CIS 2015 Security Without Borders: Taming the Cloud and Mobile Frontier - Andre Durand

•

5 likes•1,683 views

This document introduces a new identity security system called Sierra Border Security V1.0. It discusses how the assumptions around internet and enterprise security have changed over time as the perimeter has expanded with new technologies. The key challenges mentioned are that identity is now too weak and disconnected to protect organizations at scale. The proposed new system aims to evolve authentication beyond single-factor to continuous multi-factor authentication using standards-based interactions. It will leverage big data and intelligence for dynamic access control and move to identity-based security definitions.

Technology

“WE DIDN’T FOCUS ON HOW
YOU COULD WRECK THE
SYSTEM INTENTIONALLY”
Vinton G. Cerf

$100
BILLION
Estimated loss in US per annum due to cybercrimeTHE INTERNET
“THEY THOUGHT THEY WERE BUILDING A CLASSROOM
AND IT TURNS OUT THEY BUILT A BANK.” Abbate

UNFORTUNATE TRUTH
ATTACKS
SECURITY
Ubiquitous Internet
New Vulnerabilities
Market for Identity
Success & Profits
30 Million Bots
Insider Recruitment
Organization

WHAT IF OUR PERIMETER
NO LONGER DEFINES
OUR PERIMETER?

THE PERIMETER IS EXPANDING
2007 2008 2009 2010 2011 2012 2013 2014 2015Timeline
Software-as-a-Service
ENTERPRISE
(apps, users, network)

THE PERIMETER IS EXPANDING
2007 2008 2009 2010 2011 2012 2013 2014 2015Timeline
Software-as-a-Service
ENTERPRISE
(apps, users, network)
Smart Mobile Devices

Infrastructure-as-a-Service
2007 2008 2009 2010 2011 2012 2013 2014 2015Timeline
Software-as-a-Service
ENTERPRISE
(apps, users, network)
Smart Mobile Devices
THE PERIMETER IS EXPANDING

“DON’T EVER TAKE DOWN YOUR FENCE
UNTIL YOU KNOW THE REASON IT WAS PUT UP.”
G.K. Chesterton

internet
enterprise
computer
device
app
api
Iot
MANY BORDERS
ONE BORDERLESS
IDENTITY SYSTEM

WE’RE BUILDING A HAMSTER TRAIL
SECURE TUNNELS TO TRANSMIT
AUTHENTICATED USERS

REDEFINING SECURITY with IDENTITY CORE
SECURITY
IDENTITY
DEFINED
SECURITY
IDENTITY

WE’RE ON A JOURNEY
TO FULL IDENTITY VISIBILITY

ANONYMOUS BY DEFAULT
IDENTIFIED BY DEFAULT
FUTURE
PAY EXTRA FOR
ANONAMOUS
TRANSACTIONS

ONLY GOOD ACTORS COULD
ACCESS THE NETWORK
ASSUMPTION #1
1970

THE PERIMETER IS SECURE
ASSUMPTION #2
1970–TODAY

IDENTITY
IS MORE SECURE
ASSUMPTION #3
2015

WHAT WOULD WE DO IF
PERIMETER ALREADY BREACHED

WHAT IF THE RIGHT IDENTITY
BECOMES A BAD ACTOR?

WHAT IF…
IDENTITY IS TOO WEAK
& TOO DISCONNECTED
TO PROTECT US AT
SCALE?

EVOLVE FROM
SINGLE-FACTOR
AUTHENTICATION

TO CONTINUOUS AND
CONTEXTUAL MULTI-FACTOR

STANDARDS-BASED
INTERACTIONS
EVERYWHERE
INCLUDING FIRST/LAST MILE INTEGRATION

micro trust
trust a little > trust a little more
login > trust a lot > trust a little more
trust a little less and so on…
TIME OUT / LOGOUTLOGIN > TRUST A LOT >
BIG TRUST

NEED A NEW SYSTEM FOR
IDENTITY PROOFING
& RESOLUTION

LEVERAGE
BIG-DATA & INTELLIGENCE
TO ENABLE DYNAMIC ACCESS CONTROL

In a world where criminals are becoming more sophisticated, and wireless data shared through social media and other sources is exploding, public safety agencies recognise the importance of technology investments that will help them to better collect, filter and share information to enhance community safety. Public safety LTE is a key ingredient in delivering the next generation of public safety communications and is connecting today's mission-critical voice to high bandwidth data and video information. Community safety will be greatly enhanced by allowing agencies to collect the information that flows between citizens, responders and agencies and securely distribute it across mission-critical devices and easy-to-manage networks. This paper will illustrate the benefits of the technology, including how multiple data streams can be captured and shared for improved public safety operations, enabling agencies to make better tactical and strategic decisions and predictions to keep communities safe. David Hill, Area North Manager, Government & Public Safety, Motorola Solutions

Company profile

NKonnect Infoway

Mobile Web and Apps World New Orleans Session 6 the device, mobile applicatio...

NextVision Media

The Device, Mobile Applications and the Cloud Ubiquitous connectivity is constantly transforming the mobile landscape. Bigger, Hi-Resolution Displays, Larger Memories, Faster Processors have helped increase device and network usage. Higher bandwidth for mobile devices has opened up new possibilities in spaces ranging from digital media to mobile health. All of this has had a huge impact in consumer behavior. Consumers are starting to ask for anywhere, anytime experience today and people don’t want to be tied down to devices, platforms or physical spaces when it comes to storing, accessing and consuming data – user experience has come to the fore-front. The session will address the following: The evolution of devices, mobile applications and the cloud Making better use of the data overload The cloud as the backbone for the ‘Internet of Things’ Creating a Seamless, Coherent and Integrated User Experience across Devices & Platforms The search for the ‘Killer App’ Asokan Thiyagarajan, Director – Platforms & Technology Strategy-Samsung Information Systems America

UX for Internet of things == Experience of Things

Puneet Arora

Mobile

Kris Bruynson

WSO2Con US 2013 - Securing Cloud and Mobile: Pragmatic Enterprise Security Ar...WSO2

Happy happy with indiavibesThe Links India ( saltmangotree marcom previously )

Much like Eleven and the gang, we at BinaryEdge sometimes are confronted with real monsters. Unlike in the series "Stranger Things" however, the monsters we're faced with take different shapes. Our monsters are usually found in the shape of weird things people connect to the internet. Often we're asked "What is the craziest things you guys have found connected to the internet?" In this talk we intend to answer and show exactly that. If you've seen our previous talks and/or read our "World Security Report" for 2016 (ise.binaryedge.io) you know that we have found some of the weirdest things online. From water dams, to electricity grids, and nuclear laboratory sensors, people simply love connecting things to the internet. And in this talk, we are going to explore the top "things" we've found exposed, talk about the different protocols they use and also allow YOU live on talk to search for your own things! On this talk we will also release our 2017 report, where we show how we detected some of the NSA tools such as Double pulsar. We will also make an interesting reveal on this topic. :)

Distil Networks Protecting the Telephony Industry

Paul Hobbs

Cyber Security: A Common Problem 2018

joshquarrie

Internet of Things - A Different Kind of Scary v2FitCEO, Inc. (FCI)

[4YFN]Cyber Security Innovation, an urgent call to cyber heroes SMCarlos Valderrama

SolarWinds Attack

InstaSafe Technologies

SolarWinds Attack

InstaSafe Technologies

IoT - THE NEW NORMAL?

M2M Alliance e.V.

Unraveling the Latest Cybersecurity Trends in 2024

FTx Identity

Vodqa why cybersecurity

Dileep Bellamkonda

Cyber crime

VARIndiaManishYadav

CIS 2016 Content Highlights

CloudIDSummit

Top 6 Reasons You Should Attend Cloud Identity Summit 2016

CloudIDSummit

The Cloud Identity Summit was founded by Ping Identity with support from industry leaders in 2010 to bring together the brightest minds across the identity and security industry. Today the event is recognized as the world’s premier identity industry conference and includes tracks from industry thought leaders, CIOs and practitioners. Cloud Identity Summit serves as a multi-year roadmap to deploy solutions that are here today but built for the future. For more info, go to www.cloudidentitysummit.com. Be apart of the convo on Twitter: @CloudIDSummit + #CISNOLA

Similar to CIS 2015 Security Without Borders: Taming the Cloud and Mobile Frontier - Andre Durand

Current Trends in Cyber Crime 2015

Cybernetic Global Intelligence

Internet of Things - Desire for Convenience Brings Multiple New Attack Vectors

Craig Walker, CISSP

MITRE ATT&CKcon Power Hour - November

MITRE - ATT&CKcon

21 Cybersecurity Companies You Need to Know.pptx

SonaliG6

What lies ahead? 2016 Cyber Security Predictions from Symantec in the EMEA (E...

Symantec

Internet & iot security

Usman Anjum

IOT Security

Sylvain Martinez

i7 Networks - Presentation at Zensar #TechShowcase - An iSPIRT ProductNation ...

ProductNation/iSPIRT

Bitidentify Security Technology

Klaus Drosch

Pixels Camp 2017 - Stranger Things the internet version

Tiago Henriques

Distil Networks Protecting the Telephony Industry

Paul Hobbs

Cyber Security: A Common Problem 2018

joshquarrie

Internet of Things - A Different Kind of Scary v2FitCEO, Inc. (FCI)

[4YFN]Cyber Security Innovation, an urgent call to cyber heroes SMCarlos Valderrama

SolarWinds Attack

InstaSafe Technologies

SolarWinds Attack

InstaSafe Technologies

IoT - THE NEW NORMAL?

M2M Alliance e.V.

Unraveling the Latest Cybersecurity Trends in 2024

FTx Identity

Vodqa why cybersecurity

Dileep Bellamkonda

Cyber crime

VARIndiaManishYadav

Similar to CIS 2015 Security Without Borders: Taming the Cloud and Mobile Frontier - Andre Durand (20)

Current Trends in Cyber Crime 2015

Internet of Things - Desire for Convenience Brings Multiple New Attack Vectors

MITRE ATT&CKcon Power Hour - November

21 Cybersecurity Companies You Need to Know.pptx

What lies ahead? 2016 Cyber Security Predictions from Symantec in the EMEA (E...

Internet & iot security

IOT Security

i7 Networks - Presentation at Zensar #TechShowcase - An iSPIRT ProductNation ...

Bitidentify Security Technology

Pixels Camp 2017 - Stranger Things the internet version

Distil Networks Protecting the Telephony Industry

Cyber Security: A Common Problem 2018

Internet of Things - A Different Kind of Scary v2

[4YFN]Cyber Security Innovation, an urgent call to cyber heroes SM

SolarWinds Attack

IoT - THE NEW NORMAL?

Unraveling the Latest Cybersecurity Trends in 2024

Vodqa why cybersecurity

Cyber crime

More from CloudIDSummit

CIS 2016 Content Highlights

CloudIDSummit

Top 6 Reasons You Should Attend Cloud Identity Summit 2016

CloudIDSummit

Mobile security, identity & authentication reasons for optimism 20150607 v2CloudIDSummit

CIS 2015 Mobile Security, Identity & Authentication: Reasons for Optimism - R...

CloudIDSummit

In an ever interconnected and inter-reliant world, the state of security has been a cause for deep pessimism. In the midst of all the gloom, there is good cause for optimism. With some fits and starts, the building blocks for transforming mobile security are taking shape at every level from the processor, to the chipset to special purpose hardware to operating systems and protocols that address use cases from device integrity to user authentication to payments. How do we think about security, privacy, identity and authentication in this world? This talk will provide a rapid overview of some selected building blocks and some practical examples that are now deployed at scale to illustrate the coming wave and how you as a practitioner or customer can participate and position yourself for maximum benefit.

CIS 2015 Virtual Identity: The Vision, Challenges and Experiences in Driving ...

CloudIDSummit

CIS 2015 Deploying Strong Authentication to a Global Enterprise: A Comedy in ...

CloudIDSummit

Does anybody remember seeing a big red button with the word “PANICK!” written on it? I know it was around here somewhere. Also, there’s all these cats running pell-mell around the place, can someone give me a hand in herding them? In this real-world case study, come and learn how a Fortune 100 with a diverse and extremely mobile work-force was able to turn up strong authentication protections for our critical cloud resources, and how the IT department lived to tell the tale. You’ll hear about the technical implementation of strong authentication enforcement, and how we made key design decisions in the ongoing balancing act between security and user experience, and how we managed up-and-down the chain from executive stakeholders to the boots-on-the-ground who were being asked to join us on this new security adventure.

CIS 2015 Without Great Security, Digital Identity is Not Worth the Electrons ...

CloudIDSummit

CIS 2015 Mergers & Acquisitions in a Cloud Enabled World - Brian Puhl

CloudIDSummit

You'll laugh, you'll cry, and you might even pick up a useful nugget or two listening to a real-world enterprise IT architect share the experiences of the past year trying to support his business migrating to cloud services, and sharing the lessons learned from trying to integrate 2 hybrid enterprises into a single, streamlined company. You'll hear where the cloud came through for us, and how we often had to fall back to on-prem services such as FIM, Ping Federate, and ADFS to make the glue which binds it all together.

CIS 2015 IoT and IDM in your Mobile Enterprise - Brian Katz

CloudIDSummit

CIS 2015 Practical Deployments Enterprise Cloud Access Management Platform - ...

CloudIDSummit

CIS 2015 What I Learned From Pitching IAM To My CIO - Steve Tout

CloudIDSummit

The IAM program needs to align behind the shift towards ITaaS, building the platform for execution and supporting transformation and migration activities. CIOs should keep informed through a relevant IAM capability roadmap in order to make calculated decisions on where investments should be made. Ongoing investments in the IAM program are crucial in order to fill capability gaps, keep up-to-date with support and license agreements and make opportunistic progress on the strategic roadmap. In this talk, Steve discusses recent experiences and lessons learned in preparing for and pitching VMware’s CIO on enterprise IAM program initiatives.

CIS 2015 How to secure the Internet of Things? Hannes Tschofenig

CloudIDSummit

Companies and researchers are exploring ways to make software and hardware development easier for the masses. Soon you will be able to build your own autonomous drone, create a sensor that assess the watering needs of your plants, and develop a cat tracking device with minimal coding and hardware skills. What is the place of security and privacy in this exciting development? Are we building the next generation of Internet security vulnerabilities right now? In his talk Hannes Tschofenig will highlight challenges with Internet of Things, what role standardization plays, and what contributions ARM, a provider of microprocessor IP, is making to improve IoT security.

CIS 2015 The IDaaS Dating Game - Sean Deuby

CloudIDSummit

The IDaaS (identity as a service) market segment continues to grow in popularity, and the scope of its vendor's capabilities continue to grow as well. It's still not a match for everyone, however. Join identity architect Sean Deuby for an overview of the most popular IDaaS deployment scenarios, scenarios where IDaaS has a tougher time meeting customer requirements, and whether your company is likely to find its perfect IDaaS mate.

CIS 2015 SSO for Mobile and Web Apps Ashish Jain

CloudIDSummit

The Industrial Internet, the Identity of Everything and the Industrial Enterp...

CloudIDSummit

CIS 2015 SAML-IN / SAML-OUT - Scott Tomilson & John Dasilva

CloudIDSummit

CIS 2015 Session Management at Scale - Scott Tomilson & Jamshid Khosravian

CloudIDSummit

Centralized session management has long been a goal of Web Access Management systems: the idea that one session can give end users access to dozens of protected applications with a seamless SSO experience, and terminating it (either by the end user themselves, or by an administrator) cuts off access instantly. It’s a nice dream isn’t it? Turns out that while most WAM products claim they can do this, when deployment time comes around (especially in globally distributed organizations) serious security and scalability challenges emerge that make it unfeasible. In this “session”, come and learn our vision for deploying session management at scale and see how Ping Identity has implemented it in our Federated Access Management solution.

CIS 2015 So you want to SSO … Scott Tomilson & John Dasilva

CloudIDSummit

Are you asking yourself how do I take my inhouse application and make it available to internal users, partners or customers using SSO and access management technologies? Oh, and you don't want it to be a 6 month project? No problem. Come and find out how to leverage your existing investments and move to modern standards like OpenID Connect, without having to rip and replace infrastructure. Learn the capabilities and tradeoffs you can make to deploy the right level of identity and access management infrastructure to match your security needs.

CIS 2015 Identity Relationship Management in the Internet of Things

CloudIDSummit

Devices need owners, people need confidence in device authenticity, data needs to persist in systems long after devices change hands, and access needs to be authorized selectively. That's a lot to ask; even if emerging web identity and security technologies are simpler than the models of yesteryear, IoT devices have complicating limitations when it comes to processing power, memory, user interface, and connectivity. But many use cases span web and IoT environments, so we must try! What are the specific requirements? What elements of web technologies can we borrow outright? What elements may need tweaking?

CIS 2015 The Ethics of Personal Data - Robin Wilton

CloudIDSummit

We're all more conscious than we were 2 years ago, about how much data is collected about us, and how revealing it can be. The commercial and government direction of travel is clear: more data, more mining, more monetization. And if personal data fuels the information economy, who'd want to stop that? But can we get the economic benefits, without selling our digital souls in the process? - Is there a data equivalent to the ""polluter pays"" principle? And if not, is there an alternative? - Ethical data handling sounds great in principle, but can it be practical? - How can organizations put ethical data handling into practice?

More from CloudIDSummit (20)

CIS 2016 Content Highlights

Top 6 Reasons You Should Attend Cloud Identity Summit 2016

Mobile security, identity & authentication reasons for optimism 20150607 v2

CIS 2015 Mobile Security, Identity & Authentication: Reasons for Optimism - R...

CIS 2015 Virtual Identity: The Vision, Challenges and Experiences in Driving ...

CIS 2015 Deploying Strong Authentication to a Global Enterprise: A Comedy in ...

CIS 2015 Without Great Security, Digital Identity is Not Worth the Electrons ...

CIS 2015 Mergers & Acquisitions in a Cloud Enabled World - Brian Puhl

CIS 2015 IoT and IDM in your Mobile Enterprise - Brian Katz

CIS 2015 Practical Deployments Enterprise Cloud Access Management Platform - ...

CIS 2015 What I Learned From Pitching IAM To My CIO - Steve Tout

CIS 2015 How to secure the Internet of Things? Hannes Tschofenig

CIS 2015 The IDaaS Dating Game - Sean Deuby

CIS 2015 SSO for Mobile and Web Apps Ashish Jain

The Industrial Internet, the Identity of Everything and the Industrial Enterp...

CIS 2015 SAML-IN / SAML-OUT - Scott Tomilson & John Dasilva

CIS 2015 Session Management at Scale - Scott Tomilson & Jamshid Khosravian

CIS 2015 So you want to SSO … Scott Tomilson & John Dasilva

CIS 2015 Identity Relationship Management in the Internet of Things

CIS 2015 The Ethics of Personal Data - Robin Wilton

Recently uploaded

Accelerate your Kubernetes clusters with Varnish Caching

Thijs Feryn

PCI PIN Basics Webinar from the Controlcase Team

ControlCase

FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf

FIDO Alliance

Observability Concepts EVERY Developer Should Know -- DeveloperWeek Europe.pdf

Paige Cruz

Monitoring and observability aren’t traditionally found in software curriculums and many of us cobble this knowledge together from whatever vendor or ecosystem we were first introduced to and whatever is a part of your current company’s observability stack. While the dev and ops silo continues to crumble….many organizations still relegate monitoring & observability as the purview of ops, infra and SRE teams. This is a mistake - achieving a highly observable system requires collaboration up and down the stack. I, a former op, would like to extend an invitation to all application developers to join the observability party will share these foundational concepts to build on:

Secstrike : Reverse Engineering & Pwnable tools for CTF.pptx

nkrafacyberclub

The Future of Platform Engineering

Jemma Hussein Allen

Video Streaming: Then, Now, and in the Future

Alpen-Adria-Universität

In his public lecture, Christian Timmerer provides insights into the fascinating history of video streaming, starting from its humble beginnings before YouTube to the groundbreaking technologies that now dominate platforms like Netflix and ORF ON. Timmerer also presents provocative contributions of his own that have significantly influenced the industry. He concludes by looking at future challenges and invites the audience to join in a discussion.

Monitoring Java Application Security with JDK Tools and JFR Events

Ana-Maria Mihalceanu

Quantum Computing: Current Landscape and the Future Role of APIs

Vlad Stirbu

zkStudyClub - Reef: Fast Succinct Non-Interactive Zero-Knowledge Regex Proofs

Alex Pruden

This paper presents Reef, a system for generating publicly verifiable succinct non-interactive zero-knowledge proofs that a committed document matches or does not match a regular expression. We describe applications such as proving the strength of passwords, the provenance of email despite redactions, the validity of oblivious DNS queries, and the existence of mutations in DNA. Reef supports the Perl Compatible Regular Expression syntax, including wildcards, alternation, ranges, capture groups, Kleene star, negations, and lookarounds. Reef introduces a new type of automata, Skipping Alternating Finite Automata (SAFA), that skips irrelevant parts of a document when producing proofs without undermining soundness, and instantiates SAFA with a lookup argument. Our experimental evaluation confirms that Reef can generate proofs for documents with 32M characters; the proofs are small and cheap to verify (under a second). Paper: https://eprint.iacr.org/2023/1886

Le nuove frontiere dell'AI nell'RPA con UiPath Autopilot™

UiPathCommunity

In questo evento online gratuito, organizzato dalla Community Italiana di UiPath, potrai esplorare le nuove funzionalità di Autopilot, il tool che integra l'Intelligenza Artificiale nei processi di sviluppo e utilizzo delle Automazioni. 📕 Vedremo insieme alcuni esempi dell'utilizzo di Autopilot in diversi tool della Suite UiPath: Autopilot per Studio Web Autopilot per Studio Autopilot per Apps Clipboard AI GenAI applicata alla Document Understanding 👨‍🏫👨‍💻 Speakers: Stefano Negro, UiPath MVPx3, RPA Tech Lead @ BSP Consultant Flavio Martinelli, UiPath MVP 2023, Technical Account Manager @UiPath Andrei Tasca, RPA Solutions Team Lead @NTT Data

The Art of the Pitch: WordPress Relationships and Sales

Laura Byrne

Clients don’t know what they don’t know. What web solutions are right for them? How does WordPress come into the picture? How do you make sure you understand scope and timeline? What do you do if sometime changes? All these questions and more will be explored as we talk about matching clients’ needs with what your agency offers without pulling teeth or pulling your hair out. Practical tips, and strategies for successful relationship building that leads to closing the deal.

State of ICS and IoT Cyber Threat Landscape Report 2024 preview

Prayukth K V

The IoT and OT threat landscape report has been prepared by the Threat Research Team at Sectrio using data from Sectrio, cyber threat intelligence farming facilities spread across over 85 cities around the world. In addition, Sectrio also runs AI-based advanced threat and payload engagement facilities that serve as sinks to attract and engage sophisticated threat actors, and newer malware including new variants and latent threats that are at an earlier stage of development. The latest edition of the OT/ICS and IoT security Threat Landscape Report 2024 also covers: State of global ICS asset and network exposure Sectoral targets and attacks as well as the cost of ransom Global APT activity, AI usage, actor and tactic profiles, and implications Rise in volumes of AI-powered cyberattacks Major cyber events in 2024 Malware and malicious payload trends Cyberattack types and targets Vulnerability exploit attempts on CVEs Attacks on counties – USA Expansion of bot farms – how, where, and why In-depth analysis of the cyber threat landscape across North America, South America, Europe, APAC, and the Middle East Why are attacks on smart factories rising? Cyber risk predictions Axis of attacks – Europe Systemic attacks in the Middle East Download the full report from here: https://sectrio.com/resources/ot-threat-landscape-reports/sectrio-releases-ot-ics-and-iot-security-threat-landscape-report-2024/

GenAISummit 2024 May 28 Sri Ambati Keynote: AGI Belongs to The Community in O...

Sri Ambati

By Design, not by Accident - Agile Venture Bolzano 2024

Pierluigi Pugliese

Encryption in Microsoft 365 - ExpertsLive Netherlands 2024

Albert Hoitingh

Leading Change strategies and insights for effective change management pdf 1.pdf

OnBoard

The Metaverse and AI: how can decision-makers harness the Metaverse for their...

Jen Stirrup

The Metaverse is popularized in science fiction, and now it is becoming closer to being a part of our daily lives through the use of social media and shopping companies. How can businesses survive in a world where Artificial Intelligence is becoming the present as well as the future of technology, and how does the Metaverse fit into business strategy when futurist ideas are developing into reality at accelerated rates? How do we do this when our data isn't up to scratch? How can we move towards success with our data so we are set up for the Metaverse when it arrives? How can you help your company evolve, adapt, and succeed using Artificial Intelligence and the Metaverse to stay ahead of the competition? What are the potential issues, complications, and benefits that these technologies could bring to us and our organizations? In this session, Jen Stirrup will explain how to start thinking about these technologies as an organisation.

GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...

James Anderson

Effective Application Security in Software Delivery lifecycle using Deployment Firewall and DBOM The modern software delivery process (or the CI/CD process) includes many tools, distributed teams, open-source code, and cloud platforms. Constant focus on speed to release software to market, along with the traditional slow and manual security checks has caused gaps in continuous security as an important piece in the software supply chain. Today organizations feel more susceptible to external and internal cyber threats due to the vast attack surface in their applications supply chain and the lack of end-to-end governance and risk management. The software team must secure its software delivery process to avoid vulnerability and security breaches. This needs to be achieved with existing tool chains and without extensive rework of the delivery processes. This talk will present strategies and techniques for providing visibility into the true risk of the existing vulnerabilities, preventing the introduction of security issues in the software, resolving vulnerabilities in production environments quickly, and capturing the deployment bill of materials (DBOM). Speakers: Bob Boule Robert Boule is a technology enthusiast with PASSION for technology and making things work along with a knack for helping others understand how things work. He comes with around 20 years of solution engineering experience in application security, software continuous delivery, and SaaS platforms. He is known for his dynamic presentations in CI/CD and application security integrated in software delivery lifecycle. Gopinath Rebala Gopinath Rebala is the CTO of OpsMx, where he has overall responsibility for the machine learning and data processing architectures for Secure Software Delivery. Gopi also has a strong connection with our customers, leading design and architecture for strategic implementations. Gopi is a frequent speaker and well-known leader in continuous delivery and integrating security into software delivery.

GraphRAG is All You need? LLM & Knowledge Graph

Guy Korland

Guy Korland, CEO and Co-founder of FalkorDB, will review two articles on the integration of language models with knowledge graphs. 1. Unifying Large Language Models and Knowledge Graphs: A Roadmap. https://arxiv.org/abs/2306.08302 2. Microsoft Research's GraphRAG paper and a review paper on various uses of knowledge graphs: https://www.microsoft.com/en-us/research/blog/graphrag-unlocking-llm-discovery-on-narrative-private-data/

Recently uploaded (20)

Accelerate your Kubernetes clusters with Varnish Caching

PCI PIN Basics Webinar from the Controlcase Team

FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf

Observability Concepts EVERY Developer Should Know -- DeveloperWeek Europe.pdf

Secstrike : Reverse Engineering & Pwnable tools for CTF.pptx

The Future of Platform Engineering

Video Streaming: Then, Now, and in the Future

Monitoring Java Application Security with JDK Tools and JFR Events

Quantum Computing: Current Landscape and the Future Role of APIs

zkStudyClub - Reef: Fast Succinct Non-Interactive Zero-Knowledge Regex Proofs

Le nuove frontiere dell'AI nell'RPA con UiPath Autopilot™

The Art of the Pitch: WordPress Relationships and Sales

State of ICS and IoT Cyber Threat Landscape Report 2024 preview

GenAISummit 2024 May 28 Sri Ambati Keynote: AGI Belongs to The Community in O...

By Design, not by Accident - Agile Venture Bolzano 2024

Encryption in Microsoft 365 - ExpertsLive Netherlands 2024

Leading Change strategies and insights for effective change management pdf 1.pdf

The Metaverse and AI: how can decision-makers harness the Metaverse for their...

GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...

GraphRAG is All You need? LLM & Knowledge Graph

CIS 2015 Security Without Borders: Taming the Cloud and Mobile Frontier - Andre Durand

2. WELCOME IDENTERATI

3. INTRODUCING SIERRA BORDER SECURITY V1.0

4. “WE DIDN’T FOCUS ON HOW YOU COULD WRECK THE SYSTEM INTENTIONALLY” Vinton G. Cerf

5. $100 BILLION Estimated loss in US per annum due to cybercrimeTHE INTERNET “THEY THOUGHT THEY WERE BUILDING A CLASSROOM AND IT TURNS OUT THEY BUILT A BANK.” Abbate

6. SECURITY WASN’T EVEN A GOAL

7. UNFORTUNATE TRUTH ATTACKS SECURITY Ubiquitous Internet New Vulnerabilities Market for Identity Success & Profits 30 Million Bots Insider Recruitment Organization

8. WHAT IF OUR PERIMETER NO LONGER DEFINES OUR PERIMETER?

9. THE PERIMETER IS EXPANDING 2007 2008 2009 2010 2011 2012 2013 2014 2015Timeline Software-as-a-Service ENTERPRISE (apps, users, network)

10. THE PERIMETER IS EXPANDING 2007 2008 2009 2010 2011 2012 2013 2014 2015Timeline Software-as-a-Service ENTERPRISE (apps, users, network) Smart Mobile Devices

11. Infrastructure-as-a-Service 2007 2008 2009 2010 2011 2012 2013 2014 2015Timeline Software-as-a-Service ENTERPRISE (apps, users, network) Smart Mobile Devices THE PERIMETER IS EXPANDING

12. “DON’T EVER TAKE DOWN YOUR FENCE UNTIL YOU KNOW THE REASON IT WAS PUT UP.” G.K. Chesterton

13.

14.

15. internet enterprise computer device app api Iot MANY BORDERS ONE BORDERLESS IDENTITY SYSTEM

16. WE’RE BUILDING A HAMSTER TRAIL SECURE TUNNELS TO TRANSMIT AUTHENTICATED USERS

17. REDEFINING SECURITY with IDENTITY CORE SECURITY IDENTITY DEFINED SECURITY IDENTITY

18. WE’RE ON A JOURNEY TO FULL IDENTITY VISIBILITY

19. ANONYMOUS BY DEFAULT IDENTIFIED BY DEFAULT FUTURE PAY EXTRA FOR ANONAMOUS TRANSACTIONS

20. BEWARE OUR ASSUMPTIONS

21. ONLY GOOD ACTORS COULD ACCESS THE NETWORK ASSUMPTION #1 1970

22. THE PERIMETER IS SECURE ASSUMPTION #2 1970–TODAY

23. IDENTITY IS MORE SECURE ASSUMPTION #3 2015

24. WHAT WOULD WE DO IF PERIMETER ALREADY BREACHED

25. WHAT IF THE RIGHT IDENTITY BECOMES A BAD ACTOR?

26. WHAT IF… IDENTITY IS TOO WEAK & TOO DISCONNECTED TO PROTECT US AT SCALE?

27. MOVING FORWARD

28. EVOLVE FROM SINGLE-FACTOR AUTHENTICATION

29. TO CONTINUOUS AND CONTEXTUAL MULTI-FACTOR

30. STANDARDS-BASED INTERACTIONS EVERYWHERE INCLUDING FIRST/LAST MILE INTEGRATION

31. micro trust trust a little > trust a little more login > trust a lot > trust a little more trust a little less and so on… TIME OUT / LOGOUTLOGIN > TRUST A LOT > BIG TRUST

32. NEED A NEW SYSTEM FOR IDENTITY PROOFING & RESOLUTION

33. move beyond STATIC ACCESS CONTROL

34. LEVERAGE BIG-DATA & INTELLIGENCE TO ENABLE DYNAMIC ACCESS CONTROL

35. KUDO’S OPENID CONNECT

36. THANK YOU

37. REGISTER EARLY!

38. INTRODUCING ALEX SIMONS

CIS 2015 Security Without Borders: Taming the Cloud and Mobile Frontier - Andre Durand

Recommended

Recommended

More Related Content

Similar to CIS 2015 Security Without Borders: Taming the Cloud and Mobile Frontier - Andre Durand

Similar to CIS 2015 Security Without Borders: Taming the Cloud and Mobile Frontier - Andre Durand (20)

More from CloudIDSummit

More from CloudIDSummit (20)

Recently uploaded

Recently uploaded (20)

CIS 2015 Security Without Borders: Taming the Cloud and Mobile Frontier - Andre Durand