Agenda

Security policies are a foundational requirement of any security program. Most of us have them, auditors review them, and we update them annually. That is a good start, but are your policies working for you in a way that advances your security program? A well-designed policy structure coupled with strategic communication, training, and processes will enable organizational clarity, gain executive buy-in, drive accountability, and even help advance security culture.

Tina Meeker, CISSP, CIPP/US, and Sr. Director of Information Security for Sleep Number, will share proven practices to help you take your policy design and operational practices to the next level (or build from scratch) based on her experience in this space for over 15 years across several organizations across various industries.

In this session, you will learn how to:

• Architect a policy structure that fits your organization’s needs
• Gain buy-in from the top and key stakeholders early and often
• Identify key stakeholders to develop and deliver custom messaging (and training if needed) and drive ownership and accountability
• Establish a simple “policy operations” process to help capture challenges and exceptions and to ensure proper visibility to risks
• Evolve policy over time, staying in line with business capabilities and priorities

It is shocking that, year over year, stealing credentials is still the top tactic used by attackers to breach organizations. Why is this still happening? Hint: It isn’t only because of weak passwords. Organizations have invested heavily into privileged access management (PAM) technologies, but these solutions have struggled to address the problem for five key reasons. In this discussion, we will address the gaps in current access management approaches but, more importantly, show you how to quickly close the gaps and significantly reduce security risks without disrupting your current investments or systems.

Join Remediant in this discussion to:

• Learn the five reasons why privileged access management implementations fail
• Identify areas in your IAM program where you can reduce admin access risk
• Capitalize on existing investments, while improving your risk posture

Presentation level: TECHNICAL (deeper dive including TTPs)

The promise of the Security Data Lake is to provide a centralized, massively scalable repository for ALL data relevant for the Security Operations team, enabling many core functions required by the modern enterprise -- monitoring and alerting, threat hunting, advanced persistent threat protection, DDoS mitigation and many others.  

But the quest to achieve it has been a rocky one, as infrastructure complexity has prevented most teams from achieving the vision.  

This session will explain the benefits of achieving a true security data lake, explain the previous barriers that companies have faced, and describe a new approach which is allowing companies to achieve the vision, and finally put the Security Data Lake at the heart of their overall Security Architecture.  

Most organizations have a hybrid implementation of cloud and on-prem services. With the rapid adoption of business digitalization and expanding remote work force, how do we consolidate controls and enhance the security of the systems?

In this hybrid mode, enterprises need speed, visibility, security, and reliability without compromise. Enter the secure access service edge, better known as SASE. It’s inevitable that SASE implementations and Zero Trust implementations will provide a more comprehensive security capability to truly support digital transformation. How can your organization best position itself for the transition?

In this session, James Christianson will discuss:
·  How to migrate your security controls to take advantage of SASE
·  Reducing cost while increasing your security posture
·  Implementing a road map for SASE / Zero Trust

Information Security programs protect complex businesses. Learn how to keep it simple.

Securing your organization can be daunting—further complicated by a global pandemic. You enter a new organization and you need to build a Security team and a practice. Where do you start? Your business, Board, colleagues, leadership, and stakeholders all have expectations. Do not get overwhelmed. Learn how to leverage your resources to orchestrate an Information Security program.

Presentation level: MANAGERIAL (security and business leaders)

To keep pace with the database activity explosion that has accompanied recent rapid technology innovations, organizations must rethink their strategy for securing their data assets. A strategy designed to meet compliance requirements is not enough. Organizations need to develop new approaches that augment traditional agent-based monitoring to achieve real data security today and in the future.

We’ll provide insight into how you can automate data collection and monitoring so you may apply more resources to identifying non-compliant behavior and orchestrating rapid responses, regardless of where your data is or the size of your data estate.

The world changed overnight, and we adapted to it, but so did the hackers and cybercriminals. We are seeing a new breed of cyber mercenaries for hire, hackers for hire, ransomware-as-a-service (RAAS), and enterprise-level tools and servers to help manage this new Dark Web of consulting services. This is why we are all players in the new game of WWD even if we do not know it.

The false security we wrap ourselves in—hoping the other guy, tool, or services we have invested in, even at the lowest level that will protect us—is fleeting. The Dark Web is becoming the e-commerce for obtaining off the shelf roadmaps to your systems architecture, the data you hold, the tools and processes needed to access your environment—physical, logical, and your R&D.

All animals, including humans, are wired to either fight or flight when challenged. The new predators on the planet include a hybrid of human-animal that is adopting new tools that leverage AI/ML, pitting offense and defense with no evolutionary road map and little remorse for the outcome.

Presentation level: TECHNICAL (deeper dive including TTPs)

IT professionals have had an incredible front row seat to one of the most extensive and lengthy business continuity plan (BCP) exercises we’ve ever seen, so in many ways, this has been a case study in resilience—both of systems and the human spirit. The pandemic fundamentally altered how people worked, and IT was the enabler.

The audience will gain insights as to how COVID-19 has impacted the IT field and how CISO organizations have had to shift their responsibilities during the pandemic. Tina will reflect on considerations for employees returning from the wild and share what steps companies can take to improve their risk management posture moving forward.

Presentation level: MANAGERIAL (security and business leaders)