DevelopSec: Developing Security Awareness
Curious about application security? Want to learn how to detect security vulnerabilities and protect your application. We discuss different topics and provide valuable insights into the world of application security.
Episodes
133 episodes
Ep. 79: Marketing with USB Drives
James talks about the risk of USB thumb drives and their risk using the recent BCBS marketing campaign as an example. (
Ep. 78: MySpace Lessons - Looking At Account Recovery
James talks about a recent vulnerability report regarding MySpace's Account Recovery system (https://www.wired.com/story/myspace-security-account-takeover/). He ...
Ep. 77: Interactive Application Security Testing
In this episode, James talks about Interactive Application Security Testing, or IAST. It is a sort of hybrid approach that is similar to both dynamic and static analysis. Listen in to learn more about it.The video version of this can be ...
Ep. 76: Validation - Client vs. Server
Are you thinking about client vs. server-side input validation? Curious why each is important and when to use them? James talks about the basic concepts and how to apply them to create more secure applications.A video version...
Ep. 75: IAM with Geurt van Wijk
In this episode I sit down with Geurt van Wijk from IDdriven to discuss IAM and IDaaS. Geurt has many years of experience around Identity and shares some great insights into considerations when working wit...
Ep. 74: Audio Driver Key Logger Lessons Learned
It was recently reported that an audio driver on HP systems was logging key strokes to a local file. Accidental? Malicious? Instead, we talk about how to try and avoid this from happening in the future. Original A...
Ep. 73: Identity with Vittorio Bertocci
I sat down with Vittorio Bertocci from Microsoft at the Microsoft Build 2017 conference in Seattle Washington. Vittorio shared some great insights into Identity and some new things around Azure AD and Azure AD B2C. Listen in to lear...
Ep. 72: Where to Perform Output Encoding
Over the years I have had many people ask about encoding before storing data in the database. Here are my thoughts and recommendations.For more info go to https://www.developsec.co...
Ep. 71: Sub Resource Integrity
Do you use hosted content on a CDN? How do you know the file hasn't been modified? James describes Sub Resource Integrity and how it is used to help detect and prevent loading modified files. For details referenced in the show about...
Ep. 70: Considering security when selecting an application platform
Do you struggle with trying to pick the most secure application platform? Are you focusing on the right questions? James talks about ways to look at application platforms and be secure, no matter which one you choose.For more info go...
Ep. 69: Concurrent User Sessions
Do you allow users to login into their accounts across multiple browsers or devices? Does this raise a security concern? James talks about how to handle this question and analyze the root issue.For more info go to
Ep. 68: How the AWS disruption can help us
I am sure you have heard about the AWS service disruption that occurred. Have you seen how we can learn from this when we look at our own tools and processes? James talks about how...
Ep. 67: Clearing up HTTPOnly and Secure Cookie Attributes
I hear a lot of people struggling with HTTPOnly and Secure attributes on cookies. The names may be confusing to some. Change your viewpoint and it may become easier..For more info go to ...
Ep. 66: Forgot Username
We always talk about Forgot Password... But what about Forgot Username? Listen in as James discusses why protecting this functionality is important and the ways it could be abused if not properly handled.For more info go to
Ep. 65: Security Questions: Good or Bad?
In this episode, James talks about security questions, or secret questions. We see them used in many different places. People complain they are horrible. So are they that bad that you shouldn't use them? Is it possible to help reduce the ...
Ep. 64: Using Stolen Passwords to Protect User Accounts
A few months ago, it was announced that some companies buy stolen passwords off of the black market to help protect their users. This is done by determining if the user's password was part of that list and forcing a reset. James tal...
Ep. 63: Remember Me Feature: Security Considerations
Are you, or have you, implemented a remember me feature for your application? What do you remember, username, password, or both? James talks about some security considerations around implementing a remember me feature for your appli...
Ep. 62: MongoDB Ransomware Attacks
Do you use MongoDB? If so, is it exposed to the internet? Recent news (listed below) had shown that a large number of MongoDB instances are being infected with ransomware. James talks about the issue and ways to help ensure yo...
Ep. 61: Multi-factor Authentication
Implementing multi-factor authentication isn't just about a second factor. There are many considerations that need to be included. One in particular, how do you handle the user losing their means of that second factor. James t...
Ep. 60: Yahoo Breach Takeaways
Yahoo has announced yet another breach from back in 2013 affecting a very large number of user accounts. https://investor.yahoo.net/ReleaseDetail.cfm?&ReleaseID=1...
Ep. 59: All About Cookie Protection
It is the holiday season. It is appropriate to talk about cookies. Not the kind that you bake, but the ones in your applications. James talks about the security mechanisms for cookies and clarifies what they are for. ...
Ep. 58: "Untrusted" Data
Have you heard someone mention "untrusted" data? Applications take data from multiple data sources and we are often confused on what should be trusted or not. In this episode, James Jardine talks about untrusted data and some though...
Ep. 57: Source Code Review
Are you an organization looking to do source code review? Are you trying to hire a pen tester with source code review as a duty? James talks about Secure Code Review and some common implementations. For more ...
Ep. 56: Security Contacts
Do you have a clear path for users to contact you about potential security issues in your application or device? Is there a potential for the communication to be lost in the mix? James talks about how it is important for users to ha...
Ep. 55: Scoping an application security assessment (Applications)
Having a penetration test performed against your applications? Do you have mobile and web applications performing the same functionality? James talks about the reason behind doing these assessments at the same time vs. separate.&nbs...