Chris and Robert: A Taste of Hi-5

What happens when Chris and Robert trade a single interview topic for five current application security ideas? This experimental Hi-5 episode reviews articles about secure design, developer mentoring, OWASP Proactive Controls, web security practices, and layered testing. The hosts connect each article to work they have seen inside development and security teams, challenging simplistic advice and asking what makes a recommendation usable. They discuss deliberate mentoring, broader language for software security, automation, early design choices, multiple testing techniques, penetration testing, and the operational readiness required before launching a bug bounty. The format is lighter and faster than a standard interview, but the goal remains practical: identify ideas worth carrying into a real secure development program.The Application Security Podcast is brought to you by Security Journey.About Security JourneySecurity Journey provides application security education for developers and everyone in the software development lifecycle.→ Learn more about Security JourneyConnect with Chris Romeo and Robert Hurlbut:→ Chris Romeo on LinkedIn→ Robert Hurlbut on LinkedInMentioned in this episode:→ Interest In Secure Design Practices Is Increasing Leading To Two Predictions→ Developers mentoring other developers: practices I've seen work well→ 7 Web Application Security Best Practices→ OWASP Proactive ControlsFollow the Application Security Podcast:➜ Home➜ X➜ LinkedIn➜ YouTube➜ Instagram➜ FacebookChapters:00:00 Introducing the Hi-5 format02:01 Secure design predictions05:23 Security and software development working together07:05 Deliberate developer mentoring10:04 Plans, follow-up, and mentoring habits11:20 OWASP Proactive Controls13:13 Who participates in secure development14:38 Naming the broader discipline15:55 Automating repeatable security work17:10 Starting security practices early18:36 Layering tools and testing methods22:05 The role of penetration testing25:36 Readiness before bug bounty programs