<i>"You can't automate all tests. There are a lot of things you can't find automatically. You have to have somebody who knows what they are looking for." -- Simon Bennetts</i>

In today's segment, I talk with Simon Bennetts, project lead for the OWASP <a href="https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project">Zed Attack Proxy Project</a> or "ZAP" for short. Simon is working on a user friendly tool for integrated penetration testing of web applications. Our discussion took place at AppSec USA 2013. We begin with an overview of the ZAP project and talk about how it came about.

<b>About Simon Bennetts</b>
Simon Bennetts (a.k.a. Psiinon) has been developing web applications since 1997, and strongly believes that you cannot build secure web applications without knowing how to attack them.

He works for Mozilla as part of their Security Team.

Some of the projects Simon works on:
-- OWASP Zed Attack Proxy project lead
-- OWASP Vulnerable Web Applications Directory Project joint project lead
-- Mozilla Zest project lead
-- Mozilla Plug-n-Hack joint project lead
-- Bodge It Store project lead
-- OWASP Web Application Security Testing Cheat Sheet joint author
-- OWASP AppSensor contributor
-- wavsep contributor
-- OWASP Data Exchange Format project lead (currently inactive)

AppSec USA 2013: Zed Attack Proxy Project with Simon Bennetts

In this episode, Matt Tesauro hosts Adam Shostack to talk about threat modeling - not only what it is but what Adam has learned from teaching numerous teams how to do threat modeling. Learn what makes a good threat model and some news about a new book from Adam to help further the spread of threat modeling with the end goal of more threat modeling and fewer security surprises.  Enjoy!

Show Links:
- Threats Book site: https://threatsbook.com/
- Resources on Adam’s website: https://shostack.org/resources

OWASP Podcast

Threat Modeling using the Force with Adam Shostack - OWASP Podcast e001

Annotations and transcribed highlights: http://www.brainpickings.org/2015/06/16/neil-gaiman-how-stories-last

Recorded at the Long Now Foundation (http://longnow.org/) on June 9, 2015. 

Follow @https://soundcloud.com/longnow and subscribe to the podcast of their excellent seminars on long-term thinking on iTunes: https://itunes.apple.com/us/podcast/seminars-about-long-term-thinking/id186908455?mt=2

MORE / TRANSCRIPT

Neil Gaiman on how stories last

The OWASP Podcast Series is a recorded series of discussions with thought leaders and practitioners who are working on securing the future for coming generations.

AppSec USA 2013: Zed Attack Proxy Project with Simon Bennetts

The OWASP Podcast Series

Related tracks