Spring Joint Conference

Event Schedules

Day 01

09 May 2024
Day 02

10 May 2024

07.00 AM- 08.00 AM

Breakfast

08.00 AM - 08.05 AM

Opening Comments

08.05 AM - 09.05 AM

Continuous Security Testing

David Hunt

"When we talk about security issues, we often resort to labeling them: this one is low priority, this one is high, this one is critical.. The process is largely subjective and often results in thousands (or millions) of ""risks"" that will challenge even the most battle-tested security team. This is called noise. To cut through it, you need to know one thing: do I have any risks that I need to remediate right now? These risks are known as material risks. The SEC defines them as weaknesses ""to which there is a substantial likelihood that a reasonable investor would attach importance."" While every risk carries the potential for financial or reputational harm, material risks are those which can cause significant harm. Continuous cybersecurity is a strategy that shifts organizations away responding to breaches after they happen to identifying material risks before an attacker notices them. This paradigm shift allows those responsible for protecting our organizations - from IT to cybersecurity teams - the ability to cut through the noise and do what they do best: protect us."

09.05 AM - 10.05 AM

Generative AI: Cyber Risk and Building Resiliency

Jason Dablow

Many businesses are considering using generative AI to improve efficiency and accelerate operations, but some organizations lack visibility into the tools and potentially fraudulent AI-generated assets their staff interacts with. Threat actors are also actively using generative AI for malicious purposes. How can cybersecurity teams get the right visibility and insights while using generative AI to accelerate detection, response, and more? In this session, explore the opportunities and risks associated with generative AI and how the right tools offer the visibility and protection you need without sacrificing the benefits of this emerging technology.

10.05 AM - 10.15 AM

Morning Break

10.15 AM - 11.15 AM

AI in Internal Audit

Mitch Polenske

Driven by a complex, wide-ranging and rapidly developing AI landscape, it is crucial for IA functions to have full visibility on their organization's use of AI, and the risks and controls. Take advantage of AI capabilities throughout the risk assessment, planning, execution, and reporting processes.

11.15 AM - 12.15 PM

Leveraging the NIST AI Risk Management Framework to Audit AI

Raj Sawhney

A recent study by the IIA found that 28% of chief audit executives, IT audit directors, and other executives and professionals deem AI a high risk during the next 12 months. Utilizing the NIST AI Risk Management Framework we provide attendees the key tools and understanding to build their own AI Audit program to address this risk for their organization. Source: https://www.accountancyage.com/2024/01/18/ai-is-an-emerging-risk-for-auditors-new-research-shows/

12.15 PM - 01.15 PM

Lunch / Networking Break

01.15 PM - 02.15 PM

Jason James

Coming Soon

02.15 PM - 03.15 PM

Brett Chabot

"Coming Soon"

03.15 PM - 03.30 PM

Afternoon Break

03.30 PM - 04.30 PM

Build a Successful Data Protection Program

Neetu Khilnani

Organizations may have millions of electronic documents that sit outside structured databases and contain sensitive information such as personally identifiable information (PII) and healthcare information. Crafting a Data Protection strategy involves aligning on the roles that your people, processes and technology will play. In addition to selecting and implementing information protection tools and technologies that are still maturing, an organizational change management program with supportive governance structures is critical to program success. What are the key success factors for a Data Protection program? What are the metrics you want to monitor and report to the Board? And once a Data Protection program is built, how would you assess and audit it?

04.30 PM - 05.15 PM

Security Champions: Building a Program for the Ultimate Shift-Left

David Wayland

Security Champions programs have the opportunity to directly, and positively, impact the daily lives of developers specifically, and the entire company. Establishing, cultivating, and maintaining solid and open lines of communication ensure a successful program. David Wayland, a former developer, current Senior Staff, Enterprise Security for a financial operations platform company, will discuss building a Security Champions program from his unique development and security team perspective. Join David as he reveals the expectations, realities, and best practices gained from over a decade of running Security Champion programs that you can use to drive your own programs success.

05.15 PM - 05.30 PM

Closing Comments

07.00 AM - 08.00 AM

Breakfast

08.00 AM - 08.05 AM

Opening Comments

08.05 AM - 09.05 AM

Workiva

" Coming Soon "

09.05 AM - 10.05 AM

API Security - Regulatory and Compliance Changes for 2024 and Beyond

Karl Mattson

Regulators are setting clear guidelines for companies to raise the bar in API security in 2024. From NYDFS to the CFPB to DORA and PSD3 in the EU, the pressure will be on companies to address APIs risks for privacy and security in entirely new ways. In this session, we will explore recent and significant changes to regulations and compliance expectations, how they apply to protecting APIs and sensitive data, and what IT, security and compliance professionals can do to prepare themselves for this new wave of scrutiny.

10.05 AM - 10.15 AM

Morning Break

10.15 AM - 11.15 AM

7 Steps to GenAI security and Governance

Vishwas Manral

We will talk about AI and more specifically Generative AI. Then we will discuss the typical use cases how GenAI is being used. Taking a practical view of the existing usage of GenAI in companies we will then talk of the 7 steps security teams need to take to secure and govern their GenAI usage.

11.15 AM - 12.15 PM

Michael Boanta + Poss Jason

"Coming Soon"

12.15 PM - 01.15 PM

Lunch / Networking Break

01.15 PM - 02.15 PM

Going Beyond the SOD Matrix

Amanda Monrad

"In this session, we will cover how to revisit your SOD controls when faced with the introduction of new technologies. We’ll discuss what to consider when SoD is no longer controlled using security alone. You’ll be provided with business case considerations that you can use to elevate your SOD game by investing in tooling or automation in support of your organization’s digital transformation efforts. And finally, we’ll discuss SOD automation deployment strategies, by discussing common challenges faced when bringing continuous monitoring tooling to life and two approaches for how and who to engage in your organization to tackle those challenges head on."

02.15 PM - 03.15 PM

Internal Audit’s role in Digital Transformation – Beyond the Obvious

Bob Green / Carl Grifka

Internal auditors may well be familiar with some of the more traditional contributions that they provide to a complex software or digital transformation initiative. This course will both highlight the source guidance around these traditional roles and to provide meaningful, instructional learnings targeted to Internal auditors where they can add significant value to increase the likelihood of the success of these initiatives (which, as proven, fail over 50% of the time).

03.15 PM - 03.30 PM

Afternoon Break

03.30 PM - 04.30 PM

How We Can All Help Fill the Skills Gaps in Cybersecurity Teams

Mel Rico Reyes

"Cultivating a robust cybersecurity workforce requires a multifaceted approach with a diverse set of skills. Organizations can invest in hiring candidates from various verticals and markets to enhance their security programs. Additionally, bringing in fostering a culture of knowledge sharing and collaboration can bridge skills gaps and ensure a resilient cybersecurity team. • How can we create a culture of continuous learning and knowledge sharing within our cybersecurity team? • What training and certification programs would be most beneficial in addressing specific skills gaps within our team? • Are there mentorship opportunities or collaborative initiatives that can help empower existing talent and enhance our overall cybersecurity workforce?"

04.30 PM - 05.15 PM

The Chatbotter’s Guide to NIST CSF: Don’t Panic by Using AI

John Vasquez

"As organizations seek to develop and strengthen their cybersecurity programs, many turn to security frameworks as the answer to the ultimate question of threats, risk management, and resilience. However, after reading through seemingly endless pages of vague, yet complex, security controls, security teams may quickly realize how daunting that framework adoption will be, especially given their limited time, budget, and personnel. Perhaps deep thought could help… In this presentation, we will explore how AI-powered tools can be leveraged to build effective cybersecurity programs aligned with the recently released NIST CSF 2.0. We will demonstrate how AI chatbots can help organizations comprehend, assess, prioritize, and communicate their specific risks based on the CSF’s six high-level functions. Key topics to be covered include: • Overview of the NIST CSF 2.0 and its role in developing cybersecurity programs • Introduction to AI chatbot technology and its applications in cybersecurity and GRC domains • Use cases for AI chatbots in supporting NIST CSF 2.0 implementation, such as: ◦ Automated assessment of current security posture ◦ Intelligent gap analysis and prioritization of security controls ◦ Customized CSF 2.0 control implementation recommendations ◦ Continuous monitoring and optimization of cybersecurity programs • Considerations for deploying AI-powered solutions"

05.15 PM - 05.30 PM

Closing Comments

10.30 AM - 11.30 AM

Web Design Principles and Best Practices

David Warner

Lorem ipsum dolor sit amet, consectetur adipisicing elit. Amet minima dolores rerum maiores qui at commodi quas, reprehenderit eius consectetur quae magni molestias veniam, provident illum facere iure libero asperiores! Lorem ipsum dolor sit amet, consectetur adipisicing elit. Veniam earum nihil ex ipsa magni eligendi fugiat assumenda suscipit, accusantium, necessitatibus reiciendis odit sed, vero amet blanditiis?