DevelopSec: Developing Security Awareness

This episode discusses vulnerability disclosure policies in web security, explaining how they differ from bug bounties and provide a structured way for reporting security flaws in applications.

This episode discusses the Log4J vulnerability event and provides higher-level strategies for organizations, development teams, and security teams to prepare for future third-party component vulnerabilities rather than focusing on specific technical details.

This episode discusses the evolution and importance of providing relevant, accurate security recommendations from penetration tests and automated scans to help development teams effectively implement fixes without confusion.

James discusses the new OWASP Top 10 2025 release, highlighting changes in categories and their implications for integrating security into development processes.

This episode explains the new cybersecurity attack technique called double-click checking, how it differs from click jacking, and practical ways to protect applications during development.

James discusses the pressure to always be right in security work and why it's okay to make mistakes or not have all the answers.

This episode explores the pros and cons of using third-party authentication like Facebook or Google login for applications, discussing benefits for users and developers while examining potential risks.

James discusses the importance of using correct terminology in technology, using a real-world example about misleading encryption claims to illustrate how terminology affects decisions in security and development.

This episode features an interview with Tim Medin, a SANS instructor and security consultant, discussing his work in offensive security and a presentation on Meteor security.

James discusses whether CSRF (cross-site request forgery) is dead in light of the new same site cookie attribute default in 2020, explaining how it works and why CSRF remains relevant.

Host James Jardine discusses the significance of New Year's resolutions for personal and professional growth, particularly in security awareness, while acknowledging common challenges in maintaining them.

James discusses the 2017 OWASP Top 10 update and introduces a new live video format called DevelopSec Live for enhanced security education.

This episode discusses the security risks of browser spell check features in relation to sensitive data and explores integrating security into development processes.

This episode discusses recent security changes in the Chrome browser, including same-site and mixed content updates, and explores why browsers are implementing these features to protect users.

This episode discusses application penetration testing as a key security assessment method for verifying the security of applications, networks, and IoT devices within development processes.

This episode discusses Chrome's removal of the XSS Auditor cross-site scripting filter in version 78, exploring its implications for web security and development processes.

James Jardine discusses the importance of understanding security in application platforms, covering frameworks like .NET, Python, and modern tools like React and Angular, and how they provide built-in protections.

James discusses how to choose appropriate application security tools that align with organizational needs and development environments, emphasizing the importance of avoiding tool selection pitfalls driven solely by security teams.

This episode explains the concept of shifting left in the Software Development Lifecycle (SDLC) to integrate security earlier in development rather than at the end.

This episode revisits the topic of open redirect vulnerabilities in web applications, discussing their prevalence in older apps, attack vectors, and practical demonstrations for developers, testers, and everyday users.

This episode discusses practical approaches to integrating security responsibilities into development teams by updating job descriptions and shifting accountability from separate security groups to developers themselves.

This episode discusses the evolution of ransomware tactics, focusing on how attackers motivate organizations to pay ransoms and the emerging software solutions for mitigation.

This episode explores whether security flaws should be classified as defects in software development, discussing the complexities and implications for integrating security into development processes.

Host James reflects on 2018 achievements in application security and development processes while setting goals for 2019, focusing on professional growth and security integration.

James Jardine explains credential stuffing attacks, how they differ from brute force attacks, and their implications for security in development processes.

This episode discusses integrating security into development through code review versus static analysis, emphasizing the importance of embedding security practices into existing processes.

This episode discusses the low adoption rates of two-factor authentication, particularly among Google users, and explores why it's underutilized and how to improve its implementation in development processes.

This episode analyzes the recent Facebook data breach, discussing how it occurred, why it went undetected, and offering practical security solutions for organizations to prevent similar incidents.

James discusses the concept of security culture, emphasizing shared responsibility and practical integration of security into development processes without turning everyone into security experts.

This episode discusses the importance of balancing security and user experience through proper authentication failure messaging to prevent panic and misunderstandings while avoiding risks like username enumeration.

This episode discusses the importance of understanding underlying technologies like HTTP, HTTPS, HTML, and JavaScript in application security, using a real-world vulnerability example.

This episode discusses the recent Apple Mac OS security bug that allowed root login with a blank password, exploring its implications and lessons for developers.

This episode features an interview with Perry Krug from Couchbase discussing database security and integrating security into development processes.

This episode discusses the security risks of using third-party components with known vulnerabilities in application development, referencing the OWASP Top 10 and examples like WordPress plugins.

This episode discusses the importance of addressing root causes rather than just symptoms in application security, focusing specifically on the challenges of vulnerable third-party components in development.

This episode discusses the importance of authentication alerts in security mechanisms, covering various controls like multi-factor authentication and brute force protection to prevent and detect unauthorized access.

James interviews Julien Vehent from Mozilla about integrating security into DevOps processes, focusing on securing Firefox's backend infrastructure and cloud services.

James uses a personal story about e-scooter tires to illustrate the importance of tools, process, and knowledge in integrating security into development processes.

This episode discusses the security risks of using common security questions in applications and provides practical recommendations for implementing them more securely.

This episode explains application fingerprinting, a security technique for identifying server frameworks and applications like IIS, Apache, PHP, ASP.NET, and CMS platforms such as WordPress.

This episode discusses a potential Gmail-Netflix email scam exploiting Gmail features and introduces a new application security fundamentals course.

This episode provides an overview of authorization in cybersecurity, explaining how it determines what authenticated users are allowed to do in a system based on their roles and permissions.

James discusses the importance of implementation in security controls, using vain authentication as an example to highlight how context affects security effectiveness.

This episode discusses the MyFitnessPal data breach, its implications as one of the largest personal data breaches in U.S.

This episode explores the definition of a data breach through the lens of Dunkin' Donuts' reported security incident, questioning what truly constitutes a breach in development and security contexts.

James interviews Eric Johnson about integrating application security into development processes, with personal anecdotes about their shared history at Wells Fargo and morning routines.

James Jardine analyzes the Equifax breach to extract practical security lessons, focusing on patching, server vulnerabilities, and learning from past incidents like Target to help organizations improve their defenses.

James discusses the importance of investing in people rather than just tools and processes to build effective application security programs within development organizations.

James Jardine introduces episode 81 of Develop Sec, discussing JavaScript in HREF and SRC for XSS vulnerabilities, while apologizing for a delay caused by Hurricane Irma and announcing the conversion of old episodes to YouTube for wider access.

This episode discusses the e-fail vulnerability affecting PGP and S-MIME email encryption, analyzing how news media often sensationalizes security issues without providing sufficient technical details.