Application Security Weekly (Video)

Security Weekly Productions
  • 4,8 (4)
  • ACTUALITÉS TECHNOLOGIQUES
  • TOUTES LES 2 SEMAINES

About all things AppSec, DevOps, and DevSecOps. Hosted by Mike Shema and John Kinsella, the podcast focuses on helping its audience find and fix software flaws effectively.

  1. Researching and Remediating RCEs via GitHub Actions - Bar Kaduri, Roi Nisimi - ASW #355

    -2 J · VIDÉO

    Researching and Remediating RCEs via GitHub Actions - Bar Kaduri, Roi Nisimi - ASW #355

    Pull requests are a core part of collaboration, whether in open or closed source. GitHub has documented some of the security consequences of misconfiguring how PRs can trigger actions. But what happens when repo owners don't read the docs? Bar Kaduri and Roi Nisimi walk through their experience in reading docs, finding vulns, demonstrating exploits, and working with repo owners to improve their security. Their work highlights the challenges in maintaining good security guidance, figuring out secure defaults, and how so many orgs still struggle with triaging external security reports -- something that's becoming even more challenging when orgs are being flooded with low-quality reports from LLMs. Segment Resources: https://orca.security/resources/blog/pull-request-nightmare-github-actions-rce/ https://orca.security/resources/blog/pull-request-nightmare-part-2-exploits/ Show Notes: https://securityweekly.com/asw-355

    1 h 8 min
  2. Quantum Computing Isn't A Threat To Blockchains - Yet - Sandy Carielli, Martha Bennett - ASW #354

    28 OCT. · VIDÉO

    Quantum Computing Isn't A Threat To Blockchains - Yet - Sandy Carielli, Martha Bennett - ASW #354

    The post quantum encryption migration is going to be a challenge, but how much of a challenge? There are several reasons why it is different from every other protocol and cypher iteration in the past. Is today's hardware up to the task? Is it just swapping out a library, or is there more to it? What is the extent of software, systems, and architecture that have to be updated or replaced to complete the migration? Can we get it all done by 2030? Sandy Carielli and Martha Bennett join us to answer these questions and dive into one area of tech that hasn't been discussed much when it comes to post-quantum encryption: blockchain. Relevant Forrester Reports: Quantum Computing isn't a Threat to Blockchains - Yet The Architect's Guide to Quantum Security In the news, high standards for open source software, trends in self-hosting, doing the cloud wrong, and is it really always DNS? Show Notes: https://securityweekly.com/asw-354

    59 min
  3. Reacting to Ransomware and Setting Secure Defaults - Rob Allen - ASW #353

    21 OCT. · VIDÉO

    Reacting to Ransomware and Setting Secure Defaults - Rob Allen - ASW #353

    Ransomware attacks typically don't care about memory safety and dependency scanning, they often target old, unpatched vulns and too often they succeed. Rob Allen shares some of the biggest cases he's seen, what they have in common, and what appsec teams could do better to help them. Too much software still requires custom configuration to make it more secure. And too few software makers are embracing secure by default, let alone secure by design. In the news, passively monitoring geosynchronous satellite communications on the cheap, successful LLM poisoning of any size model with a single size dose, security engineering lessons from Signal's post-quantum crypto work, improving security for JavaScript in the browser, and more! This segment is sponsored by ThreatLocker. Visit https://securityweekly.com/threatlocker to learn more! Show Notes: https://securityweekly.com/asw-353

    1 h 4 min
  4. Inside the OWASP GenAI Security Project - Steve Wilson - ASW #352

    14 OCT. · VIDÉO

    Inside the OWASP GenAI Security Project - Steve Wilson - ASW #352

    Interest and participation in the OWASP GenAI Security Project has exploded over the last two years. Steve Wilson explains why it was important for the project to grow beyond just a Top Ten list and address more audiences than just developers. He also talks about how the growth of AI Agents influences the areas that appsec teams need to focus on. Whether apps are created by genAI or directly use genAI, the future of securing software is going to be busy. Resources https://genai.owasp.org https://genai.owasp.org/llm-top-10/ LLM security book on Amazon at https://a.co/d/6LZoXxQ This segment is sponsored by The OWASP GenAI Security Project. Visit https://securityweekly.com/owasp to learn more! Show Notes: https://securityweekly.com/asw-352

    1 h 8 min
  5. Finding Large Bounties with Large Language Models - Nico Waisman - ASW #351

    7 OCT. · VIDÉO

    Finding Large Bounties with Large Language Models - Nico Waisman - ASW #351

    Software has forever had flaws and humans have forever been finding and fixing them. With LLMs generating code, appsec has also been trying to determine how well LLMs can find flaws. Nico Waisman talks about XBOW's LLM-based pentesting, how it climbed a bug bounty leaderboard, how it uses feedback loops for better pentests, and how they handle (and even welcome!) hallucinations. In the news, using LLMs to find flaws, directory traversal in an MCP, another resource for learning cloud and AI security, spreadsheets and appsec, and more! Show Notes: https://securityweekly.com/asw-351

    54 min
  6. Changing the Vuln Conversation from Volume to Remediation - Francesco Cipollone - ASW #350

    30 SEPT. · VIDÉO

    Changing the Vuln Conversation from Volume to Remediation - Francesco Cipollone - ASW #350

    Dealing with vulns tends to be a discussion about prioritization. After all, there a tons of CVEs and dependencies with known vulns. It's important to figure out how to present developers with useful vuln info that doesn't overwhelm them. Francesco Cipollone shares how to redirect that discussion to focus on remediation and how to incorporate LLMs into this process without losing your focus or losing your budget. In the news, supply chain security in Ruby and Rust, protecting package repositories, refining CodeQL queries for security, refactoring and Rust, an OWASP survey, and more! Show Notes: https://securityweekly.com/asw-350

    1 h 15 min
  7. Design Errors in Entra ID, Design Defenses in iOS, Design Difficulties in DeepSeek - ASW #349

    23 SEPT. · VIDÉO

    Design Errors in Entra ID, Design Defenses in iOS, Design Difficulties in DeepSeek - ASW #349

    In the news, Microsoft encounters a new cascade of avoidable errors with Entra ID, Apple improves iOS with hardware-backed memory safety, DeepSeek demonstrates the difficulty in reviewing models, curl reduces risk by eliminating code, preserving the context of code reviews, and more! Show Notes: https://securityweekly.com/asw-349

    59 min
  8. How OWASP's GenAI Security Project keeps up with the pace of AI/Agentic changes - Scott Clinton - ASW #348

    16 SEPT. · VIDÉO

    How OWASP's GenAI Security Project keeps up with the pace of AI/Agentic changes - Scott Clinton - ASW #348

    This week, we chat with Scott Clinton, board member and co-chain of the OWASP GenAI Security Project. This project has become a massive organization within OWASP with hundreds of volunteers and thousands of contributors. This team has been cranking out new tools, reports and guidance for practitioners month after month for over a year now. We start off discussing how Scott and other leaders have managed to keep up with the crazy rate of change in the AI world. We pivot to discussing some of the specific projects the team is working on, and finally discuss some of the biggest AI security challenges before wrapping up the conversation. If you're neck-deep in AI like we are, I highly recommend checking out this conversation, and consider joining this OWASP project, sponsoring them, or just checking out what they have to offer (which is all free, of course). Segment Resources: Get started with the OWASP GenAI Security Project Register for the GenAI Application Security & Risk Summit on October 9th, 11am - 4pm EST This segment is sponsored by The OWASP GenAI Security Project. Visit https://securityweekly.com/owasp to learn more about them! Show Notes: https://securityweekly.com/asw-348

    1 h 8 min
Tout afficher (682)

Notes et avis

4,8
sur 5
4 notes

À propos

About all things AppSec, DevOps, and DevSecOps. Hosted by Mike Shema and John Kinsella, the podcast focuses on helping its audience find and fix software flaws effectively.

Informations

  • Création
    Security Weekly Productions
  • Années d’activité
    2018 - 2025
  • Épisodes
    682
  • Classification
    Tous publics
  • Copyright
    © 2024 CyberRisk Alliance
  • Site web de l’émission
    Application Security Weekly (Video)

Vous aimeriez peut‑être aussi