John Worrall, ZeroNorth CEO, expands on the "why" of DevSecOps, focusing on the business benefit, gain and measurement of what we seek to accomplish through DevSecOps. John advocates we concentrate on the process and data enabling us to assess risk, prioritize the most beneficial security work. Learn more about ZeroNorth athttps://www.zeronorth.io.

Maximizing The Benefits of DevSecOps, ZeroNorth

Randy’s career includes leadership roles at pioneering companies, including WebEx back when it was a small startup through its IPO. He was CISO for the SaaS security leader Qualys, and he was head of product security and security operations for Zoom as its usage exploded over the last year with the pandemic. Now, he’s back to being a CISO at a highly regulated life sciences organization, InterVenn.

In this episode, we discuss the importance of shifting left for modern software development with the high velocity of code releases. Getting security implemented as early as possible, close to developers is key. The goal is to help them find and understand any vulnerabilities early so they can fix issues. Effective strategies include implementing tools for static and dynamic testing, giving developers security training, and working with pen testers that can interact directly with the developers. 

He also discusses his approaches to securing what is becoming the new normal of a largely remote workforce. You may not know where team members are connecting from, how they’re connecting, whether there are others connecting on their same network, whether they are using personal devices, etc. There are opportunities to use security controls to enable this flexibility for employees while ensuring security.

We also discuss the importance of community participation. Randy participates and shares his knowledge with local chapters of information security groups, the cloud security alliance (CSA), and he works for companies that embrace working with other security professionals. 

I can’t emphasize how important this is! A CISO can’t (and doesn’t) know everything. For example, the supply chain risk with Zoom is going to be entirely different than with precision medicine at InterVenn. It is so easy to think “I’m the CISO, I should know…” A better answer is, “I have a community, we have each other's backs. And while I may not have the answer right now, I will have feedback from several peers in real companies dealing with this very issue in real ways.”

When you stand in front of a board, they will ask, “How are others doing this...specifically companies x,y, and z…”  I have heard this numerous times myself.  And this is Randy’s chief point. Build and use your community – it’s arguably your strongest asset. 

Perhaps this point of view comes from his military training, having started his career in the Marines (is it just me, or is there a growing cadre of security leaders with backgrounds in the military)?  Surround yourself with great intel. We are fighting a digital war, we need our allies! As he points out, there are a lot of bad actors out there, so working independently, in silos, doesn’t work when you could be working together to fight the bad guys.

Security Superfriends Episode 8 Randy Barr, InterVenn

Soluble's Rich Seiersen interviews Clint Gibler, head of security research at r2c, co-founder at tl;dr sec. They discuss the popularity of the r2c open source tool Semgrep, which helps developers perform static testing of their code in CI.

Security Superfriends Episode 9 Clint Gibler

As the Projects Manager for all projects at OWASP (the Open Web Application Security Project), Samantha Groves has deep visibility into the 140 or so projects currently on the boards at OWASP. We start our discussion with what her typical day looks like and then move into how OWASP is changing and the different models for project frameworks.

<b>About Samantha Groves</b>
Samantha Groves is the Project Manager at OWASP. Samantha has led many projects in her career, some of which include website development, brand development, sustainability and socio-behavioural research projects, competitor analysis, event organisation and management, volunteer engagement projects, staff recruitment and training, and marketing department organisation and strategy implementation projects for a variety of commercial and not-for-profit organisations. She is eager to begin her work at OWASP and help the organisation reach its project completion goals.

Samantha earned her MBA in International Management with a concentration in sustainability from Royal Holloway, University of London. She earned her Bachelor's degree majoring in Multimedia from The University of Advancing Technology in Mesa, Arizona, and she earned her Associate's degree from Scottsdale Community College in Scottsdale, Arizona. Additionally, Samantha recently attained her Prince2 (Foundation) project management certification.

Samantha Groves - Getting the Most from OWASP Projects

In this segment of OWASP 24/7, I talk with Kelly Santalucia about what it takes to grow OWASP, how she's working with the outreach foundation, the outreach program for kids, the diversification of the membership... things that are helping the community grow. We also talk about what OWASP will look like in the future as virtual chapter meetings become an integral part of the platform. I began by asking Kelly what her job responsibilities are with OWASP.

Kelly Santalucia - Growing OWASP and the Outreach Programs

On today's segment, we're going to take a different approach from our normal format. I was at the AppSec USA Conference in New York City last week and was asked to chair a panel for the game show "Wait, wait... don't pwn me!". This is the full recording of the session. As you listen, keep in mind, every situation described within the game is true. Let's start first with the introductions of Chris Eng, Josh Corman and Space Rogue.

AppSec USA 2013 - Wait, Wait... Don't Pwn Me!

Purple Box specializes in comprehensive cybersecurity and cloud solutions that defend against evolving cyber threats, secure cloud infrastructure, and optimize operations. We help businesses mitigate risks, achieve compliance, and ensure secure cloud migration and management.

Cybersecurity and Cloud Solutions

WebGoat is a deliberately insecure web application maintained by OWASP designed to teach web application security lessons. It is one of the most used projects at OWASP. 

With the current team headed by Bruce Mayhew, Nanne Baars and Jason White, work is moving forward on the creation of new content for creating training lessons for application security. I talked with Bruce and team about what they've done with the latest update and what they hope to accomplish in the coming year.

2016 AppSec USA

2016 AppSec USA - An Update on the WebGoat Project

Application Security Requirements & Threat Management (ASRTM)is a great way to:
• Lowering costs to build secure	software
• Making	security measurable
• Turning unplanned work into planned work
• Freeing	up time away	from remediation,	and into feature development
• Having	a single process that works	with	in-house, outsourced, and	commercial software
• Providing confidence	that	software	is secure, when requirements	are	linked to verification

In this chat with Rohit Sethi of Security Compass, we discuss ASRTM and how it helps DevOps teams, security teams and DevSecOps.

Security Boulevard Chats

ASRTM, Application Security Requirements & Threat Management

What exactly is a chief scientist? Eric Sheridan at WhiteHat tells us. More than that, Eric gives us what he calls the "the security addendum to the 12 factor App." I guess to understand this, you need to understand something about the 12 factor app process.  Here is the website to learn: https://12factor.net/

Eric lays out a well reasoned approach to appsec and some good research findings from WhiteHat.  Have a listen

DevOps Chat

The Security Addendum to the 12 Factor App

Purple Box is a leader in cybersecurity and cloud solutions, offering integrated services that help businesses detect, protect, and recover from cyber threats with ease. Their intelligent, scalable approach ensures teams can stay secure while focusing on growth and innovation. With advanced technology and a strong people-first philosophy, Purple Box delivers tailored protection for businesses of all sizes.

"DevOps Chats" by Techstrong Group, the force behind industry-leading platforms like DevOps.com, Cloud Native Now, Security Boulevard, Techstrong.ai, DigitalCxO, and Techstrong.TV, is your premier destination for all things DevOps. Hosted by industry veterans Alan Shimel and Mitchell Ashley, this podcast series delves deep into the world of DevOps, bringing you the latest trends, innovative strategies, and insightful discussions that matter.

Each episode of "DevOps Chat" is a journey through the evolving landscape of DevOps, featuring interviews with thought leaders, practitioners, and change-makers who are shaping the future of technology. Whether you're a developer, operations professional, IT leader, or tech enthusiast, Alan and Mitchell ensure you stay informed, engaged, and ahead of the curve.

From continuous integration and delivery to cloud-native development and cybersecurity, "DevOps Chat" covers the spectrum, offering valuable lessons, expert advice, and engaging stories. Tune in to explore how DevOps principles and practices are transforming the tech industry, driving efficiency, enhancing security, and fostering innovation.

Join us at "DevOps Chat" for your regular dose of DevOps insights, inspiration, and community. It's not just a podcast; it's your gateway to the forefront of the DevOps movement. Subscribe now and be part of the conversation that's setting the pace for the future of technology.

The OWASP Podcast Series is a recorded series of discussions with thought leaders and practitioners who are working on securing the future for coming generations.

Popular tracks tagged #application security