SIEM is Dead: Changing The Approach to Enterprise Security Monitoring

The seismic jolt in the Threat Landscape caused by the success of threats like ransomware combined with the geometric rise of so-called zero-day malware (i.e. malware for which no AV signature defenses exist) has given rise to all manner of innovation in the Cybersecurity industry. But a lot of what is being said and presented in the market is really confusing and that’s a problem for practitioners. One of the most-frequently-used phrases in security today is “Machine Learning” or “Math-Based” and “Artificial Intelligence” or “AI”. These phrases are entering the security conversation to describe capabilities, approaches, and strategies, but in reality, they are confusing a great many people. Which begs the question: “What on Earth does it mean?” and “How can Machine Learning be used in Enterprise Security?” Join McAfee and (ISC)2 on April 27, 2017 at 1:00PM Eastern as we clear the confusion, explore the answers to these questions and discuss what this means for dealing with threats.

While infosecurity teams are playing defense against external threats, they cannot lose sight of the threat that insiders at their organization pose. Employees, contractors and business associates can all have accounts which provide them legitimate access to systems within the enterprise, but that access can carry significant risk. Detecting, monitoring and preventing such unauthorized access and exflitration is critical. Building an Insider threat program to manage such functions can help an organization get visibility into the problem and streamline these efforts. But where does an organization start when building such a program? What underpinnings need to be in place in order to have success with a program? Get an inside scoop on what it is really like to build and run these types of programs; what are insiders really doing and what are they stealing. Join Code42 and (ISC)2 on March 16, 2017 at 1:00PM Eastern for a discussion on how to construct an effective insider threat program.

There's an overwhelming amount of information that comes from the connected world. Information sources are endless, but their credibility can be questionable. Cyber security teams can often relate with an overload of threat data from a variety of sources. Building an effective threat intelligence capability requires drilling down through all of information to find the data that is most relevant to you. So where do you start? To avoid information overload, an organization needs to be selective about the sources that they need to stay ahead of the threats and exploits that can compromise them. Join (ISC)2 and our sponsor Recorded Future for a From the Trenches webcast on March 2, 2017 at 1:00 PM ET for a discussion on threat intelligence sources, what's available out there, and how to separate the signal from the noise so you can spend less time on data collection and more time on analysis.

Working in silos, while never a good idea, is a reality in many organizations today. Security and network operations teams have different priorities, processes and systems. Security teams use various controls and tools to mitigate different kinds of threats which provides them with thousands of alerts on a daily basis. They often find it difficult to prioritize the threats to address first. What they may not know is that there is a whole piece of the puzzle they could be missing - core network services like DNS, DHCP and IPAM. These can provide a wealth of information and context on threats, which can help prioritize response based on actual risk and ease compliance. Join Infoblox and (ISC)2 on February 23, 2017 at 1:00PM Eastern for a roundtable discussion on how to use ecosystem integrations between network and security tools for better security and compliance.

Threats. They are everywhere and one of those things that keep security practitioners awake at night. However, the exposure to and damage from the myriad threats out there can be mitigated via a number of steps. These include threat hunting and detection, investigation and timely and effective response. If your security is synchronized it can help to reduce the response times and the resources that are used. Join (ISC)2 and our sponsor Sophos for our first From the Trenches webcast of 2017 on January 26, 2017 at 1:00PM Eastern for a discussion about threats and how to cut the time in detecting and responding to them.

Quantitative risk analysis is achievable, can be pragmatic, and can actually out-perform qualitative risk analysis in the face of complex issues like intelligent adversaries. Join Jack Jones, the original author of the Factor Analysis of Information Risk (FAIR) framework and (ISC)2 to learn more about FAIR. Jack will highlight both the quantitative use-cases as well as the ways in which FAIR can be leveraged to improve qualitative risk analysis. This will be followed by a demonstration on how to quantify cyber risk with the RiskLens Cyber Risk Quantification software platform.

You can't secure what you can't see and not knowing what's on your network can be damaging. While security is about proactively detecting and mitigating threats before they cause damage, it is also about gaining deep visibility into today's complex networks which may include diverse platforms and architectures. A truly enterprise grade DNS, DHCP and IPAM (DDI) platform can provide that visibility because of where it sits in networks. On the downside, DNS is a top threat vector but it can be used as strategic control points to block malicious activity and data exfiltration. Join Infoblox and (ISC)2 on January 19, 2017 at 1:00PM Eastern for a round table discussion featuring Cricket Liu, a well known authority on the Domain Name System and the co- author of all of O'Reilly & Associates' Nutshell Handbooks on DNS, as we examine how strategic DNS can be used for visibility and security.

Insiders. Targeted attacks. Bad actors. Malware. Organized crime. Ransomware. The threats to your IT infrastructure and organization are many and come from multiple vectors. Detecting, assessing and managing these threats are paramount to the well being of the organization. If the worse does happen and there is an incident, quick and efficient response is critical. Join Intel Security and (ISC)2 on December 20, 2016 at 1:00PM Eastern for our final ThinkTank roundtable of the year where we will discuss threats, threat management and incident response.

It's said that teamwork makes the dream work. And the dream is a secure organization. While you and the rest of your team works towards that, it takes everyone to achieve comprehensive and effective security. But achieving this degree of security thinking within in an organization is fraught with challenges - ensuring the consistent application of controls across the enterprise and across, to outside partners and vendors, the changing skill set and diversity of the workforce & security staff and the hiring of talent to maintain security. Join Trend Micro and (ISC)2 on December 15, 2016 at 1:00PM Eastern for a roundtable discussion as we examine this topic and how best to manage these issues.

If it bleeds, it leads and the headlines these days indicate that more and more companies are succumbing to ransomware. A user clicks the wrong link and the next thing you know, you’re your data is being held hostage...for a price. It leads to nonproductive downtime, tests the limits of your back-up strategy, and saps your bottom line. How do you combat a threat like ransomware? Do you pay up? Join Imperva and (ISC)2 on November 10, 2016 at 1:00PM Eastern for a discussion on ransomware, its impact and how organizations should respond.

While we will never see the end of generalized mass attacks, the real damage is being done through highly targeted attacks. In discussing why targeted attacks are so effective and economically advantageous to the attacker, we'll learn why that trend is likely to continue. Timely case studies of targeted and integrated attacks will contribute to understanding the trade-offs for the adversaries. Some suggestions for countermeasures against this strategy will be provided.

Business executives are unlikely to ever really understand risk statements like “High risk”, “Medium risk” and “Low risk”. As a result, they sometimes discount higher risk situations as “infosec conservatism.” Risk quantification can be a powerful tool to help them better understand and appropriately prioritize infosec risk scenarios. In this session, Jack will walk participants through an analysis of a specific cloud service leveraging the Factor Analysis of Information Risk (FAIR) framework. The analysis results will be described in business terms that any executive would understand. This session will demonstrate a pragmatic approach to quantifying cloud-related risk.

The shortage of information security professionals and high turnover can derail even the best security programs. This session will cover proven strategies for recruiting, retaining and building a team of top security professionals.

As a wise person once said, a man with one watch knows what time it is, a man with two isn't so sure. Despite the myriad of tools at our disposal in the SOC, how do you accurately identify and triage security Events, escalate those that need it to the status of Incident, and mange them through remediation or response effectively? Join Intel and (ISC)2 on September 29, 2016 at 1:00PM Eastern as we bring a panel of SOC operational experts to discuss strategies and opportunities to orchestrate SOC operations for peak performance.

Hear from a panel of experts including Afir Agasi, Rich Campagna, Sami Laine, Javvad Malik, Patrick Pushor, Alvaro Vitta and Dan Waddell as they review the results of the 2016 Cloud Security Spotlight Report. This report highlights cloud security concerns and what security best practices are evolving with the increasing adoption of cloud computing. Get the report here: cert.isc2.org/cloud-security-spotlight-report/

Moving and integrating multiple applications across both on-premise and into the cloud is a daunting task. Whether it is the "lift and shift" of existing workloads into IaaS or the federation of identities between your traditional enter isle and SaaS providers, the task is monumental. Join Trend Micro and (ISC)2 on August 11, 2016 at 1:00PM for a spirited roundtable webinar where we'll dig into the important security implications of your cloud strategy and how to ensure that you are considering all of the angles as you make the change.

The EU's General Data Protection Regulation (GDPR) was adopted on April 14, 2016 and threw infosecurity and privacy teams into chaos. While teams were trying to get their arms around the new regulations and rules, the UK voted to leave the EU, throwing another big wrinkle into the mix. What does all of this mean to you and your compliance and regulation efforts? What does the Brexit vote mean for the GDPR and for the UK's infosecurity and privacy rules? Imperva sponsors an (ISC)2 From the Trenches webinar discussion on this and answers questions from the audience on July 28, 2016 at 1:00PM Eastern.