Application Security Maturity Model
|
|
|
- Malcolm Cannon
- 8 years ago
- Views:
Transcription
1 Application Security Maturity Model Ed Adams Phone: x23
2 Agenda Introduction to the Application Security Maturity (ASM) Model Three Case Studies Business drivers for application security Mistakes organizations make that stall their efforts Best practices for moving along the ASM curve
3 It s All About Awareness
4 Tools & Technology Application Security Maturity Model High Version Control Typical Source Code Scanning Tools Progression Defect Management Curve Test Automation Web Security Vulnerability Scanning Application-layer Security Mitigations, e.g., Web Application Firewall 25% Low Low Panic Scramble Secure SDLC Activities for Development Teams Staff Training (technical & awareness) Internal Red Teams 3rd 15% Party Security 60% Reviews (at code and as-built layers) Application Security audit procedures for ALL application types Integration with IRM, Compliance, and Governance initiatives Pit of Despair People & Process Security as Core Business Process High
5 Agenda Introduction to the Application Security Maturity (ASM) Model Three Case Studies Business drivers for application security Mistakes organizations make that stall their efforts Best practices for moving along the ASM curve
6 Tools & Technology Application Security Maturity Model High Large e-merchant ( 04, 05, 07) No process early; thought tools panacea Built audit procedures and sought training Now specializing toolkit and integrations Typical Progression Curve Large EU Bank So immature we need negative axes! Large Tech Vendor ( 07) Integrated each SDLC phase 3 rd party and internal review process Extensive staff training (high & low) Low Low Panic Scramble Pit of Despair Security as Core Business Process People & Process High
7 Agenda Introduction to the Application Security Maturity (ASM) Model Three Case Studies Business drivers for application security Mistakes organizations make that stall their efforts Best practices for moving along the ASM curve
8 Is Software Security REALLY a Problem?
9 What s the Fuss about Application Security? Over 70 percent of security vulnerabilities exist at the application layer, not the network layer Gartner 64 percent of developers are not confident in their ability to write secure applications - Microsoft Developer Research 70% of companies today are NOT applying secure application development techniques in their software development practices. Aberdeen Group, May 2007 A proliferation of security failures TJX Corporation Fidelity National 95 Million CC# s 8.5 Million records Ameritrade Georgia Dept. of Health 6.3 Million records 2.9 Million medical records Monster.com Chicago Board of Elections 1.6 Million records 1.3 Million voters Number of vulnerabilities cataloged This includes only the breaches in 2007 in USA that lost more than 1 Million records! Statistics from CERT
10 Additional Business Drivers What does Management Care about? <<Second Verse Same as the First>> Make Money Secure Software protects critical data Poor Reputation == Less Sales Save Money Secure Software Cheaper to Maintain 1,2,3 Avoid Fines and Impact to Business, e.g., PCI compliance Fewer Vulnerabilities means Fewer Patches Stay Out of Jail Resistant Software Means Less Theft Less Theft == Less Litigation Pescatore, John, Require Vulnerability Testing During Software Development, Gartner Research Steve McConnell, Code Complete 2nd edition Boehm, et al, COCOMO II, Center for Software Engineering
11 Where is it Costly to Address Security? Source: Ponemon Study, 2007
12 The Application Quality Stack Application security is the definitive quality assurance issue -- Gartner, Inc.
13 Agenda Introduction to the Application Security Maturity (ASM) Model Three Case Studies Business drivers for application security Mistakes organizations make that stall their efforts Best practices for moving along the ASM curve
14 The List (in no particular order) Over-relying on Network Defenses Believing the Hype of Technology/Tools Making Too Many People Assumptions Failing to Integrate AppSec with Info Risk Management (IRM) and Governance Models Assuming Secure Software is Costly Falling into the Recency Trap
15 Agenda Introduction to the Application Security Maturity (ASM) Model Three Case Studies Business drivers for application security Mistakes organizations make that stall their efforts Best practices for moving along the ASM curve
16 ASM Best Practices Samples Tools & Technology Implement Version Control and Change Management Utilize Source Code and Web Scanning Tools (when appropriate!) Adopt Defect Management System (and defect classification process) Test Automation Application-layer Security Mitigations, e.g., Web Application Firewall People & Process Secure SDLC Activities for Development Teams (all members; in phases) Staff Training (awareness first, followed by technical) Internal Red Teams 3 rd Party Security Reviews (at code and as-built layers) Application Security audit procedures for ALL application types Integration with IRM, Compliance, and Governance initiatives Relating AppSec to Regulatory Requirements
17 Other ways to Avoid the Pitfalls Self-Assessment (quick, inexpensive) Incorporate Application Security into Risk Management Integrate Security into Each Phase of S/W Development Lifecycle Believe the <application> Security Hype Ask the hard questions Of Your Vendors Of Yourself Ask ME for a list of tough questions Plan, Plan, Plan!
18 Security Investment in the wrong place
19 European Headquarters: Amsterdam Security Innovation BV ITO Building Gustav Mahlerplein MA Amsterdam The Netherlands Ph: +31 (0) US Headquarters: Boston Security Innovation, Inc. 187 Ballardvale Street Suite A170 Wilmington, MA U.S.A. Ph:
20 About Security Innovation (SI) Leading Application Security Solutions Firm, that delivers To... Professional Services (Risk Assessment and Risk Mitigation) Professional Education Tools & Guidance Enterprise IT organizations Enterprise Software Development organizations Technology Vendors So Organizations can.. Understand the security vulnerabilities in their software systems; and Incorporate security and manage risk throughout the Application Development and Management lifecycle. Security Innovation has offices in Amsterdam, Boston, and Seattle, and widely-adopted security testing methodologies and education courses
21 Security Innovation Credentials and Expertise Books we have written: Information Security Management: Survival Guide, Wiley 2008 How to Break Web Software, Addison Wesley 2006 Software Vulnerability Guide, Charles River Media 2005 How to Break Software Security, Addison Wesley 2003 How to Break Software, Addison Wesley 2002 Conferences we speak at (sample): RSA Conference Best of Conference Gartner IT Security Summit two Analyst presentations 80+ presentations/keynotes at RSA, Gartner, TechEd, STAR,, EuroSTAR, etc Corporate Symposium Keynotes - Fidelity Information Security Summit - McAfee World-Wide Manager s Meeting - Mass Mutual Security Symposium - AT&T Cyber Security Summit - Nationwide Insurance Testing Symposium Publications/Media (sample): Columnist for CIO Update, Blogs on CSO Magazine website 60+ interviews with Wall Street Journal, ABC News, Business Week, Forbes, Fox News, CNN, Network World, Radio Netherlands, Washington Post, German National Television, CSO Magazine 50+ articles for InformationWeek, ComputerWorld, CNET, CIO Update, Better Software, etc. Editors of IEEE Security and Privacy Magazine, Better Software Magazine
22 Application Security Solutions from SI Risk Assessment Deep Penetration Testing Design and Code Review Process Assessment Recurring Security Assessment Competitive Analysis Threat Modeling PCI Audits and Scans Holodeck Software Product Education Secure Code Development Security Testing Techniques Security Awareness How to Break Web Software elearning Software Product Risk Mitigation Process and Policy Improvement PCI Readiness Tools and Technology Recommendation/Adoption Guidance TeamMentor Software Product Educate Assess Mitigate Consulting Service Software Product
23 Some of SI s Customers 62% are either Fortune 500 or Fortune Global % are Fortune 100; 3 are Fortune 10 80%+ are repeat customers
24 Product: TeamMentor Standards for Secure Development Guides companies on how to develop secure applications Documents process for regulatory compliance Key Components Security Encyclopedia Just in time reference guide Attack Libraries and Examples Content Authoring & Commenting Add corporate rules, policies, etc. License Options Site-wide license, which includes engine, content for Java & Web, authoring tool, and support Subscription license (per user per month charge) See online demo videos
25 Product: elearning software titles Recommended Courses Creating Secure Code, Java/Web How to Break Software Security Information Security Awareness Complete Self-paced Course 14 hours of content Labs and Self-Tests Broad Content: from introductory to deep technical content License Options Site-wide purchase Per user purchase Subscription license (per user per month charge) See online demo videos
26 Product: Holodeck Fault Injection and Fuzz Testing Advanced Fault Simulation File and Network Fuzzing Dependency Attacks Design Attacks UI Attacks API Monitoring Maps to 4 key tenets of Microsoft Security Development Lifecycle download 15-day trail version online how to s and resources
How To Integrate Security Into Your Application Development
Six Best Practices of IT Security 187 Ballardvale Street, Wilmington, MA 01887 +1.978.694.1008 2 Table of Contents 1. Make a Self-Assessment...3 2. Believe the Application Security Hype...3 3. Ask Tough
Secure Software Begins in the Development Process
A S P E S D L C Tr a i n i n g Secure Software Begins in the Development Process A WHITE PAPER PROVIDED TO ASPE BY SECURITY INNOVATION Secure Software Begins in the Development Process written for CIO
Application Security Maturity Model (ASM)
Application Security Maturity Model (ASM) A PRAGMATIC APPROACH TO SECURING YOUR SOFTWARE APPLICATIONS 187 Ballardvale Street, Wilmington, MA 01887 +1.978.694.1008 2 Table of Contents Introduction... 3
Certification Project Discussion
Certification roject Discussion OWAS Academies Meeting 5 & 6 January 2011 Lisbon, ortugal Agenda About Security Innovation Company Ed Adams & Jason Taylor elearning/certification Case Studies OWAS Certification
How to start a software security initiative within your organization: a maturity based and metrics driven approach OWASP
How to start a software security initiative within your organization: a maturity based and metrics driven approach Marco Morana OWASP Lead/ TISO Citigroup OWASP Application Security For E-Government Copyright
Web application security Executive brief Managing a growing threat: an executive s guide to Web application security.
Web application security Executive brief Managing a growing threat: an executive s guide to Web application security. Danny Allan, strategic research analyst, IBM Software Group Contents 2 Introduction
Ed Adams CEO Security Innovation. John Kirkwood CISO Security Innovation. 2012 ISACA Webinar Program. 2012 ISACA. All rights reserved.
Mapping Application Security to Compliance Ed Adams CEO Security Innovation John Kirkwood CISO Security Innovation Agenda About Security Innovation Security Drivers and Industry Data Aligning software
Addressing the SANS Top 20 Critical Security Controls for Effective Cyber Defense
A Trend Micro Whitepaper I February 2016 Addressing the SANS Top 20 Critical Security Controls for Effective Cyber Defense How Trend Micro Deep Security Can Help: A Mapping to the SANS Top 20 Critical
IBM Rational AppScan: Application security and risk management
IBM Software Security November 2011 IBM Rational AppScan: Application security and risk management Identify, prioritize, track and remediate critical security vulnerabilities and compliance demands 2 IBM
Presentation for : The New England Board of Higher Education. Hot Topics in IT Security and Data Privacy
Presentation for : The New England Board of Higher Education Hot Topics in IT Security and Data Privacy October 22, 2010 Rocco Grillo, CISSP Managing Director Protiviti Inc. Quote of the Day "It takes
Overview of F5 Networks. Fatih Bilger Senior Systems Engineer, Prolink. fatih.bilger@prolink.com.tr
Overview of F5 Networks Fatih Bilger Senior Systems Engineer, Prolink fatih.bilger@prolink.com.tr Company Snapshot Leading provider of Application Delivery Networking products that optimize the security,
The monsters under the bed are real... 2004 World Tour
Web Hacking LIVE! The monsters under the bed are real... 2004 World Tour Agenda Wichita ISSA August 6 th, 2004 The Application Security Dilemma How Bad is it, Really? Overview of Application Architectures
Intelligent Security Design, Development and Acquisition
PAGE 1 Intelligent Security Design, Development and Acquisition Presented by Kashif Dhatwani Security Practice Director BIAS Corporation Agenda PAGE 2 Introduction Security Challenges Securing the New
Aligning Application Security and Compliance
Aligning Application Security and Compliance A Security Innovation Whitepaper 187 Ballardvale Street, Wilmington, MA 01887 +1.978.694.1008 2 Table of Contents Application Security: The Next Frontier of
White Paper. Guide to PCI Application Security Compliance for Merchants and Service Providers
White Paper Guide to PCI Application Security Compliance for Merchants and Service Providers Contents Overview... 3 I. The PCI DSS Requirements... 3 II. Compliance and Validation Requirements... 4 III.
Accelerating Software Security With HP. Rob Roy Federal CTO HP Software
Accelerating Software Security With HP Rob Roy Federal CTO HP Software If we were in a cyberwar today, the United States would lose. Mike McConnell Former DNI, NSA. Head of Booz Allen Hamilton National
CORE Security and the Payment Card Industry Data Security Standard (PCI DSS)
CORE Security and the Payment Card Industry Data Security Standard (PCI DSS) Addressing the PCI DSS with Predictive Security Intelligence Solutions from CORE Security CORE Security +1 617.399-6980 info@coresecurity.com
ABB s approach concerning IS Security for Automation Systems
ABB s approach concerning IS Security for Automation Systems Copyright 2006 ABB. All rights reserved. Stefan Kubik stefan.kubik@de.abb.com The problem Most manufacturing facilities are more connected (and
Cyber Insurance: How to Investigate the Right Coverage for Your Company
6-11-2015 Cyber Insurance: How to Investigate the Right Coverage for Your Company Presented by: Faith M. Heikkila, Ph.D., CISM, CIPM, CIPP-US, ABCP Greenleaf Trust Chief Information Security Officer (CISO)
CYBER SECURITY SERVICES PWNED
CYBER SECURITY SERVICES PWNED Jens Thonke Capital Market Day 16 Sept 2015 1 AGENDA Cyber Security Services in brief Market overview and key trends Offering and channels Competition Enabling growth Performance
White Paper. Automating Your Code Review: Moving to a SaaS Model for Application Security
White Paper Automating Your Code Review: Moving to a SaaS Model for Application Security Contents Overview... 3 Executive Summary... 3 Code Review and Security Analysis Methods... 5 Source Code Review
The Security Development Lifecycle. Steven B. Lipner, CISSP SLipner@microsoft.com Senior Director Security Engineering Strategy Microsoft Corp.
The Security Development Lifecycle Steven B. Lipner, CISSP SLipner@microsoft.com Senior Director Security Engineering Strategy Microsoft Corp. 2 Overview Introduction A look back Trustworthy Computing
The Next Generation of Security Leaders
The Next Generation of Security Leaders In an increasingly complex cyber world, there is a growing need for information security leaders who possess the breadth and depth of expertise necessary to establish
CyberSecurity Innovation Assessing your Organizations Vulnerability to a Cyber breach
CyberSecurity Innovation Assessing your Organizations Vulnerability to a Cyber breach Steve Mullan Co Founder of Cognition Secure Ltd https://cognitionsecure.com Thank You 7/12/2015 Copyright Cognition
Real World Healthcare Security Exposures. Brian Selfridge, Partner, Meditology Services
Real World Healthcare Security Exposures Brian Selfridge, Partner, Meditology Services 2 Agenda Introduction Background and Industry Context Anatomy of a Pen Test Top 10 Healthcare Security Exposures Lessons
Worldwide Security and Vulnerability Management 2009 2013 Forecast and 2008 Vendor Shares
EXCERPT Worldwide Security and Vulnerability Management 2009 2013 Forecast and 2008 Vendor Shares IN THIS EXCERPT Global Headquarters: 5 Speen Street Framingham, MA 01701 USA P.508.872.8200 F.508.935.4015
RSA Solution Brief RSA. Encryption and Key Management Suite. RSA Solution Brief
RSA Encryption and Key Management Suite The threat of experiencing a data breach has never been greater. According to the Identity Theft Resource Center, since the beginning of 2008, the personal information
How To Buy Cyber Insurance
10-26-2015 Cyber Insurance: How to Investigate the Right Coverage for Your Company Presented by: Faith M. Heikkila, Ph.D., CISM, CIPM, CIPP-US, ABCP Greenleaf Trust Chief Information Security Officer (CISO)
Protecting Your Data, Intellectual Property, and Brand from Cyber Attacks
White Paper Protecting Your Data, Intellectual Property, and Brand from Cyber Attacks A Guide for CIOs, CFOs, and CISOs White Paper Contents The Problem 3 Why You Should Care 4 What You Can Do About It
Security Services. A Solution for Providing BPM of Security Services within the Enterprise Environment.
Security Services A Solution for Providing BPM of Security Services within the Enterprise Environment. First steps towards Next Generations Operations (OPS) to drive Gross Margin Dear security colleagues,
Big Data, Big Risk, Big Rewards. Hussein Syed
Big Data, Big Risk, Big Rewards Hussein Syed Discussion Topics Information Security in healthcare Cyber Security Big Data Security Security and Privacy concerns Security and Privacy Governance Big Data
New IBM Security Scanning Software Protects Businesses From Hackers
New IBM Security Scanning Software Protects Businesses From Hackers Chatchawun Jongudomsombut Web Application Security Situation Today HIGH AND INCREASING DEPENDENCE ON WEB SERVICES Work and business Communications
IT Risk Management: Guide to Software Risk Assessments and Audits
IT Risk Management: Guide to Software Risk Assessments and Audits Contents Overview... 3 Executive Summary... 3 Software: Today s Biggest Security Risk... 4 How Software Risk Enters the Enterprise... 5
Email Marketing and Data Security
WHITE PAPER APRIL 2011 Best Practices in Email Marketing Email Marketing and Data Security Important guidelines for how brands can protect their customers data PUBLISHED BY US Headquarters StrongMail Systems,
The Value of Vulnerability Management*
The Value of Vulnerability Management* *ISACA/IIA Dallas Presented by: Robert Buchheit, Director Advisory Practice, Dallas Ricky Allen, Manager Advisory Practice, Houston *connectedthinking PwC Agenda
An Executive Brief for Network Security Investments
An Executive Brief for Network Security Investments Implementing network security resilience is one of the few things that you can do that will: Protect company brand value Decrease operational costs Preserve
Application Security in the Software Development Lifecycle
Application Security in the Software Development Lifecycle Issues, Challenges and Solutions www.quotium.com 1/15 Table of Contents EXECUTIVE SUMMARY... 3 INTRODUCTION... 4 IMPACT OF SECURITY BREACHES TO
IBM Global Small and Medium Business. Keep Your IT Infrastructure and Assets Secure
IBM Global Small and Medium Business Keep Your IT Infrastructure and Assets Secure Contents 2 Executive overview 4 Monitor IT infrastructure to prevent malicious threats 5 Protect IT assets and information
Information Technology
Information Technology Information Technology Session Structure Board of director actions Significant and emerging IT risks Practical questions Resources Compensating Controls at the Directorate Level
Open Source Security Study How Are Open Source Development Communities Embracing Security Best Practices?
Open Source Security Study How Are Open Source Development Communities Embracing Security Best Practices? Fortify s Security Research Group and Larry Suto July 2008 Open Source Security Study WWW.FORTIFY.COM
case study Core Security Technologies Summary Introductory Overview ORGANIZATION: PROJECT NAME:
The Computerworld Honors Program Summary developed the first comprehensive penetration testing product for accurately identifying and exploiting specific network vulnerabilities. Until recently, organizations
Database Security & Auditing
Database Security & Auditing Jeff Paddock Manager, Enterprise Solutions September 17, 2009 1 Verizon 2009 Data Breach Investigations Report: 285 million records were compromised in 2008 2 Agenda The Threat
The Business Case for Security Information Management
The Essentials Series: Security Information Management The Business Case for Security Information Management sponsored by by Dan Sullivan Th e Business Case for Security Information Management... 1 Un
How To Test For Security
Security Testing Fundamentals SecAppDev 2013 Leuven, Belgium 4-8 March 2013 Confessions of a pen tester Typical scenario looks like this Customer calls and asks for a test 2-3 weeks prior to product going
Security Breaches and Vulnerability Experiences Overview of PCI DSS Initiative and CISP Payment Application Best Practices Questions and Comments
Security in the Payment Card Industry OWASP AppSec Seattle Oct 2006 Hap Huynh, Information Security Specialist, Visa USA hhuynh@visa.com Copyright 2006 - The OWASP Foundation Permission is granted to copy,
Ten Questions Your Board Should be asking about Cyber Security. Eric M. Wright, Shareholder
Ten Questions Your Board Should be asking about Cyber Security Eric M. Wright, Shareholder Eric Wright, CPA, CITP Started my career with Schneider Downs in 1983. Responsible for all IT audit and system
Protecting Sensitive Data Reducing Risk with Oracle Database Security
Protecting Sensitive Data Reducing Risk with Oracle Database Security Antonio.Mata.Gomez@oracle.com Information Security Architect Agenda 1 2 Anatomy of an Attack Three Steps to Securing an Oracle Database
Why You Need to Test All Your Cloud, Mobile and Web Applications
Why You Need to Test All Your Cloud, Introduction In a recent survey of security executives, more than 70 percent of respondents acknowledged that they are performing vulnerability tests on fewer than
TODAY S AGENDA. Trends/Victimology. Incident Response. Remediation. Disclosures
TODAY S AGENDA Trends/Victimology Incident Response Remediation Disclosures Trends/Victimology ADVERSARY CLASSIFICATIONS SOCIAL ENGINEERING DATA SOURCES COVERT INDICATORS - METADATA METADATA data providing
Now Is the Time for Security at the Application Level
Research Publication Date: 1 December 2005 ID Number: G00127407 Now Is the Time for Security at the Application Level Theresa Lanowitz Applications must be available, useful, reliable, scalable and, now
BEST PRACTICES FOR SECURITY TESTING TOP 10 RECOMMENDED PRACTICES
BEST PRACTICES FOR SECURITY TESTING TOP 10 RECOMMENDED PRACTICES Disclaimer!! Best Practices are Not rules or rigid standards General solutions to common problems Guidelines and common reference that can
Integrating web application security control in the system development lifecycle
Integrating web application security control in the system development lifecycle Chester Soong, CISSP-ISSAP, ISSMP, CISA Managing Director Security Consulting Services Ltd. What are the Challenges Application
Data Centric Security: The Village Idiot lives in the Castle
Data Centric Security: The Village Idiot lives in the Castle Michael A. Davis Chief Executive Officer Savid Technologies, Inc. http://www.savidtech.com Copyright 2011Savid Technologies, Inc. All Rights
NERC Cyber Security. Compliance Consulting. Services. HCL Governance, Risk & Compliance Practice
NERC Cyber Security Compliance Consulting Services HCL Governance, Risk & Compliance Practice Overview The North American Electric Reliability Corporation (NERC) is a nonprofit corporation designed to
Cybersecurity The role of Internal Audit
Cybersecurity The role of Internal Audit Cyber risk High on the agenda Audit committees and board members are seeing cybersecurity as a top risk, underscored by recent headlines and increased government
Best Practice Strategies for Managing and Mitigating Key Cyber Risks. Brendan Saunders, Principal Security Consultant - November 2015
Best Practice Strategies for Managing and Mitigating Key Cyber Risks Brendan Saunders, Principal Security Consultant - November 2015 1 Agenda Key Cyber Risks Technical Threats People The Cyber Assurance
Application Security Manager ASM. David Perodin F5 Engineer
Application Security Manager ASM David Perodin F5 Engineer 3 Overview BIG-IP Application Security Manager (ASM) a type of Web application firewall ASM s advanced application visibility, reporting and analytics
Threat Modeling for Secure Embedded Software
SECURITY INNOVATION & KLOCWORK WHITE PAPER JUNE 2011 Threat Modeling for Secure Embedded Software As embedded software becomes more ubiquitous and connected powering everything from home appliances and
Making Database Security an IT Security Priority
Sponsored by Oracle Making Database Security an IT Security Priority A SANS Whitepaper November 2009 Written by Tanya Baccam Security Strategy Overview Why a Database Security Strategy? Making Databases
Auditing emerging cyber threats and IT controls
Auditing emerging cyber threats and IT controls Robert Baldi Director of IT Audit, ACI Worldwide Warren Fish Manager of IT Audit, ACI Worldwide Competency The trouble with competence is that it is always
Analyzing Security for Retailers An analysis of what retailers can do to improve their network security
Analyzing Security for Retailers An analysis of what retailers can do to improve their network security Clone Systems Business Security Intelligence Properly Secure Every Business Network Executive Summary
Reining In SharePoint
Courion Perspective Reining In SharePoint SharePoint is an extremely popular tool that has been widely deployed by many organizations. SharePoint is designed so that it can be implemented without extensive
How to Justify Your Security Assessment Budget
2BWhite Paper How to Justify Your Security Assessment Budget Building a Business Case For Penetration Testing WHITE PAPER Introduction Penetration testing has been established as a standard security practice
An Evaluation of Privacy and Security Issues at a Small University
An Evaluation of Privacy and Security Issues at a Small University Abstract by Michael North Carolina Agricultural and Technical State University mejones@ncat.edu Colleges and universities process large
How To Protect Your Data From Theft
Understanding the Effectiveness of a Data Protection Program IIA: Almost Free Seminar 21 June 2011 Agenda Data protection overview Case studies Ernst & Young s point of view Understanding the effectiveness
QuickBooks Online: Security & Infrastructure
QuickBooks Online: Security & Infrastructure May 2014 Contents Introduction: QuickBooks Online Security and Infrastructure... 3 Security of Your Data... 3 Access Control... 3 Privacy... 4 Availability...
Introduction to Web Application Security. Microsoft CSO Roundtable Houston, TX. September 13 th, 2006
Introduction to Web Application Security Microsoft CSO Roundtable Houston, TX September 13 th, 2006 Overview Background What is Application Security and Why Is It Important? Examples Where Do We Go From
Checklist for HIPAA/HITECH Compliance Best Practices for Healthcare Information Security
Checklist for HIPAA/HITECH Compliance Best Practices for Healthcare Information Security Ali Pabrai, MSEE, CISSP (ISSMP, ISSAP) For Daily Compliance & Security Tips, Follow ecfirst @ Agenda Review the
10 Things Every Web Application Firewall Should Provide Share this ebook
The Future of Web Security 10 Things Every Web Application Firewall Should Provide Contents THE FUTURE OF WEB SECURITY EBOOK SECTION 1: The Future of Web Security SECTION 2: Why Traditional Network Security
RSA Archer Risk Intelligence
RSA Archer Risk Intelligence Harnessing Risk to Exploit Opportunity June 4, 2014 Steve Schlarman GRC Strategist 1 Risk and Compliance Where is it today? 2 Governance, Risk, & Compliance Today 3 4 A New
Skeletons in the Closet: Securing Inherited Applications
Skeletons in the Closet: Securing Inherited Applications Baltimore ISSA April 27, 2011 John B. Dickson, CISSP #4649 Overview for Today s Session The Problem Information Gathering Application Scoring Risk
Cloud Security Fails & How the SDLC could (not?) have prevented them
Cloud Security Fails & How the SDLC could (not?) have prevented them CSA CEE Summit 2015, Ljubjana By Christopher Scheuring, ERNW Germany #2 /whoami Christopher Scheuring Security Analyst @ ERNW Since
IT Security & Compliance. On Time. On Budget. On Demand.
IT Security & Compliance On Time. On Budget. On Demand. IT Security & Compliance Delivered as a Service For businesses today, managing IT security risk and meeting compliance requirements is paramount
Can you afford another day without Managed File Transfer (MFT)?
IPSWITCH FILE TRANSFER WHITE PAPER Can you afford another day without Managed File Transfer (MFT)? www.ipswitchft.com Introduction It s easy to understand why many organizations are confused about the
Building Security into the Software Life Cycle
Building Security into the Software Life Cycle A Business Case Marco M. Morana Senior Consultant Foundstone Professional Services, a Division of McAfee Outline» Glossary» What is at risk, what we do about
WHAT EVERY CEO, CIO AND CFO NEEDS TO KNOW ABOUT CYBER SECURITY.
WHAT EVERY CEO, CIO AND CFO NEEDS TO KNOW ABOUT CYBER SECURITY. A guide for IT security from BIOS The Problem SME s, Enterprises and government agencies are under virtually constant attack today. There
How to ensure control and security when moving to SaaS/cloud applications
How to ensure control and security when moving to SaaS/cloud applications Stéphane Hurtaud Partner Information & Technology Risk Deloitte Laurent de la Vaissière Directeur Information & Technology Risk
Classify, Protect, Audit: New Approach to SAP Data Security. Aparna Jue, SECUDE
Classify, Protect, Audit: New Approach to SAP Data Security Aparna Jue, SECUDE About SECUDE SECUDE is an innovarve global provider of IT data protecron solurons for SAP customers. Our user- friendly solurons
Professional Services Overview
Professional Services Overview INFORMATION SECURITY ASSESSMENT AND ADVISORY NETWORK APPLICATION MOBILE CLOUD IOT Praetorian Company Overview HISTORY Founded in 2010 Headquartered in Austin, TX Self-funded
How to protect yourself against cyber crime in 7 practical steps
How to protect yourself against cyber crime in 7 practical steps Fox Harbour, NS Presented by: Date: Scott Crowley, Regional Managing Partner, MNP Ken Taylor, President, ICSPA Stephen Warden, Partner,
Web Application Security
Web Application Security Ng Wee Kai Senior Security Consultant PulseSecure Pte Ltd About PulseSecure IT Security Consulting Company Part of Consortium in IDA (T) 606 Term Tender Cover most of the IT Security
How-To Guide: Cyber Security. Content Provided by
How-To Guide: Cyber Security Content Provided by Who needs cyber security? Businesses that have, use, or support computers, smartphones, email, websites, social media, or cloudbased services. Businesses
Address C-level Cybersecurity issues to enable and secure Digital transformation
Home Overview Challenges Global Resource Growth Impacting Industries Address C-level Cybersecurity issues to enable and secure Digital transformation We support cybersecurity transformations with assessments,
FedVTE Training Catalog SPRING 2015. advance. Free cybersecurity training for government personnel. fedvte.usalearning.gov
FedVTE Training Catalog SPRING 2015 advance. Free cybersecurity training for government personnel. fedvte.usalearning.gov If you need any assistance please contact the FedVTE Help Desk here or email the
Securely Yours LLC IT Hot Topics. Sajay Rai, CPA, CISSP, CISM sajayrai@securelyyoursllc.com
Securely Yours LLC IT Hot Topics Sajay Rai, CPA, CISSP, CISM sajayrai@securelyyoursllc.com Contents Background Top Security Topics What auditors must know? What auditors must do? Next Steps [Image Info]
Adobe Systems Incorporated
Adobe Connect 9.2 Page 1 of 8 Adobe Systems Incorporated Adobe Connect 9.2 Hosted Solution June 20 th 2014 Adobe Connect 9.2 Page 2 of 8 Table of Contents Engagement Overview... 3 About Connect 9.2...
Patch Management Best Practices
Patch Management Best Practices Peter H. Gregory, CISA, CISSP Seattle, WA USA April 5, 2004 isecbooks.com About the Speaker Author of five security books, two more on the way. Speaker: RSA SF 2004, Cybercrime
Security. Security consulting and Integration: Definition and Deliverables. Introduction
Security Security Introduction Businesses today need to defend themselves against an evolving set of threats, from malicious software to other vulnerabilities introduced by newly converged voice and data
The SharePoint Customer Journey Turn SharePoint into a Broadly Adopted Compliance and Security Asset
The SharePoint Customer Journey Turn SharePoint into a Broadly Adopted Compliance and Security Asset Eric Darbe Vice President of Marketing HiSoftware Agenda What if? The compliance and security case for
2012 Application Security Gap Study: A Survey of IT Security & Developers
2012 Application Gap Study: A Survey of IT & s Research sponsored by Innovation Independently Conducted by Ponemon Institute LLC March 2012 1 2012 Application Gap Study: A Survey of IT & s March 2012 Part
State of Web Application Security. Ralph Durkee Durkee Consulting, Inc. Rochester ISSA & OWASP Chapters rd@rd1.net
Ralph Durkee Durkee Consulting, Inc. Rochester ISSA & OWASP Chapters rd@rd1.net Ralph Durkee Founder of Durkee Consulting since 1996 Founder of Rochester OWASP since 2004 President of Rochester ISSA chapter
January IIA / ISACA Joint Meeting Pre-meeting. Cybersecurity Update for Internal Auditors. Matt Wilson, PwC Risk Assurance Director
January IIA / ISACA Joint Meeting Pre-meeting Cybersecurity Update for Internal Auditors Matt Wilson, Risk Assurance Director Introduction and agenda Themes from The Global State of Information Security
Developing Secure Software in the Age of Advanced Persistent Threats
Developing Secure Software in the Age of Advanced Persistent Threats ERIC BAIZE EMC Corporation DAVE MARTIN EMC Corporation Session ID: ASEC-201 Session Classification: Intermediate Our Job: Keep our Employer
Vulnerability Management Isn t Simple (or, How to Make Your VM Program Great)
Vulnerability Management Isn t Simple (or, How to Make Your VM Program Great) Kelly Hammons Principal Consultant, CISSP Secutor Consulting October 2 nd, 2015 97% of breaches could have been avoided through
Avoiding the Top 5 Vulnerability Management Mistakes
WHITE PAPER Avoiding the Top 5 Vulnerability Management Mistakes The New Rules of Vulnerability Management Table of Contents Introduction 3 We ve entered an unprecedented era 3 Mistake 1: Disjointed Vulnerability
Information Security for the Rest of Us
Secure Your Way Forward. AuditWest.com Information Security for the Rest of Us Practical Advice for Small Businesses Brian Morkert President and Chief Consultant 1 Introduction President Audit West IT
PCI Data Security Standard 3.0
SECURELY ENABLING BUSINESS PCI Data Security Standard 3.0 Training Strategies That Work Presented by Doug Hall May 20, 2014 AGENDA PCI DSS 3.0 Training Strategies That Work PCI DSS 3.0 Overview PCI Training
Cybersecurity Strategy
SYSTEM SOFT TECHNOLOGIES Cybersecurity Strategy Overview With the exponential growth of cyberspace over the past two decades has come increasing risk of data security breaches involving sensitive and private
Agenda. Agenda. Security Testing: The Easiest Part of PCI Certification. Core Security Technologies September 6, 2007
Security Testing: The Easiest Part of PCI Certification Core Security Technologies September 6, 2007 Agenda Agenda The PCI Standard: Security Basics and Compliance Challenges Compliance + Validation =