NJ ISSA Chapter Meeting on 03/25/2020 - CANCELLED
2020-03-25 16:00 - 19:00 (America/New_York) | Deloitte Office, 100 Kimball Drive, Parsippany, New Jersey, 07054
We have come to the decision that due to the spread of COVID-19 the March 25th chapter meeting has been cancelled. Our next scheduled meeting is for June 24th.
=======================================================
New Jersey Chapter ISSA Meeting
Date: Wednesday, March 25th, 4:00pm – 7:00pm
Venue: Deloitte, 100 Kimball Drive, Parsippany NJ
Agenda:
3:30 – 4:00 Check In/Registration
4:00 – 4:15 NJ ISSA Chapter Updates
4:15 – 5:15 Presentation: Automate or Die – DevSecOps in the Age of Software Supply Chain Attacks
Irina Tishelman, Solution Architect, Sonatype
Abstract
As nimble organizations deliver new innovations, adversaries are also upping their game; something we’ve seen in recent high profile and devastating cyber attacks. Bad actors have the intent and ability to exploit security vulnerabilities in the software supply chain – and in some cases plant vulnerabilities themselves. They have increased scale through automation and improved breach success through precision targeting. If we don’t fight back by doing the same – automating security directly in the DevOps pipeline – then we’ll always be at the hackers’ mercy. This session will provide new research on the above, and details on how to get started.
Key takeaways:
• Real-world examples of how large and small companies are implementing DevSecOps practices in their own delivery pipelines, and increasing developer awareness to risks
• Key insights from the 2019 DevSecOps community report – including the top investments for automated security
• A walkthrough of how security principles have been automated into a CICD pipeline and what standards for implementation are beginning to follow suite
• Why DevSecOps is more than a buzzword, and why it’s vital to protecting your software supply chain
• How automating security of policies makes it harder to ignore.
5:00 – 5:15 Break
5:15 – 6:00 Group Discussion: Information Security Headlines
Information security incidents and media headlines are omnipresent. We will be reviewing a few interesting recent security headlines and discuss as a group – sharing collective insights, and approaches that organizations can take to respond to similar challenges we face around Cybersecurity today.
6:00 – 7:00 Cocktail Reception

Save The Date: VIRTUAL NJ ISSA Chapter Meeting on 09/30/2020
2020-09-30 16:00 - 18:00
New Jersey Chapter ISSA Meeting
Date: Wednesday, September 30th, 4:00pm – 6:00pm
Venue: Remote via Zoom (NJ ISSA Members will receive an email with Zoom instructions. Please use a contact form to request dial in details if you did not receive the email.)
Agenda:
4:00 – 4:15 NJ ISSA Chapter Updates
4:15 – 5:00 Presentation: Evolution of Network Security
Chris Morales, Head of Security Analytics
Abstract
“The machine learning gives us real-time context and insights about threat behaviors – where they are, what they’re doing and what’s affected.” – Deputy CISO at major Real Estate Firm
Attackers have a big advantage in circumventing signatures, reputation lists and other prevention security defenses. Malware can gain a foothold as endpoints and networks are left vulnerable, with no way for signatures to catch unmapped threats. Combining data science, machine learning and behavioral analysis, automated threat management detects malicious behaviors inside the network, regardless of the attacker’s attempt to evade signatures and whether it’s an insider or outsider threat. This session will focus on the evolution of network security and for a real-world attack storyboarding comparing signatures to behavioral analysis methods.
Speaker Bio
Chris Morales is Head of Security Analytics at Vectra, where he advises and designs incident response and threat management programs for Fortune 500 enterprise clients. He has nearly two decades of information security experience in an array of cybersecurity consulting, sales, and research roles. Christopher is a widely respected expert on cybersecurity issues and technologies and has researched, written and presented numerous information security architecture programs and processes.
5:00 – 5:15 Break
5:15 – 6:00 Presentation: Cyber Security Simulations
David Krygowski, CyberBit
Abstract
This session will focus on the use of software to be a realistic ‘flight simulator’ for their cyberwarfare adopted by SOC’s across the world. This contrasts significantly with regards to attending courses or tabletops. Cyber simulation is a tool to train and onboard security teams, assess candidates, and test playbooks and technologies in a safe and controllable environment, ensuring their security teams are prepared for simple minor attacks or complex critical attacks.
Cyber simulations can be a training tool to provide:

Train red, blue, purple teams
Assess new hires
Simple to use
Test configurations, products, and playbooks in a safe environment
Rich catalog of out of box simulated scenarios
Customizable & dynamic
Real security technologies like Splunk
Real network traffic
Real actual attacks

5:55 – 6:00 Closing Comments

Save The Date: VIRTUAL NJ ISSA Chapter Meeting on 12/16/2020
2020-12-16 16:00 - 18:00
New Jersey Chapter ISSA Meeting
Date: Wednesday, December 16th, 4:00pm – 6:00pm
Venue: Remote via Zoom (NJ ISSA Members will receive an email with Zoom instructions. Please use a contact form to request dial in details if you did not receive the email.)
Agenda:
3:55 – 4:00 Check In/Registration
4:00 – 4:15 NJ ISSA Chapter Updates
4:15 – 6:00 NJ ISSA Cyber Escape Room!
Facilitated and Sponsored by: Living Security
Join us for a unique training experience. Living Security is proud to be a facilitator of this Virtual CyberEscape Room. This is a great way to engage with colleagues in cybersecurity awareness training through online gamification! View the trailer here: https://vimeo.com/409829810
Event details below:
5:55 – 6:00 Closing Comments

Save The Date: VIRTUAL NJ ISSA Chapter Meeting on 3/31/2021
2021-03-31 16:00 - 18:00
New Jersey Chapter ISSA Meeting
Date: Wednesday, March 31st, 4:00pm – 6:00pm
Venue: Remote via Zoom (NJ ISSA Members will receive an email with Zoom instructions. Please use a contact form to request dial in details if you did not receive the email.)
Agenda:
3:55 – 4:00 Check In/Registration
4:00 – 4:15 NJ ISSA Chapter Updates
4:15 – 5:00 Presentation: Security Mistakes Everyone Makes: Improving work-from-home and home network security
Jeremy Druin, Education Director Kentucky ISSA Chapter
Abstract
Work from Home, School from Home, and just about Everything from Home is more popular than ever due to recent events. In this presentation, we will discuss practical steps to strengthen the security of home networks and personal devices.
Speaker Bio
Jeremy works as the Principal Security Architect for UPS where he created the application security, bug bounty and penetration testing programs. Jeremy is also the owner of Ellipsis Information Security where he provides security testing services and teaches secure application development and penetration testing courses.
As a Director of Education for the Kentucky ISSA chapter, Jeremy presents on various information security topics along with operating the “webpwnized” YouTube video channel. Additionally, Jeremy develops the open-source OWASP Mutillidae II training environment.
Jeremy has a Bachelors in Computer Science from Indiana University, a Graduate Certificate in Cybersecurity and Masters in Computer Science from the University of Louisville and is a GIAC-certified Web Application, Mobile and Network Security Penetration Tester..
5:00 – 5:15 Break
5:15 – 6:00 Presentation: Cloud Infrastructure Cyber Kill Chain – Threats & Countermeasures
Mike Raggo, Cloud Security Engineer, CloudKnox
Abstract
Attackers are maturing their TTPs to now exploit over-permissioned identities within AWS, Azure, and GCP; resulting in very prominent breaches. In this session we’ll define a new Cloud Infrastructure Cyber Kill Chain and explore these TTPs to expose unique methods of lateral movement, privilege escalation, role-chaining, and more. Real world examples and best practices countermeasures will also be covered.
Speaker Bio
Michael T. Raggo has over 20 years of security research experience. Over the years he has uncovered numerous vulnerabilities in products including Samsung, Checkpoint, and Netgear. His current research focuses on hybrid cloud security risks and threats. Michael is the author of “Mobile Data Loss: Threats & Countermeasures” and “Data Hiding” for Syngress Books, and contributing author for “Information Security the Complete Reference 2nd Edition”. His Data Hiding book is also included at the NSA’s National Cryptologic Museum at Ft. Meade. A former security trainer, Michael has briefed international defense agencies including the FBI, Pentagon, and Queensland Police; and is a former participating member of FSISAC/BITS and the PCI Council. He is also a frequent presenter at security conferences, including Black Hat, DEF CON, Gartner, RSA, DoD Cyber Crime, OWASP, HackCon Norway, and SANS. He was also awarded the Pentagon’s Certificate of Appreciation.
5:55 – 6:00 Closing Comments

Save The Date: VIRTUAL NJ ISSA Chapter Meeting on 9/29/2021
2021-09-29 16:00 - 18:00
New Jersey Chapter ISSA Meeting
Date: Wednesday, September 29th, 4:00pm – 6:00pm
Venue: Remote via Zoom (NJ ISSA Members will receive an email with Zoom instructions. Please use a contact form to request dial in details if you did not receive the email.)
3:55 – 4:00 Check In/Registration
4:00 – 4:15 NJ ISSA Chapter Updates
4:15 – 5:00 Presentation: The Past, Present and Future of Strong Authentication
Ashwin Rana, Chief Solutions Architect, Beyond Identity
Abstract
Authentication is a foundational element of every cybersecurity program. With more than 80% of data breaches and a large portion of ransomware incidents stemming from credential-based attacks (e.g., phishing, credential stuffing, RDP brute, etc.), it has become clear that passwords are a fatally flawed authentication method.
Speaker Bio
Ashwin has served as Chief Technical Architect at Zscaler, Director of Product Management at Nokia Networks, Senior Director of System Architecture and Product Management at AudioCodes, Inc., Director of Product Management at Netrake, among others. Ashwin received a bachelor’s degree in electrical and electronics engineering from Sardar Patel University and a master’s degree in electrical, electronics, and communications engineering from The University of Texas at Dallas.
5:00 – 5:15 Break
5:15 – 6:00 Group Discussion: Information Security Headlines
Information security incidents and media headlines are omnipresent. We will be reviewing a few interesting recent security headlines and discuss as a group – sharing collective insights, and approaches that organizations can take to respond to similar challenges we face around Cybersecurity today.
5:55 – 6:00 Closing Comments

Save The Date: VIRTUAL NJ ISSA Chapter Meeting on 12/15/2021
2021-12-15 16:00 - 18:00
New Jersey Chapter ISSA Meeting
Date: Wednesday, December 15th, 4:00pm – 6:00pm
Venue: Remote via Zoom (NJ ISSA Members will receive an email with Zoom instructions. Please use a contact form to request dial in details if you did not receive the email.)
3:55 – 4:00 Check In/Registration
4:00 – 4:15 NJ ISSA Chapter Updates
4:15 – 5:55 Pharma Drama: An Interactive Crisis Simulation of an Insider Threat
Jake Alosco and Jeffrey Wu, Immersive Labs
Abstract
Pharma is vulnerable. The sector, which bridges the healthcare–business divide and deals extensively with data and intellectual property (IP), is a tantalizing prospect for malicious actors. It is now one of the most targeted sectors, with over a fifth of companies suffering at least seven attacks.
Perhaps the greatest threat facing the pharma industry, however, lies inside the walls. That’s because insider threats are as much a public health issue as they are an economic one; they hamper a pharma company’s ability to remain competitive, and thus pose a risk to potential patients. IP may become inaccessible, which could affect drug production and lead to medicine running short.
This interactive webinar throws attendees into an emerging insider threat simulation taking place at a fictional pharmaceutical company. In this scenario, participants must use their decision-making skills to find the insider threat, manage the growing crisis, and prevent the loss of potentially billions of dollars.
During this session we will:

See the impact of the human element in crisis management and response
Gain a greater understanding of how decisions in a threat scenario have a business-wide impact
Discover how to strengthen your organization on both sides of “the boom”, so it’s as ready before the impact as it is after it

Speaker Bios
Jake Alosco is Senior Director of Channel Sales at Immersive Labs, working closely with partners to help business leaders drive Cyber Workforce Optimization within their organization. Prior to Immersive Labs, Jake held various channel specific roles for Contrast Security, Avecto, and Veracode.
Jeffrey Wu serves as an Enterprise Sales Engineer for Immersive Labs, helping organizations to optimize their cyber workforces to meet ever-evolving threats. Prior to Immersive Labs, Jeffrey held Engineering roles at VMware, Carbon Black, and United Electronic Industries. Jeffrey graduated from Tufts University with a BS in Electrical Engineering.
5:55 – 6:00 Closing Comments

Save The Date: VIRTUAL NJ ISSA Chapter Meeting on 3/30/2022
2022-03-30 16:00 - 18:00
New Jersey Chapter ISSA Meeting
Date: Wednesday, March 30th, 4:00pm – 6:00pm
Venue: Remote via Zoom (NJ ISSA Members will receive an email with Zoom instructions. Please use a contact form to request dial in details if you did not receive the email.)
3:55 – 4:00 Check In/Registration
4:00 – 4:15 NJ ISSA Chapter Updates
4:15 – 5:55 Cloud Security Controls
Jonathan Villa, GuidePoint
Abstract
Many organizations have attempted to align their cloud security programs to existing industry standards while their cloud teams seek to implement controls using cloud-native services. Unfortunately, because most standards were written for brick-and-mortar data centers, many requirements become “not applicable” or are deferred to the CSP. GuidePoint Security will discuss how organizations can implement CSA CCM controls using AWS services by walking through examples of people, process and technology within the specific scope of cloud computing.
Speaker Bios
Jonathan Villa has worked as a technology and security for over 20 years. Jonathan has consulted to organizations in various verticals and across varying sizes ranging from startups to enterprises. Jonathan has architected and managed automated CI environments since the mid-2000’s that included static and dynamic code analysis for over 150 applications being deployed to several distinct environments and platforms. Jonathan is currently the national Practice Director for GuidePoint Security’s Cloud Security Practice and has worked with early stage FinTech startups as a co-founder and advisor since 2007 by designing cloud-first security programs that meet industry and regulatory compliance requirements. Jonathan continues to stay active as a technologist through advising organizations throughout their cloud transformation journey.
5:55 – 6:00 Closing Comments

Save The Date: VIRTUAL NJ ISSA Chapter Meeting on 6/28/2023
2023-06-28 16:00 - 17:30
New Jersey Chapter ISSA Meeting
Date: Wednesday, June 28th, 4:00pm – 6:00pm
Venue: Remote via Zoom (NJ ISSA Members will receive an email with Zoom instructions. Please use a contact form to request dial in details if you did not receive the email.)
4:00 Check In/Registration
4:00 – 4:15 NJ ISSA Chapter Updates
4:15 – 5:45 Best Practices in Storytelling: What You MUST Implement to Effectively Communicate and Security and Risk Management
Jeffrey Wheatman, SVP, Cyber Risk Evangelist, Black Kite
Abstract
“Once upon a time” are the most powerful words in the English language. Why? Because storytelling is as old as human communication itself. Why do we tend to compile data, charts, graphs, facts and opinions and throw them at an audience for ingestion and likely misinterpretation? We need to learn how to construct a story that effectively communicates messages, goals and objectives to the business executives in your organization. In this presentation, attendees will learn:

What is storytelling and how does it work?
How to create the elements of good stories that get our points across without drowning the audience in unnecessary details
Best practices in delivering your stories to focus on messages that garner support for program actions

Speaker Bio
A strategic thought leader with extensive expertise in security and cyber risk management, Jeffrey Wheatman is regarded as a foremost expert in guiding public sector clients and Fortune 500 companies in connection with their cybersecurity and risk management programs. Jeffrey’s history of working with clients to plan, grow, and transform their cyber risk management programs has been instrumental in ensuring organizations’ continued
viability and health as they define short- and long-term expansion plans. Under Jeffrey’s guidance, board and C-level leaders are fortified with the best practice solutions to realize exceptional performance outcomes.
In his current capacity as SVP, Cyber Risk Evangelist at Black Kite, Jeffrey has been tasked with raising awareness of the enterprise-wide risk impacts of third party risk, both in the digital and traditional supply chain and supporting the strategic vision of the executive leadership team and investors.
Most recently, Jeffrey acted as a VP, Advisor with Gartner, the global strategic advisory firm, where he worked with clients to build and improve their security programs, assess risk, focus on reporting on program status, metrics, performance management, stakeholder engagement, executive communication, and bridging the connection between technology and security risk. Jeffrey guided leaders in selecting frameworks to run cyber programs in compliance with regulatory requirements and expectations of auditors and partners.
Jeffrey has extensive experience engaging with executive leaders and board members. Jeffrey has prepared security and risk leaders to present before a board; he has reviewed and advised on upwards of 500 board presentations and briefed 60+ boards of directors to understand their role in managing cyber risk.
For four years, Jeffrey served as the Chair of the North America Security and Risk Management Summit, Gartner’s 2nd largest conference with 4000+ annual attendees. As part of this high-profile effort, he guided the creation of the conference agenda comprising more than 150 presentations, 20 case studies, external keynote speakers, and 50 vendor sessions.
5:15 – 5:30 Closing Comments
