Sessions in Detail

Case Study Panel: Real-World Problems Meet Credible Solutions

Moderated by:
Robert, Richardson, Editorial Director, Security Media Group, TechTarget

Nothing communicates the full dimension of a problem and its solution like working through that problem with somebody who’s already been there and succeeded. Our evening case study session will bring forward security program leaders, each addressing a specific project or problem they’ve faced in recent months. They’ll talk through the details of a scenario in a way that will help you anticipate problems in your own situation. The discussion that ensues will help foster innovation among you and your peers – plus, this is a great venue for challenging ideas that sound good on vendor collateral but that don’t pan out when it’s go-time.

Click here to see all sessions

Traffic Interception and Remote Mobile Phone Cloning with a Compromised CDMA Femtocell

Presenter(s)
Tom Ritter, Principal Security Engineer, iSEC Partners

I have a box on my desk that your CDMA cell phone will automatically connect to while you send and receive phone calls, text messages, email and browse the Internet. I own this box. I watch all the traffic that crosses it and you don't even know you're connected to me. Welcome to the New World, where I, not them, own the towers.

A femtocell is a low-power cellular base station given or sold to subscribers by mobile network operators that works just like a small cell tower, using a home Internet connection to interface with the provider network. When in range, a mobile phone will connect to a femtocell as if it were a standard cell tower and send all its traffic through it without any indication to the user.

The state-of-the-art authentication protecting cell phone networks can be an imposing target. However, with the rising popularity of femtocells there is more than one way to attack a cellular network. Inside, they run Linux, and they can be hacked.

During this talk, we will demonstrate how we've used a femtocell for traffic interception of voice calls, SMS, and data in a controlled environment and show active attacks on cellular enabled services. We also demonstrate how we were able to exploit a particular vulnerability in order to remotely clone a mobile device without physical access. Finally, we’ll show how old is new again, and how we need to rethink and redesign protocols and business processes now that the underlying network we rely on is vulnerable to active and passive attacks.

Click here to see all sessions

To BYOD (Bring Your Own Device), or not to BYOD?

Presenter(s)
Ernesto DiGiambattista, Chief Technology & Security Officer, Sentinel Benefits & Financial Group

Beyond technology - Technology and Security Risk professionals need to understand and take stock of compliance and any potential regulatory requirements. This Project addresses how Sentinel approached a BYOD solution that would meet the needs of the business and associates, while addressing all the regulatory requirements. Further, it highlights the importance of non-technical matters that require organizational input and communications if BYOD is to be managed successfully.

Click here to see all sessions

DLP, Redone Right

Presenter(s)
Edward Gardner, Director, Infrastructure and Security Operations, Homesite Insurance

Data Loss Prevention systems are an important part of Homesite's Information Security program. Homesite recently swapped out its existing system in favor of an easier to manage implementation. Implementing a successful DLP solution requires broad cooperation from the business, as well as a deep understanding of the data you are trying to protect. This presentation will cover Homesite's re-implementation of DLP in the enterprise, covering off on pitfalls to avoid and top considerations to keep in mind when rebuilding your DLP program.

Click here to see all sessions

Who's Watching the Watcher

Presenter(s)
William Lewis, Director of Information Technology, State Garden, Inc.

Who's watching the watcher? The watcher should be watching the watcher. As companies refine policies and procedures and add new technologies, what is being done to validate the results of such changes? In this case study, we will talk about how my team tackled auditing and validating policies / procedures, the technologies we used to secure our networks and the approach we have taken to ensure measures that have been put into place are providing the desired results.

Click here to see all sessions

An Identity and Access Management Odyssey: A step-by-step approach to building a global capability for managing access

Presenter(s)
John R. Schramm, Vice President of Global Information Risk Management and Chief Information Risk Officer (CIRO)

Historically, companies have taken a monolithic approach to defining and building a business case for Identity and Access Management (IAM) programs with “everything but the kitchen sink” thrown in.  My experiences in implementing IAM programs at a number of major enterprises lead me to believe that this approach is high risk and prone to failure and that a modular/progressive approach is more successful and likely to result in positive forward progress for companies.  In this talk, I will describe the approach that our IAM team has landed on to build capability in a progressive and modular fashion.  Our IAM approach has generated very positive business results while at the same time building our capability and maturity in the access management area.

 

Click here to see all sessions

Executive Keynote: Managing for Sanity

Presenter(s)
Anne Kuhns, Information Security Professional, Former CISO for The Walt Disney Company

Information security professionals deal with an incredible amount of change in their discipline. The rate of change in technology advancements accelerates unchecked, there are four generations of employees in the work place, data is everywhere, data volume is skyrocketing, and this is all occurring while the threat landscape and our exposure footprint becomes more diverse than ever before.

As security professionals we face new challenges and new choices every day. How do we keep up? Can we? In this keynote, Anne discusses her thoughts about how she was able to maintain some semblance of order amidst all the chaos which may give you some thoughts about how you, too, can keep your sanity through it all.

Click here to see all sessions

Pragmatic Cloud Security

Presenter(s)
Rich Mogull, Analyst & CEO, Securosis

As the pace of cloud adoption continues unabated, security professionals face the challenge of protecting a still-emerging technology. This session establishes the basics of security for cloud computing, with an emphasis on where the cloud is different from your existing environment. Rather than rehashing security platitudes and generalities, we'll focus on concrete, cloud specific, and dare we say "pragmatic" approaches to get started on cloud security.

This session will also cover:

  • From a security perspective, how specifically cloud changes the game.
  • Practical ways to communicate cloud security and risk to the rest of the business.
  • How to build a secure private cloud.
  • How to secure the cloud management plane.
  • The top tips for securing public cloud deployments.
  • Integrating identity management with your cloud deployments.

Click here to see all sessions

It's Finally Time to Love SIEM

Presenter(s)
Karen Scarfone, Principal Consultant, Scarfone Cybersecurity

A few years back, SIEM offered far more irritation than actionable information. Now, product offerings are more mature and better integrated so that more complex data sets can be assimilated and analyzed. This session looks at how SIEM tools are likely to evolve in the next 2-3 years, how you can lay the groundwork now for more effective SIEM use later, and what operation tips and tricks can enhance your SIEM deployment.

Click here to see all sessions

Going Beyond Mobile Device Management - Leveraging NAC for Mobile Devices

Presenter(s)
G. Mark Hardy, Founder and President, National Security Corporation

Historically, NAC was the way to control guest use of the enterprise network. While it serves that purpose quite well, it also offers capabilities that make it applicable to a larger number of strategic uses. In this session, we’ll take a look at some of those other cases, including the control of mobile devices and coping with the complexities of BYOD.

Click here to see all sessions

The Truth About Enterprise Mobile Security Products

Presenter(s)
Jack Madden, Editor, BrianMadden.com and SearchVirtualDesktop.com

Mobile security products and enterprise mobility management solutions are flooding the market today. CISOs and device administrators have all been exposed to these products and are wondering the same things: Are they effective? What do they actually protect users from? This session will compare the approaches taken by mobile security suites and enterprise mobility management solutions (including mobile device management and mobile app management tools) to give attendees a better grasp on the current state of mobile security and what the real challenges are today. Attendees will learn the validity of deploying mobile security products and enterprise mobility management solutions in their organization and will leave ready to make a more informed decision about the mobile security posture of their organization.

Click here to see all sessions

Data Security for Cloud Computing

Presenter(s)
Rich Mogull, Analyst & CEO, Securosis

One of the top concerns when moving into cloud computing is protecting your digital assets- the data. As with managed services, we trust an outsider with sensitive information, but now we may be doing so in a multitenant environment with limited custom security controls. This session will focus on data security for cloud computing and explore public and private clouds, and techniques for software, platform, and infrastructure as a service.

This session will also cover:

  • Understanding the different cloud data storage models.
  • Techniques for evaluating existing cloud data security controls and limits.
  • How to control data migrating to the cloud.
  • Methods for protecting data in different cloud models.
  • The role of encryption in cloud data security.

Click here to see all sessions

What's Supposed to Happen at the Endpoint NOW?

Presenter(s)
Karen Scarfone, Principal Consultant, Scarfone Cybersecurity

One in five of Information Security magazine's enterprise readers think they won't be committed to static signature malware detection in five years. Which make sense - given that half of the readers don't think the signature scanning approach works well anymore. We know whitelisting is out there. And if you’re not too picky you’ve the capability right out of the box with Window professional. But a few questions linger:

  • Are these strategies in fact the right approach?
  • Is it remotely practical at a typical professional organization?
  • Where does NAC play these days?
  • Is the endpoint now better protected by network-based anomaly detection?

 

This expert session offers a wide-ranging discussion of what's actually going on where the fingers meet the plastic.

Click here to see all sessions

Closing Executive Keynote - When Business Processes Fly the Coop

Presenter(s)
G. Mark Hardy, Founder and President, National Security Corporation

Our business processes are now on the road and we are vulnerable like never before.  We went from PCs to laptops to smartphones, and bring your own device (BYOD) gave us one killer app: email.  But now that the enterprise extends to tablets and always-on connectivity, it's not just about BYOD, but bringing your own apps (BYOA).

So: do you have a mechanism to control software provisioning for every BYOD, or do your users just download at will?  Now that our mission critical functions are no longer within our span of control in the same (technical) sense they used to be, we must focus on business processes and controls over them.  We must define the technical arrangements necessary to exert and monitor security controls in a meaningful way. We’ll discuss these and other important points in this closing executive keynote session.

Click here to see all sessions