SecureWorld Denver 2024

Have you ever wondered how to actually use the NIST Cybersecurity Framework and apply it to your business or organization?

In this course, you will get an inside look at how cybersecurity, information technology (IT), and business professionals use the NIST Cybersecurity Framework (CSF) Version 2.0 to understand and actively manage their risk posture.

You will begin by learning the fundamentals of the NIST Cybersecurity Framework, including:

• What are the components of the framework?

• Why is the framework is valuable?

• What type of organizations can use the framework?
  

Then, you will dive deeper into the framework to fully understand the Framework Core, the Framework Tiers, and the Framework Implementation Profile.

You will also review various case studies from diverse organizations across the globe, including critical infrastructure organizations, technology companies, governmental organizations, and others.

Finally, we will spend the majority of this course walking you through how to implement this framework within your own organization by conducting a Cyber Risk Mapping (CR-MAP). This CR-MAP of your organization will aid you in identifying your weaknesses and creating a remediation plan to achieve higher levels of security by minimizing your cyber risk.

We even include a free bonus digital workbook that helps you conduct a step-by-step Cyber Risk Mapping at the conclusion of the course.

Today’s ransomware attacks have a severe impact on the operating capability of organizations. If an organization is prepared and has functional back-ups, restoring affected systems could take hours. If an organization is not prepared, restoring systems could take weeks to return to full operating capacity. Organizations cannot 100% prevent ransomware attacks. The best thing you can do is assume you will be hit and have plans in place that focus on planning, protecting, detecting, responding, and recovering from an attack.

This course helps organizations design, build, operate, and maintain a comprehensive ransomware program. The key areas of focus include:

1. How to prepare the organization for a ransomware attack by understanding the stages of a human-operated ransomware attack (initial access, privilege escalation, lateral movement, exfiltration, and encryption), maintaining and securing back-ups, detecting and mitigating vulnerabilities, cybersecurity training and education, and a detailed incident response plan;
2.  How to protect the organization from a ransomware attack by implementing an asset management solution, deploying endpoint detection and response capability, establishing a zero-trust architecture, maintaining email and DNS filtering, hardening systems based on secure configurations, managing user accounts and privileged accounts;
3. How to detect a ransomware attack in the early stages with continuous security monitoring, anomaly detection, and threat intelligence solutions;
4. How to respond to a ransomware attack by isolating impacted systems, malware eradication / containment, focusing on critical assets; and
5. How to recover from a ransomware attack with minimal downtime and data loss by restoring from back-ups, initiating recovery efforts, and reporting the incident.

The class is based on best practices and guidance detailed in the U.S. CISA #StopRansomware Guide. The guide includes two primary resources: Part 1: Ransomware and Data Extortion Prevention Best Practices; Part 2: Ransomware and Data Extortion Response Checklist. Part 1 provides guidance for all organizations to reduce the impact and likelihood of ransomware incidents and data extortion, including best practices to prepare for, prevent, and mitigate these incidents. Prevention best practices are grouped by common initial access vectors. Part 2 includes a checklist of best practices for responding to these incidents.

Come to the Registration desk in the lobby to check-in and get your badge. SecureWorld staff will be available throughout the day if you have any questions.

Your opportunity to visit our solution vendor partners, whose sponsorship makes SecureWorld possible! Booths have staff ready to answer your questions. Look for participating Dash For Prizes sponsors to be entered to win prizes.

This roundtable discussion is for our Advisory Council members only.

Investment scams, a multi-channel problem, topped the annual list of monetary losses in the FBI 2023 Crime Report at over $4.5 billion last year. The FBI has reported that crypto scams, called “pig butchering,” have been sweeping the US, so it’s unsurprising to see investment scams resulting in the costliest scams on record.

We will discuss how pig-butchering crypto scams take place outside of email. They start on dating or social media apps and continue through well-scripted touch points to build trust and rapport with victims, who invest more and more money into the fraudulent funds until the cybercriminal steals the funds and disappears.

We will also discuss the concept, provide real-life examples, pinpoint pig-butchering touch points, and suggest ways to combat malicious activity.

Cyber insurance is no longer a “do I need it?” but a must-have for organizations. This conversation among cybersecurity peers will discusse how to properly assess insurance programs, including a candid look into how the organization should drive what is and is not covered, not the insurance provider.

Visit the Exhibitor Hall to network with attendees and connect with our vendor sponsors and association partners.

Visit the Exhibitor Hall to network with attendees and connect with our vendor sponsors and association partners.

Session description coming soon.

In today’s rapidly evolving digital landscape, cybersecurity is no longer solely the responsibility of backup administrators. It demands a collective effort and a streamlined approach to ensure comprehensive protection across an organization. This presentation delves into the critical themes of modern data protection: broadening responsibility beyond backup administrators, tightening security cycles, and maintaining simplicity in implementation.

We will explore the significance of a tiered data protection architecture—a modern methodology that safeguards data across multiple geographies while ensuring high accessibility. This approach is essential for organizations seeking robust and resilient data protection strategies.

Pure Storage offers innovative solutions that empower customers to consolidate modern data applications onto a single, scalable platform. By eliminating complex and inefficient infrastructure silos, our solutions provide unparalleled investment protection and operational efficiency. Join us to discover how Pure Storage can help your organization achieve new heights in data security and management.

Visit the Exhibitor Hall to network with attendees and connect with our vendor sponsors and association partners.

In today’s data-driven world, organizations face increasing pressure to protect personal information while complying with complex privacy regulations. This session offers practical insights and strategies for developing a comprehensive privacy program that effectively manages ‘Forget Me’ requests and Subject Access Requests (SARs). Drawing from real-world experiences, we’ll explore how to leverage people, processes, and technology to create a privacy framework that meets regulatory requirements and builds trust with customers and stakeholders.

Key Takeaways:

1. Roadmap to Success: Learn how to develop a strategic project roadmap for implementing a robust privacy program, including key milestones and dependencies.
2. Streamlined SAR Management: Discover efficient processes for handling Subject Access Requests, from initial receipt to final delivery of information.
3. Effective ‘Forget Me’ Protocols: Explore best practices for implementing and managing data erasure requests in compliance with GDPR and other privacy regulations.
4. Data Discovery and Classification: Understand techniques for conducting thorough data inventories and classification to support privacy initiatives.
5. Technology Integration: Learn how to leverage technology solutions to automate and enhance privacy processes, including data mapping and request management.
6. Training and Culture: Develop strategies for fostering a privacy-aware culture through comprehensive employee training and engagement.
7. Balancing Compliance and Operations: Gain insights on striking the right balance between regulatory compliance and operational efficiency.
8. Continuous Improvement: Explore methods for monitoring, auditing, and continuously improving your privacy program to adapt to evolving regulations and threats.

This session will equip privacy professionals, IT leaders, and compliance officers with actionable strategies to enhance their organization’s privacy posture and effectively manage data subject rights in an increasingly complex regulatory landscape.

Sometimes just having a SOC isn’t enough to address insider threat issues. Security operations teams are managing massive amounts of data across billions of events from on premises to the cloud. Looking for specific needles like insider threats in this complex haystack has special requirements that encompass both searching historic data and seeing evolving credential behavior changes as they happen.

Whether from downsizing or expanding the business, employees, vendors, contractors, and more are moving in and out of your environment. And often, it is during turbulent times that insider threats go unobserved as everything  changes so quickly. Insider threat initiatives require a new, more focused approach.

This presentation will explore:

• The common scenarios that indicate you need an insider threat team, how to build a mission statement, and tools
• Four attributes of a successful insider threat program
• How behavioral analytics baseline “normal” behavior of users and devices – showing risk faster
• An automated investigation experience that replaces manual routines and effectively guides new insider threat teams

In the shadows of our digital world, a clandestine battle is waged against our data, systems, and infrastructure. These hidden threats, much like the villains of comic books, lurk in the shadows, seeking to exploit vulnerabilities and disrupt our digital lives. Join us as we delve into the ever-evolving threat landscape, unmasking the villains of the digital realm and exploring their nefarious tactics.

Our panel of cybersecurity experts unravel the intricate world of cyber threats, shedding light on the latest trends, emerging attack vectors, and the expanding arsenal of malicious tools employed by cyber adversaries. Learn the motivations behind these threats, from profit-driven cybercriminals to state-sponsored actors wielding cyberweapons.

Our panel provides a comprehensive overview of the current threat landscape.

Moderated discussion for SecureWorld Advisory Council members. By invite only.

Visit the Exhibitor Hall to network with attendees and connect with our vendor sponsors and association partners.

AI is the fourth event horizon of our technology lifetime !  Karen will provide an AI backgrounder and share the risk management strategy that will ensure you aren’t caught in the compliance hamster wheel of pain as legislators and regulators respond to the explosive AI revolution.

Key take-away: 
How to rethink database security controls in a cloud-first world.

For most organizations, data repositories hold our most sensitive, mission critical assets. As enterprises continue their digital transformation journeys, data repositories and the sensitive assets within are more exposed than ever before for several reasons, including a dramatic rise in the:

• Amount of data created, collected, and stored
• Number of repositories storing sensitive data across clouds
• Number of users and applications that need access to data

In the dynamic realm of cybersecurity, the battle between defenders and digital villains is an ongoing saga. This forward-looking session will explore the evolution of cyber threats, forecasting the next wave of challenges that organizations and individuals may face. We aim to unmask the upcoming generation of digital villains, examining their sophisticated tactics and exploiting vulnerabilities that may become prevalent in the future.

Our distinguished panel of cybersecurity experts will dissect the motivations driving these threats, from the ever-adapting strategies of profit-driven cybercriminals to the evolving techniques employed by state-sponsored actors wielding cyberweapons. As we peer into the future, we will also address the role of emerging technologies in reshaping the threat landscape, providing insights that empower organizations to proactively defend against tomorrow’s cyber challenges.

Join us in this exploration of the unseen, as we strive to anticipate and understand the threats that lie beyond the shadows of the current cybersecurity landscape.

Visit the Exhibitor Hall to network with attendees and connect with our vendor sponsors and association partners.

We’ll discuss trends in e-fraud, cybercrime , and the evolution of recent attacks in the Rocky Mountain region.

When a data breach or other cyber incident happens, having a plan in place can mean the difference between a quick recovery and unwanted headlines and irreparable harm to stakeholder trust.

Visit the solution sponsor booths in the Exhibitor Hall and connect with other attendees.

Participating sponsors will announce their Dash for Prizes winners. Must be present to win.

Join your peers for conversation and complimentary beverages. This is a great opportunity to network with other security professionals from the area and discuss the hot topics from the day.