Dev Academy

•

Canal • 2 podcasts

Tecnologia

Tecnologia

Semanal
Tecnologia

Tecnologia

Diário

07/06/2024

Special episode: How Alex became Security-oriented developer

Join the program until 13.06.2024: https://dev-academy.com/web-security/?ref=podcast

07/06/2024

•

7min
22/03/2024

OWASP Top 10 and Beyond: Expert Discussion with Randall Degges

Web Security Dev Academy WAITING LIST: http://links.dev-academy.com/c07 Secure your spot and receive exclusive bonuses 🎉 In this episode, we're honored to have Randall Degges, a renowned expert in the field of web security, explore the intricacies of the OWASP Top 10 and what lies beyond. Episode Highlights: Randall's Journey: Dive into Randall's extensive experience in the tech industry and his pivotal contributions to web security. OWASP Top 10 Explained: Understand the core of the OWASP Top 10 vulnerabilities, why they are critical for developers to know, and how they evolve over time. Emerging Threats: Discover the latest threats in web security, with insights into how professionals can stay ahead of the curve. SAST and SCA: Learn about the significance of Static Application Security Testing (SAST) and Software Composition Analysis (SCA) in identifying and mitigating security risks. Generative AI vs. Symbolic AI: Engage in a thought-provoking discussion on the applications and implications of generative AI (LLMs) and symbolic AI in web security. Practical Tips: Gain actionable advice on enhancing security measures and integrating effective practices into your development workflow. Why You Should Listen: Whether you're a seasoned developer, an aspiring tech enthusiast, or simply keen on understanding the latest trends in web security, this episode offers valuable insights and knowledge that can help elevate your understanding and application of web security principles. Connect with Us: Bartosz: - https://github.com/bartosz-io - https://twitter.com/bartosz_io - https://www.linkedin.com/in/bpietrucha Randall: - https://github.com/rdegges - https://mastodon.green/@rdegges - https://www.linkedin.com/in/rdegges Thank you for tuning in to the Dev Academy Podcast. Enhance your web security insight with us as we explore the fascinating world of technology with industry experts. #OWASPTop10 #WebSecurity #DevAcademyPodcast #RandallDegges #TechPodcast

22/03/2024

•

1h10min
29/03/2024

Unveiling Web App Security: Pen Testing, Vulnerabilities & More With Adrian Tiron

Web Security Dev Academy WAITING LIST: http://links.dev-academy.com/w3y Secure your spot and receive exclusive bonuses 🎉 Join cybersecurity expert Adrian Tiron in a captivating dive into web application security on our latest podcast episode hosted by Bartosz from Dev Academy. Adrian, the mastermind behind uncovering a critical vulnerability in Concrete CMS, shares his journey through the challenging world of pen testing and secure coding. This episode is a treasure trove for anyone interested in the behind-the-scenes of web vulnerabilities and the strategies to mitigate them. Highlighting his discovery of a remote code execution flaw in Concrete CMS, Adrian offers a masterclass on identifying and exploiting web app vulnerabilities. This discussion is not just technical—it's a call to action for developers and cybersecurity enthusiasts to prioritize security in their projects. Whether you're a developer, an aspiring cybersecurity professional, or just fascinated by web security, this episode promises to enlighten and inspire. Dive into the essentials of protecting web applications with one of the industry's best. Connect with Us: Bartosz: https://github.com/bartosz-io https://twitter.com/bartosz_io https://www.linkedin.com/in/bpietrucha Adrian: https://www.linkedin.com/in/tironadrian/ Thank you for tuning in to the Dev Academy Podcast. Enhance your web security insight with us as we explore the fascinating world of technology with industry experts. #WebSecurity #CyberSecurity #DevAcademyPodcast #PenTesting #TechPodcast #SecureCoding #Vulnerabilities

29/03/2024

•

1h12min
TRAILER

Prompt Injection is CRAZY

The Challenges of Prompt Injection

Trailer

•

1min
TRAILER DA TEMPORADA 1

96 seconds TRAILER 🎧 Maximum Security in SDLC 🔐

In this conversation, Borja Berastegi discusses various aspects of security in web application development. He highlights common security mistakes, such as unmaintained code and applications, and emphasizes the importance of simplifying and reducing the attack surface. Borja also emphasizes the need for security awareness and training among developers. He suggests involving security-minded individuals in architectural reviews and conducting threat modeling exercises to identify potential vulnerabilities. The conversation also touches on the risk of enumeration and the need to avoid exposing information that can aid malicious actors. In this conversation, Borja Berastegui shares insights on various aspects of cybersecurity, including the importance of security awareness and training, conducting pen tests to discover vulnerabilities, developing an incident response plan, and analyzing incidents to learn from them. He also discusses the limitations of web application firewalls (WAFs) and highlights the rising threats in the future.

Trailer da T1

•

2min
24/05/2024

Pill #1: Use strong JWT secret

Hello and welcome back to Pills Dev - your bite-sized podcast for mastering software engineering fundamentals. I'm your host - Bartosz from Dev Academy - sharing quick tips on security, quality, and system design. To get more hot juicy tips visit pills dot dev. Today, let's delve into the world of web security, focusing on JSON Web Tokens, commonly known as JWTs. You might have heard that JWTs are a golden standard, often considered a more modern solution compared to traditional session cookies. But, let's set the record straight, JWTs aren't necessarily better, they're just different, each with its own set of advantages and drawbacks.Here's a critical point to consider, the security of a JWT hinges on its cryptographic signature, which depends on a secret key known only to your server. Now, imagine this key is simple or too short. It becomes an easy target for brute force attacks where attackers use powerful cloud computing to guess this key. Once they crack it, they can impersonate any user by generating valid tokens. That sounds like a nightmare, doesn't it?But there is a straightforward solution. Use a strong secret key. For instance, if you're using HS256 for token signing, your key should be at least 32 bytes long, ensuring that a brute-force attack could take centuries with current technology.In summary, while JWTs can be useful, they require careful handling to ensure they are secure. Always opt for strong, complex keys to protect your applications from potential attacks. Thanks for tuning in and learning with me today. If you enjoyed this episode, consider subscribing so you won't miss tomorrow's exciting content!

24/05/2024

•

2min
21/08/2024

Mastering Threat Modeling: From Code to Security with Adam Shostack

Discover the Secrets⁠ of Web Applications Security 👉 http://links.dev-academy.com/dwog In this episode: Threat modeling is essential in software development to consider security implications early in the design process. Integrating security considerations into the development process is crucial for shifting left and addressing potential risks. ADRs can be merged with security concerns to create concise records of architectural and security decisions. Checklists play a crucial role in systematizing and organizing tasks, reducing the mental burden, and improving focus. Stride provides a balance between generality and specificity, making it a valuable tool for threat modeling. Developing security skills requires exploration, experimentation, and patience, and it is not a quick or smooth process.

21/08/2024

•

1h10min
24/05/2024

Pill #3: Always Use Referrer-Policy Header

Hello and welcome back to Pills Dev - your bite-sized podcast for mastering software engineering fundamentals. I'm your host - Bartosz from Dev Academy - sharing quick tips on security, quality, and system design. To get more hot juicy tips visit pills dot dev. Have you ever clicked "Remind me the password"? I bet you have. Did you know there is a serious security issue hidden behind it that most developers are unaware of? Let me explain. Imagine you request a password reset. You receive an email with a password reset link, which often looks like this: application dot com slash reset question mark code equals one two three four five six. This code is unique to your password reset request. If the page contains some third-party code fetched from an external domain, this code might leak. In fact, any data from the URL may leak. You might ask, how come? Look, if you load the page, then all the embedded parts load accordingly, sending proper HTTP requests. If you have some widget on the page that loads from, let's say, some dash widget dot com, the request loading that widget may contain HTTP Header Referer. The referer could be application dot com slash reset question mark code equals one two three four five six. So the secret token leaks. If you don't believe me, open your developer tools, and look for XHR requests on any website. You will find the Referer header with the original website address. To prevent this URL data leakage, we need Referrer-Policy. This is one of the HTTP security headers that every developer should know. You can read the whole documentation about it, but here is a quick win. While serving your application, add an HTTP header: Referrer-Policy: origin-when-cross-origin. This will instruct the browser to send the origin, path, and query string only if the request points to the same origin, your internal link. If the request is cross-origin, only the sole origin is sent without the path and query string. That's it for today. I hope it was useful. Thanks for tuning in and learning with me today. If you enjoyed this episode, consider subscribing so you won't miss tomorrow's exciting content!

24/05/2024

•

3min
28/04/2024

Maximum security of software development lifecycle with Borja Berastegui

Web Security Dev Academy 👉 http://links.dev-academy.com/xweg Secure your spot and receive exclusive bonuses 🎉 In this conversation, Bartosz and Borja discuss common security mistakes in web application development and how developers can enhance security in the software development lifecycle (SDLC). They highlight the importance of security awareness and training for developers, as well as the need for architectural reviews and threat modeling exercises. They also mention the value of integrating static code analysis tools to identify potential vulnerabilities. The conversation emphasizes the need for developers to be aware of security issues and to collaborate with security experts to ensure the security of their applications. In this conversation, Bartek and Borja discuss incident response and management in the context of web application security. They cover topics such as integrating security tools into development pipelines, evaluating the risk and impact of security issues, incident response planning, and the importance of post-mortem analysis. They also touch on the role of web application firewalls (WAFs) and the rising threats in the cybersecurity landscape. Chapters 00:00 Introduction and Background 13:23 The Importance of Security Awareness and Training 31:34 Architectural Reviews and Threat Modeling 39:02 Evaluating Risk and Impact in Incident Response 48:14 Post-Mortem Analysis and Lessons Learned 01:05:49 Rising Threats in the Cybersecurity Landscape #DevSecOps #SecureCoding #AppSecTips #CodeSecurity #TechTrends #DevelopersLife #CodingBestPractices

28/04/2024

•

1h10min
18/04/2024

The Battle of Access Control Models 🤺 𝐑𝐁𝐀𝐂 𝐯𝐬. 𝐎𝐭𝐡𝐞𝐫𝐬 | Or Weis

Web Security Dev Academy WAITING LIST⁠⁠: ⁠http://links.dev-academy.com/u65⁠ Secure your spot and receive exclusive bonuses 🎉 The principle of least privilege is a key component of the zero trust architecture and mentality in software development. It is important to minimize access to the bare minimum that is needed to reduce the attack surface. Role-based access control (RBAC) is a commonly used approach where permissions are assigned to users based on their roles. Hierarchical RBAC adds a hierarchy to roles, allowing for more granularity. Attribute-based access control (ABAC) focuses on conditions and attributes to determine access. ABAC is useful for dynamic scenarios and can be combined with RBAC for more complex policies. Access control models, such as RBAC and ABAC, will continue to evolve as applications and technology change. The future of access control will involve more non-deterministic AI agents acting as users and integrations. Policy models will merge together and be simplified, focusing on groups, patterns of usage, and levels of usage. It is important for developers to stay up to date with security standards and best practices. Utilizing open source tools and connecting with their communities is a great way to stay informed. Additionally, engaging in discussions with other developers and seeking guidance can help navigate the complexities of access control. Takeaways The principle of least privilege is important in minimizing access and reducing the attack surface in software development. Role-based access control (RBAC) is a commonly used approach where permissions are assigned based on roles. Hierarchical RBAC adds a hierarchy to roles, allowing for more granularity in access control. Attribute-based access control (ABAC) focuses on conditions and attributes to determine access and is useful for dynamic scenarios. Applications often use a combination of RBAC and ABAC to implement access control policies. Access control models will continue to evolve as applications and technology change The future of access control will involve more non-deterministic AI agents acting as users and integrations Policy models will merge together and be simplified, focusing on groups, patterns of usage, and levels of usage Developers should stay up to date with security standards and best practices Utilizing open source tools and connecting with their communities can help developers stay informed Engaging in discussions with other developers and seeking guidance can help navigate the complexities of access control #DevSecOps #SecureCoding #AppSecTips #CodeSecurity #TechTrends #DevelopersLife #CodingBestPractices

18/04/2024

•

1h12min

Dev Academy empowers software developers through focused education on fundamental and timeless topics such as security, quality, and system design. Our mission is to provide developers with the knowledge and tools to build robust and secure software systems.

Site

Dev Academy

Principais podcasts

Special episode: How Alex became Security-oriented developer

OWASP Top 10 and Beyond: Expert Discussion with Randall Degges

Unveiling Web App Security: Pen Testing, Vulnerabilities & More With Adrian Tiron

Prompt Injection is CRAZY

96 seconds TRAILER 🎧 Maximum Security in SDLC 🔐

Pill #1: Use strong JWT secret

Mastering Threat Modeling: From Code to Security with Adam Shostack

Pill #3: Always Use Referrer-Policy Header

Maximum security of software development lifecycle with Borja Berastegui

The Battle of Access Control Models 🤺 𝐑𝐁𝐀𝐂 𝐯𝐬. 𝐎𝐭𝐡𝐞𝐫𝐬 | Or Weis

Sobre

Dev Academy

Principais podcasts

Principais episódios

Sobre