THE ART OF SECURING 100 PRODUCTS. Nir
|
|
|
- Sharyl Norris
- 5 years ago
- Views:
Transcription
1 THE ART OF SECURING 100 PRODUCTS Nir
2 I work for as the <HEAD> Application Security </HEAD> 1st time speaking publicly, except at Mmmm OH, AND Neither of my previous startups succeeded! But at least I invented few open source tools. SAPIA Lastly I m not a fan of the buzzword Cyber! Cyber Cyber Cyber Arghhh!!!! The trademark specified above is a trademark or a registered trademark of its respective company. This slide is intended for informational purposes only and does not represent any endorsement by this company.
3 Why Does This Talk Matter? Provides Practical Approaches To Secure 100 Products Why Does It Matter? It's A Big Challenge To Secure 100 Products Why Does It Matter? You May Need To Secure Many Products Why Does It Matter? Someone Will Pay You Lots Of $$$ To Do It Why Does It Matter? You Like Expensive Stuff!
4 Agenda Plan Reality
5 Meet The Application Security Lead! Accountable for Product Security Cloud-based, self-hosted or installed on customers premise Part of the products are regulated Needs to keep the company out of the news Got executive leadership to support him * Avatar generated on avatarmaker.com
6 The Daily Challenges Need to secure a single high-risk product. Who s involved? Legal Internal Audit IT Services Solution Management CISO Hardware Solutions Software R&D Product Management Professional Services
7 Mapping The Business Owners Product #1 ü Software R&D ü CISO ü Legal ü Product Management ü Internal Audit Product #2 ü Software R&D ü CISO ü Legal ü Product Management ü Solution Management ü Hardware Solutions Product #100 ü Software R&D ü IT ü CISO ü Legal ü Product Management ü Solution Management ü Professional Services 7
8 Will I Finish This Mapping Soon? Start Date Done!
9 SCOPING THE ACCOUNTABILITY Cause someone will be blamed eventually
10 Core vs. Extensions? Core/Vanilla Customer #1 Extensions Customer #2 Extensions Customer #N Extensions
11 In theory, building a central security library is a best practice. In practice, theory sucks! Multiple code repositories Static Application Security Testing (SAST) should check violations Language/ Framework specific Web vs. Native App
12 Difficult To Control All Engineering Parties APIs are documented! Application Security Security requirements are documented! Software R&D Who cares? BYOAPI rocks!! Professional Services
13 RESOURCE DIVERSITY & LIMITATIONS
14 Distinct Technologies The trademarks specified above are trademarks or registered trademarks of their respective owners. This slide is intended for informational purposes only and does not represent any endorsement
15 Diverse Application Security Tools Static Application Security Testing (SAST) Dynamic Application Security Testing (DAST) Interactive Application Security Testing (IAST) Software Composition Analysis & More Mobile AST Container Security Code Obfuscation The trademarks specified above are trademarks or registered trademarks of their respective owners. This slide is intended for informational purposes only and does not represent any endorsement.
16 Labor Limitations 1%-2% What is the Application Security labor percentage of the engineering labor? of engineering org size
17 APPLICATION SECURITY MATURITY PROGRAM Maturity is knowing when and where to be immature
18 Governance Easy To Say, Difficult To Control Best Practice Develop an S-SDLC Enforce the S-SDLC Provide Technology-Specific Training Define Risk Management & Risk Acceptance Process Map, Track & Drive Towards Completion Of Trainings Get Executives To Sign On A Security Risk
19 Construction Relatively Difficult Threat Assessment Documenting risks in agile development lifecycle consumes much resources Security Requirements Should app security be involved in ALL requirements sessions? Security Architecture Providing best practices for various product types
20 Verification Roadblocks Ahead! Design Review Get a design diagram from engineering teams lots of teams!!! Working with many smart engineering people they know everything! Code Review Utilizing automation is great if ALL bug tracking, code repo, and build systems are centralized Scaling automation for 100 products is nearly impossible (technology & labor wise) Building a central security library is a waste of time if technologies are vary! Security Testing Automation = [sophisticated] vulnerability scanning. Manual work = penetration test! $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
21 Deployment Only Sounds Easy Shadow -operated IRT Corporate IRT Work w/ every engineering team to QA hardening If I define & It doesn t work, they re responsible
22 Perspective On 1 Of 100 Products Application Security Maturity Overview Operational Enablement Strategy & Metrics Policy & Compliance 2.60 Environment Hardening Education & Guidance 0.50 Issue Management Threat Assessment 1.67 Security Testing Security Requirements Implementation Review Secure Architecture Design Analysis
23 Perspective On 1 Of 100 Products Created vs. Resolved Chart: Product X Security Bugs /17 2/17 3/17 4/17 5/17 6/17 7/17 Additional Considerations Number of items per development lifecycle stage E.g. pending QA, not started, in dev, etc. Average time to mitigate a vulnerability Prioritized list of outstanding Epics/US/Bugs Bugs Created Bugs Resolved
24 Perspective On 100 Products
25 Perspective On 100 Products Product names are sanitized
26 DON T REINVENT THE WHEEL, JUST REALIGN IT (Anthony J. D Angelo)
27 NCR s App Sec Team s Specialties Application Security Architect Application Security Engineer Application Security Program Manager Application Security Risk & Compliance Manager
28 NCR s App Sec Team s Specialties Mapping OpenSAMM Domain Activity Security Architecture Program Management Speciality Risk Management & Compliance Application Security Engineering Governance Strategy & Metrics V V Policy & Compliance V Education & Guidance V V V V Construction Threat Assessment V Security Requirements V V V Secure Architecture V Verification Design Review V Code Review V V Security Testing V Deployment Vulnerability Mgmt V V Environment Hardening V Operational Enablement V
29 Prioritizing Security Product Type Strategy Financial Impact Internal Regulated Internet- Facing & Regulated Investments & Commitments $1M- $5M >$5M Internal Internet- Facing <$500K $500K- $1M 29
30 Budgeting Labor Correctly The Formula Product Type % Of R&D Product Type % Of AppSec Internet-Facing & Regulated 2% Internet-Facing 1% Internal & Regulated 1% Internal 0.3% R&D Labor Count Program Manager 20% Risk & Compliance 10% Architecture 23% Engineering 47% Example An Internet-facing & regulated product suite that is developed by an org size of 1000 employees needs: 2% X 1000 = 20 App Sec Team Members, consisting of 4 PM, 2 R&C, 4.6 Architects and 9.4 Engineers
31 A Lesson Learned Even with an aggressive strategy, hiring app sec people is a REAL bottleneck!
32 A Satellite Program Give a poor man a fish and you feed him for a day. Teach him to fish and you give him an occupation that will feed him for a lifetime. (Chinese proverb.)
33 A Satellite Program Example Yellow Belt Green Belt Brown Belt Black Belt Online Training Instructor-led or conferences participation Special Interest Static/Dynamic/Interac tive Security Analysis Advanced Foundation app sec classes On-boarding Advanced classes Various advanced topics PII, GDPR, PCI, FFIEC Tool/Process improvement Threat modeling Standards review, reusable IP
34 Measuring Effectiveness! Ongoing Escalations asking for security resources by the engineering teams are good! Status reports must be balanced Neither too Green nor Red
35 Measuring Effectiveness! Year Over Year Overall Application Security Maturity rank increases Decreased number of security vulnerability reporting per X (you to define) lines of code Engineers will always make mistakes Use 3 rd parties to assess it
36 Scaling Out Team s Capabilities Security Questionnaire For Engaging An App Sec Architect 10 Yes/No Questions 36
37 Scaling Out Team s Capabilities Security Questionnaire For Engaging An App Sec Architect Is Data Classified? 10 Yes/No Questions Do You Follow The S- Security Automation SDLC? Handle Sensitive Data Related To PII/PCI? Integrated Into Pipeline? Data Encryption? Consumer-Facing Mobile App? 37
38 Scaling Out Team s Capabilities Security Questionnaire For Engaging An App Sec Architect Workflow 10 Yes/No Questions Best Collaboration Page Better File Good 38
39 Scaling Up Security Application Security Must Fit Into Any Pipeline DEV OPS Plan Code Build Test Release Deploy Operate Continuous Delivery Continuous Integration Agile Development 39
40 Scaling Up Security Using Release Automation Static App Sec Testing Interactive App Sec Testing (IAST) Binary Signing Code Obfuscation Dynamic App Sec Testing (DAST) Vulnerability Scanning Runtime App Self Protection (RASP) Dynamic App Sec Testing (DAST) Vulnerability Scanning Runtime App Self Protection (RASP) 40
41 Scaling Up Security When Lacking Automation Identify Quick Wins Code Obfuscation Dynamic App Sec Testing (DAST) Static App Sec Testing Binary Signing Penetration Tests Manual Code Review Vulnerability Scanning Even A Long-Term Plan Is A Viable Plan
42 Finding The Partnerships Use Cases Customer Needs Industry Trends Regulations Partnerships Security
43 Additional Tips Securing 100 products takes years. Start by investing 80% of the resources in 20% of the products. Reflect your success! Trending charts of app sec metrics Integration of tools into the build process Share product certifications completion Speak at Black Hat J
44 44
45 Apply What You Have Learned Today Next week you should: Generate security engagement questionnaire (10 Yes/No Qs) Identify security tool implementation quick wins In the first three months following this presentation you should: Establish an application security maturity program Develop a product security strategy based on Company s strategy Development methodologies & pipelining tools Product Types Within six months you should: Hopefully map all products & owners J Start executing the strategy
46 THANK YOU Nir
SDLC Maturity Models
www.pwc.com SDLC Maturity Models SecAppDev 2017 Bart De Win Bart De Win? 20 years of Information Security Experience Ph.D. in Computer Science - Application Security Author of >60 scientific publications
DevOps Anti-Patterns. Have the Ops team deal with it. Time to fire the Ops team! Let s hire a DevOps unit! COPYRIGHT 2019 MANICODE SECURITY
DevOps Anti-Patterns Have the Ops team deal with it. Time to fire the Ops team! Let s hire a DevOps unit! 31 Anti-Pattern: Throw it Over the Wall Development Operations 32 Anti-Pattern: DevOps Team Silo
AppScan Deployment APPLICATION SECURITY SERVICES. Colin Bell. Applications Security Senior Practice Manager
APPLICATION SECURITY SERVICES AppScan Deployment Colin Bell Applications Security Senior Practice Manager Copyright 2017 HCL Products & Platforms www.hcltech.com The Evolution of Devops 2001 - Continuous
Application Security at Scale
Jake Marcinko Standards Manager, PCI Security Standards Council Jeff Williams CTO, Contrast Security Application Security at Scale AppSec at Scale Delivering Timely Security Solutions / Services to Meet
In collaborazione con
In collaborazione con 1. Software Security Introduction 2. SDLC frameworks: how OWASP can help on software security 3. OWASP Software Security 5 Dimension Framework 4. Apply the models to a real
Suman Sourav Director DevSecOps, Vantage Point Security. OWASP Indonesia Day 2017
Suman Sourav Director DevSecOps, Vantage Point Security OWASP Indonesia Day 2017 About me Certified Secure Software Lifecycle Professional (CSSLP) 12+ Years of Experience in Software Security Co-Founder
Cloud is the 'Only' Way Forward in Information Security. Leveraging Scale to Make the Unknown Known, in Dev, Sec & Ops.
George Gerchow, Sumo Logic Chief Information Security Officer Cloud is the 'Only' Way Forward in Information Security. Leveraging Scale to Make the Unknown Known, in Dev, Sec & Ops. Agenda Sumo Security
TRAINING CURRICULUM 2017 Q2
TRAINING CURRICULUM 2017 Q2 Index 3 Why Security Compass? 4 Discover Role Based Training 6 SSP Suites 7 CSSLP Training 8 Course Catalogue 14 What Can We Do For You? Why Security Compass? Role-Based Training
DevOps A How To for Agility with Security
DevOps A How To for Agility with Security Murray Goldschmidt, COO Compliance, Protection & Business Confidence Sense of Security Pty Ltd Sydney Level 8, 66 King Street Sydney NSW 2000 Australia Melbourne
Will your application be secure enough when Robots produce code for you?
SESSION ID: ASD-W02 Will your application be secure enough when Robots produce code for you? Hasan Yasar Technical Manager, Faculty Member SEI CMU @securelifecycle With the speed of DevOps It is me! I
SOLUTION BRIEF RSA ARCHER IT & SECURITY RISK MANAGEMENT
RSA ARCHER IT & SECURITY RISK MANAGEMENT INTRODUCTION Organizations battle growing security challenges by building layer upon layer of defenses: firewalls, antivirus, intrusion prevention systems, intrusion
Certified Information Security Manager (CISM) Course Overview
Certified Information Security Manager (CISM) Course Overview This course teaches students about information security governance, information risk management, information security program development,
Brochure. Security. Fortify on Demand Dynamic Application Security Testing
Brochure Security Fortify on Demand Dynamic Application Security Testing Brochure Fortify on Demand Application Security as a Service Dynamic Application Security Testing Fortify on Demand delivers application
Building a Resilient Security Posture for Effective Breach Prevention
SESSION ID: GPS-F03B Building a Resilient Security Posture for Effective Breach Prevention Avinash Prasad Head Managed Security Services, Tata Communications Agenda for discussion 1. Security Posture 2.
Nathan Desmet. Lead Engineer
Nathan Desmet Lead Engineer Degree in Applied Informatics - Computer and Cyber Crime Professional Co-founder of Sensei Security (which is merged with SCW) Leading the development of Sensei. Pieter De Cremer,
Product Security Program
Product Security Program An overview of Carbon Black s Product Security Program and Practices Copyright 2016 Carbon Black, Inc. All rights reserved. Carbon Black is a registered trademark of Carbon Black,
How to spend $3.6M on one coding mistake and other fun stuff you can do with $3.6M. Matias Madou Ph.D., Secure Code Warrior
How to spend $3.6M on one coding mistake and other fun stuff you can do with $3.6M Matias Madou Ph.D., Secure Code Warrior Matias Madou, Ph.D. CTO and Co-Founder Ph.D. in Computer Engineering from Ghent
.NET JAVA C ASE. Certified. Certified. Application Security Engineer.
.NET C ASE Certified Application Security Engineer JAVA C ASE Certified Application Security Engineer Certified Application Security Engineer www.eccouncil.org EC-Council Course Description The Certified
How to Secure Your Cloud with...a Cloud?
A New Era of Thinking How to Secure Your Cloud with...a Cloud? Eitan Worcel Offering Manager - Application Security on Cloud IBM Security 1 2016 IBM Corporation 1 A New Era of Thinking Agenda IBM Cloud
Taking Control of Your Application Security
EDUCAUSE Wednesday, May 3 rd Taking Control of Your Application Security 2017 SANS Institute All Rights Reserved INTRODUCTION Eric Johnson, CISSP, GSSP-Java, GSSP-.NET, GWAPT Application Security Curriculum
AGILE AND CONTINUOUS THREAT MODELS
SESSION ID: DEV-R04 AGILE AND CONTINUOUS THREAT MODELS Nancy Davoust Vice President, Security Architecture and Technology Solutions Comcast CONTEXT FOR AGILE AND CONTINUOUS THREAT MODELING The Landscape
TWELVEDOT SECURITY DESIGN.BUILD.SECURE
TWELVEDOT SECURITY DESIGN.BUILD.SECURE 1 AGENDA About Us The Threat Landscape IoT Standards Using an ISMS Approach Testing and Evaluation Privacy Considerations 2 ABOUT US - YOW based company - Global
locuz.com SOC Services
locuz.com SOC Services 1 Locuz IT Security Lifecycle services combine people, processes and technologies to provide secure access to business applications, over any network and from any device. Our security
Embedding GDPR into the SDLC. Sebastien Deleersnyder Siebe De Roovere
Embedding GDPR into the SDLC Sebastien Deleersnyder Siebe De Roovere Who is Who? Sebastien Deleersnyder 5 years developer experience 15+ years information security experience Application security consultant
CLOUD GOVERNANCE SPECIALIST Certification
CLOUD GOVERNANCE SPECIALIST Certification The Cloud Professional (CCP) program from Arcitura is dedicated to excellence in the fields of cloud computing technology, mechanisms, platforms, architecture,
The Business Case for Security in the SDLC
The Business Case for Security in the SDLC Make Security Part of your Application Quality Program Otherwise, Development Teams Don t View it is Part of their Job The notion of application quality, which
Quality Assurance and IT Risk Management
Quality Assurance and IT Risk Deutsche Bank s QA and Testing Transformation Journey Michael Venditti Head of Enterprise Testing Services, Deutsche Bank IT RISK - REGULATORY GOVERNANCE Major shifts in the
90% of data breaches are caused by software vulnerabilities.
90% of data breaches are caused by software vulnerabilities. Get the skills you need to build secure software applications Secure Software Development (SSD) www.ce.ucf.edu/ssd Offered in partnership with
Global Security Consulting Services, compliancy and risk asessment services
Global Security Consulting Services, compliancy and risk asessment services Introduced by Nadine Dereza Presented by Suheil Shahryar Director of Global Security Consulting Today s Business Environment
Application Security Kung-Fu Competitive Advantage from Threat Modeling
Application Security Kung-Fu Competitive Advantage from Threat Modeling Akshay Aggarwal Practice Manager (North America & LATAM) Akshaya AT Microsoft Dot com ACE Team Microsoft Information Security Agenda
Continuously Discover and Eliminate Security Risk in Production Apps
White Paper Security Continuously Discover and Eliminate Security Risk in Production Apps Table of Contents page Continuously Discover and Eliminate Security Risk in Production Apps... 1 Continuous Application
Six Weeks to Security Operations The AMP Story. Mike Byrne Cyber Security AMP
Six Weeks to Security Operations The AMP Story Mike Byrne Cyber Security AMP 1 Agenda Introductions The AMP Security Operations Story Lessons Learned 2 Speaker Introduction NAME: Mike Byrne TITLE: Consultant
Weaving Security into Every Application
Weaving Security into Every Application Paul Fox AVP Technology AT&T 2018 TM Forum 1 Cyber Security Accelerating Threat Telecom Breaches 300,000 Number of complaints filed with the FBI Internet Crime Complaint
Session 408 Tuesday, October 22, 10:00 AM - 11:00 AM Track: Industry Insights
Session 408 Tuesday, October 22, 10:00 AM - 11:00 AM Track: Industry Insights ITIL Success: Five Years Later Paul Fibkins Director and Founder, FIBKO LLC fibkinsp@hotmail.com Session Description In 2007,
ISSMP is in compliance with the stringent requirements of ANSI/ISO/IEC Standard
Certification Exam Outline Effective Date: April 2013 About CISSP-ISSMP The Information Systems Security Management Professional (ISSMP) is a CISSP who specializes in establishing, presenting, and governing
Adaptive & Unified Approach to Risk Management and Compliance via CCF
SESSION ID: SOP-W08 Adaptive & Unified Approach to Risk Management and Compliance via CCF Vishal Kalro Manager, Risk Advisory & Assurance Services (RAAS) Adobe @awish11 Disclaimer All the views presented
Converged security. Gerben Verstraete, CTO, HP Software Services Colin Henderson, Managing Principal, Enterprise Security Products
Converged security Gerben Verstraete, CTO, HP Software Services Colin Henderson, Managing Principal, Enterprise Security Products Increased risk and wasted resources Gartner estimates more than $1B in
NEXT GENERATION CLOUD SECURITY
SESSION ID: CMI-F02 NEXT GENERATION CLOUD SECURITY Myles Hosford Head of FSI Security & Compliance Asia Amazon Web Services Agenda Introduction to Cloud Security Benefits of Cloud Security Cloud APIs &
SANS AppSec AppSec what can you learn from small companies? What Works and What Doesn t
SANS AppSec 2012 AppSec what can you learn from small companies? What Works and What Doesn t About Me 25 years experience in software development and Ops Mostly in small companies designing and building
National State Auditors Association Vulnerability Management: An Audit Primer September 20, 2018
Office of the Legislative Auditor State of Minnesota National State Auditors Association Vulnerability Management: An Audit Primer September 20, 2018 Christopher Buse Deputy Legislative Auditor Boot Camp
SECURITY TRAINING SECURITY TRAINING
SECURITY TRAINING SECURITY TRAINING Addressing software security effectively means applying a framework of focused activities throughout the software lifecycle in addition to implementing sundry security
Robots with Pentest Recipes:
Robots with Pentest Recipes: Democratizing Security Testing for DevOps Wins Abhay Bhargav - CTO, we45 Yours Truly Co-author of Secure Java For Web Application Development Author of PCI Compliance: A Definitive
MHA Consulting BCM Metrics Resiliency Through Measurement
0 MHA Consulting BCM Metrics Resiliency Through Measurement Presented by: Michael Herrera, CBCP March, 2013 2009 2013 MHA MHA Consulting All All Rights Rights Reserved. Reserved. Agenda 1 Overview A Menu
FTA 2017 SEATTLE. Cybersecurity and the State Tax Threat Environment. Copyright FireEye, Inc. All rights reserved.
FTA 2017 SEATTLE Cybersecurity and the State Tax Threat Environment 1 Agenda Cybersecurity Trends By the Numbers Attack Trends Defensive Trends State and Local Intelligence What Can You Do? 2 2016: Who
CISO View: Top 4 Major Imperatives for Enterprise Defense
CISO View: Top 4 Major Imperatives for Enterprise Defense James Christiansen Chief Information Security Officer Evantix, Inc. Gary Terrell CIPP Chief Information Security Officer Adobe Session ID: Star
Run the business. Not the risks.
Run the business. Not the risks. RISK-RESILIENCE FOR THE DIGITAL BUSINESS Cyber-attacks are a known risk to business. Today, with enterprises becoming pervasively digital, these risks have grown multifold.
Threat and Vulnerability Assessment Tool
TABLE OF CONTENTS Threat & Vulnerability Assessment Process... 3 Purpose... 4 Components of a Threat & Vulnerability Assessment... 4 Administrative Safeguards... 4 Logical Safeguards... 4 Physical Safeguards...
Cloud Customer Architecture for Securing Workloads on Cloud Services
Cloud Customer Architecture for Securing Workloads on Cloud Services http://www.cloud-council.org/deliverables/cloud-customer-architecture-for-securing-workloads-on-cloud-services.htm Webinar April 19,
Best Practices in Securing a Multicloud World
Best Practices in Securing a Multicloud World Actions to take now to protect data, applications, and workloads We live in a multicloud world. A world where a multitude of offerings from Cloud Service Providers
Development. Architecture QA. Operations
Development Architecture QA Operations Lack of business agility Slow to onboard new customers Hard to practice true DevOps Outpaced by disruptors Rogue dev projects Lack of SecOps agility Slow threat assessments
A company built on security
Security How we handle security at Flywheel Flywheel was founded in 2012 on a mission to create an exceptional platform to help creatives do their best work. As the leading WordPress hosting provider for
Sage Data Security Services Directory
Sage Data Security Services Directory PROTECTING INFORMATION ASSETS ENSURING REGULATORY COMPLIANCE FIGHTING CYBERCRIME Discover the Sage Difference Protecting your business from cyber attacks is a full-time
Automating the Top 20 CIS Critical Security Controls
20 Automating the Top 20 CIS Critical Security Controls SUMMARY It s not easy being today s CISO or CIO. With the advent of cloud computing, Shadow IT, and mobility, the risk surface area for enterprises
THE POWER OF TECH-SAVVY BOARDS:
THE POWER OF TECH-SAVVY BOARDS: LEADERSHIP S ROLE IN CULTIVATING CYBERSECURITY TALENT SHANNON DONAHUE DIRECTOR, INFORMATION SECURITY PRACTICES 1 IT S A RISK-BASED WORLD: THE 10 MOST CRITICAL UNCERTAINTIES
DevSecOps Why Aren t You Doing It? Brian Liceaga, CISSP 1
DevSecOps Why Aren t You Doing It? Brian Liceaga, CISSP 1 Agenda State of DevOps Value of DevOps Benefitting from DevOps DevSecOps What you can do as InfoSec 2 The State of DevOps - 2017 Automation is
CLOUD SECURITY SPECIALIST Certification. Cloud Security Specialist
CLOUD SECURITY SPECIALIST Certification Cloud Security The Cloud Professional (CCP) program from Arcitura is dedicated to excellence in the fields of cloud computing technology, mechanisms, platforms,
Effective Application Security Testing at High Velocity: Keeping up with Agile / DevOps February 28, 2017 Today s Speaker:
Effective Application Security Testing at High Velocity: Keeping up with Agile / DevOps February 28, 2017 Today s Speaker: Cindy Blake CISSP Product Marketing Manager Hewlett Packard Enterprise Effective
Internet of Things. Internet of Everything. Presented By: Louis McNeil Tom Costin
Internet of Things Internet of Everything Presented By: Louis McNeil Tom Costin Agenda Session Topics What is the IoT (Internet of Things) Key characteristics & components of the IoT Top 10 IoT Risks OWASP
WITH ACTIVEWATCH EXPERT BACKED, DETECTION AND THREAT RESPONSE BENEFITS HOW THREAT MANAGER WORKS SOLUTION OVERVIEW:
SOLUTION OVERVIEW: ALERT LOGIC THREAT MANAGER WITH ACTIVEWATCH EXPERT BACKED, DETECTION AND THREAT RESPONSE Protecting your business assets and sensitive data requires regular vulnerability assessment,
Day One Success for DevSecOps and Automation on Azure
Day One Success for DevSecOps and Automation on Azure Chris Jeffrey Senior Cloud Architect Microsoft Azure Cloud Technology Partners, A Hewlett Packard Enterprise Company Twitter: @chrisjeffrey_uk What
Rethinking Product Security: Cloud Demands a New Way
SESSION ID: CSV-R11 Rethinking Product Security: Cloud Demands a New Way Reeny Sondhi Chief of Product Security Autodesk Inc. @reenysondhi Tony Arous Head of Application Security Autodesk Inc. @tonyarous
Embedding Privacy by Design
Embedding Privacy by Design Metric Stream Customer Conference May 12, 2015 TRUSTe Data Privacy Management Solutions 1 Today s Agenda Privacy in the Context of GRC Data Privacy Management and Top Privacy
National Initiative for Cyber Education (NICE) and the Cybersecurity Workforce Framework: Attract and Retain the Best in InfoSec.
National Initiative for Cyber Education (NICE) and the Cybersecurity Workforce Framework: Attract and Retain the Best in InfoSec April 12, 2018 1 Introduction to NICE - The National Initiative for Cybersecurity
Automating Security Practices for the DevOps Revolution
Automating Security Practices for the DevOps Revolution Hari Srinivasan Director Product Management, Cloud and Virtualization Security Qualys Inc. 1 Qualys, Inc. 2018 Agenda Transformation of today s IT
Cybersecurity Risk Mitigation: Protect Your Member Data. Introduction
Cybersecurity Risk Mitigation: Protect Your Member Data Presented by Matt Mitchell, CISSP Knowledge Consulting Group Introduction Matt Mitchell- Director Risk Assurance 17 years information security experience
BUILDING CYBERSECURITY CAPABILITY, MATURITY, RESILIENCE
BUILDING CYBERSECURITY CAPABILITY, MATURITY, RESILIENCE 1 WHAT IS YOUR SITUATION? Excel spreadsheets Manually intensive Too many competing priorities Lack of effective reporting Too many consultants Not
Jim Reavis CEO and Founder Cloud Security Alliance December 2017
CLOUD THREAT HUNTING Jim Reavis CEO and Founder Cloud Security Alliance December 2017 A B O U T T H E BUILDING SECURITY BEST PRACTICES FOR NEXT GENERATION IT C L O U D S E C U R I T Y A L L I A N C E GLOBAL,
Mobile Malfeasance. Exploring Dangerous Mobile Code. Jason Haddix, Director of Penetration Testing
Mobile Malfeasance Exploring Dangerous Mobile Code Jason Haddix, Director of Penetration Testing Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject to
Meeting PCI DSS 3.2 Compliance with RiskSense Solutions
Meeting PCI DSS 3.2 Compliance with Solutions Platform the industry s most comprehensive, intelligent platform for managing cyber risk. 2018, Inc. What s Changing with PCI DSS? Summary of PCI Business
Digital Service Management (DSM)
Digital Service Management (DSM) A Proactive, Collaborative and Balanced Approach for Securing, Managing and Improving the Online Services that Drive the Digital Enterprise itsm003 v.3.0 Agenda and Objectives
Discover Best of Show März 2016, Düsseldorf
Discover Best of Show 2016 2. - 3. März 2016, Düsseldorf 2. - 3. März 2016 Softwaresicherheit im Zeitalter von DevOps Lucas von Stockhausen Regional Product Manager Fortify The case for Application Security
Accelerate Your Enterprise Private Cloud Initiative
Cisco Cloud Comprehensive, enterprise cloud enablement services help you realize a secure, agile, and highly automated infrastructure-as-a-service (IaaS) environment for cost-effective, rapid IT service
Surprisingly Successful: What Really Works in Cyber Defense. John Pescatore, SANS
Surprisingly Successful: What Really Works in Cyber Defense John Pescatore, SANS 1 Largest Breach Ever 2 The Business Impact Equation All CEOs know stuff happens in business and in security The goal is
OWASP - SAMM. OWASP 12 March The OWASP Foundation Matt Bartoldus Gotham Digital Science
OWASP - SAMM Matt Bartoldus Gotham Digital Science OWASP 12 March 2009 Copyright The OWASP Foundation Permission is granted to copy, distribute and/or modify this document under the terms of the OWASP
Nebraska CERT Conference
Nebraska CERT Conference Security Methodology / Incident Response Patrick Hanrion Security Center of Excellence Sr. Security Consultant Agenda Security Methodology Security Enabled Business Framework methodology
A Strategic Approach to Web Application Security
A STRATEGIC APPROACH TO WEB APP SECURITY WHITE PAPER A Strategic Approach to Web Application Security Extending security across the entire software development lifecycle The problem: websites are the new
Information Security In Pakistan. & Software Security As A Quality Aspect. Nahil Mahmood, Chairman, Pakistan Cyber Security Association (PCSA)
Information Security In Pakistan & Software Security As A Quality Aspect Nahil Mahmood, Chairman, Pakistan Cyber Security Association (PCSA) Software Quality [Includes Security] LETS OWN SECURITY! Agenda
10 FOCUS AREAS FOR BREACH PREVENTION
10 FOCUS AREAS FOR BREACH PREVENTION Keith Turpin Chief Information Security Officer Universal Weather and Aviation Why It Matters Loss of Personally Identifiable Information (PII) Loss of Intellectual
News Flash: Some Things Actually Do Work in Security!!!
SESSION ID: STR-T07R News Flash: Some Things Actually Do Work in Security!!! John Pescatore Director, Emerging Security Trends SANS Institute @John_Pescatore Largest Breach Ever A Short Reality Break
Embedding GDPR into the SDLC
Embedding GDPR into the SDLC Sebastien Deleersnyder Siebe De Roovere Toreon 2 Who is Who? Sebastien Deleersnyder Siebe De Roovere 5 years developer experience 15+ years information security experience
Building Security Into Applications
Building Security Into Applications Cincinnati Chapter Meetings Marco Morana Chapter Lead Blue Ash, July 30 th 2008 Copyright 2008 The Foundation Permission is granted to copy, distribute and/or modify
V Conference on Application Security and Modern Technologies
V Conference on Application Security and Modern Technologies In collaborazione con Venezia, Università Ca Foscari 6 Ottobre 2017 1 Matteo Meucci OWASP Nuovi standard per la sicurezza applicativa 2
Best Practices & Lesson Learned from 100+ ITGRC Implementations
Best Practices & Lesson Learned from 100+ ITGRC Implementations Presenter: Vivek Shivananda CEO of Rsam Dec 3, 2010 ISACA -NY Chapter Copyright 2002 2010 Relational Security Corp. (dba Rsam) Agenda Overview
Evolution of Cyber Attacks
Update from the PCI Security Standards Council Troy Leach, CTO, PCI Security Standards Council Evolution of Cyber Attacks Viruses Worms Trojan Horses Custom Malware Advanced Persistent Threats 1 Modern
Managing Privacy Risk & Compliance in Financial Services. Brett Hamilton Advisory Solutions Consultant ServiceNow
Managing Privacy Risk & Compliance in Financial Services Brett Hamilton Advisory Solutions Consultant ServiceNow 1 Speaker Introduction INSERT PHOTO Name: Brett Hamilton Title: Advisory Solutions Consultant
Survey Results: Virtual Insecurity
Best Practices SURVEY Survey Results: Virtual Insecurity May 2013 Executive Summary: Virtual Assets Could Bring Real Risk Virtualization technologies have reshaped how IT offers and delivers their services
Risk: Security s New Compliance. Torsten George VP Worldwide Marketing and Products, Agiliance Professional Strategies - S23
Risk: Security s New Compliance Torsten George VP Worldwide Marketing and Products, Agiliance Professional Strategies - S23 Agenda Market Dynamics Organizational Challenges Risk: Security s New Compliance
How to Evaluate a Next Generation Mobile Platform
How to Evaluate a Next Generation Mobile Platform appcelerator.com Introduction Enterprises know that mobility presents an unprecedented opportunity to transform businesses and build towards competitive
TIPS FOR FORGING A BETTER WORKING RELATIONSHIP BETWEEN COUNSEL AND IT TO IMPROVE CYBER-RESPONSE
TIPS FOR FORGING A BETTER WORKING RELATIONSHIP BETWEEN COUNSEL AND IT TO IMPROVE CYBER-RESPONSE Association of Corporate Counsel NYC Chapter 11/1 NYC BDO USA, LLP, a Delaware limited liability partnership,
Operationalizing Cybersecurity in Healthcare IT Security & Risk Management Study Quantitative and Qualitative Research Program Results
Operationalizing Cybersecurity in Healthcare - - 2017 IT Security & Risk Management Study Quantitative and Qualitative Research Program Results David S. Finn, CISA, CISM, CRISC Health IT Officer, Symantec
PROTECT AND AUDIT SENSITIVE DATA
PROTECT AND AUDIT SENSITIVE DATA Teleran Data and Compliance KEY FEATURES Monitors user, application, query and data usage activity Enforces data access policies in real-time Alerts staff in real-time
Atlassian. Atlassian Software Development and Collaboration Tools. Bugcrowd Bounty Program Results. Report created on October 04, 2017.
Atlassian Software Development and Collaboration Tools Atlassian Bugcrowd Bounty Program Results Report created on October 04, 2017 Prepared by Ryan Black, Director of Technical Operations Table of Contents
SYMANTEC DATA CENTER SECURITY
SYMANTEC DATA CENTER SECURITY SYMANTEC UNIFIED SECURITY STRATEGY Users Cyber Security Services Monitoring, Incident Response, Simulation, Adversary Threat Intelligence Data Threat Protection Information
CipherCloud CASB+ Connector for ServiceNow
ServiceNow CASB+ Connector CipherCloud CASB+ Connector for ServiceNow The CipherCloud CASB+ Connector for ServiceNow enables the full suite of CipherCloud CASB+ capabilities, in addition to field-level
Is Your Web Application Really Secure? Ken Graf, Watchfire
Is Your Web Application Really Secure? Ken Graf, Watchfire What we will discuss today Pressures on the application lifecycle Why application security defects matter How to create hacker resistant business
Cloud Security Whitepaper
Cloud Security Whitepaper Sep, 2018 1. Product Overview 3 2. Personally identifiable information (PII) 3 Using Lookback without saving any PII 3 3. Security and privacy policy 4 4. Personnel security 4
Welcome to Staying Ahead Webinar
Welcome to Staying Ahead Webinar Migrating to NNMi 1 Footer Goes Here Agenda 1. NNMi features and benefits 2. PSQS / Education offerings around NNMi 3. Q&A 2 Footer Goes Here Streamline your network operations
Training and Certification. Guide to Learning and Certification Paths
Training and Certification Guide to Learning and Certification Paths Home Contents Back Next Table of Contents ServiceNow Fundamentals Implementer Developer Fulfiller Training 3 Get Certified Become Indispensable
Transformation in Technology Barbara Duck Chief Information Officer. Investor Day 2018
Transformation in Technology Barbara Duck Chief Information Officer Investor Day 2018 Key Takeaways 1Transformation in Technology driving out cost, supporting a more technologyenabled business Our new
Best practices in IT security co-management
Best practices in IT security co-management How to leverage a meaningful security partnership to advance business goals Whitepaper Make Security Possible Table of Contents The rise of co-management...3