John Worrall, ZeroNorth CEO, expands on the "why" of DevSecOps, focusing on the business benefit, gain and measurement of what we seek to accomplish through DevSecOps. John advocates we concentrate on the process and data enabling us to assess risk, prioritize the most beneficial security work. Learn more about ZeroNorth athttps://www.zeronorth.io.

Maximizing The Benefits of DevSecOps, ZeroNorth

In this episode, Matt Tesauro hosts Greg Anderson and Cody Maffucci to talk about OWASP DefectDojo.  DefectDojo is an OWASP flagship project that aims to be the single source of truth for AppSec or Product Security teams.  It provides a single pane of glass for security programs and can import and normalize over 150 different security tools. I thought that the OWASP podcast might just cover an OWASP project now and then so here we go.

Show Links:
- https://www.defectdojo.org/
- Github organization: https://github.com/defectdojo
- Github main repo: https://github.com/DefectDojo/django-DefectDojo
- Pubic Demo info: https://github.com/DefectDojo/django-DefectDojo#demo 
- Data models (part of the project docs) https://defectdojo.github.io/django-DefectDojo/usage/models/

OWASP Podcast

Getting Lean and Mean in the DefectDojo

Software supply chain seems to be front and center for technologists, cybersecurity and many governments. One of the early pioneers in this space was Steve Springett with two highly successful projects: OWASP Dependency Track and CycloneDX. In this episode, we catch up with Steve to talk about how he got started in software supply chain management as well as the explosive growth for Dependency Track and ClycloneDX. We also touch on future developments for CycloneDX and places where Steve never expected to see his projects go.  Enjoy!

Show Links:

- OWASP Dependency Track: https://dependencytrack.org/
- Dependency Track Github: https://github.com/DependencyTrack
- CycloneDX: https://cyclonedx.org/
- CycloneDX Github: https://github.com/CycloneDX
- Software Component Verification Standard: https://scvs.owasp.org/
Social Media links:
- https://twitter.com/stevespringett
- https://infosec.exchange/@stevespringett
- https://www.linkedin.com/in/stevespringett/

SBOMS, CycloneDX and Dependency Track: Automation for Survival with Steve Springett

After getting a ping from an old friend about a potential new OWASP project, I had to bring him on as a guest. He's got an interesting idea around potential vulnerabilities in web crawlers which just happen to gather data for so many AI system. We talk about that, Cybersecurity and Government and so much more.

Show Links:

- LinkedIn https://www.linkedin.com/in/buanzo/
- Github https://www.linkedin.com/in/buanzo/

The OWASP Podcast

ep2023-09  Vulnerable Data Gathering for AI with Arturo Buanzo Busleiman

What happens when you get interested in Threat Modeling and you want to share. For some, that means you do one work shop, then another, then another. What happens when you start down this path. Takaharu Ogasa tells us what it's been like to become a threat modeling evangelist in Japan, what he's learned and what he's got planned next. It's a great story on how sharing what you learned can make the world just that much better for you and those lucky enough to be involved.

Threat Modeling Community (Japanese):
- https://threatmodeling.connpass.com/
Takaharu on Twitter
-https://x.com/TakaharuOgasa

ep2024-09 Threat Modeling with Takaharu

This is the Engineering Culture Podcast, from the people behind InfoQ.com and the QCon conferences.

In this podcast Shane Hastie, Lead Editor for Culture & Methods spoke to Adam Kentosh about the ongoing challenges organisations face in their DevOps DevSecOps and digital transformation journeys.

Read a transcript of this interview: https://bit.ly/3zSd3OW

Subscribe to the Software Architects’ Newsletter for your monthly guide to the essential news and experience from industry peers on emerging patterns and technologies:
https://www.infoq.com/software-architects-newsletter 

Upcoming Events:

QCon San Francisco (November 18-22, 2024)
Get practical inspiration and best practices on emerging software trends directly from senior software developers at early adopter companies.
https://qconsf.com/ 

QCon London (April 7-9, 2025)
Discover new ideas and insights from senior practitioners driving change and innovation in software development.
https://qconlondon.com/ 

Save the date: InfoQ Dev Summit Boston (June 9-10, 2025)
Actionable insights on today’s critical dev priorities.


The InfoQ Podcasts: 
Weekly inspiration to drive innovation and build great teams from senior software leaders. Listen to all our podcasts and read interview transcripts:

- The InfoQ Podcast https://www.infoq.com/podcasts/ 
- Engineering Culture Podcast by InfoQ https://www.infoq.com/podcasts/#engineering_culture 
- Generally AI: https://www.infoq.com/generally-ai-podcast/ 

Follow InfoQ:
- Mastodon: https://techhub.social/@infoq 
- Twitter: twitter.com/InfoQ
- LinkedIn: www.linkedin.com/company/infoq
- Facebook: bit.ly/2jmlyG8
- Instagram: @infoqdotcom
- Youtube: www.youtube.com/infoq

Write for InfoQ:
Learn and share the changes and innovations in professional software development.
- Join a community of experts.
- Increase your visibility.
- Grow your career.
https://www.infoq.com/write-for-infoq

InfoQ Podcast

Transcript

The Ongoing Challenges of DevSecOps Transformation and Improving Developer Experience

Some production issues caused this one to slip to December so the intro is a bit off but this is still a great episode. So, learn some lessons on creating secure code from one of my favorite guests: Tanya Janca. It was hard to keep this one to its current length as Tanya is such a great person to talk to for any reason. Enjoy and happy holidays!

Show Links:

Get your copy of Alice and Bob Learn Secure Coding! (and more):
https://shehackspurple.ca/books/
Also the newsletter so that you can join the free online streams:
https://newsletter.shehackspurple.ca/

owasp podcast

ep2024-12 Tanya Janca: Happy Holidays are Secure Code

In episode 43 of Generationship, Rachel explores the frontier of AI-driven cybersecurity with John Amaral, co-founder of Root.io. Together they unpack the promise and challenges of agentic systems that detect, patch, and remediate vulnerabilities automatically. This installment offers a mix of technical deep dives, AI optimism, and a vision of security that works more like an immune system than a fire alarm.

Subscribe

Generationship - Ep. #43, Security Woven In with John Amaral

In episode 22 of Open Source Ready, Brian and John sit down with Benji Kalman, co-founder of Root, to explore the intersection of AI, software development, and security. They unpack "vibe coding," its impact on API proliferation, and the hidden costs of increased technical debt. Learn why a security vulnerability is just a bug with a purpose, and discover how AI agents can be used not just to write code, but to automatically find and remediate vulnerabilities in open-source containers.

Open Source Ready - Ep. #22, AI and Container Security with Benji Kalman of Root

Does cloud, DevSecOps and network security all go together? They have to in the real world. We sit down with Harry Sverdlove, CTO founder of Edgewise Networks and discuss this very topic as well as top three tips from Harry. Have a listen

DevOps Chat

Cloud, DevSecOps and Network Security, All Together?

Heavybit is the leading early-stage investor in enterprise infrastructure. Since 2013, we've helped launch and scale visionary technical startups—from DevSecOps and feature flagging to AI code generation and beyond. We go hands-on from day 0, backing founders as they turn code into companies and build the future of software from the bottom up to the top down.

"DevOps Chats" by Techstrong Group, the force behind industry-leading platforms like DevOps.com, Cloud Native Now, Security Boulevard, Techstrong.ai, DigitalCxO, and Techstrong.TV, is your premier destination for all things DevOps. Hosted by industry veterans Alan Shimel and Mitchell Ashley, this podcast series delves deep into the world of DevOps, bringing you the latest trends, innovative strategies, and insightful discussions that matter.

Each episode of "DevOps Chat" is a journey through the evolving landscape of DevOps, featuring interviews with thought leaders, practitioners, and change-makers who are shaping the future of technology. Whether you're a developer, operations professional, IT leader, or tech enthusiast, Alan and Mitchell ensure you stay informed, engaged, and ahead of the curve.

From continuous integration and delivery to cloud-native development and cybersecurity, "DevOps Chat" covers the spectrum, offering valuable lessons, expert advice, and engaging stories. Tune in to explore how DevOps principles and practices are transforming the tech industry, driving efficiency, enhancing security, and fostering innovation.

Join us at "DevOps Chat" for your regular dose of DevOps insights, inspiration, and community. It's not just a podcast; it's your gateway to the forefront of the DevOps movement. Subscribe now and be part of the conversation that's setting the pace for the future of technology.

Software engineers, architects and team leads have found inspiration to build better, high performing teams by listening to the weekly InfoQ Podcast. We have achieved that by interviewing some of the top CTOs, engineers and technology directors from companies like Uber, Netflix and more. Over 500,000 downloads in the last 3 years.

Security Boulevard is the destination for the security community to stay up on the latest news, discussion and analysis. Home of the Security Bloggers Network, Security Boulevard has more security related content than anywhere else on the web.

The OWASP Podcast Series is a recorded series of discussions with thought leaders and practitioners who are working on securing the future for coming generations.

Popular tracks tagged #devsecops