|
9:00 — 9:15 AM |
Welcome and Introductions
- Jeff Moss, Founder, Black Hat + DEF CON
- Steve Wylie, General Manager, Black Hat
|
| 9:15 — 9:45 AM |
How Can New and Existing CISOs Stand Out From the Crowd and Separate Themselves From Others as They Compete for Desired Roles?
For new and existing CISOs the job market has never been riper with opportunity. The CISO has become the critical hire for many organizations regardless of industry, company size, or location. Whether a company is hiring a CISO to secure their products, achieve compliance, build customer trust, or demonstrate executive leadership, the job opportunities are plentiful. How do you know if you are a match?
- What will prevent a company from taking a closer look at your background?
- Understanding your superpower, personal brand, and points of separation from the crowd when attempting to stand out to an organization?
- What should you consider and investigate when evaluating the many CISO and Head of Security opportunities?
- To what information are you entitled and what defines a good match versus a bad match?
- When considering an opportunity, understanding what's "in it for me" as a candidate and "what's in it" for the client?
We intend to explore these and other areas to help CISOs better comprehend the new world job market.
-
Michael Piacente
Michael has 15 years of executive search experience proceeded by 12 years in IT. Today Michael co-manages Hitch Partners, a national retained search firm focused exclusively on CISO and executive security leadership positions. The firm provides executive search and advisory services for companies ranging from early to late-stage startups to enterprises. For more information please visit to www.hitchpartners.com.
-
Lee Kushner
Lee J Kushner has been exclusively providing recruitment services to the Information Security industry and its profession for the past 25 years. As the founder of LJ Kushner & Associates, Lee and his team of experienced information security professionals have been called upon to successfully solve some of the industries most complex recruitment challenges. Throughout his career, he has provided recruitment services and consultative guidance to over five hundred (500) unique entities as these organizations attempt to protect and enable their businesses. He has supported information security initiatives in both the largest enterprises and some of the most innovative start-ups. Throughout the past two decades, Lee has been an invited speaker at major events on the topics of hiring and retention, organizational design, compensation, and professional development.
In 2019, his firm, LJ Kushner & Associates, was acquired by BGSF (NYSE: BGSF) where he is now the Executive Managing Director responsible for the Cyber Security business unit.
|
| 9:45 - 10:15 AM |
Live Breakout Sessions:
Threat Modeling the CI/CD Pipeline to Improve Software Supply Chain Security
The SolarWinds attack brought additional scrutiny software supply chain security, but concerns about organizations' software supply chains have been discussed for a number of years. Development organizations' shift to DevOps or DevSecOps has pushed teams to adopt new technologies in the build pipeline — often hosted by 3rd parties. This has resulted in build pipelines that expose a complicated and often uncharted attack surface. In addition, modern products also incorporate code from a variety of contributors — ranging from in-house developers, 3rd party development contractors, as well as an array open source contributors.
This talk looks at the challenge of developing secure build pipelines. This is done via the construction of a threat model for an example software build pipeline that walks through how the various systems and communications along the way can potentially be misused by malicious actors. Coverage of the major components of a build pipeline — source control, open source component management, software builds, automated testing, and packaging for distribution — is used to enumerate likely attack surface exposed via the build process and to highlight potential controls that can be put in place to harden the pipeline against attacks. After introducing the threat model, the presentation is intended to be an interactive discussion that will help attendees both evaluate internal build processes as well as ask vendors questions to better understand the maturity of their practices.
-
Dan Cornell
A globally recognized software security expert, Dan Cornell has over 20 years of experience architecting, developing and securing software systems. As Vice President of Product Strategy at Coalfire, Dan works with customers and industry partners to help drive the direction of their product portfolio. Prior to its acquisition by Coalfire, Dan was a founder of and the Chief Technology Officer at Denim Group, where he helped Fortune 500 companies and government organizations integrate security throughout the development process.
Cornell is an active member of the development community and a sought-after speaker on topics of application and software security, speaking at international conferences including RSA Security Conference, OWASP AppSec USA and EU, TEDx, and Black Hat Arsenal. He holds three patents in the area of software security.
Anatomy of a Breach with CyberArk Labs- Supply Chain & Privilege
Examining revelations from the SolarWinds and Codecov attacks, it's clear that the compromise of identity and manipulation of privileged access were instrumental in their success. In this session, CyberArk Labs deconstructs these breaches to shed light on supply chain risk and the lure of identity compromise by breaking down the key phases of the attack - from initial infection and customer targeting, through privilege escalation to high value assets.
-
Andy Thompson
CyberArk Labs Research Advisor, CyberArk
Andy is a CyberArk Labs Advisor and Research Evangelist. He and his team focus on offensive security and security innovation. They specialize in spotting security gaps in emerging technologies and developing innovative new security layers and effective mitigations to fill those gaps. Andy has 25 years of experience in web development, systems administration and security, and is a frequent speaker on security breaches, defense tactics and his passion of "travel-hacking".
Executive (dis)Orders: Cognitive and Systemic Risk in the Boardroom
Organizations have to address various forms and manifestations of risk: cyber risk, financial risk, supply chain risk and many others. Lately it seems that a large portion of innovation and disruptive thinking is coming from the bottom of the org chart and not so much from the top.
This session will dive into some strategic questions about risk that plague every business both large and small. Building secure systems and technology platforms that are resilient and profitable is not impossible, but increasingly difficult unless we strive to understand two oft-overlooked sources of trouble: cognitive risk and systemic risk.
-
Mike Wilkes
CISO
Mike Wilkes is a Chief Information Security Officer that has built, transformed and protected companies such as ASCAP, Marvel, AQR Capital, CME Group, Sony, Macy's as well as European banks and airlines. A graduate of Stanford University and author of a book for Cisco Press in 2002, he is a featured speaker at technology conferences and is a professor at NYU teaching cybersecurity courses. An avid jazz fan and musician, he is also on the board of trustees for the National Jazz Museum in Harlem.
|
| 10:15 - 10:30 AM |
CISO PANEL: Why Data Science Powered Behavioral Analytics is Critical to Modern Cyber Defenses
Staying ahead of cybercriminals and insider threats is more critical than ever. It's also important to automate as much of your security operations as possible. Data science driven controls enable you to focus on what's important – to connect the dots, weed out false positives, and get high efficacy results. Hear from peers with extensive experience implementing successful Machine Learning based cybersecurity controls. We'll discuss the nuances of what to look for when evaluating data science cyber defenses. We'll explore the business value of ML behavioral analytics and provide insights into how this technology has radically improved their organization's security posture.
-
Saryu Nayyar
CEO and Co-Founder, Gurucul
Saryu Nayyar is an internationally recognized cybersecurity expert, author, speaker and member of the Forbes Technology Council. She has more than 15 years of experience in the information security, identity and access management, IT risk and compliance, and security risk management sectors. She was named EY Entrepreneurial Winning Women in 2017. She has held leadership roles in security products and services strategy at Oracle, Simeio, Sun Microsystems, Vaau (acquired by Sun) and Disney. Saryu also spent several years in senior positions at the technology security and risk management practice of Ernst & Young. She is passionate about building disruptive technologies and has several patents pending for behavior analytics, anomaly detection and dynamic risk scoring inventions.
-
Kurt Lieber
CISO, Wells Fargo
Kurt Lieber is the Executive Vice President and CISO at Wells Fargo. He has over 20 years of experience in Information Technology and Information Security across multiple industries including health care, retail and financial services.
Kurt was formerly with CVS/Aetna where he was responsible for Risk Management, Identity & Access Management and Program Management Office within the CVS/Aetna Global Security team. Prior to CVS, Kurt was with Kaiser Permanente where he had responsibility for IAM as well as HIPAA remediation. Kurt also worked for Target Corporation, where he was accountable for the company's IT Security program and led the technology team responsible for their Payment Card Industry (PCI) program. Prior to Target, he had roles with Goldman Sachs and Accenture.
-
Jim Routh
Former CISO of MassMutual, CVS, DTTC, American Express and more!
Jim is currently an advisor for Gurucul and Agari, a board member for the University of Cailifornia Berkeley Center for Long Term Security. Jim Routh is the former Board Chair for the Health Information Sharing & Analysis Center (H-ISAC) where he served for five years and former Board member for the Financial Services Information Sharing & Analysis Center (FS-ISAC). He presented to Boards and Board Committees (Technology & Governance, Audit Committees) for many public and private companies as the CISO or CSO providing cyber security updates and education for board members for the past twenty years. Jim Routh is currently on the Board of ZeroNorth and Acceptto, two early stage cyber security software companies. He serves in an advisory capacity and investor for three cyber specific venture funds including: ClearSky, CyberStarts and Rain Capital.
Jim has along history in technology and cyber security as a leader and management consultant. Mr. Routh was formerly a cyber security leader for many large companies including MassMutual CISO, CVS Health/Aetna CSO, JP Morgan Chase- Global Leader for Software & Mobile Security, KPMG CISO, Depository Trust & Clearing Corporation (DTCC) CISO, and American Express CISO. At Aetna, he developed one of the most mature converged security programs in the private sector. Prior to that Mr. Routh served as an IT leader at American Express and a management consultant for over a decade for financial service firms.
Jim is recognized as an industry leader in digital transformations and innovation in cyber security practices using data science as a foundation for unconventional cyber security controls and enterprise resilience. He is a known icon in the cyber security industry, among the awards he has received is the Santa Fe Group/Shared Assessments Lifetime Achievement Award, CSO Hall of Fame, ISE Luminary Award, Evanta Break Away Leadership Award, Information Security Executive of the Year Award (twice), BITS Leadership Award.
|
| 10:30 — 11:00 AM |
Widespread & Worsening Cyber Events: A Cyber Insurer's Perspective
"Think earthquake modeling and building codes but for cyber security. Yes, this exists."
A leading cyber insurer's view of the state of cybersecurity, and cyber insurance, in 2021 and beyond. As ransomware continues to dominate the headlines, Matt will provide details on the state of the cyber insurance industry and various efforts underway to become an even more engrained part of the holistic solution. With the escalating market failures that exist in the cyber security and technology industries; cyber insurance also needs to change and the data that cyber insurers have is valuable. Matt will discuss how and why insurance data and establishing a common lexicon for ‘cyber catastrophes' in insurance contracts will inform society and continue to break down the walls between technology, cybersecurity, legal, insurance, & governments.
-
Matt Prevost
Matt Prevost, RPLU, joined Chubb in July 2014 as National Product Line Manager for Chubb's network security, privacy and technology Errors & Omissions (Cyber/Tech E&O) products. Since 2016, he has assumed overall responsibility for cyber product management in North America and in 2019, Matt also took on the role of Chair of Chubb's Global Cyber Product Board.
In his role, Matt is responsible for developing underwriting strategy, negotiating complex accounts, developing and maintaining a broad network of brokerage and vendor relationships, developing and driving distribution, and enhancing cyber services through all channels. Additionally, Matt plays a significant role in Chubb's Global Cyber Practice, which addresses growing risks as legislation and privacy and network security exposures evolve around the world and customer demands for cyber insurance and risk management solutions grow and change. Matt is also a member of Chubb Group's Emerging Risk Committee and an advisor for the Cyber COPE Insurance CertificationSM (CCIC) program provided by Chubb and Carnegie Mellon University.
Matt is a certified Continuing Education instructor and regularly speaks on the topics of cyber and privacy insurance, technology E&O, Directors & Officers (D&O) coverage, and cyber risk.. He is a graduate of Lafayette College with a degree in International Economics and Commerce, and also studied at Ecole Superieure de Commerce de Dijon in France.
|
| 11:00 — 11:30 AM |
Live Group Discussion
Be a part of the discussion. Join Advisory Board members Jeremiah Grossman, Wendy Nather, and Saša Zdjelar for a moderated discussion on the following topics:
- What is this year's snake oil?
- What key policy areas can the federal government best help in cyber security?
- Should ransomware payments be made illegal?
- What Zero Trust concepts have you been able to successfully implement? What was the motivation and how were you able to overcome any challenges in doing so?
Attendees should come ready to ask questions and actively participate.
|
| 11:30 — 11:45 AM |
Why Security Transparency Makes for Good Corporate Governance
Transparency in hiring, sustainability and privacy is in demand from consumers, investors, and regulators. Boards of directors are paying attention and changing their practices as a result. Is cybersecurity transparency next?
This session will cover the fast-developing realm of responsible disclosure practices, the rise in outside-in security testing, and the pressure for disclosure within supply chains. This mindset shift — from secrecy to transparency — is already happening. Topics include:
- Vulnerability disclosure policies - current and future
- Why over 40% of the Fortune 100 employ ethical hackers
- Supply chain disclosure for the U.S. government
- Communicating the benefits of security transparency to your Board
-
Marten Mickos
CEO, HackerOne
Marten Mickos is the CEO of HackerOne. Previously, Marten served as CEO at Eucalyptus, a cloud software company acquired by HP where he then served as the SVP of the cloud division. Before that, he was CEO of MySQL, an open-source database company acquired by Sun Microsystems for $1 billion in 2008. At Sun he served as SVP of the database division.
|
| 11:45 AM - 12:00 PM |
Break
|
| 12:00 — 12:30 PM |
Great Expectations (for Cyber Incident Response)
As the prevalence of cybersecurity incidents increases, more organizations have been obligated to keep Incident Response firms on retainer, or hire them at full price in the midst of an intrusion. Many of the most high-profile and lauded firms have reached their maximum capacity and have waitlists for new customers. As a result, many new incident response service providers have moved to fill the gap. Some firms provide exceptional service and boast top talent. Others are unfortunately not prepared to provide quality incident response services and are essentially ambulance-chasing. This presentation will discuss reasonable expectations which a customer should have of their incident response provider, as well as an overview of the proper incident response onboarding process and technical lifecycle. Attendees will learn to recognize key indicators of good quality and warning signs of poor quality incident response service.
-
Lesley Carhart
Lesley Carhart is a Principal Industrial Incident Responder at the industrial cybersecurity company Dragos, Inc. She has spent more than a decade of her 20+ year IT career specializing in information security, with a heavy focus on response to nation-state adversary attacks. She is recognized as a subject matter expert in the field of cybersecurity incident response and digital forensics.
Prior to joining Dragos, she was the incident response team lead at Motorola Solutions. Her focus at Dragos is developing forensics and incident response tools and processes for uncharted areas of industrial systems. She is also a certified instructor and curriculum developer for the Dragos "Assessing, Hunting and Monitoring Industrial Control System Networks" course.
She has received recognition such as DEF CON Hacker of the Year, a "Top Woman in Cybersecurity" from CyberScoop, and "Power Player" from SC Magazine.
In her free time, Lesley co-organizes resume and interview clinics at several cybersecurity conferences, blogs and tweets prolifically about infosec, has served for 20 years in the USAF Reserves, and is a youth martial arts instructor.
|
| 12:30 - 12:45 PM |
A Seat at the Table: CISO Priorities are Business Priorities
During the past tumultuous year, CISOs have juggled many issues, including those brought on by the pandemic and a massive increase in the scale and scope of hacking, ransomware, and cybercrime. This session will dive into these challenges and look at how they have transformed the role of the CISO into that of a business enabler. Ben will share his expert advice on how CISOs can capitalize on this opportunity and keep the seat they've gained at the table.
-
Sumedh Thakar
President and CEO
As CEO Sumedh leads the company's vision, strategic direction and implementation. He joined Qualys in 2003 in engineering and grew within the company, taking various leadership roles focused on helping Qualys deliver on its platform vision. Since 2014, he has served as Chief Product Officer at Qualys, where he oversaw all things product, including engineering, development, product management, cloud operations, DevOps, and customer support. A product fanatic and engineer at heart, he is a driving force behind expanding the platform from Vulnerability Management into broader areas of security and compliance, helping customers consolidate their security stack. This includes the rollout of the game-changing VMDR (Vulnerability Management, Detection and Response) that continually detects and prevents risk to their systems, Multi-Vector EDR, which focuses on protecting endpoints as well as Container Security, Compliance and Web Application Security solutions. Sumedh was also instrumental in the build-up of multiple Qualys sites resulting in a global 24x7 follow-the-sun product team.
-
Ben Carr
CISO
Ben Carr is the Chief Information Security Officer at Qualys. He is an information security and risk executive with more than 25 years of experience in developing and executing long-term security strategies. Ben has demonstrated global leadership and experience, through executive leadership roles of advanced technology, high risk, and rapid-growth initiatives, at companies such as Aristocrat, Tenable, Visa and Nokia. While at Aristocrat, Ben built a world-class global cybersecurity program from the ground up as part of a digital transformation. As a senior cybersecurity executive at Visa, Ben was responsible for developing and leading Visa's Global Attack Surface Management Team and capability. Prior to Visa, he led all security programs for Nokia corporate IT as the Global Head of IT Security. Ben holds a certificate in Risk & Information Systems Control (CRISC), is a Certified Data Privacy Solutions Engineer (CDPSE).
|
| 12:45 — 1:15 PM |
How to Put Breaches on Your Resume and Live to Tell the Tale
We live in a time when the probability of a breach is high. As security leaders, we build our security programs informed by that fact. We think about things like incident prevention, detection, and response across our data, systems, and networks. But we also should reserve time to think about what happens to our organizations, security teams, and our own careers ahead of the breach.
Bob Lord has had a front row seat at organizations that have experienced much publicized breaches. In this talk, he'll reflect on how companies and executives think about security, how that affects their actions, and how to build a more weatherproof career.
-
Bob Lord
Bob Lord was the first Chief Security Officer at the Democratic National Committee. In this role he worked to secure the Committee, as well as helping state parties and campaigns. Previous roles include being the CISO at Yahoo, CISO in Residence at Rapid 7, and before that he headed up Twitter's information security program as its first security hire. You can see some of his hobbies at www.ilord.com.
|
| 1:15 - 1:45 PM |
Live Breakout Sessions:
Defending the Build Pipeline
Software runs the world and that's never been truer than it is today. From healthcare and transportation to finance and entertainment, software enhances our experience with hardware and each other. The development and deployment of software creates a "bottle-neck" risk which can impact many aspects of our lives. We will have an open discussion on the strategic implications of poorly protected build processes and how companies should be strategizing to better protect their software deployment journey.
-
Kurt John
As Chief Cybersecurity Officer, Kurt John is responsible for overseeing strategy and operations of Siemens largest market, over $23B in revenue. Kurt also serves as a member of the Siemens Cybersecurity Board (CSB) to set strategy, drive operations and address global challenges.
Kurt is also a board member of the Virginia Innovation Partnership Authority, focusing on the continued economic and technological development of the Commonwealth of Virginia. He is also on the innovation advisory board of George Mason University and the Cybersecurity Advisory Council of MxD; among other initiatives and appointments.
Today's CISO – Leading a Resilient Enterprise
Cybersecurity in any organization is measured in by two instances in time – "before pandemic" or BP and "after pandemic" of AP. The BP CISO was largely viewed as the leader of a technical team, a cost center, and the department of "no". The AP CISO is viewed as critical to the success of business outcomes, a trusted advisor to C-suite colleagues and the board, and the leader of cross-functional team work.
Join the AT&T Cybersecurity team to learn how the role of the CISO is evolving in an AP world and how the decisions made by CISOs today matter for the future of your company. With a steady hand to guide a company, the modern CISO will lead the journey to resilience, adaptability, and new ways of conducting business in an era defined by edge computing.
-
Theresa Lanowitz
Director AT&T Cybersecurity Communications
Theresa Lanowitz is a proven global influencer and speaks on trends and emerging technology poised to help today's enterprise organizations flourish. Theresa is currently the head of evangelism at AT&T Business - Cybersecurity.
Prior to joining AT&T, Theresa was an industry analyst with boutique analyst firm voke and Gartner. While at Gartner, Theresa spearheaded the application quality ecosystem, championed application security technology, and created the successful Application Development conference.
As a product manager at Borland International Software, Theresa launched the iconic Java integrated development environment, JBuilder. While at Sun Microsystems, Theresa led strategic marketing for the Jini project – a precursor to IoT (Internet of Things).
Theresa's professional career began with McDonnell Douglas where she was a software developer on the C-17 military transport plane and held a US Department of Defense Top Secret security clearance.
Theresa holds a Bachelor of Science in Computer Science from the University of Pittsburgh, Pittsburgh, PA.
-
Bindu Sundaresan
Director AT&T Cybersecurity
Bindu provides strategic and tactical cybersecurity consulting services to customers and specializes in collaborating with clients on cybersecurity, technology transformation, cyber-risk, compliance, and data governance initiatives. She leads a team of security professionals responsible for providing consultative services specific to Trusted Advisor engagement, Incident Response, Forensics, Threat/Vulnerability Management services, & compliance assessments. Bindu leverages her extensive technical skills as she advises customers through workshops, speaking engagements, and industry forums. She counsels customers on how best to optimize their business benefits and drive organizational improvements by sustaining security protocols, managing compliance, and mitigating risk. In addition to providing subject matter expert support, she is responsible for defining services across Cybersecurity Consulting based on client-specific security challenges.
The Emerging Cyber Threat Landscape
The recent Rise of Ransomware can be traced to WannaCry and (Not)Petya that fused large scale compromise techniques with an encryption payload that demanded a ransom payment in exchange for the decryption key. This fusion inspired this new generation of human operated ransomware, vastly expanding the ransomware business model into an enterprise scale operation blending targeted attack techniques and the extortion business model, threatening disclosure of data and/or encryption in exchange for payment. Learn how this rise in ransomware is influencing cyber strategies that help strengthen your security posture.
-
Ann Johnson
Corporate Vice President, Security, Compliance & Identity Business Development, Microsoft
Ann Johnson is Corporate Vice President of SCI Business Development at Microsoft. She oversees the investment and strategic partner strategy roadmap for security, compliance, and identity for one of the largest tech companies on our planet to help organizations become operationally resilient on their digital transformation journey and unlock capabilities of Microsoft’s intelligent cloud and next generation AI. She is a member of the board of advisors for FS-ISAC (The Financial Services Information Sharing and Analysis Center), an advisory board member for EWF (Executive Women’s Forum on Information Security, Risk Management & Privacy), and an advisory board member for HYPR Corp. Ann recently joined the board of advisors for Cybersecurity Ventures. For more about Microsoft’s Cybersecurity Solutions, visit the Microsoft Security Site, or follow Microsoft Security on Twitter at Msft Security Twitter or Msft WDSecurity Twitter. You can also hear her talk with some of the biggest influencers in cybersecurity each week on Afternoon Cyber Tea with Ann Johnson.
|
| 1:45 - 2:15 PM |
Locknote
At the close of the CISO Summit, join Black Hat Advisory Board members Jeremiah Grossman, Allison Miller, Justine Bone, and Alex Stamos for an insightful conversation on the most pressing issues facing the InfoSec community. This Locknote will feature a candid discussion on the key takeaways from the CISO Summit and how these trends will impact future InfoSec strategies.
|
| 2:15 - 3:15 PM |
Closing Reception, sponsored by Cybereason
|
