The Elephant in AppSec

The Elephant in AppSec

Time to discuss AppSec issues no one talks about.

  1. The Pressure of Security Leadership: What SLAs Actually Work? with Terry O'Daniel

    1 दिन पहले

    The Pressure of Security Leadership: What SLAs Actually Work? with Terry O'Daniel

    Today, I’m excited to be joined by Terry O’Daniel, former global head of security at Amplitude, Instacart, and Netflix, and a trusted advisor in the security space. Terry thrives in high-growth environments and loves tackling complex challenges. With a strong background in engineering and security, he builds teams that focus on solving security problems at scale through automation and instrumentation. Terry is also a frequent public speaker and passionate advocate for product security. And recently, he joined Harvard as the Head TA for Security Lifecycle Threats. In this episode, we break down how SLAs enforce real accountability, why security leaders are constantly under pressure, and why ignoring identity and data structures is a recipe for failure.  We also discuss how operating under pressure can surprisingly lead to better decision-making and what the future of product security will look like. Dive right in!

    44 मिनट
  2. Can We Make AI Agents Smarter Than Security Teams? with Anshuman Bhartiya

    25 सित॰

    Can We Make AI Agents Smarter Than Security Teams? with Anshuman Bhartiya

    Today, I’m excited to welcome Anshuman Bhartiya, an AppSec tech lead at Lyft. Before that, he worked as a security engineer at companies like Thirty Madison, Intuit, and Atlassian. Anshuman is also a fellow podcaster and co-host of the Boring AppSec podcast, alongside one of my previous guests, Sandesh Mysore Anand. Recently, he’s been experimenting extensively with building AI agents for both offensive and defensive security, and he’s documenting his findings at anshumanbhartiya.com(link in the description). In this episode, we dive into the challenges of building effective AI agents, the impact of AI on security practices, and the importance of understanding AI outputs and avoiding confirmation bias. We also touch on the ongoing debate of build versus buy solutions and explore where the future of AI in security might be headed. Dive right in!

    33 मिनट
  3. Why DevSecOps isn't enough without deep cloud context with Anjali Singh Shukla

    24 सित॰

    Why DevSecOps isn't enough without deep cloud context with Anjali Singh Shukla

    Today I’m joined by Anjali Singh Shukla, Senior Security Engineer Cloud at Flipkart. She bridges the worlds of Cloud Security and DevSecOps, having led audits and defense strategies across AWS, Azure, and GCP, with a strong focus on Kubernetes and container security. Beyond building secure pipelines, Anjali designs training programs and speaks at global conferences like Black Hat and OWASP. Most recently at OWASP AppSec Days Singapore, she showed how attackers exploit AWS EKS misconfigurations and how to defend against them. In this episode, we dive into why DevSecOps alone isn’t enough without a deep understanding of cloud, and the risks that come with moving fast in modern deployments. Anjali also shares her perspective on securing multi-cloud environments and weighs in on the industry’s buzz around CNAPP and CSPM and ASPM convergence. And with that, get ready to hear Anjali’s opinions.

    33 मिनट
  4. Decoding a Healthy Security Program: What Does "Healthy" Even Mean? with Maxwell Zhou

    18 सित॰

    Decoding a Healthy Security Program: What Does "Healthy" Even Mean? with Maxwell Zhou

    Today, I’m joined by Maxwell Zhou, the Founding Partner of PolarStar Cybersecurity Group, a cybersecurity firm focused on helping fintech organizations strengthen their product security. Throughout his career at Greenlight, Visa, and T-Mobile, Maxwell has specialized in penetration testing, vulnerability assessments, and secure coding practices. He’s particularly excited about building world-class security programs that scale with hyper-growth organizations.In this episode, we discuss one of Maxwell’s articles on the traits of healthy security programs, diving into what “healthy” really means. We also explore the concept of security debt, how it can lead to increased incidents over time, and the importance of having a pentesting background when it comes to understanding which vulnerabilities truly matter.Dive right in!

    41 मिनट
  5. Why SAP Security Can be a Hidden Weakness for Enterprises with Oumaima Baira

    12 सित॰

    Why SAP Security Can be a Hidden Weakness for Enterprises with Oumaima Baira

    Today, I’m joined by Oumaima Baira, Directrice of Enterprise Security at Deloitte. With nearly a decade of experience, she’s helped organizations strengthen their defenses — from DevSecOps and SAP application security to enterprise-wide security strategy. She began her career in cloud engineering before moving into cyber consulting, and quickly rose through Deloitte’s leadership ranks, blending deep technical expertise with strategic vision. Beyond her professional roles, Oumaima is an active member of the cybersecurity community. She often takes part in OWASP France chapter meetups, where we met, and international OWASP and cyber events, sharing insights and learning from peers. She’s also a passionate advocate for women in cybersecurity, inspiring the next generation of cyber leaders to step confidently into the field. In this episode, we explore the unique challenges and security risks of SAP systems — a business management and automation platform relied on by countless global organizations. We discuss why understanding business logic is critical to application security, and why this is especially important when it comes to securing SAP. Oumaima also shares her perspective on global differences in security maturity and offers practical advice on preparing for crisis management with efficiency. Dive right in!

    37 मिनट
  6. Latin America’s AppSec Culture: What’s Lost (and Found) in Translation?

    5 सित॰

    Latin America’s AppSec Culture: What’s Lost (and Found) in Translation?

    Today, I’m joined by Max Alejandro Gómez-Sánchez Vergaray, Defensive Cybersecurity Manager at Banco de Crédito BCP. With a background in software engineering, Max transitioned into AppSec and has become a leading voice in promoting DevSecOps awareness and building robust AppSec programs using SAMM across Latin America and beyond. He actively contributes to OWASP projects like Cornucopia and regularly offers free workshops in Spanish on secure design for digital products. If you’d like to join a future session, check out the link below!In this episode, we dive into AppSec in Latin America, with a focus on Peru’s unique cybercrime laws and their impact on security awareness. Max shares insights on the cultural challenges in cybersecurity training, the complexities of translating frameworks like Cornucopia, and what can get lost in translation. We also explore building connections in remote teams and what global developers can learn from Latin America’s approach. Dive right in!

    37 मिनट
  7. OWASP SAMM vs BSIMM: Which Maturity Model Reigns Supreme?

    27 अग॰

    OWASP SAMM vs BSIMM: Which Maturity Model Reigns Supreme?

    Today, I'm joined by Nariman Aga-Tagiyev, a seasoned cybersecurity architect and threat modeling coach, bringing over two decades of experience in the software development industry.  As the founder of SecureHabits, he’s on a mission to help software manufacturers mature their secure software development lifecycle. Nariman is a familiar face at OWASP Netherlands Chapter events and an active contributor to projects like OWASP SAMM and the Security Champions Maturity Model. His work bridges the gap between theory and practice, empowering teams to build security into their culture - not just their code. In this episode, we dive into a memorable "battle" Nariman had at the RSA conference, where he argued both sides of the SAMM vs. BSIMM debate—mostly with himself, after BSIMM expert Caroline Wong couldn’t attend.  We also explore why organizations often skip the foundational steps before rushing to buy security tools, why true maturity is so rare, and what the new regulatory frameworks like the Cyber Resilience Act mean for businesses in the EU. Dive right in!

    46 मिनट
  8. Security Culture: When Are We Really Creating Change? with Marisa Fagan

    21 अग॰

    Security Culture: When Are We Really Creating Change? with Marisa Fagan

    Today, I'm joined by Marisa Fagan, a lifelong community builder and security culture enthusiast. As the Head of Product at Katilyst, Marisa leads the development of security champion programs that empower Security Champions to drive cultural change. Previously, she served as Head of Trust Culture & Training at Atlassian and has managed security programs at Synopsys, Salesforce, and Meta. Marisa is also an active contributor to the OWASP Security Champions guide. In this episode, we'll dive into some of the questions Marisa didn’t have time to cover in her talk at BSides San Francisco.  We'll also explore how security culture programs must be tailored to different teams to succeed, how to reboot struggling programs (often caused by disengaging training content) and why passion often outweighs technical skills for roles like these. Dive right in! And check out: https://www.katilyst.com/top10blunders

    35 मिनट
सभी देखें (77)

ट्रेलर

परिचय

Time to discuss AppSec issues no one talks about.

जानकारी

  • निर्माता
    The Elephant in AppSec
  • सक्रिय वर्ष
    2024 - 2025
  • एपिसोड
    77
  • रेटिंग
    श्लील
  • कॉपीराइट
    © The Elephant in AppSec
  • कार्यक्रम की वेबसाइट
    The Elephant in AppSec