ISSA Thought Leadership Series: Threat Reports Undone

In this webinar, participants will be introduced to FAIR (Factors
Analysis of Information Risk). FAIR is a quantitative risk analysis
methodology originally conceived of for analyzing information security
risk. Participants will learn the basic concepts behind FAIR and be
introduced to distinctions relevant to doing quantitative analysis of
privacy risk versus security risks.

With October's Cybersecurity Awareness Month approaching fast, it’s important to get security awareness and training top-of-mind with your users. Given that 80% of organizations only allocate two hours or less per year for security awareness, how can you maximize your time with users to ensure behavior change?

In this webinar, we’ll go over proven ways to plan and execute a successful program such as:

· Focusing your program on the riskiest users
· Keeping users engaged and on-your-side
· Benchmarking against top-performing organizations
· Reporting up to key stakeholders

As a part of your attendance, we’ll give you our free eBook, Driving Real Behavior Change: The Complete Guide to Building a Security Awareness Program that Works in addition to other free security awareness materials you can utilize in your program.

By 2021, up to 90% of devices in businesses will be unmanaged - unprotected and un-agentable. Businesses of every segment face this tsunami of new, connected devices. Beyond the traditional laptops and desktops we may use at work, these new smart devices run our operations, manage building automation systems, drive our manufacturing lines, or track and deliver healthcare to patients. Even during the current pandemic, companies are applying these devices in new ways. From contact tracing in hospitals, to cleaning robots in warehouses. These devices are essentially the new endpoint with operating systems, an application, and connect to enterprise networks - even the Internet. But what they are missing is security. This requires a whole new playbook to mitigate security risk and protect the business. How do your security controls stack up in this world of unmanaged devices?

Join Armis’ CISO Curtis Simpson and VP of Product Marketing Christopher Dobrec as they discuss the reality facing businesses with the proliferation of these unmanaged and IoT devices and how to apply agentless device security controls to meet this security challenge.

Can data breach risk be predicted by an organization’s privacy practices? How do privacy and security risk change across different types of organizations? After conducting in-depth research, Osano has discovered that companies with poor practices are more likely to suffer a data breach, and the severity of the breach they experience is many multiples worse.

In this data-driven discussion, Arlo Gilbert, Osano’s Co-Founder and CEO, will present the company’s findings from analyzing more than 11,000 companies and uncovering the important relationship between organizations’ privacy practices are their likelihood of experiencing a data breach. The presentation will break insights down by segments, such as the type of breach and industry.

The lines between privacy and cybersecurity risk are becoming increasingly blurred. Osano’s analysis provides an illustration of how privacy and security are converging, what key risks you should be concerned about, and steps you can take to move forward most effectively.

Key Takeaways

-The probability and severity of data breaches can be predicted by a
company’s privacy practices

-The privacy practices of breached companies differ across
industries, breach types, and record counts

-How the relationship between data breaches and privacy practices
can be expected to evolve in the future

-Specific steps you can take to improve your privacy and reduce your
likelihood of experiencing a data breach

"Thinking of retooling your career? Join the ISSA/ISSA Education Foundation's webinar in an

interview of one of its recent scholarship awardee, Nikki Hendricks and technology and staffing Guru,

Deidre Diamond, Founder and CEO of CyberSN. Find out from Nikki what the challenges are in re-

directing your career to get to the next level. Learn from Deirdre what skills and experience employers are

looking for to protect their customer's NPI and intellectual property. Lorraine Frost, ISSAEF's Scholarship

Committee Chair and International Board member will discuss the Foundation's many scholarship offerings, how to

apply for a scholarship and how you can help tomorrow's cybersecurity professionals enter the field."

We’ve been making some progress to move beyond the mere potentiality of women and diversity in cybersecurity. Yet, most industry experts agree that there is still a great deal of work to be done. To reach a more solid and evolved state that sees a true embrace of diversity and inclusion in the cybersecurity space and, more specifically, in organizations and on teams, we must experience sustained systemic support. Industry and executive leaders must lead the charge in undertaking practical everyday actions and implementing longer-term strategies. Indeed, as one C-level leader explains it, when choices are made to limit a labor pool — intentionally or unintentionally, a lower quality cybersecurity workforce remains which hampers an industry already challenged on still other fronts. So what are some pragmatic actions we all can take and what programs, policies or strategies can organizational leaders spearhead to ensure that they are including and gaining advantages from a diverse array of professionals with different backgrounds, experiences, skills and opinions? This presentation will share just some ideas and suggestions from a few industry pros.

Insider threats from compromised credentials, leading to lateral movement across the network continues unabated. They are notoriously difficult to spot and require lengthy investigations.

Many security operations metrics are time-driven: time-to-detect, time-to-respond, time-to-answer… Security analysts are up against the clock to review, investigate, and act. Manual processes, manual analysis, manual decision making is borne from the idea that machines cannot always be trusted to understand risk as a human would. But the data haystacks continue to grow exponentially, and the needles ever harder to find.

Humans are struggling.

Understanding where and how to focus your analyst’s efforts will help you better protect your organization from risk.

Attend this session to learn about:

-Insider threat and the risks that organizations face
-The “new breed” of insiders and the dangers they pose
-Best practices for developing an insider risk management program
-Leveraging machine learning and automation in the SOC to combat
insider threats

Adversary Emulation is a type of ethical hacking engagement where the Red Team emulates how an adversary operates, leveraging the same tactics, techniques, and procedures (TTPs), against a target organization. The goal of these engagements is to train and improve people, process, and technology. This is in contrast to a penetration test that focuses on testing technology and preventive controls. Adversary emulations are performed using a structured approach following industry methodologies and frameworks (such as MITRE ATT&CK) and leverage Cyber Threat Intelligence to emulate a malicious actor that has the opportunity, intent, and capability to attack the target organization. Adversary Emulations may be performed in a blind manner (Red Team Engagement) or non-blind (Purple Team) with the Blue Team having full knowledge of the engagement.



This webcast will teach you to plan and execute a high value adversary emulation in a blind red team engagement or as a purple team (in collaboration with the defenders/blue team).

Modern cyberattacks are not limited to network intrusions from outside by hackers. “Internal threat actors” can often be found at the center of a complex mix of simple social engineering attacks and sophisticated, multi-staged infections and data breaches.


The Zero Trust model, based on the simple principle of “trust nobody”, defines rules which enhance the security of networks against modern cyberattacks, whether they are initiated from the outside or within. However, with most of the internet traffic being encrypted, it is becoming increasingly difficult to implement the Zero Trust model in an effective way.

In this webinar, we will look at:

*The role of “internal threat actors” and TLS encryption in modern cyberattacks

* How the Zero Trust model defines the future of cybersecurity

* Why effective decryption is essential for a fool proof Zero Trust strategy.

More mid-to-smaller companies are being targeted by cyber attackers with ransomware. According to a recent report, the average-sized company impacted has decreased from 2018 to about 650 employees in 2019. This trend will likely continue.

Join Troy Vennon, who leads the Ohio security community of CISOs and security managers (ISAO), for a discussion about protecting your company with practical steps and tight budgets. Troy will discuss how knowing how vulnerable your company is to ransomware helps you better protect from it.
You will learn from this discussion:
+ Top 3 steps your security team can take to protect your network on a budget
+ How to find, prioritize and close vulnerabilities that expose you to ransomware
+ What best practices other companies are deploying to defend their enterprise from attack