Soft Skills for Success

Oct 17, 2021 5:00pm ‐ Oct 17, 2021 6:00pm

Identification: SCCC21_10


Luck is Not a Strategy

Oct 17, 2021 6:00pm ‐ Oct 17, 2021 7:00pm

Identification: SCCC21_11


Kickoff & Welcome | Keynote - Defend Today, Secure Tomorrow

Oct 18, 2021 8:00am ‐ Oct 18, 2021 9:30am

Identification: Parent


Exhibit Hall Break

Oct 18, 2021 9:30am ‐ Oct 18, 2021 10:00am

Identification: 1856934


Lessons learned from enterprise cloud security programs

Oct 18, 2021 10:00am ‐ Oct 18, 2021 11:00am

Identification: 1778614

In the on-premises world, cybersecurity risks were limited to your organization’s network perimeter. In the era of cloud computing, both the impact and likelihood of potential risks are significantly higher. With the corresponding rise of DevOps methodology, security is now the responsibility of everyone who is part of the application development lifecycle, not just security specialists. In this session, we will present findings on methods and processes to build the cloud security framework that make sense for both your business and your developers. The session is based on real-life experiences from implementing cloud security programs in some of the largest enterprises in the world.
Learning Objectives:
  • List key components of succesful cloud security programs.
  • Identify new gaps in their current public clouds security state.
  • Translate existing security requirements to the cloud.

Does Cyber Security have an Image Problem?

Oct 18, 2021 10:00am ‐ Oct 18, 2021 11:00am

Identification: 1778622

The shortage in skilled cybersecurity workers is well documented. Conventional wisdom suggests that the shortage was historically related to low unemployment in developed nations. However, the increased spike in unemployment due to the Covid-19 pandemic put this idea to rest. As such, it is critical to consider why the information security industry is simply unable to recruit enough men and women to meet global demand, identified by the (ISC)2 Cyber Security Workforce Study at more than 3 million needed today. This presentation will consider some of the potential causes for the skills shortage, what the opportunities look like and what we as cybersecurity professionals can do to create a more positive vision of our industry to attract the best and brightest to the field.
Learning Objectives:
  • Understand some of the perceptions and stereotypes related to cybersecurity careers by those not in the industry, and appreciate how these perceptions inhibit potential interest in a cyber career.
  • Better understand and appreciate the non-technical career options that exist in cybersecurity that will make the field more appealing to personalities that do not consider themselves as analytical / technical in nature.
  • Understand what a cyber career path can and should look like and better appreciate the value of tertiary education, on-the-job experience, vendor accreditations and industry certifications as part of a well-rounded skillset.

Measuring Security Effectiveness

Oct 18, 2021 10:00am ‐ Oct 18, 2021 11:00am

Identification: 1778680

How do you measure the effectiveness of security? In 2016, we established a security function within software engineering. Taking a software engineering approach to security, we created testing services, hired developers to build tools, conducted secure code reviews and created our AppSec training program. In 2020, we challenged ourselves to evaluate the effectiveness of our program by analyzing the impact of our team’s services on pen-test findings. A three-month data analysis found that development teams working with us fixed their pen-test findings faster and had significantly fewer new pen-test findings than teams we didn’t work with. In this talk, we will share the specific application security practices that led to these improved outcomes, and how we adjusted our services in response to our findings.
Learning Objectives:
  • Identify the key application security practices that have been shown to reduce risk.
  • Understand how to analyze the security data and adjust a program in response.
  • Know how to set up and run a experiment to evaluate the effectiveness of a security control.

How to Prepare and Secure Critical Infrastructure for the Future of Digitalisation

Oct 18, 2021 10:00am ‐ Oct 18, 2021 11:00am

Identification: 1778641

Digitalization is here to stay and critical infrastructures are not an exception. Even before the pandemic, we have seen an increased number of connected OT systems to the internet. It leads to no separation of IT and OT networks due to the increase in data, connectivity, complexity and costs. What makes the protection for the digitalization of critical infrastructure difficult is the convergence between IT and OT. Threats that normally impact IT can move between cyber and physical environments. Therefore, cybersecurity is a key factor for the success of digitalized critical infrastructure. The presentation will share key principles and guidelines the presenter developed and refined over the years working in several industries. The application of the principles has helped prepare and secure critical infrastructure for the future of digitalisation.
Learning Objectives:
  • Better assess environments for the future of critical infrastructure digitalization.
  • Determine key initiatives for long-term protection.
  • Identify actions to better information their cybersecurity programs.

Red Teaming with Dark Web and GitHub PoC Exploits

Oct 18, 2021 10:00am ‐ Oct 18, 2021 11:00am

Identification: 1778544

Examined is a collection of open source tools that are used in an authorized red team engagement of a cloud-native Kubernetes cluster environment to discover application security defects. Our collection of dark web and GitHub proof-of-concept (PoC) tools provide a red team with an advanced adversarial advantage over traditional commercial tooling across all stages of an engagement. We report the results in relation to our understanding of the cloud shared responsibility model as it applies to IaaS, PaaS, and SaaS. Several flaw discovery and exploit tools with be demonstrated to show their utility. We explore how CVEs are weaponized on the internet and how having red team a-priori knowledge of them can help organizations create defense-in-depth mitigating controls.
Learning Objectives:
  • Plan a penetration test using open source tools.
  • Recall specific dark web toolkits for red teaming.
  • Demonstrate an understanding of GitHub proof-of-concept (PoC) exploits and their applicability to red teaming engagements.

The Map and the Territory: MITRE ATT&CK In Theory and Practice

Oct 18, 2021 10:00am ‐ Oct 18, 2021 11:00am

Identification: 1778681

Cybersecurity practitioners have often drawn insights and ideas from other domains, relying on their insights, adopting their maxims and terminology. Sun Tzu famously wrote, “If you know the enemy and know yourself, you need not fear the result of a hundred battles.” Carl Linneaus is credited with developing the standard taxonomy for naming organisms. Only recently, however, has our industry begun to effectively apply the synthesis of such ideas. The MITRE ATT&CK Framework, publicly released in 2015, has been growing in scope and influence, but it is not the first of its kind. How does it compare with its predecessors in improving our understanding of adversary behavior and our defenses? This talk describes key concepts and goals of MITRE ATT&CK to help support successful implementations.
Learning Objectives:
  • Understand the origins, design goals and components of the MITRE ATT&CK Framework.
  • Compare and contrast the MITRE ATT&CK Framework with other frameworks in order to judge appropriateness for and applicability to an organization's security programs.
  • Use the MITRE ATT&CK Framework to correlate between offensive actions and defensive capabilities and measure coverage of ATT&CK techniques.