Security in the Age of Open Source

Do you spend countless hours assessing businesses risk, stuck in spreadsheets, sift through emails to find the most up-to-date information? After gathering all the necessary information from your line of business, you still need to review, validate, analyze, and assigned a risk score. All of this must be done before actionable insights can be drawn or mitigation efforts can take place. There is a significant gap in how risk is assessed and rate at which your business operates today. As your program evolves, the need to simplify the risk assessment process becomes unavoidable. But a common reality is that as your business continues to develop, risk assessment practices and resources have largely remained the same. It’s not as simple as getting a risk management tool; it’s about finding the right technology to adapt your processes in line with your current risk landscape and business objectives. On July 8, 2021 at 1:00 pm BST. OneTrust GRC and (ISC)2 will review risk assessment best practices businesses should consider based on leading industry standards from ISO 31000, NIST CSF, and the latest DOJ Corporate Compliance Guidance. We will also share how to:

· Familiarize yourself with proven best practices and new perspectives on risk assessments

· Identify opportunities to collect risk insights in context through an automated questionnaire process

· Streamline risk identification with automation rules tied to your risk methodology

In the latest edition of the biannual Unit 42 Cloud Threat Report, researchers analyzed data from hundreds of cloud accounts around the world between October 2019 and February 2021 to understand the global impact of COVID-19 on the security posture of organizations. In response to the global pandemic, organizations globally increased their cloud workloads by more than 20%, leading to an explosion of security incidents. This led to the conclusion that rapid cloud scale and complexity without automated security controls embedded across the entire development pipeline are a toxic combination. Join Palo Alto Networks and (ISC)2 on June 29, 2021 at 1:00p.m. BST for a discussion that provides a deep dive into the findings. Topics covered will include:

- How the latest cloud threats may be affecting your organization

- Which industries suffered a spike in security incidents in light of the pandemic

- Best practices your organization can apply today to stay protected

Cybercriminals must become masters of evasion if they are to be successful. Many threats, such as APT’s, are designed to remain hidden for weeks or longer as they slowly monitor their victim, compromising select information in a way that is also intended to go unnoticed. Others, like ransomware, may only need to hide their malicious intentions long enough to infect and begin encryption processes. And even when these attacks trip some defensive sensor, it can take analysts days to investigate and launch an effective incident response, often too late to prevent significant damage. Join Infoblox and (ISC)2 on June 22, 2021 at 1:00 p.m. BST as we assess evasion methodologies and the value of DNS, with some unique EMEA callouts, to counter them across the kill chain including:

• Why does DNS visibility expose threat activity other solutions miss?

• How can DNS visibility be used to make other solutions more effective?

• What role does DNS play in investigation and response?

As businesses constantly evolve and grow, so does an organization's attack surface. The pace and velocity of technology transformation in enterprises has created a difficult environment for security teams to defend against complex threats. Join Beyond Trust and (ISC)2 on June 15, 2021 at 1:00 p.m. BST for a webinar where will examine how Privileged Access Management (PAM) can support the security team as an enabler to digital transformation, while providing one of the most effective ways to stop lateral movement by threat actors.

Key topics to be covered include:

· What Is Digital Transformation and why should we care about it?
· Why automation isn’t just for the business
· How to mitigate identity risk with Privilege Access Management

If the idea of automating breach response fills you with a sense of uneasiness, you’re definitely not alone. But the flipside of doing everything manually isn’t ideal either…and can actually bring more risk to a situation, especially during a major incident. On June 10, 2021 at 1:00 p.m. BST, Join Sam and Jess (aka The Real Housewives of Automation) of Exabeam and (ISC)2 for a session where we will explain where, how and when automation can help you investigate and respond quickly, accurately, and without creating a LinkedIn profile updating moment. We’ll also examine:

· End to end automated vs manual response – a look into a real breach through two different lenses
· The machines are our friends – how automation will help your team thrive
· Raging alongside the machines – how to get the right balance
· Investigation and response automation – where to start and how to finish

What is the value of trust for a company, and what role does a security leader play in order to enable it? On June 8, 2021, at 1:00 p.m. BST, Duo Security Advisory CISO Helen Patton and (ISC)2 will discuss the factors that make a company trustworthy, and how a security team builds trust within an organization. We will review the Cisco Security Outcomes Study and consider the trust-based activities that enable positive security outcomes. Attendees will be provided with actionable suggestions for improving security and trust in their organization.

Every organization is working to reduce the delay between issuing a risk assessment, receiving a response, gaining risk insight, and making a risk-based decision. Risk insights quickly lose value as time elapses from the initial assessment request. Businesses should leverage the digital workstreams to collect information as updates occur using data discovery tools to find, document, and classify in real-time. Join OneTrust GRC and (ISC)2 on June 3, 2021 at 1:00 pm BST as we explore how to quickly connect enterprise data through automated data discovery and translate the data into meaningful risk insights. We’ll also examine how to:

· Identify data across business applications for the latest risk insights.

· Automatically categorize information to deliver meaningful insights across risk, compliance, and your executive teams

· Explore a new way to quantify risk using risk formulas to aggregate and standardize risk using real-time data points

In a year when a global pandemic significantly changed how and where we work, the CrowdStrike 2021 Global Threat Report has never been more highly anticipated. This year, the report exposes how cyber adversaries have exploited the situation, accelerating attacks and introducing increasingly damaging tactics, techniques and procedures. On April 13, 2021 at 1:00Pm BST, CrowdStrike Technology Strategist, Zeki Turedi and (ISC)2 will examine the notable threats, events and trends in the report, including pragmatic recommendations to help you better defend against cyberattacks in 2021 and beyond. We'll also examine:

· How the COVID-19 pandemic has changed cybersecurity

· How "big game hunters" are targeting the healthcare sector

· Significant nation-state-based targeted attacks and operations observed from China, Iran, DPRK, Russia and others

· The CrowdStrike eCrime Index and how it measures the strength of the cybercriminal market over time

This year, Cisco hosted the first global, virtual Cisco Live 2021 event. Customers from all around the world converged virtually to experience the latest technology innovations, network with peers and colleagues, and find out what Cisco has in store for 2021. We will cover the latest hot topics within cybersecurity including how companies are protecting their workforce remotely; what the future of work looks like and how companies are shifting towards a cloud security which including trends that we have seen emerging with SD-WAN and SASE. Join Cisco and (ISC)2 on May 27, 2021 at 1:00 p.m. BST as we discuss the key takeaways on Cloud Security arrived at during the Cisco Live 2021 event.

Every day, wars are being waged on invisible battlefields. The enemy is hiding and stealthily leveling its attacks from within. This formidable foe isn’t an opposing army. It may very well be a single malicious actor, or a state-sponsored group of hackers. Without a trace of their tools left on the disk, attackers are storing the code in memory–resulting in infamous Fileless Malware. If successful, the best case scenario outcome is a tarnished reputation; the worst, significant (and potentially irreparable) damage to a brand and its business. Join Intezer Labs and (ISC)2 on May 25, 2021 at 1:00 pm BST for a discussion on how attacks like these can cripple an organization without its security team ever knowing it.

Communicating Cybersecurity for non-technical users is a common challenge across organizations, who commonly perceive cybersecurity as a needed expense and cost center. Leveraging a Risk Based approach, such as the one provided by Security Ratings, allows you to better understand and communicate risks coming from gaps in your Security Program, prioritize and justify investments to the business, bridging the gap to technical stakeholders acting upon the cybersecurity issues and incidents. Join BitSight and (ISC)2 on May 20, 2021 at 1:00 p.m. BST as we look at how Security Ratings can provide an unbiased metric to your external security performance, while complementing your operational tools with both an operational view, and a strategic perspective to prioritize your greatest risks, measure performance, and communicate to stakeholders.

As organizations continue to struggle to find trained cybersecurity professionals to build out their teams, recruiters and hiring managers may need to adjust the tactics they use to proactively identify internal and external candidates. Developing bench strength by targeting candidates who have transferable skills can lead to long term depth and stability on security teams. Understanding who to look for and managing their expectations of what cybersecurity roles entail is critical to success. Join Clar Rosso, CEO of (ISC)2 on May 18, 2021 at 1:00 p.m, Eastern/10:00 a.m. Pacific as she provides an overview of the 2021 (ISC)2 Cybersecurity Career Pursuers Study, which surveyed both experienced cybersecurity professionals as well as jobseekers considering a career in the field. The study examines such topics as which tasks and experiences make a cybersecurity professional successful, the value of mentorship, at what point in their careers pursuers seem likely to seek a cybersecurity path, what attracts people to the profession and which qualities rank as strong indicators of future success for team members.

The MITRE Engenuity ATT&CK Framework has become an integral part of IT security. Every year, MITRE Engenuity tests the most important Endpoint Detection & Response (EDR) manufacturers and checks how well they perform in a real attack scenario (the ATT&CK Evaluations). Every year the results are eagerly awaited as they are an important decision-making tool for companies when determining their security strategy. On May 18, 2021 at 1:00 p.m. BST, SentinelOne and (ISC)2 will provide detailed insight into the criteria used for the evaluation, the latest results and how they should be interpreted. We’ll also examine:

· Why the ATT&CK evaluation is relevant for your company

· How the ATT&CK evaluation is tested

· How to evaluate the results most effectively

· How SentinelOne compares to other manufacturers