Halloween pumpkin in field

Photo by Diego Damato on Unsplash

We celebrated some milestone episode numbers this month! Episode 404 was a fun conversation about what's not found in appsec.

Getting Granular with Access, Attributes, and Intent (ep. 403)

The principle of least privilege access is ubiquitous in recommendations, but perhaps too uncommon in practice. Alex Olivier explained how the AuthZen Working Group has been approaching new standards and guidelines to make practical deployment patterns easier for orgs to adopt, which in turn should lead to more refined and correct access policies.

Weak access management is a problem that predates LLMs, but one that agents and MCPs made all the more acute. We talked about what intent means (if anything) when trying to constrain agents' activities, what role LLMs have (if any) in policy decisions, and how LLMs might help create a much-needed inventory of access controls.

What’s Not Found in AppSec? (ep. 404)

To celebrate our 404th episode we riffed on the HTTP response code to discuss what’s not found in modern appsec and what still exists that we wish couldn’t be found.

The conversation started with a classic problem of appsec -- looking for a reliable vuln prioritization methodology. But we used that to challenge whether a focus on vulns and patches is even the right choice for an appsec program. Then we turned to incentives, the role of agents in writing and securing software, and what we should be looking for to bring new appsec practitioners into the industry.

John Kinsella, Adrian Sanabria, and Tyler Shields all joined in on this celebration of searching.

Standardizing Mobile Defense: Inside the OWASP Mobile App Security Project v2 (ep. 405)

The OWASP Mobile Application Security (MAS) project recently released an updated version of its guidance, with excellent advice organized into common weaknesses, a verification standard for devs (MASVS), and a testing guide (MASTG). One of my favorite things about this project is that it dropped the framing of a Top Ten list in favor of that more clear and accessible format.

Ryan Lloyd and Jan Seredynski from Guardsquare talked about the project’s updates, how orgs can use it, and the challenges orgs face in managing their mobile frameworks and environments.

We also covered how agents and LLMs are impacting mobile security and what future iterations of the MAS project might include for securing mobile apps interacting with LLMs or being written by LLMs. We wrapped up with practical ways for developers to get involved as OWASP contributors and advocates.

This segment was sponsored by Guardsquare.

Securing Modern Financial Systems in the Age of AI (ep. 406)

AppSec doesn't have to wait for a vuln disclosure to be effective. Even if a patch isn't available – even before a vuln is known – it's possible to deploy controls and design systems to be resilient against how vulns are exploited.

Rashid Feroze explained the benefits of runtime security based on using eBPF filters to improve observability and block unauthorized behavior. He walked through scenarios related to supply chain attacks, prompt injections, and responding to major events like PHP2Shell.

We also mentioned a few threat models to clarify what eBPF filters can protect against versus what still requires secure coding discipline from developers.

Subscribe to catch these episodes and more! Then go check out the previous recap.