Jeremiah Grossman, Chief Technology Officer, WhiteHat Security

In 2011, attitude towards hacks shifted from "It happens," to "It is happening.” A poorly coded website and web application is all that’s needed to wreak havoc – expensive firewall, pervasive anti-virus and multi-factor authentication be damned. But what is possible? What types of attacks and attackers should we be mindful of? This presentation will show the real risks in a post-2011 Internet.  

Jeremiah Grossman founded WhiteHat Security in August 2001. Grossman is a world-renowned expert in Web security, a founder of the Web Application Security Consortium, and was named one of InfoWorld's Top 25 CTOs for 2007. He is a frequent speaker at industry events including the Black Hat Briefings, RSA Conference, ISACA, CSI, InfoSec World, OWASP, ISSA, and Defcon. He has authored dozens of articles and white papers, is credited with the discovery of many cutting-edge attack and defensive techniques, and is a co-author of XSS Attacks: Cross Site Scripting Exploits and Defense. Prior to WhiteHat, he was an information security officer at Yahoo! responsible for performing security reviews on the company's hundreds of websites.

Download <08:09>

Dan Cornell, Chief Technology Officer, Denim Group

This session presents analysis of data drawn from fifteen software security remediation projects. Data is presented both on the time required to remediate specific classes of vulnerabilities as well as the overall composition of remediation projects so that attendees can see what percentage of remediation projects is spent actually fixing vulnerabilities and what time is spent on other activities.

Dan Cornell has over twelve years of experience architecting and developing web-based software systems. As Denim Group’s Chief Technology Officer, he leads the company's security research team in investigating the application of secure coding and development techniques to improve web-based software development methodologies. Dan was the founding coordinator and chairman for the Java Users Group of San Antonio (JUGSA) and currently serves as the OWASP San Antonio chapter leader, member of the OWASP Global Membership Committee and co-lead of the OWASP Open Review Project. Dan has spoken at such international conferences as ROOTs in Norway, OWASP EU AppSec in Dublin and OWASP EU Summit in Portugal.

Download <07:49>

Dawn Cappelli, Technical Manager, CERT Insider Threat Center, Carnegie Mellon SEI CERT Program

The CERT Insider Threat Center has studied insider threat for ten years. We have worked with federal law enforcement, psychologists, cyber analysts, visionary sponsors, academics and practitioners in government and industry. This session will present the top 10 list for winning the battle against malicious insiders based on a decade of work and the nearly 700 actual insider attacks we have examined.

Dawn Cappelli, CISSP, is Technical Manager of CERT’s Enterprise Threat & Vulnerability Management Team and the Insider Threat Center at Carnegie Mellon’s Software Engineering Institute. Her teams research technical threat areas; develop and conduct assessments; and provide solutions and training for preventing, detecting, and responding to illicit activity. Dawn is often an invited speaker at national and international venues, is adjunct professor in Carnegie Mellon’s Heinz College, Vice-Chair for the CERT CSIH Certification Advisory Board, on the program committee for RSA and HICSS conferences, and was awarded the 2011 Software Engineering Institute Director's Office Award of Excellence. Before joining CMU she worked at Westinghouse as a software engineer developing nuclear power systems.

Download <09:35>

Evan Wheeler, Director, Information Security, Omgeo (A DTCC/Thomson Reuters Company)

There has been a lot of published work on how to perform risk assessments and various analysis methods, but they never tell you how to actually build a

Risk Management Program from scratch and successfully integrate it into your organization. This session will demonstrate how to build out the core components and successfully integrate it into your environment with minimal resistance.

Evan Wheeler leads the information security risk management effort as a Director of Corporate Information Security for Omgeo, and previously spent six years as a Security Consultant for the U.S. Dept. of Defense. As a complement to this diverse experience in the field, he has earned a Master of Science in Information Assurance from the National Security Agency certified program at Northeastern University. Currently, Evan continues to contribute to the security industry as an instructor at Northeastern University, and a course author and instructor for the SANS Institute.  Evan has both published a book, "Security Risk Management: Building an Information Security Risk Management Program from the Ground Up," and is also the author of the popular Security Risk Management course for SANS.

Download <08:52>

Joshua Corman, Director, Security Intelligence, Akamai Technologies

David Etue, Vice President, Corporate Development Strategy, SafeNet, Inc.    

The security community has spent years on failed approaches to Return On Investment (ROI) on security offerings and Return On Security Investment (ROSI). It’s failed as it evaluates from the wrong perspective. This session flips ROI on its head, looking from the adversary’s perspective. We’ll introduce an “Adversary ROI” model, and show how it can change how you evaluate cyber security investment.

Joshua Corman is Director of Security Intelligence for Akamai Technologies. Corman has more than a decade of security experience, most recently serving as Research Director for The 451 Group. His research cuts across sectors to the core challenges of the industry, and drives adaptive strategies amidst changing landscapes. He is a candid and highly coveted speaker and has spoken at leading industry events such as RSA, Interop, ISACA, SANS, DEFCON, and ShmooCon – and was recognized by NetworkWorld as a top Influencer of IT for 2009. As a staunch advocate for CISOs, he serves as a Ponemon Institute Fellow, as an IANS Faculty, and co-founded www.ruggedsoftware.org. He received a bachelor’s degree in philosophy, Phi Beta Kappa, summa cum laude, from the University of New Hampshire.

David Etue brings experience including security program leadership, management consulting, product management, and technical implementation. David is the vice president of corporate development strategy at SafeNet, where he is responsible for SafeNet's strategic decisions regarding product and solution partnerships, as well as mergers and acquisitions.  He was previously the cyber security practice lead at management consultancy PRTM, VP of Products & Markets at Fidelis Security Systems, led General Electric's global computer security program, and held various positions in technology strategy, operations and product management. He is a Certified Information Privacy Professional, a graduate of GE's Information Management Leadership Program, and a certified Six Sigma Green Belt.

Download <15:27>

Davi Ottenheimer, President, flyingpenguin

Breach data is now available from a wide  variety of sources and perspectives. This session will explore issues like why some industries receive more attention yet see fewer breaches and how to  re-frame the insider/outsider threat model given the rise of mules and hybrid  attacks.

Davi Ottenheimer has more than sixteen years' experience managing global security operations and assessments, including a decade of leading incident response and digital forensics. Ottenheimer is an expert in compliance, a qualified PCI DSS and PA-DSS assessor with K3DES, and former Board Member for the Payment Card Industry Security Alliance and the Silicon Valley chapters of ISACA and OWASP. He is an award-winning public speaker and has been quoted or written articles on security, risk management and compliance for publications including Bank Info Security, Network World, Red Herring, Chain Store Age and SC Magazine.

Download <07:44>

Brad Arkin, Senior Director, Product Security & Privacy, Adobe

Security practitioners struggle with the predicament: How do I get the engineering teams to wake up and start taking software security seriously? Rapid, dramatic change is most quickly achieved via a crisis. This session will share some lessons on how to prepare for a crisis and what to do once it arrives to ensure you leave your software security program in a stronger position once it’s all over.

Brad Arkin is the Director of Product Security and Privacy at Adobe. In his role, Arkin leads the Adobe Secure Software Engineering Team (ASSET) responsible for ensuring Adobe's products are designed, engineered and validated using security best practices, as well as the Product Security Incident Response Team (PSIRT) dedicated to responding to and communicating about security issues.

Download <07:10>

Marc Stiegler, Research Scientist, Hewlett-Packard Laboratories

Cloud based elasticity lets us build apps that are supposed to scale to arbitrary numbers of users. Alas, even though these apps may scale their

horsepower seamlessly, they use traditional access control models that do not scale. IT teams end up being large, expensive, and still unresponsive. Why not crowdsource access control to the users themselves?

Marc Stiegler has 30 years of experience building collaborative and distributed systems. For the last 12 years Stiegler has focused on systems supporting secure cooperation. His CapDesk secure graphical desktop presented ideas that have since been adopted by Google Chrome. His DecideRight decision analysis software was selected by the Software Publishers' Association as the Best New Business software of 1996. His book on Programming Languages for the IBM PC was selected as one of 20 key books on the PC by Byte Magazine in 1986.

Download <08:58>

Crowd Source Rap Version

We are the IT gurus
controlling data states
without our patient guidance
the users meet bad fates

But users need to work free
without our muss and fuss
they need the tools to do it
or else they'll whine and cuss

The six degrees of sharing
supply them all they need
they solve each other's problems
so no IT folk bleed

The users need dynamic
attenuated chains
they need to be accountable
although they cross domains

And this is why the email
is both our boon and bane
Email alone shares all six ways
to keep the worker sane

But sometimes email fails us
the solution is at hand
we use credential sharing
security be ... slammed

ZBAC techniques enable
rich sharing easily
authorizations not passwords
to fix  things properly

We show a cloud based system
rich sharing to display
we crowd source most access control
least privilege rules the day

A problem here arises
Sock puppets in deep trees
Revoking deep descendants
brings users to their knees

So now we vet the ids
whereever we can see
we stop our revoke pruning
The user keeps his key

Apply this to our systems?
Start with a simple choice
Let users grant with webkeys
Crowd sourcing gets a voice

With zbac based rich sharing
safe users work away
while we the IT gurus
Kick back on the beach and play.