About this event…
ISACA Illini has heard your request for learning events that feature technical content and our January events are our way of gauging the true level of interest within our membership community.
Please Note: Although there is benefit to attending both Wednesday’s and Thursday’s event, these events can also be attended as stand-alones. (Click here for more information about Thursday’s event.)
About our presentations…
Our Web Applications Are Under Attack!
Note: CPEs for this presentation will be issued as a separate event.
We rely on web applications every day, from the application used to capture our timesheets to the billing system used to manage sensitive customer records. As the breaches in the news are making more and more evident, many of these applications have been deployed without proper security controls, using insecure coding practices, and lacking security testing. This has made these critical applications susceptible to attack.
During this presentation, we will discuss the following ways that our applications are susceptible to attack:
- Reviewing the OWASP Top 10 vulnerabilities (i.e. XSS, injection, etc.)
- Understanding the importance of security in the software development lifecycle (SDLC)
- Reviewing the architecture of web-based applications (i.e. authentication, session management, etc.) and the various technologies used (i.e. .NET, Java, JS, Angular, Node.JS, etc.)
- Identifying the risks of using cloud and virtual hosting infrastructure to host our web applications and the security controls needed to protect them
Lurking in the Shadows – Developing an Insider Threat Strategy
Protecting against today's threats is an ongoing battle. When we once worried mainly about external threats, we now, more than ever, have to ensure we can defend our organizations against the malicious insider. Research has shown that insider threat represents over 70% of cyber security threats - yet many still spend most of their budgets on defending against external threats. During this discussion, Peter will use real world examples to help us better understand how organizations can protect themselves against insider threats. He will:
- Help us define the insider.
- Teach us common techniques used by insiders and proven detection techniques.
- Show us the pros and cons of technology used to detect insider threats, such as DLP, database monitoring, and whitelisting.
- Tell us how to establish a successful insider threat program, including the requirements and challenges he has faced.
- Provide ideas on how to monitor for insider threats in the era of GDPR and other privacy regulations.
An Introduction to the MITRE ATT&CK Framework
Google Trends tells us that this strange new ampersand-infused acronym is red hot. But what is MITRE ATT&CK™ all about, and why should cybersecurity pros pay attention? Peter will help us understand these questions and so many more during our final hour together…
During this presentation we will discuss the following:
- What is the ATT&CK framework? How did it come to be?
- What are the various phases of an adversary’s attack lifecycle? And what platforms they are known to target?
- How can I apply the framework in my organization?
- When is it useful?
- How does ATT&CK differ from the Lockheed Martin Kill Chain?
- How do I apply ATT&CK to known threats/use cases?
- What challenges are there when using ATT&ACK?
About our speaker…
Peter Morin is a Director of PwC’s Cyber Security and Privacy practice, where he focuses on ICS and Critical Infrastructure. He is a senior cyber security professional with over 20 years of experience, focusing on:
- Information Security Risk Management,
- Cyber Threat Incident Response,
- Threat Hunting,
- Malware Analysis, and
- Computer Forensics.
He has held senior positions for a number of organizations, including a national telecommunications and media company, a Fortune 500 cloud-computing company, a recognized cyber security software company. Most recently, Peter worked with a major US defense contractor where he focused on developing insider threat solutions, engaging in incident response, threat hunting, and implementing monitoring/detection systems for security operations centers.
Peter holds a number of designations including the CISSP, CISA, CRISC, CGEIT and a few SANS GIAC certifications. He has presented at numerous events held by the FBI, US Department of Homeland Security, HTCIA, PMI, SANS, and ISACA. He is also a frequent guest lecturer at numerous colleges and universities throughout North America.
About the event…
- Date and time: Wednesday, January 29, 2019. Registration begins at 11:00, doors open at 11:15, lunch is served at 11:30, and the presentation begins at 12:30.
- Location: Holiday Inn & Suites Bloomington Airport, 3202 E Empire St., Bloomington, IL 61704.
- Lunch: Baxter’s Grill will provide an Italian buffet that features mixed greens, baked mostaccioli with marinara, chicken rotini pasta and a dessert flight. (Please request gluten free, vegetarian, or other dietary needs when registering.)
- Registration: Members and non-members are invited to attend for $50.00. Please use the registration process below to reserve a spot.
- CPEs: 3