- Open Sessions
- Conference Pass
- SecureWorld Plus
- VIP / Exclusive
- Tuesday, October 29, 20197:00 amRegistration openRegistration Level:
- Open Sessions
7:00 am - 3:00 pmLocation / Room: Registration DeskCome to the Registration desk in the lobby to check-in and get your badge. SecureWorld staff will be available throughout the day if you have any questions.
7:30 amAdvisory Council Breakfast – (VIP / INVITE ONLY)Topic: The Journey to the Cloud – Roadblocks, Pitfalls & Silver LiningsExecutive Director of Cybersecurity & Infrastructure, Focus on the FamilyRegistration Level:- VIP / Exclusive
7:30 am - 8:30 amLocation / Room: 3rd Floor BoardroomDenver Advisory Council Kickoff (Advisory Council members only)
Join us for breakfast and coffee.8:00 amExhibitor Hall openRegistration Level:- Open Sessions
8:00 am - 3:00 pmLocation / Room: SecureWorld Exhibitor FloorYour opportunity to visit our solution vendor partners, whose sponsorship makes SecureWorld possible! Booths have staff ready to answer your questions. Look for participating Dash For Prizes sponsors to be entered to win prizes.
8:00 am[SecureWorld PLUS] Part 1 - Designing and Building a Cybersecurity Program based on the NIST Cybersecurity FrameworkEarn 16 CPEs With This in-Depth 3-Part CourseSr. Cybersecurity Consultant, Wilson CyberRegistration Level:- SecureWorld Plus
8:00 am - 9:30 amLocation / Room: ACA/TriaxThe University of Massachusetts has developed a 6 hour SecureWorld Plus training class that instructs attendees on the best practices for designing, building, and maintaining a Cybersecurity Program based on the NIST Cybersecurity Framework. Organizations who currently use the Framework or are planning to use the Framework for their cybersecurity program will benefit from this course.
This innovative education and training program includes the following key elements:
- An introduction to the key components of the NIST Cybersecurity Framework
- How to use the Framework to support business strategy, technology strategy, and cyber-risk strategy
- An approach for adopting the framework to build and sustain secure and resilient infrastructure, secure and resilient networks, secure and resilient applications
- How to use the framework to protect critical information assets
- A Controls Factory Model that organizations use to create an Engineering Program, a Technical Program and a and Business / Management Program
- A methodology for developing a Cybersecurity Strategy, System Security Plan (SSP), Risk Assessment, Plan of Action and Milestones (POA&M) and Executive Report
The class will help individuals and organizations acquire knowledge, skills and abilities to:
- Develop a strategy to apply the NIST Cybersecurity Framework (NCSF) to their environment
- Create a comprehensive System Security Plan (SSP) based on the NIST Cybersecurity Framework
- Conduct a Risk Assessment to compare the current profile with the target profile and identify any gaps that need to be addressed
- Develop a Plan of Action and Milestones (POA&M) to mitigate the highest priority gaps
- Establish an Executive Report to measure and communicate current profile, target profile, POA&M and program plan / roles and responsibilities to remediate identified gaps
- Identify required workforce skills and develop career pathways for improving skills and experience
About the Instructor – Larry Wilson:
- Larry Wilson is the former CISO for UMass President’s Office from 2009 to 2017
- Prior to UMass, Larry developed and managed the Global Infrastructure Services (GIS) Security Program for State Street Corporation
- Larry has been teaching cybersecurity courses based on the NIST Cybersecurity Framework at SecureWorld events for the past 5 years
- Larry has conducted over 20 consulting engagements, helping organizations design and build cybersecurity programs based on the NIST Cybersecurity Framework
The program and its author have won the following industry awards:
- Security Magazine’s Most Influential People in Security, 2016
- SANS People Who Made a Difference in Cybersecurity Award, 2013
- Information Security Executive (ISE) North America Program Winner for Higher Education, 2013
8:00 amSecureWorld PLUS Part 1 - Cloud Security TrainingEarn 16 CPEs With This in-Depth 3-Part CourseDirector, Enterprise Security Architecture, Colorado Governor's Office of ITRegistration Level:- SecureWorld Plus
8:00 am - 9:30 amLocation / Room: Barco LibraryThe 3-part Cloud Security course will immerse students/attendees into the new frontier of IT and security services delivery in the Cloud. Using proven engaged learning techniques, students will leave the session with a solid Cloud Security knowledge and skills combined with applied hands-on on the most popular Cloud Services Provider.
Course Outline:
- Cloud Computing Governance, Risk, and Compliance (GRC)
- Cloud Identity and Access Management (IAM)
- Cloud Network Security
- Cloud Compute Security
- Cloud Storage Security
- Cloud Application Security (DevSecOps)
- Cloud Operation Security
By the end of the session you will:
- Have a solid understanding of the Cloud Computing and Security based on NIST and ISO/IEC.
- Be able to evaluate the security posture of any Cloud Service Providers (CSP) Using FedRAMP and CSA CCM.
- Be able to select, design, and deploy secure cloud services based on the business requirements
- Use the knowledge and skill learned as a foundation to pursue popular Cloud Security Certifications such as CSA CCSK, ISC2 CCSP, and AWS Security
To maximize the benefit of the class, the student needs to:
- Have a Curious, and eager to learn.
- Ask, Ask, and Ask questions
- Bring their own laptops to participate in the labs and capture valuable information
- Have an AWS free account at https://aws.amazon.com/free
Course Outline:
- Cloud Computing Governance, Risk, and Compliance (GRC)
- Cloud Identity and Access Management (IAM)
- Cloud Network Security
- Cloud Compute Security
- Cloud Storage Security
- Cloud Application Security (DevSecOps)
- Cloud Operation Security
8:30 am(ISC)2 Chapter Meeting and Guest Presentation - Open to All AttendeesTopic: Who's Your Hacker? ... And Why It MattersLead Security Architect, Colorado Judicial DepartmentRegistration Level:- Open Sessions
8:30 am - 9:15 amLocation / Room: Bresnan BoardroomJoin (ISC)2 for a chapter meeting and guest presentation. This is for chapter members and anyone interested in learning more about the association.
Presentation: Because no organization is 100% unhackable, organizations establish “acceptable” levels of risk. We then build our security strategy around the risk of our organization being hacked. In that case, how much of a role does the hacker play in that risk analysis? In this presentation, the speaker will share perspectives about security intelligence for your program. If there is time, he will give a short demo of a free tool and share ideas on how you can use this in your own organization’s security strategy.8:30 amUsing Vault to Better Protect Your SecretsSr. Software Engineer, GroupOnRegistration Level:- Conference Pass
8:30 am - 9:15 amLocation / Room: CT+TAll developers have seen it and few will admit to doing it. Putting unprotected authentication credentials like usernames and passwords or cloud service authentication keys into application code or scripts. This talk is for developers of all levels who are interested in a better way to manage their secrets and become the next hero with their security department. (Your results may vary.) 8:30 amInfraGard Chapter Meeting and Guest Presentation - Open to all AttendeesTwo-Part Guest Presentation: CISA and FBI's Private Sector Outreach ProgramCybersecurity Advisor, DHS / CISASpecial Agent / Private Sector Coordinator, FBI DenverConsultant, Advisory Services, Ernst & YoungRegistration Level:- Open Sessions
8:30 am - 9:15 amLocation / Room: Keynote TheaterTwo- Guest Presentation
Part 1: CISA: What You Should Know and How to Access New Resources to Protect Your Organization
Presented by: David Sonheim, Cybersecurity Advisor, DHS/CISAThe threats and threat actors facing our nation are becoming more complex than any point in our history. In 2018, a new cybersecurity agency was developed under the oversight of the Department of Homeland Security: Cybersecurity and Infrastructure Security Agency (CISA). CISA is mobilizing a collective defense that seeks to understand and manage risk to our critical infrastructure.
Learn about how CISA will impact your organization, and how to access the free tools and resources that are now available. We will explore:- An overview of CISA
- Cybersecurity Assessment Offerings
- Cybersecurity Service Catalog Offerings
- Cyber Incident Reporting Guidelines
- MS-ISAC Service Offerings
Part 2: Overview of the FBI’s Private Sector Outreach Program
Presented by: Christopher Calarco, Special Agent/Private Sector Coordinator, FBI DenverLearn about the FBI’s Private Sector Outreach Program, including the FBI’s Infragard program. We will discuss generational threats facing the country and why it is important to adopt a cross-sector approach to address these threats. Attendees will walk away with a better understanding of government resources that are available to address cyber threats, as well as a better understanding of the importance of public-private partnerships in protecting the nation’s economic and national security.
9:30 am[OPENING KEYNOTE] Business Email Compromise: Real World Stories and Practical DefenseSpecial Agent, Global Investigative Operations Center, United States Secret ServiceRegistration Level:- Open Sessions
9:30 am - 10:15 amLocation / Room: Keynote TheaterThe average loss from a bank robbery is about $3,000. The average loss from a successful Business Email Compromise (BEC) attack is nearly $130,000. That kind of math explains why BEC is rampant, and every type of organization is at risk. During this presentation, hear from the point person on BEC cases investigated by the U.S. Secret Service. He’ll share true crime examples of and practical steps for defense against BEC losses, which now stand at $13.5 billion in the last six years.
10:15 amConference Break / Exhibitor Product DemonstrationRegistration Level:- Open Sessions
10:15 am - 11:15 amLocation / Room: SecureWorld Exhibitor FloorReboot with coffee and infused water while visiting exhibitors on the exhibitor floor.
11:00 amAdvisory Council Roundtable - (VIP / Invite Only)Topic: 3rd Party Risk - Creating & Managing a Program that WorksCISO, The Anschutz CorporationRegistration Level:- VIP / Exclusive
11:00 am - 12:00 pmLocation / Room: 3rd Floor BoardroomThis session is for Advisory Council members only.
11:15 am[Panel] Knowledge Is Power: Women in CybersecurityCISO & C-Suite Advisor, Check Point Software TechnologiesChief Information & Digital Officer, City of AuroraIT Security Manager, Department of Information Technology, Weld CountyVP, Network Security Operations, Charter CommunicationsRegistration Level:- Conference Pass
11:15 am - 12:00 pmLocation / Room: Bresnan BoardroomIt is often said that true knowledge must be gained through experience; either through one’s own life or through others. Join this opportunity to hear from women who bring perspectives from diverse industries (retail, financial, healthcare, utilities) as they share their different experiences as women living the information security career journey.
11:15 am[Radware] Cybersecurity Pushed to the LimitSecurity Evangelist, North America, RadwareRegistration Level:- Open Sessions
11:15 am - 12:00 pmLocation / Room: SaemonThroughout 2018 mainstream headlines highlighted cyber-attacks and security threats that included possible interference in the U.S. presidential election, worldwide malware outbreaks and the Equifax data breach. These and other high-profile events spurred greater cyber-defense investment by everyone from nation states and global corporations to individuals purchasing anti-malware solutions for personal devices. Yet even as investments increase so do threats, hacks and vulnerabilities. This session will help you understand these complex and challenging dynamics. Based on findings from Radware’s research and a global industry survey, the session will show real attack data and customer stories to paint a picture of where we are and what security professionals can do.
Join the session to learn more about:
• The threat landscape deep dive—the who, what and why of attacks
• Potential impact on your business, including associated costs of different cyber-attacks
• Critical attacks in the midst: DNS, IoT and risks lurking in the cloud
• Emerging threats and how to protect against them
• A look ahead – predictions and what to prepare for11:15 amISACA Chapter Meeting & Guest Presentation - Open to all AttendeesPresenting: Threat Intelligence - The Humans, The SIEMs, and the AnalyticsSr. Security Engineer in SOC Operations, Forensics, and Threat Hunting, Pulte Financial ServicesRegistration Level:- Open Sessions
11:15 am - 12:00 pmLocation / Room: CT+TThe landscape of SOC .vs. Threat has become a game of brinkmanship and 7/24 risk. In the past 8 years as the stakes continue to escalate, tactics are the pivotal point. It’s no longer sufficient to have effective defenses, its essential to characterize threats as they view us: targets. This presentation analyzes the integration of tools, data resources, and human intuition to weigh and plan responses to secure resources.
Objectives:
• Base-lining & integrate SIEM, IPS, & defensive tools
• Discussion, history, and review of Threat Intel as it applies to ‘us’ as targets
• Integrating human logic to field and effective force12:00 pmAdvisory Council LUNCH Roundtable – (VIP / Invite Only)Topic: Security Workforce - Staffing/Retention, Fair Wages, OutsourcingExecutive Director of Cybersecurity & Infrastructure, Focus on the FamilyRegistration Level:- VIP / Exclusive
12:00 pm - 1:00 pmLocation / Room: 3rd Floor BoardroomThis session is for Advisory Council members only.
Lunch will be served during this roundtable discussion.12:15 pm[LUNCH KEYNOTE] 7 Ways To Boost InfoSec’s Influence (and Yours) by Communicating DifferentlyDirector of Media & Content, Podcast Host, SecureWorldRegistration Level:- Open Sessions
12:15 pm - 1:00 pmLocation / Room: Keynote TheaterGrow your personal influence, your leadership possibilities and move your InfoSec objectives forward (faster) by thinking differently about how you communicate. Whether your audience is the board, your team, or any part of the business, this session will help you and your communication stand out. Lead by a long-time TV reporter turned cybersecurity journalist who shares a framework for powerful communication you can implement immediately.
1:15 pm[Panel] Building a Better Mouse Trap (Emerging Threats)Registration Level:- Open Sessions
1:15 pm - 2:15 pmLocation / Room: Keynote TheaterTo be successful, as an industry, we must strive to get ahead of the bad guys. Easy enough to say but how? By taking a look at the capabilities of the threats we see today we should be able to make some educated guesses on what threats of tomorrow will look like. We know the bad guys don’t follow the rules, take the path of least resistance, and don’t care who they hurt in the process. We need to start thinking like them so that we can figure out what their next step is instead of guessing/hoping.
Panelists:
Ron Winward, Radware
Mark Lindgren, SpyCloud
David Wolpoff, Randori
Moderator: Greg Sternberg, Sungard Availability Services1:15 pm[Panel] Cloudy With a Chance of BreachRegistration Level:- Open Sessions
1:15 pm - 2:15 pmLocation / Room: Bresnan BoardroomEverything old is new again. Migrating to the cloud certainly is not a new thing. It is for some smaller companies that are just now able to afford making the move to the cloud. Cloud boasts a secure, disaster proof option for companies to store their data offsite with access to that data from practically anywhere. So, who’s fault is it when the data is compromised? What if your information is stolen from the cloud because another user’s data was at fault? At the end of the day, isn’t the cloud just someone else’s computer? Join this panel discussion as they guide you through the pros and cons in migrating to the cloud.
Panelists
Jeff Frier, Bitglass
Jay Wilson, Healthgrades
Rhett Saunders, Focus on the Family
Bruce Potter, Expel
Moderator: Sam Masiello, Gates Corporation1:15 pm[Darktrace] Cyber AI: Fighting Back with Autonomous ResponseDirector, DarktraceRegistration Level:- Open Sessions
1:15 pm - 2:15 pmLocation / Room: CT+TThe digital enterprise is constantly expanding, with new IoT, cloud, and operational technologies all challenging traditional notions of cyber security. Safeguarding these evolving environments against machine-speed attacks has never been more difficult.
Yet the digital battleground now features its most formidable defender in Cyber AI — a self-learning technology that distinguishes friend from foe in order to thwart threats autonomously. With the Cyber AI Platform protecting your entire infrastructure in real time, it doesn’t matter whether the attack originates on a connected device, an industrial system, or in the cloud. Wherever it strikes, the AI fights back in seconds.
In this session, you’ll discover:- Why only Autonomous Response can counter today’s machine-speed attacks
- Where advanced threat-actors exploit vulnerabilities in the cloud and IoT
- What achieving 100% visibility can reveal about your organization’s risk profile
- How the Cyber AI Analyst reduces the time spent triaging threats by 92%
1:15 pm[OneTrust] Third-Party Risk Management: Overcoming Today’s Most Common Security & Privacy ChallengesThird-Party Risk Offering Manager, OneTrustRegistration Level:- Open Sessions
1:15 pm - 2:15 pmLocation / Room: SaemonManaging third-party vendor risk before, during and after onboarding is a continuous effort under global privacy laws and security regulations. While outsourcing operations to vendors can alleviate business challenges, managing the associated risk with manual tools like spreadsheets is complex and time consuming. To streamline this process, organizations must put procedures in place to secure sufficient vendor guarantees and effectively work together during an audit, incident – or much more. In this session, we’ll breakdown a six-step approach for automating third-party vendor risk management and explore helpful tips and real-world practical advice to automate third-party privacy and security risk programs.
Presentation Level:
GENERAL (InfoSec best practices, trends, solutions, etc.)2:15 pmConference Break / Exhibitor Product DemonstrationRegistration Level:- Open Sessions
2:15 pm - 3:00 pmLocation / Room: SecureWorld Exhibitor FloorReboot with coffee and infused water while visiting exhibitors on the exhibitor floor.
3:00 pmCISO Ventures Panel: Are Cybersecurity Startups Meeting Expectations of Buyers Taking a Risk on Them?Founder & Managing Director, Whiteboard Venture PartnersCISO, Elevations Credit UnionCISO, The Anschutz CorporationDirector of Product Security, CollibraRegistration Level:- Conference Pass
3:00 pm - 3:45 pmLocation / Room: Bresnan BoardroomThe number of cyber startups is growing exponentially, with 4300+ cybersecurity companies worldwide including several private “unicorns”. With so many startups engaged in helping organizations achieve cybersecurity outcomes, how do organizational decision makers think about the risks involved in working with them? A panel of CXOs will share their expectations of and experiences with cybersecurity startups, including how they use solutions from startups to meet existing and emerging cybersecurity challenges.
3:00 pmBuilding a Cybersecurity Program: Lessons Learned from a New CISOCISO, Denver HealthRegistration Level:- Conference Pass
3:00 pm - 3:45 pmLocation / Room: SaemonThe first few years in a CISO role can offer unique challenges and opportunities. Gain insight into a new CISO’s experience building a security program and doing all the things necessary to be successful. We will discuss key learnings and takeaways about the importance of relationships, strategic vs. technical/tactical efforts, managing vendors, leading a team, and keeping up with emerging threats and new technology.
Presentation Level: MANAGERIAL (security and business leaders)3:00 pmIncident Response Execution - Interactive ExerciseCyber Risk Advisory Board Member, Pepperdine UniversityRegistration Level:- Conference Pass
3:00 pm - 3:45 pmLocation / Room: CT+TMalicious activity is ever changing – therefore the approach of incident response must also change. It is essential for incident responders to expand beyond traditional incident response activities by digging deeper into alerts. In this interactive session, incident responders will have the opportunity to practice problem solving through real life scenarios by pivoting off data points, threat hunting, and proposing viable solutions that expand beyond conventional response activities.
3:00 pm[SecureWorld PLUS] Part 2 - Designing and Building a Cybersecurity Program based on the NIST Cybersecurity FrameworkSecureWorld PLUS Registrants ONLYSr. Cybersecurity Consultant, Wilson CyberRegistration Level:- SecureWorld Plus
3:00 pm - 4:30 pmLocation / Room: ACA/TriaxThe University of Massachusetts has developed a 6 hour SecureWorld Plus training class that instructs attendees on the best practices for designing, building, and maintaining a Cybersecurity Program based on the NIST Cybersecurity Framework. Organizations who currently use the Framework or are planning to use the Framework for their cybersecurity program will benefit from this course.
This innovative education and training program includes the following key elements:
- An introduction to the key components of the NIST Cybersecurity Framework
- How to use the Framework to support business strategy, technology strategy, and cyber-risk strategy
- An approach for adopting the framework to build and sustain secure and resilient infrastructure, secure and resilient networks, secure and resilient applications
- How to use the framework to protect critical information assets
- A Controls Factory Model that organizations use to create an Engineering Program, a Technical Program and a and Business / Management Program
- A methodology for developing a Cybersecurity Strategy, System Security Plan (SSP), Risk Assessment, Plan of Action and Milestones (POA&M) and Executive Report
The class will help individuals and organizations acquire knowledge, skills and abilities to:
- Develop a strategy to apply the NIST Cybersecurity Framework (NCSF) to their environment
- Create a comprehensive System Security Plan (SSP) based on the NIST Cybersecurity Framework
- Conduct a Risk Assessment to compare the current profile with the target profile and identify any gaps that need to be addressed
- Develop a Plan of Action and Milestones (POA&M) to mitigate the highest priority gaps
- Establish an Executive Report to measure and communicate current profile, target profile, POA&M and program plan / roles and responsibilities to remediate identified gaps
- Identify required workforce skills and develop career pathways for improving skills and experience
About the Instructor – Larry Wilson:
- Larry Wilson is the former CISO for UMass President’s Office from 2009 to 2017
- Prior to UMass, Larry developed and managed the Global Infrastructure Services (GIS) Security Program for State Street Corporation
- Larry has been teaching cybersecurity courses based on the NIST Cybersecurity Framework at SecureWorld events for the past 5 years
- Larry has conducted over 20 consulting engagements, helping organizations design and build cybersecurity programs based on the NIST Cybersecurity Framework
The program and its author have won the following industry awards:
- Security Magazine’s Most Influential People in Security, 2016
- SANS People Who Made a Difference in Cybersecurity Award, 2013
- Information Security Executive (ISE) North America Program Winner for Higher Education, 2013
3:00 pmSecureWorld PLUS Part 2- Cloud Security TrainingSecureWorld PLUS Registrants ONLYDirector, Enterprise Security Architecture, Colorado Governor's Office of ITRegistration Level:- SecureWorld Plus
3:00 pm - 4:30 pmLocation / Room: Barco LibraryThe 3-part Cloud Security course will immerse students/attendees into the new frontier of IT and security services delivery in the Cloud. Using proven engaged learning techniques, students will leave the session with a solid Cloud Security knowledge and skills combined with applied hands-on on the most popular Cloud Services Provider.
Course Outline:
- Cloud Computing Governance, Risk, and Compliance (GRC)
- Cloud Identity and Access Management (IAM)
- Cloud Network Security
- Cloud Compute Security
- Cloud Storage Security
- Cloud Application Security (DevSecOps)
- Cloud Operation Security
By the end of the session you will:
- Have a solid understanding of the Cloud Computing and Security based on NIST and ISO/IEC.
- Be able to evaluate the security posture of any Cloud Service Providers (CSP) Using FedRAMP and CSA CCM.
- Be able to select, design, and deploy secure cloud services based on the business requirements
- Use the knowledge and skill learned as a foundation to pursue popular Cloud Security Certifications such as CSA CCSK, ISC2 CCSP, and AWS Security
To maximize the benefit of the class, the student needs to:
- Have a Curious, and eager to learn.
- Ask, Ask, and Ask questions
- Bring their own laptops to participate in the labs and capture valuable information
- Have an AWS free account at https://aws.amazon.com/free
Course Outline:
- Cloud Computing Governance, Risk, and Compliance (GRC)
- Cloud Identity and Access Management (IAM)
- Cloud Network Security
- Cloud Compute Security
- Cloud Storage Security
- Cloud Application Security (DevSecOps)
- Cloud Operation Security
- Wednesday, October 30, 20197:00 amRegistration openRegistration Level:
- Open Sessions
7:00 am - 3:00 pmLocation / Room: Registration DeskCome to the Registration desk in the lobby to check-in and get your badge. SecureWorld staff will be available throughout the day if you have any questions.
8:00 am[SecureWorld PLUS] Part 3 - Designing and Building a Cybersecurity Program based on the NIST Cybersecurity FrameworkSecureWorld PLUS Registrants ONLYSr. Cybersecurity Consultant, Wilson CyberRegistration Level:- SecureWorld Plus
8:00 am - 9:30 amLocation / Room: ACA/TriaxThe University of Massachusetts has developed a 6 hour SecureWorld Plus training class that instructs attendees on the best practices for designing, building, and maintaining a Cybersecurity Program based on the NIST Cybersecurity Framework. Organizations who currently use the Framework or are planning to use the Framework for their cybersecurity program will benefit from this course.
This innovative education and training program includes the following key elements:
- An introduction to the key components of the NIST Cybersecurity Framework
- How to use the Framework to support business strategy, technology strategy, and cyber-risk strategy
- An approach for adopting the framework to build and sustain secure and resilient infrastructure, secure and resilient networks, secure and resilient applications
- How to use the framework to protect critical information assets
- A Controls Factory Model that organizations use to create an Engineering Program, a Technical Program and a and Business / Management Program
- A methodology for developing a Cybersecurity Strategy, System Security Plan (SSP), Risk Assessment, Plan of Action and Milestones (POA&M) and Executive Report
The class will help individuals and organizations acquire knowledge, skills and abilities to:
- Develop a strategy to apply the NIST Cybersecurity Framework (NCSF) to their environment
- Create a comprehensive System Security Plan (SSP) based on the NIST Cybersecurity Framework
- Conduct a Risk Assessment to compare the current profile with the target profile and identify any gaps that need to be addressed
- Develop a Plan of Action and Milestones (POA&M) to mitigate the highest priority gaps
- Establish an Executive Report to measure and communicate current profile, target profile, POA&M and program plan / roles and responsibilities to remediate identified gaps
- Identify required workforce skills and develop career pathways for improving skills and experience
About the Instructor – Larry Wilson:
- Larry Wilson is the former CISO for UMass President’s Office from 2009 to 2017
- Prior to UMass, Larry developed and managed the Global Infrastructure Services (GIS) Security Program for State Street Corporation
- Larry has been teaching cybersecurity courses based on the NIST Cybersecurity Framework at SecureWorld events for the past 5 years
- Larry has conducted over 20 consulting engagements, helping organizations design and build cybersecurity programs based on the NIST Cybersecurity Framework
The program and its author have won the following industry awards:
- Security Magazine’s Most Influential People in Security, 2016
- SANS People Who Made a Difference in Cybersecurity Award, 2013
- Information Security Executive (ISE) North America Program Winner for Higher Education, 2013
8:00 amSecureWorld PLUS Part 3 - Cloud Security TrainingSecureWorld PLUS Registrants ONLYDirector, Enterprise Security Architecture, Colorado Governor's Office of ITRegistration Level:- SecureWorld Plus
8:00 am - 9:30 amLocation / Room: Barco LibraryThe 3-part Cloud Security course will immerse students/attendees into the new frontier of IT and security services delivery in the Cloud. Using proven engaged learning techniques, students will leave the session with a solid Cloud Security knowledge and skills combined with applied hands-on on the most popular Cloud Services Provider.
Course Outline:
- Cloud Computing Governance, Risk, and Compliance (GRC)
- Cloud Identity and Access Management (IAM)
- Cloud Network Security
- Cloud Compute Security
- Cloud Storage Security
- Cloud Application Security (DevSecOps)
- Cloud Operation Security
By the end of the session you will:
- Have a solid understanding of the Cloud Computing and Security based on NIST and ISO/IEC.
- Be able to evaluate the security posture of any Cloud Service Providers (CSP) Using FedRAMP and CSA CCM.
- Be able to select, design, and deploy secure cloud services based on the business requirements
- Use the knowledge and skill learned as a foundation to pursue popular Cloud Security Certifications such as CSA CCSK, ISC2 CCSP, and AWS Security
To maximize the benefit of the class, the student needs to:
- Have a Curious, and eager to learn.
- Ask, Ask, and Ask questions
- Bring their own laptops to participate in the labs and capture valuable information
- Have an AWS free account at https://aws.amazon.com/free
Course Outline:
- Cloud Computing Governance, Risk, and Compliance (GRC)
- Cloud Identity and Access Management (IAM)
- Cloud Network Security
- Cloud Compute Security
- Cloud Storage Security
- Cloud Application Security (DevSecOps)
- Cloud Operation Security
8:30 amShared-VPCs, a Cloud Security ArchitectureNetwork Security Architect, CenturyLinkRegistration Level:- Conference Pass
8:30 am - 9:15 amLocation / Room: SaemonThe seminar will cover a cloud architecture related to creating Shared VPCs in major cloud vendors such as Azure, AWS & GCP. The architecture will address a hybrid-cloud environment that allows DevOps to do more of the development and use common tools vetted by IT and Security that streamlines operations. No GUI configs, and nothing too deep in the weeds…we are focused on the security concepts of Shared-VPCs. The audience will walk away with an innovative approach, providing applications standard methods to secure and transfer data between the cloud and traditional data center applications.Presentation Level:
GENERAL (InfoSec best practices, trends, solutions, etc.)8:30 amHow Privacy and Security Work TogetherDirector of Privacy and Compliance, American Cyber Security ManagementGRC Consultant / Privacy & Compliance Specialist, IT Governance USA Inc.Registration Level:- Conference Pass
8:30 am - 9:15 amLocation / Room: Bresnan BoardroomSecurity and privacy professionals can build more trust within the organization when they work together rather than in silos. Come learn how to align these two functions, to reduce duplication of effort while increasing both efficiency and speed to delivery. Understanding a shared responsibility model and proactively defining the privacy and security roles and responsibilities will enable your organizations to better understand how to protect the data that it collects, processes, and stores.
Presentation Level: MANAGERIAL (security and business leaders)8:30 amIndustrial Security: Bridging the Gap Between OT and ITInformation Security Officer, Johns ManvilleIndustrial Security Manager, Johns ManvilleRegistration Level:- Conference Pass
8:30 am - 9:15 amLocation / Room: CT+TIndustrial Control Systems (ICS) are becoming a bigger part of our manufacturing operations and yet few companies truly understand how vulnerable they really are. Much of the problem lies in the lack of communications between the Information Technology and Operational Technology departments. Chris McLaughlin (IT) and Scott Reynolds (Engineering) will share some of the common gaps in understanding that exist between IT and Engineering. This presentation will cover some common ICS vulnerabilities that most IT security teams are unaware of, and will provide tips on how to bridge the communication gap.
9:00 amExhibitor Hall openRegistration Level:- Open Sessions
9:00 am - 3:00 pmLocation / Room: SecureWorld Exhibitor FloorYour opportunity to visit our solution vendor partners, whose sponsorship makes SecureWorld possible! Booths have staff ready to answer your questions. Look for participating Dash For Prizes sponsors to be entered to win prizes.
9:30 am[OPENING KEYNOTE] The Colorado = Security Podcast LIVEJoin podcast hosts Robb Reck and Alex Wood as they interview Dale Drew, CSO of Zayo Group.Chief Security Officer, Zayo GroupCo-Host, Colorado = Security PodcastCISO, Uplight; Co-Host, Colorado = Security podcastRegistration Level:- Open Sessions
9:30 am - 10:30 amLocation / Room: Keynote TheaterCome hear Colorado’s #1 security podcast live on the SecureWorld Denver keynote stage! Join podcast hosts Robb Reck (CISO of Ping Identity) and Alex Wood (CISO of Pulte Financial Services) as they update us on the news from the Colorado tech and security scene, and interview Dale Drew, CSO for Zayo Group.
Dale has run security for Zayo Group over the past year and a half, responsible for securing more than 1400 global locations and over 100,000 production elements. Previous to serving at Zayo, Dale was the Chief Security Officer for Level3. He served for Level3 for over 19 years, through numerous mergers and acquisitions, including their acquisition by CenturyLink.
Colorado = Security has one mission – to make Colorado the mecca for information security. Find more information at colorado-security.com10:15 amConference Break / Exhibitor Product DemonstrationRegistration Level:- Open Sessions
10:15 am - 11:15 amLocation / Room: SecureWorld Exhibitor FloorReboot with coffee and infused water while visiting exhibitors on the exhibitor floor.
10:15 amMark Gelhardt Book Signing in the CyberLounge on the Exhibitor FloorQuantities are limited and will be distributed on a first-come, first-served basis.Registration Level:- Open Sessions
10:15 am - 12:00 pmLocation / Room: CyberLounge on the Exhibitor FloorMark Gelhardt will be signing copies of his book, “My Time at The Clinton White House.”
Find him in the CyberLounge on the Exhibitor Floor at the following times:
10:15 a.m. – 12:00 p.m.
1:00-1:15 p.m.
BOOK SYNOPSIS:
Colonel Mark Gelhardt had an atypical military career that landed him in The White House next to the President of the United States, where he was responsible for the last link of communications between the President and the rest of the U.S. government. While a Lieutenant Colonel (LTC) in the Army, Mark was selected by top federal officials to be the Commander of the Data Systems Unit, as part of the White House Communications Agency. In this position, he supported the President as the Chief Information Officer (CIO) for all classified IT used by The White House. LTC Gelhardt served at the White House for over four years (1995-1999), working with President Clinton and his staff almost every day, both on the White House grounds and traveling worldwide. This gave him unfettered access to the inner workings of The White House and the Presidency. Since retiring from the Army in 2001, Mark has been asked by many people about his time at The White House. Mark has many stories about what happened behind closed doors, and proudly speaks about the outstanding support done by the fantastic military members that support the Commander-in-Chief. Mark has taken the time to chronicle his experiences about his day-to-day job at The White House, as well as some of the funny stories he picked up along the way. Please enjoy this non-political book with surprising behind-the-scenes stories. I hope they provide you with some insight to the wonderful military members that work so hard to keep you safe every day in support the of President and Commander-in-Chief.
11:00 amAdvisory Council Roundtable - (VIP / Invite Only)Topic: A Tactical Discussion – Dividing the Big Picture into Short-Term WinsCISO, InsurityRegistration Level:- VIP / Exclusive
11:00 am - 12:00 pmLocation / Room: 3rd Floor BoardroomThis session is for Advisory Council members only.
11:15 am[Panel] Discussion with Huawei’s VP of Risk Management: A Supply Chain Security Case StudyFounder & President, AgeLight Advisory & Research GroupVP, Risk Management & Partner Relations, Huawei Technologies (USA)Registration Level:- Conference Pass
11:15 am - 12:00 pmLocation / Room: CT+TIs Huawei a trade war target or a security risk? Regardless, the Huawei accusations by the U.S. Government have shed light on a crucial fact: increased reliance on new technologies introduces new threats into an ecosystem and supply chains. Join this discussion with Huawei’s VP of Risk Management on mitigating your organization’s supply chain risk by applying stringent criteria to all devices and services. The discussion will include the recent review of Huawei technologies and lessons learned can be applied to every enterprise including best practices advocated by NIST, NTIA, and others. Key tenets include embracing security by design, use of risk-based decision models and sharing threat intelligence data.
Presentation Level:
GENERAL (InfoSec best practices, trends, solutions, etc.)11:15 am[Expel] Get a Grip on Cloud Security: How to Lasso and Protect Your Cloud-Based Data and AppsCISO, ExpelRegistration Level:- Open Sessions
11:15 am - 12:00 pmLocation / Room: SaemonThe cloud is a new frontier, and—just like in those old westerns—it sometimes seems lawless. Decision makers and developers with credit cards are moving their data to Microsoft Azure and AWS, while IT rolls out Office 365. CISOs are getting left in the dust, trying to understand where all the data and apps went and—once they find them—figuring out how to reverse engineer security into the cloud.
The good news is that a smart combination of controls, workflow, and some of the basic tools your cloud providers give you can help you find and reign in outlaw activity.
Join Bruce Potter, CISO of Expel, for this session where he’ll share tips and tricks for thinking about and implementing cloud controls, along with workflow ideas that’ll help protect all your workloads.Presentation Level: MANAGERIAL (security and business leaders)
11:15 amConsumer Rights and Business ResponsibilitiesPartner, Husch Blackwell LLPRegistration Level:- Open Sessions
11:15 am - 12:00 pmLocation / Room: Bresnan BoardroomWhen the California Consumer Privacy Act (CCPA) goes into effect on January 1, 2020, privacy law in the United States will never be the same. During this presentation, we will discuss how the CCPA is changing privacy law in this country, including how its creation of new privacy rights for California residents will impact businesses in 2020 and beyond. We will also discuss Nevada’s amendments to its online privacy statutes (effective October 1, 2019), and what to expect from other state legislatures in 2020.
Presentation Level:
GENERAL (InfoSec best practices, trends, solutions, etc.)11:15 amManage Vulnerabilities Like a Pro: How to Take Your Vulnerability Management Program to the Next LevelCommunity Instructor, SANS InstituteRegistration Level:- Conference Pass
11:15 am - 12:00 pmLocation / Room: ACA/TriaxAt an organizational level, we all have assets and these assets all have vulnerabilities. Most of us have a patching program. Some of us have exception policies. A few of us have automated the entire process, but almost none of us think there isn’t room for improvement in the program as a whole. Join this session to learn how to take your current program to that next level and what it takes to own the vulnerability management cycle in your own organization.
12:00 pmAdvisory Council Lunch Roundtable – (VIP / Invite Only)Topic: Reporting to the Board – Using Meaningful Metrics in a Language we ALL Can UnderstandSecurity Architect, Sungard Availability ServicesRegistration Level:- VIP / Exclusive
12:00 pm - 1:00 pmLocation / Room: 3rd Floor BoardroomThis session is for Advisory Council members only.
Lunch will be served during this roundtable.12:15 pm[LUNCH KEYNOTE] How to Manage Your Own Career to Get to the TopCIO, Georgia State Defense Force, Former CIO, The White HouseRegistration Level:- Open Sessions
12:15 pm - 1:00 pmLocation / Room: Keynote TheaterDo you have a plan for your future? Why not? You are the leader of your own destiny! You need to look at where you are, where you want to go, and have a plan to get there. We will talk about how to develop a plan, what to think about, and how to put one foot in front of the other to get to your end goal. We will also talk about how to manage up to your boss to get what you need to help you in your own career. Col. Mark Gelhardt made it to The White House managing his own career, and stood next to the President of the United States. He will tell you how he did it; if he can do it, so can you! 1:15 pm[Panel] You Got Burned! Now What? (Incident Response)Registration Level:- Open Sessions
1:15 pm - 2:15 pmLocation / Room: Keynote TheaterWe’ve all heard the adage that it’s not if it happens but when you are inevitably breached. Do you have a plan? Even a framework to go off of? What do you include? Who do you include? How often should you be practicing this plan? Join our experts as they discuss incident response plans, who should be involved, best practices, and pitfalls.
Panelists:
John Linzy, Bitdefender
Jason Teplitz, Crowdstrike
Stephen Swanson, Wow!
Moderator: Mary Haynes, Charter Communications1:15 pm[Privacy Panel] A Solution Stack IdeationPresident, American Cyber Security Management (ACSM)Co-Founder, ConsentGridThird-Party Risk Offering Manager, OneTrustDirector, Privacy Program, IBM SecurityRegistration Level:- Open Sessions
1:15 pm - 2:15 pmLocation / Room: Bresnan BoardroomA solution stack focuses on the emerging technologies that businesses need to evaluate in order to implement end-to-end privacy solutions. These complimentary solution providers will discuss their unique privacy solution and where they fit in the enterprise privacy framework.
The audience will have a much broader understanding of solutions immediately available today that can support their privacy programs, making them more sustainable and faster to respond to privacy law changes.2:15 pmConference Break / Exhibitor Product DemonstrationRegistration Level:- Open Sessions
2:15 pm - 3:00 pmLocation / Room: SecureWorld Exhibitor FloorReboot with coffee and infused water while visiting exhibitors on the exhibitor floor.
2:30 pmDash for Prizes & CyberHuntRegistration Level:- Open Sessions
2:30 pm - 2:45 pmLocation / Room: SecureWorld Exhibitor FloorBe sure to have exhibitors scan your badge for a chance to win prizes. Past prizes have included Kindles, Bose headphones, gift cards, iPads, iPods and more! *Must be present to win
3:00 pm[Panel] Cybersecurity Leaders on PrivacyCISO, Uplight; Co-Host, Colorado = Security podcastCISO, Ntirety (formerly HOSTING.com)CISO, FirstBankCyber Risk Advisory Board Member, Pepperdine UniversitySecurity GRC Manager, Rightway HealthcareData Protection Officer, Compassion InternationalRegistration Level:- Conference Pass
3:00 pm - 3:45 pmLocation / Room: Bresnan BoardroomThis session will enable attendees to learn about what privacy elements are important for local cybersecurity leaders, their approach to implementing privacy in their organizations, and how they have attested to their new privacy programs. Come hear about these local leaders’ opinions on privacy, new regulations, and ask their opinions about why and when privacy matters.
3:00 pmIPv6 Security: The Latent ThreatChair Emeritus, Rocky Mountain IPv6 Task ForceRegistration Level:- Conference Pass
3:00 pm - 3:45 pmLocation / Room: CT+TMany organizations already have IPv6 networks, some organizations are working on their transitions to IPv6 and others are contemplating what IPv6 means to them. IPv6 is now used extensively on the Internet, but not intentionally implemented in enterprise networks. Most organizations already have IPv6 running on their networks and they don’t even realize it. All computer operating systems now default to running both IPv4 and IPv6 which could lead to security vulnerabilities if one is not prepared. IPv6 security vulnerabilities currently exist “in the wild” and as the popularity of the IPv6 protocol increases so will the number of threats. This session will cover the overview of IPv6 security threats and protection measures.Presentation Level: TECHNICAL (deeper dive including TTPs) 3:00 pmSurviving and Thriving in the Internet Wild - Cybersecurity With a Shoestring!IS Manager, Town of Castle RockRegistration Level:- Conference Pass
3:00 pm - 3:45 pmLocation / Room: SaemonIn a survival situation, you have incredibly limited resources and manpower. This mirrors the case often faced by cybersecurity professionals; with many parallels between the wilderness trying to kill you and the Internet “wild”. How will you survive and overcome?
In the wild, making a fire is a key difference between life and death. No matches/lighter? No problem. You just need a shoestring to make a roaring fire in mere minutes! As applied to cybersecurity, a strategically effective application of knowledge and skills with whatever limited resources you have will cause you to survive and even thrive!
Presentation Level: MANAGERIAL (security and business leaders)
- ACP Colorado Rocky Mountain ChapterBooth:
ACP is the premier organization for business continuity professionals providing a powerful networking and learning environment for ACPits members. Known for its progressive programs, workshops and symposiums, the organization has become a unifying force in defining and leading the continuously evolving fields of business continuity, disaster recovery, and emergency response (the “profession”). The Organization is strategically aligned with business partners such as DRI International, and BC Management, as well as our corporate sponsors. With a strong presence in North America, ACP has 42 chapters and over 2,300 members. We welcome all individuals, regardless of experience or certification, with an interest in the Profession.
Founded in 1983, we are an established community of industry experts, educators, practitioners, leaders, facilitators and advocates. Our members view us as connectors and as a vital networking source.
- Alert LogicBooth: 117
Whether your company is transitioning infrastructure to the cloud, taking advantage of managed hosting services, or continuing to rely on owned data centers, Alert Logic offers intrusion detection, vulnerability assessment and log management solutions that are coupled with 24/7 monitoring and expert guidance services from our security operations center. More than 1,500 enterprise customers trust Alert Logic to secure and protect their digital information, and rely on us for keeping in step with increasingly complex regulatory issues. In addition to our team of GIAC analysts dedicated to careful observation and assessment of threats to your data, our research team stays on top of emerging developments so we can stop potential security breaches before they strike. We also have a dedicated support team ready to answer any questions you have about our products and services.
- Alliance Technology GroupBooth: 427M
Alliance Technology Group is a North American Systems Integrator & IT Solutions/Services company. Alliance specializes in IT Infrastructure; Physical & Cyber Security, Storage, Systems and Networking. Our Team deploys these solutions in Traditional IT Enterprises, Private, Public & Hybrid Clouds and IoT & Edge Environments. Alliance’s Consulting & Professional Services Group provides expert support for all of the solutions we offer including design, implementation and managed services. Alliance serves customers in the Private & Public sectors and has become a trusted partner to increase the effectiveness of how IT positively impacts business.
Alliance’s team of highly trained and certified experts have been delivering complex IT Solutions since 1997. While the technology industry continues to rapidly change, Alliance’s goals have remained consistent; listen to our customers, understand their needs and deliver solutions that provide real business value.
To solve some of the most demanding IT challenges Alliance has developed Purpose Built Solutions targeted around Big Data, Cyber Security, First Responder & Public Safety and Cloud markets. Alliance’s Purpose Built Solution Divisions include PliantCloud, Vigilant Platforms, SentryWire and CyberAlliance.
- BitdefenderBooth: 210
Powered by its depth of security expertise and rapid pace of research and development, Bitdefender’s long-standing mission is to deliver transformative security technologies to the world’s users and organizations. We are innovators, creating breakthrough technology that radically improves our customer’s experience with security.
From IoT to Data Centers, from endpoints to hybrid infrastructures – Bitdefender plays a transformational role in how security is best consumed, deployed, and managed. We strive to deliver products and services that radically alter the customer’s experience with security, in terms of efficacy, performance, ease of use and interoperability.
- BitglassBooth: 138
Your company’s move to the cloud delivers flexibility and cost savings, but that doesn’t mean you should lose control of your data. Bitglass’ Cloud Access Security Broker (CASB) solution enables your enterprise to adopt cloud apps while ensuring data security and regulatory compliance. Bitglass secures your data in the cloud, at access, on any device.
Bitglass was founded in 2013 by a team of industry veterans with a proven track record of innovation and execution.
- CISO VenturesBooth:
Whiteboard Venture Partners is building this exclusive community to help cybersecurity startups engage/collaborate with security innovation stakeholders.
- Cloud Privacy LabsBooth: 433M
At Cloud Privacy Labs we provide privacy solutions for organizations that use or exchange personal data. Our product ConsentGrid™ is a privacy governed data flow platform that helps companies achieve compliance, enhance transparency, and empower their users. It combines user consent, preferences, and organizational policies to govern data in-flight.
- Cloud Security Alliance Colorado ChapterBooth:
The Cloud Security Alliance (CSA) is a not-for-profit organization with a mission to promote the use of best practices for providing security assurance within Cloud Computing, and to provide education on the uses of Cloud Computing to help secure all other forms of computing. The Cloud Security Alliance is led by a broad coalition of industry practitioners, corporations, associations and other key stakeholders.
- CobaltBooth: 424M
Cobalt’s Pentest as a Service (PtaaS) platform is modernizing traditional pentesting. By combining a SaaS platform with an exclusive community of testers, we deliver the real-time insights you need to remediate risk quickly and innovate securely.
- Code42Booth: 413M
Code42 is the leader in insider risk detection, investigation and response. Native to the cloud, Code42 rapidly detects data loss, leak, theft and sabotage as well as speeds incident response – all without lengthy deployments, complex policy management or blocking employee productivity. With Code42, security professionals can protect corporate data from insider threats while fostering an open and collaborative culture for employees. Backed by security best practices and control requirements, Code42’s insider threat solution can be configured for GDPR, HIPAA, PCI and other regulatory frameworks.
- Colorado ECTFBooth:
As a result of the amalgamation of advanced technology and the Internet, both the quantity and sophistication of cybercrimes targeting U.S. financial institutions and critical infrastructure have increased. Today, criminal trends show an increased use of phishing emails, account takeovers, malicious software, hacking attacks and network intrusions resulting in significant data breaches. To protect the nation’s financial infrastructure from cyber and financial criminals, the Secret Service has adopted a multi-pronged approach.
- Colorado Technology AssociationBooth:
The Colorado Technology Association leads the network of companies and professionals fueling Colorado’s economy, through technology.
At the Colorado Technology Association, we:
– Lead an inclusive network that benefits our member community
– Advocate for a pro-business and technology-friendly climate
– Influence the development of a robust talent pipeline
– Lead initiatives to help companies grow. - Comodo CybersecurityBooth: 216
In a world where preventing all cyberattacks is impossible, Comodo Cybersecurity delivers an innovative cybersecurity platform that renders threats useless, across the LAN, web and cloud. The Comodo Cybersecurity platform enables customers to protect their systems and data against even military-grade threats, including zero-day attacks. Based in Clifton, New Jersey, Comodo Cybersecurity has a 20-year history of protecting the most sensitive data for both businesses and consumers globally.
- CorelightBooth: 220
Corelight makes powerful network security monitoring solutions that transform network traffic into rich logs, extracted files, and security insights for incident responders and threat hunters. Corelight Sensors run on open-source Zeek (formerly called “Bro”) and simplify Zeek deployment and management while expanding its performance and capabilities. https://www.corelight.com
- CrowdStrikeBooth: 309
CrowdStrike sets the standard for cybersecurity in the cloud era. The CrowdStrike Falcon® platform protects and enables the people, processes, and technologies that drive modern enterprise, delivering superior protection, better performance, reduced complexity, and immediate time-to-value. CrowdStrike secures the most critical areas of enterprise risk—endpoints and cloud workloads, identity, and data—to keep organizations ahead of today’s adversaries and stop breaches.
- DarktraceBooth: 103
Darktrace is the world’s leading cyber AI company and the creator of Autonomous Response technology. Its self-learning AI is modeled on the human immune system and used by over 3,500 organizations to protect against threats to the cloud, email, IoT, networks, and industrial systems.
The company has over 1,200 employees and headquarters in San Francisco and Cambridge, UK. Every 3 seconds, Darktrace AI fights back against a cyber-threat, preventing it from causing damage.
- EC-CouncilBooth:
International Council of E-Commerce Consultants, also known as EC-Council, is the world’s largest cyber security technical certification body. We operate in 140 countries globally and we are the owner and developer of the world-famous Certified Ethical Hacker (CEH), Computer Hacking Forensics Investigator (C|HFI), Certified Security Analyst (ECSA), License Penetration Testing (Practical) programs, among others. We are proud to have trained and certified over 140,000 information security professionals globally that have influenced the cyber security mindset of countless organizations worldwide.
- EgnyteBooth: 227
Egnyte is the only secure content platform that is designed specifically for business. Egnyte provides teams with secure file sharing capability and access to content delivered at hyper-speed, regardless of file size, location, device or bandwidth. More than 15,000 of the world’s most demanding and regulated businesses in more than 120 countries around the globe trust Egnyte to manage their content on the cloud.
- ExpelBooth: 316
Expel provides transparent managed security, on-prem and in the cloud. It’s the antidote for companies trapped in failed relationships with their managed security service provider (MSSP) and those looking to avoid the frustration of working with one in the first place. To learn more, go to https://www.expel.io.
- ForgeRock / Ping IdentityBooth: 230
ForgeRock is a global leader in digital identity that delivers modern and comprehensive identity and access management solutions for consumers, employees, and things to simply and safely access the connected world. Using ForgeRock, more than 1,300 global customer organizations orchestrate, manage, and secure the complete lifecycle of identities from dynamic access controls, governance, APIs, and storing authoritative data—consumable in any cloud or hybrid environment. The company is headquartered in San Francisco, California, with offices around the world.
For more information and free downloads, visit www.forgerock.com or follow ForgeRock on social media.
- IAPPBooth:
Your Comprehensive global information privacy community and resource. Data powers the information economy. And the risks associated with it continue to skyrocket. Data breach, identity theft, loss of customer trust—these are the threats to organizations of all sizes, in all sectors, in today’s marketplace.
The International Association of Privacy Professionals (IAPP) is a resource for professionals who want to develop and advance their careers by helping their organizations successfully manage these risks and protect their data. In fact, we’re the world’s largest and most comprehensive global information privacy community.
The IAPP is the only place that brings together the people, tools and global information management practices you need to thrive in today’s rapidly evolving information economy.
- IBM ResilientBooth: 418M
In an industry focused on building walls, IBM Security is focused on creating an open, connected security ecosystem that leverages AI, cloud, orchestration and collaboration to help clients improve compliance, stop threats and grow their businesses securely. Our strategy reflects our belief that today’s defenses will not suffice tomorrow. It challenges us to approach our work, support our clients and lead the industry, allowing you to be fearless in the face of cyber uncertainty.
- Identity Defined Security AllianceBooth:
Identity Defined Security provides real time, intelligence-based access to data and applications by integrating IAM infrastructure with enterprise cyber security technologies.
The Identity Defined Security Alliance provides the framework and practical guidance that helps organizations put identity at the center of their security strategy, optimizing cyber security investments while controlling risk as IT infrastructures converge.
Community developed, practitioner approved. - InfraGard Colorado – Denver Members AllianceBooth:
InfraGard is an information sharing and analysis effort serving the interests and combining the knowledge base of a wide range of members. At its most basic level, InfraGard is a partnership between the FBI and the private sector. InfraGard is an association of individuals, academic institutions, state and local law enforcement agencies, and other participants dedicated to sharing information and intelligence to prevent hostile acts against the United States. InfraGard Chapters are geographically linked with FBI Field Office territories.
The FBI retained InfraGard as an FBI sponsored program, and will work with DHS in support of its CIP mission, facilitate InfraGard’s continuing role in CIP activities, and further develop InfraGard’s ability to support the FBI’s investigative mission, especially as it pertains to counterterrorism and cyber crimes.
- ISACA Denver ChapterBooth:
The Denver Chapter of ISACA® (formerly EDPAA) was founded in June 1976 with just a handful of members. Today, the Denver chapter with over 1,040 members, is one of the largest chapters within the Southwestern Region. The Denver Chapter contributes to the international organization with financial support and periodic hosting of the International Conference.
The Denver Chapter of ISACA® is a non-profit organization dedicated to the continued development and enhancement of the information systems audit and control profession by providing benefits to its members and to the professional community-at-large.
- ISC2 Denver ChapterBooth:
ISC2 is the largest not-for-profit membership body of certified information security professionals worldwide, with nearly 80,000 members in more than 135 countries. Globally recognized as the Gold Standard, ISC2 issues the Certified Information Systems Security Professional (CISSP®) and related concentrations, as well as the Certified Secure Software Lifecycle Professional (CSSLP®), Certified Authorization Professional (CAP®), and Systems Security Certified Practitioner (SSCP®) credentials to qualifying candidates.
- ISSA Colorado Springs ChapterBooth:
ISSA Colorado Springs Chapter: Developing and Connecting Cybersecurity Leaders Globally. ISSA is the community of choice for international cybersecurity professionals dedicated to advancing individual growth, managing technology risk and protecting critical information and infrastructure.
The Information Systems Security Association (ISSA)® is a not-for-profit, international organization of information security professionals and practitioners. It provides educational forums, publications, and peer interaction opportunities that enhance the knowledge, skill, and professional growth of its members.
- Ixia, a Keysight BusinessBooth: 136
We provide testing, visibility, and security solutions to strengthen applications across physical and virtual networks. Organizations use our tools and capabilities to test, secure and visualize their networks so their applications run stronger.
- Meta NetworksBooth: 125
The way we work has changed dramatically in the last decade. We’re no longer sitting in an office every day, working with applications in the local data center. It’s not just that the perimeter is dissolving – security paradigms designed around the idea that users on the LAN can be trusted is dangerous.We believe it’s time to update the way we approach network access and security. It’s now possible to leverage the cloud and the internet to build a global, zero-trust private network that is agile and scalable enough for the way we do business today. With the Meta Network-as-a-Service (NaaS), you can rapidly connect user devices to applications in the data center and the cloud and secure them with a software-defined perimeter. Meta NaaS is user-centric rather than site-centric, making it the ideal solution for the network security challenges that businesses face today – from providing user-friendly remote access, to connecting cloud infrastructure, and reducing management costs.Meta Networks was founded in 2016 by a leading team of cloud, networking and security experts from companies including Stratoscale, Intel, Check Point, Oracle, Cisco, Harman, Incapsula, Ericsson, 3M and Elbit. The company is funded by the BRM Group and Vertex Ventures.
- MimecastBooth: 312
Mimecast empowers our customers to help mitigate risk and manage complexities across a threat landscape driven by cyberattacks, human error, and technology fallibility. Our advanced solutions provide the proactive threat detection, brand protection, awareness training, and data retention capabilities that evolving workplaces need today.
- NetQuest CorporationBooth: 222
NetQuest provides telecommunications carriers and government agencies with cyber intelligence and network visibility solutions including unsampled NetFlow/IPFIX generation and advanced packet processing for securing high-capacity networks. Since its inception in 1987, NetQuest has provided SIGINT and network monitoring solutions to customers around the world.
- NewCloud NetworksBooth: 422M
NewCloud Networks is a global cloud services provider specializing in Backup, Disaster Recovery, Production Cloud, Hosted PBX, and Security as a Service. NewCloud’s solutions are built using best in breed technology and hosted on our ultra-low latency network in the United States and in Europe. At NewCloud, we believe that great technology is powered by great people. While others are automating support and customer service, we’re proud of our personalized service.
- OneTrustBooth: 305
OneTrust is the leading and fastest growing privacy management software platform used by hundreds of organizations globally to comply with data privacy regulations across sectors and jurisdictions, including the EU GDPR and Privacy Shield.
- OWASP DenverBooth:
- ProcessUnityBooth: 200
ProcessUnity’s cloud-based solutions help organizations of all sizes automate their risk and compliance programs. Our highly configurable, easy-to-use tools significantly reduce manual administrative tasks, allowing customers to spend more time on strategic risk mitigation. As a software-as-a-service technology, ProcessUnity deploys quickly with minimal effort from customers and their IT resources.
- RadwareBooth: 330
Radware® (NASDAQ: RDWR) is a global leader of cybersecurity and application delivery solutions for physical, cloud and software-defined data centers (SDDC). Our award-winning solutions portfolio secures the digital experience by providing infrastructure, application and corporate IT protection, and availability services to enterprises globally. Our solutions are deployed by, among others, enterprise customers, carriers, and cloud service providers.
- SecureAuthBooth: 213
SecureAuth enables the most secure and passwordless, continuous authentication experience for everyone, everywhere. The patented AI/ML technology allows frictionless access to any file and any application across your heterogenous environment. The platform extends the security of your IdP or it can be used as an end-to-end solution.
- Solutions IIBooth: 219
Solutions II, the Cybersecurity and Managed Services experts, specializes in secure IT solutions focused on Virtualization, Business Continuance, Data Lifecycle Management, Networking and Security.
- SpirionBooth: 319
Spirion is a leading enterprise data management software solution that provides high-precision searches and automated classification of unstructured and structured data with unparalleled accuracy. Spirion helps businesses reduce their sensitive data footprint and proactively minimize risks, costs and reputational damage of cyberattacks by discovering, classifying, monitoring and protecting sensitive data.
- SpyCloudBooth: 225
SpyCloud is the leader in account takeover (ATO) prevention, protecting billions of consumer and employee accounts worldwide. Our award-winning solutions proactively defeat fraud attempts and disrupt the criminals’ ability to profit from stolen information. Learn more & check your exposure at spycloud.com.
- TechTargetBooth:
TechTarget (NASDAQ: TTGT) is the online intersection of serious technology buyers, targeted technical content and technology providers worldwide. Our media, powered by TechTarget’s Activity Intelligence platform, redefines how technology buyers are viewed and engaged based on their active projects, specific technical priorities and business needs. With more than 100 technology specific websites, we provide technology marketers innovative media that delivers unmatched reach via custom advertising, branding and lead generation solutions all built on our extensive network of online and social media. TechTarget is based in Boston and has locations in Atlanta, Beijing, Cincinnati, London, Paris, San Francisco, Singapore, and Sydney.
- TevoraBooth: 223
Tevora is an enterprise consulting firm specializing in information assurance, governance and compliance services and solutions. We work with some of the world’s leading companies, institutions and governments to ensure the safety of their information and their compliance with applicable regulations. With a distinctive combination of proven products and services, Tevora aids enterprises in protecting their most important assets from external and internal threats. For more information visit https://www.tevora.com.com/.
- Threat X, IncBooth: 411M
ThreatX protects web applications and APIs from cyber threats across cloud and on-prem environments. By combining behavior profiling and collective threat intelligence with deep analytics, ThreatX delivers precise protection and complete threat visibility. ThreatX Managed Service combines threat hunting with 24/7 access to security experts along with operational management, virtually eliminating costs associated with legacy WAFs.
- TrustwaveBooth: 300
Trustwave helps businesses fight cybercrime, protect data and reduce security risk. With cloud and managed security services, integrated technologies and a team of security experts, ethical hackers and researchers, Trustwave enables businesses to transform the way they manage their information security and compliance programs. More than three million businesses are enrolled in the Trustwave TrustKeeper® cloud platform, through which Trustwave delivers automated, efficient and cost-effective threat, vulnerability and compliance management. Trustwave is headquartered in Chicago, with customers in 96 countries.
- UnitrendsBooth: 427M
Unitrends increases uptime, productivity and confidence in a world in which IT professionals must do more with less. Unitrends leverages high-availability hardware and software engineering, cloud economics, enterprise power with consumer-grade design, and customer-obsessed support to natively provide all-in-one enterprise backup and continuity. The result is a “one throat to choke” set of offerings that allow our customers to focus on their business rather than backup.
- Rhett SaundersExecutive Director of Cybersecurity & Infrastructure, Focus on the Family
Rhett served the Federal Reserve, and while there, led regular Enterprise Risk Management discussions between the Federal Reserve and U.S. Treasury with a focus on cybersecurity. He is a former NSA cryptoanalyst and a U.S. Army veteran, having served multiple joint intelligence communities, both foreign and domestic government agencies in international locations.
Rhett is a public speaker on the topic of privacy and identity theft prevention. He lectures on cybersecurity and cryptography topics at University of Colorado Colorado Springs (UCCS) and Flatiron School. He also serves on the SecureWorld Advisory Council. Rhett earned a Master of Business Administration from LeTourneau University and holds the CISSP credential.
- Larry Wilson, CISSP, CISA, InstructorSr. Cybersecurity Consultant, Wilson Cyber
Larry Wilson was formerly the Chief Information Security Officer for Sumitomo Pharma Americas, Inc., Worcester Polytechnic Institute, and the University of Massachusetts (UMass) President's Office. In the CISO role, Larry was responsible for developing, implementing, and overseeing compliance with the SMPA / WPI / UMass Information Security Policy and Written Information Security Plan (WISP). In addition to designing and deploying the respective cybersecurity programs, Larry has developed and delivered cybersecurity training at multiple industry events, workshops, training venues, etc. Courses include Designing and Building a Cybersecurity Program, Designing and Building a Ransomware Program, and Designing and Building a Third-Party Risk Program. Larry has also worked with multiple companies in multiple industries to help design, build, and maintain their Cybersecurity Programs, Ransomware Program, and Third-Party Risk Programs.
- Mohamed MalkiDirector, Enterprise Security Architecture, Colorado Governor's Office of IT
Mohamed Malki, director of enterprise security architecture and HIPAA officer, has been key in transforming the State of Colorado’s security landscape. He’s been critical in building Colorado’s cybersecurity plan, designing Colorado's public cloud architecture and building the requirements for Colorado's Blockchain center of excellence. Mohamed holds multiple degrees, speaks four languages, and has more than 50 certifications, including CSA CCSAK, ISACA CCAK, ISO/IEC 27001 lead Implementer and Auditor Instructor, AWS Cloud Architect, CISSP, CISM, PMP,Google GCP Architect, and Certified Ethical Hacker. A certified security trainer, Mohamed has helped hundreds of individuals achieve various certifications and proactively offers sessions for employees. Mohamed was recognized as “State Cybersecurity Leader of the Year 2019," the state leader who demonstrates a passion and focus on keeping systems secure and thinking about security in the big picture of state IT. More at: https://statescoop.com/2019-statescoop-50-awards-recognize-state-it-leaders-projects
- Siam LuuLead Security Architect, Colorado Judicial Department
Siam Luu has worked information security for over 8 years beginning as an analyst, graduating to an engineer, and currently is employed as a security architect. He has worked in both the public and private sectors in a myriad of different careers and locations in both technical and non-technical roles. At present, he has his CISSP certification and graduated from the University of Colorado with a Bachelor of Science in Business Administration. His current goals are to help organizations improve their security program creating a more effective defensive strategy.
- Bryce VerdierSr. Software Engineer, GroupOn
Bryce Verdier (CISSP, CEH) is currently a Senior Software Developer at GroupOn. In previous roles, he’s also been a Systems Engineer with an automation and DevOps minded focus, and an Information Security Engineer, focusing on host-based security.
- Christopher CalarcoSpecial Agent / Private Sector Coordinator, FBI Denver
Special Agent (SA) Christopher A. Calarco has been in law enforcement for 25 years. He was previously a local and federal prosecutor, and has been an Agent for the FBI for over 20 years. SA Calarco has investigated a number of matters to include reactive violent crimes, gangs, organized crime, fraud and major theft. SA Calarco was also a member of the FBI’s Art Crime Team. He has worked in the Los Angeles Field Office, Denver Field Office and at FBI Headquarters in Washington, D.C. in different capacities to include Field Agent, Associate Division Counsel, Squad Supervisory Special Agent and Unit Chief. SA Calarco currently works on national security matters and is the Private Sector Coordinator in Colorado and Wyoming.
- Susan BondConsultant, Advisory Services, Ernst & Young
As a technical project leader for over 20 years, Susan Bond has delivered solutions across several industries including Energy, Technology, Logistics Real Estate, and Higher Education. Susan was the Technical Lead for the implementation of network, cybersecurity, visualization, SCADA, and analytics infrastructure during construction and transition to operations of the Department of Energy's $100M+ premier energy systems research facility at NREL. Currently, Susan is an Operational Technology (OT) Lead on a large cybersecurity program and the President of InfraGard Denver Members Alliance.
- Christopher McMahonSpecial Agent, Global Investigative Operations Center, United States Secret Service
Chris McMahon is a Special Agent for the United States Secret Service. Prior to joining the Secret Service, Chris was a Prince George’s County, MD Police Officer. Chris is a well-seasoned criminal investigator specializing in cyber-enabled financial fraud, money laundering, credit card/ID fraud among other crimes. Chris began his Secret Service career out of the New York Field Office spending time between the Fraud Squad and Electronic Crimes Task Force where he earned the designation NITRO Agent for specialized training in network intrusions. While in the New York Field Office, Chris ran point on several large-scale multi-national criminal investigations targeting transnational organized crime groups. Chris is currently assigned to the U.S. Secret Service, Global Investigative Operations Center (GIOC) where he specializes in Business Email Compromise schemes and account takeovers focusing on the international nexus of cyber-enabled financial crime.
- Sam MasielloCISO, The Anschutz Corporation
Sam Masiello has been working with email, messaging, and fighting internet pollution for over 25 years. Prior to The Anschutz Corporation, he served as the CISO at Gates Corporation, where he was responsible for the company's data security, risk, and global compliance initiatives. Before that, he was CISO at TeleTech, where he oversaw the protection of employee, consumer, and customer data for all of the organization's clients, which included many Fortune 500 companies.
Sam has also been the Chief Security Officer, Head of Application Security, and Head of Security Research at companies such as Groupon, Return Path, and McAfee. He currently serves as Director-at-Large of The Coalition Against Unsolicited Commercial Email (CAUCE), National Advisory Board Member for SecureWorld, and is an Executive Board Member of Colorado Cyber. He has previously served as a member of the Board of Directors for the Messaging, Malware, and Mobile Anti-Abuse Working Group (M3AAWG), the Steering Committee of the Online Trust Alliance (OTA), and a member of the Anti-Phishing Working Group (APWG).
- Cindi CarterCISO & C-Suite Advisor, Check Point Software Technologies
Cindi Carter is a global, multi-industry Cybersecurity and Information Technology Executive who consistently seeks the optimal outcome for any endeavor. As a transformational leader from startups to enterprises, she excels at building cybersecurity practices in highly-regulated industries, turning strategic goals into actionable outcomes, and highly collaborative engagement across the organization for managing cyber risk.
At Check Point Software Technologies, Cindi is a Chief Information Security Officer in the Office of the CISO, leading Check Point's Healthcare Center of Excellence where human safety is essential to care.
Cindi is the founding President of Women in Security - Kansas City, was honored in SC Media magazine’s “Women to Watch in Cyber Security," and was also featured in Cybersecurity Venture’s book, “Women Know Cyber: 100 Fascinating Females Fighting Cybercrime.” She presents at conferences worldwide, holds several recognized IT, security, and project management certifications, and has a Master of Science degree in Information Technology.
- Aleta JeffressChief Information & Digital Officer, City of Aurora
Aleta Jeffress is the Chief Information and Digital Officer for the City of Aurora. She has over 20 years as a successful executive business leader and technologist building relationships between business and technology to enable digital transformation and market growth. She drives innovative strategies for business and IT leadership, and has developed teams for Cybersecurity and Project Management Offices from the ground up. Her career began in startup software companies where she started in a call center environment and moved through private and public sector organizations in the areas of software quality, development, product management, and ultimately leadership.
- Jessica RaymondIT Security Manager, Department of Information Technology, Weld County
Jessica Raymond is the IT Security Manager for Weld County Government where she had the opportunity to build the security program from the ground up over the last 5 years. She is responsible for information security in a 360 degree fashion including designing, implementing, and maintaining security infrastructure, compliance and audits, governance, risk management, security awareness, incident response, vulnerability management, threat prevention, budgeting, forecasting, project management, and more.
Prior to working for Weld County Government, Jessica was a Senior IT Security Analyst for the University of Northern Colorado for 5 years and was part of the IBM Managed Security Services division as a member of the Security Operations Center for 7 years. She worked professionally in the Information Technology field for the past 25 years.
In addition, Jessica serves on the Product Advisory Board for the MS-ISAC. She holds the CISM, CISSP, and C|CISO certifications.
- Mary HaynesVP, Network Security Operations, Charter Communications
Mary Haynes is the Vice President of Network Security Operations at Charter Communications. Mary currently leads the network security program for Charter’s core networks and Spectrum services, including High Speed Internet, Telephony, and Video products. Mary is also responsible for Charter’s Customer Security Operations, Law Enforcement Response Team, Abuse management and botnet remediation programs.
Mary actively participates in a leadership role in numerous security organizations and associations, including the National Communications and Telecommunications Association (NCTA), Communications Information Sharing Analysis Center (ISAC), Communications Sector Reliability and Interoperability Council Working Groups and Infragard. Mary is currently serving as the Communications Deputy Sector Chief for Denver Infragard. As the founding member of Women In Security – Denver, the largest ISSA Special Interest Group.
Mary has been in the information security field since 1996 and has served in security leadership positions for Evergy, CenturyLink, Sprint, Birch Telecom and AT&T. She graduated Summa Cum Laude from Baker University with a degree in Business Administration. - Ron WinwardSecurity Evangelist, North America, Radware
As a Security Evangelist at Radware, Mr. Winward is responsible for developing, managing, and increasing the company’s security business in North America.
Ron’s entire career has been deeply rooted in internet and cybersecurity. For over 20 years, Ron has helped design complex solutions for carriers, enterprises, and cybersecurity providers around the world.
Ron is an industry-recognized expert in the Mirai IoT botnet and its modern variants. Ron conducted the industry’s first complete analysis of the Mirai attack vectors, producing forensic examples for public distribution of each attack and the specific impact each attack had on networks. His work on IoT attack analysis has been presented at conferences worldwide and has been referenced by NIST.
Prior to joining Radware, Ron was Director of Network Engineering for a global datacenter provider and ISP. In this role, Ron oversaw the growth and development of a global network infrastructure that delivered services to other ISPs, hosting providers, and enterprises around the world. During this time, Ron assisted some of the world’s top businesses in mitigating cyberattacks on their infrastructure, cultivating an extensive knowledge in DDoS attack methodologies.
Ron holds a Bachelor of Science degree in Business and has earned many technical certifications throughout his engineering-focused career. Ron acutely understands the impact of technology and security on business and is enthusiastic about their interrelation. - John CallaghanSr. Security Engineer in SOC Operations, Forensics, and Threat Hunting, Pulte Financial Services
As a security practitioner of 30 years, Jack's experience began in the 80s with commercial and military venues, and expanding in early days of the Internet. It continued to be shaped by the growth of malware and data breaches as global threats against business, nations, and individuals. While developing some of the earliest proactive IPS systems ( proto-SIEM) on an extensive international network (DEC's Easynet) he was able to analyze and evolve response systems by observing the nature and techniques resulting in data exposure.
His present focus is global information growth and the profitable criminal practices and State actors constantly assaulting data, inevitably with profound impact. Recent work in MSSP and financial sectors continues to expose him to the bleeding edge of data loss affecting every user of this global data repository. His current position, Senior Security Engineer at Pulte Financial, offers constant exposure to threats engineered to steal financial and PII content and continues to sharpen his sense of appropriate Incident Response, CSIRT defense activities, and the continual need to protect individuals funds and privacy.
As a regular presenter for ISSA and ISACA, he's focused on sessions addressing information exposure, attack methodologies, and integrating threat content and TTPa to quick response defenses, but now is concerned with practical approaches to tailored tactical response, SOC operations, and personal data privacy.
- Rhett SaundersExecutive Director of Cybersecurity & Infrastructure, Focus on the Family
Rhett served the Federal Reserve, and while there, led regular Enterprise Risk Management discussions between the Federal Reserve and U.S. Treasury with a focus on cybersecurity. He is a former NSA cryptoanalyst and a U.S. Army veteran, having served multiple joint intelligence communities, both foreign and domestic government agencies in international locations.
Rhett is a public speaker on the topic of privacy and identity theft prevention. He lectures on cybersecurity and cryptography topics at University of Colorado Colorado Springs (UCCS) and Flatiron School. He also serves on the SecureWorld Advisory Council. Rhett earned a Master of Business Administration from LeTourneau University and holds the CISSP credential.
- Bruce SussmanDirector of Media & Content, Podcast Host, SecureWorld
Emmy-winning journalist Bruce Sussman spent more than 20 years on TV screens in Portland, Oregon. During his "second career," he became fascinated by cybersecurity while working with CISOs at Gartner. He joined SecureWorld in 2017 to help grow its media division. Currently, he hosts the Remote Sessions daily web conference series and SecureWorld podcast published each Tuesday, and oversees news content for secureworldexpo.com. Sussman graduated from the University of Missouri School of Journalism back in the dark ages. Message him on LinkedIn if you'd like to connect!
- Jesse HoodDirector, Darktrace
Jesse Hood is a Director at Darktrace, the world’s leading cyber AI company. Jesse has helped many enterprise organizations and SMB’s throughout Colorado and the neighboring states deploy cyber AI to detect and stop emerging threats. He works with businesses across a range of industries, including finance, healthcare, biopharma, local government, oil & gas, energy, critical infrastructure, legal firms, and more. During Jesse’s tenure at Darktrace, the company has grown to over 3,000 customers and has been the recipient of numerous achievements, including: Fast Company’s Most Innovative Companies 2018, Forbes Cloud 100 2018, and the CNBC Disruptor 50 2018.
- Jaymin DesaiThird-Party Risk Offering Manager, OneTrust
Jaymin Desai is a Certified Information Privacy Professional (CIPP/E , CIPM) and the Third Party Risk Offering Manager at OneTrust—the #1 most widely used privacy, security, and third-party risk technology platform. In this role, Desai oversees a global professional services team of privacy certified consultants focused on formulating efficient and effective responses to data protection requirements. His team advises many of the world's leading organizations on General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA) and ePrivacy (Cookie Law) solution implementations with extensive experience building and scaling enterprise-level privacy programs. He holds a B.S. in Biomedical Engineering from the Georgia Institute of Technology.
- Abhijit SolankiFounder & Managing Director, Whiteboard Venture Partners
Abhijit Solanki is the founder of Whiteboard Venture Partners, an early stage venture capital firm helping entrepreneurs achieve their whiteboard dreams.
- Christopher MandelarisCISO, Elevations Credit Union
Chris Mandelaris is the Chief Information Security Officer of Elevations Credit Union. He has over 16 combined years’ experience in IT and Information Security. He received his Bachelor of Science from Central Michigan University and Master’s Degree Information Technology - Walsh College of Business Chris has earned CCISO, CISM, CISA, CRISC, PMP, ITILv3, Six Sigma, MCSA, MCP, CNA, Network+, A+ certifications and is an active member of PMI and ISACA organizations. Previously Chris has worked for Ford Motor Credit, Flagstar Bank, Electronic Arts, Dell, First Tennessee Bank and Bank of America taking on increased roles and responsibilities globally.
- Sam MasielloCISO, The Anschutz Corporation
Sam Masiello has been working with email, messaging, and fighting internet pollution for over 25 years. Prior to The Anschutz Corporation, he served as the CISO at Gates Corporation, where he was responsible for the company's data security, risk, and global compliance initiatives. Before that, he was CISO at TeleTech, where he oversaw the protection of employee, consumer, and customer data for all of the organization's clients, which included many Fortune 500 companies.
Sam has also been the Chief Security Officer, Head of Application Security, and Head of Security Research at companies such as Groupon, Return Path, and McAfee. He currently serves as Director-at-Large of The Coalition Against Unsolicited Commercial Email (CAUCE), National Advisory Board Member for SecureWorld, and is an Executive Board Member of Colorado Cyber. He has previously served as a member of the Board of Directors for the Messaging, Malware, and Mobile Anti-Abuse Working Group (M3AAWG), the Steering Committee of the Online Trust Alliance (OTA), and a member of the Anti-Phishing Working Group (APWG).
- Clint SowadaDirector of Product Security, Collibra
As the Director of Product Security at Collibra, Clint Sowada is responsible for delivering secure applications and protecting customer’s data. He has been in the security industry for nearly a decade and has proven track record in building secure SDLC programs at companies that range from endpoint protection to large scale cloud service providers. Prior to joining Collibra, Clint built and managed teams of security professionals at VMware, ServiceNow, Malwarebytes, and SecureAuth. He comes from a technical background specializing in penetration testing, and currently resides in Denver, Colorado.
- Randall FrietzscheCISO, Denver Health
Randall’s career started as a Law Enforcement Officer. With the technical aptitude, he moved into technology, starting as an MCSE on Windows NT 4.0. Over the next 22 or so years, he evolved to become the Enterprise Chief Information Security Officer for Denver Health and Hospital Authority. He also teaches cybersecurity courses for Harvard and Regis Universities. As an ISSA Distinguished Fellow, Randall’s mission is to give back to our profession, to mentor, teach, speak, and write. Security is his vocation, avocation and passion. Randall has presented at many security conferences, including Rocky Mountain Information Security Conference, Denver Evanta CISO Summit, SecureWorld, and the Louisville Metro Information Security Conference.
- Merlin NamuthCyber Risk Advisory Board Member, Pepperdine University
Merlin Namuth has spent over 20 years focused in security. His experience includes building and running numerous security programs, program management, managing incident response teams, computer forensics, compliance, architecture, and engineering complex security solutions. Namuth serves on the cyber risk advisory board at Pepperdine University where he also guest lectures. Merlin serves on the Board of Directors at iEmpathize, a nonprofit focused on educating people about human trafficking. He has presented at several conferences, including RSA domestically and internationally, as well as RMISC, OWASP, and ISSA. He holds the PMP, CISSP, GCFA, and GCIH certifications.
- Larry Wilson, CISSP, CISA, InstructorSr. Cybersecurity Consultant, Wilson Cyber
Larry Wilson was formerly the Chief Information Security Officer for Sumitomo Pharma Americas, Inc., Worcester Polytechnic Institute, and the University of Massachusetts (UMass) President's Office. In the CISO role, Larry was responsible for developing, implementing, and overseeing compliance with the SMPA / WPI / UMass Information Security Policy and Written Information Security Plan (WISP). In addition to designing and deploying the respective cybersecurity programs, Larry has developed and delivered cybersecurity training at multiple industry events, workshops, training venues, etc. Courses include Designing and Building a Cybersecurity Program, Designing and Building a Ransomware Program, and Designing and Building a Third-Party Risk Program. Larry has also worked with multiple companies in multiple industries to help design, build, and maintain their Cybersecurity Programs, Ransomware Program, and Third-Party Risk Programs.
- Mohamed MalkiDirector, Enterprise Security Architecture, Colorado Governor's Office of IT
Mohamed Malki, director of enterprise security architecture and HIPAA officer, has been key in transforming the State of Colorado’s security landscape. He’s been critical in building Colorado’s cybersecurity plan, designing Colorado's public cloud architecture and building the requirements for Colorado's Blockchain center of excellence. Mohamed holds multiple degrees, speaks four languages, and has more than 50 certifications, including CSA CCSAK, ISACA CCAK, ISO/IEC 27001 lead Implementer and Auditor Instructor, AWS Cloud Architect, CISSP, CISM, PMP,Google GCP Architect, and Certified Ethical Hacker. A certified security trainer, Mohamed has helped hundreds of individuals achieve various certifications and proactively offers sessions for employees. Mohamed was recognized as “State Cybersecurity Leader of the Year 2019," the state leader who demonstrates a passion and focus on keeping systems secure and thinking about security in the big picture of state IT. More at: https://statescoop.com/2019-statescoop-50-awards-recognize-state-it-leaders-projects
- Larry Wilson, CISSP, CISA, InstructorSr. Cybersecurity Consultant, Wilson Cyber
Larry Wilson was formerly the Chief Information Security Officer for Sumitomo Pharma Americas, Inc., Worcester Polytechnic Institute, and the University of Massachusetts (UMass) President's Office. In the CISO role, Larry was responsible for developing, implementing, and overseeing compliance with the SMPA / WPI / UMass Information Security Policy and Written Information Security Plan (WISP). In addition to designing and deploying the respective cybersecurity programs, Larry has developed and delivered cybersecurity training at multiple industry events, workshops, training venues, etc. Courses include Designing and Building a Cybersecurity Program, Designing and Building a Ransomware Program, and Designing and Building a Third-Party Risk Program. Larry has also worked with multiple companies in multiple industries to help design, build, and maintain their Cybersecurity Programs, Ransomware Program, and Third-Party Risk Programs.
- Mohamed MalkiDirector, Enterprise Security Architecture, Colorado Governor's Office of IT
Mohamed Malki, director of enterprise security architecture and HIPAA officer, has been key in transforming the State of Colorado’s security landscape. He’s been critical in building Colorado’s cybersecurity plan, designing Colorado's public cloud architecture and building the requirements for Colorado's Blockchain center of excellence. Mohamed holds multiple degrees, speaks four languages, and has more than 50 certifications, including CSA CCSAK, ISACA CCAK, ISO/IEC 27001 lead Implementer and Auditor Instructor, AWS Cloud Architect, CISSP, CISM, PMP,Google GCP Architect, and Certified Ethical Hacker. A certified security trainer, Mohamed has helped hundreds of individuals achieve various certifications and proactively offers sessions for employees. Mohamed was recognized as “State Cybersecurity Leader of the Year 2019," the state leader who demonstrates a passion and focus on keeping systems secure and thinking about security in the big picture of state IT. More at: https://statescoop.com/2019-statescoop-50-awards-recognize-state-it-leaders-projects
- Joe DietzNetwork Security Architect, CenturyLink
A technology focused senior level IT security professional with an excellent balance of business experience and knowledge of systems/network security. Always conducting oneself with integrity and ethical behavior following the motto of “Always do the right thing.”
- Janelle HsiaDirector of Privacy and Compliance, American Cyber Security Management
Janelle Hsia is a trusted advisor for strategic and tactical decision making within organizations of all sizes. She brings a diverse background with strong leadership, technical, and business skills spanning 20 years of experience in the areas of project management, IT, privacy, security, data governance, process improvement, and software development. Her passion is creating comprehensive data governance programs for SMEs which blends security, privacy, and risk disciplines together. Her experience includes Director of Privacy and Compliance, Deputy Information System Security Officer, and Board of Directors for the Colorado Chapter of Cloud Security Alliance (CSA). She holds the following certificates CIPM, CIPP/E, CISA, PMP, and GSLC.
- Preston BukatyGRC Consultant / Privacy & Compliance Specialist, IT Governance USA Inc.
Preston Bukaty is an attorney and consultant working for IT Governance USA. He specializes in data privacy GRC projects, from data inventory audits to gap analysis, contract management, and remediation planning. His compliance background, and experience with operationalizing compliance for a variety of industries, give him a strong understanding of the legal issues presented by international regulatory frameworks. Having conducted over 3,000 data mapping audits, he also understands the practical realities of project management in operationalizing compliance initiatives.
Preston’s legal experience and passion for technology make him uniquely suited to understanding the business impact of privacy regulations like the GDPR and CCPA. He has advised more than 250 organizations engaged in businesses as varied as SaaS platforms, mobile geolocation applications, GNSS/telematics tools, financial institutions, fleet management software, architectural/engineering design systems, and web hosting. He also teaches certification courses on GDPR compliance and ISO 27001 implementation, and writes on topics related to data privacy law.
Preston lives in Denver, Colorado, much to the envy of friends and family. Prior to working as a data privacy consultant, he worked for an international GPS software company, advising business areas on compliance issues across 140 countries. Preston holds a juris doctorate from the University of Kansas School of Law, along with a basketball signed by Hall-of-Fame coach Bill Self.
- Chris McLaughlinInformation Security Officer, Johns Manville
Chris McLaughlin is the Information Security Officer at Johns Manville, a Berkshire Hathaway company. JM is leading global manufacturer of insulation, roofing and glass fibers products. Chris has over 20 years of security and infrastructure experience leading the vision for a highly complex manufacturing environment. Chris has a passion for industrial security and has developed a center of excellence around industrial control systems that brings engineering and IT teams together to work towards common goals. Chris holds an MBA from the University of Colorado.
- Scott ReynoldsIndustrial Security Manager, Johns Manville
Scott Reynolds is the Industrial Security Manager at Johns Manville. He has over 14 years of Industrial Engineering experience and is an active member of the OT / IT community. Scott has held leadership roles in the International Society of Automation (ISA) for the last four years and is currently an Executive Board Member. Scott has an electrical engineering degree from the University of Maine and an MBA from The University of South Dakota.
- Dale DrewChief Security Officer, Zayo Group
Dale is currently the Chief Security Officer of Zayo Group, Inc, a global telecommunications service provider based in Boulder, Colorado. Dale is an accomplished and experienced corporate security executive with 31 years of experience in developing critical global security programs, having worked in Federal/State Law Enforcement and with Internet Service Providers (ISP). Dale brings a practical capability to integrating security into the culture of the business, enabling the company to be more flexible, with demonstrable results. He is an experienced leader in creating high performance teams, designing innovative security solutions, handling global regulatory environments, and managing highly technical global personnel. Dale was recently awarded the 2019 top global CISOs by the CISO Platform.
- Robb Reck, ModeratorCo-Host, Colorado = Security Podcast
- Alex WoodCISO, Uplight; Co-Host, Colorado = Security podcast
Alex Wood is currently the CISO for Uplight and has more than 18 years of experience in information security. Previously, he has had managerial, program, and technical roles at several major companies in different verticals. Additionally, Alex has served on the Board of Directors for ISSA International and is a host of the Colorado = Security podcast. Alex is a CISSP and has an MAS in Information Security from the University of Denver.
- Book Signing
- Jay Wilson, ModeratorCISO, Insurity
- Craig SpiezleFounder & President, AgeLight Advisory & Research Group
Craig Spiezle is the founder and managing partner of AgeLight Advisory Group, a professional services firm focused on online and digital services. Craig is a recognized authority on trust and the convergence of privacy and security promoting ethical privacy practices, end-to-end security and the importance on moving from a compliance mindset to stewardship. Craig is the Charmain emeritus of the Online Trust Alliance, an initiative of the Internet Society. He frequently briefs international policy makers driving awareness of best practices by both the public and private sectors and importance of internet governance. Craig has championed security best practices to help protect consumers while promoting innovation and the role of meaningful self-regulation. Prior to OTA, Craig spent over a decade at Microsoft focused on security and privacy enhancing technologies and standards. Craig chairs the Online Trust & Integrity Council and is on the board of the Identity Theft Council, editorial board of SC Magazine and a member of InfraGard, the IAPP and the APWG.
- Tim DanksVP, Risk Management & Partner Relations, Huawei Technologies (USA)
As VP Risk Management & Partner Relations Mr. Danks is responsible for understanding and managing business risks in the context of cybersecurity and privacy across Huawei USA businesses and toward external stakeholders. Further, he is responsible for developing and enhancing partner relationships towards key external stakeholders across academia, channels partners, industry, and suppliers utilizing his broad understanding of Huawei’s local and global business operations.
Mr. Danks joined Huawei’s USA operations in 2009 holding various senior level positions in Huawei’s carrier network and consumer products businesses covering operations, cybersecurity and risk management in Huawei’s customer facing solutions and services. Most recently Mr. Danks has driven a program to operationalize the NIST Cybersecurity Framework as an organizational assessment model for Huawei’s consumer facing cloud services operations and platforms globally.
Mr. Danks career spans 30 years in the telecommunications industry in both the vendor and operator environments. Prior to joining Huawei, he spent 18+ years with Ericsson preceded by several years with Rogers Communications. At Ericsson, Mr. Danks held key international positions in Canada, United States, United Kingdom and Sweden. Mr. Danks focus during much of his career was in the telecom services arena expanding into the cybersecurity, privacy and risk management space. Mr. Danks has proven success building and developing highly effective organizations focused on process driven business results supporting customer and partner success. Throughout his career risk management of operations and networks has been a significant factor contributing to success of the organizations under his responsibility. His diversified mix of global experience provides him with a broad understanding of the challenges facing the Information and Communication Technology industry today. - Bruce PotterCISO, Expel
Bruce Potter is the CISO at Expel. Previously, Bruce co-founded Ponte Technologies, a cybersecurity research and engineering company. He also served as the senior technical advisor to the members of President Obama’s Commission on Enhancing National Cyber Security, and co-founded the Shmoo Group in 1996.
- David StaussPartner, Husch Blackwell LLP
David is the leader of Husch Blackwell’s national privacy and data security practice group. Accredited by the International Association of Privacy Professionals as a Fellow of Information Privacy, Certified Information Privacy Professional/United States, and Certified Information Privacy Technologist, David brings to the table a deep engagement with the subject matter and demonstrated excellence in handling privacy and cybersecurity matters for clients. David regularly counsels clients on complying with existing and emerging privacy and information security laws, including the European Union’s General Data Protection Regulation, the California Consumer Privacy Act, and other emerging state privacy and information security statutes.
- Serge BorsoCommunity Instructor, SANS Institute
Serge Borso is the founder and CEO of SpyderSec, an organization specializing in penetration testing, security awareness training, and OSINT. He also resides on the board of directors for the Denver OWASP chapter and teaches with the SANS Institute. He is an expert in a variety of information security fields, having served in many roles in the IT and security industries over the past 15 years. As an active member in the information security community, Serge has trained over 1,000 students, presents regularly at various speaking engagements, and his quotes can be read in various industry publications.
- Greg SternbergSecurity Architect, Sungard Availability Services
Greg Sternberg is a Security Architect at Sungard Availability Services, CISO for ISSA, Denver and Affiliate Faculty at Regis University. He works at incorporating security into the SDLC and securing architectures. He has published and blogged on security and architecture topics and presented at SecureWorld, RMISC, ISC(2) and the Open Group Security Conferences. He holds CISSP, CISM and TOGAF certifications, has a Masters in Software Engineering and Management, is a member of ISACA, ISC(2), InfraGard and a board member of the Denver chapter of ISSA.
- Mark GelhardtCIO, Georgia State Defense Force, Former CIO, The White House
Colonel Gelhardt, at the pinnacle of his military career was selection to work at The White House as the CIO, supporting President Clinton, the VP, the White House Staff, and the U.S. Secret Service managing all the classified automation and telecommunications. Colonel Gelhardt is a combat veteran. Colonel Gelhardt is a well-known speaker and the author of “My time at the Clinton White House”. Since retiring from active service, Colonel Gelhardt has volunteer with many different service organizations. Currently he is the Chief Information Officer for the Georgia State Defense Force and all volunteer force keeping your state safe.
- Carlin DornbuschPresident, American Cyber Security Management (ACSM)
Carlin Dornbusch is an innovative leader in Cybersecurity and Data Privacy. His company, American Cyber Security Management, brings proven methods, best-in-class tools, and deep knowledge of data privacy and security standards to every client engagement. ACSM excels at creating custom privacy and security programs to meet the demands of modern threats and emerging compliance. Carlin’s background in technology, security, operations, and management give him a well-balanced approach to solving business problems and maximizing Return on Investment. Having worked for some of the most rapidly growing technology and solutions companies in the world, Carlin and his teams have developed hundreds of business leading solutions including; digital transformation, workforce productivity, IT simplification, business automation, customer service, and market expansion. A consultative approach has been the mainstay of Carlin’s methodology ever since leaving corporate employment in 2006. Carlin’s focus on people, process, and technology allows him to improve operational efficiency and help businesses modernize their workplace. His methods and techniques are industry leading and high leveraged by Focused Clouds’ clientele. You can find Carlin as an active member in the Cloud Security Alliance (CSA), Information Systems Security Association (ISSA), and International Association of Privacy Professionals (IAPP) organizations in Colorado. He founded and oversees the ever expanding GDPR/Privacy MeetUp. Carlin also holds an active Certified Information Systems Security Professional (CISSP) certificate from ISC2.
- Burak SerdarCo-Founder, ConsentGrid
Burak is one of the co-founders and the technical lead at Cloud Privacy Labs. He has more than 25 years of experience as a software engineer and recently left his position at Red Hat as Principal Software Applications Engineer. His work includes large scale back-end applications for distributed environments and open-source tools for enterprise data management, identity management, configuration automation, and infrastructure-as-code.
- Jaymin DesaiThird-Party Risk Offering Manager, OneTrust
Jaymin Desai is a Certified Information Privacy Professional (CIPP/E , CIPM) and the Third Party Risk Offering Manager at OneTrust—the #1 most widely used privacy, security, and third-party risk technology platform. In this role, Desai oversees a global professional services team of privacy certified consultants focused on formulating efficient and effective responses to data protection requirements. His team advises many of the world's leading organizations on General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA) and ePrivacy (Cookie Law) solution implementations with extensive experience building and scaling enterprise-level privacy programs. He holds a B.S. in Biomedical Engineering from the Georgia Institute of Technology.
- Alex WoodCISO, Uplight; Co-Host, Colorado = Security podcast
Alex Wood is currently the CISO for Uplight and has more than 18 years of experience in information security. Previously, he has had managerial, program, and technical roles at several major companies in different verticals. Additionally, Alex has served on the Board of Directors for ISSA International and is a host of the Colorado = Security podcast. Alex is a CISSP and has an MAS in Information Security from the University of Denver.
- Christopher RileyCISO, Ntirety (formerly HOSTING.com)
Chris is a seasoned IT Strategist with 20 years of leadership experience in Project & Program Management, Technology & Infrastructure, and Security & Governance. He creates and scales internal technology operations for sustained hyper-growth, builds security operations for Managed Security Provider and spearheads Compliance certification programs across industry verticals including PCI, HITRUST, SOC, SSAE 16 and ISO 27001. Chris and his teams have enabled global market access to business objectives in secure environments. As the CISO of Ntirety formerly Hostway | HOSTING, he’s responsible for compliance and security strategy and implementation while guarding the business. He’s dedicated to transforming complex problems into effective information security controls and driving revenue growth.
- Brenden SmithCISO, FirstBank
Brenden Smith is the Chief Information Security Officer at FirstBank. Having spent the last 10 years at FirstBank he is passionate about their community involvement and “Banking for Good” philosophy. In his current role Brenden is focused on aligning security with the needs of the business to help drive better business outcomes through better partnership. His passions include dark web research and the ever evolving space of data privacy.
- Merlin NamuthCyber Risk Advisory Board Member, Pepperdine University
Merlin Namuth has spent over 20 years focused in security. His experience includes building and running numerous security programs, program management, managing incident response teams, computer forensics, compliance, architecture, and engineering complex security solutions. Namuth serves on the cyber risk advisory board at Pepperdine University where he also guest lectures. Merlin serves on the Board of Directors at iEmpathize, a nonprofit focused on educating people about human trafficking. He has presented at several conferences, including RSA domestically and internationally, as well as RMISC, OWASP, and ISSA. He holds the PMP, CISSP, GCFA, and GCIH certifications.
- Michael StephenSecurity GRC Manager, Rightway Healthcare
Michael Stephen is a 20+ year Cybersecurity and Privacy professional who has worked in multiple industries including telecommunications, healthcare, state and local government, finance and restaurant. His experience includes designing, building and supporting security solutions, and successfully implementing compliance and privacy programs to support business goals. He holds active certifications CISSP, SABSA, prior multiple Cisco network and security, and his last position was Privacy & Security Officer at Connect for Health Colorado.
- Justin SchluesslerData Protection Officer, Compassion International
Justin Schluessler has served with Compassion International, a global child development non-profit, for 21 years. Starting in IT and then transitioning to Risk Management, Justin was the organization’s very first information security employee—building a comprehensive security and compliance program from the ground up. In his current role as Data Protection Officer, Justin is responsible for leading a global data protection program addressing information security and privacy risk in thirty-eight countries.
Proving the value of protecting data for employees, beneficiaries, and donors motivates Justin every day. Proving that technologists can tell stories without inflicting fatal boredom is just an added plus.
- Scott HoggChair Emeritus, Rocky Mountain IPv6 Task Force
Scott Hogg is CTO and a co-founder of HexaBuild.io, an IPv6 consulting and training firm. He is a CCIE #5133 and CISSP #4610 with over 25 years of network and security experience. He is the author of the a Cloud Guru course, “Rapidly Deploying IPv6 on AWS.” Scott is Chair Emeritus of the Rocky Mountain IPv6 Task Force (RMv6TF), and a member of the Infoblox IPv6 Center of Excellence (COE). He has authored the Cisco Press book on IPv6 Security, and also writes for NetworkWorld.com.
- Craig SwinteckIS Manager, Town of Castle Rock
Craig Swinteck has a comprehensive background in IT operations and cybersecurity, with a career spanning across entrepreneurship, small businesses to global corporations, serving the public in local and federal government, and providing cybersecurity guidance in challenging industries such as Finance, Healthcare, and Manufacturing. Craig’s passion is to coach people to choose to be the best version of themselves. He is a devoted mentor in both professional and personal life, avid athlete in numerous sports, and sees the challenging realm of cybersecurity as a great complement to the footsteps of his family of aviators, doctors, entrepreneurs, teachers, and world travelers.
• Create a personalized agenda
• View maps of the venue and Exhibit Hall
• Use secure messaging to network with attendees
• View speaker slides after the conference
• Play CyberHunt, the app game, and compete for prizes