Kayne McGladrey, CISSP - Thursday, April 3rd, 2025
Field CISO for Hyperproof, senior IEEE member
Kayne McGladrey, CISSP
Time: 6 pm meet and greet, 6:30 start
Location: Zoom and Mercer Island (register with Eventbrite for location)
Eventbrite tickets for in person attendance only
Summary:
Cyber risks are not just technical issues; they are fundamental business challenges with profound financial and reputational implications. This keynote addresses the intersection of cybersecurity and business strategy, offering practical insights to help executives and business leaders prioritize and act on cyber risks in a meaningful way.
Attendees will gain an understanding of how to frame cyber risks as business risks, communicate them effectively to stakeholders, and integrate them into broader organizational strategies. Real-world examples and actionable frameworks will equip leaders with the tools to translate technical threats into business priorities. This presentation will also explore how to allocate resources, measure the effectiveness of cybersecurity programs, and foster resilience across the enterprise.
By the end of the session, you will be prepared to engage in informed decision-making that balances cost, compliance, and risk reduction, ensuring your organization is prepared for the challenges of today’s complex risk landscape.
Bio:
Kayne McGladrey, CISSP
Field CISO for Hyperproof, senior IEEE member, and author of the GRC Maturity Model. With nearly three decades of experience in cybersecurity, I specialize in helping organizations navigate the intersection of governance, risk, and compliance (GRC) to build more secure and resilient businesses.
My work focuses on enabling CISOs, internal audit teams, and executives to align cybersecurity and business goals, communicate effectively with boards, and proactively address evolving global regulations. As a recognized thought leader, I’ve been spoken at events like Gartner IT Security & Risk, RSA, ISACA GRC, and the ISC2 Congress. My presentations are nuanced, accessible, and actionable, offering attendees practical guidance on current cybersecurity challenges and opportunities.
Throughout my career, I’ve advised Fortune 500 and Global 1000 companies, leveraging my ability to bridge the gap between business and technology. I’m passionate about reducing organizational friction, improving GRC maturity, and inspiring underrepresented communities to pursue cybersecurity careers.
Zachary Pugh - Thursday, March 6th, 2025
Sr. Product Manager, Security + Compliance Menlo Security
Zachary Pugh
Time: 6 pm meet and greet, 6:30 start
Location: Zoom and Mercer Island (register with Eventbrite for location)
Eventbrite tickets for in person attendance only
Summary:
The modern workspace is evolving. It’s cloud-driven, powered by AI, and defined by SaaS. From safeguarding Google Chrome users, to protecting against sophisticated browser-based threats and securing access to applications and data, we’ll delve into the challenges facing modern organizations and discuss how Google and Menlo Security deliver a new kind of browser protection that empowers productivity without compromising security.
Bio:
Zachary Pugh – Sr. Product Manager, Security + ComplianceMenlo Security
As a compliance and security advisor, public speaker, and co-host of the Zero Trust Journey podcast, Zach specializes in navigating the complex intersection of security, compliance, and product strategy. At Menlo Security, I lead efforts to build compliance-driven security solutions that align with frameworks like FedRAMP, DoD IL levels, and global regulatory standards. My work focuses on empowering enterprises to thrive in high-risk industries through secure, scalable solutions and actionable compliance strategies.
Alexander Salazar - Thursday, February 6th, 2025
Cybersecurity Advisor with CISA Region 10
PLEASE NOTE – February Chapter Meeting is Online due to inclement weather
Summary:
Join Alexander Salazar, Cybersecurity Advisor with CISA, as he discusses one of the most prevalent cyber threats to face US Critical Infrastructure, Volt Typhoon. This presentation will cover their known tactics, objectives, and what you can do at your organization to mitigate it.
Bio
Alexander Salazar – Cybersecurity Advisor with CISA Region 10
Experienced Cybersecurity Leader with a demonstrated history of working in the Defense Sector and Higher Education. Skilled in Incident Response, Intelligence Analysis, Operational Planning, Risk Analysis, Network Traffic Investigations, Vulnerability Management, and hosting Analytical Workshops. Holds a Bachelor of Applied Science in Information Technology and Administration Management specializing in Cyber Security from Central Washington University. Holds a Master of Information Systems from the University of Washington. Fluent in Spanish and have experience working in South America, Asia, and the Middle East.
Tony North - Thursday, Januray 9th, 2025
Senior Manager of IT Service, King County
Tony North
Time: 6 pm meet and greet, 6:30 start
Location: Zoom and Mercer Island (register with Eventbrite for location)
Eventbrite tickets for in person attendance only
Summary:
Navigating the cybersecurity landscape of 2025 demands a multifaceted approach, combining technological solutions with an emphasis on human risk management to address the myriad of challenges presented. By fostering awareness, implementing robust protection strategies, and focusing on critical areas such as access control, threat detection, and employee education, individuals and organizations can significantly enhance their security posture. Living with security stands to lead this journey while finding innovative solutions that seamlessly integrate into comprehensive cybersecurity strategies. Join me to learn how to enhance your cybersecurity posture and strengthen your defenses against the evolving digital threats of today and tomorrow.
Bio
Tony North – Senior Manager of IT Service, King County
Tony is a seasoned professional with a diverse career in management, IT, Cyber Security, and HR. His technology journey began in the U.S. Marine Corps, leading to a groundbreaking role as the first PC Software Trainer at SAFECO Insurance. He has contributed to over 200 software implementations for industry leaders like HEAT by iVanti and Magic Solutions by McAfee. His international work spans 26 countries and 42 U.S. states, offering global business insights. Holding a Bachelor of Science in Business Operations and Supervision from the University of Phoenix, he is a Lifetime Member of the National Society of Collegiate Scholars. Residing in Bothell with his three children, Tony is a dedicated volunteer, mentor, and coach, supporting nonprofits, the YMCA, and youth sports. His passion for chess, shared with his father in world tournaments, reflects his commitment to continuous learning and personal growth.
Kip Boyle and Jake Bernstein - Thursday, December 5th, 2024
Kip Boyle & Jake Bernstein
Time: 6 pm meet and greet, 6:30 start
Location: Zoom and Mercer Island (register with Eventbrite for location)
Eventbrite tickets for in person attendance only
Summary:
Join us for the first-ever live recording of the Cyber Risk Management Podcast with co-hosts Kip Boyle and Jake Bernstein. Kip and Jake will discuss their favorite Special Publications from the 800-series and promise to go beyond 800-53 and explore a wider catalogue from NIST. They will also take audience questions and do their best to include them in the episode.
Bio:
Kip Boyle – Principal Cyber Risk Opportunities, LLC
I’ve been working in cybersecurity since 1992. I started as an air force officer, leading information technology teams. My assignments had us handling very sensitive information related to air-to-air weapons testing, so we were expected to practice what I now call “good cyber hygiene”. My most challenging job during this time was director of wide area network security for the F-22 “Raptor”. At the time, we were getting ready for the first production jets to come down the assembly line. It was very exciting!
After the USAF, as a project leader at Stanford Research (SRI), I helped many Fortune 100 firms grapple with cybersecurity on a large scale. The problems they were dealing with were often 5 years or more ahead of the mainstream. So, there were no “off-the-shelf” solutions and many of our customers didn’t even know where to start. With no one else to turn to, they would come to us.
Fast forward a few years and I was selected to be Chief Information Security Officer (CISO) of an insurance company. They owned a few subsidiaries, so I was also providing cybersecurity leadership to senior decision-makers of a community bank, credit union, debit/credit card transaction processor, and an IT managed service provider. I learned a lot about the business value of cybersecurity during those years.
Then, in June of 2015, I launched my own company, Cyber Risk Opportunities. These days, cyberattacks are hurting businesses, even bankrupting them. That’s wrong! We help executives manage cyber as the business risk it has become. So they’ll be ready no matter what happens. Setting priorities is a big goal in our work.
Today, we have a lot of customers. Right now, we’re helping both a professional basketball team and a biotech company optimize their cyber risk management programs. It’s great to be able to use the same approach to help organizations that are so different in just about every obvious way. But, just under the surface, they are both very similar in terms of the cyber risk practices they need to follow.
My mission is to enable executives to become more proficient cyber risk managers. Our customers include the U.S. Federal Reserve Bank, Boeing, Visa, Intuit, Mitsubishi, DuPont, and many others.
And, because so many organizations in the US need better cyber risk management at the executive level, we’ve launched a partnership program so other professionals in positions of trust, such as lawyers and technology service providers, can use our tools and methods to help their existing customers thrive as cyber risk managers. Ask me about it!
Jake Bernstein – Cybersecurity & Privacy Partner at K&L Gates, CISSP, CIPP/US
Jake Bernstein is a practicing attorney and CISSP/CIPP/US who counsels clients trying to understand their cybersecurity risks and the legal duties that arise from those risks. In his decade-plus of practice, Jake has acted as both regulator as an Assistant Attorney General with the Washington State Attorney General’s Office and as private defense counsel representing companies subject to data security and privacy regulations enforced by federal, state, and international authorities.
Secure World - November 6-7, 2024
Meydenbauer Center
Frank Simorjay - Thursday, October 3rd, 2024
Principal Program Manager at Microsoft
Frank Simorjay
Time: 6 pm meet and greet, 6:30 start
Location: Zoom and Mercer Island (register with Eventbrite for location)
Eventbrite tickets for in person attendance only
Summary:
Microsoft Secure Futures Initiative (SFI) what is it?
We are thrilled to welcome our Chapter President Frank Simorjay to discuss Micrsoft’s Secure Futures Initiative.
In today’s rapidly evolving digital landscape, the importance of robust security measures cannot be overstated. This presentation delves into the Secure Future Initiative (SFI) by Microsoft, a comprehensive approach designed to transform and fortify our security foundation. Frank will explore the strategies and technologies Microsoft is implementing to protect against emerging threats and vulnerabilities.
The discussion will highlight how Microsoft’s efforts in enhancing security can serve as a model for organizations worldwide. By examining real-world scenarios, Frank will illustrate the proactive measures taken by Microsoft to ensure the integrity and resilience of its systems.
Attendees will gain insights into the essential principles of the SFI, including threat modeling, secure coding practices, and continuous monitoring.
Bio
Frank Simorjay is a Principal Program Manager at Microsoft. He is a cloud security architect and content developer with an extensive library of security content for Microsoft. He is passionate about promoting security computing, smart cloud adoption, and Internet of Things (IoT) security. He also enjoys working with LLMs. He is a CISSP and ISSA Distinguished Fellow and has been recognized as a distinguished fellow with the Association. He is also the founder of the ISC2 Seattle chapter and ISSA Puget Sound.
Kip Boyle - Thursday, September 5th, 2024
CEO of Cyber Risk Opportunities LLC
Kip Boyle
Time: 6 pm meet and greet, 6:30 start
Location: Zoom and Mercer Island (register for location)
Eventbrite tickets for in person attendance only
Summary:
How to Really Make Sure that Cybersecurity is Everyone’s Job
We are thrilled to welcome Kip Boyle, the founder of Cyber Risk Opportunities LLC, as our guest speaker. Kip is a renowned expert in cyber risk management with a distinguished background in the U.S. Air Force. He will be presenting on the crucial topic, “How to Really Make Sure that Cybersecurity is Everyone’s Job.” Join us to gain valuable insights from Kip’s extensive experience and learn practical strategies to foster a culture of cybersecurity within your organization.
Bio:
I’ve been working in cybersecurity since 1992. I started as an air force officer, leading information technology teams. My assignments had us handling very sensitive information related to air-to-air weapons testing, so we were expected to practice what I now call “good cyber hygiene”. My most challenging job during this time was director of wide area network security for the F-22 “Raptor”. At the time, we were getting ready for the first production jets to come down the assembly line. It was very exciting!
After the USAF, as a project leader at Stanford Research (SRI), I helped many Fortune 100 firms grapple with cybersecurity on a large scale. The problems they were dealing with were often 5 years or more ahead of the mainstream. So, there were no “off-the-shelf” solutions and many of our customers didn’t even know where to start. With no one else to turn to, they would come to us.
Fast forward a few years and I was selected to be Chief Information Security Officer (CISO) of an insurance company. They owned a few subsidiaries, so I was also providing cybersecurity leadership to senior decision-makers of a community bank, credit union, debit/credit card transaction processor, and an IT managed service provider. I learned a lot about the business value of cybersecurity during those years.
Then, in June of 2015, I launched my own company, Cyber Risk Opportunities. These days, cyberattacks are hurting businesses, even bankrupting them. That’s wrong! We help executives manage cyber as the business risk it has become. So they’ll be ready no matter what happens. Setting priorities is a big goal in our work.
Today, we have a lot of customers. Right now, we’re helping both a professional basketball team and a biotech company optimize their cyber risk management programs. It’s great to be able to use the same approach to help organizations that are so different in just about every obvious way. But, just under the surface, they are both very similar in terms of the cyber risk practices they need to follow.
My mission is to enable executives to become more proficient cyber risk managers. Our customers include the U.S. Federal Reserve Bank, Boeing, Visa, Intuit, Mitsubishi, DuPont, and many others.
And, because so many organizations in the US need better cyber risk management at the executive level, we’ve launched a partnership program so other professionals in positions of trust, such as lawyers and technology service providers, can use our tools and methods to help their existing customers thrive as cyber risk managers. Ask me about it!
https://www.linkedin.com/in/kipboyle/
Tory Fisher - Thursday, July 11th, 2024
Director of Operations at Rhino Security Labs
Tory Fisher
Time: 6 pm meet and greet, 6:30 start
Location: Zoom and Mercer Island (register for location)
Eventbrite tickets for in person attendance only
Summary:
Working with a Pentest Project Manager & Tips for Being Your Own PM
We will explore the role of a Pentest Project Manager (PM), focusing on overseeing and coordinating penetration testing projects. It details the PM’s responsibilities from project initiation and team coordination to risk management and client communication. Tips and strategies will be shared for pentesters who manage their own projects, offering insights into effective planning, time management, documentation practices, and client interactions. The session aims to equip cybersecurity professionals, familiar with penetration testing, with practical knowledge to enhance project management skills or navigate projects independently.
Bio:
As Director of Operations, Tory’s leadership plays a critical role in managing day-to-day operations at Rhino Security Labs. Her dedication to our clients and team members has ensured strong and happy partnerships.
Prior to Rhino, she obtained her MBA from Loyola University and brings experience in a diverse range of industries. Her exposure into industries such as cybersecurity, aviation, family business consulting and medical research has equipped her to handle almost any business challenge.
Though her experience is diverse, it has always had a technology component that she has become passionate about throughout her career. She has developed curriculum and held executive trainings on cybersecurity best practices, led full-scale CRM migrations and implementations, as well as managed information technology operations.
Her passion for technology, people, project management, innovation, and team collaboration makes her a unique and valued asset to Rhino Security Labs.
Doug Cavit - Thursday, June 6, 2024
CISO of Snohomish County
Doug Cavit
Time: 6 pm meet and greet, 6:30 start
Location: Zoom and Mercer Island (register for location)
Eventbrite tickets for in person attendance only
Summary:
What is a “Service SBOM” in a virtualized world and why should I care?
There is a new concept that is gaining traction with industry and government called a “Service SBOM” or service bill of materials. This talk will focus on what it is, how can it help me, and why you should care. We live in a world that with an increasingly deep and diverse supply chain that we can only ignore at our peril. Recent events show that not only financially motived bad actors but nation state entities are working to weaken and create entry points in the supply chain. The rise of ever increasing levels of virtualization through cloud services and containerization compound this issue. The talk will offer some practical advice on what to look for and how to get value from this new concept with a focus on practical solutions.
Bio:
Doug Cavit was part of the CISA working group that recently published guidance on Shared Service SBOM’s in cooperation with all the major cloud service providers. He has been involved in IT security for over 20 years as CIO of McAfee and Chief Security Strategist at Microsoft and is currently CISO for Snohomish County. He has been involved in setting security standards for the financial services and utility industries as well as the ISO process for secure software development. Mr. Cavit has helped the Global Fortune 1000 and governments around the world on security.
Ronald "Ron" Dean Watters Jr - Thursday, May 2, 2024
Cybersecurity and Infrastructure Security Agency
Ron Watters, MCSE, CNA, GSLC
Time: 6 pm meet and greet, 6:30 start
Location: Zoom and Mercer Island (register for location)
Eventbrite tickets for in person attendance only
Summary:
Cybersecurity Advisor, Private Sector Western Washington
Cybersecurity and Infrastructure Security Agency
Bio:
Ron serves as the Region 10 Private Sector Cybersecurity Advisor for the Cybersecurity and Infrastructure Security Agency. Based in Seattle, WA, he supports the Department of Homeland Security (DHS) mission of strengthening the security and resilience of the nation’s critical infrastructure.
His program coordinates cyber preparedness, risk mitigation and incident response, and provides cyber security resources, including assessments, to the nation’s sixteen critical infrastructure sectors and state, local, tribal, and territorial government entities.
Prior to joining DHS, Ron served 27 years with the U.S. Navy and Naval Reserve as a Submarine Sonar Technician and Diver. Finding not much use for a Submarine Sonar Technician in the Surface reserve Ron utilized his talents as an Intelligence Analyst and was utilized accordingly. Ron retired from the US Navy in 2007. During his active duty Ron completed his Bachelor’s degree in Public Administration with Criminal Justice emphasis (Cum Laude). Ron completed his two Master’s Degrees in Education (School Administration and Secondary Education) at Loyola Marymount University. He continued his education and achieved certification as a Microsoft Certified Systems Engineer and Microsoft Certified Trainer, he was hired as the Computer Science Department Chairman at Chaminade College Preparatory High School in West Hills, CA until he was recalled to Active duty following 9/11. Upon his demobilization he was offered a position as the Deputy, Information Systems Management Officer with the 4th Marine Corps recruiting District in New Cumberland, PA. He rose to the position of S-6 before leaving in 2009 to take a position as the Chief, Information Assurance Division, Network Enterprise Center Ft Irwin, CA. Ron remained in that positon until he left to become the Branch Manager of the Cybersecurity Branch of the Puget Sound Naval Shipyard in March of 2016. Ron interviewed and was hired as the Region X Cybersecurity advisor in June of 2017 and has filled that position presently.
Ron’s computer certifications are numerous to include Microsoft Certified Systems Engineer (MCSE), Certified Novell Administrator (CNA), GIAC Security Leadership Certification (GSLC), CompTia Security+ CE, and Microsoft Certified Trainer (MCT). In addition to the professional certifications Ron has been awarded numerous Commander’s Coins for excellence and received Two Commander’s Awards for his work at Fort Irwin.
Frank Simorjay - Thursday, April 4, 2024
Choose Your Cyber Adventure!
Frank Simorjay, CISSP
Time: 6 pm meet and greet, 6:30 start
Location: Zoom and Mercer Island (register for location)
Eventbrite tickets for in person attendance only
Summary:
Welcome, cybernauts, to an adventure where your choices forge the path of knowledge. Before you lies a digital realm riddled with challenges and opportunities. Will you delve into the abyss of Security Reviews, navigate the treacherous waters of Software Bill of Materials, or decode the enigmas of Microsoft Security – Inside and Out?
Cast your vote during the meeting, shape the quest, and let the journey to cybersecurity knowledge begin!”
Bio:
Frank Simorjay is a Principal Program Manager for the Industry Cloud Solutions team at Microsoft. He is a cloud security architect and content developer with an extensive library of security content for Microsoft. He is passionate about promoting security computing, smart cloud adoption, and Internet of Things (IoT) security. He also enjoys working with LLMs. He is a CISSP and ISSA Distinguished Fellow and has been recognized as a distinguished fellow with the Association. He is also the founder of the ISC2 Seattle chapter and ISSA Puget Sound.
Janet Lawless - Thursday, March 7, 2024
Unmasking the Shadows: Demystifying Clever Adversary Strategies and Tactics
Janet Lawless
Time: 6 pm meet and greet, 6:30 start
Location: Zoom and Mercer Island (register for location)
Eventbrite tickets for in person attendance only
Summary:
Your organization understands their strengths, weaknesses, critical assets and gaps in your defenses. The problem is, so do your adversaries.
Adversaries are sophisticated, clever, motivated and highly focused. Attacks are well planned, coordinated and use a variety tactics combining cyber, physical, human and technical to accomplish their goals. Learn more about adversarial focus, strategies and tactics and how an effective, holistic threat intelligence program can proactively mitigate attacks and get you ahead of the game. No matter how big or small your organization…they are out to get you! Knowing your adversaries and having threat intelligence throughout your organization, gives you strategic advantage to protect your organization.
Bio:
Janet is CEO and Founder of Center for Threat Intelligence. Janet established a team of intelligence experts to build a cutting-edge threat intelligence consulting, training and a certification program for Certified Threat Intelligence Specialists (CTIS). Center for Threat Intelligence is an approved provider for Department of Homeland Security’s (DHS) National Initiative for Cybersecurity Careers and Studies (NICCS), part of the National Initiative for Cybersecurity Education (NICE).
In former leadership roles at Microsoft and Cisco, she created and managed global programs focused on risk management, compliance and security. In addition, she was the VP of Sales and Channel Sales at Critical Insight, a cybersecurity start-up.
Janet is a member of InfraGard, the United States Secret Service Cyber Fraud Task Force and the Washington State Fusion Center. She has served as Board Chair for ASIS International Puget Sound Chapter and the Pacific Coast Analyst Roundtable. She is an Emeritus Board Member for the American Red Cross. Janet also founded “PCs 2 Vets” and has provided over 1,000 laptops to veterans in need.
Brian Shea - Thursday, February 1, 2024
How Security Teams can Understand LLMs and Generative AI
Brian Shea
Time: 6 pm meet and greet, 6:30 start
Location: Zoom and Mercer Island (register for location)
Eventbrite tickets for in person attendance only
Summary:
In this discussion we will talk about AI, specifically LLMs and Generative AI, and how security teams can understand these technologies, and work to embrace them while managing the risk these new technologies pose. What are good frameworks to use in assessing these risks and what are the challenges we still face?
Bio:
Brian is an IT Executive with 29 years of experience from Security Operations and Support, Compliance, Risk Management, Technology Innovation, IT Operations and Support. Currently Brian is a Business Information Security Officer (BISO) supporting multiple business units at Salesforce, delivering security and compliance across our people, process, technology, and data. In addition to this he has worked in Security and GRC at Starbucks, Microsoft, and Bank of America as well as served as a Cybersecurity Advisor for CREATE.ORG, sat on the Board of Technical Advisors for NODUS technologies, served as an alternate to the PCI-DSS Customer Advisory Council, held CISSP and CISM certifications, and has published 2 books and 3 industry papers on security.
Jake Bernstein - Thursday, January 4, 2024
Proliferation of Privacy Laws: Annual Update
Jake Bernstein
Time: 6 pm meet and greet, 6:30 start
Location: Zoom and Mercer Island (register for location)
Eventbrite tickets for in person attendance only
Summary:
The world of privacy and cybersecurity regulation has continued to expand at a blistering pace. The number of states with comprehensive privacy laws went from 5 in December 2022 to twelve as of December 2023. Numerous federal agencies have promulgated and begun enforcing new privacy and cybersecurity rules, most notably the Securities Exchange Commission. This meeting will provide you with all the updates on this important topic from Jake Bernstein, ISC2 Chapter Secretary, partner at K&L Gates LLP, and Adjunct Professor at Seattle University School of Law.
Bio:
Jake Bernstein is a practicing attorney and CISSP who counsels clients trying to understand their cybersecurity risks and the legal duties that arise from those risks. In his decade-plus of practice, Jake has acted as both regulator as an Assistant Attorney General with the Washington State Attorney General’s Office and as private defense counsel representing companies subject to data security and privacy regulations enforced by federal, state, and international authorities.
Archive
- January |
- February |
- March |
- April |
- May |
- June |
- July |
- August |
- September |
- October |
- Novemember |
- December |
- January | Bryan Hurd
- Presented by a “seasoned cyber smoke jumper” who has handled thousands of breach events, espionage investigations, and is also a cyber insurance expert. This session is designed for Risk Officers, CEOs, COOs, General Counsels and CISOs in relation to cyber security. The presentation will cover technical threats including ransomware attacks, intrusions, email compromises, invoice scams, and other major incidents that can create significant financial losses and sometimes even mean the extinction of organizations. It will furnish insights from the insurance industry, discuss pertinent areas in the underwriting process that can help companies be ahead of the threat, and provide proactive measures that executives can do today to mitigate risk. The session will also cover what it’s really like to be in the boardroom during a cyber even. The session will include an interactive Q&A.
- Archived Video
- February | Board Panel
- Advice from the (ISC)2 Seattle Chapter and featured guests about entering the cybersecurity field.
- Archived Video
- April | Tony Moor
- Tony Moor will dive into the world of silicon hacking and hardware reverse engineering. The changes in hacker’s techniques as well as their tools as security has improved along with the natural shrinking of semiconductor devices continues (Moore’s Law). From a basic setup costing thousands of pounds in the 90’s, a potential attacker may now need significant financial backing, certainly in the range of hundreds of thousands of pounds. That and the need to learn complex scientific techniques such as SEM (Scanning Electron Microscopy) and FIB (Focused Ion Beam) in order to be successful. Tony will take us along the journey of this exciting evolution.
- Archived Video
- May | Aaron Sheridan
- In this presentation, Aaron Sheridan will present the recent advanced infiltration techniques, along with a working demo of a recently used A-iTM attack method that includes Credential Harvesting.
- Archived Video
- June | Alan Luk
- How do you assess your org’s security posture? Do you use a risk or controls-based framework? How often are you gathering signals to perform the assessment? In this session, we will talk about the benefits of having automated metrics to enhance your risk management process, achieve a higher level of security assurance, and streamline audits.
- Archived Video
- July | No Meeting
- August | Aaron Weller
- HP’s Privacy Engineering Center of Excellence. Providing technical leadership and data engineering solutions designed to be leverageable across HP’s global operations.
- Archived Video
- September | Tim Rains
- Select Insights from Cybersecurity Threats, Malware Trends, and Strategies 2nd Edition. Tim Rains will present Cybersecurity Threats, Malware Trends, and Strategies and covers the statistical aspects and potential approaches to help decision makers be informed when creating or updating their company’s cybersecurity strategy.
- Archived Video
- October | Bugra Karabey
- Strategic Partner Cybersecurity at Datacenters.
- November | No Meeting will be at SecureWorld
- Connecting, informing, and developing leaders in cybersecurity.
- December | Steve Louden
- Join us for fire chat with Steve Louden to discuss how Cyber Risk Management and IT Controls influence financial forecasts and impact to companies’ bottom line. During the discussion Steve will share importance of IT controls through the lens of CFO and how cyber risk management changed how companies plan and respond to cyber risk. Learn what is important to Audit Committees in context of cyber risk management and how to convey cyber priorities using business language.
- December | Jake Bernstein, CISSP, CIPP/US
- The past three years were saturated with change and upheaval. From state-level battles concerning private rights of action to the adoption of privacy laws across the globe, the data protection and security industry refuses to stand still. This presentation looks forward to 2023 by chronicling years past. Forthcoming legislation and regulations tackling data protection respond to pitfalls and triumphs under existing structures.
- Archived Video
- October | Paul Brunson, VP of Engineering
- Developing a practical cybersecurity strategy can be a daunting task. Where do you start? What issues should I address? How do I know what to protect? While each company’s strategy will be unique to them, the basic ideas and concepts of an actionable cybersecurity strategy are the same whether you’re the CISO of a Fortune 500 company, or the Director of IT (who also happens to own Security!) at a mid-market manufacturer. Understanding your business, aligning with corporate strategy, and defining the scope and the risks, are just a few of the concepts that ALL companies must do, in order to develop a successful cybersecurity strategy.
- Archived Video
- September | Erez Benari
- As one might expect of a company the size of Microsoft, the company operates a significant infrastructure for issuing and managing certificates using a custom system known as “SSLAdmin”. Built over decades, with multiple redundancies and controls, as well as an external auditing process, this system powers a massive amount of websites, from Microsoft.com itself to hundreds of Azure services, some of which require thousands of certificates issued daily. This 45-minute presentation will explore the technology concepts behind this system and what makes it unique, in addition to some fascinating stories from the trenches and lessons-learnt from battle-scars.
- No Video
- June | Javier Salido
- The evolution of privacy and the ethical use of machine learning in the tech industry.
- Archived Video
- May | David Hobbs
- Hacking like a White Hat Wizard
- Archived Video
- April | Michael LeSueur
- We’ll navigate through uncharted security territory by analyzing the attack lifecycle in the cloud and dissecting a real-world attack. The same technology that makes the cloud dynamic can have the opposite effect on an organization’s ability to implement detection and response in cloud environments. This includes the adding additional layer of preventative controls in addition to MFA, because it’s increasingly being bypassed in O365 as an example. Michael LeSueur, Security Engineer at Vectra, will help us navigate through the uncharted security territory by analyzing the attack lifecycle in the cloud, reviewing the top cloud security threats, and dissecting a real-world cloud attack. Additionally, he’ll provide key takeaways for managing access, detection and response, and security operations.
- Archived Video
- March | Trey Blalock
- Deepfakes, Voice Cloning, Synthetic Identities, and the Future of Fraud.
This talk is a fast-paced overview of some interesting tools and techniques used by threat actors and a discussion of the implications for the future of fraud. Trey will also be discussing some of the long-term issues that defenders need to be aware of, some mistakes businesses need to avoid, and how to protect your organizations from these types of attacks. - Archived Video
- Deepfakes, Voice Cloning, Synthetic Identities, and the Future of Fraud.
- February | Jon Espenschied
- Unified GRC approaches, or “how not to bury people in policies they won’t follow.”
- Archived Video
- January | Tim Rains
- Tim Rains is the author of Cybersecurity Threats, Malware Trends, and Strategies, which covers vulnerability disclosure trends, malware trends, web-based threats, and an in-depth examination of cybersecurity strategies that the industry has used to try to mitigate them. Tim wrote this book after working as the most senior cybersecurity advisor at both Microsoft and Amazon Web Services.
- Archived Video
- November | Lori Murray, CISSP
- Risk Management Framework is a process that integrates cyber security, privacy, and supply chain mitigations into the system development life cycle. Controls are selected and tailored specific to the needs of each instantiation allowing a holistic approach to defining security architectures in order to minimize security risk. During this session we explore the basics of Risk Management Framework as called out in NIST SP 800-53 and associated NIST SP 800 publications.
- Archived Video
- October | Ethan Shackleford
- The technology sector today is evolving more quickly than ever – with the rise of new industries – greatly expanding the scope of knowledge required to evaluate the security of systems and environments; it can feel as we are getting further and further ‘away from the metal,’ especially with the explosion of cloud technology abstracting details even further beyond shiny APIs. But there’s a commonality behind the novel abstractions: hardware. Understanding the operations of this hardware and its exposure to threats – is the essential knowledge needed by infosec professionals of all industries to improve security operations.
- Archived Video
- September | Jake Bernstein, CISSP
- Exploring the 2021 Verizon Data Breach Investigations Report. Every year the Verizon cybersecurity team publishes a report analyzing the data and trends from the past year of cybersecurity investigations. Every cybersecurity professional should review the report because it is full of amazing insights and useful trends. This presentation will adapt the content from two episodes of The Cyber Risk Management Podcast to provide a distilled version of the 2021 DBIR and provide ample opportunity for discussion.
- Archived Video
- August | Abraham Kang
- GraphQL is coming to replace your REST APIs. Built on the promise of providing more flexible access to your data, there has to be a catch. Come to this talk if you would like a comprehensive overview of the known security vulnerabilities in GraphQL applications. We will also cover mechanisms and design patterns that you can use to secure your GraphQL applications from these attacks.
- Archived Video
- June | Bryan Hurd
- Cyber Smoke Jumper – Days, Nights and Weekends in the Life of a Breach Responder. This session is a view into the past, present and future of cyber attacks hitting our companies, communities and families. Leading global teams that General Counsels, CEOs and CISOs call in emergencies or to avoid one, Bryan will be discussing not only some of the trends and technical issues in what the adversaries are doing, related to ransomware, intrusions and extortion, but the way that technical and executive leaders can protect, avoid, or respond to attacks from cyber criminals or insiders. Bryan will also be discussing the skills, certifications, and network of professionals that make collective response to this global threat possible.
- Archived Video
- May | Joe Szymusiak
- Data the Unintended Consequences. Where, what, and how personal data has been used and abused.
- Archived Video
- April | Fernando Maymi
- Collective Defense is a multiparty strategy in which each member of a community freely contributes to the cybersecurity of the others and, in so doing, improves its own security. It is the idea that organizations defend as a team. Participants trust each other and cooperate in matters of cybersecurity while remaining competitive in the marketplace. The Collective Defense Framework comprises three components. Cooperation which requires that all participants work together to achieve a collective effect that would have been impossible to be done in isolation. Intelligence which entails collaborating on the production and sharing of friendly information and threat intelligence to develop a common operational picture. Activities and initiatives in these first two components are validated, practiced and enhanced through the third component, Training and Exercises.
- Archived Video
- March | Frank Simorjay
- Come join us in our upcoming ISC2 Seattle meeting where Frank Simorjay ISC2 Seattle Chapter President will share his expertise at Microsoft and present on the topic of Securing Privileged Access processes, and what you should considering in building own Privileged Access Workstations (PAW).
- Archived Video
- February | Dan Griffin
- I will discuss the role that privileged access plays in preventing future Solar Winds like attacks. I will provide specific examples of hardware and toolchain security measures that you can adopt for secure software development.
- No Video
- January | Jean Pawluk, CISSP
- All that glitters… Applying lessons learned to date to emerging technologies.
- Archived Video
- December | Marc Coady, CISSP
- One-man Band – My personal experience as the first IT Security Manager of MOD Pizza.
- No Video
- November | Trey Blalock, CISSP
- Why APT’s have Changed the Economics of Security.
- Archived Video
- October | Jake Bernstein, CISSP
- Creating a cybersecurity program that meets the FTC’s standard for reasonableness based on the NIST CSF.
- Archived Video