Chris Romeo — The State of Security and the Importance of Empathy

Network engineers and application security teams depend on each other, yet often struggle to understand each other’s responsibilities. In this rebroadcast from The Hedge, Chris Romeo joins hosts Russ White and Tom Ammon to explore that divide. They discuss encrypted traffic, denial-of-service attacks, DNS, and the limits of relying on network controls to protect applications. Chris explains threat modeling as a repeatable way to question assumptions, including assumptions about cloud services and insider access. The conversation then turns to infrastructure automation, changing engineering roles, and the frustration created when security policies arrive without technical understanding. Their practical message is to learn one another’s language and build empathy through real experience with the systems other teams operate.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Chris Romeo:
→ Chris Romeo on LinkedIn

Mentioned in this episode:
→ The Hedge episode 48
→ National Vulnerability Database

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 Chris joins The Hedge to discuss security
02:01 Where network and application security meet
04:29 Encrypted traffic and network responsibilities
06:04 Certificates, DNS, and interception threats
07:51 Threat modeling as a way of questioning assumptions
09:23 How denial-of-service defenses evolved
12:23 Revisiting models as threats change
17:45 Where network engineers can improve security
22:21 Helping developers and application teams
24:46 Routing, segmentation, and control-plane risks
28:18 Insider threats and shared control
31:11 Infrastructure as code and changing engineering roles
34:51 Empathy between network and security teams
39:39 Learning paths for network engineers