Los Angeles 2020

Prior to defending an organization against a determined attacker, their techniques must be understood. This presentation provides an adversarial viewpoint to inform network defense leaders how the attackers see their organizations and are able to be successful with their objectives, even when well defended. The presenter will draw upon over 17 years of personal experience as a Red Team operator and leader to illustrate how your organizations are viewed, through the eyes of an adversary.

Today, 94% of cyber-threats still originate in the inbox. ‘Impersonation attacks’ are on the rise, as artificial intelligence is increasingly being used to automatically generate spear-phishing emails, or ‘digital fakes’, that expertly mimic the writing style of trusted contacts and colleagues. Humans can no longer distinguish real from fake on their own – businesses are increasingly turning to AI to distinguish friend from foe and fight back with autonomous response. In an era when thousands of documents can be encrypted in minutes, ‘immune system’ technology takes action in seconds – stopping cyber-threats before damage is done. Find out how in this session.

If you’re not regularly referring to the Verizon 2020 Data Breach Investigations Report, Verizon’s 2020 Mobile Security Index or the company’s other recent research reports, you’re missing out. This presentation will highlight key findings from Verizon’s recent research reports – and will explain how security leaders can use these reports to fine-tune their security programs and educate their stakeholders and employees about risks specific to their industry.

The growth of workforce mobility and recent dramatic increase in workplace flexibility is requiring businesses to enable users more fluid, yet secure access from anywhere, at any time, and from any device to distributed applications and resources residing in data center and multi-cloud environments. In our “age of any access,” what should organizations consider to fortify their security posture and what innovations are on the horizon? Pulse Secure CEO, Sudhakar Ramakrishna will discuss how secure access has evolved, where Zero Trust model is being applied, and new technologies being put to task to ensure user productivity, operational visibility and compliance. 

When threat actors exploit weaknesses in an organization’s IT infrastructure, the consequences can be devastating to productivity, reputation, and financially. Without treating cybersecurity as an ongoing process, hackers can find, weaponize, deploy, and attack your infrastructure faster than your team can patch the vulnerability leaving your infrastructure unprotected. Your systems may be secure today, but next week, a cybersecurity criminal may discover and exploit a critical vulnerability in your environment. Join us as we discuss how continuous vulnerability management can be executed effectively.

Security teams today are being overwhelmed by the massive amounts of data collected by their various protection tools and in most cases, these security teams do not have the budget to hire external Security Operations Center (SOC) analysts. As such, companies are looking to implement an automated response system by using SOAR (Security Orchestration, Automation and Response) tools in an effort to relieve some of the burden on their already understaffed security teams and increase efficiency.

In a recent survey of more than 1,400 IT security professionals, 79% reported that their organization has existing automation tools and platforms in place (29%) or are planning to implement them within the next six months to three years (50%). However, this is not a simple solution for many companies as the successful implementation of automation requires a well-trained and educated team. In fact, 56% of organizations from this same survey indicated that they don’t currently have the in-house expertise required to effectively use these tools. This presents a problem as the shortage of gap between workforce demands and skilled cyber security professionals in the field is larger than ever and steadily increasing. According to another report, it is projected that by 2021, 3.5 million cyber security jobs will be unfilled; that’s a 350% increase in open positions from 2013 to 2021.

This panel will provide an understanding on SOAR tools, the importance on training your security team to understand and leverage these tools to more rapidly detect and respond to threats, and ways to attract and retain talent.

With the sudden shift of the global workforce from in-office to remote, IT teams quickly transformed their operations to accommodate the new realities of business — including large-scale adoption of work-from-home technologies, heightened activity on customer-facing networks, and greater use of online services. While these examples of agility allowed business to continue, they also greatly increased the risk of misconfigurations and cyberthreats. Now, it’s looking like they could be here to say for a while. On top of that, bad actors have wasted no time trying to exploit new vulnerabilities. In the past several weeks, we’ve seen ransomware attacks affect several major organizations. These attacks come on the tail of a surge of attacks across the board brought on during the pandemic, as hackers scanned and took advantage of new workloads, and vulnerable VPN connections and misconfigurations left the gates to the network open.
When attacks like these make headlines, panicked board members have one question for CISOs: how can we be sure that won’t happen to us? We will share top strategies for CISOs to lead board-level conversations about risk management amidst the stark new realities

It is important to recognize that, overall, the industry has an effectiveness problem. The escalation in threat activity and the talents shortage in the industry has created a situation where, despite lots of products and cybersecurity spend, we aren’t getting better protection. To put a finer point on it, there are over 3,000 vendors selling products in the industry. The total spend last year was $120B+ and even with all of that there we almost 4,000 breaches — a 96% increase over the previous year.​ The key takeaway from these breaches is that they are NOT product failures.​ They are operational failures. ​To prevent these kinds of breaches from happening again in the future, we believe, the industry needs to adopt a new approach – an operational approach – to cybersecurity. ​

According to a recent survey, last year 69% of organizations suffered a data breach caused by an Insider Threat, even with a data loss prevention (DLP) solution in place. While malicious users are a legitimate threat to an organization’s security, another study found that 64% of incidents were a result of human error made by an employee. In fact, 78% of Chief Security Officers confessed that even they have clicked on suspicious links.

These statistics demonstrate that having a DLP solution in place with a centralized IT Security team is not sufficient in protecting company assets. Organizations must also address the human element and provide effective ongoing training and education to all employees within the organization.

This panel will discuss the importance of understanding and detecting the various types of Insider Threats that put your organization at risk, as well as provide insight on how to prepare a prevention and defense strategy against an insider breach.

With the proliferation of COVID-19 across the globe, the need for a remote working strategy has become paramount to keep businesses running. Technologies such as Chromebooks, Chrome Browser, and SaaS applications have helped make this strategy a reality, providing access to critical data wherever employees may be working from during this challenging time. However, this way of working has created new security challenges for IT departments, who may not be equipped to address these issues. In this session, we’ll walk through many of Google’s solutions, such as Chrome Enterprise Upgrade, BeyondCorp Remote Access, Chrome Browser Cloud Management, and others, to ensure your business can keep secure, even in a remote working environment.

Many businesses are fundamentally changing the way they operate thanks to new, exciting technology that digitizes traditional workloads and processes. While digital transformation strategies focus on business impacts, the implementation of new technology, and organizational change, growing evidence shows that there has been little-to-no evolution in security practices, tooling, or risk management skills. Overlooking security in your transformation is a critical mistake that may be slowing you down, increasing risk, and setting the stage for breaches. In this session, we will look at how to develop new practices, tooling, and risk management skills and the several ways security programs must adapt to successfully support a digital transformation.

Cyberattacks have quadrupled since the beginning of the pandemic. Lots of endpoints are currently on their own when it comes to being managed and protected. What will happen when these machines come back to the office, or are they coming back at all? This presentation will address the different scenarios that companies may encounter and how to resolve them by automating their endpoint management.

As we enter the passwordless decade, more and more organizations are asking the question: How quickly can I move beyond passwords?
George Avetisov, CEO of HYPR, will discuss the rise of organizations moving to the cloud, how the perimeter fades and the attack surface gets larger.

Modern tools such as SNIPR and Modlishka make it easier for hackers to launch large-scale automated attacks, bringing credential re-use and two-factor-authentication attacks to record highs. How did we get here, and will mainstream adoption of passwordless security have an impact?
We will explore how the rise of virtual desktop infrastructure has affected workstation login and review how the evolution of authentication has impacted organizations’ identity and access management systems.
In this session, you’ll learn:
• Why is Credential Reuse at All-time Highs?
• How has Authentication Evolved?
• Why this is the Passwordless Decade