Application security is crucial for protecting sensitive data and ensuring the integrity and trustworthiness of software systems against cyber threats. In this episode, Tanya Janca, head of community and education at Semgrep discusses the importance of “shifting left” in the software development lifecycle, along with the best and worst practices in DevSecOps. Tanya has been coding and working in IT for more than 25 years and is the best-selling author of the book ‘Alice and Bob Learn Application Security’. You can follow Tanya on social media under the handle @SheHacksPurple.

Resources:

Semgrep website: https://semgrep.dev/

'Alice and Bob Learn Application Security': https://www.amazon.com/Alice-Bob-Learn-Application-Security/dp/B097NJSSV8

'Alice and Bob Learn Secure Coding': https://www.wiley.com/en-us/Alice+and+Bob+Learn+Secure+Coding-p-9781394171705

SheHacksPurple YouTube: https://www.youtube.com/channel/UCyxbNw11fMUgoR3XpVYVPIQ

SheHacksPurple website: https://shehackspurple.ca/

OWASP Global AppSec Conference: https://sf.globalappsec.org/

CISA Secure by Design: https://www.cisa.gov/securebydesign

Tanya's RSAC Talk on DevSecOps worst practices: https://www.rsaconference.com/library/Presentation/USA/2023/DevSecOps%20Worst%20Practices

RSAC Presentation: 'The End of DevSecOps?' by DJ Schleen: https://www.rsaconference.com/Library/presentation/usa/2024/the%20end%20of%20devsecops

Executive Order on Improving the Nation’s Cybersecurity (SBOMs): https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/

International law establishes norms and frameworks to ensure that States conduct their activities in a manner consistent with principles of sovereignty, responsibility, and human rights. In this episode, François Delerue, Assistant Professor of Law at IE University, discusses the application of international law to cyber operations, including the challenges with attribution and the threshold for cyberwarfare.

Resources:

- François Delerue's biography: https://francoisdelerue.eu/

- Cyber Operations and International Law: https://www.cambridge.org/core/books/cyber-operations-and-international-law/74D210E76E46531542AD27CECF07ABDE

- Tallinn Manual 2.0: https://www.cambridge.org/core/books/tallinn-manual-20-on-the-international-law-applicable-to-cyber-operations/E4FFD83EA790D7C4C3C28FC9CA2FB6C9

- "Russia Is Fighting for a Treaty That Could Soon Change the Internet Forever" (Newsweek): https://www.newsweek.com/russia-fighting-treaty-that-could-soon-change-internet-forever-1865118

- Microsoft's Digital Geneva Convention Proposal: https://www.microsoft.com/en-us/cybersecurity/content-hub/a-digital-geneva-convention-to-protect-cyberspace

In episode two of The Security Detail, Audra interviews Liz Wharton, founder of Silver Key Strategies, about her research on using large language models (LLMs) to analyze SEC 8-K filings and other public reporting to gain cybersecurity insights. Liz is an attorney who has two decades of legal, public policy, and business experience, including in cybersecurity. The interview also covers the heightened liability security executives face when reporting material incidents to the US Securities and Exchange Commission (SEC).

Resources:

SURGe Minicon talks at .conf24: https://conf.splunk.com/sessions/catalog.html?search=minicon#/

Silver Key Strategies: https://silverkeystrategies.com/about-silver-key

Splunk's 2024 State of Security Report: https://www.splunk.com/en_us/campaigns/state-of-security.html