Southern California’s leading conference for IT governance, control, security and assurance 1001010101101 0 0 00 01 11 1 1 0 0 1 1 0110 1 0 0 1 0 0 0 100 1 10 10 11 01 010010101001011 001 1 0 01 0 11 0 1 1 10 010 10 01001 1001011 0 1 10 01001 10 0 01 0110 00110101 1 0 101 01 1 11 01 10110 001101011 0 1 0 1 0 01 0 11 1 NAME NAME 1 1 0 10 00101010101010 1 1 00 01101 0 10 1 1 00 00101010101010 10 101 Hilton Los Angeles/Universal City California, USA On behalf of the Los Angeles Chapter of ISACA (ISACA-LA) we want to welcome you to our 2015 Spring Conference, "Protecting the Cyber Enterprise," a theme developed in support of ISACA International’s Nexus initiative (www.isaca.org/cyber). We have come a long way since our now International organization was first formed in Los Angeles in 1967, when a small group of auditing professionals whose jobs were to audit controls in computer systems, sat down to discuss the need for a centralized source of information and guidance in the field. We are proud of our diverse membership today, which includes a variety of professional IT-related positions—to name just a few, IS auditor, consultant, educator, IS security professional, regulator, chief information officer and internal auditor. Some of us are new to the field, others are at middle management levels and still others are in the most senior ranks. (They) We work in nearly all industry categories, including financial and banking, public accounting, government and the public sector, utilities and manufacturing. Our Spring Conference 2015 gives good reason for (these) our diverse group(s) to come together - to learn, to fulfill our IT governance responsibilities and to better deliver value to the business. We hope you will join us in what promises to be an energizing and worthwhile Spring Conference 2015! David Alexander President, ISACA Los Angeles Chapter Debbie A. Lew Chair, Spring Conference 2015 Conference Committee Debbie Lew - Chair Cheryl Santor - Vice Chair, Sponsors and Vendors Anna Carlin - Student Volunteers David Alexander - Sponsors & Vendors Dean Kingsley - Sponsors Jonathan Chan - Conference Webmaster Karen Norton - Sponsors & Vendors Kelly Lin - Finance Larry Hanson - Communications & Registration Linda Moore - Facilities Lisa Kinyon - Facilities & Registration Micah Manquen - Student Volunteers Mike O. Villegas - Sponsors & Vendor Prasad Kodukulla - Marketing and Social Media Thomas Phelps IV - Sponsors & Vendors, Program Lisa Pompan - Conference Support Ernst and Young, LLP Cal Poly Pomona Deloitte & Touche DirecTV Southern California Edison Bank of America K3DES LLC Laserfiche Metropolitan Water District of Southern California Los Angeles Department of Water and Power Deloitte & Touche KPMG LLP AIG KPMG LLP Amgen ISACA-LA The ISACA Los Angeles Conference 2015 PROTECTING THE CYBER ENTERPRISE More topics. More insight. More ways to learn. The ISACA Los Angeles Chapter’s conference provides a unique opportunity for for IT assurance, security, risk management and governance professionals to explore cybersecurity topics with knowledgeable experts, expand professional skills and enhance career potential. Leverage the benefits of a powerful learning experience with the value of the ISACA Los Angeles Chapter’s Conference: • Sharpen your skills with practical and relevant sessions that apply to your current or prospective roles and responsibilities • Tailor a learning experience that fits your style, budget and professional goals. • Prepare for the CRISC exam by attending the CRISC two-day boot camp. • Obtain your COBIT® 5 certificate after taking the COBIT® 5 Foundation course and the exam at the end of the second day. • Revisit with old friends, make new friends and network throughout the conference including the networking reception on Monday night, sponsored by Laserfiche. • If you're an IT Audit Director, be invited to our IT Audit Directors' Forum to network and discuss emerging IT audit issues and risks • Learn about technology solutions at the Vendor Exhibition Fair that can address the challenges you face in your current role. • Earn up to 20 CPE credits, to help you become or remain certified. • Attend the CSX Cyber security fundamentals workshop to prepare for the cybersecurity fundamentals exam. Learn from experienced Cybersecurity leaders The ISACA Los Angeles Chapter has brought together leading IT governance, risk, security and assurance leaders to share their experience and knowledge with you. They live the topics they teach, and draw from a deep understanding of the complex issues facing IT professionals today. This real world perspective means that attendees benefit from proven solutions and best practices. Location and dates Registration April 11 – April 15, 2015 Hilton Los Angeles/Universal City, California USA Register online at www.isacala.org/conference. 1 Day Payment can be made by credit card, check or wire transfer NOTE: Registration will not guarantee acceptance into a session until the payment is also received. PAYMENT must be postmarked by the early registration date (March 22, 2015) in order to qualify for the Early Registration discount. 2 Day Conference Fees Pre-conference Workshop ISACA/ISSA Members $200 (+$150 for COBIT Exam) Non Members $200 (+$150 for COBIT Exam) Full Time Students $100 (+$150 for COBIT Exam) CRISC Boot camp or COBIT5 Foundations or Cybersecurity Fundamentals Workshops $400 $500 $150 3 Day 1 Day 2 Day Full Conference (Mon. – Wed.) Conference Conference $220 $550 $300 $650 $100 $250 $650 ($750 after 3/22/15) $750 ($850 after 3/22/15) $250 ($300 after 3/22/15) CONFERENCE REGISTRATION DISCOUNT: A $50.00 discount per three-day registration is available to companies with three or more paid three-day registrants. To request a discount code, please e-mail [email protected]. @isacala #isacalasc15 3 Keynote Session - Monday, April 13th Theme: Protecting the Cyber Enterprise Keynote Speaker Michele Robinson, California State CISO California is home to more than 38 million people and considered one of the largest economies in the world. We are a very diverse population consisting of tech innovators in the Silicon Valley and across the state, aerospace projects at more than 3 NASA centers located in California, the entertainment industry capital, the leader in small business development, venture capitalists, and with over half of the fruit production in the US. Every one of those businesses and consumers need technology to be competitive while operating in a secure environment. Investments in the secure use of technology is paramount to sustained growth in our state. Join Michele as she discusses the cyber threat, enterprise risk management strategy and how the California Cybersecurity Task Force is chartered with advancing California’s cyber security posture. About Michele Robinson Michele Robinson was appointed Director of the California Office of Information Security (OIS) and State Chief Information Security Officer (CISO) by Gov. Jerry Brown in May 2013. Robinson joined OIS in 2007 and assumed the position of Acting Director in February 2013, where she served as the liaison to federal, State and local government on cyber security policies and issues. From 2010 to 2013, she served as Deputy CISO and was responsible for managing the day-to-day operations of OIS and the statewide information security program, including enterprise policy development, disaster recovery planning, incident management, and compliance. From 2007 to 2010, Robinson served as Assistant CISO managing the statewide enterprise incident management program and effecting several significant policies. Prior to joining OIS, Robinson served as the CISO and Privacy Officer for the California Unemployment Insurance Appeals Board (CUIAB) for nearly 5 years. Prior to her appointment with CUIAB she worked for the Department of Consumer Affairs (DCA) for 8 years, serving on policy development, new program implementation, business process reengineering and system design and integration committees, and representing DCA and its constituent board and bureau programs at task force meetings, board meetings and special meetings with control agencies and members of the Legislature. Robinson has 10 years of experience in the finance and credit industry where she has held manager, supervisor, and fraud investigator positions. She holds a Bachelor of Science in information systems from the University of San Francisco, and CISSP, CISM, CIPP/US, and CIPP/IT certifications. @isacala #isacalasc15 4 Keynote Panel California Cybersecurity Task Force Panel Discussion Keynote Panel Moderator Robert Stroud, ISACA International President As the first coordinated step toward securing California’s cyber infrastructure, California Governor Edmund “Jerry” Brown commissioned the California Cybersecurity Task Force, a cybersecurity advisory committee comprised of representatives from the public and private sectors, academia, and law enforcement. Michele Robinson, CISO of the State of CA, has said that because of the interconnectedness of government and private-sector IT assets, collaboration has become crucial. And the ultimate goal, she said is to collaborate and work together to improve cybersecurity for the state. The California Cybersecurity Task Force is working to improve the state’s ability to adapt and respond to emerging cyber threats. The coalition includes public, private and educational partners and is led by the Governor’s Office of Emergency Services and the Department of Technology. Hear how the task force has been developing a statewide cybersecurity strategy and is organized into the following 7 subcommittees (Legislation and funding, workforce and education development, economic and business development, information sharing, risk mitigation, emergency preparedness, and hightech and digital forensics). Keynote Panelists Michele Robinson, California State CISO Stan Stahl, Ph.D., William “Bill” Britton, Citadel Information Group Visiting Director of & ISSA LA President Cybersecurity Center at Cal Poly San Luis Obispo Oliver Rosenbloom, Assoc. Governmental Program Analyst General Session - Tuesday, April 14th “The National Conversation No One Wants to Have: A New Paradigm for Cyber Resiliency” Dr. Ron Ross National Institute of Standards and Technology (NIST) Information Technology Laboratory Computer Security Division The increasing complexity of the IT infrastructure supporting our public and private sector organizations is becoming the number one threat to the economic and national security interests of the United States. Developing effective cybersecurity and risk management strategies that promote trustworthy and resilient information systems and networks is the key to future mission and business success. @isacala #isacalasc15 5 Conference Schedule Pre-Conference Workshops APRIL 11 - SATURDAY 08:30 to 05:00 W1 CRISC™ Review Bootcamp (Day 1) – Shawna Flanders, Business Technology Guidance Assoc. W2 COBIT 5 Foundation Course (Day 1) – Barry Lewis, Cerebus W3 CSX Cybersecurity Fundamentals (Day 1) – Mike O. Villegas, K3DES LLC APRIL 12 - SUNDAY W1 CRISC Review Bootcamp (Day 2) – Shawna Flanders, Business Technology Guidance Assoc. 08:30 to 05:00 W2 COBIT 5 Foundation Course and Exam (Day 2) – Barry Lewis, Cerebus W3 CSX Cybersecurity Fundamentals (Day 2) – Mike O. Villegas, K3DES LLC Mobile Device Security and Mobile Application Dissection – Lee Neely, Lawrence Livermore Laboratory W4 (1 Day Workshop) Main Conference APRIL 13 - MONDAY Accelerating Your Fundamentals Security Emerging Issues, Tools & Techniques Designing and Managing Governance, Risk and Compliance REGISTRATION and BREAKFAST BREAK sponsored by Accuvant 07:00 To 08:00 08:00 To 9:45 Cybersecurity Nexus ● Opening Remarks Michele Robinson, CISO, State of California ● Keynote Panel: California Cybersecurity Task Force moderated by Rob Stroud (ISACA International President) Panelists: Michelle Robinson, Stan Stahl, Oliver Rosenbloom, Bill Britton NETWORKING BREAK sponsored by Deloitte C1 10:15 To 11:30 S1 How to conduct an IT Risk Assessment Shawna Flanders, BusinessTechnology Guidance Associates, LLC Cybersecurity Task Force Panel Discussion and Workshop Moderater: Dan Manson, Professor, Cal Poly Pomona Panelists: Michele Robinson, Stan Stahl, Oliver Rosenbloom, Bill Britton T1 G1 Bridging the Gap between Data Privacy and Security Ali Zaiee, Nasr Husami, Deloitte & Touche LLP Audit Strategy: Ongoing Cybersecurity Assessments Brad Ames, HP LUNCH NETWORKING BREAK sponsored by RSA CISO Luncheon sponsored by Allgress (by invitation only) C2 12:45 To 02:00 S2 IT Audit Fundamentals Workshop– Part 1 Tom Donohue, Deloitte Frank Mariduena, SCE Protecting the Critical Infrastructure of the United States in the Digital Age: The Role of Government, Industry, and the Audit Community Hon Theresa Grafenstein, US House of Representatives Dr. Ron Ross, NIST T2 G2 Social Media Risks John Hicks, Walt Disney Company Richard Lee, Ernst & Young LLP How the COBIT Framework can help the Auditor Audit the Cyber Enterprise Mark Stanley, Toyota Financial Services NETWORKING BREAK sponsored by Ernst & Young LLP @isacala #isacalasc15 6 Conference Schedule Accelerating Your Fundamentals 02:30 To 03:45 C2 Cybersecurity Nexus S3 T3 Dealing with a Cyber Future that is Already Here Rob Clyde, ISACA Rob Stroud, CA Technologies Continued Security Emerging Issues, Tools & Techniques Designing and Managing Governance, Risk and Compliance G3 Six Forces: Developing a Resilient Security Program James Christiansen, Accuvant IT Vendor Risk Management Christopher Garlington Jeremy Yates, Disney Global Information Security SESSION CHANGE C2 04:00 To 05:15 S4 Continued 05:15 To 07:00 T4 The Value of Splunk and Big Data at Southern California Edison (SCE) Douglas Rhoades, SCE G4 “Where are the bad guys hiding?” – A Forensic Approach to Incident Response Peter Morin, Bell Aliant Practical steps to managing IT Risk: Value Creation and Governance Brian Barnier, ValueBridge Advisors CONFERENCE NETWORKING RECEPTION sponsored by LaserFiche APRIL 14 - TUESDAY 07:30 To 08:30 08:30 To 09:45 BREAKFAST BREAK sponsored by KPMG General Session The National Conversation No One Wants to Have: A New Paradigm for Cyber Resiliency Dr. Ron Ross, NIST NETWORKING BREAK sponsored by Bit9 S5 C3 10:30 To 11:45 IT Audit Fundamentals Workshop– Part 2 Stephanie Peel, PwC Diana Tran, Allergan T5 G5 NIST Cyber Security Frame- Industrial Control Systems work; What is the Status of (ICS) Threats and Solutions Douglas Rhoades, SCE Your Assessment? Cheryl Santor, Metropolitan Water District of Southern California David Alexander, Los Angeles Department of Water and Power Common GRC Management Mistakes Brian Barnier, ValueBridge Advisors LUNCH NETWORKING BREAK sponsored by Laserfiche - EXHIBITION FAIR 01:15 To 04:30 IT Audit Directors Forum - by Invitation Only Moderated by Marios Damianides, Ernst & Young LLP & Brian Barnier, ValueBridge Advisors C3 01:15 To 02:30 Continued S6 Better Safe Than Sorry Patrick J. Hynes, Ernst & Young, LLP Cybersecurity T6 G6 Contract and Records Management Jason Messer, Kelsey Frost, Laserfiche Douglas Van Gelder, Los Angeles Community Development Commission GRC Process Optimization through Effective Use of Technology Kevin Berman, Joe DeVita, PricewaterhouseCoopers LLP NETWORKING BREAK sponsored by PwC - EXHIBITION FAIR @isacala #isacalasc15 7 Conference Schedule Accelerating Your Fundamentals S7 C3 03:15 To 04:30 Cybersecurity Nexus Security Emerging Issues, Tools & Techniques T7 G7 High Tech Cyber Crime Case Web Application Security & SDLC Studies Peter Morin, Bell Aliant Donn Hoffman, Benyomin Forer, High Tech Crime Division, Los Angeles County District Attorney’s Office Continued Designing and Managing Governance, Risk and Compliance Devising Internal Controls for Enterprise SaaS Chong Ee, Twilio APRIL 15 - WEDNESDAY 07:30 To 08:30 08:30 To 09:30 BREAKFAST BREAK sponsored by Newegg Business C4 S8 Financial Auditing Support of Mainframe John Mee, KPMG T8 Cyber Threats: Industry Trends and Actionable Advice Michael Sprunger, EMC Consulting G8 Secure by Design, Privacy baked in and Defending Data Objects Rakesh Radhakrishnan, Princess Cruises COBIT In Action: Practical IT Audit Lessons Nelson Gibbs, Union Bank SESSION CHANGE C5 9:45 To 10:45 S9 Information Security 101 Janice Wong, Union Bank Is Your Organization Prepared to Manage a Cyber-attack? Ren Powers, City National Bank T9 G9 Architecture for Secure Cloud Computing Arshad Noor, StrongAuth, Inc. Governance, Compliance and Ethics of Potential Access Gaps in Complex Systems Eric Read, United Healthcare NETWORKING BREAK Sponsored by Palo Alto Networks 11:15 To 12:15 C6 S10 Auditing New Systems Development Projects DeeDee Owens, KPMG The Compliance of Cybersecurity Larry Stewart, PennyMac LLC T10 G10 Next Generation Firewalls (NGFW) Mike O Villegas, K3DES LLC Leveraging Pen Testing to Augment the Audit Lee Neely, Lawrence Livermoore Laboratory CONFERENCE CONCLUDES Technical Education Sessions / Lunch for Pre-Registered Attendees E1 12:30 To 01:30 Assuming Network Compromise : How changing your security perspective leads to proactive threat detection and prevention Nathan Swain, ANRC E2 Technical Education Session 2 Developing the most current content. Please check the website for the latest description! www.isacala.org/conference @isacala #isacalasc15 8 Pre-Conference Workshops Introducing the COBIT 5 Foundation Course and Exam (Two-day Course) Facilitator: Barry Lewis, Cerebus COBIT 5 is the only business framework for the governance and management of enterprise IT. Learn the importance of an effective framework to enable business value. Delve into the elements of ISACA’s evolutionary framework to understand how COBIT 5 covers the business end-to-end and helps you effectively govern and manage enterprise IT. Developed for anyone interested in obtaining foundation-level knowledge of COBIT, the course explains the COBIT framework and supporting materials in a logical and example-driven approach. This is a course that is typically offered at $1500 or higher, the chapter is pleased to offer it to our membership at a substantial discount. Introducing the CRISC™ Certification Review Course (Two-day Course) Facilitator: Shawna Flanders, Business/Technology Guidance Associates This boot camp will address the key areas of the CRISC certification and explain the importance of having an organization-wide risk management program backed up by risk management professionals holding individual certification. The presentation will outline each key topic area of the CRISC curriculum and explain how to improve each person's skills in effective and proactive risk management. Introducing the Cybersecurity Fundamentals (CSX) workshop (Two-day Course) Facilitator: Mike O. Villegas, K3DES LLC Why become a cybersecurity professional? The protection of information is a critical function for all enterprises. Cybersecurity is a growing and rapidly changing field, and it is crucial that the central concepts that frame and define this increasingly pervasive field are understood by professionals who are involved and concerned with the security implications of Information Technologies (IT). The CSX Fundamentals workshop is designed for this purpose, as well as to provide insight into the importance of cybersecurity, and the integral role of cybersecurity professionals. This workshop will also prepare learners for the CSX Fundamentals Exam. @isacala #isacalasc15 9 Pre-Conference Workshops Mobile Device Security and Mobile Application Dissection Facilitator: Lee Neely - Lawrence Livermore Laboratory (One-day Course) Mobile devices are prevalent in the workspace and personal lives of all of us. With those devices comes a new set of security risks and challenges. This workshop will involve a series of lectures and hands-on exercises to help you understand mobile devices and their impact in the workplace, how they are secured, and how you can obtain a better understanding of their inner workings and the risks you are accepting. Syllabus: ● Mobile device ecosystem in the workplace, from uses and policies to mobile device management solutions. ● Mobile device security models, described and compared. ● Mobile application overview ● Mobile application testing, hands-on. ● Reverse engineering mobile applications ● Mobile application changing, hands-on. ● So what’s it all mean? Points to ponder, actions to take. You will need a laptop that you have administrative rights to as well as being able to run a virtual machine for the class exercises. Track #1 Accelerating Your Fundamentals Track #2 Cybersecurity Nexus Designed for the operational/financial auditor or anyone new to the information technology auditing, security and governance who want to learn the fundamentals to enable or change a new career or refresh knowledge. This track provides the participants with the concepts, methodologies and techniques to help improve upon their knowledge, expertise and skills. Selected session proposals will provide participants with valueadded tools such as audit programs, checklists, white papers and other reference material In this track, cutting-edge IT and cybersecurity issues will be discussed along with recommendations and solutions. Topics include issues and risks related to social media, mobile technology risks (BYOD) IAM, cybersecurity governance, cloud computing strategies, threats to privacy as well as internal controls and Sessions are designed to include the latest cybersecurity topics to enhance the skills of audit, cybersecurity, and IT professionals. Track #3 Emerging Security Issues, Tools and Techniques Track #4 Managing Governance, Risk and Compliance Through demonstration and discussions of real world issues, applications of solutions, this track will help assurance, security and risk professionals understand emerging security risks to the business and operational environments, and relevant security techniques and tools. Sessions include topics that will enable participants to take away security ideas and techniques to enhance their professional development and work. This track explores the concepts and terminology of emerging issues related to IT governance, frameworks and risk management. Included in this track is the ISACA research and tools designed and developed to aid the IT professional in recognizing today’s emerging issues and mitigating impact on the enterprise. Sessions also include governance topics that supports the enterprise’s IT ability to sustain and extend the organization’s strategies and objectives. @isacala #isacalasc15 10 2015 Spring Conference Sessions Accelerating Your Fundamentals C1 Speaker: How to Conduct an IT Risk Assessment Shawna Flanders Founder and CEO, Business Technology Guidance Associates, LLC This session will give the attendee an overview into conducting technology based risk assessments that provide benefit to the enterprise. This course is designed to provide insight for anyone participating in their company's risk assessment process. After completing this session, the participants will be able to: ● Describe the Risk Governance and the Risk Management Program ● Identify changes to the organization’s risk universe ● Develop Risk Scenario's ● Conduct Risk Identification, Analysis and Evaluations ● Track and Report on Risk ● Monitor the Risk Management Program C2 Speakers: IT Audit Fundamentals Workshop - Part 1 Tom Donohue Director, Deloitte Frank Mariduena IT Governance Manager, Southern California Edison In this session, participants will learn about IT auditor roles and relationships as well as the overall IT audit process from initial risk assessments through the development and use of control frameworks. This class is targeted toward IT auditors who are new to the profession, financial auditors learning IT audit, integrated auditors or IT personnel who are transitioning into greater involvement in IT audit. We will discuss the methodologies and frameworks that support IT audit such as CobiT®, general computing controls, application level controls, and how the Sarbanes-Oxley Act of 2002 affects the IT auditing profession. Participants will have the opportunity to apply acquired knowledge by the end of the day. After completing this session, the participants will be able to understand: ● The principles and practices of IT auditing ● The standards, guidance and procedures that ISACA recommends ● IT auditors role, the audit process and drivers, regulatory requirements (e.g., SOX, PCI, privacy), and the role of frameworks/methodologies (e.g., COBIT® 5/ITIL/ISO17799) ● IT risk assessment, developing the IA plan and conducting the audit ● Strategy & planning, business continuity, relationships with outsourced providers ● Applying COBIT® 5 in audits ● Information security ● Computer operations and change management (e.g., SDLC, change control) ● Application controls and the IT auditor’s role in business process audits @isacala #isacalasc15 11 11 2015 Spring Conference Sessions Accelerating Your Fundamentals C3 Speakers: IT Audit Fundamentals Workshop - Part 2 Stephanie Peel Managing Director, PwC Diana Tran IT Audit Director, Allergan In this session, participants will learn about IT auditor roles and relationships as well as the overall IT audit process from initial risk assessments through the development and use of control frameworks. This class is targeted toward IT auditors who are new to the profession, financial auditors learning IT audit, integrated auditors or IT personnel who are transitioning into greater involvement in IT audit. We will discuss the methodologies and frameworks that support IT audit such as CobiT®, general computing controls, application level controls, and how the Sarbanes-Oxley Act of 2002 affects the IT auditing profession. Participants will have the opportunity to apply acquired knowledge by the end of the day. After completing this session, partcipant will be able to identify: ● The principles and practices of IT auditing ● The standards, guidance and procedures that ISACA recommends ● IT auditors role, the audit process and drivers, regulatory requirements (e.g., SOX, PCI, privacy), and the role of frameworks/methodologies (e.g., CobiT®/ITIL/ISO17799) ● IT risk assessment, developing the IA plan and conducting the audit ● Strategy & planning, business continuity, relationships with outsourced providers ● Applying CobiT in audits ● Information security ● Computer operations and change management (e.g., SDLC, change control) ● Application controls and the IT auditor’s role in business process audits C4 Speaker: Financial Auditing Support of Mainframe John Mee Senior Associate, KPMG This session will provide the auditor with a broad understanding of the principles of the mainframe security architecture and key components that maintain confidentiality, integrity and availability of the system. System facilities and resources for the audit will be reviewed to help the auditor understand how to best use them. After completing this session, participants will be able to: ● Understand the basic mainframe architecture ● Understand mainframe terminology languae ● Understand how the mainframe is different from more familiar computing platform ● Understand the key elements of a mainframe and how to audit it with RACF as an example @isacala #isacalasc15 12 2015 Spring Conference Sessions Accelerating Your Fundamentals C5 Speaker: Information Security 101 Janice Wong AVP Information Security, Union Bank New to Information Security OR thinking about getting into Information Security? Grab a seat in Information Security 101 and build your foundation to understand how Information Security is structurally organized and understand the basic functions within this department. With all the media attention surrounding cyber-threats and securing customer data, you'll soon jump right into conversations with your new knowledge of Information Security Jargon. Don't stop there; discover the right certification for you to evaluate your career goals in Information Security. After completing this session, partipants will be able to: ● Better understand the Information Security Organization - via a general overview and the security roles ● Articulate the basic functions of Information Security ● Recognize Information Security Jargon/Key Terms in conversations ● Discover available certifications in Information Security to support career goals C6 Speaker: Auditing New System Development Projects Dee Dee Owens Managing Director, KPMG Implementing a new system or going through a system conversion is one of the highest risks that organizations can face. In order to address this risk and provide the most value to their organization, IT auditors must be involved throughout a system's life cycle and not just in post-implementation assessments. Join Dee Dee Owens as she addresses the value-added role of the IT Auditor in project development, including performing on-going audit planning and reporting on an iterative basis.. After completing this session, the participants will be able to: ● Assess key controls to review during each phase of project SDLC ● Identify potential findings for each phase of the SDLC ● Understand the roles of the IT Auditor in project development @isacala #isacalasc15 13 2015 Spring Conference Sessions Cybersecurity Nexus S1 Cybersecurity Task Force Panel Discussion Moderator: Dan Manson, Professor, Computer Information Systems, California State Polytechnic University, Pomona Panelists: Michele Robinson, California State CISO Stan Stahl, Ph.D., Citadel Information Group & ISSA LA President Oliver Rosenbloom Assoc. Governmental Program Analyst Bill Britton, Visiting Director of Cybersecurity Center at Cal Poly San Luis Obispo As the first coordinated step toward securing California’s cyber infrastructure, California Governor Edmund “Jerry” Brown commissioned the California Cybersecurity Task Force, a cybersecurity advisory committee comprised of representatives from the public and private sectors, academia, and law enforcement. Learn more about the California Cybersecurity Task Force, a cybersecurity advisory committee comprised of representatives from the public and private sectors, academia, and law enforcement. The California Cybersecurity Task Force is working to improve the state’s ability to adapt and respond to emerging cyber threats. The coalition includes public, private and educational partners and is led by the Governor’s Office of Emergency Services and the Department of Technology. The Task Force has been developing a statewide cybersecurity strategy. This session will be moderated by Dr Dan Manson, CalPoly Pomona. After completing this session, the participants will be able to understand cybersecurity strategy related to: ● Legislation and funding ● Workforce and education development ● Economic and business development ● Information sharing ● Risk mitigation ● Emergency preparedness ● High-tech and digital forensics S2 Speakers: Protecting the Critical Infrastructure of the United States in the Digital Age: The Role of Government, Industry, and the Audit Community Honorable Theresa Grafenstine Inspector General, US House of Representative Dr. Ron Ross Fellow, NIST The US Department of Homeland Security describes the nation's critical infrastructure as “the essential services that underpin American society.” Because of the importance in our everyday lives, critical infrastructure must be secure and able to withstand and rapidly recover from all hazards -including cyber threats. In a world where cyber-attacks are becoming more frequent and common place, protecting our critical infrastructure is a responsibility that cannot be limited to just the government. Adequate protection requires cooperation among the government, industry, and audit community. Join this interactive session with Dr. Ron Ross, Senior Fellow at NIST, and The Hon Theresa Grafenstine, Inspector General of the US House of Representatives. After completing this session, the participants will be able to: ● Understand the current risk landscape ● Understand how each of thse communities pay a vital role in protecting our nation's critical infrastructure @isacala #isacalasc15 14 2015 Spring Conference Sessions Cybersecurity Nexus S3 Speakers: Dealing with a Cyber Future that is Already Here Rob Clyde International VP and Board Member, ISACA Rob Stroud International President, ISACA The velocity of technological change in cyber space is unlike any time before. While we are yet figuring out security for recent technologies like social media, mobile, Big Data and the cloud, newer technologies such as the internet of things are already staring us in the face! The future seems to have already happened. Moreover, data breaches and cyber attacks from dedicated adversaries are accelerating. Are we agile enough to take on today's cyber security challenge and make a difference? How can I start or enhance a career in cyber security? Hear practical advice from two long-time security professionals and how ISACA's CSX can help. After completing this session, participants will be able to: ● Understand how recent and emerging technologies are affecting cyber security ● See how the pace and targeted nature of cyber attacks are creating challenges for traditional security approaches ● Learn how ISACA's CSX can help you and others to meet those challenges and enhance your career S4 Speaker: The Value of Splunk and Big Data at Southern California Edison (SCE) Douglas Rhoades Chief Engineer Cybersecurity, Southern California Edison Southern California Edison (SCE) is in the middle of a multi-year deployment of a Unified Monitoring and Data Analytics project that heavily leverages Splunk in order to increase Operational Intelligence. Splunk is used to continually aggregate data from networking equipment, firewalls, intrusion protection systems, the Windows Active Directory and most endpoints. The Splunk system then classifies, indexes and stores this data, currently up to 3TB daily, to provide a basis for SCE's Security Information and Event Management (SIEM) capability. This data is tapped for system performance monitoring, forensic investigations, and detection of Indicators of Compromise (IOCs), which are available as pre-staged reports or in interactive discovery sessions. SCE has barely scratched the surface of analytics' capability but has already found value in categorization of web traffic, trending of access and authentication events and detection of some types of anomalous behavior. SCE plans to expand the event correlation capability as data from additional sources is added in the future, but Splunk and its associated data warehouse have already become the "go-to" source for cybersecurity data. After completing this session, participants will be able to: ● Understand what Splunk is and how a typical large deployment is organized ● Know the data types that are in use at SCE and why they are relevant to so many ● Become familiar with the types of data analyses that are supported by the above data ● Be able to envision future analytic efforts that will be supported by additional data elements @isacala #isacalasc15 15 2015 Spring Conference Sessions Cybersecurity Nexus S5 Speakers: NIST Cyber Security Framework: What is the Status of Your Assessment? Cheryl Santor Director, Information Security, Metropolitan Water District of Southern California David Alexander Information Security Manager, Los Angeles Department of Water and Power Critical Infrastructure was asked to conduct a Cyber Security Assessment using the NIST Framework created by DHS/NIST as mandated by the Presidential Order of February 2013. This February Critical Infrastructure was to report on status of the effort to assess the Cyber Security of Critical Infrastructure entities. How did your organization perform the assessment? Both Speakers will outline the efforts conducted by their organizations and tell about findings and what was done about remediation. In reporting to DHS/NIST, what was discovered about the process, the findings and the status of the organizations in remediation efforts? How to move forward from the initial report? After completing this session, participants will be able to: ● Walk through the assessment process to provide examples of what was done at both organizations to conduct the assessment ● Gain an understanding of lessons learned from conducting the assessment ● Learn the resources needed to comply wiht the assessment findings ● Understand what remediation efforts can be conducted prior to obtaining funding S6 Speaker: Better Safe than Sorry Patrick J. Hynes Executive Director, Ernst & Young, LLP Cybersecurity Most companies face cyber incidents every day. Some fall under the radar, while few are only detected when it’s too late. Ask the few Fortune 500 companies that have announced that they have been breached. But what should companies do in this situation? Prepare for the worst, hope for the best? Companies need to learn how to better adopt or enhance their proactive incident response approach to ensure the right controls are in place. After completing this session, the participants will: ● Review several case studies from various global enterprises which, using this approach, could have detected massive breaches at an earlier stage, reduced the damage caused, and lowered the cost of recovery ● Learn about the common characteristics of the latest cyber attack patterns, be exposed to an alternative to the traditional approach, and identify how they can prepare their organization or clients for a rainy day @isacala #isacalasc15 16 2015 Spring Conference Sessions Cybersecurity Nexus S7 Speaker: High Tech Cyber Crime Case Studies Donn Hoffman & Benyomin Forer Deputy District Attorneys, High Technology Crime Division, Los Angeles County District Attorney's Office Prosecutors from the Los Angeles County DA’s office High Technology Crime Division will discuss the role of law enforcement in incident response and data breach situations. They will demonstrate emerging issues pertaining to technological crimes as well as bring awareness to the community on potential cyber threats. After completing this session, participants will be able to: ● Understand emerging issues pertaining to technological crimes ● Gain awareness as part of the community on potential cyber threats ● Know when and how to report an incident to law enforcement ● Learn about recent cybercrime cases prosecuted in Los Angeles S8 Speaker: Cyber Threats: Industry Trends and Actionable Advice Michael Sprunger Advisory Consultant, Practice Lead, EMC Consulting Cyber-attacks are becoming both more sophisticated and more common, with all types of systems, information, and devices being targeted. Recently there have been a number of high profile breaches that resulted in significant business impact for the targeted organization. If you can’t prevent, you must detect; if you can’t detect you can’t correct. Speaker's learning points ● examine common trends and strategies used in these attacks ● learn best practice advice for mitigating the risk @isacala #isacalasc15 17 2015 Spring Conference Sessions Cybersecurity Nexus S9 Speaker: Is Your Organization Prepared to Manage a Cyber-attack? Ren Powers Vice President & Manager, City National Bank While technically there are a variety of possible cyber-attacks and recovery options, this session will focus on the operational response and the associated risks of not being prepared to manage this type of incident. Using a playbook approach we will identify the activities associated with planning prior to an incident, the actions that are taken during the incident, and finally those tasks that must be done after the incident is over. This approach will enable us to define roles and responsibilities of the incident response team and to insert the business continuity aspects that will enhance the company's response to the incident. And throughout, the key operational activity: internal and external communications. Participants will be provided with a test scenario that can be used to either develop or evaluate an incident response plan. After completing this session, participants will be able to: ● Define the major cyber-attack categories ● Develop a cyber-attack response plan if you don't have one in place ● Evaluate your plan and maybe identify gaps to be remediated ● Review your organization's communications plan to determine if cyber-attacks are covered ● Define roles and responsibilities for a cyber-attack incident response team ● Understand how business continuity planning ties into the response to a cyber-attack incident, and what aspects of a business continuity program can be used to better focus the response S10 Speaker: The Compliance of Cybersecurity Larry Stewart VP of IT Compliance / Information Security, PennyMac LLC Compliance regulations and frameworks such as the Payment Card Industry (PCI), Data Security Standard (PCI/DSS), FFEIC and ISO 27000 offer the illusion of reasonable security but hardly provide effective protection against resolute attacks and lack the flexibility of adjusting to a company's true security needs.This session will provide the audience with the additional tools required to evaluate the options and develop an effective information security program that goes beyond the checklist approach. Continuous monitoring programs, the development of security metrics and the blend of frameworks such as ISO 27000 with the regulatory requirements are just some of the tools available to bridge the gap between compliance and risk reduction. After completing this session, partipants will be able to: ● Better understand cybersecurity regulations and the reasonable standard. ● Realize the benefits of going beyond the "checklist approach" and ensuring coverage of key controls and basics ● Benefit from insights gained regarding the incorporation of Continuous Control Monitoring into the Cybersecurity defense program @isacala #isacalasc15 18 2015 Spring Conference Sessions Cybersecurity Nexus T1 Speakers: Bridging the Gap between Data Privacy and Security Nasr Ziaee Manager, Deloitte & Touche LLP Ali Husami Senior Consultant, Deloitte & Touche LLP Organizations today are burdened by the risks associated with the protection of sensitive information, which includes both intellectual property and personal information. It does not help that increasingly stringent privacy regulatory requirements and customer/employee expectations often result in requirements that conflict with the organization's security requirements. These conflicts, make it difficult for the uniform implementation of security and privacy programs and this results in gaps - gaps that are increasingly being exploited by individuals and groups with malicious intent. This session provides an overview of what some of these typical conflicts and gaps are and options and means that organizations and security/privacy professionals may use to stay ahead of the curve as they reduce risk while nurturing and growing their organization's security and privacy programs. After completing this session, participants will be able to: ● Better understand current security risks associated with the use of company information resources by employees for their personal use ● Feel more confident in their knowledge of global privacy requirements and employee expectations for companies with global operations ● Come away with knowledge of the options available for companies to balance (conflicting) security and privacy requirements ● Determine what's the right option for your company and how to operationalize these changes at your company T2 Speakers: Social Media Risks John Hicks IT Audit Director, Walt Disney Company Richard Lee Senior Manager, Ernst & Young LLP Social media has reinvented the relationship between companies, customers, employees, suppliers and regulators, shortening processes that used to take days or weeks down to just hours or minutes. But in addition to the many opportunities that social media generates, there are also many new challenges. Social media and everyone who has internet access can quickly build a company’s brand, but it can, with equal, speed crush it. Only by building a broad and comprehensive approach to social media can organizations realize the effective governance and its resulting clarity needed to effectively protect and strengthen a brand. After completing this session, the participants will be able to: ● Understanding Social Media and how it affects your organization ● Gain a better understanding about common guidelines for Social Media Governance and what they entail ● How can a company’s Internal Audit function assist in assessing and mitigating the inherent risks of leveraging social media @isacala #isacalasc15 19 2015 Spring Conference Sessions Cybersecurity Nexus T3 Speaker: Six Forces: Developing a Resilient Security Program James Christiansen Vice President, Information Risk Management, Accuvant With more than 700 security technologies to consider, millions of threat actors to detect, and new attack vectors to defend against, today's information security leaders need to balance a more complex environment than ever before. And simply working harder will not solve the problem. Information security management must completely rethink the way they do business by transforming from being reactive and infrastructure-focused to proactive, business-aligned security leaders. They can start this evolution by developing a resilient security strategy considering the Six Forces of Information Security. This presentation will share thoughts from the corner office on how awareness and monitoring of these six forces is essential to effectively managing risk, maximizing capital effectiveness, and empowering your organization to pursue business advantages. After completing this session, participants will be able to: ● Understand the evolution of security landscapes requires a proactive, business-aligned security approach and how the Six Forces of Security Strategy can help security leaders make this transformation. ● Know how completing a threat analysis after understanding the business objectives and exposures leads to a business-aligned security program. ● Apply concepts, framework and tools essential for enabling people, process and technology to collaborate and rede fine a next-generation security strategy program. ● Employ actionable insights to recalibrate security defenses and protect intellectual property. T4 Speaker: “Where are the bad guys hiding?” – A Forensic Approach to Incident Response Peter Morin Senior Information Security Consultant, Bell Aliant Our networks and systems are under siege by attackers more now than ever. What a scary time to be a systems administrator, application owner or CEO. Organizations are looking everywhere for solutions to assist them in identifying threats on their networks and the real-time knowledge on when and how to respond to incidents. This session will provide the attendee an overview of basic incident response techniques and forensic practices to identify a potential breach in their network. It will assist the attendee to answer the real important questions of how the intruder got into the network, what they stole, and what type of defenses could mitigate a future attack. After completing this session, the participants will be able to: ● Understand some of the popular incident response processes ● Review the concept of indicators of compromise and specific forensics tips and tricks that organizations can use to identify possible attacks and breaches of their networks and applications ● Walk through some real-world examples such as the Target and Home Depot breaches and learn some valuable indicators of compromise, techniques and tools that could be used to identify and suppress these attacks @isacala #isacalasc15 20 2015 Spring Conference Sessions Cybersecurity Nexus T5 Speaker: Industrial Control Systems (ICS) Threats and Solutions Douglas Rhoades Chief Engineer Cybersecurity, Southern California Edison Cyber security is one of the most important policy and technology topics an organization must address. Critical infrastructure for energy and utilities is vital to personal safety, economic growth and national defense. Threat actors continue to seek to exploit potential vulnerabilities in the U.S. national electric grid and other energy infrastructures. Such attacks and disruptions are becoming increasingly sophisticated and dynamic. Also, as the planet becomes smarter and increasingly interconnected, this technology may represent new vectors of attack on information systems. This interconnectedness can enable many new efficiencies and conveniences, but it also means that, while every business must continue to refine and improve its security capabilities, critical infrastructure industries, like electric utilities, must become more and more proactive in their approach. After completing this session, participants will be able to: ● Better understand Threat actors ● Benefit from insights into the ICS threat environment ● Benefit from a better understanding of the weakness of ICS ● Plan with an enhanced understanding of mitigation strategies T6 Speakers: Contract and Records Management Jason Messer Senior Solutions Engineer, Laserfiche Douglas Van Gelder IT Manager, County of Los Angeles Community Development Commission Kelsey Frost Sales Engineer, Laserfiche Accumulation of electronic records on shared drives and other repositories are costly to an organization. But increased IT costs to support excess data is nothing compared to the potential cost of litigation and reputational risk. Improperly indexed data is difficult to delete, meaning old information remains on the system and is amenable to legal discovery. The Community Development Commission of the County of Los Angeles (CDC) has been using Laserfiche as an electronic document management system for years, and has recently undertaken a project to implement records management throughout the organization. This will allow the CDC to automatically find records eligible for deletion in their system keeping risk, and IT cost, at a minimum. Come join us as we speak about the records and information governance challenges LACDC has encountered, and the experiences and lessons learned in moving the LACDC to a recordscentric approach to electronic document management. We will also cover the DoD requirements for records manageement and other leading industry standards After completing this session, the participants will be able to: ● Articulate the risks associated with accumulation of excess data ● Understand the DoD requirements for records management ● Assess their organization's need for records management and governance ● Avoid common mistakes learned through experience by industry leaders @isacala #isacalasc15 21 2015 Spring Conference Sessions Cybersecurity Nexus T7 Speaker: Web Application Security & SDLC Peter Morin Senior Information Security Consultant, Bell Aliant Many traditional application development methodologies do not specifically incorporate security into their life cycles. Security requirements should provide input into every phase of the Software Development Life Cycle (SDLC), from requirements gathering to design, implementation, testing and deployment. This presentation discusses the importance of application security and describes how the role of application developers must change in response to new security threats. After completing this session, the participants will be able to understand: ● An introduction secure application coding methodologies - OWASP, NIST and WASC ● Web application security problem ● The effect of compliance on application security (i.e. PCI-DSS, SOX, etc) ● Some of the common attack scenarios (i.e. XSS, SQL Injection, Cookie Attacks, etc) ● The current state of web application development methodologies and the challenges faced when following these methodologies to develop secure web applications ● Integrating security into the SDLC (i.e. project plan, design reviews, test case development, defect tracking, etc.) ● Practical testing strategies and concepts as they relate to application security ● Use of automated tools in the testing process T8 Speaker: Secure by Design, Privacy baked in and Defending Data Objects Rakesh Radhakrishnan Senior Director, Security Architecture & Engineering, Princess Cruises Given the constant news around Identity Theft and Data Breaches, including the recent Anthem breach, Enterprises need to rethink their architecture, design and strategy for Data Security and Data Protection. It is imperative that we go beyond Intrusion Detection, Intrusion Prevention, and build systems that can Tolerate Intrusions (Intrusion Tolerance), where in the data objects themselves are self defending while at REST, in Use and in Transit. This presentation will describe an innovative approach to embedding access policies into data objects based on the "Privacy baked in" principle. It will cover the business value proposition of ensuring a common policy construct for DataBase Firewalls, DLP systems, and Cloud Data Tokenization ensuring an Integrated Defense strategy. After completing this session, participants will be able to: ● describe privacy use cases around PII, PCI, PHI etc. ● understand the pain points or GAPS in the as-is state of Data Security (global enterprises) ● understand the need for end to end, comprehensive, consistent, and cohesive controls ● understand how to design self defending data objects with standards based policy constructs ● gather key take aways/lessons learned from a multi-vendor POC study @isacala #isacalasc15 22 2015 Spring Conference Sessions Cybersecurity Nexus T9 Speaker: Architecture for Secure Cloud Computing Arshad Noor CTO, StrongAuth, Inc. Unless your organization is unique, not all your data is sensitive. This raises the question: should scarce security resources be used to protect 100% of your data? The logical approach should be to build your IT infrastructure in a manner that optimizes your investments: protecting what matters while managing non-sensitive data with minimal controls. This session presents an architecture for building the next generation of web-applications. This architecture allows you to leverage emerging technologies such as cloud-computing, cloud-storage and enterprise key-management Infrastructure (EKMI) to derive benefits such as lower costs, faster time-to-market and immense scalability with smaller investments while proving compliance to PCI-DSS, HIPAA/HITECH and similar data-security regulations. We call this Regulatory Compliant Cloud Computing, or RC3. After completing this session, participants will be able to: ● Distinguish between different application architectures used over the last four decades ● Understand why securing sensitive data in the Cloud is impossible with current technology ● Appreciate why a new application architecture is necessary for securing data in the Cloud ● Identify security gaps in securing sensitive data in the Cloud T10 Speaker: Next Generation Firewalls (NGFW) Miguel (Mike) O. Villegas Vice President, K3DES LLC Recent security breaches to some of the largest and seemingly more secure environments beg the question whether existing protection mechanisms are sufficient to deter unauthorized access to critical assets. Traditional firewalls, anti-virus and intrusion prevention systems appear to have lost their usefulness. In reality, they are still very much in use; however, more robust and effective solutions are needed to keep up with those that threaten our network infrastructures. Next-Generation Firewalls are integrated network platforms that consist of in-line deep packet inspection (DPI) firewalls, Intrusion Prevention Systems, Application Inspection and Control, SSL/SSH inspection, website filtering, and Quality of Service (QoS)/bandwidth management in the network to protect the network against latest sophisticated attacks. This session will cover NGFW features, uses, business case and vendor offerings. It will also provide the participant with a roadmap on how to audit and manage a NGFWs. After completing this session, participants will be able to: ● Better understand what is a Next Generation Firewall? ● Gain knowledge in how do they differ from UTM? ● Better understand what are NGFW features and how do they work? ● Better understand how to make a business case for a NGFW ● Gain knowledge in how to audit and manage a NGFW @isacala #isacalasc15 23 2015 Spring Conference Sessions Designing and Managing Governance, Risk and Compliance G1 Speaker: Audit Strategy: Ongoing Cybersecurity Assessments Brad Ames Director, Internal Audit, Hewlett Packer Corporation The velocity and impact of cybersecurity risk requires an innovative assurance strategy. Separate evaluations that offer a point-in-time report are not in step with the pace of cybersecurity risk. Rather, ongoing evaluations that provide a forward looking communication of cybersecurity risk will increase IT audit value. This segment will present a model for providing continuous assurance through ongoing evaluations of cybersecurity risk and controls. IT general controls are foundational, however unlikely to offer a complete solution for providing assurance related to cybersecurity. The complexity of cybersecurity requires added layers of controls such as monitoring for risk, detecting exploits as they happen and prompting corrective action. After completing this session, participants will be able to: ● Understand ongoing assurance techniques that will be required to measure changes to security configurations, monitor emerging risk outliers and trends and enact timely response and remediation ● Collaborate on key cybersecurity risk indicators for IT audit leadership in order to isolate outliers for the audit plan G2 Speaker: How the COBIT Framework can help the Auditor Audit the Cyber Enterprise Mark Stanley IT Audit Manager, Toyota Financial Services Cyber warfare is a reality. Major companies are being attacked and virtually destroyed. Reputation risk is a nice buzz word but the reality is companies are being held hostage, economically devastated and driven out of existence. Cyber Terrorism is real and can be devastating to your enterprise. Government response is antiquated. What can you do as the last line of defense in your organization? How can you adapt to this new universe and defend your virtual organization? You can adapt COBIT to meet your Audit Committee's demand for your assurance services. This session will demonstrate the possibilities. After completing this session, participants will be able to: ● Define the Cyber Enterprise and your Cyber Risk ● Gain a better understanding of the importance of Board and Management Cyber Awareness ● Extend their vision beyond the Conventional Security Management Program ● Learn how to build a Framework for Cyber Enterprise Audit Assurance ● Better understand Audit Program Considerations @isacala #isacalasc15 24 2015 Spring Conference Sessions Designing and Managing Governance, Risk and Compliance G3 Speakers: IT Vendor Risk Management Christopher Garlington Manager, IT Vendor Risk Assessments, Disney Global Information Security Jeremy Yates Senior Security Specialist, Disney Global Information Security Most companies are increasing their reliance upon third parties to improve key processes or realize cost savings. Depending on the third party’s role in the critical business process and the data involved, the risks may increase. Risks may include regulatory non-compliance, data breach, operational failure, or brand/reputational risks among others. This session will discuss the basic elements of an IT Vendor Risk Management program. This includes vendor discovery, assessment methodology, reporting, issue tracking, and contract best practices. This session hopes to provide you with the basic building blocks to create or refine your process for identifying and mitigating risks related to third parties. After completing this session, the participants will be able to understand: ● Basic building blocks for vendor risk management ● How to create or refine your process for identifying and mitigating risks related to third parties G4 Speaker: Practical steps to managing IT Risk: Value Creation and Governance Brian Barnier Principal Analyst & Advisor, ValueBridgeAdvisors “I need more business benefit from IT,” “I need to be able to seize more opportunity in the economic recovery,” “How do we get IT to do what we need and do it now?” Business leaders are asking tough questions, urgent questions and need good answers. Too often IT leaders shy away from direct answers. Clear answers begin with understanding how business value is selected, created, delivered and measured. This leads to clarity on how Business-IT initiatives deliver value. This leads to the importance of managing risk to the value cycle. After completing this session, the participants will be able to: ● Prioritize IT initiatives to create value ● Implement IT initiatives to enable value ● Operate the IT lifecycle to deliver value ● Manage risk to maximize return on the IT portfolio ● Manage change for continual improvement @isacala #isacalasc15 25 2015 Spring Conference Sessions Designing and Managing Governance, Risk and Compliance G5 Speaker: Common GRC Management Mistakes Brian Barnier Principal Analyst & Advisor, ValueBridgeAdvisors GRC is a hot topic. Hype has surrounded many techniques and software. Professionals and organizations have rushed to embrace these. Most recently, organizations are questioning the time and cost of many of these approaches. More they’re asking, are some of these techniques more than wasteful? Do they provide a false sense of security? Worse, are they dangerously distracting from more serious problems? Tough questions deserve answers. This session includes answers from the OCEG Red Book (the COBIT of the GRC world) and presented by Brian Barnier, co-chair of the OCEG Steering Committee. If you’ve got questions, this session is for you. After completing this session, the participants will be able to: ● Understand the differences between governance and program management, managing risk to compliance and man aging risk to performance objectives – and what each requires to be successful ● Describe the difference between types of compliance and implications for business objectives ● Describe the difference between tactical compliance and strategic compliance, and what that means for a GRC professional ● Identify the “serious six” dangerous techniques ● Understand the assumptions and limitations of the serious six G6 Speaker: GRC Process Optimization through Effective Use of Technology Kevin Berman Director - Southern California GRC Market Leader, PricewaterhouseCoopers LLP Joe DeVita Partner - GRC Technology, PricewaterhouseCoopers LLP In today's constantly changing Enterprise GRC environment, alignment between People, Process, and Technology is paramount to the success of building an effective GRC Program. While there is not a 'one size fits all' approach to building a GRC Program, the ability to understand the big picture within the Enterprise is a critical success factor understanding this alignment. After completing this session, participants will be able to: ● Understand key organizational drivers for Enterprise GRC Integration initiatives ● Better align Enterprise GRC Efforts in terms of standard Enterprise elements: People, Process, and Technology ● Conceptualize how Enterprise elements and business requirements align to GRC Technology ● Determine how to identify GRC Technologies which best addresses the needs of the business ● Benefit from lessons learned from past GRC Technology deployments @isacala #isacalasc15 26 2015 Spring Conference Sessions Designing and Managing Governance, Risk and Compliance G7 Speaker: Devising Internal Controls for Enterprise SaaS Chong Ee Senior Finance Systems Manager, Twilio With the enterprise increasing reliance on software as a service (SaaS) for operational and accounting processes, one is tempted to think that internal controls over transaction completeness, accuracy and validity have been redistributed to SaaS vendors armed with SSAE reports. Despite its ease of adoption, lack of sunk cost and pay as you go model, enterprise SaaS is not without accompanying risks. The presentation will demonstrate how a combination of factors - nontechnical users in smaller organizations, the ease of customization through point and click, as well as the high likelihood of integrating with other SaaS in completing a transaction lifecycle - can lead one to rethink existing internal controls. Other areas such as identifying and handling rogue IT - the use of SaaS not for its intended purpose or to compete with internal mandated products - would also be covered After completing this session, participants will be able to: ● Understand how enterprise SaaS is different from traditional ASP models ● Identify unique characteristics of users who adopt enterprise SaaS ● Appreciate the myriad of ways multiple SaaS can integrate to support an Order-to-Cash or Procure-to-Pay transaction lifecycle ● Gain insight into the ease of customizing SaaS, and accompanying risks ● Tailor internal controls to address an enterprise use of SaaS during implementation as well as post go-live G8 Speaker: COBIT In Action: Practical IT Audit Lessons Nelson Gibbs Director and Senior Audit Manager, Union Bank Where does IT Audit fit in the IT universe, and how can COBIT be used to strengthen an organization's technology use? Over the past two years I've led our IT Audit department as we pursue a predominantly COBIT aligned methodology and observed the challenges and benefits as we've become more mature and robust in our approach. At the same time our IT function has also begun to deploy COBIT to assist in risk management and governance of IT processes and activities. Come hear about some experiences and lessons learned in the field from the front line of COBIT use. After completing this session, participants will be able to: ● Understand how COBIT supports IT audits as part of the enterprise Internal Audit plan ● Learn how the generic COBIT framework is adapted for IT audits ● Identify how COBIT can benefit IT and other business functions ● Discuss how audit findings can help or hurt IT success ● Demonstrate how IT and IT Audit can work together to improve the organization @isacala #isacalasc15 27 2015 Spring Conference Sessions Designing and Managing Governance, Risk and Compliance G9 Speaker: Governance, Compliance and Ethics of Potential Access Gaps in Complex Systems Eric Read Associate Director, Audit, Risk Management and Compliance, UnitedHealth Care Logical access to most systems are governed by assigned roles. However, complex systems may require access controls outside of the defined roles. This may be due to requirements for specific access to the system front end, back end, database and even require options such as security levels and template access. If these points of access are not controlled within the specific roles, the annual Entitlement reviews used to demonstrate compliance may not be complete and accurate. This can easily lead to gaps in compliance. Accurate access compliance is a daily control, and additional processes may be necessary to manage compliance gaps in complex systems. So what do we do? Continue to hide the complex non-role based access controls from the auditors? We will review a sample complex systems, and discuss the Governance, Ethics and Compliance issues a complex system presents. After completing this session, participants will be able to: ● Better understand issues of compliance within a complex system ● Better understand the issue of access control in complex systems ● Gain knowledge in recognizing, managing and resolving compliance gaps within complex systems. ● Gain an understanding of the ethics of disclosure/non-disclosure of potential gaps in complex systems ● Discuss the value of improved Governance of access within Complex Systems G10 Speaker: Leveraging Pen Testing to Augment the Audit Lee Neely Senior Cyber Analyst, Lawrence Livermore National Laboratory (LLNL) Auditing and Pen Testing are both disciplines that find system weaknesses and confirm strengths for a customer who doesn't necessarily embrace the activity and resists accepting the results. In this talk Lee will discuss the phases of a Pen Test, and how that emulates a real cyber or physical attack, how Pen Tester's activities differ from real attacks, and the methods used to prove results while doing no harm. Specifics on how an audit can leverage Pen Testing to provide a customer a better overall assessment of their environment and the challenges of creating a final report that the customer can understand and is actionable will be reviewed as well. ● After completing this session, participants will be able to: ● Understand the five phases of a Pen Test ● Differentiate between a Pen Test and an Attack ● Benefit from the knowledge of how Pen Testing can augment Audit activities ● Utilize the gained insights into the similar challenges Auditors and Pen Testers face @isacala #isacalasc15 28 2015 Spring Conference Sessions Technical Eduction Luncheon Sessions Technical Education Session 1 (sponsored by ANRC) E1 Speaker: Assuming Network Compromise: How changing your security perspective leads to proactive threat detection and prevention Nathan Swain President, ANRC Computer and network security has come a long way at a rapid pace, yet we still have devastating data and security compromises each year in all industries. Producing and maintaining static attack signatures and Anti-Virus databases against modern and dynamic malware is no longer a viable option for information assurance. Today we have to be proactive and assume the bad guys are already past our defenses. The best defense is truly a good offense! After completing this session, the participants will be able to: ● Strategize the best approach for implementing a pro-active network defense posture ● Compare and contrast the differences between legacy network security and this new security paradigm Technical Education Session 2 E2 Developing the most current content. Please check the website for the latest description! www.isacala.org/conference @isacala #isacalasc15 29 The center of cybersecurity knowledge and expertise. TM CYBERSECURITY NEXUS Created by the leading minds in the field, Cybersecurity Nexus™ (CSX) brings you a single source for all things cybersecurity. From certification, education and training — to webinars, workshops, industry events, career management and community — you’ll find everything you need to take your career to the next level. And, we’ve designed CSX to help you every step of the way, no matter what your level of experience. Connect with the resources, people and answers you need… visit us today at isaca.org/cyber. global conferences membership certifications training knowledge education career management Sponsors Platinum Sponsor Laserfishe Since 1987, more than 35,000 organizations worldwide—including federal, state and local government agencies and Fortune 1000 companies—have chosen Laserfiche® enterprise content management (ECM) software to streamline document and business process management (e.g., accounts payable, case management, third party and contract management, records management). www.laserfiche.com The Laserfiche ECM system is designed to give IT central control over their information infrastructure, including standards, security and auditing. From securing database and communication channels to securing a specific word on a document or file, Laserfiche provides flexible, granular options to allow each organization to tailor a security policy to its needs. DoD 5015.2- and VERS-certified records management functionality provides a multi-faceted set of information governance tools to manage a document’s life cycle from initial capture to a lasting record. Laserfiche is headquartered in Long Beach, CA, with offices in Hong Kong, Shanghai, Toronto, Mexico, London, Washington, D.C., and Fort Lauderdale, FL. Gold Sponsor RSA RSA, The Security Division of EMC, is the premier provider of intelligencedriven security solutions. RSA helps the world’s leading organizations solve their most complex and sensitive security challenges: managing organizational risk, safeguarding mobile access and collaboration, preventing online fraud, and defending against advanced threats. RSA delivers agile controls for identity assurance, fraud detection, and data protection; robust Security Analytics and industry-leading GRC capabilities; and expert consulting and advisory services. www.emc.com/domains/rsa/ Silver Sponsors Newegg Business NeweggBusiness is a leading provider of a full range of IT products and solutions for small businesses, government agencies, healthcare, educational institutions and system integrators. Since our founding in 2009, we have been committed to helping our customers extend their IT capabilities by providing a suite of computing products, networking solutions, data management & storage, communications and secure cloud hosting services. It has always been our mission to continuously improve the learning, searching, buying and managing of all your IT procurement needs. www.newegg.com @isacala #isacalasc15 31 Sponsors Accuvant www.accuvant.com Accuvant is your source for information security success is the premier source for enterprise security solutions. We provide a comprehensive suite of information security strategy and IT security consulting services, managed security services, and technology resale and integration services. We are the only company that serves as a client advocate, holistically addressing information security needs ranging from the program level all the way down to the project level. We help organizations plan, build and run successful information security programs, solve focused security problems, and execute specific IT security projects. Deloitte www2.deloitte.com Deloitte provides industry-leading audit, consulting, tax, and advisory services to many of the world’s most admired brands, including 70% of the Fortune 500. Our people work across more than 20 industry sectors with one purpose: to deliver measurable, lasting results. We help reinforce public trust in our capital markets, inspire clients to make their most challenging business decisions with confidence, and help lead the way toward a stronger economy and a healthy society. As a member firm of Deloitte Touche Tohmatsu Limited, a network of member firms, we are proud to be part of the largest global professional services network, serving our clients in the markets that are most important to them. Clients count on Deloitte to help them transform uncertainty into possibility and rapid change into lasting progress. Our people know how to anticipate, collaborate, and innovate, and create opportunity from even the unforeseen obstacle. Palo Alto Networks, Inc. www.paloaltonetworks.com Palo Alto Networks, Inc. provides enterprise security platform to enterprises, service providers, and government entities worldwide. Its platform includes Next-Generation Firewall that delivers application, user, and content visibility and control, as well as protection against network-based cyber threats; and Threat Intelligence Cloud that offers central intelligence capabilities, as well as automated delivery of preventative measures against cyber attacks. We are leading a new era in cybersecurity by protecting thousands of enterprise, government, and service provider networks from cyber threats. Because of our deep expertise, commitment to innovation and game-changing security platform, thousands of customers have chosen us and we are the fastest growing security company in the market. With our platform, organizations can safely enable the use of all applications, maintain complete visibility and control, confidently pursue new technology initiatives like cloud and mobility, and protect the organization from cyber attacks - known and unknown. @isacala #isacalasc15 32 Sponsors Bronze Sponsors Bit9 Bit9 + Carbon Black provides the most complete solution against advanced threats that target organizations’ endpoints and servers, making it easier to see—and immediately stop—those threats. The company enables organizations to arm their endpoints by combining continuous, real-time visibility into what’s happening on every computer; real-time signature-less threat detection; incident response that combines a recorded history with live remediation; and prevention that is proactive and customizable. www.bit9.com More than 1,000 organizations worldwide—from Fortune 100 companies to small enterprises—use Bit9 + Carbon Black to increase security, reduce operational costs and improve compliance. Leading managed security service providers (MSSP) and incident response (IR) companies have made Bit9 + Carbon Black a core component of their detection and response services. EY www.ey.com About EY's Advisory Services: Improving business performance while managing risk is an increasingly complex business challenge. Whether your focus is on broad business transformation or, more specifically, on achieving growth or optimizing or protecting your business, having the right advisors on your side can make all the difference. Our 30,000 advisory professionals form one of the broadest global advisory networks of any professional organization, offering seasoned, multidisciplinary teams that work with our clients to deliver powerful and exceptional client service. We use proven, integrated methodologies to help you resolve your most challenging business problems, deliver a strong performance in complex market conditions and build sustainable stakeholder confidence for the longer term. We understand that you need services that are adapted to your industry issues, so we bring our broad sector experience and deep subject matter knowledge to bear in a proactive and objective way. Above all, we are committed to measuring the gains and identifying where your strategy and change initiatives are delivering the value your business needs. KPMG www.kpmg.com KPMG LLP, the audit, tax and advisory firm, is the U.S. member firm of KPMG International Cooperative ("KPMG International"). KPMG International’s member firms have 145,000 professionals, including more than 8,000 partners, in 152 countries. KPMG delivers a globally consistent set of multidisciplinary services based on deep industry knowledge. Our industry focus helps KPMG professionals develop a rich understanding of clients' businesses and the insight, skills, and resources required to address industry-specific issues and opportunities. @isacala #isacalasc15 33 Sponsors PWC www.pwc.com PwC is one of the world's largest providers of Assurance, Tax, and business consulting services. We believe that the best outcomes are achieved through close collaboration with our clients and the many stakeholder communities we serve. So every day, our people work hard to build strong relationships with others and understand the issues and aspirations that drive them. We provide industry-focused assurance, advisory and tax services for over 90% of the companies in the FT Global 500 list. And we advise and work with over 100,000 entrepreneurial and private businesses across the world. More than 195,000 people in 157 countries across our network share their thinking, experience, and solutions to develop fresh perspectives and practical advice. In the United States, PwC currently consists of more than 36,000 partners, principals, and staff The Walt Disney Company Disney Technology teams ensure we tell our stories in the most innovative ways. We deliver a full range of services that span across each of our businesses and provide the opportunity to engage people through innovative, immersive and interactive technology. We work on multiple platforms to connect with our audiences with our products such as Watch Apps at ESPN & ABC, Disney Movies Anywhere, My Disney Experience, Imagicademy and interactive games such as Disney Infinity and Star Wars Commander. thewaltdisneycompany.com Event Sponsors CISO Luncheon Meeting Sponsor Allgress www.allgress.com ● The Allgress Business Risk Intelligence Module provides security and risk professionals with an immediate, intuitive and comprehensive view of their organization-wide security and risk posture. ● The Allgress Security and Compliance Assessment Module enables security and risk professionals to perform security and compliance assessments that simplify the compliance audit process. ● The Allgress Vulnerability Management Module lets security and risk professionals make sense of vulnerability data collected across complex, global networks. ● The Allgress Incident Management Module allows security and risk professionals to manage security incidents and investigations. ● The Allgress Policy and Procedures module provides security and risk professionals with the ability to manage internal security and regulatory compliance policies and procedures that support the unique security and compliance goals of your organization. @isacala #isacalasc15 34 Sponsors Education Session Sponsor ANRC Services ANRC is an industry leading firm focused on Advanced Cyber Security Training, Enterprise Threat Assessments, and Innovative Security Solutions. ANRC draws upon experience obtained at the frontlines of today's cyber conflicts to develop its progressive and comprehensive security solutions for the defense of private enterprises. www.anrc-services.com
© Copyright 2024