Foojay Podcast #7: Security in Java, what do we need to know and how to keep our applications secure?
- November 21, 2022
- 5367 Unique Views
- 2 min read
For this Foojay Podcast, we invited security experts to dive into the fascinating world of secure coding and detecting vulnerabilities in your Java applications.
How can you make and keep your systems safe?
That's what we want to find out...
Guests
- Steve Poole (Sonatype, @spool167)
- Brian Vermeer (Snyk, @BrianVerm, @[email protected])
- Anastasiia Voitova (Cossack Labs, @vixentael, @[email protected])
Host
- Erik Costlow (Azul, @costlow, @[email protected])
Content
- 00'00 Short intro and music
- 00'15 Introduction about the topic of this podcast
- 00'31 Introduction of the guests and host
- 02'40 Foojay article written by Brain about dependencies
- 05'02 XML parsers in Java
- 05'55 "The more the merrier" versus "The less the better"
- 06'30 Foojay article written by Brain about the role of Data Transfer Objects in security
- 09'10 Extending on DTOs: encryption in data provisioning
- 11'10 Database entities versus DTOs and serialization
- 12'25 Developers need to be trained more on security and take responsibility
- 13'50 Don't design your own security solution
- 16'58 Cryptograpic dad joke... 😉
- 17'40 What are CVEs (Common Vulnerabilities and Exposures)
- 20'40 Security in the layers of a Java environment
- 24'50 JAR signing
- 26'40 CWE with the W of Weaknesses and OWASP
- 29'40 How to evaluate vulnerability scores
- 31'23 CVEs as Pokemon, "You gotta catch them all" workshop
- 32'20 How to be able to fix vulnerabilities
- 33'57 About the recent critical SSL vulnerability
- 36'02 Libraries are linked (integrated) into a Java project
- 38'15 Security is an educational thing and understand your tools
- 39'90 Role of the different players in a team
- 46'32 Can the JVM itself be more secure
- 49'44 Make the JVM aware of vulnerable code
- 51'10 Security insights in IoT devices
- 1h01'30 Developers should learn about defending depth
- 1h02'10 Conclusion
Don’t Forget to Share This Post!
Java Champions & Developer Advocate and Software Engineer for Snyk. Passionate about Java, (Pure) Functional Programming, and Cybersecurity. Co-leading the Virtual JUG, NLJUG and DevSecCon community. Brian is also an Oracle Groundbreaker Ambassador and regular international speaker on mostly Java-related conferences.
Erik Costlow was Oracle’s principal product manager for Java 8 and 9, focused on security and performance. His security expertise involves threat modeling, code analysis, and instrumentation of security sensors. He is working to broaden this approach to security with Contrast Security. Before becoming involved in technology, Erik was a circus performer who juggled fire on a three-wheel vertical unicycle.
Frank Delporte (@frankdelporte) is a Java Champion, Java Developer, Technical Writer at Azul, Blogger, Author of "Getting started with Java on Raspberry Pi", and Pi4J Contributor. Frank blogs about his experiments with Java, sometimes combined with electronic components, on the Raspberry Pi.
Comments (0)
No comments yet. Be the first.