2017 Workshop Schedule

“The Enterprise Security Ecosystem and I thought there’d be Cake”

We all experience security issues every day. Some or many may go undetected or, worse, we spend time tracking down what turns out to be a non-incident. The question now becomes how do I get off the “hamster wheel of security?” The issue we must improve is the efficiency and effectiveness of the tools that we have deployed, and we must generate the “Security EcoSystem for the Enterprise.”

“Metrics and the Story You Tell”

This session will explore information security metrics including tactical metrics, determining which are the metrics that matter, and reporting out those metrics to all audiences. We will also explore how metrics help tell the story depending on the audience to demonstrate that InfoSec is a business problem and not an IT problem.

“AWS Security Essentials”

Are you using or moving to AWS? Have you considered how you organize and secure your AWS environments? The growing push to cloud providers has allowed us to move faster and tackle problems more efficiently. The same freedoms that have allowed us to move faster have also created scenarios where security issues are exposed by accident and/or without proper management and review. As companies move toward more and more cloud usage, teams are pushed harder to ensure the same compliance and security requirements that exist in slower moving private environments. This has the potential to put us right back where we came from.

Join Aaron as he talks through the most critical security decisions you can make for you AWS environments. He will identify issues and solutions in an automation friendly fashion that aim to fit seamlessly into the development and deployment lifecycle.

This session will cover the following topics:

• Account provisioning and IAM
• Credential management
• VPC setup and network design
• AWS services that boost your security posture
• Auditing AWS configurations to find security holes
• Creating a robust CI pipeline that ensures no obvious security holes are present within your environments

In addition to these topics a heavy emphasis on both platform and server automation will be included. Please note that this session is heavily tuned to people using Amazon Web Services. If you are using another Cloud provider the ideas will still be relevant, but not all solutions will be available for your provider .

Treat every firearm as if it’s loaded, don’t point your muzzle at something you’re not willing to destroy, keep your finger off of thetrigger until you know what you are shooting at.

In a sanctioned match, violating any one of these can get you disqualified. You don’t have to actually shoot somebody to get thrown off the field.

The same with cyber security policies:

• You must have them.
• They must be robust.
• They must match your organization profile and regulatory requirements.
• They must be funded by the people that approved them.
• They must be taught and security awareness training programs.
• Their must be consequences for these policy violations or, near misses.

The RSA hack that cost 55 million dollars was due, in part to several policy violations.

“National Cybersecurity Assessments and Technical Services (NCATS)”

Description of all DHS NCATS service offerings and capabilities.

• Today’s cyber breaches are the result of 1. cyber vectors changing – rapidly 2. Speeds of today’s internet. They can use older attacks, change them slightly and you have something like WannaCry.
• We are now forced into moving from platforms that are Static (deal with the already seen cyber attacks) to those that are Dynamic ( dealing with those cyber attacks that have not been seen before. ie No CVE and etc.). In other words we are moving and being forced to move from a Defense posture to an Offensive Posture. However, the core requirement is still the same, become more Effective, Accurate, Faster. Analytics, Intelligence, Big Data allow for that ability to be present. The ability to be Extremely accurate in identifying and blocking cyber that NO one else has already identified and has a fix for.
• The take away- All new generations of solutions requires additional knowledge on how it works, the good and the bad. You have to learn where the pit falls all, what the marketing language is really saying and what can drive the goal of Extreme Accuracy.
• The topic will explain an old marketing term that has been used for years but now is as relevant as ever. “How Deep is Deep?” In reality just because the marketing material states ‘’’Analytics or Intelligence or Big Data” doesn’t not mean you will be safer or have less false positives. Bayesian is a good example. Everyone can check the box but is NOT going to be the true end game.

Take Away

• Explanation of:
  • What Analytics is about and how it CAN work to everyone’s advantage.
  • Where should the analytics be placed?
  • What should the algorithms do?
  • Will this load down my system?
  • Will I get more false positives?
  • What is a sensor? Etc.
• What Intelligent in Cyber Security caught in real time at Super Bowl 50 in San Francisco