Matt Clapham — A perspective on appsec from the world of medical software

Security teams learn something different when they leave their own conferences and listen to the industries using their products. Matt Clapham, a product security practitioner working with medical software, shares what he observed at the HIMSS healthcare technology conference. He describes the mix of established systems and newer cloud services, the sensitivity of medical information, and the questions vendors should be able to answer about secure development. Chris and Robert explore the gap between compliance claims and practical protection, including why adding security products cannot substitute for sound engineering. Matt also reflects on his path from testing into leadership. His closing challenge is to step outside the security echo chamber and understand how another industry sees risk.

The Application Security Podcast is brought to you by Security Journey.

About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey

Connect with Matt Clapham:
→ Matthew Clapham on LinkedIn

Mentioned in this episode:
→ HIMSS

Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook

Chapters:
00:00 AppSec through the lens of medical software
03:03 Matt’s path from testing to product security
05:34 Balancing leadership and hands-on work
06:43 What HIMSS brings together
08:45 Healthcare technology and security maturity
11:05 Cloud adoption in healthcare
12:16 Compliance and protecting medical information
15:57 What security vendors were offering
17:56 Asking how products are built securely
20:30 Responding to weak security explanations
21:21 Lessons beyond individual security products
25:07 Leaving the security echo chamber