Jan 29, 2021Security Engineer Interview Questions: What is XXE?We’re creating a super-useful series called Security Engineer interview questions, where we dive into real-world interview questions on AppSec from Glassdoor, Indeed.com and other sources. This week, I dive into the question “What is XXE” with the aid of an amazing lab from our Learning Path on Application Security. Enjoy!Application Security1 min readApplication Security1 min read
Jan 26, 2021TL;DR on the AWS Lambda Security OverviewAWS recently released a whitepaper on the Security Overview of Lambda. This document is meant to be an in-depth look at Lambda Security. Its definitely a worthwhile read. However, I have tried to simplify and distill some of the most important security points for general consumption A little bit of…Aws Security3 min readAws Security3 min read
Jan 17, 2021These are the things I want to learn in the year 2021Application Security1 min readApplication Security1 min read
May 22, 2019Seven Deadly Sins of Container Security — Part 1This video is AppSecEngineer’s Part 1 of Seven Deadly Sins of Container Security. These specifically refer to 7 different mistakes that people and orgs make when running containerized deployments in their environment.Docker1 min readDocker1 min read
Nov 15, 2018InfoSec is a lot like Stand-up ComedyI have been in InfoSec since 2008. I started extensively presenting at conferences and events from 2014 or so (when I felt I had something to say). It wasn’t that I had nothing much to say before then, but I constantly felt weird about “not researching enough”, or “Who’s going…Comedy5 min readComedy5 min read
Published inAppSecEngineer·Nov 12, 2018A Guided Tour of the AWS Key Management Service (KMS)-as-CodeI started doing PCI-DSS Audit work in 2008 (yes I know). Since then, PCI-DSS has always had “Requirement 3”, a PCI-DSS set of security requirements that were typically seen as infamous because of the number of organizations, who would just not be able to fulfill them. What was Requirement 3…Security5 min readSecurity5 min read
Published inAppSecEngineer·Jun 28, 2018DynamoDB InjectionI have been developing a bunch of serverless apps and experimenting with serverless security for our (we45’s) work in Pentesting and for our training on Serverless Security in OWASP AppSecUSA 2018 and I came across this interesting scenario during my research. If you are working with AWS Lambda (Serverless), chances…Application Security3 min readApplication Security3 min read
Published inAppSecEngineer·Jun 15, 2018HOWTO: Amazon Inspector with TerraformI have been playing around with Terraform for the last 2 months or so, and I really enjoy working on it. The entire approach to Infrastructure as Code, especially the modular parts, are not only powerful, but also extremely intuitive and easy-to-use, once you get used to the HCL…AWS5 min readAWS5 min read
Apr 16, 2018Integrating E2E and Application Security Testing: HOWTo with NightwatchJS and OWASP ZAPThe Problem Ever since I started my journey in DevSecOps and Application Security Automation, one of the key areas of my work has been “Parameterized Scanning”. “Parameterized Scanning” started off when we were attempting to automate an application security test for one of our largest clients, a World’s Top 10…JavaScript8 min readJavaScript8 min read
