Player FM - Internet Radio Done Right
50 subscribers
Checked 15h ago
تمت الإضافة منذ قبل seven عام
المحتوى المقدم من Security Weekly Productions and Security Weekly. يتم تحميل جميع محتويات البودكاست بما في ذلك الحلقات والرسومات وأوصاف البودكاست وتقديمها مباشرة بواسطة Security Weekly Productions and Security Weekly أو شريك منصة البودكاست الخاص بهم. إذا كنت تعتقد أن شخصًا ما يستخدم عملك المحمي بحقوق الطبع والنشر دون إذنك، فيمكنك اتباع العملية الموضحة هنا https://ar.player.fm/legal.
Player FM - تطبيق بودكاست
انتقل إلى وضع عدم الاتصال باستخدام تطبيق Player FM !
انتقل إلى وضع عدم الاتصال باستخدام تطبيق Player FM !
المدونة الصوتية تستحق الاستماع
برعاية
A
Advances in Care


1 Advancing Cardiology and Heart Surgery Through a History of Collaboration 20:13
20:13
التشغيل لاحقا
التشغيل لاحقا
قوائم
إعجاب
احب20:13
On this episode of Advances in Care , host Erin Welsh and Dr. Craig Smith, Chair of the Department of Surgery and Surgeon-in-Chief at NewYork-Presbyterian and Columbia discuss the highlights of Dr. Smith’s 40+ year career as a cardiac surgeon and how the culture of Columbia has been a catalyst for innovation in cardiac care. Dr. Smith describes the excitement of helping to pioneer the institution’s heart transplant program in the 1980s, when it was just one of only three hospitals in the country practicing heart transplantation. Dr. Smith also explains how a unique collaboration with Columbia’s cardiology team led to the first of several groundbreaking trials, called PARTNER (Placement of AoRTic TraNscatheteR Valve), which paved the way for a monumental treatment for aortic stenosis — the most common heart valve disease that is lethal if left untreated. During the trial, Dr. Smith worked closely with Dr. Martin B. Leon, Professor of Medicine at Columbia University Irving Medical Center and Chief Innovation Officer and the Director of the Cardiovascular Data Science Center for the Division of Cardiology. Their findings elevated TAVR, or transcatheter aortic valve replacement, to eventually become the gold-standard for aortic stenosis patients at all levels of illness severity and surgical risk. Today, an experienced team of specialists at Columbia treat TAVR patients with a combination of advancements including advanced replacement valve materials, three-dimensional and ECG imaging, and a personalized approach to cardiac care. Finally, Dr. Smith shares his thoughts on new frontiers of cardiac surgery, like the challenge of repairing the mitral and tricuspid valves, and the promising application of robotic surgery for complex, high-risk operations. He reflects on life after he retires from operating, and shares his observations of how NewYork-Presbyterian and Columbia have evolved in the decades since he began his residency. For more information visit nyp.org/Advances…
Removing Rust, Double Clickjacking, h3i CLI, JWT Mistakes, Reviewing Recursion - ASW #312
Manage episode 459836624 series 2086046
المحتوى المقدم من Security Weekly Productions and Security Weekly. يتم تحميل جميع محتويات البودكاست بما في ذلك الحلقات والرسومات وأوصاف البودكاست وتقديمها مباشرة بواسطة Security Weekly Productions and Security Weekly أو شريك منصة البودكاست الخاص بهم. إذا كنت تعتقد أن شخصًا ما يستخدم عملك المحمي بحقوق الطبع والنشر دون إذنك، فيمكنك اتباع العملية الموضحة هنا https://ar.player.fm/legal.
Curl removes a Rust backend, double clickjacking revives an old vuln, a new tool for working with HTTP/3, a brief reminder to verify JWT signatures, design lessons from recursion, and more!
Show Notes: https://securityweekly.com/asw-312
644 حلقات
Manage episode 459836624 series 2086046
المحتوى المقدم من Security Weekly Productions and Security Weekly. يتم تحميل جميع محتويات البودكاست بما في ذلك الحلقات والرسومات وأوصاف البودكاست وتقديمها مباشرة بواسطة Security Weekly Productions and Security Weekly أو شريك منصة البودكاست الخاص بهم. إذا كنت تعتقد أن شخصًا ما يستخدم عملك المحمي بحقوق الطبع والنشر دون إذنك، فيمكنك اتباع العملية الموضحة هنا https://ar.player.fm/legal.
Curl removes a Rust backend, double clickjacking revives an old vuln, a new tool for working with HTTP/3, a brief reminder to verify JWT signatures, design lessons from recursion, and more!
Show Notes: https://securityweekly.com/asw-312
644 حلقات
كل الحلقات
×A
Application Security Weekly (Video)

1 Top 10 Web Hacking Techniques of 2024 - James Kettle - ASW #318 44:57
44:57
التشغيل لاحقا
التشغيل لاحقا
قوائم
إعجاب
احب44:57
We're getting close to two full decades of celebrating web hacking techniques. James Kettle shares which was his favorite, why the list is important to the web hacking community, and what inspires the kind of research that makes it onto the list. We discuss why we keep seeing eternal flaws like XSS and SQL injection making these lists year after year and how clever research is still finding new attack surfaces in old technologies. But there's a lot of new web technology still to be examined, from HTTP/2 and HTTP/3 to WebAssembly. Segment Resources: Top 10, 2024: https://portswigger.net/research/top-10-web-hacking-techniques-of-2024 Full nomination list: https://portswigger.net/research/top-10-web-hacking-techniques-of-2024-nominations-open Project overview: https://portswigger.net/research/top-10-web-hacking-techniques Show Notes: https://securityweekly.com/asw-318…
A
Application Security Weekly (Video)

1 Unforgivable Vulns, DeepSeek iOS App Security Flaws, Memory Safety Standards - ASW #317 35:52
35:52
التشغيل لاحقا
التشغيل لاحقا
قوائم
إعجاب
احب35:52
Identifying and eradicating unforgivable vulns, an unforgivable flaw (and a few others) in DeepSeek's iOS app, academics and industry looking to standardize principles and practices for memory safety, and more! Show Notes: https://securityweekly.com/asw-317
A
Application Security Weekly (Video)

1 Code Scanning That Works With Your Code - Scott Norberg - ASW #317 37:01
37:01
التشغيل لاحقا
التشغيل لاحقا
قوائم
إعجاب
احب37:01
Code scanning is one of the oldest appsec practices. In many cases, simple grep patterns and some fancy regular expressions are enough to find many of the obvious software mistakes. Scott Norberg shares his experience with encountering code scanners that didn't find the .NET vuln classes he needed to find and why that led him to creating a scanner from scratch. We talk about some challenges in testing tools, making smart investments in engineering time, and why working with .NET's compiler made his decisions easier. Segment Resources: - https://github.com/ScottNorberg-NCG/CodeSheriff.NET Show Notes: https://securityweekly.com/asw-317…
A
Application Security Weekly (Video)

1 New SLAP & FLOP Attacks, OCSP Fades Away, DeepSeek's ClickHouse, OAuth 2.0 Security - ASW #316 34:47
34:47
التشغيل لاحقا
التشغيل لاحقا
قوائم
إعجاب
احب34:47
Speculative data flow attacks demonstrated against Apple chips with SLAP and FLOP, the design and implementation choices that led to OCSP's demise, an appsec angle on AI, updating the threat model and recommendations for implementing OAuth 2.0, and more! Show Notes: https://securityweekly.com/asw-316…
A
Application Security Weekly (Video)

1 Threat Modeling That Helps the Business - Sandy Carielli, Akira Brand - ASW #316 36:54
36:54
التشغيل لاحقا
التشغيل لاحقا
قوائم
إعجاب
احب36:54
Threat modeling has been in the appsec toolbox for decades. But it hasn't always been used and it hasn't always been useful. Sandy Carielli shares what she's learned from talking to orgs about what's been successful, and what's failed, when they've approached this practice. Akira Brand joins to talk about her direct experience with building threat models with developers. Show Notes: https://securityweekly.com/asw-316…
A
Application Security Weekly (Video)

1 Opengrep & Semgrep, Hacking Subarus, Hacking Synths, Stealing Cookies, and RANsacked - ASW #315 34:57
34:57
التشغيل لاحقا
التشغيل لاحقا
قوائم
إعجاب
احب34:57
An open source security project forks in response to license changes (and an echo of how we've been here before), car hacking via spectacularly insecure web apps, hacking a synth via spectacularly cool MIDI messages, cookie parsing problems, the RANsacked paper of 100+ LTE/5G vulns found from fuzzing, and more! Show Notes: https://securityweekly.com/asw-315…
A
Application Security Weekly (Video)

1 Security the AI SDLC - Niv Braun - ASW #315 33:38
33:38
التشغيل لاحقا
التشغيل لاحقا
قوائم
إعجاب
احب33:38
A lot of AI security boils down to the boring, but important, software security topics that appsec teams have been dealing with for decades. Niv Braun explains the distinctions between AI-related and AI-specific security as we avoid the FUD and hype of genAI to figure out where appsec teams can invest their time. He notes that data scientists have been working with ML and sensitive data sets for a long time, and it's good to have more scrutiny on what controls should be present to protect that data. This segment is sponsored by Noma Security. Visit https://securityweekly.com/noma to learn more about them! Show Notes: https://securityweekly.com/asw-315…
A
Application Security Weekly (Video)

1 Appsec Predictions for 2025 - Cody Scott - ASW #314 52:10
52:10
التشغيل لاحقا
التشغيل لاحقا
قوائم
إعجاب
احب52:10
What’s in store for appsec in 2025? Sure, there'll be some XSS and SQL injection, but what about trends that might influence how appsec teams plan? Cody Scott shares five cybersecurity and privacy predictions and we take a deep dive into three of them. We talk about finding value to appsec from AI, why IoT and OT need both programmatic and technical changes, and what the implications of the next XZ Utils attack might be. Segment resources: https://www.forrester.com/blogs/predictions-2025-cybersecurity-risk-privacy/ Show Notes: https://securityweekly.com/asw-314…
A
Application Security Weekly (Video)

1 PyPI's Quarantine, Phishing & Awareness, Porting Fishshell to Rust, Cyber Trust Mark - ASW #313 31:43
31:43
التشغيل لاحقا
التشغيل لاحقا
قوائم
إعجاب
احب31:43
Design lessons from PyPI's Quarantine capability, effective ways for appsec to approach phishing, why fishshell is moving to Rust component by component (and why that's a good thing!), what behaviors the Cyber Trust Mark might influence, and more! Show Notes: https://securityweekly.com/asw-313
A
Application Security Weekly (Video)

1 Discussing Useful Security Requirements with Developers - Ixchel Ruiz - ASW #313 36:04
36:04
التشغيل لاحقا
التشغيل لاحقا
قوائم
إعجاب
احب36:04
There's a pernicious myth that developers don't care about security. In practice, they care about code quality. What developers don't care for is ambiguous requirements. Ixchel Ruiz shares her experience is discussing software designs, the challenges in prioritizing dev efforts, and how to help open source project maintainers with their issue backlog. Segment resources: https://github.com/ossf/scorecard https://www.commonhaus.org/ https://www.hackergarten.net/ Show Notes: https://securityweekly.com/asw-313…
A
Application Security Weekly (Video)

1 Removing Rust, Double Clickjacking, h3i CLI, JWT Mistakes, Reviewing Recursion - ASW #312 33:24
33:24
التشغيل لاحقا
التشغيل لاحقا
قوائم
إعجاب
احب33:24
Curl removes a Rust backend, double clickjacking revives an old vuln, a new tool for working with HTTP/3, a brief reminder to verify JWT signatures, design lessons from recursion, and more! Show Notes: https://securityweekly.com/asw-312
A
Application Security Weekly (Video)

1 DefectDojo and Bringing Quality Appsec Tools to Small Appsec Teams - Greg Anderson - ASW #312 33:48
33:48
التشغيل لاحقا
التشغيل لاحقا
قوائم
إعجاب
احب33:48
All appsec teams need quality tools and all developers benefit from appsec guidance that's focused on meaningful results. Greg Anderson shares his experience in bringing the OWASP DefectDojo project to life and maintaining its value for over a decade. He reminds us that there are tons of appsec teams with low budgets and few members that need tools to help them bring useful insights to developers. Segment Resources: https://owasp.org/www-project-defectdojo/ Three-quarters of CISOs surveyed reported being "overwhelmed" by the growing number of tools and their alerts: https://www.darkreading.com/cloud-security/cisos-throwing-cash-tools-detect-breaches As many as one-fifth of all cybersecurity alerts turn out to be false positives. Among 800 IT professionals surveyed, just under half of them stated that approximately 40% of the alerts they receive are false positives: https://www.securitymagazine.com/articles/97260-one-fifth-of-cybersecurity-alerts-are-false-positives 91% of organizations knowingly released vulnerable applications, 57% of vulnerabilities are left unresolved by developers, 32% of CISOs deploy vulnerable code in the hopes it won’t be discovered, 56% of developers struggle to prioritize vulnerability fixes: https://info.checkmarx.com/future-of-application-security-2024 Show Notes: https://securityweekly.com/asw-312…
A
Application Security Weekly (Video)

1 Ancient Curl Bug, AWS re:Invent, Malware in NPM, Census III Report, MS OTP - ASW #311 35:35
35:35
التشغيل لاحقا
التشغيل لاحقا
قوائم
إعجاب
احب35:35
Curl's oldest bug yet, RCPs (and more!) from AWS re:Invent, possible controls for NPM's malware proliferation, insights and next steps on protecting top 500 packages from the Census III report, the flawed design choice that made Microsoft's OTP (successfully) brute-forceable, and more! 00:00 - Intro & Cyber Resilience Insights 01:20 - The 25-Year-Old Curl Bug Story 04:17 - Fuzzing for Security: A Missed Opportunity? 08:46 - AWS re:Invent Security Highlights 11:54 - NPM Malware Surge 16:33 - Small Packages, Big Risks in NPM 19:55 - Open Source Security Trends 24:27 - Microsoft MFA Vulnerability Explained 28:28 - Hardware Hacking & DMA Exploits 30:55 - Auditing Ruby’s Package Ecosystem 34:02 - Looking Ahead to 2025 Show Notes: https://securityweekly.com/asw-311…
A
Application Security Weekly (Video)

1 Applying Usability and Transparency to Security - Hannah Sutor - ASW #311 34:09
34:09
التشغيل لاحقا
التشغيل لاحقا
قوائم
إعجاب
احب34:09
Practices around identity and managing credentials have improved greatly since the days of infosec mandating 90-day password rotations. But those improvements didn't arise from a narrow security view. Hannah Sutor talks about the importance of balancing security with usability, the importance of engaging with users when determining defaults, and setting an example for transparency in security disclosures. Segment resources https://youtu.be/ydg95R2QKwM 00:00 Welcome to Application Security Weekly! 01:49 Meet the Experts 03:28 What Are Non-Human Identities? 06:17 Balancing Security & Usability 08:24 MFA Challenges & Admin Security 12:09 Navigating Breaking Changes 16:05 Security by Design in Action 18:42 Identity Management for Startups 20:18 Secure by Design: Real Impact 24:03 Transparency After a Critical Vulnerability 31:39 Looking Ahead to 2025 32:45 Application Security in Three Words Show Notes: https://securityweekly.com/asw-311…
A
Application Security Weekly (Video)

1 AI's Junk Vulns, Web3 Backdoor, LLM CTFs, 5 GenAI Mistakes, Top Ten for LLMs - ASW #310 29:02
29:02
التشغيل لاحقا
التشغيل لاحقا
قوائم
إعجاب
احب29:02
Curl and Python (and others) deal with bad vuln reports generated by LLMs, supply chain attack on Solana, comparing 5 genAI mistakes to OWASP's Top Ten for LLM Applications, a Rust survey, and more! Show Notes: https://securityweekly.com/asw-310
مرحبًا بك في مشغل أف ام!
يقوم برنامج مشغل أف أم بمسح الويب للحصول على بودكاست عالية الجودة لتستمتع بها الآن. إنه أفضل تطبيق بودكاست ويعمل على أجهزة اندرويد والأيفون والويب. قم بالتسجيل لمزامنة الاشتراكات عبر الأجهزة.