Shows
Relating to DevSecOpsEpisode #081: Burnout by Budget Season: Surviving Q4 in SecuritySend us a textIn this candid and cathartic episode, Ken and Mike unpack the chaos that is Q4 for security professionals. From budget burnouts to end-of-year pentesting sprints, they explore why the final months of the year feel like a perfect storm for stress. Tune in as they share hard-earned lessons, practical advice for maintaining your sanity, and some gentle reminders that not everything needs to ship before Christmas. Whether you’re a tired vendor, an overwhelmed engineer, or just trying to make it to PTO, this episode is for you.
2025-10-3021 minRelating to DevSecOpsEpisode #080: Patch Me If You Can: Compliance, SLAs, and Other FairytalesSend us a textIn this no-punches-pulled return from hiatus, Ken and Mike dig deep into the messy middle of vulnerability management, SLA fatigue, and the illusion of compliance. Are we building secure systems or just passing audits? From legacy cruft to exploitable CVEs, this episode unpacks the real-world pressures of SOC 2, the auditor dance, and whether fixing every “critical” is even feasible.Perfect for practitioners trying to balance the checkbox culture with actual risk reduction, this one’s got stories, strategies, and spicy takes. Bonus: tips on managing auditors without losing your mind—or your sec...
2025-08-2534 min
What is Street Dance?Krump in Aotearoa: Mega History SpecialDive into the definitive, play-by-play timeline of New Zealand’s Krump community. Join us as we break down every key decade, every legendary event, and every figure that put Aotearoa on the Krump world map.In this loaded episode, you’ll hear about:Global Origins and First NZ Ripples (Pre-2010)The birth of Krump in 1990s California, pioneered by Thomas “Tommy the Clown” Johnson’s “Clowning” (1992) in Compton.The world-changing contributions of Ceasare “Tight Eyez” Willis, Marquisa “Miss Prissy” Gardner, Christopher “Lil’ C” Toler, and Jo’Artis “Big Mijo” Ratti.How the documentary "Rize" (2005) and DVDs like "Breakin’ vs Krumpin...
2025-06-2855 minRelating to DevSecOpsEpisode #079: CISOver It: When Dashboards Replace DirectionSend us a textIn this episode of Relating to DevSecOps, Ken and Mike discuss the challenges faced by CISOs in today's security landscape, particularly the struggle to balance immediate security needs with long-term preventative strategies. They explore the disconnect between security leadership and practitioners, the urgency of addressing security issues, and the importance of understanding the root causes of vulnerabilities. The conversation emphasizes the need for CISOs to engage more deeply with their teams and to focus on effective, context-driven security solutions rather than simply reacting to the latest threats.
2025-06-1037 minRelating to DevSecOpsEpisode #078: 🔥 Burn Your 30-page Policies: Tanya’s Got Better IdeasSend us a textIn this must-listen episode of Relating to DevSecOps, Ken welcomes the ever-inspiring Tanya Janca, aka SheHacksPurple—author, AppSec expert, and champion of making security usable. Together, they dig into why so many application security policies fail, why developers ignore them, and how to make them actually work. Tanya shares real-world experiences from both dev and security perspectives, plus her journey from being ignored to lobbying governments for change.From communication failures and TL;DR policy pages to leveraging wikis and code reuse, this episode is a practical masterclass in creating impactful, de...
2025-04-2246 minRelating to DevSecOpsEpisode #077: Is Google Eating the Cloud? 🔥 Wiz.io Acquisition Hot TakesSend us a textIn this episode of Relating to DevSecOps, Ken Toler and Mike McCabe dive deep into Google's blockbuster acquisition of Wiz.io for a reported $32 billion. They explore the implications for cloud security, the consolidation of the DevSecOps tooling landscape, and how this move compares to Google’s previous acquisitions like Mandiant and Chronicle. The duo debates the future of multi-cloud strategies, platform fatigue, and whether Wiz will remain the darling of the security community—or get lost in the labyrinth of Google Cloud products. With sharp insights and a dash of hot takes, they...
2025-03-2431 minRelating to DevSecOpsEpisode #076: ShmooBalls & Open Source Brawls: DevSecOps, Risk, and the Final ShmooConSend us a textWelcome to 2025! Ken and Mike kick off the new year with their security resolutions (or lack thereof) before diving into the bittersweet farewell to ShmooCon, one of the most beloved hacker conferences. Ken shares his experiences from the final event, including insights on hardware hacking, radio security, and the unique hacker culture that made ShmooCon special.They also unpack one of the most practical talks from the conference: a deep dive into open source security tools versus enterprise solutions, highlighting ways security teams can cut costs without sacrificing effectiveness. Speaking of...
2025-02-0433 minRelating to DevSecOpsEpisode #075: Ghosts of DevSecOps: Past, Present, and FutureSend us a textIn this special holiday-themed episode of Relating to DevSecOps, hosts Ken and Mike channel their inner Dickens with a retrospective journey through the "Ghosts of DevSecOps Past, Present, and Future." From lessons learned about security awareness and collaboration challenges of the past, to the growing pains and contradictions of today’s implementation of security basics, they explore it all. Wrapping up with a hopeful look at future innovations like policy-as-code and preemptive security measures, the hosts outline their visions for a more integrated and automated security future. Packed with insights, humor, and holiday sp...
2024-12-2436 minRelating to DevSecOpsEpisode #074: Battling Budgets in SecuritySend us a textIn this episode of Relating to DevSecOps, hosts Ken and Mike tackle the complex challenges of managing security budgets in organizations of all sizes. From small, scrappy teams to sprawling enterprises, they explore how security leaders can navigate tight financial constraints while maintaining strong security postures. They share insights on integrating security into IT operations, leveraging open-source tools, and rethinking traditional budget allocations. Whether you’re a CISO grappling with scaling or a developer looking to improve security outcomes, this discussion is packed with actionable strategies and thought-provoking debates on the future of se...
2024-12-0936 minRelating to DevSecOpsEpisode #073: Staffing Security in DevSecOpsSend us a textIn this episode, Ken and Mike discuss the pressing issue of staffing security in the DevSecOps field. They explore the challenges of finding qualified application security professionals, the importance of diverse backgrounds in security roles, and the paradox of understaffed security teams despite a high demand for cybersecurity jobs. The conversation also delves into strategies for mitigating staffing issues, such as empowering security champions within organizations, leveraging automation and tooling, and avoiding bottlenecks in security processes. Throughout the discussion, they emphasize the need for a balanced approach to security that considers b...
2024-10-2137 minRelating to DevSecOpsEpisode #072: Measuring the Immeasurable: The Power and Pitfalls of Metrics in DevSecOpsSend us a textKen and Mike dive deep into the world of metrics and measurement in the context of security and DevSecOps. They explore the critical role metrics play in driving security improvements, from tracking vulnerabilities to gauging the effectiveness of incident response. The hosts discuss what makes a good metric, the importance of aligning metrics with business goals, and the dangers of relying too heavily on numbers alone. They also tackle the challenges of quantifying "squishy" aspects like culture and training effectiveness. Whether you're a seasoned security professional or just getting started, this episode offers...
2024-08-2833 minRelating to DevSecOpsEpisode #071: Retro Vibes with RetrospectivesSend us a textKen and Mike discuss the importance of postmortems in incident response and security incidents. They explore the definition of postmortems, the value of reflection, the challenges of blame, and the significance of actionable outcomes. They also touch on the transparency of postmortems and the need for root cause analysis. The conversation concludes with a brief announcement about an upcoming conference series.
2024-06-1925 minRelating to DevSecOpsEpisode: #070: Putting da BOM in SBOM and SCASend us a textKen and Mike discuss supply chain security, including software composition analysis (SCA) and software bill of materials (SBOM). They highlight the importance of understanding the components that make up your software and the risks associated with using third-party libraries. They also discuss recent supply chain failures, such as the XZ library hack and the SolarWinds attack. The hosts emphasize the need for organizations to stay up to date with software patches and to consider the security of commercial off-the-shelf software. They caution against placing too much focus on any one security tool or...
2024-05-0839 min
✮✮✮ Mme GAULTIER ✮✮✮Transistor #22 by Mme GaultierPlaylist Transistor #22
1/ Larry Houl/Papillon/Yasbadas « Funky Woman »
2/ Ken@Work « Jamaica Funk »
3/ Solid State « Can U Rock »
4/ Hotmood « Copacabana »
5/ Ben Banjo « Tumbala »
6/ Happy Gutenberg « Beijo »
7/ Ladies On Mars « You Can Do It! »
8/ Dave Leatherman, HP Vince & Bruce Nolan « Bahama Funk »
9/ Raffaele Ciavolino « Oh No »
10/ Alexny « Just Need A Time Out »
11/ Mousse T., Ninetoes, TTeo « Holdin' On To Your Love »
12/ Aron Scott,Baseek,Lydia Scarfo,Stephane Deschezeaux « Don't Move Alone »( Stephane Deschezeaux Remix)
13/ Funkatomic, Din Jay, Emory Toler « Supaconstellation » (Funkatomic Mix)
14/ B3RAO « El Calor »
2024-04-061h 00Relating to DevSecOpsEpisode #069: Your SaaS is GrassSend us a textIn this episode Mike and Ken dive into the wild world of SaaS products in DevSecOps. From vendors to security tooling hygiene they cover an often overlooked ecosystem of cloud and software services that may be rotting in the sky of your workloads. Join up for a listen on SaaS Security!
2024-03-2032 minRelating to DevSecOpsEpisode #068: Data Breaches and DevSecOpsSend us a textWith pep and full youtube energy Ken and Mike discuss the findings of the IBM "Cost of a Data Breach" report and its implications for DevSecOps. They highlight the importance of integrating security into every phase of the software development life cycle and the positive impact it can have on reducing the cost of a data breach.
2024-02-2134 minRelating to DevSecOpsEpisode #067: Welcome to 2024! AppSec Resolutions and A Smhoocon RecapSend us a textKen and Mike discuss their new year's resolutions related to application security. They also reflect on the impact of AI and its adoption in the industry. The hosts share their experiences attending conferences and highlight interesting talks on topics such as zero-day vulnerabilities and fuzzing LLM models. They discuss the OWASP LLM Top 10 and the evolving perception of AI in the industry. The conversation concludes with a discussion on the definition of DevSecOps and how it has evolved over time, as well as their predictions for DevSecOps in 2024.
2024-01-2635 min
Our True Crime PodcastThe Glynn County Massacre: Guy Heinze Jr Day 8: 12 Nightmares Before ChristmasWelcome to Our True Crime Podcast’s original “12 Nightmares Before Christmas,” where we discuss a true crime story daily for the days leading up to December 24. Make sure to like, subscribe, and tune in each day.It's already day 8!On an August morning in 2009 in Brunswick, Georgia, twenty-two-year-old Guy Heinze Jr returned to the trailer that he shared with nine family members. When he stepped inside, he found the beaten bodies of seven people: his father, Guy Sr, Russell Toler Sr, Russell Jr, Michelle and Chrissy Toler, Brenda Falagan, and Joseph West. Michael Toler and Chrissy's three...
2023-12-211h 05Relating to DevSecOpsEpisode #066: Exploration of the Shifting Definition of Shifting LeftSend us a textWe are joined by incredible guests Mikhail Chechik and Marcus Hallberg as they help us define DevSecOps and emphasize the importance of a security mindset throughout the development process. These two incredible folks explore common misconceptions about shifting left and discuss the challenges of triaging and validating vulnerabilities early in the development lifecycle. We enter in the wild world of this wonderful shifting buzzword and how it applies to incident response, design, people, and the general development process.
2023-12-0542 minRelating to DevSecOpsEpisode #065: LASCON 2023 Recap - AI, a Misunderstood Menace or Magic BulletSend us a textOn this episode of R2DSO Mike and Ken dive into their takeaways and experiences from LASCON 2023 in Austin, TX where AI was both a problem child and praised bringer of salvation in security. Vendors and companies alike are embracing AI with wide eyes and there was no shortage of talks, presentations, and hallway conversations about the topic. Beyond that security is fast accepting that they can't be the department of "No" a consistent theme here on the podcast. The team had a fantastic time at LASCON and we're happy to see where...
2023-11-1133 minRelating to DevSecOpsEpisode #064: Don't Instigate, Mitigate!Send us a textIn this episode Ken and Mike dive directly into the meat with solutioning and mitigation. All too often security professionals finding themselves falling into the trap of focusing on vulnerability counts, evangelizing findings, and playing the age old game of red, yellow, green. We jump straight into the why of this focus in the industry and offer some ideas on how to get out of it successfully. If you're interested in a conversation about solving problems rather than just identifying them, hop on in!
2023-09-2631 minRelating to DevSecOpsEpisode #063: Unscrambling CloudSecSoup with CSPM, Vuln Management, SIEMs, and Log AggregatorsSend us a textIn today's episode, we untangle the web of alphabet-soup technologies: CSPM, VM, SIEM, and Log Aggregators. We go beyond the buzzwords to give you a no-nonsense look at how these tools fit together, complement each other, or might even replace one another in specific use-cases. Selecting the right tool can be overwhelming, and we're here to guide you through the when, where, and how of leveraging these technologies effectively. Whether you're encountering overlapping features or unique challenges, we'll help you make a savvy, informed choice for your workloads. Tune in for a practical...
2023-09-0537 minRelating to DevSecOpsEpisode #062: Cyber Sentinels: Ken and Mike in the DevSecOps LabyrinthSend us a textDive headfirst into AppSec and Terraform security with Ken and Mike in this electrifying podcast episode. They demystify complex security concepts, offer golden nuggets on Cybersecurity programs as a DevSecOps concept, and provide a rare glimpse into the high-octane training sessions they're delivering at BlackHat, Defcon, and Lascon. This episode is a view into building resilient security programs, tackling compliance challenges, and comparing bug bounty programs and pentests. Brimming with empathy and passion, it’s a captivating blend of strategic insights and practical advice for navigating modern cybersecurity landscapes. Tune in, soak up the...
2023-08-0740 minRelating to DevSecOpsEpisode #061: Fossilized Code & Future Clouds: Contrasting Worlds of Balance in Legacy ApplicationsSend us a textKen and Mike dive into the exciting world of modern application and cloud security, with a keen focus on the challenges posed by legacy systems. They explore the hurdles faced when dealing with older applications written in stalwart languages like Java, .NET, Rails, and Python, and shed light on the complexities of addressing security issues in these systems. Join them as they discuss everything from slow performance and resistance to change to the intricate nature of large monolithic applications.In addition, they tackle the concept of security absolutism and highlight the...
2023-07-1839 minRelating to DevSecOpsEpisode #060: Precise Angles for Automation in DevSecOps AdventuresSend us a textIn this captivating episode of R2DSO hosts Ken and Mike embark on an exploration of security automation in the realms of application and cloud security. With a a keen understanding of the pitfalls, they emphasize the need for precision, consistency, and repeatability. Stepping beyond the traditional confines of scanning, and automation techniques destined for failure, they offer insightful analogies and practical advice, empowering listeners to harness the true power of secure automation. Join this engaging conversation tailored for technical application security enthusiasts and discover the keys to unlock a new era of...
2023-06-2256 minRelating to DevSecOpsEpisode #059: DevSecOps Pentesting, Possible or Preposturous?Send us a textIn this action-packed episode, Ken, Mike, and Izzy (Ken's cat) dive headfirst into the wild world of DevSecOps Penetration Testing – is it possible or downright preposterous? Can we truly automate pentesting in this breakneck DevSecOps environment, or are we chasing a cybersecurity unicorn?Discover the vital distinction between red team operations and adversarial simulations within the DevSecOps landscape. We strip back to basics, defining penetration testing and its critical role in security programs we're talking practical, actionable insights into building robust pentesting into your CI/CD pipelines and vulnerability management by le...
2023-06-0843 min
The Evolution Exchange Cyber Security PodcastEvo Cyber Security #36 - AI & Machine Learning in Application SecurityIn this episode of Evo Cyber Security, host James Price delves into the world of AI and machine learning in application security. Joining him are three esteemed guests who bring their expertise to the table. Ken Toler, the Director of Application Security at Kudelski Security, offers valuable insights. Prathyusha Muddasani, the Application Security Manager at Compass Group USA, shares her experiences in the field. Lastly, Johnny Walters, the Application Security Program Manager at Ascena Retail Group, contributes his knowledge to the discussion. Tune in to gain a deeper understanding of the intersection between AI, machine learning, and application security.
2023-06-0841 minRelating to DevSecOpsEpisode #058: Merging Your Mergers without Git MergeSend us a textMike and Ken dive into the exciting topic of Mergers and Acquisitions. Take a bit of time out of your day to join them in their explorations of how M&As have affected operations for clients, companies, and security teams. Today they discuss techniques, trials, tribulations, and methods for tackling the joining of two companies, organizations, and teams bringing real scenarios from their own experiences
2023-06-0133 minRelating to DevSecOpsEpisode #057: Security Without Compromise!Send us a textJoin Mike and Ken as they discuss collaborative security work and what working together looks like in enterprise and organizations. In an effort to help people make better security decisions, in this episode they cover avoiding silos, working effectively together, picking your battles, reframing the security conversation with engineers, and using security as an enabler.Now Available on YouTube:https://youtu.be/HDOWGqmaILc
2023-05-1930 minRelating to DevSecOpsEpisode #56: Respond Well in Incident Response with DevSecOpsSend us a textJoin Mike and Ken in their discussion about Incident Response and how it fits into the DevSecOps world and arena. Incident Response, logging and monitoring are hard problems to solve and Mike has some strong opinions on how to leverage and use native tooling to prepare and respond to incidents in your environment. Understanding logs, what to do with them, and how to filter through all of the noise are all covered in this episode. Mike and Ken also mention some tools and techniques you can start using for free today. Apologies for...
2023-04-2134 minRelating to DevSecOpsEpisode #055: Engineering Empathy with Hecber CordovaSend us a textWe dive back into bringing guests onto the show focusing on real problems with real people on the ground. In this episode, we are joined by Hecber Cordova, Director of Cloud Security at RBC. He shares insights around growth into DevSecOps, developing empathy with your engineering teams, creating cloud patterns, paved paths, and building secure architectures from the ground up. If you're interested in hearing from someone who has built strong security cultures in large institutions this is an episode to listen to!Links mentioned on the show:https://cloudseclist...
2023-03-3142 minRelating to DevSecOpsEpisode #54: ChatGPT's Cryptic Insights: AI in Security for Developers and Operations TeamsSend us a textIn this episode, Mike and Ken will dive deep into the world of ChatGPT and explore how it can be used to generate code for developers and operations teams. They'll discuss the benefits and drawbacks of relying on AI for security, and how it can be used to improve the security posture of your organization.But that's not all - Mike and Ken will also explore the challenges that come with scripting examples such as terraform, AWS, Azure, and python scripting for data structures. They'll share their experiences and insights into...
2023-03-2336 min
Conversations on the CreekHow We Built Duck Creek with Andy YohnOn this episode of Conversations on the Creek, Rob Savitsky sits down with Duck Creek Co-Founder and VP of Product Strategy, Andy Yohn, to discuss the founding and evolution of Duck Creek.
We start off by discussing the early days at the company, and how in the year 2000, Andy teamed up with co-founders Doug Roller, John Roller, Becky Roller, Kerrick Tweedy, Barry Tate, Ken Toler and high school graduate, Devon Clasby to build a low-code, rating engine that would forever change the way that P&C insurers would build and manage insurance products.
From there...
2023-03-1430 minRelating to DevSecOpsEpisode #053: DevSecOps on the Emerald Isle: Insights from Global OWASP AppSec Dublin, with a Side of Guinness and Frustrations with Application Security VendorsSend us a textIn this episode, our hosts recap the Global OWASP AppSec Dublin conference and share insights into interesting talks about DevSecOps. They delve into the challenges and opportunities that come with securing modern applications in a dynamic and ever-changing landscape. The hosts also share their frustrations with application security vendors in the space and discuss potential solutions to overcome these challenges. Along the way, they also share their experiences in Dublin. Tune in for a candid and engaging conversation about DevSecOps, the future of application security, and the Irish experience.To view...
2023-03-0841 minRelating to DevSecOpsEpisode #052: Dude! Where's My Stuff? Application Inventory and Service DiscoverySend us a textToday's episode covers one of the most common problems for software development teams and their security partners. Application Inventory. App Inventory brings to mind different struggles and difficulties for teams and even Ken and Mike have a few different experiences in approach. The team breaks apart some differences between asset inventory, software constellations, service discovery, and api security.If you want to meet and greet, come see us in Ireland at OWASP Global Dublin 2023!
2023-02-0728 minRelating to DevSecOpsEpisode #051: Hiring for DevSecOps in 2023!Send us a textHappy New Year! Another year of DevSecOps fun as we head into an unpredictable and volatile security market, Ken and Mike talk hiring and the struggle between having a ton of talented passionate junior talent and a security mission that requires experienced individuals with a limited budget. Inadequate staffing, the reality of security vs engineering budgets, bridging the talent gap with internships and an all call to organizations to fund security programs are all hot topics in the first episode of the new year.If you're looking to think about some...
2023-01-1450 minRelating to DevSecOpsEpisode #050: The Evolution of Data Security in DevSecOpsSend us a textWe hope all of the turkey comas have worn off! These holiday delays are almost over, and in the meantime here we are with the second part of how security verticals fit into the great sprawling world of DevSecOps! Mike and Ken discuss migration fro on prem to cloud and how this shift has had a tremendous effect on the perception of data security. It's become easier and easier to spin up data storage solutions in cloud and infrastructure as code, but it's lead to some common and repeated mistakes that rear their...
2022-12-0334 minRelating to DevSecOpsEpisode #049: IAM! The Myers Briggs of DevSecOpsSend us a textIt's been tough getting together with the end of year madness, but we're back again after another unanticipated delay. In this episode, we take some time to cover how IAM fits into the greater idea and methodology of DevSecOps. We cover how we think of IAM in today's code driven world and go through some thoughts, opinions, and scenarios around IAM. In the next few episodes we'll be covering how other security verticals like data, incident response, and endpoint detection/response meet application and cloud security horizontals.Videos are coming before...
2022-10-2437 minRelating to DevSecOpsEpisode #048: Threat Modeling doesn't need to feel like pain and sorrowSend us a textWe are back from vacation! Pick up where you left off as we jump back into DevSecOps with threat modeling experiences, lessons, and perceptions we've seen in our day to day. After getting through a bit of a slow start, we revisit this topic all the way back from episode 3 where we got the hot takes on threat modeling from our resident devops and software engineering representatives Jamieson and Simon. Here we unpack a bit of how to get started in threat modeling, approaches we've seen that have worked and failed, and some...
2022-09-1642 minRelating to DevSecOpsEpisode #47: Geese aren't the only things migrating in the cloud, but we're more secure at leastSend us a textOne thing Mike and Ken have talked about at length at conferences, in board rooms, and in team chats is migrating workloads to the cloud security. Join them as they discuss the migrating patterns, how they vary between your favorite cloud service providers, and just where security fits into the whole mess. From on prem, refactoring, lift and shifted, native cloud workloads, or just someone else's computer, we have enough buzzwords to knock your socks off this time around
2022-08-0837 minRelating to DevSecOpsEpisode #046: Security Spiderwebs with Kubernetes and how Cloud helps (and hurts)Send us a textWe are BACK! after a hiatus of vacations, illness, and family gatherings, but while we may have been absent we are at no shortage of words to say and hope you enjoy our conversation about Kubernetes and the variety of flavors cloud service providers have to offer. From EKS through GKE and AKS we cover security concerns and challenges we've seen in the last few months. We talk about why teams choose to implement one of the other and how you might think about locking down your own Kubernetes instances. Through that we...
2022-07-1136 minRelating to DevSecOpsEpisode #045: What is DevSecOps in 2022 an R2DSO anniversary reduxSend us a textMike and Ken take it back to the roots with a special anniversary episode on what is DevSecOps. Since we started this podcast we've had a lot of topics that fit the overall DevSecOps buzzsord, but in this episode we talk about some of the evolution DevSecOps has gone through, how it's perceived in the industry and market today and some hot takes on what's changed. The good, the bad, and the ugly. We leave it to you to decide, has DevSecOps lost it's marketing shine and buzzword status?
2022-06-1035 minRelating to DevSecOpsEpisode #044: Multiball Pinball with Multicloud Hot Takes and Infrastructure as CodeSend us a textMike and Ken are BACK after a small hiatus and they jump into hot takes on multi-cloud. What does multi-cloud even mean? How does it differ from hybrid cloud, private cloud, or even just the status quo data center. The hosts discuss integration of products and projects into a multicloud deployment, security concerns associated with the approach, and how it differs from the horrors and challenges in private cloud and hybrid cloud. The team talks resources, talent, hiring, and what challenges they've faced over time shifting organizations into cloud deploymentsAs t...
2022-05-2137 minRelating to DevSecOpsEpisode #043: Security leaves the cave to go to Miami with the Blockchain People and this episode happenedSend us a textKen had a chance to attend a blockchain conference for Solana out in Miami and Mike hops into the interviewer seat. We talk about some differences between the approach. With a heavy builder community we chat through the build it on site mentality of Solana devs and the driving market that is new and novel blockchain ecosystems. From new projects, industry verticals, and everything from gaming to sports betting. We give you some hot takes and first looks at Solana Miami.
2022-04-2134 min
Absolute AppSecEpisode 167 - Ken Toler - Cryptocurrency, Spring4ShellA pair of Kens. A quick discussion on Spring4Shell and how the exploit takes advantage of Java's dynamic configuration options along with a data binding aka mass assignment vulnerabilities. Ken Toler (@relotnek) joins the show to discus the current web3 security landscape and how security can be involved in cryptocurrency projects. "There is a place for you in crypto" - @relotnek
2022-04-0500 minRelating to DevSecOpsEpisode #042: Perscription Lenses or Sunglasses for Eyes on CodeSend us a textIn this Episode we talk about the differences in code review depending on role and how you can be a better code reviewer on the "blue" side. Sometimes security tends to think in breaks and hacks, but we talk about how to think and act like a secure developer. Continuing the theme of systemic fixes, we discuss how difficult it can be to review small segments of code without context, how code reviews change when you move internal, and what you can do about it.
2022-03-3134 minRelating to DevSecOpsEpisode #041: Holistic Cloud Medicine in the Face of the Modularization of Cloud Components Affects ApplicationsSend us a textA continuing trend in cloud and application security has been the modularization of application functions that offloads the developer responsibility for security and even some development! We cover how these cloud legos affect secure architectures, how the assessment paradigm shifts to configuration, how traditional silos such as #cloudsec, #netsec, and #appsec change. Mike brings a real world scenario and provoking thoughts around how we can possibly call something secure if we don't understand all the cards and players. In this episode Mike coins the phrase of holistic medicine in cloud. As l...
2022-03-1731 minRelating to DevSecOpsEpisode #040: Over the hill with blockchain and DevSecOps with digital moneySend us a textIn this episode we introduce the general concepts of security in cryptocurrency in blockchain, what we see in our day to day with regard to application security and devsecops. We cover developer personas, cloud, centralized organizations, the difference in transparency, compliance, and frustrations as Mike grills Ken and teases out a tangent or two.
2022-02-2536 minRelating to DevSecOpsEpisode #039: Cloud Metal Detectors with Monitoring and LoggingSend us a textIn this episode we cover another security perspective on logging and monitoring in the cloud as opposed to web applications specifically. We dive into Mike's view on how logs and software defined infrastructure evolve in the world of incident response and detection today. With the propagation of infinitely scalable cloud environments, we dive into ways to wrangle logs and make sense of the information these environments generate. Whether it's automation or filtering, we get this conversation started with the cloud side of DevSecOps
2022-02-1632 minRelating to DevSecOpsEpisode #038: Layers of the DevSecOps Onion, are we reversing time?Send us a textIn this episode Mike and Ken talk about the magic of software defined things and how skill crossover is becoming a thing of the future. Maybe history is repeating itself. Whether it's endpoint detection and response, physical security, disaster recovery, networks, or a firewall, it seems like everything has a software defined equivalent. Developers and Application Security engineers are being called on more and more to know things they didn't have to even 5 years ago. The team digs into this topic by looking at it through two lenses, what skills engineers n...
2022-02-0235 minRelating to DevSecOpsEpisode #037: New Year, New Security what can you do to level up?Send us a textHappy New Year from R2DSO as we head into 2022. In this Episode we bring back Michael McCabe for a more permanent role on the show! Super exciting for us and hopefully for you. We talk about our plans for the future of the show including interactive components, video, and expansion on the existing repository. We also take some time to talk about trends in security skills that organizations are looking for and what types of programming languages are hot in the industry right now. Join us for a light-hearted come back as...
2022-01-1935 min
The Application Security PodcastKen Toler -- Blockchain, Cloud, and #AppSecKen Toler is a principal consultant at Kudelski Security and is passionate about building and optimizing application security programs that stick through strong adoption and ease of use. Ken has spent considerable time on all sides of the security aisle from playing defense and managing security teams to offense by breaking applications and reviewing code. Ken is also the host and creator of the Relating to DevSecOps podcast that focuses on forging strong relationships between engineers, operations, and security through collaboration, understanding, skill-sharing, and healthy debate. Ken joins us to talk about all things Blockchain and AppSec. We define...
2022-01-1844 minRelating to DevSecOpsEpisode #036: Trending Topics from Terraform to TestingSend us a textIn this alliterative episode we bring back Mike McCabe to wrap up a security year in consulting with common trends and successes in security. On the back of Ken and Mike's talk at LASCON 2021, these two break down some of the common security themes from clients and scenarios that highlight just how we've progressed in an almost fully remote year of work. AppSec programs, maturity, compliance, transferring risk, and infrastructure as code are just a few of the topics we chat through We know it's been a while since we've laid down some...
2021-12-0738 minRelating to DevSecOpsHappy Holidays from R2DSO!Send us a textWe've had a bit of an end of year rush so just wanted to give listeners a preview of what's to come in the next few episodes. We're laying down the tracks now and should have something out the door early December. Thanks for all of your support and feedback. We're looking forward to getting back into the studio!
2021-11-2401 minRelating to DevSecOpsEpisode #035: Successful Unit Testing Through Collaboration with Your UnitSend us a textWe know, we know! It's been too long between episodes, but we had some speaking engagements, conferences, and general life going into November and here we are.In this episode we cover unit testing, what it means to security vs what it means to engineers and some learning along the way as we dig into what makes a good unit test. All to often security engineers are telling development teams they need to write security unit tests, but they don't say how or what to write. We go through definitions, potential...
2021-11-0241 minRelating to DevSecOpsEpisode #034: Attack of the Git PR through K8sSend us a textIn this episode we squeeze one more git topic out with an attack through a PR. Based on a recent article posted on https://cloudseclist.com/ we thought it fit the series pretty well and put a nice capstone on everything. You can read the article we reference yourself at https://goteleport.com/blog/hack-via-pull-request/ This episode is full of hot takes and rambling, but we thought we ended in a good place even if we went through a few roundabout analogies to get there. Learn more about how security relates to...
2021-10-1142 minRelating to DevSecOpsEpisode #033: Getting out of git by branching out with branching strategiesSend us a textBad puns end this series with branching strategies and git. We start with Simon's preferred approach from a product engineering strategy for branching and why it works for him. Then we talk about some of the common issues that occur due to strategies that are not optimized for the organization running them. Some of these include over engineering, cultural frustrations, re-work, and security bugs! Join us for the capstone of the git series in 2021, hope you enjoy the listen
2021-09-2132 minRelating to DevSecOpsEpisode #32: Hooks, Kits, and Git - putting security into your git pipelineSend us a textIn this episode we cover a few technical topics, but primarily how to get started with getting security into your git pipeline through git hooks, pre-commit strategies, secrets analysis, and scan automation. We also cover some best practices that help engineers and developers stay security minded throughout their time in the repository. We hope you have as much fun listening as we did recording!
2021-09-0739 minRelating to DevSecOpsEpisode 031: Git Security Done with GitSend us a textWe head into an unknown number of episodes around git. In this episode we introduce git and common security concerns to folks who may be unfamiliar with either. Git is an essential skill for security practitioners and engineers and sometimes we're just winging it when it comes to doing things right (or at least our opinion of right). We cover differences between rebase and merge, common commands that become problems down the road, and some problems we've face in our careers with using, evaluating, and analyzing code in a repo.
2021-08-1737 minRelating to DevSecOpsEpisode #030: Blueprints, Reference Architectures, and Plans - Building Apps SecurelySend us a textIn this episode we chat blueprints, security patterns, reference architectures, and plans. Basically what we've seen in terms of the left hand side of the SDLC in establishing requirements early. This topic came about after reading the recent AWS Security reference architecture and grappling with implementation. We get pretty metaphor and analogy heavy in this one with some examples that may or may not make sense. Ultimately, these things work! We've seen them in the real world in a variety of samples, and hopefully you'll use them tooAWS Security...
2021-07-2634 minRelating to DevSecOpsEpisode #029: Does anyone REALLY do DevSecOps, and succeed?Send us a textIn this somewhat makeshift, low-power episode recorded during the NYC power grid strain we do our best at getting inventive with recording techniques. Topic of the day is does DevSecOps really work? We discuss some of our failures, frustrations, and successes with DevSecOps. We also cover things you can do to succeed with DevSecOps techniques. While it may seem like fighting an uphill battle in security automation and all of these fancy modern security practices, we share some stories and methods to make sure these things stick.
2021-07-0730 minRelating to DevSecOpsEpisode #028: Non-technical management and Email as your IDESend us a textEpisode number 28 moves us back to a more people focused topic as we dive into technical vs non-technical management, leadership, management styles, how we've approached managers and management in our careers, and general hot takes on leadership and management in the DevSecOps world. Opinion heavy in this one and while this isn't management advice, hopefully it sparks some ideas and avenues of thought for our listeners.Referenced in this episode:Extreme Ownership:https://echelonfront.com/extreme-ownership/The first 90 Days:https://www.amazon.com/First-90-Days-Strategies-Expanded/dp/1422188612
2021-06-2257 minRelating to DevSecOpsEpisode #027: Hot Takes on Blogs: Part I - Are QA, BA, and DBAs Dead?Send us a textIn this react video of a podcast we have a look at a recent blog post on whether the QA, DBA, and BA jobs are going away in favor of more consolidated roles in development such as the full stack engineer and cloud services like abstracted databases. Simon baits Ken into a reaction since security is excluded, but eventually conclusions and comparisons are drawn to the security industry and just how important these role functions are in today's modern workloads. Thanks to Simon for bringing the bait and to the author fo...
2021-06-0334 minRelating to DevSecOpsEpisode #026: Starting right by shifting left - what to do at build timeSend us a textAfter such a fun conversation last week, we bring Mike back in to discuss applying security at build time and what we can do with infrastructure as code through linting and early analysis. We break down the difference between Linting, Policy as Code, and SaaS and talk about how each of these might fit into your workloads. Plus! As a security practitioner, what you can do to move the ball forward in automated testing and security in your CI/CD pipelines. We got it back down to 30-ish minutes and hope you enjoy...
2021-05-2133 minRelating to DevSecOpsEpisode #025: Warm blankets around your cloud with CSPM and Michael McCabeSend us a textEpisode 25 is all about CSPM and our good friend Michael McCabe. Mike has a ton of experience securing application and cloud workloads and we break down how CSPM fits into the larger landscape of DevSecOps. Whether you look at it as the first step, last step, catch all, or waste of money, we break down ways a CSPM can be a valuable part of your cloud strategy and DevSecOps. In the worlds of buzzwords, hot air, and the security hype train, Mike has all kinds tips and tricks around navigating cloud, i...
2021-05-1156 minRelating to DevSecOpsEpisode #024: The first line of defense for MicroServices - AUTHSend us a textAnd that means authentication and authorization. Once you start splitting up the monolithic apps and iterating faster and faster, how does your mindset on security change? Simon and I have our own opinions, but we're starting with authentication and authorization on this episode as well as some ideas that come to mind when organizations take their first microservices steps. It's only one part of the mystery, but an important consideration! Hoping you all get something out of this.In episode #25 we will be taking a break on the microservices side and...
2021-04-2639 minRelating to DevSecOpsEpisode #023: A call back to Microservices - do we even get it yet?Send us a textKen and Simon talk engineering and security ramifications of microservices, why organizations choose to split up their treasured applications and cut them into bite size pieces for ease of use and maintenance. As with most technological advances - the best outcomes come from good implementation so SImon and Ken talk about some real world experiences, some things to think about, and some overarching microservices topics. This will probably be a two-parter so stay tuned for even more on this huge (but complex and isolated) topic.
2021-04-1033 minRelating to DevSecOpsEpisode #22: From Engineer to CTO and what security means along the way w/ Jonathan SchwartzSend us a textAn exciting episode indeed! Jon Schwartz the CTO of Jetty joins us in a discussion about security through his career, leadership guidance, and how to align with all roles in your organization. Hear some real world examples of security, engineering, and devops working together towards a common goal and listen in to learn how to use a new perspective to bring security to the table. We really enjoyed this conversation! A big thanks to Jonathan for coming onIf you'd like to learn more about Jetty you can find them at...
2021-03-1242 minRelating to DevSecOpsEpisode #021: An Outside-In Look at Application InventorySend us a textKeeping with the SecOps theme the crew discusses Application Inventory, arguably the most important part of any successful application security program. Challenges are always there in keeping an accurate and robust inventory, and with a focus on assets Jamieson, Ken, and Simon discuss what they want out of an inventory and how you might look at it from the outside in when dealing with a world of ever changing application environments that can differ from hour to hour.
2021-02-2733 minRelating to DevSecOpsEpisode #20: Security Operations ain't what it used to beSend us a textSimon, Ken, and Jamieson ponder what Security Operations brings to the table and discuss some of the misconceptions around responsibilities of security operations folks in the wild. A high-level episode exploring what SecOps means, and how it fits into the overall security dynamic of DevSecOps. We touch on the direction of the industry in SOAR and hit on the immaturity of SecOps in organizations as compared to other operations teams. We do hope you enjoy
2021-02-1437 minRelating to DevSecOpsEpisode 019: Welcome to 2021 - R2DSO goes visual and moreSend us a textWith Jamieson out of commission, Simon and Ken chat and relfect on 2020. In this episode we cover some of our favorites and look towards the future with what's to come for DevSecOps in 2021. While Jamieson's there in spirit we take the opportunity to get one last Perl joke in. In 2021 we will be bringing video tutorial content, more guests, and deeper dives into topics with a git repo to follow along. We hope you'll join us for the ride and thanks for a great start!References in this Podcast:
2021-01-2531 minRelating to DevSecOpsEpisode #18: Was 2020 just a giant Chaos Engineering Experiment? Part Deux: Tooling and Security ExperimentsSend us a textIn our final episode of 2020 we dive into chaos engineering tools with a focus on security and unpack the differences between penetration testing, security testing, and chaos engineering. After all, what was 2020 if not a chaos engineering experiment. We each took some time to review this awesome list of chaos engineering resources: https://github.com/dastergon/awesome-chaos-engineering and had a chat about what pulled us in to our respective choices. It's interesting what chaos engineering means depending on who you talk to and I think this sets us up well.
2020-12-2250 minRelating to DevSecOpsEpisode #017: Chaos in your Engineering, what to do if Zombies attack your cloudSend us a textIn this episode we talk about Chaos Engineering, what it is, what it isn't, our thoughts on what chaos really means and how we approach it in our day to day. In this episode we talk about our introductions to chaos engineering and how some of our career activities have related to it in the past. Have you ever done a tabletop exercise, but were dissatisfied with the technical level of it. This episode is for you!References: Jamieson's current read: https://learning.oreilly.com/library/view/chaos-engineering/9781492043850/Ken's c...
2020-12-0453 minRelating to DevSecOpsEpisode #016: Terraform CDK, finishing the Infra as Code series with its final form?Send us a textWe wrap up this series with a talk through the terraform cdk and our initial reactions of the project and product. We all learned a ton through this journey trying to figure out where and when to use these tools. I think we've all come out of this with a newfound respect to the future of infrastructure as code and hope you've enjoyed listening to us. It's been fun to discover this on the mic!
2020-11-1146 minRelating to DevSecOpsEpisode #015: Quest to Terraform CDK through the Amazon CDKSend us a textIn our quest to discuss and debate the usefulness of the Terraform CDK we take a pit stop at the Amazon CDK and Cloudformation. All of us have had varying experiences with the trials and tribulations of infrastructure as code, JSON, and YAML. We tease out why and when the CDK or Cloudformation route might be a better or complimentary choice to other platforms. We touch on some security concerns along the way and prep ourselves for the Terraform CDK use case from all 3 perspectives. We've had a pretty good time researching each...
2020-11-0139 minRelating to DevSecOpsEpisode #014: Approaching Terraform and other "as-code" funSend us a textWe've listened to your feedback and started diving into infrastructure as code starting with terraform, our experiences learning it for fun and for clients. The trials and tribulations of automation in Jamieson's lengthy DevOps career, and where to go to get started with terraform. We cover some of our personal frustrations living with terraform and the real world and discuss how learning something as fast paced as this can be challenging and different depending on whether your a consultant or corporate deploying things engineer. We're also moving to every two weeks a...
2020-10-1741 minRelating to DevSecOpsEpisode #013: How a backend engineer looks at XSSSend us a textSimon gives his perspective on Cross-Site Scripting (XSS) and we dig into some of the common protections. We also cover different views between front and back end development and where the responsibility lies for teams facing this issue. We start to unpack the importance of the product, context, and user experience as it pertains to browser attacks.
2020-10-0349 minRelating to DevSecOpsEpisode #012: What DevSecOps means to a SCRUM master with Jenn MolyneauxSend us a textJenn Molyneaux joins the crew as the very first guest! ( https://bit.ly/3ctCLJu ). Jenn is a Senior SCRUM Master who brings her wealth of experience and patience to the table to help us all understand how we can work better together. We had a great time recording this one and are excited to start getting more opinions and views on the show. We talk about DevSecOps in Agile/SCRUM, how to handle security issues, how to develop relationships across teams and getting leadership buy-in for your projects. We also get Jenn's opinions...
2020-09-2459 minRelating to DevSecOpsEpisode #011: Bugs vs Vulns - what's your opinion?Send us a textSecurity and Engineering go head to head in a conversation about bugs vs vulnerabilities and where we think they should fall in the grand scheme of product development. Unfortunately we threw this one together at the last minute as we had to scramble due to some life events. Keep an eye out for our intended episode next week on Agile/Scrum with Jenn!
2020-09-1834 minRelating to DevSecOpsEpisode #010: Security Configs, Default Configs, and other decisions we regretSend us a textThis episode we riff on some of the hotter topics we discussed during Episode 9 as we cover security misconfigurations, default misconfigurations, and the responsibility of application/infrastructure configs in an organization. We talk about how to best interact with other teams to ensure configurations are manageable, maintained, and in the right hands
2020-09-1140 minRelating to DevSecOpsEpisode #009: OWASP Top 10: Awareness, not MeasurementSend us a textIn this episode we cover the OWASP Top 10, a popular security awareness document and how DevOps and Product Engineering are typically exposed to it. While it's made waves in the industry we discuss how to use and how not to use this document and give some opinions on categories that fall into the DevSecOps sphere of work. This isn't your typical "What is SQL Injection" episode, so give us a listen and hopefully you come out the other side with a new viewpoint on using the top 10 to help your organization. Also, Ken...
2020-09-0441 min
Relating to DevSecOpsEpisode #008: Testing Depths of the DevSecOps River with Both FeetSend us a textThere are so many types of tests across DevSecOps and we try to cover as many as possible from SAST to Contract testing. Simon covers his dislike for test-driven development, Ken talks through writing security tests against requirements, and Jamieson brings automation testing to light with new toolsets and process developments. We all had some preconceived notions going into this, but it was an eye opening and long episode. We hope you enjoy!
2020-08-1955 min
Relating to DevSecOpsEpisode #007: Service Mesh, more than a Sean Connery sidecar to your Indiana Jones AppSend us a textIn this episode we get back to tech in the DevOps centric topic of Service Mesh. Ken and Simon chat with Jamieson about concerns and first thoughts on service mesh in their respective experiences. If you're looking at spinning up service mesh within your organization or just want to learn more about it this episode gives highlights from different professional perspectives. We end with some ways to pitch this internally to get buy in from departments that may challenge your next push into service mesh.
2020-08-1242 min
Relating to DevSecOpsEpisode #006: How Engineering Titles Affect Your Communication with Development and Product Engineering TeamsSend us a textIn this episode we take another people centric approach with Simon Dollo as we explore the difference between developers and product engineers. We explore Simon's engineering history and work to identify more meaningful and effective ways of communicating with people writing code.
2020-08-0541 min
Relating to DevSecOpsEpisode #005: Know Your Audience, the Face of Documentation and Training in a DevSecOps WorldSend us a textIn this episode we discuss product engineering security Easter eggs and try to stay on track talking about how to get other departments and teams to adapt your latest and greatest process, tool, or optimization. The conversation quickly devolves into a side track on documentation where we discuss the pitfalls of traditional documentation tactics in the fast paced world of Agile development and continuous deployment. Speaking of Easter Eggs, Ken's cat makes an earnest request to be a part of the show.
2020-08-0137 min
Relating to DevSecOpsEpisode #004: Be careful with your logs aka a hand grenade with a dictionary attached to itSend us a textThis time on Relating to DevSecOps we cover application logging, how it's viewed by different teams and what those teams are looking to get out of them. We cover some tips and tricks with logging challenges like ACTUALLY implementing a logging standard, the importance of logging severity levels, and the challenge with the appropriate amount to log. Join us for our divergent opinions and challenges we've faced in the real world.
2020-07-2238 min
Relating to DevSecOpsEpisode #003: Bookending DevSecOps starting with Threat ModelsSend us a textStarting on the left side of the SDLC, we talk about Threat Modeling experiences from all perspectives and the fundamental issues with checkbox security. We almost get through a whole episode without making fun of Perl and are still waiting for a Perl developer to reach out and tell us how wrong we are. We attempted to get to application logging perspectives but ran into a timewall. Keep an eye out for Episode #004 as we tackle DevSecOps from both sides.
2020-07-0934 min
Relating to DevSecOpsEpisode #002: A Product Engineering Perspective on DevSecOpsSend us a textSimon Dollo joins the crew and brings his product engineering perspective to the burning question "What is DevSecOps?" We explore the developer perspective to security and devops and have a little fun with Jamieson's love of Perl as an automation tool. Along the way we figure out a common thread to our introduction to code and dig into collaborating against the challenge of open source software security.
2020-06-3047 minRelating to DevSecOpsRelating to DevSecOps #001: What is DevSecOps?!Send us a textJoin us on our first episode of relating to DevSecOps where we introduce the first two co-hosts of 3 recurring players, Jamieson Colburn, representing DevOps. We dig into our definitions of DevSecOps, talk about learning from your colleagues, leveling up your collaboration chops, homelabs, tearing apart electronics in our youth, and Jamieson's love affair with Perl. As the first of many we hope you give us a listen!
2020-06-2340 minAbsolute AppSecEpisode 101: Mike McCabe, Ken Toler, Cloud SecuritySeth and Ken are joined by Mike McCabe (@mccabe615) and Ken Toler (@relotnek) to break down their talk on Cloud Security. Discussions revolves around cloud security, but touches legacy systems, application inventory, virtual conferences, and more.
2020-06-2300 min
Marley Media's Unfiltered BroadcastSeason 3 "Doughnuts"Episode 219 Highlights How The Music Industry Can Change By NBA Youngboy & Other Artists Not Doing Live Shows,FBG Duck Directly Responding To Von,Sxsw Being Canceled,Ozarks 3rd,Ken Petty Failing To Register As A Sex Offender,New Ep Suga By Meg Thee Stallion, Lil Uzi Vert Release Eternal Atake,Lynn Toler Leaving Divorce Court,Bill Clinton,The Fda Putting A Ban On Electric Shock Devices In Schools,Olive Garden, Offset Vs Lil Baby Rumor & More! Listen To The New "Rose From Concrete" Album By Geezy The Hitmaker On All Platforms Now! Go Watch Our Series "Behind The Music" On...
2020-03-071h 12Absolute AppSecEpisode 23: Ken TolerKen and Seth are joined by Ken Toler (@relotnek) and talk security champions and security program management.
2018-07-1100 min