ISE® Southeast Schedule of Events 2018

Monday, March 5, 2018

ISE® SOUTHEAST PRIVATE WELCOME DINNER
Voice of the Analyst

Wade Baker
Partner & Co-Founder
Cyentia Institute
Biography

It has been well-established over the years that breaches aren’t simply a dice roll pitting attacker strength against technical defenses. Most security incidents, rather, stem from operational inefficiencies and gaps that directly or indirectly lead to the organization being compromised. This makes security operations center (SOCs) and the analysts who staff them the cornerstone upon which effective cybersecurity defenses are built. However, many analysts feel that there is a misalignment between how their time is spent vs how effectively they are able to respond to incidents. While most analysts would rather invest their time on things like advanced threat hunting and incident response management, many feel that their time is spent on vastly less effective tasks. Moreover, security analysts have become hard to find, train, and retain. A recent study by the Cyentia Institute found that the more security expertise a security analyst gains, the less satisfied they tend to be in their role. Join our conversation as we look at current state of security analysts and discuss how their roles as critical members of a security team can be improved through a shift in role focus, implementation of effective automation and orchestration, and improved training options to help them maintain overall skill quality and job satisfaction.

Tuesday, March 6, 2018

11 AM - 3 PM: Registration

Location: Chastain Terrace, Sixth Floor

3 PM - 8 PM: Registration

Location: 200 Grant Loft, Foyer-- attached to Westin 7th Level

11:15 AM: ISE® Signature Luncheon (Invitation Only)

Location: Chastain F, Sixth Floor

David Nolan
CIO & CISO
Aaron's
ISE® East Executive Award Finalist 2023
ISE® East People's Choice Award Winner 2023
Biography

Putting the Sec in DevSecOps
Join David Nolan, Director of Information Security at Aaron’s, Inc., and application security expert Kunal Anand, for a case study on how the international retail and ecommerce company Aaron’s, Inc. successfully integrated a next-gen application security program into rapid DevOps cycles to achieve greater application protection, visibility, and risk mitigation. This session will outline the lessons learned, challenges and rewards of an integrated DevSecOps program that leverages the latest advances in runtime application self-protection to overcome critical application security problems.

12:50 PM: Welcoming Remarks and Introductions

Location: Chastain 1&2, Sixth Floor

Marci McCarthy
CEO and President
T.E.N.
Biography

T.E.N.'s CEO & President will welcome guests, provide an overview of the program agenda and event purpose, and introduce the speakers and sponsors of the ISE® Southeast Executive Forum and Awards 2018.

1:00 PM: Keynote Address

Location: Chastain 1&2, Sixth Floor

Joey Johnson
CISO
Premise Health
ISE® Southeast Executive of the Year Award Winner 2017
ISE® North America Executive: Health Care Award Finalist 2017
Biography

Security Forward: The Evolution and Future of Security Leaders
The role of the Chief Information Security Officer has evolved significantly over the last decade. As more and more organizations realize just how critical and difficult the task of securing their enterprise is, the need for highly skilled and dedicated information security leaders has become a crucial necessity. At the same, the roles and functions expected of a CISO or CIO have also changed dramatically and will continue to do so in the years to come. For some organizations, the role is moving closer to a Chief Protection Officer or a Chief Trust Officer, removing the IT component of the role. Other companies are splitting the traditional aspects of the CISO into separate IT tactical and business strategic functions. Outside of potential title and duty changes, the ever evolving threat landscape also necessitates that current CISOs and those aspiring to the role must acquire a host of new skills, many of which are deeply integrated into central business functions. Join Joey Johnson, CISO for Premise Health, as he looks at the future of the Chief Information Security Officer role and discusses the possible changes it might undergo in the years to come.

1:35 PM: Interactive Executive Roundtables

Location: Chastain 1&2, Sixth Floor

The Interactive Executive Roundtables brings together ISE® Nominees, industry leaders, invited guests, and sponsor delegates to meet each other and join in interactive discussions on key industry issues as well as share best practices. The interactive roundtable discussions are hosted by our leading ISE® Alumni.

• Roundtable 1
• Roundtable 2
• Roundtable 3
• Roundtable 4

The Increasing Impact of Insider Threats

Shane Callahan
Director, Information Security, BCP/DR
Tractor Supply Company

Insider threats continue to be one of the top cyber security threats and have proven that they are a force to be reckoned with. According to a 2017 Insider Threat Report, 53% of companies estimate remediation costs of $100,000 and more, with 12% estimating a cost of more than $1 million. The same report suggests that 74% of companies feel that they are vulnerable to insider threats, with 7% reporting extreme vulnerability. Every company will face an insider-related breach sooner or later regardless of whether it will be caused by a malicious action or an honest mistake. As costs related to insider threats continue to grow, what can Information Security Executives and their security teams do to combat this all too familiar foe?

The Human Point: Security in a Perimeter-less Age

Sponsored by:

Brent Comstock
Sr. Director, Global Data & Endpoint Protection
ADP
Biography

Digital transformation has empowered employees to access and interact with data and intellectual property through a variety of systems, applications, and devices. Because of this, traditional security perimeters are eroding or becoming obsolete. Rather than focus on building bigger walls, the security industry needs better visibility. In addition, increases in the sheer volume of data means organizations no longer have the line of sight they once did, leaving them exposed to vulnerabilities and compliance violations. Understanding how, when, and why people interact with critical data, no matter where it is located, is crucial. It has become imperative that we examine the behavior-centric risks ranging from the common user error that turns an email lure into a ransomware debacle, to sporadic, anomalous activities that, once presented in context, can illuminate the early stages of a malicious insider threat. In a world where malware is continually evolving, critical data is moving to the cloud, and criminals are exploring new vectors of attack, how can security professionals stay up to date with, and keep ahead of, changes in the industry?

Turning the Tables with Deception-Based Security

Curley Henry
Vice President and Deputy Chief Information Security Officer
Southern Company
Biography

In recent years, deception-based security has become one of the most talked about and prominent information security solutions on the market. Having evolved far beyond the humble honey pot origins of yore, modern deception technology can be deployed in a number of ways across the enterprise. From larger scale network models to deception solutions focused on endpoints, applications, and data, there now exist a plethora of ways that companies can shape deceptive security solutions to fit their needs. As attackers continue to become more aggressive and deceptive in their methods of attack, it’s imperative that security teams are able to also make the best use of deception to combat against them. If deception can be used to attack, it can also be used as a means of defense.

The Evolution of AppSec: From WAFs to Autonomous Application Security

Sponsored by:

Nir Valtman
VP, Head of Product & Data Security
Finastra

Web application firewalls (WAFs) entered the security market at the turn of the century as web apps became increasingly complex and critical to digital life. As app-targeted attacks have become more common and sophisticated, WAFs have failed in much the same way that other firewalls, rule-based security measures, and legacy security solutions have: defenses that rely on past signatures and patterns always lose. With the acceleration of DevOps application development, a more refined and modernized solution is necessary. Autonomous application security can provide real time visibility into attacks, help bridge the DevSecOps gap, and reduce overall risk.

2:35 PM: Afternoon Break

2:45 PM: ISE® Southeast Nominee Showcase Presentation #1

Location: Chastain 1&2, Sixth Floor

Tony Spurlin
Vice President & Chief Security Officer
Windstream
ISE® North America People's Choice Award Winner 2005
ISE® Southeast Executive Award Finalist 2018
Biography

Weathering the Business Transformation Storm through Sturdy Leadership
In life or business, there are many situations that when encountered, help drive us to meaning and understanding. This philosophy has been a driving force behind the security leadership of Tony Spurlin, VP and CSO for Windstream. In 2016, Windstream and Tony’s previous organization, Earthlink, merged together as one organization. Upon joining the Windstream team, he charged his security architecture team to work with identity management to evaluate the current challenges with regards to identity and access management and developed a comprehensive and rational plan to incrementally improve Windstream’s risk posture through approved and planned capital investments. Tony builds relationships and powerhouse teams that shape and enable all involved to succeed. Through his career, he has influenced and has grown many leaders across the industry that continue to succeed in their new respective companies and information security programs that continue flourish within these organizations. Tony continuously seeks out opportunities to collaborate with other Windstream organizations valuing the benefits of different perspectives and he finds that solutions to business challenges are most effective when melded into a comprehensive plan benefitting from different points of view and diverse experiences. Join Tony Spurlin as he shares his thoughts and experiences on information security teambuilding, effective board engagement, and hands-on leadership and problem-solving strategies.

3:05 PM: ISE® Southeast Exabyte Sponsor Showcase Presentation

Location: Chastain 1&2, Sixth Floor

Our Exabyte Sponsor will facilitate a 20 minute industry presentation around a top-of-mind security issue facing InfoSec executives today.

Kunal Anand
CTO
Imperva
Biography

Say Goodbye to Vulnerability Backlogs: Using RASP to Reclaim Control and Reduce Risk
Knowing is half the battle when it comes to protecting applications and their sensitive data. Application security testing tools scan your code to reveal the long lists of known vulnerabilities, but not all are remediated before the next release, even with mature secure software development practices. Enterprises resort to using theoretical levels of criticality — not actual risks — to prioritize which accumulated vulnerabilities to fix and in what order. Many vulnerabilities often undergo an exception process and make it into protocol. How can security leaders leverage new strategies and technologies that improve visibility and remediate based on actual risk—not just hypothetical threats?

3:25 PM: Information Security Executive® Deep Dive Panel

Location: Chastain 1&2, Sixth Floor

An industry cross section of ISE Alumni and leading security executives explore today’s hottest security trends and issues and the key challenges they are facing now and in the future.

Moderator

Joe Bennett
Senior Vice President, Chief Information Officer
Adient
Biography

Panelists

Kunal Anand
CTO
Imperva
Biography

Scott Breece
VP of Security & CISO
Community Health Systems
ISE® North America Health Care Executive Award Finalist 2012
Biography

Ashley Ewing
CISO
University of Alabama
Biography

Tony Spurlin
Vice President & Chief Security Officer
Windstream
ISE® North America People's Choice Award Winner 2005
ISE® Southeast Executive Award Finalist 2018
Biography

4:10 PM: ISE® Southeast Nominee Showcase Presentation #2

Location: Chastain 1&2, Sixth Floor

Stoddard Manikin
VP, CISO
Children's Healthcare of Atlanta
ISE® East Executive Award Winner 2024
Biography

Atul Kanvinde
Director, Clinical Applications
Children's Healthcare of Atlanta
Biography

Healthcare on the Move: Using Security as a Business Enabler
To improve clinician to clinician communication, Children's Healthcare of Atlanta replaced the existing hospital communication solution to provide enhanced services, including: bar code scanning, secure messaging and integration with existing applications. The project set out to develop and implement the necessary clinical and infrastructure components to improve operational workflows in order to provide a seamless and secure means of communication and medication administration documentation. The Mobile Clinician Project rollout addressed both security and operational needs, helping prove the idea that security can be an enabler vs. a barrier. Join our conversation as the Children’s Healthcare of Atlanta Team shares how they combined multiple technologies that made patient care more efficient, addressed security and privacy concerns, and promoted mobility for their caregivers.

4:30 PM: ISE® Southeast Nominee Showcase Presentation #3

Location: Chastain 1&2, Sixth Floor

Randy Conner
Director, Threat Prevention, Detection and Response
NCR Corporation

The Prescription for 20/20 Security Vision
Threat monitoring can be one of the trickiest and most resource intensive practices to establish and use to create real security value. With a quickly maturing security program, NCR wanted to secure a gap in the visibility of their monitoring program. With thousands of servers, applications, network devices, and SaaS applications to monitor, they needed a good solution for gaining this visibility and an comprehensive way to onboard, track, and receive alerts on the thousands of logging points in their environment. Through working with internal infrastructure and application owners and their third party MSSP, NCR was able to put a program in place to allow a robust set of tools to do just that. Join our conversation as the NCR team shares how they were able to create a best in breed visibility solution that has allowed them to drastically reduce malware and bot-bet infections as well as reduce their user compromised credential scenarios to virtually non-existent levels.

4:50 PM: Late Afternoon Break

5:00 PM: ISE® VIP Reception (Invitation Only)

Location: The Overlook, Sixth Floor

ISE® Nominees, sponsors and special guests will have the opportunity to network in a private setting with beverages and appetizers.

6:00 PM: Sponsor Pavilion and Dinner Buffet

Location: 200 Grant Loft- attached to Westin 7th Level

Guests enjoy gourmet dinner while networking and meeting the sponsors. Honoring and celebrating the Award Nominees for 2018, this exciting occasion will bring together top security executives to recognize the individuals who have made significant and positive impact on their organizations through exemplary performance.

7:30 PM: Sponsor Tear Down

Location: 200 Grant Loft- attached to Westin 7th Level

7:45 PM: ISE® Southeast Awards Gala

Location: 200 Building Whitehall

Honoring and celebrating the ISE® Southeast Award Nominees, this exciting occasion will bring together top security executives to recognize the individuals and the project teams who have made significant and positive impact on their organizations through exemplary performance. Don't miss the Passport for Prizes drawing and a chance to win outstanding gifts from our ISE® sponsors.

Pete Chronis
SVP, Chief Information Security Officer
WarnerMedia

Michael Varno
Sr. Business Security Officer
ADP
Biography

9:00 PM: Champagne & Dessert Reception

Location: 200 Building Whitehall Balcony

Enjoy champagne and dessert while celebrating the winners, nominees and project teams.