Josh Grossman - building Appsec programs, bridging security and developer gaps
Release Date: 04/15/2024
Josh Grossman - building Appsec programs, bridging security and developer gaps
BrakeSec Education Podcast
Youtube VOD: #appsec, #owasp, #ASVS, #joshGrossman, #informationsecurity, #SBOM, #supplychain, #podcast, #twitch, #brakesec, #securecoding, #Codeanalysis Questions and topics: 1. The background to the topic, why is it something that interests you? How do you convince developers to take your course? 2. What do you think the root cause of the gap is? 3. Who is causing the gaps? (‘go fast’ culture, overzealous security, GRC requirements, basically everyone?) 4. Where do gaps begin? Is it the ‘need’ to ‘move fast’? 5. What can devs do to involve security in their process?...
info_outline
Managing messaging with management, becoming a CISO with Mary Gardner from Goldiknox
BrakeSec Education Podcast
Disclaimer: The views, information, or opinions expressed on this program are solely the views of the individuals involved and by no means represent absolute facts. Opinions expressed by the host and guests can change at any time based on new information and experiences and do not represent views of past, present, or future employers. Recorded: 08 Apr 2024 Youtube VOD: https://www.youtube.com/watch?v=K8qApvsFtqw Show Topic Summary: If you want to get in the mind of a board member, I submit to you my discussion with we did last night on . Join Mary and I as we discuss...
info_outline
p2-accidentalCISO, building trust in new places
BrakeSec Education Podcast
Full Youtube VOD: Questions and topics: Let’s talk about Mindful Business Podcast What’s the topics you cover? Topic #1: discuss your experiences when you were a new leader. What worked? What didn't? What would you have done differently? Do you emulate your manager's style? What have been your go-to management resources? What is a good piece of advice that you’ve been given or that you impart to others that relates to leadership? Topic #2: building/Operating SaaS products (we can discuss securing them, what functions...
info_outline
AccidentalCISO on BrakeSecEd, talking Leadership, SaaS development, and Appsec
BrakeSec Education Podcast
Disclaimer: The views, information, or opinions expressed on this program are solely the views of the individuals involved and by no means represent absolute facts. Opinions expressed by the host and guests can change at any time based on new information, and do not represent views of past, present, or future employers. Recorded: 28 Jan 2024 Youtube VOD: https://youtube.com/live/uX7odQTBkyQ Questions and topics: Let’s talk about Mindful Business Podcast What’s the topics you cover? Topic #1: discuss your experiences when you were a new leader. What...
info_outline
1st show of 2024! Our 10th Anniversary...
BrakeSec Education Podcast
It's our 10th anniversary and the first show of our 2024 season! Amanda was on "7 minute security" Check out the complete VOD at Explicit language warning
info_outline
Brakesec Call to Action 2023
BrakeSec Education Podcast
Youtube Video: is the link to the survey. Your information (should you choose to identify yourself) will not be shared outside of the BrakeSec Team. Thank all of you for listening and for your input. RSS feed for the audio podcast is at website:
info_outline
How to get more headcount, BLUFFs Vulnerability, and Ranty Clause debuts!
BrakeSec Education Podcast
Show Topic Summary: Ms. Berlin proposes a question of how to gather more headcount with metrics, we discuss the BLUFFS bluetooth vulnerability, and “Ranty Claus” talks about CISA’s remarks of putting the onus on device product makers to remove choice for customers and implement secure defaults. #youtube VOD: Questions and topics: Additional information / pertinent LInks (Would you like to know more?): Examples of companies forcing changes - eBPF implementation in Rust Show points of Contact: Amanda...
info_outline
25Oct - okta breached (again), Energy company hit by supply chain attack, and you can help hire the best people
BrakeSec Education Podcast
Subscribe on Twitch using Amazon Prime and watch us live: https://twitch.tv/brakesec Check out our VODs on Youtube: Join the BrakeSecEd discord: News:
info_outline
Nicole Sundin - CPO at Axio - SEC compliance, usable security, setting up risk mgmt programs
BrakeSec Education Podcast
Disclaimer: The views, information, or opinions expressed on this program are solely the views of the individuals involved and by no means represent absolute facts. Opinions expressed by the host and guests can change at any time, and do not represent views of past, present, or future employers. Guest Bio: Nicole is the Chief Product Officer at Axio. Nicole has spent her career building awareness around the benefits of usable security and human-centered security as a way to increase company revenue and create a seamless user experience. Youtube VOD Link: Questions and...
info_outline
John Aron, letters of marque, what does a "junior" job look like with AI?
BrakeSec Education Podcast
Disclaimer: The views, information, or opinions expressed on this program are solely the views of the individuals involved and by no means represent absolute facts. Opinions expressed by the host and guests can change at any time, and do not represent views of past, present, or future employers. Guest Bio: John is the CEO of Aronetics. An avid climber and runner, John has spoken at many conferences about topics like ZeroTrust, BIOS/UEFI security, communication security, and malware. Aronetics is a technology-enabled service provider. Youtube VOD:...
info_outlineYoutube VOD: https://youtu.be/G3PxZFmDyj4
#appsec, #owasp, #ASVS, #joshGrossman, #informationsecurity, #SBOM, #supplychain, #podcast, #twitch, #brakesec, #securecoding, #Codeanalysis
Questions and topics:
1. The background to the topic, why is it something that interests you?
How do you convince developers to take your course?
2. What do you think the root cause of the gap is?
3. Who is causing the gaps? (‘go fast’ culture, overzealous security, GRC requirements, basically everyone?)
4. Where do gaps begin? Is it the ‘need’ to ‘move fast’?
5. What can devs do to involve security in their process? Sprint planning? SCA tools?
6. How have you seen this go wrong at organizations?
7. How important is it to have security early in the product development process?
8. What sort of challenges do you think mainstream security people face in AppSec scenarios?
9. How does Product Security differ from Application Security? (what if the product is an application?)
10. What are the key development concepts that security people need to be familiar with to effectively get involved in AppSec/ProdSec?
11.. How do you suggest a security team approach AppSec/ProdSec?
Leadership buy-in
Effective/valuable processes
Tools should achieve a goal
12. SBOM - NTIA is asking for it, How to get dev teams to care.
13. Key takeaways?
Additional information / pertinent LInks (Would you like to know more?):
BlackHat Training: https://www.blackhat.com/us-24/training/schedule/index.html#accelerated-appsec--hacking-your-product-security-programme-for-velocity-and-value-virtual-37218
https://www.walkme.com/blog/leadership-buy-in/
https://www.bouncesecurity.com/
https://www.teamgantt.com/blog/raci-chart-definition-tips-and-example
https://www.cisa.gov/sbom
SCA Tools https://chpk.medium.com/top-10-software-composition-analysis-sca-tools-for-devsecops-85bd3b7512dd
https://semgrep.dev/
https://www.linkedin.com/in/joshcgrossman
https://owasp.org/www-project-application-security-verification-standard/
https://github.com/OWASP/ASVS/tree/master/5.0
https://owasp.org/www-project-cyclonedx/
https://joshcgrossman.com/
PyCon talk about custom security testing: https://www.youtube.com/watch?v=KuNZzDjvMlg
Michal's Black Hat course - Accurate and Scalable: Web Application Bug Hunting: https://www.blackhat.com/us-24/training/schedule/index.html#accurate-and-scalable-web-application-bug-hunting-37210
https://www.blackhat.com/us-24/training/schedule/index.html#accurate-and-scalable-web-application-bug-hunting-372101705524544
ASVS website: https://owasp.org/asvs
Lightning talk I did recently about OWASP: https://www.bouncesecurity.com/eventspast#f86548cb37cb2a82728b1762bd1b7aee
Show points of Contact:
Amanda Berlin: @infosystir @hackershealth
Brian Boettcher: @boettcherpwned
Bryan Brake: https://linkedin.com/in/brakeb
Brakesec Website: https://www.brakeingsecurity.com
Youtube channel: https://youtube.com/@brakeseced
Twitch Channel: https://twitch.tv/brakesec