The Application Security State of the Union

Oct 25, 2023 3:05pm ‐ Oct 25, 2023 4:00pm

Credits: None available.

This session will discuss application security: its maturity today and where it’s going, viewed through the lens of a practitioner. Discover the state-of-the-art and cutting-edge in cybersecurity, from attacks and threats to the impact of people, processes, tools and governance. Explore eight specific areas of improvement for the next five years that will prevent your application security strategy from being left in the dust. We’ll look at market consolidation, solving the software supply chain and fully automating application security.
Learning Objectives:
  • Demonstrate an in-depth understanding of where application security is today.
  • Describe where application security is going over the next five years.
  • Utilize successful strategies and roadmaps in your cybersecurity program.

ICS2 on Point with DEI: Witnessing Progress: Career Journeys of IT and Security Pioneers

Oct 25, 2023 3:05pm ‐ Oct 25, 2023 4:00pm

Credits: None available.

Join Janice Reese, Director of Strategic Partnerships, Healthcare and Life Sciences of SoftServe, and Barbee Mooneyhan, VP of Security, IT, and Privacy of Woebot Health as they dive into their extensive career paths with a combined 40+ years of IT and Security experience. From triumphs and obstacles, allies and adversaries—they will share their compelling narratives of the pivotal culture shifts they have witnessed and the profound positive effects these changes have brought to the larger security industry for underrepresented groups.

Killing Me Too softly: Why Won’t Passwords Die?

Oct 25, 2023 3:05pm ‐ Oct 25, 2023 4:00pm

Credits: None available.

Decades into our lament of weak passwords, it’s been six years since NIST 800-63B formally published why “best-practice” password policies are bogus. Yet, here we still are, calculating how strong passwords are, and warning people against choosing passwords like “Summer2023.” What must we do to leave the password swamp behind? Why are we stuck? Thanks to bold moves by technology firms, we rallied as an industry to kill off SSLv3 and TLS 1.0. Now what must we do to kill off single-factor authentication?
Learning Objectives:
  • Identify gaps in the organization that are preventing retirement of technical debt.
  • Recognize force levers for effecting change in the organization, enabling the retirement of single-factor authentication systems.
  • Communicate the business case for retirement of broken authentication systems.

Zero Trust and Third-Party Risk: Reduce the Blast Radius

Oct 25, 2023 3:05pm ‐ Oct 25, 2023 4:00pm

Credits: None available.

As the level of incidents, events and breaches continues to grow by double digits year over year, it is now a mathematical inevitability that one or more of your third-parties will be a statistic. Learn how Zero Trust is a strategy and set of principles that assumes a breach will occur and creates architecture and operations around controls. Given the increased likelihood of a vendor breach, adopting a Zero Trust approach focused on third-party risk can greatly reduce risk for your organization.
Learning Objectives:
  • Explain why Zero Trust strategy is ideal in third-party risk and how it lends itself well to the staged journey of most Zero Trust deployments.
  • Utilize an OSI model type to demonstrate the overlap of Zero Trust and third-party risk.
  • Recognize that Zero Trust is a strategy and set of principles that assumes a breach will occur and creates architecture and operations around controls.

Defending Against Token Theft

Oct 25, 2023 3:05pm ‐ Oct 25, 2023 4:00pm

Credits: None available.

Token theft is the No. 1 unmitigated identity-based attack vector today. While strong authentication can mitigate most password-based attacks, this type of attack involves compromising a token after a victim user completed authentication. This session will cover the current threat landscape and what proactive measures you can take in your organization to prevent, detect and respond to token theft. You’ll get a walkthrough of a machine-learning algorithm that detects anomalous token usage, and detailed step-by-step incident response playbook you can use.
Learning Objectives:
  • Articulate to your stakeholders where token theft can occur and the prevalence of this attack type.
  • Determine what proactive measures to take to prevent and detect instances of token theft.
  • Respond to a token theft attack using the detailed process specified in an incident response playbook.

Learning from History: What Past Cyber Attacks Taught Us

Oct 25, 2023 3:05pm ‐ Oct 25, 2023 4:00pm

Credits: None available.

This session will review past incidents, breaches and ransomware outbreaks from the news and the Rapid7 security operations center to understand what we can all learn from these incidents. The presenters will discuss the attacks, vulnerabilities and trends they are seeing in their global security operations centers, including how they identify zero-day vulnerabilities and how organizations should respond. You’ll learn how to improve your organization’s prevention, detection and response procedures to better identify and stop today’s attacks.
Learning Objectives:
  • Analyze past security incidents, breaches and ransomware outbreaks to understand the root causes and what could have been done to prevent the incidents.
  • Recognize attacks, vulnerabilities and trends in global security operations.
  • Evaluate your organization's prevention, detection and response procedures to better identify and defend against attacks.

Global Voices From The EU: Safeguarding Cyberspace: Empowering a Capable and Diverse Cyber Workforce

Oct 25, 2023 3:05pm ‐ Oct 25, 2023 4:00pm

Credits: None available.

Join key influencers, policy makers and thought leaders from around the globe to hear their perspectives on regional cybersecurity issues impacting all corners of the world. Seize the opportunity to get answers to your questions from our featured guests. In an increasingly interconnected world, the role of securing cyberspace has never been more important. Studies show, however, that the number of trained professionals that can perform this critical role does not align to the current and future needs of the industry. The workforce gap is currently around 350,000 and expected to widen over the next three years. This session will explore the challenges that organizations face in developing skilled cybersecurity teams and examines the power of diversity in the workforce. Hear about successful strategies that have been used in the European Union to address the cyber workforce gap such as talent development schemes like the European Cybersecurity Skills Framework, collaboration between academia and industry and continuous learning. Attendees will gain insights into future trends, the importance of overcoming obstacles, and the imperative of nurturing a workforce poised to defend against evolving cyber threats.


Why Dark Web Markets Matter

Oct 25, 2023 4:40pm ‐ Oct 25, 2023 5:35pm

Credits: None available.

The dark web conjures up visions of bad actors in black hoodies working in a dark, smelly basement (and sure, there’s some of that). But the reality is, the dark web is a multibillion-dollar marketplace that funds some of the most powerful digital crime organizations on the planet. Ransomware, phishing kits, DDoS attacks — almost anything you can imagine — is for sale. How do these markets affect your organization on a day-to-day basis? What can you do to help mitigate their impact? We’ll discuss the tools you can use in defense.

Learning Objectives:
  • Define the financial structures that underpin dark web markets.
  • Defend against the financially lucrative methods attackers use against organizations.
  • Implement the high-level techniques needed to use to secure against compromise.

Cybersecurity Strategies for Blended IT/OT Environments

Oct 25, 2023 4:40pm ‐ Oct 25, 2023 5:35pm

Credits: None available.

Managing risk and incident response in OT is complex. It begins with asset inventory, vulnerability management and risk measurement. Learn what an adequate inventory looks like and how to round out a “normalized risk score” with temporal risk factors. We’ll explore the art of incident response in OT, and how to use a hierarchal SOC structure to better manage events and report risk status to executive leadership. You’ll learn how to maximize the functions of central SOC and subordinate SOCs.

Learning Objectives:
  • Define the challenges of measuring, managing and responding to risk in blended IT/OT environments.
  • Recognize the importance of temporal risk factor analysis as it affects managing and responding to normalized risk.
  • Apply hierarchal SOC operations to better serve IT/ OT and present a blended risk assessment to executive leadership.

ISC2 on Point with Careers: How to Hack Your Cybersecurity Career

Oct 25, 2023 4:40pm ‐ Oct 25, 2023 5:35pm

Credits: None available.

This session will answer the common question, “How do I find a job in cybersecurity?” Whether you want to break into cybersecurity or land your next job, you can use hacker skills to make it happen. You’ll learn the three traits of a well-rounded cybersecurity professional and three areas for balanced learning. Steps for hacking your career include visualizing your goals, knowing the best path for you, social engineering your next boss, active learning and keeping your skills sharp. There is no single correct cybersecurity career path — learn how to find your own road less traveled.

Learning Objectives:
  • Distinguish the traits of a well-rounded cybersecurity professional.
  • Differentiate cybersecurity careers and career paths.
  • Apply hacking and social engineering methods to find the right role for you.