CyberRisk Alliance

VP, Content Strategy

billb-0


<p>Timely threat detection is essential. Every second that a malicious actor lingers inside your network, the odds increase that your organization could be the victim of a major malware attack. Nation-state APT actors are especially adept at staying hidden – but if you know what TTPs and IOCs to look for and you have comprehensive visibility into the processes and packets flowing through your network, then you can take steps to root them out. This live democast will demonstrate how VMware&#8217;s network detection and response solution (NDR) can uncover the various clues that threat actors drop as they infiltrate your network and execute their attack chains.</p>





<div class="wp-block-cra-webcast-speaker"><div class="speaker-wrap overflow -grid"><figure class="speaker-image"><img decoding="async" src="https://cdn.scmagazine.com/wp-content/uploads/2021/10/ChadSkipperPic.jpg" alt="Speaker" /></figure><div class="speaker-info"><div class="speaker-about"><p class="speaker-name">Chad Skipper</p><p class="speaker-job">Global Security Technologist</p><p class="speaker-company">VMWare</p></div><div class="speaker-description"><p>Chad Skipper serves as Global Security Technologist in the Network and Security Business Unit at VMware. With more than 25 years in Information Security, Chad has served in many executive security technologist and strategist roles of endpoint, network, cloud, and hosted security services at Lastline, acquired by VMware, Cylance, acquired by Blackberry, Dell, Cisco, Symantec and is a USAF veteran.</p></div></div></div></div>



<div class="wp-block-cra-webcast-speaker"><div class="speaker-wrap overflow -grid"><figure class="speaker-image"><img decoding="async" src="https://cdn.scmagazine.com/wp-content/uploads/2021/10/Ant_Ducker.jpg" alt="Speaker" /></figure><div class="speaker-info"><div class="speaker-about"><p class="speaker-name">Ant Ducker</p><p class="speaker-job">Lead Cyber Security Solution Engineer</p><p class="speaker-company">VMWare</p></div><div class="speaker-description"><p>Ant Ducker, Lead Cyber Security Solution Engineer at VMware, has twenty+ years’ experience in engineering, deployment, operation and maintenance of network security platforms in the Provider, Financial &amp; Enterprise verticals.</p><p></p><p>Specializing in: proactive and reactive malware defence, manual and automated threat hunting workflows, breach detection and NDR solutions, security systems integration with direct or orchestrated API, workflow integration for enterprise network security, SOC and threat hunting platforms.</p></div></div></div></div>





<p><strong>Sponsored By:</strong></p>



<figure class="wp-block-image size-full"><img decoding="async" width="995" height="153" src="https://cdn.scmagazine.com/wp-content/uploads/2020/11/VMware-Logo-200x200-01-1024x1024-1.png" alt="" class="wp-image-109472" srcset="https://files.scmagazine.com/wp-content/uploads/2020/11/VMware-Logo-200x200-01-1024x1024-1.png 995w, https://files.scmagazine.com/wp-content/uploads/2020/11/VMware-Logo-200x200-01-1024x1024-1-300x46.png 300w, https://files.scmagazine.com/wp-content/uploads/2020/11/VMware-Logo-200x200-01-1024x1024-1-768x118.png 768w, https://files.scmagazine.com/wp-content/uploads/2020/11/VMware-Logo-200x200-01-1024x1024-1-860x132.png 860w, https://files.scmagazine.com/wp-content/uploads/2020/11/VMware-Logo-200x200-01-1024x1024-1-156x24.png 156w, https://files.scmagazine.com/wp-content/uploads/2020/11/VMware-Logo-200x200-01-1024x1024-1-312x48.png 312w, https://files.scmagazine.com/wp-content/uploads/2020/11/VMware-Logo-200x200-01-1024x1024-1-640x98.png 640w" sizes="(max-width: 995px) 100vw, 995px" /></figure>


Breach

Network Security

Democast

Archived: Part 2: Detection & Response Demo: Patrolling Every Packet & Process for Signs of Compromise


<p>As more organizations adopt multi-cloud strategies, security managers must develop a strategy to consistently protect web applications across hybrid environments, while preserving quality of security and operational efficiency. The traditional approach to application security no longer works in the multi-cloud, and anew approach is needed. Join us for this webinar to discuss the new challenges of multi-cloud security and how to overcome them. In this webinar you will learn:</p>



<ul><li>The security challenges of the multi-cloud</li><li>Why traditional approaches and tools no longer work</li><li>The requirements for multi-cloud security solutions</li><li>How Radware helps organizations protect their web applications in the multi-cloud</li></ul>





<div class="wp-block-cra-webcast-speaker"><div class="speaker-wrap overflow -grid"><figure class="speaker-image"><img decoding="async" src="https://cdn.scmagazine.com/wp-content/uploads/2022/05/Eyal-Arazi.png" alt="Speaker" /></figure><div class="speaker-info"><div class="speaker-about"><p class="speaker-name">Eyal Arazi</p><p class="speaker-job">Solution Expert</p><p class="speaker-company">Radware</p></div><div class="speaker-description"><p>Eyal is a Solution Expert in Radware&#8217;s security group, responsible for the company’s line of cloud security products, including Cloud WAF, Cloud DDoS, and Cloud Malware Protection. Eyal has extensive background in security, having served in the Israel Defense Force (IDF) at an elite technological unit.</p></div></div></div></div>





<p><strong>Sponsored By:</strong></p>



<figure class="wp-block-image size-full"><img decoding="async" width="513" height="86" src="https://cdn.scmagazine.com/wp-content/uploads/2022/05/Radware-Logo.jpg" alt="" class="wp-image-260913" srcset="https://files.scmagazine.com/wp-content/uploads/2022/05/Radware-Logo.jpg 513w, https://files.scmagazine.com/wp-content/uploads/2022/05/Radware-Logo-300x50.jpg 300w" sizes="(max-width: 513px) 100vw, 513px" /></figure>


Application security

Cloud Security

Cybercast

Archived: How to Protect Your Applications in the Multi-Cloud


<p>Tactics of adversaries to infiltrate the software supply chain have grown more sophisticated. Among them: co-opting the names of submissions in public code, with the ultimate goal being to use counterfeit code to compromise networks. How can organizations recognize pockets of risk that may exist within their own development efforts? What preventative measures can they take to ensure devops processes don’t provide avenues of access for bad actors?</p>



<p>Join Matt Austin, Director of Security Research, to hear details about Contrast Security’s own experience with a targeted attack against its own code: how the company responded to prevent exploitation, and best practices for secure development.</p>





<div class="wp-block-cra-webcast-speaker"><div class="speaker-wrap overflow -grid"><figure class="speaker-image"><img decoding="async" src="https://cdn.scmagazine.com/wp-content/uploads/2022/08/mattresize.png" alt="Speaker" /></figure><div class="speaker-info"><div class="speaker-about"><p class="speaker-name">Matt Austin</p><p class="speaker-job">Director of Security Research</p><p class="speaker-company">Contrast Security</p></div><div class="speaker-description"><p>Matt is an accomplished application security expert with over 11 years of experience focused on security research, development, and engineering.</p></div></div></div></div>





<p><strong>Sponsored by:</strong></p>



<figure class="wp-block-image size-full is-resized"><img decoding="async" src="https://cdn.scmagazine.com/wp-content/uploads/2022/08/Contrast_Security_Logo-1.png" alt="" class="wp-image-443208" width="306" height="72" srcset="https://files.scmagazine.com/wp-content/uploads/2022/08/Contrast_Security_Logo-1.png 954w, https://files.scmagazine.com/wp-content/uploads/2022/08/Contrast_Security_Logo-1-300x70.png 300w, https://files.scmagazine.com/wp-content/uploads/2022/08/Contrast_Security_Logo-1-768x180.png 768w" sizes="(max-width: 306px) 100vw, 306px" /></figure>


Threat Hunting

Data Security

Archived: How we did it: Detection and prevention of a dependency confusion attack


<p>New analysis from VMware delves deep into the most recent waves of the Emotet botnet, providing never-before-seen insights into the malware delivery mechanism’s malicious components and modules, its execution chains and its software development lifecycle. &nbsp;<br><br>This webcast will reveal key findings and takeaways from VMware’s researchers, who managed to bypass anti-analysis techniques in order to map Emotet’s dynamic infrastructure. This presentation will offer:&nbsp;</p>



<ul><li>A review of Emotet’s infection chain process, along with its TTPs and IOCs. Plus, similarity metrics that allow for the clustering of similar infection techniques.&nbsp;</li><li>An inside look at Emotet’s command-and-control network infrastructure, and its AGILE-like software development life cycle.&nbsp;</li><li>“How-tos” for creating Emotet sock puppets (for fetching modules) and extracting its recently updated configuration.&nbsp;</li><li>An analysis of two recently updated modules that differ from previous Emotet attacks – one that steals credit card info from users of Google Chrome and one that exploits the SMB protocol to proliferate.&nbsp;</li><li>Tips and recommendations for mounting a more ironclad defense.</li></ul>





<div class="wp-block-cra-webcast-speaker"><div class="speaker-wrap overflow -grid"><figure class="speaker-image"><img decoding="async" src="https://cdn.scmagazine.com/wp-content/uploads/2022/09/giovanni_vigna_resize.png" alt="Speaker" /></figure><div class="speaker-info"><div class="speaker-about"><p class="speaker-name">Giovanni Vigna</p><p class="speaker-job">Sr. Director of Threat Intelligence</p><p class="speaker-company">VMware</p></div><div class="speaker-description"><p>Giovanni Vigna is the Sr. Director of Threat Intelligence at VMware. He is also a Professor in the Department of Computer Science at the University of California in Santa Barbara (on leave). His research interests include malware analysis, vulnerability assessment, the underground economy, binary analysis, web security, and the applications of machine learning to security problems. Giovanni Vigna is also the founder of the Shellphish hacking group, who has participated in more DEF CON CTF competitions than any other group in history. He is an IEEE Fellow and an ACM Fellow.</p></div></div></div></div>



<div class="wp-block-cra-webcast-speaker"><div class="speaker-wrap overflow -grid"><figure class="speaker-image"><img decoding="async" src="https://cdn.scmagazine.com/wp-content/uploads/2022/09/stefano_ortolaniresize.png" alt="Speaker" /></figure><div class="speaker-info"><div class="speaker-about"><p class="speaker-name">Stefano Ortolani</p><p class="speaker-job">Staff Engineer 2, Threat Research Lead at VMware</p><p class="speaker-company">VMware</p></div><div class="speaker-description"><p>Stefano Ortolani is Staff Engineer 2 / Threat Research Lead at VMware, formerly Director of Threat Research at Lastline, where he joined in 2015 as a Security Researcher. In his current role, Stefano focuses on finding novel approaches to investigate, classify, and detect unknown cyber tradecraft. Prior to Lastline, he was part of the Global Research and Analysis Team at Kaspersky Lab, in charge of fostering operations with CERTs, governments, universities, and law enforcement agencies, as well as conducting research of the global threat landscape. He received his Ph.D. in Computer Science from VU University Amsterdam.</p></div></div></div></div>





<p></p>


Malware

Archived: EMOTET Exposed: Inside the Cybercriminals’ Supply Chain


<p>Organizations have more security concerns than ever before (due to an increasingly volatile threat landscape, growing attack surfaces, and increased volume and complexity of security threats and alerts) and security operations will continue to be difficult for many organizations to effectively combat without the right combination of technology, intelligence, and expertise.&nbsp;</p>



<p>To compensate, security teams need high performing, modern capabilities to address the complexity creating slow and inefficient security operations.</p>



<p>InsightIDR &#8211; Rapid7’s cloud native SIEM and XDR &#8211; delivers accelerated detection and response via a lightweight deployment and intuitive SaaS interface, complete environment visibility, embedded threat intelligence, expertly vetted detections, and automated response. Security teams can feel confident in stopping threats earlier in the kill chain via three key benefits: cloud-centric incident response, accelerated time-of-value for a speedy return on investment, and a stacked library of detections intelligence that helps identify potential cyber incidents. &nbsp;Perhaps most significantly, InsightIDR is designed for SOC teams of all skill levels, from tenured veterans to up-and-coming go-getters. In this webcast, Rapid7 will take you through a demonstration of its XDR solution, and the myriad benefits it can deliver – from quick out-of-the-box wins for those just getting started, to advanced features for more experienced analysts looking to dig deeper into incoming threats.</p>





<div class="wp-block-cra-webcast-speaker"><div class="speaker-wrap overflow -grid"><figure class="speaker-image"><img decoding="async" src="https://cms.scmagazine.com/wp-content/uploads/2022/11/20220907_161914resize.jpg" alt="Speaker"/></figure><div class="speaker-info"><div class="speaker-about"><p class="speaker-name">Stephen Davis</p><p class="speaker-job">Detection and Response Lead Sales Technical Advisor</p><p class="speaker-company">RAPID7</p></div><div class="speaker-description"><p>Stephen Davis is Rapid7’s Detection and Response Lead Sales Technical Advisor. Stephen has over 15 years of IT-related experience &#8211; from Small Computer Systems Specialist, Senior Systems Administrator, and also as a Lead Technical Customer Advisor for Rapid7’s very own MDR Service. Outside of work, Stephen is an avid beach bum who enjoys console gaming, artistry, tattoos, and being the worst golfer in his neighborhood (it&#8217;s so he can just have an excuse to drive the golf carts).</p></div></div></div></div>




Endpoint/Device Security

Security Program Controls/Technologies

Consolidating without compromise: An XDR democast for analysts of all tenure


<p>How IT risk translates into enterprise risk, and how we tie the two together.&nbsp;</p>



<ul><li>What is IT risk? How has the definition shifted over the years as it relates to overall enterprise risk?</li><li>What are key drivers of IT risk on a business today?</li><li>How do you quantify and communicate IT risk in a tangible way? Why IT should be seen as an enabler, rather than as a cost.</li><li>What is the best approach to manage IT investment and be successful when it comes to risk management.</li><li>How can technology play a role in identifying and measuring business risk and allowing companies to pivot and be more responsive?</li></ul>





<div class="wp-block-cra-webcast-speaker"><div class="speaker-wrap overflow -grid"><figure class="speaker-image"><img decoding="async" src="https://cms.scmagazine.com/wp-content/uploads/2022/12/ErikGastonresize.png" alt="Speaker"/></figure><div class="speaker-info"><div class="speaker-about"><p class="speaker-name">Erik Gaston</p><p class="speaker-job">VP Global Executive Engagement</p><p class="speaker-company">Tanium</p></div><div class="speaker-description"><p>Erik Gaston oversees all Global Executive Engagement in the Global Sales organization at Tanium. A CIO / CTO by trade, he has spent most of his career as a C-level executive leading enterprise technology organizations in the space of modernization, full stack observability and digital / cloud transformation across a host of industries including Financial Services, Global Trade/ Supply Chain, and e-Commerce. Erik joined Tanium in November of 2021 initially as the CIO for Financial Services, a position he still holds, and was soon after asked to lead the Global Executive Engagement Team. Erik partners with our global customers and prospect organizations to drive platform visibility, enterprise maturity and security solutions at scale&#8230;he is a passionate learner, coach and business partner for Tanium customers. Erik is bi-lingual German English, is a member of the NJ Society for Information Management (NJSIM) and is also on the Advisory Board at New Jersey Institute of Technology and is a guest lecturer at the University.</p></div></div></div></div>



<div class="wp-block-cra-webcast-speaker"><div class="speaker-wrap overflow -grid"><figure class="speaker-image"><img decoding="async" src="https://cms.scmagazine.com/wp-content/uploads/2023/01/SteveNeiersresize.png" alt="Speaker"/></figure><div class="speaker-info"><div class="speaker-about"><p class="speaker-name">Steve Neiers</p><p class="speaker-job">CISO, Retired</p><p class="speaker-company">Chevron</p></div><div class="speaker-description"><p>teve recently retired as the CISO at Chevron where he spent 33 years, starting with a variety of technical geophysical roles, and then moving into leadership positions including managing Chevron’s global network, managing Chevron’s end user computing environment, and in 2014 assumed the role of CISO. He is a founding board member of the Oil and Natural Gas Information Sharing and Analysis Committee and has been an active participant with the CEB Information Risk Leadership Council and Information Risk Management Research Board. Steve was also co-chair of the Houston CISO Executive Summit and a member of the Engineering Advisory Board for Houston Baptist. He is a staunch supporter of cross-industry cybersecurity collaboration in an effort to stay ahead of threat actors.</p></div></div></div></div>




Compliance Management

How IT Risk Translates into Enterprise Risk


<p>Join this webcast to learn about the findings from the 2023 State of Passwordless Security report and how you can use it to improve your organization’s security posture.</p>



<p>CRA VP of Content Strategy Bill Brenner, Bojan Simic, HYPR&#8217;s Co-founder, CEO and CTO and &nbsp;Andrew Shikiar, Executive Director &amp; CMO, FIDO Alliance discuss key takeaways from HYPR’s 3rd annual edition, including:</p>



<ul>
<li>Current authentication practices, their security levels, and drivers/barriers to passwordless adoption</li>



<li>The top causes of breaches and strategies to close those vulnerabilities</li>



<li>The role of passkeys and their potential impact on the use of passwordless technologies</li>
</ul>





<div class="wp-block-cra-webcast-speaker"><div class="speaker-wrap overflow -grid"><figure class="speaker-image"><img decoding="async" src="https://cms.scmagazine.com/wp-content/uploads/2023/03/Bojan-Simicresize.png" alt="Speaker"/></figure><div class="speaker-info"><div class="speaker-about"><p class="speaker-name">Bojan Simic</p><p class="speaker-job">Chief Executive Officer &amp; Chief Technology Officer</p><p class="speaker-company">HYPR</p></div><div class="speaker-description"><p>Bojan Simic is the Chief Executive Officer &amp; Chief Technology Officer of HYPR. Bojan&#8217;s vision for the elimination of shared secrets and his experience in authentication &amp; cryptography serves as the underlying foundation for HYPR technology and company strategy. Previously, he served as an information security consultant for Fortune 500 enterprises in the financial and insurance verticals conducting security architecture reviews, threat modeling, and penetration testing. Bojan has a passion for deploying applied cryptography implementations across security-critical software in both the public and private sectors. Bojan also serves as HYPR’s delegate to the FIDO Alliance board of directors, empowering the alliance’s mission to rid the world of passwords.</p></div></div></div></div>



<div class="wp-block-cra-webcast-speaker"><div class="speaker-wrap overflow -grid"><figure class="speaker-image"><img decoding="async" src="https://cms.scmagazine.com/wp-content/uploads/2023/03/Andrew-Shikiarresize.png" alt="Speaker"/></figure><div class="speaker-info"><div class="speaker-about"><p class="speaker-name">Andrew Shikiar</p><p class="speaker-job">Executive Director and Chief Marketing Officer</p><p class="speaker-company">FIDO Alliance</p></div><div class="speaker-description"><p>Andrew Shikiar is Executive Director and Chief Marketing Officer at FIDO Alliance, a global consortium working to create open standards and an interoperable ecosystem for simpler, stronger user authentication. He has deep experience in multi-stakeholder organizations, having previously led market development efforts for Tizen Association, LiMo Foundation and Liberty Alliance Project – and also helped structure and launch groups such as the Smart TV Alliance and Open Visual Communications Consortia.</p></div></div></div></div>




Identity

Passwordless security: Where things stand, and What’s next?


<p>The Managed Detection and Response (MDR) market is heating up as lean security teams lacking the human and financial resources of larger organizations clamor for tools to uncover and stop cyber intrusions more quickly. They understand that when a bad actor penetrates their organization, every second counts. Many have learned this lesson the hard way. This cybercast explores some of the more notorious breaches to make headlines in recent months, where MDR would have made the difference &#8212; and how to use it to bolster incident response in the future.&nbsp;</p>





<div class="wp-block-cra-webcast-speaker"><div class="speaker-wrap overflow -grid"><figure class="speaker-image"><img decoding="async" src="https://cms.scmagazine.com/wp-content/uploads/2023/04/Jeffrey-Gardner-Headshot-.png" alt="Speaker"/></figure><div class="speaker-info"><div class="speaker-about"><p class="speaker-name">Jeffrey Gardner</p><p class="speaker-job">Practice Advisor &#8211; Detection &amp; Response</p><p class="speaker-company">Rapid7 </p></div><div class="speaker-description"><p>Jeffrey Gardner is Rapid7’s Detection &amp; Response Practice Advisor. Jeffrey has over 20 years of experience in the industry as an analyst up through CISO in the tech, healthcare, manufacturing, e-commerce, government and military verticals (among others). In addition to holding a library’s worth of C &amp; G certs (CISSP, CISM, CRISC, GDAT, GPEN, GCIH, etc.) and being an offensive security aficionado he is also a veteran, tattoo artist, avid gamer, comic book nerd, lover of all bad horror movies, and host of cybersecurity podcast &#8220;The Lost Bots&#8221;.</p></div></div></div></div>



<div class="wp-block-cra-webcast-speaker"><div class="speaker-wrap overflow -grid"><figure class="speaker-image"><img decoding="async" src="https://cms.scmagazine.com/wp-content/uploads/2023/04/Erick_headshot.jpg" alt="Speaker"/></figure><div class="speaker-info"><div class="speaker-about"><p class="speaker-name">Erick Galinkin</p><p class="speaker-job">Principal Artificial Intelligence Researcher</p><p class="speaker-company">Rapid7</p></div><div class="speaker-description"><p>Erick Galinkin is a hacker and computer scientist working as principal researcher in Rapid7&#8217;s Office of the CTO. Presently, Erick leads R&amp;D suporting Rapid7&#8217;s Managed Detection and Response service. An alumnus of Johns Hopkins University, he has published many academic papers and given talks on security decision theory and artificial intelligence applications for security at conferences from AAAI and GameSec to DEF CON&#8217;s AI Village. He has spent his entire life in different parts of information security, ranging from threat intelligence and malware analysis to cloud security and security architecture.</p></div></div></div></div>




Incident Response

Incident Response War Stories: When MDR Would Have Made the Difference


<p>Even cybersecurity pros struggle to address the unique challenges of Kubernetes and container security. It can be disorienting to take a career full of knowledge in more traditional platforms and apply it to the leading edge of declarative infrastructure and microservices. This webcast is designed to help security teams get over the initial culture shock of operating within a heavily containerized environment. First, we will look at the unique challenges associated with container security and then we’ll examine how to overcome them by:</p>



<ul>
<li>Understanding how the characteristics of containers, such as immutability, and container runtimes affect our approaches to identifying risks and addressing issues</li>



<li>Gaining visibility into everything being deployed in your environment and understanding the risks of each asset</li>



<li>Embracing automation to extend your reach and accelerate your response</li>



<li>Shifting left such that your security policies and processes are embedded into your code development</li>
</ul>



<p><strong>Sponsored by:</strong></p>



<figure class="wp-block-image size-full"><img decoding="async" width="350" height="160" src="https://cms.scmagazine.com/wp-content/uploads/2023/04/orca_logo_color_digital.png" alt="" class="wp-image-482968" srcset="https://files.scmagazine.com/wp-content/uploads/2023/04/orca_logo_color_digital.png 350w, https://files.scmagazine.com/wp-content/uploads/2023/04/orca_logo_color_digital-300x137.png 300w" sizes="(max-width: 350px) 100vw, 350px" /></figure>


DevSecOps

Tackling The Unique Challenges of Kubernetes & Container Security


<p>For developer and AppSec teams alike, securing critical components of the software supply chain, including open source libraries, container images, cloud infrastructure, and developer tools, is increasingly essential. But more often, tracking dependencies to fixing vulnerabilities can still be siloed because common tools and processes to create unified alignment have not been established.&nbsp;<br><br>To effectively manage and mitigate supply chain risk a more complete, holistic approach is needed. Join technical experts from Snyk and ServiceNow for a webinar where they will discuss:</p>



<ul>
<li>Why it’s critical to establish a workflow bridging developer and AppSec teams,</li>



<li>How to prioritize and action vulnerabilities quickly,&nbsp;</li>



<li>And create automated workflows to ensure timely remediation.</li>
</ul>


Supply chain

Vulnerability Management

Reducing silos between Developers and AppSec in your Software Supply Chain with Snyk and ServiceNow


<p>Cyber risk and business risk are increasingly one and the same, and it’s about time that business-minded executives understood that reality when managing their budgets and agendas. With cybercriminal activity showing no signs of slowing down, companies must understand that a commitment to mitigating cyber risk represents an investment in the business as well.<br>In this session we’ll look at two specific case studies in which organizations successfully addressed some of their biggest sources of business risk by prioritizing quicker detection and assessment of cyber threats through solutions such as XDR, cloud security platforms and managed security services.&nbsp;<br>Learn how one Trend Micro customer’s expanding roster of distributed and remote employees introduced unwanted endpoint security risk, and how cloud security and XDR addressed this issue by unifying enterprise-wide threat data visibility into a single-pane-of-glass solution.<br>And discover how managed XDR helped another customer simultaneously reduce business and security risks – not to mention costs – after acquisition activity resulted in a decentralized IT environment that hampered visibility, communication and control.</p>



<p></p>



<p><strong>Sponsored by:</strong></p>



<figure class="wp-block-image size-full"><img decoding="async" width="350" height="74" src="https://cms.cyberriskalliance.com/wp-content/uploads/2023/07/TM_Logo_Primary_2c_1200x255.png" alt="" class="wp-image-498086" srcset="https://files.scmagazine.com/wp-content/uploads/2023/07/TM_Logo_Primary_2c_1200x255.png 350w, https://files.scmagazine.com/wp-content/uploads/2023/07/TM_Logo_Primary_2c_1200x255-300x63.png 300w" sizes="(max-width: 350px) 100vw, 350px" /></figure>


Leadership

Cyber risk is business risk: Walking the intersecting lines


<p>Open source code provides developers with the shortcuts they need to innovate and&nbsp;<br>iterate faster. But due to a host of open source vulnerabilities, some shortcuts are&nbsp;<br>safer than others. Metaphorically speaking, are your organization’s developers&nbsp;<br>taking a well-lit, mapped-out shortcut, or straying down a mysterious, risky, and foreboding&nbsp;<br>path?<br><br>Snyk&#8217;s &#8220;2023 State of Open Source Security Report&#8221; explores the adoption of&nbsp;<br>security tools, practices, and technologies, as well as the impact of automation and&nbsp;<br>AI in software development. Leveraging findings from both a survey of security practitioners from organizations across the United States and anonymized Snyk product usage data, the report reveals that the software supply chain is lagging in terms of the adoption of fundamental security measures and tools, such as software composition analysis and static application security testing.&nbsp;<br><br>Join this webcast to learn more about the report&#8217;s key takeaways, including:&nbsp;</p>



<ul>
<li>Why supply chain and open source security tools can’t keep up with the pace of development, and why organizations are failing to fully shift left</li>



<li>How organizations are responding to recent attacks by ramping up their code scanning and SBOM efforts, while adopting more formal software supply chain security programs&nbsp;</li>



<li>The mixed impact of AI, and how usage can reduce the burden on security-minded developers, but also potentially introduce additional vulnerabilities or create false alerts</li>
</ul>


AI/ML

Seeking safer shortcuts for devs: Snyk’s 2023 State of Open Source Security Report


<p>As bad actors look to blur the lines between real and fake, cybersecurity experts need to stay one step ahead of tech-savvy fraudsters. A simple, yet robust set of fraud prevention practices is often the best approach for stopping fraudsters at the gate.<br>In this impactful Q&amp;A webcast, you will see through the lens of two expert solution engineers who will dig deep into the vulnerabilities and dangers of AI-based fraud and account takeover (ATO) schemes. They will discuss how low-friction telephony insights, combined with multi-factor authentication (MFA) methods create a simple yet powerful firewall against fraudsters, and how businesses are equipping consumers with the necessary knowledge to stay vigilant ahead of a constant stream of cyber risks.</p>



<p>Join us to learn:<br>· How AI is changing the identity theft game and raising the stakes<br>· How MFA and mobile identity insights create a foundation that’s difficult to crack<br>· Ways to balance too many customer-facing safety protocols and the dangers of not enough<br>· Why it’s important for businesses to create ongoing education and awareness programs</p>



<p><strong>SPONSORED BY:</strong></p>



<figure class="wp-block-image size-full"><img decoding="async" width="350" height="72" src="https://cms.cyberriskalliance.com/wp-content/uploads/2023/06/telesignfinal.png" alt="" class="wp-image-491815" srcset="https://files.scmagazine.com/wp-content/uploads/2023/06/telesignfinal.png 350w, https://files.scmagazine.com/wp-content/uploads/2023/06/telesignfinal-300x62.png 300w" sizes="(max-width: 350px) 100vw, 350px" /></figure>


Threat Management

Revolutionizing the essentials: Friction-minimizing approaches to overcoming advanced account takeover (ATO)


<p>Though red teaming is sometimes perceived as pen testing with the gloves off, in reality, the goal of these engagements isn’t to prove how much damage these skilled testers can do. Modern red teams must set out to provide learning opportunities for organizations and their blue teams, running attack simulations to help teach them how to better protect their infrastructure against real-world attacks. &nbsp;<br><br>To run effective engagements, red teams must not focus solely on capturing the proverbial flag, forgetting their roles as trainers. They should instead provide opportunities for blue teams to put their skills to work so that they are fully prepared for when a real-world attack hits. &nbsp;<br><br>In this webcast, learn more about how red teams can successfully run such engagements, including:&nbsp;</p>



<ul>
<li>Setting expectations with clients &nbsp;</li>



<li>Creating scenarios that strengthen Blue Team proficiency &nbsp;</li>



<li>Staying up to date with adversarial techniques&nbsp;</li>



<li>Having an evasive toolset to keep up with EDR and other detection solutions&nbsp;</li>
</ul>


Penetration Testing

Prioritizing Blue Team Success Over Red Team Wins


<p>Just because a business is mid-sized doesn’t mean the security risks it encounters are any smaller than those experienced by large enterprises. All organizations, regardless of size, face the same challenges around identity growth and management. A growth that places a greater burden on smaller organizations with limited resources that need to remain agile in how they approach their operations. And a proliferation that complicates implementing zero-trust/least privileged security programs that maintain continuous compliance and minimize third-party risk.&nbsp;<br><br>Mid-sized organizations who find themselves in this predicament can gain a leg up with a strong Identity Governance and Administration (IGA) program. Modern IGA solutions provide a portfolio of capabilities that help organizations manage increasingly complex human and machine identities, even as a business scales.&nbsp;</p>



<p>This webcast will reveal how solutions such as Saviynt’s modular SaaS-based IGA platform allow companies in varying stages of IAM maturity to build a robust and flexible identity program &#8211; without breaking the bank – by implementing modern techniques used for onboarding, provisioning, privileged access management, and much more.&nbsp;<br><br>Throughout our discussion we’ll also reveal how a strong IGA strategy improves productivity, streamlines tasks, and automates workflows in a manner that overcomes seven of the most universal challenges facing mid-sized IAM programs: manual processes, user access reviews, third-party identity management, maintaining compliance, lack of integration between systems, human error, and lack of resources.</p>



<p>Discussion Topics will include:</p>



<ol>
<li>An overview of today’s identity landscape</li>



<li>The common challenges your peers are looking to solve for</li>



<li>The benefits of modern IGA solutions</li>
</ol>


Privileged access management

Modern Identity Governance & Administration for Mid-sized Organizations


<p>The U.S. Securities and Exchange Commission’s highly-anticipated new cybersecurity rules are finally in force, and deadlines are approaching quickly. Organizations, both public and private, will now have to take quick action to either establish or transform their cybersecurity programs to come into compliance with these new regulations and prevent financial, legal, and reputational consequences.<br>Join us to learn:</p>



<ul>
<li>How you can ready your organization in 4 steps&nbsp;</li>



<li>What SEC regulations mean for both private and publicly traded companies</li>



<li>Tips for elevating your overall governance and risk management practices</li>
</ul>



<p><strong>Sponsored by</strong>:</p>



<figure class="wp-block-image size-full"><img decoding="async" width="350" height="60" src="https://cms.cyberriskalliance.com/wp-content/uploads/2023/08/LogicGate_Logo_LogicGate-Color.png" alt="" class="wp-image-625077" srcset="https://files.scmagazine.com/wp-content/uploads/2023/08/LogicGate_Logo_LogicGate-Color.png 350w, https://files.scmagazine.com/wp-content/uploads/2023/08/LogicGate_Logo_LogicGate-Color-300x51.png 300w" sizes="(max-width: 350px) 100vw, 350px" /></figure>



<p></p>


Governance, Risk and Compliance

SEC Cyber Compliance Readiness: 4 Steps Every Leader Should Take Now


<p>A company’s data is its lifeblood and must be protected at all costs. But the larger the data pile, the harder it is to manage. Attackers know this and are on a nonstop hunt for holes in your tech stack to exploit. To have a fighting chance, organizations need to approach security as a team sport.<br><br>In this SC webcast, host Bill Brenner sits down with Megan LaFlamme, Director of Product Marketing of data security and management company Cohesity for a discussion on how to assemble the team and help everyone in the organization make the right plays – and how to make the best use of all the security tools available, including threat intelligence, backup and recovery, data classification/isolation and response/recovery. Discussion points will include:<br></p>



<ul>
<li>The challenge of people and IT, including the lack of collaborative tools.</li>



<li>Data siloes across the enterprise and how they should be managed.</li>



<li>How to achieve greater interoperability of security tools.</li>
</ul>


Threat Intelligence

Using Centralized Data Security Management to Turn Cybersecurity into a Team Sport


<p>AppSec has long been considered a subset of IT security, but today’s threats make securing applications an imperative for the entire business. But how do you make it so?<br><br>In this SC Cybercast, Alex Babar, VP of Solutions for cybersecurity company Brinqa, has a discussion with SC’s Bill Brenner about how Brinqa helped one client on its journey to effective Application Security Posture Management (ASPM).<br><br>As Brinqa’s client grew their application security program to detect AppSec findings across their SDLC, they ran into a big problem: too many findings from too many sources. This made it impossible to understand, analyze, and report on SDLC security risks at scale. They needed a way to filter the results and ensure they remained on the path to more secure products, and found their solution in ASPM even before this trending market category had a name. Alex Babar will explain how the company unified its application security testing findings in one place, so they could take a business-first approach to analyzing and remediating their scan results.<br><br>By attending this session, you will learn how the company now uses ASPM to:</p>



<ul>
<li>Unify SAST, SCA, Pen Testing, and other AppSec findings into one graph database</li>



<li>Prioritize AppSec findings with correlated business context and threat intelligence</li>



<li>Collaborate effectively with remediation teams and accurately tracks their progress</li>



<li>Report on trends and progress with a business-first view of risk</li>
</ul>


Application Security Posture Management is essential to your business. Here’s how to get there.


<p>Applications and software supply chains are constantly changing. So is the threat landscape.</p>



<p>Vulnerabilities, misconfigurations, exposed secrets, design flaws, sensitive data exposure, etc., will always be inevitable. That’s why application security remains such a vibrant market and why application security teams have a host of tools (SAST, SCA, DAST, IaC security, etc.) and processes (security questionnaires, pen tests, threat models, etc.) at their disposal. But with today’s pace of change and the complexity of modern applications, those solutions are noisy, resource-intensive, and inefficient.</p>



<p>That’s where application security posture management (ASPM) comes into play, enabling application security teams minimize noisy alert backlogs, reduce remediation times, streamline processes, and proactively reduce application risk.</p>



<p>Join us for this expert-led session where we’ll dive deep into the emerging world of ASPM, including:<br>• The evolution of the ASPM market and the challenges it solves.<br>• How ASPM benefits different teams and functions.<br>• What core components to look for in an ASPM solution.<br>• How to build a risk-based AppSec program and operationalize ASPM.</p>



<p><strong>Sponsored by</strong></p>



<figure class="wp-block-image size-full is-resized"><img decoding="async" src="https://cms.cyberriskalliance.com/wp-content/uploads/2023/10/Apiiro.jpg" alt="" class="wp-image-663931" style="width:307px;height:86px" width="307" height="86" srcset="https://files.scmagazine.com/wp-content/uploads/2023/10/Apiiro.jpg 600w, https://files.scmagazine.com/wp-content/uploads/2023/10/Apiiro-300x84.jpg 300w" sizes="(max-width: 307px) 100vw, 307px" /></figure>


Optimizing AppSec: A Deep Dive into ASPM’s Risk-Based Approach


<p>A new breed of adversaries has emerged — hybrid attackers. These assailants have mastered the art of combining multiple attack vectors, exploiting vulnerabilities and leveraging identities to execute one of the most devastating cybercrimes of our time — ransomware. Ransomware is not just the end goal; hybrid attackers often use it as part of their arsenal to cripple organizations as their attacks progress. &nbsp;</p>



<p>During this discussion, our experts will dive deep into the heart of the matter, shining a light on the problem that plagues modern cybersecurity — hybrid attacks. We&#8217;ll explore why all contemporary cyberattacks are evolving into hybrid forms and how attackers skillfully manipulate identities as their weapon of choice. Understanding this crucial connection is the first step towards securing your digital assets and data.&nbsp;</p>



<p>Don&#8217;t miss this opportunity to learn more about the tactics, techniques and procedures employed by malicious actors to infiltrate and compromise organizations. You’ll walk away with practical insights on how to protect your organization from the grasp of ransomware and how to combat hybrid attackers with integrated signal, so you can find and stop identity-based attacks before they become breaches.</p>


Bill Brenner

For MSSPs, Channel Partners and Everyone Else, 2022 Was a Year of Living Dangerously

How MSSPs Can Survive and Thrive in a Recession