Name: Are You in Control of Your Network? Ask Your Firewall...
Start: 2011-11-08T17:00:00Z
End: 2011-11-08T17:59:46.000Z
Location: BrightTALK
Rating: 3

This channel features presentations by leading experts in the field of information security. From application, computer, network and Internet security to access control management, data privacy and other hot topics, you will walk away with practical advice for your strategic and tactical information security initiatives.

This session provides practical advice to establish cybersecurity metrics, Key Performance Indicators (KPIs) and Key Risk Indicators (KRIs). We begin with an explanation of the differences between them and why each are needed. Examples of how to design metrics, KPIs and KRIs are provided. Areas of focus include cybersecurity measurements for all organizations, for processes & functions and in alignment with a control framework. The end game is to measure if processes and controls are functioning as designed.

We also walk through tips for communicating new metrics and go-to-green updates for metrics in red or yellow status. The session includes 22 metrics and seven resources for many more. All of this saves time and can assist with enhancing your program.

About the speaker:
Gideon Rasmussen is a Cybersecurity Management Consultant with over 20 years of experience in corporate and military organizations. Gideon has designed and led programs including Information Security (CISO), PCI - Payment Card Security, Third Party Risk Management, Application Security and Information Risk Management. Has diverse cybersecurity industry experience within banking, insurance, pharmaceuticals, DoD/USAF, state government, advertising and talent management. Gideon has authored over 30 information security articles. He is a veteran of the United States Air Force, a graduate of the FBI Citizens Academy and a recipient of the Microsoft Most Valuable Professional award. Gideon has also completed the Bataan Memorial Death March (4 occurrences). He is certified in many programs including CISSP, CRISC, CISA, CISM, CIPP, ITILv3, and NSA-IAM.

Cybersecurity Metrics, KPIs and KRIs

In today’s rapidly changing world, it’s very easy to lurch from issue to issue without stopping to pause and think strategically about where the issues are coming from and how you can prevent the next one from being a career-defining incident. 

In this talk, Quentyn will take a light-hearted view of eight issues he sees frequently today; how they have developed, and how to avoid them keeping you up at night.

8 Things That Keep CISOs Up At Night (You Won't Believe Number 4!)

Cyber attacks are not random acts that affect only a few. They are calculated ambushes that will impact you at some point -- whether you're prepared or not. Join this session as Jim Goldman discusses the state of cybersecurity, the implications of an attack, and what you can do to best mitigate your risk to protect yourself and your business. 

About the speaker:
Jim Goldman is the co-founder and CEO of Trava, a company created to protect small and medium-sized businesses from the potential damage of cyber threats through risk assessment, security strategy, and cyber insurance. He is a nationally published author and frequently requested speaker and subject matter expert on technical topics and security topics. Prior to founding Trava, he was a faculty scholar at Purdue University where he served as a professor and associate department head. He started a research lab serving the FBI and trust organizations for cloud computing companies that included Salesforce. And while at Salesforce he was responsible for enterprise-wide security governance, risk management, and compliance and built the company's first Security GRC organization.

It's Not Cyber Crime, It's Cyber Warfare

As threat vectors grow in complexity and detail, it is increasingly evident that measures like CISA’s Shields Up are necessary for today’s environment. Between cyber operations as part of the Russian invasion of Ukraine, continually high ransomware payments, gaps in the cybersecurity workforce, and the continued theft of U.S. intellectual property by foreign adversaries -- threats range from the short, medium, and long term. But really, all are tenets of national security. 

With such a variety of threats to choose from, it is more important than ever to chart cyber threats and their probability. This talk will discuss the likelihood of different threat vectors, and new threat vectors that are important to monitor in 2023 – especially as they impact the sectors that face the most cyber risk in the new year. 

About the speaker:
Tatyana Bolton is the Policy Director for R Street’s Cybersecurity and Emerging Threats team. She crafts and oversees the public policy strategy for the department with a focus on secure and competitive markets, data security and data privacy, and diversity in cybersecurity. Most recently, Bolton worked as the senior policy director for the U.S. Cyberspace Solarium Commission focusing on U.S. government reorganization and resilience portfolios. From 2017-2020, Bolton also served at the Cybersecurity and Infrastructure Security Agency as the cyber policy lead in the Office of Strategy, Policy and Plans where she developed strategies for strengthening the cybersecurity of our nation’s critical infrastructure.

The Emerging Cyber Threats of 2023

Why do we do the things we know we shouldn’t, and not do the things we know we should? Take password managers: Most of us know they’re an easy, useful tool that enhances our security, but not enough of us actually use them. What’s the reason behind this? Lisa Plaggemier, Executive Director of the National Cybersecurity Alliance, reveals new research from the Alliance about the public’s attitudes and beliefs about security, as well as potential drivers and barriers towards secure habits.

About the speaker:
Lisa Plaggemier is Executive Director at the National Cybersecurity Alliance. She is a recognized thought leader in security awareness and education with a proven track record of engaging and empowering people to protect themselves, their families, and their organizations.  Lisa has held leadership roles with the Ford Motor Company, CDK, InfoSec and MediaPRO, and is a frequent speaker at major events including RSA, Gartner and SANS. She is a University of Michigan graduate (Go Blue!) and while she wasn’t born in Austin, Texas, she got there as fast as she could.

A Whole Lotta BS (Behavioral Science) About Security

As cybersecurity experts, our overall goal is to protect the confidentiality, preserve the integrity, and promote the availability of data for authorized use—all without inhibiting the business from meeting its objectives. But what about the times when we must say “no” for various reasons? This interactive session focuses techniques for having a diplomatic “crucial conversation” with the business when a request just can’t be approved.

About the speaker:
Tamika Bass is an Information Security professional with more than 15 years’ experience in information security, including information security governance and risk management. Tamika is passionate about improving communication and understanding of information security in the industry. Tamika is an active speaker, college professor and enjoys spending her time educating technical staff on the importance of communicating effectively in the Information Technology space. Tamika holds the following certifications: CISA, CRISC, HCISPP, CBCP.

When the Answer Really Is “No” -- How to Say It Diplomatically

Senior management is generally supportive of cybersecurity and lower-level staff do what they’re told to do. Middle management, however, is beset by perverse incentives to sell, sell, sell; cut costs; and do more with less. This leaves them without enough mind-space left to focus attention on cybersecurity. 

Tune into this cyber-session to discover tips and ideas covering:
--Finding and fixing the middle management weak spots.
--The consequences of a cybersecurity culture based on inaction.
--Potential solutions, tailored for middle managers, to enhance a cybersecurity culture. 

About the speaker:
Steve holds certification as a Master Business Continuity Professional (MBCP) as well as a Certified Information Systems Security Professional (CISSP) and a Certified Information Systems Auditor (CISA). He is a specialist in business continuity management, IT disaster recovery planning, and information security and has implemented programs for numerous banks, government agencies, and industrial corporations. Before founding Risk Masters, Steve was with Deloitte & Touche as the leader of their Business Continuity Management practice. In recent years, his focus has been on the resilience of large business and technology environments. He is editor of the multi-volume series, e-Commerce Security, and author of several of the books in the series.

The Tone in the Middle: The Biggest Hindrance to a Cybersecurity Culture

Security Partners at Adobe provide product teams with guidance needed to help improve overall security posture. They partner with risk management, operational and application security teams to help product teams create unified security roadmaps and provide needed visibility for executive teams. This partnership has helped to elevate security and risk conversations into stronger business value conversations and improve overall risk management across Adobe.

Astrid Bailey, Security Partner Program Owner, will talk about her experience in building this program and scaling it using a tiered model to be effective across 200 product teams at Adobe. She will discuss lessons learned as she and her colleagues:
- Worked to get security requests positioned more strategically in product roadmaps.
- Made use of automation and standardization to help ensure management and executive teams are getting the information they need to make better security decisions.
- Improved the overall relationships between key security team leaders and product team leaders.

The best practices learned in developing this program will be beneficial to any organization looking to strengthen and improve the effectiveness of the relationship between security and other technical teams. Such an effort can help ensure your teams are even more invested in your overall risk management strategy.

About the speaker:
Astrid Bailey has been an IT project/program manager for over a decade. She has worked in numerous industries and on diverse efforts such as managing software development teams, coordinating large-scale vendor integrations to support corporate tradeshows, and, most recently, leading several key security programs at Adobe that focus on cross-org collaboration. In 2022, Astrid completed a Master of Science, Information Systems (Cybersecurity Management) at the University of Utah. Additionally, Astrid has her PMP certification and is an Associate of ISC2.

Building a Stronger Security Partner Team

In recent years, much attention has been paid to the technology that prevents malware and malicious attackers from wreaking havoc in enterprise systems, especially during the COVID era. Multi-factor authentication? Check. Robust access control? Check. Intelligent firewalls? Check. 

Still, a lot of IT enterprise leaders overlook the importance of the IT compliance function in identifying COVID symptoms, especially the “people” aspect of the information technology triad of people-process-technology. In this presentation, Ralph Villanueva will speak about the vital role IT compliance plays in securing the enterprise by identifying these post COVID symptoms, and what enterprise IT leaders can do to harness their valuable expertise and unique role in the organization.

About the speaker:
Ralph has been keeping his employers compliant with IT and cybersecurity requirements across numerous and diverse regulations such as the Nevada Gaming Control Board, Payment Card Industry, COSO-Integrated Framework, COBIT and ISO 27001 since 2007, and data privacy since 2017. His more than two decades of internal and IT audit and compliance work in the US and the Asia Pacific region provide him with insights not only in enforcing IT and cybersecurity requirements in light of changing regulatory and technical environments, but also in anticipating and dealing with future. Ralph has also earned numerous certifications such as the ISO 27001LA and ISO 27701LA, CISA and CISM, PCI-ISA and PCIP, CIA and CRMA, CFE, CPA and ITIL. Since 2010, Ralph has regularly spoken at over 40 conferences.

The IT Compliance Role in Safeguarding the Enterprise from Post-COVID Symptoms

People are crucial to the success of your cybersecurity culture. With the rate of change in cyber and information Security, we need to start thinking differently about bringing our teams up to speed. This session will discuss some tips and ideas to build a more robust training and learning solution for your security team and create security champions throughout your organization. We will also explore the importance of providing career pathways to encourage growth and career advancement of your current teams and how to attract new talent. 

About the speaker:
Connie Matthews Reynolds is the Founder/CEO of ReynCon, LLC (REST- ReynCon Educational Services & Training). Her passion drove her to start her own company, to help companies and individuals seek to build more awareness toward soft and technical cybersecurity training and provide professional services to assist organizations in improving their security posture. A believer in the importance of giving back to the community, she is also President, Central Ohio ISSA; founding member of EmpoWE-R Women of InfoSec, named in Cybercrime Magazine's 181 Top Women in Cybersecurity to follow on Twitter and Columbus Business First's Who’s Who to Follow.

Building a Cybersecurity Culture: It's Time to Think Differently About Training!

Based on hands-on experiences from a large number of cloud application development projects, Karl has compiled a list of top 5 key security pitfalls that are common across all application types and team sizes. In this session, he will share what these security pitfalls are, why they matter, and how to mitigate them.

About the speaker:
Karl Ots is a cloud and cybersecurity expert, as well as international speaker and trainer, with a broad range of deep Azure expertise. He believes that secure cloud technologies are the key to successful digital transformation. He applies his passion as Head of Cloud Security at EPAM Systems. Karl has been working with Microsoft Azure since 2011 in a variety of forums ranging from large projects to speaking at largest tech conferences, such as Microsoft Ignite. Karl is a Microsoft Certified Trainer (MCT) and a Certified Information Systems Security Professional (CISSP). He is the author of Azure Security Handbook.

Top Public Cloud Security Fails and How to Avoid Them

Since the birth of the Internet, it has been missing a layer of identity protocols that define identifiers for people, organizations and things separate from an application, making identity and access management more and more complicated as enterprises are moving to a multi-cloud strategy and face advancing threats from attackers. 

In the presentation, Kaliya Young, widely known as the Identity Woman, is going to introduce some new and emerging Internet identity standards and technologies, e.g. W3C Verifiable Credentials, W3C Decentralized Identifiers, which can help enterprises improve application security significantly at multiple fronts:
• Identity and access management across multiple cloud environments; 
• Workforce and customer identity and access management; 
• Information/data security management.

Implementing Emerging Identity Standards for Better Application Security

One of the most transformative recent shifts within application development in a cloud context is the rise of IaC -- infrastructure as code technologies like Terraform and CloudFormation. As organizations make more use of IaC, it's important for security organizations to pay attention. Why? Because IaC changes the risk equation -- it introduces some new potential risks, and can help close some existing ones.  

This discussion aims to answer these questions:
• Why/how IaC requires thinking about security of assets a new way.
• Artifacts produced by IaC and how they can help us.
• Security “gotchas” and things to watch out for when changing to IaC.
• How you can tailor your security program in light of IaC.

Ed Moyle is currently Director of Software and Systems Security for Drake Software.  In his 20 years in information security, Ed has held numerous positions including: Director of Thought Leadership and Research for ISACA, Application Security Principal for Adaptive Biotechnologies, Senior Security Strategist with Savvis, Senior Manager with CTG, and Vice President and Information Security Officer for Merrill Lynch Investment Managers.  Ed is co-author of Cryptographic Libraries for Developers and Practical Cybersecurity Architecture, and a frequent contributor to the Information Security industry as author, public speaker, and analyst.

Better Security IaC

There was a time when applications were hosted on a traditional computing model. All hardware and software resided in-house. Companies maintained physical servers on-premises in a secure climate-controlled room with a secure level of access. Only Network Engineers were allowed access to application security as it mainly revolved around the network (port, FW) and OS level protection with security-level access to server rooms. But times have changed. Companies now have more to gain with a more layered approach to application security. 

Tune into this presentation to hear TD Bank's Application Release Engineer Pankul Chitrav discuss the challenges faced by businesses still using the traditional model and how we can overcome these challenges by implementing a layered security model.

Define Application Security Accurately To Generate Business Success

Tune into this session to hear cloud expert Dwayne Natwick provide guidance for configuring and managing hybrid and multi-cloud resources within cloud native tools for complete security posture management of your infrastructure. After configuring resources for security posture management, you will learn how to configure vulnerability scans on these resources for next level security posture management.

Key takeaways attendees will learn include:
--The evolving types of infrastructure with multiple cloud providers and on-premises architectures.
--Options that tools provide for multi-cloud and hybrid infrastructure security posture management.
--How to manage security posture through cloud-native tools for the full infrastructure.

About the speaker:
Dwayne is a Global Principal Cloud Security Technical Lead/CTO for Atos across Microsoft, AWS, and GCP.  He is the thought leader determining trends, developing, advocating, and building business plans for the overall cybersecurity services for this global systems integrator. Dwayne also leads the cloud education portfolio for Microsoft and AWS. In addition to creating curriculum, training, and blog writing, he is a Microsoft MVP and a Microsoft Certified Trainer Regional Lead. Dwayne has spoken at conferences and user groups globally on cloud security, identity security, and data/AI trends. Dwayne has authored books and is a Security Professional Community Manager for Packt Publishing.

Security Posture Management for Multi-Cloud and Hybrid Infrastructures

Spreading operations across more than one cloud enables organizations to choose from a variety of cloud services to cut costs, improve operations and improve scalability. However, operating complex environments across multiple platforms requires a comprehensive strategy to handle connectivity, applications, data and security.

In this panel, experts will discuss how organizations can evaluate risks in their own and their cloud service provider environments, as well as technologies and tools that can assist in achieving a comprehensive strategy.

Join us to learn about:
--Understanding cloud scope across the organization
--Cloud governance frameworks
--Pros and cons of centralizing security access and monitoring controls
--Multi-cloud management and network security analytics platforms
--Cloud security posture management (CSPM) tools that can identify misconfigurations and risks
--Tools for cloud compliance monitoring

Build a Multi-cloud Strategy that Supports Governance and Compliance

Organizations are adopting multi-cloud strategies to leverage capabilities of different cloud security providers (CSPs) and to provide flexibility to software development teams. But this brings up challenges for security teams who are responsible for managing security risk and meeting compliance regulations for workloads and applications running in different environments. In this session, ESG Senior Analyst Melinda Marks explores how to supercharge your security to gain the visibility and control you need to scale security programs for multi-cloud environments.

Supercharge Your Security for Multi-Cloud

Cybersecurity has not only become a regular boardroom topic, but may soon be a requirement. If proposed SEC legislation takes hold, all publicly traded companies must have a process in place to disclose cybersecurity incidents and more importantly, must actively identify and manage cybersecurity risks with board of directors’ oversight.  This legislation will likely have a trickle-down effect on many private companies as well. 

While some organizations have already undergone this journey, we expect that numerous companies are late to the party and haven’t begun to determine what this change means for them. This session will help you develop a game plan to right-size security for your organization by addressing the following key issues:

• Who should fill this role?
• Where to start?
• The art of incident response and reporting.
• What are some of the functionalities the SEC will be looking to include:
      o Controls to prevent unauthorized access
      o Monitoring
      o Measures to detect, mitigate, and remediate cybersecurity threats
      o Third-party risk management
• Coordination with legal counsel and financial advisors.

Coming Soon -- CISO Observability in the Boardroom

The world of network security threats has changed radically and chances are your firewall is not providing the security you need. This 40 minute webinar reveals what has changed and how you can easily make the switch to a Next-Generation firewall. Customers who have traded-up to SonicWALL will share their challenges and perspectives on making the switch from Cisco, Check Point and others.

Are You in Control of Your Network? Ask Your Firewall...

SonicWALL

firewall

security

The IT security community on BrightTALK is composed of more than 200,000 IT security professionals trading relevant information on software assurance, network security and mobile security. Join the conversation by watching on-demand and live information security webinars and asking questions of experts and industry leaders.

IT Security

Increasing expectations for good governance, effective risk management and complex demands for corporate compliance are presenting a growing challenge for organizations of all sizes. Join industry thought leaders as they provide you with practical advice on how to implement successful risk and compliance management strategies across your organization. Browse risk management resources in the form of interactive webinars and videos and ask questions of expert GRC professionals.

IT Governance, Risk and Compliance

As an IT professional, many of the problems you face are multifaceted, complex and don’t lend themselves to simple solutions. The information technology community features useful and free information technology resources. Join to browse thousands of videos and webinars on ITIL best practices, IT security strategy and more presented by leading CTOs, CIOs and other technology experts.

Are You in Control of Your Network? Ask Your Firewall...

Presented by

About this talk

More from this channel