AppSec Unlocked

Season 1: Open Source Security Episode 11: Help! There’s too many Vulnerabilities! A Practical Guide to Tackling Open-Source Security

Season 1: Open Source Security Episode 10: A FAIR Approach to Vulnerability Patch Prioritization In this episode of AppSec Unlocked, we dive into the fascinating topic of using a FAIR approach to Vulnerability Patch prioritization, where we explore how organizations can better prioritize vulnerabilities in their open-source software using the FAIR model and EPSS. And we have Denny Wan, an expert on FAIR analysis sharing his insights on this innovative approach.

Season 1: Open Source Security Episode 9: Open-Source Vulnerability Management Policy: A Balanced Approach In today's rapidly evolving cybersecurity landscape, managing vulnerabilities in open-source components has become increasingly complex. While traditional approaches relying solely on CVSS scores have their merits, they may not be sufficient to address the exponential growth in discovered vulnerabilities. A more nuanced and scalable approach is needed, one that considers not only severity but also exploitability and potential impact.

Season 1: Open Source Security Episode 8: A Cautionary Tale on Supply Chain Attacks: My Recent Encounter with a Compromised NPM Library This is a rebroadcast from the CyberBites podcast as it is related to application security and open source supply chain.

Season 1: Open Source Security Episode 7: Introduction to StakeholderSpecific Vulnerability Categorization (SSVC) Introduction to a transformative risk-based approach to vulnerability management Why SSVC, especially when we already have CVSSHow SSVC works and how to use itChallenges and considerationsReal-world example

Season 1: Open Source Security Episode 6: Software Composition Analysis Selection Criteria The Language of Love (and Code)Accuracy: The Goldilocks ZoneSpeed: Because Time is Money (and Sanity)Remediation: The Path of Least ResistanceUser-Friendly: No Computer Science Degree RequiredTiming is EverythingThe Never-Ending Story

Season 1: Open Source Security Episode 5: Embarking on the Open Source Security Journey. When Organisations Take the LeapThe Crucial Role of Awareness and Buy-inThe First Steps: Gaining VisibilityKey Takeaways for a Successful ProgramPractical Steps and Resources

Season 1: Open Source Security Episode 4: 5 Steps for Securing Your Open Source Supply Chain Most modern applications are assembled from open-source components with developers typically writing less than 15% of the code for their application. Here are the 5 Steps for securing your open source supply chain. Step 1: Maintain a Software Bill of Materials (SBOM) Step 2: Perform Due Diligence - Scan for Vulnerabilities Step 3: Have a Centralized Artifact Repository - Use Only Approved Software Step 4: Always Use Latest - Don't Use Stale Components Step 5: Run a Web Application Firewall (WAF)

Series 1: Open-Source Security Episode 3: How Secure Are Your Open Source Software Get ready for an eye-opening episode that could change the way you think about the building blocks of modern applications. The Open-Source ParadoxThe Security Controls GapThe Open-Source EnigmaThe Due Diligence DisparityThe Cost of Insecure Open Source: A Walk Down Memory LaneBest Practices for Secure Open-Source Usage

Season 1: Open Source Security Episode 2: Do Your Applications Have A Software Bill of Materials? “Oh, I didn’t realise we were exposed to as I didn’t think that application was using .”  I often heard such comments during the initial stages of our application security uplift. There was a lack of visibility on what open-source components applications relied on. Developers were often surprised, and sometimes in disbelief, as most of these vulnerable software components weren’t listed as application dependencies; they were transitive dependencies. In this episode we're diving into a crucial topic: "Do You Have a Software Bill of Materials?" Get ready for an enlightening episode as we explore why SBOMs are essential in today's software landscape. The Visibility ProblemThe Open-Source RealityWhat is an SBOM?The Benefits of SBOMsKeeping SBOMs Up-to-DateRecent Developments in SBOM Adoption

Season 1: Open Source Security Episode 1: You're Using More Open-Source Than You Realise We're diving into a topic that might surprise you: "You're Using More Open-Source Than You Realize." Get ready for an eye-opening episode that could change the way you think about your applications. • The Open-Source Reality Check • Real-World Example: The Log4j Wake-Up Call • The Rise of AI in Development • The Exponential Growth of Open-Source Usage • The Log4j Saga Continues • Why Are We Still at Risk? • The Hidden Costs of Open-Source • Best Practices for Managing Open-Source

Welcome to AppSec Unlocked, the podcast that's all about demystifying application security and empowering developers and security professionals alike. I'm your host, Edwin Kwan, and I'm thrilled to kick off this exciting journey with you. What is AppSec Unlocked? AppSec Unlocked is your key to understanding the complex world of application security. Whether you're a seasoned security professional, a curious developer, or somewhere in between, this podcast is designed to provide you with actionable insights, expert interviews, and the latest trends in the rapidly evolving field of application security.