Application Security Weekly (Video)

Security Weekly Productions
  • 0.0（0）
  • 技術ニュース
  • アップデート：隔週

About all things AppSec, DevOps, and DevSecOps. Hosted by Mike Shema and John Kinsella, the podcast focuses on helping its audience find and fix software flaws effectively.

  1. Helping Users with Practical Advice to Protect their Digital Devices - Runa Sandvik - ASW #371

    4日前 · ビデオ

    Helping Users with Practical Advice to Protect their Digital Devices - Runa Sandvik - ASW #371

    Journalists put a lot of effort into collecting information and protecting their sources, but everyone can benefit from having a digital environment that's more secure and more privacy protecting. Runa Sandvik shares her experience working with journalists and targeted groups to craft plans for how they use their devices and manage their information. And she also makes the point that the burden of security should not be just for users -- platforms and software providers should be evaluating secure defaults and secure designs that improve protections for everyone. Resources https://techcrunch.com/2025/03/13/apples-lockdown-mode-is-good-for-security-but-its-notifications-are-baffling/ https://www.glitchcat.xyz/p/lessons-learned-from-the-2021-arrest https://gijn.org/resource/introduction-investigative-journalism-digital-security/ https://cpj.org/ Show Notes: https://securityweekly.com/asw-371

    1時間
  2. Conducting Secure Code Analysis with LLMs - ASW #370

    2月17日 · ビデオ

    Conducting Secure Code Analysis with LLMs - ASW #370

    A major premise of appsec is figuring out effective ways to answer the question, "What security flaws are in this code?" The nature of the question doesn't really change depending on who or what wrote the code. In other words, LLMs writing code really just means there's mode code to secure. So, what about using LLMs to find security flaws? Just how effective and efficient are they? We talk with Adrian Sanabria and John Kinsella about the latest appsec articles that show a range of results from finding memory corruption bugs in open source software to spending an inordinate amount of manual effort validating persuasive, but ultimately incorrect, security findings from an LLM. Show Notes: https://securityweekly.com/asw-370

    46分
  3. Bringing Strong Authentication and Granular Authorization for GenAI - Dan Moore - ASW #369

    2月10日 · ビデオ

    Bringing Strong Authentication and Granular Authorization for GenAI - Dan Moore - ASW #369

    When it comes to agents and MCPs, the interesting security discussion isn't that they need strong authentication and authorization, but what that authn/z story should look like, where does it get implemented, and who implements it. Dan Moore shares the useful parallels in securing APIs that should be brought into the world of MCPs -- especially because so many are still interacting with APIs. Resources https://stackoverflow.blog/2026/01/21/is-that-allowed-authentication-and-authorization-in-model-context-protocol/ https://fusionauth.io/articles/identity-basics/authorization-models Show Notes: https://securityweekly.com/asw-369

    1時間9分
  4. Focusing on Proactive Controls in the Face of LLM-Assisted Malware - Rob Allen - ASW #368

    2月3日 · ビデオ

    Focusing on Proactive Controls in the Face of LLM-Assisted Malware - Rob Allen - ASW #368

    Everyone is turning to LLMs to generate code, including attackers. Thus, it's no great surprise that there are now examples of malware generated by LLMs. We discuss the implications of more malware with Rob Allen and what it means for orgs that want to protect themselves from ransomware. Resources https://www.bleepingcomputer.com/news/security/voidlink-cloud-malware-shows-clear-signs-of-being-ai-generated/ https://research.checkpoint.com/2026/voidlink-early-ai-generated-malware-framework/ https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools/ This segment is sponsored by ThreatLocker. Visit https://securityweekly.com/threatlocker to learn more about them! Show Notes: https://securityweekly.com/asw-368

    1時間7分
  5. Building proactive defenses that reflect the true nature of modern software risk - Paul Davis - ASW #367

    1月27日 · ビデオ

    Building proactive defenses that reflect the true nature of modern software risk - Paul Davis - ASW #367

    Supply chain security remains one of the biggest time sinks for appsec teams and developers, even making it onto the latest iteration of the OWASP Top 10 list. Paul Davis joins us to talk about strategies to proactively defend your environment from the different types of attacks that target supply chains and package dependencies. We also discuss how to gain some of the time back by being smarter about how to manage packages and even where the responsibility for managing the security of packages should be. Show Notes: https://securityweekly.com/asw-367

    1時間13分
  6. Lessons from MongoBleed, CWE Top 25, and Secure Coding Benchmarks - ASW #366

    1月20日 · ビデオ

    Lessons from MongoBleed, CWE Top 25, and Secure Coding Benchmarks - ASW #366

    MongoBleed and a recent OWASP CRS bypass show how parsing problems remain a source of security flaws regardless of programming language. We talk with Kalyani Pawar about how these problems rank against the Top 25 CWEs for 2025 and what it means for relying on LLMs to generate code. Show Notes: https://securityweekly.com/asw-366

    44分
  7. Secure By Design Is Better Than Secure By Myth - Bob Lord - ASW #365

    1月13日 · ビデオ

    Secure By Design Is Better Than Secure By Myth - Bob Lord - ASW #365

    Not all infosec advice is helpful. Bad advice wastes time, makes people less secure, and takes focus away from making software more secure. Bob Lord talks about his efforts to tamp down hacklore -- the security myths and mistakes that crop up in news stories and advice to users. He talks about how these myths come about, why they're harmful, and how they're related to the necessity of building software that's secure by design. Segment Resources: https://www.hacklore.org/ https://medium.com/@boblord/lets-stop-hacklore-d5c86a0fdad8 https://www.cisa.gov/securebydesign https://medium.com/@boblord/recurring-classes-of-software-weaknesses-2007-vs-2025-c2cd56125e1a https://www.ncsc.gov.uk/report/a-method-to-assess-forgivable-vs-unforgivable-vulnerabilities https://99percentinvisible.org/episode/nut-behind-wheel/ https://timharford.com/2022/05/cautionary-tales-short-a-screw-loose-at-17000ft/ Show Notes: https://securityweekly.com/asw-365

    54分
  8. The Upsides and Downsides of LLM-Generated Code - Chris Wysopal - ASW #364

    1月6日 · ビデオ

    The Upsides and Downsides of LLM-Generated Code - Chris Wysopal - ASW #364

    Developers are adding LLMs to their code creation toolboxes, using them to assist with writing and reviewing code. Chris Wysopal talks about the security downsides of relying on LLMs and how appsec needs to adapt to dealing with more code at a faster pace. Resources https://www.veracode.com/blog/genai-code-security-report/ https://www.veracode.com/blog/ai-code-security-october-update/ https://www.veracode.com/resources/analyst-reports/2025-genai-code-security-report/ Show Notes: https://securityweekly.com/asw-364

    1時間10分
すべて見る（698）

番組について

About all things AppSec, DevOps, and DevSecOps. Hosted by Mike Shema and John Kinsella, the podcast focuses on helping its audience find and fix software flaws effectively.

情報

  • クリエイター
    Security Weekly Productions
  • 配信期間
    18年 - 26年
  • エピソード
    698
  • 制限指定
    不適切な内容を含まない
  • Copyright
    © 2024 CyberRisk Alliance
  • 番組のWebサイト
    Application Security Weekly (Video)

その他のおすすめ