François Proulx - Arbitrary Code Execution 0-day in Build Pipeline of Popular Open Source Packages

The Application Security Podcast

Player FM - Internet Radio Done Right

54 subscribers

Security

Ditambah seven tahun yang lalu

Kandungan disediakan oleh Chris Romeo and Robert Hurlbut, Chris Romeo, and Robert Hurlbut. Semua kandungan podcast termasuk episod, grafik dan perihalan podcast dimuat naik dan disediakan terus oleh Chris Romeo and Robert Hurlbut, Chris Romeo, and Robert Hurlbut atau rakan kongsi platform podcast mereka. Jika anda percaya seseorang menggunakan karya berhak cipta anda tanpa kebenaran anda, anda boleh mengikuti proses yang digariskan di sini https://ms.player.fm/legal.

On the Bus with Troy Vollhoffer

1
From Backroom Bars to Broadway with Dustin Lynch 36:27

24 days ago36:27

Main Kemudian

Senarai

Suka

Disukai

36:27

Not many artists actually hail from Tennessee, but the scenic valleys and rolling hills of The Volunteer State are part of Dustin Lynch’s DNA. In this episode of On the Bus, Country Thunder CEO Troy Vollhoffer sits down with Dustin to discuss his journey from playing fraternity parties and weddings across the southeast to being the first country artist with a club residency at the Wynn in Las Vegas. Plus, stick around for our new segment, Thunder Strike, where Troy features upcoming festival performer Riley Green’s hit song “Damn Good Day to Leave” to give you a taste of what’s to come at Country Thunder in 2025.…

about a year ago 45:31

MP3•Laman utama episod

Where to find Francois:
LinkedIn
X: @francoisproulx

Previous Episodes:
François Proulx -- Actionable Software Supply Chain Security

FOLLOW OUR SOCIAL MEDIA:

➜Twitter: @AppSecPodcast
➜LinkedIn: The Application Security Podcast
➜YouTube: https://www.youtube.com/@ApplicationSecurityPodcast

Thanks for Listening!

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

309 episod

#Robert Hurlbut #Security #Tech #Software Development #Application Security #Threat Modeling #Security Culture #News #Tech News #Podcasting Education #pChris Romeo And Robert Hurlbut #pChris Romeo #OWASP #DevSecOps #DevOps

The Application Security Podcast

François Proulx - Arbitrary Code Execution 0-day in Build Pipeline of Popular Open Source Packages

The Application Security Podcast

54 subscribers

published about a year ago

Kongsi

MP3•Laman utama episod

Where to find Francois:
LinkedIn
X: @francoisproulx

Previous Episodes:
François Proulx -- Actionable Software Supply Chain Security

FOLLOW OUR SOCIAL MEDIA:

➜Twitter: @AppSecPodcast
➜LinkedIn: The Application Security Podcast
➜YouTube: https://www.youtube.com/@ApplicationSecurityPodcast

Thanks for Listening!

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

309 episod

Semua episod

The Application Security Podcast

1
Javan Rasokat and Andra Lezza -- When Chatbots Go Rogue - Lessons Learned from Building and Defending LLM Applications 47:31

26 days ago47:31

47:31

Andra Lezza and Javan Rasokat discuss the complexities of securing AI and LLM applications. With years of experience in Application Security (AppSec), Andra and Javan share their journey and lessons from their DEF CON talk on building and defending LLMs. They explore critical vulnerabilities, prompt injection, hallucinations, and the importance of data security. This discussion sheds light on the evolving landscape of AI and LLM security, offering practical advice for developers and security professionals alike. Javan’s blog article: Adversarial Misuse of Generative AI Javan’s recommendation for the TLDR newsletter Andra's book recommendation: The Cuckoo’s Egg by Cliff Stoll FOLLOW OUR SOCIAL MEDIA: ➜Twitter: @AppSecPodcast ➜LinkedIn: The Application Security Podcast ➜YouTube: https://www.youtube.com/@ApplicationSecurityPodcast Thanks for Listening! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~…

The Application Security Podcast

1
Jim Routh -- The CISO Transition to the rest of life 49:36

5 weeks ago49:36

49:36

Former CISO Jim Routh discusses his perspective on retirement and career fulfillment in cybersecurity. Rather than viewing retirement as simply stopping work, Routh describes his three-filter approach: working only with people he respects and admires, doing only work he finds fulfilling, and controlling when he works. He shares valuable lessons learned about which post-retirement opportunities truly bring satisfaction and explains why he avoids certain roles. Routh emphasizes the importance of cybersecurity professionals taking ownership of their career development, recommending they focus on developing two specific skills annually rather than using tenure to guide career moves. The article written by Jim, published on LinkedIn: CISO Transition Check out previous episodes with Jim: Jim’s original AppSec podcast episode is our #1 listened to of all time. Jim Routh -- Selling #AppSec Up The Chain And Jim Routh — Secure Software Pipelines FOLLOW OUR SOCIAL MEDIA: ➜Twitter: @AppSecPodcast ➜LinkedIn: The Application Security Podcast ➜YouTube: https://www.youtube.com/@ApplicationSecurityPodcast Thanks for Listening! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~…

The Application Security Podcast

1
Henrik Plate -- OWASP Top 10 Open Source Risks 38:26

6 weeks ago38:26

38:26

Henrik Plate joins us to discuss the OWASP Top 10 Open Source Risks, a guide highlighting critical security and operational challenges in using open source dependencies. The list includes risks like known vulnerabilities, compromised legitimate packages, name confusion attacks, and unmaintained software, providing developers and organizations a framework to assess and mitigate potential threats. Henrik offers insights on how developers and AppSec professionals can implement the guidelines. Our discussion also includes the need for a dedicated open-source risk list, and the importance of addressing known vulnerabilities, unmaintained projects, immature software, and more. The OWASP Top 10 Open Source Risks FOLLOW OUR SOCIAL MEDIA: ➜Twitter: @AppSecPodcast ➜LinkedIn: The Application Security Podcast ➜YouTube: https://www.youtube.com/@ApplicationSecurityPodcast Thanks for Listening! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~…

The Application Security Podcast

1
Tanya Janca -- A Secure SDLC from a Developer's Perspective 48:54

7 weeks ago48:54

48:54

Security expert Tanya Janca discusses her new book "Alice and Bob Learn Secure Coding" and shares insights on making security accessible to developers. In this engaging conversation, she explores how security professionals can better connect with developers through threat modeling, maintaining empathy, and creating inclusive learning environments. Tanya emphasizes the importance of system maintenance after deployment and shares practical advice on input validation, while highlighting how security teams can build better relationships with development teams by avoiding arrogance and embracing collaboration. Tanya’s new book: Alice & Bob Learn Secure Coding Three Individuals that Tanya would like to introduce to you: Confidence Staveley https://confidencestaveley.com/ Rana Khalil https://www.linkedin.com/in/ranakhalil1 Laura Bell Main https://www.laurabellmain.com/ FOLLOW OUR SOCIAL MEDIA: ➜Twitter: @AppSecPodcast ➜LinkedIn: The Application Security Podcast ➜YouTube: https://www.youtube.com/@ApplicationSecurityPodcast Thanks for Listening! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~…

The Application Security Podcast

1
Mehran Koushkebaghi -- Security as a Systemic Concern: How to develop Anti-Requirements 45:08

9 weeks ago45:08

45:08

Mehran Koushkebaghi, a seasoned engineering expert, delves into the intricacies of systemic security. He draws parallels between civil engineering and IT systems, and explains the importance of holistic thinking in security design. Discover the difference between semantic and syntactic vulnerabilities and understand how anti-requirements play a critical role in system resilience. This episode offers fresh perspectives on application security. Books recommended by Mehran: Critical System Thinking Book by Mike Jackson The Fifth Discipline by Peter Senge Understanding Complexity on Audible read by Scott E Page Nassim Taleb books FOLLOW OUR SOCIAL MEDIA: ➜Twitter: @AppSecPodcast ➜LinkedIn: The Application Security Podcast ➜YouTube: https://www.youtube.com/@ApplicationSecurityPodcast Thanks for Listening! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~…

The Application Security Podcast

1
Kalyani Pawar -- Shaping AppSec at Startups 39:52

10 weeks ago39:52

39:52

Kalyani Pawar shares critical strategies for integrating security early and effectively in AppSec for startups. She recommends that startups begin focusing on AppSec around the 30-employee mark, with an ideal ratio of one AppSec professional per 10 engineers as the company grows. Pawar emphasizes the importance of building a security culture through "culture as code" - implementing automated guardrails and checkpoints that make security an integral part of the development process. She advises startups to prioritize visibility into their systems, conduct pentests, develop thoughtful policies, and carefully vet third-party tools and open-source solutions. Ultimately, Pawar's approach is about making security a collaborative, integrated effort that doesn't impede innovation but instead supports the startup's long-term success and safety. Kalyani’s Book recommendation: The Alignment Problem by Brian Christian FOLLOW OUR SOCIAL MEDIA: ➜Twitter: @AppSecPodcast ➜LinkedIn: The Application Security Podcast ➜YouTube: https://www.youtube.com/@ApplicationSecurityPodcast Thanks for Listening! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~…

The Application Security Podcast

1
Milan Williams -- AppSec Metrics 36:16

13 weeks ago36:16

36:16

Milan Williams discusses the importance of application security metrics and how to make them both meaningful and actionable. She explains that metrics are crucial for tracking progress in what can often feel like an overwhelming security landscape, and they're valuable for career advancement and securing resources. We discuss metrics categories and several specific metrics that are good to track. Milan shares important principles on the importance of making metrics actionable through storytelling and relating security impacts to real-world consequences for users. Milan's Book Recommendation: Quiet Influence : The Introvert’s Guide to Making a Difference by Jennifer Kahnweiler FOLLOW OUR SOCIAL MEDIA: ➜Twitter: @AppSecPodcast ➜LinkedIn: The Application Security Podcast ➜YouTube: https://www.youtube.com/@ApplicationSecurityPodcast Thanks for Listening! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~…

The Application Security Podcast

1
MO Sadek -- Building an AppSec Program from Scratch 48:50

14 weeks ago48:50

48:50

Mo Sadek shares his unique journey of building an Application Security program from scratch at Roblox. Mo discusses his unconventional path, including temporarily joining the infrastructure team to truly understand engineering challenges. He emphasizes that security isn't about mandating rules, but about making processes easier and more secure by default. Mo shares his insights on how to build effective cross-team security relationships and approaches for gaining leadership buy-in. Mo's Book Recommendation: I Have No Mouth and I Must Scream by Harlan Ellison FOLLOW OUR SOCIAL MEDIA: ➜Twitter: @AppSecPodcast ➜LinkedIn: The Application Security Podcast ➜YouTube: https://www.youtube.com/@ApplicationSecurityPodcast Thanks for Listening! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~…

The Application Security Podcast

1
Brett Crawley -- Threat Modeling Gameplay with EoP 45:28

18 weeks ago45:28

45:28

Brett Crawley discusses the Elevation of Privilege (EoP) card game, a powerful tool for threat modeling in software development. The discussion explores recent extensions to the game including privacy-focused suits and TRIM (Transfer, Retention/Removal, Inference, Minimization) categories. Crawley emphasizes that threat modeling shouldn't end with the game but should be an ongoing process throughout an application's lifecycle, ideally starting before implementation. He also shares insights from his book, which provides detailed examples and guidance for teams new to threat modeling using EoP. You can find Brett on X @brettcrawley Brett’s book: Threat Modeling Gameplay with EoP: A reference manual for spotting threats in software architecture Book recommendation: Conscious Business by Fred Kofman FOLLOW OUR SOCIAL MEDIA: ➜Twitter: @AppSecPodcast ➜LinkedIn: The Application Security Podcast ➜YouTube: https://www.youtube.com/@ApplicationSecurityPodcast Thanks for Listening! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~…

The Application Security Podcast

1
Matin Mavaddat - Understanding Security as a Systemic Concern: The Role of Anti-Requirements 50:20

22 weeks ago50:20

50:20

Matin Mavaddat discusses his perspective on security as a systemic concern, developed from his background in requirements engineering and systems architecture. He introduces the concept of "anti-requirements" - defining what a system should not do - and distinguishes between "syntactic security" (addressing technical vulnerabilities that are always incorrect) and "semantic security" (context-dependent security emerging from system interactions). Mavaddat shares his perspective that security itself doesn't have independent existence but rather emerges from preventing undesirable states. The discussion concludes with practical implementation strategies, suggesting that while automated tools can handle syntactic security issues, organizations should focus more energy on semantic security by understanding business context and defining anti-requirements early in the development process. Mentioned in this episode: Matin’s article: Reframing Security: Unveiling Power Anti-Requirements Systems Thinking for Curious Managers by Russell Ackoff Antifragile by Nassim Nicholas Taleb The Black Swan by Nassim Nicholas Taleb FOLLOW OUR SOCIAL MEDIA: ➜Twitter: @AppSecPodcast ➜LinkedIn: The Application Security Podcast ➜YouTube: https://www.youtube.com/@ApplicationSecurityPodcast Thanks for Listening! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~…

The Application Security Podcast

1
Kayra Otaner -- DevSecOps 32:46

24 weeks ago32:46

32:46

Kayra Otaner joins the podcast today to discuss DevSecOps and answer the question, is it dead? Kayra is the Director of DevSecOps at Roche and is highly involved in the DevSecOps community. Kayra states that DevSecOps in its traditional form is “dead” and that each organization should approach its needs based on their size. Otaner introduces the concept of "security as code" and "policy as code" as more effective approaches, where security functions are codified rather than relying on traditional documentation and checklists. Finally, they discuss the emergence of Application Security Posture Management (ASPM) tools as the "SIM for AppSec," suggesting these tools, especially when enhanced with AI, could help manage the overwhelming number of security alerts and issues that currently plague development teams. Mentioned in this Episode: Books by Yuval Noah Harari FOLLOW OUR SOCIAL MEDIA: ➜Twitter: @AppSecPodcast ➜LinkedIn: The Application Security Podcast ➜YouTube: https://www.youtube.com/@ApplicationSecurityPodcast Thanks for Listening! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~…

The Application Security Podcast

1
François Proulx - Arbitrary Code Execution 0-day in Build Pipeline of Popular Open Source Packages 45:31

25 weeks ago45:31

45:31

François Proulx shares his discovery of security vulnerabilities in build pipelines. Francois has found that attackers can exploit this often overlooked side of the software supply chain. To help address this, his team developed an open source scanner called Poutine that can identify vulnerable build pipelines at scale and provide remediation guidance. Francois has over 10 years of experience in building application security programs, he’s also the founder of the NorthSec conference in Montreal. Mentioned in the Episode: Cooking for Geeks by Jeff Potter Poutine Living Off the Pipeline project Grand Theft Actions Abusing Self Hosted GitHub Runners - Adnan Khan and John Stawinski Where to find Francois: LinkedIn X: @francoisproulx Previous Episodes: François Proulx -- Actionable Software Supply Chain Security FOLLOW OUR SOCIAL MEDIA: ➜Twitter: @AppSecPodcast ➜LinkedIn: The Application Security Podcast ➜YouTube: https://www.youtube.com/@ApplicationSecurityPodcast Thanks for Listening! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~…

The Application Security Podcast

1
Steve Wilson -- The Developer's Playbook for Large Language Model Security: Building Secure AI Applications 36:32

28 weeks ago36:32

36:32

Steve Wilson, the author of 'The Developer's Playbook for Large Language Model Security’ is back to dive into topics from his book like AI hallucinations, trust, and the future of AI. Steve has been at the forefront of the explosion of activity at the intersection of AppSec, LLM, and AI. We discuss the biggest fears surrounding LLMs and AI, and explore advanced concepts like Retrieval Augmented Generation and prompt injection. Links: The Developer’s Playbook for Large Language Model Security by Steve Wilson Find Steve on LinkedIn Previous Episodes: Steve Wilson -- OWASP Top Ten for LLMs Steve Wilson and Gavin Klondike -- OWASP Top Ten for LLM Applications Release Two people Steve recommends you look up: Chris Voss , Former FBI Negotiator and author of “Never Split the Difference” Arshan Dabirsiaghi FOLLOW OUR SOCIAL MEDIA: ➜Twitter: @AppSecPodcast ➜LinkedIn: The Application Security Podcast ➜YouTube: https://www.youtube.com/@ApplicationSecurityPodcast Thanks for Listening! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~…

The Application Security Podcast

1
Jeff Williams -- Application Detection & Response (ADR) 51:28

29 weeks ago51:28

51:28

Jeff Williams, a renowned pioneer in the field of application security is with us to discuss Application Detection and Response (ADR), detailing its potential to revolutionize security in production environments. Jeff shares stories from his career, including the founding of OWASP, and his take on security assurance. We cover many topics including; security assurance, life, basketball and plenty of AppSec as well. Where to find Jeff: LinkedIn: https://www.linkedin.com/in/planetlevel/ Previous Episodes: Jeff Williams – The Tech of Runtime Security Jeff Williams – The History of OWASP FOLLOW OUR SOCIAL MEDIA: ➜Twitter: @AppSecPodcast ➜LinkedIn: The Application Security Podcast ➜YouTube: https://www.youtube.com/@ApplicationSecurityPodcast Thanks for Listening! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~…

The Application Security Podcast

1
Phillip Wylie -- Pen Testing from Somebody who Knows about Pen Testing 52:08

30 weeks ago52:08

52:08

Philip Wiley shares his unique journey from professional wrestling to being a renowned pen tester. We define pen testing and the role of social engineering in ethical hacking. We talk tools of the trade, share a favorite web app pentest hack and offer good advice on starting a career in cybersecurity. Philip shares some insights from his book, ‘The Pentester Blueprint: Starting a Career as an Ethical Hacker.’ And we discuss the impact of AI on pen testing and where this field is headed in the next few years. The Pentester Blueprint Starting a Career as an Ethical Hacker written by Phillip Wylie The Web Application Hacker’s Handbook written by Dafydd Stuttard, Marcus Pinto Where to find Phillip: Website: https://thehackermaker.com/ Podcast: https://phillipwylieshow.com/ X: https://x.com/PhillipWylie LinkedIn: https://www.linkedin.com/in/phillipwylie/ FOLLOW OUR SOCIAL MEDIA: ➜Twitter: @AppSecPodcast ➜LinkedIn: The Application Security Podcast ➜YouTube: https://www.youtube.com/@ApplicationSecurityPodcast Thanks for Listening! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~…

Selamat datang ke Player FM

Player FM mengimbas laman-laman web bagi podcast berkualiti tinggi untuk anda nikmati sekarang. Ia merupakan aplikasi podcast terbaik dan berfungsi untuk Android, iPhone, dan web. Daftar untuk melaraskan langganan merentasi peranti.