Membership Meeting 7/22/2020
2020-07-22 17:00 - 19:30 (America/New_York) | Virtual via Zoom, MD
Chapter Business Meeting Slides: Membership Meeting 7/22/2020
Speaker Slides: MSSP Market Overview
Speaker Recording: MSSP Market Overview
Topic: Managed Security Services
An overview of the Managed Security Services market including:

Definition of MSS
Categorization of MSS market segments and the pros and cons of each
Explanation of why certain offerings dominate the MSS market and why other offerings are less common
Overview of vendors and their products aligned with the common MSS offerings
Description of the varying service models and how they align to different types of customers
Predictions of disruptions to the MSS market in the coming years

Speaker:
John Perkins, Founder, ThreatAngler
John Perkins is the Founder of Threat Angler and brings over twenty years of cybersecurity experience. During the first fifteen years of his career at the Federal Reserve, he contributed to nearly all cybersecurity disciplines. John spent the next five years designing, building, and leading managed security services with Optiv, GuidePoint, Insight Enterprises, and other service providers. John’s passion is to build a sustainable managed security service focused on delivering cybersecurity value outcomes while developing cybersecurity talents in team members.

IT + Cybersecurity Virtual Career Expo
2020-07-23 10:00 - 15:00 | Virtual
The Maryland Tech Council, in collaboration with Montgomery College’s America’s Promise leadership, is hosting a virtual career expo to connect job seekers and students with industry for cybersecurity and IT related career positions and create awareness of the job opportunities available. The Career Expo is complimentary for all students and job seekers, registration is required.
About the IT + Cybersecurity Virtual Career Expo

20 employers in the virtual expo hall
Explore employer information and career opportunities
Ability to engage with employers through the one-on-one online chat feature
Upload your resume and LinkedIn information to make a strong first impression
This event is complimentary and open to all students and job seekers exploring career opportunities in cybersecurity and IT related fields

If your company is interested in exhibiting, please contact Emily Sumpter at emily@mdtechcouncil.com for more details.

SANS - Cyber Camp for Teens
2020-08-11 - 2020-08-12 | Virtual
SANS introduces the first-ever SANS Cyber Camp for Teens. If you’re interested in a career in cyber security and you attend high school or junior high, this event is for you!
The camp brings together a group of cyber security experts, discussing the latest topics and trends in IT Security. This free Live Online training event includes:

IT Security-Focused Talks – The industry’s top practitioners will present a series of short, age-appropriate talks on Coding, Using Technology Responsibly, Ethical Hacking, Digital Forensics, Security Awareness and more!
Workshops – These hands-on activities are designed to help you learn in a safe and fun environment and do what the professionals do every day.

ISSA-DC August Chapter Meeting
2020-08-18 18:30 - 20:00 | Virtual via Go To Meeting, MD
Incident Handling & Threat Hunting w/ Security Onion by Tyrone E. Wilson
Mr. Wilson will discuss how to use a free and open source tool like Security Onion (SO) to provide hands-on experience and increase our knowledge in incident response and threat hunting. This event is for those with minimal experience working with detection alerts, pcap files, and log management. We will learn how to setup Security Onion at home or on an enterprise network and use its features to complete various network defense challenges. Attendees will leave with a higher level of confidence in network defense as well as the ability to crush their next analyst interview. Participants will also receive a booklet of instructions and credentials to a live SO server which will allow them to continue to practice their new found skills from anywhere in the world.

Membership Meeting 8/26/2020
2020-08-26 17:00 - 19:30 | HubSpot—The Gathering Place on the Gateway, 6724 Alexander Bell Drive Hub Spot, Suite 105, Columbia, MD, 21046
Chapter Business Meeting Slides: 2020-08-26 Membership Meeting
Speaker Slides: Dell Security Operations 2.0 Transformation
Speaker Recording: Dell Security Operations 2.0 Transformation
Topic: Security Operations 2.0
With Dell Technologies being looked at as a key innovator is response to the rapidly changing workforce, Bob will layout a vision of what the next-gen security operations will begin to look like. Based on his past experience as a cybersecurity director and his current outlook within Dell Technologies, Bob will explore how technology will drive how we assess risk, manage and mitigate risk, and provide situational awareness. Enablers for remote workforce, multi-cloud operations, and enhanced intelligence all play a role in every agency’s modernization strategy. But should how you secure these new environments change how you think about securing the rest?
Speaker: Bob Nicholson, Business Development Executive, Dell Technologies Federal
Bob Nicholson is currently a Business Development Executive for the Dell Technologies’ Federal team with a concentration on Federal Civilian agencies. Bob has been serving in this position for 5 years but brings more than 25+ years of solutioning experience in support of the public sector.
For 15 years he served as a cybersecurity leader and solution architect within the federal government which included designing and implementing many enterprise solutions and establishing many best practices. Many of these as a result of Federal mandates, Bob has a great deal of experience working within government, in coordination with its many bodies of governance, and throughout industry. He has transferred this knowledge and relationships into not only being a strong advocate for innovation within government, but also a facilitator for ensuring its success.

Insider Threat Day at Johns Hopkins University Applied Physics Lab
2020-09-01 08:30 - 13:30 | JHU Kossiakoff Conference Center, 11100 Johns Hopkins Road, Laurel, MD, 20723
The Insider Threat Day at Johns Hopkins University Applied Physics Lab, hosted by the ISSA Central Maryland Chapter, will take place on Monday, September 1, 2020. This one-day event will be part of the Insider Threat Awareness Month declared by the U.S. National Counterintelligence and Security Center (NSCS) and the National Insider Threat Task Force (NITTF). The goal of Insider Threat Day is to raise awareness and help organizations develop proactive strategies for detecting and combating these threats, as well as to reduce the risk of compromised information.
Register at https://www.fbcinc.com/e/JHU/attendeereg.aspx

Early Bird registration price for Industry is $75 and ends on 7/31/2020. Afterward, the registration price will be $100.
There is no cost for Government, ISSA members, or JHU/APL Employees to register for this event.

Johns Hopkins Applied Physics Lab is the nation’s largest university-affiliated research center and provides U.S. government agencies with deep expertise in specialized fields to support national priorities and technology development programs. They also serve as independent trusted technical agents to the government, providing continuity for highly complex, multigenerational technology development systems. To find out more about JHU/APL, please visit https://www.jhuapl.edu/

This conference is brought to you by the ISSA Central Maryland Chapter and the Federal Business Council.

Cyber Threat Hunting Workshop
2020-09-02 11:00 - 13:30 | Virtual
Join RedSeal and ISSA Central Maryland on Thursday, August 13, 2020 at 11:30am ET, for a free virtual Cyber Threat Hunting workshop for cybersecurity practitioners.
Learn to identify potential attack vectors that bad actors could use to exploit existing vulnerabilities
During the event, you will leverage the RedSeal platform to assess the overall cybersecurity posture of, and threat hunt within, a pre-built virtual network model while refining your skills in risk and vulnerability assessment, cyber hunting, and incident response.
At the completion of the session, you will have learned how to:

Easily identify devices on the network that pose the most risk to your enterprise
Identify devices across your enterprise that have network access and exploitable vulnerabilities
Quickly visualize where aggressors can pivot following system compromise
Coordinate with other teams to enhance digital resilience

Click Here to Register

BSidesCharm
2020-09-05 - 2020-09-06
BSidesCharm is a regional Security B-Sides held in Baltimore, MD. It operates under the umbrella principles of Security B-Sides as a larger community project within information security. The goal of BSides is to offer small, intimate events where all participants can engage each other to help develop connections, friendships, and network with different industry professionals.

We recognize the value in engaging a smaller audience and being the big fish in a small pond. Every organization will have different goals and priorities which is why we offer different levels of participation for every individual, group, or organization. We specifically designed several different options for any sized organization to participate and support this event.

Labor Day
2020-09-07

Billington CyberSecurity Summit
2020-09-08 - 2020-09-09
Following a sold-out Summit in 2019, the 11th Annual CyberSecurity Summit promises to continue the proud tradition of convening the top “who’s who” in cybersecurity leadership for an unparalleled two days of high-level networking and knowledge-sharing to advocate cyber mission in the U.S. and among allied countries.

Rosh Hashanah Jewish Holiday
2020-09-19

Membership Meeting 9/23/2020
2020-09-23 17:00 - 19:30 | Virtual via Zoom, MD
Chapter Business Meeting Slides: 2020-09-23-Meeting-Presentation.pdf
Speaker Slides: UAS-Forensics-Framework-2020-09-23.pdf
Topic: A Study on Drone Forensics Framework
As consumer unmanned aircraft systems (UAS) or drones are used more commonly in public areas, an approach for a drone forensics framework is needed to guide forensics investigators in analyzing recovered drones that entered the unauthorized national airspace system (NAS). The presentation is based on a doctoral research study focused on whether a single framework and multiple frameworks for drone forensics. The data collected through an online survey provided detailed descriptions of the participants’ most commonly used forensics frameworks or guidelines. The data collected from participants in the United States measured the occurrences of the type of guidelines forensics examiners used. The results of the study identified a need for a standard drone forensic framework across digital forensic disciplines and aircraft accident investigation for use by investigators to produce admissible evidence for litigation in the U.S. courts. The research led to a proposed basic drone forensics framework, which can be improved upon in future research.
Speaker: Nagi Mei, D.Sc.

Dr. Nagi Mei has over 14 years in management and technology consulting service offerings to the commercial and health industries, and federal, state, and local governments. She has extensive experience in strategic initiatives and operational responsibilities grounded in information security management. Dr. Mei is a project manager where she leads teams in implementing information security projects. Dr. Mei received a Doctor of Science in Cybersecurity from the Capitol Technology University. She holds a Master in Business Administration, a Master of Science in Information and Telecommunications Systems from the Johns Hopkins Carey Business School, and a Bachelor of Science in Information Systems concentrating in Digital Forensics from the Johns Hopkins University. She holds certifications in Sec+, PMP, PMI-ACP, SSM, CSM, and ITILv3.

Yom Kippur Jewish Holiday
2020-09-28

Data Connectors Baltimore 2020
2020-09-30
Capital Region:
Virtual Cybersecurity Summit
A live, interactive experience!
Wednesday, September 30th
More than 70,000 members of the Data Connectors Cybersecurity Community are in the DC area. The Virtual Summit will be conducted in real time, with the same panels, presentations and solution provider exhibits and demonstrations
Complimentary Registration Includes:

Keynote presentation
CIO/CISO Panel Discussion
Cybersecurity expert presentations
Virtual exhibits from solution providers with chat capability
CPE Credits
Prizes such as Air Pods, XBox, Amazon Gift Cards and lots more…

Register Here

Virtual Threat Defense Challenge
2020-10-08 10:00 - 16:00 | Virtual
Join our security experts for a hands-on learning experience as you navigate a simulated cyberattack in real-time. Learn to “think like a hacker” and then respond to and defend valuable assets. Whether you are a novice or a skilled security professional, this experience has something for everyone.
Compete in teams alongside your peers to run cyberattacks in a controlled environment. Premium prizes will be given to the team with the most points.
Join this action-packed session and learn to:

Understand the tools and techniques used by hackers
Identify infrastructure security gaps
Plan and implement security measures

There’s no cost to attend. Just bring your best game!
Register Here; https://resources.trendmicro.com/2020-Q4-NE-MA_TDC_OCT8.html

Columbus Day
2020-10-12

EC-Council - Hacker Halted Virtual Cyber Security Training and Conference 2020
2020-10-19 - 2020-10-23 | Virtual
Hacker Halted is a global series of computer and information security conferences presented by EC-Council. Hacker Halted is a global series of computer and information security conferences presented by EC-Council. The objective of the hacker halted conferences is to raise international awareness towards increased education and ethics in IT security.

Membership Meeting 10/28/2020
2020-10-28 17:00 - 19:30 | Virtual via Zoom, MD
Chapter Business Meeting Slides: 2020-10-28- Meeting Presentastion.pdf
Speaker Slides: 30 Years 20-10-28.pdf
Topic: Lessons Learned from 30 Years of Security Awareness Efforts
Organisations acknowledge that employees are often the weakest link, yet efforts to improve ‘user awareness’ tend to rely upon available tools and not true experience. Drawing on three decades of awareness efforts and experience improving true security behaviours, Ira Winkler will dispel many commonly held beliefs about security awareness, detailing what consistently works and what does not.
Learning Objectives:
1: Learn and apply what works consistently across hundreds of organisational awareness efforts.
2: Learn from research in other disciplines that improves awareness efforts.
3: Learn how to create a security culture that drives individual security behaviours.
Speaker: Ira Winkler, President, Secure Mentem

Ira Winkler, CISSP, is the President of Secure Mentem and Author of Advanced Persistent Security, and the forthcoming books, You Can Stop Stupid and Security Awareness for Dummies. He is considered one of the world’s most influential security professionals and was named “The Awareness Crusader” by CSO magazine in receiving their CSO COMPASS Award. He also received the ISSA Hall of Fame award. He has designed and implemented and supported security awareness programs at organizations of all sizes, in all industries, around the world. Ira began his career at the National Security Agency, where he served in various roles as an Intelligence and Computer Systems Analyst. He has since served in other positions supporting the cybersecurity programs in organizations of all sizes. Ira’s new book can be preordered here: https://tiny.cc/stupidbook

Veterans Day
2020-11-11

(ISC)² Security Congress
2020-11-16 - 2020-11-18 | Virtual
Join thousands of leading cybersecurity professionals virtually at (ISC)² Security Congress 2020 November 16-18. You will hear expert insights into the latest security challenges, and share best practices for combating threats, building teams and implementing the latest processes and procedures to better defend your organizations’ critical assets. We will discuss the latest issues facing the workforce, explore pathways for career advancement and discover new tools and solutions together.
Attend (ISC)² Security Congress from home and take advantage of the powerful collaboration that you can only find at a conference of your peers who are dedicated to helping one another solve the challenges we all face.
Early Bird pricing to (ISC)² members and associates of just $295 for an All-Access pass. Non-members will also benefit with Early Bird pricing of $395. Registration details will be announced when open. The Early Bird window will close on September 30. Registration and more information can be found Here!

Membership Meeting 11/18/2020
2020-11-18 17:00 - 19:30 | Virtual via Zoom, MD
Chapter Business Meeting Slides: 2020-11-18 – Meeting Presentastion.pdf

Speaker Slides: Roles of Artificial Intelligence and Deep Learning in Detecting Data Exfiltration
Topic: Roles of Artificial Intelligence and Deep Learning in Detecting Data Exfiltration
Essential Internet services are vital for many aspects of modern living, yet those services remain valuable to threat actors who use them for network intrusions and data exfiltration. Dr. Pena completed a quantitative research study analyzing the ability of a Convolutional Neural Network (CNN) to detect Domain Name System (DNS) covert communications generated by the DNSExfiltrator open source tool. The results showed the CNN model had100% accuracy when exfiltrated file sizes exceeded 2 Kilobytes (KB) using the default (maximum) transmission packet size, but its performance fell dramatically for files below 1 KB in size.
As AI/ML solutions become more prevalent in cybersecurity tools, professionals must understand where a model’s strengths and weaknesses lay in order to apply appropriate risk mitigations, such as tuning complimentary detection systems.
Speaker: Dr. Tomas Pena, L3 Harris Technologies

Dr. Tomas Pena is the Chief Technologist for Cyber Operations at L3Harris Technologies’ Space and Airborne Systems Segment. In that role, he’s responsible for cyber innovation and improving the resiliency of company products spanning land, sea, air, space, and cyber domains. He’s been in cyber-related systems engineering and defense contracting positions since 2013. Prior to that time, he completed 20 years of service in the United States Air Force as a Cyberspace Operations Officer where he organized, planned, executed full-spectrum cyberspace operations, stood up the United States Cyber Command’s 24/7 Joint Operations Center, and led Air Force Business Transformation Initiatives at the Pentagon. Dr. Pena has also filled roles such as managing the Global Positioning System satellite control systems, managing theater communications during Operations IRAQI FREEDOM and ENDURING FREEDOM. He is also the Founder and President of Parallax Cyber LLC, a small business focused on training and educating the workforce in Cybersecurity and Cyber Conflict, and the current Editor-in-Chief of the Military Cyber Professional Associations’ Military Cyber Affairs Journal.

Click Here to register for the November 18, 2020 General Membership Meeting

Thanksgiving Day
2020-11-26

December 2020 "Lunch and Learn"
2020-12-16 12:00 - 13:00 | Virtual via Zoom, MD
O365 Lunch and Learn Abstract: We’ll navigate through uncharted security territory by analyzing the attack lifecycle in the cloud and dissecting a real-world attack. The same technology that makes the cloud dynamic can have the opposite effect on an organization’s ability to implement detection and response in cloud environments. This includes the adding additional layer of preventative controls in addition to MFA, because it’s increasingly being bypassed in O365 as an example. Chris Morales, Head of Analytics with Vectra, will help us navigate through the uncharted security territory by analyzing the attack lifecycle in the cloud, reviewing the top cloud security threats, and dissecting a real-world cloud attack. Additionally, he’ll provide key takeaways for managing access, detection and response, and security operations.
This event is sponsored by Vectra.

Click Here to register for this event. Thanks.

Membership Meeting 12/16/2020
2020-12-16 17:00 - 19:30 | Virtual via Zoom, MD
December meeting is sponsored:

https://redcanary.com/
Click Here for more information about on meeeting sponsor.

Chapter Business Meeting Slides: 2020-12-16 Membership Meeting

Speaker Slides: Least Privilege with PowerShell JEA

Speaker Recording: Least Privilege with PowerShell JEA
Topic: PowerShell JEA
PowerShell JEA allows us Systems Administrators to empower our fellow admins, developers, and security personal to accomplish what they need to on our systems. Give them just enough administrative permissions to accomplish their duties without interrupting your day or night. This talk shows how to assign roles and give the appropriate permissions to those roles.
Speaker: James Honeycutt

James is a dedicated cybersecurity professional who enjoys scripting and participating in capture the flags. He has served over 20 years in the military in various technical and leadership positions. He is part of a Cyber Protection Team and serve as the Microsoft Windows Expert. In past assignments, he served as the OIC (Officer in Charge) of both the battalion IT shop and brigade logistics IT shop, he was the “technology adviser to the Commander”. He has also served as a systems administrator, helpdesk manager, and classroom support tech. Some of his additional duties included being an Information Assurance Manager Alternate and Network Admin backup.
​James is working as a SANs Mentor and TrilogyEd TA. For SANs, he is mentoring SEC505 (Securing Windows and PowerShell Automation) and SEC511 (Continuous Monitoring and Security Operations) and for TrilogyEd, He is TA’ing a Cyber Security Bootcamp
During his career, James has been known as the “go-to guy” for IT questions and problems by his directors, commanders, and peers. He has received numerous awards for his work and knowledge, to include several Meritorious Service Medals and Company Grade Officer of the Year for the state of Arkansas. He has a Bachelors of Science in Management in Information Systems. James holds the following certifications: CISSP, VCP5-DCV, GWAPT, GPYC, GMON, GCWN, GPEN, GCIA, GCIH, GCFA, GSEC, GSNA, SEC +, C|EH

Christmas Day
2020-12-25

New Years Day
2021-01-01

Morning Membership Meeting 01/13/2021
2021-01-13 08:00 - 09:30 | Virtual via Zoom, MD
Chapter Business Meeting Slides: 2021-01-13 Breakfast Meeting Presentation

Speaker Slides: 2021-01-13 Sepio HAC Solution for ISSA
Sepio Whitre Paper: 2021-01-13 Sepio CMMC White Paper

Topic: Reducing The Risk of Unapproved and Rogue Devices
Meeting Recording: Reducing The Risk of Unapproved and Rogue Devices
Sepio delivers a Hardware Access Control (HAC) platform that reduces the risk of unapproved and rogue devices by providing complete visibility, control, and mitigation of all hardware assets. Sepio’s hardware fingerprinting, augmented by machine learning, discovers all managed, unmanaged, and hidden devices that are invisible to all other security tools. Sepio’s solution supports CMMC hardware controls, NNDA section 889 and also enhances zero trust, insider threat, BYOD, IT, OT, and IoT security programs.
Speaker: Jay Smilyk, Chief Revenue Officer, Sepio

Jay Smilyk is the Chief Revenue Officer for Sepio. He oversees the firm’s strategic operations including its growth, recruitment and channel development efforts. Previously, Smilyk served as vice president of North American sales at Safend/Supercom and held similar sales leadership positions at Cynet, RSA and Check Point Software Technologies.

Martin Luther King Day
2021-01-18

AFCEA January Luncheon
2021-01-21 11:30 - 13:00 | Virtual
Featured Speakers: GEN Keith Alexander (Ret.), Founder, Chairman & Co-CEO of IronNet Cybersecurity, is one of the foremost authorities on cybersecurity in the world. A four-star Army general, GEN Alexander was previously the highest-ranked military official of USCYBERCOM, NSA/CSS, where he led these DoD agencies during the conflicts in Afghanistan and Iraq.

Registration Page Here

Membership Meeting 1/27/2021
2021-01-27 17:00 - 19:30
Chapter Business Meeting Slides: 2021-01-27 Membership Meeting

Speaker Slides: 2021-01-27 Red Canary Threat Detection ReportTBD

MITRE ATT&CK home page: https://attack.mitre.org/
Github repo of Atomic Red Team: https://github.com/redcanaryco/atomic-red-team
Github Repo for Atomic Red Team execution fraemwork, Invoke-Atomic: https://github.com/redcanaryco/invoke-atomicredteam
Github repo for variation testing tool, AtomicTestHarnesses: https://github.com/redcanaryco/AtomicTestHarnesses
Installation wiki for Invoke-Atomic: https://github.com/redcanaryco/invoke-atomicredteam/wiki
Invoke-Atomic video tutorials: https://www.youtube.com/watch?v=-HEx-qfd54M&list=PL92eUXSF717W9TCfZzLca6DmlFXFIu8p6
About Atomic Red Team: https://github.com/redcanaryco/atomic-red-team/wiki/About-Atomic-Red-Team
Atomic Red Team microsite: https://atomicredteam.io/
Atomic Red Team Slack: https://slack.atomicredteam.io/
Atomic Test Harnesses Blog series:
Pt. 1: https://redcanary.com/blog/introducing-atomictestharnesses/
Pt. 2: ‌https://redcanary.com/blog/threat-research-questions/
2020 Threat Detection Report: https://redcanary.com/threat-detection-report/introduction/
Previewing the 2021 Threat Detection Report: https://redcanary.com/blog/2021-threat-detection-report-preview/
Someone asked about the difference between Caldera and Atomic Red Team: https://redcanary.com/blog/comparing-red-team-platforms/
Here’s some information on mapping to ATT&CK (both on the context of Atomic Red Team and in the context of behavioral analytics): https://redcanary.com/blog/mitre-sub-techniques/
Topic: Simulating Adversary Tradecraft with Atomic Red Team and the Red Canary Threat Detection Report
We plan to discuss two important resources that leading teams are using to improve their security:

2020 Threat Detection Report: Red Canary’s annual in-depth analysis of of the top techniques for tens of thousands of threats seen in the wild. For each technique, we include detection, prevention, and testing strategies.

Atomic Red Team: An open-source tool mapped to ATT&CK techniques valuable for benignly simulating specific adversary behaviors

Speaker: Brian Donohue, Red Canary
Brian has been writing about and researching information security for the last decade. He started his career as a journalist covering security and privacy. He later consulted as a threat intelligence analyst, researching adversaries and techniques for a variety of major banks, retailers, and manufacturers. At Red Canary, Brian helps guide research publication and technical messaging efforts.
