Venue is Oracle 5815 Owens Drive Pleasanton, CA 94588

Please arrive at 6:45 – Registration is required – email programs@isc2-eastbay-chapter.org AND conferencedirector@isc2-eastbay-chapter.org to assure we list you for pizza count and we have your name at the door to let you in.

Running a Successful Crowdsourced Security Program: Tips on How to Not Fail: Running A Successful Crowdsourced Security Program_ Tips On How Not To Fail

Scaling application and infrastructure security has been, and continues to be, a problem most organizations tend to face, but often don’t have the resources or bandwidth to tackle effectively. This is a fundamentally human problem. There are plenty of scanners, but we still need people to validate those results and to find the issues that scanners aren’t capable of catching – as well as identifying any exposed attack surface that the automated tools aren’t even covering. Enter the idea of the “crowd.” While crowdsourced security through bug bounties is not a new concept, adoption has only recently begun to pick up. Which is surprising considering there’s tremendous ROI and value to be gained from the crowd-at-large with relatively little effort.

So in what ways can an organization leverage the power of the crowd (which is just a fancy word for a large contingent of humans with highly diverse and creative security skill sets)? And more importantly, how can one do so successfully? That’s what I aim to cover with this presentation. As someone who has been directly involved in the creation, management, and growth of hundreds of crowdsourced security programs, I bring both a ground floor and 30,000 foot view of the current landscape of crowdsourced security. This talk is aimed to help organizations and security teams: a) Realize the value and varying ways they can leverage the crowd (crowdsourcing security has the potential to go well beyond just bug bounties); and b) Provide practical tips for running a successful program, as well as how to grow your program over time. I see a lot of badly managed or under-utilized programs in the wild, and want to help educate the world in terms of what can be accomplished through the power of crowdsourced security (hint: it’s a lot), and how to run a more effective program. 

BugCrowd

Bugcrowd is the #1 crowdsourced security company. More Fortune 500 organizations trust Bugcrowd to manage their Bug Bounty, Vulnerability Disclosure, and Next Gen Pen Test programs. Bugcrowd’s award-winning platform combines actionable, contextual intelligence with the skill and experience of the world’s most elite hackers to help leading organizations identify and fix vulnerabilities, protect customers, and make the digitally connected world a safer place. Based in San Francisco, Bugcrowd is backed by Blackbird Ventures, Costanoa Ventures, Industry Ventures, Paladin Capital Group, Rally Ventures, Salesforce Ventures and Triangle Peak Partners. Learn more at www.bugcrowd.com.

Grant (McCracken)

Currently the Director of Solutions at Bugcrowd, Grant has extensive experience in the crowdsourced security space – having been directly involved with the creation and maintenance of hundreds of crowdsourced security programs over the last few years. An OSCP, with a background in application security, Grant understands the hacker side of security, as well as the necessary logistical components and considerations to take into account when running and managing successful crowdsourced security programs.

(Read More at https://isc2-eastbay-chapter.org/mission-vision-goals/scholarship-and-sponsorship/)

Learn how you secure your APIs and Microservices using Externalized Dynamic Authorization.

Key agenda items

• Covering API security basics
• Avoiding bad security practices
• Overcoming OAuth limitations
• Managing authorization as a microservice

Thanks for sharing the ISC2 EB chapter meeting presentation and the links to more information.

• https://www.axiomatics.com/resources/topics/apis-microservices/
• https://www.axiomatics.com/resources/authorization_kong/
• https://www.axiomatics.com/resources/dynamic-authorization-for-the-apigee-api-gateway/
• https://github.com/ioannis-iordanidis/kong-axiomatics-plugin

About our Speaker: 

Jonas Iggbom, the VP of Sales Engineering at Axiomatics, has over 20 years of experience in product management and technical sales in endpoint security and access control. His expertise lies in encryption technologies, keys, certificates, and SSH, as well as access control solutions for privileged and end user accounts, databases, and applications.

Prior to Axiomatics, Jonas worked as the Director of Product Management at Fox Technologies and as a Product Manager at Check Point Software Technologies, both in California. He also held the position of Senior Sales Engineer/Product Manager at Pointsec Mobile Technologies in Chicago and Sales Engineer at their office in Stockholm, Sweden.

Jonas earned his bachelor’s degree in computer science from the Royal Institute of Technology in Kista, Sweden. Along with his expertise in encryption technologies and access control solutions, Jonas is also knowledgeable in intrusion detection, anti-virus, data leakage prevention, content control, and client virtualization.

Thanks to our topic sponsor: Axiomatics authorization solutions are utilized around the world to share sensitive data securely, meet compliance and minimize data fraud. From our offices in Chicago and Stockholm we serve a global customer base within finance, healthcare, insurance, manufacturing, media, pharma, software/high tech and the public sector. Our dynamic authorization suite for applications, databases, Big Data, APIs and Microservices enables a policy-based approach to access control to protect the most critical assets – on premise or in the cloud. Our product suite is built on Attribute Based Access Control (ABAC) in accordance with National Institute of Standards and Technology (NIST) guidelines. For the US Federal Government, Axiomatics is a member of the CDM program and actively participates in the GSA schedule. Website http://www.axiomatics.com

Session 2: Leon Jiang sharing his analysis of the Capital One Data Breach

8:15 – 8:45

Read More https://www.roostify.com/blog-home/2019/7/31/capital-one-data-breach-step-by-step-analysis

Lessons Learned from Capital One Breach & More

Matt Bouis, Sr. Engineer in Cybersecurity data analytics.

About Cybereason:

Cybereason is the leader in endpoint protection, offering endpoint detection and response, next-generation antivirus, managed monitoring and IR services.
Founded by elite intelligence professionals born and bred in offense-first hunting, Cybereason gives enterprises the upper hand over cyber adversaries.
The Cybereason platform is powered by a custom-built in-memory graph, the only truly automated hunting engine anywhere. It detects behavioral patterns across every endpoint and surfaces malicious operations in an exceptionally user-friendly interface.
Cybereason is privately held and headquartered in Boston with offices in London, Tel Aviv, and Tokyo.

Kindly confirm your attendance for the meeting by June 12th, 2019, along with your preference of pizza (Veg/Non-Veg).

We need to provide the attendee list to our host for badges.

To RSVP please send your name, *ISC2 ID  and the subject line “attending June 13th 2019 meeting” to programs@isc2-eastbay-chapter.org, and conferencedirector@isc2-eastbay-chapter.org.

Oracle 5805 Owens Dr, Pleasanton, CA 94588

Look for the (ISC)2 East Bay Meeting Sign pointing to the entrance of 5805. We meet just inside the main lobby.

*If you are not a member of ISC2 or ISC2 East Bay Chapter, please complete the membership application form and send the application with your notice of intent to attend.  Membership is still free, but we do need to know who you are.

ATTENTION DATE WAS WRONG – is 2nd Thursday May 9th

Location change – 6101 Bollinger Canyon Rd, San Ramon, CA 94583 Room BR1X – 1150

Why CISO’s Fail, in the words of the author, Barak Engel

Information security is now a really big deal, yet we keep screwing it up. Big breaches are in the news every day, and they are only the tip of the iceberg. Security leaders average less than two years in tenure, and job satisfaction – their own, and others’ of their performance – is lower than that of watching paint dry. Fingers go ablamin’, but in security we just end up pointing them elsewhere.

Why? and more importantly, what can we do about it?

Claimed in its origin by many cultures, the ancient saying “The Fish Stinks from the Head” applies to the emerging discipline of information security, just as much as it does to organizational rot and mis-development. Providing a useful guide for an irreverent look at ourselves, the speaker in this open-to-the-audience talk will touch on both the “why” and the “what to do” parts, while doing his best to make you laugh.

Real-life experiences, both amusing and embarrassing, will be shared liberally.

Speaker Bio: Barak Engel is known for having come up with the concept of “virtual CISO” back when security was a four-letter word that no one could spell. He stubbornly insisted, and ultimately developed a consulting practice around it. Almost two decades later his company, EAmmune, develops and manages security programs for organizations, large and small, across all industries. Barak himself has served as CISO for many of them (e.g. MuleSoft), and often for several at once.

In another clear mark of insanity, he decided to write a book about security management while still actively practicing, rather than from the comfort and safety of retirement. The 2017 book, Why CISOs Fail, keeps getting incredible reviews from those who stumble upon it, delighting Barak every time it happens. It also serves as the inspiration for this talk.

Industrial Control System Cyber Security Design and Regulation

Presented by Michael Cole, CISSP, CCNP – Control System Cybersecurity Analyst – Turlock Irrigation District

In the previous UTC Journal, Jon Stizel described how Ameren is using the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) to improve the maturity of their cybersecurity program with metrics and reporting.  Turlock Irrigation District (TID) has also used the NIST CSF, Energy Sector Cybersecurity Framework Implementation Guidance (ESCFIG) and the Electric Subsector Cybersecurity Capability Maturity Model (ES-C2M2) for its NERC CIP program foundation…

Michael Cole is a Control System Cybersecurity Analyst for the Turlock Irrigation District, where he provides expertise on NERC CIP Standards and Program design. Turlock Irrigation District is a Central California public utility that provides water for irrigation and power to customers in its service area. Michael has a Bachelor of Science in Computer Science, is a Certified Information Systems Security Professional (CISSP), and a Cisco Certified Network Professional (CCNP). Michael has focused on building a NERC CIP Documentation Architecture that is based on the NIST Cyber Security Framework (CSF) and Electric Subsector Cybersecurity Maturity Model (ES-C2M2). The architecture uses the ES-C2M2 cybersecurity domains as an abstraction for Turlock Irrigation District’s NERC CIP Program.

Venue: Optiv at 3875 Hopyard Rd., Pleasanton, CA 94588

Kindly confirm your attendance for the meeting by January 9th, 2019, along with your preference of pizza (Veg/Non-Veg) so that we place orders accordingly.

We need to provide the attendee list to our host for badges.

To RSVP please send your name, *ISC2 ID  and the subject line “attending January meeting” to conferencedirector@isc2-eastbay-chapter.org.

*If you are not a member of ISC2 or ISC2 East Bay Chapter, please complete the membership application form and send the application with your notice of intent to attend.  Membership is still free, but we do need to know who you are.

REMINDER: Arrive on time or there will not be anyone to open the door.  We begin door duty at 6:30 and end at 7:00 PM – NO EXCEPTIONS

Take the elevators to the second floor, take a left, we are all the way at the end of the hallway.

Venue: Chevron World Headquarters

Dinner

RSVP

RSVP to conferencedirector@isc2-eastbay-chapter.org with the subject “Attending October 11th at Chevron building A”. Include your name and ISC2 ID. If you don’t have an ISC2 ID and are not yet a member of our chapter, include the membership application with your email and copy membership@isc2-eastbay-chapter.org

We will be meeting in Building A in room 1020., 6001 Bollinger Canyon Rd, San Ramon, CA 94583. Park in the visitor parking lot and proceed to BLDG A.

Don’t get lost

To RSVP please send your name, *ISC2 ID  and the subject line “attending September meeting” to conferencedirector@isc2-eastbay-chapter.org. If you have not arrived by 7:00 PM you will not be able to enter the Venue. Please arrive between 6:45 and 7:00 PM as doors lock and all attendees will want to go upstairs to the meeting room. (more below)

Topic 1:  Security Architecture in a Hybrid state

Speaker Istvan Berko – Security Sales Consultant, PNW, GovEd & Globals

In the past, we have aligned our security architecture through our governed controls and the applicability of these controls to our environments. As the legacy IT architecture is morphing into business-centric functions, the underlying infrastructure and data architecture is changing at pace.  This is resulting in a need to shift our information security perspective and the acceptable residual risk. This talk will discuss the need to adapt and consider some of these newer attack vectors and risks.

• Operational Cloud security controls – New privileged provided to applications from an abstracted privilege management platform
• Controls applicability to SaaS platforms – Do we introduce legacy security to hosted services?
• Network and segmentation architecture – What works and what doesn’t
• DevSecOps and CD/CI and how we enable an SDLC approach to business lead rapid deployment.

Dimension Data – http://www.dimensiondata.com/en-US/Solutions/Security

Mini Topic : Why IPv6 and IOT is the “Price of Admission” our November 9th Conference

Speakers: Robin Basham, Conference Director

Venue: Optiv at 3875 Hopyard Rd., Pleasanton, CA 94588

Kindly confirm your attendance for the meeting by September 12th, 2018, along with your preference of pizza (Veg/Non-Veg) so that we place orders accordingly.

We need to provide the attendee list to our host for badges.

To RSVP please send your name, *ISC2 ID  and the subject line “attending September meeting” to conferencedirector@isc2-eastbay-chapter.org.

*If you are not a member of ISC2 or ISC2 East Bay Chapter, please complete membership application form and send the application with your notice of intent to attend.  Membership is still free, but we do need to know who you are.

REMINDER: Arrive on time or there will not be anyone to open the door. We begin door duty at 6:30 and end at 7:00 PM.

End Point Security Training Day

Odds Are You Need More Skills than Luck

Speakers and Topics are under review.  Please reach out to  Conference Director  Robin Basham,  Director Cybersecurity Awareness Krishnan Thiruvengadam, or Director Education & Career Development Jing Zhang-Lee

Read More

ISSA and ISACA members are welcome to participate as long as seats are available.

Training day is limited to the first 50 students.  Sessions run 90 minutes.  Please reach out if you are interested in being an instructor.

9 AM to 4 PM – 6 CPE

Exfiltrating Data through IoT

“Exfiltrating data through the Internet of Things (IoT) provide insights based on research/analysis of data exfiltration vulnerabilities found in IoT protocols (i.e. SSDP, P25, Zigbee, Z-Wave, Wi-Fi, uPnP). With an eye toward mitigating weaknesses in current protocols, this talk addresses future protocol designs to eliminate those weaknesses.  This discussion will delve into the details and demo data exfiltration using IoT protocols. The application of this knowledge will allow you to assess and mitigate these risks as you integrate IoT technologies into your production systems, as well as making informed decisions regarding IoT device and protocol selection.

Garry Drummond, CEO & Founder, 802 Secure Mr. Drummond is a Wartime CEO. From his humble beginnings in Pleasanton, California, he boot-strapped his start-up company, 802 Secure Inc. from his garage. Mr. Drummond has conceptualized, designed and delivered cybersecurity products for both Critical Infrastructures, Enterprise and Government clients around the world. Mr. Drummond along with his few but loyal engineering team landed venture capital in November 2016 to expand the team and fulfill orders. 802 Secure is developing technology for Securing the Internet of Things (IoT), combining Software Defined Radios with Big Data Analytics. Mr. Drummond is a Certified Information System Security Professional (CISSP) and is passionate about wireless cybersecurity. With the recent explosion of Internet of Things, (IoT) device enablement as well as mobile adoption – wireless has now become the easiest way to back-door the wired-side of the network. Wireless technologies do not follow the traditional guidelines of security and new methodologies required to secure digital assets. Only through new thought leadership and innovation using software-defined- radios with big data analytics can these new broader spectrum attack vectors be identified.

802 Secure was awarded Silicon Valley Start-up of the Year in April 2015 and Silicon Valley Company of the Year May 2016. Most recently, in 2017, Mr. Drummond was awarded Most Innovative CEO of the Year.802 Secures products are sold through 5 of the most influential technology resellers in the US.

Aaron Davidson, Solutions Architect, 802 Secure Mr. Davidson is 802 Secure’s Solution Architect working with clients in understanding their issue(s) and providing solutions in meeting their security needs. His experiences stretch from technical support, system admin, network engineering & architecture, quality assurance, security engineering, sales engineering and personnel management. His technical sales skills and bonding with deeply technical individuals as well as creating relationships with management, senior executives, VP and C level have provided effective solutions in meeting the demands of their industry segments.

About 802 Secure:

802 Secure is developing signal intelligent technology for securing the Internet of Things; detecting and assessing new wireless risks across the broader RF spectrum using software defined radios and big data analytics. 802 Secure has developed a leading world-class product, AirShield, to monitor IoT assets, identify risks and threats, and ensure performance and reliability 24×7 of the IoT environment. (www.802secure.com)

Location: Blackhawk Network, 6220 Stoneridge Mall Rd, Pleasanton, CA 94588 – 7 PM

Privacy by Design – Why It Can’t Wait!

Here are the slides from the presentation: Privacy by Design_ISC2 EB Chapter Meeting 5.10.18

As the U.S. and the rest of the global community continue to rethink what individual privacy entails, and as “big data” is ingested into machine learning/AI, there will continue to be uncertainty of what the future of privacy will look like. This, coupled with news about mass surveillance, user behavior tracking, and targeted advertising have caused developers to take a more defensive approach when designing new services and products. Implementing Privacy by Design (PbD) can help protect organizations in the long run by applying the principles to their development and design activities that enable privacy by default.

Attendees will learn:

• What are the principles of Privacy by Design (PbD)
• Why they are important
• Tips for operationalizing PbD

Speaker Information:

Orus Dearman, CISSP, CISA ,Managing Director, Cyber Risk Advisory, P: (415) 318-2240, E:  orus.dearman@us.gt.com

Orus provides technology and advisory services to clients in the technology, financial services, and federal industries. He has extensive experience leading cyber risk projects in accordance with the NIST cybersecurity framework, Generally Accepted Privacy Principals (GAPP), FISMA, and FedRAMP guidelines within the United States and globally.  He also specializes in physical and logical vulnerability assessments. Orus works with companies enabling them to implement cybersecurity and privacy frameworks such as the NIST Cybersecurity Framework, GAPP, FISMA/FedRAMP, ISO 27001, and the Trust Services Principles.  He also leads the firm’s Federal Risk and Authorization Management Program (FedRAMP) practice nationally. He has extensive experience providing technical advisory services for clients within the technology, financial services, and federal industries.

Orus is a Certified Information System Security Professional (CISSP), and a Certified Information Security Auditor (CISA).

Dhawal Thakker, CISSP, CISA, Senior Manager, Cyber Risk Advisory, P: (650) 450-1431, E: dhawal.thakker@us.gt.com

Dhawal has over 18 years of experience leading and coordinating IT advisory engagements across several industries, with a focus on the financial services, technology services and healthcare sectors. His experience includes regulatory compliance, privacy (GDPR) GRC program and technology deployments, compliance to regulations like SOX, HIPPA, compliance to credit card industry standards (PCI) designing security policy, Network Security assessments, BCP-DR, Experience, and expertise include:

Dhawal has experience implementing privacy frameworks, assessing EU General Data Protection Regulation (GDPR) compliance, developing privacy policies, benchmarking developer agreements and ensuring compliance with global regulations.

Dhawal has hands-on experience in design implementation and managing GRC solution to automate Cyber and Privacy compliance programs using tools like RSA Archer, ServiceNow, OneTrust etc. Dhawal is a Certified Information Systems Security Professional (CISSP), and a Certified Information Systems Auditor (CISA).

Directions to our meeting:

From Hwy 680 going South (680 S):

Form San Ramon

• Get on I-680 S
• Follow I-680 S to Stoneridge Dr in Pleasanton. Take exit 29 from I-680 S
• Make a right turn on Stoneridge Dr
• Use the Right two lanes to turn right onto Stoneridge Mall Rd
• Make a right turn on Workday Way
• Take Workday Way to the end of the road and make a left in the parking lanes
• Take the road until you come to the first crossroad
• Make a right turn and take the road to the end of the street
• We are the building on the right and you can park anywhere in the parking spaces in front of the building.
• Blackhawk Network, 6220 Stoneridge Mall Rd, Pleasanton, CA 94588

From Hwy 680 going North (680 N):

Form San Jose

Get on I-680 N

• Follow I-680 N to Stoneridge Dr in Pleasanton. Take exit 29 from I-680
• Use the left two lanes to turn left on Stoneridge Dr
• Use the Right two lanes to turn right after crossing the overpass onto Stoneridge Mall Rd
• Make a right turn on Workday Way
• Take Workday Way to the end of the road and make a left in the parking lanes
• Take the road until you come to the first crossroad
• Make a right turn and take the road to the end of the street
• We are the building on the right and you can park anywhere in the parking spaces in front of the building.
• Blackhawk Network, 6220 Stoneridge Mall Rd, Pleasanton, CA 94588

Kindly confirm your attendance for the meeting by May 8th, 2018, along with your preference of pizza (Veg/Non-Veg) so that we can place orders accordingly. We need to provide the attendee list to our host for badges. To RSVP or for any questions regarding this meeting please contact Vice President Tom Rogers