Data Science Transforming Security Operations

Data science brings a huge promise to IT security and accordingly to the sprouting of DS teams across all enterprises, and numerous vendors. Indeed DS has the potential to transform the way security is done—yet, the secret sauce is how to do it in a way that actually provides clear value, embedded into the security workflow, and leverages the human knowledge in combined with the data.

Speakers

Alon Kaufman 

Dr. Alon Kaufman is currently RSA's Director of Data Science and Innovation globally, leading data science for RSA across the full portfolio. Prior to this role, within RSA, he was Head of Research for the fraud risk analytics products. Prior to joining RSA, Kaufman held several managerial and research positions in Israeli hi-tech companies, dealing with various aspects of data mining and data science. All in all, he has over 20 years of experience in technology and innovation management. He holds a Ph.D. in computational neuroscience and machine learning from the Hebrew University and an MBA from the Tel Aviv University. He teaches data science courses in Israeli universities, and is a public speaker on Big Data and data science, cybercrime, security and innovation.

Detailed Presentation:

Cloud Breach – Preparation and Response

Your next breach or insider attack will most likely have you digging for evidence in the cloud. Are you prepared? The old styles of imaging disks and tapping networks won't work! It won’t scale! This session will discuss response scenarios for cloud-enabled and cloud-dependent enterprises, a model for preparing for cloud response, and will show examples of cloud breach investigations.

Speakers

Monzy Merza ( @monzymerza )

Monzy Merza serves as the Chief Security Evangelist at Splunk, Inc. He has over 15 years of tactical and cybersecurity research experience in government and commercial organizations. His experience has included vulnerability management, security product testing, penetration testing, adversary modeling, cybertools and infrastructure development. He has also served as content developer and instructor for cyber-trainings and red/blue team exercises. Merza has been an invited speaker at government and open conferences. Merza’s current research is focused on integrated approaches to human driven and automated responses to targeted cyberattacks.

Detailed Presentation:

Make IR Effective with Risk Evaluation and Reporting

Today, determining risk of a cyberattack is the generic vulnerability or malware rating ignoring aspects of how the business is impacted. Understanding the vulnerability state of the network, reputational risk, business loss, cost of IR and reconstitution cost are rarely understood. This presentation will show a data-driven approach to IR prioritizing response based on risk and business impact.

Speakers

Justin Monti; Mischel Kwon ( @MKAsays )

Justin Monti is Sr. VP, Security Engineering at MKACyber focusing on managing technical security services including security architecture, remote monitoring and security program consulting. He assists MKACyber clients in applying technology to successfully execute holistic security programs, protecting the organization’s mission and draws on over 15 years of IT and InfoSec experience in the private and public sector. Prior to MKACyber, he served in numerous capacities at NetWitness as it grew from a small startup to acquisition by EMC in 2011. Prior to NetWitness, Monti supported government financial management systems as a system architect and information system security officer (ISSO). Monti holds a bachelor’s in computer science and business economics from Brown University.

Mischel Kwon is a recognized IT security leader with 32 years of experience in technical security operations, incident response and information assurance as well as building and managing organizational and national level SOC, CERT and IR Teams. Kwon currently serves as the President and CEO of MKACyber, a security consulting firm specializing in Technical Defensive Security, Security Operations and Information Assurance. Kwon has held senior roles in the U.S. Government, including Director of US-CERT where she coordinated national-level IR activities and at the U.S. Department of Justice where she established and managed the Justice Security Operations Center (JSOC). Kwon holds an M.S. degree in computer science and a graduate certificate in Computer Security and Information Assurance.

Detailed Presentation:

The Rise of the Purple Team

As attacker tactics, techniques and procedures evolve, so must the defenses and strategy used to defend against them. Traditional red teaming presents an opportunity to find gaps in security, but leaves more valuable information unabsorbed. Results and methodologies used in red team assessments can drive protections in place use by blue teams and a larger program and vice versa.

Speakers

Robert Wood ( @robertwood50 ); William Bengtson ( @waggie2009 ) 

Robert Wood runs the security team at Nuna Health. Coming originally from a consulting background, Wood has experience with threat modeling, red teaming, incident response, static analysis and penetration testing, having been engaged in these capacities across many industries and business types. His background, coupled with a keen interest in cloud security, has enabled Wood to build and execute a strategy and a team at Nuna Health that is aimed at protecting and managing the risk around it’s core assets. Prior to joining Nuna Health, Wood was a Principal Consultant at Cigital where he founded and led the red team assessment practice and worked with strategic clients across the United States in an advisory capacity.

William Bengtson is an information security professional with over eight years of experience in a variety of roles including red teaming, network security, architecture risk analysis lead, software security, exploit development, security architect lead, application developer and certification lead. Bengtson comes to Nuna as the Senior Security Program Manager from Lockheed Martin as a Core Cyber Security Lead, Cigital as a Senior Security Consultant, and Raytheon as a Cyber-Professional having studied anti-tamper, reverse engineering and exploit development (on both standard and non-standard systems). Bengtson has worked in numerous industries providing support and expertise creating a proactive stance on security within the industries.

Detailed Presentation:

The Incident Response Playbook for Android and iOS

What is your mobile device incident response plan? If you cannot answer that question, you should attend this session. The session will cover the challenges in mobile, how and why it is different from traditional incident response, and the building blocks you can use to craft your own mobile incident response plan.

Speakers

Andrew Hoog ( @ahoog42 ) 

Andrew Hoog is a top industry mobile forensics and security expert, computer scientist and is the CEO and Co-founder of NowSecure, a leading mobile security company. He found his passion in exploring mobile security; be it conducting original research that debunks common security assumptions, providing mobile security solutions or creating smarter technology to ensure your private information remains private and not exposed to unnecessary risks. Hoog has one issued and two pending patents in the areas of forensics and data recovery, is the author of two books on mobile forensics and security, has presented on forensics and mobile security at conferences such as RSAC, Cisco’s CIO Summit and OWASP AppSec USA, and is an expert witness.

Detailed Presentation:

Cloud Breach – Preparation and Response

Your next breach or insider attack will most likely have you digging for evidence in the cloud. Are you prepared? The old styles of imaging disks and tapping networks won't work! It won’t scale! This session will discuss response scenarios for cloud-enabled and cloud-dependent enterprises, a model for preparing for cloud response, and will show examples of cloud breach investigations.

Speakers

Monzy Merza ( @monzymerza )

Monzy Merza serves as the Chief Security Evangelist at Splunk, Inc. He has over 15 years of tactical and cybersecurity research experience in government and commercial organizations. His experience has included vulnerability management, security product testing, penetration testing, adversary modeling, cybertools and infrastructure development. He has also served as content developer and instructor for cyber-trainings and red/blue team exercises. Merza has been an invited speaker at government and open conferences. Merza’s current research is focused on integrated approaches to human driven and automated responses to targeted cyberattacks.

Detailed Presentation:

Upwardly Mobile: Looking at Evolving Cybercrime Tactics in Mobile Malware

This session will cover two key trends in mobile malware observed over the past 12 months and explore the evolution in fraud-linked mobile malware where criminals are developing credential theft tools that attempt to duplicate the successes of Windows malware in modifying victim interactions with targeted services. Also a look at mobile ransomware variants becoming more numerous and damaging.

Speakers

John Miller 

John Miller leads iSIGHT Partners’ ThreatScape Cyber Crime product, which provides actionable intelligence on financially motivated cyberthreat activity. In this role, Miller directs analysis on topics such as credential theft malware, payment card abuse, ransomware, money laundering and mobile device threats; this analytical work draws from the expertise of iSIGHT Partners’ globally-distributed researcher network. Prior to managing this product, Miller worked in threat intelligence analyst roles focused on multiple others issues, such as distributed denial-of-service (DDoS) threats and South America-based malicious activity.

Detailed Presentation:

Building a World-Class Proactive Integrated Security and Network Ops Center

The SNOC (Security & Network Operations Center) is a cost-effective, world-class, proactive integrated function that leverages and optimizes your current NOC members while hiring a minimal number of additional security professionals. Learn how to use the SNOC framework to transform your existing NOC into a single effective team that is responsible for both network and security functions.

Speakers

Hanna Sicker ( @SNOCgirl ) 

Sr. Manager, Security and Network Operations Center, StubHub (an eBay company)

Hanna Sicker has over 25 years of technical and management experience, including 10 years in information security operations. As a SOC/NOC manager, Sicker oversees a team of SOC analysts and NOC Engineers who provide support to all StubHub sites. Possessing expertise across a broad range of security technologies, Sicker has extensive experience in site operations, incident response management, predictive risk analysis, SIEM, network access control, network performance, security monitoring and anti-malware. She holds CISM and CISSP certifications with a degree in Computer Science.

Detailed Presentation:

Data Breach Litigation How To Avoid It and Be Better Prepared (RSA Conference 2016)

Here's an overview of the presentation: Background: Where are the Data Breaches occuring?; How to Be Better Prepared for When Your Company Data is Brenched; How to Avoid it: Lessons Learned & Best Practices

Speakers

Ronald I Raether, Jr.; Andrea Hoy 

Ron Raether is a partner in the Cybersecurity, Information Governance and Privacy, and Financial Services Litigation practices at Troutman Sanders. Ron is known as the interpreter between the business and information technology, guiding both parties to the best result. In this role, Ron has assisted companies in navigating federal and state privacy laws for almost twenty years. Ron's experience with technology-related issues, including data security, patent, antitrust, and licensing and contracts, helps bring a fresh and creative perspective to novel data compliance issues. Ron has been involved in seminal data compliance cases, assisting one of the first companies required to provide notice of a data breach and successfully defending companies in over 50 class actions. Ron also has represented companies in over 200 individual FCRA cases involving CRAs, resellers, furnishers, users, and public record vendors. Ron has developed a reputation for assisting companies not traditionally viewed as subject to the FCRA or with FCRA compliance questions where the law remains uncertain or unresolved. Ron not only works with companies which have experienced unauthorized access to consumer data or have been named defendants in class actions and before regulators, but also has advised companies in developing compliance programs to proactively address these issues. As a thought leader, Ron speaks nationally and publishes frequently on cutting-edge compliance issues. Ron is also a Certified Information Privacy Professional.

Andrea Hoy, received her initiation into the infosec community when her hard work and dedication for a safe international event earned her the role as an Asst. Venue Manager for the highly successful LA Summer Olympic Games. Andrea’s leadership positions include McDonnell Douglas, Rockwell, Boeing NA and Fluor. Her clients are from a diverse mix of industries that include Litton, Pacific Life, Genentech, Molina Healthcare, Activision, WAMU (now Chase), Hamni, and East West Banks. She’s served and been recognized as an advisor to the Pentagon and as ISO for the 5th largest credit union as it went through its most major technology and growth past $10 billion in assets and 600,000 in membership. Ms. Hoy is the founder of A.Hoy & Associates, a “virtual CISO” provider as well as infosecurity consulting, GRC, incident response, CISO Bootcamp training firm, assisting companies to establish policies and procedures to comply with NIST CyberSecurity Framework, top 20 Critical Controls, EUPD and privacy laws here and abroad to name a few. She represented the US as diplomat to China on eDiscovery and forensics. Andrea is actively involved in the community serving as the International President of the Information Systems Security Association (ISSA) the commun ity of choice for international cybersecurity professionals dedicated to advancing individual growth, managing technology risk and protecting critical information, after elected Vice President. ISSA members represent >10,000 security professionals worldwide with 137 chapters in 71 countries. Ms. Hoy cofounded the CISO Executive Forum and recently chartered the Financial SIG. She previously served on the Technical Advisory Board for RSA for 4 years, advised the International Board of Directors for PointSec/ProtectData of Sweden, as well as Board of advisors for Encentuate, a global identity management and provisioning company, leading to its acquisition by IBM, and DigitalSafe in Switzerland. She has previously been in the LA Times, Orange County Register: People in Technology to Watch”, MiCTa Radio, TechTarget and KNX News Radio. Andrea received her MBA from Pepperdine University in Malibu, and prior to that graduated Magna Cum Laude and was entered into the honor society of Beta Gamma Sigma, the Phi Beta Kappa of the School of Business.

Detailed Presentation:

Demystifying Security Analytics: Data, Methods, Use Cases

Many vendors sell “security analytics” tools. Also, some organizations built their own security analytics toolsets and capabilities using Big Data technologies and approaches. How do you find the right approach for your organization and benefit from this analytics boom? How to start your security analytics project and how to mature the capabilities?

Speakers

Anton Chuvakin ( @anton_chuvakin )

Research Vice President, Gartner

Anton Chuvakin is a Research Vice President in Gartner for Technical Professionals (GTP) Security and Risk Management group. Before Chuvakin joined Gartner, his job responsibilities included security product management, evangelist, research, competitive analysis, PCI DSS compliance, and SIEM development and implementation. He is an author of the books “Security Warrior” and “PCI Compliance” and a contributor to “Know Your Enemy II,” “Information Security Management Handbook” and other books. He has published dozens of papers on log management, SIEM, correlation, security data analysis, PCI DSS and security management. His blog “Security Warrior” was one of the most popular in the industry.

Detailed Presentation:

Take It to the Cloud: The Evolution of Security Architecture

As companies evolve their IT stack, traditional security approaches/architectures need to be reconsidered. This session will review some of the new risks introduced by SaaS/IaaS adoption and show how to mitigate these risks using new approaches to security architecture. Presenters will also review the transition of security architecture itself to the cloud.

Speakers

Dana Wolf ( @dayowolf )

Dana Wolf is the Sr. Director for Products at OpenDNS (now a part of Cisco). Previously she was Director of Products at Rapid7, responsible for product development of Nexpose, Metasploit and ControlsInsight. Prior to Rapid7 Wolf worked at RSA as a Director of New and Advanced Development for the Office of the CTO. She was responsible for developing new security technologies and business opportunities in the areas of virtualization security, hardware root of trust, advanced security operations and GRC. She also managed CTO operations and RSA’s advanced development engineering team. She joined RSA in 2004 as a principal software architect and served two years as an Entrepreneur in Residence at RSA for her graduate school work on payment card security.

Detailed Presentation:

*We suggest you use Chrome to view the slides, as the it may be inaccessible on other browsers like safari etc.

The Cyber Defense Matrix enables organizations to define clear categories for the range of products and services that are available in the marketplace to solve our various infosec problems. This model removes confusion around the security technologies that we buy and helps organizations align their vendors to have the right suite of capabilities to execute their information security mission.

Speakers

Sounil Yu ( @sounilyu )

Sounil Yu is a Christian, husband and father with over 30 years of hands-on experience creating, breaking and fixing computer and network systems. As the Exec Director for Security Innovation at a major financial institution, he leads teams to execute innovation initiatives and crazy experiments that reduce risk and tackle hard challenges in infosec. Previously, he helped improve infosec at several institutions spanning from Fortune 100 companies with three letters on the stock exchange to secretive three letter agencies that are not. Although on occasion he is forced to write about himself in the third person, he would rather meet people in person to share experiences rather than writing it up in a short bio. He lives in Virginia with his wife and their four homeschooled children.

Detailed Presentation:

Security Program Development for the Hipster Company

Cloud services have evolved and can now replace nearly every facet of traditional infrastructure. This movement has enabled rapid scale while introducing a considerable element of risk. This session will discuss a framework for getting started building a security program in an organization that is built purely on cloud services, covering the contradictions and opportunities of that business model.

Speakers

Robert Wood ( @robertwood50 )

Robert Wood runs the security team at Nuna Health. Coming originally from a consulting background, Wood has experience with threat modeling, red teaming, incident response, static analysis and penetration testing, having been engaged in these capacities across many industries and business types. His background, coupled with a keen interest in cloud security, has enabled Wood to build and execute a strategy and a team at Nuna Health that is aimed at protecting and managing the risk around it’s core assets. Prior to joining Nuna Health, Wood was a Principal Consultant at Cigital where he founded and led the red team assessment practice and worked with strategic clients across the United States in an advisory capacity.

Detailed Presentation:

Designing Virtual Network Security Architectures

With the advent of virtualization and software-defined networking (SDN), the nature and design of today’s networks are changing rapidly. Network security models need to adapt to the virtual data center, and there are a plethora of new technologies that can help security and operations teams design scalable network security architectures that work in highly virtualized environments.

Speakers

Dave Shackleford ( @daveshackleford ) 

Dave Shackleford is Lead Faculty at IANS, Owner and Principal Consultant at Voodoo Security and a SANS Senior Instructor and Course Author. He has consulted with hundreds of organizations in the areas of security, compliance and network architecture and engineering, and is a VMware vExpert with extensive experience designing and configuring secure virtualized infrastructures. He previously worked as CTO at IANS, CSO for Configuresoft, CTO for the Center for Internet Security, and as a security architect, analyst, and manager for several Fortune 500 companies. Shackleford is the author of Virtualization Security: Protecting Virtualized Environments, currently serves on the Board of Directors at the SANS Technology Institute and helps lead the Atlanta chapter of the Cloud Security Alliance. 

Detailed Presentation:

*We suggest you use Chrome to view the slides, as the it may be inaccessible on other browsers like safari etc.

Preserving the Privilege during Breach Response 

When companies hire cybersecurity consultants to investigate incidents, those professionals’ reports and emails could be used against the company in court unless a privilege applies. This session provides an overview of the attorney-client privilege for post-breach investigations, and tips for increasing the chances that the privilege will apply and the data will remain confidential.

Speakers

Jeff Kosseff ( @jkosseff ) 

Jeff Kosseff is an Assistant Professor of Cybersecurity Law at the United States Naval Academy. He practiced cybersecurity and privacy law at Covington & Burling, and clerked for Judge Milan D. Smith, Jr. of the U.S. Court of Appeals for the Ninth Circuit and for Judge Leonie M. Brinkema of the U.S. District Court for the Eastern District of Virginia. Kosseff is a graduate of Georgetown University Law Center and the University of Michigan. Before becoming a lawyer, he was a journalist for The Oregonian and was a finalist for the Pulitzer Prize for national reporting.

Detailed Presentation:

Integrated Security Operations Center (ISOC) for Cybersecurity Collaboration

This session will present a real case study of methodology and advanced cybersecurity tools used along with important tips and lessons learned on implementing an ISOC project at the second largest city of the nation. Topics include the critical success factors, advanced tools and technologies for ISOC, Situational Awareness, Threat Intelligence Sharing and cybersecurity collaboration.

Speakers

Timothy Lee ( @tswlj316 )

Timothy Lee is the Chief Information Security Officer at the City of Los Angeles. He is responsible for overall cybersecurity policies and initiatives for America’s second largest city. One of those initiatives is the City’s first Integrated Security Operations Center (ISOC). His work affects all 40 City of Los Angeles departments. Prior to his current position, Lee was the CISO at the Port of Los Angeles where he established the Port’s cybersecurity program and was the project manager for the Cyber Security Operations Center (CSOC), which won the 2015 American Association of Port Authorities IT Award of Excellence. He has a total of 20 years of experience in information security, network and telecommunication field and has spoken at several conferences.

Detailed Presentation:

Cloud Security Essentials 2.0 Full Stack Hacking & Recovery

Here's an overview of the presentation: A Basic Introduction – Cloud Hack Lab Attack; Harness, Enumeration and Testing Tools Cloud; Forensics at Scale; Opportunities for Tools

Speakers

Shannon LIetz ( @devsecops ); Javier Godinez

Detailed Presentation:

Wireless Infusion Pumps: Securing Hospitals’ Most Ubiquitous Medical Device

Imagine being dependent on a wireless infusion pump to receive the correct dosage of life-supporting medication. Now imagine the implications, were that pump to be maliciously hacked. In this session learn more about how to successfully secure these medical devices, based on work being conducted at the National Cybersecurity Center of Excellence (NCCoE) with premier health care organizations.

Speakers

Nathan Lesser ( @natelsr )

Nathan Lesser, Deputy Director of the National Cybersecurity Center of Excellence (NCCoE) at NIST, has over 15 years of experience in technical and leadership roles. Nate oversees the NCCoE’s engineering initiative and is responsible for cultivating collaboration across government, business, and technology companies to address cybersecurity issues within and across industry sectors. Previously, Nate led a team of cybersecurity engineers at Booz Allen Hamilton, served in the Office of Management and Budget, and the Senate’s Homeland Security and Governmental Affairs Committee. Nate holds bachelor’s and master’s degrees in electrical engineering from Columbia University, and is currently a Senior Fellow at the George Washington University Center for Cyber and Homeland Security.

Detailed Presentation:

How to Analyze an Android Bot

This presentation will demonstrate a complete end-to-end analysis of an Android bot. This will include the decompilation and static analysis of bot code and the dynamic analysis of the bot’s behavior in a controlled sandboxed environment. The session will provide details of the lab environment and tools used for the analysis.

Speakers

Kevin McNamee ( @KevMcNamee )

Kevin McNamee is Director of Alcatel-Lucent’s Motive Security Labs and is responsible for the security research team that supports the ALU’s cloud based malware detection system. Previously he was Director of Security Research at Alcatel-Lucent’s Bell Labs specializing in the analysis of malware propagation and detection. He has recently presented at BlackHat, RSA, (ISC)2 and SECTOR.

Detailed Presentation:

Building an Android Scale Incident Response Process

The Android ecosystem has over one billion active devices from hundreds of OEMs and carrier networks. The Android Security Team will explain how the ecosystem is able to respond quickly and effectively to security incidents. This will be part historical analysis of actual incidents, such as the Stagefright vulnerabilities, and part data-focused analysis of technology and processes we developed.

Speakers

Adrian Ludwig 

Adrian Ludwig is the Lead Engineer for Android security at Google. In this role, he is responsible for the security of the Android platform and Google’s applications and services for Android. Prior to joining Google, Ludwig held technical leadership positions at Joyent, Adobe, Macromedia, @stake and the Department of Defense. Ludwig has a B.A. in mathematics from Williams College and an MBA from the University of California, Berkeley.

Detailed Presentation: