Conference: IT Security and Risk Management Track
Information security continues to present a formidable challenge to organizations. The current economic climate has forced organizations to do more with less, while the global adversary community continues their relentless attacks in the hopes of compromising environments and stealing sensitive information. There is hope at the end of the tunnel though, in the form of new and exciting technologies, concepts, processes, and capabilities to assist organizations in facing their current challenges as well as understanding the new ones on the horizon. The IT Security and Risk Management track will focus on these challenges and the emerging concepts and leading industry practices, which are being utilized to meet them.
| Tuesday, April 27 | |
|---|---|
|
There is continued pressure in today’s corporate environment to do more with less, to reduce costs and to become more agile in order to meet rapidly changing business demands in a difficult global economy. Outsourcing IT Security services is often senior management’s response to these challenging times, so the question is not if it will happen, but rather when and how it will happen, if it hasn’t already. However, has anything really changed, though? What is the true impact of the decision to outsource IT Security services? When IT Security is outsourced, what are the hidden challenges? This session will be presented from the perspective an enterprise security manager who has first-hand knowledge of how outsourcing certain IT Security services can help meet the resource and costs pressures of an organization without compromising its IT Security posture. Speaker - Jay Leek, Global Manager, Corporate IT Security, Nokia Jay Leek, CISM, CISA, CISSP is currently a global manager of Corporate IT Security Services at Nokia where he has been directly involved in the negotiations and management of multi-million dollar IT security outsourcing relationships. Over the past 15 years, Jay has also worked as a product manager for information security vendors as well as a consultant to numerous telecommunications companies, government agencies and financial institutions assisting them with business development, strategic planning and architectural design required to meet their ICT and security objectives. He is also a frequent speaker on information security related topics at domestic and international conferences. | |
|
Data security via Web application and database controls is difficult and rapidly evolving. With the introduction of cloud computing new questions around sensitive data protection arise. Learn how data security can be achieved within cloud computing environments. See several use cases demonstrating effective, risk mitigating strategies. Speaker - Brian Contos, Chief Security Strategist, Imperva Mr. Contos has over fourteen-years of real-world security engineering and management expertise developed in some of the most sensitive and mission-critical environments in the world. As the chief security strategist for Imperva he advises government organizations and Global 2,000s on security strategy related to data-centric security while being an evangelist for the security space. He has written several security books including Enemy at the Water Cooler – Real Life Stories of Insider Threats as well as Physical and Logical Security Convergence which was co-authored with the former Deputy Director of the NSA – Bill Crowell. He has delivered countless speeches, webcasts, podcasts, and magazine articles for Forbes, the London Times, Computerworld, Sarbanes-Oxley Compliance Journal, SC Magazine and many others. Mr. Contos has held management and engineering positions at ArcSight, Riptech, Lucent Bell Labs, Compaq Computers and the Defense Information Systems Agency (DISA). Speaker - Chris Richter, VP Security Services, Savvis Chris is VP of security services at SAVVIS, a leading network, hosting and security services provider, where he is responsible for the managed-security line of business. He leads the effort behind implementing standardized control frameworks and risk management processes across SAVVIS’ dedicated and cloud-based services. Chris has assisted many enterprises in adapting their premise-based infrastructure risk management programs and security controls to outsourced virtualized and shared-infrastructure services. Chris is a member of ISSA and ISACA, and for more than 20 years has held various security and IT services management and consulting positions. | |
|
When companies conduct risk analyses, they often have to take into consideration the costs associated with protecting their organizations against malware (malicious software) and the potential likelihood that the end user is going to take an action that will increase their risk. To combat the complexity and sheer volume of malware creation and distribution, analyzing malware traffic, behavior and code continue to be the known methods for identifying and reducing the malware risk. Taking behavior analysis to the next level: the end user - provides a means of determining whether or not end users have been exploited and now pose a threat to themselves and, potentially, their organizations. The end user has, traditionally, been regarded as the “weakest link”. Learning and leveraging end user behavior has the potential to not only add to the security layering, but also increase the strength of the weakest link. Speaker - Jeff Deborsse, Senior Research Director, North America, ESET | |
| Wednesday, April 28 | |
|
Vulnerability identification and management has quickly become an essential capability within information security organizations. This capability has moved beyond basic identification of unpatched systems and open ports to include elements such as log management, security event monitoring, and other advances that help organizations understand where they have technological challenges. This session will focus on the concepts and technologies that are used in next generation technical vulnerability identification and management capabilities and how to more effectively use the information that is generated from them. Speaker - Todd Graham, Director, Risk and Compliance Technology, RSA, The Security Division of EMC Mr. Graham is a Senior Technologist in the Office of the CTO at RSA, The Security Division of EMC. In this role, Mr. Graham is responsible for driving RSA's corporate information security technology strategy with a focus on enterprise policy, governance, risk and compliance. Mr. Graham brings a unique blend of technical knowledge and an understanding of market requirements to RSA and previously was Chief Scientist at Tablus (acquired by RSA in 2007) where he played an integral role in the development of its data loss prevention suite. Mr. Graham joined Tablus through its acquisition of Indigo Security in 2005 where he was the Founder and Chief Technology Officer. Prior to founding Indigo, Mr. Graham was Founder and CEO of Digital-3, a digital audio device platform company. Mr. Graham was honored as the Michigan Young Entrepreneur of the Year in 2002 and named one of BusinessWeek's Best Young Technology Entrepreneurs in 2007. | |
|
To mitigate website security risks, organizations need to know what vulnerabilities bad guys are exploiting as well as issues that could possibly be taken advantage of. This session will combine comprehensive data with leading industry insight to address the “possible” and “probable” to help attendees make better website security decisions. Speaker - Jeremiah Grossman, Chief Technology Officer, WhiteHat Security, Inc. Jeremiah Grossman founded WhiteHat Security in August 2001. A world-renowned expert in Web security, Mr. Grossman is a founder of the Web Application Security Consortium (WASC), and was named to InfoWorld's Top 25 CTOs for 2007. Mr. Grossman is a frequent speaker at industry events including the Black Hat Briefings, RSA Conference, ISACA, CSI, InfoSec World, OWASP, ISSA, and Defcon as well as a number of large universities. He has authored dozens of articles and white papers, is credited with the discovery of many cutting-edge attack and defensive techniques and is a co-author of XSS Attacks: Cross Site Scripting Exploits and Defense. Mr. Grossman is frequently quoted in major media outlets such as USA Today, the Washington Post, The Financial Times, InformationWeek, InfoWorld, USA Today, PC World, Dark Reading, SC Magazine, CNET, CSO and NBC news. He frequently alerts the media community to the latest attacks and is not only able to offer in-depth commentary, but also provide his perspective of what’s to come. Mr. Grossman was named a “friend of Google” and is also an influential blogger (www.jeremiahgrossman.blogspot.com) who offers insight and encourages open dialogue regarding current research and vulnerability trend information. Prior to WhiteHat, Mr. Grossman was an information security officer at Yahoo! responsible for performing security reviews on the company's hundreds of websites. Before Yahoo!, Mr. Grossman worked for Amgen, Inc. Speaker - Alex Hutton, Research and Intelligence Principal, Verizon Business Hutton, research and intelligence principal with Verizon Business, has served as a consultant and auditor on topics related information risk and security for more than 15 years, working for Fortune 10 to SMB companies. He is a contributor to the Verizon Data Breach Investigations Report and writes regularly for the Verizon Security Blog. | |
|
While major wireless security concerns have long since left the front page, security is the one area in IT (and especially in mobile IT) where “done” is never achieved. New challenges and outright threats appear on essentially a weekly basis, and it’s important to keep up with the ever-changing security landscape. Our goal for this session is to look at the latest in mobile security threats, and how new solutions are enabling mobile users to go about their business without compromise to corporate assets. Moderator - Alex Wolfe, Editor In Chief, InformationWeek.com Alexander Wolfe is editor-in-chief of InformationWeek.com and author of its Wolfe's Den blog. In his two decades as a technology editor, he has written for Electronics, Byte.com, and IEEE Spectrum. He spent nine years at Electronic Engineering Times, where he broke the infamous 1994 story of Intel's Pentium bug. Alex was trained as an electrical engineer at Cooper Union. Speaker - Ryan Naraine, Senior Security Evangelist, Kasperksy Lab Ryan Naraine is a senior security evangelist at Kaspersky Lab, a global provider of anti-malware technologies. He is responsible for monitoring the regional malware landscape and conducting preliminary analysis of threats. He also assists with user education about malware threats and risk management. Ryan also writes extensively about security issues for Threatpost and ZDNet. Speaker - David Perry, Global Director of Education, Trend Micro, Inc. David Perry, Global Director of Education at Trend Micro, is one of the best respected and best known authorities in the world of computer viruses and malicious code. With over 36 years of experience in the technical education and support field, (the last twenty years entirely in Computer Security and Antivirus) David Perry brings to Trend Micro his own unique blend of technical understanding, communication style, and humor. While at Trend Micro, David Perry has been a featured speaker, panelist and published researcher at CES, COMDEX, Virus Bulletin, EICAR, RSA, Infosec London, FOSE, Infosec Moscow, AVAR, Dubtech in Dubai, and many other technical and trade conferences. He served in the national Y2K center and co chaired three meetings in the White House, concerning the protection of America’s critical digital infrastructure. David has appeared on numerous national and regional television news broadcasts, including the ABC Evening News with Peter Jennings, CBS's Good Morning America, and NPR All Things Considered. In addition, David is a monthly guest on Craig Crossman's nationally syndicated Computer America show, and has been quoted on the front page of major news publications such as the New York Times and USA Today. He is often looked to as a resource by news agencies such as Reuters and Associated Press. David appears on television radio and publications in every corner of the world.Prior to joining Trend Micro, David Perry began his career in the antivirus world as a technical support analyst with Peter Norton Computing (now SYMANTEC), where he helped tens of thousands of individuals and corporations to recover from virus and hostile code attacks. Later, he worked at McAfee Corporation, managing all online and Web based support, and became a well known community leader through his involvement with CompuServe and AOL. He went on to Cybermedia corporation, where he quickly moved up to a company spokesperson role where he appeared in more than 300 television and radio broadcasts in addition to a full schedule of user groups, industry conferences and other personal appearances. This is David’s thirteenth year with Trend Micro, Inc., and he continues to lead efforts to educate computer users in every walk of life. “Great system security begins in admitting that there is a problem”, says Perry, “but that is only the first step towards working in a safer, more secure world.” | |
| Thursday, April 29 | |
|
Social networking represents special challenges to security, to safety, and to privacy for individuals, companies, and government agencies. Attendees will come away with a historical perspective and better understanding of the scope, attractions and dangers of Social Networking in every form, plus special points of protection, of needed protection, and of user education that can secure a system in these treacherous waters. Speaker - David Perry, Global Director of Education, Trend Micro David Perry brings more than 25 years of technical education and support experience to his role as Global Director of Education at Trend Micro. He represents the company’s Internet content security awareness endeavors through speaking engagements working to educate network administrators, computer users, and the public at large about computer virus protection. Previously, Mr. Perry served as Product Marketing Manager at Trend Micro as well as Cybermedia Corporation, where he appeared in more than 170 television and radio broadcasts as a company spokesperson; and at McAfee Corporation, where he managed all online and Web-based support. Mr. Perry began his career as Technical Support Analyst at Peter Norton Computing (now Symantec). | |
|
Recent data breaches have taught us that we cannot solely rely on Intrusion Prevention Systems (IPS) alone to identify security challenges. Enterprises need to take a proactive approach to securing their network and applications by implementing a log management system that allows for real time access to data and reports so problems can be stopped before they start. This session will discuss the current industry leading methods and practices for log management. Speaker - Nick Nikols, Vice President of Product Management for Identity and Security, Novell
Nick Nikols is vice president of product management for identity and security at Novell. He has more than 15 years of experience in the software industry, architecting solutions and developing innovative products for directory services, identity management, provisioning, and directory/application integration. Before his current position at Novell, Nick spent three years as a senior analyst with the Identity and Privacy Strategies Service at Burton Group, where he authored many reports ranging from topics such as fine-grained authorization and identity services to identity management governance. Prior to his work at Burton Group, Nick was a software architect and engineering manager at Novell. | |
|
As data centers move become more virtualized, companies are still determining how to secure these environments. This session will examine the inner workings of the virtual data center, including where the security weak spots are and what can be done to ensure protection of critical data being stored there. Speaker - Paul Arceneaux, Vice President of Systems Management, Tipping Point Paul Arceneaux has more than 12 years of network and system management experience. Prior to TippingPoint, he was vice president of systems management for 3Com Corporation. He was responsible for the engineering and product management of the company’s management software. Previously, Arceneaux was vice president and general manager for Siemens network and service management software solutions. In addition, he has worked as a project engineer dealing with security, time management and network management. | |
