W2D1 Media

•

채널 • 2개의 프로그램

기업 운영

기업 운영

시리즈 완결
과학 기술

과학 기술

격주 업데이트

9월 11일

Fix the Flag: Rethinking Secure Code Training with Pedram Hayati

Episode SummaryCTFs are fun, but do they actually make developers write more secure code? In this episode of Secured, Cole Cornford is joined by Pedram Hayati (Founder of SecDim & SecTalks) to explore why most developer security training fails, and how SecDim’s “Fix the Flag” approach is changing the game. From contrived WebGoat-style examples to frameworks that quietly eradicate entire bug classes, Cole and Pedram dive deep into the intersection of AppSec and software engineering. They unpack why developer experience is non-negotiable, why security needs to borrow design patterns from engineering, and how real-world incidents (like GitHub’s mass assignment bug or the Optus breach) make concepts stick far better than acronyms like “XSS” or “SSTI.” This is a technical, opinionated episode for anyone who’s ever struggled to get developers engaged with security. Timestamps01:10 – Why Pedram built SecDim, the problem with pen test reports, and why CTFs don’t train developers 04:42 – From “Capture the Flag” to “Fix the Flag”: making training realistic and Git-first 06:30 – Training inside developer workflows and why contrived examples fail 10:28 – Using modern stacks, AI-tailored labs, and real-world incidents to make concepts stick 12:35 – Why security names suck (XSS vs. “content injection”) and the Optus hack as a teaching moment 17:37 – Secure design patterns vs. vague slogans, and why secure defaults beat secure by design 21:15 – Frameworks like React, Rails, and Angular that kill entire bug classes 23:23 – Engineering by-products: reproducibility, immutability, and orthogonality in secure coding 30:36 – PHP’s bad reputation, language quirks, and what’s actually most popular in security training today 33:41 – Why AppSec pros need to build and deploy apps (not just know vulnerability classes) 37:44 – Getting started with SecDim and hands-on secure coding Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

9월 11일

•

39분
2023. 12. 20.

Systems Thinking in Cybersecurity: A Conversation with Michael Collins

The cybersecurity industry is made up of people from all sorts of different backgrounds, and Michael Collins is a perfect example. After spending 8 years in the Australian navy, Michael moved to Cairns and became a diving instructor. After 5 years, Michael decided it was time for a career change and enrolled in a course to become a Microsoft certified systems engineer. Today, he’s Chief Information Security Officer at Judo Bank. In this episode we chat about how Michael has managed major transitions in his career, the importance of aligning cybersecurity strategies with business goals, systems thinking as a framework for approaching cybersecurity, and plenty more. Systems Thinking Made Simple - by Derek Cabrera: https://www.amazon.com.au/Systems-Thinking-Made-Simple-Problems/dp/1520740492 Secured by Galah Cyber with Cole Cornford website 2:20 - A good summary of Judo Bank 7:10 - How Michael became a CISO 9:00 - How Michael almost bailed on his cybersecurity training after day one 12:00 - The joys of scuba diving 14:30 - Advantages of systems thinking 16:30 - How someone can get started with systems thinking 17:40 - DSRP thinking (Distinctions, Systems, Relationships and Perspectives) 24:20 - Delivering AppSec by meeting the business where it is, not being idealistic 25:20 - “It’s not all about downsides”, businesses succeed by taking risks 27:10 - How we can promote more business-mindedness in cyber 32:50 - Michael’s transition from techie role to CISO 39:50 - Cole: “Leadership is a funny thing” 43:30 - Rapid fire questions Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

2023. 12. 20.

•

49분
7월 23일

ISM 2025 Explained: What CISOs, Devs and Security Leads Need to Know - with Toby Amodio

Episode SummaryThe Australian Information Security Manual (ISM) just got a major update, and not everyone’s thrilled. In this special episode of Secured, Cole Cornford is joined by Toby Amodio (Head of Professional Services, Fujitsu Cyber) to break down what’s changed, what’s missing, and what it all means for CISOs, AppSec teams and public sector security leads. From the new cybersecurity principles (and why they feel like yak shaving) to the long-overdue expansion of software security controls, Cole and Toby navigate the mess of frameworks, missing maturity models, and babushka-doll-style mappings that have left many teams overwhelmed. They also reflect on what “secure-by-default” really means in a world of legacy codebases, overstretched resources, and one-person AppSec teams. Timestamps01:02 – Why ISM Updates Matter (Even If They’re Late) 02:32 – New Principles: Nice Idea, Hard to Implement 04:08 – Yak Shaving and the Complexity Cascade 07:48 – Mapping Mayhem: PSPF, E8 and Governance Overload 10:25 – Losing the Maturity Model: Who Does That Help? 13:46 – Secure-by-Default and the Problem with OWASP-as-a-Proxy 18:13 – Integration, Incentives, and Cyber vs. Business Silos 20:34 – The Talent Gap and Why Code Reviews Still Matter 22:58 – Galah Cyber, Capability Building & Doing AppSec Right 23:57 – Why Buying Tools Isn’t the Same as Building Capability 25:21 – What Red, Amber, Green Tools Really Miss 26:01 – One ISM to Rule Them All… If You Can Implement It 26:52 – Final Thoughts (and a Funding Stick for CISOs) Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

7월 23일

•

29분
2월 12일

The Story So Far: Inside Secured’s Growth and What’s Coming Next

Episode SummaryIn this special solo episode, host Cole Cornford reflects on the journey of the Secured podcast over the past two years. He shares behind-the-scenes insights, from the unexpected challenges of cicada season disrupting recordings to the podcast’s growth, hitting 45 episodes and over 7,000 downloads. Cole discusses listener feedback, format changes, and his plans to expand the show, including moving to weekly episodes, introducing video content, and diversifying guest profiles. He also highlights listener engagement stats, the importance of audience reviews, and the future direction of Secured with a focus on delivering more valuable and dynamic cybersecurity content. Timestamps00:20 – The impact of cicada season on recording and production 01:10 – Hitting 45 episodes: reflections on the podcast’s growth 01:54 – Asking for listener feedback and reviews to support the show 02:51 – Plans to move to weekly episodes and potential sponsorships 03:51 – The possibility of introducing video content and its challenges 04:35 – Listener engagement stats: unique listeners, downloads, and demographics 08:05 – Most downloaded and highest engagement episodes revealed 10:55 – Diversity in guests and topics: striving for representation 13:48 – Changes in podcast format: cutting certain segments for better engagement 17:03 – The shift towards professional development-focused content 19:50 – Future goals: more international guests and sharper conversations Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

2월 12일

•

24분
4월 2일

Scaling Cyber at Fujitsu: Laura O'Neill on Strategy, Risk and Growth

Episode SummaryIn this episode of Secured, host Cole Cornford chats with Laura O'Neill from Fujitsu Cyber. Laura shares her journey from a pure maths and cryptography background through management consulting into the world of cybersecurity. She explains how she helped grow MF&A from a small team into a 70-person company before its acquisition by Fujitsu. Cole and Laura discuss the challenges of scaling a cyber practice, the importance of professionalising sales and board-level communications, and how embracing diverse, non-traditional talent can transform the industry. Their conversation offers valuable insights into shifting from a compliance-based mindset to a risk-based strategy that truly supports business objectives. Timestamps00:10 - Introduction to Laura O'Neill and her role at Fujitsu Cyber 02:27 - Laura recounts her journey from pure maths and cryptography to cybersecurity 05:31 - Discussing the rapid growth of MF&A from a small team to 70 staff 07:30 - Overcoming scaling challenges through improved processes and support 11:23 - Professionalising sales and board-level communications in cyber 15:30 - Moving from a compliance-driven approach to a risk-based strategy 26:16 - Embracing diversity and non-traditional hiring in cybersecurity 31:20 - The value of diverse backgrounds and soft skills in solving security challenges 40:43 - The importance of empathy and listening in leadership 42:16 - Closing thoughts on security as an enabling function for business success Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

4월 2일

•

44분
4월 16일

Engineering Security: Bridging DevOps and AppSec with Jon-Anthoney de Boer

Episode SummaryJon-Anthoney de Boer is the Product Security Lead at Transmax, overseeing security for critical infrastructure that manages traffic flow across Australia. Coming from a strong software engineering background, Jon-Anthoney shares his experience transitioning from traditional engineering into product and application security. He highlights the importance of aligning software engineering and security teams, building trust into the software development lifecycle, and fostering a security culture based on practical strategy rather than superficial metrics. Jon-Anthoney also discusses how behavioural change, organisational alignment, and operational excellence are key to achieving effective, sustainable security outcomes. Timestamps00:32 - Jon-Anthoney’s journey from electrical engineering to product security 05:08 - Transitioning from software craftsmanship to cybersecurity 09:30 - Why aligned incentives between engineering and security teams matter 12:22 - Goodhart's Law: pitfalls of security metrics 18:21 - Rethinking cybersecurity strategies beyond tools and compliance 25:12 - Building observability into the secure software development lifecycle 32:35 - Why executive support is crucial for security initiatives 38:34 - Operational excellence: removing waste from security processes Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

4월 16일

•

43분
2023. 06. 07.

Hacking the Game of Life: From Gaming Exploits to Cybersecurity Giant with Shubham Shah of Assetnote

Shubham Shah is co-founder and CTO of Assetnote, a cybersecurity tool used by companies like Atlassian, Qantas, and Australia Post. Shubham’s career in cybersecurity had very humble beginnings: he first learned to hack computer games as a kid so he could beat his brother. Shubham chats with Cole Cornford about video game exploits and what they can teach us about appsec, bug bounty hunting, the challenges of founding a company, and plenty more. Secured by Galah Cyber with Cole Cornford website 2:30 - Benefits of shared workspace. 5:30 - Shubham’s background. 9:00 - Bug bounty hunting. 10:45 - Developing a good work ethic from crappy jobs. 15:00 - Video game hacking. 21:00 - Tying video game hacking to cybersecurity. 22:40 - Shubham: got in trouble for hacking in high school. 24:20 - Shubham: had to convince his parents to let him study computer science. 26:00 - Shubham was working an unpaid internship. 26:50 - Cole: pros and cons of uni education. 29:20 - Shubham: I don’t discourage people from going to uni. 32:00 - Assetnote - discussing the company. 34:00 - Shubham started commercialising but “had no idea what I was doing”. 36:45 - Cole reflects on his early naivety when starting Galah Cyber. 38:30 - Pros and challenges of bootstrapping a business. 39:00 - Shubham: came close to running out of money. 40:45 - Cole: I see a vacuum for app sec talent in smaller orgs. 41:30 - Cole: software has eaten the world. Now AI is eating software. 43:10 - Shubham: division of work between Shubham and co-founder. 44:30 - Doing any job to move the business forward. 47:00 - Rapid-fire questions. Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

2023. 06. 07.

•

54분
2024. 08. 28.

Security Done Right: Ben Gittins on the Case for Generalists and Long-Term Solutions

SummaryBen Gittins is the Principal Security Engineer at Bugcrowd, one of the world's best bug bounty platforms. Ben has previously worked as a Senior DevSecOps Engineer at Canva, as well as DevSecOps Lead at SecureStack. In this conversation with Cole Cornford, Ben shares his belief that cybersecurity needs more generalists, how coding and AppSec have changed over time, whether cybersecurity qualifications are overrated, and plenty more. Timestamps3:50 - Why is Aus cybersecurity lagging behind? 9:50 - Over-reliance on purchasing cybersecurity products 14:40 - We ask too much of our AppSec professionals 19:00 - How App development & cybersecurity have changed over time 24:00 - "Greenfield projects" are often not realistic 28:20 - How to bring new people into the AppSec industry 32:00 - Importance of communication skills 38:20 - Cybersecurity qualifications are overrated 43:00 - Rapid fire questions Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

2024. 08. 28.

•

47분
2023. 08. 16.

An Agnostic Approach to AppSec: Ken Johnson on Navigating the Future with AI

Ken Johnson is co-founder of Dryrun Security and co-host of the Apsolute AppSec podcast. Ken has many years experience working in AppSec in a variety of roles, including CTO of nVisium and Application Security Engineer at GitHub. Ken chats with Cole Cornford about taking an agnostic approach to AppSec, transitioning from being an employee to a founder, how AI might change cybersecurity, and plenty more. Secured by Galah Cyber with Cole Cornford website Timestamps9:10 - When Ken started running AppSec conferences.12:00 - Ken: an “agnostic approach” to appsec really resonated with people.14:30 - Ken: “by nature we are always behind the curve”.15:40 - Ken: appsec is getting much harder.17:00 - Cole also advocates for an agnostic approach to appsec.18:50 - Ken’s favourite thing about Github: the culture.20:30 - discussing Github.25:00 - Appsec education.26:30 - quality software is secure software.27:30 - AI & Appsec.33:50 - Brief overview of Ken’s professional life, transition to being a founder.36:30 - Cole: people who plan to build a product alongside consulting.38:20 - Cole’s experience starting a consulting business.39:40 - Ken’s interests outside AppSec.40:40 - How Ken got into brazilian ju jitsu.44:10 - Cole’s pandemic experience. Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

2023. 08. 16.

•

48분
2024. 10. 02.

Building Cybersecurity Culture: Marketing, Awareness, and Diversity with Daisy Wong

Summary Daisy Wong is the Head of Security Awareness at Medibank, as well as a disability advocate. Originally from a marketing background, Daisy gained experience in the cybersecurity industry working as part of penetration teams, before making her way into the security culture and awareness space. In her conversation with Cole Cornford, Daisy discusses using the tools of marketing to educate people on cybersecurity, what are the hallmarks of a good security culture and awareness program, and the importance of diversity in cybersecurity. Timestamps 4:00 - Daisy's transition from marketing to cybersecurity 8:10 - The importance of security culture and awareness 11:00 - Building effective security awareness programs 14:15 - The role of diversity in cybersecurity 17:00 - Strategies for inclusive hiring practices 19:40 - The power of communication in security awareness 23:20 - Creative approaches to security awareness campaigns 31:45 - Daisy's personal perspective on the importance of diversity 43:40 - Rapid fire questions Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

2024. 10. 02.

•

47분

These are W2D1 Media produced shows