ISACA New England is proud to present a full day seminar on a variety of IT Audit and Security Sessions. The conference will include both a light breakfast and lunch. Topics to include:
Keynote Presentation (9:00-10:15AM): “Selecting and Applying GRC Frameworks and Standards”
* Presented by John Morency, Gartner Research
GRC standards and control frameworks are useful to guide IT risk and security management programs, but not all are applicable and not all are practical. Which standards are most appropriate to align with IT risk management and compliance programs, and what tools are there to support their implementation? These and related topics, such as COBIT 5.0, will be discussed along with practical recommendations for both planning and implementation.
Session 1A (10:30-11:45AM): “Real Business Threats for SMBs - Don’t be a Hacker’s Unsuspecting Target”
* Presented by Gary Mullen, Kaspersky Lab
It’s not news that threats are growing across the IT security landscape. Today’s malware imposes significant business risks due to the highly organized nature of attacks – applications, web sites and social networks are all subject to attacks and vulnerabilities. Hackers are highly organized professionals with vast networks who are able to precisely target an unsuspecting victim, including many small businesses and their employees. Users may not even realize his/her machine has been compromised for days, weeks or even months due to the nature of these attacks. During this presentation, Gary Mullen will examine what this means for business owners and what IT managers need to look for to stay on top of these threats.
Session 1B (10:30-11:45AM): “Web Application Security Introduction to OWASP Top 10”
* Presented by Martin Dolphin, RBSCitizens
As more legacy applications move from standalone client application to web based applications many benefits are realized such as version control, support for more systems, and reduced cost to deploy. On the flipside, poor coding and new attack vectors have unleashed security holes that have allowed exposure of sensitive information such as credit card information and patient records. This session aims to introduce the OWASP top ten risk for Web Application security. Attendees will leave the session with an understanding of top issues with respect to Web applications, examples of the business impact from these issues, and questions and tools to help assess the security focus of the development group.
Lunch (11:45AM-1:00PM): Provided by ISACA New England
Session 2A (1:00-2:15PM): “Internet Security: Threats, Trends and Actions for 2010”
* Presented by Barb Armstrong, L.L. Bean Inc.
We've seen a lot of news stories over the past few months on data breaches, attacks against governments, major companies, proliferation of malware and botnets, and privacy concerns sparking legislation across many levels. Names such as Aurora and Mariposa have been common topics in IS Security forums, as well as national news. New trends are emerging as the threats move from 'attack and grab' to 'infiltrate and harvest'. Is this a new wave of threat or an escalation of previous and known threats? What controls are needed going forward to counter these threats?
This presentation presents a high-level look at what occurred, what we know (or think we know) from publicly disclosed information, and what the potential impacts could be from an IT security, controls and risk perspective. Specific topics will include headlines from Q1 2010 (what they are and their impacts), new technology Trends, and Impacts and Actions
Session 2B (1:00-2:15PM): “Best Practices for Virtualization”
* Presented by Lou Harle, Systems Engineering
Moving from the physical server world to a virtual infrastructure requires adherence to industry best practices to ensure performance and security are optimal. What are these best practices and how do they differ from a physical environment?
Session 3A (2:30-3:45PM): “Cloud Computing - Critical Areas of Focus to Manage Risk”
* Presented by Thomas Witwicki, Assurance Point LLC
For those organizations who want to leverage the economic benefits of the Cloud Computing service models, the task of managing information risk especially challenging. The fundamental nature of the hosting model is to abstract and hide from the view of the user the underlying infrastructure behind the service. This presentation will explore the information risk and security requirements of the three Cloud Computing service delivery models, SaaS, PaaS and IaaS, from various perspectives including Legal, Audit, Compliance, Information Lifecycle Management, Portability and Interoperability, Incident Response, Business Continuity, Operations, Encryption, Identity and Access Management.
Session 3B (2:30-3:45PM): “Effectively Managing Security Risk”
* Presented by Karl Klaessig, Q1 Labs
Log Management and Security Information and Event Management (SIEM) solutions have become a trusted solution for network and security operators, to quickly detect and isolate security incidents and meet specific compliance requirements, as well as a growing number of regulatory mandates. Information and security professionals, tasked with keeping their organizations secure, are constantly challenged to improve their abilities to manage risk across an ever-growing spectrum of vulnerabilities and compliance mandates. A solution that successfully integrates risk management, SIEM, log management and network behavior analysis can provide organizations with a comprehensive network security solution, allowing them to get not only the forensics of the “during” and “after” an attack, but also enabling them to answer the “What if?”, minimizing the risk on their networks and their operations.
Attendees will leave the session with an understanding of how an integrated SIEM and Risk Management solution leverages powerful network security management and simulation and visualization to enable organizations to move away from day-to-day security firefighting while minimizing risk of exploits. IT managers will be able to simulate threats against their data centers and networks; they will also be able to simulate the introduction of new applications, allowing them to see the impact of vulnerabilities that could arise before certain aspects of a network are changed. |
