Summary

IT security organizations big and small are concerned about threats from applications, endpoints, especially unmanaged endpoints, and IoT devices. They want to reduce the number of unknown endpoints/IoT devices and are concerned about unauthorized endpoints in the network.

They are concerned about the vulnerability of these endpoints and are wondering how to detect IoT device compromise. Protecting IoT devices, to segment them with least privileged access is a real challenge.
Further, the organization must make sure sensitive data sent by these devices is protected while at rest and in motion.
Finally, they must address privacy concerns on the data stored, and data processing throughout the product lifecycle.
With all these challenges, where does the organization start? As security professionals, how do we onboard and secure these IoT devices?
This discussion provides approaches that help to identify, gather context, understand behavior, and implement necessary segmentation of IoT devices

Topic: SAP Data Custodian for Cloud Data Security

March 11th 7 PM to 9 PM Playback Link

Data is the most precious commodity for companies, and it needs to be protected at all costs. It’s an increasing challenge for our customers to protect and retain control of their data as they move from an on-premise world into the cloud and SaaS environments. Customers further face a wide range of stringent data protection regulations in various regions and countries as they move into globally connected cloud. These regulations demand strict data storage controls in terms of geo-locations and contextual data access controls based on user attributes, for example, geo-location, citizenship, job contract type, department, etc. These data protection regulations impose heavy penalties on data breaches: a single data breach can be critically detrimental for a company.
One of the most common requests from cloud customers is around geo-location: “Where is my data? How can I see where my data is and who is accessing it?”
This presentation will outline industry approaches (or lack thereof) to address the following topics:

• full stack transparency
• data residency controls
• contextual application access control
• data discovery
• anomaly detection
• customer-controlled encryption keys
• and finally, “where is my data going?”

Further, the presentation will suggest how SAP Data Custodian offers a wide range of powerful data security features to help our customers protect their data in the cloud and to get full control of their data in the cloud. These features include full-stack transparency, data residency controls, contextual application access control, data discovery, anomaly detection, and customer-controlled encryption keys. These features help our customers meet their data protection regulations, data sovereignty and business compliance requirements.

Dr. Wasif Gilani is Vice President / Head Product & Solution Management in SAP Multi-Cloud organization, leading strategic cloud data security and data protection solutions. Wasif is also the Chief Product Owner of the SAP Data Custodian solution, an initiative that he started in 2017, and which won the prestigious International Association of Privacy Professionals (IAPP) innovation award in 2019. Wasif has been working with SAP for 14 years and has worked extensively in the areas of Cloud Computing, Data Security, Data Protection, Business Intelligence, Business Process Management, and System Engineering.

Topic: Data-Driven Decision Making in Cyber Security

Presented by Dr. Marty Trevino, Chief Scientist for the Insight Cyber Group

What is Decision Support Science?

• Random Forests and Linear Regressions
• Neuroscience and Cognitive Behavior
• What do bad actors understand about our thalamus and visual cortex?
• What are intractable equations that enforce what we believe at a rate of 6 to 1 over the new information that must be understood?
• What’s the importance of Peer Review and Cohesion?
• What indicators tell us quite clearly if a group is likely to protect us or do harm?
• Do I like my job? Do I like my coworkers? Am I committed to my company? Do people listen to me? Do people respect my opinion?
• What if these same questions apply to the entire social platform and the state of our digital citizens?

About Marty:

Dr. Marty Trevino is the Chief Scientist for the Insight Cyber Group https://www.insightcybergroup.com. and serves as a Strategic Advisor to numerous other firms.  Dr. Trevino is a nationally known Data / Decision Scientist and thought leader with a focus on building advanced Analytics and Artificial Intelligence Systems. Dr. Trevino has conceptualized, developed, and deployed multiple next-generation Visual Analytic systems in the US Intelligence Community and the cybersecurity industry in Silicon Valley.  Dr. Trevino’s passion is improving higher-order decision-making through a deep understanding of the Neuroscience, Cognitive, and Behavioral Psychology of decision-making with Visual Analytics.  Dr. Trevino has led global and diverse technical and is a frequent writer and speaker.

Dr. Trevino is the senior technical advisor to the Inter-American Defense Board in Washington DC advising both the governments and military organizations of 27 nations of the Americas on advanced concepts in Cyber Security and Analytics.  Dr. Trevino is also a visiting professor at the National Defense University in Washington DC and is frequently a speaker at the Inter-American Defense College.  Dr. Trevino holds a Bachelor’s, two Master’s degrees, and a Doctoral degree in addition to various certifications.

MONITORING AND INCIDENT RESPONSE FOR THE IoT Better analytics.

 Insight Cyber Group provides a portfolio of services that deliver continuous, real-time cyber risk management and improved operational efficiencies of industrial IoT assets. Our services combine advanced visibility and expert analytics with proprietary automated tools. Insight Cyber supports the entire lifecycle of risk monitoring and incident response capabilities required by today’s industrial enterprises, filling three crucial IoT cybersecurity gaps:

1 – The Analytics Gap – Analytics for IoT are not detailed or granular enough.

2 – The Context Gap –  IoT events lack context for interpretation.

3 – The Skills & Knowledge Gap. There is a severe shortage of skilled IoT cyber resources.

Insight Cyber’s expert service-based approach delivers immediate value to your organization. We combine superior production data and state-of-the-art analytics with expert human intelligence. Our positive outcomes include measurable cyber risk monitoring, proactive defense of your IoT production environment and improved operational process efficiencies. – We protect your investments with advanced data collection tools that provide deeply granular views of process and SCADA data; advanced visibility that detects security and production issues; and dynamic, NIST-based risk scoring of IoT assets. – We extend your knowledge base by augmenting your existing team with dynamic reports and expert analysis.

Website

http://www.insightcybergroup.com

Joan Ross, Chief Intelligence Officer

Curtis Blount, CISO

Vulnerability Prioritization: Are You Getting It Right?

Thank you to all who attended our October 8th event. Please enjoy this free playback.

The following materials have been shared with our entire membership. Thank you, John and Dima!

the-state-of-open-source-vulnerabilities-2020

WS-Presentation-ISC-Oct-08-V11

WhiteSource-DevSecOps-Insights

Dima Gorbonos, Senior Sales Engineer at WhiteSource

Is a key technical advisor and solution advocate, responsible for planning and delivering of solution demonstrations to large Enterprises. It’s his role to respond to functional and technical elements of RFIs/RFPs, so he’s an outstanding choice to guide our questions related to our own  Vulnerability Prioritization and program requirements.

Dima will be assisted by John Timberlake , A self-appointment “techie” who enjoys the luxury of working with enterprise clients who are embracing DevOps and Cloud Technologies to transform the way they build software and run their business. Leader for the Seattle based North American DevOps Group
John has graciously agreed to provide attendees with some spectacular resources.

<<the-state-of-open-source-vulnerabilties-2020>>

Their conversation and demo is supported by the work of David Habusha, WhiteSource Product Executive

Here’s a recent article sample:

Developers must find a way to zero in on the security vulns that present the most risk and quickly address them without slowing down the pace of development.

The past few years have seen an exponential rise in the volume of reported security vulnerabilities. Combined with the increase in headline-grabbing security breaches, it’s no surprise that organizations are upping their application-security game. This includes a heightened focus on the detection and remediation of security vulnerabilities as early as possible in their DevOps pipeline — leaving developers with the added task of handling an increasingly high number of security alerts.

But they can’t remediate everything. This is why they must find a way to zero in on the security vulnerabilities that present the most risk and quickly address them without slowing down the pace of development.

The prioritization of vulnerabilities has become a burning issue for software development outfits that want to stay ahead of security while not falling behind on AppSec release dates. Unfortunately, there is currently no set standard or practice for how to prioritize them. Different teams prioritize security alerts based on a variety of parameters and considerations — not necessarily the most effective ones, either. As a result, they are spending a lot of valuable time figuring out what to tackle first, to varying degrees of success.

To understand which prioritization methods are currently most common, we surveyed 300 of our customers and asked them how they prioritize vulnerability alerts. The top five considerations that arose were vulnerability severity, application type, the popularity of the vulnerable open source component, vulnerability disclosure date, and ease of remediation.

To learn more, we added a new perspective: the hacker community. We took the 100 most common open source vulnerabilities reported in 2019 based on the WhiteSource vulnerabilities database and compared characteristics, such as popularity, disclosure date, and severity score, to the level of discussion in the hacker community based on data from CYR3CON, which predicts cyberattacks based on artificial intelligence gathered from hacker communities.

In doing so, we’re able to gain insights about the effectiveness of common prioritization methods are and how they measure up when it comes to the hacker community’s preferences.

Vulnerability Severity
Many organizations consider the Common Vulnerability Scoring System (CVSS) vulnerability score first when prioritizing remediation since it’s so easily accessible and seemingly straightforward. Unfortunately, this parameter does little to shorten the long list of security vulnerabilities that teams need to address since data shows over 55% of the top open-source security vulnerabilities were rated as high or critical.

<Enjoy the full article here>

About WhiteSource

WhiteSource helps businesses all over the world to develop better software by harnessing the power of open source. Open source components, a significant and important part of commercial software today, are often substantially under-managed. WhiteSource fully automates the entire process of open source components selection, approval, tracking and management, including real-time alerts on vulnerable and problematic open source components, customized reports, enforcing policies automatically and more. An integral part of your software development environment, WhiteSource guarantees the continuity and integrity of open source management and reduces respective risks. WhiteSource provides a complete solution that supports all programming languages. The solution seamlessly plugs into all popular build tools. WhiteSource is a venture-backed company with offices in NY, Boston and Tel-Aviv.

Website

http://www.whitesourcesoftware.com/

Please register for Thursday, September 10, 7 PM – 9 PM 2 CPE “Get Hired” Cyber Security event – Free and open to nonmembers.

Head of Permanent Security Recruitment – and Co-Founder at Code Red Partners –  Cybersecurity Careers Thriving During the Pandemic

Are you a senior security engineering manager looking for a career-defining role? Watch now to learn more about our latest #cybersecurityjob opportunity at a fast-growing Bay Area FinTech innovator: #infosecjob #cybersecurityjobs #cybersecuritystaffing #infosecurityjob pic.twitter.com/p0h6tsFJF0

— Code Red Partners (@CodeRedPartners) March 17, 2020

Want free cybersecurity training with certification? Check out SearchSecurity's free online security classes led by InfoSec experts today!https://t.co/Nhr4zay9UH#cybersecurity #freeclasses #certifications #onlinelearning pic.twitter.com/KNr00cKQ84

— Code Red Partners (@CodeRedPartners) August 26, 2020

Code Red specializes in cybersecurity staffing. We recruit exclusively in the security space, giving us an in-depth understanding of the needs of both the job seekers and employers that we partner with. We pride ourselves on our extensive network within the Financial Services industry, including FinTech, Banking, and Blockchain.

Website http://coderedpartners.com

JOBS HAPPENING RIGHT NOW, and how you get one.

Life Sciences & Health Care, Medical Device Manufacturing and Cybersecurity, A Strategy

Life Sciences & Health Care, Medical Device Manufacturing and Cybersecurity, A Strategy

As the Pandemic moves to its sixth month, we see a shift not only in our prioritization of health issues but how we do medicine and the implications of cybersecurity across the proliferation of attack services ranging from devices to home computing.

• Life Science and Health Care (LSHC) – Market, Players, Opportunities
• Two key documents for learning – BSI Cybersecurity of Medical Devices; MDIC Medical Device Cybersecurity Report
• Cyber Related Standards
• Frameworks, Standards & Tools, How CISO’s Address MDM Cybersecurity
• List of resources and Laws
• IoT and CCPA
• Mapping and Tagging – Unification within GRC and Cybersecurity Risk Management
• Integration Progress – Facilitated Compliance Management
• Investment in Licenses and Partners

Robin Basham is the owner EnterpriseGRC Solutions, President, ISC2 East Bay, Certified Information Systems Security (CISSP), Audit (CISA), Governance (CGEIT) and Risk (CRISC), ICT GRC expert and early adopter in both certifying and offering certification programs for Cloud Security and Virtualization, with industry experience in the management of systems, controls and data for SaaS (IaaS and PaaS), Finance, Healthcare, Banking, Education, Defense, and High Tech. Positions held include Technology Officer at State Street Bank, Leading Process Engineering for a major New England CLEC, Sr. Director Enterprise Technology for multiple advisory firms, founding, engineering product and running two governance software companies, and most recently Director Enterprise Compliance for a major player in the mortgage industry, Ellie Mae. Having served as Cisco, Unified Compliance, and ISMS Program Manager for a multi-year GRC project, Robin currently leads EnterpriseGRC Solutions LSHC initiative in support of three MDM clients. Robin may also be recognized for donating substantial time to supporting social platform security to further social democracy. Robin is also a past board member for the ISACA SV chapter.

• CCPA SB-1121 California Consumer Privacy Act of 2018. (2017-2018) https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180SB1121
• SB-327 Information privacy: connected devices. TITLE 1.81.26. Security of Connected Devices https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180SB327
• SANS Top 20 Critical Security Controls V7.1 https://www.sans.org/critical-security-controls/
• NIST Framework for Improving Critical Infrastructure Cybersecurity, V1.1 http://www.nist.gov/cyberframework/ https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
• NIST 800-53 V5. Security and Privacy Controls for Federal Information Systems and Organizations Important new features include Keywords and Attributes used for tagging https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/draft 
• DISA Secure Technical Implementation Guides. https://public.cyber.mil/stigs/

IoT and California Consumer Privacy Act, CCPA

TITLE 1.81.26. Security of Connected Devices, a new law, was designed to protect the security of IoT devices and the information those devices hold.

• The law can be enforced only by the attorney general, a city attorney, a county counsel, or a district attorney, and does not provide for any right of private action.
• The law does not apply to connected devices already subject to federal security standards.

The CCPA became effective on January 1, 2020

• Officially called AB-375, CCPA is a bill that enhances privacy rights and consumer protection for residents of California. Signed into Law June 28, 2018, CCPA amends Part 4 of Division 3 of the California Civil Code.

The Road to Zero-Trust: Past, Present, and Future: What is Zero Trust <Araali_ Deck for (ISC)2>

Organizations measure their Application teams on deployment velocity, feature release velocity, and performance of their apps. In today’s cloud-native world, app teams are building and iterating at lighting speed, churning out multiple features, and releases a day. Often application teams feel dragged down by their security counterparts, and the application security gets left behind. The disconnect between app and sec drives companies to focus more on Response and Detect – which is more manual and expensive than automated Prevention. Even though teams spend more on security, breaches galore.

Over the last couple of decades, analysts and the security community, focussed on Preventive Security, concentrated on user and hardware devices (e.g., software-defined perimeter (SDP), Zero-Trust, and Privileged Access Management). These technologies deliver the least permissive privilege and access for users and their devices, but the apps running in the data centers and hybrid cloud were never covered. One of the key reasons is that users and devices are independent entities, and they have identities – 2FA like a fingerprint, SMS, etc. Apps don’t have 2FA.

Different companies took different paths to deliver zero-trust for apps through Big Data, ML, Network processors, FPGAs, etc. However, the promised land of Application Zero-Trust remained elusive. Even though enterprises know the least permissive privilege/zero trust is the right way to go, they struggle to adapt. The conflict is mainly centered around three key pillars – operation complexity, business disruption, and operational cost.

In this talk, Abhishek will cover some of these ideas to unpack the concepts in an easy to understand fashion. Also, he will share some key ideas you should keep in mind while thinking of protecting your custom apps running in your public and private clouds.

Abhishek Singh, CEO, Araali Networks

Abhishek was previously the Co-Founder/VP of Engineering at Tetration Analytics where he led the initial team to build and scale a datacenter-scale platform to enable micro-segmentation and security in a Virtual Machine environment. Prior to Tetration, he held engineering leadership positions at Aruba, Cisco and Ericsson.

Abhishek has a Bachelor’s in Technology degree from the Indian Institute of Technology Kanpur and a Masters’s degree from John Hopkins University (both in Computer Science).

Registration for the event:

Registration for Atakama June 11 – REQUIRED

Topic: Data-Centric Security in an entirely Remote World

Atakama protects files using advanced threshold cryptography and by inextricably linking files stored in one location to more than one physical device.
‍
This session introduces the founders speaking on the problems they found and solved. Attendees can get a free trial license and experience the Atakama approach to file level security as required on any type of device and under any permutation of requirements for rights management.

Learn more at Atakama’s recent press release

Meet Daniel H. Gallancy and Dimitri Nemirovsky from Atakama

Daniel H. Gallancy  

CEO, Atakama,  LinkedIn 

200 Park Ave, 17^th Floor, New York, NY 10166 – +1-212-273-9580

About Daniel:

Daniel H. Gallancy is the CEO and a founding member of Atakama, a NYC-based information security software company. Atakama Inc. provides unparalleled data protection for businesses. By employing a file-by-file encryption design, Atakama eliminates the ability for attackers to directly profit off of confidential data and substantially mitigates the damage of unpreventable attacks. Atakama’s encryption solution helps companies adhere to mandatory compliance regulations and in the process, provides best-in-class protection for sensitive and non-public information. Atakama’s distributed key management protocols can be customized based on company or department needs, seamlessly integrates with existing cybersecurity stacks, and can be deployed within hours.

Mr. Gallancy has provided bitcoin and blockchain-related advisory services for private corporations, investment management firms, post-trade processing companies, central counterparties, and US State and Federal regulators.

Prior to founding Atakama, Mr. Gallancy spent ten years in the asset management industry. Mr. Gallancy was an investment professional at Beaconlight Capital and, before that, at Alson Capital Management. Mr. Gallancy’s areas of focus included semiconductor capital equipment, IT hardware, software, and telecommunications. Mr. Gallancy was responsible for corporate diligence, financial analysis, and investment decision-making.

Daniel is one of the co-founders of SolidX Management LLC, a company that has filed a registration statement with the Securities and Exchange Commission relating to the proposed launch of the VanEck SolidX Bitcoin Trust, which will seek to provide shareholders with exposure to the daily change in the U.S. dollar price of bitcoin. Bitcoin to be held by the VanEck SolidX Bitcoin Trust will carry insurance against theft, loss, and other adverse operational events.

Daniel was raised in Queens where he attended public school. He taught himself to program in C at age 10. Daniel graduated from Stuyvesant High School before attending the University of Pennsylvania where he earned a BA in Physics and a BSE in Electrical Engineering. During college, Daniel built a wireless, laser-based network communication link (back in the days before WiFi). He earned an MBA from Columbia University and is a CFA Charterholder.

How it Works – The Graphichowitworks_infographic_03

Dimitri Nemirovsky

About Dimitri: Dimitri is the Cofounder and COO of Atakama. Dimitri took his first coding classes in 8^th grade. He holds BBA and MBA degrees from Baruch College and earned his JD from Brooklyn Law School. Prior to co-founding Atakama, Dimitri practiced regulatory and enforcement law at an international law firm where he focused on the various technology, digital archive, and e-discovery regulations that developed during the 2000’s.

About Atakama

Atakama Inc. is an information security software company that provides unparalleled data protection for businesses. By employing a file-by-file encryption design, Atakama eliminates the ability for attackers to directly profit off of confidential data and substantially mitigates the damage of unpreventable attacks. Atakama’s encryption solution helps companies adhere to mandatory compliance regulations and in the process, provides best-in-class protection for sensitive and non-public information. Atakama’s distributed key management protocols can be customized based on company or department needs, seamlessly integrates with existing cybersecurity stacks, and can be deployed within hours. Undeniably, a vast improvement over the status quo.

If you want to improve your security and better protect your data, we’re here to help you.

To learn more or to do business with Atakama please contact us:
https://calendly.com/atakama-dimitri/15min
https://www.atakama.com/ 
Specialties: encryption, cloud security, cybersecurity

Atakama will be offering a free user version of their software to attendees and will be showcasing a live demo of their revolutionary file encryption product that is designed to protect companies from today’s emerging threats such as maze attacks.