In this podcast Michael Stiefel spoke to Robert Hurlbut about what it means to make an application, not just the code, secure. Robert is a Principal Application Security Architect and Threat Modeling Lead at Aquia, a PhD student at Cap TechU and co-host of the Application Security Podcast.

Read a transcript of this interview: https://bit.ly/4dha4yx 

Subscribe to the Software Architects’ Newsletter for your monthly guide to the essential news and experience from industry peers on emerging patterns and technologies:
www.infoq.com/software-architects-newsletter

Upcoming Events:

InfoQ Dev Summit Boston (June 24-25, 2024)
Actionable insights on today’s critical dev priorities.
devsummit.infoq.com/conference/boston2024

InfoQ Dev Summit Munich (Sept 26-27, 2024)
Practical learnings from senior software practitioners navigating Generative AI, security, modern web applications, and more.
devsummit.infoq.com/conference/munich2024

QCon San Francisco (November 18-22, 2024)
Get practical inspiration and best practices on emerging software trends directly from senior software developers at early adopter companies.
qconsf.com/

QCon London (April 7-9, 2025)
Discover new ideas and insights from senior practitioners driving change and innovation in software development.
qconlondon.com/

The InfoQ Podcasts:
Weekly inspiration to drive innovation and build great teams from senior software leaders. Listen to all our podcasts and read interview transcripts:

- The InfoQ Podcast www.infoq.com/podcasts/
- Engineering Culture Podcast by InfoQ www.infoq.com/podcasts/#engineering_culture
- Generally AI

Follow InfoQ:
- Mastodon: techhub.social/@infoq
- Twitter: twitter.com/InfoQ
- LinkedIn: www.linkedin.com/company/infoq
- Facebook: bit.ly/2jmlyG8
- Instagram: @infoqdotcom
- Youtube: www.youtube.com/infoq

Write for InfoQ:
Learn and share the changes and innovations in professional software development.
- Join a community of experts.
- Increase your visibility.
- Grow your career.
www.infoq.com/write-for-infoq

Transcript

Security Requires Traveling the Unhappy Path - A Conversation with Robert Hurlbut

This is the Engineering Culture Podcast, from the people behind InfoQ.com and the QCon conferences.
In this podcast Shane Hastie, Lead Editor for Culture & Methods spoke to Chad Whitacre about  the Open Source Pledge, an initiative to encourage companies to financially support open-source maintainers to ensure the sustainability and security of the software they depend on. The goal is to address the social contract within open source, where companies benefit from freely available software and should reciprocate to support its creators.

Read a transcript of this interview: https://bit.ly/43k3kx5

Subscribe to the Software Architects’ Newsletter for your monthly guide to the essential news and experience from industry peers on emerging patterns and technologies:
https://www.infoq.com/software-architects-newsletter 

Upcoming Events:

QCon London (April 7-10, 2025)
Discover new ideas and insights from senior practitioners driving change and innovation in software development.
https://qconlondon.com/ 

InfoQ Dev Summit Boston (June 9-10, 2025)
Actionable insights on today’s critical dev priorities.
devsummit.infoq.com/conference/boston2025

InfoQ Dev Summit Munich (October 15-16, 2025)
Essential insights on critical software development priorities.
https://devsummit.infoq.com/ 


QCon San Francisco 2025 (17-21, 2025)
Get practical inspiration and best practices on emerging software trends directly from senior software developers at early adopter companies.
https://qconsf.com/ 

InfoQ Dev Summit New York (Save the date - December 2025)
https://devsummit.infoq.com/ 

The InfoQ Podcasts: 
Weekly inspiration to drive innovation and build great teams from senior software leaders. Listen to all our podcasts and read interview transcripts:

- The InfoQ Podcast https://www.infoq.com/podcasts/ 
- Engineering Culture Podcast by InfoQ https://www.infoq.com/podcasts/#engineering_culture 
- Generally AI: https://www.infoq.com/generally-ai-podcast/ 

Follow InfoQ:
- Mastodon: https://techhub.social/@infoq 
- Twitter: twitter.com/InfoQ
- LinkedIn: www.linkedin.com/company/infoq
- Facebook: bit.ly/2jmlyG8
- Instagram: @infoqdotcom
- Youtube: www.youtube.com/infoq

Write for InfoQ: Learn and share the changes and innovations in professional software development.
- Join a community of experts.
- Increase your visibility.
- Grow your career.
https://www.infoq.com/write-for-infoq

Investing in Open Source: The Open Source Pledge and Why it Matters

The Security Shepherd Project is a mobile web application training platform for penetration testing. It covers the OWASP Top 10 risks from both the mobile and web projects. 

This recording was made at AppSecUSA 2015 during the Project Summit.

OWASP Security Shepherd Project w/ Mark Denihan and Paul McCann

Jason Schmitt's passion is to assure security is built into the development process, not just as a bolt-on add-on.  His experience in various aspects of software security has led him on a path through mobile, application and cloud security. In our conversation, Jason talks about the value OWASP provides to the community as well as what he perceives as a critical time for the integration between DevOps and security. 

About Jason Schmitt

Jason Schmitt is vice president and general manager of HPE Security  Products, Fortify for Hewlett Packard Enterprise. He is responsible for driving the growth of Fortify’s  software security business and managing all operational functions  within the group.  Schmitt has extensive experience in product management,  development and marketing for all types of web and security  technologies. His expertise ranges from cloud-based secure web  gateways, to application security and mobile security consulting  services, to network-based video surveillance.

Security as Part of DevOps and Development with Jason Schmitt

Continuing the theme of integrating security in DevOps processes, I spoke with Sacha Lebourey, CEO of Cloudbees, during a stop at CD Summit in London. As one of the main players in the software supply chain for DevOps, I was interested in Sacha's perspective on how automated security fit into that supply chain.  We start the discussion with "What is continuous delivery" followed by the place for security in the modern developer environment. 

About Sacha Labourey
Sacha was born in Neuchâtel, Switzerland and graduated in 1999 from EPFL. It was during Sacha’s studies in 1996 that he started his first consulting business - Cogito Informatique. In 2001, he joined Marc Fleury’s JBoss project as a core contributor and implemented JBoss’ original clustering features. In 2003, Sacha founded the European headquarters for JBoss and, as GM for Europe, led the strategy and partnerships that helped fuel the company’s growth in that region. While in this position, he led the recruitment of some of JBoss’ key talent and acquisition of key technology. 

In 2005, he was appointed CTO of JBoss, Inc. and oversaw all of JBoss engineering. In June 2006, JBoss, Inc. was acquired by Red Hat (NYSE:RHT). After the acquisition, Sacha remained JBoss CTO and played a crucial role in integrating and productizing JBoss software with Red Hat offerings. 

In 2007, Sacha became co-General Manager of Red Hat’s middleware division. He ultimately left Red Hat in April 2009 and founded CloudBees in April 2010.


CD Summit / Nexus World Tour

Security as Part of Continuous Delivery with Sacha Labourey

Register now at AllDayDevOps.com to view all 54 sessions and 3 keynotes. 

We've heard software is eating the world; software is infecting the world. Our dependence on connected technology is growing faster than our ability to secure it - in areas affecting public safety and human life. Adding millions of lines of code and connecting everything to everything else exposes cyber physical systems to new accidents and adversaries. This is truly where bits & bytes meet flesh & blood. 

While many in security fear DevOps and see it as the end of security as we know it... maybe that's a good thing. Our best is not good enough. Despite best practices, modern SW and Security have allowed 100 of the F100 to lose IP and sensitive information - even our governments routinely succumb to adversaries. These failure rates cannot stand with the consequences of failure being measured - not in record count - but in human lives and GDP. Paradoxically, it may take DevOps to rise to these challenges. 

Rugged DevOps is finding un-obvious common ground and break throughs like SW supply chain principles, greater visibility and response agility, immutable infrastructure, and the like. We must be better. This is what better looks like.

WHAT YOU WILL TAKE AWAY FROM THIS SESSION
-- A framework of 6 ways IoT and CyberSafey have raised the stakes and changes the game for CyberSecurity
-- 5 Areas of common ground we have wth DevOps
-- Some benefits of bring proven supply chain principles into modern software development
-- How to get started using a DataVizualization Calculator to help you make the case when you get back to work

All Day DevOps 2016 - Where Bits And Bytes Meet Flesh And Blood with Josh Corman

Prior to his work as Principal Software Assurance Engineer at MITRE, Kevin E. Greene was R&D Program Manager for the Department of Homeland Security. He is currently on the organizing committee for HackNYC, helping to organize talks and sessions around protecting and securing our national infrastructure. I spoke with Kevin about the current state of software security and how each of us can play a roll in the security of modern software.

About Kevin E. Greene

With more than 17 years of information assurance and security experience in security program management, assessment, auditing, and testing, Kevin Greene brings valuable skills and capabilities to the Department of Homeland Security Science and Technology Directorate (DHS S&T). 

As a member of the Homeland Security Advanced Research Projects Agency (HSARPA) Cyber Security Division, Greene has identified, developed, and transitioned technology projects through multiple commercial and academic organizations for the past two years. Responsible for the oversight and management of research and development projects for improving the testing, analysis, and evaluation techniques used in software quality assurance tools, he currently is focusing on the build-out of the Software Assurance Marketplace (SWAMP), a national marketplace and collaborative research forum designed to advance secure software development best-practices within the industry.

with Kevin Greene

HackNYC 2018: Preview with Kevin E. Greene

Host Kevin Greene and guest Jim Routh, Chief Security Officer at Aetna discuss the importance of developing a software security program designed to help reduce the cost to maintain software by detecting vulnerabilities early in the software development process. Jim discuss key observed software assurance practices and lessons learned from BSIMM that impact improving software security.  Jim shares his thoughts on IoT and medical device security in the healthcare industry.

Interview with Jim Routh of Aetna

Host Kevin Greene and guest Brian Knapp, industry renowned software developer discuss the importance of software engineering in modern software development. Brian discuss the need for “minimalism” in software development to help reduce technical debt, complexity and size of today’s software.   Brian shares his thoughts on how organizations approach software development to improve software quality and security.

Interview with Brian Knapp (Part 1)

In episode 28 of The Secure Developer, Guy is joined by Jason Chan of Netflix to discuss simplifying the security process for software developers, as well as some of the open source projects Netflix has shared with the community.

Subscribe in iTunes

The Secure Developer - Ep. #28, Developer Empathy with Jason Chan of Netflix

Heavybit is the leading early-stage investor in enterprise infrastructure. Since 2013, we've helped launch and scale visionary technical startups—from DevSecOps and feature flagging to AI code generation and beyond. We go hands-on from day 0, backing founders as they turn code into companies and build the future of software from the bottom up to the top down.

Cybersecurity Thought Leader Kevin Greene, explores the latest news and developments in cybersecurity and information assurance on his debut podcast, "Cybersecurity Insights & Perspectives”... Follow him at @iamkevtorious

Software engineers, architects and team leads have found inspiration to drive change and innovation in their team by listening to the weekly InfoQ Podcast. They have received essential information that helped them validate their software development map. We have achieved that by interviewing some of the top CTOs, engineers and technology directors from companies like Uber, Netflix and more. Over 1,200,000 downloads in the last 3 years.

Software engineers, architects and team leads have found inspiration to build better, high performing teams by listening to the weekly InfoQ Podcast. We have achieved that by interviewing some of the top CTOs, engineers and technology directors from companies like Uber, Netflix and more. Over 500,000 downloads in the last 3 years.

Register now at AllDayDevOps.com to view video recordings of all 54 sessions and the 3 keynotes 

Speakers from around the world participated in this first of its kind event. Timing for the conference was set for the EMEA sessions to begin at 9:00am London time, then move the concentration of presentations to the East Coast of the USA, ending with presentations in the West Coast of the USA. 

There are three tracks: 
-- Modern Infrastructure
-- Automated Security
-- CI/CD.

The OWASP Podcast Series is a recorded series of discussions with thought leaders and practitioners who are working on securing the future for coming generations.

Popular tracks tagged #software security