DevelopSec: Developing Security Awareness
Curious about application security? Want to learn how to detect security vulnerabilities and protect your application. We discuss different topics and provide valuable insights into the world of application security.
Episodes
133 episodes
Ep. 104: Securing Devops with Julien Vehent
James sits down with Julien Vehent to discuss his new book "Securing DevOps" and talk about security in a devOps world. Julien (@jvehent) is a security architect and engineering manager with over 15 years of experience in large orga...
Ep. 103: Is 3rd Party Authentication Right For Your Application?
The headlines are filled with credential breaches. One way to avoid being those headlines is to not store credentials. Instead, use a 3rd party to authenticate your users. While this cuts a lot of work out of your development time, it is ...
Ep. 102: Intro to Web Security Policies
In this episode James introduces us to the idea of web security policies stored in a security.txt file. We have talked about vulnerability disclosure before and this ties directly into that conversation.Link to Draft:
Ep. 101: You're not always right and that is ok
In this episode, James shares a story of learning from a mistake and how we can't be right every time. Hear what he learned and how you can learn too. For more info go to https://www.developsec.c...
Ep. 100: Choosing Security Tools
In this episode we talk about choosing the right security tools for your environment. There are lots of vendors offering solutions to help identify security issues within our applications. The trick is to learn to identify which ones make the m...
Ep. 99: Shifting Left in the SDLC
In this episode, James talks about what it means to shift left in the SDLC. For more info go to https://www.developsec.com or follow us on twitter (@developsec). Join the co...
Ep. 98: Efail and News Hype
In this episode we talk about efail and the HYPE around security news. For more info go to https://www.developsec.com or follow us on twitter (@developsec).&nb...
EP. 97: Gmail / Netflix Potential Scam
** Check out our new Live Fundamentals of Application Security training starting on May 1, 2018. Don't wait to sign up. For schedules and information check out http...
Ep. 96: Security Flaws as Defects
In this episode we talk about treating security flaws as defects and embedded vs. built-in security. Do you treat security flaws differently? What barriers does that create? For more info go to
Ep. 95: MyFitnessPal Breach Take-Aways
In this episode we talk about the MyFitnessPal breach and some of the key points that we as developers, security, and users can take away from it. Tweet with Graph of Largest Breaches mentioned:
Ep. 94: Penetration Testing
In this episode we talk about penetration testing and what you need to know to get the most out of the activity. Tune in to hear some of our thoughts on the topic. To take the training course survey go to
Ep. 93: Code Review
In this episode we talk about secure code review with a mention of static analysis. Do you know the difference? What is the issue of doing one over the other, or just outright replacing actual code review with static analysis? Tune in to hear s...
Ep. 92: 2-Factor Authentication
In this episode James talks about 2-factor authentication, why we use it, and maybe why we don't. Is your 2-factor implementation getting in your way? The DevelopSec YouTube Channel -
DevelopSec Podcast #91 - OWASP Top 10 2017 Thoughts
The new OWASP Top 10 2017 is out. We look at some of the changes and how you can effectively use the list to better your security program. We are also launching a new DevelopSec Live broadcast. To check out the first episode,...
Ep. 90: 5 Steps to Help Secure Your Database
James sits down with Perry Krug, from Couchbase to discuss some important steps to take to secure your database. Perry Krug - https://twitter.com/perrykrug&...
Ep. 89: New Year's Resolutions
Welcome to 2018! Another year down and time for many of us to start making promises to ourselves of things we will start doing in this new year. In this episode James talks about some lessons we should take from 2017 and ways to use them ...
Ep. 88: Meteor Security with Tim Medin
In this episode, James talks with Tim Medin regarding Meteor and security. If you develop with Meteor or have to test it, there is a lot of information packed in.More about Tim Medin (@timmedin):Red Seige website -
Ep. 87: Apple Sign-in Bug Take-Aways
You have heard about the Apple Sign-in Bug on High Sierra. Now lets talk about how we can use this example to better our current development processes to protect ourselves.Link to mentioned article:
Ep. 86: Vulnerable 3rd Party Components
In this episode, James talks the use of 3rd party components and how to handle determining if they are vulnerable or not.Links: OWASP Dependancy Check - https://www.owasp.org/index.php/OWASP_Dependency_Check GitHub Blog...
Ep. 85: Open Redirect Revisited
In this episode, James talks about open redirect and why it matters from a security perspective. He also shows how this information can be used in your personal technology use, not just in development. For more info...
Ep. 84: Understanding the Technology
You know your development language and platform, but do you really know the ins and outs of web application technology? How well do you know HTTP, HTML, etc? James talks about a few scenarios where really understanding how the technologies work...
Ep. 83: Authorization Overview
In this episode, James talks about authorization and some common areas where it poses a risk. He also goes over some techniques to help test authorization. For more info go to
Ep. 82: Equifax Take-aways
The Equifax breach was a major news story. James talks about some of the security controls mentioned and how to start a conversation within your organization about them. Want to listen on YouTube? Check out our channel where w...
Ep. 81: JavaScript in HREF and SRC (XSS)
We talk about cross-site scripting (XSS) all the time, but often overlook the ability to use javascript: in anchor tags. James talks about this unique ability and how to protect your applications from it. The related blog post...
Ep. 80: Understanding Security of Your Platforms
We use a lot of platforms and frameworks when we develop an application. These platforms may provide security features, but do you know which ones? James talks about the importance of understanding your platforms and what to consider.