Ep. 54: WAFs and Pen Testing

DevelopSec: Developing Security Awareness

DevelopSec: Developing Security Awareness

Player FM - Internet Radio Done Right

28 subscribers

اضافه شده در ten سال پیش

محتوای ارائه شده توسط Jardine Software Inc.. تمام محتوای پادکست شامل قسمت‌ها، گرافیک‌ها و توضیحات پادکست مستقیماً توسط Jardine Software Inc. یا شریک پلتفرم پادکست آن‌ها آپلود و ارائه می‌شوند. اگر فکر می‌کنید شخصی بدون اجازه شما از اثر دارای حق نسخه‌برداری شما استفاده می‌کند، می‌توانید روندی که در اینجا شرح داده شده است را دنبال کنید.https://fa.player.fm/legal

TED Tech

1
How AI is saving billions of years of human research time | Max Jaderberg 19:15

20 weeks پیش19:15

پخش در آینده

لیست ها

پسندیدن

دوست داشته شد

19:15

Can AI compress the years long research time of a PhD into seconds? Research scientist Max Jaderberg explores how “AI analogs” simulate real-world lab work with staggering speed and scale, unlocking new insights on protein folding and drug discovery. Drawing on his experience working on Isomorphic Labs' and Google DeepMind's AlphaFold 3 — an AI model for predicting the structure of molecules — Jaderberg explains how this new technology frees up researchers' time and resources to better understand the real, messy world and tackle the next frontiers of science, medicine and more. For a chance to give your own TED Talk, fill out the Idea Search Application: ted.com/ideasearch . Interested in learning more about upcoming TED events? Follow these links: TEDNext: ted.com/futureyou TEDAI Vienna: ted.com/ai-vienna Hosted on Acast. See acast.com/privacy for more information.…

۹ سال پیش 16:19

MP3•خانه قسمت

Your pen tester want you to white list them in your WAF? What should you do? Why do they ask? James breaks it down for you in this episode.

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Check out our 30 day advantage.

Send us a text

For more info go to https://www.developsec.com or follow us on X (@developsec).

The DevelopSec podcast is brought to you by Jardine Software Inc.

128 قسمت

#Tech #Security #Training #Podcasting Education #Jardine Software Inc #AppSec #Application Security #Secure Development

DevelopSec: Developing Security Awareness

Ep. 54: WAFs and Pen Testing

DevelopSec: Developing Security Awareness

28 subscribers

published ۹ سال پیش

اشتراک گذاری

MP3•خانه قسمت

Your pen tester want you to white list them in your WAF? What should you do? Why do they ask? James breaks it down for you in this episode.

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Check out our 30 day advantage.

Send us a text

For more info go to https://www.developsec.com or follow us on X (@developsec).

The DevelopSec podcast is brought to you by Jardine Software Inc.

128 قسمت

#Tech #Security #Training #Podcasting Education #Jardine Software Inc #AppSec #Application Security #Secure Development

همه قسمت ها

DevelopSec: Developing Security Awareness

1
Ep. 124: Double-ClickJacking 21:07

21 weeks پیش21:07

21:07

In this episode, I go over what Double-ClickJacking is and what you can potentially do about it to reduce the risk to your applications. Will this be the new finding on everyone's pen tests this year? Paulos Yibelo first described Double-ClickJacking and you can read more from him at his post referenced below. References: Paulos Yibelo Blog: https://www.paulosyibelo.com/2024/12/doubleclickjacking-what.html Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 123: Goals of Security Culture - Sort of? 7:56

22 weeks پیش7:56

7:56

In this episode, I talk about how security is a part of everyone's role and the labeling of "Security Culture". I share some ideas on how to improve on role based security awareness and building stronger relationships between security and the rest of the organization. For more info go to https://www.developsec.com or follow us on X (@developsec). Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 122: Integrating Security Responsibilities into Development 18:04

23 weeks پیش18:04

18:04

In this episode I talk about assigning responsibility for secure development and how the dev and security teams should be working together to accomplish a common goal. I also discuss the importance of updating developer job descriptions and creating an expectation around developers having secure development experience. For more info go to https://www.developsec.com or follow us on X (@developsec). Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 121 - Evolving Ransomware: Unique Tactics for Payment 17:44

1 year پیش17:44

17:44

In this episode I talk about the evolving world of ransomware. I discuss a few examples of unique tactics the malicious actors are using to put pressure on organizations to pay the ransom. Referenced Articles: https://www.theregister.com/AMP/2024/04/30/finnish_psychotherapy_center_crook_sentenced/ https://www.darkreading.com/cyber-risk/hackers-weaponize-sec-disclosure-rules-against-corporate-targets https://www.theregister.com/2024/01/05/swatting_extorion_tactics/ For more info go to https://www.developsec.com or follow us on X (@developsec). DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 120: Addressing Root Cause - Vulnerable Components 16:30

۲ years پیش16:30

16:30

In this episode we talk about addressing the root cause of an issue versus the symptoms. How can the process of keeping application components updated be improved? For more info go to https://www.developsec.com or follow us on twitter (@developsec). DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Transcript: In this episode, James talks about root cause analysis versus treating the symptoms. Tackling the challenge to integrate security into the development process, looking for insights, answers and practical solutions to avoid getting overwhelmed. Welcome to the develop SEC podcast where our focus is your success in securing and improving development processes. And here's your host, James Jardine. Hey, everyone, welcome back to the show. Today, I want to talk about addressing the symptoms versus addressing the root problem. And I think in application security, or when we talk about secure development, this is something where a lot of times we address the symptoms, but we never really take the step back to address the actual root cause of what's causing those symptoms. And today, I want to actually talk about vulnerable third party components. This is something that has been kind of brought to the attention a lot more in the past few years, made it into the OWASP, top 10. And it's something I think everybody struggles with, we never know when we'll have a vulnerable third party component, because until somebody actually identifies a vulnerability, we just assume that we're good. And then on top of that, if there is a vulnerability identified, then we also run the chances that we're probably not even using that feature. So vulnerable third party components are a really interesting aspect, when we think about secure development. Because there is a lot of unknowns, we may know that there's a vulnerability there. But the actual knowledge of do we use that piece and are we vulnerable, can be difficult, which, in the end, ends up adding a whole bunch of extra work and a whole lot of time for us to try to figure this out and address this stuff. And so this is where I talk about addressing the symptoms. In this case, in a lot of places, what we do is we address that symptom, we know that there's an issue of vulnerable third party components, right, that's the symptom, we have a vulnerable third party component. And so most places have some sort of process in place where we're going to identify these right, we're going to scan them all the time, whether using some of the common commercial tools, maybe you're using a free open source tool. But basically, the way it goes is I'm going to scan my repos or I'm going to scan my packages, and I'm going to look for all the dependencies, and then I'll look at their dependencies, and we'll see if there's any known vulnerable components within these right. And that requires having some sort of CVE out there that says, hey, somebody has found this, they've reported it, I remember requiring this to be a rep Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 119: Risks of SpellCheck 12:35

۳ years پیش12:35

12:35

In this episode we talk about the spell check feature of the browser and how it could present a risk to sensitive data. Link to article referenced: https://www.darkreading.com/application-security/spellchecking-google-chrome-microsoft-edge-browsers-leaks-passwords For more info go to https://www.developsec.com or follow us on twitter (@developsec). DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 118: Log4J Sparking Thought on Vulnerable Components 24:27

۴ years پیش24:27

24:27

Log4J has been the talk of the town recently and everyone is focused on the technical details of the specific vulnerabilities found. In this episode, James talks about the overarching ideas around dealing with vulnerable components. Are you vulnerable? If so, what needs to be done? For more info go to https://www.developsec.com or follow us on twitter (@developsec). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 117: How Browsers are Helping with Security 13:49

۵ years پیش13:49

13:49

Chrome has announced a few changes that we need to watch out for in the near future. We previously talked about the default value for samesite that is coming up fast. I wrote about this here: https://www.jardinesoftware.net/2019/10/28/samesite-by-default-in-2020/ Also, they are getting ready to start blocking mixed content downloads: https://blog.chromium.org/2020/02/protecting-users-from-insecure.html For more info go to https://www.developsec.com or follow us on twitter (@developsec). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 116: Chrome Retires XSS Auditor 14:07

۶ years پیش14:07

14:07

It was recently announced that Chrome was dropping the XSS Auditor in Chrome 78. What does that mean and how does that change things for you as a developer? https://www.chromium.org/developers/design-documents/xss-auditor For more info go to https://www.developsec.com or follow us on twitter (@developsec). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 115: Is CSRF Really Dead? 15:09

۶ years پیش15:09

15:09

In 2020, Chrome will default the SameSite attribute to Lax on all cookies. SameSite helps mitigate CSRF, but does that mean CSRF is Dead? For more info go to https://www.developsec.com or follow us on twitter (@developsec). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 114: Investing in People for Better Application Security 24:37

۶ years پیش24:37

24:37

In this episode, James talks about investing in the development teams to increase application security priorities. For more info go to https://www.developsec.com or follow us on twitter (@developsec). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 113: What is your mother's maiden name? 21:00

۶ years پیش21:00

21:00

In this episode, James talks about some of the risks and recommendations around security questions and their implementation. For more info go to https://www.developsec.com or follow us on twitter (@developsec). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 112: Application Fingerprinting 21:04

۷ years پیش21:04

21:04

Does your application give away details about it server, framework, or other components? How is this information used by an attacker? Check out this episode to learn more. For more info go to https://www.developsec.com or follow us on twitter (@developsec). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 111: Authentication Alerts 16:07

۷ years پیش16:07

16:07

Would you know if someone authenticated to your account? With the breaches we see in the news, and attacks like credential stuffing, there must be a way to be alerted to account access. James talks about authentication alerts, what they are, and why you may want to use them. For more info go to https://www.developsec.com or follow us on twitter (@developsec). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 110: Implementation Matters 19:17

۷ years پیش19:17

19:17

James discusses how implementation matters with security controls and how it changes priorities. This came about after reading the following story: https://www.theverge.com/2018/12/31/18162541/vein-authentication-wax-hand-hack-starbug For more info go to https://www.developsec.com or follow us on twitter (@developsec). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 109: 2018 Reflection 27:26

۷ years پیش27:26

27:26

I talk about some of what happened in 2018 and what I am looking to do in 2019. I also ask you to think about your previous year and goals. I also talk about some new training I am providing. For more info go to https://www.developsec.com or follow us on twitter (@developsec). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 108: Dunkin Donuts Breach, Maybe?? 18:25

۷ years پیش18:25

18:25

In this episode James talk about the Dunkin Donuts Perks breach. This is an interesting situation as the accounts were access using the victim's username and password found from another data breach. The issue: Password Reuse. Could D&D have prevented this? Listen in to hear my thoughts. Please feel free to share your thoughts as well. Article from Today: https://www.today.com/food/dunkin-reveals-security-breach-here-s-what-it-may-mean-t144139 Dunkin Donuts Release: https://www.dunkindonuts.com/content/dam/dd/pdf/Security_Update.pdf For more info go to https://www.developsec.com or follow us on twitter (@developsec). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 107: Credential Stuffing 18:36

۷ years پیش18:36

18:36

In this episode James talks about what credential stuffing is, how if affects your apps, and how you can look to defend against it. For more info go to https://www.developsec.com or follow us on twitter (@developsec). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 106: Facebook Breach Take-aways and Insights 31:18

۷ years پیش31:18

31:18

James talks about the Facebook breach and shares some insights into how you can take steps to prevent this type of incident in your applications. For more info go to https://www.developsec.com or follow us on twitter (@developsec). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 105: Interview with Eric Johnson 57:11

۷ years پیش57:11

57:11

I sit down with Eric Johnson to talk about security in the IDE and other fun topics. A bit longer than usual, but full of great information. You can reach out to Eric on twitter @emjohn20 or check out his site at https://www.pumascan.com . For more info go to https://www.developsec.com or follow us on twitter (@developsec). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 104: Securing Devops with Julien Vehent 45:07

۷ years پیش45:07

45:07

James sits down with Julien Vehent to discuss his new book "Securing DevOps" and talk about security in a devOps world. Julien (@jvehent) is a security architect and engineering manager with over 15 years of experience in large organizations and web companies. He is currently responsible for the operational security of Firefox's backend infrastructure at Mozilla, and is the author of Securing DevOps. Check out the book (Securing DevOps) at https://www.manning.com/books/securing-devops Special 40% discount code for Developsec listeners: poddevelopsec18 For more info go to https://www.developsec.com or follow us on twitter (@developsec). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 103: Is 3rd Party Authentication Right For Your Application? 18:16

۷ years پیش18:16

18:16

The headlines are filled with credential breaches. One way to avoid being those headlines is to not store credentials. Instead, use a 3rd party to authenticate your users. While this cuts a lot of work out of your development time, it is important to understand the pros and cons to each method. James talks through some of these risks to help better understand which method might be right for you. Links from show: Ep. 92: 2-Factor Authentication - http://podcast.developsec.com/ep-92-2-factor-authentication Ep. 61: Multi-factor Authentication - http://podcast.developsec.com/ep-61-multi-factor-authentication Ep. 39: Authentication - http://podcast.developsec.com/ep-39-authentication Ep. 2: All About Passwords - http://podcast.developsec.com/ep-1-all-about-passwords Ep. 73: Identity with Vittorio Bertocci - http://podcast.developsec.com/ep-73-identity-with-vittorio-bertocci For more info go to https://www.developsec.com or follow us on twitter (@developsec). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 102: Intro to Web Security Policies 16:41

۷ years پیش16:41

16:41

In this episode James introduces us to the idea of web security policies stored in a security.txt file. We have talked about vulnerability disclosure before and this ties directly into that conversation. Link to Draft: https://tools.ietf.org/html/draft-foudil-securitytxt-03 Link to form to create the file: https://securitytxt.org/ Link to our blog post: https://www.developsec.com/2018/06/26/overview-of-web-security-policies/ For more info go to https://www.developsec.com or follow us on twitter ( @developsec ). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 101: You're not always right and that is ok 20:58

۷ years پیش20:58

20:58

In this episode, James shares a story of learning from a mistake and how we can't be right every time. Hear what he learned and how you can learn too. For more info go to https://www.developsec.com or follow us on twitter (@developsec). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 100: Choosing Security Tools 26:36

۷ years پیش26:36

26:36

In this episode we talk about choosing the right security tools for your environment. There are lots of vendors offering solutions to help identify security issues within our applications. The trick is to learn to identify which ones make the most sense for your environment. For more info go to https://www.developsec.com or follow us on twitter (@developsec). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 99: Shifting Left in the SDLC 19:56

۷ years پیش19:56

19:56

In this episode, James talks about what it means to shift left in the SDLC. For more info go to https://www.developsec.com or follow us on twitter (@developsec). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 98: Efail and News Hype 18:07

۷ years پیش18:07

18:07

In this episode we talk about efail and the HYPE around security news. For more info go to https://www.developsec.com or follow us on twitter (@developsec). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
EP. 97: Gmail / Netflix Potential Scam 18:27

۷ years پیش18:27

18:27

** Check out our new Live Fundamentals of Application Security training starting on May 1, 2018. Don't wait to sign up. For schedules and information check out https://www.jardinesoftware.com/fundamentals-of-application-security/ ** In this episode, James shares his thoughts on an interesting scam potential was brought up regarding Gmail and Netflix. A lot of the discussion is on a unique Gmail feature most haven't heard of. James breaks this down in this episode. The original story was shared at https://www.theregister.co.uk/2018/04/10/gmail_netflix_phishing_vector/ For more info go to https://www.developsec.com or follow us on twitter (@developsec). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 96: Security Flaws as Defects 27:35

۷ years پیش27:35

27:35

In this episode we talk about treating security flaws as defects and embedded vs. built-in security. Do you treat security flaws differently? What barriers does that create? For more info go to https://www.developsec.com or follow us on twitter (@developsec). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 95: MyFitnessPal Breach Take-Aways 18:24

۷ years پیش18:24

18:24

In this episode we talk about the MyFitnessPal breach and some of the key points that we as developers, security, and users can take away from it. Tweet with Graph of Largest Breaches mentioned: https://twitter.com/EricTopol/status/979556839015661568 Link to article about the breach: https://www.cnet.com/news/millions-of-myfitnesspal-accounts-hacked-under-armour-says/ For more info go to https://www.developsec.com or follow us on twitter (@developsec). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 94: Penetration Testing 26:09

۷ years پیش26:09

26:09

In this episode we talk about penetration testing and what you need to know to get the most out of the activity. Tune in to hear some of our thoughts on the topic. To take the training course survey go to https://forms.office.com/Pages/ResponsePage.aspx?id=dUTTGKfrY0SMJRLyejG00DrfDtlb8W5HpqoXHgPDektUNDgxVU9SNlVRNVhXMTY4UUxSU041MFVWTC4u For more info go to https://www.developsec.com or follow us on twitter (@developsec). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 93: Code Review 25:53

۷ years پیش25:53

25:53

In this episode we talk about secure code review with a mention of static analysis. Do you know the difference? What is the issue of doing one over the other, or just outright replacing actual code review with static analysis? Tune in to hear some of our thoughts on the topic. For more info go to https://www.developsec.com or follow us on twitter (@developsec). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 92: 2-Factor Authentication 21:41

۷ years پیش21:41

21:41

In this episode James talks about 2-factor authentication, why we use it, and maybe why we don't. Is your 2-factor implementation getting in your way? The DevelopSec YouTube Channel - https://www.youtube.com/channel/UCdAqgfdGs0-hPa8FhsODwNw For more info go to https://www.developsec.com or follow us on twitter (@developsec). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
DevelopSec Podcast #91 - OWASP Top 10 2017 Thoughts 28:45

۷ years پیش28:45

28:45

The new OWASP Top 10 2017 is out. We look at some of the changes and how you can effectively use the list to better your security program. We are also launching a new DevelopSec Live broadcast. To check out the first episode, go to https://www.youtube.com/watch?v=kfDuxwFScOE (The first 2 minutes are just a place holder as I was starting, feel free to skip those. That will go away in future episodes). The DevelopSec YouTube Channel - https://www.youtube.com/channel/UCdAqgfdGs0-hPa8FhsODwNw For more info go to https://www.developsec.com or follow us on twitter (@developsec). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 90: 5 Steps to Help Secure Your Database 44:12

۸ years پیش44:12

44:12

James sits down with Perry Krug, from Couchbase to discuss some important steps to take to secure your database. Perry Krug - https://twitter.com/perrykrug Couchbase - https://twitter.com/couchbase Couchbase - https://www.couchbase.com/ CouchbaseSecurity Documents - https://developer.couchbase.com/documentation/server/current/security/security-intro.html For more info go to https://www.developsec.com or follow us on twitter (@developsec). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 89: New Year's Resolutions 18:34

۸ years پیش18:34

18:34

Welcome to 2018! Another year down and time for many of us to start making promises to ourselves of things we will start doing in this new year. In this episode James talks about some lessons we should take from 2017 and ways to use them in 2018. For more info go to https://www.developsec.com or follow us on twitter (@developsec). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 88: Meteor Security with Tim Medin 42:33

۸ years پیش42:33

42:33

In this episode, James talks with Tim Medin regarding Meteor and security. If you develop with Meteor or have to test it, there is a lot of information packed in. More about Tim Medin (@timmedin): Red Seige website - https://www.redsiege.com/ Link to Meteor Minor and other tools Tim mentioned: https://github.com/nidem Tim Medin's Bsides Orlando 2017 Presentation - Tim Medin - Mining Meteor B-Sides Orlando 2017 For more info go to https://www.developsec.com or follow us on twitter (@developsec). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 87: Apple Sign-in Bug Take-Aways 24:20

۸ years پیش24:20

24:20

You have heard about the Apple Sign-in Bug on High Sierra. Now lets talk about how we can use this example to better our current development processes to protect ourselves. Link to mentioned article: https://www.theguardian.com/technology/2017/nov/30/apple-macos-high-sierra-fix-breaks-file-sharing-password-security-flaw-emergency-patch For more info go to https://www.developsec.com or follow us on twitter (@developsec). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 86: Vulnerable 3rd Party Components 18:34

۸ years پیش18:34

18:34

In this episode, James talks the use of 3rd party components and how to handle determining if they are vulnerable or not. Links: OWASP Dependancy Check - https://www.owasp.org/index.php/OWASP_Dependency_Check GitHub Blog - https://github.com/blog/2470-introducing-security-alerts-on-github RetireJS - https://retirejs.github.io/retire.js/ For more info go to https://www.developsec.com or follow us on twitter (@developsec). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 85: Open Redirect Revisited 25:01

۸ years پیش25:01

25:01

In this episode, James talks about open redirect and why it matters from a security perspective. He also shows how this information can be used in your personal technology use, not just in development. For more info go to https://www.developsec.com or follow us on twitter ( @developsec ). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 84: Understanding the Technology 23:30

۸ years پیش23:30

23:30

You know your development language and platform, but do you really know the ins and outs of web application technology? How well do you know HTTP, HTML, etc? James talks about a few scenarios where really understanding how the technologies works helps better understand vulnerability risks. For more info go to https://www.developsec.com or follow us on twitter ( @developsec ). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 83: Authorization Overview 20:54

۸ years پیش20:54

20:54

In this episode, James talks about authorization and some common areas where it poses a risk. He also goes over some techniques to help test authorization. For more info go to https://www.developsec.com or follow us on twitter ( @developsec ). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 82: Equifax Take-aways 25:55

۸ years پیش25:55

25:55

The Equifax breach was a major news story. James talks about some of the security controls mentioned and how to start a conversation within your organization about them. Want to listen on YouTube? Check out our channel where we are releasing episodes starting from episode 1 at https://www.youtube.com/channel/UCdAqgfdGs0-hPa8FhsODwNw For more info go to https://www.developsec.com or follow us on twitter ( @developsec ). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 81: JavaScript in HREF and SRC (XSS) 20:20

۸ years پیش20:20

20:20

We talk about cross-site scripting (XSS) all the time, but often overlook the ability to use javascript: in anchor tags. James talks about this unique ability and how to protect your applications from it. The related blog post for this can be found at https://www.developsec.com/2017/09/06/javascript-in-an-href-or-src-attribute/ Want to listen on YouTube? Check out our channel where we are releasing episodes starting from episode 1 at https://www.youtube.com/channel/UCdAqgfdGs0-hPa8FhsODwNw For more info go to https://www.developsec.com or follow us on twitter ( @developsec ). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 80: Understanding Security of Your Platforms 19:35

۸ years پیش19:35

19:35

We use a lot of platforms and frameworks when we develop an application. These platforms may provide security features, but do you know which ones? James talks about the importance of understanding your platforms and what to consider. For more info go to https://www.developsec.com or follow us on twitter ( @developsec ). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 79: Marketing with USB Drives 15:40

۸ years پیش15:40

15:40

James talks about the risk of USB thumb drives and their risk using the recent BCBS marketing campaign as an example. ( http://www.fiercehealthcare.com/privacy-security/bcbs-alabama-re-evaluates-usb-marketing-campaign-amid-security-concerns ). For more info go to https://www.developsec.com or follow us on twitter ( @developsec ). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 78: MySpace Lessons - Looking At Account Recovery 19:14

۸ years پیش19:14

19:14

James talks about a recent vulnerability report regarding MySpace's Account Recovery system ( https://www.wired.com/story/myspace-security-account-takeover/ ). He talks about considerations around account recovery and the need to revisit this type of functionality on a regular basis. For more info go to https://www.developsec.com or follow us on twitter ( @developsec ). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 77: Interactive Application Security Testing 14:47

۸ years پیش14:47

14:47

In this episode, James talks about Interactive Application Security Testing, or IAST. It is a sort of hybrid approach that is similar to both dynamic and static analysis. Listen in to learn more about it. The video version of this can be found at https://youtu.be/KHSlDletm9I For more info go to https://www.developsec.com or follow us on twitter ( @developsec ). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 76: Validation - Client vs. Server 13:09

۸ years پیش13:09

13:09

Are you thinking about client vs. server-side input validation? Curious why each is important and when to use them? James talks about the basic concepts and how to apply them to create more secure applications. A video version of this podcast is now available at: https://youtu.be/irO1TOC6-i8 For more info go to https://www.developsec.com or follow us on twitter ( @developsec ). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 75: IAM with Geurt van Wijk 41:45

۸ years پیش41:45

41:45

In this episode I sit down with Geurt van Wijk from IDdriven to discuss IAM and IDaaS. Geurt has many years of experience around Identity and shares some great insights into considerations when working with it. If you typically think of Identity as just a user with credentials and some typical roles, you will want to listen in. You can get more information about IDdrive from https://www.iddriven.com For more info go to https://www.developsec.com or follow us on twitter ( @developsec ). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 74: Audio Driver Key Logger Lessons Learned 16:25

۸ years پیش16:25

16:25

It was recently reported that an audio driver on HP systems was logging key strokes to a local file. Accidental? Malicious? Instead, we talk about how to try and avoid this from happening in the future. Original Article: https://www.cnet.com/news/keylogger-discovered-on-some-hp-laptops-conexant/ For more info go to https://www.developsec.com or follow us on twitter ( @developsec ). Join the conversations.. join our slack channel. Email james@jardinesoftware for an invitation. Presented by Jardine Software Inc. ( https://www.jardinesoftware.com ) Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Check out our 30 day advantage . Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 73: Identity with Vittorio Bertocci 30:26

۸ years پیش30:26

30:26

I sat down with Vittorio Bertocci from Microsoft at the Microsoft Build 2017 conference in Seattle Washington. Vittorio shared some great insights into Identity and some new things around Azure AD and Azure AD B2C. Listen in to learn more about some of the interesting things going on. You can watch Vittorio's presentation from build at: https://channel9.msdn.com/Events/Build/2017/B8084 To get more information from Vittorio, you can follow him on twitter at @vibronet or check out his website at www.cloudidentity.com Also, check out this announcement about new authentication SDKs: https://azure.microsoft.com/en-us/blog/start-writing-applications-today-with-the-new-microsoft-authentication-sdks/ For more info go to https://www.developsec.com or follow us on twitter ( @developsec ). Join the conversations.. join our slack channel. Email james@jardinesoftware for an invitation. Presented by Jardine Software Inc. ( https://www.jardinesoftware.com ) Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Check out our 30 day advantage . Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 72: Where to Perform Output Encoding 13:37

۸ years پیش13:37

13:37

Over the years I have had many people ask about encoding before storing data in the database. Here are my thoughts and recommendations. For more info go to https://www.developsec.com or follow us on twitter ( @developsec ). Join the conversations.. join our slack channel. Email james@jardinesoftware for an invitation. Presented by Jardine Software Inc. ( https://www.jardinesoftware.com ) Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Check out our 30 day advantage . Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 71: Sub Resource Integrity 14:47

۸ years پیش14:47

14:47

Do you use hosted content on a CDN? How do you know the file hasn't been modified? James describes Sub Resource Integrity and how it is used to help detect and prevent loading modified files. For details referenced in the show about commands and examples, check out our post at https://www.developsec.com/2017/04/16/sub-resource-integrity-sri/ For more info go to https://www.developsec.com or follow us on twitter ( @developsec ). Join the conversations.. join our slack channel. Email james@jardinesoftware for an invitation. Presented by Jardine Software Inc. ( https://www.jardinesoftware.com ) Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Check out our 30 day advantage . Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 70: Considering security when selecting an application platform 21:02

۸ years پیش21:02

21:02

Do you struggle with trying to pick the most secure application platform? Are you focusing on the right questions? James talks about ways to look at application platforms and be secure, no matter which one you choose. For more info go to https://www.developsec.com or follow us on twitter ( @developsec ). Join the conversations.. join our slack channel. Email james@jardinesoftware for an invitation. Presented by Jardine Software Inc. ( https://www.jardinesoftware.com ) Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Check out our 30 day advantage . Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 69: Concurrent User Sessions 21:23

۸ years پیش21:23

21:23

Do you allow users to login into their accounts across multiple browsers or devices? Does this raise a security concern? James talks about how to handle this question and analyze the root issue. For more info go to https://www.developsec.com or follow us on twitter ( @developsec ). Presented by Jardine Software Inc. ( https://www.jardinesoftware.com ) Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Check out our 30 day advantage . Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 68: How the AWS disruption can help us 15:22

۸ years پیش15:22

15:22

I am sure you have heard about the AWS service disruption that occurred. Have you seen how we can learn from this when we look at our own tools and processes? James talks about how we need to look at our own applications and tools and consider how time has changed the landscape. There might be more than you think. For more info go to https://www.developsec.com or follow us on twitter ( @developsec ). Presented by Jardine Software Inc. ( https://www.jardinesoftware.com ) Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Check out our 30 day advantage . Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 67: Clearing up HTTPOnly and Secure Cookie Attributes 9:23

۸ years پیش9:23

9:23

I hear a lot of people struggling with HTTPOnly and Secure attributes on cookies. The names may be confusing to some. Change your viewpoint and it may become easier.. For more info go to https://www.developsec.com or follow us on twitter ( @developsec ). Presented by Jardine Software Inc. ( https://www.jardinesoftware.com ) Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Check out our 30 day advantage . Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 66: Forgot Username 14:45

۸ years پیش14:45

14:45

We always talk about Forgot Password... But what about Forgot Username? Listen in as James discusses why protecting this functionality is important and the ways it could be abused if not properly handled. For more info go to https://www.developsec.com or follow us on twitter ( @developsec ). Presented by Jardine Software Inc. ( https://www.jardinesoftware.com ) Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Check out our 30 day advantage . Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 65: Security Questions: Good or Bad? 18:07

۸ years پیش18:07

18:07

In this episode, James talks about security questions, or secret questions. We see them used in many different places. People complain they are horrible. So are they that bad that you shouldn't use them? Is it possible to help reduce the risk with security questions? For more info go to https://www.developsec.com or follow us on twitter (@developsec). Presented by Jardine Software Inc. ( https://www.jardinesoftware.com ) Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Check out our 30 day advantage . Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 64: Using Stolen Passwords to Protect User Accounts 14:27

۹ years پیش14:27

14:27

A few months ago, it was announced that some companies buy stolen passwords off of the black market to help protect their users. This is done by determining if the user's password was part of that list and forcing a reset. James talks about the idea and raises some interesting questions. What do you think about the tactic? For more info go to https://www.developsec.com or follow us on twitter ( @developsec ). Presented by Jardine Software Inc. ( https://www.jardinesoftware.com ) Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Check out our 30 day advantage . Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 63: Remember Me Feature: Security Considerations 15:06

۹ years پیش15:06

15:06

Are you, or have you, implemented a remember me feature for your application? What do you remember, username, password, or both? James talks about some security considerations around implementing a remember me feature for your application. For more info go to https://www.developsec.com or follow us on twitter ( @developsec ). Presented by Jardine Software Inc. ( https://www.jardinesoftware.com ) Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Check out our 30 day advantage . Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 62: MongoDB Ransomware Attacks 13:53

۹ years پیش13:53

13:53

Do you use MongoDB? If so, is it exposed to the internet? Recent news (listed below) had shown that a large number of MongoDB instances are being infected with ransomware. James talks about the issue and ways to help ensure you are not the next victim. Link to original article: http://arstechnica.com/security/2017/01/more-than-10000-online-databases-taken-hostage-by-ransomware-attackers/ For more info go to https://www.developsec.com or follow us on twitter ( @developsec ). Presented by Jardine Software Inc. ( https://www.jardinesoftware.com ) Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Check out our 30 day advantage . Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 61: Multi-factor Authentication 17:24

۹ years پیش17:24

17:24

Implementing multi-factor authentication isn't just about a second factor. There are many considerations that need to be included. One in particular, how do you handle the user losing their means of that second factor. James talks about thinking this through. For more info go to https://www.developsec.com or follow us on twitter (@developsec). Presented by Jardine Software Inc. ( https://www.jardinesoftware.com ) Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Check out our 30 day advantage . Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 60: Yahoo Breach Takeaways 18:49

۹ years پیش18:49

18:49

Yahoo has announced yet another breach from back in 2013 affecting a very large number of user accounts. https://investor.yahoo.net/ReleaseDetail.cfm?&ReleaseID=1004285 This creates an opportunity to discuss password storage and the storage of security answers. Find out what we can takeaway from this incident. For more info go to https://www.developsec.com or follow us on twitter (@developsec). Presented by Jardine Software Inc. ( https://www.jardinesoftware.com ) Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Check out our 30 day advantage . Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 59: All About Cookie Protection 23:06

۹ years پیش23:06

23:06

It is the holiday season. It is appropriate to talk about cookies. Not the kind that you bake, but the ones in your applications. James talks about the security mechanisms for cookies and clarifies what they are for. For more info go to https://www.developsec.com or follow us on twitter (@developsec). Presented by Jardine Software Inc. ( https://www.jardinesoftware.com ) Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Check out our 30 day advantage . Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 58: "Untrusted" Data 21:40

۹ years پیش21:40

21:40

Have you heard someone mention "untrusted" data? Applications take data from multiple data sources and we are often confused on what should be trusted or not. In this episode, James Jardine talks about untrusted data and some thoughts for moving past it. For more info go to https://www.developsec.com or follow us on twitter (@developsec). Presented by Jardine Software Inc. ( https://www.jardinesoftware.com ) Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Check out our 30 day advantage . Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 57: Source Code Review 21:59

۹ years پیش21:59

21:59

Are you an organization looking to do source code review? Are you trying to hire a pen tester with source code review as a duty? James talks about Secure Code Review and some common implementations. For more info go to https://www.developsec.com or follow us on twitter (@developsec). Presented by Jardine Software Inc. ( https://www.jardinesoftware.com ) Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Check out our 30 day advantage . Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 56: Security Contacts 12:32

۹ years پیش12:32

12:32

Do you have a clear path for users to contact you about potential security issues in your application or device? Is there a potential for the communication to be lost in the mix? James talks about how it is important for users to have a clear path to communication when it comes to reporting security issues. For more info go to https://www.developsec.com or follow us on twitter (@developsec). Presented by Jardine Software Inc. ( https://www.jardinesoftware.com ) Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Check out our 30 day advantage . Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 55: Scoping an application security assessment (Applications) 12:03

۹ years پیش12:03

12:03

Having a penetration test performed against your applications? Do you have mobile and web applications performing the same functionality? James talks about the reason behind doing these assessments at the same time vs. separate. See why testing your entire offering can add benefit to your security assessment. Link to DerbyCon Presentation For more info go to https://www.developsec.com or follow us on twitter (@developsec). Presented by Jardine Software Inc. ( https://www.jardinesoftware.com ) Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Check out our 30 day advantage . Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 54: WAFs and Pen Testing 16:19

۹ years پیش16:19

16:19

Your pen tester want you to white list them in your WAF? What should you do? Why do they ask? James breaks it down for you in this episode. For more info go to https://www.developsec.com or follow us on twitter (@developsec). Presented by Jardine Software Inc. ( https://www.jardinesoftware.com ) Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Check out our 30 day advantage . Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 53: Chrome Changing Secure Notifications 17:09

۹ years پیش17:09

17:09

We talk HTTP/HTTPS all the time. Google just announced that in January they are going to change how they display their secure/not secure indicators for HTTP sites that have passwords or credit cards. James talks about how this can effect you. Link to the article: https://security.googleblog.com/2016/09/moving-towards-more-secure-web.html For more info go to https://www.developsec.com or follow us on twitter (@developsec). Presented by Jardine Software Inc. ( https://www.jardinesoftware.com ) Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Check out our 30 day advantage . Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Login Forms and HTTPS 10:28

۹ years پیش10:28

10:28

Are your login forms secure? Are you sure? In this episode James talks about potential risks with presenting your login forms when using HTTPS and how to avoid them. We often are focused on HTTPS for the submission of credentials, but what about the loading of the form? What about frames? For more info go to https://www.developsec.com or follow us on twitter (@developsec). Presented by Jardine Software Inc. ( https://www.jardinesoftware.com ) Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Check out our 30 day advantage . Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 52: Importance of UI to Security 11:37

۹ years پیش11:37

11:37

The user interface plays a big part in the security of an application. We often only look at flaws such as XSS, but here James provides an example of the lack of Input Validation messages creating a Denial of Service type situation. For more info go to https://www.developsec.com or follow us on twitter (@developsec). Presented by Jardine Software Inc. ( https://www.jardinesoftware.com ) Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Check out our 30 day advantage . Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 51: Everything is a target 12:48

۹ years پیش12:48

12:48

James discusses how all applications, big or small, are a potential target and need to have secure coding practices. We often only look at our big applications from a security perspective, but in reality, all applications pose a risk. For more info go to https://www.developsec.com or follow us on twitter (@developsec). Presented by Jardine Software Inc. ( https://www.jardinesoftware.com ) Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Check out our 30 day advantage . Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 50: How Serious is Username Enumeration 23:06

۹ years پیش23:06

23:06

In this episode, James talks about what Username Enumeration is, how it can be used by attackers, and some ways to help reduce the risk of it. For more info go to https://www.developsec.com or follow us on twitter (@developsec). Presented by Jardine Software Inc. ( https://www.jardinesoftware.com ) Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Check out our 30 day advantage . Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 49: Should Password Change Invalidate Access Tokens? 16:13

۹ years پیش16:13

16:13

Interesting question was raised around changing a password and the need to invalidate all the access tokens for the associated mobile devices. James talks about his view on the topic and how you can analyze your situation to determine the appropriate direction. For more info go to https://www.developsec.com or follow us on twitter (@developsec). Presented by Jardine Software Inc. ( https://www.jardinesoftware.com ) Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Check out our 30 day advantage . Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 48: Pokemon Go Security Discussions 18:58

۹ years پیش18:58

18:58

Pokemon Go has taken the world by storm and as always, it brings up some things to talk about regarding security. In this episode James talks about some out of the box security thoughts regarding mobile applications including app permissions, fake apps, and scams. **Link to James' interview on News4Jax talking about Pokemon Go Security Concerns http://www.news4jax.com/news/morning-show/pokemon-go-security-concerns ** For more info go to https://www.developsec.com or follow us on twitter (@developsec). Presented by Jardine Software Inc. ( https://www.jardinesoftware.com ) Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Check out our 30 day advantage . Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 47: Account Lockouts and auto-unlock 10:54

۹ years پیش10:54

10:54

A question came in regarding auto-unlock of accounts and account lockout in general. James discusses his thoughts on this process and how he approaches these types of questions. For more info go to https://www.developsec.com or follow us on twitter (@developsec). Presented by Jardine Software Inc. ( https://www.jardinesoftware.com ) Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Check out our 30 day advantage . Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 46: Password Confirm Boxes 11:41

۹ years پیش11:41

11:41

A question came in around the need for the password confirm box on registration screens and the security implications. In this episode I respond to the question and give some insights on how to approach these types of questions from a security perspective. For more info go to https://www.developsec.com or follow us on twitter (@developsec). Presented by Jardine Software Inc. ( https://www.jardinesoftware.com ) Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Check out our 30 day advantage . Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 45: The importance of WHY 22:45

۹ years پیش22:45

22:45

We are too quick to just give generic recommendations for resolving security vulnerabilities. We need to make sure that the application teams understand why these are vulnerabilities and why they are important. It all starts with Why is that functionality there. James talks about the importance of understanding the WHY and how it is a building block for better secure applications. For more info go to https://www.developsec.com or follow us on twitter (@developsec). Presented by Jardine Software Inc. ( https://www.jardinesoftware.com ) Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Check out our 30 day advantage . Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 44: "We don't support Macs" 12:02

۹ years پیش12:02

12:02

When a developer was presented with a but they tried to say that it wasn't an issue because it was found by a tester using a Mac. "We don't support Macs" James talks about how this is a fundamental misunderstanding about security and tries to clear it up. For more info go to https://www.developsec.com or follow us on twitter (@developsec). Presented by Jardine Software Inc. ( https://www.jardinesoftware.com ) Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Check out our 30 day advantage . Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 43: Reflecting on Current AppSec Training 22:01

۹ years پیش22:01

22:01

James reflects on the current way we expect application teams to get security training and potential short falls. Is there a better way? Listen as I talk through some different points on the topic. For more info go to https://www.developsec.com or follow us on twitter (@developsec). Presented by Jardine Software Inc. ( https://www.jardinesoftware.com ) Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Check out our 30 day advantage . Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 42: The Need for Better Secure Code Examples 21:38

۹ years پیش21:38

21:38

How do you get your secure coding information? Do you pull code snippets from the internet? Who doesn't. How many of those actually use secure coding best practices. We have a challenge where most of our books, tutorials, and even college classes don't show secure code examples, just code examples. Everywhere we turn, the code we see is insecure. James Talks about this issue and some things you can do to help change that. In the episode, James makes reference to the IT Hot Topics Conference ( https://www.eiseverywhere.com/ehome/index.php?eventid=155122&) . James will be presenting on Friday morning. If you are in the area, this may be a great conference to check out. See the link included for registration info. For more info go to https://www.developsec.com or follow us on twitter (@developsec). Presented by Jardine Software Inc. ( https://www.jardinesoftware.com ) Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Check out our 30 day advantage . Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 41: Why You Need an Application Inventory 18:21

۹ years پیش18:21

18:21

Do you use an application inventory in your application security program? James discusses what an application inventory is and why it is important. Here is a list of a few tools that can be used to help identify some application details: Consider using OWASP Dependency Check ( https://www.owasp.org/index.php/OWASP_Dependency_Check ) Retire.js will help identify out dated javascript libraries ( http://retirejs.github.io/retire.js/ ) - This is also a burp extension For more info go to https://www.developsec.com or follow us on twitter (@developsec). Presented by Jardine Software Inc. (https://www.jardinesoftware.com) Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Check out our 30 day advantage . Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 40: Getting More Value from Pen Tests 16:48

۹ years پیش16:48

16:48

Penetration tests provide a measuring stick for security, but are you missing out on additional value? James discusses ways to use the pen test results to get more value out of a penetration test. James will be providing a free webcast regarding Penetration Testing for Application Teams on March 18th, 2016. Here is the registration link: https://attendee.gototraining.com/r/3147075330537789954 For more info go to https://www.developsec.com or follow us on twitter (@developsec). Presented by Jardine Software Inc. (https://www.jardinesoftware.com) Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 39: Authentication 19:49

۹ years پیش19:49

19:49

James discusses what authentication is and some things to look out for. For more info go to https://www.developsec.com or follow us on twitter (@developsec). Presented by Jardine Software Inc. (https://www.jardinesoftware.com) Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 38: Static Analysis: Tips for Successful Program 39:14

۹ years پیش39:14

39:14

In this episode, James Jardine talks about some of the things you need to consider when trying to implement a static analysis program. It is more than just a tool you drop in. To build a successful program there are other considerations. For more info go to https://www.developsec.com or follow us on twitter (@developsec). Presented by Jardine Software Inc. (https://www.jardinesoftware.com) Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 37: CSRF Chaining 17:51

۹ years پیش17:51

17:51

James Jardine discusses CSRF chaining, using the combination of multiple CSRF requests to perform a task. Typically we believe that CSRF can only be done with one request, but with a little javascript it is possible to execute multiple requests. Listen in for more information. For more info go to https://www.developsec.com or follow us on twitter (@developsec). Presented by Jardine Software Inc. (https://www.jardinesoftware.com) Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 36: Intro to Cross Site Request Forgery (CSRF) 23:46

10 years پیش23:46

23:46

In this episode, James talks about what CSRF is, why it is a risk, and different ways to protect against it. CSRF is #8 on the OWASP Top 10 https://www.owasp.org/index.php/Top_10_2013-A8-Cross-Site_Request_Forgery_%28CSRF%29 Want to learn more about application security? Check out https://www.developsec.com . Follow us at @developsec on twitter. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 35: An Introduction to Open Redirects 17:05

10 years پیش17:05

17:05

James discusses Open Redirects, or on the OWASP Top 10 what is referred to as Unvalidated Redirects and Forwards ( https://www.owasp.org/index.php/Top_10_2013-A10-Unvalidated_Redirects_and_Forwards) This is an introduction to what an Open Redirect is, why it is an issue, how to protect against it and how to test for it. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 34: Importance of Hacking 25:18

10 years پیش25:18

25:18

James discusses Hacking, what is it, why is it important. It is more than what you see in the media of the bad guys hacking computers. It is a curiosity, a hobby, an interesting in pushing limits. Some amazing things have come out of hacking. Check out this episode for more ramblings. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 33: Holiday Gift Security Considerations 18:38

10 years پیش18:38

18:38

James discussing some things to consider this holiday season when searching for that perfect gift. It is important to understand the privacy policy (what is collected and how it is used) as well as the technologies the gift uses (Bluetooth, wifi, etc). This discussion addresses both consumers and the companies that create these gifts. For more info go to https://www.developsec.com or follow us on twitter (@developsec). Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 32: Dynamic Analysis: An Overview 22:27

10 years پیش22:27

22:27

James Jardine provides an overview of Dynamic Analysis and why it is important. Like any automation, there are pros and cons. Listen to find out why dynamic analysis is useful. Some links to some dynamic analysis options that are available: WhiteHat Security (http://www.whitehatsec.com) HP - Web Inspect (http://www8.hp.com/us/en/software-solutions/webinspect-dynamic-analysis-dast/) IBM App Scan (http://www-03.ibm.com/software/products/en/appscan) Veracode (http://www.veracode.com) Acunetix (https://www.acunetix.com/) Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 31: Response Splitting and Header Injection 18:40

10 years پیش18:40

18:40

Join James Jardine as he discusses what Response Splitting/Header Injection is and how it works. He also discusses how ASP.Net helps defend against this attack. This is a quick overview of the vulnerability and a great starting point for anyone learning security concepts. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Newscast - Oct. 20, 2015 26:16

10 years پیش26:16

26:16

Hi and welcome to the DevelopSec newscast for October 20th, 2015. I am James Jardine and I wanted to take a few moments to talk about some recent news stories over the past week. Apple removes several apps that could spy on encrypted traffic - http://arstechnica.com/security/2015/10/apple-removes-several-apps-that-could-spy-on-encrypted-traffic/ , http://www.theregister.co.uk/2015/10/09/apple_borks_adblocking_app_over_privacy_concerns/ Apps installed a root certificate on device. Could allow monitoring of data, even SSL/TLS traffic. Recommended to uninstall the apps, unfortunately it was not made clear which ones they are. com CSRF bug pays security tester $25,000 - http://www.theregister.co.uk/2015/10/09/hotmail_hijack_hole_earns_boffin_25k_double_bug_bounty_trouble/ Wesley Wineberg found a Cross-Site Request Forgery flaw in the Microsoft Outlook.com website. Could hijack user sessions. Responsible/Coordinated disclosure allowed flaw to be resolved before publicly disclosed. Medicaid Data Breach, Security Issue at NC and CA Facilities - http://healthitsecurity.com/news/medicaid-data-breach-security-issue-at-nc-and-ca-facilities Spreadsheet sent via email unencrypted. Highlights importance of attention to detail. Sometimes the simplest mistakes create a potential risk. Difficult to prove if data was accessed by unauthorized users. What options could be used instead of emailing the attachment? Thumb drive stolen from employees home Data should be encrypted. Ensure policies exist that cover acceptable use of portal storage. Ensure that employees are trained on the policies. Join the conversation on google+ (https://www.google.com/+Developsec) and Twitter (@DevelopSec) Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Newscast - Sept. 30, 2015 23:52

10 years پیش23:52

23:52

James breaks down a few news stories from the previous week. The following stories were discussed, including some brief points. Microsoft Accidentally pushes test patch http://www.zdnet.com/article/microsoft-accidentally-issued-a-test-windows-update-patch/ Of course the community assumes hack. Oversight that allowed a test patch to be released. They are working to remove it. Credit Card Liability Shift Is here Starting October 1, 2015 if your a vendor and use the magnetic stripe on a chip enabled card, certain fraudulent transactions will fall to you, instead of the bank. This doesn’t change the liability for consumers. James' interview on Channel 4 News in Jacksonville http://www.news4jax.com/news/new-credit-card-technology/35391900 WinRAR exploit – Is it just hype? http://www.theregister.co.uk/2015/09/30/500m_winrar_users_open_to_remote_code_execution_zero_day/ Requires you to execute an exe, which is something we are taught not to do from untrusted sources. Estimates say this effects 500 million users, but let’s be realistic on the risk here. It requires you to execute an executable. Remember not to run attachments or files unless they are from a trusted source and you are expecting the item. Huge iOS 9 Security Flaw (or maybe not?) https://www.yahoo.com/tech/s/huge-ios-9-security-flaw-lets-anyone-see-134547688.html Can bypass the lock screen to see photos and contacts. Uses Siri (so it has to be enabled on the lock screen). Requires physical access to the device. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Newscast - Sept. 23, 2015 15:31

10 years پیش15:31

15:31

James breaks down a few news stories from the previous week. The following stories were discussed, including some brief points. $1 million bounty for iOS 9 hack http://www.wired.com/2015/09/spy-agency-contractor-puts-1m-bounty-iphone-hack/ Zerodium announced 1 million dollar bounty for hack that can take over an iOS device remotely, via web page, vulnerable app or text message Terms of offer demand that bug not be reported to Apple or publicly disclosed Not uncommon for iOS bugs to fetch big money Rare malware outbreak hits some Apple apps http://www.usatoday.com/story/tech/2015/09/21/apple-china-hack-app-store-malware--xcode-ghost/72572190/ Some developers used fake versions of XCode to create applications Designed to steal user passwords Reportedly little danger to US iphone users unless using Chinese social media apps. Important to use software from trusted sources. Comcast to Pay $33 million over Privacy Breach http://www.huffingtonpost.com/entry/comcast-to-pay-over-privacy-breach_55fb30d7e4b0fde8b0cd9fe4 75,000 names, phone numbers and addresses published People paid $1.50 / month more for privacy Each customer will get $100 Some law enforcement, judges and domestic violence abuse victims will get more due to facing increased safety concerns. Follow us on Twitter (@developsec). If you want to be alerted when new items are available you can subscribe on our website at https://www.developsec.com Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 30: HTTP Strict Transport Security (HSTS): Intro 14:41

10 years پیش14:41

14:41

James talks about HTTP Strict Transport Security (HSTS) and what it is for. For more information, check out the corresponding post https://www.developsec.com/2015/09/17/http-strict-transport-security-hsts-overview/ that has links to other references. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 29: FTC Start with Security Guidelines 24:58

10 years پیش24:58

24:58

Just recently, the FTC released "Start with Security: A Guide for Busines" which is a set of 10 items businesses can do to help secure their assetts. The full guide can be found at https://www.ftc.gov/tips-advice/business-center/guidance/start-security-guide-business. James Jardine breaks gives an overview of the 10 items provided in the document. If you are a business, these are some good things to think about when it comes to security. The interesting twist is that it is not highly technical, rather uses real companies as examples for the different items. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 28: What is Penetration Testing 20:45

10 years پیش20:45

20:45

In this episode, James Jardine talks about what penetration testing, "pen testing", is and how it really has a lot of meanings to different people. A pen test isn't something that should be considered negative, rather it is a positive approach to helping identify security risks to your organization. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 27: Importance of Security for BA and PM 15:54

10 years پیش15:54

15:54

In this episode James covers some thoughts on how business analysts and project managers are crucial to the security role for applications. It doesn't take a huge change in the way work is done and the domino affect carries all the way through to QA. Accompanying Blog Post: https://www.developsec.com/2015/06/01/business-analysts-and-product-managers-security-roles/ Follow us on Twitter: @developsec Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 26: The Importance of Security for QA 22:20

10 years پیش22:20

22:20

QA plays a crucial role in testing for security flaws within applications. They have the Proximity, Knowledge of the Application and it is an extension to the role they currently fill. James Jardine discusses why security testing is critical to the QA role. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 25: Static Analysis: Analyzing the Options 17:09

10 years پیش17:09

17:09

Static analysis is an important part of the secure development lifecycle. There are some things to think about when you are considering a static analysis option. James discusses the questions in this episode. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

DevelopSec: Developing Security Awareness

1
Ep. 24: The Importance of Baselines 14:44

10 years پیش14:44

14:44

Understanding baselines of our networks, applications, traffice, etc is important to identifying security issues. James Jardine shares some thoughts on the need for these baselines and why they are important. There is a quick write up on this topic at https://www.developsec.com. Send us a text For more info go to https://www.developsec.com or follow us on X ( @developsec ). The DevelopSec podcast is brought to you by Jardine Software Inc.…

به Player FM خوش آمدید!

Player FM در سراسر وب را برای یافتن پادکست های با کیفیت اسکن می کند تا همین الان لذت ببرید. این بهترین برنامه ی پادکست است که در اندروید، آیفون و وب کار می کند. ثبت نام کنید تا اشتراک های شما در بین دستگاه های مختلف همگام سازی شود.