Agenda

Today’s modern applications depend on of a substantial amount of open source components and third-party libraries, and developers acknowledge that utilizing open source allows them to focus more on unique code attributes instead of recreating what’s already been successfully established. Although organizations acknowledge a heightened level of security, license, and operational risk, unfortunately, many don’t effectively track or manage open source throughout their entire code base and cannot consistently address the widening hazards they face.

As a result, organizations desire automated, repeatable processes for open source usage, risk management, and vulnerability remediation that fit within modern development environments.

In this session, attendees will hear recommendations from Stephen Gates, Checkmarx SME, on how to effectively implement an approach to:

• Identify open source with confidence
• Minimize open source security and license risks
• Prioritize exploitable vulnerabilities
• Accelerate informed remediation
• Integrate and automate open source analysis

Presentation level: MANAGERIAL (security and business leaders)

The past year has served as an accelerant for digital innovation and, unfortunately, nation-state cybercrime. However, cybersecurity professionals are up for the challenge! Come hear this panel of security leaders, working across several verticals, as they debate and discuss:

• Return to the workplace priorities for workforce resiliency
• Pandemic lessons learned to continue digital transformation
• Practical strategies for combating nation-state cybercrime
• Mental health and coping strategies

Today, 94% of cyber threats still originate in the inbox. “Impersonation attacks” are on the rise, as artificial intelligence is increasingly being used to automatically generate spear-phishing emails, or digital fakes, that expertly mimic the writing style of trusted contacts and colleagues.

Humans can no longer distinguish real from fake on their own, and businesses are increasingly turning to AI to distinguish friend from foe and fight back with autonomous response.

In an era when thousands of documents can be encrypted in minutes, “immune system” technology takes action in seconds—stopping cyber threats before damage is done.

Find out how in this session.

Visit the Exhibitor Hall for vendor displays or connect in the Networking Lounge.

Email is still the #1 attack vector the bad guys use. A whopping 91% of cyberattacks start with a phishing email, but email hacking is much more than phishing and launching malware! Join us as we explore 10 ways hackers use social engineering to trick your end-users into revealing sensitive data or enabling malicious code to run.

You will learn:

•  How silent malware launches, remote password hash capture, and how rogue rules work
•  Why rogue documents, establishing fake relationships and getting you to compromise your ethics are so effective
•  Details behind clickjacking and web beacons
•  Actionable steps on how to defend against them all

If all you were worried about were phishing attempts, think again!

Most organizations have a hybrid implementation of cloud and on-prem services. With the rapid adoption of business digitalization and expanding remote work force, how do we consolidate controls and enhance the security of the systems?

In this hybrid mode, enterprises need speed, visibility, security, and reliability without compromise. Enter the secure access service edge, better known as SASE. It’s inevitable that SASE implementations and Zero Trust implementations will provide a more comprehensive security capability to truly support digital transformation. How can your organization best position itself for the transition?

In this session, James Christianson will discuss:
·  How to migrate your security controls to take advantage of SASE
·  Reducing cost while increasing your security posture
·  Implementing a road map for SASE / Zero Trust

InfoSec practitioners understand that observability and time-to-detection are crucial pieces of the security puzzle. However, data is often collected indiscriminately, stored unnormalized, retained for arbitrary periods of time, and sometimes even poorly understood. These issues make processing, baselining, and alerting on data sources harder than it should be.

In this session, Jayson Salazar, Sr. Security Automation Engineer @GitLab, will discuss in detail the principles, best practices, and tooling he’s relied on to continuously improve GitLab’s observability capabilities into its infrastructure. We will discuss technical, architectural, procedural, and compliance aspects surrounding successful logging, monitoring, and alerting operations for all-remote environments at scale. From Terraform, Serverless, Data-Store alternatives and Python as building blocks, over finding an architecture that meets your needs, all the way to Alert Triaging and Compliance, this is meant to be a guiding companion for Security departments at the beginning or midst of their observability journey.

Visit the Exhibitor Hall for vendor displays or connect in the Networking Lounge.

Visit the Exhibitor Hall for vendor displays or connect in the Networking Lounge.

Humans are not resilient—they get sick, die, retire, and can choose not to work for an organization. Currently, a CISO changes jobs on average every 18 months. Burnout is at an all-time high. Cybersecurity professionals feel undervalued and underutilized. Diversity continues to fight for its place on the team. While the cybersecurity industry is full of useful cyber resiliency insights and research, the human role in the resiliency chain is often overlooked. Together, we will define human resilience and the four-part solutions to create human resilience: individual, team, company, and industry.

Cybersecurity managers and leaders will leave this talk with a proactive talent resilience approach plan that will keep their talent from being vulnerable and/or from nullifying their overall resilience plans.

Presentation level: MANAGERIAL (security and business leaders)

Financial service firms have a responsibility to provide fool-proof security to instill faith in customers, and send a strong message that combating threats is a prime objective. They cannot afford to be complacent, especially when the majority of information produced or utilized in financial services is private and sensitive, not to mention highly regulated. All this adds up to make cybersecurity vital to business.

Building sustainable ongoing security starts with all-inclusive optics into the sensitivity of data and automated organization-wide control of it. Organizations can assemble all this with multiple solutions, but doing so is time-consuming, expensive, and can be fraught with integration woes.

There’s a better way. This session takes a deep dive into reducing complexity in sensitive and private data protection, including:

• How to dig deep across the enterprise into every place sensitive data may be stored, from data lakes to endpoint devices
• The benefit of automatic policy-specific remediation, including masking, redaction, deletion, and encryption
• How to scale data protection and compliance as data volumes increase