Name: BrightTALK at RSA - John DiMaria: GDPR, Critical Infrastructure & IoT Security
Start: 2017-03-06T16:45:00Z
End: 2017-03-06T16:50:06.000Z
Location: BrightTALK

CSA CloudBytes was launched as a webinar series to help us educate the industry on all matters related to the cloud. Our channel is designed to inform our audience about trending topics, new technologies, and latest research. Learn more at cloudsecurityalliance.org.  Join the Cloud Security Alliance on LinkedIn and follow us on twitter: @cloudsa

Cybersecurity is not just about securing a network, monitoring threats, or identifying vulnerabilities. Consider exactly what you are protecting: intellectual property, trade secrets, and employee and customer data. The loss, damage, or disclosure of this information can also have consequences at a regulatory level.



What has changed in recent years is the realization that risk management and zero trust go hand in hand. Security and technology leaders must protect sensitive data and assets in order to meet their governance objectives and be in compliance with regulations. Through the adoption of zero trust principles, organizations advance their cyber architectures and better protect their users, data, and reputations.   



Sounds great in theory, but what steps do organizations need to take to align zero trust  solutions with their own governance structures and compliance mandates?



Sean Cordero, Zscaler CISO - Americas, and Pam Kubiatowski, Zscaler CTO - Americas, will walk you through the practical methods that leading enterprises have used to successfully implement a zero trust architecture solution, with risk management and mitigation initiatives at the forefront.

The role of zero trust in improving corporate governance and compliance

Join the 2021 CSA-DC Chapter Research Team as they walk us through the concepts, technologies, business processes, and team building activities associated their recent CSA publication entitled “A Guided Approach to Support Your Zero Trust Strategy; A Guided Approach for a Complex Hybrid World”. 

Dr. Mari Spina, Research Committee Chair, will moderate a panel of key research contributors to the paper and experts in the field of Zero Trust Architecture (ZTA) development and adoption: Jyoti Wadhwa, Director, Cybersecurity Solutions Architect at T-REX Solutions, Paul Deakin, F5-CSE Security, F5-CSE Cloud Field Solutions Engineer, and Uma Rajagopal, Advisor and author of Essential Security Fundamentals; Security is a Process; Not a Single Product.

The Zero Trust Advancement Center is hosting free monthly webinars about one of the most widely talked about cybersecurity trends today. Zero Trust experts will guide you through the ins and outs of this increasingly popular approach to cybersecurity, helping you come to an understanding of why Zero Trust is needed today, what the key principles are, and how to implement it into your business planning, enterprise architectures, and technology deployments. Learn more at https://csaurl.org/zeroinseries.

A Guided Approach to Support Your Zero Trust Strategy

Ransomware isn’t new – we can track it back to attacks using floppy disks in 1989 – and like all attacks, it has evolved over time. As defenders adopted yesterday’s protections attackers respond by upping their game. The original “smash and grab” approach has moved on, leading to today’s more sophisticated and dangerous landscape, with:

• Ransomware-as-a-Service where attack tools are commercialized, meaning less skilled teams can buy and use advanced weapons they could not build for themselves
• Double Extortion where Cybercriminals don’t just lock your data where it sits – they pull out a copy, exploiting your weak, asymmetric network controls. This allows two threats– blocking your access to your own data, and threatening to release it publicly if you don’t pay.
• Cloud ransom attacks Every new tech has a new attack surface, and new exploits targeting it, and cloud is no different. 

Fighting Ransomware 2.0 means upgrading your defensive techniques – as the exploits evolve, so must your response. Combating both double-dip extortion demands and cloud-focused attacks requires understanding your attack surface, so you can find and fix your defensive gaps and open pathways before the bad guys use them against you. Concern about these attacks has reached the C-suite as ransoms have impacted not only brand and customer trust, but the bottom line with huge financial implications. 

In this webinar we will cover:
• Why network segmentation is the essential strategic response
• Comprehensive strategies vs. single point solutions needed
• The true impact of lateral movement within your network
• Why an ounce of prevention is worth a pound of cure

We’ve moved from smash and grab to sophisticated heists. This requires a cyber security strategy that works harder to avoid not only someone getting in, but plan to stop lateral movement and exfiltration. Control the blast radius, and you have a fighting chance at protecting your brand, your customers and your bottom line.

Combating Ransomware 2.0: Beyond Backups

As you move to the cloud, your security teams often feel a loss of control in this new world. Traditional tools and processes are not working in the cloud and visibility is limited. How do you identify and get your arms around the “real” risks in the cloud?

Getting security right starts with a first-principles approach to finding, focusing, and fixing risks across clouds and containers.

Join this webinar to learn:
• How to map security controls when moving from on-premise to the cloud?
• How innovative organizations eliminate blind spots and prioritize what matters 
• Leveraging open standards (ex. Falco) for runtime threat detection and cloud security monitoring  
• Key areas to cover when implementing cloud security from source to run

Hunting Suspicious Events with AWS CloudTrail: Fundamentals and Best Practices

Large enterprises such as Adobe have historically relied upon solutions managed wholly in-house for identity and access management. However, as we began our move towards a more cloud-centric zero-trust based networking environment, we recognized that we needed to ensure our core enterprise identity and access management system was more cloud-centric as well. This became apparent as the definition of “work” changed for our users as a result of the COVID-19 pandemic. Our cloud-based directory provider of choice for this effort is Microsoft Azure Active Directory (Azure AD). Over the past several years as we have transitioned to a cloud-based enterprise identity model we have learned a lot about how best to utilize this technology. Microsoft Azure AD is also still relatively new technology and is a constantly evolving system. This has presented some unique challenges as we work to use it in an organization as large and complex as Adobe. 

 

In this webcast Aaron Resnikoff, Sr. Security Engineer, and Trevor Ashby, Security Engineer, from our enterprise security team will talk about the evolution of how we use Microsoft Azure AD and give you the scoop on many of the lessons we have learned on our journey as we have made this the core of our enterprise identity infrastructure. You will leave this webcast with knowledge you can use to help you with your own zero-trust networking and cloud-based identity management journey.

Best Practices for using Microsoft Azure Active Directory (AD)

Even with the best security people deploying the best security scanners, businesses today experience stubbornly long time-to-remediation.

Why? The reality today is that, before any security findings can be fixed, security teams are often forced to play air traffic controller – deduplicating, sorting, and prioritizing findings coming in from multiple siloed tools, then routing and following up with developers all across the organization to make sure problems get fixed. This leads to the ultimate irony - security teams become the main bottleneck for remediation.

But, does it have to be that way? Can security be removed as the middleman between findings and fixers and instead become a guiding and enabling function?

Is the security team the bottleneck to remediation?

The digital transformation of companies is well underway, and as enterprise increasingly adopt cloud-native approaches, attackers have also identified this as the weakest link in companies security posture. The result is a steep rise in attacks that target cloud-native applications, some hitting during development and others targeting production environments and live applications. The only way to combat this is by deploying strong and purpose-built security from code to runtime. But in order to be effective, it cannot be in siloes and it cannot affect development speed and agility. Join this webinar to hear about how you can seamlessly approach this challenge.

The real way to secure from code to runtime (without breaking development)

The explosion in the number and variety of SaaS apps used by enterprises has created both opportunities and a wider attack surface. Examine today's SaaS security landscape and threats with Maor Bin, CEO and co-founder of Adaptive Shield as he reveals the new attack method called "the SaaS Rootkit" as well as perspectives gleaned from security leaders in the 2022 SSPM Survey Report (completed in conjunction with CSA).

Examining 2022’s SaaS Security Landscape and Threats

Panel Discussion 

In the light of the many cloud security related standards (e.g. ISO27017, STAR) that CSPs claim to comply with, how does an enterprise make sense of this plethora of seemingly different or similar frameworks? How does one reconcile these with respect to those specified by the regulators?  This panel of experts will help us to clear the air and clarify the confusion as well as bring to light how programs like CSA STAR help provide a "Implement Once Comply Many" approach.

MODERATOR : John DIMARIA (Assurance Investigatory Fellow & Research Fellow, CSA)

PANELISTS:
- Philip VICTOR (Managing Director, Welchman Keen)
- Ts. Saiful Bakhtiar OSMAN (Head of IT - APAC, Ascent Funds)

Standards, Standards Everywhere, Which One Should I Adopt?

Cloud adoption has been growing rapidly over the years due to business benefits such as cost  savings, scalability, increased security, ease of deployment. In 2020 the world experienced an even bigger upsurge due to the COVID pandemic. This massive growth in cloud adoption also brings about a unique set of challenges when it comes to data privacy and security.

The Security Trust Assurance and Risk (STAR) Program encompasses key principles of transparency, rigorous auditing, and harmonization of standards. Companies that submit to the STAR Registry indicate best practices and validate the security posture of their cloud offerings. They increase the level of assurance by turning their scars into STARs. It’s about reducing complexity, which equals reduced cost, decreased risk and increased security.

Join us on this must-attend as CSA provides you with an insight into the global growing mandate for organizational certification and details behind CSA STAR. During this session you will learn how it has evolved into a framework that provides a flexible, incremental, and multi-layered cloud provider system that is being recognized as the international certifiable harmonized GRC solution, starting with development, implementation and the three levels of the Open Certification Framework that constitute up the STAR Program.

CSA STAR Program – Turning your Scars into STARS

Threat modeling serves to identify threats and preventive measures for a system or application. However, threat modeling is one security methodology that has not matched the general rate of cloud adoption, due to a gap in guidance, expertise, and applicability of the practice. Threat modeling for cloud systems expands on standard threat modeling to account for unique cloud services. It allows organizations to further security discussions and assess their security controls and mitigation decisions. The CSA Cloud Threat Modeling best practice attempts to bridge the gap between threat modeling and the cloud. To that end, this publication provides crucial guidance to help identify threat modeling security objectives, set the scope of assessments, decompose systems, identify threats, identify design vulnerabilities, develop mitigations and controls, and communicate a call-to-action. Central lessons include the benefits of threat modeling, the unique knowledge and considerations required when threat modeling in the cloud, and how to create a cloud threat model.

Example threat modeling cards are provided and can be used by your team for a more gamified approach.

Cloud Threat Modeling

The presentation aims to provide a synopsis about the latest release of the Cloud Control Matrix version 4.0, a greater insight into its development and new components, the current activities of the CCM working group (ongoing works, published and future works) and finally an update on CSA’s STAR program and transition policy from CCMv3.0.1 to CCMv4.0.

Introduction to the Cloud Controls Matrix v4.0

In cloud incidents, it is necessary to coordinate and share information with stakeholders and other organizations which will be discussed. This presentation is for all cloud customers as well as cloud service providers who need a clear framework for sharing incident response practices with customers.

Cloud Incident Response Framework

Within the past 2 years, the rate of new digital transformation projects has been phenomenal. Traditional organizations have quickly pivoted to the cloud as part of their digital transformation initiatives and now interaction with customers happens over this new digital context. As per any form of interaction, be it physical or digital, it takes trust for a customer to engage over such a new digital context. Without trust, customers would not have confidence in providing their personal information and data, or the quality of the service that would be offered by the service provider. This presentation will  share what it takes to build digital trust with customers as well as suppliers / providers in the cloud when there is no face to face engagement but chatbots or virtual assistants, no shaking hands with a customer provider but instead digital signatures and virtual identity verification.

Can there be Digital Trust on the Cloud?

Keynote

The largest employer in the country cannot afford to be left behind on the rapidly increasing pace of the Digital Transformation journey. For this reason, the Government of Malaysia introduced MyDigital, a national blueprint for public sector Digital Transformation covering 6 main pillars including adoption of cloud and 100% adoption of Digital Signature, expansion of telecommunication coverage and manpower digital upskilling. In this presentation, MCMC will share our ongoing efforts as part of driving Digital Transformation in the Public Sector through Cloud Adoption.

Digital Transformation in Public Sector through Cloud Adoption

Introduction & Welcome Remarks
Dr. Hing-Yan LEE (EVP APAC, CSA) 

Welcome Address
Khadijah Ab RAHMAN (Chairman, CSA Malaysia Chapter)

Opening Address
Jim REAVIS (Co-Founder & CEO, CSA)

Welcome Remarks, Welcome Address & Opening Address

A variety of threats affect your cloud security ranging from misconfigurations, network exploitation, brute-forcing, container malware, and account takeover to stolen credentials. These threats can affect your entire cloud estate - across multiple clouds, multiple regions, and multiple accounts with each having its own specific attack surface and active attack patterns. 

SecOps and DevOps teams are inundated with alerts on misconfigurations, CVEs, and active threats and it is a real challenge to prioritize what are the 10 next most critical things to do.

In this talk, we will discuss potential strategies to prioritize which security findings need to be resolved and which can be snoozed for a later time. An ideal burn-down chart to resolve any cloud security alerts should provide optimal additional risk reduction, for every ticket created for an issue to be resolved. 

We will also discuss how coupling runtime monitoring and configuration checking intelligently can help you fix your cloud security in the right order.

How to Prioritize Fixing Your Cloud Security

Join this in-depth interview at RSA Conference with John DiMaria, Global Product Champion for Information Security & Business Continuity at BSI Group.

Viewers will learn John's insights around:
- Preparing for GDPR
- Challenges for the new U.S. administration 
- Protecting our critical infrastructure
- Protecting the IoT: personal accountability, product certifications, regulation
- The threat landscape
- The importance of security awareness training

BrightTALK at RSA - John DiMaria: GDPR, Critical Infrastructure & IoT Security

cybersecurity

risk

business continuity

Cloud computing has exploded over the past few years, delivering a previously unimagined level of workplace mobility and flexibility. The cloud computing community on BrightTALK is made up of thousands of engaged professionals learning from the latest cloud computing research and resources. Join the community to expand your cloud computing knowledge and have your questions answered in live sessions with industry experts and vendor representatives.

Cloud Computing

The IT security community on BrightTALK is composed of more than 200,000 IT security professionals trading relevant information on software assurance, network security and mobile security. Join the conversation by watching on-demand and live information security webinars and asking questions of experts and industry leaders.

IT Security

Increasing expectations for good governance, effective risk management and complex demands for corporate compliance are presenting a growing challenge for organizations of all sizes. Join industry thought leaders as they provide you with practical advice on how to implement successful risk and compliance management strategies across your organization. Browse risk management resources in the form of interactive webinars and videos and ask questions of expert GRC professionals.

IT Governance, Risk and Compliance

As an IT professional, many of the problems you face are multifaceted, complex and don’t lend themselves to simple solutions. The information technology community features useful and free information technology resources. Join to browse thousands of videos and webinars on ITIL best practices, IT security strategy and more presented by leading CTOs, CIOs and other technology experts.

BrightTALK at RSA - John DiMaria: GDPR, Critical Infrastructure & IoT Security

Presented by

About this talk

More from this channel