DevelopSec: Developing Security Awareness

EXPLORE

Society & Culture

© 2024 PodJoint

https://is1-ssl.mzstatic.com/image/thumb/Podcasts211/v4/3c/2a/e9/3c2ae915-44a7-3739-9b29-7873bb56c11e/mza_2657645121866857059.jpg/600x600bb.jpg

DevelopSec: Developing Security Awareness

Jardine Software Inc.

128 episodes

8 months ago

In this episode, I go over what Double-ClickJacking is and what you can potentially do about it to reduce the risk to your applications. Will this be the new finding on everyone's pen tests this year? Paulos Yibelo first described Double-ClickJacking and you can read more from him at his post referenced below. References: Paulos Yibelo Blog: https://www.paulosyibelo.com/2024/12/doubleclickjacking-what.html Send us a text For more info go to https://www.developsec.com or follow us on X...

Show more...

All content for DevelopSec: Developing Security Awareness is the property of Jardine Software Inc. and is served directly from their servers with no modification, redirects, or rehosting. The podcast is not affiliated with or endorsed by Podjoint in any way.

In this episode, I go over what Double-ClickJacking is and what you can potentially do about it to reduce the risk to your applications. Will this be the new finding on everyone's pen tests this year? Paulos Yibelo first described Double-ClickJacking and you can read more from him at his post referenced below. References: Paulos Yibelo Blog: https://www.paulosyibelo.com/2024/12/doubleclickjacking-what.html Send us a text For more info go to https://www.developsec.com or follow us on X...

Show more...

Episodes (20/128)

DevelopSec: Developing Security Awareness

Ep. 124: Double-ClickJacking

In this episode, I go over what Double-ClickJacking is and what you can potentially do about it to reduce the risk to your applications. Will this be the new finding on everyone's pen tests this year? Paulos Yibelo first described Double-ClickJacking and you can read more from him at his post referenced below. References: Paulos Yibelo Blog: https://www.paulosyibelo.com/2024/12/doubleclickjacking-what.html Send us a text For more info go to https://www.developsec.com or follow us on X...

8 months ago

21 minutes

DevelopSec: Developing Security Awareness

Ep. 123: Goals of Security Culture - Sort of?

In this episode, I talk about how security is a part of everyone's role and the labeling of "Security Culture". I share some ideas on how to improve on role based security awareness and building stronger relationships between security and the rest of the organization. For more info go to https://www.developsec.com or follow us on X (@developsec).

8 months ago

7 minutes

DevelopSec: Developing Security Awareness

Ep. 122: Integrating Security Responsibilities into Development

In this episode I talk about assigning responsibility for secure development and how the dev and security teams should be working together to accomplish a common goal. I also discuss the importance of updating developer job descriptions and creating an expectation around developers having secure development experience. For more info go to https://www.developsec.com or follow us on X (@developsec).

8 months ago

18 minutes

DevelopSec: Developing Security Awareness

Ep. 121 - Evolving Ransomware: Unique Tactics for Payment

In this episode I talk about the evolving world of ransomware. I discuss a few examples of unique tactics the malicious actors are using to put pressure on organizations to pay the ransom. Referenced Articles: https://www.theregister.com/AMP/2024/04/30/finnish_psychotherapy_center_crook_sentenced/ https://www.darkreading.com/cyber-risk/hackers-weaponize-sec-disclosure-rules-against-corporate-targets https://www.theregister.com/2024/01/05/swatting_extorion_tactics/ ...

1 year ago

17 minutes

DevelopSec: Developing Security Awareness

Ep. 120: Addressing Root Cause - Vulnerable Components

In this episode we talk about addressing the root cause of an issue versus the symptoms. How can the process of keeping application components updated be improved? For more info go to https://www.developsec.com or follow us on twitter (@developsec). DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help. Transcript: In this episode, James talks about...

2 years ago

16 minutes

DevelopSec: Developing Security Awareness

Ep. 119: Risks of SpellCheck

In this episode we talk about the spell check feature of the browser and how it could present a risk to sensitive data. Link to article referenced: https://www.darkreading.com/application-security/spellchecking-google-chrome-microsoft-edge-browsers-leaks-passwords For more info go to https://www.developsec.com or follow us on twitter (@developsec). DevelopSec provides application security consulting and training to add value to your applica...

2 years ago

12 minutes

DevelopSec: Developing Security Awareness

Ep. 118: Log4J Sparking Thought on Vulnerable Components

Log4J has been the talk of the town recently and everyone is focused on the technical details of the specific vulnerabilities found. In this episode, James talks about the overarching ideas around dealing with vulnerable components. Are you vulnerable? If so, what needs to be done? For more info go to https://www.developsec.com or follow us on twitter (@developsec). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec pro...

3 years ago

24 minutes

DevelopSec: Developing Security Awareness

Ep. 117: How Browsers are Helping with Security

Chrome has announced a few changes that we need to watch out for in the near future. We previously talked about the default value for samesite that is coming up fast. I wrote about this here: https://www.jardinesoftware.net/2019/10/28/samesite-by-default-in-2020/ Also, they are getting ready to start blocking mixed content downloads: https://blog.chromium.org/2020/02/protecting-users-from-insecure.html For more info go to https://www.developsec.com or follow us on twitt...

5 years ago

13 minutes

DevelopSec: Developing Security Awareness

Ep. 116: Chrome Retires XSS Auditor

It was recently announced that Chrome was dropping the XSS Auditor in Chrome 78. What does that mean and how does that change things for you as a developer? https://www.chromium.org/developers/design-documents/xss-auditor For more info go to https://www.developsec.com or follow us on twitter (@developsec). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security training to add value...

5 years ago

14 minutes

DevelopSec: Developing Security Awareness

Ep. 115: Is CSRF Really Dead?

In 2020, Chrome will default the SameSite attribute to Lax on all cookies. SameSite helps mitigate CSRF, but does that mean CSRF is Dead? For more info go to https://www.developsec.com or follow us on twitter (@developsec). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security training to add value to your application security program. Contact us today to see how we can help.

6 years ago

15 minutes

DevelopSec: Developing Security Awareness

Ep. 114: Investing in People for Better Application Security

In this episode, James talks about investing in the development teams to increase application security priorities. For more info go to https://www.developsec.com or follow us on twitter (@developsec). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security training to add value to your application security program. Contact us today to see how we can help.

6 years ago

24 minutes

DevelopSec: Developing Security Awareness

Ep. 113: What is your mother's maiden name?

In this episode, James talks about some of the risks and recommendations around security questions and their implementation. For more info go to https://www.developsec.com or follow us on twitter (@developsec). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can help.

6 years ago

21 minutes

DevelopSec: Developing Security Awareness

Ep. 112: Application Fingerprinting

Does your application give away details about it server, framework, or other components? How is this information used by an attacker? Check out this episode to learn more. For more info go to https://www.developsec.com or follow us on twitter (@developsec). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security consulting and training to add value to your application security program. Con...

6 years ago

21 minutes

DevelopSec: Developing Security Awareness

Ep. 111: Authentication Alerts

Would you know if someone authenticated to your account? With the breaches we see in the news, and attacks like credential stuffing, there must be a way to be alerted to account access. James talks about authentication alerts, what they are, and why you may want to use them. For more info go to https://www.developsec.com or follow us on twitter (@developsec). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides a...

6 years ago

16 minutes

DevelopSec: Developing Security Awareness

Ep. 110: Implementation Matters

James discusses how implementation matters with security controls and how it changes priorities. This came about after reading the following story: https://www.theverge.com/2018/12/31/18162541/vein-authentication-wax-hand-hack-starbug For more info go to https://www.developsec.com or follow us on twitter (@developsec). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security consulting ...

6 years ago

19 minutes

DevelopSec: Developing Security Awareness

Ep. 109: 2018 Reflection

I talk about some of what happened in 2018 and what I am looking to do in 2019. I also ask you to think about your previous year and goals. I also talk about some new training I am providing. For more info go to https://www.developsec.com or follow us on twitter (@developsec). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security consulting and training to add value to your application s...

6 years ago

27 minutes

DevelopSec: Developing Security Awareness

Ep. 108: Dunkin Donuts Breach, Maybe??

In this episode James talk about the Dunkin Donuts Perks breach. This is an interesting situation as the accounts were access using the victim's username and password found from another data breach. The issue: Password Reuse. Could D&D have prevented this? Listen in to hear my thoughts. Please feel free to share your thoughts as well. Article from Today: https://www.today.com/food/dunkin-reveals-security-breach-here-s-what-it-may-mean-t144139 Dunkin Donuts Release: ...

6 years ago

18 minutes

DevelopSec: Developing Security Awareness

Ep. 107: Credential Stuffing

In this episode James talks about what credential stuffing is, how if affects your apps, and how you can look to defend against it. For more info go to https://www.developsec.com or follow us on twitter (@developsec). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see how we can he...

6 years ago

18 minutes

DevelopSec: Developing Security Awareness

Ep. 106: Facebook Breach Take-aways and Insights

James talks about the Facebook breach and shares some insights into how you can take steps to prevent this type of incident in your applications. For more info go to https://www.developsec.com or follow us on twitter (@developsec). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application security consulting and training to add value to your application security program. Contact us today to see...

7 years ago

31 minutes

DevelopSec: Developing Security Awareness

Ep. 105: Interview with Eric Johnson

I sit down with Eric Johnson to talk about security in the IDE and other fun topics. A bit longer than usual, but full of great information. You can reach out to Eric on twitter @emjohn20 or check out his site at https://www.pumascan.com. For more info go to https://www.developsec.com or follow us on twitter (@developsec). Join the conversations.. join our slack channel. Email james@developsec.com for an invitation. DevelopSec provides application securit...

7 years ago

57 minutes