Join us on Tuesday, June 18 for our monthly chapter meeting with a special guest speakers:

Must here register if you plan to attend.

Practical Security Radio

 January 16, 2018 at 6:30 PM

Advanced Persistent Security
by Ira Winkler

This talk will feature Ira's new book 
Advanced Persistent Security: A Cyberwarfare Approach to Implementing
Adaptive Enterprise Protection, Detection, and Reaction Strategies.
Make sure to bring your copy and have it signed by the author.   

Abstract
There is a great deal of hype out there regarding Advanced Persistent Threats, sophisticated attackers, and otherwise unstoppable attackers. The reality is that just about all attackers can be stopped with the appropriate security programs in place. The problem is however that few security programs are designed in a way to be effective at stopping any committed attacker. Another problem is that there is a failing in security programs as to what they should actually do. In this presentation, Ira contends that security programs should be designed to stop attackers from getting out; not necessarily stopping them from getting in. This presentation will discuss how to create the appropriate mindset within your organization, and how to create a security program that stops even the most advanced adversaries.

About the Speaker
Ira Winkler, CISSP is President of Secure Mentem and author of Advanced Persistent Security. He is considered one of the world’s most influential security professionals, and has been named a “Modern Day James Bond” by the media. He did this by performing espionage simulations, where he physically and technically “broke into” some of the largest companies in the World and investigating crimes against them, and telling them how to cost effectively protect their information and computer infrastructure. He continues to perform these espionage simulations, as well as assisting organizations in developing cost effective security programs. Ira also won the Hall of Fame award from the Information Systems Security Association, as well as several other prestigious industry awards. Most recently, CSO Magazine named Ira a CSO Compass Award winner as The Awareness Crusader.

Ira is also author of the riveting, entertaining, and educational books, Advanced Persistent Security, Spies Among Us and Zen and the Art of Information Security. He is also a columnist for ComputerWorld, and writes for several other industry publications.

Mr. Winkler has been a keynote speaker at almost every major information security related event, on 6 continetnts, and has keynoted events in many diverse industries. He is frequently ranked among, if not the, top speakers at the events.

Mr. Winkler began his career at the National Security Agency, where he served as an Intelligence and Computer Systems Analyst. He moved onto support other US and overseas government military and intelligence agencies. After leaving government service, he went on to serve as President of the Internet Security Advisors Group, Chief Security Strategist at HP Consulting, and Director of Technology of the National Computer Security Association. He was also on the Graduate and Undergraduate faculties of the Johns Hopkins University and the University of Maryland. Mr. Winkler was recently elected the International President of the Information Systems Security Association, which is a 10,000+ member professional association.

Mr. Winkler has also written the book Corporate Espionage, which has been described as the bible of the Information Security field, and the bestselling Through the Eyes of the Enemy. Both books address the threats that companies face protecting their information. He has also written hundreds of professional and trade articles. He has been featured and frequently appears on TV on every continent. He has also been featured in magazines and newspapers including Forbes, USA Today, Wall Street Journal, San Francisco Chronicle, Washington Post, Planet Internet, and Business 2.0.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, January 16, 2018 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
10th Floor
Washington, DC, 20005

Click here for details.

Join us on Tuesday, January 16 for our monthly chapter meeting with a special guest speakers:

Must  register here if you plan to attend.

Join us on Tuesday, December 19, 2023 for our monthly chapter meeting with a special guest speakers:

Abstract
Insurance companies don't use traffic light analogies for setting insurance rates and neither should you. In this talk, the author of Strategic Privacy by Design will discuss the importance of quantification, the pitfalls of qualitative assessments, the growing regulatory demand for risk assessments and highlight the different focuses of privacy versus security risks.

Must  register here ifyou plan to attend.

Join us on Tuesday, September 19, 2023 for our monthly chapter meeting with a special guest speakers:

Abstract
TBA

Must  register here if you plan to attend.

Join us on Tuesday, August 15, 2023 for our monthly chapter meeting with a special guest speakers:

Abstract
TBA

Must  register here ifyou plan to attend.

Exclusive offer for the National Capital Chapter members - free passes for the 10th Annual DC Metro Cyber Security Summit on Thursday, July 20th.

Join us on Tuesday, July 18, 2023 for our monthly chapter meeting with a special guest speakers:

Must  register here if you plan to attend.

Join us on Tuesday, June 20, 2023 for our monthly chapter meeting with a special guest speakers:

Abstract
TBA

Must  register here ifyou plan to attend.

Join us on Tuesday, June 6, 2023 for our monthly chapter meeting with a special guest speakers 

Abstract
Cloud is offered as three different models; Infrastructure as a Service(IaaS), Platform as a Service (Paas), and Software as a Service (SaaS). These cloud service models allow you to offload a significant part of your operations over to a third party to do the lifting..All three forms of ‘as a service’ allow increasing degrees of capacity to be carried by the vendors but carry varying levels of risk and benefits. This session enables you to understand through analogies the best approach to cloud governance. It will also cover the resources you have at your disposal to be able to audit and analyze your cloud security posture. 

Must  register here ifyou plan to attend.

Join us on Tuesday, February 21, 2023 for our monthly chapter meeting with a special guest speakers:

Abstract
The Cyber Security Evaluation Tool (CSET®) is developed by the Cybersecurity & Infrastructure Security Agency (CISA). The Department of Homeland Security (DHS) developed CSET for asset owners with the primary objective of reducing the risk to the nation’s critical infrastructure. Control systems are defined as electronic devices that control physical processes and as such, are a crucial element in the protection of our nation’s infrastructure. Since 2014 the tool evolved into a powerful tool for organizations to perform their general cyber assessment process. The tool provides a systematic approach for evaluating an organization’s security posture by guiding asset owners and operators through a step- by-step process to evaluate their industrial control system and information technology network security practices.
The lecture will provide a high-level review of the tool along with its features and assessment process. Additionally, the lecture will review the tool’s standards section, assurance level determination, creation of diagrams, generation of questions, review analysis and reports. The slide deck will have links to CSET Tutorials and key U. S. Federal cybersecurity assessment models included with the tool.

Must  register here ifyou plan to attend.

Join us on Tuesday, January 17, 2023 for our monthly chapter meeting with a special guest speakers:

Abstract
The Department of Health and Human Services Office of Civil Rights (OCR) is responsible for enforcing the HIPAA Privacy and Security Rules (45 C.F.R. Parts 160 and 164, Subparts A, C, and E). It is responsible for investigating complaints and conducting compliance reviews to determine if covered entities (Healthcare Plans, Healthcare Clearinghouses, Healthcare Providers or any other organization who transmits any health information in electronic form in connection with a transaction) are compliant with Privacy and Security Rules. Covered entities are required by law to respond to OCR investigations. OCR is responsible for enforcing the HIPAA Privacy and Security Rules (45 C.F.R. Parts 160 and 164, Subparts A, C, and E). One of the ways that OCR carries out this responsibility is to investigate complaints filed with it. After the OCR investigation is concluded, if the evidence indicates that the covered entity was not in compliance, then OCR will attempt to resolve the case with the covered entity by obtaining, Voluntary compliance, Corrective action, and/or Resolution agreement. Our speaker Mr. Ernest Smith, CEO, The RMF Security Group will discuss his knowledge of how covered entities should handle an OCR investigation if they are faced with an OCR complaint.

Must  register here if you plan to attend.

Join us on Tuesday, October 18 for our monthly chapter meeting with a special guest speakers:

 
FedRAMP: Breaking the Barrier for Government Compliance, Presented
by Alexis Robinson & Nichole Becknel 

Abstract
TBA

Must  register here ifyou plan to attend.

CANCELLED 

We had to cancel today'smeeting and hope to announce a new date soon. We apologize for the inconvenience.

 CANCELLED 

Join us on Thursday, October 6 for our monthly chapter meeting with a special guest speakers:

 
Cloud Security with MITRE ATT&CK
by Jose Barajas, Director of Global Sales Engineering, AttackIQ

Abstract
Cloud security is a significant challenge, and few businesses today are capable of utilizing the native security controls and capabilities provided by cloud platforms. How can you ensure that your cybersecurity capabilities are working to defend your organization’s data as best they can?

Many security operations centers (SOCs) are typically uniformed in their knowledge of the security solutions available in Microsoft Azure, Amazon Web Services (AWS), or Google Cloud Platform environments. The MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) framework helps towards this as it is a clear, standardized method for organizations to address complexity in their cloud environments and increase their cloud cybersecurity efficiency.

This session with AttackIQ Academy instructor Jose Barajas will cover practical steps for deploying the ATT&CK framework to maximize your cloud security effectiveness.

The following topics will be discussed:

• How to get started with a threat-informed defense strategy for the cloud
• Applying cloud security management best practices in Azure and AWS
• Ways to improve overall cloud security operations

Must  register here ifyou plan to attend.

Join us on Tuesday, September 20 for our monthly chapter meeting with a special guest speakers:

Abstract
Join us as we explore how our Women Founder panelists are preparing our Workforce of the future, as well as their dedication in providing cybersecurity services in protection of our global citizens in an increasingly digital world. We will discuss the major cybersecurity drivers creating the most entrepreneurial opportunity, as well as how they are positively impacting the global ecosystem going forward. Our pioneering industry veterans boast decades of salient leadership and technology experience and constantly work to innovate and develop across many global programs.

Must register here if you plan to attend.

Join us on Tuesday, July 19 for our monthly chapter meeting with a special guest speaker:

Abstract
Come to this interactive session to learn how to learn the Incident Response with Backdoors & Breaches, an Incident Response online game, created by Black Hills Information Security and Active Countermeasures. Backdoors & Breaches contains 52 unique cards to help you conduct incident response tabletop exercises and learn attack tactics, tools, and methods. The session will open with a review of the rules of the game, and then participants will go through one of the risk scenarios with the facilitator.

Speaker Bio

Alex Grohmann has over two decades of experience in technology-related information security, risk management and data privacy.  During his career, he has worked at both the state and Federal level, and his private sector involvement has spanned from energy to financial services. He is the founder and operator of Sicher Consulting, LLC. Mr. Grohmann holds industry certifications of CISSP, CISA, CISM and CIPT. He holds two undergraduate degrees from Florida State University as well as an MBA from UMUC.  

 

Mr. Grohmann is a Fellow at the Information Systems Security Association (ISSA), an international organization of information security professionals. He is the recipient of their international ‘Honor Roll’ for his lifetime contributions to the information security community. He has served on the board of directors for the Northern Virginia chapter of ISSA for over ten years, including as president for three.  During his time, the chapter won the Chapter of Year. 

 

He is a graduate of the FBI’s Citizens’ Academy and served on the board of directors for the Washington DC chapter of InfraGard for four years. Currently Mr. Grohmann serves on the board directors of Northern Virginia Community College’s Workforce Development taskforce, NOVA Cybersecurity Advisory Board and is a mentor at MACH 37, the Virginia cyber security accelerator. He also sits on the IT sector coordinating council (IT-SCC).

 

Register here.  

Must use the link above to register if you plan to attend.

Join us on Tuesday, June 21 for our monthly chapter meeting with a special guest speaker:

Abstract
Cloud computing is one of the hottest technologies with a high demand for qualified professionals. The median salary for IT pros currently in a cloud computing career in the U.S. is $124,300. However, it is not the easiest of jobs to acquire because it is a specialty area. To secure a job in this field, a candidate must have several specific skills. Let’s see what they are so you can get your cloud computing career started!

Amazon's (AWS) selection of Crystal City (Arlington VA) for its new headquarters will bring $15 billion and 62,000 jobs by 2025. Are you ready for being part of this lucrative career?

There is a great deal of interest from those with traditional IT skills—such as help desk technicians, data center admins, enterprise architects, developers, and networking engineers—to steer themselves into a cloud computing career that will not only provide job protection but pay better as well. However, the path to cloud computing riches is not that clear for most.

 The good news: There is a path for many IT pros into the cloud. In this meetup, we will show you how to map a path to those cloud computing jobs from your current state if you are a Helpdesk or datacenter admin, enterprise architect, database admin, application developer, system admin, test/QA engineer, or networking engineer.

The patterns for getting from traditional IT to cloud IT are basically the same for most IT roles: Get smart on specific cloud technology and do it fast. Take advantage of the AWS and Azure training, boot camps, and exam readiness workshops.

Register here.  

Must use the link above to register if you plan to attend.

Join us on Tuesday, May 17 for our monthly chapter meeting with a special guest speaker:

Ransomware Response, A Lawyer’s Perspective,
Presented by Mark Rasch, Computer Security and Privacy Lawyer

Abstract
Typically, response to ransomware attacks is considered to be a technical issue for CISO’s and technical staff. This session will focus on the legal issues associated with ransomware - who has responsibility for prevention of attacks, who has responsibility for response, what standards should be used? It will also discuss topics like ransomware insurance (the good, the bad and the ugly), liability for paying (or not paying) ransom, duties to customers, clients, and third parties, and other associated legal issues.

Speaker Bio
Mark Rasch is a lawyer and computer security and privacy expert and a lawyer in Bethesda, Maryland and a Professor of Cyberlaw and Cyber-crime at George Washington University School of Law.

Rasch’s career spans more than 35 years of corporate and government cybersecurity, computer privacy, regulatory compliance, computer forensics and incident response. Earlier in his career, Rasch was with the U.S. Department of Justice where he led the department’s efforts to investigate and prosecute cyber and high-technology crime, starting the computer crime unit within the Criminal Division’s Fraud Section, efforts which eventually led to the creation of the Computer Crime and Intellectual Property Section of the Criminal Division.  He was responsible for various high-profile computer crime prosecutions, including Kevin Mitnick, Kevin Poulsen and Robert Tappan Morris.

Mark is a frequent commentator in the media on issues related to information security, and is the author of hundreds of articles about the Internet, Internet privacy, hacking, cryptocurrency, blockchain and ransomware.

Register here.  

Must use the link above to register if you plan to attend.

Join us on Tuesday, April 19 for our monthly chapter meeting with a special guest speaker: 

Regulatory Developments, AI and Cybersecurity
by Charlyn Ho and Cassandra Carley

Abstract
The California Privacy Rights Act (CPRA), one of the most comprehensive privacy rights legislation in the country, was adopted by a majority of California voters on November 3, 2020, and goes into effect January 1, 2023. The CPRA amends the California Consumer Privacy Act (CCPA) and, among other things, adds new opt-out and access requirements for “profiling” and automated decision making. Join us for a timely discussion with Perkins Coie technology transactions and privacy attorney Charlyn Ho and privacy litigation attorney Cassandra Carley regarding how the new California ballot initiative will affect AI and the intersection of privacy and data security. 

Speaker Bio
Perkins Coie Technology Transactions and Privacy Partner, Charlyn Ho counsels clients on legal issues related to technology and privacy, including those affecting e-commerce sites, mobile devices and applications, artificial intelligence (AI)/machine learning (ML), virtual reality (VR), mixed reality (MR) and augmented reality (AR) platforms, cloud services, enterprise software, cryptocurrency platforms and Internet of Things devices. Charlyn serves as the co-lead of the firm’s Immersive Technology vertical. She provides strategic advice and counseling to all types of technology companies throughout their lifecycle, from startup to established enterprises. She also has represented domestic and international clients on banking, acquisition financing, mergers and acquisitions and securities transactions.

Cassandra (Cassi) Carley is an associate at Perkins Coie in the privacy litigation group. Cassi attended New York University School of Law where she was a Birnbaum Women’s Leadership Network fellow, Journal of Intellectual Property and Entertainment Law staff editor, OUTLaw member, and Cyber Scholar. She also co-founded Rights over Tech (R/T), an organization for NYU Law students interested in open conversations about the impact of technology on human and civil rights, and served as president. While at NYU, Cassi also externed with the Bureau of Internet and Technology (BIT) of the New York Attorney General's Office, as well as with the NYU Technology Law & Policy Clinic.

Register here.  

Must use the link above to register if you plan to attend.

Join us on Tuesday, March 15 for our monthly chapter meeting with a special guest speaker:

The 2022 Annual Non-Profit Security Incident Report
by Matthew Eshleman, Chief Technology Officer at Community IT

Abstract
Most small-to-medium sized nonprofit organizations do not prioritize cybersecurity, despite the risks faced by many of these organizations. The threat landscape continues to evolve and grow and most organizations are at greater risk than they realize. This report shares some of our experiences and insights from the front lines. We establish a solid business case for making nonprofit cybersecurity an organizational priority. In our unique role as a managed services provider to over 140 organizations representing 6500 devices, we have the unique insights into how nonprofits are targeted and how they can defend themselves.

Register here.  

Must use the link above to register if you plan to attend.

Join us on Tuesday, February 15 for our monthly chapter meeting with a special guest speaker:

Mentoring Cybersecurity Professionals
By Mari Galloway, CEO Women’s Society of Cyberjutsu

Abstract
The growth of the Cybersecurity profession is expanding exponentially, as a result there is a strong need to mentor the next generation of Cyber professionals. What do these emerging professionals require to help them grow within the Cybersecurity field? What does it take to be an exceptional mentor? How can we expand the pool of mentors within Cyber? What are the special mentorship needs of diverse populations? Mari Galloway CEO and a Founding Board Member for the Women's Society of Cyberjutsu (WSC) will discuss these issues.

Mari is the CEO and a founding board member for the Women's Society of Cyberjutsu (WSC), one of the fastest growing 501c3 non-profit cybersecurity communities dedicated to bringing more women and girls to cyber. WSC provides its members with the resources and support required to enter and advance as a cybersecurity professional. 

 

Mari began her cyber career with Accenture where she excelled as a Network Engineer. Mari is also the inaugural ISC2 Diversity Award winner for 2019. With over 12 years of Information Technology, 10 of which are in cybersecurity, her experience spans network design and security architecture, risk assessments, vulnerability management, incident response and policy development across government and commercial industries. 

 

She holds a variety of technical and management certifications (CISSP, GIAC, CCNA, etc.) as well as a bachelor’s degree in Computer Information Systems from Columbus State University and a Master of Science in Information Systems from Strayer University. 

 

Mari is currently a resident of Las Vegas working as a Customer Success Architect for Palo Alto Networks. She regularly contributes content to security blogs and training companies across the country as well as an Adjunct Professor for UMGC. She also lends her time to various organizations as an award judge, mentor, and advisor. Outside of being a geek, Mari enjoys arts, puzzles, and legos! @marigalloway mostlymimi.com

 

Register here.  

Must use the link above to register if you plan to attend.

Do you have what it takes to be a champion of cyber security knowledge? Join the ISSA DC, ISSA NOVA, and ISSA Central MD chapters for a Trivia Night and you can prove your cyber security knowledge and may even win a prize!

Cyber Trivia Competition
Jim Broad

Schedule for the Event
• Opening remarks 6:30 PM - 6:45 PM
• Competition Time 6:45 PM - 8:00 PM

Individual Competition
Round 1: 20-minutes / 10 Questions (1st Place, 2nd Place, 3rd Place Winner)
Round 2: 20-minutes / 10 Questions (1st Place, 2nd Place, 3rd Place Winner)
Round 3: 20-minutes / 10 Questions (1st Place, 2nd Place, 3rd Place Winner)
ISSA Chapter Competition
ISSA Chapter Trophy Winner (ISSA DC, ISSA NOVA, and ISSA Central MD)

Jim Broad, Cyber Trivia Competition Host
Mr. James Broad (CISSP, C|EH, CPTS, Security+, MBA), authored the NIST RMF text book, Risk Management Framework: A Lab-Based Approach to Securing Information Systems which is utilized in cybersecurity MBA and graduate certificate programs focusing on risk management. He also co-authored Hacking with Kali. Mr. Broad serves as a faculty member for Concordia University SP. In that capacity he mentors and teaches online cybersecurity graduate certificate and MBA students to develop and apply the most current risk management methods embodied in the NIST RMF. He works with Mission Critical Institute to enable students to participate in the cloud based NIST RMF internship offered through Cyber-Recon. When they successfully complete internship students have a NIST RMF e- project portfolio which represents their cybersecurity risk management project experience. Mr. Broad is an experienced cybersecurity professional with a strong and proven background in leading people, managing programs and projects and driving improvement and change.
Mr. Broad established Cyber-Recon in 2008. Cyber-Recon provides information security consulting services as well as training and volunteer opportunities which enable security professionals to enhance their security skills while providing needed services to the community.
Mr. Broad has had extensive experience in implementing security at all phases of the development lifecycle. His expertise includes: Penetration Testing, Certification and Accreditation, Change Management, Vulnerability Assessment, Documentation and Instruction as well as compliance standards including Sarbanes Oxley (SOX), Payment Card Industry (PCI), Health Insurance Portability and Accountability Act (HIPAA), Department of Defense DoD), National Security Agency (NSA) and National Institute of Standards and Technology (NIST). Further, his experience extends to support risk management initiatives at the largest global hedge fund.

Register here.  

Must use the link above to register if you plan to attend.

Join us on Tuesday, January 18 for our monthly chapter meeting with a special guest speaker:

Controlling Privacy and the Use of Data Assets
Ulf Matteson

Abstract

Ulf Matteson will be discussing his new book, “Controlling Privacy and the Use of Data Assets – The New World Currency: Data and Trust”. He will share some valuable lessons learned from companies about the safeguards and approaches that organizations need to take in order to successfully implement data privacy and security.

About the Author
Ulf Mattsson is a recognized information security and data privacy expert with a strong track record of more than two decades implementing cost-effective data security and privacy controls for global Fortune 500 institutions, including Citigroup, Goldman Sachs, GE Capital, BNY Mellon, AIG, Visa USA, Mastercard Worldwide, American Express, The Coca Cola Company, Wal-Mart, BestBuy, KOHL's, Microsoft, IBM, Informix, Sybase, Teradata, and RSA Security.

He is currently the Chief Security Strategist and earlier the Chief Technology Officer at Protegrity, a data security company he co-founded after working 20 years at IBM in software development. Ulf holds a Master's degree in Physics in Engineering from Chalmers University of Technology in Sweden. Ulf is an inventor of more than 70 issued U.S. patents in data privacy and security.

Ulf is active in the information security industry as a contributor to the development of data privacy and security standards in the Payment Card Industry Data Security Standard (PCI DSS) and American National Standards Institute (ANSI) X9 for the financial industry. He is on the
advisory board of directors at PACE University, NY, in the area of cloud security and a frequent speaker at various international events and conferences, including the RSA Conference, and the author of more than 100 in-depth professional articles and papers on data privacy and security, including IBM Journals, IEEE Xplore, ISSA Journal and ISACA Journal.

Do you have what it takes to be crowned the king or queen of cyber security knowledge? Join us for a Trivia Night and you can prove your cyber security knowledge and may even win a prize!

Register here.  

Must use the link above to register if you plan to attend.

  Join us on Tuesday, November 11 for our monthly chapter meeting with a special guest speaker:  

ISSA Mid-Atlantic Summit
CISO Panel Discussion: Cyber Supply Chain Risk Management 

Must register here to attend.

Abstract
The Solarwinds Attack has caused government and private sector organizations to renew their focus on strengthening Cybersecurity Supply Chain Risk Management. By statute, federal agencies must use NIST’s C-SCRM and other cybersecurity standards and guidelines to protect non-national security federal information and communications infrastructure. The SECURE Technology Act and FASC Interim Final Rule gave NIST specific authority to develop C-SCRM guidelines. Matthew Butkovic, Technical Manager of the Cybersecurity Assurance, Software Engineering Institute will moderate a discussion with Dr. George Duchak, Chief Information Officer, DLA Information Operations and Robert S. Metzger, Shareholder at the Rogers, Joseph, O’Donnell Washington, D.C. law firm’s Cybersecurity and Privacy Practice Group to share their thoughts about designing stronger cybersecurity risk management strategies and approaches.

Matthew J. Butkovic (Panel Moderator)
Technical Manager of the Cybersecurity Assurance, Software Engineering Institute
Matthew Butkovic is the Technical Manager of the Cybersecurity Assurance team within the CERT® Division at the Software Engineering Institute (SEI), a unit of Carnegie Mellon University in Pittsburgh, PA. Butkovic performs critical infrastructure protection research and develops methods, tools, and techniques for evaluating capabilities and managing risk.
Butkovic has more than 15 years of managerial and technical experience in information technology (particularly information systems security, process design and audit) across the banking and manufacturing sectors. Prior to joining CERT in 2010, Butkovic was leading information security and business continuity efforts for a Fortune 500 manufacturing organization.
Butkovic is a Certified Information Systems Security Professional (CISSP) and Certified Information Systems Auditor (CISA)
 
Dr. George Duchak (Panelist)
Chief Information Officer, DLA Information Operations
Dr. George Duchak is the Chief Information Officer for the Defense Logistics Agency (DLA). He was previously the Deputy Assistant Secretary of Defense (DASD) for Command, Control, Communications, Cyber & Business Systems (C3CB). Prior to becoming a DASD, he was the founding Director of the Defense Innovation Unit Experimental (DIUx) in Mountain View, CA, where he served as a conduit between leading edge Silicon Valley innovators and the Department of Defense. Prior to that, he led the Air Force's and nation's premier research organization for command, control, communications, computers and intelligence (C4I) and cyber technologies as the Director of the Air Force Research Laboratory’s Information Directorate, Rome, NY. There, he was selected as the Federal Laboratory Director of the Year from over 300 federal lab directors. He is also a former DARPA Program Manager where he conceived of, developed, and transitioned to the services a portfolio of programs in the broad area of C4I and Cyber. He was a private sector entrepreneur and businessman with more than a decade of private industry experience starting several companies that served the US Government by providing technical consultancy or product. His private sector experience was software product focused principally in the area of intelligence exploitation using crowd sourcing techniques, big data analytics and cloud services well before industry in general and DoD began to move in this direction. Finally, and most importantly, he is a retired naval officer.

Dr. Duchak is a graduate of the U.S. Naval Academy, the Naval Postgraduate School, The Ohio State University, George Mason University and University of Chicago Booth Graduate School of Business earning degrees in Mechanical Engineering, Aerospace Avionics, Aeronautical Engineering, Public Policy, and Business Administration. He completed the Program Management Course at the Defense Acquisition University and is a certified level 1 in Program Management as well as Systems Engineering, and level 2 in Test & Evaluation and Budgeting. He is a licensed Professional Engineer and has completed the Carnegie Mellon University Chief Information Security Officer (CISO) course and Harvard’s Information Security course. He is a senior fellow Auburn University’s McCrary Center for Cyber Security, a member of the Intelligence and National Security Alliance Cyber Security Committee, and a current board member of the Blue Cross and Blue Shield Cybersecurity Subcommittee. Dr. Duchak is married to Sonya Milley, Esq., an attorney, and they have two grown children, Alexander and Tatiana.
 
Robert S. Metzger, Shareholder - (Panelist)
Shareholder, RJO – Rogers| Joseph | O'Donnell, PC
Mr. Metzger heads the Rogers, Joseph, O’Donnell Washington, D.C. office. He co-chairs the law firm’s Cybersecurity and Privacy Practice Group and is a member of the Government Contracts Practice Group. His practice includes cyber and related national security matters in addition to a wide range of public procurement and regulatory matters. In his litigation practice, he is counsel of record for Microsoft Corporation in the Court of Federal Claims litigation brought by Amazon Web Services protesting the $10B DoD award of the “JEDI” cloud services contract to Microsoft. He has represented other class-leading, international technology firms in a variety of administrative controversies, as well as state and federal litigation. He has advised U.S. aerospace and defense and international technology companies on export control laws, on CFIUS and FIRRMA, and on sanctions issues. He also represents leading information technology hardware, software and solution providers in state and local procurements.

Co-Sponsored by ISSA DC, ISSA NOVA, ISSA Central Maryland Chapters and Carnegie Mellon Heinz College CISO program

Must use the link above to register if you plan to attend.

  Join us on Tuesday, October 19 for our monthly chapter meeting with a special guest speaker:  

Security Implications: Schrems II, CCPA, and Brexit
by K Royal

https://attendee.gotowebinar.com/register/8476871129791789326

Abstract
On July 16, 2020, the Court of Justice for the European Union published their opinion on Case C-311/18 Data Protection Commissioner v Facebook Ireland Limited and Maximillian Schrems (called "Schrems II"). This decision invalidated the EU-US Privacy Shield and provided requirements for data transfer mechanisms. This decision has had far-reaching consequences for US companies doing business in the EU, but also for companies globally. What does this mean for companies and specifically, for security professionals? Will the EU drive global security requirements? And if so, how does it align with the new California laws or with the UK withdrawal from the EU? Join us as we discuss global developments in privacy and put them in context of managing a forward-looking security program.

Speaker bio

K Royal is an attorney and global privacy professional with 25 years of experience in the legal and health-related fields. She has the distinct honor of filing the first successful joint controller / processor Binding Corporate Rules for data transfers out of the European Union and founded a program for women in house attorneys that is now a Global Women in Law and Leadership annual summit held at the United Nations in New York. As an attorney, she has received numerous honors for her leadership in both technology and diversity, including Forty-under-40 recipient for Phoenix, named an Outstanding Woman in Business, and Member of the Year for the Association of Corporate Counsel (out of 43k members globally). K received her law degree from the Sandra Day O'Connor College of Law at Arizona State University and is in the dissertation phase of her PhD in public policy from the University of Texas at Dallas.

She is currently the Associate General Counsel at TrustArc and is an adjunct law professor at her alma mater teaching privacy law. She is certified through the IAPP as a Fellow of Information Privacy (FIP), Privacy Management (CIPM), and US and EU Privacy Law (CIPP/US, CIPP/E) and as a Data Privacy Solutions Engineer through ISACA. K also serves on the boards of several non-profit organizations.

Must use the link above to register if you plan to attend.

  Join us on Tuesday, September 21 for our monthly chapter meeting with a special guest speaker:  

Balanced Attacker Model
by Dr. Earl Crane PhD, CEO, Earl Crane LLC,
Adjunct Professor at Carnegie Mellon University CISO Certificate program

Must register here to attend. 

Abstract

Cybersecurity risk management is a constant struggle of insufficient resources against almost unlimited attackers. What makes a cybersecurity professional successful is balancing attackers with the right controls protecting the right assets. This is the “Balanced Attacker Model”.

In this session we will walk through a table-top exercise of the Balanced Attacker Model using a “risk deck” of cybersecurity loss scenarios. This exercise helps leadership identify and plan a course of action to address cybersecurity risks before an incident happens. This exercise has been taught to 100’s of government and commercial cybersecurity professionals, through Carnegie Mellon University and the University of Texas at Austin. 

The risk deck is available for purchase for $20 here:

https://www.earlcrane.com/card-decks

Speaker bio
Dr. Earl Crane is a cybersecurity executive and trusted advisor to public and private sector organizations, having worked at early security startups, Homeland Security, and the White House National Security Council. Dr. Crane has delivered this exercise to 100’s of government and commercial cybersecurity professionals, through Carnegie Mellon University and the University of Texas at Austin.

Must use the link above to register if you plan to attend.

  Join us on Tuesday, August 31 for our monthly chapter meeting with a special guest speaker:  

Creating the Next Generation of Cyber Professionals
by Prem Jadhwani, CEO, Intellectual Point

Conference Call Information: 
https://attendee.gotowebinar.com/register/4253667857370550800 

Abstract
The cyber threat landscape is evolving rapidly and the corporations are scrambling to find skilled people to fill the cyber positions. There is clearly an acute shortage of skilled cyber professionals. Cybersecurity workforce training and development is going through a major transformation today with the changing threat landscape as well as rapidly evolving technologies such as machine learning, artificial intelligence and big data analytics. This presentation will bring real world best practices from the trenches on how cyber security education and training can be both affordable and effective in helping people fill the cyber security job openings with the right skills. The presentation will highlight critical skills required in the next generation of cyber professionals and how is the role of a security analyst rapidly evolving with the advent of advanced targeted attacks and zero day attacks. Attendees will walk away with a clear understanding of practical cyber security training solutions as well as best practices in developing and delivering an effective cyber security program from a pragmatic perspective within the commercial and federal organizations. Attendees will learn how an accredited training provider (Intellectual Point) has been leveraging the Workforce Innovation Opportunity Act (WIOA) program to effectively impart cyber security education to the unemployed and underemployed folks and help them transition to a lucrative and stable career in cyber security with the help of hands-on professional short courses and IT certifications.

Speaker bio
Prem works as a Chief Executive Officer (CEO) & Founder of Intellectual Point – a Reston VA based professional IT Training, Education & Solutions Provider. He also serves as a Chief Technology Officer (CTO) for Government Acquisitions - an IT Solutions Provider & Trusted Advisor to the Federal Government. His primary responsibilities include defining, developing and delivering professional, hands-on IT Trainings and Solutions in the areas of Cyber Security, Cloud Computing, Data Center, Networking, Big Data Analytics, Mobility, Internet of Everything and Emerging Technologies.

Mr. Jadhwani possesses 20 years of experience working in the enterprise IT space with both commercial and Federal customers. He has a strong blend of technology and marketing background and has worked with a number of Technology and Software firms, including TIBCO Software, See Beyond Technology Corporation (now acquired by Sun/Oracle), Infogix Systems Inc., GTSI Corporation and Unicom Government Inc.

Prem has a well-rounded and extensive product management experience and has a proven track record of successfully training, coaching and mentoring people and with hands-on marketable skills in areas such as Cyber Security, Cloud Computing and Project Management and preparing them for highly skilled IT and management careers in rapidly growing IT space. He provides technical and business expertise in Data Center, Green IT, Enterprise Networking, Information Assurance & Network Security, Unified Communications, Wireless, Virtualization & Cloud Computing solutions to customers and is a prominent speaker at various tradeshows and conferences. Prem was nominated and has served as a Commissioner for the TechAmerica STLG Cloud Computing Commission as well as TechAmerica Big Data Commission. Prem is an active contributor to various industry discussions, panels and his work and articles have been published in numerous journals and periodicals.

Prem has an intuitive ability to be able to envision technological changes and provide technical direction and trainings to the companies and customers. Prem is also involved as an adjunct faculty for instructing graduate level degree courses in Cyber Forensics, Big Data, Virtualization and Cloud Computing at various reputable universities like University of Maryland University College (UMUC), Strayer University and several others. Prem holds several advanced academic credentials including MS in Computer Science, MBA in Marketing and has completed his coursework towards a Ph.D. in Cyber Security from George Mason University. He also holds 100+ advanced IT Certifications and Credentials including CISSP, CISM, CISA, CEH, Security+, CSM, CHFI, VCP, GIAC, GCIH, ITILv3, CCSP, CCNP, CCVP and several others.

Must use the link above to register if you plan to attend.

  Join us on Tuesday, July 20 for our monthly chapter meeting with a special guest speaker:  

Making the Cyber World a Safer Place for Everyone
by Pat Craven

We will be hosting the meeting virtually

Conference Call Information: 
https://attendee.gotowebinar.com/register/1522782239003077389

Abstract
The Center for Cyber Safety and Education www.IAmCyberSafe.org, formerly (ISC)² Foundation, is a non-profit charitable trust committed to making the cyber world a safer place for everyone. It works to ensure that people across the globe have a positive and safe experience online through its educational programs, scholarships, and research. The Center’s Director Pat Craven will explain:

• How you can help the community now utilizing the Center programs
• What resources available for teaching cyber safety to children, parents and senior citizens
• The newly launched “Garfield at Home“ distance learning program
• What you can do to bring “Cyber Safety Day” to your city
• How companies and individual can get involved in delivering Cyber Safety Education

Speaker bio
Pat Craven has over 35 years of experience working within the non-profit industry and has held various C-Level executive leadership roles across the country at notable charitable organizations such as the Boy Scouts of America (24 years), Big Brothers Big Sisters, and the Vietnam Veterans Memorial Fund in Washington D.C. He is now the Director for the (ISC)2 nonprofit Center for Cyber Safety and Education with world headquarters in Clearwater, Fl. Pat is a sought-after speaker and writer on how to keep children and families safe and secure online and is a regular guest on radio, TV and podcast around the world.

He has a BS in Communication from Xavier University (Cincinnati, OH). Pat is also a member of the ECPI University Program Advisory Board for Cyber and Network Security and board of directors for the FBI Citizen’s Academy – Tampa. He was awarded the international SC Media Reboot Leadership Award for his innovation and leadership in cyber safety.

At the Center, he is responsible for all business operations, supporting the Board of Trustees, service delivery, providing leadership to employees and volunteers, managing multiple income streams, overseeing marketing and business development functions, new program development and liaising with external agencies. Mr. Craven has been successful across the country developing innovative and award-winning educational, marketing, advertising, sales, management and fundraising programs.

Must use the link above to register if you plan to attend.

  Join us on Tuesday, June 15 for our monthly chapter meeting with a special guest speaker:  

ISSA-DC Hosts Understanding the Block Chain and its Impacts on the Future, Facilitated by Ms. Camila Salkov

We will be hosting the meeting virtually
Conference Call Information: 

https://attendee.gotowebinar.com/register/2883961140985587212

Abstract
The panel discussion will cover various dimensions of the blockchain industry including technology, decentralization, trust, governance, regulation, token economics, network security, funding, ecosystem development and other aspects that need to be managed to create a successful layer one blockchain. Various applications of the technology, including cryptocurrencies, NFTs etc. and the overall societal impact of the technology will be touched upon. A computational framework to evaluate the myriad blockchain projects will be presented, to help the audience get a sense of the state of the industry and the potential of the underlying technology.

After registering, you will receive a confirmation email containing information about joining the webinar.

Speaker bio
V. Rao Bhamidipati | Founder | VP Software Products | Services @ Software Products & Services Strategies Worldwide | F6S Profile

Rao Bhamidipati is a Board member and VP Product and Platform Governance at RChain. He has been managing RChain core development since July 2019 and successfully delivered the mainnet in February 2020. He leads the techno-economic governance of the platform and ecosystem development.

Rao has over 30 years of technology and business experience in both Fortune 100 companies and startups. He has several award winning 'industry first' innovations to his credit including the first fully virtual internet bank and a DARPA and IBM funded group communications system in the pre-Lotus Notes era. Rao has led many business and digital transformation projects and turned around many projects and organizations.

Rao has a Bachelor's in Electrical Engineering, an MBA from the Indian Institute of Management and a Masters in Computer Science from NJIT.   

Camila Salkov is the first woman in the board of directors of RChain – a Cooperative building a blockchain platform, and key social coordination technologies. She is the Operations Manager of TheDream.US - The nation's largest college access and success program for immigrant youth; and the Chief Financial Officer of the animal rescue SUSAN (Step Up to Save Animal Network).

Camila Graduated from Trinity W. University with a Bachelor of Science (BS) in Accounting, and a Master’s degree with a concentration in Management from Fitchburg State University.

Camila is an experienced financial consultant, an investment banking expert, and a leader that brings a diverse background to her professional endeavors.

Lucius Gregory (Greg) Meredith is the president of the RChain Cooperative. Greg is a mathematician, and the discoverer of the rho-calculus, a co-inventor of the LADL algorithm, and the inventor of the ToGL approach to graph theory.

Must use the link above to register if you plan to attend.

  Join us on Tuesday, May 18 for our monthly chapter meeting with a special guest speaker:  

Enumerating and Attacking w/ IPv6
Tyrone Wilson, CEO, Cover6 Solutions

We will be hosting the meeting virtually
Conference Call Information: 
https://register.gotowebinar.com/register/2048147584971774479

Abstract
In 1998, the Internet Protocol Version 6 (IPv6) was developed as a next generation Internet Protocol (IP) standard to replace IPv4, when it was believed that the Internet was running out of IP addresses. The new IPv6 protocol was built to handle packets more efficiently, improve performance, increase security, and reduce the size of routing tables by making them more hierarchical. Companies reported that complexity, costs, and time hindered their efforts to move to IPv6. The adoption of IPv6 was delayed because many organizations have been using Network Address Translation (NAT) as a way to extend the life of their IPv4 addresses, but this temporary work around is no longer sustainable. Twenty-Five years later, it’s about time we put more focus on expanding the availability of IP addresses to accommodate the explosion in the number of internet devices and implementing a more secure internet protocol. Tyrone E. Wilson will discuss how you can use open-source tools to provide a better understanding of the IPv6 Protocol. He will also demonstrate how to perform network enumeration and attacks over IPv6. 

Speaker bio
Mr. Tyrone E. Wilson is a cybersecurity professional with 24 years of experience in information technology and systems configuration, including information systems and network security. In addition, Wilson possesses extensive knowledge in conducting computer network defense, vulnerability assessments, cyber threat analysis, and incident response activities. As a former United States Army Cybersecurity Analyst, Wilson developed security structures to protect American intelligence systems from foreign threats. Currently, Wilson is the Founder and President of Cover6 Solutions, which teaches companies and cybersecurity professionals various aspects of information security, penetration testing, and IPv6.

Must use the link above to register if you plan to attend.

  Join us on Tuesday, April 20 for our monthly chapter meeting with a special guest speaker:  

Promoting Diversity and Inclusion in Cyber Panel Discussion

We will be hosting the meeting virtually
Conference Call Information: 
https://attendee.gotowebinar.com/register/8853899160706352910 

Abstract
According to the Bureau of Labor Statistics, the rate of growth for jobs in Cybersecurity is projected at 37% from 2012–2022—that’s much faster than the average for all other occupations. However, the industry still struggles with issues of diversity, inclusion, and equity. What strategies can organizations adopt to cultivate a more diverse workplace? How can organizations recruit and retain a diverse pools of candidates and help them to thrive within the organization? The panel will explore ways to reimagine recruitment, hiring, visibility, mentorship, allyship, training, pay equity, Executive Leadership programs/pipelines, as well as company awards & recognition programs.

Speaker bios

Panel Moderator
Talent and technology veteran, Deidre Diamond, Founder, and CEO of CyberSN and Secure Diversity, has created the largest cybersecurity talent acquisition service and technology firm in the U.S while focusing on the cybersecurity talent shortage, specifically the shortage of women. Deidre's mission is to remove the pain from job searching and matching for everyone. Deidre cares tremendously about people loving where they work and has been working to create cultures that have high EQ (emotional intelligence) skills. These skills focus on words and behaviors. Deidre is known in the D/I community as someone who works hard at making sure words and behaviors are inclusive for all so that inclusive environments can also be diverse environments. 

Panelists

 Larry Whiteside Jr. is a veteran CISO, former USAF Officer, and thought leader in the Cybersecurity field. He has 25+ years of experience in building and running cybersecurity programs, holding C-Level Security executive roles in multiple industries including DoD, Federal Government, Financial Services, Healthcare, and Critical Infrastructure.
Whiteside is the Co-Founder, President, and on the Board of Directors at the International Consortium of Minority Cybersecurity Professionals (ICMCP), a 501(c)3 non-profit association that is dedicated to increase the number of minorities and women in the cybersecurity career field through providing workforce development that includes skills assessment, training, education, mentorship, and opportunity.
He also serves as the Chief Technology Officer and Chief Security Officer at CyberClan, a full service Global Incident Response and Managed Security Services Provider for the small to medium-sized businesses.
As the 2009 founder of Whiteside Security, Larry advised several corporate security executives and companies across the cybersecurity industry on how to make Cyber Security a number one objective to their businesses. He has helped CEOs and board members of private cybersecurity companies achieve their goals in sales, marketing, and customer retention.
Larry has presented to the C-Level leadership and Board of Directors of some of the largest private and public sector organizations in America. He is a thought leader in the industry with extensive experience presenting at conferences such as the Gartner Security Summit, RSA Conference, and SC World Congress, Larry has been featured in many articles relating to information security and risk management.
Larry received his Bachelor of Science degree in Computer Science at Huston-Tillotson University.

 Mark Casper is the President and Executive Director of Tech For Troops (T4T) a nonpartisan, nonprofit based in Richmond, VA. Tech For Troops Mission is dedicated to empowering Veterans with computers, skills, and Information Technology (IT) work force training. While located in Richmond, Tech For Troops has National reach.

He believes that working computers can provide a new life to struggling veterans rather than being discarded. Many veterans face two significant barriers when competing in the modern workforce: the lack of a computer and the lack of the skills needed to effectively use that computer. Under his guidance, Tech For Troops gifts refurbished computers and instituted a Veteran Improvement Program to teach computer literacy.
He is a United States Marine Corps veteran and a career IT expert who focused on large-scale government and civilian IT projects. and has worked with Northrup Grumman, Capital One and as a contractor CPIC planner for the Veterans Affairs

Mark was the owner of a small consulting firm until Tech For Troops recruited him. Married for 35 years to his soulmate, a father of two young women and a proud “grampy” to two amazing grand-daughters, Mark has found his place in life (for work) at Tech For Troops.

Nathan Chung is a cloud security specialist with more than 20 years of experience in IT and Cybersecurity. He is an advocate for women in cyber and Neurodiversity. He serves on multiple boards including WiCyS (Women in Cybersecurity) Colorado, IGNITE Worldwide, and Spark Mindset. He is also the host of the NeuroSec podcast. Voted Male Ally of the year in 2020.

Must use the link above to register if you plan to attend.

Join us on Tuesday, March 16 for our monthly chapter meeting with a special guest speaker:  

Secure Cloud
by Wayne Dennis Jr
Senior Manager, Accenture security practice

We will be hosting the meeting virtually
Conference Call Information: 
https://attendee.gotowebinar.com/register/6800931730198916364 

Abstract
Explores how security can accelerate a cloud-first journey. It examines the key pillars that define the minimum requirements an organization needs to securely place workloads in the cloud. It identifies the dimensions of complexity that influence a security strategy. And recommends four steps to introduce security at speed and scale.

Speaker bio
Wayne is a Strategy, and Architecture leader who brings an innovation based approach to cyber security.  He brings deep security expertise in disruptive technologies such as Artificial Intelligence, Embedded & Real Time Systems, Industrial Control Systems, Medical Devices, Connected Cars, and the Internet of Things.  Wayne is a noted speaker and presenter at cyber security conferences around the world and frequently participates on panels, forums and thought groups on developing new best practices. Wayne brings organizations a mixture of deep technical, product and business skills; This combination allows to engage both business and technology leaders as a peer.

Must use the link above to register if you plan to attend.

  Join us on Tuesday, February 16 for our monthly chapter meeting with a special guest speaker:  

Security Implications: Schrems II, CCPA, and Brexit
by K Royal

We will be hosting the meeting virtually
Conference Call Information: 
https://attendee.gotowebinar.com/register/2741988898267781647

Abstract
On July 16, 2020, the Court of Justice for the European Union published their opinion on Case C-311/18 Data Protection Commissioner v Facebook Ireland Limited and Maximillian Schrems (called "Schrems II"). This decision invalidated the EU-US Privacy Shield and provided requirements for data transfer mechanisms. This decision has had far-reaching consequences for US companies doing business in the EU, but also for companies globally. What does this mean for companies and specifically, for security professionals? Will the EU drive global security requirements? And if so, how does it align with the new California laws or with the UK withdrawal from the EU? Join us as we discuss global developments in privacy and put them in context of managing a forward-looking security program.

Speaker bio
K Royal is an attorney and global privacy professional with 25 years of experience in the legal and health-related fields. She has the distinct honor of filing the first successful joint controller / processor Binding Corporate Rules for data transfers out of the European Union and founded a program for women in house attorneys that is now a Global Women in Law and Leadership annual summit held at the United Nations in New York. As an attorney, she has received numerous honors for her leadership in both technology and diversity, including Forty-under-40 recipient for Phoenix, named an Outstanding Woman in Business, and Member of the Year for the Association of Corporate Counsel (out of 43k members globally). K received her law degree from the Sandra Day O'Connor College of Law at Arizona State University and is in the dissertation phase of her PhD in public policy from the University of Texas at Dallas.

She is currently the Associate General Counsel at TrustArc and is an adjunct law professor at her alma mater teaching privacy law. She is certified through the IAPP as a Fellow of Information Privacy (FIP), Privacy Management (CIPM), and US and EU Privacy Law (CIPP/US, CIPP/E) and as a Data Privacy Solutions Engineer through ISACA. K also serves on the boards of several non-profit organizations.

Must use the link above to register if you plan to attend.

  Join us on Tuesday, January 19 for our monthly chapter meeting with a special guest speaker:  

Cyber Threat Intelligence Briefing
by Marcelle Lee

We will be hosting the meeting virtually
Conference Call Information: 
https://attendee.gotowebinar.com/register/4202793449484613133

Abstract
Join Marcelle Lee, Senior Security Researcher from Secureworks' Counter Threat Unit™ Research team, for an overview of the cyber threat landscape. Topics covered will include:

• Lessons learned from Secureworks incident response practice
• eCrime threat landscape
• Emerging and global threat landscape
• Marcelle’s briefing will include tales from the trenches and reference the extensive research done by the CTU team.

Speaker bio

Marcelle is a Senior Security Researcher specializing in cybercrime for Secureworks in the Counter Threat Unit and is also an adjunct professor in digital forensics and network securityShe specializes in network traffic analysis, malware analysis, and threat hunting and intelligence. She is involved with many industry organizations, working groups, and boards, including the Women’s Society of Cyberjutsu, the NIST Cyber Competitions Working Group, and the Cybersecurity Association of Maryland Advisory Council. She also both builds and participates in cyber competitions.

Marcelle has earned the CISSP, CSX-P, GCFA, GCIA, GCIH, GPEN, GISF, GSEC, GCCC, C|EH, CCNA, PenTest+, Security+, Network+, and ACE industry certifications. She holds four degrees, including a master’s degree in cybersecurity. She has received the Chesapeake Regional Tech Council Women in Tech (WIT) Award and the Volunteer of the Year award from the Women’s Society of Cyberjutsu. Marcelle frequently presents at conferences and training events, and is an active volunteer in the cybersecurity community. 

Must use the link above to register if you plan to attend.

  Join us on Wednesday, December 16 for two special joint chapter events with ISSA Northern Virginia and Central Maryland:  

O365 Security Lunch & Learn
By Chris Morales of Vectra
at 12:00 pm

and

Powershell JEA
By James Honeycutt - Sponsored by Red CanaryAbstract
at 5:00 pm

Both meetings will be hosted virtually. Registration is required. 

We are happy to be partnering with the Central Maryland and Northern Virginia ISSA Chapters.

O365 Security Lunch & Learn

Must RSVP if you plan to attend. 

Wednesday, December 16, 2020 at 12:00 pm

Abstract
We'll navigate through uncharted security territory by analyzing the attack lifecycle in the cloud and dissecting a real-world attack. The same technology that makes the cloud dynamic can have the opposite effect on an organization’s ability to implement detection and response in cloud environments. This includes the adding additional layer of preventative controls in addition to MFA, because it's increasingly being bypassed in O365 as an example. Chris Morales, Head of Analytics with Vectra, will help us navigate through the uncharted security territory by analyzing the attack lifecycle in the cloud, reviewing the top cloud security threats, and dissecting a real-world cloud attack. Additionally, he'll provide key takeaways for managing access, detection and response, and security operations.

Speaker Bio
Chris Morales, Is Head of Security Analytics at Vectra, where he advises and designs incident response and threat management programs for Fortune 500 enterprise clients. He has nearly two decades of information security experience in an array of cybersecurity consulting, sales, and research roles. Chris is a widely respected expert on cybersecurity issues and technologies and has researched, written and presented numerous information security architecture programs and processes.

Powershell JEA

Must RSVP if you plan to attend. 

Wednesday, December 16, 2020 at 5:00 pm

Abstract
Abstract - PowerShell Just Enough Administration (JEA) allows us Systems Administrators to empower our fellow admins, developers, and security personal to accomplish what they need to on our systems. Give them just enough administrative permissions to accomplish their duties without interrupting your day or night. This talk shows how to assign roles and give the appropriate permissions to those roles.

The presentation will start off with a little bit of JEA background and what problem it solves. We will discuss what planning and considerations are involved with implementing JEA. We will discuss the different resource files needed and how to create them. We will talk about how granular or liberal we can get with creating our rules. We will look at an example of the various resource files then create our own. I will show the commands need to enable JEA. We will do a walkthrough of setting up JEA, creating our files and enabling JEA, and demo how you can give a developer elevated permission on certain PowerShell commands. I will show how you can assign a group of commands with wild cards like get-IIS and specific commands like stopping a specific service with specific arguments and switches. We will have to talk about where the audience can get some more in-depth training on this subject, there is no way to learn it in an hour.

About the speaker
James Honeycutt is a hardworking and dedicated cybersecurity professional who enjoys scripting and participating in capture the flags. James has served over 20 years in the military in various technical and leadership positions. In his current assignment, he am part of a Cyber Protection Team and serve as the Microsoft Windows Expert. See James full bio at https://honeycuttjames.wixsite.com/mysite/about. 

  Join us on Tuesday, October 20 for our monthly chapter meeting with a special guest speaker:  

Growing in Cyber Panel
Moderator - Leslie Taylor

We will be hosting the meeting virtually
Conference Call Information: 

https://attendee.gotowebinar.com/register/837573183761453068 

Abstract
Ms. Leslie Taylor, Human Resource Consultant and Career Coach will moderate a panel of early career professionals and career changers who are currently working in cybersecurity. The panelists will discuss their early careers, how they made the choice to work in Cyber, how they obtained their first job within Cyber, the training and education programs that they pursued to prepare for their current positions, and the work experience that they have gained on the job. They will each share their advice to individuals who want to learn how to launch a career in Cyber as well as those who want to learn how to grow their Cyber careers over time.
 

Speaker bios

Leslie Taylor, Panel Moderator
Prior to launching her own entrepreneurial business venture, Leslie Taylor was a Talent Acquisition Recruiting Leader at ICF with a focus on Cyber Security and Critical Infrastructure. She has more than 15 years of experience in IT, cleared and cybersecurity recruiting. Her passion is recruiting top talent to meet the needs of the business. Leslie is a member of Leadership Fairfax and has a Master’s degree in Human Resources.
Leslie speaks regularly to local groups, colleges, military career transition groups and conferences. She is an active member in several professional associations and leverages participation in a variety of IT/Cyber, university/college, association and military career fairs and networking events.
Leslie has also managed the Military Recruiting and sourcing strategy to attract and hire veterans and military candidates from all IT services for the Cyber Industry. She has created Military recruiting pipelines while leveraging partnerships with military, social media and Military hiring websites. Leslie has conducted screenings of applicants to ensure qualified for positions including tracking and participating in local military events.

Leslie Hamilton, Panelist
Ms. Leslie Hamilton is an Associate Cyber Security Information Assurance Analyst/ISSO with Northrop Grumman in the Enterprise Services Sector on the Collateral side. Prior to joining Northrop Grumman, she worked at the Pentagon with the Airforce as an IT Journeyman. Ms. Hamilton is new to the Information Security Technology field and focused on growing her career in cybersecurity. Ms. Hamilton has a degree from Nyack College in Organizational Management and will be pursuing a Master’s Degree in Cyber Security.

Shivani Karikar, Panelist
Shivani Karikar is an Application Security Engineer at Digital Infuzion working on a CMS project. She focuses on InSpec profile development as a part of a security automation framework. She is experienced in areas like vulnerability assessment, cloud security, pentesting, risk analysis, and project management. Shivani has a Master's degree in Information Systems along with security certifications like CompTIA Security+ and Certified Ethical Hacker. She has a diverse background that consists of business management, app development, and IT training. Shivani has won an NY Hackathon and several CTF events. Her passion is to specialize in Cryptology. She also loves to volunteer and enjoys hobbies like solving puzzles, biking and playing drums.

Linda Moise, Panelist
Linda Moise received his Bachelor of Science in Computer Information Systems at Virginia Union University on May 2017. Mr. Moise was blessed with the opportunity of becoming a GEM 2017 fellow, he had two summer internship with the company Lexmark International. Mr. Moise worked as an intern at the company’s headquarters in Lexington, Kentucky as a Cybersecurity Analyst in the Platform Security Department.
After graduating with his masters in cyber security in 2019 from the University of Maryland Baltimore County (UMBC), Mr. Moise took a position at WMATA as an Information system security Engineer ISSE , where he worked in the Risk management team. Mr. Moise hold security + and Certified ethical Hacker certifications. He is still growing his career in Cybersecurity, his focus areas are cloud security, risk management, and penetration testing. Mr. Moise enjoyed mentoring and helping other students to discover their career path and go after their dreams and goals. 

Must use the link above to register if you plan to attend.

  Join us on Tuesday, September 15 for our monthly chapter meeting with a special guest speaker:  

The NIST Security and Privacy Controls Catalog (800-53): What’s New in the Draft and Looking Ahead
By Victoria Yan Pillitteri

We will be hosting the meeting virtually:

Conference Call Information: 

https://attendee.gotowebinar.com/register/2098167662344609291 

Abstract
Draft NIST Special Publication (SP) 800-53, Revision 5 provides a comprehensive catalog of next-generation security and privacy controls to safeguard systems and organizations, and the personal privacy of individuals. This long anticipated update includes changes to improve usability, promote alignment with the Cybersecurity Framework and Privacy Framework, and new and updated controls to address privacy and supply chain risk management, and security engineering. This presentation will highlight the significant changes in draft SP 800-53, Revision 5 and feature a preview of additional new supporting resources and publications in the NIST pipeline.

Speaker bio

Victoria Yan Pillitteri is a senior computer scientist in the Computer Security Division at the National Institute of Standards and Technology (NIST). Ms. Pillitteri is the team lead of the Federal Information Security Modernization Act (FISMA) Implementation Project. The FISMA team is responsible for conducting the research and development of the suite of risk management guidance used for managing information security risk in the federal government, and associated stakeholder outreach and public-private coordination/collaboration efforts.

Ms. Pillitteri previously worked on the Privacy Framework, Cybersecurity Framework, led the NIST Smart Grid and Cyber Physical Systems Cybersecurity Research Programs, served on the board of directors of the Smart Grid Interoperability Panel, served as Chair of the Federal Computer Security Managers’ Forum, and completed a detail in the office of the NIST Director as an IT policy advisor. She has co-authored a number of NIST Special Publications (SPs) and Interagency Reports (IRs) on information security. Ms. Pillitteri holds a B.S. in Electrical Engineering from the University of Maryland, a M.S in Computer Science, with a concentration in Information Assurance, from the George Washington University, and is a Certified Information Systems Security Professional (CISSP).

Must use the link above to register if you plan to attend.

  Join us on Tuesday, August 18 for our monthly chapter meeting with a special guest speaker:  

Incident Handling & Threat Hunting w/ Security Onion
by Tyrone E. Wilson

We will be hosting the meeting virtually:

Conference Call Information: 

https://attendee.gotowebinar.com/register/3393445135608649228

Abstract
Mr. Wilson will discuss how to use a free and open source tool like Security Onion (SO) to provide hands-on experience and increase our knowledge in incident response and threat hunting. This event is for those with minimal experience working with detection alerts, pcap files, and log management. We will learn how to setup Security Onion at home or on an enterprise network and use its features to complete various network defense challenges. Attendees will leave with a higher level of confidence in network defense as well as the ability to crush their next analyst interview. Participants will also receive a booklet of instructions and credentials to a live SO server which will allow them to continue to practice their new found skills from anywhere in the world.

Speaker bio
Mr. Tyrone E. Wilson is an information security professional with 24 years of experience in information technology and systems configuration, including information systems and network security. Wilson also has extensive knowledge in computer network defense, vulnerability assessments, cyber threat analysis, and incident response. As a former cybersecurity analyst for the United States Army, Wilson developed security structures to ensure American intelligence systems were protected from foreign threats. Currently, Wilson is the Founder and President of Cover6 Solutions; which teaches companies and professionals various aspects of information security, penetration testing, and IPv6.

Must RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, August 18, 2020 at 6:30 pm

Center for American Progress (CAP)

1333 H St. NW
10th Floor
Washington, DC, 20005

Click here for details.

  Join us on Tuesday, July 28 for our monthly chapter meeting with a special guest speaker:  

An overview of the NSA's Cybersecurity Directorate
by Greg Bednarski

We will be hosting the meeting virtually:

Conference Call Information: 

https://attendee.gotowebinar.com/register/5222410160482360592 

Abstract
On October 1st, 2019, the NSA formally established the Cybersecurity Directorate to “prevent & eradicate” threats - right in our own back yard. What does it look like when an intelligence agency decides to do cybersecurity? Let’s go beyond the talking points to understand the organization, why it was created, what it does, and how it does it. NSA’s Cybersecurity Directorate encompasses activities that go well beyond the scope of traditional cybersecurity organizations. This presentation will be structured to introduce each of the seven major mission activities, how they operate, and examples of real and significant problems we're tackling. Key points to be covered include what makes this different from previous information assurance efforts at the NSA; the use of NSA’s foreign signals intelligence activities to power the cybersecurity mission; the directorate’s move to take the fight to the bad guys; why we’re growing our public presence and collaboration efforts; and where we’re most focusing our efforts today.

Speaker bio
Greg Bednarski is the head of Cyber Policy & Strategy for the National Security Agency's Cybersecurity Directorate, where he leads the development, coordination, and execution of cyber-related policy with the National Security Council and other US Government departments and agencies on behalf of the NSA. Over the course of the last fourteen years, Greg has been responsible for the management and execution of computer network exploitation activities, capability development, and network analysis for foreign intelligence and cybersecurity purposes, and has provided direct support to offensive cyberspace operations

Must use the link above to register if you plan to attend.

  Join us on Tuesday, June 16 for our monthly chapter meeting with a special guest speaker:  

Artificial Intelligence & Machine Learning
Overview for Decision Makers
By Prem Jadhwani

We will be hosting the meeting virtually:

Conference Call Information: 

https://attendee.gotowebinar.com/register/8201660060435608847

Abstract
Artificial Intelligence, Machine Learning, Deep Learning and Blockchain are all emerging technological advances that are making a debut within the Federal Government for such use cases as Fraud Detection & Mitigation, Fraud Detection and Mitigation; Geo-spatial Intelligence using Drone and Satellite Imagery Fusion Platform Sustainment; Insider Threat Detection and Mitigation; Smart Video Analytics; Autonomous Sensors and Large Scale Object Detection Predictive Cyber Analytics & Next Gen Threat Mitigation; AI & ML for Healthcare; GPU Accelerated HPC Applications; and Robotic Process Automation. AI will transform Cybersecurity by creating next gen cyber tools that will be able to use AI, ML and Natural Language Processing to be able to better detect, contain and predict sophisticated cyber-attacks and advanced persistent threats. Learn about the Artificial Intelligence Roadmap to success. Hear about the potential return on investment and financial payback for AI/ML projects. Gain insights into approaches for successfully implementing AI/ML.

Speaker bio
Prem Jadhwani, Chief Technology Officer (CTO), brings 20 years of experience working in the enterprise IT space with both commercial and Federal customers to Government Acquisitions, Inc. (GAI). He is also a founder and CEO of Intellectual Point, an IT Training and Workforce Development firm based in Northern VA. As a CTO, Mr. Jadhwani provides solution vision, strategy, thought leadership, and subject matter expertise around data centers, cyber security, cloud computing, data analytics, mobile and wireless, IoT, SDN and other emerging technologies like Artificial Intelligence and Machine Learning. Mr. Jadhwani has served as a Commissioner for TechAmerica Cloud and Big Data Commission. He has published numerous papers and is an active speaker at industry conferences. He holds an MS in Computer Science from Illinois Institute of Technology, an MBA in Marketing & Strategy from Stuart School of Business in Chicago, and has completed coursework for a Ph.D. in Cyber Security from George Mason University. He also holds 100+ reputable certifications including CISSP, CISM, CySA+, CISA, CEH, CCNP, VCP, ITIL, GCIH, and GSLC and is a professional Cyber Security Trainer and sought-after speaker and panelist.

Tuesday, June 16, 2020 at 6:30 pm

Must use the link above to register if you plan to attend.

  Join us on Tuesday, May 26 for our monthly chapter meeting with a special guest speaker:  

The Next Big Thing In Cyber Security
By Dean Lane

We will be hosting the meeting virtually:

Conference Call Information:

https://attendee.gotowebinar.com/register/3005581412221155084

Abstract
2019 had many headlines covering the latest data breach, ransomware attack, or advanced hacking exploit. Unfortunately, those headlines are nothing out of the ordinary anymore – they represent our new status quo. Cyber Security, or any technical field, is ever evolving and will change in coming years; but for now, the answer for the next big thing is Cyber Intelligence. Come to this interactive session / discussion to learn the concepts of how to minimize security blind spots. This session will introduce the basic concepts of Cyber Intelligence as an enhanced method of Cyber Security. We will discuss Cyber Intelligence as an interdisciplinary look at Cyber Security and Intelligence that considers not only software, hardware, and fire walls, but also the human side of the equation. There will always be hackers and state sponsored attacks. Since it is a war that never ends we must ensure that we win every battle by staying ahead of the opposition.

Speaker bio

Mr. Lane serves as the Senior Vice President of The Institute of World Politics’ (IWP) Cyber Intelligence Initiative. In this capacity, he is responsible for ten Cyber Intelligence Certifications offered by the University. Prior to joining IWP Mr. Lane was the founder and CEO of the Office of the CIO®; an influential consultancy and community of CIOs well known throughout the Silicon Valley and beyond. Members of the Office of the CIO included CIOs from Symantec, Facebook, Polycom, Brocade, Peet’s Coffee and 45 other top Silicon Valley companies. Mr. Lane has 30 years of hands on experience in the Cyber world, having been a CIO, as a practitioner, at four different companies: Honeywell Aerospace, ATK, Plantronics, and Masters Institute of Technology. Additionally, he held the Senior IT Director position at Symantec. Mr. Lane has also been a consultant for Gartner, AT&T (Teradata) and Ernst & Young. His experience is global and as found on the internet, he is considered an expert on Cyber.

Mr. Lane obtained his undergraduate degree from the University of California (UCLA) and his MBA from National University. He is Certified in the Governance of Enterprise IT (CGEIT) by ISACA and is also certified as a Master Project Manager. Mr. Lane served on the advisory boards of the State of California Veteran’s Affairs, Comtrade Inc, TachTech, and SFSU’s Center for Electronic Business. Mr. Lane’s first book, CIO Wisdom, is a Prentice Hall World-wide #1 Best Seller and a sequel, CIO Perspectives was published by Kendall-Hunt. His most recent book CIO’s Body of Knowledge was published by Wiley & Sons. During a Hi-Tech Economic Mission to Israel, he consulted with former Israeli Prime Minister Ehud Barach. Mr. Lane is a highly decorated U.S. Naval Special Warfare Officer who served as the SEAL Team Officer for the Commander In Chief, Pacific Fleet.

Must use the link above to register if you plan to attend.

Join us on Tuesday, April 28 for our monthly chapter meeting with a special guest speaker:  

Cyber Resilience: “Risk Management” is not enough
by John Eckenrode

We will be hosting the meeting virtually:

Conference Call Information:
 https://attendee.gotowebinar.com/rt/6860298754366550795

Abstract

Business operations, enterprise risk management, and cybersecurity are critical functions that require integration to effectively understand, communicate, and manage risk. These functions are usually isolated organizationally, resulting in uninformed risk and resource decisions that can reduce resiliency, and impair efficient execution of mission and business objectives. Organizations must institute organizational tools and behaviors to develop consumable cyber-focused risk intelligence and next-generation resilience methods to respond to the challenges posed by the evolving cyber threat landscape.

Come to this interactive session to gain insights on ensuring continued mission fulfillment and added illumination of “shadow resources” that support mission essential functions.

Speaker bio

John Eckenrode leads the Guidehouse DOD Cyber business and heads up multiple Solution areas in Cyber Resilience, CMMC Pre-Assessment and Mitigation Support, as well as the development of the ICS/SCADA and IOT capabilities. John brings more than 30 years of experience supporting client cybersecurity challenges at the operational, mission, and strategic level, and excels at “connecting the dots” and opening organizational lines of communication to facilitate greater data flow and understanding of both security imperatives, and organizational objectives, leading to greater efficiency and efficacy.

John has worked for a variety of firms leading consulting engagements to Chief Information and Financial Officers, and Chief Information Security Officers in both the Defense, and Civilian markets
to include Homeland Security’s U.S. Citizenship and Immigrations Services (USCIS), US Department of the Navy, US Department of Labor, Office of the Secretary of Defense, Defense Logistics Agency, Department of State, and the Center for Medicare and Medicaid Services.

John holds a Bachelor of Arts in History from the Virginia Military Institute and is a former Marine, and Diplomatic Security Service Officer. He holds the Certified Information System Security Professional (CISSP), Certified Information Security Manager (CISM), and certified SCADA Security Architect certifications.

Must use the link above to register if you plan to attend.

  Join us on Tuesday, March 17 for our monthly chapter meeting with a special guest speaker:  

Deep Dark Web
By Warren Holston

We will be hosting the meeting virtually in light of recent
developments with the Coronavirus (COVID-19):

Conference Call Information:
https://register.gotowebinar.com/register/5498358988864251916

You will be connected to audio using your computer's microphone and speakers (VoIP).  

Alternatively, you may select "Use Telephone" after joining the Webinar.

Dial +1 (562) 247-8321
Access Code: 535-681-978
Audio PIN: Shown after joining the Webinar

Abstract
Over 96% of the web is hidden behind gates of the Deep Dark Web. Breached data often ends up in data dumps on these hidden corners, sold, traded, or offered for free. These decisions are made based on adversarial motivating factors. As such, it is important for IT auditors, cyber operations professionals, Open Source Intelligence (OSINT) analysts, and security managers to understand the real threats. Join this talk to learn more about what lies within the Deep Dark Web.

Speaker bio
As a career Technical Operations Officer, Mr. Warren Holston has worked throughout the Intelligence Community, Department of Defense, and defense industry for more than 30 years. He has served as a U.S. Navy Explosive Ordnance Disposal Diver, a collection officer and senior manager in the Central Intelligence Agency, and a Subject Matter Expert for the Department of Defense U.S. Special Operations Command. He has managed and conducted counterterrorism, covert action, and technical collection operations worldwide. He is recognized as having contributed significantly to the national security of the United States of America. Mr. Holston was awarded the CIA’s Intelligence Commendation Medal for “conceiving of, and implementing, a clandestine sensor operation against a high priority denied area intelligence target” and the Distinguished Career Intelligence Medal for “superior performance in the conduct of clandestine operations in the CIA.” Mr. Holston is the author of the personal security book “Beware the Predator”. He lectures extensively on the application of personal tradecraft in a digital world. He is also the author of the poetic artwork of “Peace in Darkness, A Study of the Darkness in Humanity”.

Must RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, March 17, 2020 at 6:30 pm

Center for American Progress (CAP)

1333 H St. NW
10th Floor
Washington, DC, 20005

Click here for details.

  Join us on Tuesday, February 18 for our monthly chapter meeting with a special guest speaker:  

A CISO Approach: Securely Facilitating the Business
By Sal Montemarano

Abstract
The implementation of a cyber security program can take many forms. An organization may implement a compliance based program, a tools based program, or more often a combination of both. This presentation will discuss the different approaches to implementing a cyber security program and the pitfalls which may occur through this implementation.

Speaker bio

Mr. Montemarano has been an examiner within the SEC’s Office of Compliance Inspections and Examinations for 3 years. Prior to joining the Commission, he was the Chief Information Security Officer for the Overseas Private Investment Corporation (OPIC). Mr. Montemarano has worked in the information technology field for over 20 years, 12 years focused on cybersecurity. Mr. Montemarano has a degree from George Mason University and a Masters in Information Security from the University of Maryland University College.

Must RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, February 18, 2020 at 6:30 pm

Center for American Progress (CAP)

1333 H St. NW
10th Floor
Washington, DC, 20005

Click here for details.

  Join us on Tuesday, January 21 for our monthly chapter meeting with a special guest speaker:  

Teaching Incident Response with Back Doors & Breaches
By Teresa Allison

Abstract
Come to this interactive session to learn how to teach Incident Response with Backdoors & Breaches, an Incident Response Card Game, created by Black Hills Information Security and Active Countermeasures. Backdoors & Breaches contains 52 unique cards to help you conduct incident response tabletop exercises and learn attack tactics, tools, and methods. The session will open with going over the rules of the game, next there will be a question and answer period, and then the participants will divide into teams to play the game. After the games end we will reconvene to discuss lessons learned and how we can use the game to better teach incident response in our workplaces and the community.

Speaker bio

Teresa Allison is Vice President of Programs for the Information System Security Association (ISSA) DC Chapter. She has worked in the field of information technology consulting for over 18 years. She provides clients with solutions for managing multi-billion dollar IT programs. She specializes in strategic planning, budgeting, performance management, portfolio management, governance, risk management, legal & regulatory compliance, project management, program management, process improvement, business operations transformation, strategic communications and stakeholder management.

Allison has supported clients in the domain areas of Health & Human Services, Homeland Security, Transportation, Financial Regulatory Agencies, Veterans Affairs, Diplomacy & Foreign Affairs, as well as International Development & Foreign Assistance. She assisted a global strategy consulting firm in implementing IT security and privacy policies to comply with the European General Data Protection Regulation (GDPR). She has also taught CISSP certification classes at ASM Educational Center.

Teresa received her bachelor’s degree in Political Science from Xavier University. She graduated from Carnegie Mellon University’s H. John Heinz III School of Public Policy with a Master of Science in Public Policy and Management with a concentration in Management of Information Systems. She is certified IT professional who currently holds the PMP, CSM, ITIL, Security+, CGEIT, CISA, CISSP, CCSK, and Lean Six Sigma certifications.

Teresa Allison is the Past President of the Carnegie Mellon University Heinz College Alumni Association comprised of over 11,000 alumni from around the world. She currently serves as a volunteer for the Women’s Society of Cyberjutsu which encourages women to pursue careers in Cybersecurity. She also coordinates higher education outreach programs for the Project Management Institute (PMI) as a member of the Higher Education Partnerships committee. Allison is also a member Information System Audit and Control Association (ISACA) DC Chapter and the Healthcare Information Management Systems Society (HIMSS).

Must RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, January 21, 2020 at 6:30 pm

Center for American Progress (CAP)

1333 H St. NW
10th Floor
Washington, DC, 20005

Click here for details.

  Join us on Friday, December 13 for our special chapter meeting:

The National Capital Chapter has partnered with the SANS Institute again this year to offer exclusive access for its members to SANS@Night events at Cyber Defense Initiative 2019. The event will take place at Washington Hilton on Friday, December 13, 2019.

Please note that the event is free but you must RSVP at least 24 hours before the event so we can have your badge ready for you. 

The chapter members and their guests will have access to the following events:

Must RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Friday, December 13, 2019 at 6:00 pm

Location Information

Washington Hilton

1919 Connecticut Ave. NW

Washington, DC  20009 US

Phone: 202-483-3000

www3.hilton.com

  Join us on Tuesday, November 19 for our monthly chapter meeting with a special guest speaker:  

Better Identity Coalition
by Jeremy A. Grant
of Venable LLP

Abstract
2017’s massive Equifax breach raised some tough questions on the limitations of America’s approach to digital identity. When 147 million Social Security Numbers are compromised, can we still assume the SSN has any value? Can we trust Knowledge Based Authentication (KBA) for remote identity proofing if one of the biggest providers of KBA has been breached? And if not, what can we use instead? The lack of good answers to these questions from industry or government led leading firms in financial services, health care, fintech, technology, payments and security to band together in 2018 to launch the Better Identity Coalition – an organization focused on developing and advancing consensus-driven, cross-sector policy solutions that promote the development and adoption of better solutions for identity verification and authentication.

 The Coalition’s “Policy Blueprint for Better Identity in America” – released in July 2018 – has earned attention from industry and government alike as providing the most sensible path forward for government’s role in improving digital identity. Jeremy Grant – who serves as the Coordinator of the Better Identity Coalition, and who previously led the National Strategy for Trusted Identities in Cyberspace (NSTIC) in his role at NIST – will discuss the work of the Coalition and the path to “Better Identity.”

Speaker bio
As a member of Venable’s Cybersecurity Risk Management Group, Jeremy Grant combines federal government and private sector experience to help clients develop growth strategies, identify and exploit market trends, and advise on policy impacts across the IT, cybersecurity, identity, and payments sectors. In this role, Jeremy utilizes his diverse background and deep understanding of business, technical, policy, and finance issues related to identity, privacy, and cybersecurity, having served in a range of leadership positions spanning government and industry. Jeremy joined Venable after serving as a managing director at The Chertoff Group. Before that, he established and led the National Program Office for the National Strategy for Trusted Identities in Cyberspace (NSTIC), housed in the National Institute of Standards and Technology (NIST); NSTIC was the first new cybersecurity program launched by the Obama administration. There he directed the administration’s activities across private and public sectors to drive a marketplace of more secure, privacy-enhancing identity solutions for online services. He also served as NIST’s senior executive advisor for identity management, and led efforts to improve identity and authentication for individuals and devices in the NIST Roadmap for Improving Critical Infrastructure Cybersecurity.

Before leading NSTIC, Jeremy was the chief development officer for government services consulting firm ASI Government. He spent three years with Washington Research Group as an equities and market analyst focused on identity, cybersecurity, and government technology. Earlier in his career, he served as vice president for Enterprise Solutions at Maximus, where he led the division's Security and Identity Management practice, playing a major role in a number of major federal identity and security programs. Jeremy began his career as a legislative aide in the U.S. Senate – focused on health and technology policy – where he drafted legislation that laid the groundwork for the Department of Defense (DOD) and civilian agency smart card and PKI efforts.

Must RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, November 19, 2019 at 6:30 pm

Center for American Progress (CAP)

1333 H St. NW
10th Floor
Washington, DC, 20005

Click here for details.

 Join us on Tuesday, October 15 for our monthly chapter meeting with a special guest speaker:  

Think Like the Adversary - A Threat Based Approach to Cyber Architecture

Abstract
The Cybersecurity and Infrastructure Security Agency (CISA) developed the .govCAR methodology to take a threat-based approach to cybersecurity risk management. .govCAR represents an evolution in managing cybersecurity —an advancement from the traditional consequence (compliance) and vulnerability (cyber hygiene) based approaches. This next-generation approach looks at cybersecurity capabilities the same way an adversary does to directly identify areas where mitigations should be applied for best defense. .govCAR creates opportunities for organizations to make their own threat-informed risk decisions and develop a prioritized approach to reducing risk to known threats. .govCAR is vendor agnostic and does not evaluate specific vendors or products.The speaker will walk the audience through the concept of threat based architecture reviews and will discuss how cybersecurity threat framework and architectural cybersecurity capabilities come together to allow organizations to improve their cybersecurity posture.

Speaker bio
Branko Bokan is a Cybersecurity specialist with the Cybersecurity and Infrastructure Security Agency (CISA) at the Department of Homeland Security (DHS). In his role, Branko assists federal agencies to adopt the .govCAR methodology. A proud holder of all three ISC2 CISSP concentrations (ISSAP, ISSEP, ISSMP), Branko also teaches cybersecurity as an adjunct professor at a local university.

Must RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, October 15, 2019 at 6:30 pm

Center for American Progress (CAP)

1333 H St. NW
10th Floor
Washington, DC, 20005

Click here for details.

 Join us on Tuesday, September 17 for our monthly chapter meeting with a special guest speaker:  

Expecting Secure, High-Quality Software: Minimizing Technical Debt and Mitigating Risks with Better Measures for Test and Audit
by Joe Jarzombek

Abstract
As external dependencies grow more complex, managing risks attributable to exploitable software includes requirements for security and quality with ‘sufficient’ test and audit regimes throughout the software supply chain. The Internet of Things (IoT) is contributing to a massive proliferation of a variety of types of software-reliant, connected devices throughout critical infrastructure. With IoT increasingly dependent upon third-party software, software composition analysis and other forms of testing are used to determine 'fitness for use' and trustworthiness of assets. Standards for measuring and sharing information about software security and quality are used in tools and services that detect weaknesses and vulnerabilities. Test and audit programs provide means upon which organizations use to reduce risk exposures attributable to exploitable software. Ultimately, addressing software supply chain dependencies and leveraging high assurance test regimes enable enterprises to provide more responsive mitigations.

Learning Objectives - Attendees will learn how:

• External dependencies contribute risks in the form of technical debt throughout the software supply chain;
• Standards can be used to convey expectations and measure software security and quality, and they can provide criteria for more relevant audits;
• Software composition, static code analysis, fuzzing, and other forms of testing can be used to determine weaknesses and vulnerabilities that represent vectors for attack and exploitation;
• Testing can support procurement and enterprise risk management to reduce risk exposures attributable to exploitable software.

Speaker bio
Joe Jarzombek is Director for Government, Aerospace & Defense Programs in Synopsys, Inc., the Silicon to Software™ partner for innovative organizations developing microelectronic products and software applications. He guides efforts to focus Synopsys’ global leadership in electronic design automation (EDA), silicon IP, and software integrity solutions in addressing technology challenges of the public sector, aerospace and defense, and critical infrastructure. He participates in consortia, public-private collaboration groups, trade associations, standards groups, and R&D projects to assist in accelerating technology adoption.

Previously, Joe served as Global Manager for Software Supply Chain Solutions in the Software Integrity Group at Synopsys. He led efforts to enhance capabilities to mitigate software supply chain risks via software security and quality test technologies and services that integrate within acquisition and development processes; enabling detection, reporting, and remediation of defects and security vulnerabilities to gain assurance and visibility within the software supply chain.

Jarzombek has more than 30 years focused on software security, safety and quality in embedded and networked systems. He has participated in industry consortia such as ITI, SAFECode, NDIA and CISQ; test and certification organizations such as Underwriters Labs’ Cybersecurity Assurance Program, standards bodies, and government agencies to address software assurance and supply chain challenges.

Prior to joining Synopsys, Jarzombek served in the government public sector; collaborating with industry, federal agencies, and international allies in addressing cybersecurity challenges. He served in the US Department of Homeland Security Office of Cybersecurity and Communications as the Director for Software & Supply Chain Assurance, and he served in the US Department of Defense as the Deputy Director for Information Assurance (responsible for Software Assurance) in the Office of the CIO and the Director for Software Intensive Systems in the Office of Acquisition, Technology and Logistics.

Jarzombek is a retired Lt Colonel in US Air Force and a Certified Secure Software Lifecycle Professional (CSSLP) and project management professional. He received an MS in Computer Information Systems from the Air Force Institute of Technology, and a BA in Computer Science and BBA in Data Processing and Analysis from the University of Texas - Austin.

Must RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, September 17, 2019 at 6:30 pm

Center for American Progress (CAP)

1333 H St. NW
10th Floor
Washington, DC, 20005

Click here for details.

 ISSA National Capital Chapter has partnered with Cyber Security Summit USA to offer our members an exclusive access to Cyber Security Summit DC Metro on July 16. First 25 members to register will receive a complimentary admission (standard price is $350). After, the code grants $95 admission. Please read below for details. 

Register Now: CyberSummitUSA.com Complimentary Admission with Promo Code: ISSA19DC (Standard Price $350) Complimentary Admission for First 25 Members to Register. After, Code grants $95 Admission. Admission is for C-Suite / Senior Level Executives & Directors / Managers of IT only. Sales / Marketing & Students are Not granted admission. You are invited to the Sixth Annual Cyber Security Summit: DC Metro. This exclusive conference is designed to enlighten Senior Executives on the latest threat landscape through interactive discussion based sessions & demonstrations with experts from best in class cyber security companies. Engage with fellow industry executives and business leaders during a catered breakfast, lunch, and cocktail & cigar reception. Register Now You will be eligible to receive up to 6 CPE Credits with your full day attendance. See Demonstrations & Evaluate Cutting-Edge Solutions From: (PARTIAL LIST) Interactive Panels & Discussions Include: (PARTIAL LIST) • Morning Security Briefing with Adam Hickey, Deputy Assistant Attorney General of the National Security Division at The U.S. Department of Justice • Closing Keynote with Curtis Dukes, Former Director at The NSA, and current Executive VP & GM, Security Best Practices & Automation at Center for Internet Security • IBM: The Security Implications of Moving to the Cloud • ServiceNow: How Government Can Transform Cyber Security Leveraging Automation and Orchestration • IDMWORKS: Best Practices for IAM Assessments, Blueprints & Roadmaps • Google Chrome Enterprise Interactive Discussion • Incident Response: What to do Before, During and After a Breach • Cloud INsecurity: Common Pitfalls that Organizations Make when Moving to the Cloud and How to Avoid Them • Insider Threat: What the CISO and Every IT Security Management Team Must Face & Govern 24/7 If you are interested in showcasing and/or speaking at the Cyber Security Summit contact Megan Hutton at 212.655.4505 x241 or This email address is being protected from spambots. You need JavaScript enabled to view it. Register Now to Secure Your Admission: CyberSummitUSA.com

 Join us on Tuesday, June 18 for our monthly chapter meeting with a special guest speaker:  

Macintosh Forensics
by Simson Garfinkel

Abstract
Macintosh is a hard operating system on which to do about forensics. The operating system is a mix of BSD Unix, the Mach kernel from CMU, utilities and functionality that have been cross-ported from GNU/Linux, and a whole bunch of custom code written by Apple. Some of that code has been written for desktop operating system, and some has been written for iOS, which started out as a fork of MacOS, diverged, and now seems to be coming back. And there are four fundamental kinds of programs on the Mac worthy of forensic analysis: the kernel, background processes (daemons), command-line tools, and programs that run under the Mac graphical user interface.

To make matters worse, the Macintosh operating system is changing fast, but it is changing incrementally. This means that some information published a few years ago is still current, but other information is hopeless out of date. Some old forensics techniques work just fine, others don’t work at all, and some work incompletely, as they access system data using legacy APIs.

This talk gives an overview of Macintosh forensics based on the course CFRS 764 — Mac Forensics, which I taught this spring at George Mason University. I will provide information about the kinds of information that the Mac records, discusses tools and resources for those interest in Mac forensics, and suggest opportunities for future research.

Speaker bio
Simson Garfinkel is the Senior Computer Scientist for Confidentiality and Data Access at the US Census Bureau. He holds seven US patents and has published more than 50 research articles in computer security and digital forensics. He is a fellow of the Association for Computing Machinery (ACM) and the Institute of Electrical and Electronics Engineers (IEEE), and a member of the National Association of Science Writers. His most recent book is The Computer Book, which features 250 chronologically arranged milestones in the history of computing. As a journalist, he has written about science, technology, and technology policy in the popular press since 1983, and has won several national journalism awards.

Garfinkel received three Bachelor of Science degrees from MIT in 1987, a Master's of Science in Journalism from Columbia University in 1988, and a Ph.D. in Computer Science from MIT in 2005.

Must RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, June 18, 2019 at 6:30 pm

Center for American Progress (CAP)

1333 H St. NW
10th Floor
Washington, DC, 20005

Click here for details.

 Join us on Tuesday, May 21 for an incredible double bill:  

Authentication Beyond SMS
by Kelley Robinson

&

Confidence as Code: Automated Security Testing in Cloud Environments
by Brad Geesaman

Abstract
In an age when a new data breach is revealed with frightening regularity, developers have a responsibility to secure our applications' user data more than ever. But fear not, YOU have the power to deter the hackers! You may recognize Two-factor Authentication (2FA) as an additional safeguard for protecting accounts, but do you really know how it works? This talk will show you how to implement One Time Passwords (including what's happening under the hood of those expiring tokens) and even provide a legitimate use case for QR codes! You'll come away recognizing the different approaches to implementing a 2FA solution and have a better understanding of the one that's right for your application. Together, we'll make the web a more secure place.

Speaker bio
Kelley works on the Account Security team at Twilio in NYC, helping developers manage and secure customer identity in their software applications.

Abstract
Given the extreme focus on delivery velocity in cloud-native environments, one of the biggest challenges for security and compliance teams is simply to keep up with the state of their highly dynamic infrastructure. Assessing a constantly-moving target without the right approach can result in insecure configurations and increased organizational risk. With a slight change in mindset and a increased focus on automated security testing, we can gain a more complete picture of the environment and continuously ensure security policy conformance. In this talk, we will outline a strategy for testing a sample cloud environment running a Kubernetes cluster from several different user perspectives and demonstrate automated testing to validate conformance to a desired state.

Speaker bio
Brad is an Independent Security Consultant helping clients improve the security of their Kubernetes clusters and supporting cloud environments. He was recently the Cyber Skills Development Engineering Lead at Symantec Corporation where he supported the operations and delivery of ethical hacking learning simulations on top of Kubernetes in AWS. Although he spent several years as a penetration-tester, his real passion is educating others on the real-world security risks inherent in complex infrastructure systems through demonstration followed by practical, usable advice on detection and prevention.

Must RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, May 21, 2019 at 6:30 pm

Center for American Progress (CAP)

1333 H St. NW
10th Floor
Washington, DC, 20005

Click here for details.

 Join us on Tuesday, April 16 for our monthly chapter meeting:  

Appsec in your Clouds
Jack Mannino, CEO of nVisium

Abstract
As cloud infrastructure and platform (IaaS/PaaS) providers differentiate their offerings, many organizations are adopting a multi-cloud strategy to leverage the best of what each world offers. Securing a multi-cloud environment presents challenges, as we need to ensure core controls are replicated across different stacks. We need to protect serverless functions, container orchestration systems, Identity & Access Management (IAM), big data workloads, DevOps pipelines, and secure networking & content delivery across different operating environments.

This presentation focuses on managing security in a multi-cloud operating environment targeting AWS, Azure, GCP and Oracle Cloud. We'll discuss the key architectural and procedural controls to focus on for strengthening your multi-cloud strategy and security posture. You will walk away with a better understanding of the nuances between cloud offerings, which controls can be applied quickly and consistently, and which controls may differ with competing clouds.

Must RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, April 16, 2019 at 6:30 pm

Center for American Progress (CAP)

1333 H St. NW
10th Floor
Washington, DC, 20005

Click here for details.

 Join us on Tuesday, March 19 for our monthly chapter meeting:  

FAIL SAFE
20 Ways to undermine your security program
by Tom Hallewell

Abstract
There's policy, and then there's reality. All too often, security teams find their efforts overridden or bypassed. Here are some tips on how to engage your stakeholders and keep your program moving forward. 

Must RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, March 19, 2019 

Center for American Progress (CAP)

1333 H St. NW
10th Floor
Washington, DC, 20005

Click here for details.

 Join us for a special joint event with Cover6 Solutions on March 12:  

Breaking into #Cyber / Lab Setup & Tools

Abstract
It's that time again! After a few months off for some much-needed rest, we're back at it and ready to start the year off right!

Must RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, March 12, 2019 

Center for American Progress (CAP)

1333 H St. NW
10th Floor
Washington, DC, 20005

Click here for details.

 Join us on Tuesday, February 19 for our monthly chapter meeting:  

Enterprise API Management Platform
by Aqeel Butt and Naresh Patel of Optimoz, Inc.

Abstract:
An API (Application Programming Interface) is a set of functions that allow the sharing of data between independently run applications. Over the past 24 months, more enterprises have begun to modernize their applications by adopting Microservices and API first strategy. Companies can quickly end up with hundreds or thousands of APIs embedded in their applications. With this, it has become essential to have an enterprise grade API management platform, not just to host their APIs but also control the exposure and consumption of those APIs. With the increase of public APIs in the market, how can we leverage an API management platform to handle the complexity of governance for multiple consumers?

About the Speakers
Aqeel Butt, Director of Engineering at OPTIMOZ is a passionate IT Professional with ten+ years of experience in enterprise architecture, systems administration, and virtualization. A proven track record of success leading complex projects while managing cross-functional resources to drive efficiency in enterprise technology operations. Recognized by peers for skillful leadership and execution of projects related to cloud architecture, cloud migrations, devsecops, automation, microservices and API driven development.

Naresh Patel, President of OPTIMOZ is a serial entrepreneur and technologist. He focuses on the delivery of Agile DevSecOps solutions leveraging heavily on the public cloud. OPTIMOZ enables enterprises and federal agencies to accelerate development and delivery of applications that engage customers and drive revenue. OPTIMOZ specializes in all aspects of cloud computing, DevSecOps (CI/CD), applications development, systems integration, system administration, database administration, data warehousing and information security. Prior to founding OPTIMOZ, Mr. Patel co-founded a Silicon Valley based successful company, GetHired.Com. He founded OPTIMOZ to share his passion for Agile DevOps development and start-up experience with commercial enterprises and federal agencies. OPTIMOZ is a Amazon AWS Advanced Consulting Partner.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, February 19, 2019 at 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
10th Floor
Washington, DC, 20005

Click here for details.

January 15, 2019

 Join us on Tuesday, January 15 for our monthly chapter meeting:  

RMF 2.0 for non-Federal Users
by Alex Grohmann 

Abstract:
Learning objectives
1) Understanding of the NIST Risk Management Framework
2) Briefing on the updates to Revision 2.0 of NIST 800-37
3) Walk through of a fictitious Federal Agency system undergoing the RMF process

The target audience are those who have not yet dealt with the NIST RMF and would like to understand the various components and how it would apply to a specific computer system. The talk will start with the steps included in the RMF process and will end with the review of the controls within one or two control families.

Speaker
Alex Grohmann has over two decades of experience in technology-related information security, risk management and data privacy. During his career, he has worked at both the state and Federal level, and his private sector involvement has spanned from energy to financial services. He is the founder and operator of Sicher Consulting, LLC. Mr. Grohmann holds industry certifications of CISSP, CISA, CISM and CIPT. He holds two bachelor degrees from Florida State University as well as an MBA from UMUC.

Mr. Grohmann is a Fellow at the Information Systems Security Association (ISSA), an international organization of information security professionals. He is the recipient of their international ‘Honor Roll’ for his lifetime contributions to the information security community. He has served on the board of directors for the Northern Virginia chapter of ISSA for over ten years, including as president for three. During his time, the chapter won the Chapter of Year.

He is a graduate of the FBI’s Citizens’ Academy and served on the board of directors for the Washington DC chapter of InfraGard for four years. Currently Mr. Grohmann serves on the board directors of Northern Virginia Community College’s Workforce Development taskforce, NOVA Cybersecurity Advisory Board and is an mentor at MACH 37, the Virginia cyber security accelerator. He also sits on the IT sector coordinating council (IT-SCC).

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, January 15, 2019 at 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
10th Floor
Washington, DC, 20005

Click here for details.

Featuring two events in December:

December 18, 2018

 Join us on Tuesday, December 18 for our monthly chapter meeting:  

Future Shock: Four Cyber-startups talk about the future

Contrast Security
Uses deep security instrumentation to identify vulnerabilities during development and protect enterprise applications in production, and it does this without application security expertise, the biggest challenge in any application security program.

Rali Kettani is a Solutions Architect with Contrast Security. He has a background in software development with extensive experience with SAST, IAST and RASP technologies. Rali holds a Master’s degree in Management Information Systems from The George Washington University and a Bachelor’s degree in Computer Science from Georgia College.

Fugue
Identifies security and compliance violations in cloud infrastructure and ensures they are never repeated. Fugue leverages a DevSecOps strategy that is underpinned by a platform that is designed to enable teams to effectively build cloud-native applications on secure and compliant cloud infrastructure.

Josh Stella is Co-founder and CTO of Fugue. Previously, Josh was a Principal Solutions Architect at Amazon Web Services, where he supported customers in the area of national security. He has served as CTO for a technology startup and in numerous other IT leadership and technical roles over the past 25 years. 

Savyint
Enables enterprises to secure applications, data, and infrastructure for Cloud and Enterprise. Saviynt pioneered Identity Governance & Administration (IGAaaS) 2.0 by integrating advanced risk analytics and intelligence with fine-grained privilege management.

Matt Schmidt has more than 20 years of business leadership experience. Matt is responsible for Saviynt's US Public Sector business. Matt's software sales career has spanned most industry verticals with a focus on delivering simplified solutions for highly engineered products, programs and enterprise initiatives.

Expanse
(formerly Qadium) is a SaaS company that continuously discovers, tracks, and monitors the dynamic global Internet Edge for the world’s largest organizations. We surface and help remediate Internet Edge risks to prevent breaches and successful attacks. Expanse shows you a complete, real-time view of all your Internet assets and what's talking to them.

Sean Donnelly leads cybersecurity research at Expanse, Inc. Sean is a passionate cybersecurity researcher with extensive experience in the industry. He holds a B.S. and M.S. from the United States Naval Academy and Boston University, respectively. As an active-duty U.S. Navy Cryptologic Warfare Officer, Sean worked for the National Security Agency (NSA) before becoming the Technical Director of Navy Blue Team at Fleet Cyber Command.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, December 18, 2018 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
10th Floor
Washington, DC, 20005

Click here for details.

 Join us on Tuesday, November 20 for our monthly chapter meeting:

Approaching Cybersecurity Law - A Guide for Information Security Professionals
by David Jackson  

Abstract
Cybersecurity law is a confusing subject. There are many different types of laws, which affect different organizations in different ways. This presentation provides insight in how to consider cybersecurity law as a discipline, and dispels the notion that law as a tool is all powerful. In fact, law can be quite limited, slow, and backward looking. Finally, the presentation ends with a discussion of the future of cybersecurity law, and how to identify the coming trends.

About the Speaker

David R. Jackson is a member of the ISSA DC and NOVA chapters, and he holds CISSP, CEH, and CIPP certifications. He works as a regulatory attorney for a government contractor in the Washington DC area, and he is a regular contributor to the ISSA Journal. Mr. Jackson has a JD from the University of Kansas, and an LL.M. from the University of Arkansas.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, November 20, 2018 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
10th Floor
Washington, DC, 20005

Click here for details.

 Join us on Wednesday, October 17 for our special event:

Cyber Career Panel: Getting Hired in Cyber
ISSA DC Chapter – Cyber Week Event 

Description
A panel of cybersecurity recruiters will share their tips and advice for successfully getting job in cyber. They will discuss the current hiring landscape, networking strategies, the importance of gaining the right qualifications (certifications, training, and education), building your professional experience, developing your resume, and preparing for interviews. Learn how to stand out from the crowd!

Panel Moderator
Elena Steinke, MBA | CISSP | Security+ | C|EH | Threat Intelligence Analyst, Cybersecurity Strategic & Tactical Architect, Geek, Cybersecurity Enthusiast, and its Champion of Diversity

Director, on the National Board of Women’s Society of Cyberjutsu (WSC)

Industry recognized Jane-of-All-Trades Security Technologist expert, specializing in providing strategic direction, designing, building, and directing cybersecurity operations across continents on multi-national projects, in the financial, healthcare, and federal industries. Stood up and directed multiple 24/7 Security Operation Centers (SOC), Network Operation Centers (NOC), Data Centers, and management of virtualized storage technologies, and elastic cloud environments. Security operations include, establishing, and leading, Threat Intelligence, Hunting, Detection, & Response; Vulnerability Management; Security Assessment; Penetration Testing; Risk Management; Secure Credential Management; Key Management; Security & Awareness Training; Information Assurance; and Governance, Compliance & Policy programs across industries. Lead global efforts for Automotive and Mobile Security, Banknote Processing Systems, Electronic Payments, eSIM, and IoT Technologies She holds a Bachelors in IT, an MBA, and is pursuing her second Masters from Mercyhurst University in Applied Intelligence. Her certifications include CISSP, CEHv9, Security+, and Intel Threat Analyst. When Elena is not being a geek, she enjoys racing triathlons.

Panelists
Leslie Taylor, Senior Cleared Talent Recruiter for Cybersecurity & Emergency Management, ICFS

Tina Atwell, SPHR, SHRM-SCP, Vice President of Administration, G+D Mobile Security, Inc.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Wednesday, October 17, 2018 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
10th Floor
Washington, DC, 20005

Click here for details.

 Join us on Tuesday, October 16 for our monthly chapter meeting:

Topic:
Weaponized Information, crafting reality, and targeting the world's most exploitable information systems

Speaker:
Dr. Richard Forno

Abstract:
Some believe 'cyberspace' is an operational environment that involves aspects of the physical, informational, and cognitive. In recent years, we have seen how these environments can be targeted, attacked, and/or exploited for nefarious purposes by adversaries ranging from criminals to foreign nations. Although some argue this represents a new form of warfare, it actually has its roots deep in history and simply is the latest example of adversaries using all available tools to acheive their goals.

From social media, so-called 'fake news', partisan echo chambers, marketing, disinformation, and good old fashioned hacking, this talk discusses the three-dimensional construct of cyberspace and how technology helps blur the lines between the digital and physical. In particular, we will discuss how adversaries, both foreign and domestic, can use these constructs in combination to disrupt the social fabric of both userdom and citizenry to influence political, commercial and/or cybersecurity outcomes. After all, the human mind is the most complicated information system in the world -- but sadly one of the most exploitable ones, too.

About the Speaker:
Dr. Richard Forno is a Senior Lecturer in the UMBC Department of Computer Science and Electrical Engineering, where he directs the UMBC Graduate Cybersecurity Program, serves as the Assistant Director of UMBC's Center for Cybersecurity, and is an Affiliate of the Stanford Law School's Center for Internet and Society (CIS). His twenty-year career in operational cybersecurity spans the government, military, and private sector, including helping build the first formal cybersecurity program for the US House of Representatives, serving as Chief Security Officer for Network Solutions (then, the global center of the internet DNS system), and co-founding the CyberMaryland conference. From 2005-2012 he was a Visiting Scientist at the Software Engineering Institute at Carnegie Mellon University where he served as a course instructor for the CERT Coordination Center (CERT/CC). As a technologist and student of national security studies, Richard has multiple interdisciplinary research and professional interests in the influence of technology upon national security, individuals, and global society.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, October 16, 2018 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
10th Floor
Washington, DC, 20005

Click here for details.

 Join us on Tuesday, September 18 for our monthly chapter meeting:

Topic:
Access Control Systems

Speaker:
Roger Roehr

Abstract:
Access control should comprise something you have, something you know, and something you are. Barcode, barium ferrite, magnetic strip, Weigland, proximity, and Hollerith are types of card or badge readers. Barriers restrict or impede access, are continuous, and deter threats. Locks are mechanical or electrical. Containers are classified by the Underwriters Association and categorized as burglary, record, and media. Area classification is controlled, limited, and exclusion.
Roger Roehr will present detail of each providing insight to what goes on behind the scenes with access control.

About the Speaker:
Roger Roehr is a director at Integrated Security Technologies, Inc. Roger’s core competencies are in the design, installation, and maintenance of electronic physical security, security video and access control systems. He is actively involved in developing standards for the integration of biometrics and smart card technology in Physical Access Control Systems (PACS). Previously he was involved in developing, testing, and implementing a wide range of integration and consulting engagements for identity management and electronic physical security. Roger was a member of the team that delivered the GSA’s FIPS 201 shared service solution. Lead the team that developed the GSA Approved Products List (APL) test harness and NIST Special Publication 800-96. He was the technical lead for physical access control on the Transportation Works Identification Credential (TWIC) smart card identity program. Developed the medium security method that was published in the Technical Implementation Guidance: Smart Card Enabled Physical Access Control Systems by the Government Interagency Advisory Board (IAB). Held the position of senior system integrator for the Department of State’s roll out of smart card enabled PASC. Roger severed for two years as the Chair of the Smart Card Alliance Physical Access Control council and currently serves as a member of the council’s steering comity. Prior to becoming a independent consultant, Roger held a number of engineering and technical positions at Tyco, BearingPoint, M.C. Dean, Battelle Memorial Labs, Siemens Building Technology and Security Technology Group. Roger served in the Air Force Security Police. Specialties: HSPD-12 Identity management, smart card and physical access.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, September 18, 2018 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
10th Floor
Washington, DC, 20005

Click here for details.

 Join us on Tuesday, August 21 for our monthly chapter meeting:

Topic:
Cybersecurity: No longer just an IT issue.

Speaker:
Mark Fearer

Abstract:
Information security and physical security share at least the domains of insider threat, access control, and awareness training. Protecting the keys to the kingdom involves safeguarding assets. What do you wish to protect? How valuable is what you wish to protect? An Impact Analysis identifies valuable assets via Risk Assessment. In comparing and contrasting information security with physical security we have in common at least gatekeepers, authentication, insider threats, awareness training, and the issues of factory defaults.

Mark Fearer will discuss the domains of insider threat, access control, and awareness training then compare and contrast information security with physical security.

About the Speaker:
Mark Fearer, CISA, CISSP leads a team of information technology auditors at the US Securities & Exchange Commission who examine infrastructure of stock exchanges for good practices in efforts to keep them available and secure. Mark and his team reference NIST standards for baseline information security. With three decades of system and network administration experience Mark holds a masters degree in computer science, several industry certifications, and is currently pursuing a doctorate in cyber-security at Capitol Technology University in Laurel. Mark has been active with ISSA for six years.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, August 21, 2018 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
10th Floor
Washington, DC, 20005

Click here for details.

 Join us on Tuesday, June 19 for our monthly chapter meeting:

Topic:
Incorporating Enterprise Priorities to the Risk Management Framework

Speaker:
Noel A Nazario 
Federal Cyber Security Senior Director for Annuk Inc.

Abstract:
On September 28th, the National Institute of Standards and Technology (NIST) announced the release of a discussion draft of Special Publication (SP) 800-37, Revision 2, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy. A key goal of this document is to institutionalize critical enterprise-wide risk management preparatory activities to facilitate a more efficient and cost-effective execution of the Risk Management Framework at the system and operational level.

This presentation will discuss this organizational preparation step and propose implementation strategies that facilitate better communication between system owners and senior leaders and executives at the enterprise and mission/business process levels. We will also discuss outputs of the organizational preparation step including the clear definition of organizational risk tolerance and acceptable limits for the implementation of security and privacy controls; identification of common controls and the development of organization-wide tailored security and privacy control baselines; reductions to the complexity of the IT infrastructure; and identification of high-value assets and high-impact systems to prioritize their protection.

About the Speaker: 
Noel A. Nazario is Federal Cyber Security Senior Director for Annuk Inc. He is focused on growing Annuk's presence within the U.S. Federal market and supporting the Washington Metropolitan Area Transit Authority (WMATA) by leading their IT Architecture Review Board. As ARB Lead, he brings a wealth of technical and leadership experience to steer WMATA towards a coherent IT Enterprise Architecture that is closely aligned with organization-wide goals and supports the integration of best-in-class practices and new technologies.



Mr. Nazario currently holds a Certified Information Security Manager (CISM) designation. He participates in multiple industry groups and is a frequent conference host and speaker for organizations such as the ISACA Greater Washington, DC Chapter.



Specialties: 
Cyber Security; IT Enterprise Architecture; IT Governance; Federal Cloud; FedRAMP; Federal Information Security Management Act (FISMA); IT Program Management; IT Strategy and Risk Management; Public Key Infrastructure (PKI); security labels and data categorization; development of IT security standards and secure communications protocols; IT controls and risk assessment; shared service provider assessments; compliance with Federal cyber security requirements.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, June 19, 2018 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
10th Floor
Washington, DC, 20005

Click here for details.

 Join us on Tuesday, May 15 for a special ISSA National Capital Chapter meeting and make your voice heard. ISSA-DC is your chapter and we want you to help us shape the future of our meetings.

As always, we'll serve some light refreshments and then, we will have an engaging discussion on a series of topics including future speakers you would like to see and hear, chapter mentoring program, field trips, even the food options. We will also introduce a candidate for the ISSA International board of directors and hear about this vision for the future of the association. 

Topic:
Make Your Voice Heard 

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, May 15, 2018 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
10th Floor
Washington, DC, 20005

Click here for details.

 Due to inclement weather, the meeting is rescheduled to
March 27, 2018 at 6:30 PM

The Battle for Cyberspace
by Samuel S. Visner

Abstract
Samuel S. Visner, Director of the National Cybersecurity Federally Funded Research and Development Center and Professor of cybersecurity policy, operations, and technology at Georgetown University, will speak on changes in the way in cyberspace is regarded by different countries, and the consequences of these changes for information security professionals. The talk will discuss the following topics:
• The forces shaping the future of cybersecurity
• Cybersecurity as an instrument of statecraft; the “sovereignty” of cyberspace
• Efforts by other countries to control and govern the cyberspace on which we depend.

The talk will include a high-level history of cyberspace, the rise of integrated computer networks, and the role cybersecurity plays in the international system, with particular attention given to the “new normal” in which hostile computer network exploitation and attack, coupled to “computer network influence,” have emerged as daily phenomena with which information security professionals and the C-Suite must deal.

About the Speaker
Samuel Sanders Visner is the Director of the National Cybersecurity Federally Funded Research and Development Center (MITRE), sponsored by the National Institute of Science and Technology (appointed October 30, 2017). Sam also serves as member of the Cyber and Domestic Security Councils of the Intelligence and National Security Alliance, and the Cyber Committee of the Armed Forces Communications and Electronics Association. Sam is an adjunct professor of Science and Technology in International Affairs at Georgetown University, where he teaches a course on cybersecurity policy, operations, and technology. Sam is also a member of the Council on Foreign Relations, the Atlantic Council, and an Intelligence Associate of the National Intelligence Council, and is a member of the Intelligence Community Studies Board, sponsored by the National Academy of Science and serving the Office of the Director of National Intelligence. Sam served previously as Senior Vice President and General Manager, Cybersecurity and Resilience, ICF International. Prior to ICF, Sam served as Vice President and General Manager, CSC Global Cybersecurity, as a Senior Vice President at SAIC, and as Chief of Signals Intelligence Programs at the National Security Agency, from which he received the Agency's highest award for civilian service. Sam also served as a member of the Board of Directors, CVG/Avtec (2008- 2010). Sam holds a Bachelor's degree in International Politics from Georgetown University and a Master's degree in Telecommunications from George Washington University. Sam served twice on the Intelligence, Surveillance, and Reconnaissance Task Force of the Defense Science Board, and has published articles on national and cybersecurity in World Politics Review, the Georgetown Journal of International Affairs, and the Defense Intelligence Journal. Sam is married to Antoinette (Toni) Burnham, Washington DC's leading urban beekeeper.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, March 27, 2018 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
10th Floor
Washington, DC, 20005

Click here for details.

 Join us for our monthly meeting
on April 17, 2018 at 6:30 PM

Developing Your Cyber Career Action Plan
by Teresa Allison

Abstract
Have you been thinking about transitioning to a career in cybersecurity, but are not quite sure how to make your dream a reality? Are you currently working a cyber job but want to make a plan for advancement? This program walks you through the steps that you need to take in order to explore your cyber career options. It gives you a structured framework for exploring your interest in cyber, researching cyber positions, learning about cyber policies and standards, learning cyber tools, obtaining cyber / IT certifications, as well as applying for cyber jobs. This approach helps you to create your own cyber career action plan so that you can position yourself to join the field of cybersecurity.

About the Speaker
Teresa Allison is an Independent Consultant with MBO Partners. She has worked in the field of information technology consulting for over 18 years. She provides clients with solutions for managing multi-billion dollar IT programs. She specializes in strategic planning, budgeting, performance management, portfolio management, governance, risk management, legal & regulatory compliance, project management, program management, process improvement, business operations transformation, strategic communications and stakeholder management.

Allison has supported clients in the domain areas of Health & Human Services, Homeland Security, Transportation, Financial Regulatory Agencies, Veterans Affairs, Diplomacy & Foreign Affairs, as well as International Development & Foreign Assistance. On her most recent project she assisted a global strategy consulting firm in implementing IT security and privacy policies to comply with the European General Data Protection Regulation (GDPR). She also teaches CISSP certification classes at ASM Educational Center.

Teresa received her bachelor’s degree in Political Science from Xavier University. She graduated from Carnegie Mellon University’s H. John Heinz III School of Public Policy with a Master of Science in Public Policy and Management with a concentration in Management of Information Systems. She is certified IT professional who currently holds the PMP, CGEIT, CSM, ITIL, Security+, CISA, CISSP, and Lean Six Sigma certifications. 

Teresa Allison is the Past President of the Carnegie Mellon University Heinz College Alumni Association comprised of over 11,000 alumni from around the world. She currently serves as a volunteer for the Women’s Society of Cyberjutsu which encourages women to pursue careers in Cybersecurity. She also coordinates higher education outreach programs for the Project Management Institute (PMI) as a member of the Higher Education Partnerships committee and Information System Security Association (ISSA) as the Vice President of Strategic Relations. Allison is also a member Information System Audit and Control Association (ISACA) DC Chapter and the Healthcare Information Management Systems Society (HIMSS).

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, April 17, 2018 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
10th Floor
Washington, DC, 20005

Click here for details.

 
Please note the new venue below.

February 20, 2018 at 6:30 PM

IoT the Next Frontier of Cyber Risk
by Amber Schroader & Greg Kipper

Please note the new venue below.

Abstract
The landscape of cyber is constantly changing and those changes are coming faster than ever before. The new Internet of Things area is one of these areas that are adding billions of devices that all create a true cyber-impact in our lives. Business Insider forecasts that by 2020, 75 percent of new cars will come with built-in IoT connectivity. This is only one of the 9 environments of IoT that we will see unprecedented growth. So, what do we do to prepare our cyber policies and forensic response for this emerging technology. Learn what areas are growing and how to watch for the associated risks. Learn what is required for a digital forensics response plan when it comes to IoT devices.

About the Speakers

Amber Schroader, CEO & Founder, Paraben Corporation
Throughout the past two decades Ms Schroader has been a driving force for innovation in digital forensics. Ms. Schroader has developed over two-dozen software programs designed for the purposes of recovering digital data from mobile phones, computer hard drives, email, and live monitoring services. Ms. Schroader has taught and designed the established protocols for the seizure and processing of digital evidence that have been used by numerous organizations throughout the world. Ms. Schroader has coined the concept of the “360-degree approach to digital forensics” as well as started the momentum and push to the “Forensics of Everything-FoE” with her focus to unique problems in digital evidence and solutions in the area of IoT devices. Ms. Schroader has been a huge industry influence in pushing for a big-picture consideration of the digital evidence and the acquisition process and analysis techniques used. An accomplished curriculum developer and instructor; Ms. Schroader has written and taught numerous classes for this specialized field as well as founded multiple certifications. Ms. Schroader continues support through book contributions and other industry speaking engagements.

Greg Kipper, Cyber-Futurist
Greg Kipper is an accomplished solutions architect, emerging technology strategist, certified security professional, and five-time published author with strong practical experience in all aspects of information technology, cyber security, and proactive cyber threat response. He is also a recognized cyber forensics expert and investigator who has worked several high-profile cases to include the Bernie Madoff scandal. The combination of these two disciplines is both rare and comprehensive in of itself and invaluable to any organization. Greg has also established himself as a creative and strategic thought leader in emerging information technologies gaining the attention and trusted advisor status with the CTO offices of the U.S. Army, Air Force and Coast Guard as well as major financial institutions, Elsevier Publishing, and other Fortune 500 companies. Greg is also a keynote speaker and presenter at conferences and forums around the world and encompasses one of the most difficult things to find in today’s market...someone with proven technical abilities and insights coupled with business sense and strong business communication skills.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, February 20, 2018 6:30 PM

Please note the new venue:
DC Department of General Services
441 4th Street, NW,
Washington, DC  20001,
Room 1117
(Judiciary Square Metro - Red line)
Click here for a map.

December 14, 2018

The National Capital Chapter has partnered with the SANS Institute again this year to offer exclusive access for its members to SANS@Night events at Cyber Defense Initiative 2018. The chapter meeting will take place at Washington Hilton on Friday, December 14, 2018.

Please note that the event is free but you must RSVP at least 24 hours before the event so we can have your badge ready for you. 

The chapter members and their guests will have access to the following events:

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Friday, December 14, 2018

Location Information

Washington Hilton

1919 Connecticut Ave. NW

Washington, DC  20009 US

Phone: 202-483-3000

Fax: 202-232-0438

www1.hilton.com

July 17, 2018

The National Capital Chapter has partnered with the SANS Institute again this year to offer exclusive access for its members to SANSFIRE 2018. The chapter meeting will take place at Marriot Wardman Park Hotel on Tuesday, July 17.

Please note that the event is free but you must RSVP at least 24 hours before the event so we can have your badge ready for you. 

The chapter members and their guests will have access to the following events:

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, July 17, 2018

Location Information

December 15, 2016

The National Capital Chapter has partnered with the SANS Institute again this year to offer exclusive access for its members to SANS@Night events at Cyber Defense Initiative 2017. The chapter meeting will take place at Washington Hilton on Friday, December 15, 2017.

Please note that the event is free but you must RSVP at least 24 hours before the event so we can have your badge ready for you. 

The chapter members and their guests will have access to the following events:

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Friday, December 15, 2017

Location Information

Washington Hilton

1919 Connecticut Ave. NW

Washington, DC  20009 US

Phone: 202-483-3000

Fax: 202-232-0438

www1.hilton.com

December 16, 2015 starting at at 5:30 PM

ISSA National Capital Chapter invites you to a special event:

ISSA -DC at SANS@Night Cyber Defense Initiative 2015 

The National Capital Chapter has partnered with the SANS Institute again this year to offer exclusive access for its members to SANS@Night events at Cyber Defense Initiative 2015. The chapter meeting will take place at Grand Hyatt Washington on Wednesday, December 16, 2015. 

Please note that the event is free but you must RSVP at least 24 hours before the event so we can have your badge ready for you. 

The chapter members and their guests will have access to the following events:

5:30pm - 7:30pm
Vendor Showcase — Vendor Event
7:15pm - 9:15pm
Malware Analysis for Incident Responders: Getting Started - Lenny Zeltser
7:15pm - 8:15pm
The Tap House Phil Hagen
8:15pm - 9:15pm
The Plinko Board of Modern Persistence Techniques - Alissa Torres
8:15pm - 9:15pm
Debunking the Complex Password Myth - Keith Palmgren
8:15pm - 9:15pm
ICS/SCADA Cyber Attacks - Fact vs. Fiction - Robert M. Lee

Malware Analysis for Incident Responders: Getting Started - Lenny Zeltser
Knowing how to analyze malware has become a critical skill for incident responders and forensic investigators. A good way to get started with such efforts involves examining how malicious software behaves in a controlled laboratory environment. In this two-hour seminar briefing, Lenny Zeltser demonstrates key aspects of this process, walking you through behavioral analysis of a malware specimen by using several free tools and even peeking into the world of code analysis.
You will see practical techniques in action and understand how malware analysis will help you to triage the incident to assess key capabilities of the malicious software. You will also learn how to determine ways of identifying this malware on systems in your environment by establishing indicators of compromise (IOCs). This seminar will help you start learning how to turn malware inside out.

The Tap House - Phil Hagen
Packets move pretty fast. The field of Network Forensics needs to move fast, too. Whether you are investigating a known incident, hunting unidentified adversaries in your environment, or enriching forensic findings from disk- and memory-based examinations, it's critical to stay abreast of the latest developments in the discipline.
In this @Night series, Phil Hagen will discuss some of the latest technologies, techniques, and tools that you will want to know in pursuit of forensication nirvana.
Phil is also an avid craft beer fan, so there's a good chance you will learn something about a new notable national or interesting local beer in the process.
This presentation will be helpful for those that wish to keep up-to-date on the most cutting-edge facets of Network Forensics.

The Plinko Board of Modern Persistence Techniques - Alissa Torres
No matter what techniques an attacker employs to hide and persist on compromised remote systems, we must be up for the challenge, to detect, analyze and remediate. This session focuses on the latest techniques modern malware is using to ensure continued presence in your network. As detailed in recently released industry threat intelligence reports, these methods are increasing in sophistication and are often times missed by forensics tools developed to only enumerate common autorun and service persistence methods. In this presentation, we will cover advanced detection techniques, pivoting from physical memory analysis to the examination of remnants found on the file system.

Debunking the Complex Password Myth - Keith Palmgren
Perhaps the worst advice you can give a user is "choose a complex password". The result is the impossible-to-remember password requiring the infamous sticky note on the monitor. In addition, that password gets used at a dozen sites at home, AND the very same password gets used at work. The final result ends up being the devastating password compromise. In this one-hour talk, we will look at the technical and non-technical (human nature) issues behind passwords. Attendees will gain a more complete understanding of passwords and receive solid advice on creating more easily remembered AND significantly stronger passwords at work and at home, for their users, for themselves and even for their children.

ICS/SCADA Cyber Attacks - Fact vs. Fiction - Robert M. Lee
Industrial Control Systems (ICS) play a huge role in almost every aspect of modern day life. Supervisory control and data acquisition (SCADA) as an example play a large role in monitoring and controlling the power grid, oil pipelines, and more. It's understandable then that they gain attention in national headlines when they come under attack. Due to this ability to grab attention and the complexity behind getting the technical details right though there have been cases where the stories have just been down right wrong. These inaccurate case-studies push hype and confusion which drives the investment of resources into trying to solve the wrong problem. The threat is real, but plenty of the stories are not.
In this presentation, Robert M. Lee, the ICS515 author and FOR578 co-author will break down a number of high profile stories that are fiction and then deconstruct real threats to show the actual issues in the community and what can be learned towards defense.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Wednesday, December 16, 2015 starting at 5:30 PM

Grand Hyatt Washington
1000 H Street NW
Washington, DC 20001 US

Dear Member, 

Voting for Chapter Officers is officially open.  You may vote until 11:59 PM Sunday, December 14, 2014.  The new Board will be announced at the December 15 meeting. Click the link at the bottom of this email to access ballot.  You must supply your ISSA ID number to vote.  If you vote more than once, the last vote received will be the vote counted.
 
The candidates are:
 
President
Jim Shanesy
Jim Shanesy has more than 30 years experience as a controls engineer, software developer and information security specialist. He has worked both in private industry and as a government contractor for such varied clients as the US General Services Administration, Federal Reserve Board and the Administrative Office of the US Courts. He holds Security+ and CISSP certifications.  He is currently a Senior Risk Analyst with Knowledge Consulting Group of Reston, VA and presently serves as Executive VP of the ISSA-DC Chapter.
 
Statement:  My goals for the Chapter are simple – to continue the robust growth in membership we’ve enjoyed for the past two years, strengthen strategic relations with not only the other ISSA Chapters in the Region but with private industry to obtain sponsorship, and establish outreach to the security programs of area educational institutions.
 
Executive Vice President
Scott Binder
Thank you for considering to vote for me for the position of Executive Vice President. My qualifications include more than 20 years’ experience assisting the federal government and private sector with planning, managing, and executing complex information technology engagements. In my current position as a Director within MorganFranklin Consulting, I have the wonderful opportunity to network, teach, and learn from key leaders from around the country. I’m a detail oriented professional with proven success in planning, managing, and working with teams and individuals to accomplish short, medium, and long term initiatives and goals. For the past two years, I have served the ISSA-DC chapter as the President and I have been a long standing board member in a variety of other positions. I hope to continue serving the National Capital Chapter as the EVP and want to thank you for your consideration when casting your ballot.
 
Treasurer
Eddie Schwartz
Eddie Schwartz is President and COO of White Ops, Inc., and has over 25 years experience in the information security field.  Eddie formerly worked as VP/Chief Security Officer for RSA, Co-Founder and CSO of NetWitness (acquired by EMC), EVP/CTO of ManTech, EVP and General Manager of Global Integrity (acquired by INS), SVP of Operations of Guardent (acquired by VeriSign), VP/CISO of Nationwide Insurance, a Senior Computer Scientist at CSC, and a Foreign Service Officer.   Eddie advises a number of early stage security companies, and has served on the Executive Committee for the Banking Information Technology Secretariat (BITS).  Eddie serves on ISACA’s Strategic Advisory Council and is Chairman of ISACA’s Global Cybersecurity Taskforce.  He has a B.I.S. in Information Security Management and an M.S. in Information Technology Management from the George Mason University School of Management.
 
Vice President of Communication
Branko Bokan
Branko has been a member of the chapter's board of directors for the past six years. He is an information security professional with extensive experience in IT and security management and technologies. Branko holds a BSc in Information Systems from the London School of Economics, and an MSc in Information Security from Royal Holloway, University of London. He currently works as a director of cyber security at Innotion Enterprises Inc.
 
Vice President of Programs
Maureen Kaplan
Maureen Kaplan is the Managing Director & COO for Global Security within Verizon Enterprise Solutions.  In this role, she is responsible for business operations oversight, enabling growth in Cyberthreat Intelligence strategic services to customers.  She has spent the past 10 years working with global organizations in the development of their security risk mitigation programs and assisting with the delivery of strategic projects.  Previous roles within Verizon include leading healthcare cloud & security sales, managing complex solution practice for major enterprise clients, and received a Black Belt in the Verizon Lean Six Sigma program. 
 
Prior to joining Verizon in 2008, Maureen was Vice President of Sales Development for Perimeter eSecurity.  Maureen holds CISSP, CHSA, CHPA certifications.  Maureen received an Engineering degree from the University of Michigan, and spent a dozen years as a software engineer designing manufacturing automation systems.
 
Vice President of Membership
Kathie Miley
Kathie has 24 years of experience in the information technology and security field, and is currently Global Executive Director of Security Solutions Sales and Engineering at Verizon.  Kathie has held a variety of leadership roles in the information security and cyber threat industry including positions at Predictive Systems Global Integrity division, NetSec, MCI, Verizon's CyberTrust and Terremark divisions, and Verizon Enterprise Solutions.  Kathie’s expertise includes Enterprise Governance Risk and Compliance, Security Policy Assessment and Development, Global Managed Security, Physical Security and Advisory, Cyber Threat and Intelligence, Vulnerability and Patch Management, Identity and Access Management, Security and Network Architecture, and Security Training and Enablement.  Kathie has held memberships in industry security organizations including ISSA, ASIS, HIMSS, and others.  Kathie currently maintains her Certified HIPAA Security Expert (CHSE).
 
Vice President of Strategic Relations
Virginia Elharam
Mrs. Virginia Elharam has over 15 years of experience; combined both as a federal government employee with NIH and as a consultant with several US Federal Government Agencies and Departments.  Mrs. Elharam is currently working for System 1, Inc. as a Program Manager supporting a US Federal Government Agency.  Mrs. Elharam has experience designing, implementing, and managing information assurance programs for federal government agencies.  Additionally, Mrs. Elharam served as the ISSA-DC chapter Vice President of Strategic Relations (2009-2010) and is an active member of InfraGuard since 2009.
 
Vice President of Education
TomHallewell
Tom is the incumbent VP of Programs for the Chapter.  He has more than 15 years’ experience in Information Security.  He currently works for the Federal Government in Software Assurance and Identity Management.  He holds numerous certifications, including CISSP,  Certified Scrum Master.

CLICK HERE TO CAST YOUR VOTE

Thomas E. Hallewell, CISA, CISSP, CRISC, CSSLP, Certified Scrummaster
VP, Programs, Former Past President, Election Committee Chair
National Capital Chapter, ISSA
www.issa-dc.org

 November 21, 2017 at 6:30 PM

The Blockchain Hype: What's reality
by Meagan Metzger

Abstract
Chances are that you have heard about the promise of blockchain. Some say that blockchain will revolutionize the world's economy, and not just around digital currency. Blockchain can be used for supply chain, data exchange, and more. But is it really the silver bullet? Join us to learn more about what problems the blockchain can solve and how it can potential improve transparency, prevent fraud, and make sure data doesn't end up in the wrong hands. We'll also discuss the challenges companies will face when adopting blockchain, the major security concerns, and the potential unintended consequences.

About the Speaker
Meagan is the Founder and CEO of Dcode, an accelerator program to help technology companies break into the Federal Government market. Dcode is currently running a blockchain focused program to help agencies successfully implement these solutions. Prior to Dcode, Meagan served as Chief Operating Officer (COO) of a mobile and cloud government products and services company, helping to stand up and grow it by over 200% in its first two years. She previously served as Chief Strategy Officer (CSO) for government IT consulting firm, helping the company grow from $500K in revenue to over $12 million in only two years. The company was placed on Washington Technology’s Fast50 list, as one of the fastest growing small businesses in DC, for three years in a row. Meagan has worked closely with senior leadership across DoD and civilian agencies, providing hands-on support for the execution of multi-million dollar IT programs and projects, ranging from $1M - $70M+ budgets.

Meagan also currently serves as a mentor for startups through Springboard Enterprises, a network of innovators, investors and influencers who are dedicated to building high-growth technology-oriented companies led by women. Meagan also serves at the chair of a Career Advisory Board in the Athletic department at George Washington University, her alma mater, where she was a captain of the nationally ranked Division I gymnastics team.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, November 21, 2017 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
10th Floor
Washington, DC, 20005

Click here for details.

 October 17, 2017 at 6:30 PM

Cyber Career Paths

Interested in a Cyber Career? Get career advice and insights from a panel of successful Cybersecurity Professionals. The ISSA National Capital Chapter is hosting a Cyber Career Panel as part of TechScoop's DC CyberWeek.

Get career advice and insights from a panel of successful Cybersecurity Professionals.

Abstract
Whether you are a senior cyber security expert or just starting your career in cyber, you will benefit from this event. More senior professionals are encouraged to bring their protegees. The session will last approximately 90 minutes and will begin with a brief Chapter introduction and housekeeping, followed by a moderated discussion/Q & A.

Here is a sampling of issues our moderator will cover:

• Brief panelist introduction/bio
• How did you get into cybersecurity?
• What does a typical day look like?
• What certifications and courses do you think are valuable?
• What skills and attributes do you think are most needed in the field?
• What do you look for when hiring?
• What advice would you give a student who wants to be successful in this field?

Moderator
Tyrone Wilson President of Cover6 Solutions, Organizer of the D.C. Cyber Security Professionals and Breaking Into Cyber Meet Up groups, Virtual CISO.

Panelists
Eric Mill Senior Advisor, U.S. General Services Administration's Technology Transformation Service (pending Agency approval)

Loren Schwartz, IT Audit Partner, Cotton & Co.

Michael Misumi, CIO, JHU Applied Physics Laboratory

Vu Nguyen, Acting CISO, US Citizenship and Immigration Services

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, October 17, 2017 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
10th Floor
Washington, DC, 20005

Click here for details.

Speaker bios

Eric Mill, Sr. Advisor, TTS/GSA, has been an integral force in moving the digital security discussion into the minds of public servants across the government. He was the driving force behind M-15-13, which requires federal websites to use HTTPS. He leads the “Security-today” listserv, in which the community discusses vulnerabilities, solutions, new technology capabilities, and other cybersecurity-related issues. He was also a main component of the government's recent adoption of bug bounties, which have proved extremely valuable to the Pentagon and others. Eric is a true gem in this field, and we are all lucky to have him in public service.
Eric was just nominated for a FedScoop 50 award.

Mr. Michael Misumi became the Chief Information Officer of the Johns Hopkins University Applied Physics Laboratory on January 3, 2008. In addition to serving as the CIO, Mr. Misumi is a Department Head leading a 350-person department that manages IT applications and infrastructure for APL, while also serving on the front lines of cyber-protection, securing APL networks from hackers and other outside threats. As the nation’s largest University Affiliated Research Center (UARC), APL performs research and development on behalf of the Department of Defense, the intelligence community, the National Aeronautics and Space Administration, and other federal agencies. The Laboratory has more than 6,000 staff members who are making critical contributions to a wide variety of nationally and globally significant technical and scientific challenges. Prior to joining APL he was at the RAND Corp. in Santa Monica, Calif., where he was Deputy CIO. He led the operational Cyber Strategy development and has over 20 years experience developing information technology strategy, security operations, project portfolio management, network operations, data center operations, desktop administration and personnel management. Mr. Misumi is the APL Cyber Response Incident Lead and has led a Cyber Security review of all of Johns Hopkins institutions. In addition to his APL responsibilities, he leads the Navy UARC Cyber Security Task Force, serves on the US Strategic Command’s (USSTRACOM) Strategic Advisory Group (SAG) IT Task Force and the Computer Advisory Committee for Oakridge National Laboratory, and is a Board Member for the Howard County School System Cyber Security program. Mr. Misumi earned a BA and MBA from the University of California, Los Angeles.

Loren Schwartz joined Cotton & Company in May 2002 and was elected a partner in April 2003. He has more than 20 years of diversified information system audit, financial and operational audit, privacy, and risk management consulting experience. He directs many of Cotton & Company’s major information technology reviews and audits. Mr. Schwartz’s experience includes directing and participating in a wide range of system reviews, Federal Information Security Management Act/Federal Information Security Modernization Act (FISMA) audits, financial statement audits, process re-engineering improvement projects, and audits of internal management controls of automated information systems. He has directed projects with clients ranging in size from start-up entrepreneurial organizations to Fortune 500 organizations. His industry experience includes both commercial and governmental clients. Mr. Schwartz has also conducted speaking engagements for well-known industry organizations on a variety of topics related to information technology. Mr. Schwartz holds a Bachelor of Science in Accounting from Virginia Polytechnic Institute and State University. He is a Certified Public Accountant (CPA), a Certified Information Systems Security Professional (CISSP), and a Certified Information Systems Auditor (CISA). He is also an active member of the American Institute of Certified Public Accountants (AICPA) and the Information System Audit and Control Association (ISACA) (Washington, DC Chapter). In addition, Mr. Schwartz is a Board Member at the Ronald McDonald House Charities of Greater Washington, DC.

Vu T. Nguyen is currently serving as the Acting Chief Information Security Officer (CISO) for US. Citizenship and Immigration Services. His responsibilities include providing direction and oversight to all USCIS cyber security initiatives as well as ensuring the FISMA compliance of USCIS systems and programs.
Prior to joining USCIS, Mr. Nguyenserved as the Director of the Federal Information Security Modernization Act (FISMA) Compliance and Metrics Division in the DHS Office of the Chief Information Security Officer. In this role, he was responsible for ensuring department-wide compliance with FISMA and other legislative mandates. He established department-wide compliance reporting metrics to evaluate and mitigate DHS IT security vulnerabilities and ensure the integrity and accountability of all information systems.
Mr. Nguyen has also served the Chief of the DHS Enterprise Security Operations Center (ESOC) from 2014 to 2016. During his tenure, Mr. Nguyen led several major cybersecurity operations and enhanced the overall maturity and efficacy of the ESOC by bolstering its network monitoring and analysis, vulnerability assessment, security engineering, and incident response capabilities.
Mr. Nguyen has also held supervisory positions in the U.S. Customs and Border Patrol and U.S. Department of Commerce security operation centers. He has also supported the Homeland Security Advisory Council Cyberskills Task Force as a subject matter expert in cyber threat analysis and response.

 September 19, 2017 at 6:30 PM

ISSA National Capital Chapter September meeting topic:

DevSecOps - automating security testing
by Naresh Patel of OPTIMOZ

Abstract
The wide adoption of cloud has continued to change the way we develop and deliver the quality software. Automated continuous integration pipeline has helped us to deliver quality applications faster. This has allowed many organizations to continuously modernize their applications - no more modernization projects. Recently, we have started adding security testing within the automated CI pipeline to bring the security concerns closer to development to address them way early in the life cycle of the software development by sharing the security responsibility with the development. We will talk about how effectively this is done in the pipeline to practice a true DevSecOps mindset.

About the Speaker
Naresh Patel, President of OPTIMOZ is a serial entrepreneur and technologist.  He focuses on the delivery of Agile DevSecOps solutions leveraging heavily on the public cloud.  OPTIMOZ enables enterprises and federal agencies to accelerate development and delivery of applications that engage customers and drive revenue. OPTIMOZ specializes in all aspects of cloud computing, DevSecOps (CI/CD), applications development, systems integration, system administration, database administration, data warehousing and information security. Prior to founding Optimoz, Mr. Patel co-founded a Silicon Valley based successful company, GetHired.Com. He founded OPTIMOZ to share his passion into Agile DevOps development and start-up experience with commercial enterprises and federal agencies. OPTIMOZ is a Amazon AWS Advanced Consulting Partner.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, September 19, 2017 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
10th Floor
Washington, DC, 20005

Click here for details.

 August 15, 2017 at 6:30 PM

ISSA National Capital Chapter August meeting topic:

Securing Microservices 
by Jack Mannino

Abstract
Microservices offer a lot of benefits for deploying large-scale applications, but implementing a secure architecture that scales over time can be challenging. Services are highly decoupled from each other as well as producers and consumers of data moving throughout the architecture. Data contracts between services are often blurry, and data sharing between microservices require careful consideration around access patterns and boundaries between related services. New services come, new services go. Some are deployed to containers, some to servers, and some are serverless. Your developers, data scientists, and infrastructure team are all empowered to move quickly and ship new services. Your job is to make sure all of the above happens in a secure and sane way. Microservices offer a lot of benefits for deploying large-scale applications, but implementing a secure architecture that scales over time can be challenging. Services are highly decoupled from each other as well as producers and consumers of data moving throughout the architecture. Data contracts between services are often blurry, and data sharing between microservices require careful consideration around access patterns and boundaries between related services. New services come, new services go. Some are deployed to containers, some to servers, and some are serverless. Your developers, data scientists, and infrastructure team are all empowered to move quickly and ship new services. Your job is to make sure all of the above happens in a secure and sane way. 

In this presentation, we will discuss the challenges with securing microservices and present solutions to make security a seamless and frictionless part of scaling your architecture. Using real-world examples of successes and failures while building a microservice architecture, we will discuss what translates well from monolithic design to microservices, and the bad habits you should leave behind. At the end of this presentation, you’ll understand what separates microservices from traditional monolithic applications and understand the problem space from a secure architectural perspective.

About the Speaker
Jack Mannino is the CEO and founder of nVisium, a technology company focused on making secure development scale. Passionate about technology and solving problems, his expertise spans over 15 years of building, breaking and securing software. Jack founded nVisium in 2009 to invent, test and provide new and more efficient methods of protecting software. He has spoken at conferences globally on topics including software security architecture, mobile application security, and DevOps.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, August 15, 2017 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
10th Floor
Washington, DC, 20005

Click here for details.

 July 18, 2017 at 6:30 PM

ISSA National Capital Chapter July meeting topic:

Derived Personal Identity Verification (PIV) Credentials
by David Coley of Intercede

Abstract
Derived credentials have been a technical option on mobile devices for over a decade, yet the deployment and ultimate usage of Derived PIV Credentials (DPC) is a relatively recent innovation for agencies.  The NIST framework outlining the use of DPC, Special Publication 800-157, was released in December 2014.  It defines the administrative process required to ensure a user can prove possession of a valid Personal Identity Verification (PIV) card prior to the issuance of a new PKI credential for use on mobile devices or other platforms that don’t easily support a PIV card and associated reader. To date, many agencies have not engaged closely with NIST and the Federal Identity, Credentialing, and Access Management program to align internal policies and move forward with DPC.  As a result, the U.S. Government either continues to rely on username and password or has forgone access to business and mission applications from mobile devices lacking built-in or attached smart-card readers.

 
The ATARC Mobile Identity Management project team, a collection of industry and government members, found that while the creation and issuance of DPC is relatively well understood, issues associated with credential storage and management, as well as PKI enablement of service providers (aka relying parties, web servers, mobile API’s), remains a significant hurdle to mobile enablement and use.
 
In this talk, learn a bit more about the obstacles facing the US Government in the deployment and use of derived PIV credentials and the guidance offered by the ATARC team for accelerating their use.

About the Speaker
David Coley is a Senior Solutions Engineer at Intercede, a cybersecurity company specializing in enabling digital trust in a mobile world. David has worked in the mobile and security fields for over 20 years educating executives and technical teams on the use of mobile technology to increase workforce flexibility.  His emphasis has been on U.S. Government customers and the wide-ranging missions they support.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, July 18, 2017 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
10th Floor
Washington, DC, 20005

Click here for details.

 May 16, 2017 at 6:30 PM

ISSA National Capital Chapter March meeting topic:

Threat Rover: Go Beyond. Achieve 361o Threat Visibility of the Enterprise
by Inno Eroraha of NetSecurity® Corporation

Abstract
Neutralizing today’s advanced attacks requires an enterprise to identify its assets and to have a complete grasp of these assets. Vendors offer solutions from signature, behavior, machine learning, and artificial intelligence approaches to achieve enterprise protection and to counter the emerging threat problem. Are current technologies in this realm providing the needed 361o threat visibility, and do these technologies prevent attacks with high fidelity?

Protecting today’s assets from advanced cyber-criminal elements and from determined insider threat actors requires more than just perimeter protection or the classic “people, process, technology” paradigm. To stay ahead of these determined adversaries, solutions must go beyond and must dive deeper to detect threat activities wherever the data, information, system, or device may live. “Threat Roving” is a term we’ll use in this presentation to denote an integrated approach to neutralize cyber threats with basic primitives – threat intelligence, analytics, detection, response, prevention, investigation, and hunting – to protect against the next ransomware or other sophisticated attack and to gain situational awareness of the threat landscape. It is with acute visibility that we can predict and defuse attacks at the source.

About the Speaker 

Inno Eroraha is the Founder and Chief Strategist of NetSecurity® Corporation, a computer forensics, cyber security and training company based in Dulles, Virginia, USA – in the Washington, DC Metropolitan area. His main responsibility is to position NetSecurity as “the brand of choice for forensics, security, and training,” by delivering innovative, high-quality, timely, and customer-focused solutions. Mr. Eroraha oversees NetSecurity’s day-to-day operations, including the proprietary HANDS-ON HOW-TO® training program, THREATRESPONDER™ platform, and the state-of-the-art NETSECURITY FORENSIC LABS. He leads the execution of NetSecurity’s solutions and helps clients protect, defend, and recover valuable assets from the most advanced cyber attacks. He has been consulted by Fortune 500 companies, financial institutions, law firms, government entities, and other premier organizations. Among other hands-on responsibilities, he leads penetration testing exercises, cyber operations, data breach investigations, and real-world training.

Before founding NetSecurity, Mr. Eroraha was a senior manager of information security at VeriSign, Inc. In this capacity, he led the implementation of solutions to protect critical Internet infrastructures. As an advocate, he significantly heightened security awareness among internal and external stakeholders and key decision makers. Inno Eroraha also worked at Network Associates (now McAfee), Trusted Information Systems, Smartronix, SAIC, and other consulting firms.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, May 16, 2017 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
10th Floor
Washington, DC, 20005

Click here for details.

 June 20, 2017 at 6:30 PM

ISSA National Capital Chapter June meeting topic:

The Payments Ecosystem: Security Challenges in the 21st Century
by Phil Smith III of HPE Data Security

Abstract

Credit and debit cards—whether they use magnetic stripes, EMV (“chip” cards), or near-field communication—are well-established in world commerce, and the majority of enterprises process them in some part of their operations. But how does this ecosystem really work? What are its vulnerabilities and security gaps, and how can we defend them? And what do mobile payments systems, bitcoin and its clones, and other innovations mean for the future?

As story after story in the press has demonstrated, simply keeping your physical card secure is no longer sufficient —and neither is protecting the IT perimeters of card processing systems. Millions of card numbers have been breached at all layers of the system, despite companies’ best efforts to secure at a system level. The Payment Card Industry Data Security Standard (PCI DSS) lays down excellent guidelines to help secure data, but many breaches have occurred despite passing PCI DSS compliance assessments.

Come learn about how the threat landscape is evolving, what the attackers are doing, and how merchants and processors are reacting to stay ahead of the attackers.

About the Speaker

Philip Smith III is Senior Product Manager and Architect, Mainframe and Enterprise, at HPE Data Security. He has spent over 35 years doing and managing software support/development. Phil also creates technical reference books, contributes to trade journals, speaks at SHARE and local user groups, and tracks IBM evolution.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, June 20, 2017 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
10th Floor
Washington, DC, 20005

Click here for details.

 April 18, 2017 at 6:30 PM

ISSA National Capital Chapter March meeting topic:

A King’s Ransom: Why Ransomware is Winning and How We Can Turn the Tide
by Michael Sutton of Zscaler

Abstract

Ransomware has exploded to become one of the most profitable tools in the attacker’s toolkit. Why? While ransomware has actually been around for more than two decades, the financial success of CryptoLocker, along with the emergence of anonymous payment schemes led to it’s resurgence in 2013. While Operation Tovar killed off CryptoLocker, this only spawned a variety of copycat malware families following a similar pattern of leveraging public key encryption to hold personal files hostage until a ransom is ultimately paid. Attackers have managed to hit a sweet spot by targeting valuable data with financial or sentimental value, while setting a price point that individuals and corporations seem willing to pay. This, combined with poor data backup practices and ineffective endpoint security, has made ransomware a lucrative and growing market. As attackers have realized the potential of this weapon, they have moved beyond opportunistic attacks to target corporations and are now demanding significant payments well beyond the ransom demanded from individuals…and the companies are paying.

Combating ransomware requires a combination of dynamic analysis of the quickly morphing binary payloads and associated network traffic and exploiting the mistakes that have been made by the malware authors. Monitoring ransomware families over the years, we have noted interesting trends both in the techniques utilized by the families tracked and also where they are achieving success. Despite being generic in nature, certain malware families have reaped greater damage in specific global regions. The reasons for this involve a combination of attack techniques and human psychology. In monitoring the impact of ransomware on over 5,000 enterprises, we have also noted unintended, but predictable behaviors that can aid in identifying and defending against the threat. Our research has shown that binary analysis of ransomware is only half the battle. An effective defense must also incorporate network traffic analysis to proactively identify the infrastructure used to facilitate the cycle of infection and extortion.

In this talk, we will address the evolution of ransomware and focus on specific case studies to demonstrate and reveal the unique traits leveraged by specific families. We will discuss solutions which have proven highly effective in combatting ransomware. We will also peer into the crystal ball and leverage the expertise that we’ve gained in observing thousands of ransomware variants to predict where this threat is headed next.

About the Speaker

Michael Sutton has dedicated his career to conducting leading-edge security research, building teams of world-class researchers and educating others on a variety of security topics. As VP, Security Research, Sutton heads ThreatLabZ, the research and development arm of Zscaler. ThreatLabZ is responsible for researching emerging topics in web security and developing innovative security controls, which leverage the Zscaler in-the-cloud model. He is a published author, frequent speaker at major security conferences and is regularly quoted in the media. Prior to joining Zscaler, he was the Security Evangelist for SPI Dynamics (acquired by HP) and the Research Director at iDefense (acquired by VeriSign).

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, April 18, 2017 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
10th Floor 
Washington, DC, 20005

Click here for details.

 March 21, 2017 at 6:30 PM

ISSA National Capital Chapter March meeting topic:

Current State of Application Security
by Aravind Venkataraman

Abstract
Our presentation will center around the current state of application security; we will delve into new research of application security practices at over 75 companies. We will cover software security strategies and tactics used by your peers as they are practiced “in the wild”. Statistics from the real world will be balanced with war stories from the field to illustrate foundational principles of starting and sustaining programs, as well as “what not to do” gotchas that can kill an initiative in its tracks. We will then open up the floor for discussion where you can share your experiences and hear from your colleagues and peers.

About the Speaker
Mr. Aravind Venkataraman is a Managing Consultant at Cigital. He has over 9 years of experience in software security and network security. At Cigital (www.cigital.com), he has spent the past 7 years helping a number of Fortune 100 companies build and run software security practices. He has performed planning, advisory and operational roles in building such practices. He specializes in deploying static analysis programs. He has helped several organizations deploy and run static analysis capabilities of different sizes and shapes. He presently plays a technical leadership and program advisory role both for internal staff and clients based out of Washington DC.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, March 21, 2017 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
Washington, DC, 20005

Click here for details.

 February 21, 2017 at 6:30 PM

ISSA National Capital Chapter February meeting topic:

Major Trends in Cyber Security
by Ron Gula

Abstract
Ron will discuss the three major trends in cyber security today - the quest to find intruders, the quest to protect networks and the notion of starting over with resilient systems. Ron will discuss the recent advances in detecting intruders, performing realtime compliance monitoring and re-designing computing environments to leverage resilient technologies such as cloud applications and containers.

About the Speaker
Ron Gula is the Founder and Chairman of Tenable Network Security. During the past fourteen years as CEO, Tenable Network Security has grown to more than 20k customer's worldwide, revenues in access of $100m in 2015, more than 650 employees operating in 10 different countries and close to $300m raised from private, government and angel investors. Ron has helped Tenable become the most dominant vulnerability management company and today organizations all over the world turn to Tenable to measure their compliance with standards such as PCI, FISMA, NIST and CIS. Ron began his career in information security while working at the National Security Agency conducting penetration tests of government networks and performing advanced vulnerability research. In the late 90s he pioneered the world of detecting hackers and botnets with the creation of the Dragon Intrusion Detection System which was acquired by Enterasys Networks and received industry acclaim from Gartner, SANS and Network Computing. Ron is a managing partner at Gula Tech Adventures which focuses on seed investing and advisement of cyber-security startups. Ron is currently working with several dozen companies with their product roadmaps and growth strategies.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, February 21, 2017 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
Washington, DC, 20005

Click here for details.

January 24, 2017 at 6:30 PM

ISSA National Capital Chapter January meeting topic:

Cyber Risk – How DHS is Clarifying its Vision through the Continuous Diagnostics & Mitigation (CDM) Dashboard
by Matt House

Abstract
Agencies face increased pressure to mature their cyber practices, but often lack sufficient resources to properly address the ever growing backlog of actions required to stay ahead of sophisticated threats. The Federal Government lacks a comprehensive mechanism for reporting on and managing organizational and cyber risk in a consistent fashion. As the cybersecurity posture of agencies varies widely, there is no standardization in identifying, scoring, prioritizing, or reporting these risks. DHS’s Continuous Diagnostics and Mitigation program is a major effort to promote standardized cyber hygiene and cyber risk management throughout the .GOV domain. Central to CDM is the dashboard that serves as the scoring, prioritization, visualization, and reporting engine that gives Federal agencies the “easy button” to meet today’s strict compliance and cyber performance goals.

About the Speaker
Matt House is the Director of Cyber Security Services for InfoReliance, an IT consulting firm specializing in cybersecurity, cloud services, and software engineering. Matt is responsible for all service delivery for InfoReliance’s Cyber Business Unit, which has annual revenues of approximately $50M. Within this portfolio, InfoReliance supports US Government customers including the Department of Homeland Security (DHS), US Army, US Navy, many Federal/Civilian agencies, as well as numerous commercial customers. Matt directly supports several critical cybersecurity programs within DHS such as the Continuous Diagnostics and Mitigation (CDM) Dashboard, National Cyber Protection System (also known as EINSTEIN), and the Cyber Assurance program at the Naval Surface Warfare Center in Dahlgren. Previously, Matt led the effort to deploy cloud services to the National Nuclear Security Administration (NNSA) and supported the Office of the Chief Information Officer at the Executive Office of the President

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, January 24, 2017 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
Washington, DC, 20005

Click here for details.

December 13, 2016 at 6:30 PM

The ISSA National Capital Chapter has partnered with the SANS Institute again this year to offer exclusive access for its members to SANS@Night events at Cyber Defense Initiative 2016. The chapter meeting will take place at Grand Hyatt Washington on Tuesday, December 13, 2016.

Please note that the event is free but you must RSVP at least 24 hours before the event so we can have your badge ready for you. 

The chapter members and their guests will have access to the following events:

6:15pm - 9:15pm
Special Event - Women's CONNECT Event
Hosted by SANS COINS program and ISSA WIS SIG

6:30pm - 7:00PM
ISSA-DC: Announcement of 2017 ISSA-DC Board Election results

7:15pm - 8:15pm
SANS@Night - Security Awareness: Understanding and Managing Your Top Seven Human Risks
by Lance Spitzner

7:15pm - 8:15pm
Reception - (CS)2AI Reception: Control System Cyber Security Association International
Hosted by Derek Harp and Mike Assante

8:15pm - 9:15pm
SANS@Night - Analysis of the Cyber Attack on the Ukrainian Power Grid
by Robert M. Lee

8:15pm - 9:15pm
SANS@Night - Current and Future Trends in Digital Investigative Analysis
by Ovie Carroll

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, December 13, 2016 6:30 PM

Location Information

Grand Hyatt Washington

1000 H Street NW

Washington, DC  20001 US

Phone: 202-582-1234

Fax: 202-637-4797

www.grandwashington.hyatt.com

Grand Hyatt Washington

 

 November 15, 2016 at 6:30 PM

ISSA National Capital Chapter November meeting topic:

NIST Draft 800-63-3: What’s new, what’s the same, what’s radically different, when will we finalize, and what is YOUR feedback
by Paul Grassi

About the Speaker

Paul Grassi is the Senior Standards and Technology Advisor at the National Institute of Standards and Technology (NIST). He joined NIST in June 2014 to advance and accelerate the development and adoption of identity authentication and authorization related standards and technologies needed to implement the identity ecosystem envisioned in the National Strategy for Trusted Identities in Cyberspace (NSTIC).

Mr. Grassi comes to NIST with a broad background of technology and management consulting, and significant experience developing enterprise security strategies and systems, having served a range of Fortune 500 companies, as well as domestic and foreign governments.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, November 15, 2016 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
Washington, DC, 20005

Click here for details.

 October 18, 2016 at 6:30 PM

ISSA National Capital Chapter October meeting topic:

Understanding Basic Physical Access Control, (PACS)
by Bill Stover 

Abstract
We will speak briefly of the history of PACS, why it became a "Must Have" for most companies/Government Agencies. How it developed from Card centric and has morphed into Identity centric. Where it is going for Role Based Access Control, RBAC to the Back End Attributes, BAE access control. This one-hour presentation will go over the purpose of PACS and the different architectures that are available. We will discuss the PROS and CONS to Access Control. The information the PACS systems are gathering is placing the PACS into an integral part of the LACS system. As the PACS has developed through the years the physical equipment is no longer the key factor in a PACS, but the information and what can be done with that information that the PACS is gathering.

About the Speaker
William (Bill) Stover is the Director of Business Development Manager – Federal Programs for SigNet Technologies, Inc. With over 34 years of experience in the Electronic Security Industry focusing on ID Management and Physical Access Control Systems. Mr. Stover has concentrated on identifying and meeting the needs of Federal Government Agencies. Mr. Stover has developed FICAM APL certified solutions to mitigate the need of replacing legacy equipment while maintaining authentication/validation of the card and cardholder at the door. Mr. Stover has developed several sustainment programs to provide ongoing FICAM compliance of existing systems. Mr. Stover continues to pursue the latest education for innovative technologies within the ID Management for Logical and Physical Access Control security solutions. 


Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, October 18, 2016 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
Washington, DC, 20005

Click here for details.

September 20, 2016 at 6:30 PM

ISSA National Capital Chapter September meeting topic:

Understanding the Federal IT Security Professional (FITSP)
by Jim Wiggins

Abstract
The Federal IT Security Institute (FITSI) is a non-profit organization managing and administering a role- based certification program known as the Federal IT Security Professional (FITSP). This credential is for Managers, Designers, Operators, and Auditors of Federal IT systems. By earning the FITSP credential, candidates demonstrate an in-depth knowledge of Federal IT security management, operational, and technical control requirements and the best means by which to validate their proper installation and operation.

FITSP measures candidates based on standards and guidelines promulgated by the National Institute of Standards and Technology (NIST) and other relevant Federal statutes and regulations. Collectively, these Federal documents comprise a special Federal Body of Knowledge (FBK) for the IT security workforce.

Mastery of the FBK provides a detailed framework for synergistically applying the technical knowledge and expertise acquired through other security certifications. Through certification as a Federal IT Security Professional (FITSP), military, civilian, and contractor personnel demonstrate their understanding of the interrelationship of Federal requirements that define the physical and logical security control objectives necessary to protect and defend Federal information systems.

The four FITSP certification designations - Manager, Designer, Operator, and Auditor - represent certification roles from the FBK that are specifically tailored to fit the job requirements of every person in the Federal workforce who has significant IT security responsibilities.

This 1-hour presentation will provide an overview of the Federal IT Security Professional certification and the requirements for obtaining it. 

About the Speaker
Jim has over 18 years direct experience in the design, operation, management, and auditing of information technology systems, with the past 14 years focused on information systems security. He has an extensive background in technical education and specializes in security certification courses targeted at federal and government contracting clients.

Additionally, Jim is the founder and executive director of the Federal IT Security Institute (FITSI). FITSI is a 501c6, non-profit organization that provides a role-based IT security certification program targeted at the federal workforce.

Jim is also the executive director of the FITSI Foundation. The FITSI Foundation is 501c3 public charity that runs the Wounded Warrior Cyber Combat Academy (W2CCA).

Currently as a contractor, Jim provides education and training support for the Federal Network Resilience Division at DHS and its Continuous Diagnostics and Mitigation program.

In 2011, the Federal Information Systems Security Educators’ Association (FISSEA) named him “Educator of the Year” for the impact he continues to make in the federal workforce.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, September 20, 2016 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
Washington, DC, 20005

Click here for details.

 August 16, 2016 at 6:30 PM

ISSA National Capital Chapter August meeting topic:

Enumerating software security design flaws throughout the SSDLC
by John Willis

PLEASE NOTE CHANGE OF VENUE 

Abstract
 The security challenges we face today are numerous. Yet, we just can’t seem to produce software without including countless security vulnerabilities. About one-third (1/3rd) of all software security vulnerabilities are due to design errors. To further compound the problem, nonfunctional security requirements often do not get translated to real technical security design features, or controls. To make matters worse, security design features have their own dependencies. Bundle this with design errors that may or may not be uncovered through threat modeling, and it is no surprise that we have the perfect storm. Worse yet, any security functionality implemented to address nonfunctional requirements is unlikely to receive attention during testing. Unfortunately, if we don’t address these security design flaws the testers may never notice anyway!

A methodology and evolving mock-up/prototype is introduced to address these problems. A graphical tool that is SysML compatible is the ultimate goal. The hypothesis is that by employing the above methodology/tool we should be able to establish order where there is currently chaos regarding the identification and satisfaction of security requirements, not only in the solution space—but throughout the SSDLC as well.

About the Speaker
John M. Willis is a Senior Information Security Architect with a history of electronics engineering, programming, and configuration management. John’s first computer was a wire-wrap Z80 board he programmed in assembly.

John has been a consultant to commercial and government clients for over 30 years. He holds a number of professional certifications, including CISSP-Information Systems Security Architecture Professional (CISSP-ISSAP), Certified Secure Software Lifecycle Professional (CSSLP), and Certified Ethical Hacker (CEH). In addition, John completed the Advanced Computer Security Professional Certificate program at Stanford University in 2015. Nowadays, John seeks to build security in by coming up with new and different ways of looking at things.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, August 16, 2016 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
Washington, DC, 20005

Click here for details.

 July 19, 2016 at 6:30 PM

ISSA National Capital Chapter July meeting topic:

Targeted Ransomware Attacks
by Jason Rebholz

Abstract
Ransomware started out as a nuisance and has grown into a pandemic. Companies everywhere are struggling to keep pace with the constantly evolving threat of losing their data. In a recent trend, opportunistic ransomware attacks have evolved into targeted attacks that have resulted in the deployment of ransomware to hundreds of systems. These targeted ransomware attacks have crippled companies and forced them to pay thousands of dollars in ransom money just to stay in business. This presentation will cover a short history on the evolution of ransomware and discuss in detail what happens during a targeted ransomware case – from the initial compromise through file encryption. Furthermore, the talk will cover lessons learned from numerous targeted ransomware cases so that you may avoid being the next victim.

About the Speaker
Jason Rebholz is a Director in The Crypsis Group’s McLean, Virginia office. As a Director, Mr. Rebholz oversees the professional services that Crypsis provides its clients and manages incident response investigations. Mr. Rebholz has led incident response investigations that involved multiple threat actors including financially motivated attackers, organized crime, nation-state threat actors, and hacktivists. He has worked across numerous industries including the defense industrial base, financial industry, healthcare industry, Fortune 100 companies, and law enforcement.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, July 19, 2016 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
Washington, DC, 20005

Click here for details.

 June 21, 2016 at 6:30 PM

ISSA National Capital Chapter June meeting topic:

INVESTING IN CYBERSECURITY
by Lawrence A. Gordon

Abstract
Cybersecurity is fundamental to the survival of organizations in our interconnected digital world.  Accordingly, a key question that must be addressed by organizations is: How much should an organization spend on cybersecurity activities and how should those funds be allocated?  The objective of the talk by Dr. Lawrence A. Gordon, EY Alumni Professor of Managerial Accounting and Information Assurance, at the University of Maryland's Smith School of Business, is to discuss how the Gordon-Loeb Model for Cybersecurity Investments can be used to help organizations answer the above question. Details underlying his talk can be found in his recent coauthored paper at: http://file.scirp.org/pdf/JIS_2016032315382494.pdf.

About the Speaker
Dr. Lawrence A. Gordon is the Ernst & Young Alumni Professor of Managerial Accounting and Information Assurance at UMD’s Robert H. Smith School of Business, and an Affiliate Professor in the UMD Institute for Advanced Computer Studies. He is also an active participant in the Maryland Cybersecurity Center, a new research/education Center at the UMD. His Ph.D. is in Managerial Economics from Rensselaer Polytechnic Institute. He is the author of more than 90 articles, published in such journals as ACM Transactions on Information and System Security, Journal of Computer Security and The Accounting Review. He is the author of several books, including Managing Cybersecurity Resources:A Cost-Benefit Analysis, and is the Editor-in-Chief of the Journal of Accounting and Public Policy. In 2007, Dr. Gordon provided Congressional Testimony on cybersecurity economics before a Subcommittee of the U.S. House Committee on Homeland Security. He is a frequent speaker at universities and professional meetings around the world, has been a consultant to many major private and public sector organizations. Dr. Gordon’s former Ph.D. students are distinguished faculty members at many top universities in the U.S., Europe and Asia. In two authoritative studies, Dr. Gordon was cited as being among the world’s most influential/productive accounting researchers.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, June 21, 2016 6:30 PM

Government Publishing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details.

 May 17, 2016 at 6:30 PM

ISSA National Capital Chapter May meeting topic:

Smartphones issues and data in Apps and the Cloud…or your next level of evidence
by Amber Schroader, CEO & Founder, Paraben Corporation

Abstract
Our smartphones are hiding a dirty little secret that not only leaves data for others to capture, but also data for forensic evidence. This session covers common issues with smartphones when it comes to forensics and also the security of these devices. We will go through existing flaws that can be exploited to capture data and passwords and keys associated with the most popular devices of Android OS and Apples iOS.

About the Speaker
Throughout the past two decades Ms Schroader has been a driving force for innovation in digital forensics. Ms. Schroader has developed over two-dozen software programs designed for the purposes of recovering digital data from mobile phones, computer hard drives, email, and live monitoring services. Ms. Schroader has taught and designed the established protocols for the seizure and processing of digital evidence that have been used by numerous organizations throughout the world. Ms. Schroader has coined the concept of the “360-degree approach to digital forensics” as well as started the momentum and push to the “Forensics of Everything-FoE” with her focus to unique problems in digital evidence and solutions. Ms. Schroader has been a huge industry influence in pushing for a big-picture consideration of the digital evidence and the acquisition process and analysis techniques used. An accomplished curriculum developer and instructor; Ms. Schroader has written and taught numerous classes for this specialized field as well as founded multiple certifications. Ms. Schroadercontinues support through book contributions and other industry speaking engagements.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, May 17, 2016 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
Washington, DC, 20005

Click here for details.

 April 19, 2016 at 6:30 PM

ISSA National Capital Chapter April meeting topic:

Cyber Security Management – An analytics based approach

by Krishnamurthy Krithivasan of OEQ, Inc.

Abstract
The two most discussed domains today are Cyber Security and Data Analytics. The presentation will focus on using data analytics as an enabler for effective cyber security management.

About the Speaker
Krish has around 2 decades of experience delivering technology enabled business solutions to large federal and commercial organizations. Krish was instrumental in building the Business Intelligence, Analytics and Reporting practices at Ernst & Young LLP and at PricewaterhouseCoopers LLP. Krish currently is the CEO of OEQ, Inc., an Analytics and Technology startup based in Reston, VA.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, April 19, 2016 6:30 PM

Government Publishing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details.

 March 15, 2016 at 6:30 PM

ISSA National Capital Chapter March meeting topic:

Cloud Breaks Traditional Security

by Rich Gardner

Director of Sales Engineering, CISSP, CISM, CGEIT
CloudPassage

Abstract

The rapid adoption of Infrastructure-as-a-Service, rise of DevOps and use of containers all have put a huge strain on InfoSec teams. Traditional security tools don't work well with the new infrastructure and development paradigms, dragging down speed and agility. Join us to learn how companies have automated and orchestrated security to align the needs of all the stakeholders: security, development and operations.

About the Speaker
With 20+ years of Information Technology experience, for the past 15 years Rich Gardner has been focused on Information Security. Rich comes to CloudPassage with a wealth of experience and a fresh perspective to solving people, process and technology challenges when it comes to Information Security. Previously working at a number of carriers, Rich was involved in executive consulting, security architecture and pre-sales engineering. Throughout his career in IT Rich has been exposed to fortune 500 companies ranging from major broadcast networks to global financial enterprises.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, March 15, 2016 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
Washington, DC, 20005

Click here for details.

 February 23, 2016 at 6:30 PM

ISSA National Capital Chapter February meeting topic:

Safeguarding Our Data – DevOps Friend or Foe
by Joseph Santangelo

This meeting brought to you by

Abstract
Organizations are under increasing pressure to perform. The environment that they are working in has become more complex and more chaotic. Multiple internal masters all have a stake in the workings of Information Technology. External cops and robbers are both forcing organizations to reinvent themselves and look at new ways of doing things. DevOps is a new way of working which fosters collaboration instead of confrontation. The DevOps approach gives developers more control while making infrastructure personnel more aware and understanding of the application landscape. The use of specialized tools and the implementation of Service Based IT is crucial to meet goals in an environment where things are moving faster and faster. But it is not clear that this new way is right for all organizations and all implementations. There can be dangers from using this approach. Done badly DevOps can create more problems and lead to serious security concerns. And what about Security? Is Security an afterthought in DevOps? Are there DevOps techniques that Security personnel can leverage? What about some tried and true security practices, do they fit in with the DevOps movement?

About the Speaker
Joseph Santangelo has been a technology professional for over 20 years and has a Master of Science degree from Steven’s Institute of Technology.   Joseph has focused on Privacy and Security throughout his career with a heavy emphasis while he was CIO of the Citi Private Bank in the Americas.   In his current role at Delphix Corp, much of his focus is on securing private data and establishing Risk, Governance and Compliance frameworks.  Specific areas of focus include testing for interoperability purposes.   Joseph is a member of the Society for Information Management (“SIM”), the Information Systems Security Association (“ISSA”) and the Healthcare Information and Management Systems Society (“HIMSS”) where he was chairman of the Privacy and Security Toolkit Task Force.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, February 23, 2016 6:30 PM

Government Publishing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details.

 January 19, 2016 at 6:30 PM

ISSA National Capital Chapter January meeting topic:

Cybersecurity Landscape in 2016

Abstract
Coming off of a year when “cyber risk” entered the lexicon of corporate boardrooms, CISOs and CIOs are recognizing the reality that a cybersecurity breach is inevitable. As 2015 comes to a close, Nik Son, Abel Sussman, and Dan Choi of Coalfire will discuss their top predictions for what will impact the cybersecurity landscape in 2016 and how the federal government and commercial providers will meet these challenges.

About the Speakers
Nick Son, CPA, CISSP, CISA, CISM, CIA - is Managing Director of Coalfire Federal. He leads FISMA and FedRAMP solutions business serving U.S. Federal, state, local and commercial clients. Mr. Son has over 20 years of experience in information assurance and cybersecurity program management and legislative compliance. He is a subject matter expert in the area of FISMA, FedRAMP and 3rd Party Reporting.

Abel Sussman, PMP, CISSP, CCSP - is the Director for Coalfire Public Sector practice. For more than 18 years, Abel has been helping organizations implement new systems and transform stagnant programs. He is a nationally recognized industry expert and has presented on information security and cloud computing for the Federal Bureau of Investigation, Department of Homeland Security, Department of Defense.

Dan Choi, CISSP, CISA, CISM - is a Director of Coalfire’s Public Sector practice. He leads the FISMA and FedRAMP assessments for companies and cloud service providers serving the federal government. Dan has over 9 years of experience leading information technology audits and security consulting services of governmental agencies and commercial clients performing FISMA, FedRAMP, and FISCAM reviews.

.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, January 19, 2016 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
Washington, DC, 20005

Click here for details.

October 20, 2015 at 6:30 PM

ISSA National Capital Chapter October meeting topic:

Mike Dombo

Abstract
Today, it is no longer a matter of if an organization will be impacted by a data breach, but rather when they will be hit. In many cases, personal, proprietary and otherwise sensitive data accessed from a data breach is sold and published on what is known as the “Dark Web.” This portion of the Internet is hidden from conventional search engines and people who access the Dark Web typically operate anonymously, making illegal activity harder to detect.

OPM, Target and Anthem have proven that every organization is a potential victim. It has become increasingly more vital for organizations to take measures to keep their sensitive information from being leaked onto the Dark Web as there are real financial and reputational consequences to data breaches.

Mike Dombo, Vice President of Sales at Winvale, will discuss the Dark Web, how information is sold and traded and how you can take action if your organization is breached.

About the Speaker 
As Vice President of Sales, Mike Dombo leads the team’s overall sales and key customer account objectives and is based in Dark Web ID’s office in Odenton, Maryland. 

 Dark Web ID was developed by Winvale to address criticalcybersecurity issues impacting both public and private sector organizations. Dark Web ID’s web-based platform provides external monitoring reports of an organization’s user accounts, including IP addresses and third party and supply chain accounts to identify compromised credentials in real time. Through this platform, organizations can access actionable threat intelligence to help anticipate and protect against a cyberattack. To date, Dark Web ID has identified more than 400 million email and network passwords from more than 350,000 private Dark Web locations.

Previously, Dombo worked in several syndicated research sales roles as founder and head of sales for companies providing advisory services in areas such as: Public Safety & Homeland Security, Environmental & Sustainability issues, Human Resources and Finance. He graduated from Lafayette College with degrees in English and Russian and holds a Master’s Certificate in Project Management from The George Washington University.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, October, 2015 6:30 PM

Government Publishing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

NOvember 17, 2015 at 6:30 PM

ISSA National Capital Chapter November meeting topic:

“The Craft” – Cyber Threat Intelligence from the Analysts Perspective 

Abstract
In the current cyber security environment, the organization does not stop at the perimeter, but extends to all facets and operations of the organization. This session will focus on how threats to any organization can manifest themselves in many ways, often with tell-tale signs in the digital landscape of OSINT and less open arenas such as specialized forums, IRC, paste sites and Dark Web. With the proper skills and tools, analytical craft and intelligence can act as not only a warning signal to concerned parties, but in many cases act as a disruptive capability that can severely limit damage to brand, assets, customers, personnel or IT systems. Come learn how some of your most crucial defenses start beyond the perimeter and are not simply a matter of the newest IDS, Firewalls, or IT defense-of-the-day.

Takeaways:
Better understand the ways and means bad actors leverage to meet their goals
Real world examples of how proper intelligence can win early and often
Understand what is at stake if threat intelligence is not part of your current efforts

About the Speaker
Jeff Daisley has a long history of managing and delivering cyber threat intelligence and analysis to the U.S. Secret Service, large Government and NGO institutions, and Fortune 500 companies. Range of work encompasses anything from high-profile government leadership, to disaster and crisis efforts as well as threats to leading private sector companies and executives. Jeff had the special privilege of serving as the chief analyst on-site to the USSS, specializing in reports and analysis to protection of the President of the United States, and subjects of interest or groups possessing threats to USSS protectees. Currently, Jeff is the leading Cyber Threat Intelligence analyst at BrandProtect, a leader in detecting, analyzing and mitigating online incidents and cyber activity that threatens business, people and customers across private and public institutions.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, November 17, 2015 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
Washington, DC, 20005

Click here for details.

September 15, 2015 at 6:30 PM

ISSA National Capital Chapter September meeting topic:

Operationalizing Threat Intel 
by Brian Costello

Abstract

There are many sources of cyber threat intelligence, and their quality varies dramatically. At a minimum, high quality threat intel must be:
• Continually updated
• Free of outdated information
• Derived from authentic sources

But quality is only the beginning. As with any tool, the real value of threat intel relies on how you use it. Attend this enlightening and practical talk on operationalizing cyber threat intel, and learn how to make the most of your intel resources.

About the Speaker 

Mario Santana joined Risk Analytics in June 2015, where his main responsibility is to sate his passion for disruptive technology. Formerly, Mr. Santana was with Terremark since January 2006, acquired by Verizon in 2011 for $1.4B. He built the Security Analytics team, growing it into Verizon's premier next-generation managed security offering. He has consulted with clients on topics of security, technology, and risk management. Before that, Mr. Santana founded an identity management technology company and worked in IT and security for over 25 years.

Through his career, Mr. Santana has worked with numerous Fortune 1000 organizations worldwide, including financial, healthcare and educational institutions, airport security and airlines, retail conglomerates, and technology and legal firms. He has led projects and engagements around such security and risk management concerns as leading-edge security operations, corporate governance, forensics and electronic discovery, incident response, intellectual property fraud, insider incidents, and the assessment of networks, systems and applications.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, September 15, 2015 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
Washington, DC, 20005

Click here for details.

August 18, 2015 at 6:30 PM

ISSA National Capital Chapter August meeting topic:

Export Controls
by Michael Dobson

Abstract
U.S. export controls dictate where and to whom U.S. companies can send products and information. They also dictate the types of data foreign nationals living and working in the U.S. are allowed to access. For cybersecurity professionals – particularly those working in international teams, regardless of where their teammates happen to be located – this can make for a complicated dynamic: not only do they have to consider who is allowed to access the information they are charged with safeguarding, but also whether they can share the tools they use to do their jobs with non-U.S. colleagues, counterparts, and third-parties. In this talk, Michael Dobson will share an overview of the export control system and best practices for navigating it, with the goal of preparing you to spot export compliance issues before they become problems.  

About the Speaker 
Michael Dobson is an international trade attorney in the Washington, D.C. office of Kelley Drye & Warren LLP. His practice focuses primarily on U.S. export controls, sanctions programs, and anti-corruption laws. Mr. Dobson counsels clients in a range of industries, with a particular emphasis on data management solutions. He has written extensively about export controls on information, most recently in a white paper titled “From Wassenaar to Mars: Open Source Hardware, U.S. Export Controls, and Avoiding Missteps in the Maker Movement,” along with a subsequent companion article on Slate Magazine’s Future Tense blog.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, August 18, 2015 6:30 PM

Government Publishing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

July 14, 2015 at 6:30 PM

ISSA National Capital Chapter Special Event

Federal Cyber Sprint -- 
Strong Authentication Now!

Refreshments provided by
 

Abstract
If you are in any way involved with Federal IT Security, then you are impacted by the current 30-day CyberSprint. The ISSA National Capital Chapter has scheduled a special out-of-band meeting to help you solve one of the toughest problems for most Agencies – Single Sign-On.

Are you having trouble getting to Single Sign-On (SSO)? Join a panel of Subject Matter Experts from across the Federal Government as they discuss resources and strategies to help you implement Single Sign-On in your Agency.

This special meeting will cover:

• Brief SSO Overview
• Privileged User SSO strategies
• Putty CAC client
• Username Hints
• Application SSO onboarding strategies
• SAML
• Agents
• PIV Direct
• Kerberos Authentication
• Open discussion – an opportunity to get advice about your personal SSO nightmare

We have moved our regular meeting time a week ahead to July 14th, to help you meet your deadlines to be SSO compliant. Please excuse the last-minute notice, but we want to get this information out to our membership as quickly as possible to help you comply with the very tight deadlines imposed by the Cyber Sprint.

About the Speakers
Because of the short notice, not all speakers have been confirmed yet, but we assure you that these will include high-level Federal PKI and ICAM Subject Matter Experts.

Paul Grassi
Paul Grassi is the Senior Standards and Technology Advisor at the National Institute of Standards and Technology (NIST). He joined NIST in June 2014, to advance and accelerate the development and adoption of identity authentication and authorization related standards and technologies needed to implement the identity ecosystem envisioned in the National Strategy for Trusted Identities in Cyberspace (NSTIC).

LaChelle Levan
Lachelle Levan is the Chief Architect for Federal Identity, Credential, and Access Management (FICAM) in the Office of Government-wide Policy at GSA.
She has over 15 years of experience in Information Technology, and has participated in over a dozen successful enterprise implementations--from Fortune 500 companies to governmental agencies.

Please join us for a timely and informative meeting! 

Please do not forget to RSVP if you plan to attend. An accurate head count helps us plan to make sure we have enough room and food for everyone. 

Non-members are welcome without charge! Light refreshments will be served.

Tuesday, July 14, 2015 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
Washington, DC, 20005

Click here for details.

June 16, 2015 at 6:30 PM

ISSA National Capital Chapter February meeting topic:

Greg Witte: NIST Cybersecurity Framework

Abstract
Greg Witte has spent the last 18 months implementing the NIST Cybersecurity Framework in the field, much of that for ISSA members, He will share some areas where companies have had success with the model and some lessons learned from applying it to those organizations. We'll also look at some of the items on NIST's roadmap such as information sharing, privacy engineering, and supply chain considerations.

About the Speaker 
Greg is a Senior Security Engineer for G2 Inc of Annapolis Junction MD. He supports Federal and commercial clients, primarily the NIST Computer Security Division. As part of his NIST support role, Greg was one of several primary authors of the NIST Cybersecurity Framework (CSF).

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, June 16, 2015 6:30 PM

Government Publishing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

Tuesday, September 1, 2015 at NIST in Gaithersburg, MD

May 19, 2015 at 6:30 PM

ISSA National Capital Chapter February meeting topic:

The New Normal: Cyber Attacks and Effective Defense in the Modern Era
by Travis Rosiek
Chief Solutions Strategist, CTO Office – Global Government, FireEye, Inc.

Abstract
In this presentation, Travis Rosiek, Chief Solutions Strategist in FireEye’s CTO office, will discuss the evolution of cyber attacks and threat actors, with insights on where exploits are happening today and why. Mr. Rosiek will discuss a current threat landscape that is more complex than ever, with security teams finding it increasingly difficult to prevent, detect, analyze and respond to advanced attacks. Drawing on FireEye’s experience with a range of government and industry organizations, this presentation will touch on where we’re making progress, and what can be done to address the new and increasingly sophisticated tactics being used by attackers.

About the Speaker 
Travis Rosiek is the Chief Solutions Strategist in the CTO office supporting Global Government. In this role, he provides technical and executive support to help ensure the FireEye implementation addresses the evolving security challenges that Federal Government organizations face. Travis also assists in educating customers on the evolving cyber threats, understanding customer requirements, and influencing FireEye solutions. Prior to joining FireEye, Mr. Rosiek was a Principal Cyber Security Consultant at McAfee. Prior to joining McAfee, Travis spent nearly 10 years at the Department of Defense (DoD) in various roles including: management, security architecture, CND analyst, and as an engineer supporting DoD Enterprise Information Assurance programs, CND Operations centers, Incident Response, Red Team, C&A, Metrics, and many others. In addition, he supported several of the COCOMS, services, and agencies to integrate systems and operations in an effort to enable Cyber Defenders to be more effective in defending their networks.

Travis received his M.S. in Electrical Engineering, with a concentration in Information Assurance and Biometrics, from West Virginia University. In addition, he has completed the Executive Leadership Development Program (ELDP) at George Washington University.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, May 19, 2015 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
Washington, DC, 20005

Click here for details.

April 21, 2015 at 6:30 PM

ISSA National Capital Chapter February meeting topic:

Human Exploitation: How Social Engineering Will Defeat Your Organization
by Matt James

Abstract
Words like exploitation have a negative connotation, and no one wants to be the one left holding the potato when the music stops. Since the earliest days of conflict, exploiting human-nature has been at the core of strong offensive capabilities. So, why are organizations (especially the government) so adverse to taking the steps necessary to train and equip their employees with the tools necessary to defeat this effective attack vector? Matt James, cyber warfare consultant for Knowledge Consulting Group, will show just how easy it is to exploit humans, and marry it with technical methodologies. Anecdotal stories will be shared about exploiting multi billion-dollar corporations, to the largest banks; secure installations, to senior staff. Come learn what social engineers look for, and gain insight into what your organization can do to defeat their attempts.

About the Speaker 
Matt James is a cyber warfare consultant for Knowledge Consulting Group, Inc., based out of Reston, Virginia. He has more than 12 years experience in information security, and has most recently served as lead for federal, financial, and commercial red-team penetration testing engagements. Prior to his work in the private sector, he served as an Information Management Officer in the Special Operations community, and as an Operations Officer for the State Department. Mr. James is a disabled combat veteran, having served during Operation Iraqi Freedom, where he was awarded the Bronze Star Medal and Purple Heart from separate instances during that time-period.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, April 21, 2015 6:30 PM

Government Publishing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

March 17, 2015 at 6:30 PM

ISSA National Capital Chapter February meeting topic:

Verizon 2015 Annual Data Breach Investigations Report
by Wade Baker

Abstract
Wade will go “off script” from the main DBIR to explore some side alleys of the underlying data and try to answer some big picture questions about information security management. He’s not exactly sure yet what those will be, but promises it will be interesting and instructive. He also promises to give a light taste of what’s cooking for the 2015 DBIR (which is in the works now and the reason this abstract is so short).

About the Speaker 
Wade Baker is the Director of Cybersecurity Strategy & Research at Verizon Security Solutions. In this role, he is responsible for the overall direction of security services, technology capabilities, intelligence operations, and research programs. He is also the creator and lead author of Verizon’s annual Data Breach Investigations Report ("DBIR"). Baker has over 15 years of experience in the IT and security field. His background spans the technical-managerial spectrum from system administration and web development to intelligence operations and risk management. Prior to his tenure at Verizon, he spent 5 years on the faculty of two major research universities, most recently in the Pamplin College of Business at Virginia Tech.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, March 17, 2015 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
Washington, DC, 20005

Click here for details.

Dear Members:
Voting for Chapter Officers is officially open.  You may vote until 11:59 PM Monday, December 16, 2013.  The new Board will be announced at the December 17 meeting.  Click the link at the bottom of this email to access ballot.  You must supply your ISSA ID number to vote.  If you vote more than once, the last vote received will be the vote counted.
 
The candidates are:
 
President:  Scott Binder
Scott's statement
Please accept my nomination for the ISSA National Capital Chapter President. For many years I have been an active member of the National Capital Chapter and have served as the Chapter President for 2013 and it has truly been an honour serving in that position. I believe that I can assist the chapter even further by serving again as President in 2014.

I have been involved in information systems security for over 20 years. During this time, I have assisted the Federal Government and the private sector in planning, managing, solving, and executing complex audit and information technology issues. I hold the CISSP, CISA, CIA and other certifications.  I work very well with people and believe that good and frequent communication is the primary key for opening doors and accomplishing goals. Please accept my nomination for President and thank you for your support and consideration.
 
Executive Vice President:  Jim Shanesy
Jim’s statement
I have been involved in IT full life cycle applications development for more than 25 years, supporting both government and the private sector.  My current position is Sr. Risk Analyst with Knowledge Consulting Group.  I have served on ISSA-DC's Board in the past as both VP Education and EVP.  I look forward to assisting the President in bringing exciting new programs to ISSA-DC this year. Thanks to all the membership for your support and your vote.
 
Chief Financial Officer:  Eddie Schwartz
Eddie is the incumbent Chapter Treasurer/Chief Financial Officer.  
 
Secretary and Vice President of Communications:  Branko Bokan
Branko’s statement
Branko has been a member of the chapter's board of directors for the past five years. He is an information security professional with extensive experience in IT and security management and technologies. Branko holds a BSc in Information Systems from the London School of Economics, and an MSc in Information Security from Royal Holloway, University of London. He currently works as a director of cyber security at Innotion Enterprises Inc. 
 
Vice President of Education:  Roxane Nelson
Roxane’s statement
Roxane Nelson is a retired US Navy Veteran. She completed her Masters Degree in Cybersecurity from the University of Maryland University College (UMUC) in 2012 and recently completed her MBA, December 2013. She currently holds the position of Information Assurance Specialist for InfoTek supporting the Naval Explosive Ordinance Division in Indian Head, MD.
 
Vice President of Programs and Events:  Tom Hallewell
Tom’s statement
Tom Hallewell has served on the National Capital Chapter Board of Directors for six years. He is currently serving as VP of Programs and Events.
 
Vice President of Membership:  Patricia Summers
Patricia’s statement
I have been a member of ISSA-DC for more than 6 years and have had the honor of serving as Membership VP for the past 2 years.  I am willing to serve again in this post, but feel strongly that it is time for someone else to have this opportunity.  I am willing to assist whoever else wants to run for this position until they feel comfortable in the role.  That said, I have over 20 years in various aspects of Information Technology and Information Security, have earned a CISSP and am keenly aware of the benefits of organizations such as ISSA, both personally and professionally. Membership gives us access to people we might not meet otherwise, and the monthly meetings are more like Grad Seminars than boring stand-up lectures.  Risk Management plays a role in our meetings, as for instance when the Speaker shows up but is carrying items that are not allowed in secure government buildings, the Speaker doesn't show up at all, or the Pizza goes missing;  opportunities for quick thinking and disaster recovery abound.  This is a fun group.  If no one else runs I will be happy to serve another term. 
 
Vice President of Strategic Relations
No candidate has been nominated for Vice President of Strategic Relations.
 

 
Thomas E. Hallewell, CISA, CISSP, CRISC, CSSLP, Certified Scrummaster
VP, Programs
Chair, 2014 Election Board
National Capital Chapter, ISSA
www.issa-dc.org

February 24, 2015 at 6:30 PM

ISSA National Capital Chapter February meeting topic:

Data Breach: Investigations and Readiness

Abstract
Turn on the television and you are more likely to hear about a data breach than any other security incident. Despite all security measures, data leakage and exfiltration still occur in “well-protected” enterprise networks – bypassing all defensive measures. Unless a viable process exists to protect valuable corporate intellectual property and customers’ sensitive information, data breaches and loss will become commonplace rather than an anomaly. Real-world experience gained from preparing high-stake organizations against data loss as well as in conducting high-profile investigations will be shared with participants. These experiences should help attendees anticipate, prepare for, and conduct forensically-sound data breaches investigations timely. 

About the Speaker 

Inno Eroraha is the Founder and Chief Strategist of NetSecurity® Corporation, a computer forensics, cyber security and training company based in Dulles, Virginia. His main responsibility is to position NetSecurity as “the brand of choice for forensics, security, and training,” by delivering high-quality, timely, and customer-focused solutions. Mr. Eroraha oversees NetSecurity’s day-to-day operations, including the proprietary HANDS-ON HOW-TO® training program and the state-of-the-art NETSECURITY FORENSIC LABS. He leads the execution of NetSecurity’s solutions and helps clients protect, defend, and recover valuable assets from cyber attacks and computer fraud. He has been consulted by Fortune 500 companies, financial institutions, IRS, DHS, DoD, and otherpremier organizations to solve complex cyber security problems.

Before founding NetSecurity, Mr. Eroraha was a senior manager of information security at VeriSign, Inc. In this capacity, he led the implementation of solutions to protect critical Internet infrastructures. As an advocate, he significantly heightened security awareness among internal and external stakeholders and key decision makers. Inno Eroraha also worked at Network Associates (now McAfee), Trusted Information Systems, Smartronix, SAIC, and other consulting firms. Mr. Eroraha has contributed to the field of computer security and forensics, often speaking, authoring, or consulting with media outlets on security and forensics topics.

Mr. Eroraha graduated cum laude with dual-bachelor degrees in mathematics and computer science from Morgan State University. He also received a masters degree in computer science from The George Washington University. Additionally, he has received industry certifications that include CISSP, ISSAP, ISSMP, CISM, CISA, CHFI, CCSE, and CCSA. Mr. Eroraha is a member of FBI InfraGard, High Technology Crime Investigation Association (HTCIA), (ISC)2 , ISSA, and ISACA.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, February 24, 2015 6:30 PM

Government Publishing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

January 20, 2105 at 6:30 PM

ISSA National Capital Chapter January meeting topic:

Dr Ron Ross

Abstract
To be announced. 

This event is brought to you by  

About the Speaker 
Dr. Ron Ross is a senior computer scientist and information security researcher at the National Institute of Standards and Technology (NIST). Dr. Ross leads the Federal Information Security Management Act (FISMA) Implementation Project for NIST, which includes the development of key security standards and guidelines for the federal government, support contractors, and the United States critical information infrastructure. His recent publications include Federal Information Processing Standards (FIPS) Publication 199, FIPS Publication 200, NIST Special Publication 800-53, NIST Special Publication 800-53A, NIST Special Publication 800-37, and NIST Special Publication 800-39.

Dr. Ross is also the principal architect of the NIST Risk Management Framework that provides a disciplined and structured methodology for integrating the suite of FISMA security standards and guidelines into a comprehensive enterprise-wide information security program.

Dr. Ross is a frequent speaker at public and private sector venues including federal agencies, state and local governments, and Fortune 500 companies.

Dr. Ross is a two-time recipient of the Federal 100 award for his leadership and technical contributions to critical information security projects affecting the federal government and has been inducted into the ISSA Hall of Fame. Dr. Ross is a graduate of the Program Management School at the Defense Systems Management College and holds both Masters and Ph.D. degrees in Computer Science from the United States Naval Postgraduate School.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, January 20, 2015 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

December 15, 2014 at 6:30 PM

ISSA National Capital Chapter invites you to a special event:

ISSA -DC at SANS@Night Cyber Defense Initiative 2014 

A Night of CryptoG by Mark Hardy
and 
Debunking the Complex Password Myth by Keith Palmgren

The National Capital Chapter has partnered with the SANS Institute again this year to offer exclusive access for its members to SANS@Night events at Cyber Defense Initiative 2014. The chapter meeting will take place at Grand Hyatt Washington on Monday, December 15, 2014. 

Please note that the event is free but you must RSVP at least 24 hours before the event so we can have your badge ready for you. 

The chapter members and their guests will have access to the following events:

5:00pm - 7:00pm
Vendor Expo and Networking Event
6:30pm - 7:00pm
National Capital Chapter Meeting - 2014 Election Results
7:15pm - 8:00pm
A Night of Crypto by Mark Hardy
7:15pm - 8:00pm
Debunking the Complex Password Myth by Keith Palmgren

A Night of Crypto by G. Mark Hardy
Want to learn a bit more about cryptography but not get wrapped up in the math? G. Mark Hardy has been writing crypto contests for major hacker conferences for years (DEFCON, Toorcon, Shmoocon, THOTCON, SkyDogCon, etc.), and is going to share insights into the reasons behind cryptography, why some algorithms work and some fail, and take a look at what's in use in business today. We'll even cover the cryptographic principles behind Bitcoin. Plus, you'll get a chance to see how crypto puzzles are designed, which might give you some ideas for your own.

Debunking the Complex Password Myth by Keith Palmgren
Perhaps the worst advice you can give a user is "choose a complex password." The result is the impossible-to-remember password requiring the infamous sticky note on the monitor. In addition, that password gets used at a dozen sites at home, AND the very same password gets used at work. The final result ends up being the devastating password compromise. In this one-hour talk, we will look at the technical and non-technical (human nature) issues behind passwords. Attendees will gain a more complete understanding of passwords and receive solid advice on creating more easily remembered AND significantly stronger passwords at work and at home, for their users, for themselves and even for their children.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Monday, December 15, 2014 6:30 PM

Grand Hyatt Washington
1000 H Street NW
Washington, DC 20001 US

Novebmer 18, 2014 at 6:30 PM

ISSA National Capital Chapter November meeting topic:

A (Brief) History of Computer Crime
by Mark Rasch, Rasch Technology And Cyberlaw

Scroll down for abstract and speaker's bio.

Abstract
Mr. Rasch will discuss the history of computer crime since 1971.

About the Speaker

Mark Rasch brings over 25 years of experience in the information security field, having served for nine years as the head of the United States Department of Justice Computer Crime Unit, and having prosecuted key cases involving computer crime, hacking, computer fraud and computer viruses. Mark has served as Chief Privacy Officer in the private sector where he managed the risks and business impacts of privacy laws and policies.

While at the Department of Justice, he was responsible for investigations of computer hacking cases including those of the so-called “Hannover Hacker” ring, Kevin Mitnick and the prosecution of Robert T. Morris, author of the Cornell Internet Worm in 1988. He helped the FBI and Treasury Department develop their original procedures on handling electronic evidence. He created and taught classes at the FBI Academy and the Federal Law Enforcement Training Center on electronic crime and evidence. He has also taught classes on cyberlaw at American University, George Washington University, Harvard University, and Stanford.

Mark is frequently featured in news media on issues related to technology, security and privacy including. He has appeared on or been quoted by NBC News, MSNBC, Fox News, CNN, The New York Times, Forbes, PBS, The Washington Post, NPR and other national and international media. He writes a monthly column for StorefrontBacktalk on issues related to law and e-commerce and is a regular contributor to Wired magazine.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, November 18, 2014 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
Washington, DC, 20005

Click here for details.

October 21, 2014 at 6:30 PM

ISSA National Capital Chapter October meeting topic:

Jonathan Fallone
Releasing the Kracken: Building and Using A GPU Password Cracker

Abstract
We’ve all seen the major security firms show off their password cracking setups on Twitter and their blogs. But it’s not that hard – or expensive - to build a serious password cracker for your own company. In fact, the real attackers probably sport similar hardware to use against you. While it can look daunting to pick from the massive number of GPUs available on the market, it’s not that difficult to nail down your requirements and put together a fast rig able to crack a significant number of passwords in a short period of time. This presentation will show you what to look for, how to pick your equipment, and considerations for building and maintaining your rig – from piecing the system together to considering your power requirements.

But a password cracker is useless if you don’t know how to use it. It’s all too common for pen testers and auditors to use a dictionary or two and a couple of simple brute force attacks and give up. There are tons of options in most cracking tools to increase the effectiveness of your cracking efforts. We’ll show you how to use your new password cracker and the industry favorite oclHashcat effectively to crack a significant number of passwords in a short amount of time, with minimal brute forcing.

About the Speaker
Jonathan Fallone is a senior penetration tester and security consultant for Knowledge Consulting Group (KCG) in Reston, VA. He is a 2010 summa cum laude graduate of Strayer University with a Bachelors of Science in Information Systems (BSIS), concentrating in security administration. He’s worked as a contractor for the Department of the Navy, Naval Sea Systems Command, performing DoD Information Assurance Certification and Accreditation Process (DIACAP) assessments on Team Submarine systems. Most recently, Jonathan has worked as a technical assessor and pen tester on numerous government and industry assessments, using multiple frameworks, including NIST 800-53 and PCI. He was also the primary technical assessor for KCGs independent review of the Akamai Content Delivery Network (CDN) for their FedRAMP ATO effort. Jonathan’s primary area of interest is in internal penetration tests and password cracking. He’s recently worked on providing proof of concepts and practical application of the Cold Boot and FireWire attacks on local memory, and has published a paper on the subject on EthicalHacker.net. He holds the GPEN, Certified Ethical Hacker (CEH), Security+, Network+, and A+ certifications, and is an Intermediate Level Navy Validator.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, October 21, 2014 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

September 16, 2014 at 6:30 PM

ISSA National Capital Chapter September meeting topic:

Military Tactics for Enterprise Defense
by Greg Conti
Director, Army Cyber Center
United States Military Academy, West Point

Abstract
On today's increasingly militarized Internet, companies, non-profits, activists, and individual hackers are forced to melee with nation-state class adversaries. Just as one should never bring a knife to a gun fight, a network defender should not rely on tired maxims such as "perimeter defense" and "defense in depth." Today's adversaries are well past that. This talk teaches you how to tap what we call the Library of Sparta - the collective written expertise codified into military doctrine. Hidden in plain sight, vast free libraries contain the time-tested wisdom of combat at the tactical, operational, and strategic levels. This is the playbook nation-state adversaries are using to target and attack you. This talk will help you better understand how adversaries will target your organization, and it will help you to employ military processes and strategies in your defensive operations. These techniques scale from the individual and small team level all the way up to online armies. This talk isn't a dry index into the library of doctrine, we provide entirely new approaches and examples about how to translate and employ doctrinal concepts in your current operations. A key point of the talk will be helping defenders generate the intelligence, information, and disinformation advantage necessary to turn the tables. You will leave this talk with a suite of military-grade strategies that will help you advance your work beyond the individual and small-team level and will prepare you to take on the most advanced adversaries.

About the Speaker
Greg Conti is Director of the Army Cyber Institute and is an Associate Professor at West Point, where he conducts security research and teaches computer science. He is the author of Security Data Visualization (No Starch Press) and Googling Security (Addison-Wesley) as well as over 60 articles and papers covering cyber warfare, online privacy, usable security, and security data visualization. He has spoken at numerous security conferences, including Black Hat, Defcon, CyCon, HOPE, Interz0ne, ShmooCon, and RSA. His work can be found at www.gregconti.com

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, September 16, 2014 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
Washington, DC, 20005

Click here for details.

August 19, 2014 at 6:30 PM

ISSA National Capital Chapter August meeting topic:

Combating Today's Targeted Attacks 
by Tom Kellermann, VP Cyber Security at Trend Micro

Abstract
Targeted attacks can only be thwarted by increasing the level of discomfort of the adversary to a point where they cannot expend the resources to maintain persistence. Advanced persistent response is the future of cyber security.

 Meeting Sponsor

About the Speaker

Within this role Tom Kellermann is a trusted advisor for Cybersecurity.  Tom is responsible for analysis of emerging cybersecurity threats and relevant defensive technologies.

Tom Kellermann served as a Commissioner on The Commission on Cyber Security for the 44th Presidency and serves as an advisor to the International Cyber Security Protection Alliance (ICSPA), and the National Board of Information Security Examiners Panel for Penetration Testing.  Tom is a Professor at American University's School of International Service and the Kogod School of Business.  Tom is a Certified Information Security Manager (CISM).

Prior to joining Trend, Tom held the position as Vice President of Security for Core Security for 6 years. Previously, Tom was the Senior Data Risk Management Specialist for the World Bank Treasury Security Team, where he was responsible for internal cyber-intelligence and policy and for advising central banks around the world about their cyber-risk posture and layered security architectures. In 2003, Tom co-authored the book "E-safety and Soundness: Securing Finance in a New Age."

Favorite quote: “There is one thing stronger than all the armies in the world, and that is an idea whose time has come.” –Victor Hugo

Experience: 16 years

Specialty: Financial sector cyber security and cyber security for government agencies

Education: M.A., American University; B.A., University of Michigan

Expert in Action: Tom appeared on BrightTalk to give this 2 minute overview "The Future of Endpoint Security." Watch RSA Interview with Tom, "The Evolution of Cyber-Attacks". Tom recently appeared on Fox Business News to discuss threats to mobile banking and payment transactions.The Accidental Insider Threat: Tom joins a panel of experts to explore the threats posed by “accidental insiders”— individuals who can unknowingly present a major risk to an organization and its infrastructure. Airing on Federal News Radio. Watch Tom's interview about attacks on Apple devices on Bloomberg Television's "Market Makers" Read Tom's latest opinion piece, How the Thwart the Digital Insider - An Advanced Persistent Response to Targeted Attacks

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, August 19, 2014 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
Washington, DC, 20005

Click here for details.

July 15, 2014 at 6:30 PM

ISSA National Capital Chapter July meeting topic:

Terry Gudaitis, Ph.D.
Social Media and the Insider Threat

Abstract

With the onslaught of new social media platforms and the handheld devices used by people to gain access to apps, the web, and social media, insider threat may need a new perspective.  Whether the threat or compromise is malicious or accidental, insiders are no longer only restricted to the computers, networks and devices provided by their organizations.  Between BYOD, remote work arrangements and the new generation of users entering the workforce, people are using, sharing and accessing more information than ever.  Thus, the risk vectors are increasing and this poses a different type of challenge for security professionals.  Some of the topics covered will include:

• Apps and data mining – what is actually being collected about you, your activities and how you use your devices.  Some studies are actually indicating that data mining by apps is more of a threat than malware.
• Social media disclosure and sharing – what the “typical” employee shares on social media and how that can leave a door open to your organization
• Integration of home/work use of computers, phones and tablets…even when BYOD is not part of the accepted policy
• The new workforce – how the new generation of employees generally views security, company loyalty, privacy, data sharing, and self-disclosure via social media 

The presentation will conclude with some recommendations on how to better understand the contemporary insider threat and discuss technologies and solutions that can address the mitigation of risk.

About the Speaker

Terry is currently the owner of Mindstar Security & Profiling, LLC.  Mindstar Security and Profiling specializes in custom/concierge security training, consulting, and imminent threat assessment for the commercial industry focusing on high profile and high net worth executives and families.  Training and consultations include a unique perspective and blend of physical/cyber security, intelligence, and behavioral profiling.  Terry provides psychological and behavioral profiling for investigations and offers profiling training in the classroom to security professionals.

Prior to forming her own firm in 2013, Terry was the Vice President and Cyber Intelligence Director at Cyveillance, responsible for operations and management of the security/intelligence delivery organization.  Before joining Cyveillance, Terry also held senior positions at SAIC, Psynapse Technologies LLC and Global Integrity Corporation.  Before focusing on the commercial sector, Terry was an operations officer and behavioral profiler at the Central Intelligence Agency (Counter Terrorist Center).  

In addition to her corporate related work, Terry has served on the United States Secret Service Advisory Board for Insider Threat; trained investigators at the National Center for Missing and Exploited Children and regularly presents at national and international conferences. Her most current publications include a book on Social Engineering – Low Tech Hacking (2011) and, a book on profiling hackers entitled Malware Profiling (Oct. 2014 – to be released). Terry is also a frequent speaker at the International Spy Museum in Washington, DC.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, July 15, 2014 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
Washington, DC, 20005

Click here for details.

June 17, 2014 at 6:30 PM

ISSA National Capital Chapter June meeting topic:

Scott Lehman and Tom Hallewell 

The Five Stages of Grief

How to Implement a Software Assurance Program

Abstract

Introducing software assurance into your in-house development projects is more a social challenge than a technical one. Elizabeth Kubler-Ross' Five Stages of Grief (Denial, Anger, Bargaining, Depression, and Acceptance) seems like an apt model for the process needed build a robust, effective secure software development program from the ground up.

We will share some of the challenges we encountered while implementing a software assurance program.  We will discuss the various stakeholders, and their varying goals, expectations, and fears.  We will present suggestions based on our experience that may help your program gain acceptance and produce more secure software.  We will briefly describe Continuous Integration/DevOps and discuss some of the security benefits – and risks – that come from this software development approach. 

About the Speakers

Scott Lehman
Scott has over two decades of professional development experience in the commercial, government and military sectors.  He leverages this experience in his current Application Security-focused role for a large Federal entity.

Tom Hallewell
Tom Hallewell has more than fifteen years experience in the Information Security field.  He has led both development and software security programs.  He is currently engaged in the implemention of enterprise identity management in a large Federal Agency.  He is also a leader in the National Capitol Chapter of ISSA.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, June 17, 2014 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

May 20, 2014 at 6:30 PM

ISSA National Capital Chapter and OWASP Washington DC Chapter
Joint Meeting

 How To Find Mobile Internet Love (Securely)
by Jack Mannino and Abdullah Munawar

Abstract:
As mobile dating applications grow in popularity, so does our interest in the security posture behind them. There are a vast number of mobile dating applications available for use today by anyone with a smart phone. We wanted to take a look at numerous features within these apps to determine the good, the bad, and the ugly. 

We will cover popular features such as location-based services, analytics, sharing of information, in-app purchasing, and any other features we discover to be interesting. We will analyze the type of personal data being stored within these applications, communication channels used to transmit information, hardware interaction with the application, and interaction with other applications on the device. We will answer the big questions posed by those who use these apps or want to use these apps: Are these applications disclosing sensitive information? How private is the communication between me and another user? How can I be sure my data is being protected?

This talk will feature highlights from popular, obscure, and scary dating applications to answer a simple question: “Can you find love on the Internet without having your personal data exposed?”

Jack’s Bio: 
Jack Mannino is an Application Security expert with over a decade of experience building, breaking, and securing into complex systems. Jack is Co-Founder and CEO of nVisium, while also leading research and development initiatives. With experience developing in Java, Objective-C, and C#, he performs risk assessments and penetration tests for Fortune 500 companies and government agencies. Jack also founded and leads the OWASP Mobile Application Security Project, which is a global initiative to build secure development standards for mobile. He is an active Android security researcher with a keen interest in large-scale security analysis.

Abdullah’s Bio:
Abdullah Munawar is an Application Security consultant at nVisium who specializes in mobile application testing and ripping apart new things. With over 7 years of experience, Abdullah previously worked on the security teams at financial and aviation organizations. Abdullah attempts humor on a daily basis and succeeds most of the time, every time.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, May 20, 2014 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
Washington, DC, 20005

Click here for details.

April 15, 2014 at 6:30 PM

ISSA National Capital Chapter April meeting topic:

Dmitri Alperovitch

At Government Printing Office

Abstract
To be announced. 

About the Speaker

Dmitri Alperovitch is the Co-Founder and CTO of CrowdStrike Inc., leading its Intelligence, Research and Engineering teams.  A renowned computer security researcher, he is a thought-leader on cybersecurity policies and state tradecraft.  Prior to founding CrowdStrike, Dmitri was a Vice President of Threat Research at McAfee, where he led company’s global Internet threat intelligence analysis and investigations.

In 2010 and 2011, Alperovitch led the global team that investigated and brought to light Operation Aurora, Night Dragon and Shady RAT groundbreaking cyberespionage intrusions, and gave those incidents their names.

In 2013, Alperovitch received the prestigious recognition of being selected as MIT Technology Review’s “Young Innovators under 35” (TR35), an award previously won by such technology luminaries as Larry Page and Sergey Brin, Mark Zuckerberg and Jonathan Ive.

Alperovitch was named Foreign Policy Magazine’s Leading Global Thinker for 2013, an award shared with Secretary of State John Kerry, Elon Musk and Jeff Bezos.

He was the recipient of the prestigious Federal 100 Award for his contributions to the federal information security in 2011 and recognized in 2013 as one Washingtonian’s Tech Titans for his accomplishments in the field of cybersecurity.

With more than a decade of experience in the field of information security, Alperovitch is an inventor of nineteen patented technologies and has conducted extensive research on reputation systems, spam detection, web security, public-key and identity-based cryptography, malware and intrusion detection and prevention.

As a recognized authority on cyberespionage, cyber warfare, online organized criminal activity, and cybersecurity, Alperovitch has significant experience working as a subject matter expert with all levels of U.S. and international policy makers, intelligence and law enforcement agencies on analysis, investigations, and profiling of transnational organized criminal activities and cyber threats from terrorist and nation-state adversaries. He is a well-respected technical and policy thinker on the most difficult global cybersecurity issues, and is a frequent speaker at military, intelligence, law-enforcement, academic and security industry conferences. Alperovitch has published and given numerous talks on the contemporary issues in cybersecurity policy such as cyberdeterrence doctrine, Chinese-sponsored  cyberespionage and the use of cyber weapons on the future battlefield. Alperovitch is frequently quoted as a cyberpolicy and cybersecurity expert source in national publications, including The New York Times, USA Today, and The Washington Post, The Associated Press and Reuters.

Prior to joining McAfee, Alperovitch led the research team and the Cloud Security business unit at Secure Computing.

Alperovitch is currently a Senior Fellow at Atlantic Council and has served on the board of Georgia Tech Information Security Center (GTISC) Industry Advisory Board. He currently serves on the RSA Conference Advisory Board.

Alperovitch holds a master's degree in Information Security and a bachelor's degree in Computer Science, both from Georgia Institute of Technology. 

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, April 15, 2014 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

March18, 2014 at 6:30 PM

ISSA National Capital Chapter February meeting topic:

 Man-in-the-Browser Session Hijacking
by Raphael Mudge, Strategic Cyber LLC

Abstract 
Two-factor authentication is mainstream now. Most major web services have it as an option. Is this the end of phished accounts? No. Attackers will simply shift tactics.

This talk walks through a man in the browser attack to hijack authenticated web sessions. You will learn different ways a browser may identify itself to a server and one way an attacker can hijack these, regardless of the two-factor user authentication in place.

Demonstrations included.   

About the Speaker 
Raphael Mudge is the founder and Principal at Strategic Cyber LLC. His company’s software, Cobalt Strike, helps pen testers and red teams emulate advanced threats. http://www.advancedpentest.com/

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, March 18, 2014 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
Washington, DC, 20005

Click here for details.

February 18, 2014 at 6:30 PM

ISSA National Capital Chapter February meeting topic:

William Jimenez
Deputy Director DC3

Abstract
During a roundtable discussion at Fordham University in New York City, Federal Bureau of Investigation (FBI) Director Robert Muller commented that “the cyber threat will equal or eclipse the terrorist threat and pointed at the proliferation of adversaries in the cyber arena” (fbi.gov).  The proliferation of connected devices or “Internet of Things” enables unique possibilities to integrate technology and simplify our lives.  This technology also creates a vector for criminals and other adversaries to exploit our networks for their own purposes.  In order to combat the proliferation of our adversaries and this threat there are a number of government initiatives underway to assist in protecting our networks, information, and critical infrastructure.   Law enforcement, net defenders, and the intelligence community are also actively engaged in mitigating this evolving threat.  As technology continues to push the boundaries of automation, communications, and information sharing we will continue to contend with cyber criminals who continue to expand their own boundaries.     

About the Speaker
William M. Jimenez is the Deputy Director of the Defense Cyber Crime Center (DC3).  As the deputy “Chief Executive Officer” he is responsible for the day-to-day operations of a national cyber center.  He leads DC3’s budget, logistics, procurement, human capital, infrastructure, security, information assurance, and network operations. He also oversees support to DC3’s five organizations which perform deep forensic examinations of electronic media and network intrusions; training for DoD cybercrime investigators, analysts, and digital forensic examiners; technical solutions development and validation of software and hardware used in forensic applications; cyber threat analysis in support of cyber investigations; and critical infrastructure protection through the sharing of threat information with defense industrial base partners.  DC3 operates under the executive agency of the Secretary of the Air Force with program oversight provided by the Air Force Office of Special Investigations.

Prior to joining DC3 Mr. Jimenez held various positions in progressive levels of responsibility with the United States Air Force. This included assignments to HQ Standard Systems Group and the Electronic Systems Center, where he supported Air Force Materiel Command’s mission of delivering dynamic and technologically advanced systems.  He also served combat tours in both Iraq and Afghanistan.

Mr. Jimenez holds a bachelor’s degree in business from George Mason University in Fairfax VA, and masters’ degrees in business from Boston University in Boston MA, and technology management from Columbia University in New York City NY. His professional military education includes Aerospace Basic Course, Squadron Officer School, and Scope Eagle. He is a graduate of the Senior Executive Fellows program at the Kennedy School of Government, Harvard University in Cambridge, MA.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, February 18, 2014 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

January 28, 2014 at 6:30 PM

ISSA National Capital Chapter January meeting topic:

Social Engineering to Improve Security Awareness
by Ira Winkler, CISSP

At Government Printing Office

Abstract

While many organizations perform Social Engineering assessments to test their security, they end up being useless games of "gotchas", with results that prove the obvious. Rarely, do they provide recommendations that could not have been found through less expensive, overt methodologies. This presentation provides guidance on performing penetration tests in a systematic way that tests levels of security awareness. The results allow for a very tailored awareness program that is specific to the organization's employee base. As the level of awareness increases, the number and severity of incidents can dramatically decrease.

About the Speaker

Ira Winkler, CISSP is President of Secure Mentem. He is considered one of the world’s most influential security professionals, and has been named a “Modern Day James Bond” by the media. Ira is one of the foremost experts in the human elements of cyber security and is known for the extensive espionage and social engineering simulations that he has conducted for Fortune 500 companies globally. He continues to perform these espionage simulations, as well as assisting organizations in developing cost effective security programs. Ira is a noted speaker, media contributor and author of several books most notably Spies Among Us, Corporate Espionage and Zen and the Art of Information Security. He and his work have been featured in a variety of media outlets including CNN, The Wall St Journal, USA Today, San Francisco Chronicle, Forbes, among other outlets throughout the world.

Winkler began his career at the National Security Agency, where he served as an Intelligence and Computer Systems Analyst. After leaving government service, he went on to serve as President of the Internet Security Advisors Group, Chief Security Strategist at HP Consulting, and Director of Technology of the National Computer Security Association. He has also served on the graduate and undergraduate faculties of the Johns Hopkins University and the University of Maryland. In addition to his security efforts, Winkler is passionate about health and wellness and has over the past several years and is certified as a Master Scuba Diver Trainer, P90X Certified Instructor and Insanity Certified Instructor. 

Ira currently serves as the President of ISSA International, and was recently awarded the CSO Magazine Compass award.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, January 28, 2014 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

December 17, 2013 at 6:30 PM

ISSA National Capital Chapter December meeting topic:

DNS Security
by Matt Bianco 

Abstract

DNS is critical to the stability of communications on our networks as well as the internet but has largely gone unprotected. This very important service is now being used against us in many types of attacks and coupled with that are all of the new devices being introduced in the modern network. This is a great concern but they all have one underlying commonality……DNS. We will take a look at how mobile device proliferation is adding to the strenuous task of maintaining and allowing access to the network. It also raises the question on how to best protect you from BYOD and network malware. Understanding how malware communicates and exhilarates data through DNS will also highlight the benefits of adding security at that layer and how it can aid in incident response. 

About the Speaker

Mr. Bianco has over 14 years of experience in information technology, cyber security, computer forensics, and Technical Surveillance and Countermeasures accumulating multiple industry leading designations in each field.  He is a Certified Information Systems Security Professional (CISSP) and an Encase Certified Examiner (EnCE) and has obtained multiple Microsoft and Cisco certifications.  Mr. Bianco provides technical security guidance and advice to our broad base of customers along multiple verticals.  Prior to Infoblox, Mr. Bianco was Director of Cyber Intelligence at E-merging Technologies Group, Inc.  There he was an elite technical resource providing expert guidance to ETG's customers on a regular basis.  He was an acting “virtual CIO” for ETG’s managed customer base providing them with technology solutions for common and complex corporate problems.   Mr. Bianco graduated cum laude from Myers University with a Bachelor’s Degree in Business Management.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, December 17, 2013 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

November 19, 2013 at 6:30 PM

ISSA National Capital Chapter October meeting topic:

Visualization Tools in SDLC
by Wayne Beekman 

Abstract

Albert Einstein once said, If I can’t see it, I can’t understand it. This is the basis for utilizing visualization tools in the requirements gathering phase of software development projects.

Most projects that fail are due to miscommunication between the business stakeholders and the development team. Visualization tools combat this, allowing you to quickly see your software solution before a single line of code is written. Advanced visualization tools enable extremely rapid prototyping with online publishing and critiquing that can cut the time and cost of requirements gathering in half.

Visualization tools make traditional requirements sessions appear heavy and arduous. The resulting simulation is so rich in functionality that you can actually show your stakeholders what they are going to get. In fact, the prototype is so robust that it can be used for training purposes while the development effort is underway.

This seminar is designed to discuss tools that engage stakeholders and get the requirements right, the first time, before development begins.

About the Speaker

Wayne Beekman started Information Concepts in 1982 with his partner, Cary Toor, to provide fixed-price custom software development services to the Public and Private Sectors. Information Concepts specializes in the design and implementation of Mission Critical, Database Applications. Clients include NASDAQ, IRS, and PBS.

For the past 30 years, he has directed the technical direction of the firm, navigating changing technical platforms. Solutions have transitioned from the Mainframe, Client-Server architectures, Web Based projects, to Cloud Based platforms today.

Throughout his tenure, he has always utilized visualizations as part of the requirements gathering planning process.

Mr. Beekman holds a BBA and a Masters of Science in Information Systems from George Washington University. He lives in Great Falls, Virginia with his wife and two daughters.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, November 19, 2013 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
Washington, DC, 20005

Click here for details.

October 15, 2013 at 6:30 PM

ISSA National Capital Chapter October meeting topic:

Jack Whitsitt 

Abstract
Over the past several years, "cyber security" has been a term that has both grown in popularity and, in some circles, grown to be disdained by those on the front lines of information security.  On 10/15, Jack Whitsitt - who has spent many years dipping his toes into both perspectives simultaneously - will explore the space that he believes is formalizing around the term, how it differs from traditional views on what security is, what is driving these changes, and how it might affect other areas of computer security practice long term.  Topics covered will include National Critical Infrastructure, Protection vs. Assurance, the NIST Cyber Security Framework draft, the Executive Order, humans as critical vulnerabilities, and the use of nice, traditional coding practices...to create better security policy.

About the Speaker
Jack Whitsitt, recently identified by Tripwire as one of the top 10 Rising Stars and Hidden Gems in security education, began his career in security living in a small hacker compound in his teens. Years later, he was involved in early open source honeypot development work, moved into large scale data correlation system design, and has spent the past several years in the critical infrastructure space (including a stint at ICS-CERT, time building a sector specific agency program, and now as an analyst for the non-profit electric sector organization, Energysec).

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday,October 15, 2013 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
Washington, DC, 20005

Click here for details.

September 17, 2013 at 6:30 PM

ISSA National Capital Chapter September meeting topic:

Cyber Forensics Strategies for Data Loss Incidents
by Inno Eroraha

Abstract
Data breach and ex-filtration continues to cause significant financial damage to businesses. A myriad of solutions are available today that attempt to solve data leak problems. Capabilities such as cyber forensics investigation, incident response, network forensics, memory forensics, and malware analysis are all critical elements to conduct thorough data breach investigations. This presentation discusses some avenues of data leaks and shares some real-world cyber forensics strategies that can speed up and yield thorough data loss/leak investigation results.

About the Speaker
Inno Eroraha is the Founder and Chief Strategist of NetSecurity® Corporation, a computer forensics, cyber security and training company based in Dulles,Virginia. His main responsibility is to position NetSecurity as “the brand of choice for forensics, security, and training,” by delivering high-quality, timely, and customer-focused solutions. Mr. Eroraha oversees NetSecurity’s day-to-day operations, including the proprietary HANDS-ON HOW-TO® training program and the state-of-the-art NETSECURITY FORENSIC LABS. He leads the execution of NetSecurity’s solutions and helps clients protect, defend, and recover valuable assets from cyber attacks and computer fraud. He has been consulted by Fortune 500 companies, financial institutions, IRS, DHS, DoD, and other premier organizations to solve hard cyber security problems.

Before founding NetSecurity, Mr. Eroraha was a senior manager of information security at VeriSign, Inc. In this capacity, he led the implementation of solutions to protect critical Internet infrastructures. As an advocate, he significantly heightened security awareness among internal and external stakeholders and key decision makers. Inno Eroraha also worked for information security consulting practices at Network Associates(now McAfee), Trusted Information Systems, Smartronix, SAIC, and other consulting firms.

Mr. Eroraha has contributed to the field of computer security and forensics, often speaking, authoring, or consulting with media outlets on security and forensics topics. 

Mr. Eroraha graduated cum laude with dual-bachelor degrees in mathematics and computer science from Morgan State University. He also received a masters degree in computer science from The George Washington University. Additionally, he has received industry certifications that include CISSP, ISSAP, ISSMP, CISM, CISA, CHFI, CCSE, and CCSA. Mr. Eroraha is a member of FBI InfraGard, High Technology Crime Investigation Association (HTCIA), (ISC)2, ISSA, and ISACA.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, September 17, 2013 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
Washington, DC, 20005

Click here for details.

August 20, 2013 at 6:30 PM

ISSA National Capital Chapter August meeting topic:

What's Hiding in Your Software Components?  Hidden Risks of Component-Based Software
by Bruce Mayhew

Abstract
What's Hiding in Your Software Components?  Hidden Risks of Component-Based Software

Software is no longer written, it's assembled. With 80% of a typical application now being assembled from components, it's time to take a hard look at the new risks posed by this type of development -- and the  processes and tools that we'll need in order to keep them in check.

On the just released OWASP Top 10 for 2013, entry A9 highlights the potential problems associated with the widespread use of open-source components with known security vulnerabilities in modern-day application development.

Join Bruce Mayhew,  as he shares real world data on component risks, outlines the scope of the problem, and proposes approaches for managing these risk. You'll learn how security professionals can work cooperatively with application developers to reduce risk AND boost developer efficiency.

About the Speaker
Bruce Mayhew is the Director of Security Products at Sonatype with over 20 years of software development experience, 13 years of which have been focused on application security.  He has performed code-level security assessments for hundreds of applications, created application security programs and training curriculums for large institutions, and has been a Web Application Security Course instructor for the SANS Institute.  Bruce is the primary author and project lead of OWASP WebGoat, a deliberately insecure JavaEE educational application. He is an author of the SANS GSSP Secure Programming Assessment and a frequent speaker on application
 security topics.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, August 20, 2013 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

July 16, 2013 at 6:30 PM

ISSA National Capital Chapter July meeting topic:

Transforming your SOC for Big Data Analytics -- Rationale and Strategy
by Eddie Schwartz

Abstract
Despite the best efforts and significant investments of security teams, various classes of threat actors continue to wreak havoc within organizations today.  The challenge for our profession is how to reduce the impact of unknown and unexpected attacks and risks when traditional security technologies, processes, and skills have proven to be inadequate.  Big data is transforming security operations centers in government agencies and the private sector.  This session will describe the rational for a movement from traditional approaches to security management to big data, and a sensible approach to people, process, and technologies.

About the Speaker
Eddie Schwartz is Chief Security Officer for RSA and has over 25 years experience in the information security field.  Previously, he was Co-Founder and CSO of NetWitness (acquired by EMC), CTO of ManTech, EVP and General Manager of Global Integrity (acquired by INS), SVP of Operations of Guardent (acquired by VeriSign), CISO of Nationwide Insurance, a Senior Computer Scientist at CSC, and a Foreign Service Officer with the U.S. Dept. of State.   Mr. Schwartz has advised a number of early stage security companies, and served on the Executive Committee for the Banking Information Technology Secretariat (BITS).  Mr. Schwartz has a B.I.S. in Information Security Management and an M.S. in Information Technology Management from the George Mason University School of Management.  Mr. Schwartz is a 2013 recipient of the Computerworld Premier 100 IT Leaders Award and is the Treasurer of the ISSA-DC Chapter.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, July 16, 2013 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
Washington, DC, 20005

Click here for details.

June 18, 2013 at 6:30 PM

ISSA National Capital Chapter June meeting topic:

When Less Is More, the Thin Slicing of a Black Swan 
by Michele Chubirka and Ronald P. Reck

Abstract

As infosec professionals we are swimming in prodigious amounts of data, but it isn’t making us better at our jobs, it seems to make us worse. In Verizon’s 2012 Data Breach Investigations Report, it was found that across organizations, an external party discovers 92% of breaches. We continue to desperately grasp at that straw of, “more data,” but what if this is simply information gluttony? Incident response's bloated model drives it closer to a form of security archaeology rather than its promise of real time relevance.

About the Speakers

Michele Chubirka aka "Mrs. Y."
Mrs. Y is a recovering Unix engineer most recently assigned to the network security team of financial services provider. Likes long walks in hubsites, traveling to security conferences, and spending extended hours in the Bat Cave. Believes that every problem can be solved with a "for" loop. She also hosts a podcast called Healthy Paranoia, a security feed of Packetpushers. 

Ronald P. Reck
Ronald P. Reck is formally trained in theoretical syntax, an author of countless papers on linguistics and a book on RDF. He has worked extensively with the intelligence community and law enforcement, implementing standards for data and knowledge representation.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, June 18, 2013 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

May 21, 2013 at 6:30 PM

ISSA National Capital Chapter May meeting topic:

Outcome Based Security
in a Continuous Monitoring World
by Ron Gula

Abstract
The speaker will discuss how large scale enterprises security programs are combining their compliance and security monitoring solution into continuous monitoring efforts. He will review why SIMs, GRC, anti virus, IDS, patch management and many other types of enterprise security technologies fail at scale and how they can be best used in a continuous monitoring effort.

About the Speaker
Ron Gula is known in the global security community as a visionary, innovator, and engineer of extraordinary talent. He traces his passion for his work in security to starting his career in information security at the National Security Agency conducting penetration tests of government networks and performing advanced vulnerability research. Since co-founding Tenable Network Security in 2002, Ron has been CEO and CTO at Tenable, maker of the world-renowned Nessus® vulnerability scanner and Unified Security Monitoring™ architecture. As CEO/CTO of Tenable, he is responsible for product strategy, research and development, and product design and development. Ron is also a leader in his community and a passionate advocate for education and scientific research.

Prior to Tenable, Ron was the original author of the Dragon IDS and CTO of Network Security Wizards, which was acquired by Enterasys Networks. At Enterasys, Ron was Vice President of IDS Products and worked with many top financial, government, security service providers, and commercial companies to help deploy and monitor large IDS installations. He was also the Director of Risk Mitigation for US Internetworking and was responsible for intrusion detection and vulnerability detection for one of the first application service providers. Ron also worked for BBN and GTE Internetworking where he conducted security assessments as a consultant, helped to develop one of the first commercial network honeypots, and helped develop security policies for large carrier-class networks.

Ron has a BS from Clarkson University and an MSEE from the University of Southern Illinois. He was the recipient of the 2004 Techno Security Conference "Industry Professional of the Year" award. In SC Magazine's 20th Anniversary Edition, Ron was named as one of the top market entrepreneurs for the past 20 years.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, May 21, 2013 6:30 PM

Center for American Progress (CAP)
1333 H St. NW
Washington, DC, 20005

Click here for details.

April 16, 2013 at 6:30 PM

ISSA National Capital Chapter April meeting topic:

Social Media Smarts

By Michael Janke

Abstract:

Social media is transforming how organizations do business. The speed, interactivity, and community aspects of social media make it ideal for ongoing customer and partner interaction, collaborative work of all types, timely or urgent notifications, and tailored-targeted ads and promotion.  Social media lets people communicate and work when and how they want, via richer modes and means of expression.

Yet, as with most things, the benefits of Social Media come have counterbalances. The access, speed, familiarity, and amplification inherent in social media channels raise the potential risks. Users need to be more vigilant about the content they communicate and exchange; have clear understandings of who will receive or have access to their exchanges; and keep legal and business implications in mind. For example, several retail organizations send product promotions over social media. These promotions are financial records and must be treated as such. To boot, the retailers must know who the recipients are, and carefully craft eligibility, terms, and any regulatory implications.

About the speaker

Michael Janke, CEO & Co-Founder of Silent Circle a Silicon Valley, Washington DC & London based Internet Tech Firm. Best-Selling author: Take Control- mastering the art of self-discipline.Board Member/Part-Owner -SOC: Large-diversified Defense Contracting firm providing Logistics-Construction-Security services worldwide.Owner and Board Member of Security Management Group International (SMGI) .Former Navy SEAL.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, April 16, 2013 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

March 19, 2013 at 6:30 PM

ISSA National Capital Chapter March meeting topic:

SCADA Cyber Security for the Smart Grid

By Dewan Chowdhury

Abstract:

Our society is evermore dependent on the use electricity for its self-preservation, economic development, and future growth; but few truly appreciate how this energy is being delivered to your home or office. Power companies through out the world are upgrading their power infrastructure to utilize technological advances that Tesla and Edison would only dream of.  The upgrade to the power grid is allowing power companies to collect analytics they never could before, and help transform their power grid to a “smart grid”.  The move to the smart grid is ever dependent on the use of computing devices that help monitor and control power to ensure reliable electricity to the consumer.  The introduction to more computing devices to the smart grid network also introduces new cyber threats that can affect the availability and integrity of power.  If successful the cyber threats against the smart grid can have dire consequences to our society.  It’s much easier and cost effective for an adversary to attack critical infrastructure using cyber weapons to cause disruption to our energy supplies.  This presentation will educate how the power grid/smart grid works, the fundamentals of power delivery, cyber threats against the power grid/smart grid.

About the speaker

Dewan is a recognized cyber security expert for critical infrastructure/SCADA Systems, and has over 15 years of experience in the industry. Dewan has diverse experience in cyber security support from managing security operation centers for some of the largest organizations in the world, malware reverse engineering, cyber counterintelligence, advanced persistent threat.  Dewan currently specializes in targeted threats from nation state and industrial espionage targeted toward industrial control systems. Dewan continues to provide incident response/handling for Industrial Control Systems/SCADA (gas, oil, power utilities). Federal agencies (DOD, DHS, etc.) utilize his cyber security expertise on SCADA systems to help understand threat landscape and measures to protect critical infrastructure.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, March 19, 2013 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

February 19, 2013 at 6:30 PM

ISSA National Capital Chapter January meeting topic:

What is Cyber and How Do We Test It?
by Peter H. Christensen

Abstract:

This presentation will be of interest, not just to those working for the DOD, but also to anyone working in the Information Security Arena. The term "Cyber" is an ambiguous term that is liberally applied as a prefix to just about anything! In fact the term Cyberspace, as used today is used to connect Social, Information and Physical Networks. Threats in Cyberspace are realized by exploiting vulnerabilities that expose critical information. The risks in Cyberspace are bad and getting worse. The Joint Capabilities Development, DOD Acquisition and Security Certification and Accreditation Processes as currently executed are not helping to mitigate these vulnerabilities. We must change the paradigm and begin by focusing on the impact of the Cyber Threat impact on critical missions. The relationship between the mission and supporting systems must be  understood and protected as part of design and development. Cyber Test and Evaluation as well as Security Certification and Accreditation must focus on identification and mitigation of in design, development and test earlier in the process to shift defect discovery to left! DOD is working to change the paradigm and we will discuss some initiatives currently in work.

About the speaker

Pete is currently employed by the MITRE Corporation as the Test and Evaluation Integrator for Joint & Defense-Wide Programs. In that role he is responsible for coordinating Test and Evaluation Activities across the DOD Portfolio. Pete supports several DOD sponsors including DASD DT&E, TRMC and OSD DOT&E.

From 2001 through 2006, Pete served on Intergovernmental Personnel Assignment with the Marine Corps Operational Test and Evaluation Activity as the Assistant Scientific Advisor and in 2006 as the Scientific Advisor. During that time he lead OTA sponsored working groups to address Information Assurance and Net Ready KPP. In addition, he provided oversight and direction to the OT&E of the M777 Lightweight 155 Howitzer, Expeditionary Fighting Vehicle and approximately 50 C4ISR Systems.

Pete serves on the Board of Directors for the International Test and Evaluation Association (ITEA) and also chairs the Ways and Means Committee. He has been a Short Course and Tutorial Instructor and he has Co Authored several articles in the ITEA Journal. 

Pete is an Adjunct Professor in the Information Systems Masters Program at Capitol College in Laurel Md. teaching courses in Network Systems Security Concepts and Malicious Software courses.

Pete retired from the U.S. Navy in 1995. He had a wide range of assignments as a Naval Flight Officer flying EA-6B Prowlers. His last operational flying tour was with VAQ-136 on USS Midway. His last Navy assignment was as a Program Manager in the Advanced Tactical Aircraft Protection Systems Program Office (PMA-272) where he managed three EW programs.

Pete is married to Maryanne Friedrichs, from Menasha Wisconsin, so he is a Green Bay Fan. His son Chris, is a Notre Dame Grad and so he is also an Irish Fan. He is the proud Grandfather of William and Victoria Luckey. 

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, February 19, 2013 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

January 15, 2013 at 6:30 PM

ISSA National Capital Chapter January meeting topic:

Sharing Threat Information to Improve Cyber Defense 
by Douglas Wilson

Abstract:
Doug will discus some of the entrenched problems in the security arena that prevent organizations from quickly sharing threat intelligence without translation or communication errors. Solving those problems is a key component to improving modern incident response and computer network defense. This talk will discuss a variety of issues surrounding sharing threat intelligence, and some suggestions on how to tackle some of the problems from the technical side using open standards to communicate threat intelligence. It will also include discussion of possible solutions for some of the layer 8 problems involved, and introduce the community to some of the open standards that are available (OpenIOC, MITRE's STIX/TAXII, and the IETF's RID/IODEF). Doug will conclude with ways that the community can get involved, and things that are really needed to move this effort forward so that everyone can benefit. (Full Disclosure -- Doug is one of the stakeholders in OpenIOC (http://openioc.org))

About the speaker

Doug Wilson is the Threat Indicators Team Lead and a Principal Consultant at Mandiant. He lives in DC, and in an effort to try to get the ridiculously large community of Infosec nerds in this town to interact on a more regular basis, Doug has had his fingers in various local security pies over the years, such as founding the OWASP DC chapter, AppSec DC, and CapSec DC. He's gotten to take his passion for getting people to share information and interact into the workplace in the past year, having been the spokesperson for Mandiant's open-sourced threat information sharing standard, OpenIOC (http://openioc.org).

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, January 15, 2013 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

December 11, 2012 at 6:30 PM

The ISSA National Capital Chapter invites you to attend this month's meeting at SANS Cyber Defense Initiative 2012 -

The National Capital Chapter has partnered with the SANS Institute again this year to offer exclusive access for its members to SANS@Night events at Cyber Defense Initiative 2012. The monthly chapter meeting will take place at Washington Hilton on Tuesday, December 11, 2012. We will also announce the results of 2012 Election for ISSA-DC Chapter Officers. 

The chapter members and their guests will have access to the following events:

8:30pm - 9:30pm
Gamification: Hacking Your Brain for Better Learning by Yori Kvitchko 

Please note that RSVP is required.
You can pick up your badge at the registration desk on the day of the event.
 

Tuesday, December 11, 2012
There is no charge to attend and non-members are welcome. Light refreshments will be served. 
RSVP is mandatory.

November 20, 2012 at 6:30 PM

ISSA National Capital Chapter November meeting topic:

Angelos Stavrou

Abstract:
Recent advances in the hardware capabilities of mobile hand-held devices have fostered the development of open source operating systems and a wealth of applications for mobile phones and table devices. This new generation of smart devices, including iPhone and Google Android, are powerful enough to accomplish most of the user tasks previously requiring a personal computer. 

In this talk, Dr Stavrou will discuss the cyber threats that stem from these new smart device capabilities and the online application markets for mobile devices. These threats include malware, data exfiltration, exploitation through USB, and user and data tracking. We will present the ongoing GMU and NIST efforts to defend against or mitigate the impact of attacks against mobile devices. Our approach involve analyzing the source code and binaries of mobile applications, hardening the Android Kernel, using Kernel-level network and data encryption, and controlling the communication mechanisms for synchronizing the user contents with computers and other phones. Dr Stavrou will also explain the enhanced difficulties in dealing with these security issues when the end-goal is to deploy security-enhanced smart phones into military combat settings. The talk will conclude with a discussion of our current and future research directions.

About the speaker
Dr. Angelos Stavrou is an Associate Professor at George Mason University and the Associate Director Center for Secure Information Systems. Stavrou has served as principal investigator on contracts from NSF, DARPA, IARPA, AFOSR, ARO, ONR, and he is an active member of NIST's Mobile Security team and has written more than 40 peer-reviewed conference and journal articles. Stavrou received his M.Sc. in Electrical Engineering, M.Phil. and  Ph.D. (with distinction) in Computer Science all from Columbia University. He also holds an M.Sc. in theoretical Computer Science from University of Athens, and a B.Sc. in Physics with distinction from University of Patras, Greece. His current research interests include security and reliability for distributed systems, security principles for virtualization, and anonymity with a focus on building and deploying large-scale systems. Stavrou was awarded with the 2012 George Mason Emerging Researcher, Scholar, Creator Award, a university-wide award. He is a member of the ACM, the IEEE, and USENIX.

Over the past few years, Dr. Stavrou's research has focused on two aspects of security: Systems' Security and Reliability. In the context of the first, he is working with NIST as part of the DARPA “Transformative Applications” project that involves securing Android mobile phone devices against kernel-level attacks. Furthermore, Stavrou is the GMU PI participating along with Columbia, Stanford, and Symantec in the IARPA “StoneSoup” effort. In addition, the PI is funded by DARPA under the CyberGenome project to perform analysis on the phylogenetic origins of malware. Dr. Stavrou is currently supported by a NSF Trustworthy Computing (NSF-CNS- 0915291) grant on “Scalable Malware Analysis using Lightweight Virtualization”. This effort seeks efficient methods to collect and analyze the nature of Internet malfeasance.  

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, November 20, 2012 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

October 16, 2012 at 6:30 PM

ISSA National Capital Chapter October meeting topic:

Derek Melber and Paul Andrew
Creating a Secure Desktop

Abstract
This session covers the key aspects of how end-points become attack vectors. We will cover all of the key aspects that we did in the ISSA session, with demos of the PB products. There are some key issues which can be solved with software, but most companies are not aware the software exists. We will start the session describing what an endpoint can do to the environment. We will then discuss the potential issues with solving this, specifically with trying to remove the user from being a local administrator. We will also cover whitelisting, LM authentication, firewalls, and more.
 
In this one hour session, Group Policy MVP Derek Melber will go over some of the most important--yet often forgotten--security settings for Windows desktops. Settings like LanManager, Anonymous, IE, UAC, etc will be covered and you will see why these settings are so important for every corporation. Learn about common mistakes in Windows Security and how to avoid them, as well as how adopting least privilege can help protect you against malware and insider threats.
 
When you leave this session, you will have learned:

- How to secure the use of LAN Manager for your entire enterprise
- How to disable anonymous access to your domain controllers and servers
- What options are available to control and configure IE security
- Why UAC is so important and what it does for security
- Even more security settings inside of Windows Group Policy
 

About the speakers
Derek Melber (MCSE, MVP) is an independent consultant and speaker, as well as author of many IT books. Derek educates and evangelizes Microsoft technology, focusing on Active Directory, Group Policy, Security, and desktop management. Derek is President and CTO of BrainCore.Net. As one of only 8 MVPs in the world on Group Policy, Derek's company is often called upon to develop end-to-end solutions regarding Group Policy and security for companies. Derek is one of only a few in the industry that has a deep knowledge of Group Policy, Group Policy Preferences (AKA PolicyMaker), and Advanced Group Policy Management (AGPM). Derek is the author of the The Group Policy Resource Kit by Microsoft Press. This book covers all aspects of the new features provided for Group Policy in Windows Server 2008 and 7. Derek also wrote a series of books related to Auditing and Security Windows through the IIA. Derek is a contributing editor for WindowSecurity.com, RIAG Journal, IT Audit newsletter, and various other publications. You will most likely see Derek at one of the many conferences that he speaks at including InfoSec World, Windows Connections, MISTI, ISACA, and the IIA. Derek provides Windows security training through MISTI and also delivers custom training and speaking on nearly all Windows topics. Program Chair's Note: I saw Derek in April at ISSA give the first talk, and it was superb. In addition, David Merritt also gives him Derek an enthusiastic thumbs-up.

Paul Andrew is a Senior Sales Manager at BeyondTrust Software. In this role, for over six years, Paul has been a pioneer in the rapidly growing Desktop Security Industry, helping organizations successfully implement a Least Privilege Security Environment. Paul manages all day-to-day customer needs and he is responsible for increasing the already high demand for the BeyondTrust PowerBroker Product Suite. Paul manages all large Commercial Accounts, Government Agencies and Education clients. Paul also brings over 20 years of sales and sales management experience with other fast growing technology companies, including PC/GovConnection, Ecora Software, W.L Gore & Associates (GORE-TEX®) and Groundwater Technology, Inc.
 
Paul holds a B.S in Geology from the University of New Hampshire. In addition, Paul has also held various research positions within the National Marine Fisheries Service (NMFS) and Woods Hole Oceanographic Institution (WHOI). While working at the NMFS and WHOI, Paul was Head of Deck Operations, staging several research cruises, while at Sea. Paul has also authored or co-authored 3 volumes of Marine Sediment Core and Rock Descriptions and one Technical Publication describing Thermistor Probe Construction, which was used in support of WHOI Marine Heat-Flow research programs.
 

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, October 16, 2012 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

September 18, 2012 at 6:30 PM

ISSA National Capital Chapter August meeting topic:

Open Source and Security 
by Phil Odence, Black Duck Software

Abstract
Mr Odence will discuss the security challenges associated with the use of open-source libraries.

About the Speaker
Phil Odence is responsible for expanding Black Duck’s reach, image and product breadth by developing partnerships in the multi-source development ecosystem. He is in charge of building the company’s growing network of international resellers and launched Black Duck’s legal certification program. A frequent speaker at open source industry events, Phil chairs the Linux Foundation’s Software Package Data Exchange (SPDX) working group and is a blogger for NetworkWorld http://www.networkworld.com/community/odence.

He came to Black Duck from Empirix where he served as Vice President of Business Development and in other business management positions. Prior to Empirix, Phil was a partner and ran consulting at High PerformanceSystems, a startup computer simulation modeling firm. He began his career with Teradyne’s electronic design and test automation group in product, sales and marketing management roles. He has an AB in Engineering Science and an MS in System Simulation from Dartmouth College.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, September 18, 2012 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

August 21, 2012 at 6:30 PM

ISSA National Capital Chapter August meeting topic:

Advanced Persistent Threats (APT’s)
A Balanced Approach for Survivability and Sustainability in the Cyber Realm

by Curtis Levinson
United States Cyber Defense Liaison to NATO

Abstract
Advanced Persistent Threat (APT):   APTs are attacks on US information technology and telecommunications infrastructure by known nation-state and other bad actors.  These attacks are currently taking the form of Phishing and Spear Phishing attacks on US assets both government and industry.  Phishing attacks are extremely difficult to detect and it appears from public sources that a portion of the attacks are coming from (spoofed) trusted domains, which makes filtering even more difficult.  The primary remedy to such attacks is a combination of extreme user education/training and comprehensive Business Continuity Planning and Disaster Recovery (BCP/DR/COOP) implementation.  Users need to be educated as to what acceptable practices are for eMail messages with embedded URLs and the urgent need to NOT CLICK on embedded URLs.  Any questions as to the nature of the destination of the embedded URL MUST be directed to the message author, NOT acted upon in the eMail note itself.   Since bad things can, do and will continue to happen, recovery plans, programs and techniques must be up to the task of restoring critical functions as soon as possible.  The quicker we can recover, the more ineffective the attack.

About the Speaker
Curtis Levinson has over 25 years of focused experience in Cyber Security and Information Assurance. He is a highly experienced risk assessor and technology architect specializing in all phases of the security engineering process including regulatory compliance, policy formulation, cyber attribution and forensics, risk analysis, network/system hardening and resilience, implementation, testing, certification and accreditation, operations, training and managing the security of information and telecommunications systems in a wide variety of environments.

Mr. Levinson was selected by NATO (North Atlantic Treaty Organization) to represent the United States as an advisory subject matter expert on Cyber Defense for the IRCSG (Industrial Resources and Communications Services Group). This group falls under NATO’s Civil-Military Planning and Support Section, which is essential to the Alliance’s common defense and security.

Mr. Levinson's professional certifications include: Master Business Continuity Planner, Certified Data Professional, Certified Information Systems Security Professional, Certified Business Continuity Planner and Certified Homeland Security Professional. He is a graduate of the American University in Washington, DC and the London School of Economics in London, England. He has also completed post graduate course-work at the National War College, Columbia University, and the Wharton School of Business.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.

Tuesday, August 21, 2012 6:30 PM

Government Printing Office
Room A138
732 N. Capitol St.
Washington, DC, 20401

Click here for details

July 17, 2012 at 6:30 PM

ISSA National Capital Chapter July meeting topic:

The Easy Stuff

by Marcus Ranum
CSO, Tenable Network Security, Inc.

Abstract
Marcus will discuss why the most important trend-lines in computer security are backward from the direction that's most likely to end in success. This will be a short-term situation but it will be the reality of affairs for most of our careers.

About the Speaker
Marcus J. Ranum, Chief Security Officer of Tenable Security, Inc., is a world-renowned expert on security system design and implementation. Since the late 1980's, he has designed a number of groundbreaking security products including the DEC SEAL, the TIS firewall toolkit, the Gauntlet firewall, and NFR's Network Flight Recorder intrusion detection system. He has been involved in every level of operations of a security product business, from developer, to founder and CEO of NFR. Marcus has served as a consultant to many FORTUNE 500 firms and national governments, as well as serving as a guest lecturer and instructor at numerous high-tech conferences. In 2001, he was awarded the TISC "Clue" award for service to the security community, and also holds the ISSA lifetime achievement award. In 2005 he was awarded Security Professional of the Year by Techno Security Conference.

Please RSVP if you plan to attend.
Non-members are welcome without charge! Light refreshments will be served.