Learn with us

Videos

Grow your knowledge of cybersecurity best practices.

The Application Security Podcast

Chris Romeo and Robert Hurlbut invite AppSec experts to break down a topic in 45 minutes.

Chris and Robert are thrilled to have an insightful conversation with Dr. Jared Demott, a seasoned expert in the field of cybersecurity. The discussion traverses a range of topics, from controversial opinions on application security to the practical aspects of managing bug bounty programs in large corporations like Microsoft. We dive into the technicalities of bug bounty programs, exploring how companies like Microsoft handle the influx of reports and the importance of such programs in a comprehensive security strategy. Dr. Demott provides valuable insights into the evolution of bug classes and the never-ending challenge of addressing significant bug types, emphasizing that no bug class can ever be fully eradicated. This episode is a must-listen for anyone interested in the nuances of software security, the realities of cybersecurity employment, and the ongoing challenges in bug mitigation. Join us for an enlightening journey into the heart of application security with Dr. Jared Demott. 00:00 Introduction and Background 03:06 Dr. Jared DeMott's Journey into Cybersecurity 10:46 The Role at Microsoft and the Bug Bounty Program 14:52 The Top Vulnerabilities in Cloud and Online Services 35:37 The Labor Shortage in Cybersecurity: A Hot Take 42:14 Conclusion and Key Takeaways
Dr. Jared Demott -- Cloud Security & Bug Bounty
Dr. Katarina Koerner, a renowned advisor and community builder with expertise in privacy by design and responsible AI, joins Chris and Robert to delve into the intricacies of responsible AI in this episode of the Application Security Podcast. She explores how security intersects with AI, discusses the ethical implications of AI's integration into daily life, and emphasizes the importance of educating ourselves about AI risk management frameworks. She also highlights the crucial role of AI security engineers, the ethical debates around using AI in education, and the significance of international AI governance. This discussion is a deep dive into the world of AI, privacy, security, and ethics, offering valuable insights for tech professionals, policy makers, and individuals alike. 00:00 Introduction: Dr. Koerner and Responsible AI 02:22 Dr. Katarina Koerner's Journey into the World of Security 05:31 Understanding Responsible AI Principles 17:20 The Intersection of Privacy and AI 36:59 The Future of AI Security 47:06 Final Thoughts and Call to Action Links: UNESCO Recommendation on the Ethics of Artificial Intelligence: https://www.unesco.org/en/artificial-intelligence?hub=32618 OECD AI Principles: https://oecd.ai/en/ai-principles White House Blueprint for an AI Bill of Rights: https://www.whitehouse.gov/ostp/ai-bill-of-rights/ NIST AI Risk Management Framework: https://www.nist.gov/itl/ai-risk-management-framework NIST Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations: https://csrc.nist.gov/pubs/ai/100/2/e2023/ipd Microsoft Responsible AI Standard, v2: https://www.microsoft.com/en-us/ai/principles-and-approach == Microsoft Failure Modes in Machine Learning: https://learn.microsoft.com/en-us/security/engineering/failure-modes-in-machine-learning ENISA Securing Machine Learning Algorithms: https://www.enisa.europa.eu/publications/securing-machine-learning-algorithms Google Secure AI Framework: https://developers.google.com/machine-learning/resources/saif == Google Why Red Teams Play a Central Role in Helping Organizations Secure AI Systems: https://services.google.com/fh/files/blogs/google_ai_red_team_digital_final.pdf Recommended Book: The Ethical Algorithm: The Science of Socially Aware Algorithm Design by Michael Kearns and Aaron Roth: https://global.oup.com/academic/product/the-ethical-algorithm-9780190948207?cc=us&lang=en&
Katharina Koerner -- Security as Responsible AI
Must-Listen Conversation for Security Pros & Business Leaders | Strategic Insights & Leadership Lessons 🔒🌟 When Ray Espinoza joined Chris and Robert on the Application Security Podcast, he gave a treasure trove of insights for both security professionals and business leaders alike! Whether you're deep in the trenches of information security or steering the ship in business leadership, this episode is packed with valuable takeaways. Dive in to discover why this is a must-listen for professionals across the spectrum. 🌟🔒 For Security Professionals: 1. CISO Insights: Gain a glimpse into the strategic mind of a Chief Information Security Officer. Learn from their real-world experiences and challenges in aligning security with business goals. 2. Career Development: Get inspired by the speaker's career journey and learn the importance of mentorship in your professional growth. 3. Data-Driven Security: Embrace a data-driven approach to security solutions, focusing on tangible results and measurable outcomes. For Business Leaders: 1. Strategic Security Understanding: Learn how information security is integral to overall business strategy and decision-making. 2. Universal Risk Management: Gain insights into risk management strategies applicable across various business aspects. 3. Communication & Relationship Building: Enhance your skills in effective communication and professional relationship building. 4. Leadership & Mentorship: Absorb valuable lessons in guiding and inspiring your team, crucial for effective leadership. 5. Adaptability in Leadership: Understand the importance of flexibility and adaptability in today's rapidly evolving business landscape. 6. Data-Driven Decisions: Embrace the power of data in driving efficient and accountable business processes. Why Listen? 👉 For security pros, this is your chance to deepen your understanding of strategic security management and enhance your interpersonal skills. 👉 For business leaders, this episode offers a unique perspective on how security strategies impact broader business objectives and leadership practices. Don't Miss Out! 🎧 Tune in now for an enlightening discussion filled with actionable insights. Whether you're an aspiring CISO, a seasoned security professional, or a business leader looking to broaden your horizons, this podcast has something for everyone. 👍 Like, Share, and Subscribe for more insightful content! 💬 Drop your thoughts and takeaways in the comments below! #SecurityLeadership #BusinessStrategy #RiskManagement #CareerGrowth #DataDrivenDecisions #LeadershipSkills --- Remember, your engagement helps us bring more such content. So, hit that like button, share with your network, and subscribe for more insightful episodes! 🌟🔊📈 Ray's Book Recommendation: Extreme Ownership by Jocko Willink and Leif Babin https://echelonfront.com/books/extreme-ownership/
Ray Espinoza -- The AppSec CISO, Vendor Relationships, and Mentoring
Load More... Subscribe

Security Table Podcast

Four cybersecurity industry veterans from diverse backgrounds discuss how to build secure software, and all the issues that arise!

Join Izar, Matt, and Chris in a broad discussion covering the dynamics of the security community, the evolving role of technology, and the profound impact of social media on our lives. As the trio considers what they are most thankful for in security, they navigate a series of topics that blend professional insights with personal experiences, offering a unique perspective on how these elements intersect in the modern world. Chris begins by highlighting the importance of collaboration and learning within the ever-expanding security community. Shifting to broader security concerns, Izar emphasizes the value of mentoring and the potential for institutionalizing it through platforms like OWASP. Matt critiques over-relying on AI. He advocates for tool-assisted solutions rather than tool-performed ones and stresses the importance of accurately representing AI's capabilities. In a particularly engaging segment, the panelists explore the influence of social media and technology on personal well-being. They share anecdotes and observations on the pursuit of simplicity in a tech-driven world, discussing the concept of 'social media sobriety' and social media's impact on happiness. They conclude with a collective call to action, urging viewers to engage in positive change through volunteering, mentoring, and contributing to open-source projects. This discussion is a must-watch for anyone interested in the intersection of technology, security, and societal trends.
Looking Back, Looking Forward
Patrick Garrity joins the Security Table to unpack CVSS 4.0, its impact on your program, and whether or not it will change the game, the rules of how the game is played, or maybe the entire game.
CVSS 4.0 Unleashed with Patrick Garrity
Aditi Sharma joins Matt, Izar, and Chris around the Security Table to discuss Software Bill of Materials (SBOMs). The team discusses potential advantages as well as challenges of SBOMs in different contexts such as SaaS solutions, physical products, and internal procedures. The episode also explores the importance of knowing what software components a company is consuming and the significance of SBOM for vulnerability management and risk posture. The team concludes by stressing that while SBOM has great potential value, the value realization is still a work in progress. Links: Chris' LinkedIn post about the SBOM cycle: https://www.linkedin.com/posts/securityjourney_where-is-the-part-where-the-vulnerabilities-activity-7128757968740777986-0PQV
An SBOM Lifecycle
Load More... Subscribe

Subscribe to our weekly newsletter

Stay up to date and grow your application security expertise with our free weekly newsletter, “Reasonable AppSec.”

Subscribe

Five Links

Five security articles that are worth your time.

One Focus

One quickly digestible thought to expand your insight.

Three Podcast Episodes

Links and short descriptions of three(ish) important security podcast episodes.

Upcoming Events

Security talks and conferences to keep you up to date.

Let’s talk.

Ready to learn more? Reach out and let’s set up a time to have a conversation.

Contact Us
Company
Services
Education
Elsewhere
Legal

Copyright: © 2023 Kerr Ventures. All Rights Reserved.

  • About

      Kerr ventures

      What We Do

      We invest in cybersecurity startups and advise firms on application security.

      Who We Are

      Meet our team.

      Our Vision and Values

      How We Can Help

      Education

      Learn application security best practices through our free articles and podcasts.

      Incubation

      Our experienced team partners with startups to provide guidance at every stage.

      Investment

      We fund startups that are poised to revolutionize cybersecurity.

      Consulting

      Let us help your team learn, design, and implement best application security practices.

  • Services
  • Education
  • Contact
Subscribe