Information Systems Security Association

Los Angeles Chapter, cybersecurity, InfoSec, CISO, Privacy

Monthly Meeting Speakers

Recap: April 2020 Virtual Chapter Meeting

By

We had an extremely passionate discussion in our April 2020 meeting on Application Security with an extremely dedicated and passionate panelists and application security leaders.

Our panelists took us through the various debates on importance of security standards, application penetration testing, security as a software development lifecycles, and processes.

If you missed our spirited session, catch the replay below.

Our next virtual chapter meeting will be Wednesday, June 17, 2020 at 11:45am.

Speakers:

  • Richard Greenberg, Moderator, ISSA-LA President
  • Andrew van der Stock, Current co-lead of the OWASP Top 10 and OWASP Application Security Verification Standard
  • Holly Grace Williams Technical Director at Secarma Ltd
  • Jack Mannino, Chief Executive Officer at nVisium
  • Jim Manico, Founder, Secure Coding Instructor at Manicode Security
  • John Steven, Chief Technology Officer at ZeroNorth
  • Simon Bennetts , Security Automation Engineer at Mozilla, OWASP ZAP Project Lead
  • Tony UcedaVélez, CEO & Founder-VerSprite, Author of Risk Centric Threat Modeling & PASTA Methodology

February – Joshua Jacobson

By

February2020_SpeakerSlidesDownload

Topic: Taking The Bugs Out of Bug Bounty

Bug Bounties are the new big “thing” in infosec with a diverse group companies of all sizes jumping in. While these programs can be highly effective, it is easier said than done. Using his experience building and running Aviation’s first bug bounty program, Josh discusses his trials and tribulations implementing a first of its kind Bug Bounty program. By the end of this talk you will know what to anticipate, do, and avoid while building a Bug Bounty program to be as successful as possible right out of the gate.

Speaker: Josh Jacobson

Josh is an ethical hacker and researcher based out of Los Angeles California. He began his career as an ethical hacker with a focus on internal and wireless network penetration testing before taking on application security. In his previous role at United Airlines he designed, built, and managed aviation’s first public bounty program which subsequently won multiple awards. While at United also lead digital forensics and conducted Aircraft and Avionics research as an ethical hacker. Josh now oversees vulnerability management for Sony Pictures Entertainment.

January – Andy Kim

By

January2020_SpeakerSlidesDownload

Topic: All Eyes On You: Cyber security in the Age of Innovation

Digital Transformation and Innovation are profoundly impacting the way businesses operate today. Time to market, speed, and agility are necessary requirements just to stay competitive in today’s marketplace. But, just as businesses are moving  fast into the future, cyber threats continue to multiply exponentially, challenging cyber security professionals and the businesses they support. What can cyber security professionals do given these seemingly incompatible objectives and how can they position the business for success? In this session, we’ll cover the reality of digital transformation, the impact of privacy, and the importance of the customer journey among many others topics that will position your cyber security program for success in 2020.

Speaker: Andy Kim, CISO eBusiness, Allstate

Andy is a strategic business partner to the C-Suite, implementing business vision within acceptable business risk. He is an avid technologist with the understanding that cyber security risks are fundamentally a human problem. A conclusion he has drawn from successfully implementing information security programs across heavily regulated industries including banking, investments, insurance, and healthcare for the past 18 years. Andy currently serves as the CISO for the digital brands and innovation businesses at Allstate. Andy helps insurance innovators deliver their capabilities in the cloud, while managing risk within acceptable tolerances.

Previously, Andy led the Risk Solutions group at Neustar. As Director, he supported multi-million dollar anti-fraud deals involving the internet and call center consumer channels for the top 10 financial institutions in the US. As a thought leader, he has been featured on American Banker http://pages.marketing.americanbanker.com/20180208_abp_neustar_ws_lp.html?source=client and has had published thought leadership blogs on identity and GDPR: https://www.risk.neustar/blog/authors/andy-kim

Before Neustar, Andy served as Director of Technology Risk Consulting Services at FIS (NYSE: FIS), in the Risk Information Security and Compliance business, which attained the #1 ranking in the Chartis RiskTech 100, where he was responsible for leading a team of subject matter experts that provided expert advisory and consulting services focusing on fraud, digital crime and cybersecurity to hundreds of financial services clients in the U.S.  He also led the design and product marketing of CyberForce, an innovative next generation fraud and cybersecurity anomalous activity detection solution in the U.S. and EMEA markets.  

Other positions include CISO of a large regional bank in Los Angeles, CISO supporting the CTO and CIO of a major US bank, CISO and HIPAA Security Officer at a pharmacy benefit management software company, Americas Security Officer of one of largest asset management firms, and Group IT Risk Officer to the third largest insurance company in the US.

Andy is highly regarded in the industry for his subject matter expertise and thought leadership and is a frequent speaker at industry conferences.  He also holds multiple certifications such as CGEIT, CISA, CISSP, CISM, ISSAP and ISSMP. 

December – Neil Daswani

By

Topic: The Biggest Breaches And What They Mean For The Future Of Cybersecurity Investment

This talk covers the key lessons learned and root causes from the biggest mega-breaches over the past several years, and analyzes their correlation to the over $45 billion invested in cybersecurity thus far. Based on hard data of over 4,000 cybersecurity companies that have been funded thus far, and what they have focused on to-date, some hypotheses on where future investment is required will be presented. Whether you’re interested in how your current company is positioned for the future of cybersecurity, considering a job change, or even potentially starting a cybersecurity company yourself, this talk will arm you with the information that you need about the security landscape, both on the business and technology fronts. Future trends in cybersecurity will also be discussed.

Speaker: Neil Daswani

Neil Daswani is currently an Executive-in Residence at Trinity Ventures, and is a Co-Director of the Stanford Advanced Security Certification Program. He has in the past served in a variety of research, development, teaching, and executive roles at Symantec, LifeLock, Twitter, Dasient, Google, NTT DoCoMo USA Labs, Yodlee, and Bellcore. Neil has been both a security entrepreneur having co-founded Dasient which was acquired by Twitter, and has also served as a Chief Information Security Officer at LifeLock and at Symantec’s Consumer Business Unit. His DNA is deeply rooted in security research and development, he has dozens of technical articles published in top academic and industry conferences (ACM, IEEE, USENIX, RSA, BlackHat, and OWASP), and he has been granted over a dozen U.S. patents. Neil is also co-author of “Foundations of Security: What Every Programmer Needs To Know” (http://tinyurl.com/33xs6g), He earned Ph.D. and M.S. degrees in Computer Science at Stanford University, and he holds a B.S. in Computer Science with honors with distinction from Columbia University.

November – Michael Gold

By

Topic: California Consumer Privacy Act (CCPA)

MAG-CCPA-Slides-November-2019Download

The California Consumer Privacy Act of 2018 is the most comprehensive law of its kind ever enacted in the United States, setting forth rules for companies that buy, collect, transfer or sell consumers’ personal information. Because of the size and reach of the California economy – the 6th largest in the world – and the number of companies that may need to comply – estimated at about 500,000 worldwide – the CCPA is effectively a national, if not international, law. This program will address the salient features of the CCPA, who must comply, the new rights consumers have under the CCPA, legal exposures for violations, likely impacts of the law, and what companies should do to comply with the law.

Speaker: Michael Gold

Michael Gold is co-chair of JMBM’s Cybersecurity and Privacy Group and counsels businesses in a wide variety of matters, including data breach responses and investigations, crisis management, development of computer-based information retention systems, forensic investigations of computer systems, and computer and internet privacy matters.

Michael assists clients in developing and implementing information management and governance best practices and developing policies and compliance structures for protecting personal and company information. He counsels clients on information security and privacy law compliance issues; assists clients in developing policies and processes to comply with information security and privacy laws (including the E.U.’s General Data Protection Regulation, the California Consumer Privacy Act of 2018, and other state and industry-sectoral privacy laws in the U.S.); negotiates technology agreements relating to information security and privacy; and defends litigation and arbitrations, including class actions, arising from data breach and privacy claims.

Michael was named one of California’s “Top 20 Cyber – Artificial Intelligence Lawyers” by the Daily Journal (2018), one of the “Most Influential Lawyers: Digital Media and E-Commerce Law” by the Los Angeles Business Journal, and has been designated a “Top Rated Lawyer in Technology Law” by Martindale Hubbell. He is the author of the upcoming Bloomberg BNA portfolio Enterprise Cybersecurity Governance, and co-author of the Bloomberg BNA Portfolio Records Retention for Enterprise Knowledge Management.

October – Art Poghosyan

By

Topic: Closing the Cloud Security Gap with Privileged Access GovernanceDownload

Privileged access has been one of the most complex issues organizations have had to address. Breaches of privileged access can have profound impact on IT infrastructure, expose large volumes of confidential data and cause devastating consequences for the business. The rapid evolution of the public cloud technologies in the past few years has introduced even more complexity and has challenged the existing methods and tools for securing privileged access. As a result, we are witnessing an exponential increase in cloud access breaches that leave terabytes of confidential data exposed and cost businesses billions of dollars every year.
In this talk, we will review key examples of how the growing public cloud ecosystems have re-defined privileged access security requirements which, in turn, created the need for new and innovative approaches to securing privileged access. We will also review the best practices for cloud privileged access governance that are already emerging and are being adopted by the industry leading organizations. We will conclude with recommendations for security professionals to help identify their cloud privileged access exposures and define a methodical approach for addressing this critical risk in their environments.

Speaker: Art Poghosyan
Art has spent nearly two decades of his professional career in Information Security. The first 8 years of his career Art spent at Big 4 firms, serving global enterprises across many industries. In 2010, Art co-founded Advancive, a market leading brand for Identity & Access Management (IAM) consulting and solutions implementation. Art led the company’s exponential growth and eventual acquisition by Optiv Security in 2016. At Optiv, Art built and launched Optiv’s first managed IAM service offering focused on Privileged Access Management (PAM). In 2018, Art left Optiv to start his next business venture, Britive, where he is serving as the CEO. Art is a frequent industry contributor, recognized for sponsorships and speaking engagements at events such as Identiverse, RSA Charge, ISSA LA Summit, and ISACA Orange County conference. He is a regular volunteer and contributor at (ISC)2 CISSP and ISSAP certification exam development workshops.

September – Neela Jacques

By

Topic: Sophisticated Spear Phishing
96% of attacks start with an Email. This session, Neela will focus on understanding the types of attacks you are likely receiving and the various ways you can protect your organization. A specific area of focus will be the rise in sophisticated Spear Phishing and the way we now have to rely on Machine Learning and Artificial intelligence to stay ahead of the hackers.

Speaker: Neela Jacques
Neela Jacques joined Barracuda Networks in 2018, bringing more than 20 years’ experience of bringing innovative enterprise software products to market. Neela has global responsibility for all aspects of Go-to-Market for Barracuda’s complete portfolio of award-winning, cloud enabled security products. Prior to Barracuda, Neela was Executive Director of the OpenDaylight project and VP at the Linux Foundation. There, Neela led a community of thousands of developers around the world to drive innovations in SDN and NFV with a developer-driven open source platform. He oversaw and provided guidance for all aspects of the project, from governance and technology to community and marketing. Prior to that, Neela was part of the core VMware team that took virtualization from a niche development and testing product to ubiquitous use. He developed and took to market the company’s Software-Defined Data Center (SDDC) vision and strategy. Neela also founded and launched VMware’s first cloud computing initiative in 2007.

August – Dr. Paulo Shakarian

By

Topic: Artificial Intelligence Research for Forecasting Exploit Usage
Vulnerability disclosure rates are at an all-time high – averaging over 1,000 per month in 2019 – more than twice as much as in 2016. But while disclosure rates have remained at this high level, hackers still only exploit a small fraction ranging from 2%-3% by most studies. Ironically, the fact that exploited vulnerabilities make up such a small portion mean that this a particularly challenging machine learning problem. In this talk will review a series of peer-reviewed research papers that were produced under U.S. government grant funding that have investigated this problem. Through a combination of machine learning, graph theory, and data mining (from sources including social media, deepweb, open web, and Tor sites), these approaches provided promising results. These techniques leveraged an understanding of not only the content of hacker discussions, but also the underlying social structure of these communities as well as technical information about the vulnerabilities themselves. This, in-turn, enabled successful forecasting of exploits before they become available – providing a 20-fold improvement in terms of precision. This talk not only reviews the peer reviewed research, but also gives insight into how machine learning can be used to address cybersecurity problems and provides examples of exploit usage successfully predicted ahead of time.

July – Gary Asplund

By

Topic: My CEO Told Me We Have To Move Our Datacenter to the Public Cloud…So, What’s the Big Deal?

Abstract:

Consider the following:

– You don’t own any of it but, it is your responsibility to control and secure everything in it

– You don’t own any of it, but you critically depend on what’s in it

– You don’t maintain any of it, but you trust all of it is properly maintained at all times 

– You can’t touch any of it, but it’s up to you to completely orchestrate, control and secure what’s in it

– You can’t physically walk in anywhere but you (and anyone else on the planet with the right access) can virtually access from everywhere 

At first blush, a seasoned and experienced network / security director may not fully appreciate the significant differences and challenges his/her staff will experience in trying to fulfill their job duties when their datacenter is in the public cloud. The old strategy of ‘lift and shift’ – creating VM’s of all of your current/existing hardware and ‘shifting’ it to the cloud – will fail. Further evidence of the urgent need for purpose-built tools to secure public cloud infrastructures can be seen in the multiple and repeated data leaks and misconfiguration compromises we have seen in the last year – According to Gartner, “Through 2022, at least 95% of cloud security failures will be the customer’s fault.” 

And in a world which is rapidly becoming completely ‘software defined’ new skills and tools are required. 

In this session, we will discuss why today’s IT organizations require mature and complete native tools – built in the cloud for the cloud – which provide: 

– Complete visibility
– Configuration management – Identity protection
– Secure DevOps
– Compliance Automation
– Governance Enforcement
– Environment Lockdown 

We will discuss the subtle yet profound differences in operating your datacenter in the public cloud vs operating your own datacenter. We will discuss the ’Shared Responsibility Model’ and what it really means to you and your IT department as you expand the number of workloads you move to the public cloud. And, as your sophistication increases, and you expand your use of PaaS and IaaS, the complexities follow in tandem. We will show how today’s IT organizations require new, purpose-built tools designed and capable of ’speaking the same language’ as the public cloud infrastructures and built to leverage the extensive API’s they provide.

June – Kevin Albano

By

Topic: Effective Threat Intelligence Sharing

Many organizations struggle with creating threat intelligence for a variety of reasons – availability of data, trust of the data, and effective integration with other sources, among others.  Further compounding the challenge is the need to convert the information into meaningful and actionable actions. With the possibility of mounting cyber threats to several densely populated areas, many municipalities across the world face a growing need for insightful information to act and react to real-time dangers.

In this presentation, we will present approaches to effective sharing of threat intelligence and how we create new threat intelligence every day using commercial data sources for malware, surface web, dark web and open data sources.

Speaker: Kevin Albano
Kevin Albano, Global Lead, Threat Intelligence, IBM X-Force IRIS
Kevin Albano has more than 17 years of experience working in information technology, law enforcement, and security consulting. Throughout his career, he has focused on investigating computer network intrusions, notifying impacted organizations, and disrupting some of the largest cyber espionage campaigns.

At IBM, Kevin is responsible for threat intelligence collections, managing advanced threat research and directing information analysis – all focused on helping customers understand their cyber threat risk and make decisions to protect their organization.

Prior to IBM, Kevin held prominent roles at the Federal Bureau of Investigation (FBI) and Mandiant. As a Special Agent at the Los Angeles FBI Field Office, Kevin developed the investigative process for examining computer network attack operations. He identified large-scale organized data theft operations and created the field guide for how cyber espionage investigators notify data breach victims.

Kevin joined Mandiant from the FBI to help defend commercial and government entities against cyber espionage. While at Mandiant, Kevin developed programs to analyze criminal attack infrastructures, notify victim commercial entities, and define threats. He also supported incident responders by categorizing and organizing threat information to identify sophisticated threat groups.

Kevin has also made significant contributions to the Information Sharing and Analysis Organization (ISAO) Standards Organization ISAO 300-1