Menu

Monthly Meeting - June 25, 2018

 

Leveraging Internal Audit as a Security Tool

Register for Monthly Meeting

Presenters: Chris Garza and Matthew White

 

Description:

This talk will discuss factors that can build the relationship between the internal audit and information security functions to improve the effectiveness of a company's information security posture. The discussion will reference research done on the topic and real-world experiences.

Bios:

Chris Garza

Chris is a Senior Staff IT Auditor at FBL Financial Group, Inc responsible for performing internal IT audits. Prior to this role he was a Senior Associate at KPMG responsible for performing external IT audits. Chris holds the CISA and CPA certifications. He has a bachelor's degree in Accounting and Management Information Systems from the University of Iowa and is currently enrolled in the Information Assurance master's degree program at Iowa State University.

Matthew White

Matthew White is an Information Security Vulnerability Engineer at INTL FCStone Inc. responsible for performing vulnerability assessments. Prior to this role he was an Information Security Admin at FBL Financial Group, Inc responsible for being a jack of all trades in Security Operations. Matthew holds the GWAPT and CCNA Cyber Ops certifications. He has an associate’s degree in Network Technology – Telecom/Data Communications from DMACC. He is the former Director of Communications for the Des Moines ISSA chapter and currently serves on the SecDSM board.

Where:

FBL Financial
5400 University Ave
West Des Moines, IA 50266

Read more...

Monthly Meeting - April 23, 2018

[During this meeting we are holding elections for both President and Communications Director. IMPORTANT: If you wish to be considered make sure your membership is current and send me your biography to This email address is being protected from spambots. You need JavaScript enabled to view it. before April 23rd so they can be distributed before voting.]  

 

Cyber Quantitative Risk Analysis – What’s the deal?

Register for Monthly Meeting

Presenters: Aaron Fister

 

Description:

Identify and prioritizing cyber risks is a major concern of the IT industry. With limited budgets and resources, tradeoffs must be made where time and effort is spent. Cyber Quantitative Risk Analysis (CQRA) is an option for modeling of cyber risk. CQRA is made up of two major components. Expert data estimation techniques and the use of a Monte Carlo simulation to model risk. The results of the analysis can then be used to compare and prioritize risks.

This talk will present a fictional example applying the methodology. A brief overview of the estimation technique and modeling method are covered. Strengths and weaknesses as well areas of research and future directions of the methodology are discussed.

Bio:

Aaron Fister

Aaron Fister is currently a Ph.D. student at the University of Oklahoma. His areas of study are public management, risk perception, and data science. He has 15 years of IT and Information Security experience in the financial services, retail, and government sectors and holds the CISSP, CISA, and CISM professional security certifications. He has completed a Bachelor of Science degree from Iowa State University and a Master of Science from the University of Oklahoma. Aaron is a coauthor of the open access textbook Quantitative Research Methods for Political Science, Public Policy, and Public Administration. Aaron has previously taught workshops and classes on statistics, data science, and quantitative text analysis. His research interest is studying how individual and organizational dynamics influence cyber risk.

Where:

FBL Financial
5400 University Ave
West Des Moines, IA 50266

Read more...

Monthly Meeting - March 26, 2018

Continuous Security: Monitoring & Active Defense in the Cloud

Register for Monthly Meeting

Presenters: Eric Johnson

 

Description:

Monitoring and feedback loops from production is a critical tenant in DevOps for measuring performance, runtime errors, statistics, and changes. In the SecDevOps world, security teams can take advantage of DevOps monitoring tools to increase security visibility, identify anomalies, and respond swiftly to real time attacks.

Cloud providers are offering powerful infrastructure, development, and application continuous monitoring services that generate a wealth of data. But, building continuous security monitoring on top of the data can be challenging. Where are the log files? What is the log file format? What security events are captured? How do we display meaningful metrics? Can we detect and defend in real time?

This talk will introduce attendees to a realistic AWS environment’s monitoring and active defense system and discuss real data collected during a war game exercise. Afterwards, we will walk through the postmortem, review the alerts raised during the incident, determine if there were any surprises, and identify opportunities to improve the system. Attendees will walk away with actionable techniques for building an active defense framework to help protect your organization’s cloud resources.

Bios:

Eric Johnson

Eric Johnson is a Principal Security Consultant at Cypress Data Defense where he leads secure software development lifecycle consulting, web and mobile application penetration testing, secure code review assessments, static source code analysis, security research, and security tools development. He also founded the Puma Scan static analysis open source project, which allows software engineers to run security-focused .NET static analysis rules during development and in continuous integration pipelines.

As a Certified Instructor with the SANS Institute, Eric authors application security courses on DevOps, cloud security, secure coding, and defending mobile apps. He serves on the advisory board for the SANS Securing the Human Developer awareness training program, delivers security training around the world, and has presented his security research at conferences including SANS, BlackHat, OWASP, BSides, JavaOne, UberConf, and ISSA.

Eric completed a bachelor of science degree in Computer Engineering and a master of science degree in Information Assurance at Iowa State University, and currently holds the CISSP, GWAPT, GSSP-.NET, and GSSP-Java certifications.

Where:

FBL Financial
5400 University Ave
West Des Moines, IA 50266

Read more...

Monthly Meeting - February 26, 2018

Purple Team something something...

Register for Monthly Meeting

Presenters: Brad Beltman & Ben Schmitt

 

Description:

This talk takes a look at several red team techniques, then walks through blue team mitigations to each. The goal is to get teams working together more effectively to strengthen security.

Bios:

Brad Beltman

Brad is a consultant with SecureWorks doing full time web application penetration testing.

He has a masters degree in Information Assurance from Dakota State University. Certifications include OSCP, GWAPT, GPEN, GCIH, GCED, and CISSP. When not on a computer, Brad is usually tormenting his wife, playing with his two kids, or playing guitar.

Ben Schmitt

Ben Schmitt is the VP of Information Security for Dwolla leading the company’s security team and internal IT operations. Prior to this role, Ben held the position of Global Director, IT Security & Compliance at the Danfoss Group responsible for Network and Application security with a focus on ERP systems. Ben started his InfoSec career with TDS Telecom covering ISP and Enterprise security as a Security Architect.

Where:

FBL Financial
5400 University Ave
West Des Moines, IA 50266

Read more...

Monthly Meeting - January 22, 2018

IT Security Investment

Register for Monthly Meeting

Presenter: Casey Decker, CIO at FBL Financial Group, Inc.

 

Description:

Overview of budgeting and expense planning for Information Security. Discussions on expense ratios, prioritization and risk management when making decisions on security investments.

Bio:

Casey Decker was named Chief Information Officer for FBL Financial Group, Inc. in June 2016. Decker joined FBL in 2004 and progressed through various information technology roles, leading to Business Technology Vice President. Since 2014, Decker served as Agency Support Vice President, leading the team that provides strategies and solutions to support agents in growing successful and sustainable businesses.

Prior to joining FBL Financial Group, Decker was the Director of Technology for a not-for-profit organization in Chicago with responsibilities for creating and leading programs that improved information systems capabilities for various social service agencies and public schools. Decker holds a bachelor's degree from Drake University and a master's degree in Management of Information Systems from DePaul University. He serves on the boards of directors of the Food Bank of Iowa, Junior Achievement, the Global Insurance Accelerator and as a member of the Education Cabinet for United Way of Central Iowa.

Where:

FBL Financial
5400 University Ave
West Des Moines, IA 50266

Read more...