Presented at
Black Hat USA 2015,
Aug. 5, 2015, 4:20 p.m.
(50 minutes)
Sharing information isn't hard - getting past backroom deals, NDAs and approval from general counsel is *very hard*. This topic is not two-dimensional, even if we are quick to weigh data sharing in the face of data breaches, and the US has several pieces of legislation in play on this *right now*.
Conservatively there are over 300,00 open jobs available in information security- efficiency, prioritization and alignment with IT has never been more important. Information sharing and threat intelligence offers hope that we can better inform priorities to align with real threats, however these solutions come with a new set of questions:Can we collaborate outside our company *and* protect privacy?What information is worth sharing?Is there a level of minimum care in protecting civil liberties while enabling rapid information dissemination?
Clearly, we need to talk. If you've got thoughts, we want to hear them. Sharing isn't only the theme of this session, it is also the format. Attendees and panelists will discuss:
What should you do with the information once you have it?What sharing models (hub-spoke vs. de-centralized) make sense?What are the privacy considerations in sharing information?What kinds of liability impact information sharing today?What corporate controls affect your ability to share information?What's the status of information-sharing legislation in Congress?
Presenters:
-
Mark Hammell
- Facebook
Mark Hammell manages the eCrime team at Facebook, responsible for disrupting attacks against Facebook and its related products via building frameworks like ThreatExchange, campaign analysis, collaboration with external partners, and other techniques. Prior to joining Facebook, Mark was a Special Agent with the Federal Bureau of Investigation and a software developer for Goldman Sachs.
-
Brian Engle
- Retail Cyber Intelligence Sharing Center
Brian Engle serves as the Executive Director of the Retail Cyber Intelligence Sharing Center (R-CISC), the resource supporting the retail and commercial services industries for sharing cybersecurity information and intelligence. The R-CISC, and its operation of the Retail and Commercial Services Information Sharing and Analysis Center (RCS-ISAC), create a trusted environment for robust collaboration for its members and partners. As Executive Director, Brian provides the leadership and oversight of all aspects of the R-CISC's mission, goals and operations for the delivery of effective and high quality services to the R-CISC membership. Brian's previous information security roles include CISO and Cybersecurity Coordinator for the State of Texas, CISO for Texas Health and Human Services Commission, CISO for Temple-Inland, Manager of Information Security Assurance for Guaranty Bank, and Senior Information Security Analyst for Silicon Laboratories. Brian has been a professional within Information Security and Information Technology for over 25 years. Brian is a past president and Lifetime Board of Directors member of the ISSA Capitol of Texas Chapter, is a member of ISACA and InfraGard, and holds CISSP and CISA certifications. Awards and recognition include: recognized as an Evanta Global Top 25 CISO Breakaway Leader Finalist in 2013 and 2014; received the ISSA International Honor Roll Award in 2014; was the ISE Central Executive of the Year and the ISE North America Executive Award in Academic/Public Sector in 2014.
-
Rebekah Brown
Rebekah Brown is a Cyber Threat Intelligence Analyst at a Fortune 500 company, currently working to build threat intelligence and information sharing capabilities. Prior to moving to the private sector, Rebekah spent over a decade in the intelligence community, where she served multiple positions including a Deputy Branch Chief at NSA, Operations Chief of the United States Marine Corps Cyber Unit, and ran a DHS-funded information-sharing program in California. Rebekah is trained in cyber intelligence, network warfare analysis, and is proficient in Mandarin Chinese.
-
Kevin Bankston
- Open Technology Institute
Kevin Bankston is the Director of the Open Technology Institute and Co-Director of the Cybersecurity Initiative at New America, where he works in the public interest to promote policy reforms that foster open and secure communications networks, platforms, and technologies. Prior to joining OTI, Kevin was a Senior Counsel and the Director of the Free Expression Project at the Center for Democracy & Technology, which he joined after working for nearly a decade at the Electronic Frontier Foundation, where he specialized in free speech and privacy law with a focus on government surveillance, Internet privacy, and location privacy. As a Senior Staff Attorney at EFF, he regularly litigated issues surrounding free expression and electronic surveillance, and was a lead counsel in EFF's lawsuits against the National Security Agency and AT&T, challenging the legality of the NSA warrantless wiretapping program first revealed in 2005. Before joining EFF, he litigated Internet-related free speech cases at the national office of the American Civil Liberties Union in New York City as a Justice William Brennan First Amendment Fellow. He received his JD at the University of Southern California Law School after receiving his BA at the University of Texas at Austin.
-
Trey Ford
- Rapid7
Trey Ford is the Global Security Strategist at Rapid7 where he serves as a customer resource, industry and community advocate. Over the last 15 years, Trey ran Black Hat events worldwide as General Manager, and served functions ranging from incident response, product management, PCI QSA and security engineer for a variety for industry leaders including Zynga, McAfee, FishNet Security and WhiteHat Security.
Links:
Similar Presentations: