Anticipate the unexpected - ASIS 2012

Education sessions: 3000 Series
TUEsDAY, sEPTEMbEr 20 • 4:30 pm–5:30 pm
3380 Debate—Collecting of Personal
information From the Cloud
■ Intermediate
are we over sharing? as more and more of the
global village connect and share personal
information, these connected pieces of data have
become increasingly valuable. But are we losing
our personal privacy? While Google’s spiders may
find much of the data on us and the organizations
we represent, we are the ones who are truly to
blame for making it available in the first place.
This spirited debate will explore privacy trends and
how the impact of social media has shaped our
current and future data protection strategies.
Raj Goel, Chief Technology Officer, Brainlink
International, Inc.
3381 Psychological Principles in
social Engineering
■ Intermediate
From lawyers to panhandlers, con artists to serial
killers—knowing the fundamental attributes of
psychology can propel your social engineering
efforts to a new level. understanding people’s
tendencies and reaction to your behavior can
help you maintain control or convincingly deceive
your target. This presentation includes core
psychological principles and combines them with
real-world technical security examples to assist
you in creating more successful storyboards for
social engineering efforts.
Joe Sechman, Director, Sunera; Robert Carr, Senior
Manager, Sunera
3383 impact of social Networking on
security Threats
■ Intermediate
The expanding use of social networking technologies
in and outside the workplace has created
a new set of threats facing the organization.
This presentation provides a comprehensive
overview of the new and emerging landscape
of social networking and the resulting attack
vectors created by our use of these technologies.
develop an understanding of the specific range
of risks organizations face in managing these
new technologies. learn a range of potential
responses to address these risks and the likely
vulnerabilities we face in confronting these rapidly
evolving technologies in our organizations.
David Melnick, Principal, Manager, Deloitte, LLP;
Charlie Blanchard, Deloitte, LLP
3384 A Guide to security Metrics
■ Intermediate
a metrics program provides the information
security team with information for better decision
making at both strategic and operational levels.
an effective program should influence the strategy
so that decisions made based on the data from
the metrics program are different than they would
be without such data. Operationally, an effective
program guides day-to-day decision making and
optimizes existing technologies and processes.
Security metrics may be used to fix a security
process which is broken, to focus limited
resources on protecting the most valuable assets,
or to ensure that basic security processes are in
place and working well.
Caroline Wong, Senior Manager, Security Program,
Zynga, Inc.
3385 software Assurance Panel
Wrap-up
■ Intermediate
This interactive session highlights the strengths
and weaknesses of the methods and practices
presented today. ask the speakers to contrast
their perspectives in order to understand what
lessons best apply to you. do the practitioners
appreciate the benefits and products from the
theoreticians and modelers? What will it take to
make all this work and produce tangible results?
how far are we from a software assurance
marketplace with automated tools we can use?
can we move cybersecurity and applications
development from a blame game to a team game?
Joe Jarzombek, Director of Software Assurance, U.S.
Department of Homeland Security; Bob Martin, Principle
Engineer, The MITRE Corporation; Richard Struse, Deputy
Director of Software Assurance Program, U.S. Department
of Homeland Security; Paul Nguyen, Vice President, Cyber
Solutions for Knowledge Consulting Group
“You need to be there to appreciate
the level of education and practical
knowledge you will acquire in a
week.”
Ikhuoria evans
Security Intelligence & Surveillance Analyst,
Lagos and Offshore
Shell nigeria exploration & Production
company (SnePco)
52 Asis 2011 Anticipate the unexpected. The security tools, techniques, and talent for tomorrow.