A strong collaborative relationship between development and security is critical to achieving real, meaningful reduction in risk in custom applications development. By partnering with the development organization you can identify frequent vulnerabilities and encourage them to adopt practices that will result in more secure code. However, as past experience has shown us, working with development teams can be challenging. Join us and our sponsors Fortify and Capella University for our next ThinkTank Roundtable webinar on September 14, 2010 at 12:00pm Noon Eastern time where we will discuss some of those challenges and look at how mature organizations have addressed issues like understanding the development mindset, best practices and achieving superior results.
RecordedSep 14 201065 mins
Your place is confirmed, we'll send you email reminders
Geraldo Castillo, CISSP, Costa Rica; James Packer, CISSP, London; Hoo Chuan Wei, CISSP, Singapore; B. Dunlap (Moderator)
More than 130,000 information security professionals have invested time, determination and resources to attain the CISSP certification. Join (ISC)² members from different regions on May 21, 2019 at 10:00AM Eastern as we discuss what pain points, issues and challenges they encounter in their day-to-day work life, as well as solutions, tips and best practices they have developed along the way. We’ll also examine how the CISSP certification has helped them with their job and career.
According to a recent Ponemon Institute survey, the average data breach costs $3.8M, up 6.4% from 2017. When it comes to an insider data breach, 95% of IT leaders view this as a concern for their organization (statistic from 2019 Data Breach Survey from Egress Software and Opinions Matters). Employees can put sensitive data at risk by accessing or sharing without permission, just because they are “curious” or intrigued by the content. An insider data breach can be the most damaging, the most expensive and the most difficult to detect and stop. How can an organization deal with these insider data breaches? Join Egress Software and (ISC)² on May 9, 2019, at 1PM Eastern for a wide-ranging discussion on insider data breaches, the malicious and the accidental and what can be done to mitigate such occurrences.
Tarik Saleh, Snr Sec. Engr, DomainTools; Erik von Geldern, CISO, FXCM; Clinton Campbell, CEO & Prin. Consul., Quirktree, LLC
Marc Andreessen famously said “Software is eating the world”, but what about in InfoSec? In the beginning, security practitioners depended on Excel and VB scripts to make sense of their data. Today, machine learning is aiding in the discovery and reporting of insights. As more and more cloud-forward companies are embracing an “infrastructure-as-code” model, what does this mean for the security leaders of tomorrow? Is automation important to your role and to the organization’s infosecurity posture? If so, join DomainTools and (ISC)2 on April 11, 2019 at 1:00PM for a discussion on security automation and how being fluent with programming languages and scripting can expand your knowledge and value to an organization, as well as strategizing for machines to work in harmony with the compliance and risk teams.
Ron Nevo, CTO, cPacket Networks; John Carnes, Info Sec. Architect; Gordon Rudd, 3rd Party Risk Officer, Venminder, B. Dunlap
Ferris Bueller famously said, “Life moves pretty fast. If you don’t stop to look around once in a while, you could miss it.” With complex data flows now reaching speeds 100G, what are your security tools missing? Can they handle the increased volume of information that’s coming in? By making use of packet brokers, you can get the visibility you need and not miss out on life. Join cPacket Networks and (ISC)2 on March 14, 2019 at 1:00PM for a discussion on packet brokering visibility across the network, the need for pre-egress filtering and how the convergence of NetOps and SecOps can help protect your company’s top-line revenue and productivity.
Shimon Oren, Deep Instinct; Jared Peck, Financial Services; Rob Armstrong; Colossal Technologies, LLC; B. Dunlap (Moderator)
Cyber-attacks and the threat actors behind them are becoming more and more sophisticated. Today’s attackers adopt existing techniques, modify them and develop new capabilities much faster than ever before. This translates not only to more attacks, but also to a bigger share of attacks which are highly evasive and stealthy, and inevitably more challenging to prevent or detect over-time. How does an organization stay up-to-speed with the varied attacks that are aimed at them? Join Deep Instinct and (ISC)2 on February 14, 2019 at 1:00PM Eastern when we’ll review several common and emerging evasion techniques in today’s threat-landscape and discuss the best avenues to counter them in terms of technology and cost-effectiveness.
Tarik Saleh, Snr Sec Engnr, DomainTools; John Carnes, Info Sec Healthcare; Aamir Lakhani, Sen Sec Strat & Rsrchr; Dr. Chaos
Scam and Phishing emails continue to put organizations of all sizes at risk. A favored vector of attack is the use of a malicious Office document attachment or PDFs to gain a foothold into a targeted system. These types of threats can put account credentials, financial, healthcare information, and other highly sensitive data at risk. How can an organization defend against the onslaught of such attacks that continue to plague them unabated? Join DomainTools and (ISC)2 on January 31, 2019 at 1:00 PM Eastern for a roundtable discussion on mitigating the prevalence and distribution of malicious documents and their payload.
Josh Bartolomie, Dir, Res & Dev, Cofense; Sharon Smith, Fndr, C-Suite Results; Theresa Frommel, Act Dep CISO, State of MO
Process automation delivers a lot of promises. A car can be assembled in less than a day and vegetables can go from vine to can in hours. Sensors look for obvious flaws, but at points in the production process there is human oversight in the form of quality control. The same holds true for protecting against phishing threats. Automation can help weed out some of the bad stuff, but bad actors and new threats constantly outsmart the latest sensors. Join Cofense and (ISC)2 on January 17, 2019 at 1:00PM Eastern for a panel discussion examining strategies on how to enable your workforce to be quality control when it comes to malicious emails to know when something isn’t right and what to do when they see something.
John MacInnis, Prd Mktg Mgr, IAMS, HID Global; Tariq Shaikh, Sr. Security Adv., IAM, Aetna; Erik Von Geldern, CISO, FXCM
With the multiple points of access to an organization, both internal and external, as well as physical and electronic, identity and access control is a critical security concern. Practitioners need to constantly monitor and assess the organization’s security posture, access provisioning and even the on boarding of employees, partners and customers. Join HID Global and (ISC)2 at 1:00pm Eastern Thursday, December 6, 2018 for a discussion on why identity has become the center of security and how to better manage identity, access management and authentication in your enterprise.
Jason Garbis, VP of Cyb. Products, Cyxtera; Mike Brannon, Dir. Infra. & Sec., National Gypsum; Spencer Wilcox, B. Dunlap
Like a good rollercoaster, a journey to the cloud can be both exhilarating and terrifying. Unlike a rollercoaster, however, a cloud journey is a long-term commitment and requires thoughtful planning, especially the need to ensure security and compliance controls. Join Cyxtera and (ISC)2 on November 29, 2018 at 1:00PM Eastern for a discussion on making a secure journey to the Cloud and the benefits of a software-defined perimeter.
Matt Gardiner, Dir. Prd Mkg, Mimecast; Derrick Butts, CIO/CO, Truth Init.; Bruce Beam, Dir Infr & Sec (ISC)²; Brandon Dunlap
According to the Verizon Data Breach Investigations Report 2018, 99% of malware, such as ransomware, trojans, and RATs, were delivered via malicious email attachments or via the web. With the vast majority of all security incidents and breaches using email and the web -- and the necessity of these services to your organization’s day-to-day operations -- how can you protect yourself? What are the best practices for defending against these types of threats? What are the best methods of acquiring, deploying and managing these protections? Join Mimecast and (ISC)2 on November 8, 2018 at 1:00PM Eastern for a discussion of these questions and the methods attackers are currently using to accomplish their goals, how attackers are using email and the web against organizations, why email and web security should be considered together and the benefits of cloud delivered security solutions, including improved security efficacy and reduction in overall costs.
Jadee Hanson, CISO, Code42; Andrew Neal, Pres; InfoSec/Compliance, TransPerfect; Greg Braunton, Catholic Health Initiatives
As the time and complexity associated with incident investigations increase, response times become more critical. The longer detection and remediation take, the higher the cost to the business and the greater the risk of a cyberattack expanding across the organization. Organizations have to react with speed and precision. How can an organization reduce the time and effort it takes to investigate and resolve an incident successfully? Join Code42 and (ISC)2 on October 25, 2018 at 1:00PM Eastern for a roundtable discussion on why time matters when conducting an investigation, where gaps may be in the incident response process and how to get the most out of your investigation and response efforts.
It’s no secret that limited visibility into user actions keeps cybersecurity professionals up at night. The right level of visibility into user action and access can produce positive insights that enable business results. Additionally, indicators of out of policy activities can stop an insider threat before it becomes a full-blown incident. Research from The Ponemon Institute showed that financial services institutions faced the highest insider threat costs of any other industry (at $12.05 million annually) -- a very concrete reason to address an otherwise invisible problem. Join ObserveIT and (ISC)2 on September 13, 2018 at 1:00PM Eastern for a roundtable discussion on insider threats including the most important components to gaining full cyber visibility: user activity, data activity, and analytics, best practices for managing insider threats and the key question organizations should be asking to mitigate insider threats.
Tim Helming, Director of Product Management, DomainTools; Aamir Lakhani; Andrew Neal, TransPerfect; B Dunlap (Moderator)
While the tools, techniques and procedures that threat actors employ are evolving, these threat actors often take the shortcut of reusing code and files on multiple domains (because it’s easier than setting different ones up each time). It’s these “tells” and habits that can help an organization more quickly identify and deal with a threat, by examining and pivoting through related infrastructure. Join DomainTools and (ISC)2 on August 30, 2018 at 1:00PM Eastern as we learn how to identify these pieces of evidence and how the threat intelligence space is changing, as well as what techniques security practitioners can learn and employ to stay ahead of threat actors.
Sharon Smith, Founder & Princ Consultant, C-Suite Results; Rob Ayoub, Program Dir, IDC; Derrick Butts, Truth Initiative
(ISC)2 will hold its Security Congress 2018 in New Orleans, Oct. 8 – 10. This conference will bring together 2000+ attendees and more than 100 educational sessions. One of the 13 tracks at the conference will focus on Professional Development and the challenges practitioners face advancing their careers, and staying ahead of the latest best practices and strategies with ongoing education. On Aug. 21, 2018 at 1 p.m. Eastern, join (ISC)2 and several speakers who’ll be presenting in the Professional Development track at Security Congress as we preview their sessions and discuss why professional development is so critical to advancing a career and knowledge.
Ken Wilson, Dir, Sales Central U.S., Skybox, Michael Roling, CISO, State of MO; Curtis Dukes, CIS; Brandon Dunlap (Moderator)
Security automation technologies can help drive improvements in managing security policies, including their implementation in firewalls and other network devices. However, whether you’re struggling with continuous compliance, auditing and reporting or managing firewall changes, deciding what to automate can be challenging. Join Skybox Security and (ISC)2 on August 16, 2018 at 1:00PM Eastern for a discussion where we’ll examine which automated processes in security policy management deliver the biggest rewards while introducing the least risk to your organization. Areas to be examined include why automation, visibility and context should be the indivisible, foundational components of any security policy management solution, which processes in security policy management are ripe for automation and where human intervention is still valuable. We’ll also explore how to educate security stakeholders in your organization on what’s needed to make automation initiatives a success.
Jeff Costlow, Dir of Security, ExtraHop; Kristy Westphal, VP, MUFG Union Bank; Melissa Duncan, Sr Sys Sec Eng, Charles Schwab
They say “Packets don’t lie”. Instead of waiting to respond to incidents and anomalies, SecOps teams are using the network to enable proactive measures such as threat hunting, auditing encryption and other suspicious and out-of-policy behaviors existing in the dark alleys of the traffic corridor. Real time network traffic analytics (NTA) tools can help an organization shift from defensive to offensive and cut investigation time, enabling analysts to quickly correlate activities and test hypotheses. Join ExtraHop and (ISC)2 on August 2, 2018 at 1:00PM Eastern as we discuss proactive measures that can work for an organization, what activities to look for and how machine learning can help speed up these efforts.
Mike Brannon, Dir, Infrastructure & Security, National Gypsum; Tim Sills,Accudata; Tyler Smith, IT Analyst, John Deere
(ISC)2 will hold its Security Congress 2018 in New Orleans, LA, October 8th – 10th. This conference will bring together 2000+ attendees and over 100 educational sessions. One of the 13 tracks that are being offered with focus on Cloud Security and challenges practitioners face when dealing with all things cloud. On July 24, 2018 at 1:00PM Eastern, join (ISC)2 and several of the speakers who’ll be presenting in the Cloud track as we preview their sessions, get an idea of what will be discussed and discuss the state of cloud security today.
Human error. Unintentional security incident. It’s going to happen at every organization. Sooner or later, someone will click on a rogue link or open an attachment they shouldn’t, exposing your organization to malware, phishing and ransomware. Old-school training, testing and policies can only go so far. Actions need to replace rhetoric. Join KnowBe4 and (ISC)2 on July 19, 2018 at 1:00PM Eastern for a discussion on how to build a security-centric culture than can benefit any size organization. We’ll examine how to establish a solid foundation, making sure everyone is on the same page and leveraging leadership to help with accountability.
Wesley Simpson, (ISC)² COO, Mirtha Collin, (ISC)² Sr. Ed. & Training Mgr., Michelle Schweitz, (ISC)² Media Mgr.
(ISC)² is committed to delivering value to our members, providing a transparent view of the organization’s developments and plans for the future. To that end, please join (ISC)² for a virtual Town Hall meeting on July 17, 2018 at 1:00PM Eastern to review many of our new member benefits, service offerings and look at what is still to come in 2018, including enriching professional development opportunities, Security Congress and more. Members and non members alike will enjoy the opportunity to learn how (ISC)² is delivering on its value promise.
Chris McCormack, Sen Prod Mgr, Sophos; Bruce Beam, Dir, TPO, (ISC)2; Brandon Dunlap, Moderator
Your network firewall isn’t being honest with you. According to a recent survey conducted by Sophos that gathered responses from 2,700 IT managers at mid-sized organization, network firewalls can’t disclose what up to 45% of the bandwidth is being consumed by. Additionally, they are failing to protect the organizations they are deployed in and this inefficiency is costing time and money. Why is this happening? What can be done to correct it? Join Sophos and (ISC)2 on June 14, 2018 at 12:00PM Eastern for a wide ranging discussion about this survey, the results and what can be done to get the best information and performance from your network firewall.