Black Hat CISO Summit

• Jeff Moss, Founder, Black Hat + DEF CON

  

  Mr. Moss advises companies on security issues, both, electronic and physical, as well as speaking globally on the topic. He sits on several advisory boards helping enterprises make informed decisions on cyber risks.

  In April 2011 Mr. Moss was appointed as the Chief Security Officer for the Internet Corporation for Assigned Names and Numbers (ICANN), a non-profit whose responsibilities include coordinating and ensuring the security, stability and resiliency of the Internet's unique global identifiers as well as maintaining the root zone of the Internet. This position involved managing the IT security of the ICANN networks and information systems, the physical security of ICANN facilities and meetings, and ensuring that ICANN meets its security and resiliency commitments to the multi stake holder community that oversees ICANN. This position involved extensive international travel and coordination with governments, law enforcement, and operational security communities in support of discussions around Internet Governance and security. Mr. Moss left this position at the end of 2013.

  Moss is the founder and creator of both the Black Hat Briefings and DEF CON, two of the most influential information security conferences in the world, attracting over ten thousand people from around the world to learn the latest in security technology from those researchers who create it. DEF CON just had its 21^st anniversary.

  Prior to creating Black Hat Briefings, Jeff was a director at Secure Computing Corporation where he helped establish their Professional Services Department in the United States, Asia, and Australia. His primary work was security assessments of large multi-national corporations. Jeff has also worked for Ernst & Young, LLP in their Information System Security division. Because of this unique background Jeff is uniquely qualified with his ability to bridge the gap between the underground researcher community and law enforcement, between the worlds of pure research and the responsible application of disclosure.

  Jeff is currently a member of the U.S. Department of Homeland Security Advisory Council (HSAC), providing advice and recommendations to the Secretary of the Department of Homeland Security on matters related to homeland security. Jeff is a life member of the Council on Foreign Relations, which is an independent, nonpartisan membership organization, think tank, and publisher.

  In 2013, Jeff was appointed as a Nonresident Senior Fellow at the Atlantic Council, associated with the Cyber Statecraft Initiative, within the Brent Scowcroft Center on International Security.

  In 2014, Jeff joined the Georgetown University School of Law School Cybersecurity Advisory Committee.

  Jeff is active in the World Economic Forum, and recently became a member of the Cyber Security Global Agenda Council for 2014-2016.

  ICSA President's Award for Public Service, 2011.

  ---

• Steve Wylie, Vice President, Cybersecurity Market Group at Informa Tech

  

  ---

• Jeremiah Grossman, MC

  

  Jeremiah Grossman is one of the most-experienced and accomplished experts operating within the internet security realm. He is a specialist at finding network weaknesses and backdoors in order to allow companies to fix them before they’re exploited—or what he calls, a “good hacker.” Jeremiah is currently the Chief of Security Strategy at SentinelOne, a former information security officer at Yahoo!, and the founder of WhiteHat Security, which today boasts one of the largest professional “hacking armies” on the planet. With a career that spans nearly 20 years, Jeremiah has lived a literal lifetime in computer security and has become one of the industry’s biggest names. Coding since he was eight years old, Jeremiah proudly counts breaking software and hardware as “hobbies” and has been publicly thanked by global corporations including Microsoft, Mozilla, Google, Facebook and others for privately informing them of weaknesses in their systems—a polite way of saying, “hacking them.” He grips audiences with his stories of hacking some of the biggest corporations working today and discusses the current threats to secure systems globally, including hacktivists, cyber criminals, and nation states. Jeremiah also shares what businesses need to know to protect themselves now and moving forward as cyber crime businesses using ever-evolving tactics such as ransomware, malware, and economic warfare develop.

  Jeremiah began coding at eight and was a network administrator by the time he was 12. At the age of 18, he created a Yahoo! account, hacked into it, and sent instructions on how to do so to Yahoo!’s IT department; he was subsequently offered a job by the tech titan at the age of 18. Jeremiah worked for Yahoo! for several years, managing security for a portfolio of 600 websites in 42 countries with 120 million users. He also worked alongside eBay, Amazon, and even the FBI when the first major DDoS attack occurred in 2000. After leaving Yahoo!, Jeremiah founded WhiteHat, where he worked for 15 years, steadily growing the company until he was ultimately managing a network of 1,000 customers and 30,000 websites.

  ---

Tales from the Breach

• Jason Haddix

  

  Jason Haddix currently serves as the CISO at BuddoBot where he leads all efforts in cyber security. Previously, Jason worked at Ubisoft where his group protected over 22,000 employees worldwide with a vast scope. In previous roles Jason was Director of Penetration Testing at HP, leading all efforts on matters of information security consulting. Jason has also served as a Director of Operations and VP of Trust and Security at Bugcrowd, leading teams of highly technical Application Security Engineers and Technical Operations staff. While leading teams for the past 11 years, Jason is also a world renowned security engineer and hacker, participating in the bug bounty scene and releasing methodologies and tools for ethical hackers.

  ---

• Chris Gates

  

  Chris Gates has been in I.T. for 20 years and breaking things professionally for over 15 years via Network & Web Application Penetration Testing, Red Teaming & Adversarial Simulation. These days Chris spends most of his time focusing on building a great offensive security team and leading with an open heart as Sr. Manager for Robinhood’s Offensive SecurityTeam.

  ---

CISO Success in the Board Room

• Richard Seiersen

  

  Richard Seiersen is the Chief Risk Officer for Resilience – a cyber focused InsurTech. Prior to Resilience Richard was the co-founder of Soluble, a cloud-native security company sold to Lacework.com (2021). He is a former Chief Information Security Officer (CISO) for GE Healthcare, Twilio, and LendingClub. He is also consulting faculty with IANS helping CISO and their teams on strategy, risk quantification, and board presentations. Richard has also authored two books: How To Measure Anything In Cybersecurity Risk (with Doug Hubbard) and The Metrics Manifesto: Confronting Security With Data. Richard's first book is curriculum for the Department of Defence (DoD) CISO program at Carnegie Mellon and has been curriculum for the Society of Actuaries Exam Prep and several graduate programs at universities such as Harvard, Brown, Berkeley, and others.

  ---

Personal Privacy & Security for CISOs

• Caleb Sima

  

  Caleb Sima served as the Chief Security Officer at Robinhood where he built the team thru IPO and served as a public company executive. Prior to Robinhood he was VP of Information Security at Databricks a leading data analytics and machine learning company where he has built the security team from the ground up. Previously he was a Managing VP at CapitalOne, where he spearheaded many of their security initiatives. Prior to CapitalOne, Caleb founded SPI Dynamics and BlueBox security, which were acquired by HP and Lookout. He is attributed as one of the pioneers of application security and holds multiple patents in the space and is also the author of Web Hacking Exposed. He serves as an advisor, investor, and board member for security companies.

  ---

Using Data to Prioritize Cybersecurity Investments

• Scott Stransky

  

  Scott Stransky is Managing Director and Head of the Marsh McLennan Cyber Risk Intelligence Center. The Center launched in 2021 to provide cyber modeling, thought leadership, and cyber analytics guidance across Marsh McLennan. Previously, he led the Cyber Modeling group at extreme event modeling firm AIR Worldwide (part of Verisk Analytics). Under his leadership and guidance, the team sourced and cleansed detailed cyber security, incident, and claims data, and combined it with advanced machine learning algorithms, stochastic modeling techniques, and Monte Carlo simulations, providing the insurance industry with a robust suite of models to manage their cyber insurance portfolios. He is a recognized speaker across North America and Europe on the topics of cyber insurance risk and catastrophe modeling, having been invited to speak at numerous conferences sponsored by Advisen, NetDiligence, IUA of London, RAA, CPCU Society, AM Best, Lloyd's, and others, in addition to engaging directly with clients. He was voted by his industry peers to be the 2023 Cyber Risk Industry Person of the Year in the Actuary/Modeler category. Mr. Stransky earned a bachelor’s degree in Mathematics with Computer Science from MIT and a master’s degree in Atmospheric Science from MIT.

  ---

AI vs. Software, Society, and Security Programs

• Daniel Miessler

  

  Daniel Miessler is a recognized cybersecurity expert and writer with 20 years in Information Security. His experience ranges from technical assessment and implementation to executive-level advisory services consulting, to building and running industry-leading security programs.

  ---

Cyber Preparedness - Future Conflicts Will Include Non-Military

• Rich Baich

  

  Joseph “Rich” Baich serves as CIA’s Chief Information Security Officer (CISO) and Director of the Office of Cyber Security (OCS). Mr. Baich brings with him a wealth of technical leadership experience and cybersecurity expertise, including his most recent role as American Insurance Group’s (AIG) Global Chief Information Security Officer. At AIG, he was responsible for developing, implementing, and operating an information security strategy to address global cyber risks. Previously, Mr. Baich was the CISO for Wells Fargo and a principal at Deloitte. His prior government experience includes retiring as an Information Warfare Officer in the US Navy for NSA and serving as Special Assistant to the Deputy Director for the National Infrastructure Protection Center at the FBI. As a member of our Digital C-Suite, he partners with the Chief Information Officer and Chief Data Officer to further integrate our approaches to cybersecurity, enterprise information technology, and data management. Mr. Baich holds an MBA and a Master of Science in Financial Management from the University of Maryland University College, a Bachelor of Science from the United States Naval Academy, and is a graduate of the Joint Forces Staff College and Naval War College. During his military service, he qualified not only in surface warfare, but in various technical fields, including space, cryptology, and information warfare, all while maintaining numerous security industry certifications. He is the author of Winning as a CISO, a leadership sourcebook for security executives. In 2021, Mr. Baich was honored as one of the top 100 CISOs by CISO Connect and was selected by the Executive Women’s Forum (EWF) to receive their inaugural 2021 EWF Catalyst award. The EWF Catalyst Award was presented to five outstanding male executives that have been exemplary in their engagement, commitment, and support of gender equality.

  ---

Cyber Security Economics

• Fernando Montenegro

  

  Fernando Montenegro is a Senior Principal Analyst on Omdia’s cybersecurity research team, based in Toronto, Canada. He focuses on the Infrastructure Security Intelligence Service, which provides vendors, service providers, and enterprise clients with insights and data on network security, content security, and more.

  Fernando’s experience in enterprise security environments includes network security, security architecture, cloud security, endpoint security, content security, and antifraud. He has a deep interest in the economic aspects of cybersecurity and is a regular speaker at industry events.

  Before joining Omdia in 2021, Fernando was an industry analyst with 451 Research. He previously held a variety of operations, consulting, and sales engineering roles over his 25+ years in cybersecurity, always focusing on enterprise security at organizations including vArmour, RSA, Crossbeam, Hewlett Packard, and Nutec/Terra. Fernando holds a Bachelor of Science in computer science and different industry certifications.

  ---

How Institutional Investors Evaluate Your Vendors

• Roger Thornton

  

  Roger Thornton is a driving force behind hundreds of technology products and services that have formed and grown companies across a range of industries. As a founder and CTO, his visionary product and technology leadership helped create cybersecurity industry leaders Fortify Software and AlienVault. As an investor, mentor and board member he has helped multiple generations of entrepreneurs build more than 15 successful cybersecurity companies. In his General Partner role at Ballistic, Roger taps into over 30 years of experience and counsels future generations of cybersecurity founders who are focused on building great products as a foundation for great companies.

  ---

• Bill Ryckman

  

  Bill Ryckman has a computer science background and a quarter century of experience analyzing, advising and investing in companies in the Aerospace and Defense industry, Mr. Ryckman decided in 2013 to dedicate himself to serving the cyber security mission exclusively.

  ---

• Chenxi Wang

  

  Chenxi Wang is an experienced technology executive with deep cybersecurity expertise. Board of Director for MDU Resources, a Fortune 500 company, serving on Audit and ESG Committee. Founder and General Partner of Rain Capital, a Cyber-focused venture fund. Chenxi has held senior tech strategy roles in large companies (Intel Security). She has led Go-to-market operations and product strategy in booming Silicon Valley startups (Twistlock, Ciphercloud). Chenxi is also an advocate for diversity & inclusion, and founder of the Forte Group, a 5013(C) organization to advance women's careers in Cyber. Previously Chenxi was a computer engineering professor at Carnegie Mellon University. She holds a Ph.D. in Computer Science.

  ---

• Justine Bone, Moderator

  

  Justine Bone is an experienced leader and board advisor serving the healthcare, defense, and financial sectors. Her areas of expertise include hacking, risk management, cybersecurity communications, and strategy development for technology companies. She serves as a member of HP Inc.’s Security Advisory Board, the Review Board of Blackhat, as a faculty member of IANS and is the co-founder of several cybersecurity companies. Justine also previously led as CISO of Bloomberg and Dow Jones. Her training was as a computer hacker and security analyst for the USA’s NSA and New Zealand’s GCSB. In addition to technology, Justine credits her creative interests to her international background and early career as a classical ballet dancer.

  ---

Your Threat Model is Too Narrow: A Broader Look at Supply Chain Ecosystem Attacks

• Mike Hanley

  

  Mike Hanley is the Chief Security Officer and SVP of Engineering at GitHub. Prior to GitHub, Mike was the Vice President of Security at Duo Security, where he built and led the security research, development, and operations functions. After Duo’s acquisition by Cisco for $2.35 billion in 2018, Mike led the transformation of Cisco’s cloud security framework and later served as CISO for the company. Mike also spent several years at CERT/CC as a Senior Member of the Technical Staff and security researcher focused on applied R&D programs for the US Department of Defense and the Intelligence Community. When he’s not talking about security at GitHub, Mike can be found enjoying Ann Arbor, MI with his wife and eight kids.

  ---

CISO Liability – Lessons Learned

• Joe Sullivan

  

  Joe Sullivan has worked at the intersection of government, technology, and security since the Internet went mainstream. He’s dedicated his career to helping to make the online world a safer place for everyone, where businesses and people can thrive without risk.

  He was the government employee who in 1995 was able to convince the Department of Justice to let him run a direct Internet cable into the office, where he used the connection to research global politics related to claims for political asylum in the United States. In 1997 , the DOJ gave him special technical training and computer equipment and invited him to join the Computer and Telecommunications Crime Coordinator program. He eventually became 100% focused on technology-related crimes, received national recognition from the DOJ for outstanding service as a federal prosecutor, and worked on many first-of-their-kind cybercrime cases, including supporting the digital aspects of the 9/11 investigation.

  Joe thought he would spend his whole career with the government but was recruited to eBay in 2002 to build out their eCrime team, and since then has been working at the forefront of cybercrime investigations to build large teams that have fought hard to protect consumers from digital harm. While the governments of the world struggled to be proactive in preventing internet crime, Joe took jobs at companies at the forefront of the Internet, where the companies needed to invest in building out their defenses to try to prevent harm from happening in the first place. At eBay and PayPal between 2002 and 2008, those efforts were focused on protecting people who used those services from financial harm. At Facebook between 2008 and 2015 he prioritized child safety, at a time when children were joining social networks and parents were struggling to keep up. At Uber he focused on protecting riders and drivers from physical world dangers, as technology revolutionized transportation. From early 2018 through late 2022, Joe was part of the team at Cloudflare, prioritizing both building out the team protecting the customers of the company and the privacy and security tools that are given away for free for everyone to use online.

  Even though he left government service in 2002, he’s never stopped actively supporting government efforts to promote safety online for everyone. He’s testified before the US Congress twice, been a commissioner on the National Action Alliance for Suicide Prevention, a board member on the National Cyber Security Alliance, a many-time opening plenary speaker at the Dallas Crimes Against Children Conference, a participant in a White House anti-online-bullying effort, an advisor to the Department of Homeland Security, and accepted an appointment from President Obama to his Commission on Enhancing National Cybersecurity.

  Joe is currently the CEO of a nonprofit named Ukraine Friends where he focuses on providing humanitarian aid to the people of Ukraine. He also advises several startups and mentors security leaders.

  ---