Missouri Governor's Cybersecurity Summit 2016
Overview
At the direction of Governor Jay Nixon, the State of Missouri Office of Administration hosted the Governor’s Cybersecurity Summit in Jefferson City. The purpose of the Summit: to engage with stakeholders, including representatives of state and local governments; law enforcement; business; higher education; and K-12 institutions across the state.
The key goals of the Summit included:
1) Information Sharing and Awareness, including case studies and information sharing on current and emerging threats and industry best practices;
2) Training and Exercises, with an emphasis on sharing expertise and experience on tools proven most effective in detecting and defending against the growing number of cyber events;
3) Workforce Development, including strategies for educating the current and future cybersecurity workforce;
4) Hardening Critical Infrastructure, such as the electrical grid with an emphasis on ensuring continuity of services; and
5) Incident Response, with an emphasis on swift and effective coordinated response to cyber attacks.
This Year's Topics include:
- Organizational Awareness – What Leaders Can Do
- Combating Small Business Cyber Threats
- The Tabletop Exercise – What, Where, When, Why and How
- Solving the Personnel Gap
- Network Awareness
- The Role of Education in Cybersecurity
- The Internet of Things – Managing the Unmanageable
- The Legal Side of Cybersecurity
- Getting Back to the Basics or How Not to be the Low Hanging Fruit
- How to Be Prepared for Cyber-Attacks Resulting from Civil Disruptions
- Automation and Orchestration
- Web and Mobile App Security
- ROI for Cybersecurity Investment
- Social Engineering as an Attach Vector
- Ransomware Epidemic
State government is uniquely positioned to serve as a resource for organizations in both the public and private sectors and further strengthen cybersecurity preparedness across Missouri.
- Governor Jay Nixon, State of Missouri
Speakers
Teri Takai – Featured Speaker
Former CIO of U.S. Department of Defense, State of California and State of Michigan
Teri Takai is one of the most respected and influential CIOs in the country. Teri is most well-known for her public sector roles, starting in budget-torn Michigan where she led the state to the #1 ranking in the Digital States Survey four years in a row. Never one to back down from a challenge, she next accepted a plea from Governor Schwarzenegger to put the state’s struggling technology efforts back on track. And if that wasn’t enough, Teri next took on the job of heading up the largest IT budget in the world, a budget matched only by the scope of its problems and complexities. In each locale, she was tasked with driving disruptive change. Her biggest takeaway: No job is too small to make a big impact – but there are right ways and wrong ways to go about it. In this captivating session, Teri shares her extraordinary experiences and lessons learned.
Dr. Charlie Miller - Featured Speaker
Security Engineer, Uber
Dr. Charlie Miller is "one of the most technically proficient hackers on Earth", according to Foreign Policy. After receiving his PhD in Mathematics from the University of Notre Dame, Dr. Miller was a computer hacker for the National Security Agency for five years. Since that time he has been a consultant and worked for the Twitter information security team. He has won the “Super Bowl” of computer hacking, the annual Pwn2Own competition four times. Dr. Miller has found countless vulnerabilities in a number of Apple products including their laptops and phones. Perhaps the most notorious of these issues was the ability to remotely compromise an iPhone by merely sending it a malicious text message. He also has the privilege of having been the first to remotely exploit the iPhone when it was released as well as the first Android phone when it was released (on the day it came out). Lately, Dr. Miller has spent considerable time in the field of automotive security along with his research partner Chris Valasek. Together they demonstrated that a variety of Fiat Chrysler vehicles could be remotely hacked from anywhere in the county and he could control the radio, brakes, wipers, transmission, and even the steering of the target vehicle. The demonstration of these vulnerabilities led to the recall of 1.4 million vehicles. Dr. Miller has been featured on the Today Show, ABC World News Tonight, CNN, NPR, CNBC, New York Times, USA Today, Forbes, etc.
Darren W. Carroll
Director, Security & Risk Management Practice, Enterprise Solutions Group, SHI
As SHI’s Director of Security and Risk Management Practice, Darren is a risk management and information security leader with over 28 years of experience in operational, technical, management, and architectural roles. Throughout his career, Darren has provided consultative thought leadership, strategic direction, and tactical response to multiple federal, state, and local agencies, most of the Fortune 100 and hundreds of mid-sized enterprises.
Darren has assisted numerous clients with their comprehensive risk management programs, including leading them from assessment and identifi¬cation, to prioritization, mitigation and remediation. He has developed programmatic solutions for risk mitigation and transformed organizations’ security management processes to better codify and consume risk information.
Darren brings a strong understanding and familiarity with diverse compliance and regulatory frameworks, including NIST CSF & 800 series, ISO 2700X series, HIPAA/HITECH, PCI regulations, and several critical infrastructure & industry-specifi¬c guidelines (ISA, API, CFR, etc.).
Kevin Keeney
Director, Cyber Incident Response Team (CIRT), Monsanto
Kevin Keeney, Jr. joined the military in 1996 and was stationed in Georgia and Vilseck, Germany. After completing active duty in 2000, he moved to Missouri where he lives with his wife, Allyse, and five children. He has spent most of his professional career in the Midwest, with the exception of a two-year move (2007–2009) to Washington, D.C. in order to co-found Capital Business Development Associates, Inc. He has dedicated his professional career to serving his community through various military, civil, nonprofit, and corporate activities. He has been a member of the armed services and has volunteered with the Missouri National Guard, in various capacities, for over two decades.
In the corporate sector, Kevin’s 16+ year career has been oriented toward information technology and security. He held positions such as technical architect, datacenter manager, security analyst, incident response lead, and senior systems administrator. During a recent tenure with World Wide Technologies—a company that works with more than 40 of the Fortune 100 companies and holds major purchasing contracts with the U.S. government—Kevin was responsible for supporting sales to key Department of Defense accounts and providing WWT Data Center and Security expertise to all assigned accounts.
Across all of his corporate and military experiences, he has distinguished himself over the past two decades in the areas of cybersecurity and incident response. In June 2016, he joined a Fortune 200 multinational agrochemical and agricultural biotechnology company, as the Director of Incident Response. He uses his knowledge of IT infrastructure, business, and leadership expertise to implement strong security protocols that will reduce the cost of security organization while maximizing threat reduction. He was commissioned by executives to build a world-class program that will be recognized inside and outside of the company as cutting edge; he is doing this by building and training a high-functioning team. He is tasked with growing a U.S.-based incident response capability to a global one.
Al Pomerantz
Principal, Sofbang
Al Pomerantz has had an extensive career in technology. Some of his notable projects related to the Internet of things include WellTrends, ISIMS, AI in Network Security Appliances, and Animally Detection Engine. Mr. Pomerantz conceived the WellTrends concept which utilizes individual health related data and statistical process control to determine acute and chronic illnesses. He invented ISIMS which is an Intelligent Secure Incident Monitoring System that uses building automation control sensors to alert event first responders to anomalies within the event area. Al managed a successful three year NIST ATP research grant on utilizing Artificial Intelligence (AI) in network security appliances. Mr. Pomerantz has conceptualized a method to manage the massive amounts of Internet of Things data utilizing networked anomaly detection engines that can be cascaded to perform complex analysis of data to bring to the surface only that data which is relevant for use or examination.
Agenda
Tuesday, August 30 |
|
7:30 am Central |
Registration and Morning RefreshmentsAtrium |
8:30 am Central |
Opening RemarksMissouri/Capitol RoomHonorable Jay Nixon, Governor, State of Missouri Commissioner Doug Nelson, Office of Administration, State of Missouri |
8:45 am Central |
Keynote – Missouri Cybersecurity Task ForceMissouri/Capitol RoomThe newly-formed Cybersecurity Task Force brings together government, business and academic leaders from across the State of Missouri to address the challenges and the possibilities arising from technological innovation. The Task Force has been created to help build plans to mitigate risks and safeguard security for government infrastructure networks, foster cyber security education and awareness, promote best practices to protect data statewide, and explore the role of public-private partnerships. Commissioner Doug Nelson, Office of Administration, State of Missouri |
9:15 am Central |
General Session – State of the State of CybersecurityMissouri/Capitol RoomRich Kliethermes, Acting Chief Information Officer, State of Missouri Michael Roling, Chief Information Security Officer, State of Missouri |
9:35 am Central |
General Session – It Can Happen to YouMissouri/Capitol RoomToday, Distributed Denial of Service (DDoS) attacks and ransomware are in the news on a daily basis. From schools to hospitals and private sector to public sector, no sphere is immune to these attacks. Couple these external threats with the reality of an insider attack and the security of any organization is challenged on a daily basis. There are, however, lessons one can learn and strategies to put in place to help stave off or mitigate your risks. This panel discussion will share what organizations have learned and what they’ve done to survive these attacks and how you can learn from the bad day’s others have had. Moderator: Alan Cox, Executive Vice President & Publisher, Government Technology magazine Brennan P. Baybeck, Vice President, Global IT Risk Management, Oracle Corporation Darren W. Carroll, Director, Security & Risk Management Practice, Enterprise Solutions Group, SHI (@darrencarroll41) Kevin Keeney, Director, Cyber Incident Response Team (CIRT), Monsanto (@kevinkeeneyjr) Dale “Dr. Z” Zabriskie, Symantec Evangelist, Symantec Corporation |
10:00 am Central |
Featured Speaker – What Can I Say?Missouri/Capitol RoomTeri Takai, Former CIO of U.S. Department of Defense, State of California and State of Michigan; Senior Advisor, Center for Digital Government (@teritakai) After many years at Ford Motor Company and stints in Michigan, California and the US Department of Defense, Teri Takai has seen it all. What she can tell you is a horse of a different color! Teri will share the thoughts and expertise gained from years of IT experience in many industries covering both the public and private sector. Lessons learned, the pervasiveness of the threats and the job we all must do will all be touched on in this informative presentation. |
10:30 am Central |
BreakAtrium |
11:00 am Central |
Concurrent SessionsOrganizational Awareness – What Leaders Can DoCarnegies RoomOn a daily basis, organizations the world over need to be in a state of constant vigilance regarding data security and privacy. Given the diversity in the workforce and the growing trend towards user-owned devices in the workplace, this is a daunting task. In this session, a group of experts will provide guidance on simple things leaders can do on a regular basis to improve overall security awareness and preparedness. Daniel Clark, Security Architect, Sophos Charles Herbst, Associate Commissioner, District 2, Cape Girardeau County Aaron J. Scantlin, Security Analyst, Division of Information Technology, University of Missouri, Columbia Combating Small Business Cyber ThreatsJefferson B/CSmall businesses are as much a target as larger organizations. In fact, they often have the most to lose as the combination of limited cybersecurity resources and a lack of financial resilience to business disruption can make smaller organizations a prime target. So what can you do? In this session, our speaker will discuss the options available that can help an organization improve its readiness, including best practices owners should be using in this war on cybercrime. Kevin Seiler, Channel Manager, Check Point Software Technologies, Inc. The Tabletop Exercise – What, Where, When, Why and HowJefferson AOne of the most valuable things an organization can do to improve cyber security response is a tabletop exercise. They can last a few hours or be full and multi-day. They serve a vital purpose similar to their counterpart in emergency management disaster simulations and can make a challenging situation one where calm is the order of the day. In this session you will hear about exercises you can take part in and also receive advice and templates to host your own that can be tailored to your unique environment. Mike Pendergrast, Chief Engineer, Critical Systems Security, Boeing Renault Ross, Chief Cybersecurity Business Strategist, North America, Symantec Corporation Solving the Personnel GapTruman B/CIf you can’t hire a full-time CISO (who can?), how can you logically divide the tasks and what should the key focuses be for each person? How can you leverage internal staff, create cross-training strategies and even extend the capacity of your current IT staff? Conversely, can you job rotate this position? Join this session to learn creative ideas for how to create a CISO by committee and other innovative ways to solve the personnel gap. Chris Konrad, Cyber Security Engagement Manager, World Wide Technology (@cjkonrad) Michael Roling, Chief Information Security Officer, Information Technology Services Division, Office of Administration, State of Missouri Network AwarenessTruman AIn the business world, it is said that you cannot manage what you cannot measure. In information technology circles, it is said you cannot secure what you do not manage! It is therefore of vital importance to gain endpoint and network visibility, using tools and strategies to bring to learn what is on your network and who is on your network with the fundamental question of why is it on your network? Cyber policies can create pockets within organizations that “go off the ranch” and make their own decisions if they feel the enterprise policies prevent them from being effective and nimble. What can you do to raise the security profile without causing parts of the organization to make decisions that can create greater risk? This session will be an open discussion on how and why to have more awareness of your network. Darren W. Carroll, Director, Security & Risk Management Practice, Enterprise Solutions Group, SHI (@darrencarroll41) |
12:00 pm Central |
LunchMissouri/Capitol Room |
12:45 pm Central |
General Session – Cybersecurity Meets the Internet of EverythingMissouri/Capitol RoomDr. Charlie Miller, Security Engineer, Uber (@0xcharlie) Current projections suggest that 50 billion devices will be connected to the internet by 2020. As more and more gadgets are connected, cybersecurity issues will arise. This talk discusses the security implications of the Internet of things, including how we got into this situation and how it differs from the history of enterprise security. From this context, it discusses the recent forays into automobile hacking that led to a 1.4 million vehicle recall last year. Finally, it considers whether the security of the Internet of Things is serious concern or not as well as steps we take to protect ourselves. |
1:30 pm Central |
BreakAtrium |
1:45 pm Central |
Concurrent SessionsThe Role of Education in CybersecurityCarnegies RoomThe academic community has important roles in the fight against cybercrime. They are a source of certified professionals and, through research, can help fight the next wave of attacks before they happen. But what are colleges and universities in Missouri doing to alleviate the demand pressure for trained cyber warriors? What is the value of certificates like CISSP, CISM and CISA? What programs can/should you send staff to? How do you plug yourself into this network if you need to hire someone or if you want to provide feedback on skill programs needed? This session will provide you an overview of the role education is playing in the war on cybersecurity and will share resources you can use to help bolster the skills within your organization. Dr. Vijay Anand, Professor, Southeast Missouri State University Dr. Jeanette Cowherd, Assistant Superintendent for School Improvement, Park Hill School District Dr. Bruce McMillin, Professor of Computer Science and Associate Dean, College of Engineering and Computing, Missouri University of Science and Technology Dr. Gloria Stephenson, Manager, Cybersecurity and LAN Services, MORENet, University of Missouri The Internet of Things – Managing the UnmanageableJefferson B/CBy 2025 it is estimated that there will be over 20 billion devices connected to the internet! From personal medical devices to building automation systems and smart phones to autonomous vehicles, the world is getting connected. This wave of connectivity will add unfathomed risks to cybersecurity and we are just beginning to understand what this will mean. In this session, you will hear a frank discussion of what is coming and what needs to be done so as not to open new doors that will have to be closed before the data escapes! Gary Johnson, Senior Director, Cyber Security and Infrastructure, Kansas City Power & Light Al Pomerantz, Principal, Sofbang (@sofbang) The Legal Side of CybersecurityJefferson AWhether an internal or external effort, a cyber-attack is a crime. That means that certain legal issues or principals are involved. In Missouri, there are basics steps that organizations are required to follow when responding to a breach. In this session you will gain an understanding of your individual and organizational responsibilities that will ensure you are following published rules and acting in a manner that will preserve a chain of evidence in the event of an attack. Jeffery Jensen, Partner, Husch Blackwell LLP Allen Russ, Solution Architect, Public Sector Chief Technology Office, Adobe Systems Peter Sloan, Managing Attorney, Information Governance Group, LLC Getting Back to the Basics or How Not to be the Low Hanging FruitTruman AMost attacks go against known vulnerabilities that have not been addressed though they are known about for up to and over a year. For example, there is patch management. You know this needs to be done but it’s still not getting done. What can you do to put in place a comprehensive patch management program without it being a full-time job? Some organizations lack the proper tools to manage this process. Others simply get distracted by other pressing issues only to find a known vulnerability has not been correctly addressed. In this session learn how to handle the basics and not fall victim to an attack aimed at the low hanging fruit! Jeff Coiner, Director of Information Systems, City of Springfield Shane Harsch, Senior Solution Success Manager, RSA, The Security Division of EMC Charles King, Vice President of Information Technology and Chief Information Officer, Kansas City Power & Light How to Be Prepared for Cyber-Attacks Resulting from Civil DisruptionsTruman B/CIn the immediate aftermath of the civil disturbance in Ferguson, a cyber-attack was launched that caused network disruption to the City of Ferguson and also to St. Louis County and the State of Missouri. This is just one example of many where attacks were launched when officials were thought to be distracted or to add to the challenges that were already in play, be they man-made or natural. This session will be an opportunity to hear what happened but, more importantly, to learn what you can do to be prepared for cyber-attacks during other civil disruptions. Rick Powell, Client Site Manager, REJIS Venkat Sundaram, Enterprise Architect, Mythics Inc. Patrick Woods, Assistant Director – Cybersecurity, Criminal Justice Information Services Division and Chief Information Security Officer, Missouri State Highway Patrol |
2:45 pm Central |
BreakAtrium |
3:00 pm Central |
Concurrent SessionsAutomation and OrchestrationTruman AThere are many point solutions employed for cybersecurity but few staff resources to handle the workload. What can be automated in this process? What is the balance between automation and the judgement of a trained professional? What are the next steps you can take? This session is for those organizations that are beyond the basics of cybersecurity but don’t have the resources in place to be a full-fledged enterprise cyber organization with all the bells and whistles. Charles Cephas, Business Development Director, Veritas Web and Mobile App SecurityJefferson AOne of the biggest areas of concern for any cybersecurity expert is focused on the development of secure mobile apps and web sites. Without the proper focus, the mobile world is easy to attack and a prime target for the black hats. This session will focus on the do’s and don’ts for web and mobile development so you can begin the process of ensuring greater security as you continue to move into the world where everything is built for mobility. Kashif Dhatwani, Director, Identity & Access Management and Data Security Practice, BIAS Corporation David Veit, Information Technology Specialist, Information Technology Services Division, Office of Administration, State of Missouri Nikki Veit, Technical Architect, Information Technology Services Division, Office of Administration, State of Missouri ROI for Cybersecurity InvestmentCarnegies RoomIn government organizations, it is especially difficult to show an ROI on investments towards cybersecurity. The basics can be done but that is rarely enough investment to protect all of the sensitive data within a government organization. So how do you show ROI? What are specific examples of positive ROI on security investments. This session will provide examples of ROI and how one can positively show the value of further cybersecurity investment. Shawn Lorimer, Senior Aviation Consultant, Digital Aviation Business Consulting, Boeing Mike Pendergrast, Chief Engineer, Critical Systems Security, Boeing Social Engineering as an Attack VectorTruman B/CCon games go back centuries in human history. In the cybersecurity world, this takes a new form known as social engineering or social hacking. It comes down to this question: How do we secure the human? For both the practitioner and the end users who want to know the latest ways that the bad guys are employing to get sensitive data, this will be a must-attend session to wrap up the day. Darren W. Carroll, Director, Security & Risk Management Practice, Enterprise Solutions Group, SHI (@darrencarroll41) Ransomware EpidemicJefferson B/CRansomware has certainly gathered tremendous momentum over the past 18 months. According to Newsweek, Americans paid over $325 million due to ransomware attacks in 2015. So how do you protect you and your organization? What is the appropriate response? What are the legal issues and what is the role of law enforcement? This session will get you the latest information you need to be better prepared for preventing or remediating a ransomware attack on your data. Troy Campbell, Director, Cyber Threat Intelligence Program and IT Director, Kansas City Terrorism Early Warning Fusion Center Chris VanWagoner, Chief Strategy Officer, Commvault |
4:00 pm Central |
General Session – Tales from the TrenchesMissouri/Capitol RoomGrady Summers, Senior Vice President and Chief Technology Officer, FireEye The threat landscape is an ever-changing topic. Ransomware, malware, social hacking and other threats are a real and persistent issue for all organizations the world over. This session will include examples of recent breaches and what can be done to prepare for similar attacks on your organization. Given that cybersecurity is a shared responsibility, knowing what is out there and what can be done to mitigate these threats will make it more difficult for the bad guys and potentially save your organization from a messy situation. |
4:30 pm Central |
End of ConferenceConference times, agenda, and speakers are subject to change. For current updates, please visit the Executive Events website at www.govtech.com/events. |
Capitol Plaza Hotel
415 West McCarty Street
Jefferson City, MO 65101
(573) 635-1234
Capitol Plaza Hotel
Made Possible by Our Corporate Sponsors
Registration Information / Contact Us
Contact Information
2017 Sponsorship opportunities are available. For more information, contact:
Heather Earney
Government Technology
Phone: (916) 932-1435
E-mail: hearney@govtech.com