51 subscribers
Go offline with the Player FM app!
In Search of Secure Design - ASW #325
Manage episode 475806540 series 2086046
We have a top ten list entry for Insecure Design, pledges to CISA's Secure by Design principles, and tons of CVEs that fall into familiar categories of flaws. But what does it mean to have a secure design and how do we get there? There are plenty of secure practices that orgs should implement are supply chains, authentication, and the SDLC. Those practices address important areas of risk, but only indirectly influence a secure design. We look at tactics from coding styles to design councils as we search for guidance that makes software more secure.
Segment resources
- https://owasp.org/Top10/A042021-InsecureDesign/
- https://www.cisa.gov/securebydesign/pledge
- https://www.cisa.gov/securebydesign
- https://kccnceu2025.sched.com/event/1xBJR/keynote-rust-in-the-linux-kernel-a-new-era-for-cloud-native-performance-and-security-greg-kroah-hartman-linux-kernel-maintainer-fellow-the-linux-foundation
- https://newsletter.pragmaticengineer.com/p/how-linux-is-built-with-greg-kroah
- https://daniel.haxx.se/blog/2025/04/07/writing-c-for-curl/
Show Notes: https://securityweekly.com/asw-325
660 episodes
Manage episode 475806540 series 2086046
We have a top ten list entry for Insecure Design, pledges to CISA's Secure by Design principles, and tons of CVEs that fall into familiar categories of flaws. But what does it mean to have a secure design and how do we get there? There are plenty of secure practices that orgs should implement are supply chains, authentication, and the SDLC. Those practices address important areas of risk, but only indirectly influence a secure design. We look at tactics from coding styles to design councils as we search for guidance that makes software more secure.
Segment resources
- https://owasp.org/Top10/A042021-InsecureDesign/
- https://www.cisa.gov/securebydesign/pledge
- https://www.cisa.gov/securebydesign
- https://kccnceu2025.sched.com/event/1xBJR/keynote-rust-in-the-linux-kernel-a-new-era-for-cloud-native-performance-and-security-greg-kroah-hartman-linux-kernel-maintainer-fellow-the-linux-foundation
- https://newsletter.pragmaticengineer.com/p/how-linux-is-built-with-greg-kroah
- https://daniel.haxx.se/blog/2025/04/07/writing-c-for-curl/
Show Notes: https://securityweekly.com/asw-325
660 episodes
All episodes
×
1 Appsec News & Interviews from RSAC on Identity and AI - Charlotte Wylie, Rami Saas - ASW #331 1:01:48

1 Secure Code Reviews, LLM Coding Assistants, and Trusting Code - Rey Bango, Karim Toubba, Gal Elbaz - ASW #330 1:09:38

1 AI Era, New Risks: How Data-Centric Security Reduces Emerging AppSec Threats - Idan Plotnik, Vishal Gupta - ASW #329 1:03:03

1 Secure Designs, UX Dragons, Vuln Dungeons - Jack Cable - ASW #328 44:08

1 Managing Secrets - Vlad Matsiiako - ASW #327 1:03:03

1 More WAFs in Blocking Mode and More Security Headaches from LLMs - Sandy Carielli, Janet Worthington - ASW #326 1:14:45

1 In Search of Secure Design - ASW #325 1:07:36

1 Avoiding Appsec's Worst Practices - ASW #324 1:11:19

1 Finding a Use for GenAI in AppSec - Keith Hoodlet - ASW #323 54:08

1 Redlining the Smart Contract Top 10 - Shashank - ASW #322 53:01

1 Skype Hangs Up, Android Backdoors, Jailbreak Research, Pretend AirTags, Wallbleed - ASW #321 33:17

1 CISA's Secure by Design Principles, Pledge, and Progress - Jack Cable - ASW #321 40:34

1 QR Codes Replacing SMS, MS Pulls VSCode Extension, Threat Modeling, Bybit Hack - ASW #320 33:55

1 Keeping Curl Successful and Secure Over the Decades - Daniel Stenberg - ASW #320 35:08

1 Regex DoS, LLM Backdoors, Secure AI Architectures, Rust Survey - ASW #319 36:26
Welcome to Player FM!
Player FM is scanning the web for high-quality podcasts for you to enjoy right now. It's the best podcast app and works on Android, iPhone, and the web. Signup to sync subscriptions across devices.