Detroit SecureWorld

2014 Agenda
Exhibition Sessions
Conference Pass
SecureWorld Plus
Executive Track
View All

Day 1

  • 7:00am - 3:00pm9 Registration Open

    Click here to view registration types and pricing.

    Room: Registration Desk
    0
  • 8:00am - 9:15am9 Executive Advisory Board Breakfast: Recruiting & Retaining Cyber Talent (VIP / INVITE ONLY)

    Executive Advisory Board Breakfast: VIP / INVITE ONLY

    Room: Lookout
    3
    Christopher Pierson
  • 8:00am - 9:30am9 Secure World Plus: Planning and Designing a Corporate Information Security Program (SecureWorld Plus Registrants ONLY)

    This class is for SecureWorld Plus Registrants ONLY.
    This class will cover the essential elements for planning, designing, budgeting, implementing, maintaining and assessing a comprehensive information security program.
    A high-level course outline includes:
    1.Creating a Business Case
    2.Developing a Security Program
    •Step 1 - Establish program goals, objectives, critical success factors
    •Step 2 – Document security controls in controls books
    •Step 3 - Apply security controls to critical asset groups to create managed assets
    •Step 4 - Establish security program governance, budget, resources, operations, and implementation roadmap
    3.Documenting Security Controls in Controls Books
    4.Applying Controls to Protect Critical Assets
    5.Establishing a Program Governance Model and Security Operations Center
    6.Auditing / Assessing Security Program Deliverables
    7.Establishing an Information Security Exchange (ISX)

    The course is based on the University of Massachusetts Information Security Program, which was the ISE® North America Project Award Winner 2013 - Academic/Public Sector Category.

    An executive summary of the UMASS program: The University of Massachusetts Cyber-security initiative involves planning, designing, implementing and managing a University-wide technology-based program based on the SANS 20 Critical Security Controls (CSC). The main deliverables include IT asset management, software asset management, system and network configuration, malware defenses, vulnerability management, log management, security administration, data loss prevention, etc. The primary goal is to establish technology, implementation and security monitoring standards that are implemented and managed across all five campuses (Amherst, Boston, Dartmouth, Lowell, Worcester Medical School), UMASS On-line and the President’s Office. Successful implementation of this program ensures the University reduces the impact and exposure of a Cyber-security threat.

    Room: 106
    2
    Larry Wilson
  • 8:30am - 9:15am9 Game Changer – Why You Can’t Afford to be Wrong About Risk Management

    Healthcare Consumerism means a new world for healthcare. Already behind the curve on security and risk, many healthcare organizations either don’t have risk management or they are doing it wrong. This can be a fatal mistake as only the healthcare organizations that are able to identify, quantify and operationalize risk will emerge as victors in this brave new world.

    Room: 101
    1
    Jane Harper
  • 8:30am - 9:15am9 Surviving an Audit

    Achieving successful audit results are imperative for business regulatory compliance, as well as customer retention. What are the basics of an IT audit focusing on information security controls and how can a company achieve favorable audit results? Satisfying auditors’ information security requests and a walk-through of the audit process will be discussed.

    Room: Suite 3
    1
    Dr. Faith Heikkila
  • 8:30am - 9:15am9 We’re All in This Together: Turning Adversaries Into Allies

    How many people are on your Security team? The answer should be, “Everybody in the company!” With this session we will review some of the tools and techniques that allow you to engage the company at every level and turn them from adversaries into allies.

    Room: 103
    1
    Robert Keefer
  • 9:00am - 3:00pm9 Exhibit Floor Open Please check back for presentation details.
    0
  • 9:30am - 10:15am9 OPENING KEYNOTE: The Evolving Cybersecurity Threat Matrix and Legal Landscape

    The Cybersecurity threats to US business continue to grow each day, the bad actors continue to attack, and the legal landscape is trying to keep pace. Ensuring that your company is not the victim of the next intrusion or data breach is now a critical part of your company’s business. Understanding the various Cybersecurity threats and trends from an information security, risk, legal and critical infrastructure perspective is crucial to successfully surmounting these challenges.

    Room: Keynote Theater
    0
    Christopher Pierson
  • 10:15am - 11:15am9 (ISC)2 Chapter Meeting

    This is an open meeting.

    Room: Lookout
    0
  • 10:15am - 11:15am9 Conference Break / Exhibitor Product Demonstration Please check back for presentation details.
    0
  • 11:00am - 12:00pm9 Executive Roundtable - DLP & the Human Factor (INVITE ONLY)

    VIP / INVITE ONLY

    Room: Executive Boardroom
    3
  • 11:15am - 12:00pm9 Firemon: Highway Traffic Engineering: A Study in Proactive Security & Risk Management

    Automobile Congestion, Back-ups, Road-Rage... we have all experienced the frustration of sitting in traffic jams on the highways and byways of this great land. While there has been a significant increase in the amount of highway capacity over the past 30 years, traffic congestion continues to grow unabated. In this session, we will study the fascinating history of highway traffic engineering, the tools traffic engineers utilize to solve the problem of congestion, and we will learn if there have been any modern advancements within the field that have effectively solved the problem of traffic congestion. Attendees will learn there are a number of similarities between traffic engineering and proactive security & risk management within enterprise network security, and a number of parallels will be drawn between the two fields to show how the same principles from the traffic engineering world can be applied to solve the risk challenge within network security management.

    Room: 105
    0
    Ward Holloway
  • 11:15am - 12:00pm9 SecureWorld Expo IT Security Jeopardy

    Be a contestant and learn the facts that elude you! Challenge yourself against different security categories based upon America’s favorite quiz show. There is no grand prize trip, you won’t win money, but you will have a great time and gain knowledge during the presentation. The categories that will challenge you will range from encryption, regulatory guidelines, network security, cloud security, mobile security and much more.

    Room: 103
    1
    Clark R. Crain Tim Kennedy
  • 11:15am - 12:00pm9 Selling Security to Management

    As trained and certified network and security professionals we are ready to implement solutions to solve the security problems of our organization. If only we could get management to listen to our advice.

    To begin becoming successful it will be important to understand what management really wants to accomplish. In this presentation we will examine the steps needed to ensure that you and the program you develop meet the expectations of management. To do this we will examine methods to be used to prepare to sell your message to management.

    Room: Suite 3
    1
    Thomas R. Peltier
  • 11:15am - 12:00pm9 U.S. vs E.U. – A Privacy Cage Match

    A legislative and policy battle rages between the U.S. and the E.U. – one emerging from their respective views on privacy. This session sets the stage for this global cage match, discusses trends of concern to security practitioners, and contemplates the future of data protection in our global economy.

    Room: Keynote Theater
    1
    Steven F. Fox
  • 12:00pm - 1:00pm9 Executive Roundtable - Preparing for the Inevitable Breach (VIP / Invite Only)

    Executive Track- VIP / INVITE ONLY
    Lunch Served at Noon

    Room: Executive Boardroom
    3
  • 12:15pm - 1:00pm9 LUNCH KEYNOTE: FishNet Security - Threat Intelligence: Friend of the Enterprise

    In today’s ever-evolving threat landscape, having information about new and emerging threats in advance can prevent potential attacks to your network. With actionable intelligence, you can stay ahead of the attackers who may be targeting your organization or identify and take action against existing threats.

    Many organizations realize there is value in obtaining intelligence support, but do not have a thorough enough understanding of the basics of true intelligence and how it can be incorporated as part of the team. Attendees will learn what Threat Intelligence is, how intelligence operations have shifted since the Cold War to the Cyber realm in an historical perspective, and what needs to happen to truly incorporate Threat Intelligence into their Information Security program.

    Room: Keynote Theater
    0
    Danny Pickens
  • 1:15pm - 2:15pm9 Industry Expert Panel: Security in a Mobile World

    There are a wide variety of mobile devices that employees carry to connect to networks around the city, the state, or even the world. Cyber security professionals need a proven way to enforce and extend enterprise data protection. Lack of security training and technology can now be your emergency. How do you safe guard your IT systems without impeding user productivity and efficiency? Ask our experts this question and more on this educational panel discussion.

    FishNet Security

    Nexum, Inc.

    Duo Security

    Technology Engineering Group

    Room: Suite 3
    0
  • 1:15pm - 2:15pm9 Industry Expert Panel: The Emerging Threat Landscape

    The number of cyber security threats is growing every day forcing the need for thorough security assessment and analysis. Join industry leaders discussing emerging threats in the industry for the opportunity to learn what is next in the future of cyber security.

    FishNet Security

    Radware

    Wombat Security

    Symantec

    General Dynamics Fidelis Cybersecurity Solutions

     

     

    Room: Keynote Theater
    0
  • 1:15pm - 2:00pm9 Trend Micro: Stories of Malicious Code in action - APT to CryptoLocker

    Ken Donze presents on malicious code events from the last year. He will be relaying stories from his experiences working with customers along with research found at TrendLabs and news releases.

    Room: 105
    0
    Ken Donze
  • 2:15pm - 3:00pm9 Conference Dessert Break / Exhibitor Product Demonstrations Please check back for presentation details. Room: SecureWorld Exhibit Floor
    0
  • 3:00pm - 3:45pm9 Are We Insane?

    The definition of insanity is doing the same thing over and over expecting different results. The information security industry has been doing the same thing (trying to keep bad guys out) over and over expecting different results. This session will explore why doing the same thing won’t work, and why we need a new paradigm to recover our sanity.

    Room: 103
    1
    David Barton
  • 3:00pm - 3:45pm9 Better Monitoring Thru Threat Modeling & Exercise

    The art of security monitoring is in balancing collecting too little with collecting too much. In this session, we will explore threat modeling for identifying the path attackers take and focusing our monitoring efforts. Next, we will discuss security exercises that simulate the attack and test our incident response.

    Room: 105
    1
    J Wolfgang Goerlich
  • 3:00pm - 3:45pm9 Recorded Session: Spread Spectrum, Wireless Security & the World's Most Beautiful Geek

    Note: This is a previously recorded session.
    In her movies and interviews, she never sounded particularly technical, yet Hedy Lamarr, frequently cited in the 1930’s, 40’s and 50’s as “the most beautiful woman in the world,” was granted the patent on a frequency hopping technique that serves as one of the cornerstones of security for wireless devices even today. Ms Lamarr never received a cent from any of her inventions. She signed over the rights to frequency hopping spread spectrum to the US Navy, but the invention was so far ahead of its time that the Navy didn’t initially understand what it had. We’ll cover her story, her invention, and how it relates to security for the mobile connected world of 2014.

    Room: Keynote Theater
    0
    John O'Leary
  • 3:00pm - 3:45pm9 Roadmap for Success: 20 Critical Controls for Effective Cyber Defense

    Need to roadmap your security plan without a business impact analysis from 15 departments? Want to start on NIST 800-53 without first taking the full documentation plunge? Need to sort through the “fog of more” infosec solutions and tactics? This overview of the Controls and their implementation may be for you.

    Room: 101
    1
    Ken Evans
  • 3:00pm - 4:30pm9 Secure World Plus: Planning and Designing a Corporate Information Security Program (SecureWorld Plus Registrants ONLY)

    This class is for SecureWorld Plus Registrants ONLY.
    This class will cover the essential elements for planning, designing, budgeting, implementing, maintaining and assessing a comprehensive information security program.
    A high-level course outline includes:
    1.Creating a Business Case
    2.Developing a Security Program
    •Step 1 - Establish program goals, objectives, critical success factors
    •Step 2 – Document security controls in controls books
    •Step 3 - Apply security controls to critical asset groups to create managed assets
    •Step 4 - Establish security program governance, budget, resources, operations, and implementation roadmap
    3.Documenting Security Controls in Controls Books
    4.Applying Controls to Protect Critical Assets
    5.Establishing a Program Governance Model and Security Operations Center
    6.Auditing / Assessing Security Program Deliverables
    7.Establishing an Information Security Exchange (ISX)

    The course is based on the University of Massachusetts Information Security Program, which was the ISE® North America Project Award Winner 2013 - Academic/Public Sector Category.

    An executive summary of the UMASS program: The University of Massachusetts Cyber-security initiative involves planning, designing, implementing and managing a University-wide technology-based program based on the SANS 20 Critical Security Controls (CSC). The main deliverables include IT asset management, software asset management, system and network configuration, malware defenses, vulnerability management, log management, security administration, data loss prevention, etc. The primary goal is to establish technology, implementation and security monitoring standards that are implemented and managed across all five campuses (Amherst, Boston, Dartmouth, Lowell, Worcester Medical School), UMASS On-line and the President’s Office. Successful implementation of this program ensures the University reduces the impact and exposure of a Cyber-security threat.

    Room: 106
    2
    Larry Wilson
  • 3:00pm - 3:45pm9 Security Challenges of the Internet of Things and Big Data

    The Internet of Things consists of a network of devices with embedded technology that communicates and interacts with other devices collecting massive amounts of data which makes up a large component of Big Data. This presentation will discuss the security challenges that the Internet of Things and Big Data presents.

    Room: Suite 3
    1
    Barbara L. Ciaramitaro
  • 3:15pm - 6:00pm9 FishNet Security Happy Hour

    Join FishNet Security and their partners for Happy Hour at Crave Lounge (22075 Michigan Avenue Dearborn, MI 48124) following your SecureWorld sessions. Network and socialize with industry peers while enjoying appetizers and drinks compliments of FishNet Security and partners!

    Register Now!

    Room: Crave Lounge
    0

Day 2

  • 7:00am - 3:00pm10 Registration Open

    Click here to view registration types and pricing.

    Room: Registration Desk
    0
  • 8:00am - 9:15am10 InfraGard Chapter Meeting

    This Meeting is for InfraGard members ONLY.

    "Threat actors" (e.g., cyber criminals, hackivists and nation states) are evolving their capabilities to penetrate organizations' networks at a phenomenal rate and scale. How do they do what they do? Colonel (U.S. Army Retired) Barry Hensley has unique military and commercial experiences in seeing how quickly adversaries can elude today's security controls if they're not properly aligned/maintained, giving threat actors full freedom of movement within an organization's network. COL. Hensley will discuss the latest tactics and techniques adversaries use - from operational preparation of the environment down to actions on the objective. IT security professionals have to be right 100 percent of the time, while threat actors only need to exploit one unknown vulnerability. Come see real examples and demonstrations of how a threat actor eludes security controls and learn how to better position your organization to defend against today's complex threats. 

    Room: Keynote Theater
    0
    Col. Barry Hensley
  • 8:00am - 9:30am10 Secure World Plus: Planning and Designing a Corporate Information Security Program (SecureWorld Plus Registrants ONLY)

    This class is for SecureWorld Plus Registrants ONLY.
    This class will cover the essential elements for planning, designing, budgeting, implementing, maintaining and assessing a comprehensive information security program.
    A high-level course outline includes:
    1.Creating a Business Case
    2.Developing a Security Program
    •Step 1 - Establish program goals, objectives, critical success factors
    •Step 2 – Document security controls in controls books
    •Step 3 - Apply security controls to critical asset groups to create managed assets
    •Step 4 - Establish security program governance, budget, resources, operations, and implementation roadmap
    3.Documenting Security Controls in Controls Books
    4.Applying Controls to Protect Critical Assets
    5.Establishing a Program Governance Model and Security Operations Center
    6.Auditing / Assessing Security Program Deliverables
    7.Establishing an Information Security Exchange (ISX)

    The course is based on the University of Massachusetts Information Security Program, which was the ISE® North America Project Award Winner 2013 - Academic/Public Sector Category.

    An executive summary of the UMASS program: The University of Massachusetts Cyber-security initiative involves planning, designing, implementing and managing a University-wide technology-based program based on the SANS 20 Critical Security Controls (CSC). The main deliverables include IT asset management, software asset management, system and network configuration, malware defenses, vulnerability management, log management, security administration, data loss prevention, etc. The primary goal is to establish technology, implementation and security monitoring standards that are implemented and managed across all five campuses (Amherst, Boston, Dartmouth, Lowell, Worcester Medical School), UMASS On-line and the President’s Office. Successful implementation of this program ensures the University reduces the impact and exposure of a Cyber-security threat.

    Room: 106
    2
    Larry Wilson
  • 8:30am - 9:15am10 Business Impact Analysis on the Corporate R.A.D.A.R.

    We are pleased to release the first open source BIA workflow that is actionable and repeatable. This workflow has been developed to empower IT to make more informed investment decisions in anticipation of a business interruption. It’s compatible with existing Co-OP frame works such as COBIT, ISO 27000, PCI, and others.

    Room: Suite 3
    1
    Steven Aiello
  • 8:30am - 9:15am10 Finding the Balance: Privacy, Security & Freedom in a Connected World

    Another year, another series of legal challenges regarding privacy and security in the digital age! Your toaster has a MAC address, the TSA has PreCheck, but police now need a subpoena to search your cell phone – except at the border. Congress threatens to limit the NSA's eavesdropping power, but Google wants to tell the law when it finds child pornography on its servers, and Europe wants the right to be forgotten. Where is proper balance between security and privacy? Does the Constitution grant absolutely free speech? Is the role of government to protect freedom, or to provide safety? What can corporate information security do that governments can't? This session will look at how law and society are addressing these issues, and where the future might lead.

    Room: 103
    1
    Melissa Markey
  • 8:30am - 9:15am10 Scan Your Networks Safely & Automatically – For Free

    Scan large networks using freely available tools to generate useful reports. I will demonstrate a 4-tiered approach I use to quickly discover transient systems, identify system type, and finally run a comprehensive vulnerability scan on identified subsets (i.e. *nix, Windows Server, VM, desktop, laptop, printers). Results are fed into Splunk, a powerful search, report and dashboard tool.

    Room: Keynote Theater
    1
    Scott Aschenbach
  • 9:00am - 3:00pm10 Exhibit Floor Open Please check back for presentation details.
    0
  • 9:30am - 10:15am10 OPENING KEYNOTE: Intelligence and Cybersecurity: Toward a More Effective Public / Private Partnership

    Col. Cedric Leighton's keynote presentation will discuss the following:

    • Overview of the Cyber Threat based on publicly available intelligence
    • Why current Intelligence Community structure needs to be re-vamped for the Cyber Age
    • How intelligence agencies should be working with private companies
    • It's about new legislation AND changing mindsets and cultures
    • The new relationship between the US Intelligence Community and US companies in the Cyber Age - a vision for the future

     

    Room: Keynote Theater
    0
    Col Cedric Leighton
  • 10:15am - 11:15am10 Conference Break / Exhibitor Product Demonstration Please check back for presentation details.
    0
  • 11:00am - 12:00pm10 Executive Track - Advanced Persistent Threats (VIP / Invite Only)

    Executive Track - VIP/Invite Only

    Room: Executive Boardroom
    3
  • 11:15am - 12:00pm10 Bit9: New World, New Realities: Endpoint Threat Detection, Response & Prevention for DUMMIES

    Traditional, signature-based endpoint protection solutions are ineffective against today’s advanced threats, including zero-day and targeted attacks, which don’t have known malware signatures. Advanced attackers do everything they can to evade detection. To combat them, enterprises need endpoint threat detection, response and prevention tools that will enable them to see and understand the full attack lifecycle. During this presentation you’ll learn:
    • Who’s a target and Why
    • Why traditional endpoint security solutions are failing to protect your environment from advanced threats
    • The definition of Endpoint Threat Detection & Response and foundational capabilities
    • What you can do right now to assess your endpoint security posture and reduce your organizations attack surface

    Room: 105
    0
    Brian Orr
  • 11:15am - 12:00pm10 Cybersecurity Challenges and Practical Remedies in Healthcare

    Although considered critical infrastructure, the healthcare industry has some unique challenges when it comes to cybersecurity preparedness. Doug Copley will outline some of those challenges and outline some of the practical remedies that can be employed to reduce the risk exposure to the organization and the industry.

    Room: 101
    1
    Doug Copley
  • 11:15am - 12:00pm10 Looking Ahead by Looking Back at Ten Years of Security Events

    The universe of threats over ten years of analysis can be described into only nine basic patterns. Learn which of those patterns are most likely to affect your organization and how you can take appropriate steps in applying your security resources. Join us to hear input from 50 global organizations across 95 countries who have examined more than 63,000 security incidents in the past year.

    Room: Keynote Theater
    1
    Steven Hill
  • 11:15am - 12:00pm10 Reinventing Cybersecurity Training

    Your end-user can be your greatest security asset, or your greatest liability. Meanwhile, your technical staff need hands-on advanced skills. Equally important, every family needs to understand their role in Internet safety. Let’s explore cyber awareness from a variety of perspectives – what you need to know and how to get your message across to different audiences. This case study will examine what works and what doesn’t, when it comes to security awareness training, Michigan’s advanced Cyber Range offerings, and outreach efforts that make Michigan a national model for security training. You’ll learn how to provide interactive, engaging training that makes your end-user into a true security partner and have fun in the process.

    Room: Suite 3
    1
    Dan Lohrmann
  • 12:00pm - 1:15pm10 Executive Track - Challenges in the Mobile Workforce (VIP / INVITE ONLY)

    Executive Track-VIP/Invite ONLY
    Lunch Served at Noon

    Room: Executive Boardroom
    3
  • 12:00pm - 1:00pm10 ISSA Chapter Meeting

    This Meeting is for ISSA Members ONLY.

    Room: Lookout
    0
  • 12:15pm - 1:00pm10 Lunch Keynote: Radware Please check back for presentation details. Room: Keynote Theater
    0
    Carl Herberger
  • 1:15pm - 2:15pm10 Industry Expert Panel: Identifying Risk - Are You Vulnerable?

    Many security professionals are moving to a risk based approach to security. Companies must look at their current strategies and vulnerabilities to determine and prioritize the associated risks within the organization. Our panel will discuss best practices and give you some food for thought to help you identify risk within your company.

    Invincea

    Solarflare

    Qualys, Inc.

     

    Room: Keynote Theater
    0
  • 1:15pm - 2:15pm10 Industry Expert Panel: Incident Response-Are You Prepared?

    The current threat landscape is continually changing and security professionals are being tasked with keeping the company’s data safe. Inevitably it happens – someone lost their tablet or their smartphone was stolen at the local coffee shop, or the network was compromised. Organizations must move from the mindset of hoping the incident doesn’t happen to them to a mindset of what will our plan of action be when it does happen? The goal of an Incident Response program is to handle the issue in a way that limits the damage, reduces the recovery time and costs, and helps to mitigate the risk to their clients. Join our experts as they look at the challenges security teams are facing, tools and initiatives that are working for them, and guidance in creating a program that will work for your organization.

    FishNet Security

    Symantec

    OpenDNS

     

    Room: Suite 3
    0
  • 2:15pm - 3:00pm10 Conference Dessert Break / Exhibitor Product Demonstrations

    Located on the SecureWorld Exhibit floor.

    0
  • 2:30pm - 2:45pm10 Dash for Prizes

    Be sure to leave your business card* with any participating exhibitor. Past prizes have included Kindles, Bose headphones, gift cards, iPads, iPods and more! *Must be present to win

    Room: SecureWorld Exhibit Floor
    0
  • 3:00pm - 3:45pm10 Defining the Field of Cybersecurity: The National Framework for Cybersecurity Work

    This presentation will explain the National Initiative for Cybersecurity Education (NICE) Framework 2.0. NICE is the first complete, authoritative definition of the elements of the field of cybersecurity. This will explain the framework and how to use it to fully understand the profession and the work involved in it.

    Room: Suite 3
    1
    Dan Shoemaker
  • 3:00pm - 3:45pm10 Framework: The Difference Between Winning and Losing

    After decades of information security strategy, method, tech, daily breach reports, political hactivism, organized cybercrime, nationally supported cyberwarfare, etc. – why do we still struggle to make the case for a solid enterprise information security program? It all has to do with the “F-word” of security: Framework.

    Room: 105
    1
    David Hawley
  • 3:00pm - 3:45pm10 Public Recon: Why Your Corporate Security Doesn’t Matter

    In a world with sites like Facebook, Twitter and Linkedin, enterprises are leaking data like a sieve. Information available to potential attackers can include customer lists, structural plans, help desk documents and other confidential files. There are no appliances or products to protect your enterprise. This is your wake-up call.

    Room: Keynote Theater
    1
    Ronald Ulko

Session Information

Description: