This document summarizes a presentation on building a cybersecurity risk management program. Some key points:
- The presenter discusses the importance of understanding business impacts of cybersecurity failures and balancing compliance obligations with operational risks.
- Cybersecurity controls must be embedded in business processes to be effective.
- As an executive, one must understand the organization's risk posture relative to peers and how the organization responds to incidents.
- The presenter emphasizes communicating cybersecurity risks using common language executives can understand and prioritizing risks based on limited resources.
Alex Hanway - Securing the Breach: Using a Holistic Data Protection Frameworkcentralohioissa
From this presentation you will learn:
· A brief history of encryption
· How encryption is now deployed in the enterprise
· Encryption and key management best practices to keep data safe
Gabriel Gumbs - A Capability Maturity Model for Sustainable Data Loss Protectioncentralohioissa
Based on the combined experiences of information security professionals protecting some of the world’s most sensitive data, the Sensitive Data Maturity model is built on practical lessons learned while implementing world class data security programs. During this session Gabriel Gumbs will explain the components of the framework that builds on these lessons and provides a path to mature and measure their sensitive data security strategies.
Topics covered in this session include:
• Taxonomy of Sensitive Data
• Domains & Levels of the Sensitive Data Maturity Framework
• Practices & Standards
• Transitional States of Data Protection
• Guide to Improvement Efforts
• Measurement & Analysis
The increasing loss of data either by hacking or misuse along with ever evolving data regulations continue to heighten the need for security professionals to evolve their data protection strategies. During this session I will present a capability model based on real world experience that covers the business functions and security practices necessary to build an effective data protection program.
Oliver Schuermann - Integrated Software in Networking - the Mystery of SDNcentralohioissa
For the past several years, software-defined networking (SDN) has been a popular buzz word in the networking industry. In many ways, networking has always been defined by software. Software is pervasive within all of the technology that impacts our lives and networking is no different. However, networks have been constrained by the way software has been configured, delivered and managed—literally within a box, updated monolithically, managed through command lines that are reminiscent to the days of minicomputers and DOS in the 1980’s. Well, almost.
Jack Nichelson - Information Security Metrics - Practical Security Metricscentralohioissa
So exactly how do you integrate information security metrics into action in an organization and actually achieve value from the effort. Learn what efforts are currently underway in the industry to create consensus metrics guides and what initial steps an organization can take to start measuring the effectiveness of their security program.
Most boards of directors don't have someone that understands cyber security issues. As a consequence, they can't provide the proper oversight over the companies they are responsible for. This presentation will cover the issues boards of directors need to understand, what questions board members need to ask and how to communicate with them.
Mark Villinski - Top 10 Tips for Educating Employees about Cybersecuritycentralohioissa
Corporate cybercrime is usually blamed on outsiders, but sometimes, your employees can represent the biggest threat to your organization’s IT security. In this presentation, Kaspersky Lab’s Mark Villinski, will provide practical advice for educating your employees about cybersecurity. Attend to learn:
• How to create efficient and effective security policies
• Overview and statistics of the current threat landscape
• The importance of keeping your employees updated about the latest threats and scams
• Security solutions that can help keep your systems updated and protected
In 2015, phishing related breaches dominated security news headlines, and will likely remain the leading initial point-of-entry method for 2016. Not surprisingly an upswing in security awareness spending has paralleled the rise in phishing. In this presentation we dive deep into the largest data pool of human phishing susceptibility and also new research about phishing awareness. We will also look at phishing from the attacker’s point of view and look for opportunities to be better defenders.
Let’s examine the evidence and decide if awareness is the problem. Why do users who are aware of phishing continue to fall for it? What are some of the most successful phishing themes? What are some common response rates? And finally, what can conditioned informants (your co-workers) reporting suspicious emails bring to the table?
In this provocative and sometimes irreverent presentation, retired Brigadier General Greg Touhill, the United States government's first federal Chief Information Security Officer, will discuss why the legacy perimeter defense model has been overwhelmed and made obsolete by the advent of modern mobility and cloud computing. He'll demonstrate how to make the business case that the shift to the Zero Trust security strategy is now essential for businesses to survive and thrive in today's highly contested global digital economy.
Alex Hanway - Securing the Breach: Using a Holistic Data Protection Frameworkcentralohioissa
From this presentation you will learn:
· A brief history of encryption
· How encryption is now deployed in the enterprise
· Encryption and key management best practices to keep data safe
Gabriel Gumbs - A Capability Maturity Model for Sustainable Data Loss Protectioncentralohioissa
Based on the combined experiences of information security professionals protecting some of the world’s most sensitive data, the Sensitive Data Maturity model is built on practical lessons learned while implementing world class data security programs. During this session Gabriel Gumbs will explain the components of the framework that builds on these lessons and provides a path to mature and measure their sensitive data security strategies.
Topics covered in this session include:
• Taxonomy of Sensitive Data
• Domains & Levels of the Sensitive Data Maturity Framework
• Practices & Standards
• Transitional States of Data Protection
• Guide to Improvement Efforts
• Measurement & Analysis
The increasing loss of data either by hacking or misuse along with ever evolving data regulations continue to heighten the need for security professionals to evolve their data protection strategies. During this session I will present a capability model based on real world experience that covers the business functions and security practices necessary to build an effective data protection program.
Oliver Schuermann - Integrated Software in Networking - the Mystery of SDNcentralohioissa
For the past several years, software-defined networking (SDN) has been a popular buzz word in the networking industry. In many ways, networking has always been defined by software. Software is pervasive within all of the technology that impacts our lives and networking is no different. However, networks have been constrained by the way software has been configured, delivered and managed—literally within a box, updated monolithically, managed through command lines that are reminiscent to the days of minicomputers and DOS in the 1980’s. Well, almost.
Jack Nichelson - Information Security Metrics - Practical Security Metricscentralohioissa
So exactly how do you integrate information security metrics into action in an organization and actually achieve value from the effort. Learn what efforts are currently underway in the industry to create consensus metrics guides and what initial steps an organization can take to start measuring the effectiveness of their security program.
Most boards of directors don't have someone that understands cyber security issues. As a consequence, they can't provide the proper oversight over the companies they are responsible for. This presentation will cover the issues boards of directors need to understand, what questions board members need to ask and how to communicate with them.
Mark Villinski - Top 10 Tips for Educating Employees about Cybersecuritycentralohioissa
Corporate cybercrime is usually blamed on outsiders, but sometimes, your employees can represent the biggest threat to your organization’s IT security. In this presentation, Kaspersky Lab’s Mark Villinski, will provide practical advice for educating your employees about cybersecurity. Attend to learn:
• How to create efficient and effective security policies
• Overview and statistics of the current threat landscape
• The importance of keeping your employees updated about the latest threats and scams
• Security solutions that can help keep your systems updated and protected
In 2015, phishing related breaches dominated security news headlines, and will likely remain the leading initial point-of-entry method for 2016. Not surprisingly an upswing in security awareness spending has paralleled the rise in phishing. In this presentation we dive deep into the largest data pool of human phishing susceptibility and also new research about phishing awareness. We will also look at phishing from the attacker’s point of view and look for opportunities to be better defenders.
Let’s examine the evidence and decide if awareness is the problem. Why do users who are aware of phishing continue to fall for it? What are some of the most successful phishing themes? What are some common response rates? And finally, what can conditioned informants (your co-workers) reporting suspicious emails bring to the table?
In this provocative and sometimes irreverent presentation, retired Brigadier General Greg Touhill, the United States government's first federal Chief Information Security Officer, will discuss why the legacy perimeter defense model has been overwhelmed and made obsolete by the advent of modern mobility and cloud computing. He'll demonstrate how to make the business case that the shift to the Zero Trust security strategy is now essential for businesses to survive and thrive in today's highly contested global digital economy.
Ruben Melendez - Economically Justifying IT Security Initiativescentralohioissa
IT Security Initiatives create strategic and operational value to all enterprises; however, many IT professionals do not know how to economically quantify and forecast the benefits of IT security. Additionally, the new digital business ecosystem is resulting in rapid business cycles, which require faster speed and agility in all IT areas and IT services. The new ecosystem, largely caused by the Internet-of-Things, mobility and the Cloud, create a challenge for selecting and prioritizing IT security tools and projects. This session will present an overview of principles, models, trends and best practices, which can have been adopted by individuals and organizations to get right IT security initiatives approved.
Gary Sheehan - Winning a Battle Doesn't Mean We Are Winning the Warcentralohioissa
In the spirit of Continuous Improvement, we must ask ourselves - Are we doing the best job we can? In this presentation Gary will present some ideas and concepts that can be used to improve the security posture within your organization. These ideas and concepts are not your typical solutions, rather they will force you to make a fundamental change in your approach to implementing security and underlying assumptions about good security practices. This presentation will challenge conventional thinking about how to build a successful security program. After all, what do you have to lose? Are we really winning the cybersecurity war?
We are all aware of the current risks when developing a connected product, especially with vehicles since much is at stake both from an information and safety perspective. In this workshop, we will learn how to build Security requirements, architect, design, test and produce Safety and Security critical components using a methodology that works in harmony both with Engineering and Security
Ken Czekaj & Robert Wright - Leveraging APM NPM Solutions to Compliment Cyber...centralohioissa
This discussion will detail best practices and recommendations for using your Application Performance Management / Network Performance Management solutions. The focus is to work in tandem and compliment existing Cyber Security solutions.
Jake Williams - Navigating the FDA Recommendations on Medical Device Security...centralohioissa
In January, the FDA has draft recommendations for medical device security after the sale. Among other things, the recommendations tell manufacturers how to evaluate security risks, how to build a program for coordinated vulnerability disclosure program, and how to intake vulnerability reports from researchers. While the security of medical devices is especially important given the potential consequences, we can learn from the FDA recommendations regardless of our industry. Any recommendations adopted by the FDA for medical devices are likely to be implemented across other verticals for their IoT devices as well. Whether you manufacture, purchase, integrate, implement, or generally try to run away from IoT devices, there’s plenty to take away from this session while learning about the future of IoT device security.
Building in-house breach detection and response capabilities is difficult. When chosen right, your managed detection and response service provider actually become your cyber security partner: its capabilities become an extension of your own. One of the biggest reasons why your organization should consider a managed security service instead of an in-house SIEM (security information and event management) deployment for breach detection and response: cost, cost, cost!
As organizations struggle to mature their security and IT service profiles across expanding numbers of endpoints, they are increasingly turning to the proactive management capabilities of endpoint detection and responses platforms.
To provide organizations with a clear example of how to identify the most effective EDRP solutions, leading IT analyst firm Enterprise Management Associates (EMA) has conducted independent and objective research on the features and capabilities of two of the leading solution suites in this market: Tanium Core and 1E Tachyon.
Jeffrey Sweet - Third Party Risk Governance - Why? and How?centralohioissa
In this session information will be presented on Third Party Risk Governance. The presenter will provide a better understand of the what’s, why’s and how’s of a Third Party Risk Governance program and provide some suggestions on sources for a program as well as some of the typical “gotchas”. This presentation will also provide common objections from the recipients of assessments and how to overcome those objections as well as discuss contract language that can be added to your products and services contracts.
William Diederich - Security Certifications: Are They Worth the Investment? A...centralohioissa
The IT world seems to be exploding with certifications, with new ones being offered practically every month. How does one chose from all of the options available, and are they worth it?
This session discusses the plethora of Governance, Risk, Compliance, Security and Technology related certifications being offered today. What are the benefits, and which are the most highly valued? Most importantly, which ones are right for you? Can one get too many certifications, and what’s the balance?
Practical tips and recommendations are offered to help the person who decides on attaining certifications. Including, how to select the best certifications, how to plan a roadmap for achieving them, and successfully completing the plan they set out.
Lastly, the benefits of certifications are discussed, and how to maximize their value.
A brief run-through of the economics of controls, threats and how attackers and defenders think. Following an introduction to the current and next generation security analytics.
This presentation will explore suggestions for ways Security people in Central Ohio can and do collaborate to improve Security practices within and external to organizations. This will explore ISACs, ISAOs, partnerships such as the Collaboratory, Internships, ISSA, etc.
As cyber criminals and nation-states continue to improve the sophistication of attacks that bypass traditional preventive defenses, organizations must evolve their security defenses to reduce dwell time. Join Fidelis Advisor, and ex CIA CTO, Bob Flores and Fidelis Senior Manager, Tom Clare as they delve into the results of The 2018 State of Threat Detection Report and discuss what the research means for organizations large and small across the globe.
In 2018, Zero Trust Security gained popularity due to its simplicity and effectiveness. Yet despite a rise in awareness, many organizations still don’t know where to start or are slow to adopt a Zero Trust approach.
The result? Breaches affected as many as 66% of companies just last year. And as hackers become more sophisticated and resourceful, the number of breaches will continue to rise.
Unless organizations adopt Zero Trust Security. In 2019, take some time to assess your company’s risk factors and learn how to implement Zero Trust Security in your organization.
Brian Henger - Psychological Warfare: How Cyber Criminals Mess With Your Mindcentralohioissa
-The evolution of online advertising tactics
-What cyber criminals find appealing about advertising and profiling
-How advertisers and cyber criminals have worked together in the past
-What psychological tactics are used by cyber criminals in real world attacks
-How to protect yourself from psychological attacks
Evidence-Based Security: The New Top Five ControlsPriyanka Aash
Most cybersecurity professionals know the CIS Top Five Critical Security Controls. Yet, the evidence that they are effective is slim. Using data on cyber-incidents, researchers looked at the attack paths used by adversaries and determined what controls could have disrupted these attack paths. The result is a new set of critical controls that organizations should implement on a priority basis.
Learning Objectives:
1: Understand evidence-based approach to selecting controls.
2: Understand why the “new top five” controls were selected.
3: Chart a pathway to implementing the new top five controls.
(Source: RSA Conference USA 2018)
Providing a Flexible Approach to the Inflexible World of Information Security...gemmarie1
A short presentation on a new, unique approach to Information Security Managed Services.
PragmaticDefence utilise all existing internal resources, to provide as much or as little you need to remain secure.
Ruben Melendez - Economically Justifying IT Security Initiativescentralohioissa
IT Security Initiatives create strategic and operational value to all enterprises; however, many IT professionals do not know how to economically quantify and forecast the benefits of IT security. Additionally, the new digital business ecosystem is resulting in rapid business cycles, which require faster speed and agility in all IT areas and IT services. The new ecosystem, largely caused by the Internet-of-Things, mobility and the Cloud, create a challenge for selecting and prioritizing IT security tools and projects. This session will present an overview of principles, models, trends and best practices, which can have been adopted by individuals and organizations to get right IT security initiatives approved.
Gary Sheehan - Winning a Battle Doesn't Mean We Are Winning the Warcentralohioissa
In the spirit of Continuous Improvement, we must ask ourselves - Are we doing the best job we can? In this presentation Gary will present some ideas and concepts that can be used to improve the security posture within your organization. These ideas and concepts are not your typical solutions, rather they will force you to make a fundamental change in your approach to implementing security and underlying assumptions about good security practices. This presentation will challenge conventional thinking about how to build a successful security program. After all, what do you have to lose? Are we really winning the cybersecurity war?
We are all aware of the current risks when developing a connected product, especially with vehicles since much is at stake both from an information and safety perspective. In this workshop, we will learn how to build Security requirements, architect, design, test and produce Safety and Security critical components using a methodology that works in harmony both with Engineering and Security
Ken Czekaj & Robert Wright - Leveraging APM NPM Solutions to Compliment Cyber...centralohioissa
This discussion will detail best practices and recommendations for using your Application Performance Management / Network Performance Management solutions. The focus is to work in tandem and compliment existing Cyber Security solutions.
Jake Williams - Navigating the FDA Recommendations on Medical Device Security...centralohioissa
In January, the FDA has draft recommendations for medical device security after the sale. Among other things, the recommendations tell manufacturers how to evaluate security risks, how to build a program for coordinated vulnerability disclosure program, and how to intake vulnerability reports from researchers. While the security of medical devices is especially important given the potential consequences, we can learn from the FDA recommendations regardless of our industry. Any recommendations adopted by the FDA for medical devices are likely to be implemented across other verticals for their IoT devices as well. Whether you manufacture, purchase, integrate, implement, or generally try to run away from IoT devices, there’s plenty to take away from this session while learning about the future of IoT device security.
Building in-house breach detection and response capabilities is difficult. When chosen right, your managed detection and response service provider actually become your cyber security partner: its capabilities become an extension of your own. One of the biggest reasons why your organization should consider a managed security service instead of an in-house SIEM (security information and event management) deployment for breach detection and response: cost, cost, cost!
As organizations struggle to mature their security and IT service profiles across expanding numbers of endpoints, they are increasingly turning to the proactive management capabilities of endpoint detection and responses platforms.
To provide organizations with a clear example of how to identify the most effective EDRP solutions, leading IT analyst firm Enterprise Management Associates (EMA) has conducted independent and objective research on the features and capabilities of two of the leading solution suites in this market: Tanium Core and 1E Tachyon.
Jeffrey Sweet - Third Party Risk Governance - Why? and How?centralohioissa
In this session information will be presented on Third Party Risk Governance. The presenter will provide a better understand of the what’s, why’s and how’s of a Third Party Risk Governance program and provide some suggestions on sources for a program as well as some of the typical “gotchas”. This presentation will also provide common objections from the recipients of assessments and how to overcome those objections as well as discuss contract language that can be added to your products and services contracts.
William Diederich - Security Certifications: Are They Worth the Investment? A...centralohioissa
The IT world seems to be exploding with certifications, with new ones being offered practically every month. How does one chose from all of the options available, and are they worth it?
This session discusses the plethora of Governance, Risk, Compliance, Security and Technology related certifications being offered today. What are the benefits, and which are the most highly valued? Most importantly, which ones are right for you? Can one get too many certifications, and what’s the balance?
Practical tips and recommendations are offered to help the person who decides on attaining certifications. Including, how to select the best certifications, how to plan a roadmap for achieving them, and successfully completing the plan they set out.
Lastly, the benefits of certifications are discussed, and how to maximize their value.
A brief run-through of the economics of controls, threats and how attackers and defenders think. Following an introduction to the current and next generation security analytics.
This presentation will explore suggestions for ways Security people in Central Ohio can and do collaborate to improve Security practices within and external to organizations. This will explore ISACs, ISAOs, partnerships such as the Collaboratory, Internships, ISSA, etc.
As cyber criminals and nation-states continue to improve the sophistication of attacks that bypass traditional preventive defenses, organizations must evolve their security defenses to reduce dwell time. Join Fidelis Advisor, and ex CIA CTO, Bob Flores and Fidelis Senior Manager, Tom Clare as they delve into the results of The 2018 State of Threat Detection Report and discuss what the research means for organizations large and small across the globe.
In 2018, Zero Trust Security gained popularity due to its simplicity and effectiveness. Yet despite a rise in awareness, many organizations still don’t know where to start or are slow to adopt a Zero Trust approach.
The result? Breaches affected as many as 66% of companies just last year. And as hackers become more sophisticated and resourceful, the number of breaches will continue to rise.
Unless organizations adopt Zero Trust Security. In 2019, take some time to assess your company’s risk factors and learn how to implement Zero Trust Security in your organization.
Brian Henger - Psychological Warfare: How Cyber Criminals Mess With Your Mindcentralohioissa
-The evolution of online advertising tactics
-What cyber criminals find appealing about advertising and profiling
-How advertisers and cyber criminals have worked together in the past
-What psychological tactics are used by cyber criminals in real world attacks
-How to protect yourself from psychological attacks
Evidence-Based Security: The New Top Five ControlsPriyanka Aash
Most cybersecurity professionals know the CIS Top Five Critical Security Controls. Yet, the evidence that they are effective is slim. Using data on cyber-incidents, researchers looked at the attack paths used by adversaries and determined what controls could have disrupted these attack paths. The result is a new set of critical controls that organizations should implement on a priority basis.
Learning Objectives:
1: Understand evidence-based approach to selecting controls.
2: Understand why the “new top five” controls were selected.
3: Chart a pathway to implementing the new top five controls.
(Source: RSA Conference USA 2018)
Providing a Flexible Approach to the Inflexible World of Information Security...gemmarie1
A short presentation on a new, unique approach to Information Security Managed Services.
PragmaticDefence utilise all existing internal resources, to provide as much or as little you need to remain secure.
Apparently, bank directors are a very worried bunch. Nearly 20 members of Bank Director’s membership program responded to the question posed in last month’s newsletter: “What worries you most about the future?”
Estudio de Russell Reynolds Associates sobre ciberseguridad que explora la importancia de la relación entre el Chief Information Security Officer y el Consejo de Administración.
Perpetual Information Security - Driving Data Protection in an Evolving Compl...SafeNet
Market forces, such as compliance, globalization, outsourcing, SaaS, and cloud computing, have driven greater proliferation of data, information exchange, and access to data by “outsiders.” As this happens, the threats continue to mount, as more people inside and outside of the organization need access to data.With the loss of a traditional physical perimeter, a data-centric approach will protect each information item using a cryptographic perimeter that encases the data. Utilizing encryption as the data protection method enables a high-level of trust in allowing more free exchange of information – no need to worry about any type of data loss with each item being individually isolated. The key is central control – one place that has all the controls for all the data in every type of environment. For true life-cycle management and the control needed to “secure” the data, a consolidate location for control and management is key.
Cyber risk tips for boards and executive teamsWynyard Group
Craig Richardson, CEO of crime fighting software company Wynyard Group shares his recommendations for boards and executives on addressing cyber risks for their organisations.
Here are my slides on "Board and Cyber Security" that I presented at the Just People Information Security breakfast this morning. Thanks Adam for arranging the session and those who attended.
Discussion that was held at RSA on the five steps CISO's can use to assess their enterprise security program and architect one that meets the organizations objectives and reduces its exposure to risk.
Information Security in a Compliance WorldEvan Francen
Presented by Evan Francen at the 2012 RK Dixon Tech Summit
What drives information security in your organization?
What is information security?
Customer requirements
Compliance
Compliant = Secure?
Solution - Strategic Information Security
Top Five Things You Should Do (Tactically & Strategically)
Need Help? – Contact Us!
What CIOs Need To Tell Their Boards About Cyber SecurityKaryl Scott
Companies are under increasing risks of breaches, theft of intellectual property and erosion of customer trust. CIOs and CISOs need to be able to explain to executive management what's being done to shore up their company's security strategy and defenses.
(Consulting) Couch to CISO: A Security Leader's First 100 Days and BeyondPhilip Beyer
:: History ::
Security BSides DFW 2011 - November 5, 2011 (Philip J Beyer) - http://lanyrd.com/skymy
:: Summary ::
I will present details of how I transitioned from security consultant to program leader from vision to practice and planning for the future.
:: Abstract ::
If you want to go from a sedentary life to running a marathon, you have to have a plan. If you want to go from a consulting life to owning a security program, you also have to have a plan. Much like a 'Couch to 5K' running program, that plan will require vision, persistent effort, and a clear set of goals. I'll share my plan, what has worked so far and what didn't, and how you can design your own.
Mitigating Security Risks in Vendor Agreements
Providers of software, software-as-a-service, managed services, and professional services have varying degrees of sophistication in addressing security in their form contracts. Learn from an experienced technology attorney how to understand key clauses, or discover when they are missing, to ensure that the company's vendors are compliant with the appropriate security measures before signing the deal.
Brian Kirkpatrick is the founding shareholder of Kirkpatrick Law PC and a business attorney with a technology focus. He also serves as Of Counsel to Mullin Law PC for matters involving technology and information security.
His practice revolves around clients needing assistance in technology transactions, data privacy, cyber security, software compliance and audits, and general counsel related to business matters. Brian was voted 2015 Top Technology Attorney in Tarrant County by his peers as published in Fort Worth Texas Magazine.
Brian has published numerous articles and lectured nationally on legal topics such as software as a service, software licensing, contract negotiation, cyber security and legal considerations when starting a business. He is also featured in radio news interviews, as a conference panelist, a featured speaker, and is featured in an instructional video series about conducting negotiations. Before entering the legal profession, Brian was a Vice President commercial banker.
Brian is a graduate of Texas A&M University School of Law where he was inducted into the National Order of Barristers. He also has a Masters of Arts in Applied Economics from Southern Methodist University and a Bachelors of Science in Economics from Texas A&M University - Commerce where he was inducted into the Omicron Delta Epsilon International Economics Honor Society.
A Day in the Life of a CISO
The intent of this presentation is to present the diverse nature of being a CISO today within the context of a public, regulated and targeted organization. The content is to both inspire and warn those whose career choices may include the CISO destination.
Mark Nagiel SVP/CISO, PrimeLending (4th. largest mortgage company in the US)
Director, Information Security (MetroPCS/T-Mobile)
VP, Technology/VP Information Security (InCharge Institute - Financial Services)
Co-Founder, Network Audit Systems, Inc. (Acquired by Armor Holdings (NYSE company)
InfoSec Chief (Niagara Mohawk Power Corp.)
Robert Brzezinski - Office 365 Security & Compliance: Cloudy Collaboration......centralohioissa
Collaboration often drives how we work especially when our workforce is mobile, when it is working off premises and serving clients in the field. Our employees adopt cloud solutions to communicate, exchange ideas and files, and to collaborate without our knowledge…this approach keeps security officers sleepless not only in Seattle but also in Columbus…
This presentation is an overview of Office 365 functionality, security and compliance (reporting) capabilities to manage information privacy, security and compliance risks, and related documentation. Office 365 email security and management, SharePoint collaboration platform and Azure Active Directory reporting will be reviewed. This is a business/technical (not in depth technical) presentation to help business / technical audience understand the security and functionality of Office 365 solution when considering cloud solutions adoption.
Cyber presentation spet 2019 v8sentfor uploadsavassociates1
An accountant is a valuable asset to any organization. He or she is a professional who performs accounting functions. Accounting is not only confined to tax and financial matters as per what people generally think.
What is Cyber Security
What is Cyber Threat and Threat Landscape
Is Cybersecurity an IT Problem? It’s a human Problem
Role of a CFO
Well accepted Cybersecurity Frameworks and common Themes
SOC (Service Organization Control) and SOC for Cybersecurity
Recommended risk mitigation strategies for the weakest links of the Cybersecurity chain
Key Takeaways
Best Practices
Cloud Cybersecurity: Strategies for Managing Vendor RiskHealth Catalyst
As more organizations shift away from on-premise architectures toward the cloud or hybrid hosting models, critical cybersecurity concerns emerge. Organizations, especially health systems, should carefully examine the shared responsibility model in partnership with their cloud vendor.
Kevin Scharnhorst, Health Catalyst Chief Information Security Officer, shares perspectives on how your organization’s security program, through adherence to standards-based policy and procedures, can align with your cloud vendor on reduced organizational risk.
Top 10 Interview Questions for Risk Analyst.pptxinfosec train
A Risk Analyst is in charge of reviewing and examining an organization's investment portfolio to ensure that the risk is acceptable in light of the company's commercial and financial goals.
https://www.infosectrain.com/courses/crisc-certification-training/
CHAPTER 3 Security Policies and Regulations In this chapEstelaJeffery653
CHAPTER 3
Security Policies and Regulations
In this chapter you will
• Explore the different types of regulations associated with secure software
development
• Learn how security policies impact secure development practices
• Explore legal issues associated with intellectual property protection
• Examine the role of privacy and secure software
• Explore the standards associated with secure software development
• Examine security frameworks that impact secure development
• Learn the role of securing the acquisition lifecycle and its impact on secure
development
Regulations and Compliance
Regulations and compliance drive many activities in an enterprise. The primary
reason behind this is the simple fact that failure to comply with rules and
regulations can lead to direct, and in some cases substantial, financial penalties.
Compliance failures can carry additional costs, as in increased scrutiny, greater
regulation in the future, and bad publicity. Since software is a major driver of
many business processes, a CSSLP needs to understand the basis behind various
rules and regulations and how they affect the enterprise in the context of their
own development efforts. This enables decision making as part of the software
development process that is in concert with these issues and enables the
enterprise to remain compliant.
Much has been said about how compliance is not the same as security. In a
sense, this is true, for one can be compliant and still be insecure. When viewed
from a risk management point of view, security is an exercise in risk
management, and so are compliance and other hazards. Add it all together, and
you get an “all hazards” approach, which is popular in many industries, as senior
management is responsible for all hazards and the residual risk from all risk
sources.
Regulations can come from several sources, including industry and trade
groups and government agencies. The penalties for noncompliance can vary as
well, sometimes based on the severity of the violation and other times based on
political factors. The factors determining which systems are included in
regulation and the level of regulation also vary based on situational factors.
Typically, these factors and rules are published significantly in advance of
instantiation to allow firms time to plan enterprise controls and optimize risk
management options. Although not all firms will be affected by all sets of
regulations, it is also not uncommon for a firm to have multiple sets of
regulations across different aspects of an enterprise, even overlapping on some
elements. This can add to the difficulty of managing compliance, as different
regulations can have different levels of protection requirements.
Many development efforts may have multiple regulatory impacts, and
mapping the different requirements to the individual data flows that they each
affect is important. For instance, if an application invo ...
To better understand how organizations manage the planning and securing of their digital assets, McAfee, Inc. retained Evalueserve to conduct an independent assessment of how organizations manage their security policies and processes, and what threats are perceived to pose the greatest
risk to their business. This global study of Enterprise-class organizations highlights how IT decision makers view the challenges of securing information assets in a highly regulated and increasingly complex global business environment. It is also forward-looking, revealing companies’ IT security priorities around processes, practices and technology for 2012 and beyond.
8242015 Combating cyber risk in the supply chain Print Art.docxevonnehoggarth79783
8/24/2015 Combating cyber risk in the supply chain Print Article SC Magazine
http://www.scmagazine.com/combatingcyberriskinthesupplychain/printarticle/381050/ 1/2
Daryk Rowland, director of risk
management, Guidance Software,
Inc.
Daryk Rowland, director of risk management, Guidance Software, Inc.
November 11, 2014
Combating cyber risk in the supply chain
Share this article:
facebook
twitter
linkedin
google
Comments
Email
Print
Security threats within the supply chain have been a concern of purchasing,
information security and risk and compliance teams for many years. What's
new is the rapid increase in targeted attacks on a less welldefended area for
most corporations the confidential data now commonly shared with
supply chain vendors and partners.
In research released in 2013, the Information Security Forum (ISF) found
that, “of all the supply chain risks, information risk is the least well
managed,” and that, “forty percent of the datasecurity breaches experienced
by organizations arise from attacks on their suppliers.” The Target breach
began with a simple login to its corporate network—a login seen as normal
by its security systems because the user name and password were valid. The
problem, of course, was that these login credentials were stolen—yet they
were also authorized for access, so they went unchallenged by Target's
authentication system.
Consider the fact that the recent Dragonfly/Energetic Bear hack of U.S. and
European energy companies began with a spearphishing campaign against
senior employees in energy sector companies. Those senior employees took
the bait and enabled the hackers to compromise legitimate software used by
industrial control system (ICS) manufacturers, inserting malware into
software updates sent from the ICS manufacturers to their clients.
Everyone involved with vendor management — from legal and risk/compliance teams to information security and
purchasing specialists — should now develop a common, collaborative security strategy (or program) that includes
layering new protections onto processes and policies to defend against information risk in the supply chain. Adding the
following practices to your existing security controls can help you collaborate productively for a targeted approach to
supply chain cybersecurity.
Map locations of sensitive data: Collaborate across all relevant teams to determine which data—intellectual property,
employee records, financial information, credit card data — is considered sensitive by your organization. Security
teams should audit for all locations of that sensitive data on your network, as well as for the locations of copies of that
data that may be accessible to members of your supply chain.
Evaluate risk by vendor: Assess and rank vendors and partners with access to your network—or any who retain
copies of your data—according to their risk to information security. Two helpful templates for this are the annotated
ICT Supply Chain Risk Manageme.
Five steps to achieve success with application securityIBM Security
This white paper provides a general framework your organization can use to create or build upon an application security program. It includes guidelines that can be useful at different stages of your security program’s maturity. By addressing key considerations, providing clear and actionable items, and offering real-world examples, these five steps provide an adaptable strategy to help your organization get started and maintain an effective, ongoing application-security strategy.
crucet1crucet2crucet3crucet4crucet5crucet6crucet7crucet8crucet9crucet10crucet11crucet12
CHAPTER 3
Security Policies and Regulations
In this chapter you will
• Explore the different types of regulations associated with secure software
development
• Learn how security policies impact secure development practices
• Explore legal issues associated with intellectual property protection
• Examine the role of privacy and secure software
• Explore the standards associated with secure software development
• Examine security frameworks that impact secure development
• Learn the role of securing the acquisition lifecycle and its impact on secure
development
Regulations and Compliance
Regulations and compliance drive many activities in an enterprise. The primary
reason behind this is the simple fact that failure to comply with rules and
regulations can lead to direct, and in some cases substantial, financial penalties.
Compliance failures can carry additional costs, as in increased scrutiny, greater
regulation in the future, and bad publicity. Since software is a major driver of
many business processes, a CSSLP needs to understand the basis behind various
rules and regulations and how they affect the enterprise in the context of their
own development efforts. This enables decision making as part of the software
development process that is in concert with these issues and enables the
enterprise to remain compliant.
Much has been said about how compliance is not the same as security. In a
sense, this is true, for one can be compliant and still be insecure. When viewed
from a risk management point of view, security is an exercise in risk
management, and so are compliance and other hazards. Add it all together, and
you get an “all hazards” approach, which is popular in many industries, as senior
management is responsible for all hazards and the residual risk from all risk
sources.
Regulations can come from several sources, including industry and trade
groups and government agencies. The penalties for noncompliance can vary as
well, sometimes based on the severity of the violation and other times based on
political factors. The factors determining which systems are included in
regulation and the level of regulation also vary based on situational factors.
Typically, these factors and rules are published significantly in advance of
instantiation to allow firms time to plan enterprise controls and optimize risk
management options. Although not all firms will be affected by all sets of
regulations, it is also not uncommon for a firm to have multiple sets of
regulations across different aspects of an enterprise, even overlapping on some
elements. This can add to the difficulty of managing compliance, as different
regulations can have different levels of protection requirements.
Many development efforts may have multiple regulatory impacts, and
mapping the different requirements to the indi ...
Cyber-attacks are an alarming threat to all types of businesses & organizations.The risk of a cyber-attack is not just a risk to your company but also to your privacy.Hence, cybersecurity is crucial for every business. Cybersecurity protects critical data from cyber attackers. This includes sensitive data, governmental and industry information, personal information, personally identifiable information (PII), intellectual property, and protected health information (PHI). If you are looking for tools to fight against cyber threats, then Techwave’s tools & technologies with adequate controls will help your organization stay protected.
Cyber-attacks are an alarming threat to all types of businesses & organizations.The risk of a cyber-attack is not just a risk to your company but also to your privacy.Hence, cybersecurity is crucial for every business. Cybersecurity protects critical data from cyber attackers. This includes sensitive data, governmental and industry information, personal information, personally identifiable information (PII), intellectual property, and protected health information (PHI). If you are looking for tools to fight against cyber threats, then Techwave’s tools & technologies with adequate controls will help your organization stay protected.
This article examines cyber and information security as it relates to the legal industry and provides strategic considerations for law firms looking to deal with information security issues.
Mike Spaulding - Building an Application Security Programcentralohioissa
Application Security in many organizations is a simply a 'wish list' item, but with some staff and some training, AppSec can be a reality, even for a small organization. This talk will discuss the best practices, strategies and tactics, and resource planning to build an internal AppSec function - enterprise to 'mom & pop' operations will all benefit from this talk.
Dino Tsibouris & Mehmet Munur - Legal Perspective on Data Security for 2016centralohioissa
Key legal data security concerns for 2016; Privacy and security preparation; Vendor management; When and how to engage outside counsel & advisors; EU Privacy update; Sample enforcement actions.
Tre Smith - From Decision to Implementation: Who's On First?centralohioissa
This presentation will explore tactics to improve organizational control implementations that meet the spirit of organizational risk decisions. An approach that may help to improve the time it takes to see organizational policy reflected in everyday workplace practice and technologies. Starting with clarifying “Who’s On First?”
By 2014, medical facilities nationwide implemented Electronic Health Records (EHR) as mandated by congress. Today, most of these systems are still using shared kiosk Windows accounts. This talk explores the risks of shared accounts, and alternatives that can provide much greater security and accountability, while maintaining ease of access.
Robert Hurlbut - Threat Modeling for Secure Software Designcentralohioissa
Threat modeling is a way of thinking about what could go wrong and how to prevent it. Instinctively, we all think this way in regards to our own personal security and safety. When it comes to building software, some software shops either skip the important step of threat modeling in secure software design or, they have tried threat modeling before but haven't quite figured out how to connect the threat models to real world software development and its priorities. In this session, you will learn practical strategies in using threat modeling in secure software design and how to apply risk management in dealing with the threats.
Harry Regan - Disaster Recovery and Business Continuity - "It's never so bad ...centralohioissa
Disaster recovery, emergency response and business continuity plans are usually developed when no disaster exists. We think we’ve covered all contingencies. We think we’ve trained all the appropriate players. We’ve tested. We’ve re-tested. We think we’re ready to face whatever event there is looming out their with our name on it! The real world has a nasty habit of triggering disasters at the least opportune time, often featuring a twist that throws plans into disarray.
This presentation focuses on three real-world plans, each of which with a fatal flaw. We will discuss elements that should be in a plan beyond the normal guidance from the Disaster Recovery Institute (DRI) and a set of actions that should be included in planning and preparation.
Rafeeq Rehman - Breaking the Phishing Attack Chaincentralohioissa
Many security research reports show that phishing is significant contributing factor to data breaches. Verizon data breach investigations report (DBIR) shows that attackers used phishing as their entry point in two third of the security incidents, especially in cyber espionage category. Although the phenomenon of phishing is nothing new, the attackers are enhancing their techniques and using phishing more effectively.
The good news is that understanding the phishing attack chain helps in stopping these attacks, break the phishing chain, and avert a data breach. This session is to understand different phases of phishing attacks and developing a comprehensive strategy to manage risk associated with these attacks.
Michael Woolard - Gamify Awareness Training: Failure to engage is failure to ...centralohioissa
We call it security awareness training, but all we ever give our employees is regurgitated knowledge. Their passwords suck, public wifi is bad, and email is deceiving. Mix in some yearly reviews of policies and procedures and you have the perfect recipe for an employee who stopped listening hours ago. You don't truly learn something until you understand "why" and that comes when employees are engaged and motivated. This is my take on how to engage through gaming and why it works.
Ed McCabe - Putting the Intelligence back in Threat Intelligencecentralohioissa
What is Threat Intelligence? It's more than raw source feeds and technical information.
If you ask most vendors, they talk about their lists of "bad" IP addresses and domain names, which don't enable the business to make informed decisions on assessing risk and taking action; it lacks -- well, intelligence.
We'll cover what Threat Intelligence is, why analysis is an important factor and methods available to analyze raw data.
Ofer Maor - Security Automation in the SDLC - Real World Casescentralohioissa
How can we really automate secure coding? Agile, DevOps, Continuous Integration, Orchestration, Static, Dynamic - There's an endless feed of Buzzwords, but how can we turn this into a practice that really works? In this session we will review real world examples of building a successful automation process for delivery of secure software in fast paced development environments. The talk will focus on three different organizations at different maturity levels and how security automation processes were applied and adapted to fit their development lifecycle.
Jim Wojno: Incident Response - No Pain, No Gain!centralohioissa
Say incident response to 10 people and odds are you'll get 10 different opinions on how to do it right. When evaluating tools and procedures for enterprise Incident Response it's helpful to understand how to approach this in a way that will cause the adversary maximum pain. This talk will review the essential requirements for IR tools and procedures in a vendor / tool neutral approach. Find out the right questions to ask and the strategies to make sure you get the most out of your incident response team.
Jessica Hebenstreit - Don't Try This At Home! (Things Not To Do When Securing...centralohioissa
Securing an enterprise is never easy, especially if the organizations culture and orthodoxy does not accept change easily. Covering lessons learned from the perspective of an information security practitioner who has spent her career building security programs, we will look at the lessons learned on challenges and opportunities associated with implementing an information security program, addressing technical, security and business risks.
Carolyn Engstrom - IT Data Analytics: Why the Cobbler's Children Have No Shoescentralohioissa
This presentation is to provide IT departments who have not leveraged their own data analytics skills for increasing the efficiency and effectiveness of compliance efforts to implement very low-cost solutions while achieving high returns on investment. Focusing on understanding how audit performs testing should assist IT organizations in designing their own compliance testing. Multiple examples will be provided to demonstrate how unlocking the potential of small and/or unstructured data and focusing on data relationships will improve overall data integrity and provide quantifiable measures of operational effectiveness.
Sam Herath - Six Critical Criteria for Cloud Workload Securitycentralohioissa
Modern elastic cloud infrastructure is fundamentally breaking traditional security approaches. Public cloud has no natural perimeter and network segmentation leaving individual cloud servers exposed. In private cloud, malicious East-West traffic inside the network is a serious threat. As new workloads are added and retired dynamically, change control is difficult, and updating granular firewall rules and security policies becomes a risky, manual process. Join us and learn the 6 Critical Criteria to secure your public, private or hybrid cloud – on-demand, anywhere, at any scale.
Kevin Glavin - Continuous Integration, Continuous Delivery, and Deployment (C...centralohioissa
Continuous Integration, Continuous Delivery, and Continuous Deployment can include security! We will explore functional examples of CI/CD^2 toolchains using only open source software (OSS): What are the components? What activities do they support? What works well? What works... not so well? What is the cost of freely available OSS?
In this talk we will explore the activities that are involved with successful Continuous Integration, Continuous Delivery, and Continuous Deployment. We’ll do this by discussing how traditional software security activities like SAST, DAST, manual code reviews, and ethical hacking work together and independently to strengthen your program.
In April of 2015, Portswigger released Burp Collaborator, a tool focused on testing for out of band web app vulnerabilities. Almost a year later, it is still either largely unused, or not understood. This talk covers the basics of how Burp Collaborator works, the vulnerabilities it can help discover, how they can be exploited, and the requirements to set up a private Burp Collaborator server.
Kubernetes & AI - Beauty and the Beast !?! @KCD Istanbul 2024Tobias Schneck
As AI technology is pushing into IT I was wondering myself, as an “infrastructure container kubernetes guy”, how get this fancy AI technology get managed from an infrastructure operational view? Is it possible to apply our lovely cloud native principals as well? What benefit’s both technologies could bring to each other?
Let me take this questions and provide you a short journey through existing deployment models and use cases for AI software. On practical examples, we discuss what cloud/on-premise strategy we may need for applying it to our own infrastructure to get it to work from an enterprise perspective. I want to give an overview about infrastructure requirements and technologies, what could be beneficial or limiting your AI use cases in an enterprise environment. An interactive Demo will give you some insides, what approaches I got already working for real.
Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...UiPathCommunity
💥 Speed, accuracy, and scaling – discover the superpowers of GenAI in action with UiPath Document Understanding and Communications Mining™:
See how to accelerate model training and optimize model performance with active learning
Learn about the latest enhancements to out-of-the-box document processing – with little to no training required
Get an exclusive demo of the new family of UiPath LLMs – GenAI models specialized for processing different types of documents and messages
This is a hands-on session specifically designed for automation developers and AI enthusiasts seeking to enhance their knowledge in leveraging the latest intelligent document processing capabilities offered by UiPath.
Speakers:
👨🏫 Andras Palfi, Senior Product Manager, UiPath
👩🏫 Lenka Dulovicova, Product Program Manager, UiPath
Epistemic Interaction - tuning interfaces to provide information for AI supportAlan Dix
Paper presented at SYNERGY workshop at AVI 2024, Genoa, Italy. 3rd June 2024
https://alandix.com/academic/papers/synergy2024-epistemic/
As machine learning integrates deeper into human-computer interactions, the concept of epistemic interaction emerges, aiming to refine these interactions to enhance system adaptability. This approach encourages minor, intentional adjustments in user behaviour to enrich the data available for system learning. This paper introduces epistemic interaction within the context of human-system communication, illustrating how deliberate interaction design can improve system understanding and adaptation. Through concrete examples, we demonstrate the potential of epistemic interaction to significantly advance human-computer interaction by leveraging intuitive human communication strategies to inform system design and functionality, offering a novel pathway for enriching user-system engagements.
GraphRAG is All You need? LLM & Knowledge GraphGuy Korland
Guy Korland, CEO and Co-founder of FalkorDB, will review two articles on the integration of language models with knowledge graphs.
1. Unifying Large Language Models and Knowledge Graphs: A Roadmap.
https://arxiv.org/abs/2306.08302
2. Microsoft Research's GraphRAG paper and a review paper on various uses of knowledge graphs:
https://www.microsoft.com/en-us/research/blog/graphrag-unlocking-llm-discovery-on-narrative-private-data/
State of ICS and IoT Cyber Threat Landscape Report 2024 previewPrayukth K V
The IoT and OT threat landscape report has been prepared by the Threat Research Team at Sectrio using data from Sectrio, cyber threat intelligence farming facilities spread across over 85 cities around the world. In addition, Sectrio also runs AI-based advanced threat and payload engagement facilities that serve as sinks to attract and engage sophisticated threat actors, and newer malware including new variants and latent threats that are at an earlier stage of development.
The latest edition of the OT/ICS and IoT security Threat Landscape Report 2024 also covers:
State of global ICS asset and network exposure
Sectoral targets and attacks as well as the cost of ransom
Global APT activity, AI usage, actor and tactic profiles, and implications
Rise in volumes of AI-powered cyberattacks
Major cyber events in 2024
Malware and malicious payload trends
Cyberattack types and targets
Vulnerability exploit attempts on CVEs
Attacks on counties – USA
Expansion of bot farms – how, where, and why
In-depth analysis of the cyber threat landscape across North America, South America, Europe, APAC, and the Middle East
Why are attacks on smart factories rising?
Cyber risk predictions
Axis of attacks – Europe
Systemic attacks in the Middle East
Download the full report from here:
https://sectrio.com/resources/ot-threat-landscape-reports/sectrio-releases-ot-ics-and-iot-security-threat-landscape-report-2024/
Transcript: Selling digital books in 2024: Insights from industry leaders - T...BookNet Canada
The publishing industry has been selling digital audiobooks and ebooks for over a decade and has found its groove. What’s changed? What has stayed the same? Where do we go from here? Join a group of leading sales peers from across the industry for a conversation about the lessons learned since the popularization of digital books, best practices, digital book supply chain management, and more.
Link to video recording: https://bnctechforum.ca/sessions/selling-digital-books-in-2024-insights-from-industry-leaders/
Presented by BookNet Canada on May 28, 2024, with support from the Department of Canadian Heritage.
UiPath Test Automation using UiPath Test Suite series, part 3DianaGray10
Welcome to UiPath Test Automation using UiPath Test Suite series part 3. In this session, we will cover desktop automation along with UI automation.
Topics covered:
UI automation Introduction,
UI automation Sample
Desktop automation flow
Pradeep Chinnala, Senior Consultant Automation Developer @WonderBotz and UiPath MVP
Deepak Rai, Automation Practice Lead, Boundaryless Group and UiPath MVP
JMeter webinar - integration with InfluxDB and GrafanaRTTS
Watch this recorded webinar about real-time monitoring of application performance. See how to integrate Apache JMeter, the open-source leader in performance testing, with InfluxDB, the open-source time-series database, and Grafana, the open-source analytics and visualization application.
In this webinar, we will review the benefits of leveraging InfluxDB and Grafana when executing load tests and demonstrate how these tools are used to visualize performance metrics.
Length: 30 minutes
Session Overview
-------------------------------------------
During this webinar, we will cover the following topics while demonstrating the integrations of JMeter, InfluxDB and Grafana:
- What out-of-the-box solutions are available for real-time monitoring JMeter tests?
- What are the benefits of integrating InfluxDB and Grafana into the load testing stack?
- Which features are provided by Grafana?
- Demonstration of InfluxDB and Grafana using a practice web application
To view the webinar recording, go to:
https://www.rttsweb.com/jmeter-integration-webinar
Accelerate your Kubernetes clusters with Varnish CachingThijs Feryn
A presentation about the usage and availability of Varnish on Kubernetes. This talk explores the capabilities of Varnish caching and shows how to use the Varnish Helm chart to deploy it to Kubernetes.
This presentation was delivered at K8SUG Singapore. See https://feryn.eu/presentations/accelerate-your-kubernetes-clusters-with-varnish-caching-k8sug-singapore-28-2024 for more details.
UiPath Test Automation using UiPath Test Suite series, part 4DianaGray10
Welcome to UiPath Test Automation using UiPath Test Suite series part 4. In this session, we will cover Test Manager overview along with SAP heatmap.
The UiPath Test Manager overview with SAP heatmap webinar offers a concise yet comprehensive exploration of the role of a Test Manager within SAP environments, coupled with the utilization of heatmaps for effective testing strategies.
Participants will gain insights into the responsibilities, challenges, and best practices associated with test management in SAP projects. Additionally, the webinar delves into the significance of heatmaps as a visual aid for identifying testing priorities, areas of risk, and resource allocation within SAP landscapes. Through this session, attendees can expect to enhance their understanding of test management principles while learning practical approaches to optimize testing processes in SAP environments using heatmap visualization techniques
What will you get from this session?
1. Insights into SAP testing best practices
2. Heatmap utilization for testing
3. Optimization of testing processes
4. Demo
Topics covered:
Execution from the test manager
Orchestrator execution result
Defect reporting
SAP heatmap example with demo
Speaker:
Deepak Rai, Automation Practice Lead, Boundaryless Group and UiPath MVP
Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...Ramesh Iyer
In today's fast-changing business world, Companies that adapt and embrace new ideas often need help to keep up with the competition. However, fostering a culture of innovation takes much work. It takes vision, leadership and willingness to take risks in the right proportion. Sachin Dev Duggal, co-founder of Builder.ai, has perfected the art of this balance, creating a company culture where creativity and growth are nurtured at each stage.
Key Trends Shaping the Future of Infrastructure.pdfCheryl Hung
Keynote at DIGIT West Expo, Glasgow on 29 May 2024.
Cheryl Hung, ochery.com
Sr Director, Infrastructure Ecosystem, Arm.
The key trends across hardware, cloud and open-source; exploring how these areas are likely to mature and develop over the short and long-term, and then considering how organisations can position themselves to adapt and thrive.
Jason Harrell - Compliance and Security: Building a Cybersecurity Risk Management Program
1. Information Classification: Public
COMPLIANCE AND SECURITY:
BUILDING A CYBERSECURITY
RISK MANAGEMENT
PROGRAM
Central Ohio Infosec Summit - 2016
Jason Harrell
Corporate Senior Information Risk Officer (CSIRO)
Investment Management
BNY Mellon
March 30, 2016
2. Information Classification: Public
AUDIENCE QUESTIONS
• How many of you are Chief Information Security Officers or Chief Information Risk Officers
for your organization?
• How many of you have regularly scheduled meetings with your Chief Compliance Officers
on cybersecurity regulations?
• How many of you have regularly scheduled meetings with your Legal Counsel (internal
and/or external)?
• How many of you have regularly scheduled meeting with your Chief Operating Officer or
equivalent?
• How many of you subscribe to industry publications for the industry for which you work?
• How many of you brief your Board of Directors on cybersecurity risks for your organization?
2
3. Information Classification: Public
KEY TAKEAWAYS
• As a Chief Information Security Officer (CISO) and Chief Information Risk Officer (CIRO),
you will be required to understand and articulate the business impacts for cybersecurity risk
failures that resonates with your audience
• As executives, we will need to balance our compliance obligations for cybersecurity controls
with our business’ operational cybersecurity risks to prioritize our risk management efforts
(EXHAUSTIVE MEDIOCRITY)
• Cybersecurity controls must be embedded into the business processes to be effective (i.e.,
the business must be involved with the execution of cybersecurity controls)
• As an executive, you need to understand your risk posture/maturity relative to your peer
group
• How your organization responds to a cyber incident is equally as important as the
preventative measures taken to prevent an incident
3
4. Information Classification: Public
WHAT IS CYBERSECURITY RISK MANAGEMENT?
THE MANAGEMENT OF THE BUSINESS’ LEGAL, REGULATORY, OPERATIONAL,
AND CLIENT RISKS THAT MAY RESULT FROM ITS USE OF INFORMATION,
TECHNOLOGY, OR ASSOCIATED BUSINESS PROCESSES IN ORDER TO ALIGN
WITH THE BUSINESS’ RISK APPETITE.
CYBERSECURITY RISKS EXTEND BEYOND TECHNOLOGY. THE CONTROLS MUST
BE EMBEDDED INTO THE BUSINESS PROCESS TO BE EFFECTIVE!
4
5. Information Classification: Public
CYBERSECURITY RISK MANAGEMENT EXPECTATIONS
In general, regulatory authorities want to provide businesses with a principles based risk
approach to provide flexibility. Common guidance from the regulatory authorities (financial)
is that controls should be appropriate based on
The size and complexity of business operations
The makeup of the customers and counterparties serviced
The products and markets traded
Access to trading venues and other industry participants (i.e., market
interconnectedness)
Depending on your sector and regional presence, your business may have more
prescriptive requirements for cybersecurity controls (e.g., OCC Third Party Risk
Management)
The NIST Framework is recommended by different regulatory authorities but is not a silver
bullet. Every organization must understand the risks relative to its business operations and
the controls that are used to manage these risks
5
6. Information Classification: Public
BOARD AND EXECUTIVE MANAGEMENT QUESTIONS
• When do I know when I have spent enough on cybersecurity controls? (i.e., When have I
spent too much on cybersecurity?)
• How does our cybersecurity program stack up against our peers?
• Is our business in compliance with our regulatory obligations for managing cybersecurity
risks?
• What are the legal / client / fiduciary / regulatory impacts for cybersecurity failures AND do
we understand those impacts on business operations?
• Could an event like Target / Sony / Anthem / Home Depot happen at our organization?
• How do we know that we haven’t been hacked already?
• Are we prepared to manage a cybersecurity incident and, if not, how long will it take for us
to be appropriately prepared?
6
8. Information Classification: Public
LEGAL / REGULATORY OBLIGATIONS
Every regulatory agency has a rule requiring the adoption and implementation of written
policies and procedures reasonably designed to prevent violation of federal security laws
As the CISO or CIRO, do you know the compliance rules
relative to internal control requirements for your business?
Client Contracts and Addendums
As the CISO or CIRO, do you have visibility into
client agreements being entered into by your business areas?
Enforcement Actions
As the CISO or CIRO, do you understand how fines
and enforcement actions are being levied in your sector?
Regulatory Focus
There are a number of areas relative to cybersecurity risk management.
Do you know where there regulatory focus is on the required controls?
8
9. Information Classification: Public
OPERATIONAL IMPACTS
Numerous cybersecurity risks are realized due to (1) the lack of demarcation of the business and
technology responsibility for controls (2) inappropriate business processes to managing changing
risk environment
How does your business ensure that cybersecurity
controls extend and are embedded into associated business processes?
While many business have a technology incident response plan, they do not have an appropriate
business incident response plan or crisis communication plan.
Does your business have a crisis communication plan that includes engagement of external
counsel, regulatory reporting, law enforcement engagement, media relations, client
communications?
The lack of understanding of how the business operates causes may lead to arduous and/or
ineffective implementation of controls
How do you train the individuals in your organization to look outside of the technology
controls to those controls that are part of the business process?
The maturity of your peer’s cybersecurity risk management program will contribute to your
definition of reasonable and adequate controls.
Do you know where the cybersecurity risk management
program stacks up relative to your peer group?
9
10. Information Classification: Public
Communicating cybersecurity risks and associated impacts through
a common vernacular as the individuals you are trying to influence
will increase your success with gaining the support required for your
cybersecurity risk management program.
11
11. Information Classification: Public
IMPORTANT POINTS
Remember that you are competing for a limited pool of resources (e.g., money, personnel)
with other risk and control organizations as well as the business revenue-generating
programs
You can’t fix everything at once! As an executive, you need to define and defend those risk
gaps that you are addressing and demonstrate that you understand those areas that will
also need additional focus
Technology controls without business adoption will not decrease your business risks. These
controls must be embedded into the business operational processes
Understanding where your program is relative to your peer group will assist you with
gaining executive program support and changes in the risk management posture within
your industry
12
