Future of Application Security

The resounding sentiment from organizations is that there’s major tension between development and security teams. This tension makes it nearly impossible for any AppSec program to scale, making reducing this friction mission critical.  To learn how to improve the relationship between developers and security, on today’s episode of the Future of AppSec Harshil speaks with Dustin Lehr , Director of A...

Databricks is responsible for massive amounts of data for more than 7,000 customers worldwide including more than 40% of the Fortune 500. This means security is mission critical and the stakes are incredibly high. To keep their customer data secure, Databricks has put major focus into building both their product security team and strategy. In January, their team had just two members and today, the...

Three years ago LinkedIn had no vulnerability management program in place. Today that’s a completely different story. Over the past three years, they built their program from scratch and rapidly scaled to keep their 25k+ employees and  800 million users safe and secure.  How did LinkedIn achieve this scale so quickly and what lessons were learned along the way? On today’s episode we speak with Jus...

Credit Karma is expanding rapidly and a huge focus for them is having a truly agile engineering team. Application security has also been a focus and their ratio of appsec engineers to developers is 1-:50 which is one of the industries best ratios.  In their movement to success, today's show shares exactly how Credit Karma’s Director of Application Security Chaitanya Bhatt has tackled modern applic...

This modern SDLC has really exacerbated the fractured relationship between developers and security. Often security is frustrated that developers cannot deliver on their laundry list of asks, and in turn, developers are sick of the legacy application security ways that slow down progress. To scale at the speed of DevOps, organizations have to eliminate this friction and improve the relationship bet...

Developers today go from code-to-cloud in a matter of hours and security teams are struggling to keep up. Legacy AppSec systems and processes are impeding their efforts to scale their AppSec program and the majority of security teams feel unprepared to govern and secure the modern SDLC.  To solve this problem, organizations must rethink their approach to AppSec. Instead of trying to force develope...

To build a high-performing security team, organizations must rethink how they approach recruiting, hiring, and retaining talent. The problem is, building a great team is incredibly challenging today. With an estimated 400,000 unfilled security jobs , security teams are understaffed, burnt out, and struggling to keep up with an ever-increasing  number of cyberattacks each day .  Our guest today tea...

Most people think about threat modeling as an extensive, costly and heavyweight exercise. But what if it didn’t have to be? What if threat modeling could be as easy as asking and answering a few simple questions?    In today’s episode, we speak with Adam Shostack about his simple four-question threat modeling framework. Adam’s framework was developed based on 20+ years of threat modeling experienc...

CISOs have one of the most unique views of an organization.    Being in charge of teams that are under enormous pressure to ship, deliver, and sell security goes beyond an effective management.   Michael Piacente is the co-founder and managing director of Hitch Partners and he has been helping the CISO community for several years.  In today's show, he shares his insights about the patterns that mo...

In this first episode, NextRoll’ s Product Security Lead Nicolas Valcarcel shares how since he was 15 he wanted to work in security. However, his career path has been far from conventional.  By being part of developer teams in early-stage startups and working hand to hand with founding teams, he has been able to get a grasp on how developers and security teams see the same product in very differen...