Episodes

  • Episode 265 - w/ Scott Norberg - Static Analysis

    Episode 265 - w/ Scott Norberg - Static Analysis
    Oct 29 2024
    Scott Norberg joins Ken Johnson and Seth Law for an episode of Absolute AppSec all about SAST. Scott is an ASP.NET Security Consultant, Author, Researcher and Speaker. In addition to running his Opperis Technologies consultancy, Scott has recently begun working as lead application security architect at CDW. Before that he worked as Lead Application Security engineer at Gallagher and was a Senior Consultant with the AppSec team at Coalfire. He has been a web security specialist for nearly two decades, and holds several certifications, including Microsoft Certified Technology Specialist (MCTS), certifications for ASP.NET and SQL Server, and a Certified Information Systems Security Professional (CISSP) and CCSP certification. He also has an MBA from Indiana University. To find out more about Scott check out his website https://scottnorberg.com/ as well as his 2020 book Advanced ASP NET Core Security Vulnerabilities.
    Show More Show Less
    Less than 1 minute
  • Episode 264 - w/ Jeremy Long - Software Composition Analysis

    Episode 264 - w/ Jeremy Long - Software Composition Analysis
    Oct 17 2024
    Jeremy Long (@ctxt on social media), Principal Security Engineer at Service Now and project founder and lead for the OWASP Dependency Check project joins Ken Johnson (@cktricky) and Seth Law (@sethlaw). Jeremy spent a decade and a half as a lead application security engineer and principal engineer at Wells Fargo before joining ServiceNow. He has spent years developing processes for automated security analysis of software libraries and techniques for improving real-time application protection (RTAP) systems. Make sure to set time aside for a discussion on Jeremy's insights into improving security systems through dependency analysis and managing industry projects.
    Show More Show Less
    Less than 1 minute
  • Episode 263 - WebApp Fuzzing, Mobile Testing, Secrets Management

    Episode 263 - WebApp Fuzzing, Mobile Testing, Secrets Management
    Oct 8 2024
    Ken and Seth return for Episode #263 and start with a discussion around web application fuzzing and the deficiencies of vulnerability and exploit-focused dynamic testing, a common thread in Seth's ranting. This is followed by a discussion on mobile testing and attempting to control security through client-side controls, spurred by an article that compares security in the McDonald's Android app to various banking apps. The final topic is around secrets management and use of the dotenv (.env) file for storing secrets.
    Show More Show Less
    Less than 1 minute
  • Episode 262 - w/ Ariel Shin - Building a Security Program

    Episode 262 - w/ Ariel Shin - Building a Security Program
    Sep 30 2024
    Ariel Shin joins Ken Johnson (@cktricky on social media) and Seth Law (@sethlaw) for a special episode of Absolute AppSec. Ariel is currently a Security Engineering Manager at Datadog after a three-year stint at Twilio where she worked as an engineering manager in product security, a product security team lead, and a senior product security engineer. This year at Bsides SF 2024, she presented on her time at Twilio in a retrospective talk entitled “Six Years in Review: Transforming Company Culture to Embrace Risk.” The video from Bsides SF can be found here: https://www.youtube.com/watch?v=cQE1OqCpeI8. Before Twilio, Ariel worked at one medical as an appsec engineer as well as spending time as a Technology and Privacy consultant with Protiviti. She also helps build the professional appsec and prodsec communities as a frequent commenter and presenter at security conferences.
    Show More Show Less
    Less than 1 minute
  • Episode 261 - Security Economy, Password Resets, Vendor Consolidation

    Episode 261 - Security Economy, Password Resets, Vendor Consolidation
    Sep 25 2024
    Ken (@cktricky) and Seth (@sethlaw) are back to review this weeks news and commiserate about industry happenings. First up are their thoughts on the current economic climate and how it has affected the security industry over the last 5 years. This is followed with evolving nature of password reset requirements as frequent changes are not recommended by NIST. The duo digs into possible motives for Checkmarx's recent announcement that they are funding ZAP. Finally, some thoughts on domain takeovers.
    Show More Show Less
    Less than 1 minute
  • Episode 260 w/ Darren Meyer of Endor Labs - Dependency Management

    Episode 260 w/ Darren Meyer of Endor Labs - Dependency Management
    Sep 20 2024
    Absolute AppSec welcomes Darren Meyer (@DarrenPMeyer on infosec.exchange and X platform) from Endor Labs as a guest on the show to discuss Endor Lab’s newly released 2024 Dependency Management Report. Implementation of reachability analysis as a sine qua non of effective dependency management is one of the top-line takeaways from the newly released report. The discussion dives deeper with Darren during the livestream to talk about useful lessons from the report's findings.
    Show More Show Less
    Less than 1 minute
  • Episode 259 - Special Melbourne Australia Edition w/Paul McCarty and Daniel Ting

    Episode 259 - Special Melbourne Australia Edition w/Paul McCarty and Daniel Ting
    Sep 12 2024
    Seth and Ken take the podcast global this week while traveling to Melbourne, Australia. The duo is joined this episode are joined by Paul McCarty and Daniel Ting, both involved in the local application security community. The discussion starts with a comparison of industries in Australia and the United States, both differences and similarities. This is followed by thoughts on security software supply chain, from a red and blue team perspective. Finally, some thoughts on community changes due to the pandemic and supporting local meetups.
    Show More Show Less
    Less than 1 minute
  • Episode 258 - Engaging Developers, ALBeast, Dangerous TLDs

    Episode 258 - Engaging Developers, ALBeast, Dangerous TLDs
    Sep 3 2024
    Seth (@sethlaw) and Ken (@cktricky) are back this week with some hot takes on the recent cancellation of OWASP's San Francisco Developer Days that were running alongside Global AppSec San Francisco. OWASP has struggled to engage the development community over the years and this is no surprise for anyone in AppSec/ProdSec. This is followed by review of the ALBeast (why do all vulnerabilities have to be branded?) and how our past selves were correct in identifying dangerous TLDs as being exploitable.
    Show More Show Less
    Less than 1 minute