W2D1 Media

・

頻道・共 2 個節目

創業

創業

完整系列
科技

科技

隔週更新

7月23日

ISM 2025 Explained: What CISOs, Devs and Security Leads Need to Know - with Toby Amodio

Episode SummaryThe Australian Information Security Manual (ISM) just got a major update, and not everyone’s thrilled. In this special episode of Secured, Cole Cornford is joined by Toby Amodio (Head of Professional Services, Fujitsu Cyber) to break down what’s changed, what’s missing, and what it all means for CISOs, AppSec teams and public sector security leads. From the new cybersecurity principles (and why they feel like yak shaving) to the long-overdue expansion of software security controls, Cole and Toby navigate the mess of frameworks, missing maturity models, and babushka-doll-style mappings that have left many teams overwhelmed. They also reflect on what “secure-by-default” really means in a world of legacy codebases, overstretched resources, and one-person AppSec teams. Timestamps01:02 – Why ISM Updates Matter (Even If They’re Late) 02:32 – New Principles: Nice Idea, Hard to Implement 04:08 – Yak Shaving and the Complexity Cascade 07:48 – Mapping Mayhem: PSPF, E8 and Governance Overload 10:25 – Losing the Maturity Model: Who Does That Help? 13:46 – Secure-by-Default and the Problem with OWASP-as-a-Proxy 18:13 – Integration, Incentives, and Cyber vs. Business Silos 20:34 – The Talent Gap and Why Code Reviews Still Matter 22:58 – Galah Cyber, Capability Building & Doing AppSec Right 23:57 – Why Buying Tools Isn’t the Same as Building Capability 25:21 – What Red, Amber, Green Tools Really Miss 26:01 – One ISM to Rule Them All… If You Can Implement It 26:52 – Final Thoughts (and a Funding Stick for CISOs) Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

7月23日

・

29 分鐘
2月12日

The Story So Far: Inside Secured’s Growth and What’s Coming Next

Episode SummaryIn this special solo episode, host Cole Cornford reflects on the journey of the Secured podcast over the past two years. He shares behind-the-scenes insights, from the unexpected challenges of cicada season disrupting recordings to the podcast’s growth, hitting 45 episodes and over 7,000 downloads. Cole discusses listener feedback, format changes, and his plans to expand the show, including moving to weekly episodes, introducing video content, and diversifying guest profiles. He also highlights listener engagement stats, the importance of audience reviews, and the future direction of Secured with a focus on delivering more valuable and dynamic cybersecurity content. Timestamps00:20 – The impact of cicada season on recording and production 01:10 – Hitting 45 episodes: reflections on the podcast’s growth 01:54 – Asking for listener feedback and reviews to support the show 02:51 – Plans to move to weekly episodes and potential sponsorships 03:51 – The possibility of introducing video content and its challenges 04:35 – Listener engagement stats: unique listeners, downloads, and demographics 08:05 – Most downloaded and highest engagement episodes revealed 10:55 – Diversity in guests and topics: striving for representation 13:48 – Changes in podcast format: cutting certain segments for better engagement 17:03 – The shift towards professional development-focused content 19:50 – Future goals: more international guests and sharper conversations Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

2月12日

・

24 分鐘
4月2日

Scaling Cyber at Fujitsu: Laura O'Neill on Strategy, Risk and Growth

Episode SummaryIn this episode of Secured, host Cole Cornford chats with Laura O'Neill from Fujitsu Cyber. Laura shares her journey from a pure maths and cryptography background through management consulting into the world of cybersecurity. She explains how she helped grow MF&A from a small team into a 70-person company before its acquisition by Fujitsu. Cole and Laura discuss the challenges of scaling a cyber practice, the importance of professionalising sales and board-level communications, and how embracing diverse, non-traditional talent can transform the industry. Their conversation offers valuable insights into shifting from a compliance-based mindset to a risk-based strategy that truly supports business objectives. Timestamps00:10 - Introduction to Laura O'Neill and her role at Fujitsu Cyber 02:27 - Laura recounts her journey from pure maths and cryptography to cybersecurity 05:31 - Discussing the rapid growth of MF&A from a small team to 70 staff 07:30 - Overcoming scaling challenges through improved processes and support 11:23 - Professionalising sales and board-level communications in cyber 15:30 - Moving from a compliance-driven approach to a risk-based strategy 26:16 - Embracing diversity and non-traditional hiring in cybersecurity 31:20 - The value of diverse backgrounds and soft skills in solving security challenges 40:43 - The importance of empathy and listening in leadership 42:16 - Closing thoughts on security as an enabling function for business success Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

4月2日

・

44 分鐘
4月16日

Engineering Security: Bridging DevOps and AppSec with Jon-Anthoney de Boer

Episode SummaryJon-Anthoney de Boer is the Product Security Lead at Transmax, overseeing security for critical infrastructure that manages traffic flow across Australia. Coming from a strong software engineering background, Jon-Anthoney shares his experience transitioning from traditional engineering into product and application security. He highlights the importance of aligning software engineering and security teams, building trust into the software development lifecycle, and fostering a security culture based on practical strategy rather than superficial metrics. Jon-Anthoney also discusses how behavioural change, organisational alignment, and operational excellence are key to achieving effective, sustainable security outcomes. Timestamps00:32 - Jon-Anthoney’s journey from electrical engineering to product security 05:08 - Transitioning from software craftsmanship to cybersecurity 09:30 - Why aligned incentives between engineering and security teams matter 12:22 - Goodhart's Law: pitfalls of security metrics 18:21 - Rethinking cybersecurity strategies beyond tools and compliance 25:12 - Building observability into the secure software development lifecycle 32:35 - Why executive support is crucial for security initiatives 38:34 - Operational excellence: removing waste from security processes Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

4月16日

・

43 分鐘
2023/06/07

Hacking the Game of Life: From Gaming Exploits to Cybersecurity Giant with Shubham Shah of Assetnote

Shubham Shah is co-founder and CTO of Assetnote, a cybersecurity tool used by companies like Atlassian, Qantas, and Australia Post. Shubham’s career in cybersecurity had very humble beginnings: he first learned to hack computer games as a kid so he could beat his brother. Shubham chats with Cole Cornford about video game exploits and what they can teach us about appsec, bug bounty hunting, the challenges of founding a company, and plenty more. Secured by Galah Cyber with Cole Cornford website 2:30 - Benefits of shared workspace. 5:30 - Shubham’s background. 9:00 - Bug bounty hunting. 10:45 - Developing a good work ethic from crappy jobs. 15:00 - Video game hacking. 21:00 - Tying video game hacking to cybersecurity. 22:40 - Shubham: got in trouble for hacking in high school. 24:20 - Shubham: had to convince his parents to let him study computer science. 26:00 - Shubham was working an unpaid internship. 26:50 - Cole: pros and cons of uni education. 29:20 - Shubham: I don’t discourage people from going to uni. 32:00 - Assetnote - discussing the company. 34:00 - Shubham started commercialising but “had no idea what I was doing”. 36:45 - Cole reflects on his early naivety when starting Galah Cyber. 38:30 - Pros and challenges of bootstrapping a business. 39:00 - Shubham: came close to running out of money. 40:45 - Cole: I see a vacuum for app sec talent in smaller orgs. 41:30 - Cole: software has eaten the world. Now AI is eating software. 43:10 - Shubham: division of work between Shubham and co-founder. 44:30 - Doing any job to move the business forward. 47:00 - Rapid-fire questions. Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

2023/06/07

・

54 分鐘
2024/08/28

Security Done Right: Ben Gittins on the Case for Generalists and Long-Term Solutions

SummaryBen Gittins is the Principal Security Engineer at Bugcrowd, one of the world's best bug bounty platforms. Ben has previously worked as a Senior DevSecOps Engineer at Canva, as well as DevSecOps Lead at SecureStack. In this conversation with Cole Cornford, Ben shares his belief that cybersecurity needs more generalists, how coding and AppSec have changed over time, whether cybersecurity qualifications are overrated, and plenty more. Timestamps3:50 - Why is Aus cybersecurity lagging behind? 9:50 - Over-reliance on purchasing cybersecurity products 14:40 - We ask too much of our AppSec professionals 19:00 - How App development & cybersecurity have changed over time 24:00 - "Greenfield projects" are often not realistic 28:20 - How to bring new people into the AppSec industry 32:00 - Importance of communication skills 38:20 - Cybersecurity qualifications are overrated 43:00 - Rapid fire questions Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

2024/08/28

・

47 分鐘
2023/08/16

An Agnostic Approach to AppSec: Ken Johnson on Navigating the Future with AI

Ken Johnson is co-founder of Dryrun Security and co-host of the Apsolute AppSec podcast. Ken has many years experience working in AppSec in a variety of roles, including CTO of nVisium and Application Security Engineer at GitHub. Ken chats with Cole Cornford about taking an agnostic approach to AppSec, transitioning from being an employee to a founder, how AI might change cybersecurity, and plenty more. Secured by Galah Cyber with Cole Cornford website Timestamps9:10 - When Ken started running AppSec conferences.12:00 - Ken: an “agnostic approach” to appsec really resonated with people.14:30 - Ken: “by nature we are always behind the curve”.15:40 - Ken: appsec is getting much harder.17:00 - Cole also advocates for an agnostic approach to appsec.18:50 - Ken’s favourite thing about Github: the culture.20:30 - discussing Github.25:00 - Appsec education.26:30 - quality software is secure software.27:30 - AI & Appsec.33:50 - Brief overview of Ken’s professional life, transition to being a founder.36:30 - Cole: people who plan to build a product alongside consulting.38:20 - Cole’s experience starting a consulting business.39:40 - Ken’s interests outside AppSec.40:40 - How Ken got into brazilian ju jitsu.44:10 - Cole’s pandemic experience. Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

2023/08/16

・

48 分鐘
2024/10/02

Building Cybersecurity Culture: Marketing, Awareness, and Diversity with Daisy Wong

Summary Daisy Wong is the Head of Security Awareness at Medibank, as well as a disability advocate. Originally from a marketing background, Daisy gained experience in the cybersecurity industry working as part of penetration teams, before making her way into the security culture and awareness space. In her conversation with Cole Cornford, Daisy discusses using the tools of marketing to educate people on cybersecurity, what are the hallmarks of a good security culture and awareness program, and the importance of diversity in cybersecurity. Timestamps 4:00 - Daisy's transition from marketing to cybersecurity 8:10 - The importance of security culture and awareness 11:00 - Building effective security awareness programs 14:15 - The role of diversity in cybersecurity 17:00 - Strategies for inclusive hiring practices 19:40 - The power of communication in security awareness 23:20 - Creative approaches to security awareness campaigns 31:45 - Daisy's personal perspective on the importance of diversity 43:40 - Rapid fire questions Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

2024/10/02

・

47 分鐘
2024/06/19

Behind Elttam: Matt Jones Discusses Infosec Innovations and Australia's Cybersecurity Landscape

Summary In this episode, Cole Cornford chats with Matt Jones, co-founder of Elttam, an independent security boutique that provides security assessment services. On top of his role at Elttam, Matt is active in the infosec community in a variety of ways, including helping with BSides Canberra's call for papers and writing open-source tooling such as talkback.sh. Cole and Matt chat about the motivation behind founding Elttam, why Australia's infosec industry is lagging behind other parts of the world, the exploit development space, and plenty more. Timestamps 2:00 - Matt's career background 7:00 - Matt's early challenges finding an opportunity in cybersecurity 11:00 - Why Matt chose to co-found Elttam 13:00 - Cole: Australia's infosec industry is immature compared to US 19:00 - The importance of specialisation 20:30 - Better to do 1 thing really well when bootstrapping 24:00 - Using the right approach for the right context 25:30 - Risks of using a bug bounty program 31:10 - Cole: the bar for pen testing reports should be much higher 37:10 - Training & education for infosec 39:00 - Cole: is infosec a cottage industry? 44:00 - Product vs service approach to cybersecurity 47:50 - Cole: I like looking at source code from 80s and 90s 49:00 - Rapid fire questions Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

2024/06/19

・

56 分鐘
2024/10/09

Open-Source Software: Balancing Innovation and Security with Ilkka Turunen, CTO of Sonatype

Episode SummaryIlkka Turunen is the CTO at Sonatype, a company that helps millions of software developers use open-source software while minimising security risk. In this conversation, Ilkka chats with Cole Cornford about the benefits and risk of using open-source software, how Maven helped standardise software development processes, the different approaches to AppSec regulation in Australia and Europe, and plenty more. Timestamps1:33 - Ilkka's career background 4:00 - Varying quality of open-source software 6:10 - How Maven helped standardise software development processes 13:00 - The balance between speed of delivery & quality 17:00 - Importance of environment parity in software dev 21:40 - Risk of using 3rd party code in software 25:10 - Regulation of AppSec in Australia vs Europe 32:10 - How new European software security regulations will be enforced 35:00 - Recommendations for compliance with European regulations 39:00 - Rapid fire questions Mentioned in this episode: Call for Feedback This podcast uses the following third-party services for analysis: Podtrac - https://analytics.podtrac.com/privacy-policy-gdrp Spotify Ad Analytics - https://www.spotify.com/us/legal/ad-analytics-privacy-policy/

2024/10/09

・

47 分鐘

These are W2D1 Media produced shows