Name: (ISC)² Security Congress 2022 Town Hall
Start: 2022-10-10T19:50:00Z
End: 2022-10-10T19:51:17.000Z
Location: BrightTALK
Rating: 4.7

(ISC)² Security Congress channel contains digital content of activities at (ISC)2's Flagship conference event. You'll find keynotes, sessions and related items.

After two years of virtual events, (ISC)² is excited to be back in person for our upcoming Security Congress conference. Join us for this webinar to learn everything you need to know about the upcoming event, taking place at Caesars Palace in Las Vegas, Nevada October 10-12. Hear from (ISC)² staff on what you can expect from the year’s best opportunity to earn CPE credits, network with colleagues, learn from experts and hear from dynamic keynote speakers.
 
(ISC)² Security Congress will also be available for virtual registration as well, so if you’re not able to join us in Las Vegas, you can still learn and connect from home! Be sure to join us live to ask your questions about the conference and engage with (ISC)² leadership.

Face to Face Again! Preview for (ISC)² Security Congress - October in Las Vegas

The panel will consist of members from (ISC)² Management and (ISC)² Board of Directors who will be ready to answer any questions that you may have regarding membership, certifications, information security, etc. This meeting is open to both members and non-members. Dr. Kevin Charest, CISSP - Board of Directors Chairperson Zachary Tudor, CISSP - Board of Directors Vice Chairperson Clar Rosso - CEO, (ISC)² Dr. Casey Marks - Chief Products Office and Vice President, (ISC)² Moderated by Wes Simpson - COO, (ISC)²

Town Hall

From the view of a CSP providing B2B services in global regulated markets; we’ll explore big-picture concepts and provide a treasure map of references on why, and how to build, and maintain a go-to-market certification and compliance program. Highlights include common myths and misunderstandings. Why this profession requires a multi-disciplinary approach. How to leverage standards and control frameworks. Ideas on building the business for senior management to gain support, buy-in, and funding necessary for success. And the ideal state: where the program is driving integrated risk management and continuous improvement as strategic imperatives.

Certification & Technical Compliance: A Risk-based Program to Grow Market Access

Containers make life easier, right? You just whip out your tight little microservices app, drop it into your container runtime, toss it into the cloud, and "voila!"magic happens. Sadly, we don't live in the lollipop world of rainbows and unicorns. All of these "simple" things have compounding risk factors that quickly pile up along the way, accruing technical and security debt at breakneck pace. Here we'll walk through seven major pain points "from dev to prod" that span the entirety of DevSecOps and may make you want to reconsider your approach to containers.

Learning objectives: 
1. More fully assess the risks associated with containerized micro services.
2. Understand the complexities inherent to containerization.
3. Develop a plan of attack for risk management and security controls around containers, DevSecOps and micro services.

7 Layers of Container Insecurity

Managing cyber risk needs to be a journey inclusive of the people who make up your culture while executing a transitional engineering and logistics plan (TELP).  The TELP framework includes a proactive process of managing cyber risk while planning the migration for a more secure enterprise business, infrastructure, services and/or modernized framework with little to no interruption to daily business operations.  The TELP 3.1 framework uses a hybrid methodology combining secure systems engineering best practices with NIST SP 800 guidelines, Center for Internet Security (CIS) and Information Technology Infrastructure Library (ITIL)  " IT Service Management frameworks.  As a result, businesses may execute cybersecurity strategies while minimizing residual risks across business and operational areas.

Learning objectives: 
1. Develop a proactive TELP framework process for managing cyber risk while planning the migration to a more secure enterprise business, infrastructure, services, and/or modernized framework with little to no interruption to daily business operations.
2. Generate more ideas on how to change the mindset of their culture to minimize residual cyber risk across potentially impacted business and operational areas.
3. Discover how to proactively communicate cyber policies, practices, services and training to set and meet end-user expectations while tracking changes to cyber threats and vulnerabilities for your business.

Managing Cyber Risk with a little T.E.L.P.

The DoD's Vulnerability Disclosure Program (VDP) is the oldest and largest such program in the world. Born as a permanent sustainment of the 2016 Hack the Pentagon Bug Bounty Program, the DoD VDP is the central point for crowdsourced vulnerability discovery and also tracks vulnerabilities from initial report to completed mitigation.

This presentation will:
Enrich: Provide historical background and the need for building VDP programs as well as a  new methodological construct of the vulnerability lifecycle to better understand vulnerability data.

Enable: Outline the functions and stakeholder roles in building a VDP. Through a case study of a buildout of a Defense Industrial Base VDP program, we'll show how VDPs can help inoculate organizations through vulnerability information sharing.

Excel: Reduce an attack surface  through an additional outer layer of defense.

Learning objectives: 
1. Describe what a vulnerability disclosure program (VDP) is and why it is an important component of an organization's security platform.
2. Define how a VDP differs from traditional vulnerability management programs.
3. Describe ways that a vulnerability can be shared between organizations in order to better protect security partners.

Building a VDP Program: Lessons from the Battlefield

We'll focus on the potential exploitation of vulnerabilities in connected medical devices and genetic information by nation-states in order to achieve strategic goals. An attack on a medical device would likely involve a single target, while DNA manipulation would involve larger groups. Both scenarios would likely occur within the context of a campaign involving the use of deep fakes and other disinformation.

We believe that these tactics will be increasingly adopted by nation-state proxies, organized criminals and terrorists. We'll discuss our research into the technical and legal aspects of, as well as mitigations to, this grave and under-explored area. Our hope is that organizations of all types and sizes will be better equipped to confront these non-traditional and emerging threats.

“Biological Stuxnet” Law & Techology Around Nation-State Attacks

The CISO dashboard is a challenge for all from senior members of the board to the security professional  tasked with preparing  the "deck." It is too detailed to some or too long and technical to others, or it is not quantifiable and lack the "So what?" factor. Security metrics can tell a story when the right metrics are in place and aligned to the business strategy and organizational capabilities. The results of these metrics, both key risk Indicators and key performance indicators, which are key components of continuous security (risk) monitoring, should dictate security as well as business initiatives.
Learning objectives: 
1. Implement an effective CISO security risk dashboard detailing security risk posture for divisional management, senior management and the board to enable risk-based decision making at the enterprise level.
2. Identify key security metrics such as key risk indicators, key performance indicators and be able to generate a story.
3. Demonstrate the foundational knowledge to enrich the CISO storyline by monitoring the results of the metrics via continuous risk monitoring.

Security Risk Posture... The CISO's 7 Minute Story to the Board

As Liberty Mutual announced the go-live date for placing 60% of its workloads in the cloud, a stunned security architect stared in disbelief. A few years and several lost hair follicles later, Liberty Mutual presented its RADAR automated security governance tool during AWS re:Inforce, the inaugural AWS security conference in 2019. In retrospect, the presenter thought of the game "two truths and a lie," and how the opposite seemed to be true regarding the promise of the AWS public cloud. Come hear the lessons learned as well as the details surrounding the development of a custom security governance tool and why built-in AWS tools didn't suffice.

Learning objectives: 
1. Understand the cloud is more than just another data center; it has the capability to secure your companies resources better than on-premise.
2. Identify from the lessons learned over five years to influence and change their own companies public cloud journeys.
3. Better understand how the public cloud can automate security and show compliance in ways not easily obtained on-premise.

Two Lies and a Truth: An Angsty Journey to the Cloud

In this workshop, participants will learn how to apply threat modeling concepts to cloud-native application architectures to expose attack surfaces. Our case study will be a cloud-native SaaS, multi-tenant application running in AWS.
 
 We will be applying attack methodologies from the open source community and attack libraries from Mitre (e.g., ATT&CK, CAPEC), as well as from the Common Architectural Weaknesses and Exposures (CAWE) taxonomy. Participants will each produce a working threat model. We will use publically available tools for the threat modeling exercise to uncover application design defects that can be exploited. Our goal is to understand how cloud-native applications work holistically and to dive deep into topics such as: container orchestration; micro services; advanced authentication; secrets management; and data processing risks.

Learning objectives: 
1. Demonstrate advanced threat modeling skills that are necessary to analyze cloud-native applications.
2. Define the attack surface for a SaaS multi-tenant application.
3. Conduct advanced attack simulations on a cloud-native architecture to validate findings and remediation efforts.

Cloud Security Engineering: Applied Threat Modeling

Most incident response plans only address eradication and recovery in an effort to return the business to normal operations as quickly as possible. In the haste to close investigations and move on to the next issue, it’s easy to ignore the critical phase of post-incident review. Skipping this phase robs security teams of invaluable learning opportunities to identify technical and procedural gaps, improve team operations and communication, and increase visibility for leadership on where additional training and team development is needed to reduce future impact on the business.

“It's the Living I Fear” – Cyber Security Post Incident Review

On July 16, the EU Court of Justice issued a decision invalidating the EU-U.S. Privacy Shield Framework, which enabled thousands of companies to move personal data across the Atlantic in support of global commerce. The Court also made clear that transfers under EU-approved standard contracts (used by the vast majority of global companies) require case by case assessments and “additional safeguards” if they are subject to foreign government access rules that aren’t essentially equivalent to EU legal requirements. This has called into question the legality of global data movement and sent companies scrambling for technical (think encryption) and legal (contractual and otherwise) fixes. This session will examine how companies are responding in practice, existing options for “additional safeguards”, and the broader path forward as US-EU negotiations progress.

Learning Objectives:

- Understand the implications of the “Schrems II” ruling for your company.
- Learn how companies around the world are currently responding.
- Discuss the technical, organizational and contractual safeguards under consideration to enable continued data flows, including when they might help and where they can’t.

Schrems II: Impact of the EU Court of Justice Decision on Your Global Data Flows

Technology sprawl is a challenge for every CISO. From legacy hardware to shadow IT, the sheer number and functionality of applications used within an infrastructure is a venerable melting pot of security risks. The only hope we have of protecting our enterprises from attack is by being able to continually and accurately validate access ""and to do that, we must be able to truly manage our users.
 
 This case study will take a look at what it takes to roll out a true identity access governance platform across four geographically dispersed and application-independent organizations, generating a true, enterprise-wide single source identity warehouse. We’ll touch on the challenges presented, the approach and the gotchas of deploying such a solution in today’s distributed diverse enterprise infrastructure.

Learning objectives: 
1. Understand the process and approach of deploying a global IAM solution in an enterprise that maintains country-specific HR, AD and financial platforms.
2. Identify and address potential pitfalls, challenges and roadblocks that occur during a global, distributed IAM rollout.
3. Articulate the financial and risk mitigation value of a central, enterprise-wide identity warehouse.

From Zero to 60 in 180 days - A Global IAM Deployment Case Study

"In this talk, we will discuss detection of three well-defined security problems "adversarial user behavior, lateral movement and insider threat detection" using a relatively untapped data set: shell and session commands. We'll discuss machine learning (ML) techniques needed to analyze this data, present research key findings and describe the effects and mitigations of bias to achieve higher accuracy. Additionally, we will explore techniques for safeguarding ML models based on this data.

Data Swamps to Data Lakes - Visualizing the Void of Security Audit Data

Penetration testing has evolved dramatically in recent years with crowdsourced pen testing and automated pen testing  now viable solutions to the traditional approach of having a lone pen tester assess your environment. But what exactly are these offerings? How do they compare to each other and to traditional pen testing? This session will explain each methodology and cover the pros and cons of each approach. We'll also cover which technique works best for different uses cases (such as internal and external pen tests, as well as device testing and IoT). At each stage, live examples taken from pen testing engagements will be used to illustrate the efficacy or weakness of each methodology.
Learning objectives: 
1. Understand the weaknesses of traditional pen testing.
2. Understand and learn about crowdsourced pen testing and automated pen testing—what it is, including pros and cons.
3. Learn when to apply a pen testing methodology for different use cases.

Pentesting - Crowdsourced vs Traditional vs Automated - Which One Is For Me?

Since EU supervisory authorities began GDPR enforcement in May 2018, at least 250 companies and government agencies have been punished for privacy and security failures. These failures have resulted in excess of €150M in fines, plus orders for remediation. Remarkably, only a few GDPR articles "such as Articles 5 (Principles), 6 (Legal Basis) and 32 (Security) "are consistently cited by those authorities. Moreover, in the majority of cases, the failures were attributable to basic privacy and security practices. In this presentation, a data protection industry veteran will review several post-mortems, determine what went wrong, and discuss the implications for complying with the privacy and security requirements of the GDPR going forward.

Learning objectives: 
1. Understand what regulators consider when issuing a GDPR-related penalty.
2. Prioritize remediation efforts, especially in light of the new privacy standard, ISO 27701.
3. Apply these lessons for California Consumer Privacy Act (CCPA) compliance.

GDPR Security Post-Mortems: 10 Critical Lessons You Can Apply Now

This presentation addresses a current and growing need for personal cyber safety. This is especially important as so many people move to online education, remote working and connecting online to family and friends. Attendees can expect to walk away with the tools and program knowledge that will enable them to bring valuable online safety education to their community and business.

Learning objectives: 
1. Develop the tools, knowledge and confidence to approach schools, public libraries and/or youth clubs to organize and conduct children cyber safety presentations with Garfield's Cyber Safety Adventures program.
2. Learn how to be an ambassador for community cyber safety events and programs available by the Center for Cyber Safety and Education.
3. Acquire the tools, knowledge and confidence to engage with businesses, networking groups and/or their companies about cyber safety programs available by the Center for Cyber Safety and Education.

How To Inspire A Safe Community

(ISC)² CEO Clar Rosso will provide strategic updates for our association, including recent accomplishments and milestones, as well as what members can expect in 2023 and beyond.
Bring your questions — a panel of representatives from the (ISC)² Board of Directors and management will answer inquiries about our association, membership, certifications and workforce trends, as well as the current issues and challenges facing cybersecurity.

(ISC)² Security Congress 2022 Town Hall

(ISC)2

ISC2

CISSP

Cyber Security

Security Congress

Cloud computing has exploded over the past few years, delivering a previously unimagined level of workplace mobility and flexibility. The cloud computing community on BrightTALK is made up of thousands of engaged professionals learning from the latest cloud computing research and resources. Join the community to expand your cloud computing knowledge and have your questions answered in live sessions with industry experts and vendor representatives.

Cloud Computing

The IT security community on BrightTALK is composed of more than 200,000 IT security professionals trading relevant information on software assurance, network security and mobile security. Join the conversation by watching on-demand and live information security webinars and asking questions of experts and industry leaders.

IT Security

The application development community features top thought leadership focusing on optimal practices in software development, SDLC methodology, mobile app development and application development platforms and tools. Join top software engineers and coders as they cover emerging trends in everything from enterprise app development to developing for mobile platforms such as Android and iOS.

Application Development

Join thousands of engaged IT professionals in the application management community on BrightTALK. Interact with your peers in relevant webinars and videos on the latest trends and best practices for application lifecycle management, application performance management and application development.

Application Management

Network infrastructure professionals understand that a reliable and secure infrastructure is crucial to enabling business execution. Join the network infrastructure community to interact with thousands of IT professionals. Browse hundreds of on-demand and live webinars and videos to learn about the latest trends in network computing, SDN, WAN optimization and more.

Network Infrastructure

Welcome to the big data and data management community on BrightTALK. Join thousands of data quality engineers, data scientists, database administrators and other professionals to find more information about the hottest topics affecting your data. Subscribe now to learn about efficiently storing, optimizing a complex infrastructure, developing governing policies, ensuring data quality and analyzing data to make better informed decisions. Join the conversation by watching live and on-demand webinars and take the opportunity to interact with top experts and thought leaders in the field.

Big Data and Data Management

As an IT professional, many of the problems you face are multifaceted, complex and don’t lend themselves to simple solutions. The information technology community features useful and free information technology resources. Join to browse thousands of videos and webinars on ITIL best practices, IT security strategy and more presented by leading CTOs, CIOs and other technology experts.

Information Technology

Thousands of healthcare IT professionals compose the health IT community on BrightTALK. Learn alongside them with relevant webinars on healthcare IT compliance, big data in healthcare and IT solutions for healthcare organizations. Join the conversation by asking questions and engaging with other participants during live webinars and organized discussions.

(ISC)² Security Congress 2022 Town Hall

Presented by

About this talk

More from this channel