Chris and Robert: A Taste of Hi-5

What happens when Chris and Robert trade a single interview topic for five current application security ideas? This experimental Hi-5 episode reviews articles about secure design, developer mentoring, OWASP Proactive Controls, web security practices, and layered testing. The hosts connect each article to work they have seen inside development and security teams, challenging simplistic advice and asking what makes a recommendation usable. They discuss deliberate mentoring, broader language for software security, automation, early design choices, multiple testing techniques, penetration testing, and the operational readiness required before launching a bug bounty. The format is lighter and faster than a standard interview, but the goal remains practical: identify ideas worth carrying into a real secure development program.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Chris Romeo and Robert Hurlbut:
→ Chris Romeo on LinkedIn
→ Robert Hurlbut on LinkedIn

Mentioned in this episode:
→ Interest In Secure Design Practices Is Increasing Leading To Two Predictions
→ Developers mentoring other developers: practices I've seen work well
→ 7 Web Application Security Best Practices
→ OWASP Proactive Controls

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Introducing the Hi-5 format
02:01 Secure design predictions
05:23 Security and software development working together
07:05 Deliberate developer mentoring
10:04 Plans, follow-up, and mentoring habits
11:20 OWASP Proactive Controls
13:13 Who participates in secure development
14:38 Naming the broader discipline
15:55 Automating repeatable security work
17:10 Starting security practices early
18:36 Layering tools and testing methods
22:05 The role of penetration testing
25:36 Readiness before bug bounty programs