DevelopSec: Developing Security Awareness
Curious about application security? Want to learn how to detect security vulnerabilities and protect your application. We discuss different topics and provide valuable insights into the world of application security.
Episodes
133 episodes
Newscast - Oct. 20, 2015
Hi and welcome to the DevelopSec newscast for October 20th, 2015. I am James Jardine and I wanted to take a few moments to talk about some recent news stories over the past week.Apple removes several apps that could spy on enc...
Newscast - Sept. 30, 2015
James breaks down a few news stories from the previous week. The following stories were discussed, including some brief points. Microsoft Accidentally pushes test patch
Newscast - Sept. 23, 2015
James breaks down a few news stories from the previous week. The following stories were discussed, including some brief points.$1 million bounty for iOS 9 hack
Ep. 30: HTTP Strict Transport Security (HSTS): Intro
James talks about HTTP Strict Transport Security (HSTS) and what it is for. For more information, check out the corresponding post https://www.developsec.com/2015/09/17/http-strict-transport-security-hsts-overview/ that has links to other...
Ep. 29: FTC Start with Security Guidelines
Just recently, the FTC released "Start with Security: A Guide for Busines" which is a set of 10 items businesses can do to help secure their assetts. The full guide can be found at https://www.ftc.gov/tips-advice/business-center/guidance/...
Ep. 28: What is Penetration Testing
In this episode, James Jardine talks about what penetration testing, "pen testing", is and how it really has a lot of meanings to different people. A pen test isn't something that should be considered negative, rather it is a positive app...
Ep. 27: Importance of Security for BA and PM
In this episode James covers some thoughts on how business analysts and project managers are crucial to the security role for applications. It doesn't take a huge change in the way work is done and the domino affect carries all the way th...
Ep. 26: The Importance of Security for QA
QA plays a crucial role in testing for security flaws within applications. They have the Proximity, Knowledge of the Application and it is an extension to the role they currently fill. James Jardine discusses why security testing is...
Ep. 25: Static Analysis: Analyzing the Options
Static analysis is an important part of the secure development lifecycle. There are some things to think about when you are considering a static analysis option. James discusses the questions in this episode.
Ep. 24: The Importance of Baselines
Understanding baselines of our networks, applications, traffice, etc is important to identifying security issues. James Jardine shares some thoughts on the need for these baselines and why they are important. There is a quick write ...
Ep. 23: 3rd Party CMS Security Thoughts
CMS platforms are an easy way to get content to the internet, but we still have to consider security. James talks about some of the concerns and things to think about when thinking about these security features. For a more details,...
Ep. 22: Black lists vs. White Lists
I came across an interesting tweet https://twitter.com/suffert/status/567486188383379456 depicting a good example of a black list that didn't quite cover everything I think they wanted too. This episode discusses the differen...
Ep. 21: Sensitive Data and Storage
James talks about the need for developers, QA, business analysts and project managers to understand the type of application they are creating and the requirements around sensitive data. Reference Links from the podcast:...
EP. 20: MoonPig Take-aways
I discuss the lessons learned from the recent Moonpig security disclosure. This is full of information for a developer or QA tester. For more information, visit https://www.developsec.com
Ep. 19: Target Environments
Are you looking to test our your security skills? There are lots of targets that are freely available to you that can be quite helpful. The good news is you won't be getting in trouble for hacking these applications. Here is a...
Ep. 18: Planning for an Assessment
No matter what size company you are, sooner or later you will be subject to some form of security assessment. Whether that is a penetration test, architecture review, code review or some other assessment. It is important to be prepa...
Ep. 17: Authorization
Are you sure you are performing proper authorization checks everyplace? What does Authorization even mean? James Jardine talks about Authorization and how QA, Dev and others can reinforce its implementation.
Ep. 16: The Cloud: Is it Safe?
In this episode, James Jardine talks about the recent breaches regarding cloud services and whether or not we should be running for the hills. Lets focus on the real issue, not the hype of nude photos.
Ep. 15: Security Testing - QA can do this!!
In this episode, James talks about security testing... scratch that, testing. There really is no difference between security testing and regular testing. The app is functioning in a way it was not designed to. QA can do this. ...
Ep. 14: Input Validation and Output Encoding
The debate is out there, which is more important. I discuss what they are and how they both play a key role in securing an application.
Ep. 13: Introduction to Cross Site Scripting
This episode gives a high level overview of what XSS is and why it is of concern. Future episodes will dig deeper into the vulnerability.
DS: Ep 12: Ebay hacked. All about Cookies
We discuss a little about eBay and their unfortunate hack, how sourceforge has upgraded their password storage and a lot about cookies. What are cookies, how are they used, how do we secure them. Lots of great information about coo...
Ep. 11: Not your Grandpa's Phishing
In this episode, we talk about phishing. Mass email and spear phishing. What you should know about the topic and how to protect yourself.