec

Time to discuss AppSec issues no one talks about.... more

· Technology

Download on the App Store

Download on the App Store

Get it on Google Play

FAQs about The Elephant in AppSec:

How many episodes does The Elephant in AppSec have?

The podcast currently has 58 episodes available.

The Elephant in AppSec episodes:

April 29, 2024 How security research can earn you $20m in tokens ⎪Swan Beaujard
Welcome to the Elephant in AppSec, the podcast to explore, challenge, and boldly face the AppSec Elephants in the room.
Today we’re excited to have an amazing guest, Swan Beaujard, join us.
Swan is a security software engineer at Escape, specializing in Dynamic Application Security Testing. He is a core contributor to a lot of open-source projects related to GraphQL security and is passionate about machine learning and reverse engineering.
He presented his contributions and research at several international security conferences like BSides Oslo: • BSides Oslo 2023
This year, Swan published his new research detailing scanning and analysis of the 1 million most popular domains. Scanning the front-end code of these domains led to shocking results. He discovered 18,000 exposed tokens and turned a $100 investment in the project into $20 million in Stripe tokens.
In this episode, we discuss Swan’s technical approach and how it feels to find so many exposed secrets. Dive right in!
...more
30min
April 12, 2024 Securing cloud native applications: how hard is it? ⎪Mihir Shah
Welcome to the Elephant in AppSec, the podcast to explore, challenge, and boldly face the AppSec Elephants in the room.

Today we’re excited to have an amazing guest, Mihir Shah, join us.

Mihir Shah is a Senior Staff Application Security Engineer at ForgeRock, specializing in architecting secure cloud-based Identity & Access Management services hosted using Kubernetes and Google Cloud Platform.

He is also the author of the Cloud Native Software Security Handbook, a comprehensive guide on securing cloud-native applications and services.

Additionally, he serves as an Industry Mentor at Stanford University's Advanced Cybersecurity Program and holds two patents on defense against cloud-native infrastructure.

Mihir is passionate about learning and sharing his knowledge on cloud-native security, software development security, and serverless computing. He is a frequent speaker and trainer at security conferences such as BlackHat, DefCon, and OWASP. Moreover, he has published multiple articles on Medium covering various security topics, such as hacking Windows machines, scanning vulnerable Docker images, and compromising Windows systems.

With his passion for the security of cloud-native applications, we decided to ask him how challenging it is. Dive right in!
...more
57min
April 01, 2024 Are custom security tests a product security superpower? ⎜Keshav Malik (LinkedIn)
Welcome to the Elephant in AppSec, the podcast to explore, challenge, and boldly face the AppSec Elephants in the room.
Today we’re excited to have an amazing guest, Keshav Malik, join us.
Keshav is a Senior Product Security Engineer at LinkedIn. With experience in information security and a passion for automation, Keshav brings a unique blend of expertise to the table.
Keshav is also a dedicated tech enthusiast and deeply passionate about contributing to the community. He actively writes custom security rules for various applications like Semgrep and has built several projects like QuickXSS, a bash script automating XSS workflows. Not stopping there, Keshav loves to share his knowledge by organizing workshops, empowering others to write their own custom security tests.
Building on Keshav's experience in writing custom security rules, we've challenged him on whether adding custom rules to existing security software can be the next product security engineer's superpower. Want to find out what he thinks? Dive right in!
...more
24min
March 21, 2024 The art and science of product security ⎥Jacob Salassi (Snowflake)
Welcome to the Elephant in AppSec, the podcast to explore, challenge, and boldly face the AppSec Elephants in the room.
Today we’re excited to have an amazing guest, Jacob Salassi, join us.
Jacob is the Director of Product Security and Regulatory Expansion at Snowflake, where he has played a pivotal role in guiding the company through its pre- and post-IPO phases.
With over 15 years of experience, initially in software engineering before transitioning to security, Jacob is a sought-after speaker at numerous conferences and podcasts, sharing his wealth of insights with others.
Jacob has a deep passion for cycling, and he revealed to us that he has a large repository of ideas stored in his smartphone notes that he records while cycling.
Jacob held a strong opinion that product security should be approached as a science, not an art. Therefore, we challenged him on how, in this case, one can nurture developer creativity to build secure applications and asked in-depth about his scientific approach. Dive right in!
...more
50min
March 05, 2024 Security Consultant vs. In-House Engineer: The Showdown⎜Ric Campo
Welcome to the Elephant in AppSec, the podcast to explore, challenge, and boldly face the AppSec Elephants in the room.
Today we’re excited to have an amazing guest, Ric Campo, join us.
Ric started his cybersecurity journey in the Royal Australian Air Force. With a decade of dedicated experience as an Application Security Engineer and Penetration Tester, he currently serves as a Principal Security consultant at Galah Cyber.
Ric also strongly believes in the power of the community in AppSec. He focuses on writing blogs that will help the community in the long term. He's also been an OWASP Sydney chapter leader for several years. During the podcast, he'll share a funny story about how he became involved with the chapter. Ric has organized multiple meetups and has also presented at the OWASP 20th-anniversary event.
Throughout his career in application security, Ric has worn multiple hats: serving as both a cybersecurity consultant and an in-house application security engineer. This unique perspective prompted us to challenge him on their differences, unique challenges, and reasons behind his preference for the consultant role. Dive right in!
...more
41min
February 29, 2024 Developers and security training: can they co-exist?⎜Laura Bell Main
Welcome to the Elephant in AppSec, the podcast to explore, challenge, and boldly face the AppSec Elephants in the room.
Today, we’re excited to have an amazing guest, Laura Bell Main, join us.

With over 20 years in software development and application security, Laura is the co-founder and CEO of SafeStack, an online education platform that offers secure development training for fast-moving companies.

Laura is also a well-known keynote speaker and has spoken at high-profile events like BlackHat USA, NDC, and OSCON. With her love of speaking and being heavily invested in the community, Laura also hosts her own podcast, Build Amazing Things (securely), where she collects various stories from AppSec professionals.

More than that, she is a regular writer for a range of technology and business publications and is the co-author of “Agile Application Security” and “Security for Everyone.”

If you want to learn practical advice on how to adapt an efficient and enjoyable Lego approach to training programs for your teams and build a great security-minded tech team, tune into our conversation. By the end of the podcast, you'll have an answer to the question: can developers and security training really co-exist?
...more
34min
February 23, 2024 Adversarial machine learning: what is it and are we ready? ⎜Anmol Agarwal
Welcome to the Elephant in AppSec, the podcast to explore, challenge, and boldly face the AppSec Elephants in the room.
Today we’re excited to have an amazing guest, Anmol Agarwal, join us.
Anmol is a security researcher at Nokia, focused on securing AI and Machine Learning in 6G and securing 5G.
She also holds a doctoral degree in cybersecurity analytics from George Washington University. Her research was focused on adversarial machine learning and Federated Learning.
Anmol is also an active speaker and has spoken at various conferences and events including SecureWorld, Pacific Hackers Conference, and Bridges in Tech.
In her free time, she enjoys giving back to the community and is an active industry mentor for Women in CyberSecurity and WCAPS.
As you can see, Anmol is a true expert in adversarial machine learning, so we have decided to challenge her on its current state and how she sees its evolution in the future.

Dive right in!
...more
38min
February 15, 2024 AppSec vendors and CISOs: a love - hate relationship? ⎜Olivia Rose
Welcome to the Elephant in AppSec, the podcast to explore, challenge, and boldly face the AppSec Elephants in the room.
Today, we're joined by an amazing guest, Olivia Rose.
You can find Olivia on LinkedIn: https://www.linkedin.com/in/oliviaros...
Olivia is an executive leader with more than 20 years of dedicated experience, having served as the former CISO at Amplitude and Mailchimp and currently as the Founder of the Rose CISO Group: https://www.rosecisogroup.com/
Her company offers virtual Chief Information Security Officer (CISO) services, boardroom and leadership communications, assessment services, keynote speaking, event presentations, and career and executive coaching.
Olivia is a frequently requested speaker on cybersecurity at events like BSides or RSA, as well as on podcasts.
In her free time, she enjoys mentoring young women and minorities interested in pursuing a career in cybersecurity. At Cyversity, Olivia launched and now leads the mentorship program with over 500 participants.
In the upcoming episode, Olivia will share with us the dos and don'ts of the AppSec vendor CISO relationship, including why you should never make jokes when talking to CISOs and precious tips for breaking into the cyber world.
...more
53min
February 08, 2024 Pentesting: What are the actual benefits?⎥Harsh Modi
Welcome to the Elephant in AppSec, the podcast to explore, challenge, and boldly face the AppSec Elephants in the room.
Today, we're joined by an amazing guest, Harsh Modi.
You can find Harsh on LinkedIn: https://www.linkedin.com/in/neighborhoodpenetrationtester/
With over 8 years of dedicated experience as an Offensive Security Engineer and Penetration Tester, Harsh has honed an exceptional skill set in identifying and mitigating security vulnerabilities. Currently, he is an independent consultant and a Lead Security Architect at Bell.
Harsh is also an enthusiastic security researcher and has presented his research at various conferences such as OWASP Vancouver, BSides Vancouver, Edmonton, Calgary and others, where he shared invaluable insights on different topics ranging from pentesting Android applications to car hacking.
With all his experience in pentesting and offensive security, we decided to challenge him on the actual value of pentesting programs. Dive right in!
...more
55min
February 01, 2024 Security champion program: A must or completely useless? ⎥Dustin Lehr
Welcome to the Elephant in AppSec, the podcast to explore, challenge, and boldly face the AppSec Elephants in the room.
Today, we're joined by an amazing guest, Dustin Lehr.
You can find Dustin on LinkedIn: https://www.linkedin.com/in/dustinlehr/
Dustin is an accomplished software engineer turned information security leader, currently serving as Senior Director of Platform Security / Deputy CISO at Fivetran. He possesses an enormous wealth of experience in application security and is a strong community leader, organizing the online meetup 'Let's Talk Software Security,' where everyone passionate about security can join for an open discussion.
Dustin is also the author of the 'Security Champion Program Success Guide,' a valuable resource for organizations and individuals passionate about security, aiming to build or improve their security champion program. He is a strong advocate for its benefits, so we decided to challenge him on whether this program is actually useful. Dive right in to find out the results!
Referenced:
- Let's Talk Software Security! Meet-up: https://www.meetup.com/lets-talk-software-security/
- Security Champion Program Success Guide: https://securitychampionsuccessguide.org/
...more
46min

FAQs about The Elephant in AppSec:

How many episodes does The Elephant in AppSec have?

The podcast currently has 58 episodes available.