Chris Romeo — The State of Security and the Importance of Empathy

Network engineers and application security teams depend on each other, yet often struggle to understand each other’s responsibilities. In this rebroadcast from The Hedge, Chris Romeo joins hosts Russ White and Tom Ammon to explore that divide. They discuss encrypted traffic, denial-of-service attacks, DNS, and the limits of relying on network controls to protect applications. Chris explains threat modeling as a repeatable way to question assumptions, including assumptions about cloud services and insider access. The conversation then turns to infrastructure automation, changing engineering roles, and the frustration created when security policies arrive without technical understanding. Their practical message is to learn one another’s language and build empathy through real experience with the systems other teams operate.The Application Security Podcast is brought to you by Security Journey.About Security JourneySecurity Journey provides application security education for developers and everyone in the software development lifecycle.→ Learn more about Security JourneyConnect with Chris Romeo:→ Chris Romeo on LinkedInMentioned in this episode:→ The Hedge episode 48→ National Vulnerability DatabaseFollow the Application Security Podcast:➜ Home➜ X➜ LinkedIn➜ YouTube➜ Instagram➜ FacebookChapters:00:00 Chris joins The Hedge to discuss security02:01 Where network and application security meet04:29 Encrypted traffic and network responsibilities06:04 Certificates, DNS, and interception threats07:51 Threat modeling as a way of questioning assumptions09:23 How denial-of-service defenses evolved12:23 Revisiting models as threats change17:45 Where network engineers can improve security22:21 Helping developers and application teams24:46 Routing, segmentation, and control-plane risks28:18 Insider threats and shared control31:11 Infrastructure as code and changing engineering roles34:51 Empathy between network and security teams39:39 Learning paths for network engineers