Are You in Control of Your Network? Ask Your Firewall...

With organizations moving infrastructure to the cloud at a record pace, building a perimeter wall around your organization is no longer a viable option for securing your data. Cloud computing completely changes the attack surface available to be exploited and can create potential security vulnerabilities for those unaware of what to look for. Fortunately, the data provided by cloud providers can be your best tool for identifying and mitigating threats. We will take a look at how threat hunting changes in the cloud.

For the 2014-2020 DBIR (Data Breach Investigations Report) timeframe, annually, we see Financial motive underlying breaches between 67% and 86% of the time and Espionage motive as the driver between 10% and 26% of the time. Given their nature (e.g., stealthy tactics, specific targeting), Espionage attacks can be difficult to detect and identify as an actual Espionage-related attack (given scant IoCs and other details). Whereas Financial attacks—if not detected while occurring or soon thereafter—eventually become apparent when money goes missing. At that point, the Financial motive, if not already ascertained, can be determined.

When we look at the VERIS (Vocabulary for Event Recording and Incident Sharing) A4 Threat Model—Actors, Actions, Attributes, Assets—we see similarities with and differences between data breaches involving Financial attacks and Espionage attacks. Join this session and discover:

· how data breaches with Financial and Espionage motives compare
· how data breaches with Financial and Espionage motives differ
· what can be done to counter either Financial and Espionage attacks

Due to the fast pace the organizations are using for their digital transformation, cybersecurity excellence is becoming difficult to achieve.

Most organizations need to consider not only a single network to secure, but also mobile developments, hybrid cloud implementation, among many other environments. This also includes a complex software development lifecycle, like DevSecOps, microservices, containers, etc.

Being on the top of the game is hard, so it is better to have a good strategy to be proactive to prevent new attacks (who wants another WannaCry?)

In this talk we will see:

· The best practices to properly defend itself against current threat trends
· How to predict a broad number of future attacks
· How organizations can be more proactive to prevent the next wave of attacks before they occur

Your vendors present a real operational risk to your business in 2021. The pandemic drove major shifts in not only how your business operates and partners, but also how your suppliers operate and partner. These systemic changes left unchecked can leave your business at significant risk to real cybersecurity threats.

Join Troy Vennon, Director of Cybersecurity and Trustworthiness at Covail, for a quick session on:
1. The 2021 outlook on supply chain risk and threats
2. How MITRE ATT&CK can help prioritize threats and risks
3. Practical, actionable steps to get you on the right path to managing third-party risk with confidence

The trouble with the world is not that people know too little; it’s that they know so many things that just aren’t so”. This eye-opening quote by Mark Twain makes one think about the possible misconceptions we might have in our minds.

In our daily life, we use many tools and rapidly adopt innovative technologies to improve our routine. Yet we are being neutral to the risks involved with those tools due to a false belief regarding the attacking vector and potential threats related to those devices.

In this section, we focus and disrupt cyber security misconceptions.

From the digital cameras, that we all use to take photos and our indispensable smartphones, to the newest technologies on the public cloud infrastructures, this session presents our research findings and vulnerabilities on those devices.

The common denominator for those platforms all have weak spots, allowing malicious individuals to take advantages and reach to our data on devices.

Breaking those misconceptions shows that we need to take cyber precautions in order to prevent the potential upcoming attacks.

All vulnerabilities presented on the talk were “responsibly disclosed” and are being discussed publicly after the relevant vendors have applied all patches

The Challenge - With the worldwide migration to Ecommerce platforms accelerating several years ahead of estimates, coupled with an increased attention to personal privacy and data security needs, The demands on all sizes of E Commerce firms to build in security and privacy as a foundation has taken new relevance and urgency. Between the pressures imposed by regulatory measures addressing Cyber Security and Data Privacy measures like CCPA (California Consumer Privacy Act)-GDPR (General Data Protection Regulations) and the increase and evolution of the Cyber Security threat landscape demands a holistic, segmented and layered 'zero trust' approach. (From Theft of Intellectual Property, Theft of Personally Identifiable Information all the way to ransomware-wiperware destroying a companies very existence.)

The approach REGO Payments Architecture has taken with its partners- From the beginning of the technical design and marketing discussions-due primarily to the sensitive nature of the spirit and decision mantra was the platform MUST comply with COPPA and GDPR Privacy and security mandates. We have taken an 'all hazards; approach to the emerging threat landscape and implemented a few key functions-

Light Stream-
Veracode-
Armor-

Some bullet points/key takeaways for the audience e.g in this webinar you will learn.....
1-Need for resilience and redundancy
2-Need to have a holistic view of all the parts
3-Cyber Hygiene has never been more important-patches, updates applied and logged. IAM tools in place, restrict admin access, etc.
4-Maintain across all business units the foundation of security and privacy (Not just meet minimum standards or regulatory threshholds but add extra care whenever possible

Panelists:
Donald Codling, Advisor & Acting CISO & Chief Privacy Officer at REGO Payment Architectures
Mark Vanderbeek, CTO at REGO Payment Architectures
Johnny Wong, Director, Solutions Architecture at Veracode

Dealing with Cyber Security issues in a post pandemic world

2021 may be the year the world starts to overcome a health pandemic, but the effects on how work is undertaken and the consequent evolution of threats to organizations’ information assets have not yet been fully felt.

The shift to distributed working, accelerated by the pandemic, continues to disrupt organizations’ attempts to mitigate risk. The impact for many organizations has been catastrophic as evidenced by the surge in cyber-attacks in the immediate aftermath of the pandemic.

As security teams grapple with updating organization-wide policies, there are multiple implications thrown up by a distributed workforce including Shadow IT, lack of employee awareness, the insider threat of willful employees collaborating with malicious actors et al – all these coupled with the brazenness of the hackers who may well have found an easy back-door entry into an apparently ‘secure’ Enterprise.

Is there a solution to this issue?

This session will cover the following key areas
-Enforcing the Enterprise Security Posture to a distributed workforce
-The importance of employee accountability & ownership in securing the Enterprise
-Identifying & addressing the scourge of the insider threat - malicious cooperation between outside actors & willful employees.