2019 Security BSides Orlando

Saturday March 30th, the 2019 Security BSides Orlando conference was held.  This is the 6th one, and the largest yet.  Believe they had over 700 in attendance.  As last year, it was held at Full Sail University's Live venue location. 

This year there were 4 tracks of speakers, along with several workshops and a CFT.  Several sponsors were in attendance.  No job track this year.

There was a book signing with the book Tribe of Hackers as there were 3 hackers from the book in attendance.

And there was an electronic badge again this year, but this time was a little more complex and programmable. 

No idea where next year's event will be, but will probably be tied to SANS Orlando again.

SFISSA Security Conference

On March 22, 2019, the South Florida ISSA held their biannual 2019 Security Conference.  This time the theme was "A New Year, a New Era of Cybersecurity".

The conference had 4 tracks of speakers, as well as a 2 hour workshop on your cybersecurity career.  A keynote address was given by Dave Aitel of Cygtera, and a CISO panel was held with 4 local CISO from different companies.

An array of sponsors were present as well.  Breakfast and lunch were provided, and everyone had a great time.

The next event of the chapter will be their annual Hack the Flag/Chili Cookoff held September 7th at FIU's Graham Center.

2019 Update on frameworks, standards, and regulations for infosec

At the 2019 BSides Tampa Security conference I did a talk on 2019 Updates on frameworks, standards, and regulations for infosec.  Over the last year several new and updated frameworks and regulations have come out, as well as are being updated.

Most of the information can be found on the Internet, but if you're not making an effort to stay up to date, you can miss something.  So here I give links to much of the information I gave.

NIST is the National Institute of Standards and Technology, a non-regulatory part of the Department of Commerce.  They are doing a lot of things that impact us in infosec.  Most are hopefully familiar with the Special Publication 800 and 1800 series that are put out on a regular basis.  Several are being developed, updated, and in a few cases retired. Go HERE to access all of them.

The NIST Cybersecurity Framework (CSF) was updated to version 1.1 last year, and they later had a cyber risk conference in October.  It just had its 5th anniversary, too. For full info on the CSF, and any updates and the like, go HERE.  One element I am looking forward to is an update to informative references that will add additional references (such as crosswalks to PCI-DSS, Standards of Good Controls, etc).  Hopefully we'll start seeing these coming out.

NIST Privacy Framework.  NIST has embarked on creating a privacy framework like they've done for cybersecurity.  This work has just begun, and they are working on a preliminary framework which we should see soon.  I would hope there will be further workshops and feedback before the final version is out.  To see where they are, go HERE.

FISMA is the Federal Information Security Management Act. Basically sets down security standards for federal information systems.  NIST has developed the materials for this, the Risk Management Framework (SP 800 37), the controls set (SP 800-53) and other materials.  They are working on updating this, having just come out with the latest version of the RMF.  The control set is next, with others to follow.  Go HERE for their page on this work.  The schedule is HERE.

Baldridge Cybersecurity Excellence Builder is a combination of NIST's Baldridge Excellence work crossed with their CSF.  It was rolled out in 2017, and should get an update this Spring.  You can download it for free HERE, and there is info on how others have used it successfully.

NIST OSCAL is an interesting project that attempts to create a common set of control assessment language.  This is a project I want to spend more time looking into myself.  More info on their website HERE.

Hopefully most have heard of the "Critical Controls" or the "Critical Security Controls".  Maybe you've heard it referred to as the "Top 20" or the "SANS20" or the like.  While it was started by SANS, they no longer manage it.  For the last few years its been handled by the Center for Internet Security, which has rolled out v6 and in early 2018 they rolled out v7.  They have reorganized it into 3 groups: Basic, Foundational, Organizational.  They have been putting out other resources for it, including the CSAT, a self assessment tool.  They are working on a v7.1 and I expect more resources coming from CIS.  So keep your eye out for them, as they just rolled out a companion guide for cloud (go HERE) and is working on another for IoT.

ISO/IEC 27000 is the international standard set for information security.  This series is made up of about 50-60 documents in various states of work.  Sadly, the documents are not free, and the cost is over $100 for each.  Key documents is usually 27001 and 27002.  1 sets down the ISMS (Information Security Management System) and 2 is the control set (compare with SP800-53).  As several of the documents are being worked on, its hard to keep up.  ISO/IEC 27005 got updated.  My go-to site to keep up to date on this is iso27002security.com.

Privacy regs  (GDPR & California).  Privacy is getting more and more important.  While we work in security, we often get pulled into privacy work as well.  GDPR (General Data Protection Regulation) of the EU was rolled out last year.  And we've already seen some big companies get in trouble.  While I see a lot of groups pushing GDPR training and the like, as a consultant I'm not seeing a lot of clients asking for help.  Yet.  California is rolling out their regulation, which isn't in effect yet.  We'll see if other states will roll out or update their privacy regulations.

One I left out of my presentation is 23 NYCRR 500, which is the New York Department of Financial Services (NY DFS) regulations on cybersecurity.  Rolled out a couple of years ago, the various elements of the regulation has been slowly rolled out with the last one required this March.  This regulation expects companies do certain things to protect NPI (non-public information), such as have a security program, policies, doing pentesting and vulnerability scanning, have a CISO, do training, have an incident response plan, vendor management plan, etc.  This may be a model for other state.  You can read it all HERE.

Now, there are some other items that aren't pure infosec/cybersecurity, but do touch on it, so should be mentioned.

CMMI- The Capability Maturity Model Integrated, originally for assessing the maturity of software development, it was later expanded to others.  Later merged into the CMMI, with Development, Service, and Acquisition versions.  The Software Engineering Institute at CMU developed it, and it used to be available for free or via books.  But they moved the CMMI to the CMMI Institute, which was recently bought by ISACA.  They've rolled out CMMI v2, but its available as a SaaS product, and no longer free.  The CMMI Institute has also rolled out a Cybermaturity Platform, again as a SaaS product.  I'd like to learn more about it, but hard to do.

COBIT, which is ISACA framework for governance of enterprise IT has been updated to COBIT 2019.  They've rolled out the new books, and hopefully other materials will be updated to COBIT 2019.

ITIL is a framework for IT Service Management, which includes infosec.  The current version is ITIL v3 (updated in 2011).  It's being updated to a new version, ITIL 4.  So far only the foundation certification info have been updated.  Hopefully they will update the 5 main books this year.

PCI-DSS is the standard for assessing credit card processing systems.  Current version is 3.2.1, which was updated due to issues with SSL.  Well, the next version, v4, is going to be coming out, but not for another year or so.  It will be a very different version, but info on this is hard to find.  Am sure as we move further along we'll learn more.

Hopefully this is useful for others.  As I learn of new updates, I'll make further postings.

2019 Secure Miami

This past weekend I attended 2019 Secure Miami conference, the third edition of this local cybersecurity conference.  Organized by DigitalEra, and held at FIU, it also tied to BrewMiami, held later that day at FIU.

This was a full day event held in FIU's Graham Center with key note speakers and panel discussions.  As I've been to the prior events, I felt this as good or better then the last one.

On the panel discussions, topics covered included the "Cybersecurity skills gap", "managing visibility and compliance" and "smart cities".  The skills gap discussion was interesting, as I know several who struggle to find work and our hiring process in IT/infosec is broken.  Had a good chat with one of the people on the panel about the NICE conference that we had at FIU and learned the next one will be in Phoenix.  The smart cities one got into the matter about IoT security and the like.  We'll see where that goes.

On the keynotes, they had an interesting one given by a former FBI Agent and his experiences, and another about artificial intelligence.  AI was a topic I had a keen interest in college, but drifted away from, that seems to have become more a topic in infosec.  I need to get back on top of that.

Afterwards many of us headed over to the BrewMiami event and chatted and had fun.  Another great event.  I look forward to next year's event, as well as other upcoming events in the area:  ISACA South Florida's WOW event, Infragard South Florida's next meeting, South Florida ISSA's Conference and HackMiamiCon.

BSides Tampa 2019

This past Saturday (Feb 2nd), the 2019 BSides Tampa Conference was held.

In a change from past years, they've moved to a new venue, the Embassy Suites on the USF Campus.  The 2020 Conference will also be held there, apparently on February 29th.

This year there were about 8 tracks of talks, including one for job seekers.  There were many vendors in attendance as well as several infosec groups.  The Tampa Bay chapters of ISSA, ISC(2), and IAPP were in attendance, along with a couple of universities with infosec programs.

I spoke again on the topic of updated and upcoming frameworks, standards, and regulations for infosec people.  I'll be posting separably on that talk with links to information I spoke of.

Overall, I thought the event went great.  Sadly, due to other issues, this year I flew in that morning and left that evening, so missed out on the dinner the night before for speakers and couldn't hang around for the afterparty.  Maybe next year.

2018 NIST Cybersecurity Risk Management Conference

Back in October I was in Baltimore for NIST's 2018 Cybersecurity Risk Management Conference.  For those not aware, let me break this down.  NIST is the National Institute of Standards and Technology, a non-regulatory research arm of the Department of Commerce.  For those of us in the IT and infosec world, we know NIST for their SP800 and SP1800 series of documents on various IT and infosec topics, for creating the Risk Management Framework (sometimes call FISMA) and the Cybersecurity Framework (CSF).

For the last two years they held annual workshops for the CSF (these were actually the 7th and 8th), which I was able to attend and previously reported on.  The main purpose of these workshops was to bring people together to look at the future of the CSF, and develop the next version, which was v1.1 that came out earlier this year.

This year we instead got a 3 day conference held at a hotel in Baltimore.  It was a mix of plenary sessions, work sessions, panel discussions, and presentations.  There were also working lunches for those who paid extra for 'catering'.

It was almost overwhelming the number of sessions, as there were about 8-9 sessions going on at once during certain period.  Some of the slide decks from these presentations are made available, as there was almost too much information.

Some of the items I learned was details on the updating going on with various documents related to FISMA.  I knew this was going on, but got more details.  Also learned more about the plans for PCI-DSS v4, which is planned for development over the coming year.  I also learned more about the Baldridge Cybersecurity Excellence Builder (which will have an update early next year).

There were some problems, I think due to the change in venue and expansion from the workshops.  I hope these will be addressed for the next one.  At this point, we don't know when or even where the next one will be.  So we'll have to see.  I hope I can attend the next one as well.