Data Connectors is proud to host the Boston Virtual Cybersecurity Summit.

Managing Digital Risk in Transformative Times

Digital transformation is not only changing how companies think about business. It is changing how we think about risk. We need to *act* on risk, not worry about it. We need to start and end with the basics. In this session we review several key areas of digital risk management to target as you are challenged to be a key contributor in your company’s digital journey.

Speaker’s Bio:

Ben Smith is Field Chief Technology Officer (Field CTO – US) with RSA, a Dell Technologies business. With 25 years’ experience in the information security, networking and telecommunications industries, he regularly consults on RSA’s security and risk management solutions. His prior employers include UUNET, CSC, and the US Government, along with several technology-oriented startups. He holds industry certifications in information security (CISSP), risk management (CRISC), and privacy (CIPT), and has presented on RSA’s behalf internationally at cybersecurity events sponsored by Gartner, FS-ISAC, SANS, IANS, CERT/SEI, RSAC, ISSA, (ISC)2, ISACA, Infosecurity, IIA, RMA, BSides, ASIS, InfraGard, HTCIA, SecureWorld, MWCA, ICI and other organizations.

Implementing Security at the Speed of Innovation

There is no question that every organization is struggling to prevent cyber attacks, especially when it comes to their production environments. The mission critical information found in a modern Linux production infrastructure should be protected at all costs, unless that cost is stability and performance. The introduction of new innovations such as containers, the cloud, and hybrid environments have created an ever evolving attack surface that many struggle to keep up with and defend. This talk will discuss the challenges of and considerations you must make when securing an evolving production environment, all while trying to keep up security and operations teams happy.

Speaker’s Bio:

Austin Britt is the director of solutions architecture at Capsule8. He was previously a Solution Architect at Veracode where he helped build and optimize application security programs across Fortune 100 organizations. Prior to Veracode, he was a technical services consultant for a Microsoft partner based in the Boston area. Austin is a Boston OWASP Chapter Member, as well as a CCSK from the Cloud Security Alliance.

About Capsule8

Founded in fall 2016 and headquartered in New York, NY, Capsule8 is the only company providing high-performance attack protection for enterprise Linux — whether containerized, virtualized, or bare metal. Capsule8 frees-up SecOps teams, while being safe for even the busiest workloads, on the busiest networks. Founded by experienced hackers and seasoned security entrepreneurs, and funded by Bessemer Venture Partners, Intel Capital and ClearSky.

Threat Hunting & Modern Security: 3 Fundamental Flaws:

Security Operations is a discipline continuously evolving – with the evolution of tools and processes, there are still many flaws that exist around people & process. We will examine 3 specific flaws of modern security operations: 1.) Risk Acceptance 2.) SOC Alert Overload 3.) Inability to mitigate all Zero-Day Attacks.

We will start the discussion with a quick SOC capacity expertise, review in detail the 3 fundamental security flaws, revisit the math from the SOC capacity exercise to understand “what is being missed based upon my current capacity?”  We will also cover costs to the business for associated with these flaws and wrap up with some suggestions for mitigation.

Speaker Bio:

Jim Rohde, Director of Presales Engineering at CRITICALSTART is responsible for leading a team of security experts supporting technical conversations for CRITICALSTART’s products & services, including their flagship offering: Managed Detection & Response. Prior to CRITICALSTART, Jim held leadership roles at large Managed Security Service providers including Secureworks & Trustwave where he has received numerous awards for customer & company exceeding objectives.  Jim’s expertise in a multitude of security domains over his career has made him a sought after Trusted advisor for organizations of all sizes.

Coffee Break / Vendor Exhibit Time

Risk Management – Insights in a World Gone Crazy

Join Phil Richards, CISO for Ivanti, as we discuss key concepts and strategies for Risk Management. A few of the questions to be addressed in this session include: Is risk always a bad thing? How do you categorize risk according to your company’s objectives? Do data breaches really impact the big companies? What are the steps to recognizing, assessing and managing risk? The answers to these and many other questions will be discussed in this very important and timely session.

Speaker’s Bio:

Phil has both breadth and depth of security experience. He currently works as the Chief Information Security Officer for Ivanti. He has held other senior security positions including the head of operational security for a medical manufacturing corporation, Chief Security Officer for financial services technology (FinTech) company, and Engineering Director at a regional healthcare corporation. In his security leadership roles, he has created and implemented information security policies based on industry standards. He has led organizations to clean PCI DSS and HIPAA compliance attestations, implemented security awareness training, and established a comprehensive compliance security audit framework based on industry standards. He has led Ivanti through their most recent FedRAMP authorization process. He has implemented global privacy policies, including addressing privacy issues in the European Union. Transforming an organization requires focus on the objectives, clear communication, and constant coordination with executive leadership, which is exactly what Phil has focused on during his security career.

Introduction to Proactive Prevention

Despite continued infosec investments, data breaches continue while companies contend with
complicated security architectures composed of disconnected technologies that produce mountains of
non-actionable data. A renewed focus on prevention may hold the answer.

Security architecture can be broken down into three main elements: Prevention, Detection and
Remediation. Prevention should be considered the most strategically important defense element, as by
default good true time zero prevention dramatically reduces latency, risks and operational costs of the
security structure as a whole. As advanced threats evolve and data center transformation forces
enterprise teams to consolidate security, the need for faster, easier and more deterministic threat
prevention is essential, thus corporations need to consider a purpose-built stack of true prevention
capabilities, that isn’t available in a singular off-the-shelf solution, and add Detection based tools, which
by definition have a huge latency, false alerts and are cost prohibitive, where and when appropriate, but
not as a prevention tool.

Speaker’s Bio:

Netta Schmeidler, VP Product at Morphisec, has more than 25 years of experience delivering complex enterprise applications and managing global development groups and product teams. Her broad expertise includes all aspects of defining, building and successfully bringing solutions to market. Prior to Morphisec, Netta held senior product management and engineering roles at VMware (Digital Fuel), BMC, Identify Software, and Mercury. She received an MBA from Tel Aviv University, and a BSc in Computer Science from Hebrew University.

TPRM 2.0: How to Reduce the Burden of Vendor Risk Assessments

You spend countless hours assessing your vendors, stuck in spreadsheets, trying to sift through last year’s emails to find the right vendor contact and the most up-to-date questionnaire. And when assessments are finally completed (which can take months), you still need to review and validate the answers, as well as mitigate any identified risks.

As your program evolves, the need to simplify the vendor risk assessment process becomes unavoidable. So, what can you do to streamline assessment completion and simplify vendor risk reviews? In this webinar, we’ll outline the latest vendor risk assessment tips and tactics that you can implement to build a more efficient third-party risk management practice.

Keypoints:

• How you can save hours on vendor risk assessments
• How you can leverage inherent risks and tiered assessments
• How Cyber Risk Exchanges are reinventing the assessment process

Speaker’s Bio:

Emily Couch serves as a Third-Party Risk Consultant for OneTrust Vendorpedia – a purpose-built software designed to operationalize third-party risk management. In her role, Couch advises companies throughout their third-party risk management implementations to help meet requirements relating to relevant standards, frameworks, and laws (e.g. ISO, NIST, SIG, GDPR and CCPA). Couch works with clients to centralize their third-party information across business units, assess risks and performance, and monitor threats throughout the entire third-party relationship, from onboarding to offboarding.

This session will feature all of the presenters from the morning agenda, answering questions from the audience live via video, in a panel format. Each presenter will take questions that pertain to their topic, and if there is time, they will also respond to a few questions about larger trends and directions that face all members of the cyber-security community.

Presentation:

Frederick will provide an informal discussion on the following topics:

• Overview of USSS Cyber Fraud Task Force (CFTF) and Digital Evidence Forensic Labs (DEFL) program: History, Authority, Mission and Principles of Success within your Region
• Cyber Incidents: An International Team Sport!
• What is trending – Cryptocurrency.
• Leading a Federal Law Enforcement District during a COVID 19 shutdown.

Presenter’s Bio:

Frederick Regan began his career with the United States Secret Service (USSS) in 1999, after serving as a Captain in the United States Marine Corps.  Mr. Regan has led numerous complex criminal investigations throughout his career while assigned to the San Diego Field Office, Washington Field Office, and the Forensic Services Division – Polygraph Branch.  Mr. Regan’s career also included protective responsibilities while assigned to the Clinton Protective Division, Presidential Protective Division, and the Dignitary Protective Division.  As an Assistant Special Agent in Charge, Mr. Regan led the Criminal Investigative Division – Cyber Intelligence Branch responsible for criminal intelligence and targeting of high-level cyber criminals.  Currently, Mr. Regan is the Special Agent in Charge of the Boston Field Office, which is responsible for USSS criminal investigations and protection operations throughout Maine, Massachusetts, New Hampshire, Rhode Island, and Vermont.

Mr. Regan is a graduate of the United States Naval Academy and holds post graduate degrees from the University of Connecticut and U.S. Naval War College.

Cyber Resilience: Rethinking your data protection strategy in the age of ransomware.

Ransomware threats increased by 300% last year, and the industry is expecting it to get worse. Ransomware victims’ greatest pains are downtime and data loss. Current DR and Backup solutions aren’t equipped to help you manage it at the speed of business. Join us for this discussion on how to transform your data protection approach to ensure you can protect your data and resume operations almost instantly when facing a ransomware attack. See you there!

Speaker Bio:

Andy Fernandez is a Global Product Marketing Manager at Zerto. With a focus on product marketing and launches, he strives to translate technical innovation to business value. After spending years in various technology companies and entrepreneurship pursuits, Andy is focused on launching industry-leading products and accelerating their adoption.

Introduction to Risk-Based Vulnerability Management

Organizations have millions of vulnerabilities. And our research has shown that those same organizations, large or small, on average, can only fix one in 10 of those vulnerabilities.

But as a security executive you still need to keep your organization secure, so how do you do that when you can’t possibly fix all of your vulnerabilities? The answer is to focus on your highest-risk vulnerabilities first.

Join Kenna Security’s CTO and Co-Founder Ed Bellis as he:

• Reviews what years of research into vulnerability management data uncovered about the scope of the challenge
• Details the findings on how risk-based is the way to get ahead in vulnerability management
• Lays out several factors that drive better remediation performance
• Provides steps for setting up a successful risk-based vulnerability management program

Speaker’s Bio:

Ed Bellis is a security industry veteran and expert and known in security circles as “the father of risk-based vulnerability management.” He founded Kenna Security to deliver a data-driven risk-based approach to remediation and help IT teams prioritize and thwart would-be security threats.

Ed is the former CISO of Orbitz and former Vice President, Corporate Information Security at Bank of America. He is an advisor to Dharma and former advisor to SecurityScoreboard.com and Society of Payment Security Professionals. Ed is a contributing author to the book, Beautiful Security (Oram, Andy & Viega, John, O’Reilly Media, 2009).

He is a frequent speaker at industry conferences. Recent engagements include the 2017 Enterprise Security Summit (Dos and Don’ts of Establishing Metrics that Cultivate Real Security) and InfoSec World (Amateur Hour: Why APT’s Are the Least of Your Worries).

The Evolution of Zero Trust in a New Age of Security

As we shift our focus from the data center to the cloud and containers, it is important to keep the Zero-Trust security model in mind. Hear how to make sure the new frontier of cloud, SaaS applications, and serverless functions are staying just as secure as your Datacenter with Check Point.

Speaker’s Bio:

Cory Pellegren is a Security Engineer for Check Point Software Technologies for the past 5 years. In his role, he is making sure that all Check Point customers around New England are secure everywhere – in the datacenter, cloud environments, mobile and endpoint devices, as well as IOT. Previous to joining Check Point, Cory worked for a large MSSP, maintaining some of the world’s largest companies security infrastructure.

Shifting PAM into High Gear with Zero Standing Privilege (ZSP)

Zero Standing Privilege (PAM) was a new term introduced in 2019 and might just be the best approach to shift your PAM strategy into high gear. In this short presentation, we’ll discuss how PAM projects were managed historically and highlight a new PAM approach to reduce the impact of compromised admin credentials.
Do you know what admin credentials exist today or even how they change over time in your organization? This is just one of several challenges we’ll discuss, offer a solution and discuss the need and value of frequent scanning of admin rights, reporting on current standing privileges and the adoption of a ZSP and Just-In-Time administration.
So, if you’re looking for quick wins in PAM, including removing local admin rights and support for DevOps+PAM use cases, join the discussion and learn how other organizations like yours have succeeded.

Speaker’s Bio:
Paul Lanzi is the co-founder and COO of Remediant. Paul and Tim Keeler worked together in the IT departments of several biotechs including Genentech, Roche and Gilead Sciences before starting Remediant. At each of those organizations, they saw first-hand the drawback of the legacy approaches to PAM and were inspired to create something new. Paul’s previous corporate IT experience includes project and program management, corporate mobile app development team management and recruiting and managing full-stack web development teams. Paul has a passion for excellent user experience (UX) and project management, having held a PMP certification from the Project Management Institute since 2005. Paul also holds a BS with Honors in Computer Science from UC Davis.

Secure the Enterprise with AI-Powered Adaptive Authentication

With the risk of cyberattack continuing to increase due to perpetrators finding smarter and less-detectable ways to circumvent security, it is becoming increasingly difficult for today’s businesses to implement solutions that evolve as the methods of attackers evolve.

In the pursuit of finding more ways to secure the enterprise, the user experience is often sacrificed, causing end-users to become increasingly agitated and unable to get work done due to account lockout.

Join our session as we discuss how AI-powered authentication is the solution you need to provide an optimal balance between securing your data and ensuring users enjoy seamless access to business-critical applications.

Rise of the Machines: Best Practices for Securing Unmanaged and IoT Devices

For many years now, enterprise networks have seen an explosive rise in devices that are challenging for security teams to secure. These include not only unmanaged devices, but also the extensive portfolio of Internet of Things (IoT) in enterprises such IP cameras, conference room TVs, smart building systems, manufacturing machines and medical devices.
Join Ordr CSO Jeff Horne in this webinar to learn:

• Risks and vulnerabilities associated with unmanaged and IoT devices
• Why traditional networking and security tools fall short
• Security best practices to protect these devices without impacting business operations

Speaker’s Bio:

Jeff Horne is currently the CSO at Ordr where he is responsible for security direction both within Ordr products and internal security. Prior to Ordr Jeff was the VP of Information Security for Optiv where he was responsible for all Security Operations, Governance Risk and Compliance, Endpoint, Internal Incident Response, Physical Security, and Employee Security Awareness groups. Before Optiv Jeff was the Senior Director of Information Security for SpaceX where he was responsible for the overall security strategy of SpaceX and managing the Information Security, Compliance (ITAR), Security Operations, and Physical Security groups. Previous to SpaceX Jeff was the Vice President of R&D and Chief Architect for Accuvant LABS where he managed teams of researchers and consultants specializing in reverse engineering, malicious code, incident response, breach analysis, and vulnerability assessment. Prior to Accuvant Jeff was the Director of Threat Research at Webroot Software where he led several teams of malware researchers, reverse engineers, and a development organization specializing in creating anti-malware functionality and detection signatures for all Webroot products. Jeff began his career as a Vulnerability Researcher at Internet Security Systems where he was responsible for vulnerability discovery, exploit creation, IDS evasion research, and behavioral detection of malware. Jeff is well known for his insight in interviews for numerous news channels and publications, speaking roles at various security conferences, as well as authoring several vulnerability disclosures and patents.

This session will feature all of the presenters from the afternoon agenda, answering questions from the audience live via video, in a panel format. Each presenter will take questions that pertain to their topic, and if there is time, they will also respond to a few questions about larger trends and directions that face all members of the cyber-security community.