Have some fun as an experienced awareness trainer/course developer refreshes your view and teaches you some new tricks for making messages stick through demonstrations, interactive exercises and storytelling. Learn first-hand how to communicate in ways that work with, rather than against, the brain. Audience participation is encouraged and will be rewarded.
Speaker - K Rudolph, Chief Inspiration Officer, NATIVE INTELLIGENCE INC
K is the founder and Chief Inspiration Officer at Native Intelligence, Inc., a firm that has spent the last ten years supporting security awareness efforts of government organizations and private industry clients. K is a CISSP, holds a degree from Johns Hopkins University, and is the author of the chapter on Security Awareness Programs in the soon-to-be-published three-volume ?Handbook of Information Security.? She is a contributor to NIST Special Publication 800-16, "Information Technology Security Training Requirements: A Role- and Performance-Based Model." She has had several articles and interviews on Security Awareness Programs published. Currently, K is working with Mich Kabay of Norwich University on an illustrated book on cyber security for general audiences.
Several hundred thousand people worldwide have taken security awareness courses that K has developed. Some of these courses have been translated into several languages. K has developed awareness programs that include surveys, e-learning, newsletters, security mascot and themes, screen savers, posters, contests, videos, individual responses to security questions, and security awareness give-aways. K is a requested speaker at security conferences and events throughout the US. K is also an active member of the Executive Board of the Federal Information Systems Security Educators' Association (FISSEA).
Wireless LANs are popping up everywhere—in homes, hotspots and businesses. We'll review wireless LAN attacks that have occurred, give an appraisal of various risk models that address real dangers (not just hype) and provide a vendor-neutral review of wireless security technologies on the market.
Speaker - Jon Green, Senior Product Manager, Aruba Networks, Inc.
Jon Green, CISSP, is a senior product manager for Aruba Networks with primary responsibility for wireless security solutions. Jon has published a number of papers and speaks often on topics including mobility, wireless, and network security. Prior to joining Aruba in 2003, his experience included a variety of technical consulting and engineering positions at companies including Bay Networks, Shasta/Nortel Networks, Atrica, and Foundry Networks. He holds a BS in Information Technology from Western Governor's University, is a licensed commercial pilot, and has produced a number of award-winning wines.
Imagine: different exploit code for every user's browser. Subscription-based managed exploit services. Exploits that are invulnerable to signature-based anti-virus software. X-morphic exploitation may create such a hacker's paradise. Learn about this rising threat and how to combine signature- and behavior-based techniques to fight it.
Speaker - Gunter Ollmann, Director of Security Strategy, IBM Internet Security Systems
Gunter Ollmann serves as director of security strategy at IBM Internet Security Systems. With more than two decades of service within the information technology (IT) field, Ollmann is responsible for IBM Internet Security Systems? overall strategy for handling next generation security threats. As the former director of X-Force, Ollmann was also responsible for IBM Internet Security Systems? security research and development efforts, including all security content for IBM ISS products and services, zero-day vulnerability analysis, observation and analysis of global security trends and vulnerability discovery. Ollmann was previously the head of X-Force security assessment services in EMEA. In this role, he managed a distributed team of highly skilled consultants in multiple locations throughout Europe. He also pioneered specialist methodologies and techniques for the successful assessment of custom software solutions and increased the growth and application of the IBM ISS global center of excellence in security assessment and penetration testing. Prior to joining IBM ISS, Ollmann was the professional services director of Next Generation Security Software (NGS Software), a leader in vulnerability research and attack-based consulting. He was responsible for the development of business relationships, including building NGS? international clientele and defining the direction of research activities and the development of the company?s vulnerability-based knowledge services. Ollmann grew NGS? premier consulting service, dispensing cutting-edge security advice to product vendors to aid them in the development of commercial technology.
Organizations that are implementing Web services and beginning to look at Web 2.0 and rich Internet applications are discovering that there are unique security challenges that can surface throughout the various phases of the Web service lifecycle. Here's the full rundown.
Speaker - Steve Orrin, Director of Security Solutions, Intel Corporation
Steve Orrin is Director of Security Solutions for SSG-SPI at Intel Corporation and is responsible for security strategy and product direction. Steve joined Intel as part of Intel's acquisition of Sarvega, Inc., where he was their CSO. Steve was formerly VP of Security Solutions for Watchfire, Inc. Steve was previously CTO of Sanctum, a pioneer in Web application security testing and firewall software, and came to Watchfire through their acquisition of Sanctum. Prior to joining Sanctum, Steve was CTO and co-founder of Lockstar, Inc. Lockstar provided enterprises with the means to secure XML/Web Services and enable legacy enterprise applications for e-business. Orrin joined Lockstar from SynData Technologies where he was CTO and chief architect of their desktop e-mail and file security product. He is a member of the the Computer Security Institute (CSI), Internation Association of Cryptographic Research (IACR) and is co-founder of Web Application Security Consortium (WASC) and the SafeSOA Taskforce. He participates in several OASIS, IETF and AFEI working groups..
Swept up in the Enterprise 2.0 movement, organizations are conducting more e-business and introducing new technologies to enhance business capabilities. To support these evolving businesses and address the new challenges this evolution creates, information security must transform into information risk management. Learn how and why this new focus on a proactive, risk-based approach to information assurance must fundamentally change the way organizations view information security.
Speaker - John Pironti, Chief Information Risk Strategist, Getronics
John P. Pironti is the Chief Information Risk Strategist at Getronics. He has designed and implemented enterprise wide electronic business solutions, information security programs, and threat and vulnerability management solutions for key customers in a range of industries, including financial services, government, hospitality, aerospace and information technology. Mr. Pironti has a number of industry certifications including Certified in the Governance of Enterprise Information Technology (CGEIT), Certified Information Systems Auditor (CISA), Certified Information Security Manager (CISM), Certified Information Systems Security Professional (CISSP), Information Systems Security Architecture Professional and (ISSAP) and a Information Systems Security Management Professional (ISSMP). He is also a published author and writer, and a frequent speaker on electronic business and security topics at domestic and international industry conferences.
Whether you're adding on a privacy or security module or competing for resources with new privacy and information protection education and awareness initiatives, this session is for you. Learn why the two belong together and the cooperative steps you can take to assure optimum results for both missions. Session includes sample awareness communications incorporating both privacy and information protection.
Speaker - Gerry Phelan, Director of Training, Pro-Tec Data
Gerry Phelan is the Director of Training for Pro-Tec Data. In that role he is responsible for the marketing, delivery and facilitation of Pro-Tec Data?s information protection training offerings. Gerry previously was the Director of Training and Development for TD Ameritrade and was responsible for all aspects of their training programs including information protection. Gerry also had a successful twenty year career with International Paper Company. During that time he filled a variety of management roles including General Manager, Vice President of Group Operations, Accounting Manager, Credit Manager and IT Manager. He has planned and led numerous large scale projects in diverse areas like green-fielding, mergers, systems conversions, facility moves, systems, sales and new building construction. His 30 years of management experience in a wide range of industries and disciplines lends depth and reality to his facilitation and public speaking.
Speaker - Naomi Fine, President and Founder, Pro-Tec Data
Naomi Fine, Esq. is a nationally recognized authority on information and intellectual property protection. Her depth of knowledge comes from working with hundreds of world-class companies to assess needs, develop tailored strategies, identify sensitive information, establish policies and procedures, and provide training and tools which secure competitive advantage. Ms. Fine has been cited by Fortune, Business Week, Time Magazine, USA Today, The New York Times Cybertimes the LA Times and the Industry Standard as a leading expert in her field. Ms. Fine's work for MCI, Apple Computer and Tandem Computers has been described as exemplary in industry trade journals, including The Personnel Journal, The Sales & Marketing Management Magazine, and Security Management Magazine. Ms. Fine is an authoritative and enthusiastic speaker for many industry associations, as well as being a published author of numerous articles related to information and intellectual property protection. Prior to founding Pro-Tec Data, Ms. Fine was a business attorney counseling high technology companies on protection, licensing and other transactions related to intellectual property.
As physical and information security converges—particularly in transportation, utilities and national security systems—infosec professionals must learn more about Supervisory Control and Data Acquisition (SCADA) and process control systems. This session will include a background in how control systems work, threats particular to control systems and a case study in Progress Energy's approach to cyber security standards for the electric power industry.
Speaker - Ed Goff, CISSP, System Architect - IT&T Security, Progress Energy
Ed Goff, CISSP, started his IT career in the U.S. Air Force in 1995 where he was responsible for managing vital Command and Control systems including UNCLASSIFIED-to-SECRET interfaces. Ed is currently a IT Security System Architect at Progress Energy based in Raleigh, NC. Ed has been working with Supervisory Control and Data Acquisition (SCADA) and Process Control Systems (PCS) for over 5 years. In that time, Ed has collaborated with experts in the SCADA and PCS field from the electric power (including nuclear), water management, chemical and manufacturing industries, plus several U.S. national laboratories. Ed is currently serving as the Vice-Chair of the Cyber Security Compliance Advisory Group of the South Eastern Electric Reliability Corporation (SERC). Ed was requested to participate in panel discussions in a recent SERC Compliance Seminar. He is the IT Security Functional Lead for Progress Energy?s North American Electric Reliability Corporation (NERC) Compliance initiative. As part of the NERC Compliance initiative, he is leading project teams of engineers, operations and IT to develop and implement solutions that address numerous complex problems for SCADA and PCS (e.g. access control, monitoring, network security, and systems management).
You know the importance of tailoring awareness messages to each target audience, but what should you be teaching application developers about security that relates to their daily job? Learn from experienced application developers about the content and approaches that will work to impact this tough target audience.
Nishchal Bhalla, the Founder of Security Compass, is a specialist in product testing, code reviews, web application testing, host and network reviews. Prior to joining Security Compass, Nish was a Principal Consultant at Foundstone, where he performed numerous security reviews (Web Application / Code ) for major software companies, online banking and trading & e-commerce sites. He also helped develop and teach the
Rohit Sethi, Manager of Professional Services, Security Compass, is a specialist in threat modeling, application security reviews, and building security controls into the software development life cycle (SDLC). Mr. Sethi is a frequent guest speaker and instructor at several national conferences. He has written articles for Security Focus and the Web Application Security Consortium (WASC), and has been quoted as an expert in application security for ITWorldCanada and Computer World. At Security Compass, Rohit teaches hundreds of students various topics on web application security in cities across North America. He has also managed and performed extensive threat analysis, source code reviews, and penetration testing for clients in financial services, utilities, telecommunications and healthcare. He is often consulted for his dual expertise in information security and software engineering.
Windows Vista has already been deployed by numerous governments and corporate customers. Even if you're not quite ready to deploy the new Windows operating system, it will come to your organization. Focusing on the Microsoft security guidance for Vista and Windows Server 2003, we will examine the tools, specific settings and new security roles that you can use to help deploy baseline and customized security.
Speaker - Mike Danseglio, Group Program Manager, Microsoft
Mike Danseglio is a Group Program Manager in the Security Solutions group at Microsoft Corporation. He has worked in the areas of security and technology for the last decade. He holds several technical certifications including MCSE and CISSP. His work includes developing and teaching extensive security training on topics including cryptography, security technology, and attacks and countermeasures. His recent projects include publishing security guides for Windows XP, Server 2003, and Vista. He also works on security feature development for Microsoft Windows. Mike has published several books and numerous papers on computer security.
You know what your firewall, NAC system and IPS are supposed to do, but do you know how well they're doing it? Learn how to verify that your network security devices are working appropriately and doing so under load. Learn methodologies for testing these various types of devices, where these devices commonly fail and how to design dynamic and comprehensive test cases to identify these failures.
Speaker - Dustin D. Trammell, Security Researcher, BreakingPoint Systems, Inc.
Founder of the Computer Academic Underground, co-founder of the Austin Hackers Association (AHA!), and currently employed in Security Research by BreakingPoint Systems, Inc., Dustin has over a decade of experience in various areas of information security including vulnerability assessment, penetration testing, secure network architecture, vulnerability research and development, and security research in specific areas related to network protocols, network applications, steganography, and VoIP. Over the years Dustin has been involved with many security community projects such as design and development of Sender Policy Framework (SPF) for e-mail (RFC 4408) and contributing to the Metasploit Framework project. Dustin has also released numerous security tools such as the infamous PageIt! mass-paging application, the hcraft HTTP exploit-crafting framework, and the SteganRTP VoIP steganography tool. He regularly releases vulnerability and exploit advisories, speaks at security related events and conferences, and is involved with many aspects of the Voice over IP Security Alliance (VoIPSA).
Virtualization can help organizations progress to flexible and lower-cost enterprise computing. But with these benefits come some serious complications for enterprise systems management, security and compliance efforts. This session will discuss the security issues introduced by virtualization deployment and will highlight technical approaches to securing these environments.
As a Founder and the Chief Technology Officer for Configuresoft, Dennis Moreau is specialist in the application of leading edge technologies to the solution of complex problems in the systems management domain. His primary focus is in developing tools and methodologies to improve IT efficiency and effectiveness in systems management, security compliance and configuration optimization. He works actively with the National Institute of Standards and Technology (NIST) and Mitre on the development of security checklists standards and vulnerability assessment technology. Prior to joining Configuresoft, Dennis was the Chief Technology Officer for Baylor College of Medicine (BCM). He holds a doctorate in Computer Science and speaks regularly at IT management and security conferences.
Here's the trick: learn first about management's needs, then take best advantage. Talk "policy," "compliance" and "risk reduction" rather than "training and awareness." Learn how to tie awareness initiatives to key business needs, using three case studies that will illustrate varied goals and approaches. Leave with strategies for interacting more effectively and confidently with management.
Speaker - Thomas Peltier, President, Thomas R. Peltier Associates, LLC
Tom Peltier has been an information security professional for over thirty years. During this time he has shared his experiences with follow professionals and because of his work has been given the 1993 Computer Security Institute?s (CSI) Lifetime Achievement Award. In 1999 the Information Systems Security Association (ISSA) bestowed its Individual Contribution to the Profession Award and in 2001 he was inducted into the ISSA Hall of Fame. Tom was also awarded the CSI Lifetime Emeritus Membership Award. Over the past decade, Tom has averaged 4 articles published a year on various computer and information security issues, including developing policies and procedures, disaster recovery planning, copyright compliance, virus management and security controls. He has had six books published on policy development and risk assessment. He co-authored four other information security books. He continues to speak and teach information security courses throughout the world.
Get a technical overview of the various malicious bot families and how they work?including source code, disassembly analysis and methods they use to attack new systems. Attendees will leave with a thorough understanding of common bot internals and the ability to both spot them and stop them. Programming and TCP/IP knowledge are helpful, but not required.
Speaker - Dr. Jose Nazario, Senior Security Engineer, Arbor Networks
Dr. Jose Nazario is a Senior Security Engineer within Arbor Networks' Arbor Security Engineering & Response Team (ASERT). In this capacity, he is responsible for analyzing burgeoning Internet security threats, reverse engineering malicious code, software development, developing security mechanisms that are then distributed to Arbor's Peakflow platforms via the Active Threat Feed (ATF) threat detection service.
Dr. Nazario's research interests include large-scale Internet trends such as reachability and topology measurement, Internet-scale events such as DDoS attacks, botnets and worms, source code analysis tools, and data mining. He is the author of the books "Defense and Detection Strategies against Internet Worms" and "Secure Architectures with OpenBSD." He earned a Ph.D. in biochemistry from Case Western Reserve University in 2002. Prior to joining Arbor Networks, he was an independent security consultant. Dr. Nazario regularly speaks at conferences worldwide, with past presentations at CanSecWest, PacSec, Blackhat, and NANOG. He also maintains WormBlog.com, a site devoted to studying worm detection and defense research.
Whether data thieves plunder a Web server or a laptop, whether they use phishing messages or Podslurping, the spoils they seek are often your databases, rich with identity and financial data about your employees, customers and business partners. Learn how to secure your data repositories, using encryption, device and port control tools. Also learn to monitor when and how sensitive data leaves your network and how to fuse security onto the data itself.
Speaker - Josh Shaul, Director of Technology Strategy, Application Security, Inc.
As the Director of Technology Strategy with Application Security, Inc., Josh Shaul helps customers in the development of strategic database asset protection, with the implementation and integration of DbProtect?, the company?s industry-leading database security suite. Josh is the foremost security policy and standards guru at the firm, with added expertise in trusted computing and application-level security issues. He?s recently authored Practical Oracle Security: Your Unauthorized Guide to Relational Database Security to resoundingly positive critical reviews. Wetting his feet in the IT security industry, Josh started with SafeNet, Inc. working on the industry's first complete IPsec accelerator chip. In over five years with SafeNet, he was responsible for the design, development and overall enhancement of SafeNet's embedded security solutions, covering a wide range of applications. For the last four years his focus has been primarily in field engineering, where he?s leveraged his technical and consulting skills to help customers deploy security software and hardware into various SoCs, platforms and devices. Mr. Shaul holds a BS in Computer Systems Engineering from the University of Massachusetts. Josh has shared his expertise, by presenting at various industry conferences and events, including: ? Federal Information Assurance Technology Forum ? Federal Web Seminar on ?Securing Your Data from Insider Threat ? GFirst ? IOUG COLLABORATE ? Midwest Oracle Users Group (MOUG) ? OWASP, Boston Chapter ? Toronto Oracle Users Group (TOUG) ? Twin City Security Conference
The largest Federal agencies are deploying new vulnerability, configuration and remediation management tools that support interoperability standards. Any organization (not just government agencies) can better measure their security and regulatory compliance by using tools, guidelines and standards provided the Security Content Automation Protocol for enabling automation of measurement and compliance evaluation, the Office of Management and Budget's FDCC mandate for securing desktops/laptops running Windows operating systems, NIST standards and more.
Speaker - Robert Martin, Principal Engineer, MITRE Corporation
Robert A. Martin is a Principal Engineer at MITRE, a company that works in partnership with the government to address issues of critical national importance. For the past 17 years, Robert's efforts have been focused on the interplay of risk management, cyber security, quality assessment and the use of software-based technologies. The majority of this time has been spent working on the CVE, OVAL, CAPEC, and CWE family of security standards initiatives in addition to basic quality measurement and management for software-based systems. Robert is a frequent speaker on the various security and quality issues surrounding information technology systems and has published numerous papers on these topics. Robert joined MITRE in 1981 with a bachelor's and master's in Electrical Engineering from Rensselaer Polytechnic Institute, later he earned an MBA from Babson College. He is a member of the ACM, AFCEA, IEEE, and the IEEE Computer Society.
Wireless networks are about convenience—security tends to be an afterthought. And it's not just WiFi: these security issues extend to Bluetooth, RFID and other wireless technologies. Here you'll find the basic tools and attacks that anyone with a laptop and a wireless card can use to take you down.
Speaker - Richard Rushing, Chief Security Officer, AirDefense
Richard is a recognized IT security expert with almost 20 years experience working with computers and networks as a system analyst, network administrator, engineer, consultant and architect. Richard has participated in several corporate security councils setting standards and policies for entire organizations. Richard was most recently Chief Technical Officer of VeriSign's Network Security Services division where he identified and developed products and services to maintain VeriSign's focus on leading-edge security solutions. He was VeriSign's key player in the delivery of complex security consulting and architecture solutions to numerous Fortune 500 companies. In 1997 Richard teamed up with Jay Chaudhry and Jay Johnson to form SecureIT, a leading provider of security services to the IT industry that was acquired by VeriSign in 1998. Prior to SecureIT, Richard worked as a security consultant for the Technology Management Services group at GE Capital.
You need to tell upper management why security is important, but you're rarely given 30 minutes to do so. Learn how to sell security and answer management's top questions in 30 seconds apiece; no slides necessary.
Rebecca is an information privacy, security and regulatory compliance consultant, author and instructor with her own business, Rebecca Herold, LLC, and over 17 years of experience. Rebecca is authoring her 11th book, and is the editor and primary author for the ?Protecting Information? quarterly subscription security and privacy awareness multi-media publication. Rebecca has authored chapters for dozens of books and over one hundred published articles. In 2007 Rebecca was named a ?Best Privacy Adviser? by Computerworld magazine and one of the "Top 59 Influencers in IT Security" by IT Security magazine. Rebecca is an Adjunct Professor for the Norwich University Master of Science in Information Assurance (MSIA) program. Rebecca is a frequent speaker and has been quoted in dozens of publications. Rebecca can be reached at http://www.privacyguidance.com, her blog at http://www.realtime-itcompliance.com, and rebeccaherold@rebeccaherold.com.
News flash! Virtualization is here to stay. All indicators from big business, analyst firms and the vendor community point towards virtualization continuing to enjoy explosive growth as a core IT strategy that will transform the datacenter. However, recent studies have shown that organizations frequently get enamored in the hot technology of the day and they begin deploying before the complexities and implications on security & compliance are well understood. When considering the case of PCI DSS and the introduction of virtualization, there are significant challenges in meeting the prescribed technical controls and in some situations, existing security solutions such as IDS and IPS could be made ineffective. As adoption continues, companies must go through a very thorough analysis of how to properly and securely implement virtualization, and develop a plan that will ensure virtualization has a positive, rather than a negative impact. This session will examine both the positive and negative ways that virtualization can impact data security and compliance.
With more than 18 years of experience in systems engineering and security, Chris has assisted many Fortune 1000 companies in securing their infrastructures. His background spans several industries, including the military/defense, healthcare, manufacturing, investment banking and software development. Prior to joining Fortisphere, Chris worked with Configuresoft where he was the founder and director of Configuresoft?s Center for Policy & Compliance, a research & advisory group created to address the issues of managing security within strict metrics. Prior to Configuresoft, Chris held positions as product manager and systems engineer for several well known technology vendors such as NetIQ, Intrusion.com and BindView Corporation. An active industry resource on the topics of compliance, security management and remediation strategies, Chris co-founded the PCI Security Vendor Alliance and was the driving force behind the CIS benchmark on virtual machine security. Chris has publicly spoken at numerous conferences including Blackhat, SANS, Gartner IT-Expo, InfoSec, ISSA and ISACA. He is a SANS local mentor and SANS Stay Sharp instructor in Colorado Springs, CO, and holds certifications from (ISC)2, ISACA, SANS, Microsoft and Novell.
While no two organizations are the same, they all have similar challenges with security. In this session, the speaker will share those commonalities and provide solutions that you can use. Here, you will see free security tools and resources in action. You will hear stories of security challenges from a seasoned professional. You will experience that we share difficulties and there are solutions.
Those irksome questions that come up after the session is over and you've moved on to the next subject?those are the ones that keep you awake, tossing miserably in your hotel bed all night. But not tonight, because you've got a second chance to ask those puzzlers this afternoon. So: when you have one of those questions during the day on Monday, write it down and hand it over to your nearest CSI staffer. We'll pull together a panel of speakers who're prepared to take on any (security related) question. We're fearless when it comes to unanswered questions. And we want you to get your forty winks.
Many security tools, documents and programs are available for free (or very little cost). This session will show how they can be used for vulnerability assessments, penetration testing, intrusion detection, incident response and security management. Bring your PC so you can try them for yourself. This updated presentation is great for cash-strapped organizations promoting security activities.
Speaker - Ronald Woerner, Security Compliance Manager, TD Ameritrade ThinkTech
Ron Woerner has over 17 years of experience in the security industry. He has been quoted in CSO, SC, and Information Security magazines and has been a noted speaker at security conferences throughout the U.S. including the RSA, CSI, and NebraskaCERT Security Conferences. He has been employed as an Air Force Intelligence Officer, the Information Security Officer for the Nebraska Department of Roads, a UNIX administrator for the Mutual of Omaha Companies, and the Lead Security Engineer for CSG Systems and ConAgra Foods. He is now the Security Compliance Manager for TD Ameritrade. Ron earned a Bachelors degree from Michigan State University and a Masters degree from Syracuse University in Information Systems. He was awarded the CISSP security certification in August of 2001, the NSA IAM certification in August of 2003, the Certified Ethical Hacker (CEH) designation in December 2005 and is a Certified Forensics Investigator.
Technical forensics can only recover so much data about a security incident—more can be gathered through effective interviews of those with valuable information. Learn about social engineering, neuro-linguistic programming and interviewing techniques that will help you get the most information and most accurate information out of interviewees—and know when the information you're given is false. This hour-long session is followed by an hour-long lab. In the lab session attendees will participate in role-playing exercises to test their interviewing skills and see how much information they can coax out of both cooperative and uncooperative interviewees.
Speaker - Brad Smith, Director, Computer Institute of the Rockies
Brad Smith (RN, ASCIE, BS-Psy MCNPS, CISSP, NSA-IAM) started his computer training in 1971 and is still going strong. Living in the North West, Brad is currently working as a private practice informatics nurse helping rural and frontier medical facilities comply HIPAA. His company, the Computer Institute of the Rockies was selected as the 2005 Microsoft Small Business Solution Partner of the Year for its innovative and cost effective business solutions. He is a frequent speaker at the national medical and security conferences, where he makes complex ideas simple to grasp. Brad is known for his high-energy style of presenting and the real-world experiences he shares during these sessions. He values an active session where everyone is encouraged to share their ideas.
Learn to write a security policy that provides living guidance for your program. Focusing on specific case studies, we will explore the lifecycle and methodology of successful security policy development, implementation, maintenance and continued enforcement. This hour-long session is followed by an hour-long lab. During the lab, the instructors will help attendees create a policy development checklist appropriate for their own situations, listing who they need to include in which parts of the process; what questions they need to answer or have answered; and when to set deadlines or benchmarks.
Speaker - Michael Metzler, Master Security Architect, SAVVIS Federal Systems
Michael Metzler has 25 years of experience in Computer Science, Computer Networking and Security. He has delivered consulting service internationally that includes expertise and experience in security policy, security planning, network design and troubleshooting. Mr. Metzler has designed global networks for Fortune 500 customers and provided network security services for many major corporations, as well as for the United States and foreign government agencies. As a consultant, he has specialized in security policy, global network designs, enterprise networking strategies, and network security for customers that include major airlines, automobile manufacturers, aerospace and aircraft manufacturers, power utilities, pharmaceutical companies, petroleum companies, regional and global telecommunications providers, computer hardware, software manufacturers and government customers including network design and security work on Capitol Hill and at the White House, as well as with the Department of Defense. He has been a Certified Information Systems Security Professional (CISSP) since 1998, is a Certified Information Security Manager (CISM), and a member of FBI InfraGard. As a speaker, he has presented computer networking and security seminars worldwide at customer locations and public conferences including Computer Security Institute (CSI), NetWorld+InterOP, Internet World and Electronic Commerce Expo, International Computer Security Association (ICSA), and previous Digital Equipment Computer User Society (DECUS) events. His current projects include Information Assurance of aircraft data networks; providing system engineering, specifications, and security architecture for Internet and broadband networking aboard commercial airlines and U.S. Government aircraft; as well as counseling commercial enterprises in developing security programs to reduce risk related to Personally Identifiable Information and to meet Payment Card Industry Data Security Standards (PCI/DSS).
Speaker - Paul Harker, Master Security Architect, SAVVIS, Inc.
Mr. Paul Harker is a respected professional with distinguished 12-year career analyzing, designing, implementing and managing Information Systems Security infrastructures for large global businesses and government institutions across multi-platform environments. He has developed consulting methodologies that focus on compliance with security industry standards such as the former Visa CISP, MasterCard SDP, ISO17799 and the current Payment Card Industry (PCI) Data Security Standards. He has an MBA from the University of Washington, and is a Certified Information Systems Security Professional (CISSP), a Certified Information Security Manager (CISM) , as well as a Project Management Professional (PMP)
Individuals, corporations and even government agencies are establishing a presence in virtual worlds like SecondLife where they can buy and sell products with a global currency, buy virtual real estate, create and distribute their own virtual objects and applications, conduct meetings and events and more. Social networks like LinkedIn and Facebook are increasingly being used to foster personal and professional relationships. With these new capabilities come new security concerns. This hour-long session is followed by an hour-long lab. During the lab session attendees who bring their own laptops will be helped to reconfigure their settings on social networking sites and virtual worlds in the most secure fashion.
Speaker - Sara Peters, Editor, Computer Security Institute
Editor Sara Peters joined the Computer Security Institute (CSI) in 2005, taking on a security beat that includes both policy issues (like Web vulnerability disclosure legislation and the Payment Card Industry Data Security Standard) and technological issues (like Windows Vista security and third-party patching). Prior to her work in information security, she served as associate director of communications at Princeton University's School of Engineering and Applied Science, writing and editing their quarterly magazine. She began her reporting career in a small newspaper chain after graduating from Rutgers University with a B.A. degree in journalism.
A new wave of enterprise applications is being developed according to a Service- Oriented Architecture (SOA) using Web services. This session discusses how the Security Assertion Markup Language (SAML) can be used for authenticating Web services. The discussion is followed by a one hour practical session in which the attendees will get a chance to experiment with SAML assertions and how they are used in authenticating Web services. Attendees who bring their own laptops can load and use the demonstration software on their computer.
Jahan Moreh is the chief security architect at Sigaba. In this role, Jahan works with Sigaba's internal development staff and external customers to implement practical security strategies in Sigaba's product line. Moreh is co-holder of US patents 6158007, 6584564, and 69593636, all related to information security. He has testified before the Social Security Administration commission on the issues regarding privacy protection of citizens in face of information availability on the Internet. Moreh is a frequent speaker at major conferences and has published numerous papers and articles. In addition, Jahan Moreh is a senior member of teaching staff at the Department of Engineering and Information Science at UCLA, where he teaches classes in Distributed Systems Security.
Security-related policy isn't just Sarbanes–Oxley and PCI. This session will give you a rundown that includes: data breach disclosure laws, bills that are being reviewed by Congress and by state legislatures, precedent-setting court cases and actions by the Federal Trade Commission and other agencies. (And yes, PCI and SOX.)
M. Peter Adler is an attorney and the President of InfoCounsel, LLC. Two years ago Peter served as the Interim Chief Information Security Officer at the University of Colorado in Boulder. Last year he fulfilled similar duties for Montgomery College in Rockville, MD. In his security and privacy practice, he assists organizations with governance and legal issues pertaining to information security and privacy compliance. This practice follows a unified approach in providing simultaneous security and privacy compliance with multiple regulatory regimes. The laws, regulations and private standards he works with include the Gramm-Leach-Bliley Act (GLBA), the Health Insurance Portability and Accountability Act (HIPAA), the EU Data Protection Directive (including the US ?Safe Harbor? and other derogations), FDA security regulations (21 C.F.R. Part 11), the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA), the Federal Education Records Protection Act (FERPA), the Federal Information Systems Management Act (FISMA) and the numerous state laws regarding notice of security breaches the Payment Card Industry (PCI) Data Security Standard, and ISO, NIST and FIPS security standards. He also provides legal support during e-discovery and forensics in preparation for litigation.
Your IT, legal, HR and accounting departments all have different standards and regulations to comply with, with different auditing processes and different reports to generate. Get acquainted with the tools and techniques that will allow you to efficiently monitor, maintain and prove compliance with multiple regulations with comprehensive, centralized processes.
Speaker - Kimber Spradlin, Director Product Marketing, Embarcadero Technologies
Kimber recently joined Embarcadero Technologies, bringing more than 10 years experience in the Information Security industry. She started her career at Ernst & Young specializing in IT compliance; helping Fortune 500 organizations meet both regulatory and internal information security requirements. This included developing risk assessment, compliance, policy management, and product evaluation programs. She then spent 5 years at NetIQ, responsible for driving the strategy and marketing around the company?s policy-based security products and sharing her regulatory compliance expertise with customers in all types of industries. She also regularly works with industry analysts from such firms as Gartner, META (now Gartner), and Forrester on these topics. Kimber has a bachelor?s degree in Accounting from Baylor University, an MBA from Michigan State, and has received the Certified Public Accounting, the Certified Information Systems Auditor, and the Certified Information Systems Security Professional designations.
The man who coined the term "Wi-phishing" will explain why your company may still be at risk, in spite of advances in encryption and increased WLAN security. You will also learn how your company can define wireless connectivity policies and enforce compliance on all laptops and mobile devices.
Nicholas Miller is an innovative career entrepreneur who has founded a number of successful private and publicly traded companies in the software, wireless, and Internet sectors. His wide ranging experience as a high technology executive includes over 25 years of direct P & L responsibility, along with extensive experience in sales, marketing and technology start-ups. Miller was one of the first to identify the security threats posed by wireless technology and coined the phrase
Are appropriate controls in place to adequately secure Web-based applications and data? Learn how to effectively manage application security through the Secure Development Lifecycle (SDLC), how to integrate the OWASP Top 10 to mitigate Web application security vulnerabilities and how to use best practices for security testing.
Speaker - Tara Kissoon, Director, Information Security Services, Global Information Security Office, Visa Inc.
Tara Kissoon is a Director within Visa?s Information Security Services where her focus is on security assessments, security management and providing security expertise. She represents Visa on several International Working Groups. Tara has over 15 years experience in various aspects of Information Technology. Tara?s diverse experience includes security reviews of complex network architectures, facilitating multi disciplined risk assessments, conducting various workshops and forums, and leading Information system audits specializing in system development, web architectures, application and database reviews and SOX compliance. Tara taught at Seneca College, where she was responsible for the development, delivery, and evaluation of information technology curriculum. She was appointed to represent her college on several advisory committees and developed the first security course at Seneca College. Tara is a Certified Information System Security Professional (CISSP) and a Certified Information Systems Auditor (CISA) and has achieved various industry certifications.
Many Web users are resigned to the fact that their identities are perpetually at risk, because authentication mechanisms are either too weak or too difficult to manage. Yet, some efforts—OpenID and Windows CardSpace—aim to create an identity metasystem that is strong, flexible, trivial to use and can work across any site on the Net. Learn how these systems work and discuss what else needs to happen before truly secure online identity and access management can become a reality.
Speaker - Robert Richardson, Director, Computer Security Institute
Flash drives containing classified U.S. military data were sold on the cheap in an Afghan bazaar. Laptops were stolen right out of meeting rooms. Smartphones are left in taxis every day. Today's mobile workforce lives and breathes on mobile devices. Learn why and how to protect them and the data they contain.
Speaker - Emmitt Wells, Practice Director - NA Consulting, Getronics USA Inc.
Mr. Wells is a senior consultant with 19 years (15 years with Getronics) of professional experience in the IT industry and is currently responsible for a team of Infrastructure Engineers engaging in both pre-sales and post-sales opportunities including Network Architecture, Mobile Infrastructures, Unified Communications, and Video Conferencing. Most recently he was responsible for the US Security and Communications Portfolio Practice for North America and has managed large projects for both government and enterprise customers. He was also a key contributor to building the current global solution set for Getronics Network, Server, and Application Management Services. Throughout his career, he has focused on delivering IT services in a consistent, cost effective, and secure manner. This emphasis on security, wireless technologies, and IPT services brought him into the Getronics consulting organization to help distribute industry leading solutions amongst all Getronics services. Mr. Wells has both technical and business knowledge of the operations, delivery, and financial aspects necessary to run an effective ICT organization. He has managed up to 77 people in the ICTC organization, with a $5.1 million budget. Having been involved in the business line delivery most of his career; he brings a unique perspective on what is expected from a supporting organization. This part of the business does not drive the business through technology, but analyzes the business requirements and is a business enabler through technology. His experience in delivering outsourced services to external customers was very integral in beginning Getronics? EWWS/SWWE business initiative. Ultimately with the goal of reducing centralized expense allocations to the individual business lines to help facilitate lower pricing and increased revenue.
One country demands you destroy a piece of data, while another demands you retain it. One requires you monitor certain traffic while one forbids it. When your customers, your contractors, your office and your servers are all in different nations, how do you balance the laws of them all? There are no easy answers; learn here what the questions are and get a clue of how to begin answering them.
Speaker - Milton Luoma, Assistant Professor, Metropolitan State University
Milton H. Luoma, Jr. holds the degrees of Juris Doctor, M.S. in Computer Science, M.B.A., and M.S. in Engineering. He has also completed advanced work in the Ph.D. program in business at the University of Cincinnati. He has practiced law and worked as a business consultant in Minnesota for over 20 years. He has designed and developed the Computer Forensics and Computer Security programs at Fond du Lac Tribal & Community College in Minnesota. He is currently an Assistant Professor teaching Computer Science and Computer Foreniscs at Metropolitan State University in St. Paul, Minnesota. , Previous Speaking Engagements: Midwest Association for Legal Studies in Business Conferences; American Academy for Legal Studies in Business; Keynote Speaker at Northeast Service Cooperative Conference; Fairview Hospital Public Lecture Series; Brenau University Online College Conference; Minnesota State University IT & Wireless Technology Conference Licensed Attorney at Law, State of Minnesota; Graduate Certificate in Computer Forensics, Oregon State University; NTI Computer Forensics Certification
Speaker - Vicki Luoma, Assistant Professor, Minnesota State University
Vicki Luoma holds a Juris Doctor degree and is a candidate for a Ph.D. in Business. She has practiced law and worked as a business consultant in Minnesota for over 25 years. Further, she is a former Vice President of a small business university. She is currently an Assistant Professor in the College of Business at Minnesota State University.
Breach disclosure laws sometimes mandate that an incident be reported, but in other cases the decision is made at the discretion of the breached organization's leaders. In this session, breach case studies and the companies' decisions to disclose or keep the event secret will be reviewed and discussed. Attendees will discuss, in an open forum, the sticky choices organizations should make when business motivations and social responsibility collide.
Speaker - Pat Logan, Associate Professor, Marshall University
Dr. Logan is an associate professor in the College of Information Technology and Engineering at Marshall University. She has taught information security, computer forensics, multimedia, and cybercrime. She has been an invited speaker at both national and international conferences on security topics. In addition to her academic experience, Dr. Logan has over sixteen years of corporate experience including Assistant Vice President of Information Services at Sanwa Bank, Monterey Park, California. Her research interests include information security, computer forensics, Fourth Amendment issues that apply to the search and seizure of computer media, and the application of computer technology to courtroom presentations.
By simulating real attacks coming from the Internet, fuzzers can be used to test the effectiveness and security of your perimeter defenses as well as other security solutions. We will discuss the potential value of fuzzing test results and debate how realistic and usable these results are in environments where detecting all imaginable attacks would be impossible.
Ari Takanen, founder and CTO of Codenomicon, has since 1998 been focusing his work on information security issues in next-generation networks and security critical environments. The work of Codenomicon and the University of Oulu aims at ensuring that new technologies are accepted by the general public by providing means of measuring and ensuring quality in networked software. Ari Takanen is one of the people behind the PROTOS research that studied information security and reliability errors in e.g. WAP, SNMP, LDAP, VoIP implementations. His company, Codenomicon Ltd. provides automated tools with a systematic approach to test a multitude of interfaces on mission critical software, including but not limited to VoIP platforms, Internet routing infrastructure and 3G devices. Ari has been speaking at numerous security and testing conferences, and also at leading universities and international corporations. Especially the presentations at commercial companies have shown that that what we do at Codenomicon really matters and makes a change to the information society in general. He has co-authored a book on Voice over IP security (published by Addison-Wesley).
So many Powerpoint slides, so little interest. Looking for a livelier image for your face-to-face awareness presentations? This engaging session will help you brand your program as fun—so fun, you may need a waiting list. Find ideas, props, themes, plans and techniques you can easily adapt for your organization.
Speaker - Todd Fitzgerald, Systems Security Officer, National Government Services
Todd Fitzgerald, CISSP, CISA, CISM serves as a Medicare Systems Security Officer for National Government Services, LLC (NGS), Milwaukee, WI which is the nation?s largest processor of Medicare claims, and subsidiary of WellPoint, Inc. (NYSE:WLP) the nation?s largest health insurer. Todd was named as a finalist for the 2005 Midwest Information Security Executive (ISE) of the Year Award, nominee for the national award, Judge for the 2006/08 central region awards, and has moderated several Executive Alliance Information Security Executive Roundtables. Todd is the co-author of the ISC2 book entitled CISO Leadership: Essential Principles for Success (January, 2008) and has authored articles on Information Security for The 2007 Official ISC2 Guide to the CISSP Exam, The Information Security Handbook Series, The HIPAA Program Reference Book, Managing an Information Security and Privacy Awareness and Training Program, and several other security-related publications. Todd is also a member of the Editorial Board for ISC2 Journal/Information Systems Security Magazine and is frequently called upon to present at national and local conferences. Todd serves on the Board of Directors for the HIPAA Collaborative of Wisconsin, and is an active leader, participant and presenter in multiple industry associations such as Information Systems Security Association (ISSA), Blue Cross Blue Shield Information Security Advisory Group, CMS/Gartner Security Best Practices Group, Workgroup for Electronic Data Interchange (WEDI), Information Systems Audit and Control Association (ISACA), and others. Todd has 28 years of Information Technology experience, including 20 years of management. Prior to joining NGS, Todd held various broad-based senior Information Technology management positions for Fortune 500 organizations such as American Airlines, IMS Health, Zeneca (subsidiary of AstraZeneca Pharmaceuticals), Syngenta, as well as prior positions with Blue Cross Blue Shield of Wisconsin.
NAC can protect your network from insecure endpoints and enforce security policies. Yet deploying NAC can be a huge challenge. Does it make sense for your organization to take the plunge? This session will teach you how to answer that question, by showing how open standards enable technology that helps ensure endpoint compliance with integrity policies at and after network connection.
Speaker - Lisa Lorenzin, Principal Solutions Architect - Security Solutions, Juniper Networks
Lisa Lorenzin is a Principal Solutions Architect with Juniper Networks, specializing in security solutions, and a contributing member of Trusted Network Connect (TNC), a work group of the Trusted Computing Group (TCG) that defines an open architecture and standards for endpoint integrity and network access control. She has worked in a variety of Internet-related roles for the past 13 years, with more than a decade of that focused on network and information security. Lorenzin's experience in data center, government and enterprise environments, as well as her active participation and service in local user groups, has brought her a thorough understanding of the challenges network administrators and users face in today's world of expanding regulations and increasing security threats.
No one wants to experience the down-time, reduced productivity or corrupted software and data associated with computer viruses. But do you know what tools hackers use to attack networks and how to counter those attacks? We will tackle a variety of hacker scenarios, illustrating how hackers operate, what common tools and techniques they use and how to protect against them.
Mr. Conorich is the Global Solutions Manager for IBM Global Services? Managed Security Services. In this capacity, he has responsibility for developing new security offerings, insuring that the current offerings are standardized globally, and all training of new members of the MSS team worldwide in how to do "Ethical Hacking" and service delivery. Mr. Conorich teaches people how to use the latest vulnerability testing tools to monitor Internet and Internet connections and develop vulnerably assessments suggesting security related improvements. Mr. Conorich is also actively engaged in the research of bugs and vulnerabilities in computer operating systems and Internet protocols and is involved in the development of customized alerts notifying clients of new potential risks to security. Mr. Conorich has over 30 years of experience with computer security holding a variety of management positions. He joined IBM in 1997. Prior to coming to IBM, he was a Principal Security Analyst with AXENT Technologies, Inc., a leading vendor of computer security applications and services. For over five years, he analyzed customer?s enterprise security requirements and helped them find practical business solutions. He was, also, AXENT's UNIX security products manager, where he designed and managed AXENT's UNIX security product offerings.
Reporting security incidents to law enforcement is rarely an organization's first choice, but sometimes the situation demands it. When mistakes can jeopardize an investigation, make it impossible to prosecute criminal suspects and damage your organization's reputation, it's imperative you be prepared; get ready here.
Speaker - Tom Prunier, Computer System Security Analyst Senior, Lockheed Martin
Tom Prunier is a Computer System Security Analyst for Lockheed Martin. Tom is currently contracted to the Federal Bureau of Investigations as a Cyber Crimes Investigation Instructor and a certified Intrusion incident handler. Tom previously was a Detective and a member of the Internet Crimes Against Children?s Task Force for the State of Kansas and has investigated a wide variety of computer related crimes at the Local, State, and Federal Level. Tom has responded to numerous incidents in an investigative and computer forensic capacity. Tom has a Master of Arts in Computer Information Management and is an Associate Professor at Southwestern College in the fields of Criminal Justice, Computer Science, and Security Management.
Visual analytics have been emerging in recent years to help transform cyber security data into relevant information so professionals can acquire greater insight on their security posture, respond faster and prove compliance. Among the benefits of visualization are the ability to deal with vast amounts of security data, quickly discover patterns and anomalies, and effectively communicate issues to experts and non-experts alike. Learn how visualization is transforming the security field, what visualization tools are available today, and basic principles for successfully implementing security data visualization.
Speaker - Anita D'Amico, Director, Secure Decisions div of AVI
Dr. Anita D?Amico is the Director of Secure Decisions, a division of Applied Visions, Inc. in Northport, NY. She is both a human factors psychologist and an information security specialist. Her research, publications, and teaching have been in the areas of: situational awareness, particularly improving decision-making through visualization; information security and information warfare; cognitive analysis; operational fatigue; and research methods. All Dr. D?Amico?s research projects stress the development of visualizations that can be rapidly transitioned into real operational environments for real-world evaluation and early adoption.
Recent changes to the Payment Card Industry's Data Security Standard have moved some merchants into different merchant levels with more rigorous requirements, and created new requirements for securing Web servers and services. Make certain you're ready to pass your next PCI audit.
Branden R. Williams could easily be described as one of the industry?s leading experts but that title does not encompass his robust talents. With four active professional certifications, a list of publications, more than a decade of experience, and an enviable knowledge of technology he has earned the respect of global, top named clients and industry insiders. Yet, Williams is much more than an IT expert, his astute understanding of business has enabled him to create innovative solutions that align with key organizational objectives. This rare combination of technology and business expertise has resulted in Williams becoming a sought after Information Technology and Strategy Leader by the world?s foremost corporate executives. Equally impressive is Williams high energy, results oriented business style. Williams is firmly committed to partnering with organizations to maximize profitability and opportunity. Williams has a steadfast belief that IT and IT security should support and contribute to an organization. Utilizing his keen business insights and ability to communicate with technical and non-technical audiences, he has been able to collaborate with corporations to analyze, develop and implement enterprise wide solutions that support key business drivers. Williams has worked with clients in the financial, retail, healthcare, manufacturing, utilities, transportation, service provision and industrial sectors. He currently manages a multi-million dollar consulting practice while leading a global team of 80 certified Qualified Security Assessors (QSAs). Williams holds an MBA in Supply Chain Management and Logistics from the University of Dallas where he is also a graduate level Adjunct Professor consistently ranked in the top 10% of professors. He is a Lifetime Member of Pi Sigma Epsilon, and Founding Member of The Michelangelo Group Security Alliance. Williams is also a sought after speaker and author.
An effective risk management process is critical to successful business operations; not just protecting data assets, but also protecting the ability of the enterprise to meet its missions and objectives. In this open forum we will examine and discuss how risk analysis may support management's due diligence needs, then discuss how management can furthermore meet its fiduciary duty to protect the organization's assets.
Speaker - Thomas Peltier, President, Thomas R. Peltier Associates, LLC
Tom Peltier has been an information security professional for over thirty years. During this time he has shared his experiences with follow professionals and because of his work has been given the 1993 Computer Security Institute?s (CSI) Lifetime Achievement Award. In 1999 the Information Systems Security Association (ISSA) bestowed its Individual Contribution to the Profession Award and in 2001 he was inducted into the ISSA Hall of Fame. Tom was also awarded the CSI Lifetime Emeritus Membership Award. Over the past decade, Tom has averaged 4 articles published a year on various computer and information security issues, including developing policies and procedures, disaster recovery planning, copyright compliance, virus management and security controls. He has had six books published on policy development and risk assessment. He co-authored four other information security books. He continues to speak and teach information security courses throughout the world.
It is widely believed that homeland security agencies infringe on innocent citizens' privacy in order to carry out the war on terror. In this session the instructor will present an argument for why this need not be the case. Advanced cryptographic techniques can enable complex data mining tasks, while preserving citizens' privacy by revealing the minimum information necessary. Attendees will then discuss the social and tecnhological battle between national security and Constitutional rights in an open forum.
Speaker - Andrew Lindell, Chief Cryptographer, Aladdin Knowledge Systems
Andrew Lindell is the Chief Cryptographer at Aladdin Knowledge Systems and an Assistant Professor at Bar-Ilan University in Israel. Andrew attained a Ph.D. at the Weizmann Institute of Science in 2002 and spent two years at the IBM T.J.Watson research lab as a Postdoctoral fellow in the cryptography research group. Andrew has carried out extensive research in cryptography, and has published more than 40 conference and journal publications, as well as a textbook on cryptography and another book detailing secure protocols. Andrew has presented at numerous international conferences, workshops and university seminars, and has served on program committees for top international conferences in cryptography. In addition to Andrew's notable academic experience, he joined Aladdin Knowledge Systems in 2004. In his position as Chief Cryptographer, he has worked on the cryptographic and security issues that arise in the design and construction of authentication schemes, smartcard applications, software protection schemes and more. Offering a unique combination of academic and industry experience, Andrew brings a fresh and insightful perspective on many of the crucial security issues that arise today.
Got a fresh idea that will change security? Looking for that idea? Head to the Security Soapbox Derby. You visionaries will have five minutes to convey your ideas and opinions to a small group of your fellow attendees. When the bullhorn blares that time is up, the groups rotate and you get a new audience. By the end of the day those on their soapboxes will have perfected their pitches and those attending will have cast their votes for their favorite big idea. The winner will be rewarded—and not just by being showered with laurels by their peers. If you are interested in participating, please contact Dina-Marie Frangella
"Enjoyed the mix of the highly technical hacking versus Policy & Awareness. Smaller size (compared to RSA) made it easier to speak with other people and make connections." Laura Nelson, Data Architect
UPS
"The sessions were very good, however, I most enjoyed the engaging conversation of my peers." Robert E. Lee, Jr., CEO
RK Goodworks, LLC
"It's the first conference I've seen with a track just for Security Training & Awareness." Tami Kilbourne, Sr. Technical Analyst
Philip Morris USA
