W2D1 Media

•

Channel • 2 Shows

Entrepreneurship

Entrepreneurship

Complete Series
Technology

Technology

Updated Biweekly

JUL 23

ISM 2025 Explained: What CISOs, Devs and Security Leads Need to Know - with Toby Amodio

Episode SummaryThe Australian Information Security Manual (ISM) just got a major update, and not everyone’s thrilled. In this special episode of Secured, Cole Cornford is joined by Toby Amodio (Head of Professional Services, Fujitsu Cyber) to break down what’s changed, what’s missing, and what it all means for CISOs, AppSec teams and public sector security leads. From the new cybersecurity principles (and why they feel like yak shaving) to the long-overdue expansion of software security controls, Cole and Toby navigate the mess of frameworks, missing maturity models, and babushka-doll-style mappings that have left many teams overwhelmed. They also reflect on what “secure-by-default” really means in a world of legacy codebases, overstretched resources, and one-person AppSec teams. Timestamps01:02 – Why ISM Updates Matter (Even If They’re Late) 02:32 – New Principles: Nice Idea, Hard to Implement 04:08 – Yak Shaving and the Complexity Cascade 07:48 – Mapping Mayhem: PSPF, E8 and Governance Overload 10:25 – Losing the Maturity Model: Who Does That Help? 13:46 – Secure-by-Default and the Problem with OWASP-as-a-Proxy 18:13 – Integration, Incentives, and Cyber vs. Business Silos 20:34 – The Talent Gap and Why Code Reviews Still Matter 22:58 – Galah Cyber, Capability Building & Doing AppSec Right 23:57 – Why Buying Tools Isn’t the Same as Building Capability 25:21 – What Red, Amber, Green Tools Really Miss 26:01 – One ISM to Rule Them All… If You Can Implement It 26:52 – Final Thoughts (and a Funding Stick for CISOs) Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

Jul 23

•

29 min
06/07/2023

Hacking the Game of Life: From Gaming Exploits to Cybersecurity Giant with Shubham Shah of Assetnote

Shubham Shah is co-founder and CTO of Assetnote, a cybersecurity tool used by companies like Atlassian, Qantas, and Australia Post. Shubham’s career in cybersecurity had very humble beginnings: he first learned to hack computer games as a kid so he could beat his brother. Shubham chats with Cole Cornford about video game exploits and what they can teach us about appsec, bug bounty hunting, the challenges of founding a company, and plenty more. Secured by Galah Cyber with Cole Cornford website 2:30 - Benefits of shared workspace. 5:30 - Shubham’s background. 9:00 - Bug bounty hunting. 10:45 - Developing a good work ethic from crappy jobs. 15:00 - Video game hacking. 21:00 - Tying video game hacking to cybersecurity. 22:40 - Shubham: got in trouble for hacking in high school. 24:20 - Shubham: had to convince his parents to let him study computer science. 26:00 - Shubham was working an unpaid internship. 26:50 - Cole: pros and cons of uni education. 29:20 - Shubham: I don’t discourage people from going to uni. 32:00 - Assetnote - discussing the company. 34:00 - Shubham started commercialising but “had no idea what I was doing”. 36:45 - Cole reflects on his early naivety when starting Galah Cyber. 38:30 - Pros and challenges of bootstrapping a business. 39:00 - Shubham: came close to running out of money. 40:45 - Cole: I see a vacuum for app sec talent in smaller orgs. 41:30 - Cole: software has eaten the world. Now AI is eating software. 43:10 - Shubham: division of work between Shubham and co-founder. 44:30 - Doing any job to move the business forward. 47:00 - Rapid-fire questions. Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

06/07/2023

•

54 min
08/28/2024

Security Done Right: Ben Gittins on the Case for Generalists and Long-Term Solutions

SummaryBen Gittins is the Principal Security Engineer at Bugcrowd, one of the world's best bug bounty platforms. Ben has previously worked as a Senior DevSecOps Engineer at Canva, as well as DevSecOps Lead at SecureStack. In this conversation with Cole Cornford, Ben shares his belief that cybersecurity needs more generalists, how coding and AppSec have changed over time, whether cybersecurity qualifications are overrated, and plenty more. Timestamps3:50 - Why is Aus cybersecurity lagging behind? 9:50 - Over-reliance on purchasing cybersecurity products 14:40 - We ask too much of our AppSec professionals 19:00 - How App development & cybersecurity have changed over time 24:00 - "Greenfield projects" are often not realistic 28:20 - How to bring new people into the AppSec industry 32:00 - Importance of communication skills 38:20 - Cybersecurity qualifications are overrated 43:00 - Rapid fire questions Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

08/28/2024

•

47 min
08/16/2023

An Agnostic Approach to AppSec: Ken Johnson on Navigating the Future with AI

Ken Johnson is co-founder of Dryrun Security and co-host of the Apsolute AppSec podcast. Ken has many years experience working in AppSec in a variety of roles, including CTO of nVisium and Application Security Engineer at GitHub. Ken chats with Cole Cornford about taking an agnostic approach to AppSec, transitioning from being an employee to a founder, how AI might change cybersecurity, and plenty more. Secured by Galah Cyber with Cole Cornford website Timestamps9:10 - When Ken started running AppSec conferences.12:00 - Ken: an “agnostic approach” to appsec really resonated with people.14:30 - Ken: “by nature we are always behind the curve”.15:40 - Ken: appsec is getting much harder.17:00 - Cole also advocates for an agnostic approach to appsec.18:50 - Ken’s favourite thing about Github: the culture.20:30 - discussing Github.25:00 - Appsec education.26:30 - quality software is secure software.27:30 - AI & Appsec.33:50 - Brief overview of Ken’s professional life, transition to being a founder.36:30 - Cole: people who plan to build a product alongside consulting.38:20 - Cole’s experience starting a consulting business.39:40 - Ken’s interests outside AppSec.40:40 - How Ken got into brazilian ju jitsu.44:10 - Cole’s pandemic experience. Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

08/16/2023

•

48 min
10/02/2024

Building Cybersecurity Culture: Marketing, Awareness, and Diversity with Daisy Wong

Summary Daisy Wong is the Head of Security Awareness at Medibank, as well as a disability advocate. Originally from a marketing background, Daisy gained experience in the cybersecurity industry working as part of penetration teams, before making her way into the security culture and awareness space. In her conversation with Cole Cornford, Daisy discusses using the tools of marketing to educate people on cybersecurity, what are the hallmarks of a good security culture and awareness program, and the importance of diversity in cybersecurity. Timestamps 4:00 - Daisy's transition from marketing to cybersecurity 8:10 - The importance of security culture and awareness 11:00 - Building effective security awareness programs 14:15 - The role of diversity in cybersecurity 17:00 - Strategies for inclusive hiring practices 19:40 - The power of communication in security awareness 23:20 - Creative approaches to security awareness campaigns 31:45 - Daisy's personal perspective on the importance of diversity 43:40 - Rapid fire questions Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

10/02/2024

•

47 min
06/19/2024

Behind Elttam: Matt Jones Discusses Infosec Innovations and Australia's Cybersecurity Landscape

Summary In this episode, Cole Cornford chats with Matt Jones, co-founder of Elttam, an independent security boutique that provides security assessment services. On top of his role at Elttam, Matt is active in the infosec community in a variety of ways, including helping with BSides Canberra's call for papers and writing open-source tooling such as talkback.sh. Cole and Matt chat about the motivation behind founding Elttam, why Australia's infosec industry is lagging behind other parts of the world, the exploit development space, and plenty more. Timestamps 2:00 - Matt's career background 7:00 - Matt's early challenges finding an opportunity in cybersecurity 11:00 - Why Matt chose to co-found Elttam 13:00 - Cole: Australia's infosec industry is immature compared to US 19:00 - The importance of specialisation 20:30 - Better to do 1 thing really well when bootstrapping 24:00 - Using the right approach for the right context 25:30 - Risks of using a bug bounty program 31:10 - Cole: the bar for pen testing reports should be much higher 37:10 - Training & education for infosec 39:00 - Cole: is infosec a cottage industry? 44:00 - Product vs service approach to cybersecurity 47:50 - Cole: I like looking at source code from 80s and 90s 49:00 - Rapid fire questions Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

06/19/2024

•

56 min
10/09/2024

Open-Source Software: Balancing Innovation and Security with Ilkka Turunen, CTO of Sonatype

Episode SummaryIlkka Turunen is the CTO at Sonatype, a company that helps millions of software developers use open-source software while minimising security risk. In this conversation, Ilkka chats with Cole Cornford about the benefits and risk of using open-source software, how Maven helped standardise software development processes, the different approaches to AppSec regulation in Australia and Europe, and plenty more. Timestamps1:33 - Ilkka's career background 4:00 - Varying quality of open-source software 6:10 - How Maven helped standardise software development processes 13:00 - The balance between speed of delivery & quality 17:00 - Importance of environment parity in software dev 21:40 - Risk of using 3rd party code in software 25:10 - Regulation of AppSec in Australia vs Europe 32:10 - How new European software security regulations will be enforced 35:00 - Recommendations for compliance with European regulations 39:00 - Rapid fire questions Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

10/09/2024

•

47 min
08/14/2024

AI-Driven AppSec: Shan Kulkarni on Nullify, Hiring Challenges, and the Future of Cybersecurity in Australia

Summary Shan Kulkarni is the co-founder and CEO of Nullify, a product designed to augment AppSec teams with AI agents capable of carrying out multiple levels of product security work autonomously. Prior to Nullify, Shan worked in roles such as Cloud Operations Lead at UNSW Redback Racing, and Cloud Security Engineer at CMD Solutions Australia. In this conversation with Cole Cornford, Shan discusses the challenges of starting a business, and in particular the challenges of hiring, the state of AppSec in Australia, what the future might hold for the industry, and plenty more. Timestamps 1:30 - Shan's career background 5:30 - Why AppSec is so often inefficient and expensive 9:00 - Bigh tech has a monopoly on AppSec talent 12:30 - Shan's journey from consultant to founding a company 15:40 - Biggest mistakes when starting a business 19:20 - Selling products/services to devs is extremely difficult 25:00 - Where Shan sees AppSec going 28:00 - Consolidation of security products 32:00 - What security leaders are struggling with: visibility 34:00 - Rapid fire questions Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

08/14/2024

•

38 min
05/22/2024

Bruce Large discusses the importance of threat modelling in operational technology security

SummaryIn this episode of Secured, host Cole Cornford interviews Bruce Large, a security architect and evangelist at Secolve, the OT security specialists in Australia. They discuss the importance of threat modelling in operational technology systems and the need for engineers to consider the potential for cyber attacks. Bruce also shares insights from the ISA/IEC 62443 series of standards, which provides guidelines for secure system development in OT. Additionally, they touch on the significance of unions in the tech industry and the benefits of joining organisations like Professionals Australia. Tune in for a fascinating conversation on application security and more. Timestamps1:25 - Bruce's professional background 2:40 - Defining "engineer" in different contexts 6:20 - Differences between computer engineers and civil engineers 8:20 - Threat modeling 12:40 - How we treat safety in software vs other industries 18:30 - Bruce: we should be encouraging lifelong learning 24:00 - ISA/IEC 62443 safety standard 29:00 - The Year 2038 Problem 34:20 - Unions & industrial relations 43:40 - Rapid fire questions Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

05/22/2024

•

49 min
12/20/2023

Systems Thinking in Cybersecurity: A Conversation with Michael Collins

The cybersecurity industry is made up of people from all sorts of different backgrounds, and Michael Collins is a perfect example. After spending 8 years in the Australian navy, Michael moved to Cairns and became a diving instructor. After 5 years, Michael decided it was time for a career change and enrolled in a course to become a Microsoft certified systems engineer. Today, he’s Chief Information Security Officer at Judo Bank. In this episode we chat about how Michael has managed major transitions in his career, the importance of aligning cybersecurity strategies with business goals, systems thinking as a framework for approaching cybersecurity, and plenty more. Systems Thinking Made Simple - by Derek Cabrera: https://www.amazon.com.au/Systems-Thinking-Made-Simple-Problems/dp/1520740492 Secured by Galah Cyber with Cole Cornford website 2:20 - A good summary of Judo Bank 7:10 - How Michael became a CISO 9:00 - How Michael almost bailed on his cybersecurity training after day one 12:00 - The joys of scuba diving 14:30 - Advantages of systems thinking 16:30 - How someone can get started with systems thinking 17:40 - DSRP thinking (Distinctions, Systems, Relationships and Perspectives) 24:20 - Delivering AppSec by meeting the business where it is, not being idealistic 25:20 - “It’s not all about downsides”, businesses succeed by taking risks 27:10 - How we can promote more business-mindedness in cyber 32:50 - Michael’s transition from techie role to CISO 39:50 - Cole: “Leadership is a funny thing” 43:30 - Rapid fire questions Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

12/20/2023

•

49 min

These are W2D1 Media produced shows