Join IANS at the IANS San Francisco Information Security Forum

DEBRA FARBER, WISP Leadership & IANS Faculty Member is a trainer

AGENDA

THEME 1: CONFIGURATION & DATA PROTECTION

Theme 1 Sessions

The Security of Things: Billions of Reasons IoT Matters to you
Just when you get a grip on cloud and mobility, along comes the Internet of Things. IoT is more than just connected thermostats and Apple Watches; it’s expanding the security team’s jurisdiction to include HVAC and building controls, industrial-automation infrastructure and a growing list of products designed to integrate smart devices with legacy systems. In this session, we’ll discuss policies and practices to protect sensitive corporate assets and data from "things," both sanctioned and rogue

Patch Tuesday's Gone: Now What? 
For the past 12 years, Microsoft taught us that the second Tuesday of every month was patch day. But with Redmond moving to an ad-hoc update cycle, security teams need a new way to plan and perform testing, patch rollouts, and assessment of implementation and remediation timeframes. For this session, come prepared to explore and discuss ways to rethink, adapt and improve IT patching programs in the absence of planned monthly releases.

No Pain, Cloud Gain: Quick Steps for Success
Cloud may be ubiquitous in the enterprise, but that doesn’t mean IT security professionals have fully mastered all the ways to make cloud services resilient, reliable and safe. Join us to talk about lessons learned from experiences with cloud architecture, design and vendor products. We’ll share quick steps for improving your cloud security posture through better policy implementation, network security architecture, encryption and identity management.

Conducting A Well-Orchestrated Cloud Deployment
Large-scale cloud deployments are a symphony of policies and processes, tools and timelines. Taken together, they can make beautiful music… or create a discordant mess. The difference comes down to the conductor. In this session, we’ll look at common obstacles to cloud initiatives and offer proactive advice for choosing tools, improving visibility, setting policies and managing elements such as authentication, encryption and key management.

The Evolution of Mobility: A Strategy Session
For good or ill, the BYOD wave engulfed most organizations, leaving lingering questions over the best ways to manage device ownership, applications and data access. With mobile device management platforms firmly in place, where do we go from here? In this session, we’ll focus on next-gen mobile challenges and share insights on how to incorporate more apps, wearables and even Internet of Things components into your evolving mobile security strategy.

Network Security Reloaded
Let’s face it: Current security practices just aren't working. Patching – and playing whack-a-mole with malware – is an endless, grinding failure. Join us as we introduce a completely new model for building secured networks from the ground up based on a real-world example from a large media company. We’ll explain the principle of interlocking and overlapping controls, and walk through each component in a new network architecture. Come see how the pieces and the processes reinforce each other to result in a superior security system. .

Silver Linings: A Playbook for Cloud Best Practices
With most organizations adopting the cloud in some fashion, security teams now face the challenge – and opportunity – to build security into cloud-enabled workloads. In this session, we’ll discuss how peers are leveraging early-stage cloud initiatives to eliminate traditional choke points. Through their experiences and lessons learned, you’ll gain practical steps for implementing new processes, tools and methodologies that help you gain more visibility into and control of your cloud assets.

THEME 2: ANALYSIS, DETECTION & DEFENSE

Theme 2 Sessions

Tying up Loose Endpoints: New and Updated Ways to Secure Devices
Endpoint protection may be the least exciting problem in IT security, but it's also one of the most challenging. In this session, we'll take a high-level look at new techniques – and clever reboots of old strategies – for securing endpoints. We’ll discuss tried-and-true efforts such as logging and monitoring, segmentation, configuration management and other approaches that prove malware does not need to be a fact of life.

Battling Insider Threats Through Privileged Access Management
Insider attacks are statistically less likely than external intrusions, but when they occur, attacks by privileged insiders can be exponentially more disruptive and costly. With privileged-user access management now a top agenda item from the boardroom to the CISO, security pros must address the critical problem of privileged users deeply enmeshed in core technologies and processes. In this session, we’ll focus on practical techniques security teams can use to balance the needs of high-level users with the desire to gird systems against insider threats.

No Quarter: The Ruthless Pursuit of Advanced Malware
The malware landscape continues to morph and transform, and we must evolve with it. In this session, we’ll examine the latest in malware detection and eradication tools, trends and techniques. Come prepared to discuss what works – and what doesn’t – when it comes to efforts to protect systems against next-gen malware threats.

Threat Intelligence: 10 Tips to Turbocharge Feeds
Myriad security vendors offer threat intelligence services they claim will keep your business ahead of emerging threats. But how do you make sense of all the data they deliver, and how do you know which provider is right for your business? In this session, we'll examine the threat intelligence landscape and review the 10 questions security teams must answer before selecting an intelligence source. Using case studies, we'll discuss how you can get the threat intelligence you need without breaking the bank.

THEME 3: SECURITY AWARENESS AND TRAINING 

Theme 3 Sessions

Vendor Ranking And Evaluation: An Interactive Workshop
Evaluating and managing third-party relationships is a difficult but vital part of enterprise IT security operations. If you’re feeling cut off from the decision-making process and frustrated by a lack of influence over vendor and partner access, this session is for you. In this interactive workshop, we’ll explore the best ways to leverage technical and procedural solutions such as vendor assessments, remote access controls and user account management. We’ll also share real-world scenarios you can use to make immediate improvements to your vendor due-diligence efforts.

THEME 4: INCIDENT RESPONSE & RECOVERY

Theme 4 Sessions

Cover your Assets: A Cyber-Insurance Primer
Insurance is a fact of life. We buy it to protect our families, homes, even our health. Now, organizations are looking to cyber-liability insurance to cover losses stemming from hacks, breaches and other data disasters. In this session, you’ll learn the basics of cyber-insurance, including best practices for finding an insurer, evaluating policies, negotiating coverage, reporting losses and managing providers.

The Hands-On Incident Response Experience
"A forensics program is only as good as its people, processes and tools. How do you craft a forensics program that is fast and robust enough to help your organization learn and improve from each security incident? In this interactive session, you’ll get hands-on instruction in the development and organization of tabletop incident response (IR) exercises. We’ll discuss real-world IR scenarios and focus on creating effective IR exercises you can take back to your organization and implement right away."

THEME 5: ORGANIZATION ENGAGEMENT 

Theme 5 Sessions

Managing Difficult Conversations
"When it comes to workplace communication, our approach greatly affects our outcomes. During hard conversations, many professionals make a few common mistakes that make problem-solving more difficult than it needs to be. When business associates don’t communicate their position clearly, the result is added frustration. In this session, we’ll show you how to tackle the toughest talks by driving your point, owning your feelings, respecting others and accomplishing what you set out to do."

Presenting to InfoSec and Business Leaders
"Information security professionals must seize every opportunity to influence executives within the business, but making an impression on the ultimate decision-makers takes facts, trust and precision. In this interactive discussion, we’ll show you how to develop messaging and presentations that resonate with business leaders. You’ll learn how to anticipate their questions, gain their trust and shift gears when the conversation doesn’t go as planned."

Becoming an Information Security Leader
"As information security becomes more critical to the business, practitioners must develop effective leadership skills, both within their teams and across the broader organization. In this interactive session, we’ll discuss how you can strengthen your command of key situations and exert leadership to better manage information security risk."

SPEAKERS

Dave Shackleford:
Dave Shackleford is Lead Faculty at IANS. He is the founder and principal consultant with Voodoo Security, and has consulted with hundreds of organizations in the areas of security, regulatory compliance, and network architecture and engineering. Dave is also a SANS analyst, instructor, and course author, as well as a board member with the SANS Technology Institute. He is a VMware vExpert, and has extensive experience designing and configuring secure virtualized infrastructures. He's the author of the Sybex book "Virtualization Security: Protecting Virtualized Environments", leads the Atlanta chapter of the Cloud Security Alliance, and co-chairs the CSA Top Threats to Cloud Working Group. Dave has previously worked as CSO for Configuresoft, CTO for the Center for Internet Security, and has also worked as a security architect, analyst, and manager for several Fortune 500 companies.

David Etue:
David Etue brings experience including security program leadership, management consulting, product management, and technical implementation. David is the VP of Corporate Development Strategy at SafeNet, where he is responsible for SafeNet's strategic decisions regarding product and solution partnerships, as well as mergers and acquisitions. He was previously the Cyber Security Practice Lead at management consultancy PRTM, VP of Products & Markets at Fidelis Security Systems, led General Electric's global computer security program, and held various positions in technology strategy, operations and product management. He is a Certified Information Privacy Professional, a graduate of GE’s Information Management Leadership Program, and a certified Six Sigma Green Belt.

Raffy Marty:
Raffy is one of the world's most recognized authorities on security data analytics. Raffy is the Founder and CEO of PixlCloud, a next-generation data visualization application for big data. With a track record at companies including IBM Research and ArcSight, Raffy is thoroughly familiar with established practices and emerging trends in data analytics. He has served as Chief Security Strategist with Splunk and was a Co-Founder of Loggly, a cloud-based log management solution. For more than 12 years, Raffy has helped Fortune 500 companies defend themselves against sophisticated adversaries and has trained organizations around the world in the art of data visualization for security. Raffy has a Masters in Computer Science from the Federal Institute of Technology in Switzerland. In his free time, he enjoys practicing the tradition of Koan study to gain insight into life. Areas of Expertise: • Big Data Analytics • Data Science • SIEM • Log Management • Security Architecture.
 

David Agran:
David Agran has had a successful career in the high tech, manufacturing, & engineering sectors, as well as in educational systems and non-profit organizations. For nearly 10 years David has been a senior consultant with Incite Learning, teaching and coaching: professional services, financial services and manufacturing clients. His focus is on leadership, facilitation, problem solving, conflict resolution, executive coaching and change. His work has supported initiatives at Solar Turbines, Center for Creative Leadership, L-3 Communications, ViaSat, Siemens AG, Qualcomm, Takeda Pharmaceutical, Salk Institute, and more. David’s passion is in facilitating action-oriented groups with a focus on enhancing leadership and team effectiveness that generates faster results and rapid change.

Debra Farber:
Debra J. Farber is the Founder and President of Farber Strategies Inc., a privacy and data protection consulting firm. She advises clients on a wide range of topics including setting enterprise-wide strategy for PII and PHI; assessing privacy and security risk for the protection of information assets; and, setting up breach prevention, response, and notification programs. Debra has held privacy and security leadership roles at IBM, The Advisory Board Company, American Express, and Numera. She holds a JD from Brooklyn Law School and a BA in English from Binghamton University. Security and privacy credentials earned include CISSP-ISSMP, CIPP/US, CIPT, CIPM. Debra is currently pursuing an Executive Certificate in Business Excellence from The UC Berkeley Haas School of Business.

Ken Van Wyk:
Kenneth R. van Wyk is an internationally recognized information security expert and author of three popular books, Enterprise Software Security, Secure Coding, and Incident Response. In addition to providing consulting and training services through his company, KRvW Associates, LLC, he currently holds the following positions: Member of the Board of Directors for SecAppDev, and monthly columnist for Computerworld. Ken is also the project leader of the Open Web Application Security Project (OWASP) iGoat project and is a Lehigh University distinguished engineering alumnus. Ken has 25 years experience as an IT Security practitioner in the commercial, academic, and military sectors. He has held executive and senior technologist positions at Tekmark, Para-Protect, Science Applications International Corporation (SAIC), the U.S. Department of Defense, Carnegie Mellon University, and Lehigh University. At Carnegie Mellon University’s Software Engineering Institute, Ken was one of the founders of the Computer Emergency Response Team (CERT®). Areas of Expertise : Incident Response , Software Security, Security Architecture , Application Security