Matt Clapham — A perspective on appsec from the world of medical software

Security teams learn something different when they leave their own conferences and listen to the industries using their products. Matt Clapham, a product security practitioner working with medical software, shares what he observed at the HIMSS healthcare technology conference. He describes the mix of established systems and newer cloud services, the sensitivity of medical information, and the questions vendors should be able to answer about secure development. Chris and Robert explore the gap between compliance claims and practical protection, including why adding security products cannot substitute for sound engineering. Matt also reflects on his path from testing into leadership. His closing challenge is to step outside the security echo chamber and understand how another industry sees risk.The Application Security Podcast is brought to you by Security Journey.About Security JourneySecurity Journey provides application security education for developers and everyone in the software development lifecycle.→ Learn more about Security JourneyConnect with Matt Clapham:→ Matthew Clapham on LinkedInMentioned in this episode:→ HIMSSFollow the Application Security Podcast:➜ Home➜ X➜ LinkedIn➜ YouTube➜ Instagram➜ FacebookChapters:00:00 AppSec through the lens of medical software03:03 Matt’s path from testing to product security05:34 Balancing leadership and hands-on work06:43 What HIMSS brings together08:45 Healthcare technology and security maturity11:05 Cloud adoption in healthcare12:16 Compliance and protecting medical information15:57 What security vendors were offering17:56 Asking how products are built securely20:30 Responding to weak security explanations21:21 Lessons beyond individual security products25:07 Leaving the security echo chamber