Stay Connected


More...

SECURITY THEME SPONSORS:
Nokia

SECURITY THEME WHITE PAPERS:

TriGeo Network Security: Proactive Network Security

Global Events

Interop Las Vegas
May 17 - 21, 2009
Mandalay Bay Convention Center
Las Vegas, NV

Interop Tokyo
June 8 - 12, 2009
Makuhari Messe (Nippon Convention Center)
Tokyo, Japan

Interop São Paulo
September 2 - 3, 2009
Transamerica Expo Center
São Paulo, Brazil

Interop New York
November 16 - 20, 2009
Jacob K. Javits Convention Center
New York, NY

Conference: IT Security Track

Track Chair:
John P. Pironti
CGEIT, CISA, CISM, CISSP, ISSAP, ISSMP
Chief Information Risk Strategist
CompuCom

Information Security Technology has evolved to address the new challenges of the now non-existent perimeter. The new generation of information security technological controls needs to be capable of addressing new threats while still accounting for the traditional threats that are still as viable and capable of damaging information infrastructure. Enterprises are incorporating new and exciting information technologies including Web 2.0 capabilities and Virtualization as well as maturing their current capabilities to ensure ongoing success of their businesses. These capabilities expand the threat landscape which they are now exposed to as well. The security program at Interop New York 2008 will focus on current and emerging threats and challenges associated with the protection of information and information infrastructure as well as the current leading practices in identifying, mitigating, and resolving them.

Open All Descriptions |

Close All Descriptions

Wednesday, September 17
1:30 pm–2:30 pm	Conference Sessions Preventing Data Leaks: How to Identify, Protect and Sustain Sensitive Data Concept For security programs to be successful in 2008, executives must be able to consistently evaluate their organization's security performance, determine the highest "at risk" areas within the organization, and ensure that their most sensitive data remains protected. This includes evaluating sensitive information, writing enforceable policies, implementing appropriate security mechanisms, educating employees on policies and compliance and assessing and monitoring the security program once in place. Businesses who can find a way to securely share information and protect it from exploitation while complying with strictly enforced governmental regulations will emerge as leaders. This session will discuss the value of protecting sensitive content within an organization and study the steps required to plan, implement, deploy and sustain a solution to secure it. Speaker - Todd Graham, Chief Scientist, RSA, The Security Division of EMC Todd Graham brings a unique blend of technical knowledge and an understanding of market requirements that allows RSA to provide powerful solutions to real-world problems. During his tenure at Tablus (now RSA Security), Graham has been an integral part in the development of the Tablus content loss prevention platform that enables organizations to locate, monitor and protect sensitive content from loss or misuse. Graham joined Tablus through its acquisition of Indigo Security in January, 2005 where he was the founder and chief technology officer. Prior to founding Indigo, he was founder and CEO of Digital-3, a digital audio device platform start-up. Graham was honored as the Michigan Young Entrepreneur of the Year in 2002 and named one of BusinessWeek's Best Young Technology Entrepreneurs in 2007.
2:45 pm–3:45 pm	Conference Sessions What About the Endpoint? A Discussion of Endpoint Security Concepts and Trends The attack community has begun to shift gears and focus more on the endpoint and less on the network, as well as the supporting infrastructure that the endpoint relies upon. This new level of attention has already resulted in numerous attacks using spyware tools, Trojan horse applications, keystroke loggers and other malicious software that is being installed without the knowledge of the users and under the radar screen of current endpoint protection techniques. This session will discuss the key concepts that need to be considered when choosing an endpoint security solution and highlight some of the capabilities that exist in the market today for endpoint security solutions. Moderator - Khalid Kark, Principal Analyst , Forrester Research Khalid is a leading expert in the areas of information security services, strategy and IT GRC (Governance Risk and Compliance). Khalid's research focuses on building and maintaining effective security programs and making (CISOs) Chief Security Officers more successful in their role. . His research focuses on the strategies, operational processes, and organizational structures for developing and maintaining effective security programs. Khalid covers information risk management, information security strategy, best practices and metrics. He also covers security governance topics such as roles and responsibilities, policies, awareness, training and reporting for the security organization. Khalid has been widely quoted in the press, including such media outlets as Boston Globe and the Wall Street Journal. Khalid is a frequent keynote speaker at national and international executive conferences. During his career, Khalid has worked in both the consulting and enterprise sectors. Prior to joining Forrester, he worked for a global insurance company where he provided leadership and direction for the information security program. Previously, Khalid consulted organizations in healthcare, finance, entertainment and communication industries on information security strategy and architecture. Khalid holds a master's degree in telecommunications management from University of Pennsylvania and a bachelor's degree in business and economics from University of Texas at Austin. Khalid is also a Certified Information Systems Security Professional (CISSP) and Certified Information Security Manager (CISM), and a Certified Information Security Auditor (CISA). Speaker - Dave Marcus, Director of Security Research and Communications, McAfee Avert Labs Dave Marcus serves as Director of Security Research and Communications for McAfee Avert Labs. In this role he brings McAfee's extensive security research to McAfee's customers and the greater security community. Marcus also serves as blogmaster for the McAfee Avert Labs Security Blog and co-host of AudioParasitics - The Official PodCast of McAfee Avert Labs. Marcus is also responsible for all publications from Avert Labs, including Avert Labs' journal of security vision The McAfee Security Journal. Mr. Marcus has more than ten years of technical experience in network solutions, information technology security, network performance and integration, and e-learning solutions. Prior to joining McAfee, Mr. Marcus held leadership and consulting positions focused on information technology security services, network solutions, enterprise management, knowledge engineering and management, information technology, and research and development program management. His industry experience crosses all IT-based industries with a determined focus on advanced intelligence gathering, digital forensic analysis, as well as intrusion detection/prevention and analysis on both the network and host. Marcus holds a Bachelor of Arts degree in Philosophy from Florida Atlantic University. He has countless hours of industry specific training, including Advanced Intrusion Analysis Methods, as well as Penetration Testing/Vulnerability Assessment and Computer Forensics. Speaker - Jim Waggoner, Sr. Principal Product Manager, Endpoint Security Group, Symantec Speaker - Mark Harris, Global Director, SophosLabs, Sophos Mark Harris joined Sophos in September 2005 as Global Director of SophosLabs. Based at Sophos's global headquarters near Oxford, Harris manages the company's worldwide threat analysis teams, which deliver round-the-clock protection to its growing worldwide customer base. Harris joined Sophos from McAfee where, since 1997, he held the positions of Director of Engineering, Chief Software Architect and Senior Development Manager. A respected security industry expert, Harris was responsible for a 30-strong team covering multiple sites, including the UK, India and Canada. Harris leads Sophos's team of experts, based in the UK, Australia, Canada, and US, which issues 24-hour protection in order to ensure its customers' networks automatically detect and block new threats. He also manages proactive technology development, including Sophos's Genotype detection technology, which uses forensic analysis to identify suspicious patterns and characteristics unique to either a virus family or a spam campaign. In the past Mark has presented at a variety of industry events including Infosec, APWG, Hacker Halted as well as a number of Webcasts,TV and Radio. Speaker - Michael Maloof, CTO, TriGeo Network Security Michael Maloof, CISSP, is the Chief Technology Officer for TriGeo Network Security where he leads an award-winning team of engineers and researchers working on the cutting edge of real-time network security analysis, event correlation and automated remediation. As a serial entrepreneur, TriGeo is Michael's fourth venture in a career that spans twenty five years of technology research, design and development.
4:00 pm–5:00 pm	Conference Sessions Virtual Reality: Understanding the Security and Compliance Implications of Server Virtualization Server virtualization is hot! Whether your executives think green or simply want to save some green, everyone is deploying virtualization - the benefits are undeniable. As we embrace virtualization, we must strategically approach security and compliance from the start. Virtualization introduces new attack surfaces and a swath of new availability risks. This brave new world also impacts how we approach compliance, governance, and risk Management. Joshua Corman will explore best practices and real world successes in assuring virtualization benefits while mitigating new risks. Are you virtually secure? Or are you securely virtual? Speaker - Joshua Corman, Principal Security Strategist, IBM ISS Joshua Corman serves as Principal Security Strategist for IBM Internet Security Systems. With over a decade in security and IT, Corman designs strategic and technical vision of security solutions for emerging issues. He has spoken at leading industry events such as RSA, Interop, InfoSec, LinuxWorld, and IT Security World. His Evolving Threat campaign encourages strategic approaches for dynamic threats. Building Security into Your Software Development Lifecycle In the beginning, software vendors thought that they could handle security vulnerabilities as they handle software bugs using their regular support process. Unfortunately, it's not always so easy. Software security vulnerabilities are not like other software defects; they have a timeline and they are not simply triggered by random user events. Once attackers know how to exploit a vulnerability, they will actively attack until it is patched. This "window of vulnerability" has gotten smaller with auto-update and patch management solutions, but having a window of vulnerability at all is a problem. If you are not doing anything to reduce security flaws during your development cycle, you certainly have them in your software. In this session, Chris Wysopal will explain the steps that reduce security defects and how they will be beneficial to securing your code. Speaker - Chris Wysopal, Co-Founder and CTO, Veracode Chris Wysopal, co-founder and chief technology officer of Veracode, is responsible for the security analysis capabilities of Veracode technology. Mr. Wysopal was recently named one of InfoWorld's Top 25 CTO's and one of the 100 most influential people in IT by the editorial staffs of eWeek, CIO Insight and Baseline Magazine. In 2002 while at the company @stake, Mr. Wysopal, along with Steve Christey of MITRE, proposed an IETF RFC identified as the "Responsible Vulnerability Disclosure Process," which became the foundation for the Organization for Internet Safety (OIS). Mr. Wysopal is a founder of OIS, which established industry standards for the responsible disclosure of Internet security vulnerabilities. Throughout Mr. Wysopal's career he has created the first security research think tank - L0pht Heavy Industries- while at Lotus Development Corp., managed, and later became the vice president of the Research Group at the company @stake, and later became the director of development at Symantec which was responsible for building the binary analysis technology to find vulnerabilities in software. Mr. Wysopal is co-author of the award winning password auditing and recovery application @stake LC (L0phtCrack) which is currently used by more than 6,000 government, military and corporate organizations worldwide. He also wrote The Art of Software Security Testing: Identifying Security Flaws, published by Addison Wesley and Symantec Press in December 2006. Mr. Wysopal earned his Bachelor of Science Degree in Computer and Systems Engineering from Rensselaer Polytechnic Institute in Troy, New York.
Top of Page
Thursday, September 18
10:15 am–11:15 am	Conference Sessions NAC, NAC - What's There? Network access control has been offered as the Swiss army knife of IT security solutions. It has promised to provide authentication, policy enforcement, identity and access management, ongoing security for the life of a connection, seamless usage in any network that is NAC enabled and many other capabilities. If NAC is the answer then what is the right question to ask? This session will provide a realistic perspective on what NAC can and cannot provide in regards to information security. Concepts that will be discussed will include an update on vendor interoperability and standards, case studies of successful and not so successful implementations, an overview of what NAC truly can and cannot provide, discussion of requirements (both network and application), and what the future holds for NAC. Moderator - Mike Fratto, Managing Editor, Labs, Information Week Mike is Managing Editor, Labs, for InformationWeek. He previously was a Senior Technology Editor with Network Computing and Executive Editor for Secure Enterprise. He has spoken at several conferences including NetWorld+Interop, MISTI, the Internet Security Conference, as well as to local groups. He also teaches a network security graduate course at Syracuse University. Prior to Network Computing, Mike was an independent consultant. Speaker - Amith Krishnan, Senior Product Manager, Windows Server Group, Microsoft Amith Krishnan is a Senior Product Manager in the Windows Server group at Microsoft, and is responsible for the product management and marketing of Microsoft Windows Server's platform networking and security technologies. In this role, Krishnan drives the go-to-market strategy for solutions focused around key security and networking initiatives. Prior to joining Microsoft, Krishnan was the Product Line Manager for Enterprise Wireless Solutions at 3Com Corporation. He also held Product Manager and Technical Marketing Engineer positions at Roving Planet, a provider of end point security and wireless network management solutions. Krishnan holds a Masters degree in Telecommunications Engineering from the University of Colorado, Boulder and a Bachelor of Engineering degree in Electronics and Telecommunications from the University of Mumbai, India. Speaker - Brendan O'Connell, Senior Manager, Product Management, Cisco Systems, Inc. Speaker - Stephen Karkula, Security Product Marketing Manager, Nokia Steve Karkula has more than 15 years experience in the networking and network security industries. Steve manages the Nokia Intrusion Prevention System (IPS) with Sourcefire product line including responsibility for global product positioning and messaging. His strong background in Security Event Management provides a solid foundation for his work on Nokia's Intrusion Prevention System. Prior to joining Nokia in 2008, Steve was the Director of Product Management & Business Development at Intellitactics and served as the Vice President of Marketing at RealBlocker. In addition, he has held multiple positions in engineering, evangelism, product management, and product marketing while working for GE, Xerox, Apple, and several start-ups. Steve graduated from MIT and has a BS in Electrical Engineering and Computer Science. Steve Karkula is based at Nokia's campus in Mountain View, CA Speaker - Steve Hanna, Trusted Network Connect (TNC) Co-chair, Trusted Computing Group Steve Hanna is a Distinguished Engineer at Juniper Networks. As co-chair of the Trusted Network Connect Work Group in the TCG and the Network Endpoint Assessment Working Group in the IETF, Steve has a deep and broad understanding of Network Access Control technology. He is the author of many papers, an inventor or co-inventor on 32 issued U.S. patents, and a regular speaker at industry events.
11:30 am–12:30 pm	Conference Sessions Security Vulnerabilities in VOIP Products and Standards This session will examine vulnerabilities that have been demonstrated in VOIP and IPT telephony systems, as well as showing potential security issues in the SIP protocol. Moderator - Eric Krapf, Program Co-Chairman, VoiceCon Eric Krapf was named editor of Business Communications Review at the beginning of 2004, after serving as the magazine's managing editor since 1996. As editor, he is responsible for all magazine content and production, as well as content for BCR's electronic publishing endeavors. Before coming to BCR, he was managing editor and senior editor at America's Network magazine, covering the public telecommunications industry. Prior to working in high-tech journalism, he was a reporter and editor at newspapers in Connecticut and Texas. Speaker - Bogdan Materna, CTO, VoIPshield Systems Inc Speaker - Mark Collier, CTO, Secure Logix Security and Governance of Online and B2B SOA Traffic Increased information privacy legislation requires organizations to secure online processes, including automated business processes with partners. Organizations are challenged to achieve this because their information systems, HR, ERP, CRM, and finance, were not designed to provide the secure interoperability required for automating workflow. Web services technologies offer a new architecture for enterprises struggling to automate business processes - a services-oriented architecture (SOA). While Web services deliver efficient automated workflows, governance is lost. An emerging alternative model for SOA deployment is presented which includes a network-embedded security and compliance infrastructure applicable to healthcare, finance, utilities, state & local government, and education. Speaker - Clifford Grossner, Product Management & Marketing , Alcatel Lucent Enterprise Security Unit Clifford Grossner Ph.D. Cliff is currently responsible for Product Management & Marketing in an Alcatel-Lucent Venture, run out of Bell Labs. Cliff has over 10 years of experience in bringing new products to market in information and communications technology industries. Most recently, he was Vice President, Product Marketing at Sesame Networks, where Cliff was responsible for product vision, go-to-market strategy and product positioning for the company's products, media and analyst relations. Previous to Sesame, Cliff was the Vice President, of Product Line Management for NewStep Networks, a successful telecom start-up. Cliff has also served in a variety of senior positions at both March Networks and Nortel. Previous to Nortel, Cliff worked as a Research Scientist and Faculty Lecturer in the areas of Artificial Intelligence, Distributed Computing, and Computer Architecture. Cliff has a Ph.D. from McGill University and M.Sc. Computer Science from Concordia University, Montreal.
3:15 pm–4:15 pm	Conference Sessions Anatomy of a Malware Attack Today the threat has changed. Hackers are no longer kids trying to create a name for themselves; they're professionals with a vast network and are capable of increasingly sophisticated and highly targeted attacks. In fact, many of today's attacks are so stealthy that the victims may not even realize their systems have been compromised for days, weeks or even months. So how do organizations address malware attacks as part of their overall risk management program? What steps can you take to ensure that your organization is not the next TJX or Ameritrade? This session will provide an overview of the attacks targeting the enterprise today, as well as an insider's look into how a malware attack is executed and what tools are needed to respond effectively. The presentation will provide recent statistics on malware from the Kaspersky Anti-Virus Research Lab in Moscow and the specific business risks they represent. Key components of the presentation will include: risk analysis, virus dissection and recommended mitigation frameworks. Speaker - Ryan Naraine, Security Evangelist, Kaspersky Lab As a security evangelist at Kaspersky Lab, Ryan Naraine has more than a decade of experience monitoring Internet and computer security trends and hacker attacks. Along with monitoring current events in security, he is leading the development of Kaspersky's online community initiative around secure content management technologies. Outside of his work at Kaspersky, he is the leading contributor to ZDNet's Zero Day security blog. (http://blogs.zdnet.com/security/) Prior to joining Kaspersky Lab, Ryan was Editor-at-Large/Security at eWEEK, leading the magazine's and Web site's coverage of Internet and computer security issues and managing the popular SecurityWatch blog, covering the daily threats, vulnerabilities and IT security technologies. He also covered IT security, hacker attacks and secure content management topics for Jupiter Media's internetnetnews.com.
Top of Page
Friday, September 19
10:15 am–11:15 am	Conference Sessions Fixing the Security Blind Spot: New Strategies to Monitor and Stop Insider Threats According to a survey from the Computer Security Institute, 2007 marked the first year that insider threats topped external attacks as the most pressing security issue. Despite efforts to prevent these breaches, businesses remain shockingly vulnerable. Internal blind spots leave companies open to fraud, policy violations and theft of intellectual property. Security managers lack the real-time monitoring and policy enforcement tools to effectively see and manage end-user activity. What can security teams do? This session will discuss existing approaches and current constraints to preventing insider threats. Attendees will also learn new strategies and techniques for minimizing their risks. Speaker - Paul Smith, CEO, Packet Motion Paul Smith has been driving innovation for emerging networking and security businesses for more than 25 years. Currently serving as President and CEO of PacketMotion, Paul has been a guiding force behind the PacketSentry appliance system that allows businesses to monitor, report and archive in detail exactly what insiders are doing on the corporate network. Throughout his tenure within the industry, Paul has witnessed first-hand how security threats have evolved from an external to internal concern. At the same time, he's watched organizations struggle to adapt to the new threat paradigm as they combat today's threats in a quest to more effectively manage risk. Paul's previous experience includes Tasman Networks, where he led the company as chairman and CEO, before Nortel acquired the startup in 2005. In addition, he has served as vice president and general manager of the Telecom Division of New Focus. He has also held senior engineering and marketing roles at Asante Technologies, Proxim, Virtual Microsystems, and Adept Technology. Paul earned a B.S. in engineering from the University of Alabama and an M.S.E.E. from Purdue University. He holds a patent in wireless LAN protocols and he sits on the board of Avanex Corporation.
Top of Page

Use these conference track quick links to help you navigate your way around the Interop Conference:

Interop Is About:

Conference: IT Security Track