Secure Software Development

Cloud and code don't sit in separate lanes anymore, and neither do their vulnerabilities. Dan Beller (Director of Cloud Solutions) and Greg Vanore (Director of Software Development) join This Is Fine to dig into what secure software development actually demands once the checklist runs out. They cover the widening blast radius of cloud misconfigurations, the quiet risk of open source dependencies that lose their maintainers, and why "shift left" stays a slogan until contracts actually fund it. A detour through JavaScript's messy history makes the case that unchecked abstraction is its own security problem, tooling included. They also dig into why government agile adoption keeps colliding with government security posture, and what the NIST SSDF gets right about treating security as a mindset rather than a gate. It's a candid, occasionally cursed (RIP JScript) conversation about building software that survives contact with reality.Episode Chapters: 00:00 Introduction and Podcast Production 00:44 Exploring Secure Software Development 01:43 The Changing Threat Landscape 03:05 Impact of Open Source Software 04:55 Infrastructure Security and Open Frameworks 05:57 Balancing Tooling and Understanding 06:53 The Evolution and Challenges of JavaScript 10:22 The Stabilization of UI Frameworks 12:18 Challenges in Government Cloud Environments 15:01 Agility and Security in Government 16:40 Reconciling Agile Processes with Security 22:35 Embedding Security in the Development Process 24:55 The Scope of Secure Software Development