In this episode our new co-host Justin Barksdale and Michael Chenetz sit down and have a chat with A10 Networks CEO, Dhrupad Trivedi on customer focused innovation.

Social Media Links:
A10 Twitter: https://twitter.com/A10Networks
A10 LinkedIn: https://www.linkedin.com/company/a10networks/
Dhrupad Trivedi’s LinkedIn Page: https://www.linkedin.com/in/dhrupad-trivedi-505669/

EP120 - Customer Focused Innovation with A10Networks CEO, Dhrupad Trivedi

SANS Top 20 Critical Security Controls 1-4

The SANS SANS Top 20 Critical Security Controls are an industry and (for the most part) vendor neutral set of controls that organizations are encouraged to implement to ensure they are cognizant of security issues and can respond accordingly. This episode deals exclusively with the second 4 (Numbers 5-8) controls in-depth, so to not overwhelm listeners with what is shaping up to be a nearly 3 hour podcast.

If you want to discuss how Advanced Persistent Security can help you implement the SANS Top 20 Critical Security Controls, please contact Advanced Persistent Security Sales.

Content

This week, we begin to discuss the SANS Top 20 Critical Security Controls, this week we cover the following 4 Controls:
SANS Top 20 Critical Security Controls, #5: Malware Defenses
SANS Top 20 Critical Security Controls, #6: Application Software Security
SANS Top 20 Critical Security Controls, #7: Wireless Access Control
SANS Top 20 Critical Security Controls, #8: Data Recovery Capability

DISCLAIMER: Aside from receiving training from SANS and holding a certification from their partner organization, GIAC, neither Advanced Persistent Security nor myself, Joe Gray are affiliated with SANS. This podcast is authorized via SANS open use clause and is not officially authorized by SANS. There is no compensation to Advanced Persistent Security nor myself, Joe Gray for doing this podcast. The purpose is to increase awareness using open frameworks.

If you have any questions or concerns about the podcast or something you want featured on the podcast, please email us at podcast@advancedpersistentsecurity.net

Advanced Persistent Security's tracks - SANS-Top-20-5-8 (made with Spreaker)

In the first episode of the series, we are joined by Chris Eng, Vice President of Research at Veracode. We’ll detail highlights of the Veracode State of Software Security Volume 9 report and discuss what the findings reveal in terms of the progress companies are making with fixing flaws. How are factors like flaw severity, business criticality of applications, and exploitability of the flaws impacting how companies view vulnerabilities? We’ll also examine information about industry performance, differences by region, third-party component risks, and vulnerability trends to give security and development teams a holistic view of the state of software security.

The State of Software Security is Still a Challenge

"Chaos engineering is an empirical practice of setting up experiments to figure out where your system is vulnerable so that you can know that ahead of time and proactively fix some of these vulnerabilities in your system." -- Casey Rosenthal

In this broadcast, I speak with Casey Rosenthal about the beginnings of Chaos Engineering and Netflix and how the concept has morphed into a cross-industry community, sharing ideas through local chaos conferences.

with Casey Rosenthal

What is Chaos Engineering, an Interview with Casey Rosenthal

If you've read the Phoenix Project, you'll remember Brent, the indispensable cog on the operations team. Brent was a good guy, he wanted to do the right things, all of the right things, but was pulled in all directions because of the lack of a unified plan for the company's project workflow. But what if Brent didn't want to do the "right" thing? What if Brent was more interested in the convenience of getting his work done than he was in the overall health and output of the project. What if he deployed to production without checking into SourceSafe, not just once, but for years.

From Tanya janca: I went to our trusty code repository, took a copy of the most recent code. I went looking for the bug, and I couldn't even find it. And then I'm running it locally, and I'm looking at the real one in prod. And they're completely different. I'm like, "What would have happened if I had pushed to prod? If I fixed that bug, and pushed to prod, and not noticed the difference?" And he's like, "All my work would have been gone. That would have been your mistake." I'm like, "Are you kidding?" He's like, "It's just easier if I check it in directly, if I just edit it right on the web server. It's just easier for me." I'm like, "Oh. Is it easier to do a shitty job? No. No, no, no.

In today's episode, Tanya Janca, Cloud Security Advocate, Microsoft, expands on her just published article, "DevSecOps: Securing Software in a DevOps World", clarifying each of the 5 tactics she uses to integrate not just security into the software development process, but how to manage people as part of that process. Have a listen...

Tanya Janca, Cloud Security Advocate, Microsoft 

Persectives on the "Sec" in DevSecOps w/ Tanya Janca

As the velocity of software creation, testing, and deployment increase rapidly, security at the app level is gaining ever more scrutiny. Code vulnerability scanners, automated security test tools, test libraries for containers are just a few of the security testing approaches broadly in use. Many of these approaches fall under a DAST (dynamic application security testing) or SAST (static application security testing.) 

As velocity increases, so does that amount of code we're creating, placing even great importance on testing, test automation, and application security testing.

Creator of Seeker IAST (Interactive Application Security Testing), Ofer Maor,  Director of Solutions Management at Synopsys, joins DevOps Chat.  We talk about the value of IAST, maximizing testing automation, integration of testing technologies into the workflow, security testing built into containers, application security testing orchestration, and more.

The Value of Interactive Application Security Testing, Synopsys

More than ever, application security is a top priority. Beyond secure coding practices, a holistic app security strategy addresses the full application and infrastructure stack. This includes containers, microservices, orchestration, infrastructure software, and the cloud. Bolting on the next security tool may not be the answer.

Kamal Shah, StackRox CEO, joins us on this episode of DevOps Chats, diving into the need for a systemic security approach across the lifecycle of cloud-native, even "Kubenative", applications.  We explore how Kubernetes and cloud-native apps bring access to rich configuration information, usage visibility, runtime context, inherent security controls, and compliance. It's a fascinating conversation that will open up new paths to secure Kubernetes and cloud-native applications.

Holistic Kubernetes and Cloud-Native App Security, StackRox

Application security is top of mind now more than ever. For more than a decade, Veracode examined increasing amounts of code as it passes through their source code vulnerability scanning service. During this period, automation is increasingly prevalent, making it easier to run scans more frequently and regularly. But has automation helped?. Is the software we create more secure? We gain key insights about this in Veracode's The State of Software Security Report X (10th edition).

Chris Eng, Chief Research Officer at Veracode, joins us on DevOps Chats. We talk about many insights uncovered in the latest report, such as 50% of applications are accruing security debt over time,  the regularity of scanning correlates to vulnerability fix times, and that scanning frequency directly impacts security debt.  

There is a wealth of information in the report, and you can get a jump on the key findings on this podcast episode with Chris. Download the full report at https://www.veracode.com/state-of-software-security-report.

Is the Software We Create More Secure? Veracode's 10th Report

Bytesize Podcast Episode 1 

Do you agree that humans are the weakest link in the security chain?

With the world striving towards digitalization and digitization, most businesses strive towards being more cyber resilient against threats and vulnerabilities that evolve with the digital age. Cyberattacks are still hitting headlines which led to many discussions on what exactly results in the weakest links in cybersecurity.

Join us in this episode of the podcast as Chiang Kai Er, CTO of V-Key, and Raymond Lee, COO of V-Key explore what are the possible factors of cyber breaches.

Follow us on these platforms to get the latest updates from V-Key!

LinkedIn: https://linkedin.com/company/v-key-inc/
Facebook: https://facebook.com/VKeyInc
Twitter: https://twitter.com/vkey_inc/

Bytesize Podcast Episode 1 - Humans are the weakest link in cyber breaches

"DevOps Chats" by Techstrong Group, the force behind industry-leading platforms like DevOps.com, Cloud Native Now, Security Boulevard, Techstrong.ai, DigitalCxO, and Techstrong.TV, is your premier destination for all things DevOps. Hosted by industry veterans Alan Shimel and Mitchell Ashley, this podcast series delves deep into the world of DevOps, bringing you the latest trends, innovative strategies, and insightful discussions that matter.

Each episode of "DevOps Chat" is a journey through the evolving landscape of DevOps, featuring interviews with thought leaders, practitioners, and change-makers who are shaping the future of technology. Whether you're a developer, operations professional, IT leader, or tech enthusiast, Alan and Mitchell ensure you stay informed, engaged, and ahead of the curve.

From continuous integration and delivery to cloud-native development and cybersecurity, "DevOps Chat" covers the spectrum, offering valuable lessons, expert advice, and engaging stories. Tune in to explore how DevOps principles and practices are transforming the tech industry, driving efficiency, enhancing security, and fostering innovation.

Join us at "DevOps Chat" for your regular dose of DevOps insights, inspiration, and community. It's not just a podcast; it's your gateway to the forefront of the DevOps movement. Subscribe now and be part of the conversation that's setting the pace for the future of technology.

Cloud Unfiltered is a series of interviews with the people that are working to move cloud technology and implementation forward. This includes everyone from software engineers and open source project leads to IT executives and cloud users. In these interviews we talk about different cloud architectures, management models, and deployment strategies. We discuss platform compatibility, the culture changes required for cloud success, and the complimentary technologies that are making cloud more powerful with each passing day.

In this six-part podcast series, we’ll dissect the results of Veracode’s State of Software Security Volume 9 report. Join industry experts for a deep-dive discussion on the research and a larger examination of application security today. Listeners will learn more about:
 
• How organizations are handling software security amid today’s technology landscape
• How to embed security design directly into the software delivery lifecycle
• How security managers can better address low software flaw fix rates
• What is a security champion - and how can your organization create the role?

Sponsored by Veracode

The OWASP Podcast Series is a recorded series of discussions with thought leaders and practitioners who are working on securing the future for coming generations.

Popular tracks tagged #applicationsecurity