bed time :)

devsecops

The OWASP Top Ten Proactive Controls Project is spearheaded by Jim Bird and Jim Manico. According to Jim Bird, it is a list of security techniques that should be included in every software development project. I spoke with him about the evolution of the project and how he envisions it being used by the OWASP community, and specifically by developers. 

Resources for this Broadcast
<a href="https://www.owasp.org/index.php/OWASP_Proactive_Controls">OWASP Top Ten Proactive Controls Project </a>
<a href="ca.linkedin.com/pub/jim-bird/3/4b2/646">Jim Bird on LinkedIn</a>

About Jim Bird
Jim Bird is a software development manager and CTO with more than 25 years of experience in software engineering, with a special focus on high-integrity and high-reliability systems. Jim is currently the co-founder and CTO of a major US-based institutional trading service, where he is responsible for managing the company’s technology group and IT security programs. Jim has worked as a consultant to IBM and to major stock exchanges and banks globally. He was also the CTO of a technology firm (now part of NASDAQ OMX) that built custom IT solutions for stock exchanges and central banks in more than 30 countries. Jim is an active contributor to OWASP, helps out as a member of the SANS Analysts program on application security, and rants about Agile software development, project management and application security topics on his blog “Building Real Software.

The OWASP Top Ten Proactive Controls Project  with Jim Bird

In this segment, we talk with the co-coordinators of the OWASP OWTF Project. The aim of the project is to make security assessments as efficient as possible by automating the manual, uncreative part of pen testing.

OWASP Offensive Web Testing Framework with Bharadwaj Machiraju and Abraham Aranguren

The OWASP Top 10 Proactive Controls Project uses the OWASP Top 10 model as a way to encourage the community to participate in the building and maintenance of a Top 10 project aimed at developers. In this interview, I talk with Jim Manico and Katy Anton on the history of the project, how they anticipate it being utilized, and how they have worked with the community do decide the criteria for building the list of controls.

OWASP Top 10 Proactive Controls Project with Jim Manico and Katy Anton

<img src="http://twit.cachefly.net/coverart/sn/sn144audio.jpg" align="right" hspace="20" vspace="20" border="0" title="Security Now" alt="Security Now"/>Hosts: <a href="https://twit.tv/people/leo-laporte">Leo Laporte</a>, <a href="https://twit.tv/people/steve-gibson">Steve Gibson</a>
BadLock, the latest draft of the Burr/Feinstein encryption&nbsp;bill, the iPhone FBI hack update, a worrisome architectural problem in Mozilla's Firefox extension handling, HTTPS gets a BIG new supporter, at least tens of thousands of commercial CCTV DVRs can be remotely hacked, Amazon is (was) selling a malware-infected Webcam system, and the results of Steve's deep dive into the security of WhatsApp.
We invite you to read our <a href="https://www.grc.com/sn/SN-555-Notes.pdf">show notes</a>.
Download or subscribe to this show at <a href="https://twit.tv/shows/security-now">https://twit.tv/shows/security-now</a>.
You can submit a question to Security Now! at the <a href="http://grc.com/feedback.htm" target="_blank">GRC Feedback Page</a>.
For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: <a href="http://grc.com/securitynow.htm" target="_blank">grc.com</a>, also the home of the best disk maintenance and recovery utility ever written <a href="http://spinrite.info/" target="_blank">Spinrite 6</a>.
Bandwidth for Security Now is provided by <a href="http://cachefly.com/" target="_blank">Cachefly</a>.

SN 555: WhatsApp

<img src="http://twit.cachefly.net/coverart/sn/sn144audio.jpg" align="right" hspace="20" vspace="20" border="0" title="Security Now" alt="Security Now"/>Hosts: <a href="https://twit.tv/people/leo-laporte">Leo Laporte</a>, <a href="https://twit.tv/people/steve-gibson">Steve Gibson</a>
The U.S. Congress passed a new eMail privacy act, Edward Snowden and Fareed Zakaria debate, the still unresolved fingerprint question, Android's continuing troubles with "Stagefright", Brazillian judge shuts down WhatsApp for three days, will the real Satoshi Nakamura please stand up? And Steve answers more of your questions!
We invite you to read our <a href="https://www.grc.com/sn/SN-558-Notes.pdf">show notes</a>.
Download or subscribe to this show at <a href="https://twit.tv/shows/security-now">https://twit.tv/shows/security-now</a>.
You can submit a question to Security Now! at the <a href="http://grc.com/feedback.htm" target="_blank">GRC Feedback Page</a>.
For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: <a href="http://grc.com/securitynow.htm" target="_blank">grc.com</a>, also the home of the best disk maintenance and recovery utility ever written <a href="http://spinrite.info/" target="_blank">Spinrite 6</a>.
Bandwidth for Security Now is provided by <a href="http://cachefly.com/" target="_blank">Cachefly</a>.

SN 558: Bit Con

<img src="http://twit.cachefly.net/coverart/sn/sn144audio.jpg" align="right" hspace="20" vspace="20" border="0" title="Security Now" alt="Security Now"/>Leo and I catch up with another packed week of security news, including an update on mobile ransomware, the successful extraction of Android's full disk encryption (FDE) master keys, Google's Tavis Ormandy finds horrific flaws in all Symantec traffic analyzing software, a Brazilian judge is at it again with WhatsApp, this week's IoT horror story, some miscellany and errata, and finally a look at a horribly flawed attempt to copy Let's Encrypt automation of free SSL certificate issuance. We invite you to read our <a href="https://www.grc.com/sn/SN-567-Notes.pdf">show notes</a>.
 
Download or subscribe to this show at <a href="https://twit.tv/shows/security-now">https://twit.tv/shows/security-now</a>.
You can submit a question to Security Now! at the <a href="http://grc.com/feedback.htm" target="_blank">GRC Feedback Page</a>.
For 16kbps versions, transcripts, and notes (including fixes), visit Steve's site: <a href="http://grc.com/securitynow.htm" target="_blank">grc.com</a>, also the home of the best disk maintenance and recovery utility ever written <a href="http://spinrite.info/" target="_blank">Spinrite 6</a>.
Bandwidth for Security Now is provided by <a href="http://cachefly.com/" target="_blank">Cachefly</a>.

SN 567: Hacking Certificates

Jason Schmitt's passion is to assure security is built into the development process, not just as a bolt-on add-on.  His experience in various aspects of software security has led him on a path through mobile, application and cloud security. In our conversation, Jason talks about the value OWASP provides to the community as well as what he perceives as a critical time for the integration between DevOps and security. 

About Jason Schmitt

Jason Schmitt is vice president and general manager of HPE Security  Products, Fortify for Hewlett Packard Enterprise. He is responsible for driving the growth of Fortify’s  software security business and managing all operational functions  within the group.  Schmitt has extensive experience in product management,  development and marketing for all types of web and security  technologies. His expertise ranges from cloud-based secure web  gateways, to application security and mobile security consulting  services, to network-based video surveillance.

Security as Part of DevOps and Development with Jason Schmitt

The inclusion of security as an integral piece of the DevOps puzzle continues to gain traction. In this episode of the DevSecOps Days Podcast Series, I speak with Curtis Yanko and Scott McCarty about their new book, "A Concise Introduction to DevSecOps". We discuss why they wrote the book, who the audience is that will benefit from it and why enterprises should be considering security as part of the software development environment.

with Curtis Yanko and Scott McCarty

A Concise Introduction to DevSecOps

The OWASP Podcast Series is a recorded series of discussions with thought leaders and practitioners who are working on securing the future for coming generations.