Data Breach Litigation How To Avoid It and Be Better Prepared (RSA Conference 2016)

Here's an overview of the presentation: Background: Where are the Data Breaches occuring?; How to Be Better Prepared for When Your Company Data is Brenched; How to Avoid it: Lessons Learned & Best Practices

Speakers

Ronald I Raether, Jr.; Andrea Hoy 

Ron Raether is a partner in the Cybersecurity, Information Governance and Privacy, and Financial Services Litigation practices at Troutman Sanders. Ron is known as the interpreter between the business and information technology, guiding both parties to the best result. In this role, Ron has assisted companies in navigating federal and state privacy laws for almost twenty years. Ron's experience with technology-related issues, including data security, patent, antitrust, and licensing and contracts, helps bring a fresh and creative perspective to novel data compliance issues. Ron has been involved in seminal data compliance cases, assisting one of the first companies required to provide notice of a data breach and successfully defending companies in over 50 class actions. Ron also has represented companies in over 200 individual FCRA cases involving CRAs, resellers, furnishers, users, and public record vendors. Ron has developed a reputation for assisting companies not traditionally viewed as subject to the FCRA or with FCRA compliance questions where the law remains uncertain or unresolved. Ron not only works with companies which have experienced unauthorized access to consumer data or have been named defendants in class actions and before regulators, but also has advised companies in developing compliance programs to proactively address these issues. As a thought leader, Ron speaks nationally and publishes frequently on cutting-edge compliance issues. Ron is also a Certified Information Privacy Professional.

Andrea Hoy, received her initiation into the infosec community when her hard work and dedication for a safe international event earned her the role as an Asst. Venue Manager for the highly successful LA Summer Olympic Games. Andrea’s leadership positions include McDonnell Douglas, Rockwell, Boeing NA and Fluor. Her clients are from a diverse mix of industries that include Litton, Pacific Life, Genentech, Molina Healthcare, Activision, WAMU (now Chase), Hamni, and East West Banks. She’s served and been recognized as an advisor to the Pentagon and as ISO for the 5th largest credit union as it went through its most major technology and growth past $10 billion in assets and 600,000 in membership. Ms. Hoy is the founder of A.Hoy & Associates, a “virtual CISO” provider as well as infosecurity consulting, GRC, incident response, CISO Bootcamp training firm, assisting companies to establish policies and procedures to comply with NIST CyberSecurity Framework, top 20 Critical Controls, EUPD and privacy laws here and abroad to name a few. She represented the US as diplomat to China on eDiscovery and forensics. Andrea is actively involved in the community serving as the International President of the Information Systems Security Association (ISSA) the commun ity of choice for international cybersecurity professionals dedicated to advancing individual growth, managing technology risk and protecting critical information, after elected Vice President. ISSA members represent >10,000 security professionals worldwide with 137 chapters in 71 countries. Ms. Hoy cofounded the CISO Executive Forum and recently chartered the Financial SIG. She previously served on the Technical Advisory Board for RSA for 4 years, advised the International Board of Directors for PointSec/ProtectData of Sweden, as well as Board of advisors for Encentuate, a global identity management and provisioning company, leading to its acquisition by IBM, and DigitalSafe in Switzerland. She has previously been in the LA Times, Orange County Register: People in Technology to Watch”, MiCTa Radio, TechTarget and KNX News Radio. Andrea received her MBA from Pepperdine University in Malibu, and prior to that graduated Magna Cum Laude and was entered into the honor society of Beta Gamma Sigma, the Phi Beta Kappa of the School of Business.

Detailed Presentation:

Demystifying Security Analytics: Data, Methods, Use Cases

Many vendors sell “security analytics” tools. Also, some organizations built their own security analytics toolsets and capabilities using Big Data technologies and approaches. How do you find the right approach for your organization and benefit from this analytics boom? How to start your security analytics project and how to mature the capabilities?

Speakers

Anton Chuvakin ( @anton_chuvakin )

Research Vice President, Gartner

Anton Chuvakin is a Research Vice President in Gartner for Technical Professionals (GTP) Security and Risk Management group. Before Chuvakin joined Gartner, his job responsibilities included security product management, evangelist, research, competitive analysis, PCI DSS compliance, and SIEM development and implementation. He is an author of the books “Security Warrior” and “PCI Compliance” and a contributor to “Know Your Enemy II,” “Information Security Management Handbook” and other books. He has published dozens of papers on log management, SIEM, correlation, security data analysis, PCI DSS and security management. His blog “Security Warrior” was one of the most popular in the industry.

Detailed Presentation:

Take It to the Cloud: The Evolution of Security Architecture

As companies evolve their IT stack, traditional security approaches/architectures need to be reconsidered. This session will review some of the new risks introduced by SaaS/IaaS adoption and show how to mitigate these risks using new approaches to security architecture. Presenters will also review the transition of security architecture itself to the cloud.

Speakers

Dana Wolf ( @dayowolf )

Dana Wolf is the Sr. Director for Products at OpenDNS (now a part of Cisco). Previously she was Director of Products at Rapid7, responsible for product development of Nexpose, Metasploit and ControlsInsight. Prior to Rapid7 Wolf worked at RSA as a Director of New and Advanced Development for the Office of the CTO. She was responsible for developing new security technologies and business opportunities in the areas of virtualization security, hardware root of trust, advanced security operations and GRC. She also managed CTO operations and RSA’s advanced development engineering team. She joined RSA in 2004 as a principal software architect and served two years as an Entrepreneur in Residence at RSA for her graduate school work on payment card security.

Detailed Presentation:

*We suggest you use Chrome to view the slides, as the it may be inaccessible on other browsers like safari etc.

The Cyber Defense Matrix enables organizations to define clear categories for the range of products and services that are available in the marketplace to solve our various infosec problems. This model removes confusion around the security technologies that we buy and helps organizations align their vendors to have the right suite of capabilities to execute their information security mission.

Speakers

Sounil Yu ( @sounilyu )

Sounil Yu is a Christian, husband and father with over 30 years of hands-on experience creating, breaking and fixing computer and network systems. As the Exec Director for Security Innovation at a major financial institution, he leads teams to execute innovation initiatives and crazy experiments that reduce risk and tackle hard challenges in infosec. Previously, he helped improve infosec at several institutions spanning from Fortune 100 companies with three letters on the stock exchange to secretive three letter agencies that are not. Although on occasion he is forced to write about himself in the third person, he would rather meet people in person to share experiences rather than writing it up in a short bio. He lives in Virginia with his wife and their four homeschooled children.

Detailed Presentation:

Security Program Development for the Hipster Company

Cloud services have evolved and can now replace nearly every facet of traditional infrastructure. This movement has enabled rapid scale while introducing a considerable element of risk. This session will discuss a framework for getting started building a security program in an organization that is built purely on cloud services, covering the contradictions and opportunities of that business model.

Speakers

Robert Wood ( @robertwood50 )

Robert Wood runs the security team at Nuna Health. Coming originally from a consulting background, Wood has experience with threat modeling, red teaming, incident response, static analysis and penetration testing, having been engaged in these capacities across many industries and business types. His background, coupled with a keen interest in cloud security, has enabled Wood to build and execute a strategy and a team at Nuna Health that is aimed at protecting and managing the risk around it’s core assets. Prior to joining Nuna Health, Wood was a Principal Consultant at Cigital where he founded and led the red team assessment practice and worked with strategic clients across the United States in an advisory capacity.

Detailed Presentation:

Designing Virtual Network Security Architectures

With the advent of virtualization and software-defined networking (SDN), the nature and design of today’s networks are changing rapidly. Network security models need to adapt to the virtual data center, and there are a plethora of new technologies that can help security and operations teams design scalable network security architectures that work in highly virtualized environments.

Speakers

Dave Shackleford ( @daveshackleford ) 

Dave Shackleford is Lead Faculty at IANS, Owner and Principal Consultant at Voodoo Security and a SANS Senior Instructor and Course Author. He has consulted with hundreds of organizations in the areas of security, compliance and network architecture and engineering, and is a VMware vExpert with extensive experience designing and configuring secure virtualized infrastructures. He previously worked as CTO at IANS, CSO for Configuresoft, CTO for the Center for Internet Security, and as a security architect, analyst, and manager for several Fortune 500 companies. Shackleford is the author of Virtualization Security: Protecting Virtualized Environments, currently serves on the Board of Directors at the SANS Technology Institute and helps lead the Atlanta chapter of the Cloud Security Alliance. 

Detailed Presentation:

*We suggest you use Chrome to view the slides, as the it may be inaccessible on other browsers like safari etc.

Preserving the Privilege during Breach Response 

When companies hire cybersecurity consultants to investigate incidents, those professionals’ reports and emails could be used against the company in court unless a privilege applies. This session provides an overview of the attorney-client privilege for post-breach investigations, and tips for increasing the chances that the privilege will apply and the data will remain confidential.

Speakers

Jeff Kosseff ( @jkosseff ) 

Jeff Kosseff is an Assistant Professor of Cybersecurity Law at the United States Naval Academy. He practiced cybersecurity and privacy law at Covington & Burling, and clerked for Judge Milan D. Smith, Jr. of the U.S. Court of Appeals for the Ninth Circuit and for Judge Leonie M. Brinkema of the U.S. District Court for the Eastern District of Virginia. Kosseff is a graduate of Georgetown University Law Center and the University of Michigan. Before becoming a lawyer, he was a journalist for The Oregonian and was a finalist for the Pulitzer Prize for national reporting.

Detailed Presentation:

Integrated Security Operations Center (ISOC) for Cybersecurity Collaboration

This session will present a real case study of methodology and advanced cybersecurity tools used along with important tips and lessons learned on implementing an ISOC project at the second largest city of the nation. Topics include the critical success factors, advanced tools and technologies for ISOC, Situational Awareness, Threat Intelligence Sharing and cybersecurity collaboration.

Speakers

Timothy Lee ( @tswlj316 )

Timothy Lee is the Chief Information Security Officer at the City of Los Angeles. He is responsible for overall cybersecurity policies and initiatives for America’s second largest city. One of those initiatives is the City’s first Integrated Security Operations Center (ISOC). His work affects all 40 City of Los Angeles departments. Prior to his current position, Lee was the CISO at the Port of Los Angeles where he established the Port’s cybersecurity program and was the project manager for the Cyber Security Operations Center (CSOC), which won the 2015 American Association of Port Authorities IT Award of Excellence. He has a total of 20 years of experience in information security, network and telecommunication field and has spoken at several conferences.

Detailed Presentation:

Cloud Security Essentials 2.0 Full Stack Hacking & Recovery

Here's an overview of the presentation: A Basic Introduction – Cloud Hack Lab Attack; Harness, Enumeration and Testing Tools Cloud; Forensics at Scale; Opportunities for Tools

Speakers

Shannon LIetz ( @devsecops ); Javier Godinez

Detailed Presentation:

Wireless Infusion Pumps: Securing Hospitals’ Most Ubiquitous Medical Device

Imagine being dependent on a wireless infusion pump to receive the correct dosage of life-supporting medication. Now imagine the implications, were that pump to be maliciously hacked. In this session learn more about how to successfully secure these medical devices, based on work being conducted at the National Cybersecurity Center of Excellence (NCCoE) with premier health care organizations.

Speakers

Nathan Lesser ( @natelsr )

Nathan Lesser, Deputy Director of the National Cybersecurity Center of Excellence (NCCoE) at NIST, has over 15 years of experience in technical and leadership roles. Nate oversees the NCCoE’s engineering initiative and is responsible for cultivating collaboration across government, business, and technology companies to address cybersecurity issues within and across industry sectors. Previously, Nate led a team of cybersecurity engineers at Booz Allen Hamilton, served in the Office of Management and Budget, and the Senate’s Homeland Security and Governmental Affairs Committee. Nate holds bachelor’s and master’s degrees in electrical engineering from Columbia University, and is currently a Senior Fellow at the George Washington University Center for Cyber and Homeland Security.

Detailed Presentation:

How to Analyze an Android Bot

This presentation will demonstrate a complete end-to-end analysis of an Android bot. This will include the decompilation and static analysis of bot code and the dynamic analysis of the bot’s behavior in a controlled sandboxed environment. The session will provide details of the lab environment and tools used for the analysis.

Speakers

Kevin McNamee ( @KevMcNamee )

Kevin McNamee is Director of Alcatel-Lucent’s Motive Security Labs and is responsible for the security research team that supports the ALU’s cloud based malware detection system. Previously he was Director of Security Research at Alcatel-Lucent’s Bell Labs specializing in the analysis of malware propagation and detection. He has recently presented at BlackHat, RSA, (ISC)2 and SECTOR.

Detailed Presentation:

Building an Android Scale Incident Response Process

The Android ecosystem has over one billion active devices from hundreds of OEMs and carrier networks. The Android Security Team will explain how the ecosystem is able to respond quickly and effectively to security incidents. This will be part historical analysis of actual incidents, such as the Stagefright vulnerabilities, and part data-focused analysis of technology and processes we developed.

Speakers

Adrian Ludwig 

Adrian Ludwig is the Lead Engineer for Android security at Google. In this role, he is responsible for the security of the Android platform and Google’s applications and services for Android. Prior to joining Google, Ludwig held technical leadership positions at Joyent, Adobe, Macromedia, @stake and the Department of Defense. Ludwig has a B.A. in mathematics from Williams College and an MBA from the University of California, Berkeley.

Detailed Presentation:

Finding Triggered Malice in Android Apps

Traditional techniques to detect malice in Android apps struggle to identify trigger-based changes to application logic. Unfortunately, such triggers are a key component of targeted malware, where the trigger is the mechanism that ensures that the code is only executed at the target. This talk will review how static analysis can be used to detect and leverage triggers for more robust detection.

Speakers

Christopher Kruegel ( @lastlinelabs ) 

Currently on leave from his position as Professor of Computer Science at UC Santa Barbara, Christopher Kruegel’s research interests focus on computer and communications security, with an emphasis on malware analysis and detection, web security and intrusion detection. Kruegel previously served on the faculty of the Technical University Vienna, Austria. He has published more than 100 peer-reviewed papers in top computer security conferences and has been the recipient of the NSF CAREER Award, MIT Technology Review TR35 Award for young innovators, IBM Faculty Award and several best paper awards. He regularly serves on program committees of leading computer security conferences and speaks at industry events such as Black Hat and RSAC.

Detailed Presentation:

The State of End-User Security—Global Data from 30,000+ Websites

We live in a rapidly changing environment. Mobile commerce is skyrocketing, browsers/OS are changing, web applications enable increasing functionality—yet the only thing that seems constant is the amount of flaws and vulnerabilities we find in these software components. Using data from more than 30,000 websites, this session will explore the state of security ecosystem and myths and assumptions.

Speakers

Andreas Baumhof ( @abaumhof )

Andreas Baumhof, Chief Technology Officer, ThreatMetrix, is an internationally renowned cybersecurity thought leader and expert with deep experience in the encryption, PKI, malware and phishing markets. Prior to ThreatMetrix, Baumhof was an Executive Director, CEO and Co-founder of Australian-based TrustDefender, a leading provider of security and fraud detection technologies. Baumhof previously served as Co-founder and Chief Technology Officer of Microdasys Inc., a leading provider of deep content security solutions. While there, he developed the first SSL proxy and has patents pending in Europe and the U.S. Baumhof holds a degree in mathematics and computer science from the University of Munich, Germany.

Detailed Presentation:

Android Serialization Vulnerabilities Revisited

This session is about Android Serialization vulnerabilities. We revisit two vulns found in Android (CVE-2014-7911, CVE-2015-3837) which allowed for privilege escalation. We also present vulns found in third-party SDKs (CVE-2015-2000/1/2/3/4/20) which allowed for arbitrary code execution in apps which used them. But what has been done to prevent similar vulns? The session will answer this question.

Speakers

Roee Hay ( @roeehay )

X-Force Application Security Research Team Lead, IBM

Roee Hay leads the X-Force Application Security Research Team in IBM Security. His team focuses on discovering new vulnerabilities and has published dozens of papers or advisories in the past, including several ones in Android.

Detailed Presentation:

Hacking Exposed: The Mac Attack

Windows attacks receive all the attention. However, Mac and Linux have gained in popularity with the adversary. This session will focus on common Mac attack vectors and other cross-platform hacks that are typically seen in enterprise intrusions. We will also cover practical counter measures to make these alternate platforms more resilient.

Speakers

Dmitri Alperovitch ( @DAlperovitch ); George Kurtz ( @George_Kurtz ) 

Dmitri Alperovitch is the Co-founder and CTO of CrowdStrike Inc., leading its Intelligence, Technology and CrowdStrike Labs teams. A renowned computer security researcher, he is a thought-leader on cybersecurity policies and state tradecraft. Prior to founding CrowdStrike, Alperovitch was a Vice President of Threat Research at McAfee, where he led the company’s global Internet threat intelligence analysis and investigations. In 2010 and 2011, Alperovitch led the global team that investigated and brought to light Operation Aurora, Night Dragon and Shady RAT groundbreaking cyberespionage intrusions and gave those incidents their names.

George Kurtz, President/CEO and Co-founder of CrowdStrike, former CEO/Founder, Foundstone, and former Executive Vice President and worldwide CTO of McAfee, is an internationally recognized security expert, author and entrepreneur. Kurtz holds a B.S. degree from Seton Hall University. He also holds several industry designations, including Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA) and Certified Public Accountant (CPA). Kurtz also authored the best-selling security book of all time, Hacking Exposed: Network Security Secrets & Solutions.

Detailed Presentation:

What IT Professionals Need to Know about Sniffing Wireless Traffic in 2016

Next generation wireless standards define MU-MIMO, which promises 4x capacity gains. This session compares different multi-antenna technologies (SM, STBC, BF, MU-MIMO). It describes the subtle mistakes wireless security experts make sniffing wireless traffic. It explains how MU-MIMO introduces new challenges in capturing wireless traffic, which could make wireless sniffing near impossible.

Speaker

Avril Salter (@avrilsalterUSA)

Wireless Implementation Architect, Salter & Associates

Dr. Avril Salter is an author and a world-renowned specialist in wireless deployments. She has over 20 years of experience in both the wireless and computer industries. She has held executive and technical positions at small startups and major corporations, including IBM, Intel, Microsoft, Motorola and Sprint. Salter played key roles in making first GSM phone call in Frankfurt in 1991, the first CDMA deployment in Hong Kong, and the roll-out of WiMAX in China and the United States. She has worked extensively on the highly successful 802.11 Wi-Fi technology, and is a Cisco CCNP Wireless and CCNA Security certified. Salter received her Ph.D. in engineering from the University of Reading, UK. She currently resides in California.

Detailed Presentation

Hacking Exposed: The Mac Attack

Windows attacks receive all the attention. However, Mac and Linux have gained in popularity with the adversary. This session will focus on common Mac attack vectors and other cross-platform hacks that are typically seen in enterprise intrusions. We will also cover practical counter measures to make these alternate platforms more resilient.

Speaker

Dmitri Alpxrovitch ( @DAlperovitch ); George Kurtz ( @George_Kurtz )

Co-Founder & CTO, CrowdStrike

Dmitri Alperovitch is the Co-founder and CTO of CrowdStrike Inc., leading its Intelligence, Technology and CrowdStrike Labs teams. A renowned computer security researcher, he is a thought-leader on cybersecurity policies and state tradecraft. Prior to founding CrowdStrike, Alperovitch was a Vice President of Threat Research at McAfee, where he led the company’s global Internet threat intelligence analysis and investigations. In 2010 and 2011, Alperovitch led the global team that investigated and brought to light Operation Aurora, Night Dragon and Shady RAT groundbreaking cyberespionage intrusions and gave those incidents their names.

George Kurtz, President/CEO and Co-founder of CrowdStrike, former CEO/Founder, Foundstone, and former Executive Vice President and worldwide CTO of McAfee, is an internationally recognized security expert, author and entrepreneur. Kurtz holds a B.S. degree from Seton Hall University. He also holds several industry designations, including Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA) and Certified Public Accountant (CPA). Kurtz also authored the best-selling security book of all time, Hacking Exposed: Network Security Secrets & Solutions.

Detailed Presentation

Hacking Exposed LIVE: Attacking in the Shadows

Attackers have found compromise trivial for decades. But as additional security layers get deployed and next generation solutions come to market, attackers are turning to old and new techniques for bypassing security controls to launch their attacks and stay hidden. This session will explore the latest techniques and how simple defense techniques can foil even the most sophisticated attacks.

Speaker

Stuart McClure (@stuartmcclure)

Stuart McClure leads Cylance as its CEO and visionary for the first math based approach to threat detection, protection and response. Prior to Cylance, McClure was EVP, Global CTO and General Manager at McAfee/Intel. He is the creator and lead author of the most successful security book of all time, “Hacking Exposed.” He is widely recognized for his extensive and in-depth knowledge of security, and is one of the industry's leading authorities in information security today.

Detailed Presentation

Sophisticated Attacks vs. Advanced Persistent Security

It appears that any successful attack these days is labeled, Sophisticated. The implication is that the attacks were unpreventable. The reality is very different. We dissect recent attacks, and then go through how they could have been prevented. Advanced Persistent Security principles are applied to demonstrate how even successful breaches can be contained to significantly reduce loss.

Speaker

Araceli Gomes (@sleepdeficit); Ira Winkler (@irawinkler)

Subject Matter Expert-Intelligence and Investigations, Dell SecureWorks

Araceli Treu Gomes is Co-host of The Irari Report and serves as a Cybersecurity Strategist and Subject Matter Expert for Dell SecureWorks, counseling global organizations on preventing advanced attacks. Previously, she held technical and leadership positions, including Strategic Security Advisor for a Fortune 100 company, Engineering Director at a large defense contractor, Deputy CSO for a multinational financial services organization, and Chief Security and Privacy Officer at a major content delivery network. She designed early DDoS, extrusion prevention and network forensics tools for Internet backbone providers. She holds certifications in privacy and computer forensics, and serves on IEEE Cybersecurity SIGs and ISSA boards locally and nationally.

President, Secure Mentem

Ira Winkler, CISSP, is President of Secure Mentem and Co-host of The Irari Report. He is considered one of the world’s most influential security professionals, and has been named a “Modern Day James Bond” by the media. He did this by performing espionage simulations, where he physically and technically “broke into” some of the largest companies in the world, investigating crimes against them and telling them how to cost effectively protect their information and computer infrastructure. He assists organizations in developing cost effective security programs. He also won the Hall of Fame award from the ISSA, as well as several other prestigious industry awards. Most recently, CSO Magazine named him a CSO Compass Award winner as “The Awareness Crusader.” 

Detailed Presentation