Software supply chain seems to be front and center for technologists, cybersecurity and many governments. One of the early pioneers in this space was Steve Springett with two highly successful projects: OWASP Dependency Track and CycloneDX. In this episode, we catch up with Steve to talk about how he got started in software supply chain management as well as the explosive growth for Dependency Track and ClycloneDX. We also touch on future developments for CycloneDX and places where Steve never expected to see his projects go.  Enjoy!

Show Links:

- OWASP Dependency Track: https://dependencytrack.org/
- Dependency Track Github: https://github.com/DependencyTrack
- CycloneDX: https://cyclonedx.org/
- CycloneDX Github: https://github.com/CycloneDX
- Software Component Verification Standard: https://scvs.owasp.org/
Social Media links:
- https://twitter.com/stevespringett
- https://infosec.exchange/@stevespringett
- https://www.linkedin.com/in/stevespringett/

OWASP Podcast

SBOMS, CycloneDX and Dependency Track: Automation for Survival with Steve Springett

In this episode we talk with Zain Haq and take a leap and bound over the first and second line to discover more about the third line - internal audit. We discover answers to a number of questions: What role does audit play in the overall cybersecurity of an organization? What does the CISO gain from having an audit function? What makes a good auditor? Learn how to get the most out of audit and what they bring to the table. Special thanks to Tina Turner for inspiring the show title. ;-)

Show Links:

- Zain Haq: https://www.linkedin.com/in/zainhaq25/

ep2023-07 What's Audit got to do with IT

For years we've heard talk about a shortage of cybersecurity professionals so what can be done about that? In this episode, I speak to Brad Causey who has taken one approach he's found successful. We cover the trade-offs of his approach and how, should you agree with him, you can help fill those troubling vacancies at your company.

Show Links:

- SecurIT360 https://securit360.com/
- Offensive Security Blog https://offsec.blog/

The OWASP Podcast

ep2023-08 Finding Next Gen Cybersecurity Professionals with Brad Causey

After getting a ping from an old friend about a potential new OWASP project, I had to bring him on as a guest. He's got an interesting idea around potential vulnerabilities in web crawlers which just happen to gather data for so many AI system. We talk about that, Cybersecurity and Government and so much more.

Show Links:

- LinkedIn https://www.linkedin.com/in/buanzo/
- Github https://www.linkedin.com/in/buanzo/

ep2023-09  Vulnerable Data Gathering for AI with Arturo Buanzo Busleiman

You can significantly improve your chances of finding and remediating Open Web Application Security Project(OWASP) top vulnerabilities in your web applications. Remember, security is an ongoing process. Continuous monitoring, testing, and education are essential to maintain a strong security posture and protect your applications from potential attacks. 

To get more information, check 

https://whitecoastsecurity.com/safeguarding-web-applications-a-white-coast-security-perspective-on-the-owasp-top-10-vulnerabilities/

Unmasking Threats - Top Tips To Find OWASP Vulnerabilities

After a long and unplanned pause, the OWASP podast is back with a home run of an episode. We have Lisa Plaggemier as our guest who reprises her eloquent keynote topic from AppSec DC. All hope isn't lost, we are making progress - just look at safety in the auto industry to understand where we are and where we're going.

Links:
Lisa's keynote from AppSec DC
https://www.youtube.com/watch?v=Rirxc1OXR4Q&list=PLpr-xdpM8wG_3eyVQxB0oXqVJwlNKs85x&index=38&ab_channel=OWASPFoundation
Kubikle web series
https://kubikleseries.com/
Convene Seattle 2024 event
https://staysafeonline.org/programs/events/convene-seattle-2024/

ep2024-07 Safety belts for AppSec with Lisa Plaggemier

The August episode is a review of projects from a recent OWASP project showcase. We talk to the leaders of the OWASP pytm, OWASP Developer Guide, OWASP State of AppSec Survey Project. Get up on the latest news and update on these OWASP projects.

OWASP pytm:
- https://owasp.org/www-project-pytm/
- https://github.com/izar/pytm
OWASP Develper Guide:
- https://owasp.org/www-project-developer-guide/
- https://github.com/OWASP/www-project-developer-guide
OWASP AppSec Survey Project:
- https://owasp.org/www-project-state-of-appsec-survey/

ep2024-08 OWASP Projects Roundup

What happens when you get interested in Threat Modeling and you want to share. For some, that means you do one work shop, then another, then another. What happens when you start down this path. Takaharu Ogasa tells us what it's been like to become a threat modeling evangelist in Japan, what he's learned and what he's got planned next. It's a great story on how sharing what you learned can make the world just that much better for you and those lucky enough to be involved.

Threat Modeling Community (Japanese):
- https://threatmodeling.connpass.com/
Takaharu on Twitter
-https://x.com/TakaharuOgasa

ep2024-09 Threat Modeling with Takaharu

There's no reason to be scared about a pen test - especially when it's run by a professional like Brad Causey. I catch up with Brad in this episode to discuss what's recently changed in pen testing in how you test and people's motivations for hiring a pen testing. Interesting and not spooky at all.

Show Links:
Brad on LinkedIn
- https://www.linkedin.com/in/bradcausey/
SecurIT360
- https://www.securit360.com/
- https://www.linkedin.com/company/securit360/
OWASP Testing Guide
- https://owasp.org/www-project-web-security-testing-guide/

ep2024-10 Don't be Scared, It's just a Pen Test with Brad Causey

This podcast discusses the OWASP Guide for Preparing and Responding to Deepfake events https://genai.owasp.org/resource/guide-for-preparing-and-responding-to-deepfake-events/ and.... can you tell this podcast itself is synthetic media? Deepfake podcast to promote the deepfake guide!

Podcast on OWAP Deepfake Guide Release

This guide helps business leaders evaluate software security by explaining OWASP's top 10 web application risks in plain language. It provides specific questions to ask vendors about each risk—from injection attacks to insufficient monitoring—and offers practical next steps for making informed decisions about software security, all without requiring deep technical knowledge. Signup for the tech newsletter at https://gregdoig.com


WVBIs Tech Tip with Greg Doig - Web Application Security Risks

Some production issues caused this one to slip to December so the intro is a bit off but this is still a great episode. So, learn some lessons on creating secure code from one of my favorite guests: Tanya Janca. It was hard to keep this one to its current length as Tanya is such a great person to talk to for any reason. Enjoy and happy holidays!

Show Links:

Get your copy of Alice and Bob Learn Secure Coding! (and more):
https://shehackspurple.ca/books/
Also the newsletter so that you can join the free online streams:
https://newsletter.shehackspurple.ca/

owasp podcast

ep2024-12 Tanya Janca: Happy Holidays are Secure Code

(☞ ͡° ͜ʖ ͡°)☞ OWASP💗

WVBI is a nonprofit, community-run radio station, broadcasting to Beaver Island, Michigan at 91.9 FM and worldwide on wvbi.net, to bring you a variety of music along with news, events, and local information. Our Cottage Mix offers a unique blend of pop, oldies, country, Celtic, folk, jazz, and Island artists. Our news shows bring you the latest from around the world, and keep you up to speed on everything that’s happening on Beaver Island. You’ll also enjoy special programming like tech tips, interviews, personal stories from Islanders, and more.

The OWASP Podcast Series is a recorded series of discussions with thought leaders and practitioners who are working on securing the future for coming generations.

New tracks tagged #OWASP