Central Maryland Chapter of ISSA

Membership Meeting 3/25/2020
2020-03-25 17:00 - 19:30 (America/New_York) | HubSpot—The Gathering Place on the Gateway, 6724 Alexander Bell Drive Hub Spot, Suite 105, Columbia, MD, 21046
Cancelled: Membership Meeting: March 25, 2020
Notice: The March membership meeting has been cancelled. Due to the COVID-19 Coronavirus, the Board of Directors of the Central MD Chapter of the Informatin System Security Association, and in followig the guidelines of the local government and medical experts, have decided that it is in the best interest of our members to cancel the March membership meeting. We apologize for any inconvenience.
Stay tuned for news of future metings. We are researching opportunities to virtually conduct the April meeting.

Membership Meeting 2/26/2020
2020-02-26 17:00 - 19:30 | HubSpot—The Gathering Place on the Gateway, 6724 Alexander Bell Drive Hub Spot, Suite 105, Columbia, MD, 21046
Chapter Business Meeting Slides: 2020-02-26 Meeting Slides
Speaker Slides: Business Email Compromise (BEC)
Topic: Business Email Compromise: More Sophistication, More Problems
Business Email Compromise (BEC) is a major threat vector for the private sector. These attacks usually begin with a spear-phishing attempt, with the intent to conduct fraudulent wire transfers or take other data from an organization. This is a very sophisticated social engineering attack, so it’s important to understand the way this attack is conducted, as well as how to protect oneself and an organization. This presentation will give a deep-dive into email headers, technical issues and solutions around business email compromise attacks. While this is a technical brief, the idea is to give attendees actionable items to take back to their organization to provide awareness and relevant security configurations.
Speaker: Dr. Nikki Robinson, XLA
Nikki holds a Doctorate of Science in Cybersecurity from Capitol Technology University. Her specialization is in vulnerability management and the challenges around it. She has over 12 years in both the IT and Security fields. Nikki is a Cybersecurity Engineer with an IT background – so she brings technical descriptions to each presentation. She holds certifications in both IT and Security, including CISSP, CEH, CNDA, MCITP, and CCAA. Nikki is excited about helping people to solve issues around vulnerability management and lower their risk profile.

Membership Meeting 1/22/2020
2020-01-22 17:00 - 19:30 | HubSpot—The Gathering Place on the Gateway, 6724 Alexander Bell Drive Hub Spot, Suite 105, Columbia, MD, 21046
Chapter Business Meeting Slides: 2020-01-22-Meeting-Presentation.pdf
Speaker Slides: The Next Gen of Vulnerability Management
Topic: The Next Gen of Vulnerability Management
Traditionally, Vulnerability Management has become entrenched in the CVSS scoring system which itself, has undergone some revision to more appropriately address things like exploitability, degree of sophistication and human intervention. While CVSS allows centralization of data and a consistent scoring system, it falls short of adequately addressing risk from a dynamic perspective. We’ve seen the industry shift in the last few years to a realization that every vulnerability cannot be addressed, inclusion of individual threat feeds and a more specific approach to dealing with risk. As a result, the landscape has shifted to a pro-active approach to identify where the best value can be aimed on the vulnerabilities that are most important.
Speaker: Michael Morgan, Chris Edson: Tenable Network Security
Mike Morgan & Chris Edson have been helping customers understand the need for protecting their network, both on-prem and in the cloud for over 10 years. They have been instrumental in advocating and supporting clients to introduce, implement, and build out vulnerability management programs leading to a greater understanding of risk.
Please Note:

Deadline to register is December 16th at 5 PM.
Chapter & ISSA member’s ticket: FREE
Guest tickets: $15 if registered by 5 PM on December 16th. Otherwise, $20 at the door (cash or credit card). Refunds available until December 16th at 5pm.

Agenda:
5:15 – 5:45 Chapter Business Meeting
6:00 – 7:30 Speaker and Q&A

Membership Meeting 12/18/2019
2019-12-18 17:00 - 19:30 | HubSpot—The Gathering Place on the Gateway, 6724 Alexander Bell Drive Hub Spot, Suite 105, Columbia, MD, 21046
Sponsored by:
Chapter Business Meeting Slides: 2019-12-18-Meeting-Presentation.pdf
Speaker Presentation: Risk Mitigation for Cybersecurity Service Providers
Topic: Risk Mitigation Strategies for Cybersecurity Service Providers
Everyone is talking about “vendor risk” and “vendor management” on the client side, but who’s looking out for the risks that your cybersecurity product or service company faces when helping those same clients by licensing a cutting-edge cyber tool, conducting a penetration test or risk assessment, providing post-breach forensic services, or otherwise helping a customer deal with its privacy and data security risks? This session will focus on a few key areas of concern when negotiating customer contracts.
Speaker: Razvan E. Miutescu: Business, Technology, and Information Governance Attorney, Whiteford Taylor & Preston LLP
Razvan Miutescu is a technology and information governance attorney with Whiteford, Taylor & Preston. His practice focuses on privacy; data security; information technology transactions; licensing; and data management, including data broker transactions, cloud services, and distributed ledgers/blockchain technology matters. He has been a co-chair of the Data Privacy, Cyber Security & Technology committee of the Maryland State Bar Association since 2015 and is an active member of the tech community in the Baltimore-DC area.
Please Note:

Deadline to register is December 16th at 5 PM.
Chapter & ISSA member’s ticket: FREE
Guest tickets: $15 if registered by 5 PM on December 16th. Otherwise, $20 at the door (cash or credit card). Refunds available until December 16th at 5pm.

Agenda:
5:15 – 5:45 Chapter Business Meeting
6:00 – 7:30 Speaker and Q&A

Membership Meeting 11/20/2019
2019-11-20 17:00 - 19:30 | HubSpot—The Gathering Place on the Gateway, 6724 Alexander Bell Drive Hub Spot, Suite 105, Columbia, MD, 21046
Topic: Threat Informed Defense with MITRE ATT&CK™
Chapter Business Meeting Slides: 2019-11-20-Meeting-Presentation.pdf
Speaker Presentation: Threat Informed Defense with MITRE ATT&CK
The MITRE ATT&CK framework has become a widely used knowledge base and model for real cyber adversary behavior. In use across governments, private sector, and security solutions providers, ATT&CK helps to focus defenses against known threats, provides an effective tool for measuring security improvements, and drives innovation.
The session will cover the history of ATT&CK and what drove its creation at MITRE, the philosophy behind how ATT&CK is maintained, and several use cases for how it can be applied including behavioral analytic development, defensive gap analysis, and adversary emulation.
Speaker: Michael C. Long II, Senior Cyber Adversarial Engineer, The MITRE Corporation
Michael Long is a Senior Cyber Adversarial Engineer with the MITRE Corporation and a former U.S. Army Cyber Operations Specialist. Michael has over 10 years of experience in information security disciplines including adversary threat emulation, red teaming, threat hunting, and digital forensics and incident response. Michael Long has a proven track record of service in the public interest. Michael served on countless cyber operations for organizations including the Army Cyber Protection Brigade and Army Cyber Command, the results of which he regularly briefed to commanding generals, strategic executives, and congressional staffers. With MITRE, Michael continues to apply his technical expertise to improve the cybersecurity of our nations most sensitive and critical networks. Michael has a Masters Degree in Information Security Engineering from SANS Technology Institute, and holds many information security certifications including the prestigious GIAC Security Expert certification (GSE).
Please Note:

Deadline to register is November 18th at 5 PM.
Chapter & ISSA member’s ticket: FREE
Guest tickets: $15 if registered by 5 PM on November 18th. Otherwise, $20 at the door (cash or credit card). Refunds available until November 18th at 5pm.

Agenda:
5:15 – 5:45 Chapter Business Meeting
6:00 – 7:30 Speaker and Q&A

Membership Meeting 10/16/2019
2019-10-16 17:00 - 19:30 | National Electronics Museum, 1745 West Nursery Road, Linthicum, MD, United States
Chapter Business Meeting Slides: 2019-10-16-Meeting-Presentation.pdf
Speaker Presentation: Taking a holistic approach to an insider threat program
Speaker Presentation: Security Operations Maturity Model (SOMM)
ISSA Central MD is hosting an event at the National Electronic Museum to celebrate National Cybersecurity Month.
Topic: Taking a holistic approach to an insider threat program
This presentation will provide insider threat mitigation strategies for every phase of the employment life cycle, including pre-employment screening; ongoing insider threat and security training; leveraging tools like Jazz Networks for user activity monitoring, and finally what to watch out for when an employee is leaving the organization. We will share anecdotes from public and private sector service experience, highlighting vulnerable areas of the employee life cycle where an insider can become an active threat. We will also provide a brief demonstration of the Jazz Networks insider threat and detection platform.

Speaker: Charles Finfrock, Senior Threat Investigator, Tesla
Charles Finfrock is a Senior Threat Investigator in Tesla’s Security Intelligence Department, the team responsible for protecting Tesla’s Intellectual Property and confidential business information from internal and external threats. Prior to joining Tesla, Charles spent 18 years as an operations officer in the Central Intelligence Agency. Charles is also the head of Insider Threat at the Washington DC based, Cyber Intelligent Partners, a training and education company focused on helping companies develop programs to counter cyber threats, regional threats, and insider threats.
Topic: Security Operations Maturity Model (SOMM)
SOMM explores how to assess and evolve the principle programs of the security operations center (SOC): threat monitoring, threat hunting, threat investigation, and incident response. LogRhythm developed the Threat Lifecycle Management (TLM) framework to help organizations ideally align technology, people, and process in support of these programs. The TLM framework defines the critical security operations technological capabilities and workflow processes that are vital to realize an efficient and effective SOC. LogRhythm’s SOMM helps organizations measure the effectiveness of their security operations, and to mature their security operations capabilities. Using our TLM framework, the SOMM provides a practical guide for organizations that wish to optimally reduce their mean time to detect (MTTD) and mean time to respond (MTTR) — thereby dramatically improving their resilience to cyberthreats.
Speaker: Darren Cathey, Sr. Systems Engineer, LogRhythm
Darren Cathey has several decades of experience in programming, operating systems, and applications security. His multi-functional experience in engineering, marketing and sales lends itself well to supporting both SMB and Enterprise customers in the Mid-Atlantic territory as a Sr. Systems Engineer. Past experience includes positions with HP, Wind River Systems, Arxan, Vormetric and Varonis.
5:15 – 5:45 (Chapter Business / Food / Networking)
6:00 – 7:30 (Presentation / Q&A)
7:30 – 9:00 (Exploring the museum on your own or with a guide)
Note: The October Meeting will be at the National Electronic Museum to celebrate National Cybersecurity Month.

ISSA Central MD Breakfast Meeting 10/8/2019
2019-10-08 08:00 - 10:00 | HubSpot—The Gathering Place on the Gateway, 6724 Alexander Bell Drive Hub Spot, Suite 105, Columbia, MD, 21046
Chapter Business Meeting Slides: 2019-10-08-Meeting-Presentation.pdf
Topic: A Security Walkthrough of IAM in Light of Data Breaches in the Cloud
Identity has become the new perimeter in the world of api-driven infrastructures (cloud computing). Understanding the challenges and complexity of least privilege is critical to securing your organization against data breaches in the cloud.
Speaker: Jonathan Villa, Practice Director, Cloud Security at GuidePoint Security
Jonathan Villa has over 19 years of experience as a technology consultant including 17 years of working experience in the information security field. For over 10 years Jonathan consulted to a large municipality as a senior consultant in several competencies including PCI compliance and training, web application architecture and security, vulnerability assessments, trained developers in secure coding, web application firewall administration, and co-architected and managed an automated continuous integration environment that included static and dynamic code analysis for over 150 applications deployed to several distinct environments and platforms. Jonathan has worked with virtualization and cloud technologies since 2005 and his main focus has been on cloud security since 2010. Jonathan has worked with clients across the USA, in South America, and Asia to design and implement secured public and hybrid cloud environments, integrate security into continuous integration and continuous delivery methodologies, develop custom security solutions using the AWS SDK, and provide guidance to customers in understanding how to manage their environments under the Shared Responsibility Model.

Membership Meeting 9/25/2019
2019-09-25 17:00 - 19:30
Chapter Business Meeting Slides: 2019-09-25-Meeting-Presentation.pdf
Speaker Presentation: .govCAR: Threat Based Cyber Capability Review
Topic: .govCAR: Threat Based Cyber Capability Review
The Cybersecurity and Infrastructure Security Agency (CISA) developed the .govCAR methodology to take a threat-based approach to cybersecurity risk management. .govCAR represents an evolution in managing cybersecurity —an advancement from the traditional consequence (compliance) and vulnerability (cyber hygiene) based approaches. This next-generation approach looks at cybersecurity capabilities the same way an adversary does to directly identify areas where mitigations should be applied for best defense. .govCAR creates opportunities for organizations to make their own threat-informed risk decisions and develop a prioritized approach to reducing risk to known threats. .govCAR is vendor agnostic and does not evaluate specific vendors or products.
The speaker will walk the audience through the concept of threat based architecture reviews and will discuss how cybersecurity threat framework and architectural cybersecurity capabilities come together to allow organizations to improve their cybersecurity posture.
Speaker: Branko S. Bokan, Department of Homeland Security
Branko Bokan is a Cybersecurity specialist with the Cybersecurity and Infrastructure Security Agency (CISA) at the Department of Homeland Security (DHS). In his role, Branko assists federal agencies to adopt the .govCAR methodology. A proud holder of all three ISC2 CISSP concentrations (ISSAP, ISSEP, ISSMP), Branko also teaches cybersecurity as an adjunct professor at a local university.

Membership Meeting 8/28/2019
2019-08-28 17:00 - 19:30
Chapter Business Meeting Slides: 2019-08-28-Meeting-Presentation.pdf
Speaker Presentation: Failing-at-Cybersecurity.pdf
Topic: Fail Secure: 20 Ways to Undermine Your Security Program
There’s policy, and then there’s reality. All too often, security teams find their efforts overridden or bypassed. Here’s some unconventional wisdom and tips on how to engage your stakeholders and keep your program moving forward.
Speaker: Tom Hallewell, VP of Programs and Event for the ISSA DC Chapter
Tom Hallewell works for the Government. He’s also VP of Programs for ISSA-DC. He’s worked in just about every area of cybersecurity, and has the scars to prove it. Hopefully this talk will help you avoid getting them yourself. Tom Hallewell is the VP of Programs and Event for the ISSA DC Chapter
Please Note:

Deadline to register is August 26th at 5 PM.
Chapter & ISSA member’s ticket: FREE
Guest tickets: $15 if registered by 5 PM on August 26th. Otherwise, $20 at the door (cash or credit card). Refunds available until August 26th at 5pm.

Agenda:
5:15 – 5:45 Chapter Business Meeting
6:00 – 7:30 Speaker and Q&A

Membership Meeting 7/24/2019
2019-07-24 17:00 - 19:30
Chapter Business Meeting Slides: 2019-07-24-Meeting-Presentation.pdf
Speaker Presentation: Attackers-Prey-on-Uncertainty_ISSA-Central-MD.pdf
Topic: Attackers Prey on Uncertainty: How to Fail at Threat Detection

It takes a lot of visibility and context to detect and respond to sophisticated threats. Attackers usually target data, where enterprises have the least visibility and most uncertainty. In this session, we’ll explore new, sophisticated threats from inside and out, demonstrate how easy it is for adversaries to bypass traditional controls, and present a methodology to better protect data at scale, improve threat detection, and reduce uncertainty.
Speaker: Courtney Chau, System Engineer at Varonis
Bringing a diverse business and technical skill set, Courtney Chau has had the privilege of working with an elite list of clientele in the Cyber Security & Information Technology sector. Courtney’s commitment to continued learning and academic excellence provided the opportunity for a year of early completion at Virginia Tech with a B.S. in Business Information Technology, summa cum laude, and minor in Applied Business Computing. Courtney embarked on her professional journey in IT Risk Assurance at the multinational professional services network firm PricewaterhouseCoopers (PwC), providing superior client relationship management to cultivate efficient and innovative business solutions. She collaborated with multiple teams, inter-company lines of service, clients, and client third-party service organizations for multiple projects regarding interfaces/configurations, key reports, SDLC, and other IT general controls. Following this, Courtney served Darktrace as a Cyber Defense Technology Specialist to manage deployments and incident responses, ranging from small business to global firms across a variety of industries. She mentored a team of engineers and holds substantial experience covering a global territory. Presently, she works with Varonis to serve the data security needs of large enterprise customers.
Please Note:

Deadline to register is July 22nd at 5 PM.
Chapter & ISSA member’s ticket: FREE
Guest tickets: $15 if registered by 5 PM on July 22nd. Otherwise, $20 at the door (cash or credit card). Refunds available until July 22nd at 5pm.

Agenda:
5:15 – 5:45 Chapter Business Meeting
6:00 – 7:30 Speaker and Q&A

Membership Meeting 6/26/2019
2019-06-26 17:00 - 19:30 | HubSpot—The Gathering Place on the Gateway, 6724 Alexander Bell Drive Hub Spot, Suite 105, Columbia, MD, 21046
Chapter Meeting Registration
Please note the new meeting Location: Hub Spot, 6724 Alexander Bell Drive, Suite 105, Columbia, MD 21046,
Chapter Business Meeting Slides: 2019-06-26-Meeting-Presentation
Speaker Presentation: Crafting a DLP Program
Topic: Data Loss Prevention Essentials
A how-to primer on overcoming organizational challenges to implement a successful Data Loss Prevention program.
Advances in technology have prompted a rapid evolution of business processes over the last two decades. Along with the benefits provided to organizations, these advances have brought about new types of risks. Data has become the lifeblood of organizations, yet many do not know what data they have, what is important, or how it is being used.
A Data Loss Prevention program provides insight into these new risks, but organizations are often ill-equipped to respond to this new information or manage the associated risks.
Infolock’s Director of Advisory Services, Ryan Dobbins, will discuss the three main areas required for a successful implantation:

Governance: The organizational articulation of what data is important and how it is measured
Visibility: The technical ability to make informed decisions
Protection: The enforcement of organization risk tolerance

A successful DLP program supports and informs organizational leadership as they manage data risk and minimize the occurrence and impact of data incidents. Attendees will leave this presentation with an understanding of how to turn DLP technology into a holistic program to reduce organizational risks.
Speaker: Ryan Dobbins, Director of Advisory Services, Infolock
Ryan Dobbins is Infolock’s Director of Advisory Services and helped develop the Data Risk Management Framework (DRMF). A graduate of James Madison University, Mr. Dobbins holds the SANS GSLC certification and is active in the Governance, Risk, and Compliance (GRC) community where he offers his expertise on topics such as:

Strategic Data Governance
Aligning Compliance Goals with Real Security
Reducing Enterprise Risk with Data Loss Prevention
How to Use a Control Framework to Build a Security Program

In addition to his work at Infolock, Mr. Dobbins was a featured speaker at VA HIMSS (2017), the AMC Security Conference (2017), the NCHICA Conference (2016), and the AMC Conference (2016). Prior to Infolock, Mr. Dobbins developed and managed the information security program at a multi-billion-dollar healthcare enterprise, including its GRC system and Security Operations Center. In this role, Mr. Dobbins and his team worked to detect, respond to, and report on technical security issues. During this time, they responded to internal and external security audits, formed business relationships with various organizational units and provided corporate
guidance on security related issues. The results of their findings were scored against HITRUST and internal policies and added to the GRC system for risk-tracking and remediation. Later, these results were published to a wide audience across a number of formats, including
executive dashboards and technician remediation paths.
Please note new meeting schedule – June 2019
5:15 – 5:45 Chapter Business Meeting
6:00 – 7:30 Speaker and Q&A
Chapter Meeting Registration

Membership Meeting 5/22/2019
2019-05-22 17:00 - 19:30 | HubSpot—The Gathering Place on the Gateway, 6724 Alexander Bell Drive Hub Spot, Suite 105, Columbia, MD, 21046
Please note the new meeting Location: Hub Spot, 6724 Alexander Bell Drive, Suite 105, Columbia, MD 21046,
Topic: RMF 2.0 for non-Federal Users
Membership Meeting Slides: 2019-05-22 Meeting Presentation
Speaker Presentation: Risk Management for non-Federal Users
Learning objectives
1) Understanding of the NIST Risk Management Framework
2) Briefing on the updates to Revision 2.0 of NIST 800-37
3) Walk through of a fictitious Federal Agency system undergoing the RMF process
The target audience are those who have not yet dealt with the NIST RMF and would like to understand the various components and how it would apply to a specific computer system. The talk will start with the steps included in the RMF process and will end with the review of the controls within one or two control families.
Speaker: Joe Klein, Mitre
Joe Klein is a +30-year veteran of the IT, IA, IoT and IO domains, with extensive experience in DoD, US Government, and commercial sectors. He has a long history of speaking at Computer Science, Technology, Security and Hacker conferences on topics such as IPv6, Time Hacking, Auto Hacking, Physical Security, Risk Management, IoT Security, Cybersecurity as a Business advantage, and success in your security career. National and international speaking venues include Defcon, BlackHat, BSidesDC, ISSA events, ITU, InfraGard, TorCon, SecTor, and Security Days.
He also contributes his talent to standards and practices at NIST, DoD, SPAWAR, IEEE, and IETF.
Please note new meeting schedule – May 2019
5:15 to 5:45 Business Meeting
5:45 to 6:15 Networking and Dinner
6:15 to 7:45 Speaker and Q&A

Membership Meeting 4/24/2019
2019-04-24 17:00 - 19:30
Membership Meeting Slides: 2019-04027 Meeting Presentation
Speaker Presentation: Intro to Cyber Insurance
Topic: Intro to Cyber Insurance
Cyber risk management is something that continues to evolve with the threat landscape as well as innovations in processes and technology. One of these new innovations is the emergence of cyber insurance. While it is new in terms of insurance products it has been around for several years and is quickly developing into something that many commercial organizations are starting to consider. The purpose of this presentation is to provide an overview of the cyber insurance marketplace, the underwriting process and a shallow dive into the coverage provided by a typical policy.
Speaker: MICHAEL VOLK, VP, CYBER RISK SOLUTIONS, PSA INSURANCE
As the lead for PSA’s Cyber Risk Solutions Practice, Mike Volk is responsible for helping clients make informed decisions about cyber insurance and develop strategies to reduce cyber risk. For the past eight years he has worked in several roles where he helped individuals and organizations navigate the complex cybersecurity landscape. Mike is engaged in the cybersecurity community and currently serves on the Board of Directors for the Cybersecurity Association of Maryland, Inc. (CAMI). Prior to joining PSA, Mike worked with individual job-seekers, industry experts, as well as government organizations and contractors in areas related to cybersecurity training and workforce development. He has authored several articles on topics related to cyber risk, cybersecurity education/training and cybersecurity workforce development. Mike contributed to Anne Arundel Community College as the Business Development Coordinator for the CyberCenter and Instructional Specialist for the Cyber and Technology Training area. He also served as the Cybersecurity Navigator and Project Coordinator for the Mayor’s Office of Employment Development in Baltimore City.
Please note new meeting schedule – February 2019
5:15 to 5:45 Business Meeting
5:45 to 6:15 Networking and Dinner
6:15 to 7:45 Speaker and

Membership Meeting 3/27/2019
2019-03-27 17:00 - 19:30 | UMBC Training Centers, 6996 Columbia Gateway Dr., Suite 100, Columbia, MD, 21046, United States
Chapter Business Meeting Slides: 2019-03-27-Meeting-Presentation
Topic: An Update on Deep Content Inspection and DLP for Government
Deep Content Inspection! OK right, but what is Deep Content Inspection? Is it the ability to work in highly regulated federal agencies? Is it working with other vendors to ensure that file transfers are reviewed prior to allowing? Or ensuring that data transfers to removable media drives do not contain sensitive information? Is it automatically encrypting email messages that contain sensitive information in them? How about all of the above? Today, advanced security and data loss prevention features are needed to combat information borne threats across a wide range of technologies.
Speaker: Scott Messick, Senior Sales Engineer with Clearswift
Scott Messick is a Senior Sales Engineer with Clearswift based in New Jersey. In this role he works with the largest Clearswift customers and prospects across North and South America. Scott joined Clearswift about two years ago, after 12 years with Credit Agricole Corporate Investment Bank (CA-CIB). While with Credit Agricole, Scott was a Windows Technical Lead, a Windows Platform Engineer, a Windows Platform Group Manager and was promoted to Vice President. Scott also served on the IT and IT Security Management Committees that oversaw all North and South America IT and IT Security infrastructure operations for the Bank.
Please note new meeting schedule – February 2019
5:15 to 5:45 Business Meeting
5:45 to 6:15 Networking and Dinner
6:15 to 7:45 Speaker and Questions

Membership Meeting 2/27/2019
2019-02-27 17:00 - 19:30
Meeting Presentation: 2019-02-27 Meeting Presentation
Speaker Presentation: Hacking Social Media – ZeroFOX

Social Media Protection For Dummies: Download free book, click HERE.
Topic: What is Social Media Security?
Social media security is the process of analyzing dynamic social media data in order to protect against security and business threats.. Every industry faces a unique set of risks on social, many of which have put organizations in the press or at the center of controversy.
Speaker: Christopher Cullison, VP Emerging Technologies @ ZeroFOX
Co-founder of ZeroFOX and Vice President of Emerging Technologies, has over 16 years of experience in the software industry. Christopher has worked with and managed large scale applications for Fortune 50 corporations, specializing in advanced enterprise architecture solutions. His expertise includes reverse engineering, code inspection, dynamic integrations, and cyber-security. Chris has worked as a consulting expert in patent litigation, specializing in patent and prior art analysis. Besides holding multiple coding and security certifications, he speaks regularly about innovative coding at security conferences. Chris has a Bachelors in Business Information Systems from Stevenson University.
Please note new meeting schedule – February 2019
5:15 to 5:45 Business Meeting
5:45 to 6:15 Networking and Dinner
6:15 to 7:45 Speaker and Q&A

Membership Meeting 1/23/2019
2019-01-23 17:00 - 19:30 | UMBC Training Centers, 6996 Columbia Gateway Dr., Suite 100, Columbia, MD, 21046, United States
Meeting Presentation: 2019-01-23 Meeting Presentation
Speaker Presentation: What is Cyber Threat Intelligence?
John Stoner and Ronnie Obenhaus will present on how gathering threat intelligence data is necessary to combat various threat actors from nation states. Threat intelligence solutions gather raw data about emerging or existing threat actors and threats from a number of sources. CTI data is analyzed and filtered to produce threat intelligence feeds and management reports that contain information that can be used by automated security control solutions. The primary purpose of this type of security is to keep organizations informed of the risks of advanced persistent threats, zero-day threats and exploits, and how to protect against them.
Speaker: John Stoner & Ronnie Obenhaus
Cyber Threat Intelligence Analyst John Stoner has over 18 years of experience in the national security and defense sector working a variety of roles, including most recently as a Cyber Threat Intelligence Analyst, Cyber Counterintelligence Analyst and Cyber Instructor. His work experience includes IT, instruction and course design, cyber exercise and testing, penetration testing, intelligence collection, threat support, SIGINT (Signals Intelligence), and Cyber Operations. He holds A+, Net+, CEH, CHFI, CEI, CISD, CASP and CISSP and a Computer Studies degree from UMUC. He is a huge soccer fan and coaches youth soccer. You may see his Zombie response car at unnamed government facilities. By secretly joining the Army at 19 years old, he got started in military intelligence and then eventually government cybersecurity.
Cyber Threat Intelligence Analyst Ronnie Obenhaus is a US Army Veteran and is not good at providing additional facts for his bio. He is married and has several children (amount variable). He may or may not have pets, but seems to like dogs. He currently is a DOD civilian at a federal cyber agency.
Agenda:

5:15 – 5:45 (Chapter Business)
5:45 – 6:15 (Food / Networking)
6:15 – 7:15 (Presentation / Q&A)

Membership Meeting 11/28/2018
2018-11-28 17:00 - 19:30
Business Meeting Slides: 2018-10-24-Meeting-Presentation.pdf
Speaker: Colton McQue, Zscaler
Topic: No Network Needed?!?!
It seems every day, we are bombarded with news of yet another breach and our personal information being traded and sold on the dark web/Internet. We lose sleep wondering if we have the right controls and policies in place to prevent our companies and our names from appearing in the next morning’s headlines. Is it time for a different approach? What if we could get rid of our network so we no longer had to define complex boundaries and policies? Is it really possible to architect a system that removes all the traditional ingress and egress points? If we resign ourselves to the fact that it’s not IF but WHEN our network gets breached….then why do we still have a network?

Membership Meeting 06/27/2018
2018-06-27 17:00 - 19:30 | Parsons, 110 Samuel Morse Drive, Suite 200, Columbia, MD, 21046, United States
Monthly ISSA Meeting Slides: Click Here
Speaker Slides: REnigma: A Tool to Analyze Malware
Title: REnigma: A Tool to Analyze Malware

REnigma is an advanced semi-automated malware analysis tool designed to give enterprise network defenders a safe, effective, and efficient environment to manually execute and inspect malware behavior. Originally developed at the Johns Hopkins University Applied Physics Laboratory (JHU/APL) with funding from the United States Government, REnigma uses advanced Virtual Machine Record and Replay technology to capture everything that happens inside of a virtual machine at nearly full speed and perfectly replay execution down to the instruction level. With this capability, analysts can easily capture second stages, defeat advanced packers, extract IOCs from memory, and much more. This talk will cover how REnigma works, how REnigma is deployed within an enterprise environment, and give a demonstration of REnigma analyzing malware.

Speaker: Jim Stevens, Co-Founder Deterministic Security, LLC
Jim Stevens is a co-founder of Deterministic Security, LLC. He was previously employed at the Johns Hopkins University Applied Physics Laboratory (JHU/APL). At JHU/APL, Jim co-lead the Malware Laboratory, co-lead the REnigma project, and invented Guard Lines, a patented CPU-based technology designed to prevent memory corruption exploits in real time. He holds a B.S. in Computer Engineering from the University of Kansas, an M.S. in Computer Science from the University of Arkansas-Fayetteville, and is a Ph.D. candidate in Computer Science at the University of Maryland-College Park.

Membership Meeting 12/13/17
2017-12-13 17:00 - 21:00 | National Electronics Museum, 1745 West Nursery Road, Linthicum, MD, United States
ISSA Business Meeting Presentation slides: 2017-12-13 Meeting Presentation

Speaker slides: Enhancing Information Security in Microsoft Office 365 12-13-2017
Clear Swift Case Study: Clearswift_Volusia_Schools_Case_Office365_Study
Topic: Enhancing Information Security in Microsoft Office 365
Many organizations across various verticals have either moved or are strongly considering a move to Office 365. Yet, these systems represent a substantial threat of data loss due to hackers, phishing and insider threats – and the threat landscape is continually evolving. Today, advanced security and data loss prevention features are needed to combat information borne threats across email – from within and outside the organization. However, Microsoft Office 365 only has basic security features. This presentation will examine that threat landscape and Clearswift’s or other Secure Email Gateway’s ability to substantially enhance Office 365 security via an integrated approach

Speaker: Scott Messick, Senior Sales Engineer, ClearSwift
Scott Messick is a Senior Sales Engineer with Clearswift based in New Jersey. In this role he works with the largest Clearswift customers and prospects across North and South America. Scott joined Clearswift about one year ago, after 12 years with Credit Agricole Corporate Investment Bank (CA-CIB). While with Credit Agricole, Scott was a Windows Technical Lead, a Windows Platform Engineer, a Windows Platform Group Manager and was promoted to Vice President. Scott also served on the IT and IT Security Management Committees that oversaw all North and South America IT and IT Security infrastructure operations for the Bank.

Membership Meeting 11/15/2017
2017-11-15 17:00 - 19:00
ISSA Business Meeting Presentation slides: 2017-11-15-Meeting-Presentation
ISSA Chapter Outreach: ISSA Chapter Outreach 11_2017
Speaker slides: Lessons Learned from the Life of a Security Consultant
Topic:Secure InfoSec Observations from the Life of a Security Consultant
What’s the difference between companies that have solid, mature information security programs and ones that seem to be constantly struggling to keep up? After working with many companies across multiple verticals and varied sizes, there are plenty of lessons to be learned from observations made across the industry. We will be taking a closer look at a few key information security trends and how you and your organization can improve your information security posture.

Speaker: Seth Lucci, GuidePoint Security, LLC
Seth Lucci is a Senior Security Consultant at GuidePoint Security. Since 2001, his career has included experience in multiple disciplines and includes over 10 years as a Federal contractor supporting Information Technology (IT) security, information assurance, configuration, program and project management, systems engineering, quality assurance, finance, and business development. He is a subject matter expert (SME) in implementing NIST-based risk management frameworks in the commercial and federal workspace. Seth has been a trusted advisor to C-suite executives in addressing their needs for IT strategic plans, IT transformations, IT risk management, governance, frameworks, and business process improvements.
More recently, Seth has been consulting clients on Payment Card Industry Data Security Standard (PCI DSS) reviews and compliance. Some of his clients include: NGA, DIA, NATO, and Freddie Mac. Seth’s compliance-related initiatives focus on a myriad of associated federal (DOD and IC), as well as commercial standards such as: FISMA, STIGs, NIST 800 Series, DCID 6/3, ICD 503, PCI DSS and ISO.
Seth earned a Bachelor of Business Administration degree in Marketing from Radford University and a Master of Business Administration degree from Marymount University.

Membership Meeting 10/25/2017
2017-10-25 17:00 - 19:00 | Parsons, 110 Samuel Morse Drive, Suite 200, Columbia, MD, 21046, United States
Business Meeting Slide Presentation: 2017-10-25-Meeting-Presentation.pdf
ISSA Chapter Outreach: SIG-LIaisons-Decks-4Q_2017.pdf
Speaker slides: TBD
Topic:Secure SDLC: The Missing Link in the Supply Chain
In recent years, the global supply chain has become the new “playground for hackers”. With supply chain inherently having numerous links (from suppliers to manufacturers to distributors), the number of potentially exploitable relationships makes it an attractive target. This presentation includes the ‘how’ and the ‘why’ of supply chain attacks and describes several notable malware campaigns affecting supply chain in multiple industries

Speaker: Chris Hall, Wapack Labs
Chris has been in the intelligence community for over 16 years in various capacities including SIGINT, network defense, reverse-engineering, and fusion. In 2012, Chris moved from the government to the private sector to help form the Red Sky alliance and then co-found Wapack Labs in 2013. As a partner at Wapack Labs, Chris’s main responsibility is to oversee the production, sourcing, and collection of intelligence.

Membership Meeting 9/27/17
2017-09-27 17:00 - 19:00
ISSA Business Meeting Slide Presentation: 2017-09-27-Meeting-Presentation.pdf
Speaker slides: SDLC: How to Get Adoption
Topic:Secure SDLC: How to Get Adoption

Most companies have some form of a security initiative for custom applications. Whether this is driven by regulations, a past incident, executive awareness or other factors, development managers understand the need to promote and/or enforce secure development practices. While striving for consistently secure code and continually improving code security is a goal development teams share, actually achieving that relies on the enthusiasm of individual developers. Based on hundreds of customers across many industries over the course of 10 years, we will discuss common practices for building application security into the SDLC, and note which ones have been the most successful. We will also offer ideas on emerging practices that may further promote application security in process.
Speaker: Curtis Bragdon, Director of Sales, Code Dx
Curtis Bragdon has over 20 years’ experience designing and deploying software systems, helping teams design more secure software, and selling technical tools throughout the enterprise. Over the past 10 years, he has focused on cybersecurity at the network and application level, helping hundreds of companies secure their systems. At Code Dx, he helps companies build security into the Software Development Lifecycle

Membership Meeting 8/23/2017
2017-08-23 17:00 - 19:00
ISSA Business Meeting Presentation slides: 2017-08-23-Meeting-Presentation.pdf
ISSA Chapter Outreach: ISSA Chapter Outreach 08_2017.pdf
Speaker slides: Threat Lifecycle Management

Topic:Threat Lifecycle Management

Why having a response strategy to cyber incidents is just as important as a prevention strategy and leveraging co-managed services as a force-multiplier to make the most of your security program.
Speaker: Michelle C. Lapuente, LogRhythm, Regional Sales Manager
Michelle C Lapuente has been with LogRhythm for over five years with previous experience at Dell and other tech start-ups. She comes most recently from the banking and finance industry. A graduate of the University of Texas at Austin in Economics and Spanish, Michelle is focused to helping security professionals solve security challenges within their organizations. Additionally, she is a six time Ironman finisher, a fan of wine, and dogs.

Membership Meeting 7/26/17
2017-07-26 17:00 - 19:00
ISSA Business Meeting Presentation slides: 2017-07-26-Meeting-Presentation.pdf

Speaker slides: Contemporary Challenges for Cloud Service Providers Seeking FedRAMP Compliance

Topic:Contemporary Challenges for Cloud Service Providers Seeking FedRAMP Compliance

The Federal Risk and Authorization Management Program, FedRAMP, is a government-wide assessment and compliance program providing a standardized approach for Cloud Service Providers (CSP) and other organizations delivering SaaS and related products and services to government clients. Although FedRAMP is a well thought out and structured framework, CSPs and other providers will invariably face serious challenges when seeking an assessment, potentially resulting in significant losses in time, money, and reputation if not prepared. Engaging knowledgeable advisory services and experienced third-party assessors is essential to successful outcomes and greater business opportunity.
Speaker: Jeff Roth, NCC Group Security Services, Inc.

Jeff Roth is a Regional Director in NCC Group’s Risk Management and Governance organization. He has over 30 years as a global information assurance specialist and cybersecurity engineer delivering excellence in consulting to government, commercial, and non-profit organizations. Jeff’s achievements include:
– Member of the NIST Cybersecurity Working Group that developed the National Initiative for Cybersecurity Education training course.
– Contributor and SME for the 4th and 5th editions of COBIT and COBIT 5 for Security.
– Co-author of the ISACA 26th Edition of the 2016 CISA Review Manual
– 2006 recipient of the ISACA’s John Kuyers Best Speaker/Conference Contributor Award
Prior to working at NCC Group Jeff served as a US Air Force Information Assurance Officer, Special Operations Command Cybersecurity Engineer, Director of Technology Risk Management Service at RSM McGladrey, and Manager of Internal Audit and Government Relations for the United Space Alliance (Prime Contractor for the NASA Space Shuttle Program) where he was awarded the NASA Astronauts Achievement Award – “Silver Snoopy”
His professional credentials include CISSP-ISSEP, CISA, and CGEIT

Membership Meeting 6/28/17
2017-06-28 17:00 - 19:00
Business Meeting Slides: Click Here

Topic: Cyber Innovation
While invention can be defined as creating something new, “innovation” is applying an invention or creative idea in a different way that adds value to the customer or user. Innovative ideas are not limited to new technology, but can occur in policy, concept of operations, process and other areas. For example, there is potential synergy between corporate IT/SOCs, cyber R&D, and the cyber security applied to critical mission systems. However, exploiting this synergy is not free, and many organizations struggle in applying the tools they develop to the real-life problems their SOC operators encounter on a daily basis. This talk will cover innovative ideas stemming from this cyber-related synergy, and where it has led to new approaches in malware analysis, network architecture, multi-organization collaboration, visualization of the battle space, and automated cyber response.
Speaker: Michael Misumi, CIO, Johns Hopkins University Applied Physics Lab (APL)

Michael Misumi serves as the Chief Information Officer and Head of the Information Technology Service Department at the Applied Physics Laboratory (APL) at Johns Hopkins University. Prior to his current position he was at the RAND Corp. in Santa Monica, Calif., where he was deputy CIO. He led the operational Cyber Strategy development at both organizations, he is the APL Cyber Response Incident Lead, and he led a Cyber Security review of all of Johns Hopkins (including the university, medical center, and hospitals). Misumi, who has an MBA from the UCLA Anderson School of Management and a bachelor’s degree in English from UCLA, has over 20 years experience developing information technology strategy, security operations, project portfolio management, network operations, data center operations, desktop administration and personnel management. The 300-person Information Technology Service Department develops and maintains software for APL business applications; its experts also serve on the front lines of cyber-protection, securing APL networks from hackers and other outside threats. Misumi leads the Navy UARC Cyber Security Task Force, serves on the USSTRATCOM Strategic Advisory Group (SAG) IT Task Force and the Computer Advisory Committee for Oakridge National Laboratory, and is a Board member for the Howard County School System Cyber Security program (ARL).

Membership Meeting 5/24/17
2017-05-24 17:00 - 19:00
ISSA Business Meeting Presentation slides: 2017-05-24-Meeting-Presentation.pdf
Speaker slides: Advanced-Persistent-Threat.pdf

Topic: Advanced Persistent Security: Learning from failure
This discussion will focus on how failure should not only be expected, but welcomed. Failures tell you how to improve protection and detection, and can lead to the discovery of other breaches – all supported by case studies. Such failures can also be considered part of how to respond to a data breach. There is clearly the patching, but the more important long-term issues are, what are the actual lessons learned to take away and improve security? Ira will share his Syrian Electronic Army experiences which proactively stopped attacks after learning from past attacks. Additional lessons learned from the Snowden case and others will also be examined.
Speaker: Ira Winkler, Secure Mentem

Ira Winkler, CISSP is President of Secure Mentem, author of Advanced Persistent Security, and co-host of The Irari Report (www.irarireport.com). He is considered one of the world’s most influential security professionals, and has been named a “Modern Day James Bond” by the media. He did this by performing espionage simulations, where he physically and technically “broke into” some of the largest companies in the World and investigating crimes against them, and telling them how to cost effectively protect their information and computer infrastructure. He continues to perform these espionage simulations, as well as assisting organizations in developing cost effective security programs. Ira also won the Hall of Fame award from the Information Systems Security Association, as well as several other prestigious industry awards. Most recently, CSO Magazine named Ira a CSO Compass Award winner as The Awareness Crusader.
Mr. Winkler began his career at the National Security Agency, where he served as an Intelligence and Computer Systems Analyst. He moved onto support other US and overseas government military and intelligence agencies. After leaving government service, he went on to serve as President of the Internet Security Advisors Group, Chief Security Strategist at HP Consulting, and Director of Technology of the National Computer Security Association. He was also on the Graduate and Undergraduate faculties of the Johns Hopkins University and the University of Maryland. Mr. Winkler is a Past President of the Information Systems Security Association, which is a 10,000+ member professional association.

Membership Meeting 4/26/17
2017-04-26 05:00 - 19:00
General Membership Meeting Slides: click Here

Topic: Data Engine Security Management
Please Join Charles Sirois, Chief Security and Strategy Officer and creator of DataLeakTest.com for a discussion on “Data Engine Security Management” In this presentation Charles will discuss the inner workings of the inside-out Data Engine model for data protection. We will discuss handling data protection in 3 major phases; Inbound Data handling controls, Internal Data handling controls, and Output Data handling controls. Time permitting Charles will discuss Data controls deployment methodology including; Data Security Deployment phases, Data protection, ROI matrix, and 4 golden rules of deploying Data Security

Speaker: Chuck (Charles) Sirois, Chief Security and Strategy Officer, Assurance Data
Chuck has been a thought leader for Enterprise Security for nearly 20 years, Chuck’s expertise stems from independent security software development and consulting for the largest Federal DoD/ civilian and fortune 500 firms. Chuck has demonstrable experience in how threat actors operate and how to defend the Enterprise against them. Further, Chuck has proven his skills effective by successfully finding and preventing weaponized threats in hostile environments.Previously Chuck was founder of Contegrity Partners LLC and DataLeakTest.com, as well as Security Engineer for Websense, Novell, NetIQ, Tufts HC, and Citigroup.

Membership Meeting 3/28/17
2017-03-28 17:00 - 21:00
Speaker: Ron Gula, President Gula Tech Adventures Tenable Network Security
Ron Gula started his cyber security career as a network penetration tester for the NSA. At BBN, he developed network honeypots to lure hackers and he ran US Internetworking’s team of penetration testers and incident responders.
As CTO of Network Security Wizards, Ron pioneered the art of network security monitoring and produced the Dragon Intrusion Detection System which was recognized as a market leader by Gartner in 2001.
As CEO and co-founder of Tenable Network Security, Ron led the company’s rapid growth and product vision from 2002 through 2016. He helped them scale to more than 20,000 customers worldwide, raise $300m in venture capital and achieve revenues in excess of $100m annually.
Presentation – Building a Successful Tech Company
Ron Gula will share his perspectives on the cyber security market and give advice for growing and building tech companies including how to “pitch” and what sort of ideas are trendy and new.

Mid Atlantic Information Security Conference 2017
2017-03-10 08:00 - 17:00
ISSA Mid-Atlantic Information Security Conference
Friday, March 10, 2017. Universities at Shady Grove Conference Center, Rockville, MD
Join us for a full day of training by industry leaders discussing some of the latest topics in tactics and techniques for preparing for cyber-attacks. This conference will feature a variety of presentations and cutting edge training opportunities, including hands-on demonstrations and workshops.
Click here for additional information and to register.

Membership Meeting 2/22/17
2017-02-22 17:00 - 19:00
General Membership Meeting Slides: click Here
Logical Operations Presentation: click Here
Red Owl Presentation: Click Here

Sponsor Appreciation Night:
The February ISSA Central Maryland Chapter meeting will be a Sponsor Appreciation Night to show our thanks for their continued support throughout the year. Each sponsor will be given 10-15 minutes to give an introduction to their company and discuss some of their security technologies. Vendors that have confirmed include:

Parsons
PhoenixTS
LogRhythm
Clearswift
RedOwl Analytics
Logical Operations
