SPVA Panel Session: What's Threatening PCI DSS?

This month's episode of The (Security) Balancing Act will focus on botnets as a growing threat to the enterprise, examples from the real world, and what enterprises can do to better protect against botnet-fueled state sponsored attacks.

Join this interactive roundtable discussion with security experts and industry leaders to learn more about:
- How botnets have become a tool for cyber criminals and nation state actors
- Real-world examples & known botnet attacks
- Nation state ransomware attacks
- DDoS attacks
- Cyber espionage
- ATPs
- The trouble with attribution
- What enterprises and governments can do to address the threat

Panelists:
- Johna Till Johnson, CEO and Founder of Nemertes Research
- Derek Manky, Chief, Security Insights & Global Threat Alliances, Fortinet
- Craig Harber, Chief Customer Success Officer, Fidelis

This episode is part of The (Security) Balancing Act original series with Diana Kelley. We welcome viewer participation and questions during this interactive panel session.

Mentoring programs can increase knowledge and build skills for future goals and milestones, allowing your workforce to grow their skills organically and create cultures of collaboration and success.

Join Part 1 of our series to learn how to design a mentoring program for women and minorities in security that actually delivers for everyone involved.
- Learn from experts on how to design a mentoring program that delivers
- Understand how to make mentoring meaningful for your organization
- Learn what strategic planning steps are critical to make the plan a success

Speakers:
- Virginia "Ginger" Spitzer, Executive Director | ISACA, One In Tech Foundation
- Joy Harrison, Director, Leadership Development Center for Excellence | NTT DATA Services
- Sushila Nair, VP Security Services, Chief Digital Officer | NTT DATA Services
- Kwasi Mitchell, Chief Purpose Officer | Deloitte
This is Part 1 of our new series on mentorship produced by BrightTALK. Sign up for Part 2 via the link in the attachments.

Instead of the traditional "castle and moat" model of the past, today the security perimeter is being defined around the identity of the person or the device requesting access. What are organizations doing to protect digital identities in the age of breaches? How are the current trends in identity and access management helping address this issue?

Join this interactive roundtable discussion with notable security experts to learn more about:
- The shift to identity-centric security
- The zero trust mindset
- What constitutes strong and effective authentication and authorization
- The role of policy orchestration and enforcement
- Best practices for protecting identities and managing access across the enterprise

Panelists:
- Joseph Carson, Chief Security Scientist and Advisory CISO at Thycotic
- Dave Farrow, VP, Information Security at Barracuda
- Jeremy Snyder, Sr. Director, Corporate Development, Rapid7

This episode is part of The (Security) Balancing Act original series with Diana Kelley. We welcome viewer participation and questions during this interactive panel session.

If you don’t fix your security vulnerabilities, attackers will exploit them. It’s simply a matter of who finds them first. If you fail to prove that your software is secure, your sales are at risk, too.

Whether you’re a technology executive, developer, or security professional, you are responsible for securing your application. However, maybe you’re uncertain about what works, what doesn’t, how hackers exploit applications, or how much to spend. Or, maybe you think you do know, but don’t realize what you’re doing wrong.

To defend against attackers, you must think like them. Join Ted Harrington, author of HACKABLE: How to Do Application Security Right and learn:
- how to eradicate security vulnerabilities
- establish a threat model
- build security into the development process

You’ll leave knowing how to build better, more secure products, gain a competitive edge, earn trust, and win sales.

This episode is part of Cyber Authors, a new series with Sushila Nair. We welcome viewer participation and questions during this interactive interview.

This month's episode of The (Security) Balancing Act will look at how the CISO role has evolved in the last few years, what today's expectations are and what it takes to succeed as a CISO.

Some of the topics to be covered during this roundtable discussion with security and tech leaders include:
- How has the CISO role evolved over the last few years and what is expected of CISOs in 2021?
- CISO vs BISO
- How to see ROI on your cybersecurity investment?
- How to get the business to understand risk and care about security?
- How to keep cyber employees happy. The churn is exhausting and costly for companies, and it’s exacerbated by employee burnout and a “grass is greener” approach.

Panelists
- Patricia Titus, Chief Privacy and Information Security Officer, Markel Corporation
- Jonathan Nguyen-Duy, Vice President, Global Field CISO Team at Fortinet
- Gerald Mancini, Chief Operating Officer of Fidelis Security

This episode is part of The (Security) Balancing Act original series with Diana Kelley. We welcome viewer participation and questions during this interactive panel session.

In the shadow of the global pandemic and the associated economic downturn, organizations are focused on cost optimization, which often leads to impulsive decisions to deprioritize compliance with all nonrevenue programs.

Regulators have evolved to adapt with the notable increase in data subject complaints and are getting more serious about organizations that don’t properly protect consumer data. Marriott was hit with a $124 million fine while Equifax agreed to pay a minimum of $575 million for its breach. The US Federal Trade Commission, the US Consumer Financial Protection Bureau (CFPB), and all 50 U.S. states and territories sued over the company’s failure to take “reasonable steps” to secure its sensitive personal data.

Privacy and data protection are enforced by a growing number of regulations around the world and people are actively demanding privacy protection — and legislators are reacting. More than 60 countries have introduced privacy laws in response to citizens’ cry for transparency and control. By 2023, 65% of the world’s population will have its personal information covered under modern privacy regulations, up from 10% today, according to Gartner. There is a convergence of data privacy principles, standards and regulations on a common set of fundamental principles.

The opportunities to use data are growing exponentially, but so too are the business and financial risks as the number of data protection and privacy regulations grows internationally.

Join this webinar to learn more about:
- Trends in modern privacy regulations
- The impact on organizations to protect and use sensitive data
- Data privacy principles
- The impact of General Data Protection Regulation (GDPR) and data transfer between US and EU
- The evolving CCPA, the new PCI DSS version 4 and new international data privacy laws or regulations
- Data privacy best practices, use cases and how to control sensitive personal data throughout the data life cycle

2020 was the year that third-party risk management was put under a microscope. How will this change third-party risk management in the year to come?

Tune in to our fireside chat with industry leaders from SecurityScorecard and CybelAngel as they discuss their top 5 predictions for Third-Party Risk Management in 2021, and how to stay ahead of the risks!

Speakers:
● Drew Wilkinson, VP Professional Services and Customer Success at SecurityScorecard
● Camille Charaudeau, VP Marketing & Product Strategy at CybelAngel

The 2020 US presidential election is behind us, but the key cybersecurity issues surrounding election integrity could linger for years to come. From ransomware attacks on local governments, to the untamed spread of disinformation, to experimenting with online voting apps and the myriad of vulnerabilities uncovered across election infrastructures, cybersecurity had never before taken such a central place in the national conversation as it did in 2020.

So, what have we learned in the aftermath? And how can we apply it to better protect upcoming elections as well as enterprises, customers and employees?

Join this interactive panel with security experts and tech leaders to learn the biggest lessons from the election from a cybersecurity and privacy standpoint. Discover what went down, what could have gone better and how to prepare for the midterm elections in 2022.

- Can we build a hack-free election
- Does misinformation on social sites impact how people vote and what can be done to stop the spread
- What was new this time and what should security leaders keep in mind for their organizations
- Would it be safer if we brought the voting process online or in app
- Can nation state actors change voter rolls or polling data
- What the biggest election threats mean for industry
- Key takeaways for cybersecurity leaders

Panelists:
- Jim Richberg, Public Sector Field CISO at Fortinet
- W. Curtis Preston, Chief Technical Evangelist, Druva

This episode is part of The (Security) Balancing Act original series with Diana Kelley. We welcome viewer participation and questions during this interactive panel session.

Every year top security companies, industry thought-leaders, and tech media publications come out with their predictions for the upcoming year, and every year Dan Lohrmann publishes his roundup of these security industry reports, forecasts, themes and trends.

This BrightTalk webinar will dig into the 2021 prediction report in detail.

In addition to counting down (and referencing) the top 21 security prediction reports from the leading vendors, this webinar will examine:
- Where is their agreement on what’s coming next?
- Where is their major disagreement?
- Where will cyberattacks come from next?
- Which vendors have the best reports (and why)?
- Who are the award-winners for most creative, most likely, most scary and other security industry predictions?

We'll discuss security and tech predictions on Covid-19 and working from home as well as major security incidents such as attacks on global events (like the 2021 Olympics), cyber incident response and much, much more.

We will take your questions at the end, and may even ask you to vote for your favorite predictions (or offer one of your own to share.) Join us now!

This session is Part 10 of the PCI Dream Team series on BrightTALK.

Our panelists are some of the top PCI QSA’s in the country, with decades of combined PCI and card processing experiences. They’ve seen it all: the good, bad and ugly; and lived to tell the tale.

Join Ben Rothke, David Mundhenk, Arthur Cooper, and Jeff Hall for an interactive Q&A session, and get answers to your most vexing PCI questions. No PCI question is out of bounds.

The Cloudscape provisions a shared/split model for responsibility. This generally means that the cloud provider is responsible for certain layers of the environment. But the provided graphics are usually more IT focused than Information Security let alone Risk Management. The information security elements of cloud have been improving for years. However, there are still areas that are light in detail or clarity This presentation will take you on a deeper dive of Cloud GRC. This presentation will use the premise of Platform (PaaS) clouds, as this model provides a clear “bang for the buck”. Other models (Infrastructure IaaS, Software SaaS) are do provide benefits, but at different specialization levels. In this conversation, we will discuss repercussions of the shared/split responsibility model. In this webinar you will learn:

· Viewpoint changes
· To distinguish shared responsibility and shared risk
· Changes to compliance and continuous monitoring
· Changes to Risk management and assessment from shared/split responsibility model
· and what you are (really) protecting

Earlier this year many companies experienced an incredible shift to fully remote work almost overnight, in response to the COVID-19 pandemic. This accelerated the “digital transformation” journey for many companies compressing what was a multi-year timeline into a few months and making 2020 different than any other previous year. In this episode we’ll explore how the balance between security, privacy and productivity was tipped this year, and what can we expect to see in 2021 as some, but not all, organizations head back to office work with a post-pandemic mindset.

The audience will hear from CISOs and Security Directors about how this year was different, what they're going to do differently going forward, and what they expect (or have already seen) as organizations get back to pre-COVID levels.

Topics covered:
- 2020 in review
- The hard lesson that a mobile workforce is not the same as a remote workforce
- How the attack surface expanded and what CISOs are doing to ensure risk doesn’t expand too
- How digital transformation sped up and what they meant for security, privacy and productivity
- During the speedy journey to the cloud - what mistakes were made?
- Lessons learned that will be carried forward for security teams
- What CISOs are doing to prepare for whatever 2021 may bring

Panelists:
- Mark Weatherford, Chief Strategy Officer and Board Member, National Cybersecurity Center
- Amir Shaked - VP, R&D, PerimeterX
- Ted Harrington, Executive Partner, Independent Security Evaluators [ISE]

This episode is part of The (Security) Balancing Act original series with Diana Kelley. We welcome viewer participation and questions during this interactive panel session.

As your enterprise moves to the cloud, you need to develop a holistic cloud security strategy. Should you adopt tools developed and provided by cloud platform providers, or is it better to invest in third-party offerings? Now you can discover cutting-edge strategies from industry leaders and leverage best practices to easily secure your cloud investments.

Moderated by ISACA GWDC, join this insightful discussion that brings together leading cloud IT Integrator NTT DATA, cloud service provider Microsoft, and cloud security solution provider.

Sushila Nair, VP, Security Services, NTT Data
Matt Soseman, Sr. Security Architect, Microsoft
Scott Vachal, Founder, Soter Cloud Solutions
John Aarsen, Cybersecurity Expert & Territory SE Northern EMEA, SonicWALL

The 2020 U.S. presidential election has brought cyber security to the forefront for many in the U.S.

From shedding light on disinformation campaigns aimed at disrupting the election, to testing voting machines and pentesting online voting apps, to raising awareness around the risk of ransomware and other attacks to local governments, voter registration databases, poll books and election reporting websites - security researchers and practitioners have been raising red flags throughout the election cycle.

Join this episode of the Election Hacking series to learn about:
- The 2020 election takeaways from a cybersecurity viewpoint: What went down, what could have gone better and how to better prepare for the midterm election in 2022
- What the biggest election threats mean for your industry and organization
- What have we learned and will it change anything in time for 2022
- Post-election cybersecurity lessons for tech leaders

Panelists:
- Lee Imrey, Security Strategist at Splunk
- Harrison Morris, PhD Candidate Georgia Tech researching the intersection of Cybersecurity and Cognitive & Brain Sciences
- Mick Baccio, Security Advisor, Splunk

Moderator: David Morris, Executive Director at Digital Risk Management Institute

This episode is part of the Election Hacking Original series examining the threats to democratic elections, the technologies used to power and hijack elections, and what's needed to educate and empower voters before Election Day.

When it comes to deception technology, the industry is evolving beyond simple honeypots to a more automated, scalable, and effective approach.

Join this episode of The (Security) Balancing Act to discover how deception technology can be used by organizations to detect, investigate and respond to malicious intruders. How does deceiving the attacker save your company and buy you time?

During this episode, we'll go over:
- What is deception technology and what does it help with?
- How does it work? (e.g. Deception decoys, lures, honeytokens, traps, grids)
- Is your organization ready to adopt deception?
- What do you need to do before you buy the technology / build it in-house?
- Key benefits of using deception for threat hunting
- What else can deception be used for?
- Deception use cases
- The role of AI in deception (e.g. dynamic deception)

Panelists:
- Chris Roberts, vCISO, Researcher, Hacker, Consultant, Devils Advocate
- Christina Fowler, Chief Cyber Intel Strategist at MITRE Corporation

This episode is part of The (Security) Balancing Act original series with Diana Kelley. We welcome viewer participation and questions during this interactive panel session.

The client-side or the front end of web applications, aka ‘digital user experience,’ actively ingests customer/user information at data input points that can include very sensitive information.

As the web front-end code runs on unmonitored and untrusted devices, spyware, malware and other malicious actors leverage client-side security flaws and third-parties to steal credentials, financial transactions and payment card data to conduct fraud.

Speakers:
- David Mundhenk, Information Security Consultant, Herjavec Group
- Ivan Tsarynny, CEO and Co-Founder, Feroot Security
- Tabitha Gallo, Principal Security and Privacy Consultant in the Advisory Services team, Herjavec Group

With the 2020 U.S. presidential election less than a month away, let's take a look at the current state of this election from a tech and cybersecurity perspective. What are the new challenges and threats to democracy that we have not seen in previous election cycles?

Join this panel to ask your questions and learn more about:
- Things to keep in mind ahead of Election Day
- Lessons from recent cyber attacks in the public & private sector
- Securing voter databases and election infrastructure
- Election reporting websites and when to expect to hear the results of the election
- Weeding through election interference and disinformation
- What to expect after Election Day

Panelists:
- Mick Baccio, former CISO at Pete for America, and White House Threat Intelligence Branch Chief, Security Advisor at Splunk
- Harrison Morris, PhD Candidate Georgia Tech researching the intersection of Cybersecurity and Cognitive & Brain Sciences

Moderator: David Morris, Executive Director at Digital Risk Management Institute

This episode is part of the Election Hacking Original series examining the threats to democratic elections, the technologies used to power and hijack elections, and what's needed to educate and empower voters before Election Day.