Dear Member, 

Voting for Chapter Officers is officially open.  You may vote until 11:59 PM Sunday, December 14, 2014.  The new Board will be announced at the December 15 meeting. Click the link at the bottom of this email to access ballot.  You must supply your ISSA ID number to vote.  If you vote more than once, the last vote received will be the vote counted.
 
The candidates are:
 
President
Jim Shanesy
Jim Shanesy has more than 30 years experience as a controls engineer, software developer and information security specialist. He has worked both in private industry and as a government contractor for such varied clients as the US General Services Administration, Federal Reserve Board and the Administrative Office of the US Courts. He holds Security+ and CISSP certifications.  He is currently a Senior Risk Analyst with Knowledge Consulting Group of Reston, VA and presently serves as Executive VP of the ISSA-DC Chapter.
 
Statement:  My goals for the Chapter are simple – to continue the robust growth in membership we’ve enjoyed for the past two years, strengthen strategic relations with not only the other ISSA Chapters in the Region but with private industry to obtain sponsorship, and establish outreach to the security programs of area educational institutions.
 
Executive Vice President
Scott Binder
Thank you for considering to vote for me for the position of Executive Vice President. My qualifications include more than 20 years’ experience assisting the federal government and private sector with planning, managing, and executing complex information technology engagements. In my current position as a Director within MorganFranklin Consulting, I have the wonderful opportunity to network, teach, and learn from key leaders from around the country. I’m a detail oriented professional with proven success in planning, managing, and working with teams and individuals to accomplish short, medium, and long term initiatives and goals. For the past two years, I have served the ISSA-DC chapter as the President and I have been a long standing board member in a variety of other positions. I hope to continue serving the National Capital Chapter as the EVP and want to thank you for your consideration when casting your ballot.
 
Treasurer
Eddie Schwartz
Eddie Schwartz is President and COO of White Ops, Inc., and has over 25 years experience in the information security field.  Eddie formerly worked as VP/Chief Security Officer for RSA, Co-Founder and CSO of NetWitness (acquired by EMC), EVP/CTO of ManTech, EVP and General Manager of Global Integrity (acquired by INS), SVP of Operations of Guardent (acquired by VeriSign), VP/CISO of Nationwide Insurance, a Senior Computer Scientist at CSC, and a Foreign Service Officer.   Eddie advises a number of early stage security companies, and has served on the Executive Committee for the Banking Information Technology Secretariat (BITS).  Eddie serves on ISACA’s Strategic Advisory Council and is Chairman of ISACA’s Global Cybersecurity Taskforce.  He has a B.I.S. in Information Security Management and an M.S. in Information Technology Management from the George Mason University School of Management.
 
Vice President of Communication
Branko Bokan
Branko has been a member of the chapter's board of directors for the past six years. He is an information security professional with extensive experience in IT and security management and technologies. Branko holds a BSc in Information Systems from the London School of Economics, and an MSc in Information Security from Royal Holloway, University of London. He currently works as a director of cyber security at Innotion Enterprises Inc.
 
Vice President of Programs
Maureen Kaplan
Maureen Kaplan is the Managing Director & COO for Global Security within Verizon Enterprise Solutions.  In this role, she is responsible for business operations oversight, enabling growth in Cyberthreat Intelligence strategic services to customers.  She has spent the past 10 years working with global organizations in the development of their security risk mitigation programs and assisting with the delivery of strategic projects.  Previous roles within Verizon include leading healthcare cloud & security sales, managing complex solution practice for major enterprise clients, and received a Black Belt in the Verizon Lean Six Sigma program. 
 
Prior to joining Verizon in 2008, Maureen was Vice President of Sales Development for Perimeter eSecurity.  Maureen holds CISSP, CHSA, CHPA certifications.  Maureen received an Engineering degree from the University of Michigan, and spent a dozen years as a software engineer designing manufacturing automation systems.
 
Vice President of Membership
Kathie Miley
Kathie has 24 years of experience in the information technology and security field, and is currently Global Executive Director of Security Solutions Sales and Engineering at Verizon.  Kathie has held a variety of leadership roles in the information security and cyber threat industry including positions at Predictive Systems Global Integrity division, NetSec, MCI, Verizon's CyberTrust and Terremark divisions, and Verizon Enterprise Solutions.  Kathie’s expertise includes Enterprise Governance Risk and Compliance, Security Policy Assessment and Development, Global Managed Security, Physical Security and Advisory, Cyber Threat and Intelligence, Vulnerability and Patch Management, Identity and Access Management, Security and Network Architecture, and Security Training and Enablement.  Kathie has held memberships in industry security organizations including ISSA, ASIS, HIMSS, and others.  Kathie currently maintains her Certified HIPAA Security Expert (CHSE).
 
Vice President of Strategic Relations
Virginia Elharam
Mrs. Virginia Elharam has over 15 years of experience; combined both as a federal government employee with NIH and as a consultant with several US Federal Government Agencies and Departments.  Mrs. Elharam is currently working for System 1, Inc. as a Program Manager supporting a US Federal Government Agency.  Mrs. Elharam has experience designing, implementing, and managing information assurance programs for federal government agencies.  Additionally, Mrs. Elharam served as the ISSA-DC chapter Vice President of Strategic Relations (2009-2010) and is an active member of InfraGuard since 2009.
 
Vice President of Education
TomHallewell
Tom is the incumbent VP of Programs for the Chapter.  He has more than 15 years’ experience in Information Security.  He currently works for the Federal Government in Software Assurance and Identity Management.  He holds numerous certifications, including CISSP,  Certified Scrum Master.

CLICK HERE TO CAST YOUR VOTE

Thomas E. Hallewell, CISA, CISSP, CRISC, CSSLP, Certified Scrummaster
VP, Programs, Former Past President, Election Committee Chair
National Capital Chapter, ISSA
www.issa-dc.org

Dear Members:
Voting for Chapter Officers is officially open.  You may vote until 11:59 PM Monday, December 16, 2013.  The new Board will be announced at the December 17 meeting.  Click the link at the bottom of this email to access ballot.  You must supply your ISSA ID number to vote.  If you vote more than once, the last vote received will be the vote counted.
 
The candidates are:
 
President:  Scott Binder
Scott's statement
Please accept my nomination for the ISSA National Capital Chapter President. For many years I have been an active member of the National Capital Chapter and have served as the Chapter President for 2013 and it has truly been an honour serving in that position. I believe that I can assist the chapter even further by serving again as President in 2014.

I have been involved in information systems security for over 20 years. During this time, I have assisted the Federal Government and the private sector in planning, managing, solving, and executing complex audit and information technology issues. I hold the CISSP, CISA, CIA and other certifications.  I work very well with people and believe that good and frequent communication is the primary key for opening doors and accomplishing goals. Please accept my nomination for President and thank you for your support and consideration.
 
Executive Vice President:  Jim Shanesy
Jim’s statement
I have been involved in IT full life cycle applications development for more than 25 years, supporting both government and the private sector.  My current position is Sr. Risk Analyst with Knowledge Consulting Group.  I have served on ISSA-DC's Board in the past as both VP Education and EVP.  I look forward to assisting the President in bringing exciting new programs to ISSA-DC this year. Thanks to all the membership for your support and your vote.
 
Chief Financial Officer:  Eddie Schwartz
Eddie is the incumbent Chapter Treasurer/Chief Financial Officer.  
 
Secretary and Vice President of Communications:  Branko Bokan
Branko’s statement
Branko has been a member of the chapter's board of directors for the past five years. He is an information security professional with extensive experience in IT and security management and technologies. Branko holds a BSc in Information Systems from the London School of Economics, and an MSc in Information Security from Royal Holloway, University of London. He currently works as a director of cyber security at Innotion Enterprises Inc. 
 
Vice President of Education:  Roxane Nelson
Roxane’s statement
Roxane Nelson is a retired US Navy Veteran. She completed her Masters Degree in Cybersecurity from the University of Maryland University College (UMUC) in 2012 and recently completed her MBA, December 2013. She currently holds the position of Information Assurance Specialist for InfoTek supporting the Naval Explosive Ordinance Division in Indian Head, MD.
 
Vice President of Programs and Events:  Tom Hallewell
Tom’s statement
Tom Hallewell has served on the National Capital Chapter Board of Directors for six years. He is currently serving as VP of Programs and Events.
 
Vice President of Membership:  Patricia Summers
Patricia’s statement
I have been a member of ISSA-DC for more than 6 years and have had the honor of serving as Membership VP for the past 2 years.  I am willing to serve again in this post, but feel strongly that it is time for someone else to have this opportunity.  I am willing to assist whoever else wants to run for this position until they feel comfortable in the role.  That said, I have over 20 years in various aspects of Information Technology and Information Security, have earned a CISSP and am keenly aware of the benefits of organizations such as ISSA, both personally and professionally. Membership gives us access to people we might not meet otherwise, and the monthly meetings are more like Grad Seminars than boring stand-up lectures.  Risk Management plays a role in our meetings, as for instance when the Speaker shows up but is carrying items that are not allowed in secure government buildings, the Speaker doesn't show up at all, or the Pizza goes missing;  opportunities for quick thinking and disaster recovery abound.  This is a fun group.  If no one else runs I will be happy to serve another term. 
 
Vice President of Strategic Relations
No candidate has been nominated for Vice President of Strategic Relations.
 

 
Thomas E. Hallewell, CISA, CISSP, CRISC, CSSLP, Certified Scrummaster
VP, Programs
Chair, 2014 Election Board
National Capital Chapter, ISSA
www.issa-dc.org

 

February 24, 2015 at 6:30 PM

ISSA National Capital Chapter February meeting topic:

Data Breach: Investigations and Readiness

 

Abstract
Turn on the television and you are more likely to hear about a data breach than any other security incident. Despite all security measures, data leakage and exfiltration still occur in “well-protected” enterprise networks – bypassing all defensive measures. Unless a viable process exists to protect valuable corporate intellectual property and customers’ sensitive information, data breaches and loss will become commonplace rather than an anomaly. Real-world experience gained from preparing high-stake organizations against data loss as well as in conducting high-profile investigations will be shared with participants. These experiences should help attendees anticipate, prepare for, and conduct forensically-sound data breaches investigations timely. 

About the Speaker 

Inno Eroraha is the Founder and Chief Strategist of NetSecurity® Corporation, a computer forensics, cyber security and training company based in Dulles, Virginia. His main responsibility is to position NetSecurity as “the brand of choice for forensics, security, and training,” by delivering high-quality, timely, and customer-focused solutions. Mr. Eroraha oversees NetSecurity’s day-to-day operations, including the proprietary HANDS-ON HOW-TO® training program and the state-of-the-art NETSECURITY FORENSIC LABS. He leads the execution of NetSecurity’s solutions and helps clients protect, defend, and recover valuable assets from cyber attacks and computer fraud. He has been consulted by Fortune 500 companies, financial institutions, IRS, DHS, DoD, and otherpremier organizations to solve complex cyber security problems.

Before founding NetSecurity, Mr. Eroraha was a senior manager of information security at VeriSign, Inc. In this capacity, he led the implementation of solutions to protect critical Internet infrastructures. As an advocate, he significantly heightened security awareness among internal and external stakeholders and key decision makers. Inno Eroraha also worked at Network Associates (now McAfee), Trusted Information Systems, Smartronix, SAIC, and other consulting firms. Mr. Eroraha has contributed to the field of computer security and forensics, often speaking, authoring, or consulting with media outlets on security and forensics topics.

Mr. Eroraha graduated cum laude with dual-bachelor degrees in mathematics and computer science from Morgan State University. He also received a masters degree in computer science from The George Washington University. Additionally, he has received industry certifications that include CISSP, ISSAP, ISSMP, CISM, CISA, CHFI, CCSE, and CCSA. Mr. Eroraha is a member of FBI InfraGard, High Technology Crime Investigation Association (HTCIA), (ISC)2 , ISSA, and ISACA.

 

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

 

Tuesday, February 24, 2015 6:30 PM

Government Publishing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

January 20, 2105 at 6:30 PM

ISSA National Capital Chapter January meeting topic:

Dr Ron Ross

 

Abstract
To be announced. 

This event is brought to you by  

 

About the Speaker 
Dr. Ron Ross is a senior computer scientist and information security researcher at the National Institute of Standards and Technology (NIST). Dr. Ross leads the Federal Information Security Management Act (FISMA) Implementation Project for NIST, which includes the development of key security standards and guidelines for the federal government, support contractors, and the United States critical information infrastructure. His recent publications include Federal Information Processing Standards (FIPS) Publication 199, FIPS Publication 200, NIST Special Publication 800-53, NIST Special Publication 800-53A, NIST Special Publication 800-37, and NIST Special Publication 800-39.

Dr. Ross is also the principal architect of the NIST Risk Management Framework that provides a disciplined and structured methodology for integrating the suite of FISMA security standards and guidelines into a comprehensive enterprise-wide information security program.

Dr. Ross is a frequent speaker at public and private sector venues including federal agencies, state and local governments, and Fortune 500 companies.

Dr. Ross is a two-time recipient of the Federal 100 award for his leadership and technical contributions to critical information security projects affecting the federal government and has been inducted into the ISSA Hall of Fame. Dr. Ross is a graduate of the Program Management School at the Defense Systems Management College and holds both Masters and Ph.D. degrees in Computer Science from the United States Naval Postgraduate School.

  

 

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

 

Tuesday, January 20, 2015 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

December 15, 2014 at 6:30 PM

ISSA National Capital Chapter invites you to a special event:

ISSA -DC at SANS@Night Cyber Defense Initiative 2014 

A Night of CryptoG by Mark Hardy
and 
Debunking the Complex Password Myth by Keith Palmgren

 

The National Capital Chapter has partnered with the SANS Institute again this year to offer exclusive access for its members to SANS@Night events at Cyber Defense Initiative 2014. The chapter meeting will take place at Grand Hyatt Washington on Monday, December 15, 2014. 

Please note that the event is free but you must RSVP at least 24 hours before the event so we can have your badge ready for you. 

The chapter members and their guests will have access to the following events:

5:00pm - 7:00pm
Vendor Expo and Networking Event
6:30pm - 7:00pm
National Capital Chapter Meeting - 2014 Election Results
7:15pm - 8:00pm
A Night of Crypto by Mark Hardy
7:15pm - 8:00pm
Debunking the Complex Password Myth by Keith Palmgren

A Night of Crypto by G. Mark Hardy
Want to learn a bit more about cryptography but not get wrapped up in the math? G. Mark Hardy has been writing crypto contests for major hacker conferences for years (DEFCON, Toorcon, Shmoocon, THOTCON, SkyDogCon, etc.), and is going to share insights into the reasons behind cryptography, why some algorithms work and some fail, and take a look at what's in use in business today. We'll even cover the cryptographic principles behind Bitcoin. Plus, you'll get a chance to see how crypto puzzles are designed, which might give you some ideas for your own.

Debunking the Complex Password Myth by Keith Palmgren
Perhaps the worst advice you can give a user is "choose a complex password." The result is the impossible-to-remember password requiring the infamous sticky note on the monitor. In addition, that password gets used at a dozen sites at home, AND the very same password gets used at work. The final result ends up being the devastating password compromise. In this one-hour talk, we will look at the technical and non-technical (human nature) issues behind passwords. Attendees will gain a more complete understanding of passwords and receive solid advice on creating more easily remembered AND significantly stronger passwords at work and at home, for their users, for themselves and even for their children.

 

 

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

 

Monday, December 15, 2014 6:30 PM

Grand Hyatt Washington
1000 H Street NW
Washington, DC 20001 US

Novebmer 18, 2014 at 6:30 PM

ISSA National Capital Chapter November meeting topic:

A (Brief) History of Computer Crime
by Mark Rasch, Rasch Technology And Cyberlaw

Scroll down for abstract and speaker's bio.

Letter from the Past President   Dear Chapter members,   The ISSA National Capital Chapter needs you to nominate our 2015 Chapter Officers!  We are looking for new people with fresh ideas so we can continue to provide maximum value to our membership.  Board service is a small investment of time (perhaps 4 hours a month, including the regular Chapter meetings), but I have found it to be very rewarding, both personally and professionally, and I think you will, too.  If you are a Chapter Member in good standing, you may nominate any Chapter Member (or yourself) for office.  If you would like to help build our Chapter, please consider nominating someone for a Board Position, or running for a position yourself.   Board Positions ·                     President ·                     Executive Vice-President ·                     Treasurer (Chief Financial Officer) ·                     Vice-President of Communications (Secretary) ·                     Vice-President of Programs ·                     Vice-President of Education ·                     Vice-President of Membership ·                     Vice President of Strategic Relations For a full description of the positions, please review the Chapter Bylaws.   Schedule November 12 through November 28, 2014 - Nominations collected All nominations must be received by November 30, 2014 at 11:59 PM.  To nominate an individual, please send an email to This email address is being protected from spambots. You need JavaScript enabled to view it.. You must be a member of the National Capital Chapter on the day you submit your nomination. All nominees must be general members in good standing of ISSA and the National Capital Chapter.   Student members are not eligible.  Candidates for President must have served on the National Capital Chapter Board in the year prior to his or her nomination. The Election Committee will contact nominees to confirm acceptance of the nomination and to request a candidate bio. All candidates, including self-nominations, must provide a brief (150 words or less) statement/bio. The statement will be distributed to members for review before voting begins. Statements longer than 150 words will not be accepted.   November 30, 2014 - Candidates announced We will email Candidate statements and instructions for casting your ballot to chapter members on November 30, 2013.   December 01, 2014 - December 15, 2014 - Ballots collected You must cast your vote before 11:59 PM on December 15, 2013.   December 16, 2014 - Election results announced We will announce incoming Officers at the Chapter meeting on December 16, 2014.  The new Officers’ terms of Office are effective immediately upon announcement . Elected Officers of the National Capital Chapter of the ISSA serve one-year terms.   Questions If you have any questions regarding nominating a candidate or other matters related to the nominations and elections process, please contact the ISSA-DC Election Committee at This email address is being protected from spambots. You need JavaScript enabled to view it..   Thank you for supporting the National Capital Chapter!   Thomas E. Hallewell, CISA, CISSP, CRISC, CSSLP, Certified Scrummaster VP, Programs, Former Past President, Election Committee Chair National Capital Chapter, ISSA www.issa-dc.org

Abstract
Mr. Rasch will discuss the history of computer crime since 1971.

 

About the Speaker

Mark Rasch brings over 25 years of experience in the information security field, having served for nine years as the head of the United States Department of Justice Computer Crime Unit, and having prosecuted key cases involving computer crime, hacking, computer fraud and computer viruses. Mark has served as Chief Privacy Officer in the private sector where he managed the risks and business impacts of privacy laws and policies.

While at the Department of Justice, he was responsible for investigations of computer hacking cases including those of the so-called “Hannover Hacker” ring, Kevin Mitnick and the prosecution of Robert T. Morris, author of the Cornell Internet Worm in 1988. He helped the FBI and Treasury Department develop their original procedures on handling electronic evidence. He created and taught classes at the FBI Academy and the Federal Law Enforcement Training Center on electronic crime and evidence. He has also taught classes on cyberlaw at American University, George Washington University, Harvard University, and Stanford.

Mark is frequently featured in news media on issues related to technology, security and privacy including. He has appeared on or been quoted by NBC News, MSNBC, Fox News, CNN, The New York Times, Forbes, PBS, The Washington Post, NPR and other national and international media. He writes a monthly column for StorefrontBacktalk on issues related to law and e-commerce and is a regular contributor to Wired magazine.

 

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

 

Tuesday, November 18, 2014 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
Washington, DC, 20005

Click here for details.

October 21, 2014 at 6:30 PM

ISSA National Capital Chapter October meeting topic:

Jonathan Fallone
Releasing the Kracken: Building and Using A GPU Password Cracker

Abstract
We’ve all seen the major security firms show off their password cracking setups on Twitter and their blogs. But it’s not that hard – or expensive - to build a serious password cracker for your own company. In fact, the real attackers probably sport similar hardware to use against you. While it can look daunting to pick from the massive number of GPUs available on the market, it’s not that difficult to nail down your requirements and put together a fast rig able to crack a significant number of passwords in a short period of time. This presentation will show you what to look for, how to pick your equipment, and considerations for building and maintaining your rig – from piecing the system together to considering your power requirements.

But a password cracker is useless if you don’t know how to use it. It’s all too common for pen testers and auditors to use a dictionary or two and a couple of simple brute force attacks and give up. There are tons of options in most cracking tools to increase the effectiveness of your cracking efforts. We’ll show you how to use your new password cracker and the industry favorite oclHashcat effectively to crack a significant number of passwords in a short amount of time, with minimal brute forcing.

 

About the Speaker
Jonathan Fallone is a senior penetration tester and security consultant for Knowledge Consulting Group (KCG) in Reston, VA. He is a 2010 summa cum laude graduate of Strayer University with a Bachelors of Science in Information Systems (BSIS), concentrating in security administration. He’s worked as a contractor for the Department of the Navy, Naval Sea Systems Command, performing DoD Information Assurance Certification and Accreditation Process (DIACAP) assessments on Team Submarine systems. Most recently, Jonathan has worked as a technical assessor and pen tester on numerous government and industry assessments, using multiple frameworks, including NIST 800-53 and PCI. He was also the primary technical assessor for KCGs independent review of the Akamai Content Delivery Network (CDN) for their FedRAMP ATO effort. Jonathan’s primary area of interest is in internal penetration tests and password cracking. He’s recently worked on providing proof of concepts and practical application of the Cold Boot and FireWire attacks on local memory, and has published a paper on the subject on EthicalHacker.net. He holds the GPEN, Certified Ethical Hacker (CEH), Security+, Network+, and A+ certifications, and is an Intermediate Level Navy Validator.

 

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

 

Tuesday, October 21, 2014 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

September 16, 2014 at 6:30 PM

ISSA National Capital Chapter September meeting topic:

Military Tactics for Enterprise Defense
by Greg Conti
Director, Army Cyber Center
United States Military Academy, West Point

Abstract
On today's increasingly militarized Internet, companies, non-profits, activists, and individual hackers are forced to melee with nation-state class adversaries. Just as one should never bring a knife to a gun fight, a network defender should not rely on tired maxims such as "perimeter defense" and "defense in depth." Today's adversaries are well past that. This talk teaches you how to tap what we call the Library of Sparta - the collective written expertise codified into military doctrine. Hidden in plain sight, vast free libraries contain the time-tested wisdom of combat at the tactical, operational, and strategic levels. This is the playbook nation-state adversaries are using to target and attack you. This talk will help you better understand how adversaries will target your organization, and it will help you to employ military processes and strategies in your defensive operations. These techniques scale from the individual and small team level all the way up to online armies. This talk isn't a dry index into the library of doctrine, we provide entirely new approaches and examples about how to translate and employ doctrinal concepts in your current operations. A key point of the talk will be helping defenders generate the intelligence, information, and disinformation advantage necessary to turn the tables. You will leave this talk with a suite of military-grade strategies that will help you advance your work beyond the individual and small-team level and will prepare you to take on the most advanced adversaries.

 

About the Speaker
Greg Conti is Director of the Army Cyber Institute and is an Associate Professor at West Point, where he conducts security research and teaches computer science. He is the author of Security Data Visualization (No Starch Press) and Googling Security (Addison-Wesley) as well as over 60 articles and papers covering cyber warfare, online privacy, usable security, and security data visualization. He has spoken at numerous security conferences, including Black Hat, Defcon, CyCon, HOPE, Interz0ne, ShmooCon, and RSA. His work can be found at www.gregconti.com

 

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

 

Tuesday, September 16, 2014 6:30 PM

 

Center for American Progress (CAP)
1333 H St. NW
Washington, DC, 20005

Click here for details.

August 19, 2014 at 6:30 PM

ISSA National Capital Chapter August meeting topic:

Combating Today's Targeted Attacks 
by Tom Kellermann, VP Cyber Security at Trend Micro

 

Abstract
Targeted attacks can only be thwarted by increasing the level of discomfort of the adversary to a point where they cannot expend the resources to maintain persistence. Advanced persistent response is the future of cyber security.

 Meeting Sponsor

About the Speaker

Within this role Tom Kellermann is a trusted advisor for Cybersecurity.  Tom is responsible for analysis of emerging cybersecurity threats and relevant defensive technologies.

Tom Kellermann served as a Commissioner on The Commission on Cyber Security for the 44th Presidency and serves as an advisor to the International Cyber Security Protection Alliance (ICSPA), and the National Board of Information Security Examiners Panel for Penetration Testing.  Tom is a Professor at American University's School of International Service and the Kogod School of Business.  Tom is a Certified Information Security Manager (CISM).

Prior to joining Trend, Tom held the position as Vice President of Security for Core Security for 6 years. Previously, Tom was the Senior Data Risk Management Specialist for the World Bank Treasury Security Team, where he was responsible for internal cyber-intelligence and policy and for advising central banks around the world about their cyber-risk posture and layered security architectures. In 2003, Tom co-authored the book "E-safety and Soundness: Securing Finance in a New Age."

Favorite quote: “There is one thing stronger than all the armies in the world, and that is an idea whose time has come.” –Victor Hugo

Experience: 16 years

Specialty: Financial sector cyber security and cyber security for government agencies

Education: M.A., American University; B.A., University of Michigan

Expert in Action: Tom appeared on BrightTalk to give this 2 minute overview "The Future of Endpoint Security." Watch RSA Interview with Tom, "The Evolution of Cyber-Attacks". Tom recently appeared on Fox Business News to discuss threats to mobile banking and payment transactions.The Accidental Insider Threat: Tom joins a panel of experts to explore the threats posed by “accidental insiders”— individuals who can unknowingly present a major risk to an organization and its infrastructure. Airing on Federal News Radio. Watch Tom's interview about attacks on Apple devices on Bloomberg Television's "Market Makers" Read Tom's latest opinion piece, How the Thwart the Digital Insider - An Advanced Persistent Response to Targeted Attacks

 

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

 

Tuesday, August 19, 2014 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
Washington, DC, 20005

Click here for details.

July 15, 2014 at 6:30 PM

ISSA National Capital Chapter July meeting topic:

Terry Gudaitis, Ph.D.
Social Media and the Insider Threat

 

Abstract

With the onslaught of new social media platforms and the handheld devices used by people to gain access to apps, the web, and social media, insider threat may need a new perspective.  Whether the threat or compromise is malicious or accidental, insiders are no longer only restricted to the computers, networks and devices provided by their organizations.  Between BYOD, remote work arrangements and the new generation of users entering the workforce, people are using, sharing and accessing more information than ever.  Thus, the risk vectors are increasing and this poses a different type of challenge for security professionals.  Some of the topics covered will include:

• Apps and data mining – what is actually being collected about you, your activities and how you use your devices.  Some studies are actually indicating that data mining by apps is more of a threat than malware.
• Social media disclosure and sharing – what the “typical” employee shares on social media and how that can leave a door open to your organization
• Integration of home/work use of computers, phones and tablets…even when BYOD is not part of the accepted policy
• The new workforce – how the new generation of employees generally views security, company loyalty, privacy, data sharing, and self-disclosure via social media 

The presentation will conclude with some recommendations on how to better understand the contemporary insider threat and discuss technologies and solutions that can address the mitigation of risk.

 

About the Speaker

Terry is currently the owner of Mindstar Security & Profiling, LLC.  Mindstar Security and Profiling specializes in custom/concierge security training, consulting, and imminent threat assessment for the commercial industry focusing on high profile and high net worth executives and families.  Training and consultations include a unique perspective and blend of physical/cyber security, intelligence, and behavioral profiling.  Terry provides psychological and behavioral profiling for investigations and offers profiling training in the classroom to security professionals.

 

Prior to forming her own firm in 2013, Terry was the Vice President and Cyber Intelligence Director at Cyveillance, responsible for operations and management of the security/intelligence delivery organization.  Before joining Cyveillance, Terry also held senior positions at SAIC, Psynapse Technologies LLC and Global Integrity Corporation.  Before focusing on the commercial sector, Terry was an operations officer and behavioral profiler at the Central Intelligence Agency (Counter Terrorist Center).  

 

In addition to her corporate related work, Terry has served on the United States Secret Service Advisory Board for Insider Threat; trained investigators at the National Center for Missing and Exploited Children and regularly presents at national and international conferences. Her most current publications include a book on Social Engineering – Low Tech Hacking (2011) and, a book on profiling hackers entitled Malware Profiling (Oct. 2014 – to be released). Terry is also a frequent speaker at the International Spy Museum in Washington, DC.

 

 

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

 

Tuesday, July 15, 2014 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
Washington, DC, 20005

Click here for details.

June 17, 2014 at 6:30 PM

ISSA National Capital Chapter June meeting topic:

Scott Lehman and Tom Hallewell 

The Five Stages of Grief

How to Implement a Software Assurance Program

 

Abstract

Introducing software assurance into your in-house development projects is more a social challenge than a technical one. Elizabeth Kubler-Ross' Five Stages of Grief (Denial, Anger, Bargaining, Depression, and Acceptance) seems like an apt model for the process needed build a robust, effective secure software development program from the ground up.

We will share some of the challenges we encountered while implementing a software assurance program.  We will discuss the various stakeholders, and their varying goals, expectations, and fears.  We will present suggestions based on our experience that may help your program gain acceptance and produce more secure software.  We will briefly describe Continuous Integration/DevOps and discuss some of the security benefits – and risks – that come from this software development approach. 

 

About the Speakers

Scott Lehman
Scott has over two decades of professional development experience in the commercial, government and military sectors.  He leverages this experience in his current Application Security-focused role for a large Federal entity.

 

Tom Hallewell
Tom Hallewell has more than fifteen years experience in the Information Security field.  He has led both development and software security programs.  He is currently engaged in the implemention of enterprise identity management in a large Federal Agency.  He is also a leader in the National Capitol Chapter of ISSA.

 

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

 

Tuesday, June 17, 2014 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

May 20, 2014 at 6:30 PM

  

ISSA National Capital Chapter and OWASP Washington DC Chapter
Joint Meeting

 How To Find Mobile Internet Love (Securely)
by Jack Mannino and Abdullah Munawar

Abstract:
As mobile dating applications grow in popularity, so does our interest in the security posture behind them. There are a vast number of mobile dating applications available for use today by anyone with a smart phone. We wanted to take a look at numerous features within these apps to determine the good, the bad, and the ugly. 

We will cover popular features such as location-based services, analytics, sharing of information, in-app purchasing, and any other features we discover to be interesting. We will analyze the type of personal data being stored within these applications, communication channels used to transmit information, hardware interaction with the application, and interaction with other applications on the device. We will answer the big questions posed by those who use these apps or want to use these apps: Are these applications disclosing sensitive information? How private is the communication between me and another user? How can I be sure my data is being protected?

This talk will feature highlights from popular, obscure, and scary dating applications to answer a simple question: “Can you find love on the Internet without having your personal data exposed?”

 

Jack’s Bio: 
Jack Mannino is an Application Security expert with over a decade of experience building, breaking, and securing into complex systems. Jack is Co-Founder and CEO of nVisium, while also leading research and development initiatives. With experience developing in Java, Objective-C, and C#, he performs risk assessments and penetration tests for Fortune 500 companies and government agencies. Jack also founded and leads the OWASP Mobile Application Security Project, which is a global initiative to build secure development standards for mobile. He is an active Android security researcher with a keen interest in large-scale security analysis.

 

Abdullah’s Bio:
Abdullah Munawar is an Application Security consultant at nVisium who specializes in mobile application testing and ripping apart new things. With over 7 years of experience, Abdullah previously worked on the security teams at financial and aviation organizations. Abdullah attempts humor on a daily basis and succeeds most of the time, every time.

 

 

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

 

Tuesday, May 20, 2014 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
Washington, DC, 20005

Click here for details.

April 15, 2014 at 6:30 PM

ISSA National Capital Chapter April meeting topic:

Dmitri Alperovitch

At Government Printing Office

Abstract
To be announced. 

 

About the Speaker

Dmitri Alperovitch is the Co-Founder and CTO of CrowdStrike Inc., leading its Intelligence, Research and Engineering teams.  A renowned computer security researcher, he is a thought-leader on cybersecurity policies and state tradecraft.  Prior to founding CrowdStrike, Dmitri was a Vice President of Threat Research at McAfee, where he led company’s global Internet threat intelligence analysis and investigations.

In 2010 and 2011, Alperovitch led the global team that investigated and brought to light Operation Aurora, Night Dragon and Shady RAT groundbreaking cyberespionage intrusions, and gave those incidents their names.

In 2013, Alperovitch received the prestigious recognition of being selected as MIT Technology Review’s “Young Innovators under 35” (TR35), an award previously won by such technology luminaries as Larry Page and Sergey Brin, Mark Zuckerberg and Jonathan Ive.

Alperovitch was named Foreign Policy Magazine’s Leading Global Thinker for 2013, an award shared with Secretary of State John Kerry, Elon Musk and Jeff Bezos.

He was the recipient of the prestigious Federal 100 Award for his contributions to the federal information security in 2011 and recognized in 2013 as one Washingtonian’s Tech Titans for his accomplishments in the field of cybersecurity.

With more than a decade of experience in the field of information security, Alperovitch is an inventor of nineteen patented technologies and has conducted extensive research on reputation systems, spam detection, web security, public-key and identity-based cryptography, malware and intrusion detection and prevention.

As a recognized authority on cyberespionage, cyber warfare, online organized criminal activity, and cybersecurity, Alperovitch has significant experience working as a subject matter expert with all levels of U.S. and international policy makers, intelligence and law enforcement agencies on analysis, investigations, and profiling of transnational organized criminal activities and cyber threats from terrorist and nation-state adversaries. He is a well-respected technical and policy thinker on the most difficult global cybersecurity issues, and is a frequent speaker at military, intelligence, law-enforcement, academic and security industry conferences. Alperovitch has published and given numerous talks on the contemporary issues in cybersecurity policy such as cyberdeterrence doctrine, Chinese-sponsored  cyberespionage and the use of cyber weapons on the future battlefield. Alperovitch is frequently quoted as a cyberpolicy and cybersecurity expert source in national publications, including The New York Times, USA Today, and The Washington Post, The Associated Press and Reuters.

Prior to joining McAfee, Alperovitch led the research team and the Cloud Security business unit at Secure Computing.

Alperovitch is currently a Senior Fellow at Atlantic Council and has served on the board of Georgia Tech Information Security Center (GTISC) Industry Advisory Board. He currently serves on the RSA Conference Advisory Board.

Alperovitch holds a master's degree in Information Security and a bachelor's degree in Computer Science, both from Georgia Institute of Technology. 

 

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

 

Tuesday, April 15, 2014 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

March18, 2014 at 6:30 PM

ISSA National Capital Chapter February meeting topic:

 Man-in-the-Browser Session Hijacking
by Raphael Mudge, Strategic Cyber LLC

Abstract 
Two-factor authentication is mainstream now. Most major web services have it as an option. Is this the end of phished accounts? No. Attackers will simply shift tactics.

This talk walks through a man in the browser attack to hijack authenticated web sessions. You will learn different ways a browser may identify itself to a server and one way an attacker can hijack these, regardless of the two-factor user authentication in place.

Demonstrations included.   

 

About the Speaker 
Raphael Mudge is the founder and Principal at Strategic Cyber LLC. His company’s software, Cobalt Strike, helps pen testers and red teams emulate advanced threats. http://www.advancedpentest.com/

 

 

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

 

Tuesday, March 18, 2014 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
Washington, DC, 20005

Click here for details.

February 18, 2014 at 6:30 PM

ISSA National Capital Chapter February meeting topic:

William Jimenez
Deputy Director DC3

Abstract
During a roundtable discussion at Fordham University in New York City, Federal Bureau of Investigation (FBI) Director Robert Muller commented that “the cyber threat will equal or eclipse the terrorist threat and pointed at the proliferation of adversaries in the cyber arena” (fbi.gov).  The proliferation of connected devices or “Internet of Things” enables unique possibilities to integrate technology and simplify our lives.  This technology also creates a vector for criminals and other adversaries to exploit our networks for their own purposes.  In order to combat the proliferation of our adversaries and this threat there are a number of government initiatives underway to assist in protecting our networks, information, and critical infrastructure.   Law enforcement, net defenders, and the intelligence community are also actively engaged in mitigating this evolving threat.  As technology continues to push the boundaries of automation, communications, and information sharing we will continue to contend with cyber criminals who continue to expand their own boundaries.     

 

About the Speaker
William M. Jimenez is the Deputy Director of the Defense Cyber Crime Center (DC3).  As the deputy “Chief Executive Officer” he is responsible for the day-to-day operations of a national cyber center.  He leads DC3’s budget, logistics, procurement, human capital, infrastructure, security, information assurance, and network operations. He also oversees support to DC3’s five organizations which perform deep forensic examinations of electronic media and network intrusions; training for DoD cybercrime investigators, analysts, and digital forensic examiners; technical solutions development and validation of software and hardware used in forensic applications; cyber threat analysis in support of cyber investigations; and critical infrastructure protection through the sharing of threat information with defense industrial base partners.  DC3 operates under the executive agency of the Secretary of the Air Force with program oversight provided by the Air Force Office of Special Investigations.

Prior to joining DC3 Mr. Jimenez held various positions in progressive levels of responsibility with the United States Air Force. This included assignments to HQ Standard Systems Group and the Electronic Systems Center, where he supported Air Force Materiel Command’s mission of delivering dynamic and technologically advanced systems.  He also served combat tours in both Iraq and Afghanistan.

Mr. Jimenez holds a bachelor’s degree in business from George Mason University in Fairfax VA, and masters’ degrees in business from Boston University in Boston MA, and technology management from Columbia University in New York City NY. His professional military education includes Aerospace Basic Course, Squadron Officer School, and Scope Eagle. He is a graduate of the Senior Executive Fellows program at the Kennedy School of Government, Harvard University in Cambridge, MA.

 

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

 

Tuesday, February 18, 2014 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

January 28, 2014 at 6:30 PM

ISSA National Capital Chapter January meeting topic:

Social Engineering to Improve Security Awareness
by Ira Winkler, CISSP

At Government Printing Office

Abstract

While many organizations perform Social Engineering assessments to test their security, they end up being useless games of "gotchas", with results that prove the obvious. Rarely, do they provide recommendations that could not have been found through less expensive, overt methodologies. This presentation provides guidance on performing penetration tests in a systematic way that tests levels of security awareness. The results allow for a very tailored awareness program that is specific to the organization's employee base. As the level of awareness increases, the number and severity of incidents can dramatically decrease.

 

About the Speaker

Ira Winkler, CISSP is President of Secure Mentem. He is considered one of the world’s most influential security professionals, and has been named a “Modern Day James Bond” by the media. Ira is one of the foremost experts in the human elements of cyber security and is known for the extensive espionage and social engineering simulations that he has conducted for Fortune 500 companies globally. He continues to perform these espionage simulations, as well as assisting organizations in developing cost effective security programs. Ira is a noted speaker, media contributor and author of several books most notably Spies Among Us, Corporate Espionage and Zen and the Art of Information Security. He and his work have been featured in a variety of media outlets including CNN, The Wall St Journal, USA Today, San Francisco Chronicle, Forbes, among other outlets throughout the world.

 

Winkler began his career at the National Security Agency, where he served as an Intelligence and Computer Systems Analyst. After leaving government service, he went on to serve as President of the Internet Security Advisors Group, Chief Security Strategist at HP Consulting, and Director of Technology of the National Computer Security Association. He has also served on the graduate and undergraduate faculties of the Johns Hopkins University and the University of Maryland. In addition to his security efforts, Winkler is passionate about health and wellness and has over the past several years and is certified as a Master Scuba Diver Trainer, P90X Certified Instructor and Insanity Certified Instructor. 

 

Ira currently serves as the President of ISSA International, and was recently awarded the CSO Magazine Compass award.

 

 

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

 

Tuesday, January 28, 2014 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

December 17, 2013 at 6:30 PM

ISSA National Capital Chapter December meeting topic:

DNS Security
by Matt Bianco 

Abstract

DNS is critical to the stability of communications on our networks as well as the internet but has largely gone unprotected. This very important service is now being used against us in many types of attacks and coupled with that are all of the new devices being introduced in the modern network. This is a great concern but they all have one underlying commonality……DNS. We will take a look at how mobile device proliferation is adding to the strenuous task of maintaining and allowing access to the network. It also raises the question on how to best protect you from BYOD and network malware. Understanding how malware communicates and exhilarates data through DNS will also highlight the benefits of adding security at that layer and how it can aid in incident response. 

 

About the Speaker

Mr. Bianco has over 14 years of experience in information technology, cyber security, computer forensics, and Technical Surveillance and Countermeasures accumulating multiple industry leading designations in each field.  He is a Certified Information Systems Security Professional (CISSP) and an Encase Certified Examiner (EnCE) and has obtained multiple Microsoft and Cisco certifications.  Mr. Bianco provides technical security guidance and advice to our broad base of customers along multiple verticals.  Prior to Infoblox, Mr. Bianco was Director of Cyber Intelligence at E-merging Technologies Group, Inc.  There he was an elite technical resource providing expert guidance to ETG's customers on a regular basis.  He was an acting “virtual CIO” for ETG’s managed customer base providing them with technology solutions for common and complex corporate problems.   Mr. Bianco graduated cum laude from Myers University with a Bachelor’s Degree in Business Management.

 

 

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

 

Tuesday, December 17, 2013 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

November 19, 2013 at 6:30 PM

ISSA National Capital Chapter October meeting topic:

 

Visualization Tools in SDLC
by Wayne Beekman 

Abstract

Albert Einstein once said, If I can’t see it, I can’t understand it. This is the basis for utilizing visualization tools in the requirements gathering phase of software development projects.

Most projects that fail are due to miscommunication between the business stakeholders and the development team. Visualization tools combat this, allowing you to quickly see your software solution before a single line of code is written. Advanced visualization tools enable extremely rapid prototyping with online publishing and critiquing that can cut the time and cost of requirements gathering in half.

Visualization tools make traditional requirements sessions appear heavy and arduous. The resulting simulation is so rich in functionality that you can actually show your stakeholders what they are going to get. In fact, the prototype is so robust that it can be used for training purposes while the development effort is underway.

This seminar is designed to discuss tools that engage stakeholders and get the requirements right, the first time, before development begins.

 

About the Speaker

Wayne Beekman started Information Concepts in 1982 with his partner, Cary Toor, to provide fixed-price custom software development services to the Public and Private Sectors. Information Concepts specializes in the design and implementation of Mission Critical, Database Applications. Clients include NASDAQ, IRS, and PBS.

For the past 30 years, he has directed the technical direction of the firm, navigating changing technical platforms. Solutions have transitioned from the Mainframe, Client-Server architectures, Web Based projects, to Cloud Based platforms today.

Throughout his tenure, he has always utilized visualizations as part of the requirements gathering planning process.

 

Mr. Beekman holds a BBA and a Masters of Science in Information Systems from George Washington University. He lives in Great Falls, Virginia with his wife and two daughters.

 

 

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

 

Tuesday, November 19, 2013 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
Washington, DC, 20005

Click here for details.

October 15, 2013 at 6:30 PM

ISSA National Capital Chapter October meeting topic:

 

Jack Whitsitt 

Abstract
Over the past several years, "cyber security" has been a term that has both grown in popularity and, in some circles, grown to be disdained by those on the front lines of information security.  On 10/15, Jack Whitsitt - who has spent many years dipping his toes into both perspectives simultaneously - will explore the space that he believes is formalizing around the term, how it differs from traditional views on what security is, what is driving these changes, and how it might affect other areas of computer security practice long term.  Topics covered will include National Critical Infrastructure, Protection vs. Assurance, the NIST Cyber Security Framework draft, the Executive Order, humans as critical vulnerabilities, and the use of nice, traditional coding practices...to create better security policy.

 

About the Speaker
Jack Whitsitt, recently identified by Tripwire as one of the top 10 Rising Stars and Hidden Gems in security education, began his career in security living in a small hacker compound in his teens. Years later, he was involved in early open source honeypot development work, moved into large scale data correlation system design, and has spent the past several years in the critical infrastructure space (including a stint at ICS-CERT, time building a sector specific agency program, and now as an analyst for the non-profit electric sector organization, Energysec).

 

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

 

Tuesday,October 15, 2013 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
Washington, DC, 20005

Click here for details.

September 17, 2013 at 6:30 PM

ISSA National Capital Chapter September meeting topic:

 

Cyber Forensics Strategies for Data Loss Incidents
by Inno Eroraha

 

Abstract
Data breach and ex-filtration continues to cause significant financial damage to businesses. A myriad of solutions are available today that attempt to solve data leak problems. Capabilities such as cyber forensics investigation, incident response, network forensics, memory forensics, and malware analysis are all critical elements to conduct thorough data breach investigations. This presentation discusses some avenues of data leaks and shares some real-world cyber forensics strategies that can speed up and yield thorough data loss/leak investigation results.

 

About the Speaker
Inno Eroraha is the Founder and Chief Strategist of NetSecurity® Corporation, a computer forensics, cyber security and training company based in Dulles,Virginia. His main responsibility is to position NetSecurity as “the brand of choice for forensics, security, and training,” by delivering high-quality, timely, and customer-focused solutions. Mr. Eroraha oversees NetSecurity’s day-to-day operations, including the proprietary HANDS-ON HOW-TO® training program and the state-of-the-art NETSECURITY FORENSIC LABS. He leads the execution of NetSecurity’s solutions and helps clients protect, defend, and recover valuable assets from cyber attacks and computer fraud. He has been consulted by Fortune 500 companies, financial institutions, IRS, DHS, DoD, and other premier organizations to solve hard cyber security problems.

Before founding NetSecurity, Mr. Eroraha was a senior manager of information security at VeriSign, Inc. In this capacity, he led the implementation of solutions to protect critical Internet infrastructures. As an advocate, he significantly heightened security awareness among internal and external stakeholders and key decision makers. Inno Eroraha also worked for information security consulting practices at Network Associates(now McAfee), Trusted Information Systems, Smartronix, SAIC, and other consulting firms.

Mr. Eroraha has contributed to the field of computer security and forensics, often speaking, authoring, or consulting with media outlets on security and forensics topics. 

Mr. Eroraha graduated cum laude with dual-bachelor degrees in mathematics and computer science from Morgan State University. He also received a masters degree in computer science from The George Washington University. Additionally, he has received industry certifications that include CISSP, ISSAP, ISSMP, CISM, CISA, CHFI, CCSE, and CCSA. Mr. Eroraha is a member of FBI InfraGard, High Technology Crime Investigation Association (HTCIA), (ISC)2, ISSA, and ISACA.

 

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

 

Tuesday, September 17, 2013 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
Washington, DC, 20005

Click here for details.

August 20, 2013 at 6:30 PM

ISSA National Capital Chapter August meeting topic:

What's Hiding in Your Software Components?  Hidden Risks of Component-Based Software
by Bruce Mayhew

Abstract
What's Hiding in Your Software Components?  Hidden Risks of Component-Based Software

Software is no longer written, it's assembled. With 80% of a typical application now being assembled from components, it's time to take a hard look at the new risks posed by this type of development -- and the  processes and tools that we'll need in order to keep them in check.

On the just released OWASP Top 10 for 2013, entry A9 highlights the potential problems associated with the widespread use of open-source components with known security vulnerabilities in modern-day application development.

Join Bruce Mayhew,  as he shares real world data on component risks, outlines the scope of the problem, and proposes approaches for managing these risk. You'll learn how security professionals can work cooperatively with application developers to reduce risk AND boost developer efficiency.

 

About the Speaker
Bruce Mayhew is the Director of Security Products at Sonatype with over 20 years of software development experience, 13 years of which have been focused on application security.  He has performed code-level security assessments for hundreds of applications, created application security programs and training curriculums for large institutions, and has been a Web Application Security Course instructor for the SANS Institute.  Bruce is the primary author and project lead of OWASP WebGoat, a deliberately insecure JavaEE educational application. He is an author of the SANS GSSP Secure Programming Assessment and a frequent speaker on application
 security topics.

 

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

 

Tuesday, August 20, 2013 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

July 16, 2013 at 6:30 PM

ISSA National Capital Chapter July meeting topic:

Transforming your SOC for Big Data Analytics -- Rationale and Strategy
by Eddie Schwartz

Abstract
Despite the best efforts and significant investments of security teams, various classes of threat actors continue to wreak havoc within organizations today.  The challenge for our profession is how to reduce the impact of unknown and unexpected attacks and risks when traditional security technologies, processes, and skills have proven to be inadequate.  Big data is transforming security operations centers in government agencies and the private sector.  This session will describe the rational for a movement from traditional approaches to security management to big data, and a sensible approach to people, process, and technologies.

 

About the Speaker
Eddie Schwartz is Chief Security Officer for RSA and has over 25 years experience in the information security field.  Previously, he was Co-Founder and CSO of NetWitness (acquired by EMC), CTO of ManTech, EVP and General Manager of Global Integrity (acquired by INS), SVP of Operations of Guardent (acquired by VeriSign), CISO of Nationwide Insurance, a Senior Computer Scientist at CSC, and a Foreign Service Officer with the U.S. Dept. of State.   Mr. Schwartz has advised a number of early stage security companies, and served on the Executive Committee for the Banking Information Technology Secretariat (BITS).  Mr. Schwartz has a B.I.S. in Information Security Management and an M.S. in Information Technology Management from the George Mason University School of Management.  Mr. Schwartz is a 2013 recipient of the Computerworld Premier 100 IT Leaders Award and is the Treasurer of the ISSA-DC Chapter.

 

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

 

Tuesday, July 16, 2013 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
Washington, DC, 20005

Click here for details.

June 18, 2013 at 6:30 PM

ISSA National Capital Chapter June meeting topic:

When Less Is More, the Thin Slicing of a Black Swan 
by Michele Chubirka and Ronald P. Reck

Abstract

As infosec professionals we are swimming in prodigious amounts of data, but it isn’t making us better at our jobs, it seems to make us worse. In Verizon’s 2012 Data Breach Investigations Report, it was found that across organizations, an external party discovers 92% of breaches. We continue to desperately grasp at that straw of, “more data,” but what if this is simply information gluttony? Incident response's bloated model drives it closer to a form of security archaeology rather than its promise of real time relevance.

 

About the Speakers

Michele Chubirka aka "Mrs. Y."
Mrs. Y is a recovering Unix engineer most recently assigned to the network security team of financial services provider. Likes long walks in hubsites, traveling to security conferences, and spending extended hours in the Bat Cave. Believes that every problem can be solved with a "for" loop. She also hosts a podcast called Healthy Paranoia, a security feed of Packetpushers. 

Ronald P. Reck
Ronald P. Reck is formally trained in theoretical syntax, an author of countless papers on linguistics and a book on RDF. He has worked extensively with the intelligence community and law enforcement, implementing standards for data and knowledge representation.

 

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

 

Tuesday, June 18, 2013 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

May 21, 2013 at 6:30 PM

ISSA National Capital Chapter May meeting topic:

Outcome Based Security
in a Continuous Monitoring World
by Ron Gula

Abstract
The speaker will discuss how large scale enterprises security programs are combining their compliance and security monitoring solution into continuous monitoring efforts. He will review why SIMs, GRC, anti virus, IDS, patch management and many other types of enterprise security technologies fail at scale and how they can be best used in a continuous monitoring effort.

 

About the Speaker
Ron Gula is known in the global security community as a visionary, innovator, and engineer of extraordinary talent. He traces his passion for his work in security to starting his career in information security at the National Security Agency conducting penetration tests of government networks and performing advanced vulnerability research. Since co-founding Tenable Network Security in 2002, Ron has been CEO and CTO at Tenable, maker of the world-renowned Nessus® vulnerability scanner and Unified Security Monitoring™ architecture. As CEO/CTO of Tenable, he is responsible for product strategy, research and development, and product design and development. Ron is also a leader in his community and a passionate advocate for education and scientific research.

 

Prior to Tenable, Ron was the original author of the Dragon IDS and CTO of Network Security Wizards, which was acquired by Enterasys Networks. At Enterasys, Ron was Vice President of IDS Products and worked with many top financial, government, security service providers, and commercial companies to help deploy and monitor large IDS installations. He was also the Director of Risk Mitigation for US Internetworking and was responsible for intrusion detection and vulnerability detection for one of the first application service providers. Ron also worked for BBN and GTE Internetworking where he conducted security assessments as a consultant, helped to develop one of the first commercial network honeypots, and helped develop security policies for large carrier-class networks.

 

Ron has a BS from Clarkson University and an MSEE from the University of Southern Illinois. He was the recipient of the 2004 Techno Security Conference "Industry Professional of the Year" award. In SC Magazine's 20th Anniversary Edition, Ron was named as one of the top market entrepreneurs for the past 20 years.

 

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

 

Tuesday, May 21, 2013 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
Washington, DC, 20005

Click here for details.

 

April 16, 2013 at 6:30 PM

ISSA National Capital Chapter April meeting topic:

Social Media Smarts

By Michael Janke

 

Abstract:

Social media is transforming how organizations do business. The speed, interactivity, and community aspects of social media make it ideal for ongoing customer and partner interaction, collaborative work of all types, timely or urgent notifications, and tailored-targeted ads and promotion.  Social media lets people communicate and work when and how they want, via richer modes and means of expression.

 

Yet, as with most things, the benefits of Social Media come have counterbalances. The access, speed, familiarity, and amplification inherent in social media channels raise the potential risks. Users need to be more vigilant about the content they communicate and exchange; have clear understandings of who will receive or have access to their exchanges; and keep legal and business implications in mind. For example, several retail organizations send product promotions over social media. These promotions are financial records and must be treated as such. To boot, the retailers must know who the recipients are, and carefully craft eligibility, terms, and any regulatory implications.

 

About the speaker

Michael Janke, CEO & Co-Founder of Silent Circle a Silicon Valley, Washington DC & London based Internet Tech Firm. Best-Selling author: Take Control- mastering the art of self-discipline.Board Member/Part-Owner -SOC: Large-diversified Defense Contracting firm providing Logistics-Construction-Security services worldwide.Owner and Board Member of Security Management Group International (SMGI) .Former Navy SEAL.

 

 

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

 

Tuesday, April 16, 2013 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

March 19, 2013 at 6:30 PM

ISSA National Capital Chapter March meeting topic:

SCADA Cyber Security for the Smart Grid

By Dewan Chowdhury

 

Abstract:

Our society is evermore dependent on the use electricity for its self-preservation, economic development, and future growth; but few truly appreciate how this energy is being delivered to your home or office. Power companies through out the world are upgrading their power infrastructure to utilize technological advances that Tesla and Edison would only dream of.  The upgrade to the power grid is allowing power companies to collect analytics they never could before, and help transform their power grid to a “smart grid”.  The move to the smart grid is ever dependent on the use of computing devices that help monitor and control power to ensure reliable electricity to the consumer.  The introduction to more computing devices to the smart grid network also introduces new cyber threats that can affect the availability and integrity of power.  If successful the cyber threats against the smart grid can have dire consequences to our society.  It’s much easier and cost effective for an adversary to attack critical infrastructure using cyber weapons to cause disruption to our energy supplies.  This presentation will educate how the power grid/smart grid works, the fundamentals of power delivery, cyber threats against the power grid/smart grid.

 

About the speaker

Dewan is a recognized cyber security expert for critical infrastructure/SCADA Systems, and has over 15 years of experience in the industry. Dewan has diverse experience in cyber security support from managing security operation centers for some of the largest organizations in the world, malware reverse engineering, cyber counterintelligence, advanced persistent threat.  Dewan currently specializes in targeted threats from nation state and industrial espionage targeted toward industrial control systems. Dewan continues to provide incident response/handling for Industrial Control Systems/SCADA (gas, oil, power utilities). Federal agencies (DOD, DHS, etc.) utilize his cyber security expertise on SCADA systems to help understand threat landscape and measures to protect critical infrastructure.

 

 

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

 

Tuesday, March 19, 2013 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

February 19, 2013 at 6:30 PM

ISSA National Capital Chapter January meeting topic:

What is Cyber and How Do We Test It?
by Peter H. Christensen

Abstract:

This presentation will be of interest, not just to those working for the DOD, but also to anyone working in the Information Security Arena. The term "Cyber" is an ambiguous term that is liberally applied as a prefix to just about anything! In fact the term Cyberspace, as used today is used to connect Social, Information and Physical Networks. Threats in Cyberspace are realized by exploiting vulnerabilities that expose critical information. The risks in Cyberspace are bad and getting worse. The Joint Capabilities Development, DOD Acquisition and Security Certification and Accreditation Processes as currently executed are not helping to mitigate these vulnerabilities. We must change the paradigm and begin by focusing on the impact of the Cyber Threat impact on critical missions. The relationship between the mission and supporting systems must be  understood and protected as part of design and development. Cyber Test and Evaluation as well as Security Certification and Accreditation must focus on identification and mitigation of in design, development and test earlier in the process to shift defect discovery to left! DOD is working to change the paradigm and we will discuss some initiatives currently in work.

 

About the speaker

Pete is currently employed by the MITRE Corporation as the Test and Evaluation Integrator for Joint & Defense-Wide Programs. In that role he is responsible for coordinating Test and Evaluation Activities across the DOD Portfolio. Pete supports several DOD sponsors including DASD DT&E, TRMC and OSD DOT&E.

From 2001 through 2006, Pete served on Intergovernmental Personnel Assignment with the Marine Corps Operational Test and Evaluation Activity as the Assistant Scientific Advisor and in 2006 as the Scientific Advisor. During that time he lead OTA sponsored working groups to address Information Assurance and Net Ready KPP. In addition, he provided oversight and direction to the OT&E of the M777 Lightweight 155 Howitzer, Expeditionary Fighting Vehicle and approximately 50 C4ISR Systems.

Pete serves on the Board of Directors for the International Test and Evaluation Association (ITEA) and also chairs the Ways and Means Committee. He has been a Short Course and Tutorial Instructor and he has Co Authored several articles in the ITEA Journal. 

Pete is an Adjunct Professor in the Information Systems Masters Program at Capitol College in Laurel Md. teaching courses in Network Systems Security Concepts and Malicious Software courses.

Pete retired from the U.S. Navy in 1995. He had a wide range of assignments as a Naval Flight Officer flying EA-6B Prowlers. His last operational flying tour was with VAQ-136 on USS Midway. His last Navy assignment was as a Program Manager in the Advanced Tactical Aircraft Protection Systems Program Office (PMA-272) where he managed three EW programs.

Pete is married to Maryanne Friedrichs, from Menasha Wisconsin, so he is a Green Bay Fan. His son Chris, is a Notre Dame Grad and so he is also an Irish Fan. He is the proud Grandfather of William and Victoria Luckey. 

 

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

 

Tuesday, February 19, 2013 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

January 15, 2013 at 6:30 PM

ISSA National Capital Chapter January meeting topic:

Sharing Threat Information to Improve Cyber Defense 
by Douglas Wilson

Abstract:
Doug will discus some of the entrenched problems in the security arena that prevent organizations from quickly sharing threat intelligence without translation or communication errors. Solving those problems is a key component to improving modern incident response and computer network defense. This talk will discuss a variety of issues surrounding sharing threat intelligence, and some suggestions on how to tackle some of the problems from the technical side using open standards to communicate threat intelligence. It will also include discussion of possible solutions for some of the layer 8 problems involved, and introduce the community to some of the open standards that are available (OpenIOC, MITRE's STIX/TAXII, and the IETF's RID/IODEF). Doug will conclude with ways that the community can get involved, and things that are really needed to move this effort forward so that everyone can benefit. (Full Disclosure -- Doug is one of the stakeholders in OpenIOC (http://openioc.org))

 

About the speaker

Doug Wilson is the Threat Indicators Team Lead and a Principal Consultant at Mandiant. He lives in DC, and in an effort to try to get the ridiculously large community of Infosec nerds in this town to interact on a more regular basis, Doug has had his fingers in various local security pies over the years, such as founding the OWASP DC chapter, AppSec DC, and CapSec DC. He's gotten to take his passion for getting people to share information and interact into the workplace in the past year, having been the spokesperson for Mandiant's open-sourced threat information sharing standard, OpenIOC (http://openioc.org).

 

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

 

Tuesday, January 15, 2013 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

 

December 11, 2012 at 6:30 PM

The ISSA National Capital Chapter invites you to attend this month's meeting at SANS Cyber Defense Initiative 2012 -

The National Capital Chapter has partnered with the SANS Institute again this year to offer exclusive access for its members to SANS@Night events at Cyber Defense Initiative 2012. The monthly chapter meeting will take place at Washington Hilton on Tuesday, December 11, 2012. We will also announce the results of 2012 Election for ISSA-DC Chapter Officers. 

The chapter members and their guests will have access to the following events:

8:30pm - 9:30pm
Gamification: Hacking Your Brain for Better Learning by Yori Kvitchko 

Please note that RSVP is required.
You can pick up your badge at the registration desk on the day of the event.
 

Tuesday, December 11, 2012
There is no charge to attend and non-members are welcome. Light refreshments will be served. 
RSVP is mandatory.

 

 

November 20, 2012 at 6:30 PM

ISSA National Capital Chapter November meeting topic:

Angelos Stavrou

Abstract:
Recent advances in the hardware capabilities of mobile hand-held devices have fostered the development of open source operating systems and a wealth of applications for mobile phones and table devices. This new generation of smart devices, including iPhone and Google Android, are powerful enough to accomplish most of the user tasks previously requiring a personal computer. 

In this talk, Dr Stavrou will discuss the cyber threats that stem from these new smart device capabilities and the online application markets for mobile devices. These threats include malware, data exfiltration, exploitation through USB, and user and data tracking. We will present the ongoing GMU and NIST efforts to defend against or mitigate the impact of attacks against mobile devices. Our approach involve analyzing the source code and binaries of mobile applications, hardening the Android Kernel, using Kernel-level network and data encryption, and controlling the communication mechanisms for synchronizing the user contents with computers and other phones. Dr Stavrou will also explain the enhanced difficulties in dealing with these security issues when the end-goal is to deploy security-enhanced smart phones into military combat settings. The talk will conclude with a discussion of our current and future research directions.

 

About the speaker
Dr. Angelos Stavrou is an Associate Professor at George Mason University and the Associate Director Center for Secure Information Systems. Stavrou has served as principal investigator on contracts from NSF, DARPA, IARPA, AFOSR, ARO, ONR, and he is an active member of NIST's Mobile Security team and has written more than 40 peer-reviewed conference and journal articles. Stavrou received his M.Sc. in Electrical Engineering, M.Phil. and  Ph.D. (with distinction) in Computer Science all from Columbia University. He also holds an M.Sc. in theoretical Computer Science from University of Athens, and a B.Sc. in Physics with distinction from University of Patras, Greece. His current research interests include security and reliability for distributed systems, security principles for virtualization, and anonymity with a focus on building and deploying large-scale systems. Stavrou was awarded with the 2012 George Mason Emerging Researcher, Scholar, Creator Award, a university-wide award. He is a member of the ACM, the IEEE, and USENIX.

Over the past few years, Dr. Stavrou's research has focused on two aspects of security: Systems' Security and Reliability. In the context of the first, he is working with NIST as part of the DARPA “Transformative Applications” project that involves securing Android mobile phone devices against kernel-level attacks. Furthermore, Stavrou is the GMU PI participating along with Columbia, Stanford, and Symantec in the IARPA “StoneSoup” effort. In addition, the PI is funded by DARPA under the CyberGenome project to perform analysis on the phylogenetic origins of malware. Dr. Stavrou is currently supported by a NSF Trustworthy Computing (NSF-CNS- 0915291) grant on “Scalable Malware Analysis using Lightweight Virtualization”. This effort seeks efficient methods to collect and analyze the nature of Internet malfeasance.  

 

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

 

Tuesday, November 20, 2012 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

October 16, 2012 at 6:30 PM

ISSA National Capital Chapter October meeting topic:

Derek Melber and Paul Andrew
Creating a Secure Desktop

 

Abstract
This session covers the key aspects of how end-points become attack vectors. We will cover all of the key aspects that we did in the ISSA session, with demos of the PB products. There are some key issues which can be solved with software, but most companies are not aware the software exists. We will start the session describing what an endpoint can do to the environment. We will then discuss the potential issues with solving this, specifically with trying to remove the user from being a local administrator. We will also cover whitelisting, LM authentication, firewalls, and more.
 
In this one hour session, Group Policy MVP Derek Melber will go over some of the most important--yet often forgotten--security settings for Windows desktops. Settings like LanManager, Anonymous, IE, UAC, etc will be covered and you will see why these settings are so important for every corporation. Learn about common mistakes in Windows Security and how to avoid them, as well as how adopting least privilege can help protect you against malware and insider threats.
 
When you leave this session, you will have learned:

- How to secure the use of LAN Manager for your entire enterprise
- How to disable anonymous access to your domain controllers and servers
- What options are available to control and configure IE security
- Why UAC is so important and what it does for security
- Even more security settings inside of Windows Group Policy
 

About the speakers
Derek Melber (MCSE, MVP) is an independent consultant and speaker, as well as author of many IT books. Derek educates and evangelizes Microsoft technology, focusing on Active Directory, Group Policy, Security, and desktop management. Derek is President and CTO of BrainCore.Net. As one of only 8 MVPs in the world on Group Policy, Derek's company is often called upon to develop end-to-end solutions regarding Group Policy and security for companies. Derek is one of only a few in the industry that has a deep knowledge of Group Policy, Group Policy Preferences (AKA PolicyMaker), and Advanced Group Policy Management (AGPM). Derek is the author of the The Group Policy Resource Kit by Microsoft Press. This book covers all aspects of the new features provided for Group Policy in Windows Server 2008 and 7. Derek also wrote a series of books related to Auditing and Security Windows through the IIA. Derek is a contributing editor for WindowSecurity.com, RIAG Journal, IT Audit newsletter, and various other publications. You will most likely see Derek at one of the many conferences that he speaks at including InfoSec World, Windows Connections, MISTI, ISACA, and the IIA. Derek provides Windows security training through MISTI and also delivers custom training and speaking on nearly all Windows topics. Program Chair's Note: I saw Derek in April at ISSA give the first talk, and it was superb. In addition, David Merritt also gives him Derek an enthusiastic thumbs-up.

Paul Andrew is a Senior Sales Manager at BeyondTrust Software. In this role, for over six years, Paul has been a pioneer in the rapidly growing Desktop Security Industry, helping organizations successfully implement a Least Privilege Security Environment. Paul manages all day-to-day customer needs and he is responsible for increasing the already high demand for the BeyondTrust PowerBroker Product Suite. Paul manages all large Commercial Accounts, Government Agencies and Education clients. Paul also brings over 20 years of sales and sales management experience with other fast growing technology companies, including PC/GovConnection, Ecora Software, W.L Gore & Associates (GORE-TEX®) and Groundwater Technology, Inc.
 
Paul holds a B.S in Geology from the University of New Hampshire. In addition, Paul has also held various research positions within the National Marine Fisheries Service (NMFS) and Woods Hole Oceanographic Institution (WHOI). While working at the NMFS and WHOI, Paul was Head of Deck Operations, staging several research cruises, while at Sea. Paul has also authored or co-authored 3 volumes of Marine Sediment Core and Rock Descriptions and one Technical Publication describing Thermistor Probe Construction, which was used in support of WHOI Marine Heat-Flow research programs.
 

 

 

 

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

 

Tuesday, October 16, 2012 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

September 18, 2012 at 6:30 PM

ISSA National Capital Chapter August meeting topic:

Open Source and Security 
by Phil Odence, Black Duck Software

 

Abstract
Mr Odence will discuss the security challenges associated with the use of open-source libraries.

 

About the Speaker
Phil Odence is responsible for expanding Black Duck’s reach, image and product breadth by developing partnerships in the multi-source development ecosystem. He is in charge of building the company’s growing network of international resellers and launched Black Duck’s legal certification program. A frequent speaker at open source industry events, Phil chairs the Linux Foundation’s Software Package Data Exchange (SPDX) working group and is a blogger for NetworkWorld http://www.networkworld.com/community/odence.

He came to Black Duck from Empirix where he served as Vice President of Business Development and in other business management positions. Prior to Empirix, Phil was a partner and ran consulting at High PerformanceSystems, a startup computer simulation modeling firm. He began his career with Teradyne’s electronic design and test automation group in product, sales and marketing management roles. He has an AB in Engineering Science and an MS in System Simulation from Dartmouth College.

 

 

 

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, September 18, 2012 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

August 21, 2012 at 6:30 PM

ISSA National Capital Chapter August meeting topic:

Advanced Persistent Threats (APT’s)
A Balanced Approach for Survivability and Sustainability in the Cyber Realm

by Curtis Levinson
United States Cyber Defense Liaison to NATO

 

Abstract
Advanced Persistent Threat (APT):   APTs are attacks on US information technology and telecommunications infrastructure by known nation-state and other bad actors.  These attacks are currently taking the form of Phishing and Spear Phishing attacks on US assets both government and industry.  Phishing attacks are extremely difficult to detect and it appears from public sources that a portion of the attacks are coming from (spoofed) trusted domains, which makes filtering even more difficult.  The primary remedy to such attacks is a combination of extreme user education/training and comprehensive Business Continuity Planning and Disaster Recovery (BCP/DR/COOP) implementation.  Users need to be educated as to what acceptable practices are for eMail messages with embedded URLs and the urgent need to NOT CLICK on embedded URLs.  Any questions as to the nature of the destination of the embedded URL MUST be directed to the message author, NOT acted upon in the eMail note itself.   Since bad things can, do and will continue to happen, recovery plans, programs and techniques must be up to the task of restoring critical functions as soon as possible.  The quicker we can recover, the more ineffective the attack.

 

About the Speaker
Curtis Levinson has over 25 years of focused experience in Cyber Security and Information Assurance. He is a highly experienced risk assessor and technology architect specializing in all phases of the security engineering process including regulatory compliance, policy formulation, cyber attribution and forensics, risk analysis, network/system hardening and resilience, implementation, testing, certification and accreditation, operations, training and managing the security of information and telecommunications systems in a wide variety of environments.

Mr. Levinson was selected by NATO (North Atlantic Treaty Organization) to represent the United States as an advisory subject matter expert on Cyber Defense for the IRCSG (Industrial Resources and Communications Services Group). This group falls under NATO’s Civil-Military Planning and Support Section, which is essential to the Alliance’s common defense and security.

Mr. Levinson's professional certifications include: Master Business Continuity Planner, Certified Data Professional, Certified Information Systems Security Professional, Certified Business Continuity Planner and Certified Homeland Security Professional. He is a graduate of the American University in Washington, DC and the London School of Economics in London, England. He has also completed post graduate course-work at the National War College, Columbia University, and the Wharton School of Business.

 

 

 

 

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, August 21, 2012 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

July 17, 2012 at 6:30 PM

ISSA National Capital Chapter July meeting topic:

The Easy Stuff

by Marcus Ranum
CSO, Tenable Network Security, Inc.

Abstract
Marcus will discuss why the most important trend-lines in computer security are backward from the direction that's most likely to end in success. This will be a short-term situation but it will be the reality of affairs for most of our careers.

 

About the Speaker
Marcus J. Ranum, Chief Security Officer of Tenable Security, Inc., is a world-renowned expert on security system design and implementation. Since the late 1980's, he has designed a number of groundbreaking security products including the DEC SEAL, the TIS firewall toolkit, the Gauntlet firewall, and NFR's Network Flight Recorder intrusion detection system. He has been involved in every level of operations of a security product business, from developer, to founder and CEO of NFR. Marcus has served as a consultant to many FORTUNE 500 firms and national governments, as well as serving as a guest lecturer and instructor at numerous high-tech conferences. In 2001, he was awarded the TISC "Clue" award for service to the security community, and also holds the ISSA lifetime achievement award. In 2005 he was awarded Security Professional of the Year by Techno Security Conference.

 

 

 

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, July 17, 2012 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

June 19, 2012 at 6:30 PM

ISSA National Capital Chapter June meeting topic:

Coming Together In Steady State and During an Incident
by Denise Anderson, Vice President Programs and Services,
Financial Services Information Sharing and Analysis Center

 

Abstract
Information Sharing and Analysis Centers (ISACs) provide a trusted forum for participating members to share threat and incident information within critical infrastructure sectors. They also help establish and maintain situational awareness and facilitate joint analysis. Yet, the role and capability of ISACs remain poorly understood. This session will provide an overview of what an ISAC is and will use case studies to demonstrate specifically how ISACs contribute to critical infrastructure security and resilience. Case studies will include specific examples from incidents, examples of collaboration with the Government and other sectors, as well as examples of collaboration within sectors.

and
The Continuity / Security Convergence
by Paul R. Lazarr, Managing Consultant,
Cybersecurity and Privacy IBM Global Business Services - US Federal Team

About the Speakers
Denise Anderson has over 25 years of management level experience in the private sector in Finance, Operations, Sales and Marketing, Public Relations/Publications, Administration and Information Technology. Denise is Vice President FS-ISAC, Government and Cross Sector Programs at the Financial Services Information Sharing and Analysis Center (FS-ISAC), a non-profit association comprised of financial institution members that is dedicated to protecting the financial services sector from physical and cyber attacks and incidents through dissemination of trusted and timely information.

At the FS-ISAC, Denise serves on numerous committees and working groups including the Account Take Over Task Force, the Business Resiliency Committee, the Threat Intelligence Committee, the Education Committee and the Online Fraud Working Group and coordinates with DHS on National Level Exercises and Cyber Storm. Denise is also part of the Financial Services Sector Coordinating Council (FSSCC) Crisis Management and Sector-Wide Activities Committees [More].

 

 

 

Please RSVP if you plan to attend.
Non-members are welcome without charge!  Light refreshments will be served.

Tuesday, June 19, 2012 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

 

March 20, 2012

Security of Large Technical Systems
by Marcus Sachs
Vice President, National Security Policy at Verizon Communications

Abstract

The Industrial Age of the 19th and 20th Centuries was marked by the development and growth of machinery and technology designed to simplify or replace manual tasks.  Early simple methods of mechanization and automation led to highly complex systems that required new techniques for control and management to prevent catastrophic failure or destruction.  The post-World War II era, especially the early years of the Cold War, were characterized by an explosion of Large Technical Systems (LTSs), a term coined by technical historian Thomas Hughes in his book "Networks of Power: Electrification in Western Society 1880 – 1930".  This talk looks at modern LTSs and asks a simple question:  Can they be secured?  In particular, can the Internet - the ultimate LTS - be secured?  Or have we literally built a Frankenstein Monster that demands a change in how we define "security" in order to tame it?

As a bonus, the speaker will also reveal a few of the conclusions coming later this month in the annual Verizon Data Breach Investigations Report.  Be sure to attend to get an early peek at the 2012 findings!

 

About the Speaker
Marcus Sachs is the Vice President for National Security Policy at Verizon in Washington, D.C. where he works closely with government and business stakeholders in task forces, working groups, committees, and trade associations as part of the National Security/Emergency Preparedness (NS/EP) community in the Nation's Capital. In January 2011 he was elected to be the Vice Chair of the US Communications Sector Coordinating Council. In November 2007 Mr. Sachs was named a member of the Commission on Cyber Security for the 44th Presidency. From August 2003 to December 2010 he directed the all-volunteer SANS Internet Storm Center.

 

Mr. Sachs' professional experience includes a 20 year military career in the United States Army, two years of federal civilian service at the White House and the Department of Homeland Security, and over six years as an executive in the private sector. He has appeared on several domestic and foreign television and radio networks as a computer security expert, has testified before the United States Congress, and is frequently quoted by the on-line and printed media. Mr. Sachs volunteered as the Director of the SANS Internet Storm Center and currently volunteers as the Corporate Evangelist of the Zeroday Emergency Response Team. He serves on the technical advisory board of SAGE Inc., the board of advisers of ThreatStop, Inc., and is a member of the National Cyber Security Alliance, Internet Security Alliance and DShield, Inc. boards of directors [more].

 

 

 

 

Please RSVP if you plan to attend.
Non-members are welcome without charge!  Light refreshments will be served.

Tuesday, March 20, 2012 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

 

February 21, 2012

The Future of Cyber Security and Digital Forensics
by Greg Kipper

Meeting sponsor

 

 

Abstract

 

 

About the Speaker
Gregory Kipper is an author, speaker, consultant and and strategic forecaster in Emerging Technologies. Mr. Kipper specialized in I.T. Security and information assurance for 18 years with the last 12 years working in the field of digital forensics and the impacts emerging technologies have on crime and crime fighting. Mr. Kipper is a trusted advisor to both the government and commercial sectors providing thought leadership and innovative solutions by bridging the gap between today's challenges and tomorrow's technology. He has been the keynote speaker at popular industry events, a digital forensics instructor and is a published author in the field of digital forensics and emerging technologies with his works including: "Investigator's Guide to Steganography", "Wireless Crime and Forensic Investigation", "Virtualization and Forensics" and the upcoming "Augmented Reality".

 

 

 

Please RSVP if you plan to attend.
Non-members are welcome without charge!  Light refreshments will be served.

Tuesday, February 21, 2012 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

 

January 17, 2012

Attribution and Response

Paul de Souza, Founding Director
Cyber Warfare Division, Cyber Security Forum Initiative

 

Abstract
The attribution problem is critical to a number of puzzling cyber security dilemmas.  Attribution is one of the main issues faced by nations when responding to cyber-attacks.  While tracing the origin of attack through a confusing network of proxy servers or infected bots is technically challenging, enough attribution can be attained through the use of creativity, deception, and unique techniques.  Mr. de Souza will cover an attribution framework, which can be used by organizations and countries looking for higher attribution levels so the appropriate response can be materialized in a timely manner.

Meeting sponsor

Join us for a chance to win Paraben’s iRecovery Stick!

About the Speaker
Paul de Souza is the Founder/President/Director of CSFI (Cyber Security Forum Initiative) and its divisions CSFI-CWD (Cyber Warfare Division) and CSFI-LPD (Law and Policy Division).  CSFI is a non-profit organization with headquarters in Omaha, NE, with offices in Washington, D.C.  Paul has over 13 years of cyber security experience and has worked as a Chief Security Engineer for AT&T, where he designed and approved secure networks for MSS.  Mr. de Souza also worked for CSC and US Robotics as a Security Engineer.  Paul has consulted for several governments, military organizations, and private institutions on best network security practices and also presented in Estonia, the country of Georgia, Australia, Czech Republic  and all across the United States.

 

 

 

Please RSVP if you plan to attend.
Non-members are welcome without charge!  Light refreshments will be served.

Tuesday, January 17, 2012 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

 

February 16, 2010

Dangers of Web Application Vulnerabilities
by Jack Mannino

 

Abstract:
Web applications have become an attacker's best friend in recent years, and a security team's worst nightmare. Nearly every organization has a public web presence, and these numbers continue to grow daily with initiatives such as Government 2.0 and the rapid shift to cloud computing. While many groups have invested heavily in securing their networking infrastructure, web applications generally have not been afforded the same level of attention. The result is that nearly 70% of all public web applications contain critical vulnerabilities that may result in significant data losses.

Most people have heard of vulnerabilities such as Cross Site Scripting and SQL Injection. While these issues get the most attention, there is certainly more than one way to skin a cat. An attacker doesn't always need to gain root level access to a system or use cutting-edge techniques in order to achieve his or her goals. The purpose of this presentation is to move beyond industry buzzwords and acronyms to demonstrate how various other techniques can be used to compromise your critical applications and networks.

Speaker Bio
Jack Mannino is the CEO of nVisium Security Inc., an emerging security firm within the DC area. Specializing in the application security field, nVisium Security regularly provides expert solutions such as vulnerability assessments, penetration testing, and source code reviews. Jack is a huge believer in the idea that a little security planning upfront will pay huge dividends throughout the duration of an application or system's lifetime.  His recent research projects include discovering new ways to leverage Flash vulnerabilities, as well as developing new techniques to improve the efficiency of web fuzzing technologies.

Prior to founding nVisium Security, Jack held several positions in both the government and private sectors. He was a senior application security engineer at Engineering Services Network, where he helped institute security programs for organizations such as the DOD, VA, and SBA. Jack was also a member of BT's Ethical Hacking group in which he performed web application penetration testing and vulnerability assessments for Fortune 500 companies and financial institutions. He is also a veteran of the United States Navy.

 February 16, 2010 6:30 PM

George Washington University
801 22nd Street NW
Room B149 (One floor below lobby)
Washington, DC 20052
View details

Please RSVP if you plan to attend.