Application Security Weekly (Video)

Mike Shema
  • 0.0 (0)
  • 科技新聞
  • 每兩星期更新

About all things AppSec, DevOps, and DevSecOps. Hosted by Mike Shema and John Kinsella, the podcast focuses on helping its audience find and fix software flaws effectively.

  1. 2日前 ·  影片

    Applying Zero Trust Principles to Agents - Kieran Human - ASW #397

    Sandboxing, least privilege, and monitoring are well-established controls in terms of the defenses they provide against unexpected and unauthorized actions. But being well-established in theory doesn't always translate to successful in practice. Kieran Human talks about some of the properties that a good sandbox should have and how monitoring creates a feedback loop to refine allow lists and access controls. In practice, the potential unpredictable behavior of an agent isn't much different from malware. We talk through some of the ways orgs can securely deploy agents without unnecessarily increasing their attack surface. Resources https://www.threatlocker.com/blog/the-principle-of-least-privilege-for-ai-agents https://www.threatlocker.com/blog/applying-threatlocker-to-agentic-ai-tools https://www.threatlocker.com/blog/why-the-five-eyes-alliance-sees-zero-trust-as-the-best-defense-against-agentic-ai-threats This interview is sponsored by ThreatLocker. Visit https://securityweekly.com/threatlocker to learn more about them! Show Notes: https://securityweekly.com/asw-397

    Applying Zero Trust Principles to Agents - Kieran Human - ASW #397

  2. 8月18日 ·  影片

    Augmenting Threat Intel Analysis with Agents - Sai Kiran Uppu, Chris Wallis, Ramin Farassat - ASW #396

    All sorts of cybersecurity disciplines are adopting agents to help humans save time and automate routine activities. Sai Kiran Uppu describes his work on creating a platform for agents to analyze external threat intel, examine internal systems, and present triage decisions to operators. This type of work is especially useful to orgs that deal with petabytes of data and thousands of systems. And, as Kiran notes, it's important to keep that scale from blowing up your budget or turning triage into a procession of false positives. Ideally, this kind of threat intel that's paying attention to attack trends and searching internal systems for evidence of compromise also turns into proactive defenses. We talk about some of the ways to engage developers to improve security visibility into their services and harden their designs against common attacks. After that discussion we're running two sponsored interviews from Black Hat. AI Pentesting and the Future of Cybersecurity: Black Hat interview with Chris Wallis, Founder and CEO of Intruder This segment discusses how AI addresses the long-standing gap between traditional pentesting and automated vulnerability scanning. Intruder CEO and founder Chris Wallis dives into the nuances of AI-enabled security and how these offerings will impact mid-market security teams. Segment Resources: https://www.intruder.io/platform/ai-pentesting https://www.intruder.io/blog/ai-pentesting-the-depth-of-a-pentest-on-demand https://www.intruder.io/blog/ai-web-app-pentesting-test-on-every-major-release Intruder's continuous exposure management platform helps security, IT, and engineering teams stop breaches before they start. For more information about Intruder's products and services, please visit https://securityweekly.com/intruderbh. How Menlo Security Is Securing AI Agents from Prompt Injection: Black Hat Interview with Ramin Farassat, Chief Product Officer of Menlo Enterprises are deploying AI agents like Microsoft Copilot, Google Gemini, and Claude Code faster than they can secure them, and attackers are exploiting that gap through prompt injection. Hidden instructions get buried in web pages, files, and even images that a human would never notice but an AI agent reads and acts on. Menlo Security is building Menlo Agent Runtime Security (MARS) to close that gap, running every agent session in an isolated cloud that sanitizes content before an agent can act on it. Ramin Farassat, Menlo Security's Chief Product Officer, will discuss why the exposure lives in the connectors and integrations around the model rather than the model itself, and how security teams can put controls on the agent attack surface without blocking agentic AI outright. Segment Resources: https://www.menlosecurity.com/product/ai-agent-security MARS is now available today, please visit https://securityweekly.com/menlobh Show Notes: https://securityweekly.com/asw-396

    Augmenting Threat Intel Analysis with Agents - Sai Kiran Uppu, Chris Wallis, Ramin Farassat - ASW #396

  3. 8月11日 ·  影片

    Using LLMs for Vuln Discovery - Rishi Sharma - ASW #395

    Finding flaws has always been a focus of appsec. And now with open source projects and open weight models orgs have modern tools to review code and conduct pentests. Rishi Sharma describes the motivation behind creating a platform of LLM-driven security tools and the effective ways to keep the tools in scope, on budget, and for engineering teams. We talk about how prompts influence LLM activity, as well as the external constraints to keep the LLMs on task. And even if finding flaws is a major focus of appsec, its goal should be delivering secure software and systems. We touch on some of the ways to keep bugs from creeping back into software and why it's more important to care about vuln classes than vuln counts. Episode Resources: https://projectdiscovery.io/research/ai-coding-impact-report https://projectdiscovery.io/blog/oh-my-rogue-agent Show Notes: https://securityweekly.com/asw-395

    Using LLMs for Vuln Discovery - Rishi Sharma - ASW #395

  4. 8月4日 ·  影片

    Prompting for Patches That Fix Vulns Without Adding New Ones - Keith Hoodlet - ASW #394

    There's already an increase in volume of security flaws found by LLMs. And orgs are already turning to LLMs to write code. So, what happens when orgs lean on LLMs to create patches for those security flaws? Keith Hoodlet gives an exclusive early look at his team's recent research into the success, quality, and failures of LLM-generated security patches. Notably, they saw scenarios across a spectrum from robust, effective patches to patches that changed the software's behavior to patches that introduced new vulns to patches that didn't even fix the original vuln while also introducing a new vuln. The research considers factors like quality and correctness of prompts, complexity of the target software, programming language, and expertise required to understand what a robust patch should look like. If you're going to spend tokens on fixing security flaws, you want a feedback loop that fixes them correctly -- not an infinite loop of new flaws creeping in with every LLM iteration. Watch for this research, its toolset, and data to be released on Thursday August 6th during Black Hat. Show Notes: https://securityweekly.com/asw-394

    Prompting for Patches That Fix Vulns Without Adding New Ones - Keith Hoodlet - ASW #394

  5. 7月28日 ·  影片

    Inside the OWASP Agent Security Regression Harness Project - Mert Satilmaz - ASW #393

    Orgs need to be able to use agents, MCPs, and LLMs in ways that don't lead to unexpected actions and undesirable outcomes. The OWASP Agent Security Regression Harness project is an approach for defining customizable scenarios and testing whether those systems fail against known security threats. Mert Saltimaz talks about the background of the project, how orgs can use it as they bring more LLMs into their environment, and how the project intends to grow. Importantly, we also talk about the security controls and designs that orgs can build around the systems and data that models interact with in addition to evaluating the security of the agents and agent harnesses themselves. Segment Resources: https://github.com/OWASP/Agent-Security-Regression-Harness https://youtu.be/6DWs5EwbFQ0?si=r0IJ_F0SZnkPzzYg -- "What Trading Systems Taught Me About Breaking (And Defending) Infrastructure" Show Notes: https://securityweekly.com/asw-393

    Inside the OWASP Agent Security Regression Harness Project - Mert Satilmaz - ASW #393

  6. 7月21日 ·  影片

    MacOS Security Design Features, Flaws, And Futures - Patrick Wardle - ASW #392

    Appsec often frames usability and security as at odds with each other. Apple's software has famously emphasized the importance of usability while also creating a solid security foundation. Patrick Wardle talks about how he's seen malware shift from Windows to macOS, how Apple's aggressive stance on deprecation benefits security, and the areas of the OS where he still sees plenty of opportunity for more security research. We discuss how developers make defensible design choices, why privacy needs security, and some security principles that any app developer should keep in mind regardless of their programming language or operating system. Resources: https://objective-see.org/blog/blog_0x86.html https://objective-see.org/products/lulu.html https://objectivebythesea.org/v9/index.html Show Notes: https://securityweekly.com/asw-392

    MacOS Security Design Features, Flaws, And Futures - Patrick Wardle - ASW #392

  7. 7月14日 ·  影片

    Discovering & Securing Your AI Agent Attack Surface - Jeremy Snyder - ASW #391

    While LLMs and agents are new to appsec and everyone else, a lot of AI security requirements translate to well-known API security requirements. Jeremy Snyder helps us frame the OWASP LLM Top 10 into five layers in order to help orgs understand and prioritize their attack surface. A lot of orgs don't have to deal with model-specific threats or building their own GPU architecture, but every org adopting LLMs and agents should be aware of how those agents are being invoked and the output those agents are producing. That awareness of input and output helps in identifying and mitigating prompt injection attacks, ensuring agents are working within their expected boundaries, and taming token budgets. Resources: https://genai.owasp.org/llm-top-10/ https://github.com/rtk-ai/rtk https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-caching.html https://www.firetail.ai/blog/beyond-the-spectacle-rsac-2026-and-the-5-layers-of-ai-security Show Notes: https://securityweekly.com/asw-391

    Discovering & Securing Your AI Agent Attack Surface - Jeremy Snyder - ASW #391

  8. 7月7日 ·  影片

    Defense-in-depth strategies for securing mobile applications - Ryan Lloyd - ASW #390

    Mobile applications have unique risks and threat models compared to server-side applications and infrastructure. Consequently, they need different strategies to ensure their business logic and workflows well secured. We'll dive into some of these defense-in-depth strategies and why they are important to mobile applications. Securing workflows goes beyond input validation and pattern matching suspicious payloads; it requires detailed attention to state machines, edge cases, and collecting signals to evaluate trust. Segment Resources: https://hubs.la/Q04jLKj70 https://mas.owasp.org/MASTG/0x04c-Tampering-and-Reverse-Engineering/ https://owasp.org/API-Security/editions/2023/en/0x00-header/ This segment is sponsored by Guardsquare. Visit https://securityweekly.com/guardsquare to learn more about them! Show Notes: https://securityweekly.com/asw-390

    Defense-in-depth strategies for securing mobile applications - Ryan Lloyd - ASW #390
查看全部 (724)

關於

About all things AppSec, DevOps, and DevSecOps. Hosted by Mike Shema and John Kinsella, the podcast focuses on helping its audience find and fix software flaws effectively.

資料

你可能也會喜歡