Speaker:
David Hahn, Vice President and CISO, Hearst

When an attack strikes, the first task on-hand for anyone working in cybersecurity is to stop the disruption; the second task is to ensure that critical data is protected. And for Fortune 500 companies and other leading U.S. businesses like Hearst Corp. - a media and business information conglomerate with ownership of and in publications such as Cosmopolitan and Esquire and television networks like A&E and ESPN - the complexities of size pose significant challenges. In this keynote address, David Hahn, the vice president and CISO at Hearst, will review how the evolution of so-called interconnectedness is impacting today's businesses, and what interconnectedness will mean for the future, especially at organizations like Hearst.

During a cybersecurity career spanning nearly three decades with one of the largest banking institutions in the country - Wells Fargo - and one of the largest media and business information conglomerates - Hearst, Hahn has seen adversaries ranging from curious 'tinkers' to nation states. Their motives span from simple revenge to financial gains and the damage they cause is often catastrophic, due to system compromises from an organization's inability to meet its mission and customer loss of trust in its brand.

Protecting an organization's assets, brand and intellectual property in this interconnected world is a challenging task for any information security professional. Listen to an industry veteran discuss his own experiences within the financial-services industry, a highly regulated sector, to a private conglomerate, where recent malware/ransomware, denial/disruption of service attacks (DDoS) attacks and malvertising have and will dictate the future of cybersecurity for years to come.

Additional Summit Insight:
Hear from more industry influencers, earn CPE credits, and network with leaders of technology at our global events. Learn more at our Fraud & Breach Prevention Events site.

Speaker:
Paul Bjerke, Vice President, Fraud and Identity Strategy, LexisNexis

Synthetic ID fraud is a fast-growing, multibillion dollar issue. Often misclassified as a credit loss, synthetic ID fraud is now affecting an expanding list of entities. Also, unless extremely large, this "victimless" crime often does not get the full attention of law enforcement. From the LexisNexis data labs, learn about the latest proof-of-life research results, how the fraudsters are perpetuating these crimes and a layered risk management approach to help identify fraud applications. Hint: KBA does not work.

Additional Summit Insight:
Hear from more industry influencers, earn CPE credits, and network with leaders of technology at our global events. Learn more at our Fraud & Breach Prevention Events site.

Speaker:
Kevin Flynn, Global Director of Products, Skybox Security

Monetarily motivated attacks are by far the most prevalent cyberthreats to organizations worldwide, yet vulnerability management techniques have largely failed to adapt to a threat landscape dominated by distributed crimeware. By understanding the commercialization of attack tools and services - particularly the vulnerabilities they use, re-use and share - vulnerability management can focus on the small subset of vulnerabilities that are exploited in the wild and packaged in distributed crimeware. This threat-centric approach improves vulnerability prioritization and focuses remediation on the relatively small number of exploitable vulnerabilities, greatly reducing risk through efficient, intelligent processes. This session will cover what's been driving the shift to distributed cybercrime, how to align vulnerability management with real-world threat behavior, and what intelligence and tools are needed.

Additional Summit Insight:
Hear from more industry influencers, earn CPE credits, and network with leaders of technology at our global events. Learn more at our Fraud & Breach Prevention Events site.

Speaker:
Scott Ramsey, Managing Director of Cybersecurity and Resiliency Consulting, FIS

The Internet-of-Things poses tremendous cybercrime challenges with crafting a meaningful risk-based financial crime management strategy. In this session, we'll cover the meaning of cybersecurity in the context of fraud and customer trust, an understanding on the meaning and purpose of a cyber threat intelligence program, when, where, and how to use anomalous behavior analytics, assessing the technical risks vendors pose and emerging endpoint protection products requirements.

Additional Summit Insight:
Hear from more industry influencers, earn CPE credits, and network with leaders of technology at our global events. Learn more at our Fraud & Breach Prevention Events site.

Speakers:
David Pollino, Chief Cybersecurity Officer, Bank of the West (BNP Paribas)
Eric Chabrow, Host & Producer, ISMG Security Report; Executive Editor, GovInfoSecurity & InfoRiskToday
Jennings Aske, CISO, New York-Presbyterian
Mitch Zahler, CISO, Proactive Cyber Security; formerly Senior Vice President of Cybersecurity, HSBC

In the wake of recent ransomware attacks, such as WannaCry, what lessons do we have yet to learn? Ransomware attacks are nothing new, and while WannaCry was widespread, it was not sophisticated or stealthy, necessarily. So why did it have such an impact?

In this session, our panelists will discuss why the "wartime mindset" has yet to be embraced, and why CISOs need to take charge and lead the way toward developing more effective security action plans.

Experienced CISOs and legal experts will:

• Provide real-world insights into how to create an effective cybersecurity action plan;
• Spell out the core elements of breach prevention, detection and response strategies; and
• Identify security technologies that can play an effective role in supporting a so-called "wartime" strategy

Additional Summit Insight:
Hear from more industry influencers, earn CPE credits, and network with leaders of technology at our global events. Learn more at our Fraud & Breach Prevention Events site.

Speaker:
Ben Smith, Principal, Sales Engineering and Field CTO, RSA

Organizations of all sizes today face serious and consequential risk-management challenges. Technology is often presented as the ultimate solution to this problem, but in many cases, organizations are experiencing not just a technical challenge, but a "language" challenge, especially when it comes to risk-management communication between various levels of the organization. Ultimately, our goal is to provide trusted, transparent and aggregated risk data in order to drive more informed, confident and effective business decisions. Join RSA, a Dell Technologies business, to discuss these challenges and, more importantly, potential solutions to consider.

Additional Summit Insight:
Hear from more industry influencers, earn CPE credits, and network with leaders of technology at our global events. Learn more at our Fraud & Breach Prevention Events site.

Speaker:
Alex Mosher, Vice President of Security Strategy, CA Technologies

Many organizations are undergoing a transformation to support digital platforms and stay competitive; but in order to maintain security, they have to ensure that access to these platforms is limited and that security remains a priority. New vulnerabilities to cybercrime are being introduced through hybrid environments, ones that often include remote access to systems and servers, automation of processes, and concentration of administrative power. Limiting administrative power through privileged access management is increasingly critical, but so is authentication, as more legitimate users' credentials are being compromised and access to systems is being fooled by the coders. According to the 2017 Verizon Data Breach Investigations Report, today's breaches involve a "combination of human factors, hardware devices, exploited configurations or malicious software." How can these risks be mitigated while still keeping a competitive edge? This session will explore how taking a proactive stance can help mitigate risks, while still enabling the business to use tools that are necessary in today's digitally charged economy.

Additional Summit Insight:
Hear from more industry influencers, earn CPE credits, and network with leaders of technology at our global events. Learn more at our Fraud & Breach Prevention Events site.

Speaker:
Paul Bowen, Principal Security Technologist, Arbor Networks

The pressure is on for all industries to upgrade their cyber-protection policies. New York is the first state to initiate a 180-day grace period for all financial services companies to upgrade both cyber policies and protection. As New York's new cyber mandates roll out, other states and industries will likely follow. During this session, Arbor Networks' Principal Security Technologist Paul Bowen will outline the impact of these new regulations, and provide an incident response framework that helps with compliance and preventing an inevitable compromise from turning into a breach.

Additional Summit Insight:
Hear from more industry influencers, earn CPE credits, and network with leaders of technology at our global events. Learn more at our Fraud & Breach Prevention Events site.

Speaker:
Kevin Donovan, Vice President of Sales for the Americas, BioCatch

Following NACHA's new rule for same-day ACH transactions, businesses and consumers are now able to benefit from same-day transaction processing, providing quicker access to payroll, account transactions and more. While beneficial for businesses and consumers, same-day ACH has necessitated that financial institutions review thousands of additional transactions per day, leading to a significant increase in staff and operational costs along with an increased potential for fraudulent activity because of the sheer volume and rapidness of review. This session analyzes the United Kingdom's transition to faster payments, which saw banking fraud volumes triple, and discusses what U.S. banks can learn from the U.K.'s example. It also reviews the types of fraud that have emerged from the move to instant transfer of funds as well as what strategies have been successful in stopping cybercriminals.

Additional Summit Insight:
Hear from more industry influencers, earn CPE credits, and network with leaders of technology at our global events. Learn more at our Fraud & Breach Prevention Events site.

Speaker:
Brian Soldato, Senior Director of Product Management, NSS Labs

Enterprises have invested extensively to address the evolving threat landscape, but security effectiveness remains a guessing game. The problem is, enterprise security teams cannot be sure of the effectiveness of their security controls once they are in place. At the same time, they are under pressure to quantify their cyber risks. In this session, we will explore how to address security effectiveness, quantify risk and deliver peace of mind to key stakeholders.

Additional Summit Insight:
Hear from more industry influencers, earn CPE credits, and network with leaders of technology at our global events. Learn more at our Fraud & Breach Prevention Events site.

Speakers:
Avivah Litan, VP and Distinguished Analyst, Gartner Research
Jackie Castelli, Senior Product Manager, CrowdStrike
Noam Jolles, Senior Intelligence Specialist, Diskin Advanced Technologies
Richard T. Jacobs, Assistant Special Agent in Charge, Cyber Branch, FBI NY

How does attacker attribution help a CISO and an enterprise? The answer: More than most might think. Most organizations don't care who the attacker is. They just want to stave off attacks. But could they do more?

By using indicators of compromise, for instance, organizations can strengthen their defenses. IOCs are basically just signatures of cyber-weapons used during attacks. They are not indicators of who the attackers are. But by creating 'indicators of attacker compromise' (IOAC), the attack attributes of one cyber-gang linked to multiple types of attacks quickly become very useful. If one attack group is linked to banking Trojans and cyberespionage against employee email accounts, for instance, then identifying the methods used can benefit organizations that are targeted by that same group in the future. So instead of just relying on multiple, somewhat-redundant IOCs across attack target types, organizations also can benefit from a single IOAC, which should be predictive of future unseen attacks. In this discussion about attribution and the role IOCs and IOACs play, moderator Garter Vice President and Distinguished Analyst Avivah Litan will question our panel of experts about the future of attribution, and why it is becoming more critical for organizations across numerous sectors.

Additional Summit Insight:
Hear from more industry influencers, earn CPE credits, and network with leaders of technology at our global events. Learn more at our Fraud & Breach Prevention Events site.

Speakers:
Brian Harrell, Director of Security and Risk Management, Navigant; former Director of Critical Infrastructure Protection at NERC and the Electricity ISAC
David Pollino, Chief Cybersecurity Officer, Bank of the West (BNP Paribas)
Jay Kramer, Partner, Data Privacy and Cyber Security Practice Group, Lewis Brisbois Bisgaard & Smith; former Supervisory Special Agent, FBI - NY Cyber Division
Lisa Sotto, Managing Partner, Chair of Global Privacy and Cybersecurity Practice, Hunton & Williams

Too many organizations continue to address breach response from a reactive mode - having a crude disaster-recovery plan in place in case something "does" happen, rather than accepting that something "will" happen and proactively preparing for it. In this session, a panel of legal, technical and law-enforcement experts will discuss what well prepared organizations are doing right, when it comes to proactive interaction with law enforcement, information sharing and breach investigation and response.

Additional Summit Insight:
Hear from more industry influencers, earn CPE credits, and network with leaders of technology at our global events. Learn more at our Fraud & Breach Prevention Events site.