Author: cbateman

ABSTRACT

Security challenges don’t stop at the border. After decades leading security in British Columbia and three years working in Arizona, the contrast between the two environments has been revealing: different organizations, regulations, but many of the same technologies, threats, and security challenges. This session explores the lessons learned from both sides of the 49th parallel, including the practical application and evolution of a defensible security approach in a new environment. It will examine what actually builds cyber resilience, where organizations continue to struggle, and how AI is changing the economics, speed, and scale of both attack and defense. The focus is not on predicting the next threat, but on building organizations that are prepared to withstand it, respond effectively, and keep moving forward.

BIOGRAPHY

Gary Perkins is the Chief Information Security Officer (CISO) for cybersecurity firm CISO Global. Prior to that he was the CISO for the Government of British Columbia in Canada for 10 years — responsible for providing cybersecurity services in support of the province and taught undergrad and graduate students at the University of Victoria for years. He has over 25 years’ experience in information technology, risk management, and cybersecurity. Prior to joining the BC Government, he worked in the private sector as chief of staff for security at TELUS and, earlier in his career, led teams responsible for incident response, operations, delivery, and architecture for both corporate and managed security services customers. A Certified Information Systems Security Professional (CISSP) since 2004, Perkins also holds an MBA from Simon Fraser University’s Management of Technology program.

ABSTRACT

Those who learn lessons from the past are better prepared for the future. Well, that’s the way I see it anyhow. In this presentation I will take us on a journey through time and cyberspace using data as our sextant. We will start our journey discussing a few high-profile InfoSec stories recently in the news to observe headline making trends, we’ll then explore the current crop of threat actors undermining our security foundations and we will wrap-up with a discussion on the most impactful risk reducing activities leaders and practitioners can take to lower their chances of being victimized.

BIOGRAPHY

Chester Wisniewski is Director, Global Field CISO at next-generation security leader Sophos. With more than 25 years of security experience, his interest in security and privacy first peaked while learning to hack from bulletin board text files in the 1980s, and has since been a lifelong pursuit. 

Chester works with Sophos X-Ops researchers around the world to understand the latest trends, research and criminal behaviors. This perspective helps advance the industry’s understanding of evolving threats, attacker behaviors and effective security defenses. Having worked in product management and sales engineering roles earlier in his career, this knowledge enables him to help organizations design enterprise-scale defense strategies and consult on security planning with some of the largest global brands.

Based in Vancouver, Chester regularly speaks at industry events, including RSA Conference, Virus Bulletin, Security BSides (Vancouver, London, Wales, Perth, Austin, Detroit, Los Angeles, Boston, and Calgary) and others. He’s widely recognized as one of the industry’s top security researchers and is regularly consulted by the press, appearing on BBC News, ABC, NBC, Bloomberg, Washington Post, CBC, NPR, and more.

When not busy fighting cybercrime, Chester spends his free time cooking, cycling, and mentoring new entrants to the security field through his volunteer work with InfoSec BC. Chester is also available on LinkedIn and Mastodon.

ABSTRACT

GRC programs often stall or freeze, not due to lack of strategy, but because of hidden
psychological barriers. This talk explores Kegan’s Immunity to Change and Self-
Determination Theory to reveal why risk initiatives face resistance and how to design GRC
programs that actually stick.

BIOGRAPHY

Jason was previously the Head of GRC globally for Starbucks, and is now a certified
Leadership & Team coach. He brings 20+ years of experience in Cybersecurity, Risk
Management, GRC, and Privacy to his work with those in high stress roles. Day-to-day he
works with leaders & teams centered around their development goals, helping identify
obstacles that might be getting in their way, and then working to break free from anything
limiting them. He applies coaching and the social sciences to work in risk management with people and teams, understanding the most powerful component of managing risk: the
human beings involved in making those decisions.

ABSTRACT

Artificial Software Composition Analysis (SCA) is used by developers to identify dependencies or components of applications, which may have been built using Open Source and/or proprietary libraries. SCA is essentially a form of Application Security Testing (AST) to find the underlying licensing issues and/or security vulnerabilities in applications. There are several SCA/AST tools available in the Open Source markets like Github. As cloud took off in a big way, many of the enterprise applications started integrating various web based APIs to provide useful technical and business functionalities built by third parties. Unfortunately, Web APIs pose unique licensing and security risks that existing SCA/AST tools do not address. In this presentation, we’ll revisit Software Composition Analysis as a way to discover and manage security and licensing risks.

BIOGRAPHY

Dr. Baljeet Malhotra is an award-winning researcher and a global tech leader known for his work in Open Source and API Risk Management. He founded TeejLab in 2019 and steered the team to build API Discovery and Security™, world’s first end-to-end API Risk Management platform. Prior to TeejLab, he established the R&D unit of Black Duck Software in 2016 (acquired by Synopsys for $565 million). He also served as Research Director at SAP and Senior Software Engineer at MahindraTech. He received a PhD in Computing Science from the University of Alberta and won several awards including NSERC (Canada) scholar and Global Young Scientist (Singapore). He concurrently holds Adjunct Professor positions at the University of British Columbia, University of Victoria and University of Northern BC. He has given numerous ISACA, ISSA, IIA, ISC2, OWASP talks globally, and published several papers and patents at international venues.

ABSTRACT

The Internet has a trust problem. The Internet was not designed to exchange the monetary and the priceless value of our personal transactions.

The pandemic brought forth a rise in our dependence on digital life: from videoconferencing to shop-at-home applications, to social media. It has also transitioned the crime and espionage centers from physical cities to the Internet. Kim Cameron, Microsoft’s Chief Identity Architect (2004-2019) predicted this when stating in his landmark publication Law of Identity “The Internet was built without a way to know who and what you are connecting to. This limits what we can do with it and exposes us to growing dangers”.

The centralized control on identity with every merchant, organization and government an individual interacts with has frustrated the public with the requirement to remember hundreds of account/password combinations and the loss of control of sensitive personal data. This has been perpetuated in a societal shift of individuals (with governmental support) demanding more control of their personal information. Despite the warning signs, the Internet has thrived without an architectural construct to bind transactions to verifiable identities.

To revolutionize an established Internet itself, the architectural core of Internet transactions must evolve using new governance blueprints, trust anchors, and secure smartphones overlaying a foundation of decentralized identifiers. The building blocks of this new architecture has been developing over the last nine years and is ready to explode on a global scale.

Speaker Scott Perry, CEO of the Digital Governance Institute and co-Chair for the Governance Working Group for the Trust Over IP Foundation (ToIP), a Linux Foundation sponsored non-profit, will walk through a multi-level technical and governance architecture (“the Trust Over IP Stack”) that outlines greater confidence over the source and content of internet communications is being achieved. He will also walk through existing ecosystems where the exchange of verified digital credentials is transforming industries and societies.

BIOGRAPHY

Scott Perry is the Founder and CEO of the Digital Governance Institute where he provides a variety of governance solutions in the emerging space of governance of digital assets. Scott is a recognized global leader in digital identity, blockchain, and verifiable credential governance and accreditation. He has worked with the world’s most respected SSL certificate issuers, aerospace and defense companies, and government agencies such as the US Senate Sergeant at Arms and Federal Aviation Administration.

He is a Co-Chair of the Trust Over IP Foundation’s Governance Stack Working Group where he has authored and contributed to most of its governance and assurance publications driven to create standards and accountability in decentralized identity and verifiable credential networks.

As a hands-on governance and cybersecurity consultant and auditor, Scott provides deep and impactful advice that you would expect from a leader in the field.