From ATT&CKcon 4.0
By Phil Davies, Distilled Security
"You have had a pen test, a red team or a threat intelligence report and drawn up a plan for remediation. You have been told you have 15 mins in front of the CFO in 48 hours! How do you show ,on one page, the connection between the techniques you are exposed and vulnerable to, the path of least resistance and the focused control changes required right now?
How will the CFO get the picture so the result is ""I get it, what do you need?""
Understanding ATT&CK as a practitioner is great with the current matrix but it is inaccessible to the CFO. But it doesn't have to be that way.
Phil will chart the journey to improved visualisation of ATT&CK techniques. He will show how the DNA of ATT&CK doesn’t just make ATT&CK accessible for all but that it can be beautiful!"
Aprio’s Business Technology Consulting Services “BTCS” offers strategic and tactical solutions that enable clients to achieve significant returns on their technology investments by improving existing systems and designing and implementing new solutions.
The rate at which technology is changing has caused a tremendous amount of Transformation trends across all industries. The same technological advancements that make Digital Transformation possible is also creating an ever-growing cyber-attack surface. With ever-connected devices and more people working remotely means more sophisticated ways for attackers to exploit systems and networks.
MYTHBUSTERS: Can You Secure Payments in the Cloud?Kurt Hagerman
Discussion of if and how you can secure payments in the cloud. Covers the issue, compliance considerations, regulatory changes and their impact, and provides a rationale for using a cloud to decouple your payments processes from your legacy infrastructure.
The Trailblazing Cybersecurity Leaders to Watch in 2024 (1) (1).pdfCIO Look Magazine
A distinguished executive in enterprise technology, cybersecurity, and services, Simon Chassar has an impressive track record spanning over two decades. Boasting international experience, Simon has been at the forefront of leading sales and business operations in the SaaS, software, hardware, and IT sectors.
Aprio’s Business Technology Consulting Services “BTCS” offers strategic and tactical solutions that enable clients to achieve significant returns on their technology investments by improving existing systems and designing and implementing new solutions.
The rate at which technology is changing has caused a tremendous amount of Transformation trends across all industries. The same technological advancements that make Digital Transformation possible is also creating an ever-growing cyber-attack surface. With ever-connected devices and more people working remotely means more sophisticated ways for attackers to exploit systems and networks.
MYTHBUSTERS: Can You Secure Payments in the Cloud?Kurt Hagerman
Discussion of if and how you can secure payments in the cloud. Covers the issue, compliance considerations, regulatory changes and their impact, and provides a rationale for using a cloud to decouple your payments processes from your legacy infrastructure.
The Trailblazing Cybersecurity Leaders to Watch in 2024 (1) (1).pdfCIO Look Magazine
A distinguished executive in enterprise technology, cybersecurity, and services, Simon Chassar has an impressive track record spanning over two decades. Boasting international experience, Simon has been at the forefront of leading sales and business operations in the SaaS, software, hardware, and IT sectors.
Matthew Rosenquist's 2015 Cybersecurity Predictions presentation to the ISACA Sacramento chapter on Feb 12th outlines the forthcoming challenges the industry is likely to face and how we can be better prepared for it. Peering into the future of cybersecurity provides valuable insights for security professionals. The industry is changing rapidly and attackers seem to always be one step ahead. Organizations must not only address what is ongoing, but also prepare for how cyber-threats will maneuver in the future.
Everything Blockchain builds platforms of trust for the modern enterprise and is on a mission to ensure every organization has access to the tools and platforms that enable them to manage, store, and protect data without the cost and complexity that holds them back today. The Company’s patented advances in engineering deliver the essential elements needed for real-world business use: speed, security, and efficiency. Everything Blockchain’s current business lines include: EB Advise, Build DB and EB Control.
How policymakers can fulfill promises of security for cloud services - SEP205...Amazon Web Services
This session is an opportunity for regulators and policymakers to share their knowledge about addressing cultural, organizational, policy, and regulatory hurdles with the security of cloud services for organizations in regulated industries (e.g., Healthcare, Financial Services, and Telecommunications). Presenters walk you through their experiences with adopting cloud services and the ways that they establish the environment in relation to policy to ensure that their specific criteria and requirements for security are addressed.
Barriers and Challenges to Opportunities and ROI
For successful cloud adoption, one needs to understand the risk[/inlinetweet] vs the reward and know how to mitigate those risks. Cloud security has been a major barrier and challenge for organizations moving into the cloud. Fortunately studies show this security concern is somewhat lessened this year. However, cloud security still remains at the forefront of boardroom discussions and security breaches in news headlines and the concerns at the top of cloud agendas.
In this webinar Dr. Mariana Carroll, Cloud Advisor, Trainer and Consultant, will walk us through the necessary assessment checklist for secure cloud adoption.
This webinar is recommended for experienced cloud trainers, consultants and practitioners.
Security Opening Keynote Address: Security Drives DIGITAL TRANSFORMATION in...CA Technologies
Without security, Digital Transformation cannot be successful. Opening organizational boundaries and providing crucial information to the right people at the right time requires the right controls and a new security model is needed. Identities are at the heart of this transformation. In this presentation, Steve Firestone (GM, CA Security) will show how security is an essential component to the CA strategy for Digital Transformation and how organizations can use the power of Identities to drive their business forward.
For more information, please visit http://cainc.to/Nv2VOe
Failing to align with industry regulations can expose financial institutions to risks and challenges. From reputational damage to legal penalties, the consequences can be profound. Moreover, the inability to retain crucial data can further compound these issues, hindering the ability to effectively respond to audits, investigations, and customer inquiries.
"If you think compliance is expensive - try non-compliance."
- Former U.S. Deputy Attorney General, Paul Mc Nulty.
Ensuring compliance with these guidelines and modernizing data management can mitigate several risks.:
1. Litigations
2. Loss of Customer Confidence/Reputational Damage
3. Data Loss and Theft
4. Operational Disruption & Inefficiencies
5. Slower or Costlier response to change
The agenda will include:
1. Decoding Regulatory Expectations
2. Data Lifecycle Management for Compliance
3. Enhancing the Digital Communication Channel
4. Real-Life Case Studies: From Leading Banks and Financial Businesses
5. Live Demonstration of the Vaultastic platform and
6. Interactive Q&A Session
Mithi’s co-founder and our speaker, Sunil Uttamchandani, is a seasoned technology leader with extensive experience in cloud computing, data management, and cybersecurity.
This conference will contextualise the evolution of IT, examining the changing role of technology within the business and the inherent implications for IT personnel. The event is geared for senior IT, business and finance leaders, providing a unique forum for knowledge exchange, discussion and high-level networking.
Core topics
• IT Evolution: the changing role of IT within the business
• Leadership: strategy, culture and collaboration
• XaaS: the shift from asset to service-based consumption
• ITAM: IT Asset Management and procurement
• Managed Services: vendor management and Service Level Agreements
• Governance: information security, GDPR and data protection
• DevOps: Agile process, faster delivery, greater collaboration
Most Intelligent Leaders in Data Science & Analytics, 2023.pdfCIO Look Magazine
This edition features a handful of The Most Intelligent Leaders in Data Science & Analytics that are leading us to a better future
Read More: https://ciolook.com/most-intelligent-leaders-in-data-science-analytics-2023-october2023/
Building & Running A Successful Identity ProgramDan Houser
Two hour presentation on steps to build a successful identity access management program, including stakeholder buyin, strategy, roadmaps, selling I&AM, foundational components of I&AM, etc.
CyberArk Cleveland Defend End Point Infection and Lateral MovementChad Bowerman
We had an amazing event in Cleveland. Customers have been asking for the slides for the event. This is the CyberArk Cleveland Defend End Point Infection and Lateral Movement slide deck. Thank you for all who attended.
Dealing With ATT&CK's Different Levels Of DetailMITRE ATT&CK
From ATT&CKcon 4.0
By Tareq AlKhatib, Lacework, Inc
"ATT&CK serves as the central language for CTI practitioners, Detection Engineers, Red Teamers, and more. Despite the benefit of having a central language, ATT&CK offers different levels of detail that might be useful for one team but not others. This paper points out some of these differences in the level of details available in ATT&CK, especially from the point of view of Detection Engineers, and focused on detection coverage.
In summary, while ATT&CK does not define the Procedure level of the TTP trinity, it is still useful to define the “Degrees of Freedom” an attacker has within a technique. Some techniques only have a limited number of possible Procedures, some techniques might have more, and others might be so open ended that they offer an unlimited number of possible procedures per technique. We examine this concept on both the Technique and Tactic levels and make the argument that techniques that have a high number of possible Procedures cannot be covered by Detection Engineers.
At the conference, we intend to release an ATT&CK Navigator layer to help Detection Engineers quickly filter out which Tactics and Techniques they need to focus on and which ones they simply cannot cover."
Automating testing by implementing ATT&CK using the Blackboard ArchitectureMITRE ATT&CK
From ATT&CKcon 4.0
By Jeremy Straub, NDSU Cybersecurity Institute
This presentation will briefly summarize work that we've done regarding implementing the ATT&CK framework as a rule-fact-action network within a Blackboard Architecture, allowing the ATT&CK framework to enable security testing automation. The presentation will start with a quick summary of the concept behind this and then present a few implementation examples.
More Related Content
Similar to The art of communicating ATT&CK to the CFO
Matthew Rosenquist's 2015 Cybersecurity Predictions presentation to the ISACA Sacramento chapter on Feb 12th outlines the forthcoming challenges the industry is likely to face and how we can be better prepared for it. Peering into the future of cybersecurity provides valuable insights for security professionals. The industry is changing rapidly and attackers seem to always be one step ahead. Organizations must not only address what is ongoing, but also prepare for how cyber-threats will maneuver in the future.
Everything Blockchain builds platforms of trust for the modern enterprise and is on a mission to ensure every organization has access to the tools and platforms that enable them to manage, store, and protect data without the cost and complexity that holds them back today. The Company’s patented advances in engineering deliver the essential elements needed for real-world business use: speed, security, and efficiency. Everything Blockchain’s current business lines include: EB Advise, Build DB and EB Control.
How policymakers can fulfill promises of security for cloud services - SEP205...Amazon Web Services
This session is an opportunity for regulators and policymakers to share their knowledge about addressing cultural, organizational, policy, and regulatory hurdles with the security of cloud services for organizations in regulated industries (e.g., Healthcare, Financial Services, and Telecommunications). Presenters walk you through their experiences with adopting cloud services and the ways that they establish the environment in relation to policy to ensure that their specific criteria and requirements for security are addressed.
Barriers and Challenges to Opportunities and ROI
For successful cloud adoption, one needs to understand the risk[/inlinetweet] vs the reward and know how to mitigate those risks. Cloud security has been a major barrier and challenge for organizations moving into the cloud. Fortunately studies show this security concern is somewhat lessened this year. However, cloud security still remains at the forefront of boardroom discussions and security breaches in news headlines and the concerns at the top of cloud agendas.
In this webinar Dr. Mariana Carroll, Cloud Advisor, Trainer and Consultant, will walk us through the necessary assessment checklist for secure cloud adoption.
This webinar is recommended for experienced cloud trainers, consultants and practitioners.
Security Opening Keynote Address: Security Drives DIGITAL TRANSFORMATION in...CA Technologies
Without security, Digital Transformation cannot be successful. Opening organizational boundaries and providing crucial information to the right people at the right time requires the right controls and a new security model is needed. Identities are at the heart of this transformation. In this presentation, Steve Firestone (GM, CA Security) will show how security is an essential component to the CA strategy for Digital Transformation and how organizations can use the power of Identities to drive their business forward.
For more information, please visit http://cainc.to/Nv2VOe
Failing to align with industry regulations can expose financial institutions to risks and challenges. From reputational damage to legal penalties, the consequences can be profound. Moreover, the inability to retain crucial data can further compound these issues, hindering the ability to effectively respond to audits, investigations, and customer inquiries.
"If you think compliance is expensive - try non-compliance."
- Former U.S. Deputy Attorney General, Paul Mc Nulty.
Ensuring compliance with these guidelines and modernizing data management can mitigate several risks.:
1. Litigations
2. Loss of Customer Confidence/Reputational Damage
3. Data Loss and Theft
4. Operational Disruption & Inefficiencies
5. Slower or Costlier response to change
The agenda will include:
1. Decoding Regulatory Expectations
2. Data Lifecycle Management for Compliance
3. Enhancing the Digital Communication Channel
4. Real-Life Case Studies: From Leading Banks and Financial Businesses
5. Live Demonstration of the Vaultastic platform and
6. Interactive Q&A Session
Mithi’s co-founder and our speaker, Sunil Uttamchandani, is a seasoned technology leader with extensive experience in cloud computing, data management, and cybersecurity.
This conference will contextualise the evolution of IT, examining the changing role of technology within the business and the inherent implications for IT personnel. The event is geared for senior IT, business and finance leaders, providing a unique forum for knowledge exchange, discussion and high-level networking.
Core topics
• IT Evolution: the changing role of IT within the business
• Leadership: strategy, culture and collaboration
• XaaS: the shift from asset to service-based consumption
• ITAM: IT Asset Management and procurement
• Managed Services: vendor management and Service Level Agreements
• Governance: information security, GDPR and data protection
• DevOps: Agile process, faster delivery, greater collaboration
Most Intelligent Leaders in Data Science & Analytics, 2023.pdfCIO Look Magazine
This edition features a handful of The Most Intelligent Leaders in Data Science & Analytics that are leading us to a better future
Read More: https://ciolook.com/most-intelligent-leaders-in-data-science-analytics-2023-october2023/
Building & Running A Successful Identity ProgramDan Houser
Two hour presentation on steps to build a successful identity access management program, including stakeholder buyin, strategy, roadmaps, selling I&AM, foundational components of I&AM, etc.
CyberArk Cleveland Defend End Point Infection and Lateral MovementChad Bowerman
We had an amazing event in Cleveland. Customers have been asking for the slides for the event. This is the CyberArk Cleveland Defend End Point Infection and Lateral Movement slide deck. Thank you for all who attended.
Similar to The art of communicating ATT&CK to the CFO (20)
Dealing With ATT&CK's Different Levels Of DetailMITRE ATT&CK
From ATT&CKcon 4.0
By Tareq AlKhatib, Lacework, Inc
"ATT&CK serves as the central language for CTI practitioners, Detection Engineers, Red Teamers, and more. Despite the benefit of having a central language, ATT&CK offers different levels of detail that might be useful for one team but not others. This paper points out some of these differences in the level of details available in ATT&CK, especially from the point of view of Detection Engineers, and focused on detection coverage.
In summary, while ATT&CK does not define the Procedure level of the TTP trinity, it is still useful to define the “Degrees of Freedom” an attacker has within a technique. Some techniques only have a limited number of possible Procedures, some techniques might have more, and others might be so open ended that they offer an unlimited number of possible procedures per technique. We examine this concept on both the Technique and Tactic levels and make the argument that techniques that have a high number of possible Procedures cannot be covered by Detection Engineers.
At the conference, we intend to release an ATT&CK Navigator layer to help Detection Engineers quickly filter out which Tactics and Techniques they need to focus on and which ones they simply cannot cover."
Automating testing by implementing ATT&CK using the Blackboard ArchitectureMITRE ATT&CK
From ATT&CKcon 4.0
By Jeremy Straub, NDSU Cybersecurity Institute
This presentation will briefly summarize work that we've done regarding implementing the ATT&CK framework as a rule-fact-action network within a Blackboard Architecture, allowing the ATT&CK framework to enable security testing automation. The presentation will start with a quick summary of the concept behind this and then present a few implementation examples.
I can haz cake: Benefits of working with MITRE on ATT&CKMITRE ATT&CK
From ATT&CKcon 4.0
By Tim Wadhwa-Brown, Cisco
The purpose of this session will be to look at how the linux-malware repo came to take shape and how we've used it to inform our view on adversarial behaviour over the last couple of years. Since the original reason for staring this project was to look at Linux coverage in ATT&CK, we'll play back some of the interesting points and reflect on how they've affected ATT&CK itself.
CISA usage of ATT&CK in Cybersecurity AdvisoriesMITRE ATT&CK
From ATT&CKcon 4.0
By James Stanley, CISA
"CISA's Adoption of the MITRE ATT&CK Framework
Over the past several years, CISA has worked to incorporate ATT&CK whenever applicable into our Cybersecurity Advisories and other cyber guidance. It has become the universal language for discussing how the adversary operates, and we leverage it for our stakeholders to respond to urgent events in real time, as well as detailed reports on subjects like our Red Team activities to give network defenders proactive guidance on how to harden their networks."
ATT&CK’s Adoption in CTI: A Great Success (with Room to Grow!)MITRE ATT&CK
From ATT&CKcon 4.0
By Scott Small, Tidal Cyber
This metrics- and meme-based lightning session spotlights the success story that is the CTI industry’s impressive (and expanding) adoption of ATT&CK in their products. Using nearly 6 years’ worth of ATT&CK-mapped, public threat reports collected from government, vendor, & independent sources, we’ll show how the rate (and detail) of mapping has increased considerably, while showcasing (anonymized) examples of high-quality end-products, with the aim of inspiring further ATT&CK adoption in this important corner of the field.
Evaluating and Enhancing Security Maturity through MITRE ATT&CK MappingMITRE ATT&CK
From ATT&CKcon 4.0
By Pranusha Somareddy, Lark Health
"By aligning security controls with specific adversary techniques and tactics, organizations can gain a comprehensive understanding of their defensive capabilities. This mapping exercise serves as a vital step in identifying potential gaps and weaknesses within the security architecture. The evaluation of security maturity using the MITRE ATT&CK framework provides valuable insights into the effectiveness of existing controls, shedding light on areas that require improvement or further attention.
In this presentation, we will delve into practical strategies and real-world examples that showcase how organizations can successfully leverage the MITRE ATT&CK framework to enhance their security maturity. We will also explore key topics such as:
(i)Customizing security training and awareness programs based on roles and responsibilities
(ii)Conducting thorough assessments of incident response capabilities through the framework
(iii)Integrating threat intelligence derived from ATT&CK to continuously improve the security posture"
MITRE ATT&CK based Threat Analysis for Electronic Flight BagMITRE ATT&CK
From ATT&CKcon 4.0
By Ozan Olali, IBM Security
The Electronic Flight Bag (EFB) has become an indispensable tool in modern aviation, providing pilots with digital resources and critical flight information. However, the increased reliance on EFB systems running on operating systems, introduces various security challenges. In this session, a technical assessment approach with MITRE ATT&CK framework to perform a comprehensive threat analysis of an EFB solution, will be presented. The potential attack vectors and relation with the risks for business/ flight operations will be demonstrated.
Tidying up your Nest: Validating ATT&CK Technique Coverage using EDR TelemetryMITRE ATT&CK
From ATT&CKcon 4.0
By Adam Ostrich and Jesse Brown, Red Canary
"Endpoint Detection & Response (EDR) telemetry offers defenders a powerful tool for catching threats. However, understanding how to validate ATT&CK technique coverage using EDR telemetry can be a challenge. As Detection Validation Engineers at a Managed Detection & Response (MDR) provider that ingests nearly a petabyte of endpoint telemetry every day, we’re in the unique and necessary position to analyze this telemetry at scale and validate its efficacy against common adversary tradecraft.
After providing a brief introduction to EDR telemetry, we’ll discuss how to break ATT&CK techniques down to individual data components, perform functional tests, analyze the ways that specific actions translate to telemetry records, and compare this analysis across different EDR sensors. We’ll discuss the tooling we’ve built to assist us in running these tests and analyzing the resulting telemetry, and we’ll explain how security teams can improve their own functional testing efforts by creating an automated validation workflow. Finally, we’ll describe how this approach has enabled us to more effectively understand and use EDR telemetry, highlighting where this telemetry excels and fails at detecting ATT&CK techniques."
Exploring the Labyrinth: Deep dive into the Lazarus Group's foray into macOSMITRE ATT&CK
From ATT&CKcon 4.0
By Marina Liang
"LABYRINTH CHOLLIMA is a prolific Democratic People's Republic of Korea (DPRK) nexus adversary focused on cyber espionage. They have been recently observed targeting FinTech (financial technology) companies in cryptocurrency revenue generation efforts. LABYRINTH CHOLLIMA has been associated with many high profile attacks, including the Sony Pictures Entertainment (SPE) breach, the WannaCry 2.0 global surge, and most recently, the 3CX supply chain compromise. Increasingly versed in cross-platform intrusions, LABYRINTH CHOLLIMA has been observed targeting macOS operating systems, and evolving their tactics, techniques, and tooling to keep in lockstep with the evolving security landscape.
This talk will deep dive into the interactive macOS intrusions Crowdstrike has attributed to LABYRINTH CHOLLIMA. We will delve into the adversary's macOS tradecraft, techniques to circumvent existing OS protections, and social engineering tactics, while showcasing how their mechanisms and tooling map to the MITRE ATT&CK kill chain, featuring some newly proposed MITRE techniques related to the Transparency, Consent, and Control (TCC) database."
Using ATT&CK to created wicked actors in real dataMITRE ATT&CK
From ATT&CKcon 4.0
By Simeon Kakpovi and Greg Schloemer, KC7 Foundation
"KC7 uses an experiential learning pedagogy to teach cybersecurity analysis to students of all levels, from elementary school all the way to industry professionals. In the KC7 experience, students analyze realistic cybersecurity data and answer a series of CTF-style questions that guide them through an investigative journey.
In order to generate authentic intrusion data, we create a fictional company that is attacked by cyber threat actors. The attributes and behaviors of these actors are defined via yaml configurations that are modeled based on MITRE ATT&CK categories and techniques. For example, we can granularly define what techniques an attacker uses for initial access or lateral movement, and how the actor explicitly uses those techniques.
Students that effectively analyze KC7 intrusion data can map the observed activity to the various stages of the MITRE ATTA&CK framework. Organizing actor definitions around the ATTA&CK framework allows KC7 to create a rich set of intrusion data in various permutations - and ensure that students are exposed to a diverse array of scenarios. A pleasant byproduct of this methodology is that students of MITRE ATT&CK can now study techniques contextually in data rather than just reading about them in reports."
Detection as Code, Automation, and Testing: The Key to Unlocking the Power of...MITRE ATT&CK
From ATT&CKcon 4.0
By Olaf Harton, FalconForce
"Modern security teams have been engineering solid detections for a while now. All this great output also needs to be managed well.
* How can we make sure that the detections we have spent a lot of time developing are deployed and are running in production in the same way as they were designed?
* How can we assure our detection and prevention controls are still working and are detecting the attacks they have been designed to cover?
We will show how we have built a robust and flexible development and deployment process using cloud technnologies. This process allows us to quickly and easily implement new detection controls, test them across multiple environments, and deploy them in a controlled and consistent manner.
We will discuss how security teams can reap the benefits of using detection-as-code, and how this can help achieving a single source of truth for their detection logic. Adopting this approach enables teams to use automation and unit testing to manage and validate their detection controls across multiple environments and ensure proper documentation. By adopting a detection-as-code approach, teams can gain the confidence that comes from knowing that their detections and mitigations work as intended."
Navigating the Attention Economy – Using MITRE ATT&CK to Communicate to Stake...MITRE ATT&CK
From ATT&CKcon 4.0
By Alexandrea Berninger, Accenture
We live in a world where attention is scarce. And yet we need to communicate complex information effectively to a variety of audiences. This talk will discuss how to cut through the noise of information overload by using MITRE ATT&CK to reach your audience. It will use lessons I have learned from videography, combined with Cyber Threat Intelligence (CTI) to weave a story around how to think about communicating to your audience when gaining their focus is becoming increasingly difficult. Using current research into focus and attention spans, combined with trends in how people like to obtain information, this talk will recommend paths to building compelling stories with MITRE ATT&CK so that stakeholders can immediately gain value from threat intelligence reports without having to read a full long-form report.
Driving Intelligence with MITRE ATT&CK: Leveraging Limited Resources to Build...MITRE ATT&CK
From ATT&CKcon 4.0
By Scott Roberts, Interpres Security
"Building threat intelligence is challenging, even under the most ideal circumstances. But what if you are even more limited in your resources? You are part of a small (but skilled) team, with high expectations, and people are relying on you to make business-critical decisions…all the time! What do you do in that situation? Turn a Toyota Tercel into a tank, of course.
The Interpres Security threat intelligence team found itself in that exact situation. Wanting to leverage the MITRE ATT&CK catalog in creating a comprehensive and timely threat intelligence repository, the Interpres team built a series of tools, processes, and paradigms that we call Intelligence Engineering. In this talk, we’ll examine how we combined ATT&CK, STIX2, the Vertex Project’s open-source intelligence platform, Synapse, and custom code to deliver meaningful, rapid, verifiable intelligence to our customers. We’ll share lessons learned on automation, how to run multiple ATT&CK libraries side-by-side, and making programmatic intelligence delivery scalable and effective – just like building a tank out of an imported sedan."
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...James Anderson
Effective Application Security in Software Delivery lifecycle using Deployment Firewall and DBOM
The modern software delivery process (or the CI/CD process) includes many tools, distributed teams, open-source code, and cloud platforms. Constant focus on speed to release software to market, along with the traditional slow and manual security checks has caused gaps in continuous security as an important piece in the software supply chain. Today organizations feel more susceptible to external and internal cyber threats due to the vast attack surface in their applications supply chain and the lack of end-to-end governance and risk management.
The software team must secure its software delivery process to avoid vulnerability and security breaches. This needs to be achieved with existing tool chains and without extensive rework of the delivery processes. This talk will present strategies and techniques for providing visibility into the true risk of the existing vulnerabilities, preventing the introduction of security issues in the software, resolving vulnerabilities in production environments quickly, and capturing the deployment bill of materials (DBOM).
Speakers:
Bob Boule
Robert Boule is a technology enthusiast with PASSION for technology and making things work along with a knack for helping others understand how things work. He comes with around 20 years of solution engineering experience in application security, software continuous delivery, and SaaS platforms. He is known for his dynamic presentations in CI/CD and application security integrated in software delivery lifecycle.
Gopinath Rebala
Gopinath Rebala is the CTO of OpsMx, where he has overall responsibility for the machine learning and data processing architectures for Secure Software Delivery. Gopi also has a strong connection with our customers, leading design and architecture for strategic implementations. Gopi is a frequent speaker and well-known leader in continuous delivery and integrating security into software delivery.
Connector Corner: Automate dynamic content and events by pushing a buttonDianaGray10
Here is something new! In our next Connector Corner webinar, we will demonstrate how you can use a single workflow to:
Create a campaign using Mailchimp with merge tags/fields
Send an interactive Slack channel message (using buttons)
Have the message received by managers and peers along with a test email for review
But there’s more:
In a second workflow supporting the same use case, you’ll see:
Your campaign sent to target colleagues for approval
If the “Approve” button is clicked, a Jira/Zendesk ticket is created for the marketing design team
But—if the “Reject” button is pushed, colleagues will be alerted via Slack message
Join us to learn more about this new, human-in-the-loop capability, brought to you by Integration Service connectors.
And...
Speakers:
Akshay Agnihotri, Product Manager
Charlie Greenberg, Host
PHP Frameworks: I want to break free (IPC Berlin 2024)Ralf Eggert
In this presentation, we examine the challenges and limitations of relying too heavily on PHP frameworks in web development. We discuss the history of PHP and its frameworks to understand how this dependence has evolved. The focus will be on providing concrete tips and strategies to reduce reliance on these frameworks, based on real-world examples and practical considerations. The goal is to equip developers with the skills and knowledge to create more flexible and future-proof web applications. We'll explore the importance of maintaining autonomy in a rapidly changing tech landscape and how to make informed decisions in PHP development.
This talk is aimed at encouraging a more independent approach to using PHP frameworks, moving towards a more flexible and future-proof approach to PHP development.
Builder.ai Founder Sachin Dev Duggal's Strategic Approach to Create an Innova...Ramesh Iyer
In today's fast-changing business world, Companies that adapt and embrace new ideas often need help to keep up with the competition. However, fostering a culture of innovation takes much work. It takes vision, leadership and willingness to take risks in the right proportion. Sachin Dev Duggal, co-founder of Builder.ai, has perfected the art of this balance, creating a company culture where creativity and growth are nurtured at each stage.
DevOps and Testing slides at DASA ConnectKari Kakkonen
My and Rik Marselis slides at 30.5.2024 DASA Connect conference. We discuss about what is testing, then what is agile testing and finally what is Testing in DevOps. Finally we had lovely workshop with the participants trying to find out different ways to think about quality and testing in different parts of the DevOps infinity loop.
UiPath Test Automation using UiPath Test Suite series, part 4DianaGray10
Welcome to UiPath Test Automation using UiPath Test Suite series part 4. In this session, we will cover Test Manager overview along with SAP heatmap.
The UiPath Test Manager overview with SAP heatmap webinar offers a concise yet comprehensive exploration of the role of a Test Manager within SAP environments, coupled with the utilization of heatmaps for effective testing strategies.
Participants will gain insights into the responsibilities, challenges, and best practices associated with test management in SAP projects. Additionally, the webinar delves into the significance of heatmaps as a visual aid for identifying testing priorities, areas of risk, and resource allocation within SAP landscapes. Through this session, attendees can expect to enhance their understanding of test management principles while learning practical approaches to optimize testing processes in SAP environments using heatmap visualization techniques
What will you get from this session?
1. Insights into SAP testing best practices
2. Heatmap utilization for testing
3. Optimization of testing processes
4. Demo
Topics covered:
Execution from the test manager
Orchestrator execution result
Defect reporting
SAP heatmap example with demo
Speaker:
Deepak Rai, Automation Practice Lead, Boundaryless Group and UiPath MVP
"Impact of front-end architecture on development cost", Viktor TurskyiFwdays
I have heard many times that architecture is not important for the front-end. Also, many times I have seen how developers implement features on the front-end just following the standard rules for a framework and think that this is enough to successfully launch the project, and then the project fails. How to prevent this and what approach to choose? I have launched dozens of complex projects and during the talk we will analyze which approaches have worked for me and which have not.
The Art of the Pitch: WordPress Relationships and SalesLaura Byrne
Clients don’t know what they don’t know. What web solutions are right for them? How does WordPress come into the picture? How do you make sure you understand scope and timeline? What do you do if sometime changes?
All these questions and more will be explored as we talk about matching clients’ needs with what your agency offers without pulling teeth or pulling your hair out. Practical tips, and strategies for successful relationship building that leads to closing the deal.
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...Jeffrey Haguewood
Sidekick Solutions uses Bonterra Impact Management (fka Social Solutions Apricot) and automation solutions to integrate data for business workflows.
We believe integration and automation are essential to user experience and the promise of efficient work through technology. Automation is the critical ingredient to realizing that full vision. We develop integration products and services for Bonterra Case Management software to support the deployment of automations for a variety of use cases.
This video focuses on the notifications, alerts, and approval requests using Slack for Bonterra Impact Management. The solutions covered in this webinar can also be deployed for Microsoft Teams.
Interested in deploying notification automations for Bonterra Impact Management? Contact us at sales@sidekicksolutionsllc.com to discuss next steps.
Accelerate your Kubernetes clusters with Varnish CachingThijs Feryn
A presentation about the usage and availability of Varnish on Kubernetes. This talk explores the capabilities of Varnish caching and shows how to use the Varnish Helm chart to deploy it to Kubernetes.
This presentation was delivered at K8SUG Singapore. See https://feryn.eu/presentations/accelerate-your-kubernetes-clusters-with-varnish-caching-k8sug-singapore-28-2024 for more details.
Key Trends Shaping the Future of Infrastructure.pdfCheryl Hung
Keynote at DIGIT West Expo, Glasgow on 29 May 2024.
Cheryl Hung, ochery.com
Sr Director, Infrastructure Ecosystem, Arm.
The key trends across hardware, cloud and open-source; exploring how these areas are likely to mature and develop over the short and long-term, and then considering how organisations can position themselves to adapt and thrive.
Smart TV Buyer Insights Survey 2024 by 91mobiles.pdf91mobiles
91mobiles recently conducted a Smart TV Buyer Insights Survey in which we asked over 3,000 respondents about the TV they own, aspects they look at on a new TV, and their TV buying preferences.
1. MITRE ATT&CK CON 4.0
THE ART OF COMMUNICATING
ATT&CK TO THE CFO
PHIL DAVIES
OCTOBER 2023
2. BRIEF INTRODUCTION
• More than 25 years in IT, and 18 years in
security
• Fascinated by data visualisation
• Leader and contributor to performing
security architecture teams
Telecoms, Finance, Retail, Manufacturing,
Insurance, Healthcare, Law and Banking
Based in Hampshire in the UK and thrilled to be here!
3. CONTEXT
• MITRE ATT&CK is
specialized and deep
• How do we elevate
this to CFO level?
• How do we focus on
investment benefits?
• Can we make it
beautiful?
4. HOW WE MANAGE
TODAY
SO MUCH
INFORMATION
IT IS EXCLUSIVE
MITRE PROJECTS
LOOK TO IMPROVE
VISUALIZATION
I MIGHT HAVE THE
ANSWER
6. A BEAUTIFUL WAY TO SHOW ATT&CK PATHS
Initial Access Execution Persistence
Privilege
Escalation
Defence
Evasion
Credential
Access
Discovery
Lateral
Movement
Collection
Command &
Control
Exfiltration Impact
7. LAZARUS GROUP
ATT&CK TECHNIQUES
Initial Access Execution Persistence
Privilege
Escalation
Defence
Evasion
Credential
Access
Discovery
Lateral
Movement
Collection
Command &
Control
Exfiltration Impact
