DevelopSec: Developing Security Awareness
Curious about application security? Want to learn how to detect security vulnerabilities and protect your application. We discuss different topics and provide valuable insights into the world of application security.
Episodes
133 episodes
Ep. 54: WAFs and Pen Testing
Your pen tester want you to white list them in your WAF? What should you do? Why do they ask? James breaks it down for you in this episode.For more info go to https://www.developsec.com or follow us on twitter (@dev...
Ep. 53: Chrome Changing Secure Notifications
We talk HTTP/HTTPS all the time. Google just announced that in January they are going to change how they display their secure/not secure indicators for HTTP sites that have passwords or credit cards. James talks about how this can e...
Login Forms and HTTPS
Are your login forms secure? Are you sure? In this episode James talks about potential risks with presenting your login forms when using HTTPS and how to avoid them. We often are focused on HTTPS for the submission of credenti...
Ep. 52: Importance of UI to Security
The user interface plays a big part in the security of an application. We often only look at flaws such as XSS, but here James provides an example of the lack of Input Validation messages creating a Denial of Service type situation. ...
Ep. 51: Everything is a target
James discusses how all applications, big or small, are a potential target and need to have secure coding practices. We often only look at our big applications from a security perspective, but in reality, all applications pose a risk.&nbs...
Ep. 50: How Serious is Username Enumeration
In this episode, James talks about what Username Enumeration is, how it can be used by attackers, and some ways to help reduce the risk of it. For more info go to https://www.developsec.com or follow us on twitter (...
Ep. 49: Should Password Change Invalidate Access Tokens?
Interesting question was raised around changing a password and the need to invalidate all the access tokens for the associated mobile devices. James talks about his view on the topic and how you can analyze your situation to determine the...
Ep. 48: Pokemon Go Security Discussions
Pokemon Go has taken the world by storm and as always, it brings up some things to talk about regarding security. In this episode James talks about some out of the box security thoughts regarding mobile applications including app permissi...
Ep. 47: Account Lockouts and auto-unlock
A question came in regarding auto-unlock of accounts and account lockout in general. James discusses his thoughts on this process and how he approaches these types of questions. For more info go to https://www.developse...
Ep. 46: Password Confirm Boxes
A question came in around the need for the password confirm box on registration screens and the security implications. In this episode I respond to the question and give some insights on how to approach these types of questions from a sec...
Ep. 45: The importance of WHY
We are too quick to just give generic recommendations for resolving security vulnerabilities. We need to make sure that the application teams understand why these are vulnerabilities and why they are important. It all starts with Wh...
Ep. 44: "We don't support Macs"
When a developer was presented with a but they tried to say that it wasn't an issue because it was found by a tester using a Mac. "We don't support Macs" James talks about how this is a fundamental misunderstanding about security a...
Ep. 43: Reflecting on Current AppSec Training
James reflects on the current way we expect application teams to get security training and potential short falls. Is there a better way? Listen as I talk through some different points on the topic. For more ...
Ep. 42: The Need for Better Secure Code Examples
How do you get your secure coding information? Do you pull code snippets from the internet? Who doesn't. How many of those actually use secure coding best practices. We have a challenge where most of our books, tutorials...
Ep. 41: Why You Need an Application Inventory
Do you use an application inventory in your application security program? James discusses what an application inventory is and why it is important. Here is a list of a few tools that can be used to help identify some application det...
Ep. 40: Getting More Value from Pen Tests
Penetration tests provide a measuring stick for security, but are you missing out on additional value? James discusses ways to use the pen test results to get more value out of a penetration test. James will be providin...
Ep. 39: Authentication
James discusses what authentication is and some things to look out for. For more info go to https://www.developsec.com or follow us on twitter (@developsec).Presented by Jardine Software Inc. (https:...
Ep. 38: Static Analysis: Tips for Successful Program
In this episode, James Jardine talks about some of the things you need to consider when trying to implement a static analysis program. It is more than just a tool you drop in. To build a successful program there are other considerations.<...
Ep. 37: CSRF Chaining
James Jardine discusses CSRF chaining, using the combination of multiple CSRF requests to perform a task. Typically we believe that CSRF can only be done with one request, but with a little javascript it is possible to execute multiple requests...
Ep. 36: Intro to Cross Site Request Forgery (CSRF)
In this episode, James talks about what CSRF is, why it is a risk, and different ways to protect against it. CSRF is #8 on the OWASP Top 10 htt...
Ep. 35: An Introduction to Open Redirects
James discusses Open Redirects, or on the OWASP Top 10 what is referred to as Unvalidated Redirects and Forwards (https://www.owasp.org/index.php/Top_...
Ep. 34: Importance of Hacking
James discusses Hacking, what is it, why is it important. It is more than what you see in the media of the bad guys hacking computers. It is a curiosity, a hobby, an interesting in pushing limits. Some amazing things have come...
Ep. 33: Holiday Gift Security Considerations
James discussing some things to consider this holiday season when searching for that perfect gift. It is important to understand the privacy policy (what is collected and how it is used) as well as the technologies the gift uses (Bluetoot...
Ep. 32: Dynamic Analysis: An Overview
James Jardine provides an overview of Dynamic Analysis and why it is important. Like any automation, there are pros and cons. Listen to find out why dynamic analysis is useful. Some links to some dynamic an...
Ep. 31: Response Splitting and Header Injection
Join James Jardine as he discusses what Response Splitting/Header Injection is and how it works. He also discusses how ASP.Net helps defend against this attack. This is a quick overview of the vulnerability and a great startin...