Loading…

Sign up or log in to bookmark your favorites and sync them to your phone or calendar.

Tuesday, May 14
 

8:30am

Everything You Need To Know About Web, API and Mobile Secure Coding [Day 1 of 2]
Everything You Need To Know About Web, API and Mobile Secure Coding

Instructor: Jim Manico

Bio: 
Jim Manico is the founder of Manicode Security where he trains software developers on secure coding and security engineering. He is an a investor/advisor for Signal Sciences and BitDiscovery. Jim is also a frequent speaker on secure software practices, is a member of the JavaOne Rock Stars and Java Champion community and is the author of "Iron-Clad Java: Building Secure Web Applications" from McGraw-Hill and Oracle Press. Jim also volunteers for the OWASP foundation where he helps build application security standards and other documentation.

Description:
The major cause of web service, mobile and web application insecurity is insecure software development practices. This highly intensive and interactive 2-day course provides essential application security training for web application, mobile and web service developers and architects.

The class is a combination of lecture, security testing demonstration and code review. Students will learn the most common threats against applications. More importantly, students will learn how to code secure web and mobile solutions via defense-based code samples.

As part of this course, we will explore the use of third-party security libraries and frameworks to speed and standardize secure development. We will highlight production quality and scalable controls from various languages and frameworks. This course will include secure coding information for Java, Swift, Objective C, PHP, Python, Javascript and .NET programmers, but any software developer building web applications and web services will benefit.

Student Requirements:
Familiarity with the technical details of building web applications, mobile and web services from a software engineering point of view.

Laptop Requirements:
Any laptop that can run an updated web browser and "Burp Community Edition".

Day 1 of the course will focus on web application basics.

- Introduction to Application Security
- HTTP Security Basics
- CORS and HTML5 Considerations
- XSS Defense
- Content Security Policy
- Intro to Angular.JS Security
- Intro to React.JS Security
- SQL and other Injection
- Cross Site Request Forgery
- File Upload and File IO Security
- Deserialization Security
- Input Validation Basics
- OWASP Top Ten 2017
- OWASP ASVS

Day 2 of the course will focus on API secure coding, Identity and Mobile Security

- Web service, Microservice and REST Security
- Authentication and Session Management
- Access Control Design
- OAuth 2 Security
- OpenID Connect Security
- iOS Secure Coding
- Android Secure Coding
- 3rd Party Library Security Management
- Application Layer Intrusion Detection

Speakers
avatar for Jim Manico

Jim Manico

Founder, Manicode Security
Jim Manico is the founder of Manicode Security where he trains software developers on secure coding and security engineering. He is also an investor/advisor for KSOC, Nucleus Security, Signal Sciences, Secure Circle and BitDiscovery. Jim is a frequent speaker on secure software practices... Read More →


Tuesday May 14, 2019 8:30am - 4:30pm
Garden Terrace

8:30am

Foundational Skills for Effective IT Security [Day 1 of 2]
So, You Want to Be a Cyber Security Consultant?
This course will review the things that are missing in many of the people who want to become a computer security consultant. Many people start off at the Application Layer (layer 7), in this Course we will discuss the importance of establishing a solid security foundation; we will look at the three main components to build this foundation. Those are:
  • TCP/IP
  • Unix/Linux
  • Virtualization
During the course we will discuss mastering the power of the command line and the importance of understanding the traffic at the lowest level … the packet!  We will also look at some simple but important protocol analysis techniques.

The course was developed to provide those entering the fascinating world of computer security consulting, a foundation prior to embarking on this journey. The more solid foundation of skills you have the better you will be prepared as a consultant or security professional.

Speakers
avatar for Kevin Cardwell

Kevin Cardwell

President, Cyber2Labs
No matter how much “security” is put in place, the reality is we are running our data on protocols that were developed many years ago when the Internet was small and as a result of this, these protocols are based on the principle of trust; therefore, to truly defend we need to... Read More →


Tuesday May 14, 2019 8:30am - 5:00pm
Club Room

8:30am

Real World Web Application Hacking [Day 1 of 2]
Title: Real World Web Application Hacking

This training lasts: 2 Days

Course Abstract
This training course was custom developed to put you right into the action and simulate real world web attacks.  On day one of the course, you'll be hired to perform a penetration test against a BitCon Exchange.  You'll go through the Hacker Playbook methodology to perform both basic and advanced attacks.  On day two of the course, you'll focus on newer attacks and frameworks.  In recent years, we have seen a number of new languages and frameworks such as NodeJS/Express.  With these new technologies come both old and new vulnerabilities.  You'll be tasked to attack a Node Chat Application and understand why you can't use generic attacks against these new frameworks.
This isn't your average web app course!  We built the labs around what we are seeing as penetration testers and bug bounty hunters.

Course Objectives:
Perform and understand both common and advanced web attacks
Learn how bug bounty hunters perform quick and effective reconnaissance
Manually attack applications with and without the use of tools
Fuzz inputs for potential injection points
Find critical vulnerabilities in applications
Understand vulnerabilities in newer languages/frameworks such as NodeJS and Express
 
Training Syllabus
Day 1  - Primer
Recon/Spidering
Attacking XSS, Polyglots, and Blind XSS
Cross-Site Request Forgery
Integer Underflows
Insecure Direct Object Reference
Local File Inclusions and Server Side Request Forgery
Manual SQL Injections
Remote Code Execute with Images
Day 2  - Advanced Attacks
XML eXternal Entities (XXE) and OOB
DOM XSS
Deserialization Attacks
NoSQL
Template Injection
Node.JS Attacks
Cloud Issues
 
Upon Completion of this training, attendees will know:
How to perform a web application penetration test
How to use proxy tools such as Burp Suite
How to manually identify vulnerabilities
How to become a bug bounty hunter
How to protect your own web applications from attackers
Attendees will be provided with (by trainer):
A signed copy of The Hacker Playbook 3!
Custom Virtual Machines
Lab Material PDF
 
Attendees should bring:
Laptop with administrator access
Laptop with network connectivity and dongles
Laptop capable of running two virtual machines simultaneously using either VMware Workstation or Player or Fusion (for OS X)
Laptop with 30GB of free disk spaces
You must have ability to disable the host firewall (Windows firewall or other third party firewall) and antivirus running on your desktop...
A passion to learn!
Pre-requisites for attendees:
Basic security concepts
Basic GNU/Linux command line
Understanding of how web protocols communicate
 
Trainer biography
Peter Kim has been in the information security industry for the last 15 years and been a penetration tester/red teamer for the last 12 years.  During this time he worked for multiple utility companies, Fortune 1000 entertainment companies, government agencies, and the Federal Reserve.  He gives back to the security community by teaching penetration testing courses at the community college and creating/maintaining one of the largest security communities in the Southern CA area (meetup.com/LETHAL).  He is the best-selling author of three offensive security books, The Hacker Playbook 1, 2& 3.  He has also spoken and trained at multiple security conferences including Toorcon, Derbycon, ISSA, OWASP AppSec, LETHAL, and Baythreat.

Speakers
avatar for Peter Kim

Peter Kim

CEO, Secure Planet
Peter Kim has been in the information security industry for the last 15 years and been a penetration tester/red teamer for the last 12 years.   During this time was a penetration tester/red teamer for multiple utility companies, Fortune 1000 entertainment companies, government agencies... Read More →


Tuesday May 14, 2019 8:30am - 5:00pm
Terrace Lounge

8:30am

Splunk Introductory Class [Day 1 of 1]
Who should attend: Those new to Splunk (less than 6 months) or not yet using Splunk for security
 
Pre-requisites:
A basic understanding of Splunk and security data sources.  It is recommended that attendees take the Splunk Fundamentals I online learning courses to get familiar with Splunk.  Attendees must bring a laptop. 
 
Workshop Description:
Morning: This workshop teaches you how to search and navigate in Splunk, use fields, get statistics from your data, create reports, dashboards, lookups, and alerts. Scenario-based examples and hands-on challenges will enable you to create robust searches, reports, and charts.  The workshop will
  • Reinforce the basics
  • Present a more advanced approach to searching, analyzing and reporting on data
  • Empower users by working in a real, live Splunk environment

Afternoon: This workshop will introduce you to using Splunk software to investigate different types of activity—including login, endpoint and network events. You’ll learn how to:
  • Identify whether login activity may be malicious
  • Find malware infections and their scope and impact (how far did it spread, how to contain it)
  • Understand where and how an attacker entered your network and how to remediate the threat
  • Use essential Splunk commands and key apps


Speakers

Tuesday May 14, 2019 8:30am - 5:00pm
Marion Davis Guest House Veranda Room
 
Wednesday, May 15
 

8:30am

Everything You Need To Know About Web, API and Mobile Secure Coding [Day 2 of 2]
Everything You Need To Know About Web, API and Mobile Secure Coding

Instructor: Jim Manico

Bio: 
Jim Manico is the founder of Manicode Security where he trains software developers on secure coding and security engineering. He is an a investor/advisor for Signal Sciences and BitDiscovery. Jim is also a frequent speaker on secure software practices, is a member of the JavaOne Rock Stars and Java Champion community and is the author of "Iron-Clad Java: Building Secure Web Applications" from McGraw-Hill and Oracle Press. Jim also volunteers for the OWASP foundation where he helps build application security standards and other documentation.

Description:
The major cause of web service, mobile and web application insecurity is insecure software development practices. This highly intensive and interactive 2-day course provides essential application security training for web application, mobile and web service developers and architects.

The class is a combination of lecture, security testing demonstration and code review. Students will learn the most common threats against applications. More importantly, students will learn how to code secure web and mobile solutions via defense-based code samples.

As part of this course, we will explore the use of third-party security libraries and frameworks to speed and standardize secure development. We will highlight production quality and scalable controls from various languages and frameworks. This course will include secure coding information for Java, Swift, Objective C, PHP, Python, Javascript and .NET programmers, but any software developer building web applications and web services will benefit.

Student Requirements:
Familiarity with the technical details of building web applications, mobile and web services from a software engineering point of view.

Laptop Requirements:
Any laptop that can run an updated web browser and "Burp Community Edition".

Day 1 of the course will focus on web application basics.

- Introduction to Application Security
- HTTP Security Basics
- CORS and HTML5 Considerations
- XSS Defense
- Content Security Policy
- Intro to Angular.JS Security
- Intro to React.JS Security
- SQL and other Injection
- Cross Site Request Forgery
- File Upload and File IO Security
- Deserialization Security
- Input Validation Basics
- OWASP Top Ten 2017
- OWASP ASVS

Day 2 of the course will focus on API secure coding, Identity and Mobile Security

- Web service, Microservice and REST Security
- Authentication and Session Management
- Access Control Design
- OAuth 2 Security
- OpenID Connect Security
- iOS Secure Coding
- Android Secure Coding
- 3rd Party Library Security Management
- Application Layer Intrusion Detection

Speakers
avatar for Jim Manico

Jim Manico

Founder, Manicode Security
Jim Manico is the founder of Manicode Security where he trains software developers on secure coding and security engineering. He is also an investor/advisor for KSOC, Nucleus Security, Signal Sciences, Secure Circle and BitDiscovery. Jim is a frequent speaker on secure software practices... Read More →


Wednesday May 15, 2019 8:30am - 4:30pm
Garden Terrace

8:30am

Foundational Skills for Effective IT Security [Day 2 of 2]
So, You Want to Be a Cyber Security Consultant?
This course will review the things that are missing in many of the people who want to become a computer security consultant. Many people start off at the Application Layer (layer 7), in this Course we will discuss the importance of establishing a solid security foundation; we will look at the three main components to build this foundation. Those are:
  • TCP/IP
  • Unix/Linux
  • Virtualization
During the course we will discuss mastering the power of the command line and the importance of understanding the traffic at the lowest level … the packet!  We will also look at some simple but important protocol analysis techniques.

The course was developed to provide those entering the fascinating world of computer security consulting, a foundation prior to embarking on this journey. The more solid foundation of skills you have the better you will be prepared as a consultant or security professional.

Speakers
avatar for Kevin Cardwell

Kevin Cardwell

President, Cyber2Labs
No matter how much “security” is put in place, the reality is we are running our data on protocols that were developed many years ago when the Internet was small and as a result of this, these protocols are based on the principle of trust; therefore, to truly defend we need to... Read More →


Wednesday May 15, 2019 8:30am - 5:00pm
Club Room

8:30am

Real World Web Application Hacking [Day 2 of 2]
Title: Real World Web Application Hacking

This training lasts: 2 Days

Course Abstract
This training course was custom developed to put you right into the action and simulate real world web attacks.  On day one of the course, you'll be hired to perform a penetration test against a BitCon Exchange.  You'll go through the Hacker Playbook methodology to perform both basic and advanced attacks.  On day two of the course, you'll focus on newer attacks and frameworks.  In recent years, we have seen a number of new languages and frameworks such as NodeJS/Express.  With these new technologies come both old and new vulnerabilities.  You'll be tasked to attack a Node Chat Application and understand why you can't use generic attacks against these new frameworks.
This isn't your average web app course!  We built the labs around what we are seeing as penetration testers and bug bounty hunters.

Course Objectives:
Perform and understand both common and advanced web attacks
Learn how bug bounty hunters perform quick and effective reconnaissance
Manually attack applications with and without the use of tools
Fuzz inputs for potential injection points
Find critical vulnerabilities in applications
Understand vulnerabilities in newer languages/frameworks such as NodeJS and Express
 
Training Syllabus
Day 1  - Primer
Recon/Spidering
Attacking XSS, Polyglots, and Blind XSS
Cross-Site Request Forgery
Integer Underflows
Insecure Direct Object Reference
Local File Inclusions and Server Side Request Forgery
Manual SQL Injections
Remote Code Execute with Images
Day 2  - Advanced Attacks
XML eXternal Entities (XXE) and OOB
DOM XSS
Deserialization Attacks
NoSQL
Template Injection
Node.JS Attacks
Cloud Issues
 
Upon Completion of this training, attendees will know:
How to perform a web application penetration test
How to use proxy tools such as Burp Suite
How to manually identify vulnerabilities
How to become a bug bounty hunter
How to protect your own web applications from attackers
Attendees will be provided with (by trainer):
A signed copy of The Hacker Playbook 3!
Custom Virtual Machines
Lab Material PDF
 
Attendees should bring:
Laptop with administrator access
Laptop with network connectivity and dongles
Laptop capable of running two virtual machines simultaneously using either VMware Workstation or Player or Fusion (for OS X)
Laptop with 30GB of free disk spaces
You must have ability to disable the host firewall (Windows firewall or other third party firewall) and antivirus running on your desktop...
A passion to learn!
Pre-requisites for attendees:
Basic security concepts
Basic GNU/Linux command line
Understanding of how web protocols communicate
 
Trainer biography
Peter Kim has been in the information security industry for the last 15 years and been a penetration tester/red teamer for the last 12 years.  During this time he worked for multiple utility companies, Fortune 1000 entertainment companies, government agencies, and the Federal Reserve.  He gives back to the security community by teaching penetration testing courses at the community college and creating/maintaining one of the largest security communities in the Southern CA area (meetup.com/LETHAL).  He is the best-selling author of three offensive security books, The Hacker Playbook 1, 2& 3.  He has also spoken and trained at multiple security conferences including Toorcon, Derbycon, ISSA, OWASP AppSec, LETHAL, and Baythreat.

Speakers
avatar for Peter Kim

Peter Kim

CEO, Secure Planet
Peter Kim has been in the information security industry for the last 15 years and been a penetration tester/red teamer for the last 12 years.   During this time was a penetration tester/red teamer for multiple utility companies, Fortune 1000 entertainment companies, government agencies... Read More →


Wednesday May 15, 2019 8:30am - 5:00pm
Terrace Lounge

8:30am

Splunk Intermediate Training Class - Threat Hunting Using Splunk [Day 1 of 1]
May 15, 2019 – Threat Hunting Using Splunk
 
Who should attend:  This workshop is designed to provide thought leadership and hands on experience of threat hunting using Splunk. The workshop is designed for  attendees who have a basic understanding of Splunk.

Pre-requisites:
A basic understanding of Splunk and security data sources.  It is recommended that attendees take the Splunk Fundamentals I online learning courses to get familiar with Splunk.  Attendees must bring a laptop.
 
Workshop Description:
The Threat Hunting Security Workshop is a hands-on workshop that guides attendees through the basics of threat hunting using Splunk. We walk through a scenario where we identify a security campaign targeting an organization, followed by a discussion of how to integrate the following techniques and data sources into a security practice. This workshop is designed to provide thought leadership and hands on experience of threat hunting using Splunk. You’ll learn how to:
  • Threat hunting basics
  • Threat hunting data sources
  • Know your endpoint
  • Cyber Kill Chain
  • Walkthrough of Attack Scenario Using Core Splunk (hands on)
  • Advanced Threat Hunting Techniques & Tools
  • Splunk Enterprise Security Walkthrough
  • Applying Machine Learning and Data Science to Security


Speakers

Wednesday May 15, 2019 8:30am - 5:00pm
Marion Davies Guest House Veranda Room North
 
Thursday, May 16
 

7:45am

Registration and Breakfast
Please visit our Sponsors, without whose help our Summit would not be possible.

Thursday May 16, 2019 7:45am - 8:35am
Pool Deck

8:35am

Welcome Address
Speakers
avatar for Richard Greenberg

Richard Greenberg

President, ISSA-LA
Richard Greenberg, CISSP, is the Summit Chair and serves on the OWASP Global Board of Directors. Previous positions include CISO, Director of Surveillance and Information Systems, Chief of Security Operations, Director of IT, and Project Manager for various companies/agencies in the... Read More →


Thursday May 16, 2019 8:35am - 8:55am
Sand and Sea Room

8:55am

9:00am

9:05am

9:10am

Keynote: #YOLO: Solving Authentication In The Age of Cloud
In today’s environment, people can be anywhere, using any device, accessing applications both in the cloud and in the datacenter. The temptation with such complexity is to say “trust no one,” but savvy consumers won’t stand for heavy-handed IT that slows them down just as business is becoming more agile. The #YOLO challenge -- You Only Login Once -- is the call to make trusted access easier, while maintaining or increasing security as needed.

Speakers
avatar for Wendy Nather

Wendy Nather

Head, Advisory CISOs, Duo Security at Cisco
Strategist, research director, former industry analyst and former CISO. 30+ years' technical experience in IT operations and security, including twelve years in the financial services industry and five years in state government. Specialties: Security program management, threat intelligence... Read More →


Thursday May 16, 2019 9:10am - 10:00am
Sand and Sea Room

10:00am

CTF Training and Competition-Hosted by Women’s Society of Cyberjutsu (WSC)
CTF4Noobz: CTF Workshop + Competition
Interested in cybersecurity competitions but don’t know where to start? Or have you tried one or two or 10 and want more practice? The Women’s Society in Cyberjutsu (WSC) invites those of all experience levels to join in on this training and competition. In this hands-on keys workshop, we will explore different types of competitions from Capture the Flag to offense/defense and everything in between. In addition, we will review various tools of the cyber trade. These will become part of your toolkit to solve cybersecurity competition challenges! We will explore techniques associated with reconnaissance, scanning and enumeration, and exploitation. Also featured will be forensic challenges, hash-cracking, binary analysis, crypto decoding, etc. The challenges are related to topics covered in the EC Council Certified Ethical Hacker (C|EH) certification.

Learning Objectives:
1: Grow information security skills.
2: Understand current abilities and areas of improvement.

Prerequisites:
Introductory to intermediate knowledge of information security concepts, tools and techniques. The challenges incorporate a broad spectrum of cyber-defense, digital forensics, and penetration testing comprehension and are designed for novice to advanced participants.


Participant Requirements:

  • A computer with at least 4 GB RAM (preferably 8 GB) and wireless network card.
  • Install VirtualBox for your OS.  Note: if you are using a different virtual machine player we will not be able to troubleshoot issues for you.
  • Download the Kali Linux VirtualBox image.  If you already have Kali you can skip this step. Import to VirtualBox.
Alternative Preparation:
Skip installing VirtualBox and Kali Linux and instead install stand-alone tools such as nmap, Wireshark, and FTK Imager. The nice thing about Kali is it already has most tools we will use built in.

Questions? Contact info@womenscyberjutsu.org

Speakers
avatar for Lisa Jiggetts

Lisa Jiggetts

Founder & President, Women's Society of Cyberjutsu
Lisa Jiggetts is the founder and CEO of the Women's Society of Cyberjutsu (WSC), one of the fastest growing nonprofits dedicated to women in cybersecurity. WSC provides women with the resources and support required to enter and advance as a cybersecurity professional. Her organization... Read More →


Thursday May 16, 2019 10:00am - 5:20pm
Marion Davies Guest House Parlor

10:10am

Law Enforcement Panel
The law enforcement panel consists of investigators and prosecutors whose day-to-day work involves apprehending cyber criminals who conduct various crimes including unlawful network intrusion, business email compromise, dark net sales of contraband, insider fraud, organized identity theft and the use of malware for criminal purposes.  The panelists will discuss case studies, best practices to prevent incidents, recommendations on working with Federal and State law enforcement, the emerging use of block chain and crypto currencies in crime and prosecuting overseas cyber criminals. The presentation is open to all conference attendees from the private and public sector.

Speakers
SB

Samuel (Brian) Whitman

Special Agent, FBI
avatar for Ryan White

Ryan White

Assistant United States Attorney, Chief, Cyber & Intellectual Property Crimes Section, US Attorney, Central District of California
Ryan White is an Assistant United States Attorney in the Central District of California, where he is Chief of the Cyber & Intellectual Property Crimes Section. White, and his team of eight federal prosecutors, investigate and prosecute cases involving national security, computer and... Read More →
avatar for Tracy Wilkison

Tracy Wilkison

First Assistant United States Attorney, California, Central District
Tracy Wilkison is the First Assistant United States Attorney for the Central District of California; she is the top career prosecutor in the district and supervises all four litigating divisions of the office. She previously served as the Executive Assistant United States attorney... Read More →
avatar for Bradley N. Maryman

Bradley N. Maryman

Founder, Maryman & Associates
Mr. Maryman is an experienced computer forensics and cyber investigations consultant. Prior to founding Maryman & Associates in 2001, he served as a Supervisory Special Agent with the Federal Bureau of Investigation (FBI) for over 29 years. During that time, Mr. Maryman conducted... Read More →


Thursday May 16, 2019 10:10am - 11:00am
Garden Terrace

10:10am

Data Protection in the Public Cloud—a look at the Good, the Bad, and the Ugly
Customers want to ensure that they can entrust their sensitive data to public cloud providers.  This often
leads to discussions with the cloud provider on various aspects of data protection, such as retention,
encryption, and key management. If encryption is not implemented properly it will not provide the
security assurance customers expect, resulting in misplaced trust. This talk will look at encryption at rest
in various layers of the application stack with a focus on the risks each type of encryption mitigates. We
will also look at various cloud-related key management schemes, including “bring your own key” (BYOK)
and cloud-based Hardware Security Modules (HSMs). Lastly, we will cover potential problems with
customer data-retention that should be explored with the cloud service provider.


Speakers
avatar for Kenneth G. Hartman

Kenneth G. Hartman

Associate Director - Cloud Products Security, Illumina
BioKenneth G. Hartman is a security engineering leader in Silicon Valley. Ken's motto is "I help my clients earn and maintain the trust of their customers." Ken is an Instructor for the SEC545 Cloud Security Operations course offered by the SANS Institute. Ken has worked for a variety... Read More →


Thursday May 16, 2019 10:10am - 11:00am
Club Room

10:10am

The OWASP Top Ten Proactive Controls 2018
Software developers are the foundation of any application. In order to achieve secure software, developers must be supported and helped by the organization they author code for. As software developers author code that makes up a web application, they need to embrace and practice a wide variety of secure coding techniques. The OWASP Top Ten Proactive Controls (2018) is an OWASP documentation project that lists critical security techniques that should be included in every software development project. This document was written by developers for developers to assist those new to secure development.

1) Define Security Requirements
2) Leverage Security Frameworks and Libraries
3) Secure Database Access
4) Encode and Escape Data
5) Validate All Inputs
6) Implement Digital Identity
7) Enforce Access Controls
8) Protect Data Everywhere
10) Handle All Errors and Exceptions

Speakers
avatar for Jim Manico

Jim Manico

Founder, Manicode Security
Jim Manico is the founder of Manicode Security where he trains software developers on secure coding and security engineering. He is also an investor/advisor for KSOC, Nucleus Security, Signal Sciences, Secure Circle and BitDiscovery. Jim is a frequent speaker on secure software practices... Read More →


Thursday May 16, 2019 10:10am - 11:00am
Sand and Sea Room

10:10am

Recent Data Breach Investigations and Attack Trends
This session will share insight from recent data breach investigations and attack trends. Wendi will
share stories behind the headlines to demonstrate how organizations are being attacked, whom is
attacking them, and how the attacks are mitigated and remediated. Wendi will discuss what
attendees can do to betters secure their organization and share industry and attacker specific
research.


Speakers
avatar for Wendi Whitmore

Wendi Whitmore

Global Partner and Director, IBM X-Force Threat Intelligence
Wendi Whitmore is a technical leader with over 15 years of experience in incident response and data breach investigations, strategic information security services, and threat intelligence analytics. At IBM, Wendi was instrumental in creating IBM X-Force IRIS which includes the global... Read More →


Thursday May 16, 2019 10:10am - 11:00am
Terrace Lounge

11:00am

Break
Please visit our Sponsors, without whose help our Summit would not be possible.

Thursday May 16, 2019 11:00am - 11:30am
Pool Deck

11:30am

Deception as a Defense: Confuse and Frustrate the Hackers
No product will make us secure, estimates are $80 Billion was spent in 2017 on cyber security products, yet we had many data breeches, we are losing the battle, so it is time for another approach. Organizations need to start with the foundations of defense in preparation for deploying deception and taking control of your networks.
No matter how much “security” is put in place, the reality is we are running our data on protocols that were developed many years ago when the Internet was small and as a result of this, these protocols are based on the principle of trust; therefore, to truly defend we need to modify these protocols. The concept is, if the protocols can be changed then the result of this will be frustration and confusion for the adversary. In this presentation advanced defensive concepts will be explored and the power of using deception at different layers of the network. The attacker depends on information that is gathered during their surveillance, and with deception we change the network at layer 2-4 and the result of this is the attacker’s collected data is no longer valid and useless for them, this requires the attacker to start the information gathering process over again. In a robust defensive solution, the network can change multiple times based on the classification of the threat, and each time it changes, the attacker is lost and has to start the recon process over again. These concepts change the game and puts the defender in control! We know our networks best and not the hackers!

Speakers
avatar for Kevin Cardwell

Kevin Cardwell

President, Cyber2Labs
No matter how much “security” is put in place, the reality is we are running our data on protocols that were developed many years ago when the Internet was small and as a result of this, these protocols are based on the principle of trust; therefore, to truly defend we need to... Read More →


Thursday May 16, 2019 11:30am - 12:20pm
Sand and Sea Room

11:30am

Enumerating the Enterprise Attack Surface
Many organizations have only a passing understanding of the scope of their application portfolios and how these assets are exposed to the Internet and other potentially dangerous networks. This puts them in a risky situation where they have attack surface that is unknown and unmanaged, often resulting in serious vulnerabilities being exposed indefinitely. This presentation looks at several tools and methods that can be used to enumerate enterprise application assets – including web applications, mobile applications, and web services. The discussion covers several open source application asset identification tools and compares their effectiveness. Finally, a framework for ongoing application asset discovery and enumeration is presented so that security managers can embark on a structured program to characterize their risk exposure due to their enterprise attack surface.

Speakers
avatar for Dan Cornell

Dan Cornell

Principal and Owner, Denim Group, Ltd.
A globally recognized application security expert, Dan Cornell holds over 15 years of experience architecting, developing and securing web-based software systems. As Chief Technology Officer and Principal at Denim Group, Ltd., he leads the technology team to help Fortune 500 companies... Read More →


Thursday May 16, 2019 11:30am - 12:20pm
Terrace Lounge

11:30am

Solving Cybersecurity Problems with NIST
You may already be familiar with the National Institute of Standards and Technology (NIST) for the famous Cybersecurity Framework. Join us for this review of the many resources beyond (and including) the framework that could help you develop new technologies, work in collaboration with industry colleagues in resolving shared problems, or develop better cybersecurity recruiting, training and management programs for your organization.  

Speakers
avatar for Harry Perper

Harry Perper

Chief Engineer, MITRE
Chief Engineer, The MITRE CorporationSenior Cybersecurity Engineer, National Cybersecurity Center of Excellence at NISTHarry Perper is a Chief Engineer for the MITRE Corporation, which operates NIST’s National Cybersecurity Federally Funded Research & Development Center (FFRDC... Read More →
avatar for Marian Merritt

Marian Merritt

Lead for Industry Engagement (NICE), NIST
Marian Merritt is the Lead for Industry Engagement for the National Initiative for Cybersecurity Education (NICE) at the National Institute of Standards and Technology (NIST). Marian has over 19 years of experience working in the cybersecurity industry. She previously was with Symantec... Read More →


Thursday May 16, 2019 11:30am - 12:20pm
Club Room

11:30am

Law Enforcement Panel: LA County DA, Sheriff, and FBI
The law enforcement panel consists of investigators and prosecutors whose day-to-day work involves apprehending cyber criminals who conduct various crimes including unlawful network intrusion, business email compromise, dark net sales of contraband, insider fraud, organized identity theft and the use of malware for criminal purposes.

The panelists will discuss case studies, best practices to prevent incidents, recommendations on working with Federal and State law enforcement, the emerging use of block chain and crypto currencies in crime and prosecuting overseas cyber criminals. The presentation is open to all conference attendees from the private and public sector.

Moderators
avatar for Marc Beaart

Marc Beaart

Assistant Head Deputy, Los Angeles District Attorney's Office - Cybercrime
Marc Beaart, a prosecutor with twenty-two years in the Los Angeles County District Attorney’s Office, is currently assigned to the Cyber Crime Division as the assistant head deputy. Before his current assignment, he served in several assignments including Compton, Central Trials... Read More →

Speakers
avatar for Senior Investigator McNary

Senior Investigator McNary

Cyber Crime Investigations Unit, LA County District Attorney
Senior Investigator McNary is a 30-year veteran of law enforcement in Los Angeles County. His first 11 years were with the Los Angeles County Sheriff’s Department. He has been an investigator with the District Attorney’s Office since 1999. Senior Investigator McNary is currently... Read More →
avatar for Sergeant Hish

Sergeant Hish

Sergeant, Los Angeles County Sheriff
Sergeant Hish is a 19-year veteran of the Los Angeles County Sheriff's Department. Before his career with the Sheriff's Department he served six years with the United States Army. During his tenure with the Army, Sergeant Hish was deployed to the Middle East in support of Operation... Read More →
avatar for John C. Weller

John C. Weller

Prosecuter, LA County DA Cyber Crime Division
John C. Weller earned his B.A from U.C. Berkeley and his Juris Doctor from Loyola Law School in Los Angeles. Weller has been a prosecutor with the Los Angeles County District Attorney’s Office for over ten years. He is currently assigned to the Cyber Crime Division. This is a specialized... Read More →


Thursday May 16, 2019 11:30am - 12:50pm
Garden Terrace

12:30pm

Benchmarks and Cost Analysis of Cloud-Based Password Cracking
And you may find yourself in control of a large database; in another part of the world. And you may find yourself in a beautiful table; viewing a beautiful hash. And you may ask yourself, well, how do I crack this?
 
Sometimes the need to crack a hash, password, file or document arises and your laptop or home machine simply won't cut it. When facing this challenge research will most likely conclude there are several options that may include utilizing a 3rd party, building a cracking rig or employing cloud-based solutions.
 
Leveraging Amazon AWS via Terraform, Ansible and more, this presentation kicks off with a live deployment of a multi-node, scalable cloud-based cracking setup using enough DevOps tools that will guarantee a winning buzzword bingo card.
 
While the cloud-based deployment is in progress we will discuss the pros and cons of the leading options including benchmarks comparing self-built rigs to cloud deployments and the economics of each. If the demo gods are kind, the presentation will conclude with several live demonstrations of cracking hashes, passwords and files in our newly provisioned cracking environment.
 
Attendees will walk away with an understanding of deployment tools and techniques, potential computational power and economic factors relating to the deployment of an extremely powerful, multi-node, cloud-based password cracking environment.

Speakers
avatar for Joe Luna

Joe Luna

Founder, Furtim, Inc
Joe Luna has over 20 years of Information Security experience in various operational and leadership roles where he has established a track record of managing complex, enterprise-wide initiatives to satisfy regulatory and business requirements while keeping the security posture of... Read More →


Thursday May 16, 2019 12:30pm - 12:50pm
Terrace Lounge

12:30pm

Lightning Talk - Exploiting Email Security
Phishing attacks are one of the most prevalent sources of malware affecting organizations. Many reputable reports have stated that between 80% and 90% of attacks start from spear phishing emails. Strong email security is the best means of protecting your organization from this, and there are a number of free, standards-based security measures that you can implement.





Speakers
avatar for Gary Landau

Gary Landau

Managing Principal, Global Security, Unisys
Gary Landau has been leading IT teams and security initiatives for over 25 years. For the past three years he has been a virtual CISO and Security Consulting Principal at Unisys. Prior to this he headed IT infrastructure and security teams at organizations such as Wilshire Associates... Read More →


Thursday May 16, 2019 12:30pm - 12:50pm
Sand and Sea Room

12:30pm

Lightning talk: Hacking the Human
Social Engineering (SE), aka Human Hacking can provide attack vectors against organizations and individuals alike. People can’t help but be people, and that’s why we’re “hackable”. Lisa will discuss what SE is, how its done, what can be done to protect against SE, and lastly, how one can do this as a profession or part of a pentest engagement.

Speakers
avatar for Lisa Jiggetts

Lisa Jiggetts

Founder & President, Women's Society of Cyberjutsu
Lisa Jiggetts is the founder and CEO of the Women's Society of Cyberjutsu (WSC), one of the fastest growing nonprofits dedicated to women in cybersecurity. WSC provides women with the resources and support required to enter and advance as a cybersecurity professional. Her organization... Read More →


Thursday May 16, 2019 12:30pm - 12:50pm
Club Room

12:50pm

Lunch and Vendor Expo
Please visit our Sponsors, without whose help our Summit would not be possible.

Thursday May 16, 2019 12:50pm - 1:35pm
Pool Deck

1:35pm

Symantec Lunchtime Spotlight Talk: 2019 Internet Security Threat Report (ISTR): The New Threat Landscape
2019 Internet Security Threat Report (ISTR): The New Threat Landscape
Join Symantec for a discussion on the key findings from Symantec’s Annual Internet Security Threat Report (ISTR). The report provides an overview of the threat landscape, including insights into global threat activity, cyber-crime trends and attack motivations.
The report analyzes data from the Symantec Global Intelligence Network, the largest civilian threat intelligence network in the world, recording events from 123 million attack sensors worldwide, blocking 142 million threats daily while monitoring threat activity in over 157 countries.
This presentation will highlight key findings from the report including:
·         Formjacking was the breakthrough threat of 2018, as cryptojacking and ransomware show signs of decline. However, ransomware infections within enterprises jumped by 12 percent.
·         Living off the land and supply chain attacks are now a staple of the new threat landscape.
·         Cloud users facing challenges on multiple fronts through data leaks from cloud storage and low-level chip vulnerabilities with more than 70 million records stolen or leaked.
·         Targeted attack groups show increasing interest in operational & industrial control systems with the potential for sabotage.

Speakers
BB

Brian Brotschi

Enterprise Security Architect, Symantec
Brian Brotschi has been with Symantec Corporation for 15+ years, providing data security and data privacy solutions to global Customers. During the past 25+ years, Brian has held individual contributor and leadership positions in the areas of system engineering, professional services... Read More →


Thursday May 16, 2019 1:35pm - 2:00pm
Sand and Sea Room

1:35pm

Vendor Lunchtime Spotlight Talk
Thursday May 16, 2019 1:35pm - 2:00pm
Garden Terrace

2:10pm

Why Companies Fail PCI DSS Assessments and What to Do About It
Having performed hundreds of PCI DSS assessments as a PCI QSA (Qualified Security Assessor) and signed just as many Attestation of Compliance (AOCs), we have identified common reasons why companies fail PCI DSS assessments. Some are technical in nature but a significant number of them is the ever-present question on scope.  All of these have ramifications on the effectiveness of controls, but the clock is what is most affected.  Every PCI DSS assessment has a deadline and with VISA’s mandate for service providers to have the Report of Compliance (ROC) completed and AOC submitted a month before the due date for listing in the Visa Global Registry of Service Providers, the PCI DSS assessment needs more attention than in the past.

This session will cover the top reasons why companies fail PCI DSS assessments.  We will cover technical challenges, scope questions, delays in evidence gathering, review of control effectiveness, and AOC submissions.  We will also cover a recommended approach to maintain compliance through the next annual PCI DSS assessment. This session will assume participant has a working knowledge of the PCI DSS assessment process.

Speakers
avatar for Miguel (Mike) O. Villegas

Miguel (Mike) O. Villegas

Senior Vice President, K3DES LLC
Miguel (Mike) O. Villegas is a Senior Vice President for K3DES LLC. He performs and QA’s PCI-DSS and PA-DSS assessments for K3DES clients. He also manages the K3DES ISO/IEC 27002:2013 program. Mike was previously Director of Information Security at Newegg, Inc. for five years. Mike... Read More →


Thursday May 16, 2019 2:10pm - 3:00pm
Club Room

2:10pm

From Cloud to Containers – Enhancing security practices to accommodate dynamic models
Securing the modern attack surface is a critical challenge. Whether it’s managing short-lived assets, assessing cloud environments or maintaining web application security, today’s attack surface presents a growing challenge to CISOs looking to understand and reduce their cyber risk. During this talk, Cassio will review the evolution of IT infrastructure and the new security practices that are designed to accommodate new and more dynamic development and infrastructure models.

Speakers
avatar for Cassio Goldschmidt

Cassio Goldschmidt

Head Of Information Security, ServiceTitan
Cassio Goldschmidt is an internationally recognized information security leader with a strong background in both product and program-level security. His past leadership experience includes services at AON/Stroz Friedberg, NCR Corporation, Intuit, Superplayer, Symantec Corporation... Read More →


Thursday May 16, 2019 2:10pm - 3:00pm
Sand and Sea Room

2:10pm

Shifting Left: Flat Earth Theory for Software Security
Spoiler: The Earth is round, and the way we build infrastructure and software has fundamentally changed, rendering some of our beloved approaches ineffective. Shifting left is promoted as "the way to do DevOps security," but it's harder than that. As our software becomes increasingly distributed, modular, and decoupled in design, we need to acknowledge the errors of our ways and adapt. Embracing failure is better than trying to prevent it. We can't test ourselves secure, no matter how many tests we run using whatever method. Gone are the days where endless whiteboarding sessions were frequent. We encourage each other to test in production and to learn by breaking. Moving fast is a business requirement, not a reckless development practice. We can't secure ourselves with a single tool or even with a bunch of them, no matter how good they are or how many fancy next-gen features they have. Our daily workload is analogous to a stream of events from every direction rather than a linear workflow.
This presentation will explore methods and security controls that don't fit into the "all things to the left" approach and will describe how to inject security into other phases without slowing things down. We've shifted concerns between team members as well as delegated many traditional security components to infrastructure and platform as a service solutions. We will propose solutions to leverage the right blend of software-defined security controls, automation, and good old-fashioned human thinking to avoid falling over the edge. We will examine the security practices that need to be done, but don't fit within a shift left security culture and how they can be adapted to meet our evolving needs. At the end of this presentation, you’ll have greater exposure to the opportunities and challenges we have in front of us securing the current generation of software.


Speakers
avatar for Jack Mannino

Jack Mannino

CEO, nVisium
Jack is the Chief Executive Officer at nVisium and loves solving problems in the field of application security. With experience building, breaking, and securing software, he founded nVisium in 2009 to invent new and more efficient ways of protecting software. Jack is an active mobile... Read More →


Thursday May 16, 2019 2:10pm - 3:00pm
Terrace Lounge

2:10pm

Attacks on Critical Infrastructure Networks as a Component of Economic Warfare
This talk will explore how, in the event of conflict escalation between the US and a nation state adversary, attacks on OT networks can be used as a powerful weapon of economic warfare. OT networks run the world's infrastructure - from oil refineries and nuclear power plants to industrial processes across chemical plants, pharmaceuticals. Compared to traditional IT networks, those OT networks are largely invisible to security teams and lag significantly when it comes to the security controls deployed. Given the relative lack of telemetry from those OT networks, we simply don't know how many critical networks have been breached. There are only a handful of publicly disclosed OT attacks, but we should not take this absence of evidence for evidence of the absence of the adversaries in those networks. Russian government threat actors have been targeting multiple critical infrastructure sectors including the energy, nuclear, commercial facilities, water, aviation, and critical manufacturing sectors for few years and it's likely that what we’re witnessing are the early stages recon / infiltration where the adversaries are getting into position.  

Speakers
avatar for Galina Antova

Galina Antova

Co-founder and Business Development Officer, Claroty
Galina Antova is the Co-founder and Chief Business Development Officer at Claroty, a leading operational technology (OT) cybersecurity provider. Since its founding in 2015, the company has become the de-facto cybersecurity provider to industrial control networks with the support of... Read More →


Thursday May 16, 2019 2:10pm - 3:00pm
Garden Terrace

3:10pm

Blockchain of Evidence, Let the Evidence Speak for Itself
The US Criminal Justice system has lost the Public Trust over the last few decades as lost evidence and misreporting by the press have led to the conclusion that the "system" is corrupt. This presentation will present a novel use of hybrid permissioned Blockchain technology to enable an immutable chain of evidence from collection at the scene to presentation in court, visible and verifiable to anyone with an interest throughout the process. Use of a system like this should remove most court backlog currently dedicated to evidence validity challenges, and put the ability to trust back into the system. Enabling new technology enriches all of our lives when used to give our public systems the chance to excel at what they do. Imagine, Defense and Prosecution trusting the evidence together throughout the case!! And public transparency from collection to court!

Speakers
avatar for Jeff Neithercutt

Jeff Neithercutt

Blockchain of Evidence
Jeff Neithercutt is a Senior Cybersecurity Consultant for a company specializing in public sector consulting. Jeff has a Master’s Degree in Cyber Security and Information Assurance, is a published author (Tactical Hacking for the Law Enforcement Professional), and tinkers with both... Read More →


Thursday May 16, 2019 3:10pm - 4:00pm
Garden Terrace

3:10pm

How Does Your Risk Management Stack Up?
This session will look at what a good risk program should cover in order to be compliant with HIPAA regulations. The participants will come away with the right building blocks of a good risk program and compare theirs to this presentation. It will answer the following question:
  • Do I have all the necessary components for a Risk Program?
  • Have I considered Threat Actors and Key Applications?
  • What about Medical IOT and Third Parties?
  • How do I keep my risk program current?
  • What kind of metrics do I need to monitor the risk program?

Speakers
avatar for John Kronick

John Kronick

Regional Director of Risk Management & Compliance, NCC Group
Mr. Kronick, an accomplished security innovator and security architecture thought leader, serves as Regional Director of Risk Management & Compliance at NCC Group, one of the world’s largest and prominent Cyber Security specialist companies, and a trusted technology partner for... Read More →


Thursday May 16, 2019 3:10pm - 4:00pm
Sand and Sea Room

3:10pm

Why a Manual Code Review Might Be One of the Best Investment You Can Make
Of all the topics related to application security, manual code review is probably one of the least popular. In the days of automation and fast paced delivery, who wants to sit down and go through tens of thousands of lines of code to search for a vulnerability? It's a long and tedious task - and it has been replaced by static application security testing.
Or has it?

In this presentation, you will learn about the advantages of doing a proper code review early in the development process. We will break this task into short and manageable iterations, each adapted to a given phase of application development. You will learn about the required skillset, useful shortcuts to speed up the process, and where code review fits in relation to other application security tools and techniques.
By the end of this presentation, it will be clear why a manual code review might very well be the one of the best investment you can make in your application security program.

Speakers
avatar for David Caissy

David Caissy

Penetration Tester and Trainer, TRM Technologies Inc.
David Caissy, M. Sc., OSCP, GWAPT, GPEN, GSEC, CISSP, CEH is a web application penetration tester with in-depth developer and IT Security background spanning over 18 years. He has extensive experience in conducting vulnerability assessments and penetration tests as well as providing... Read More →


Thursday May 16, 2019 3:10pm - 4:00pm
Terrace Lounge

3:10pm

21st Century Security: The Human Factor
Background:
The 21st Century firewall isn’t technology...it’s people. Given that 95 percent of all security incidents involve a human component, it is critical to address the human factor as part of an overall cybersecurity program.
LabCorp identifies cybercrime as a top risk globally. The Office of Information Security has a risk-aware, evidenced-based security strategy that includes an integrated Behavior Management and Communications service line. Our use case, the themed program OIS mission:SAFE, is a multi-modal approach to cybersecurity that includes both active and passive elements. Through persistent engagement and direct feedback, the program builds awareness, educates staff about the realities of cybercrime, and empowers them to become more security conscious.

OIS mission:SAFE has two main goals:
1) To inspire staff to want to learn about cyber security
2) To convert information security from a choice to a habit.

Approach:
Based on the principles of Social Cognitive Theory and adult learning methodology (ADKAR), the success of OIS
mission:SAFE draws upon various psychological triggers including:
 Expectations
 Behavioral Capability
 Self-efficacy
 Reinforcements
 Reciprocal Determinism
 Observational Learning

One of the main elements of success is a simulated phishing program, which began as an all-staff approach and has matured to targeted exercises based on divisional, regional, role-based, and cultural insights. Through the simulation program, Resiliency Rate as a KRI, as well as the results of each exercise, drive strategic decisions to enhance support in our most vulnerable areas.

Conclusion:
Since the program’s inception two years ago, the OIS mission:SAFE program has become a recognized standard of corporate assurance at LabCorp and has produced measurable results for the human factor.



Speakers
avatar for Jacqueline LaScala

Jacqueline LaScala

Director of Behavior Management and Communications, LabCorp
Jacqueline LaScala is the Director of Behavior Management & Communications for LabCorp’sIT Office of Information Security. Her area of focus is on applying the principles of SocialCognitive Theory and adult learning to the human side of securing information. She developedand manages... Read More →
avatar for Jim Nelms

Jim Nelms

CISO, LabCorp


Thursday May 16, 2019 3:10pm - 4:00pm
Club Room

4:00pm

Break - Vendor Expo
Please visit our Sponsors, without whose help our Summit would not be possible.

Thursday May 16, 2019 4:00pm - 4:30pm
Pool Deck

4:30pm

Want to make $3000 a month working from home?
We've all seen the ads for work-from-home schemes often accompanied by a picture of a cheque for thousands of dollars and a testimonial from a happy employee who only worked a few hours a week to earn the money. These legitimate looking ads are often fronts for money laundering services. Symantec working with the FBI recently gained insight into such an operation. This talk examines the scheme, from recruitment, to conversations with the ‘employees’, and ultimately, to the criminals behind the scheme. Vast technical and social skills are needed to operate such a scheme successfully while evading law enforcement. This talk shows how cooperation between security researchers and information sharing with law enforcement can bring down such an operation.

Speakers
avatar for Liam O'Murchu

Liam O'Murchu

Symantec
Liam O’Murchu is a director with the Security Technology and Response group with Symantec. Over the past 15 years O’Murchu has investigated and responded to the most sophisticated cyber attacks to ever emerge, from professional cyber-criminals targeting financial institutions... Read More →


Thursday May 16, 2019 4:30pm - 5:20pm
Garden Terrace

4:30pm

Expressing Cyber Risk: A Capital Markets Examination
Public companies are required to disclose business risks before IPO and in their annual disclosures.  Private companies with ambition to go public or be acquired are more recently going through rigorous cybersecurity assessments in M&A due diligence.  Federal, State and Local government issue bonds that are paid back to investors, in which revenue sources depend on availability of key government services.
 
There is increased scrutiny of company cybersecurity disclosures from both regulators and investors, to ensure equity and debt owners are aware of any material risks that could impact a company’s earnings. This session will provide examples of how cybersecurity does really affect the bottom line.

Speakers
avatar for Mikhael Felker

Mikhael Felker

Director of Information Security and Risk Management, Farmers Insurance
Mikhael Felker is Director of Information Security and Risk Management at Farmers Insurance. Previously, he was the first information security (IS) hire at The Honest Company to build the IS program and team for this LA based organization. During his tenure he developed the first IS policies, i... Read More →


Thursday May 16, 2019 4:30pm - 5:20pm
Club Room

4:30pm

Security From the Code to the Road – Technical and Strategic Issues for Connected Vehicles
With the rate of bleeding edge technology rising in the Automotive industry, vehicles are becoming increasingly intelligent expanding the automotive attack surface far beyond traditional paradigms. We are living in a world of connected and autonomous vehicles that are expected to be resilient in the face of malice. Driver’s are evolving into vehicle operators while safety critical functions are reliant upon coding practices of developers, manufacturers, and suppliers. This presentation will provide insights into automotive mobility security concerns, how they affect everyday lives, and mitigation measures the future has in store.  

Speakers
avatar for Aaron Guzman

Aaron Guzman

Head of Automotive & IoT Testing, Aon


Thursday May 16, 2019 4:30pm - 5:20pm
Terrace Lounge

4:30pm

"No, but..." Still Doesn't Work: Security Leaders must become Business Leaders
Many security professionals have chosen to evolve from "No" to "No, but..." Business partners still hear "No." Security can be a unifying force. We have our fingers in every aspect of the business, giving us the visibility and position to drive collaboration and provide change leadership for a variety of initiatives across the organization. Using the cornerstone principles of Context, Creativity, Collaboration, and Customer Service, we will discuss strategies for using “security as a unifier” to facilitate partnership across disparate departments, break down the silos, and transform from a security leader to a business leader. It's time for Security Leaders to lean in, say Yes, and be Business Leaders.

After completing this session, attendees will
- understand the skills and knowledge security leaders can bring to the business
- understand the benefits of being a transformational leader and a security leader who says "yes!"
- be able to apply the concepts of Context, Creativity, Collaboration, and Customer Service within their organizations to evolve from a security leader to a business leader.

Speakers
avatar for Marnie Wilking

Marnie Wilking

Global Head of Security & Technology Risk Management, Wayfair
With more than fifteen years of technical and managerial experience in Information Security and Financial Services, Marnie Wilking provides a unique set of skills and experience to manage operational risks across diverse businesses. Roles include technical project and program management... Read More →


Thursday May 16, 2019 4:30pm - 5:20pm
Sand and Sea Room

5:30pm

Closing Keynote
Hear from the highest Law Enforcement person in the SoCal region.

Speakers
avatar for Jackie Lacey

Jackie Lacey

District Attorney, Los Angeles County
District Attorney Jackie Lacey has spent most of her professional life as a prosecutor, manager and executive in the Los Angeles County District Attorney’s Office. On Dec. 3, 2012, she was sworn in as the 42nd District Attorney. She was re-elected four years later without opposition.She... Read More →
avatar for Sean Hassett

Sean Hassett

LA County DA Cyber Crimes Division
Sean Hassett received his Bachelor of Arts degree in History from the University of California at Los Angeles in 1989, and his law degree from Loyola Law School in 1993.  After working for a year in private practice, Sean joined the Los Angeles County District Attorney’s Office... Read More →


Thursday May 16, 2019 5:30pm - 6:20pm
Sand and Sea Room

6:20pm

Closing Remarks
Speakers
avatar for Richard Greenberg

Richard Greenberg

President, ISSA-LA
Richard Greenberg, CISSP, is the Summit Chair and serves on the OWASP Global Board of Directors. Previous positions include CISO, Director of Surveillance and Information Systems, Chief of Security Operations, Director of IT, and Project Manager for various companies/agencies in the... Read More →


Thursday May 16, 2019 6:20pm - 6:25pm
Sand and Sea Room

6:25pm

Opening Reception
Please visit our Sponsors, without whose help our Summit would not be possible.

Thursday May 16, 2019 6:25pm - 9:00pm
Pool Deck
 
Friday, May 17
 

7:40am

Registration, Breakfast, and Vendor Expo
Please visit our Sponsors, without whose help our Summit would not be possible.

Friday May 17, 2019 7:40am - 8:25am
Pool Deck

8:15am

Welcome Address
Speakers
avatar for Richard Greenberg

Richard Greenberg

President, ISSA-LA
Richard Greenberg, CISSP, is the Summit Chair and serves on the OWASP Global Board of Directors. Previous positions include CISO, Director of Surveillance and Information Systems, Chief of Security Operations, Director of IT, and Project Manager for various companies/agencies in the... Read More →


Friday May 17, 2019 8:15am - 8:20am
Sand and Sea Room

8:20am

Keynote: Opening
Speakers
avatar for Chenxi Wang

Chenxi Wang

Women of Influence - SC Award 2016. Experienced technology/strategy executive with deep technical background (Ph.D. Computer Science), strong analytical skills (VP, Forrester) and extensive market know-how. Advocate for equality and diversity in the high tech field. Founder of Equal... Read More →


Friday May 17, 2019 8:20am - 9:10am
Sand and Sea Room

9:10am

CTF Training and Competition Using the CMD+CTRL Platform: Security Innovation
Security Innovation will be hosting this CTF event using their CMD+CTRL platform. https://www.securityinnovation.com/training/cmd-ctrl-cyber-range-security-training

Along with the competition, we will be offering some free training lessons so that newcomers also get the chance to do some hands-on work even if they don't feel ready to participate in the official CTF event. Everyone is encouraged to participate; just bring your laptop (and an ethernet/usb adapter if you do not have an ethernet port on your laptop) and hack away!

Friday May 17, 2019 9:10am - 3:30pm
Marion Davies Guest House Parlor

9:10am

IoT Village
Want to learn how to attack IoT devices? We will have a network of new and old IoT products along with automotive and medical devices to play with! A free virtual machine (VM) with vulnerable emulated firmware and tons of preloaded tools will be available for download!! The IoT Village is hosted by Aaron Guzman of Aon Cyber Solutions. You don't want to miss out!

Speakers
avatar for Aaron Guzman

Aaron Guzman

Head of Automotive & IoT Testing, Aon


Friday May 17, 2019 9:10am - 3:30pm
Marion Davies Guest House Dining Room

9:20am

HHS OCR HIPAA Assessments
Hear the latest important strategies for HIPAA enforcement from the Deputy Regional Manager at US Department of Health and Human Services - Office for Civil Rights -Pacific Region

Speakers
avatar for Yun-Kyung (Peggy) Lee

Yun-Kyung (Peggy) Lee

Deputy Regional Manager, US Department of Health and Human Services
Yun-kyung (Peggy) Lee is the Deputy Regional Manager in the Pacific Region of the U.S Department of Health and Human Services, Office for Civil Rights (OCR).  Ms. Lee began as an Investigator at OCR in 2003 conducting investigations and recommending resolution of complaints alleging... Read More →


Friday May 17, 2019 9:20am - 10:10am
Club Room

9:20am

The Universe, Enterprise Risk Management and Cyber Insurance
This ambitious presentation covers thoughts on the nature of the universe related to physics, music and how this lays a foundation for enterprise risk management including cyber insurance.
 
  • Thoughts on the nature of the universe and its connection with enterprise risk management.
  • What are some components and terminology of a risk management framework distilled to key objectives?
  • Breaking down exposures into logical classifications.
  • What are the insurance policies and differences related to technology risk?
  • What are key coverages and provisions regarding cyber liability insurance?
  • Where does cyber insurance fit in the risk management process?
  • Overview and steps needed to complete key objectives.

Speakers
avatar for Howard Miller

Howard Miller

Director of trademarked technology division, Tech Secure
Howard is the director of trademarked technology division, Tech Secure®, for retail insurance brokerage. He provides consultative sales and unique custom insurance solutions to solve problems. Howard innovated a cybercrime insurance product for financial institutions that received... Read More →


Friday May 17, 2019 9:20am - 10:10am
Terrace Lounge

9:20am

Vulnerability Landscape 2019 – What Keeps Tripping Us Up
With the increasing spend in security budgets and the apparent increasing frequency of data breaches, managing vulnerabilities in an organisation can seem like a never-ending game of blind whack-a-mole. How organisations approach vulnerability management in the past simply does not cut it with today's technology stack and development methodologies. We will discuss some of the common themes that seem to persist and look at some actions we could take to dramatically improve our overall security.

Speakers
avatar for Rahim Jina

Rahim Jina

Chief Operating Officer & Co-Founder, edgescan™
Rahim is the COO and co-founder of edgescan™, a Security Consultancy firm and Fullstack Vulnerability Management SaaS based in Dublin, Ireland. Rahim is responsible for operational excellence and has extensive experience delivering penetration testing services to a wide range of... Read More →


Friday May 17, 2019 9:20am - 10:10am
Garden Terrace

9:20am

Incident Response and Forensics in Container Land
Join us as we have a conversation about digital forensics and incident response in container land! Our esteemed practitioners will be sharing their knowledge on the following:
  • What are containers? ( or Why Dockers just aren’t shoes any more and What is “Kubernetes”?)
  • Why does DevOps keep mentioning containers versus traditional VM (virtual machines)?
  • Why worry about Digital Forensics & Incident Response for containers?
  • How does your Incident Response process need to change?
  • How can you proactively configure containers to compensate for their non-persistency?
  • What type of conversations should you have with your DevOps, Sysadmin, and SOC about container security?
  • What is the most important question I can ask, if I learn that I am already living with containers, but just was not informed!

Moderators
avatar for Andrea Hoy

Andrea Hoy

Virtual CISO & CEO, ISA
Andrea Hoy, CISSP, CISM, MBA received her initiation into the cybersecurity community when her hard work and dedication for a safe international event earned her the role as an Asst. Venue Manager for the highly successful LA Summer Olympic Games. Andrea’s leadership positions include... Read More →

Speakers
avatar for Chenxi Wang, PhD

Chenxi Wang, PhD

Managing General Partner, Rain Capital
Women of Influence - SC Award 2016. Experienced technology/strategy executive with deep technical background (Ph.D. Computer Science), strong analytical skills (VP, Forrester) and extensive market know-how. Advocate for equality and diversity in the high tech field. Founder of Equal... Read More →
avatar for Jessica Wilson

Jessica Wilson

Information Security Engineer, Detection and Response, Snapchat
Jessica Wilson is an Information Security Engineer on the Detection and Response team at Snapchat. Jessica specializes in Digital Forensics and Incident Response, particularly on the macOS platform. Previously she had held an internship at Virta Labs, a medical device security startup... Read More →
avatar for Katie Curran

Katie Curran

Information Security Engineer, BlackLine
Katie Curran, is an Information Security Engineer on the Security Operations team at BlackLine Systems Inc., a software company that develops cloud-based solutions designed to automate and control the entire financial close process. Katie is responsible for architecting and implementing... Read More →


Friday May 17, 2019 9:20am - 10:10am
Sand and Sea Room

10:10am

Break - Vendor Expo
Please visit our Sponsors, without whose help our Summit would not be possible.

Friday May 17, 2019 10:10am - 10:40am
Pool Deck

10:40am

Healthcare CISO Panel
What are CISOs in Healthcare worried about as their heads hit the pillow each night? What new types of attacks are we all looking at defending against?

Moderators
avatar for Richard Greenberg

Richard Greenberg

President, ISSA-LA
Richard Greenberg, CISSP, is the Summit Chair and serves on the OWASP Global Board of Directors. Previous positions include CISO, Director of Surveillance and Information Systems, Chief of Security Operations, Director of IT, and Project Manager for various companies/agencies in the... Read More →

Speakers
avatar for Stan Banash

Stan Banash

CISO, CHOC
Stan Banash Jr. is the Chief Information Security Officer (CISO) for Children’s Hospital of Orange County (CHOC). As CISO, he is responsible for the strategic direction and alignment of the Information Security Program. His approach to Information Security employs risk management... Read More →
avatar for Todd Felker

Todd Felker

Information Security Officer, Torrance Memorial Medical Center
Experienced Information Security Officer with a demonstrated history of working in the hospital & health care industry. Skilled in Team Building, Data Center, Management, Cerner, and Decision Support. Strong information technology professional with a Bachelor of Science (BS) focused... Read More →
avatar for John Kronick

John Kronick

Regional Director of Risk Management & Compliance, NCC Group
Mr. Kronick, an accomplished security innovator and security architecture thought leader, serves as Regional Director of Risk Management & Compliance at NCC Group, one of the world’s largest and prominent Cyber Security specialist companies, and a trusted technology partner for... Read More →
avatar for Doug Murray

Doug Murray

CISO
Doug Murray is a recognized Information Security and Technology executive with over two decades of information security and technology experience.  With a unique blend of executive acumen, team-building and a strategic vision, he has successfully transformed and matured information... Read More →


Friday May 17, 2019 10:40am - 11:30am
Sand and Sea Room

10:40am

Beyond the Looking Glass - The integration of DevSecOps, Security Forecasting, and Artificial Intelligence
Machine learning, Artificial Intelligence, and automation are the security buzzwords of our era. However, there is a dearth of in depth analysis pertaining to how the various tools and strategies are interwoven into the fabric of a company’s infrastructure. Automation has changed the SDLC environment. DevSecOps and advanced stages of security automation enables a company to integrate security within their respective IT environment at the speed of the business.
This presentation will provide examples of various factors for success as well the implementation challenges. However, DevSecOps practices are only pieces in the next security curve. The ideas of Serverless Computing, Security Forecasting and AI will be explained as well
as shown how they can be integrated within a security framework.


Speakers
avatar for Jimmy Sanders

Jimmy Sanders

Netflix
Jimmy Sanders manages the information security for Netflix DVD. He has been a speaker at notable events such as BlackHat USA, SecureWorld as well as other notable events. Jimmy has been involved in computer technology for over 18 years with 12 years focused on security. He is the... Read More →


Friday May 17, 2019 10:40am - 11:30am
Terrace Lounge

10:40am

Rogue Device Mitigation
While the industry is focused almost entirely on software protection against cyber-attacks, one of the greatest threats resides in rogue or corrupt hardware devices that are present in almost every computing network and infrastructure. From the doctored motherboard chips on our servers that have been corrupted along the supply chain to compromised peripheral devices, mobile phones and USB drops, hardware vulnerabilities represent a target rich environment for cyber criminals leveraging a variety of threat exploits. Citing examples occurring recently in the International server manufacturing supply chain, IP theft by disgruntled employees, and data leaks at a Fortune 20 bank, the founder and CEO of Sepio will explain how to detect, prevent, and protect information systems from hardware-based attacks.    

Speakers
avatar for Yossi Appleboum

Yossi Appleboum

CEO, Sepio Systems
As CEO of Sepio Systems, Inc., Yossi is responsible for North American operations at Sepio. He brings 25 years’ experience in security, networking, and computer science and control systems, along with a wide-angle perspective to cyber security threats and unique security solutions... Read More →


Friday May 17, 2019 10:40am - 11:30am
Club Room

10:40am

Transforming Cybersecurity in the Age of Chaos and Automation
It isn’t a surprise to many of us just how much data is being generated as our lives and our world embrace digital technologies. This data explosion is creating one of the greatest shifts in history and it is creating more chaos and threats than we could have imagined. But it is also unlocking a massive opportunity. Join Haiyan Song, SVP and GM of Security Markets at Splunk, as she takes you through the future of IT security operations and how automation will enable teams to operate better, stronger and faster.

Speakers
avatar for Haiyan Song

Haiyan Song

SVP and GM of Security Market, Splunk
Haiyan Song has been with Splunk since 2014 and currently serves as our Senior Vice Presidentand General Manager of Security Markets.From 2012 to 2014, Ms. Song served as Vice President and General Manager of HP ArcSight, asecurity and compliance management company previously acquired... Read More →


Friday May 17, 2019 10:40am - 11:30am
Garden Terrace

11:40am

ONC Releases Proposed Rule to Support Seamless and Secure Access to, Exchange of, and Use of Electronic Health Information (EHI)
The U.S. Department of Health and Human Services’ (HHS) Office of the National Coordinator for Health IT (ONC) today issued a proposed rule to support seamless and secure access to, exchange of, and use of electronic health information (EHI).

The proposed rule is designed to increase innovation and competition by giving patients and their healthcare providers secure access to health information and to new tools, allowing for more choice in care and treatment. It calls on the healthcare industry to adopt standardized application programming interfaces (APIs), which would allow individuals to securely and easily access structured EHI using applications for smartphones and other mobile devices.

The proposed rule would implement provisions of the 21st Century Cures Act that deter and penalize information blocking by outlining seven proposed exceptions to its definition under the law.

The proposed rule would place a strong focus on patient access to their health information through a provision requiring that patients could electronically access their EHI at no cost. It would also encourage competition and new business models in the health care market.

The proposed rule also includes a request for information on the parameters and implications of including price information within the scope of EHI and if that information would help the public see the prices they are paying for their healthcare.

Speakers
avatar for Cynthia Stamer

Cynthia Stamer

CEO, Cynthia Marcotte Stamer, P.C.
Cynthia Marcotte Stamer is a Martindale-Hubble “AV-Preeminent (Top 1%) rated practicing attorney and management consultant, health industry public policy advocate, widely published author and lecturer, recognized for her nearly 30 years’ of work on health industry and other privacy... Read More →
avatar for Todd Rossin

Todd Rossin

CEO, IDMWORKS
Todd Rossin is responsible for the oversight of IDMWORKS business segments and for the development of strategic plans to sustain the company’s rapid growth.Todd has over 20 years’ experience in managing, architecting and deploying Identity Management, LDAP Directories, Single/Reduced... Read More →


Friday May 17, 2019 11:40am - 12:30pm
Club Room

11:40am

Left of Boom
The term “Left of Boom” was made popular in 2007 in reference to the U.S. military combating improvised explosive devices (IEDs) used by insurgents in Afghanistan and Iraq. The U.S. military spent billions of dollars developing technology and tactics to prevent and detect IEDs before detonation, with a goal of disrupting the bomb chain. This is an analog to cybersecurity as we strive to increase the incident prevention capabilities of our security tools and where we can’t prevent attacks, augment prevention with incident detection and response tools.

If you feel that you don’t have the cybersecurity evidence to know, empirically, what’s working, what’s not, how to fix it, how to verify the fix worked, and how to make sure it stays working across your security tools, your people, and the processes they follow, this presentation is for you.

There is an urgent need for evidence in cybersecurity regarding the effectiveness of specific systems as well as the overall security systems of systems. Are my security tools preventing, detecting, logging, correlating, and alerting? Does the new configuration, patch, rule, or signature result in what was intended? Are systems that were working before still working or have they drifted from a known good state? Without evidence about our security effectiveness, how can we ever empirically answer these questions and get our organizations to the “left of boom?”

Studies across endpoint, network, email, and cloud security tools have established that, on average, we’re only getting about 15-25% effectiveness out of our incident prevention security tools. When it comes to incident detection, it’s as low as 25-35% effectiveness. And for SIEMs, their ability to effectively correlate and alert ranges between 0-45%. We haven’t put a big enough dent in our risk profile and we’re wasting time, money, and resources by not getting value from these security tools. In most cases, the problem isn’t that we have bad technology or ineffective security teams. Instead, it’s an inability to effectively measure, manage, improve, and communicate the security effectiveness of our security tools in a scalable manner that results in actionable evidence.

From a leadership perspective, we’re not able to communicate our security effectiveness to executives based on evidence because we don’t have the evidence. This is devastating, as cybersecurity isn’t about cyber risk – it’s about the financial and operational risk from cyber. Without evidence, executive decision makers can’t do their jobs effectively when it comes to protecting shareholder value, revenue, and reputation.

This presentation will demonstrate automated methods to mitigate these problems. It will identify approaches that you can apply to improve the effectiveness of your security tools, security teams, and processes. Following this presentation, you’ll be able to develop your own strategy to get “left of boom.”

Speakers
avatar for Brian Contos

Brian Contos

CISO & VP Technology Innovation, Verodin
Brian Contos is the CISO & VP Technology Innovation at Verodin. He is aseasoned executive with over two decades of experience in the securityindustry, board advisor, entrepreneur and author. After getting his start insecurity with the Defense Information Systems Agency (DISA) and... Read More →


Friday May 17, 2019 11:40am - 12:30pm
Terrace Lounge

11:40am

Continuous Security for DevOps Velocity
The security industry initially reacted to the “DevOps” movement with dismay: developers deploying code themselves? Hundreds of deploys per day? How could security teams possibly keep up with that rate of change? As the DevOps approach has become a mainstream development method, security teams have begun to embrace DevOps and discover the security benefits enabled by the DevOps methodology. Adapting to a DevOps world requires not just the security team to change how they operate, but a realignment of how security permeates the entire organization.
In this talk I will share my experiences integrating security with fast-moving development teams, the successes and failures I have seen, as well as guidance on turning DevOps into DevSecOps.

Speakers
avatar for Justin Collins

Justin Collins

Senior Software Engineer, Synopsys
Justin Collins is a senior software engineer at Synopsys. He has been a part of security teams as an application security engineer at SurveyMonkey, Twitter, and AT&T Interactive. He created the Brakeman static analysis security tool for Ruby on Rails which was recently acquired by... Read More →


Friday May 17, 2019 11:40am - 12:30pm
Garden Terrace

11:40am

Paying It Forward: Cultivating a New Cybersecurity Workforce
Women and minorities constitute half of technology users, making it only natural for current cybersecurity professionals to look to them as the next generation to carry the torch. Not only is it important to have a cybersecurity workforce that reflects the diversity of its tech users, but also it is a necessity to pursue at a time when both the growth and the talent shortage of the industry are at an all-time high. In order to obtain and mentor this next generation of skilled, ambitious young people, we must put in the work and pass on what we have learned to them.

Join our conversation as our panel of leading security executives discuss how to develop and cultivate this next generation workforce and how to locate and inspire them. They will also share their personal success stories and insights on how to make new connections as well as tips for expanding your professional network.

Moderators
avatar for Marci McCarthy

Marci McCarthy

CEO and President, T.E.N.
Marci McCarthy is the CEO and President of T.E.N., an information security executive networking and relationship-marketing firm. With more than 20 years of business management and entrepreneurial experience, McCarthy founded T.E.N.’s flagship program, the Information Security Executive... Read More →

Speakers
avatar for Wendy Nather

Wendy Nather

Head, Advisory CISOs, Duo Security at Cisco
Strategist, research director, former industry analyst and former CISO. 30+ years' technical experience in IT operations and security, including twelve years in the financial services industry and five years in state government. Specialties: Security program management, threat intelligence... Read More →
avatar for Marian Merritt

Marian Merritt

Lead for Industry Engagement (NICE), NIST
Marian Merritt is the Lead for Industry Engagement for the National Initiative for Cybersecurity Education (NICE) at the National Institute of Standards and Technology (NIST). Marian has over 19 years of experience working in the cybersecurity industry. She previously was with Symantec... Read More →
avatar for Jennifer Steffens

Jennifer Steffens

CEO, IOActive, Inc.
Jennifer Sunshine Steffens, CEO of IOActive, Inc. As its CEO, Jennifer Steffens spearheads all aspects of IOActive’s global business operations and drives the company’s strategic vision. Jennifer brings a wealth of industry and business experience to the company, having been an... Read More →
avatar for Galina Antova

Galina Antova

Co-founder and Business Development Officer, Claroty
Galina Antova is the Co-founder and Chief Business Development Officer at Claroty, a leading operational technology (OT) cybersecurity provider. Since its founding in 2015, the company has become the de-facto cybersecurity provider to industrial control networks with the support of... Read More →


Friday May 17, 2019 11:40am - 12:30pm
Sand and Sea Room

12:30pm

Lunch and Vendor Expo
Please visit our Sponsors, without whose help our Summit would not be possible.

Friday May 17, 2019 12:30pm - 1:40pm
Pool Deck

1:40pm

AWS: The Netflix Layered Approach
Building a secure system is like constructing a good pizza – each individual layer adds flavor that ultimately builds to the perfect bite. At Netflix we have hand-crafted ingredients that by themself are scrumptious, but when placed together strategically on the crust (read: cloud), constructs a pizza so large that any pizza lover (read: attacker) would be challenged to finish.  Attendees will learn the secret to the sauce that is Netflix Infrastructure Security, be equipped to start baking pizza in their own kitchen, and leave satisfied.

Speakers
avatar for Travis McPeak

Travis McPeak

Senior Cloud Security Engineer, Netflix
Travis works at Netflix on the Cloud Security team where he enjoys building automation that increases security while simultaneously boosting developer productivity. Travis is a core developer of the Bandit and Repokid open source projects and has presented at security conferences... Read More →


Friday May 17, 2019 1:40pm - 2:20pm
Terrace Lounge

1:40pm

10 Lessons from the last 10 years of Incident Response; Protecting Your Network from Modern Threats
Research suggests that cyber crime will cost businesses over $2 trillion in 2019 and the average cost of a breach in 2020 will exceed $150 million per incident. Kroll Cyber Risk Associate Managing Director and National Cyber Incident Response Team Leader Pierson Clair will discuss modern threats including Emotet,Trickbot, and ransomware, attacker tools, tactics, and methodologies, along with how a back to basics approach can help better protect your network and more rapidly identify attackers on your network. 
 Goals (if relevant):
After attending this presentation, attendees will learn to:
  1. Understand modern threats and risks to network environments of all sizes.
  2. Understand how modern malware is able to penetrate and replicate through networks.
  3. Apply a back to basics approach to lock down and secure networks and endpoints.
  4. Learn from the oversights of other organizations to better protect their own infrastructure.


Speakers
avatar for Pierson Clair

Pierson Clair

Associate Managing Director, Cyber Risk, Kroll
Pierson Clair is an experienced certified digital forensic examiner, technical security consultant, and cyber security educator. Mr. Clair’s forensic experience includes extensive work with clients of all sizes and he is currently an Associate Managing Director and National Cyber... Read More →


Friday May 17, 2019 1:40pm - 2:30pm
Garden Terrace

1:40pm

Information Security for the Traveling Executive ('Road Warrior')
Keeping data safe while outside the office is significantly harder than data secured inside your company. Executives & others who travel extend the corporate ‘perimeter’, increasing the risk of data exposure. This session will include suggestions & examples on how those in the mobile workforce can safeguard themselves while outside the traditional ‘perimeter’ and avoid being a victim of information theft on the road or at home. 

Loss or exposure of data as employees travel the globe is a serious issue - for both the corporate and government sectors. Every day, thousands of people have their computers stolen or information compromised by a myriad of methods. From wireless thieves to techno-social engineering to tried-and-true ‘old school’ methods, there are people around the world and around the corner waiting to separate you from your data. 

This popular presentation will show examples of methods and tools used by thieves – and will provide you with helpful tips and pointers to lower the risk to travelers and educate users to help safeguard sensitive data. Whether you are a security professional responsible for protecting  others who travel or you are a ‘Road Warrior’ yourself, this presentation is for you!

Speakers
avatar for Roy Wilkinson

Roy Wilkinson

Principal, CIO/CISO Virtual Services, Rausch Advisory Services LLC.
Roy Wilkinson has previously served as both CISO and CSO, with 30+ years of information technology experience, focusing in security & infrastructure and 25+ years of experience in physical security, notably including serving as security advisor for the Olympic Games in Athens, Greece... Read More →


Friday May 17, 2019 1:40pm - 2:30pm
Club Room

1:40pm

Privacy in 2019
This session will explore the rapidly evolving privacy legal landscape in the US in 2019, in particular the California Consumer Privacy Act (taking effect on January 1, 2020), other state bills on the horizon, and the likelihood of a federal omnibus privacy law. The CCPA greatly expands the current scope of regulation of all kinds of sensitive information held by nearly all companies doing business in California. As relevant to healthcare, the CCPA imposes restrictions on the processing of health, wellness, and medical information handled by entities that are not regulated under HIPAA, and provides individuals with much more robust rights with respect to that information. Now is the time for organizations to prepare for compliance.

Speakers
avatar for Tanya Forsheit

Tanya Forsheit

Supervising Partner and Privacy & Data Security Group Chair, Frankfurt Kurnit Klein & Selz
Widely considered one of the country’s top privacy and data security lawyers, Tanya Forsheit has advised on high-profile matters involving confidential data and other sensitive information for over 20 years.Ms. Forsheit is Chair of the Privacy & Data Security Group, and a partner... Read More →


Friday May 17, 2019 1:40pm - 2:30pm
Sand and Sea Room

2:40pm

Medical Device Security Tipping Point
Are we close to the tipping point of an acceleration in medical device security? We are all affected (or will be at some point) by medical device security, and we all have a role to play to help push things forward. Learn about the latest FDA pre-market guidance, the HSCC Joint Security Plan, Medical Device Hacking Village, and other key initiatives that seem to indicate we are near a tipping point, though challenges remain. In an interactive Q&A, also hear from a healthcare provider CISO and medical device security program manager on lessons learned in this area.

Speakers
avatar for Adam Brand

Adam Brand

Managing Director, PwC
Adam Brand started his interest in medical devices (and hacking) in his early teens, when he built an EEG and convinced neighborhood kids to take part in his experiments on biofeedback. He now has more than 18 years of experience in information technology and security, and while he... Read More →


Friday May 17, 2019 2:40pm - 3:30pm
Club Room

2:40pm

Making Sense of the California Consumer Privacy Act
The California Consumer Privacy Act (CCPA) is the broadest and most comprehensive privacy and data security measure in the nation.  Its far-reaching obligations impact businesses across industries, dramatically shift the paradigm of what has traditionally been considered private or protected information, and threaten severe penalties for violations that will change the privacy and security landscape in California and nationwide.  This session will make sense of it all by covering:
·        The political landscape in which the CCPA and the cleanup legislation passed
·        The CCPA’s compliance requirements and who will be required to comply
·        The impact on cybersecurity and information governance programs
·        Direct and hidden litigation and enforcement risks
· The proposed recent amendments to the CCPA and the prospects for further legislation in other jurisdictions

Speakers
avatar for Brandon Reilly

Brandon Reilly

Counsel - Privacy and Data Security, Manatt, Phelps & Phillips, LLP
Brandon Reilly is a privacy and data security attorney and civil litigator inManatt’s Orange County office. Brandon counsels clients on a wide array ofconsumer protection and privacy matters, including data privacy and securitycompliance and procedure and data breach response.In... Read More →


Friday May 17, 2019 2:40pm - 3:30pm
Garden Terrace

2:40pm

Peel Back the Layers of Your Enterprise Using Free and Open Source Software
To catch modern adversaries, we need comprehensive network and host telemetry, which may be costly and cumbersome.  This is fundamentally unjust as self-defense should be affordable and easy to use.  Free and open source software is certainly affordable and can be easy to use.  Let's see how Security Onion can peel back the layers of your enterprise and make your adversaries cry!


Speakers
avatar for Doug Burks

Doug Burks

CEO, Security Onion Solutions LLC
Doug Burks started Security Onion in 2008 to provide a comprehensive platform for intrusion detection, network security monitoring, and log management.  Today, Security Onion has over 700,000 downloads and is being used by organizations around the world to help monitor and defend... Read More →


Friday May 17, 2019 2:40pm - 3:30pm
Sand and Sea Room

2:40pm

Building for the Future: Inspiring the Next Generation of Cybersecurity Professionals
It is important for young professionals to know they can have successful and impactful careers in the tech sector. However, to get more young minds interested in choosing careers in technology, the narrative needs to change to show that women and minorities have a future in the industry. Join Marci McCarthy as she discusses the importance of nurturing and growing the next generation of professionals in technology through mentorship opportunities, STEAM programs and other education opportunities.

Speakers
avatar for Marci McCarthy

Marci McCarthy

CEO and President, T.E.N.
Marci McCarthy is the CEO and President of T.E.N., an information security executive networking and relationship-marketing firm. With more than 20 years of business management and entrepreneurial experience, McCarthy founded T.E.N.’s flagship program, the Information Security Executive... Read More →


Friday May 17, 2019 2:40pm - 3:30pm
Garden Terrace

3:40pm

Keynote: All These Vulnerabilities, Rarely Matter
There is a serious misalignment of interests between Application Security vulnerability assessment vendors and their customers. On the surface you can see it within the pages of any Application Security vulnerability statistics report, where they state that the vast majority of websites contain serious issues — averaging dozens (SQL Injection, Cross-Site Scripting, Cross-Site Request Forgery, etc).  Their data also shows only half of those reported vulnerabilities ever get fixed and takes months. The data itself is not in dispute, these are legitimate vulnerabilities, but underneath there’s a secret: Vendors are incentivized to report everything they possible can, which they use to impress and win deals, even issues those vulnerabilities rarely matter. As a proof point, the vast majority of those ‘serious’ website vulnerabilities are simply NOT being exploited. Why is that?

Conversely, customers just want the vulnerability reports that are likely to get them hacked. Every finding beyond that is a waste of time, money, and energy, which is precisely what everyone is currently experiencing. If attackers really aren’t finding, exploiting, or even caring about these vulnerabilities as we can infer from the supplied data — the value in discovering them in the first place becomes questionable.


Speakers
avatar for Jeremiah Grossman

Jeremiah Grossman

Founder and CEO, Bit Discovery
Jeremiah Grossman, Founder & CEO of Bit Discovery, Chief of Security Strategy (SentinelOne), Professional Hacker, Black Belt in Brazilian Jiu-Jitsu, and Founder ofWhiteHat Security, Jeremiah Grossman's career spans nearly 20 years and has lived a literal lifetime incomputer security... Read More →


Friday May 17, 2019 3:40pm - 4:30pm
Sand and Sea Room

4:30pm

Raffle Drawings
Join us as we give away lots and lots of cool prizes provided by our vendor sponsors. ISSA-LA will be giving away Gift cards and a free admission to next year's Summit for our bingo prize winners.

Friday May 17, 2019 4:30pm - 5:00pm
Pool Deck