All Podcasts are hosted on http://developsec.libsyn.com. Podcasts are also available on iTunes


Ep. 86: Vulnerable 3rd Party Components

In this episode, James talks the use of 3rd party components and how to handle determining if they are vulnerable or not.

Links:
OWASP Dependancy Check - https://www.owasp.org/index.php/OWASP_Dependency_Check
GitHub Blog - https://github.com/blog/2470-introducing-security-alerts-on-github
RetireJS - https://retirejs.github.io/retire.js/


For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Join the conversations.. join our slack channel.  Email james@developsec.com for an invitation.

DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.


Ep. 85: Open Redirect Revisited

In this episode, James talks about open redirect and why it matters from a security perspective. He also shows how this information can be used in your personal technology use, not just in development.

 

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

 

Join the conversations.. join our slack channel.  Email james@developsec.com for an invitation.

 

DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.


Ep. 84: Understanding the Technology

You know your development language and platform, but do you really know the ins and outs of web application technology? How well do you know HTTP, HTML, etc? James talks about a few scenarios where really understanding how the technologies works helps better understand vulnerability risks.

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

 

Join the conversations.. join our slack channel.  Email james@developsec.com for an invitation.

 

DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.


Ep. 83: Authorization Overview

In this episode, James talks about authorization and some common areas where it poses a risk. He also goes over some techniques to help test authorization.

 

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

 

Join the conversations.. join our slack channel.  Email james@developsec.com for an invitation.

 

DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.


Ep. 82: Equifax Take-aways

The Equifax breach was a major news story. James talks about some of the security controls mentioned and how to start a conversation within your organization about them. 

Want to listen on YouTube?  Check out our channel where we are releasing episodes starting from episode 1 at https://www.youtube.com/channel/UCdAqgfdGs0-hPa8FhsODwNw

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Join the conversations.. join our slack channel.  Email james@developsec.com for an invitation.

DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.


Ep. 81: JavaScript in HREF and SRC (XSS)

We talk about cross-site scripting (XSS) all the time, but often overlook the ability to use javascript: in anchor tags.  James talks about this unique ability and how to protect your applications from it. 

The related blog post for this can be found at https://www.developsec.com/2017/09/06/javascript-in-an-href-or-src-attribute/

Want to listen on YouTube?  Check out our channel where we are releasing episodes starting from episode 1 at https://www.youtube.com/channel/UCdAqgfdGs0-hPa8FhsODwNw

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Join the conversations.. join our slack channel.  Email james@developsec.com for an invitation.

DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.


Ep. 80: Understanding Security of Your Platforms

We use a lot of platforms and frameworks when we develop an application. These platforms may provide security features, but do you know which ones? James talks about the importance of understanding your platforms and what to consider.

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Join the conversations.. join our slack channel.  Email james@developsec.com for an invitation.

DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.

 


Ep. 79: Marketing with USB Drives

James talks about the risk of USB thumb drives and their risk using the recent BCBS marketing campaign as an example. (http://www.fiercehealthcare.com/privacy-security/bcbs-alabama-re-evaluates-usb-marketing-campaign-amid-security-concerns).  

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Join the conversations.. join our slack channel.  Email james@developsec.com for an invitation.

DevelopSec provides application security consulting and training to add value to your application security program. Contact ustoday to see how we can help.

 


Ep. 78: MySpace Lessons - Looking At Account Recovery

James talks about a recent vulnerability report regarding MySpace's Account Recovery system (https://www.wired.com/story/myspace-security-account-takeover/).  He talks about considerations around account recovery and the need to revisit this type of functionality on a regular basis.

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Join the conversations.. join our slack channel.  Email james@developsec.com for an invitation.

DevelopSec provides application security consulting and training to add value to your application security program. Contact ustoday to see how we can help.


Ep. 77: Interactive Application Security Testing

In this episode, James talks about Interactive Application Security Testing, or IAST. It is a sort of hybrid approach that is similar to both dynamic and static analysis. Listen in to learn more about it.

The video version of this can be found at https://youtu.be/KHSlDletm9I

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Join the conversations.. join our slack channel.  Email james@developsec.com for an invitation.

DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.


Ep. 76: Validation - Client vs. Server

Are you thinking about client vs. server-side input validation?  Curious why each is important and when to use them?  James talks about the basic concepts and how to apply them to create more secure applications.

A video version of this podcast is now available at: https://youtu.be/irO1TOC6-i8

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Join the conversations.. join our slack channel.  Email james@developsec.com for an invitation.

DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.


Ep. 75: IAM with Geurt van Wijk

In this episode I sit down with Geurt van Wijk from IDdriven to discuss IAM and IDaaS. Geurt has many years of experience around Identity and shares some great insights into considerations when working with it. If you typically think of Identity as just a user with credentials and some typical roles, you will want to listen in.

You can get more information about IDdrive from https://www.iddriven.com

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Join the conversations.. join our slack channel.  Email james@developsec.com for an invitation.

DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.


Ep. 74: Audio Driver Key Logger Lessons Learned

It was recently reported that an audio driver on HP systems was logging key strokes to a local file.  Accidental?  Malicious?  Instead, we talk about how to try and avoid this from happening in the future.  

Original Article: https://www.cnet.com/news/keylogger-discovered-on-some-hp-laptops-conexant/

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Join the conversations.. join our slack channel.  Email james@jardinesoftware for an invitation.

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact ustoday to see how we can help.  Check out our 30 day advantage.


Ep. 73: Identity with Vittorio Bertocci

I sat down with Vittorio Bertocci from Microsoft at the Microsoft Build 2017 conference in Seattle Washington.  Vittorio shared some great insights into Identity and some new things around Azure AD and Azure AD B2C.  Listen in to learn more about some of the interesting things going on.  

You can watch Vittorio's presentation from build at: https://channel9.msdn.com/Events/Build/2017/B8084

To get more information from Vittorio, you can follow him on twitter at @vibronet or check out his website at www.cloudidentity.com

Also, check out this announcement about new authentication SDKs: https://azure.microsoft.com/en-us/blog/start-writing-applications-today-with-the-new-microsoft-authentication-sdks/

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Join the conversations.. join our slack channel.  Email james@jardinesoftware for an invitation.

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact ustoday to see how we can help.  Check out our 30 day advantage.


Ep. 72: Where to Perform Output Encoding

Over the years I have had many people ask about encoding before storing data in the database.  Here are my thoughts and recommendations.

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Join the conversations.. join our slack channel.  Email james@jardinesoftware for an invitation.

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.  Check out our 30 day advantage.


Ep. 71: Sub Resource Integrity

Do you use hosted content on a CDN? How do you know the file hasn't been modified?  James describes Sub Resource Integrity and how it is used to help detect and prevent loading modified files.  For details referenced in the show about commands and examples, check out our post at https://www.developsec.com/2017/04/16/sub-resource-integrity-sri/

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Join the conversations.. join our slack channel.  Email james@jardinesoftware for an invitation.

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.  Check out our 30 day advantage.


Ep. 70: Considering security when selecting an application platform

Do you struggle with trying to pick the most secure application platform? Are you focusing on the right questions? James talks about ways to look at application platforms and be secure, no matter which one you choose.

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Join the conversations.. join our slack channel.  Email james@jardinesoftware for an invitation.

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.  Check out our 30 day advantage.


Ep. 69: Concurrent User Sessions

Do you allow users to login into their accounts across multiple browsers or devices? Does this raise a security concern? James talks about how to handle this question and analyze the root issue.

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.  Check out our 30 day advantage.


Ep. 68: How the AWS disruption can help us

I am sure you have heard about the AWS service disruption that occurred.  Have you seen how we can learn from this when we look at our own tools and processes?  James talks about how we need to look at our own applications and tools and consider how time has changed the landscape.  There might be more than you think.

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.  Check out our 30 day advantage.


Ep. 67: Clearing up HTTPOnly and Secure Cookie Attributes

I hear a lot of people struggling with HTTPOnly and Secure attributes on cookies. The names may be confusing to some. Change your viewpoint and it may become easier..

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.  Check out our 30 day advantage.

 


Ep. 66: Forgot Username

We always talk about Forgot Password... But what about Forgot Username? Listen in as James discusses why protecting this functionality is important and the ways it could be abused if not properly handled.

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.  Check out our 30 day advantage.


Security Questions: Good or Bad?

In this episode, James talks about security questions, or secret questions. We see them used in many different places. People complain they are horrible. So are they that bad that you shouldn't use them?  Is it possible to help reduce the risk with security questions?

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.  Check out our 30 day advantage.


Ep. 64: Using Stolen Passwords to Protect User Accounts

A few months ago, it was announced that some companies buy stolen passwords off of the black market to help protect their users.  This is done by determining if the user's password was part of that list and forcing a reset.  James talks about the idea and raises some interesting questions.  What do you think about the tactic?

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.  Check out our 30 day advantage.


Ep. 63: Remember Me Feature: Security Considerations

Are you, or have you, implemented a remember me feature for your application?  What do you remember, username, password, or both?  James talks about some security considerations around implementing a remember me feature for your application.

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.  Check out our 30 day advantage.


Ep. 62: MongoDB Ransomware Attacks

Do you use MongoDB?  If so, is it exposed to the internet?  Recent news (listed below) had shown that a large number of MongoDB instances are being infected with ransomware.  James talks about the issue and ways to help ensure you are not the next victim.

Link to original article: http://arstechnica.com/security/2017/01/more-than-10000-online-databases-taken-hostage-by-ransomware-attackers/

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.  Check out our 30 day advantage.

 


Ep. 61: Multi-factor Authentication

Implementing multi-factor authentication isn't just about a second factor.  There are many considerations that need to be included.  One in particular, how do you handle the user losing their means of that second factor.  James talks about thinking this through.

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.  Check out our 30 day advantage.


Ep. 60: Yahoo Breach Takeaways

Yahoo has announced yet another breach from back in 2013 affecting a very large number of user accounts. https://investor.yahoo.net/ReleaseDetail.cfm?&ReleaseID=1004285   This creates an opportunity to discuss password storage and the storage of security answers.  Find out what we can takeaway from this incident.

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.  Check out our 30 day advantage.


Ep. 59: All About Cookie Protection

It is the holiday season.  It is appropriate to talk about cookies.  Not the kind that you bake, but the ones in your applications.  James talks about the security mechanisms for cookies and clarifies what they are for. 

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.  Check out our 30 day advantage.


Ep. 58: "Untrusted" Data

Have you heard someone mention "untrusted" data?  Applications take data from multiple data sources and we are often confused on what should be trusted or not.  In this episode, James Jardine talks about untrusted data and some thoughts for moving past it.  

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.  Check out our 30 day advantage.


Ep. 57: Source Code Review

Are you an organization looking to do source code review?  Are you trying to hire a pen tester with source code review as a duty?  

James talks about Secure Code Review and some common implementations.  

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.  Check out our 30 day advantage.


Ep. 56: Security Contacts

Do you have a clear path for users to contact you about potential security issues in your application or device?  Is there a potential for the communication to be lost in the mix?  James talks about how it is important for users to have a clear path to communication when it comes to reporting security issues. 

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.  Check out our 30 day advantage.


Ep. 55: Scoping an application security assessment (Applications)

Having a penetration test performed against your applications?  Do you have mobile and web applications performing the same functionality?  James talks about the reason behind doing these assessments at the same time vs. separate.  See why testing your entire offering can add benefit to your security assessment. 

Link to DerbyCon Presentation

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.  Check out our 30 day advantage.

 


Ep. 54: WAFs and Pen Testing

Your pen tester want you to white list them in your WAF?  What should you do?  Why do they ask?  James breaks it down for you in this episode.

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.  Check out our 30 day advantage.


Ep. 53: Chrome Changing Secure Notifications

We talk HTTP/HTTPS all the time.  Google just announced that in January they are going to change how they display their secure/not secure indicators for HTTP sites that have passwords or credit cards.  James talks about how this can effect you.

Link to the article: https://security.googleblog.com/2016/09/moving-towards-more-secure-web.html

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.  Check out our 30 day advantage.

 


Login Forms and HTTPS

Are your login forms secure?  Are you sure?  In this episode James talks about potential risks with presenting your login forms when using HTTPS and how to avoid them.  We often are focused on HTTPS for the submission of credentials, but what about the loading of the form?  What about frames?

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.  Check out our 30 day advantage.


Ep. 52: Importance of UI to Security

The user interface plays a big part in the security of an application.  We often only look at flaws such as XSS, but here James provides an example of the lack of Input Validation messages creating a Denial of Service type situation. 

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.  Check out our 30 day advantage.


Ep. 51: Everything is a target

James discusses how all applications, big or small, are a potential target and need to have secure coding practices.  We often only look at our big applications from a security perspective, but in reality, all applications pose a risk. 

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.  Check out our 30 day advantage.


Ep. 50: How Serious is Username Enumeration

In this episode, James talks about what Username Enumeration is, how it can be used by attackers, and some ways to help reduce the risk of it. 

 

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.  Check out our 30 day advantage.


Ep. 49: Should Password Change Invalidate Access Tokens?

Interesting question was raised around changing a password and the need to invalidate all the access tokens for the associated mobile devices.  James talks about his view on the topic and how you can analyze your situation to determine the appropriate direction. 

 

 

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.  Check out our 30 day advantage.


Ep. 48: Pokemon Go Security Discussions

Pokemon Go has taken the world by storm and as always, it brings up some things to talk about regarding security.  In this episode James talks about some out of the box security thoughts regarding mobile applications including app permissions, fake apps, and scams. 

 

**Link to James' interview on News4Jax talking about Pokemon Go Security Concerns http://www.news4jax.com/news/morning-show/pokemon-go-security-concerns **

 

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.  Check out our 30 day advantage.


Ep. 47: Account Lockouts and auto-unlock

A question came in regarding auto-unlock of accounts and account lockout in general.  James discusses his thoughts on this process and how he approaches these types of questions.

 

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.  Check out our 30 day advantage.


Ep. 46: Password Confirm Boxes

A question came in around the need for the password confirm box on registration screens and the security implications.  In this episode I respond to the question and give some insights on how to approach these types of questions from a security perspective.

 

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.  Check out our 30 day advantage.


Ep. 45: The importance of WHY

We are too quick to just give generic recommendations for resolving security vulnerabilities.  We need to make sure that the application teams understand why these are vulnerabilities and why they are important.  It all starts with Why is that functionality there.  James talks about the importance of understanding the WHY and how it is a building block for better secure applications.

 

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.  Check out our 30 day advantage.


Ep. 44: "We don't support Macs"

When a developer was presented with a but they tried to say that it wasn't an issue because it was found by a tester using a Mac.  "We don't support Macs"   James talks about how this is a fundamental misunderstanding about security and tries to clear it up. 

 

 

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.  Check out our 30 day advantage.


Ep. 43: Reflecting on Current AppSec Training

James reflects on the current way we expect application teams to get security training and potential short falls.  Is there a better way?  Listen as I talk through some different points on the topic. 

 

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.  Check out our 30 day advantage.


Ep. 42: The Need for Better Secure Code Examples

How do you get your secure coding information?  Do you pull code snippets from the internet?  Who doesn't.  How many of those actually use secure coding best practices.  We have a challenge where most of our books, tutorials, and even college classes don't show secure code examples, just code examples.  Everywhere we turn, the code we see is insecure.  James Talks about this issue and some things you can do to help change that. 

 

In the episode, James makes reference to the IT Hot Topics Conference (https://www.eiseverywhere.com/ehome/index.php?eventid=155122&).  James will be presenting on Friday morning.  If you are in the area, this may be a great conference to check out.  See the link included for registration info.

 

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.  Check out our 30 day advantage.


Ep. 41: Why You Need an Application Inventory

Do you use an application inventory in your application security program?  James discusses what an application inventory is and why it is important.  Here is a list of a few tools that can be used to help identify some application details:

 

 

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.  Check out our 30 day advantage.


Ep. 40: Getting More Value from Pen Tests

Penetration tests provide a measuring stick for security, but are you missing out on additional value?  James discusses ways to use the pen test results to get more value out of a penetration test.

 

James will be providing a free webcast regarding Penetration Testing for Application Teams on March 18th, 2016.  Here is the registration link: https://attendee.gototraining.com/r/3147075330537789954

 

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.


Ep. 39: Authentication

James discusses what authentication is and some things to look out for. 

 

 

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.


Static Analysis: Tips for Successful Program

In this episode, James Jardine talks about some of the things you need to consider when trying to implement a static analysis program. It is more than just a tool you drop in.  To build a successful program there are other considerations.

 

For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)

Jardine Software provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.


Ep. 37: CSRF Chaining

James Jardine discusses CSRF chaining, using the combination of multiple CSRF requests to perform a task. Typically we believe that CSRF can only be done with one request, but with a little javascript it is possible to execute multiple requests.  Listen in for more information.

 


For more info go to https://www.developsec.com or follow us on twitter (@developsec).

Presented by Jardine Software Inc. (https://www.jardinesoftware.com)


Ep. 36: Intro to Cross Site Request Forgery (CSRF)

In this episode, James talks about what CSRF is, why it is a risk, and different ways to protect against it.  CSRF is #8 on the OWASP Top 10 https://www.owasp.org/index.php/Top_10_2013-A8-Cross-Site_Request_Forgery_%28CSRF%29

 

Want to learn more about application security?  Check out https://www.developsec.com.  Follow us at @developsec on twitter.


Ep. 35: An Introduction to Open Redirects

James discusses Open Redirects, or on the OWASP Top 10 what is referred to as Unvalidated Redirects and Forwards (https://www.owasp.org/index.php/Top_10_2013-A10-Unvalidated_Redirects_and_Forwards)  This is an introduction to what an Open Redirect is, why it is an issue, how to protect against it and how to test for it. 


Ep. 34: Importance of Hacking

James discusses Hacking, what is it, why is it important.  It is more than what you see in the media of the bad guys hacking computers.  It is a curiosity, a hobby, an interesting in pushing limits.  Some amazing things have come out of hacking.  Check out this episode for more ramblings.


Ep. 33: Holiday Gift Security Considerations

James discussing some things to consider this holiday season when searching for that perfect gift.  It is important to understand the privacy policy (what is collected and how it is used) as well as the technologies the gift uses (Bluetooth, wifi, etc).  This discussion addresses both consumers and the companies that create these gifts.

For more info go to https://www.developsec.com or follow us on twitter (@developsec).


Ep. 32: Dynamic Analysis: An Overview

James Jardine provides an overview of Dynamic Analysis and why it is important.  Like any automation, there are pros and cons.   Listen to find out why dynamic analysis is useful. 

 

Some links to some dynamic analysis options that are available:

WhiteHat Security (http://www.whitehatsec.com)

HP - Web Inspect (http://www8.hp.com/us/en/software-solutions/webinspect-dynamic-analysis-dast/)

IBM App Scan (http://www-03.ibm.com/software/products/en/appscan)

Veracode (http://www.veracode.com)

Acunetix (https://www.acunetix.com/)


Ep. 31: Response Splitting and Header Injection

Join James Jardine as he discusses what Response Splitting/Header Injection is and how it works.  He also discusses how ASP.Net helps defend against this attack. 

This is a quick overview of the vulnerability and a great starting point for anyone learning security concepts.


Newscast - Oct. 20, 2015

Hi and welcome to the DevelopSec newscast for October 20th, 2015.  I am James Jardine and I wanted to take a few moments to talk about some recent news stories over the past week.

 

  • Apps installed a root certificate on device.
  • Could allow monitoring of data, even SSL/TLS traffic.
  • Recommended to uninstall the apps, unfortunately it was not made clear which ones they are.
  • com CSRF bug pays security tester $25,000 - http://www.theregister.co.uk/2015/10/09/hotmail_hijack_hole_earns_boffin_25k_double_bug_bounty_trouble/
    • Wesley Wineberg found a Cross-Site Request Forgery flaw in the Microsoft Outlook.com website.
    • Could hijack user sessions.
    • Responsible/Coordinated disclosure allowed flaw to be resolved before publicly disclosed.
  • Medicaid Data Breach, Security Issue at NC and CA Facilities - http://healthitsecurity.com/news/medicaid-data-breach-security-issue-at-nc-and-ca-facilities
    • Spreadsheet sent via email unencrypted.
      • Highlights importance of attention to detail. Sometimes the simplest mistakes create a potential risk.
      • Difficult to prove if data was accessed by unauthorized users.
      • What options could be used instead of emailing the attachment?
    • Thumb drive stolen from employees home
      • Data should be encrypted.
      • Ensure policies exist that cover acceptable use of portal storage.
      • Ensure that employees are trained on the policies.

 

Join the conversation on google+ (https://www.google.com/+Developsec) and Twitter (@DevelopSec)


Newscast - Sept. 30, 2015

James breaks down a few news stories from the previous week.  The following stories were discussed, including some brief points.

 


Newscast - Sept. 23, 2015

James breaks down a few news stories from the previous week.  The following stories were discussed, including some brief points.

Follow us on Twitter (@developsec).  If you want to be alerted when new items are available you can subscribe on our website at https://www.developsec.com


Ep. 30: HTTP Strict Transport Security (HSTS): Intro

James talks about HTTP Strict Transport Security (HSTS) and what it is for.  For more information, check out the corresponding post https://www.developsec.com/2015/09/17/http-strict-transport-security-hsts-overview/ that has links to other references.


Ep. 29: FTC Start with Security Guidelines

Just recently, the FTC released "Start with Security: A Guide for Busines" which is a set of 10 items businesses can do to help secure their assetts.  The full guide can be found at https://www.ftc.gov/tips-advice/business-center/guidance/start-security-guide-business. 

 

James Jardine breaks gives an overview of the 10 items provided in the document. If you are a business, these are some good things to think about when it comes to security.  The interesting twist is that it is not highly technical, rather uses real companies as examples for the different items.


Ep. 28: What is Penetration Testing

In this episode, James Jardine talks about what penetration testing, "pen testing", is and how it really has a lot of meanings to different people.  A pen test isn't something that should be considered negative, rather it is a positive approach to helping identify security risks to your organization. 


Ep. 27: Importance of Security for BA and PM

In this episode James covers some thoughts on how business analysts and project managers are crucial to the security role for applications.  It doesn't take a huge change in the way work is done and the domino affect carries all the way through to QA. 

Accompanying Blog Post: https://www.developsec.com/2015/06/01/business-analysts-and-product-managers-security-roles/

 

Follow us on Twitter: @developsec


Ep. 26: The Importance of Security for QA

QA plays a crucial role in testing for security flaws within applications.  They have the Proximity, Knowledge of the Application and it is an extension to the role they currently fill.  James Jardine discusses why security testing is critical to the QA role. 


Ep. 25: Static Analysis: Analyzing the Options

Static analysis is an important part of the secure development lifecycle.  There are some things to think about when you are considering a static analysis option.  James discusses the questions in this episode.


Ep. 24: The Importance of Baselines

Understanding baselines of our networks, applications, traffice, etc is important to identifying security issues.  James Jardine shares some thoughts on the need for these baselines and why they are important.  There is a quick write up on this topic at https://www.developsec.com.


Ep. 23: 3rd Party CMS Security Thoughts

CMS platforms are an easy way to get content to the internet, but we still have to consider security.   James talks about some of the concerns and things to think about when thinking about these security features.  For a more details, check out the blog post at https://www.developsec.com.


Ep. 22: Black lists vs. White Lists

I came across an interesting tweet https://twitter.com/suffert/status/567486188383379456  depicting a good example of a black list that didn't quite cover everything I think they wanted too.    This episode discusses the difference between black and white lists and some of the things to watch out for.


Sensitive Data and Storage

James talks about the need for developers, QA, business analysts and project managers to understand the type of application they are creating and the requirements around sensitive data. 

 

Reference Links from the podcast:

http://www.njleg.state.nj.us/2014/Bills/S1000/562_R1.PDF

http://laws.flrules.org/2014/189


EP. 20: MoonPig Take-aways

I discuss the lessons learned from the recent Moonpig security disclosure.  This is full of information for a developer or QA tester.   For more information, visit https://www.developsec.com


Ep. 19: Target Environments

Are you looking to test our your security skills?  There are lots of targets that are freely available to you that can be quite helpful.  The good news is you won't be getting in trouble for hacking these applications.  Here is a short list of some of the targets that exist for you to practice your web hacking skills.

Vulnerable Apps:

hackazon - http://www.ntobjectives.com/hackazon/

bWAPP - http://sourceforge.net/projects/bwapp/files/bee-box/

webgoat - https://www.owasp.org/index.php/Category:OWASP_WebGoat_Project

DVWA - http://sourceforge.net/projects/dvwa/

Mutillidae - http://sourceforge.net/projects/mutillidae/


Ep. 18: Planning for an Assessment

No matter what size company you are, sooner or later you will be subject to some form of security assessment.  Whether that is a penetration test, architecture review, code review or some other assessment.  It is important to be prepared.  Have the documentation needed when the engagement starts.  Most importantly, be honest to any questions and don't try and hide things.  The point is to get an accurate view of the security landscape to better help the company's risk position.  James talks about all this and more in this episode.


Ep. 17: Authorization

Are you sure you are performing proper authorization checks everyplace?  What does Authorization even mean?  James Jardine talks about Authorization and how QA, Dev and others can reinforce its implementation.


Ep. 16: The Cloud: Is it Safe?

In this episode, James Jardine talks about the recent breaches regarding cloud services and whether or not we should be running for the hills.  Lets focus on the real issue, not the hype of nude photos. 


Ep. 15: Security Testing - QA can do this!!

In this episode, James talks about security testing... scratch that, testing.  There really is no difference between security testing and regular testing.  The app is functioning in a way it was not designed to.  QA can do this.   Developers can do this.  Listen to find out some of the ways that we can help move this forward to get our internal teams testing better.


Ep. 14: Input Validation and Output Encoding

The debate is out there, which is more important.  I discuss what they are and how they both play a key role in securing an application.


Ep. 13: Introduction to Cross Site Scripting

This episode gives a high level overview of what XSS is and why it is of concern.  Future episodes will dig deeper into the vulnerability.


DS: Ep 12: Ebay hacked. All about Cookies

We discuss a little about eBay and their unfortunate hack, how sourceforge has upgraded their password storage and a lot about cookies.   What are cookies, how are they used, how do we secure them.  Lots of great information about cookies. 


Not your Grandpa's Phishing

In this episode, we talk about phishing.  Mass email and spear phishing.  What you should know about the topic and how to protect yourself.


Threat Modeling

This episode introduces the new Microsoft Threat Modeling Tool 2014.  No more requirement for Visio..  woohoo.   Lots of talk about threat modeling and its benefits.

 

Threat Modeling Tool 2014: http://download.microsoft.com/download/3/8/0/3800050D-2BE7-4222-8B22-AF91D073C4FA/MSThreatModelingTool2014.msi

 

Threat Modeling (book by Adam Shostack): http://www.amazon.com/Threat-Modeling-Designing-Adam-Shostack/dp/1118809998/


Ep. 09: Windows XP and HeartBleed

In this episode we take a look at the two hottest topics.. Windows XP End of Life and Heartbleed.  If you haven't heard of either of these, your under a rock (and you should listen).   This is not an in-depth analysis of these, but just general thoughts on them.


Ep. 08: Oversharing is not Caring

In this episode, James Jardine talks about how oversharing with network shares is a big problem.  Often times we open shares to too many people and we share sensitive information that shouldn't be shared.   We need to look at how we monitor these shares and how, as a user, we share information on them.

 

Sorry.. seems to have recorded a little quiet this time.


Ep. 07: Data Breaches

We all see data breaches happen all the time, daily in most cases.  James talks about how common this is, how companies can handle the situation and how users can be proactive to protect themselves.


Ep. 6: Mobile Security

In this episode, James Jardine discusses mobile security and why we need to be thinking about it.  Devices are Powerful these days and we do everything on them.  We can't afford to ignore the security aspect of these devices.


Ep. 5: SQL Injection

Here we are in 2014 and we still have SQL Injection issues.  James Jardine discusses what SQL Injection is, how attackers take advantage of it and how developers can protect against it. 


Ep. 4: Web Proxies

In this episode, James Jardine talks about web proxies and how they are used.  Whether you are a developer, QA tester, or pen tester, web proxies are essential to your testing efforts.  Some Proxies discussed:

  • Burp Suite - http://portswigger.net/
  • Fiddler - http://www.telerik.com/download/fiddler
  • Zap Proxy - https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project

Some cool extensions mentioned:

  • Co2 - http://co2.professionallyevil.com/
  • Watcher - http://websecuritytool.codeplex.com/

Ep. 3:Connected System Security

In this episode, James talks about these external systems that are connected to our networks.  It is speculated that the Target breach was done through an HVAC system that was connected to the Internet.   How many devices these days connect to the internet and have default passwords for the vendor to manage them.  I discuss these ideas and things to think about when working with these systems.


Ep. 2: All About Passwords

In this episode, James covers some interesting topics about passwords.   Why we use them, what makes one better than another, some password management options and multi-factor authentication.


Ep. 1: Introduction to the Podcast

This is the first episode of the DevelopSec podcast.  The goal behind this podcast is to develop security awareness.  Helping developers gain security knowledge, and also consumers with understanding security in general.  We discuss recent breaches like Target and Neiman Marcus as well as the topics we will be discussing.  We will talk about techniques, tools, and other resources that you can use.