Security Weekly

Architecture

Application security

Container security

Cloud

Cloud security

Device Security

Mobile

Network security

DDOS

Strategy

Security awareness

Training

Threat intelligence

Social engineering

Security research

Policy

Compliance

Privacy

Endpoint Security

SWN #20

North America

Group Podcast

Related Events


<p><strong>(Aired on June 22, 2021)<br></strong><em>Earn up to 3 CPE&#8217;s</em><br><br>Here’s the challenge: Web applications are progressively extending the range of critical business operations they support. But software development for cloud-native environments requires continuous security oversight. Against this backdrop, cybersecurity leaders and strategists must strike a balance between accelerating a business’s go-to-market and safeguarding the applications that fuel its growth and productivity.<br><br>Producing quality code quickly and securely is always the goal. But efforts to integrate security into the software development cycle is more often perceived as a roadblock than a catalyst. Hear from top experts in a series of discussions and presentations focused on application security, topics include:<br><br><span class="has-inline-color has-vivid-red-color">• </span>How to map application security requirements to compliance frameworks<br><span class="has-inline-color has-vivid-red-color">•</span> Embracing and extending DevSecOps principles<br><span class="has-inline-color has-vivid-red-color">•</span> Standardizing application security policies within business lines<br><br>Discover how modern application security programs can operate at the speed and scale that’s required to empower, not deter, the business. </p>



<p class="has-normal-font-size"><strong>AGENDA</strong><br><br><strong><span class="has-inline-color has-vivid-red-color">11:00 AM ET</span></strong><br><strong>KEYNOTE | Preventing the exhaust ports: How not to build a Death Star with your&nbsp;SDLC</strong><br><strong><em>Kevin Johnson,</em></strong><em>&nbsp;CEO, Secure Ideas</em><br>Millions of stormtroopers and galactic empire citizens were lost because engineers didn&#8217;t understand their design flaws.&nbsp;While this is a great movie reference, the reality is that organizations are deploying applications with their version of this fatal flaw every day.&nbsp;In this presentation, Kevin Johnson of Secure Ideas will walk attendees through various examples of application flaws, using real applications he and his team have tested.&nbsp;He will then discuss how the flaws happened and methods for improving your SDLC and security integration to prevent them in the future.&nbsp;</p>



<div class="wp-container-6284c58a24ee2 wp-block-group"><div class="wp-block-group__inner-container">
<div class="wp-container-6284c58a24bf6 wp-block-group"><div class="wp-block-group__inner-container">
<div class="wp-container-6284c58a24891 wp-block-group"><div class="wp-block-group__inner-container">
<p class="has-text-color has-normal-font-size" style="color:#444444"><strong><span class="has-inline-color has-vivid-red-color">11:55&nbsp;AM ET</span></strong><br><strong>Beyond DAST: A DAST-first tool with IAST depth</strong>&nbsp;<br><strong><em>Mark Schembri,</em></strong><em>&nbsp;Technical Solutions Engineer, Invicti</em><br>The versatility of modern dynamic tools brings advantages that extend far beyond the typical vulnerability scanning functionality. The inclusion of&nbsp;True IAST functionality maintains the advantages of a DAST solution while going deeper than ever to identify and verify more vulnerabilities with access to the application code. You will learn how&nbsp;Netsparker’s&nbsp;IAST capabilities will help you:</p>



<ul id="block-b68249d0-2801-474a-9579-3e43be3ede32" class="has-vivid-red-color has-text-color"><li><span style="color:#444444" class="has-inline-color">Find more&nbsp;vulnerabilities&nbsp;</span></li><li><span style="color:#444444" class="has-inline-color">Further reduce false positives&nbsp;</span></li><li><span style="color:#444444" class="has-inline-color">Simplify&nbsp;remediation</span></li></ul>
</div></div>
</div></div>
</div></div>



<div class="wp-container-6284c58a25ed3 wp-block-group"><div class="wp-block-group__inner-container">
<div class="wp-container-6284c58a25bb8 wp-block-group has-text-color" style="color:#444444"><div class="wp-block-group__inner-container">
<div class="wp-container-6284c58a258a4 wp-block-group"><div class="wp-block-group__inner-container">
<p class="has-normal-font-size"><strong><span class="has-inline-color has-vivid-red-color">12:35 PM ET </span></strong><br><strong>Embed&nbsp;sophisticated&nbsp;bot&nbsp;detection into your CI/CD&nbsp;pipeline with a&nbsp;single&nbsp;line of&nbsp;code.</strong><br><strong><em>Peter Craig,</em></strong><em>&nbsp;Director of Product Marketing, Human Security</em><br>Enterprises find it increasingly difficult to defend web applications from automated attacks.&nbsp;Even when apps function as intended, they are vulnerable to criminals using sophisticated bots that mimic human behavior using mouse movements, keystrokes, and fake browser behaviors.&nbsp;Solution: By embedding effective, multilayered, bot detection and mitigation, you can protect your application from automated attacks while providing insight to development on the tactics your adversaries used and the resources they targeted.&nbsp;Learn how you can:&nbsp;</p>



<div class="wp-container-6284c58a25575 wp-block-group"><div class="wp-block-group__inner-container">
<ul class="has-vivid-red-color has-text-color"><li><span style="color:#444444" class="has-inline-color">Detect even the most sophisticated, dynamic bots and gain full transparency into each&nbsp;detection&nbsp;</span></li><li><span style="color:#444444" class="has-inline-color">Mitigate malicious bots and nonstandard traffic in&nbsp;real-time&nbsp;</span></li><li><span style="color:#444444" class="has-inline-color">Enhance your application user experience with minimal performance&nbsp;impact</span></li></ul>



<p class="has-normal-font-size"><strong><span class="has-inline-color has-vivid-red-color">1:15 PM ET</span></strong><br><strong>KEYNOTE | Scorched earth: Empirical research in hacking and securing&nbsp;APIs</strong>&nbsp;<br><strong><em>Alissa Knight,&nbsp;</em></strong><em>Partner,&nbsp;Knight Ink</em><br>Application programming interfaces (APIs) are now everywhere, powering the way we live, work and play. But when authentication and authorization is broken, it opens everything up from the data these APIs are serving to remote control of connected passenger vehicles. Unfortunately, many organizations are using the wrong security control to secure their APIs, akin to using a hammer to nail in a screw.<br>Cybersecurity professionals must ensure that APIs are secured correctly, so every request is authenticated and authorized. Solutions should interdict the traffic and ensure the traffic destined for the API is not synthetically generated by malicious tools. In this keynote session, Alissa Knight will share:</p>



<ul id="block-822071bb-1a89-4e27-a30c-b01348f9155b" class="has-vivid-red-color has-text-color"><li><span style="color:#444444" class="has-inline-color">Several years of empirical data gleaned from her hacking of banks, automobile manufacturers, and healthcare providers and payers through their&nbsp;APIs</span></li><li><span style="color:#444444" class="has-inline-color">What her research produced when the wrong security control was used to secure these&nbsp;APIs</span></li><li><span style="color:#444444" class="has-inline-color">What you should be looking for in your API threat management solution</span></li><li><span style="color:#444444" class="has-inline-color">Most importantly, what the indicators of compromise are to the specific tactics and techniques used to breach&nbsp;APIs</span></li></ul>



<p class="has-text-color has-normal-font-size" style="color:#444444"><strong><span class="has-inline-color has-vivid-red-color">1:55 PM ET</span></strong><br><strong>Between the&nbsp;chair and&nbsp;keyboard</strong><br><strong><em>J. Wolfgang Goerlich,&nbsp;</em></strong><em>Advisory CISO, Duo Security&nbsp;at Cisco</em><br>People ultimately decide our security posture. The dreaded end-users.&nbsp;People performing conscientiously&nbsp;and consistently is a lofty goal. Risk management gives us the process to follow.&nbsp;Control&nbsp;frameworks&nbsp;give&nbsp;us the standards to set and meet. Yet it is people who ultimately decide our security posture.&nbsp;In this presentation, we look at the psychology and behavior science of individuals making risk decisions and leaders affecting culture change, and how it affects the security of organizations and the applications on which they rely.&nbsp;Attendees will leave with insights and pragmatic tactics for improving the human element in risk and compliance.</p>



<p class="has-text-color has-normal-font-size" style="color:#444444"><strong><span class="has-inline-color has-vivid-red-color">2:35 PM ET</span></strong><br><strong>How to determine what your open-source risks look like</strong>&nbsp;<br><strong><em>David Lindner,</em></strong><em>&nbsp;CISO, Contrast Security</em>&nbsp;<br>Studies show that upwards of 80% of software code is comprised of open-source libraries. But the reality is that less than 10% of classes within active libraries are ever invoked by the application. Yet, open-source libraries contain significant vulnerability and licensing risks with 34 CVEs per application on average and 35% of applications containing a copyleft license. Attend this session to learn what open-source risks matter and how to focus on fixing them quickly and easily.</p>



<p class="has-text-color has-normal-font-size" style="color:#444444"><strong><span class="has-inline-color has-vivid-red-color">3:15 PM ET</span></strong><br><strong>Best practices for developers for master security</strong>&nbsp;<br><strong><em>Anna Rozin,</em></strong><em>&nbsp;Director of R&amp;D,&nbsp;WhiteSource</em><br><strong><em>Shiri Arad&nbsp;Ivtsan,</em></strong><em>&nbsp;Director of Product,&nbsp;WhiteSource</em><br>When you ask developers what they think of security, they will likely go into the situation without much enthusiasm as in their mind – security is slowing them down and holding them back from doing their “actual” job. But – it doesn’t necessarily have to be that way. The friction between developers and security teams can be&nbsp;reduced if the right tools and processes are in place. Want to learn how handling security can be quick, efficient and integrate into daily workflows?&nbsp;Join Anna Rozin, director of R&amp;D at&nbsp;WhiteSource, and Shiri Arad&nbsp;Ivtsan, director of product at&nbsp;WhiteSource, who will share their hands-on experience in managing&nbsp;open source&nbsp;components with WhiteSource tools. In this session you&#8217;ll learn:</p>



<ul class="has-vivid-red-color has-text-color"><li><span style="color:#444444" class="has-inline-color">Practical advice on testing, managing and fixing vulnerabilities in&nbsp;open source&nbsp;code&nbsp;packages&nbsp;</span></li><li><span style="color:#444444" class="has-inline-color">The tools and processes to handle security in a fast and effective&nbsp;way&nbsp;</span></li><li><span style="color:#444444" class="has-inline-color">How to empower developers with security data through prioritization and remediation tips</span>&nbsp;</li></ul>



<div class="wp-container-6284c58a25271 wp-block-group"><div class="wp-block-group__inner-container">
<p class="has-text-color has-normal-font-size" style="color:#444444"><strong><span class="has-inline-color has-vivid-red-color">3:55 PM ET</span></strong><br><strong><strong>KEYNOTE |</strong></strong> <strong>Preventing the next&nbsp;SolarWinds: A look at the evolving app security&nbsp;landscape</strong><br><strong><em>Keith&nbsp;Hoodlet,</em></strong><em>&nbsp;Director, Application Experience, Thermo Fisher Scientific</em><br>Attackers targeting vulnerabilities in applications are growing more sophisticated – looking beyond the low hanging fruit of consumer apps to enterprise software that provides an avenue in for widespread network compromise across an expansive supply chain. Keith&nbsp;Hoodlet,&nbsp;director of application experience at Thermo Fisher Scientific, speaks about the evolving tactics for infiltrating the network via gaps in software security, and must-do-defensive strategies to prevent the next SolarWinds or Accellion hack.&nbsp;<br><br></p>
</div></div>
</div></div>
</div></div>
</div></div>
</div></div>


Generic_215x132_bannerNEW4

DevOps

Asset Management

Vulnerability management

eSummit

Integrating Application Security: Reengineering AppSec as a business catalyst

wordpress_ASW_161_Appsec-0.png

Application Security Weekly

Hardware security

Podcast

Router Auth Bypass, Weak IoT RNG, HTTP/2 Request Smuggling, & Kindle Fuzzing – ASW #161

wordpress_SWN_140_-_Wrap_Up-0.png

Security Weekly News

Black Hat Recap, Cisco Patches, CISA Task Force, & LockBit 2.0 – Wrap Up – SWN #140

wordpress_SWN_138_-_News-0.png

Identity and access

Encryption

Backup and recovery

Third-party risk

Intrusion detection

Pen testing

Bug bounties

Patch management

Incident response

Forensics

Threat hunting

Insider threat

Deception

Physical security

PyPI Malware, PetitPotam Attack, NSA Device Guidance, & Meteor Wiper – Wrap Up – SWN #138

<p></p><div align="center"><iframe src="https://www.youtube.com/embed/1bwCbxnpUC4?rel=0" width="560" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p></p>
<p>Pornhub has Italians singing from balconies, The Senate renews surviellance rules, Drobo hacks, Google Cloud bug bounties, all the show wrapups, and COVID-19</p>
<p>Visit https://www.securityweekly.com/swn for all the latest episodes!</p>
<p><a href="https://wiki.securityweekly.com/SWNEpisode20">Full Episode Show Notes</a></p>
<p>To learn more about our sponsors visit: <a href="https://securityweekly.com/sponsors">The Security Weekly Sponsor&#8217;s Page</a></p>
<h1>COVID-19, SMBv3.11, &amp; Drobo Exploit &#8211; Wrap Up </h1>
<h1>Hosts</h1>
<table>
<tbody><tr>
<td><div id="attachment_210" style="width: 130px" class="wp-caption alignleft"><img aria-describedby="caption-attachment-210" class="wp-image-210" src="http://securityweekly.com/wp-content/uploads/2020/03/Doug_White-0-5.png" alt="Doug White" width="120" height="96"><p id="caption-attachment-210" class="wp-caption-text">Doug White  &#8211; Professor</p></div></td>
</tr>
</tbody></table>
<h1>Guests</h1>
<table>
<tbody><tr>
</tr>
</tbody></table>


<audio class="wp-audio-shortcode" id="audio-170860-1" preload="none" style="width: 100%;" controls="controls"><source type="audio/mpeg" src="http://traffic.libsyn.com/sw-all/SWN_20_-0_converted.mp3?_=1" /><a href="http://traffic.libsyn.com/sw-all/SWN_20_-0_converted.mp3">http://traffic.libsyn.com/sw-all/SWN_20_-0_converted.mp3</a></audio>

SWN #20

COVID-19, SMBv3.11, & Drobo Exploit – Wrap Up

Hosts

Guests

Related

Application Security Weekly Router Auth Bypass, Weak IoT RNG, HTTP/2 Request Smuggling, & Kindle Fuzzing – ASW #161

Security Weekly News Black Hat Recap, Cisco Patches, CISA Task Force, & LockBit 2.0 – Wrap Up – SWN #140

Security Weekly News PyPI Malware, PetitPotam Attack, NSA Device Guidance, & Meteor Wiper – Wrap Up – SWN #138