When we consider the growing number of risks and threats to business and people from terrorist organizations and other groups, it is time for security, threat and vulnerability assessments and crisis management to become strategic governance issues. The benefits of establishing a comprehensive risk management strategy have been shown to more than offset the costs. As part of this strategy it is also essential to achieve compliance with the growing number of industry standards that address these issues. By adopting a strong risk/crisis management posture, your firm can ensure customer trust, your brand reputation and your bottom line. By attending this seminar you will learn the value of implementing risk management solutions versus the risks of not doing so.

Media Coverage
by Alex Goldman
ISP-Planet Managing Editor
http://www.isp-planet.com/business/2008/wsta_threat_overview.html
http://www.isp-planet.com/business/2008/wsta_cybercrime.html
http://www.isp-planet.com/business/2008/wsta_insider_threat.html
Sponsors: Archer Technologies, ArcSight, Avaya, AT&T, Intellitactics, LANDesk, Neocleus, , SecureWorks, Secure Computing and VoIPShield Systems

7:30AM - 8:00AM
Registration, Breakfast and WSTA Introductions -
Breakfast sponsored by Secure Computing

8:00AM - 8:45AM Keynote Presentation - The Future of Information Security - What\'s Next
The Future of Information Security: What’s Next?
John P. Pironti, Chief Information Risk Strategist, Getronics
Information security has evolved from a technical specialty into a core business function. The people, processes, procedures, and technologies that are utilized to protect information infrastructure are changing and maturing at a rapid pace. So too are the capabilities of the adversaries from whom you need to protect your information infrastructure. This session will discuss how your adversaries and threats they pose are evolving, and the emerging trends in information security designed to protect your information infrastructure from them. The areas which will be addressed include governance and organizational models, threat and vulnerability management concepts, compliance frameworks, and technological advances.

8:45AM - 9:00AM
Guest Speaker-Jim Routh, Depository Trust & Clearing Corp - TVA Overview 2008
This presentation will provide a case example of a practical approach to enterprise wide security risk assessment used at DTCC. This will include a risk scoring model that provides a daily risk score at multiple levels that can be used to quantify a security risk profile and prioritize remediation priorities for adjusting the risk posture based on changes to threat trend data.

9:00AM - 9:25AM
Premier Sponsor Presentation -Archer Technologies - Archer Technologies
Jon Darbyshire, Founder and CEO – Archer Technologies
The growing volume of threat data poses a significant challenge to identifying threats that impact your business. Companies that effectively implement a threat management solution and integrate it with asset data, policy management processes and other core enterprise risk and compliance mega processes can proactively prevent attacks before they negatively affect their enterprise. During this session, Jon Darbyshire will discuss how Fortune 1000 companies are implementing an effective threat management program to capture and consolidate threat data, filter and prioritize threats that could affect their critical technologies, notify responsible personnel who can respond proactively, and report on current state and remediation. The ultimate result of such a program is the preservation of business continuity.

9:25AM - 9:40AM
Break and demo area visits - Ballroom C

9:45AM - 11:40AM
Breakout Sessions-Two concurrent sessions of four presentations each.

Time		Session 1-Ballroom AB		Session 2-Herald Sq. Room
9:45-10:10		AT&T Real-Time Knowledge Mining, The Heart of Information and Data Protection ATT  ATT.pdf 855.69 kB Stan Quintana, Vice President – AT&T Managed Security Services Threats to corporate networks have become more complex and require solutions tailored to protect against multiple vulnerabilities. In addition to protecting against many entry points, a solid threat management solution must have the capability to identify and respond to threats in real-tim . During his presentation, Stan Quintana will discuss the importance of real-time threat management to corporate data and how to effectively identify if information is being exploited in a real-time environment.		VoIPShield Systems VoIP Security: How to Prepare for the Inevitable VoIPshield  VoIPshield.pdf 707.61 kB Rick Dalmazzi, President and CEO, VoIPshield Systems Voice over IP (VoIP) inherits many of the same security threats as data networks, and is potentially more vulnerable due to the “real time” nature of voice communications. Though security regulations do not yet mandate the protection of voice-based data, they will soon. This presentation will educate attendees about the real vs. theoretical risks associated with VoIP, and provide practical guidance on short, medium and long-term preparations for future regulatory requirements.
10:15-10:40		ArcSight ArcSight  ArcSight.pdf 1.16 MB Brian T. Contos, CISSP, Chief Security Officer A cyber incident perpetrated by a careless or malicious insider is the most difficult to prevent, hardest to detect and most problematic to respond to. This presentation will provide a short primer on the insider threat. It will also supply real-life ArcSight customer examples that will illustrate the detection of suspicious insider activity and ultimately effective responses. Take Away Points Why are insiders more dangerous than external attacks How can suspicious insider activity be detected Beyond NAC: how can an incident be responded to efficiently and effectively		Avaya Information Security: 2020 Avaya  Avaya.pdf 895.60 kB Thomas Porter, Ph.D. - Chief Security Architect, Avaya Inc Networks of the future will be based on a variety of wireless protocols connected to an IP-based optical core network and various radio endpoints. The location of intelligence within the network has historically been at the logical -- and often physical -- center of the network. In contrast, new networks will have intelligence and processing power distributing outward – particularly towards the edge. This session will review security challenges this new model presents and some available solutions.
10:45-11:10		SecureWorks The Elusive Enemy – Cybercrime SecureWorks  SecureWorks.pdf 994.68 kB Jon R. Ramsey, Chief Technology Officer Cybercrime has been a rapidly evolving phenomenon. It can be difficult for any financial institution or end user to keep up with present threats or anticipate a hacker’s next move. This presentation is a compilation of cybercrime trends, hacker trends and attack statistics from over 1000 financial institutions. Attendees will learn a plethora of facts including identity theft market rates, new and emerging attack architectures, sources of attacks by country, recent changes in criminal to criminal activities, focused attacks launched on specific audiences and samples of session-riding threats and attacks specific to circumventing 2-factor authentication.		LANDesk Securing Desktops in an Unsecured World LANDesk  LANDesk.pdf 455.68 kB Stewart Christensen, Corporate Strategist, LANDesk Given the IT security issues faced today, it is increasingly important for organizations to employ a solid, layered-security solution. What elements comprise a layered-security solution? Where is your organization vulnerable? How can you protect against zero-day exploits? I have an Antivirus solution, is this enough protection? These issues as well as other related end-point security concerns will be addressed.
11:15-11:40		Neocleus Neocleus  Neocleus.pdf 750.95 kB Etay Bogner, Co-Founder and CTO, Neocleus The number of employees, business partners and customers accessing corporate resources outside the corporate network perimeter is increasing at an unprecedented rate. As users and business requirements become more demanding, today's network perimeter may not be fully equipped to protect these precious corporate assets. As a result, the need for innovative solutions that improve infrastructure agility and reduce risk has never been stronger. Emerging developments in client virtualization are expected to revolutionize how organizations address securing their assets. Neocleus will present insights about how to leverage client virtualization to better protect corporate information, lower costs, and accelerate the delivery of tailored services to customers.		Intellitactics Intellitactics  Intellitactics.pdf 795.28 kB Sunil Bhargava, Chief Technology Officer Many financial services organizations are still investing significant time and money in an attempt to protect themselves from negative audit findings. Some investment choices are successful in the short term, but many organizations have discovered that passing an audit does not necessarily make them more secure. A more effective strategy for enterprise risk management starts with a security policy and risk assessment, and is maintained through the use of controls to protect critical information assets. This session will: Address the importance of managing risk by implementing and monitoring the performance of controls Examine an approach that minimizes the impact and cost of audits while increasing the overall security posture of the organization Discuss the reasons why incorporating control frameworks within a security program enables efficiencies in identifying and assessing threats, correcting vulnerabilities, and ultimately minimizing the impact to the availability of critical business services.

11:45AM-12:15PM
Demo Area Open - Ballroom C

12:00PM-1:30PM
VoIP Engineers Interactive Roundtable and Luncheon-WSTA Financial Firm Members Only
Sponsored by VoIPShield Systems

The Radisson Martinique on Broadway
49 West 32nd Street, NYC

John P. Pironti, Chief Information Risk Strategist, Getronics
John P. Pironti is the Chief Information Risk Strategist for Getronics. He has designed and implemented enterprise wide electronic business solutions, information security programs, and threat and vulnerability management solutions for key customers in a range of industries, including financial services, government, hospitality, aerospace and information technology on a global scale. Mr. Pironti has a number of industry certifications including Certified Information Systems Auditor (CISA), Certified Information Security Manager (CISM), Certified Information Systems Security Professional (CISSP), Information Systems Security Architecture Professional and (ISSAP) and a Information Systems Security Management Professional (ISSMP). He is also a published author and writer, and a frequent speaker on electronic business and security topics at domestic and international industry conferences.

Rick Dalmazzi, President and CEO, VoIPshield Systems
A security industry veteran, Dalmazzi brings nearly 30 years of technology industry experience to the VoIPshield team. As President and CEO of Certicom Corp, a developer of Internet wireless and wireless security technology, Dalmazzi oversaw a 25x growth in revenue and valuation. He has spoken at numerous industry conferences, including keynotes at the Wireless World Conference and Smart Card Forum. He is a frequent guest lecturer, having spoken at leading North American business schools, including MIT and Stanford. Additionally, Dalmazzi has published articles on emerging security issues in leading trade publications and acted as a trusted source to business press.

Stewart Christensen, Corporate Strategist, LANDesk Software
As a Corporate Strategist for LANDesk Software, Stewart Christensen interfaces directly with partners and customers world-wide to define and refine company solutions to meet customer needs. Interfacing with internal Product Marketing and Software Engineering teams to drive strategic direction is one of Stewart’s key goals. Delivering that strategic message to our customers and partners is his primary focus.
With over 18 years of computer industry experience, Stewart has been with LANDesk for over three years as a Corporate Strategist. Before that he held various positions at Novell such as Systems Engineering Manager, Sr. Systems Engineer and Sr. Consultant. Prior to that Stewart served as Vice President Director of IT for a large advertising agency.

Thomas Porter, Ph.D. - Chief Security Architect, Avaya Inc
Thomas Porter has spent over eleven years in the networking and security industry as a well-respected consultant, speaker and developer of security tools. He has hacked into networks belonging to banks, credit unions, credit card companies, U.S. government and military institutions, and spammers’ computers. He possesses expert knowledge of routing, switching, network and host exploitation methodologies, ISO17799, SOX, GLBA, and HIPAA security assessments. Prior to joining Avaya in 2002, he worked at Alteon WebSystems, Nortel Networks and Praxair. In the past year, Porter completed a highly successful term as the director of IT Security for the 2006 FIFA Men’s Soccer World Cup and as the chief security architect for Avaya’s Global Services Consulting & Systems Integration practice.

Brian T. Contos, CISSP - Chief Security Officer, ArcSight Inc.
Mr. Contos has over a decade of real-world security engineering and management expertise developed in some of the most sensitive and mission-critical environments in the world. As ArcSight's CSO he advises government organizations and Global 1,000s on security strategy related to Security Information and Event Management (SIEM) solutions while being an evangelist for the security space. He has written several security books including Enemy at the Water Cooler – Real Life Stories of Insider Threats as well as Physical and Logical Security Convergence. He has delivered countless speeches, webcasts, podcasts, and magazine articles for Forbes, Computerworld, Sarbanes-Oxley Compliance Journal, SC Magazine and many others. Mr. Contos has held management and engineering positions at Riptech, Lucent Bell Labs, Compaq Computers and the Defense Information Systems Agency (DISA). He has worked throughout North and South America, Europe, and Asia and holds a B.S. from the University of Arizona in addition to a number of industry and vendor certifications.

Jon R. Ramsey, Chief Technology Officer, SecureWorks
Jon Ramsey is an information security expert with policy-making responsibility at SecureWorks in Atlanta, GA. Ramsey has over 12 years of hands-on experience at every level: system administrator, software engineer, analyst, security penetration specialist and senior engineer. Prior to joining SecureWorks, Ramsey worked for the Computer Emergency Response Team (CERT), Siemens, and the University of Pittsburgh. Ramsey earned a Master’s degree in software engineering from Carnegie Mellon University and a BS in computer science from the University of Pittsburgh. He is a member of IEEE and the Association for Computing Machinery (ACM).

Jon M. Darbyshire, President and Chief Executive Officer, Archer Technologies
Jon Darbyshire founded Archer Technologies and has been the company's CEO and visionary since its inception in 2000. Jon leads the overall plan, market and product development strategies for Archer. A pioneer in the information security market, Jon has held senior executive positions within the Security and Risk Management practices of Ernst & Young and Price Waterhouse. His efforts over recent years have focused on developing product solutions that enable enterprises to effectively organize and distribute the critical knowledge employees require to be more successful in performing their daily functions. The evolution of Jon’s dream has led to the development of the Archer Technologies suite of targeted solutions, which assist businesses in effectively identifying and managing risks associated with their critical business processes and in demonstrating regulatory compliance.

Etay Bogner, Co-Founder and CTO, Neocleus
Mr. Etay Bogner, Co-Founder and Chief Technology Officer, drives the company’s product vision and technical direction. As a networking and security industry veteran, Etay brings extensive expertise and market understanding to his role at Neocleus. This is also Etay’s second entrepreneurial venture. His first venture, Sofaware Technologies Ltd., was sold to Check Point Software Technologies Ltd. (Nasdaq: CHKP). Etay founded and was managing director of Sofaware Technologies. In addition to starting Sofaware, Etay has held technical positions at BackWeb and other internet, networking and security companies. He holds a B.Sc in Mathematics and Computer Sciences from Tel Aviv University.

Jim Routh, CISM, Chief Information Security Officer,
The Depository Trust & Clearing Corporation
Jim Routh has over 20 years of experience in information technology and information security as a practitioner, management consultant and leader of technology functions and information security functions for global financial service firms. Jim designed and implemented an enterprise wide information security program for the Depository Trust and Clearing Corporation (DTCC) based on risk management best practice, COBIT and ISO 27001 standards. He implemented an information security risk assessment process and a security program for application development. Prior to joining DTCC he was the first CISO for American Express and responsible for the implementation of an enterprise wide implementation of GLBA specific controls and practices within two different banking entities in North America. Prior to that, he led a customer information management function within Risk Management for the US card businesses for American Express. Prior to that he led the information technology function for the Institutional Services and Investment Management businesses for American Express Financial Advisors. Mr. Routh was a management consultant in information technology for dozens of leading financial service firms for over 12 years.

Sunil Bhargava, Chief Technology Officer, Intellitactics
Sunil Bhargava brings more than 20 years of industry experience in enterprise technology, security practices, and product and business management to Intellitactics. Extensive experience gained from consulting to leading-edge organizations in the US, Asia, and Europe solidified his focus on assisting clients in crafting solutions to meet their requirements and implementing needed change. As chief technology officer for Intellitactics, Bhargava draws on this experience as he works with Fortune 500 companies and major government agencies to identify trends and requirements for leveraging information security best practices, technology, and processes to manage enterprise risk. Prior to joining Intellitactics, Bhargava co-founded INTECH, a technology consulting firm. Previously, he provided management consulting to numerous technology firms, including WisdomWare as chief technology officer, OneSoft as vice president of technology, and Clip Genius as co-founder and chief technology officer. He holds a Bachelor of Science degree in Computer Engineering and a Master of Science degree in Software and Systems from George Washington University.

Stan J. Quintana, Vice President, AT&T Security Services
Stan Quintana is responsible for AT&T’s Managed Security Services. These specific security services offer best-in-class solutions for AT&T customers. In addition, he has been responsible for planning, managing and implementing AT&T’s own business continuity and recovery program, as well as developing business continuity solutions for commercial clients. Stan has held positions in finance and business operations, managing various information management and information technology programs at AT&T. He was AT&T Global Financial CIO, responsible for developing AT&T’s global financial systems architecture that supported systems in 38 countries, and built the company’s first billing and operations center in Denver, CO. Stan earned a bachelor’s degreein mathematics and physics from Regis University in Denver and a masters of science degree in computer science and electrical engineering from the University of New Mexico.