The OWASP Podcast Series The OWASP Podcast Series

After getting a ping from an old friend about a potential new OWASP project, I had to bring him on as a guest. He's got an interesting idea around potential vulnerabilities in web crawlers which just happen to gather data for so many AI system. We talk about that, Cybersecurity and Government and so much more.

Show Links:

- LinkedIn https://www.linkedin.com/in/buanzo/
- Github https://www.linkedin.com/in/buanzo/

For years we've heard talk about a shortage of cybersecurity professionals so what can be done about that? In this episode, I speak to Brad Causey who has taken one approach he's found successful. We cover the trade-offs of his approach and how, should you agree with him, you can help fill those troubling vacancies at your company.

Show Links:

- SecurIT360 https://securit360.com/
- Offensive Security Blog https://offsec.blog/

In this episode we talk with Zain Haq and take a leap and bound over the first and second line to discover more about the third line - internal audit. We discover answers to a number of questions: What role does audit play in the overall cybersecurity of an organization? What does the CISO gain from having an audit function? What makes a good auditor? Learn how to get the most out of audit and what they bring to the table. Special thanks to Tina Turner for inspiring the show title. ;-)

Show Links:

- Zain Haq: https://www.linkedin.com/in/zainhaq25/

Software supply chain seems to be front and center for technologists, cybersecurity and many governments. One of the early pioneers in this space was Steve Springett with two highly successful projects: OWASP Dependency Track and CycloneDX. In this episode, we catch up with Steve to talk about how he got started in software supply chain management as well as the explosive growth for Dependency Track and ClycloneDX. We also touch on future developments for CycloneDX and places where Steve never expected to see his projects go. Enjoy!

Show Links:

- OWASP Dependency Track: https://dependencytrack.org/
- Dependency Track Github: https://github.com/DependencyTrack
- CycloneDX: https://cyclonedx.org/
- CycloneDX Github: https://github.com/CycloneDX
- Software Component Verification Standard: https://scvs.owasp.org/
Social Media links:
- https://twitter.com/stevespringett
- https://infosec.exchange/@stevespringett
- https://www.linkedin.com/in/stevespringett/

In this episode I speak with Jerry Hoff who provides some very interesting perspective on application security especially at scale and from a high level view like that of a CISO. Even if you're not in a senior leadership position, you're likely to be reporting to one. Understanding that point of view can help you successfully frame your work and accomplish your goals. We touch on multiple topics and have some great back and forth that I'm sure will entertain and inform you. Enjoy!

WAFs have been with us a while and it's about time someone reconsidered WAFs and their role in AppSec given the cloud-native and Kubernetes landscape. The OWASP Coraza is not only asking these questions but putting some Go code behind their ideas. Should WAFs work in a mesh network? Why create an open source WAF? What's next for the OWASP Coraza project? These and more topics are covered in this episode. I had a great time recording it and I think you'll have the same while listening.

Show Link:
- Coraza Website: https://coraza.io/
- Coraza Github Repo: https://github.com/corazawaf/coraza
- Coraza Twitter: https://twitter.com/corazaio
- AppSec EU 2023 presentation on Coraza - https://www.youtube.com/watch?v=S_TtvDFmia4