Name: Better Security with IaC
Start: 2022-09-14T17:00:00Z
End: 2022-09-14T17:00:59.000Z
Location: BrightTALK
Rating: 5

This channel features presentations by leading experts in the field of information security. From application, computer, network and Internet security to access control management, data privacy and other hot topics, you will walk away with practical advice for your strategic and tactical information security initiatives.

Senior management often has a fundamental question regarding cyberattacks: How would cyberattacks affect our organization?  Business impact analyses (BIA), as they have been performed for decades, are inadequate.  The determination of desired recovery times and recovery points may be meaningless in the face of stolen information and ransomware attacks that reflect what business leaders would like to be done rather than what IT can do.  Moreover, new government rules require analysis and disclosure that necessitate an understanding by executive management of what the impact of a cyberattack would be if an attack were to occur.  This session provides an approach to determining what the impact of a cyberattack would be.

Tune in to this webinar to learn:
- How cyberattacks change the context of BIA.
- What are the potential financial, operational, reputational, regulatory and societal impacts of cyberattacks.
- How to conduct a cyber impact analysis.
- How a cyber impact analysis can drive cyber resilience strategy.

Determining the Impact of Cyberattacks

Ransomware risks has the potency to affect the critical assets of organizations and wreak devastating consequences if left un-checked. This session from consultant and industry thought leader Vincent Amanyi will provide a clear strategy for managing the Ransomware-as-a-Service (RaaS) model effectively to stem better control and establish high entry barrier for cybercriminal.

Key Takeaways
- Understand when to plan and implement ransomware control strategies.
- Definition of process map to incident response plan.
- How to map gap to internal research.

Roadmap to an Iron-Clad Ransomware Defense System

Ransomware attacks are one of the most terrible outcomes of cyber breach. Whether you believe in paying ransom demands or not, you must understand the need for a negotiator in such difficult situation. We will discuss challenges, pitfalls, and factors of success that a ransomware negotiator can bring to crisis.

Key Takeaways:
- Understand components of a ransomware attack.
- Recognize intricacies of ransomware negotiations.
- Avoid mistakes frequently made during ransomware attacks.
- Recognize red flags common during ransomware attacks.

Ransomware Negotiations: Everything You Need to Know

In today's dynamic threat landscape, building a security-first culture is essential for safeguarding an organization’s data. This panel session, featuring Michelle Pruitt, Binta Kindle, Swati Popuri, and Cherie Griffith-Dunn, will explore leadership tactics for fostering a mindset of holistic data protection across all levels of the organization.

Key topics include:
- Establishing a security-centric organizational mindset.
- Best practices for leadership to encourage proactive data protection.
- Effective training strategies for promoting security awareness.
- Integrating security considerations into AI and digital workflows.
- And more

Join us to discover how to empower your team, regardless of their technical background, to embrace security as a core value and enhance your organization’s data protection strategy.

Building a Security-First Culture: Leadership Strategies for Holistic Data Protection

Automation in cybersecurity holds the promise of making the world a safer place. However, this promise can be broken if we place blind trust in automation without proper checks and balances. 

In this presentation, industry thought leader Alex Holden will share his knowledge and experience to guide you through the crucial decisions of where to trust AI, where to automate, and where human judgment and decision-making are still indispensable for achieving the most secure outcomes.

To Automate or Not Automate: Guide to Cybersecurity Best Defenses

In an era where data breaches and cyber threats are becoming increasingly common and complex, the need for a comprehensive data security strategy has never been more critical. 

This talk from industry thought leader Efe Ogolo will explore the evolving space of data security from a fragmented set of practices to a holistic, integrated approach that is made up of technological safeguards, regulatory compliance, and the cultivation of a security-conscious organizational culture. Listeners will gain insights into cutting-edge security technologies, including AI-driven threat detection and response systems, as well as the importance of aligning security protocols with legal requirements and industry standards. Moreover, the discussion will touch on the often-overlooked human element -- how fostering a culture of security awareness and accountability can be a powerful defense against both external and internal threats. 

This session is designed for business leaders, IT professionals, and data custodians looking to strengthen their data security posture in a rapidly evolving digital landscape.

Integrating AI, Compliance and the Human Factor in a Comprehensive Data Security Strategy

This session will delve into the potential impact of quantum computing on cybersecurity. It will explore how quantum computers could render current encryption methods obsolete, leading to a “crypto-apocalypse.” But it will also discuss the potential positive applications of quantum computing for enhancing security measures.

Key Takeaways:
- Understanding the threat quantum computing poses to existing cybersecurity infrastructure.
- Exploring the potential of quantum-resistant cryptography.
- Gaining insights into how quantum computing could be leveraged to strengthen security measures.
- Developing strategies to prepare for the quantum computing era.

Quantum Computing: The Cybersecurity Apocalypse or the Next Great Leap?

If you have managed to evade a data breach or fines from the regulator, then well done! Today, business and government organizations inform the public of a data breach, whereas in the past they kept quiet to avoid reputational damage until the news eventually got out!

Based on recent events, either caused internally or externally by threat actors like staff, individuals, hackers, organized crime or state governments, protection of your data and its privacy has become quite challenging.

This webinar will focus on data protection and the consequences of non-compliance. One example of this is Uber fined $324 million for personal data transfer. It will also cover unauthorized access through third-party suppliers and contractors), as well as tips to evaluate your data policy.

Tune into this session presented by business continuity, disaster recovery, cyber resilience and major incident expert Steve Yates, as he shares his views on protecting data security and privacy. Yates will explore these elements from the attacker’s point of view and take attendees on a learning path to consider their own state of readiness for data breaches and disclosure of personal, corporate, and government information. 

By the end of the session, you will be able to:
• Know the importance of understanding your organizations end-to-end data world, specifically mapping data sources and where it resides.
• Understand how easy it could be to cause disruption, modification, or destruction of critical data along with the services which they support.
• Understand the core organizational components necessary for regulation and compliance of your data resources.

How Secure and Private is Your Data?

Despite the advent of so much emerging technology like AI in cybersecurity, the continuing success of data breaches and cyber crime through social engineering and tech complacency is a sobering reminder that so called “low tech” IT security basics still matter. 

In this presentation, Hilton's IT Security and Compliance Analyst Ralph Villanueva will discuss recent cyber security threats and incidents that made the headlines. Attendees will learn what they can do to mitigate these threats in their companies as well as what tools and techniques they can use - without breaking the bank or summoning the AI gods

AI-Enabled Cybersecurity is Overrated: Why Low Tech IT Security Basics Still Matter in 2025

Artificial intelligence continues to reach new heights. But this technology can and frequently is misused for fraudulent activities. New attacks and modifications occur daily. For some, AI is a perceived boon. Others strongly argue that AI is a menace. Either way, AI is here to stay. By embracing this technology responsibly, we can effect a constructive change and enhance more efficient outcomes.
 
Powerful AI can analyze, detect, and react against fraudulent activities. A holistic cybersecurity approach to build ethical AI can help mitigate various risks via a high quality, well-trained multimodal AI model, that includes threat detection and user and entity behaviors analytics that can respond efficiently, effectively and ethically against bad actors.
 
In this talk, industry thought leader Mayra Paredes will describe three of the most repetitive challenges presented by AI and how the cybersecurity industry can embrace them to build a proactive response against the threat landscape.
-              AI Ethics: Morality Bias, weaponization, liability stereotypes. Integrate diverse contributors to build this technology.
-              AAA Systems: Authentication, Authorization and Accounting. Build an Ethical core system.
-              Lack of expertise in the workforce: Embrace AI to foster diverse talent.
 
Readers will come away from this talk with the different nuances surrounding AI and its potential application in cybersecurity. They will also be able to create clear management policies to restore trust in digital environment by building ethical AI.

Tackle 3 Common AI Challenges to Build Effective Security Programs

AI holds great potential for enhancing cybersecurity, offering advanced threat detection, rapid response capabilities, and predictive analytics. However, recent PhD research reveals unique challenges and risks associated with integrating AI into cybersecurity strategies. When attackers have spent 40 years fooling our automated systems, and there is a great risk that AI adoption will greatly widen the threat landscape.

This webinar from industry thought leader will explore both the promises and perils of AI-driven cybersecurity solutions, highlighting key findings from cutting-edge research. Attendees will gain insights into the effectiveness of using AI safely in combating cyber threats, the vulnerabilities AI systems themselves introduce, and the ethical considerations that come with widespread AI deployment in cybersecurity.

The Promises and Perils of Using AI for Cybersecurity

The future is uncertain, but many cyber threats are largely predictable. In the cybersecurity arena, our victories make a difference and cause some threats to fade into history. However, our ability to stay ahead of cyber threats has its ups and downs, influenced by numerous factors. Meanwhile, threat actors continually evolve their techniques and approaches.

Drawing on more than a quarter century of experience in cybersecurity, industry thought leader Alex Holden invites you to join him on a journey through the evolving threat landscape. We'll examine the latest trends in threat intelligence and advancements in AI, and we'll focus on building the most effective cyber defense strategies as we approach 2025.

Victories, Challenges, and Unknowns: Threat Landscape 2025

With the CrowdStrike incident impacting so many organizations, it is imperative to understand your organizations’ cyber incident response framework especially when you screen goes “blue”!

According to a snap poll conducted by Aon, 83% of risk professionals said their organisation had an incident response plan in place. But when CrowdStrike occurred, 24% said these plans underperformed. The entire poll of 500 risk professionals from across the UK and Europe revealed that 62% were directly or indirectly impacted by the global outage.

This presentation will focus on the 2025 to 2030 threatscape and considerations for an “joined-up” incident response framework that your organization should consider if it hasn’t already. 

Tune into this session presented by business continuity, disaster recovery, cyber resilience and major incident expert Steve Yates, as he shares tips to prepare for the 2025 threatscape. Yates will explore current operational cyber incident response areas, identified from more recent events such as dependency mapping, scenario planning and testing, and the core structure that your organization should have in place.  

By the end of the session, you will be able to:
- Know the importance of dependency mapping, specifically for the “before”, and the challenges that will happen if not established for the “after.”
- Form an understanding of how scenario planning and testing can be become critical in the preparation for significant cyber disruptions and provide the need for resources and capacity capabilities. 
-  Understand the core organizational components needed for a cyber incident response framework.

What Do You Need to Consider for Your Cyber Incident Response Framework?

In the ever-evolving landscape of DevOps, the paradigm is now shifting - where security is taking the central stage. With vast surface areas including containers, cloud, repositories and third party components, cyber threats became prominent then ever before in DevOps. 

Our presentation delves into the evolution from traditional DevSecOps to the advanced elimination of threats in each possible way in every stage of DevOps: Build, Test, Deploy and Operate. Lets see how we can prevent cyber threats with secure cloud architecture, continuous logging and monitoring, required approval processes in place, code scanning along with manual reviews as well ensuring heightened security at every step.

In this session, join Jyotirmayee Pradeep Kumar (Vice President - Cloud DevOps at a well-known global bank) as she unravels the stages of elimination of cyber security threats at each phase of DevOps. Topics for discussion include:
- DevOps landscape and different stages associated with it.
- Surface area of cyber threats in DevOps.
- Security breaches within the DevOps framework.
- Practical strategies for eliminating cyber threats with shift-left security implementations. 
- Diverse approaches to automate security integration into DevOps practices.

Eliminating Cybersecurity Threats: Inspection of DevSecOps

Maintaining continuous service availability is not just a priority—it's a necessity. Join us for an insightful webinar to explore the critical aspects of defending your network against Distributed Denial of Service (DDoS) attacks, which can cause significant financial and reputational damage.

Based on the findings from our latest report, The True Cost of a DDoS Attack, this session will delve into the real-world impacts of DDoS incidents on businesses of all sizes. We will discuss effective strategies for mitigating these risks and how our cutting-edge DDoS protection solutions ensure your services remain up and running without interruption.

Key takeaways will include:

- Understanding the financial and operational implications of DDoS attacks.
- Best practices for safeguarding your infrastructure against DDoS threats.
- How our protection strategy can ensure zero downtime and reliable service availability.

Zero Downtime: Ensuring Reliable Service Availability

The National Institutes of Science and Technology recently launched a new version of their cyber security framework, NIST CSF v2.0 to provide both government organizations and private industry a comprehensive set of cyber security guidelines. Better yet, this version can easily be integrated into existing frameworks and tools. 

In this session, Hilton analyst Ralph Villanueva will point out how the newly added governance aspect of this framework can boost the detection, respond and recover capabilities of any organization in the event of a cyber-security incident.

Improve Incident Detection and Response Governance with NIST CSF v2.0

Tune into this session from industry thought leader Vincent Amanyi as he highlights a robust strategy to develop core requirements and step-by-step approach to build a resilient foundation of your insider threat program.

Key takeaways:
- How to perform environment assessment. 
- How to establish a clean foundation that is central to your enterprise.
- Learn how to benchmark and manage your maturity journey.
- Develop the right mix of tool for monitoring.

Identifying and Building the Foundation of a Threat Program

How do you know the dangers you face regarding cybersecurity? A threat intelligence program is key to understanding the existing dangers.  However to be truly effective, threat intelligence must be relevant to your situation and environment. Ensuring  that threat intelligence is indeed intelligent in regards to your specific needs requires more than a basic data feed. The presentation from industry thought leader Charles Kolodgy will provide useful insight and information designed to allow you to align your threat intelligence with your specific needs by incorporating other components that complement threat intelligence.

Join this discussion to learn:
- What is threat intelligence and the specific value it provides.  
- How the MITRE ATT@CK framework is a useful tool for threat intelligence.
- Attack surface management is a valuable component of threat intelligence.
- Understand how threat intelligence and attack surface can be reconciled.
- How to evaluate the various cybersecurity threat intelligence offerings available.
- Harmonizing threat intelligence, attack surface, vulnerabilities, and business requirements when making cybersecurity decisions

Ensuring Threat Intelligence Remains Intelligent

The Benefits and Threats of the Multi-Cloud

Building Best-In-Class Multi-Cloud Backup Operations

SIEM: Threat Detection and Response for your Multi-cloud World

How Can You Protect What You Can't See?

Top 5 Leadership Strategies for Multi-Cloud Security

Top Public Cloud Security Fails and How to Avoid Them

The Importance of Cloud Security Education and Awareness

Cloud Application Security: Best Practices and Vulnerabilities

Implementing Emerging Identity Standards for Better Application Security

Oops! Your Developer’s Laptop Is Connected to Your Cloud… What Now?

Application Security Trends and Best Practices

How to protect your data using Application Layer Encryption

Protecting Web Applications in a Multi-Cloud World

Define Application Security Accurately To Generate Business Success

The Art of Cloud Governance: Essential for Modern Businesses

Agentless CNAPP: A New Approach to Multi-Cloud Security

Security Posture Management for Multi-Cloud and Hybrid Infrastructures

Multicloud Cybersecurity Trend:Supercharged Strategies for Supercharged Threats

Build a Multi-cloud Strategy that Supports Governance and Compliance

Security Challenges and Mitigation Techniques for the Multi-Cloud

Invisible Cloud Security: Accelerating your cloud transformation

Supercharge Your Security for Multi-Cloud

Superpowered Security for the Multi-Cloud in 2022

Rethinking Network-Centric Observability for Cloud Security

One of the most transformative recent shifts within application development in a cloud context is the rise of IaC -- infrastructure as code technologies like Terraform and CloudFormation. As organizations make more use of IaC, it's important for security organizations to pay attention. Why? Because IaC changes the risk equation -- it introduces some new potential risks, and can help close some existing ones.  

This discussion aims to answer these questions:
• Why/how IaC requires thinking about security of assets a new way.
• Artifacts produced by IaC and how they can help us.
• Security “gotchas” and things to watch out for when changing to IaC.
• How you can tailor your security program in light of IaC.

Ed Moyle is currently Director of Software and Systems Security for Drake Software.  In his 20 years in information security, Ed has held numerous positions including: Director of Thought Leadership and Research for ISACA, Application Security Principal for Adaptive Biotechnologies, Senior Security Strategist with Savvis, Senior Manager with CTG, and Vice President and Information Security Officer for Merrill Lynch Investment Managers.  Ed is co-author of Cryptographic Libraries for Developers and Practical Cybersecurity Architecture, and a frequent contributor to the Information Security industry as author, public speaker, and analyst.

Better Security with IaC

Application Development

Infrastructure as a Code

infrastructure security

Cyber Security

Cloud Security

Cloud Applications

The IT security community on BrightTALK is composed of more than 200,000 IT security professionals trading relevant information on software assurance, network security and mobile security. Join the conversation by watching on-demand and live information security webinars and asking questions of experts and industry leaders.

IT Security

Increasing expectations for good governance, effective risk management and complex demands for corporate compliance are presenting a growing challenge for organizations of all sizes. Join industry thought leaders as they provide you with practical advice on how to implement successful risk and compliance management strategies across your organization. Browse risk management resources in the form of interactive webinars and videos and ask questions of expert GRC professionals.

IT Governance, Risk and Compliance

As an IT professional, many of the problems you face are multifaceted, complex and don’t lend themselves to simple solutions. The information technology community features useful and free information technology resources. Join to browse thousands of videos and webinars on ITIL best practices, IT security strategy and more presented by leading CTOs, CIOs and other technology experts.

Better Security with IaC

Presented by

About this talk

More from this channel