W2D1 Media

-

قناة - البرامج: ‫٢‬

ريادة الأعمال

ريادة الأعمال

مسلسل مكتمل
التكنولوجيا

التكنولوجيا

يتم التحديث كل أسبوعين

٢٠‏/١١‏/٢٠٢٤

Navigating the PSPF 2024 Updates: Expert Insights with Kat McCrabb and Toby Amodio

Episode SummaryIn this episode, Cole Cornford is joined by cybersecurity experts and IRAP assessors, Kat McCrabb and Toby Amodio, to unpack the latest updates to the Protective Security Policy Framework (PSPF) for 2024. They explore the significant changes introduced in the PSPF, such as the heightened emphasis on IRAP assessments, the potential strain on resources due to increased demand for assessors, and the impact on government agencies' compliance efforts. The discussion delves into the restructuring of the PSPF domains, including the separation of information and technology, and the challenges this presents for reporting and governance. They also address issues with self-attestation in agencies, insights from ANAO reports, and the critical importance of managing legacy IT systems. Kat and Toby offer valuable perspectives and practical advice for organisations navigating these new requirements, highlighting the need for proactive planning and adaptation in the evolving cybersecurity landscape. Timestamps01:27 - What is the PSPF? Toby explains the framework 03:07 - Kat discusses the biggest changes in the PSPF 2024 updates 04:20 - Challenges with IRAP assessments: time, cost, and limited assessors 06:18 - When are IRAP assessments required? Clarifications 08:13 - Changes in PSPF domains: splitting information and technology 10:08 - Implications of the changes for reporting and governance 12:15 - Comparison with NIST framework and governance considerations 13:38 - Issues with self-attestation and insights from ANAO reports 15:09 - Strategies for improving reporting and assessments in agencies 17:36 - Managing legacy IT systems under the new PSPF requirements 18:52 - Key takeaways and final thoughts from Kat and Toby Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

٢٠‏/١١‏/٢٠٢٤

-

٢٢ من الدقائق
١١ سبتمبر

Fix the Flag: Rethinking Secure Code Training with Pedram Hayati

Episode SummaryCTFs are fun, but do they actually make developers write more secure code? In this episode of Secured, Cole Cornford is joined by Pedram Hayati (Founder of SecDim & SecTalks) to explore why most developer security training fails, and how SecDim’s “Fix the Flag” approach is changing the game. From contrived WebGoat-style examples to frameworks that quietly eradicate entire bug classes, Cole and Pedram dive deep into the intersection of AppSec and software engineering. They unpack why developer experience is non-negotiable, why security needs to borrow design patterns from engineering, and how real-world incidents (like GitHub’s mass assignment bug or the Optus breach) make concepts stick far better than acronyms like “XSS” or “SSTI.” This is a technical, opinionated episode for anyone who’s ever struggled to get developers engaged with security. Timestamps01:10 – Why Pedram built SecDim, the problem with pen test reports, and why CTFs don’t train developers 04:42 – From “Capture the Flag” to “Fix the Flag”: making training realistic and Git-first 06:30 – Training inside developer workflows and why contrived examples fail 10:28 – Using modern stacks, AI-tailored labs, and real-world incidents to make concepts stick 12:35 – Why security names suck (XSS vs. “content injection”) and the Optus hack as a teaching moment 17:37 – Secure design patterns vs. vague slogans, and why secure defaults beat secure by design 21:15 – Frameworks like React, Rails, and Angular that kill entire bug classes 23:23 – Engineering by-products: reproducibility, immutability, and orthogonality in secure coding 30:36 – PHP’s bad reputation, language quirks, and what’s actually most popular in security training today 33:41 – Why AppSec pros need to build and deploy apps (not just know vulnerability classes) 37:44 – Getting started with SecDim and hands-on secure coding Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

١١ سبتمبر

-

٣٩ من الدقائق
٢٠‏/١٢‏/٢٠٢٣

Systems Thinking in Cybersecurity: A Conversation with Michael Collins

The cybersecurity industry is made up of people from all sorts of different backgrounds, and Michael Collins is a perfect example. After spending 8 years in the Australian navy, Michael moved to Cairns and became a diving instructor. After 5 years, Michael decided it was time for a career change and enrolled in a course to become a Microsoft certified systems engineer. Today, he’s Chief Information Security Officer at Judo Bank. In this episode we chat about how Michael has managed major transitions in his career, the importance of aligning cybersecurity strategies with business goals, systems thinking as a framework for approaching cybersecurity, and plenty more. Systems Thinking Made Simple - by Derek Cabrera: https://www.amazon.com.au/Systems-Thinking-Made-Simple-Problems/dp/1520740492 Secured by Galah Cyber with Cole Cornford website 2:20 - A good summary of Judo Bank 7:10 - How Michael became a CISO 9:00 - How Michael almost bailed on his cybersecurity training after day one 12:00 - The joys of scuba diving 14:30 - Advantages of systems thinking 16:30 - How someone can get started with systems thinking 17:40 - DSRP thinking (Distinctions, Systems, Relationships and Perspectives) 24:20 - Delivering AppSec by meeting the business where it is, not being idealistic 25:20 - “It’s not all about downsides”, businesses succeed by taking risks 27:10 - How we can promote more business-mindedness in cyber 32:50 - Michael’s transition from techie role to CISO 39:50 - Cole: “Leadership is a funny thing” 43:30 - Rapid fire questions Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

٢٠‏/١٢‏/٢٠٢٣

-

٤٩ من الدقائق
٢٣ يوليو

ISM 2025 Explained: What CISOs, Devs and Security Leads Need to Know - with Toby Amodio

Episode SummaryThe Australian Information Security Manual (ISM) just got a major update, and not everyone’s thrilled. In this special episode of Secured, Cole Cornford is joined by Toby Amodio (Head of Professional Services, Fujitsu Cyber) to break down what’s changed, what’s missing, and what it all means for CISOs, AppSec teams and public sector security leads. From the new cybersecurity principles (and why they feel like yak shaving) to the long-overdue expansion of software security controls, Cole and Toby navigate the mess of frameworks, missing maturity models, and babushka-doll-style mappings that have left many teams overwhelmed. They also reflect on what “secure-by-default” really means in a world of legacy codebases, overstretched resources, and one-person AppSec teams. Timestamps01:02 – Why ISM Updates Matter (Even If They’re Late) 02:32 – New Principles: Nice Idea, Hard to Implement 04:08 – Yak Shaving and the Complexity Cascade 07:48 – Mapping Mayhem: PSPF, E8 and Governance Overload 10:25 – Losing the Maturity Model: Who Does That Help? 13:46 – Secure-by-Default and the Problem with OWASP-as-a-Proxy 18:13 – Integration, Incentives, and Cyber vs. Business Silos 20:34 – The Talent Gap and Why Code Reviews Still Matter 22:58 – Galah Cyber, Capability Building & Doing AppSec Right 23:57 – Why Buying Tools Isn’t the Same as Building Capability 25:21 – What Red, Amber, Green Tools Really Miss 26:01 – One ISM to Rule Them All… If You Can Implement It 26:52 – Final Thoughts (and a Funding Stick for CISOs) Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

٢٣ يوليو

-

٢٩ من الدقائق
١٢ فبراير

The Story So Far: Inside Secured’s Growth and What’s Coming Next

Episode SummaryIn this special solo episode, host Cole Cornford reflects on the journey of the Secured podcast over the past two years. He shares behind-the-scenes insights, from the unexpected challenges of cicada season disrupting recordings to the podcast’s growth, hitting 45 episodes and over 7,000 downloads. Cole discusses listener feedback, format changes, and his plans to expand the show, including moving to weekly episodes, introducing video content, and diversifying guest profiles. He also highlights listener engagement stats, the importance of audience reviews, and the future direction of Secured with a focus on delivering more valuable and dynamic cybersecurity content. Timestamps00:20 – The impact of cicada season on recording and production 01:10 – Hitting 45 episodes: reflections on the podcast’s growth 01:54 – Asking for listener feedback and reviews to support the show 02:51 – Plans to move to weekly episodes and potential sponsorships 03:51 – The possibility of introducing video content and its challenges 04:35 – Listener engagement stats: unique listeners, downloads, and demographics 08:05 – Most downloaded and highest engagement episodes revealed 10:55 – Diversity in guests and topics: striving for representation 13:48 – Changes in podcast format: cutting certain segments for better engagement 17:03 – The shift towards professional development-focused content 19:50 – Future goals: more international guests and sharper conversations Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

١٢ فبراير

-

٢٤ من الدقائق
٢ أبريل

Scaling Cyber at Fujitsu: Laura O'Neill on Strategy, Risk and Growth

Episode SummaryIn this episode of Secured, host Cole Cornford chats with Laura O'Neill from Fujitsu Cyber. Laura shares her journey from a pure maths and cryptography background through management consulting into the world of cybersecurity. She explains how she helped grow MF&A from a small team into a 70-person company before its acquisition by Fujitsu. Cole and Laura discuss the challenges of scaling a cyber practice, the importance of professionalising sales and board-level communications, and how embracing diverse, non-traditional talent can transform the industry. Their conversation offers valuable insights into shifting from a compliance-based mindset to a risk-based strategy that truly supports business objectives. Timestamps00:10 - Introduction to Laura O'Neill and her role at Fujitsu Cyber 02:27 - Laura recounts her journey from pure maths and cryptography to cybersecurity 05:31 - Discussing the rapid growth of MF&A from a small team to 70 staff 07:30 - Overcoming scaling challenges through improved processes and support 11:23 - Professionalising sales and board-level communications in cyber 15:30 - Moving from a compliance-driven approach to a risk-based strategy 26:16 - Embracing diversity and non-traditional hiring in cybersecurity 31:20 - The value of diverse backgrounds and soft skills in solving security challenges 40:43 - The importance of empathy and listening in leadership 42:16 - Closing thoughts on security as an enabling function for business success Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

٢ أبريل

-

٤٤ من الدقائق
١٦ أبريل

Engineering Security: Bridging DevOps and AppSec with Jon-Anthoney de Boer

Episode SummaryJon-Anthoney de Boer is the Product Security Lead at Transmax, overseeing security for critical infrastructure that manages traffic flow across Australia. Coming from a strong software engineering background, Jon-Anthoney shares his experience transitioning from traditional engineering into product and application security. He highlights the importance of aligning software engineering and security teams, building trust into the software development lifecycle, and fostering a security culture based on practical strategy rather than superficial metrics. Jon-Anthoney also discusses how behavioural change, organisational alignment, and operational excellence are key to achieving effective, sustainable security outcomes. Timestamps00:32 - Jon-Anthoney’s journey from electrical engineering to product security 05:08 - Transitioning from software craftsmanship to cybersecurity 09:30 - Why aligned incentives between engineering and security teams matter 12:22 - Goodhart's Law: pitfalls of security metrics 18:21 - Rethinking cybersecurity strategies beyond tools and compliance 25:12 - Building observability into the secure software development lifecycle 32:35 - Why executive support is crucial for security initiatives 38:34 - Operational excellence: removing waste from security processes Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

١٦ أبريل

-

٤٣ من الدقائق
٠٧‏/٠٦‏/٢٠٢٣

Hacking the Game of Life: From Gaming Exploits to Cybersecurity Giant with Shubham Shah of Assetnote

Shubham Shah is co-founder and CTO of Assetnote, a cybersecurity tool used by companies like Atlassian, Qantas, and Australia Post. Shubham’s career in cybersecurity had very humble beginnings: he first learned to hack computer games as a kid so he could beat his brother. Shubham chats with Cole Cornford about video game exploits and what they can teach us about appsec, bug bounty hunting, the challenges of founding a company, and plenty more. Secured by Galah Cyber with Cole Cornford website 2:30 - Benefits of shared workspace. 5:30 - Shubham’s background. 9:00 - Bug bounty hunting. 10:45 - Developing a good work ethic from crappy jobs. 15:00 - Video game hacking. 21:00 - Tying video game hacking to cybersecurity. 22:40 - Shubham: got in trouble for hacking in high school. 24:20 - Shubham: had to convince his parents to let him study computer science. 26:00 - Shubham was working an unpaid internship. 26:50 - Cole: pros and cons of uni education. 29:20 - Shubham: I don’t discourage people from going to uni. 32:00 - Assetnote - discussing the company. 34:00 - Shubham started commercialising but “had no idea what I was doing”. 36:45 - Cole reflects on his early naivety when starting Galah Cyber. 38:30 - Pros and challenges of bootstrapping a business. 39:00 - Shubham: came close to running out of money. 40:45 - Cole: I see a vacuum for app sec talent in smaller orgs. 41:30 - Cole: software has eaten the world. Now AI is eating software. 43:10 - Shubham: division of work between Shubham and co-founder. 44:30 - Doing any job to move the business forward. 47:00 - Rapid-fire questions. Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

٠٧‏/٠٦‏/٢٠٢٣

-

٥٤ من الدقائق
٢٨‏/٠٨‏/٢٠٢٤

Security Done Right: Ben Gittins on the Case for Generalists and Long-Term Solutions

SummaryBen Gittins is the Principal Security Engineer at Bugcrowd, one of the world's best bug bounty platforms. Ben has previously worked as a Senior DevSecOps Engineer at Canva, as well as DevSecOps Lead at SecureStack. In this conversation with Cole Cornford, Ben shares his belief that cybersecurity needs more generalists, how coding and AppSec have changed over time, whether cybersecurity qualifications are overrated, and plenty more. Timestamps3:50 - Why is Aus cybersecurity lagging behind? 9:50 - Over-reliance on purchasing cybersecurity products 14:40 - We ask too much of our AppSec professionals 19:00 - How App development & cybersecurity have changed over time 24:00 - "Greenfield projects" are often not realistic 28:20 - How to bring new people into the AppSec industry 32:00 - Importance of communication skills 38:20 - Cybersecurity qualifications are overrated 43:00 - Rapid fire questions Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

٢٨‏/٠٨‏/٢٠٢٤

-

٤٧ من الدقائق
١٦‏/٠٨‏/٢٠٢٣

An Agnostic Approach to AppSec: Ken Johnson on Navigating the Future with AI

Ken Johnson is co-founder of Dryrun Security and co-host of the Apsolute AppSec podcast. Ken has many years experience working in AppSec in a variety of roles, including CTO of nVisium and Application Security Engineer at GitHub. Ken chats with Cole Cornford about taking an agnostic approach to AppSec, transitioning from being an employee to a founder, how AI might change cybersecurity, and plenty more. Secured by Galah Cyber with Cole Cornford website Timestamps9:10 - When Ken started running AppSec conferences.12:00 - Ken: an “agnostic approach” to appsec really resonated with people.14:30 - Ken: “by nature we are always behind the curve”.15:40 - Ken: appsec is getting much harder.17:00 - Cole also advocates for an agnostic approach to appsec.18:50 - Ken’s favourite thing about Github: the culture.20:30 - discussing Github.25:00 - Appsec education.26:30 - quality software is secure software.27:30 - AI & Appsec.33:50 - Brief overview of Ken’s professional life, transition to being a founder.36:30 - Cole: people who plan to build a product alongside consulting.38:20 - Cole’s experience starting a consulting business.39:40 - Ken’s interests outside AppSec.40:40 - How Ken got into brazilian ju jitsu.44:10 - Cole’s pandemic experience. Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

١٦‏/٠٨‏/٢٠٢٣

-

٤٨ من الدقائق

These are W2D1 Media produced shows

موقع الويب