SC Midlands Chapter of ISACA

Hosts a 3 Day Conference for 24 CPEs

April 3, 4, and 5, 2013

Your Choice of 1, 2 or 3 days:

DAY 1: Simplifying Audits of TCP/IP Network Security

DAY 2: "Good Fences Make Good Neighbors": Auditing Your DMZ Network

DAY 3: Taking the Mystery Out of Cryptography

Presented by Ken Cutler CISA, CISSP, CISM, Security+

DATES:          Wednesday - Friday, April 3 - 5, 2013

LOCATION:     BCBSSC Tower Auditorium

                     2501 Faraway Drive,

                      Columbia, SC 29223

                    Free Parking in white spaces only

 Daily Schedule:  

Registration:                  7:30 am (Breakfast served)

Pricing:

Early Bird Registration: Now until March 15, 2013

Regular Registration: March 16, 2013 - March 27 1, 2013

Late Registration: March 28, 2013 - April 2, 2013

What you will learn:

Day 1: Simplifying Audits of TCP/IP Network Security

TCP/IP networking is the lifeblood of modern business applications, but its ancient design and fundamentally insecure network services carries a lot of important risks. As more critical business applications move from centralized legacy systems to distributed systems, the open peer-to-peer architecture concept and poorly tested software leave organizations open to a wide array of security and control risks. In this information-packed workshop, you will review the security and audit implications of local-area network (LAN) and wide-area area network (WAN) TCP/IP infrastructures, uncover the risks in the technologies, and identify cost-effective tools for preventing and detecting serious security loopholes. Topics covered include:

• Protocol stacks and topologies galore: identifying and assessing key control points in today's complex network infrastructures and multi-tiered applications
• Evaluating important threats, vulnerabilities, and risks associated with those control points
• LAN and WAN media access: getting connected with or without wires
• IP addressing, address management (DHCP), and directory services (DNS)
• Network appliance (interconnection device) operation and security
• TCP/IP application risk analysis: tools and techniques
• Outlining critical audit points and project scoping recommendations to include in network and distributed application audit programs
• Finding sources of low-cost technical audit resources

 Note: This course does not cover the details of DMZ and network perimeter security, which is covered in Auditing Your DMZ Network.

Prerequisites: A basic understanding of IT controls and terminology is assumed.

Day 2: "Good Fences Make Good Neighbors": Auditing Your DMZ Network

Today's Internet connections are typically shielded by a Demilitarized Zone (DMZ), a critical security buffer between your organization's internal network and the outside world. Firewalls, intrusion detection/prevention systems, proxy servers, packet filtering routers, and VPNs all play a major role in regulating and restricting traffic flowing to and from the Internet. Failure to properly configure, maintain, and monitor a secure and efficient DMZ increases the risk of your organization being attacked by external intruders. This intensive seminar is designed to equip you to better protect and audit your network's perimeter through a blend of practical, up-to-the minute knowledge transfer and audit case studies. Key topics covered include:

• Developing a DMZ and network perimeter security audit plan: identifying the control points
• Tools and techniques for auditing network devices and perimeter security
• Reviewing your network security traffic filters: border routers, firewalls, proxy servers
• Tunneling for safety: virtual private network (VPN) fundamentals
• Eye on the network: intrusion detection/prevention systems (IDS/IPS)
• Special considerations for performing network perimeter IT audits and vulnerability testing

 Note: This course does not cover the details of audits of web application security and audit, which is covered in How to Audit Web Applications.

Prerequisites: Familiarity with TCP/IP concepts and terminology is assumed.

Day 3: Taking the Mystery Out of Cryptography

Fueled by PII data breach laws, Payment Card Industry Data Security Standard (PCI DSS), and alarming frequency of data leakage, encryption is becoming a necessary safeguard in many applications. In the down-to-earth workshop, we will build on the basic cryptography knowledge required for a CISA and expand the playing field to systematically cover the operation and use of shared key (symmetrical) and public key (asymmetrical) cryptography for a variety of essential business applications. We will also cover the use of hashing (message digest) and message authentication code (MAC) algorithms to ensure data integrity and to support digital signature applications. Highlighted will be a wide array of common applications of encryption and key audit points covering "data at rest" as well as "data in motion" traveling over the Internet and other untrusted network connections. We focus only on the practical, operational aspects of cryptography, NOT on the related complex mathematics and formulas. Numerous diagrams, information worksheets, references, and checklists will be provide to equip auditors with the necessary tools and know-how to effectively assess the prudent and secure use of the often mystifying area of encryption technology. Topics covered include:

• Building your cryptography vocabulary
• Identifying applications and risks requiring the use of encryption technology
• Operating characteristics and trade-offs associated with the major encryption algorithm families: symmetric (shared key), asymmetric (public key/private key), hashing (message digest), message authentication codes (MACs)
• Digital certificates and Certificate Authorities (CA)
• Public key infrastructure (PKI) workflow and control points
• Auditing key management and PKI controls
• Securing and auditing the use of encryption in web and network applications

Prerequisites: A basic understanding of IT controls and terminology is assumed.

About the Instructor:

Ken Cutler is President and Principal Consultant of Ken Cutler & Associates (KCA) InfoSec Assurance, an independent consulting firm delivering a wide array of Information Security and IT Audit management and technical professional services. He is also the Director - Q/ISP (Qualified Information Security Professional) programs for Security University and a Senior Teaching Fellow at CPEi, specializing in Technical Audits of IT Security and related IT controls.

Ken is an internationally recognized consultant and trainer in the Information Security and IT audit fields. He is both certified as and has conducted courses for: Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified Information Systems Auditor (CISA) and CompTIA Security+. In cooperation with Security University, he recently was featured in two full length training videos on CISSP and Security+.

Formerly he was Vice President - Information Security for MIS Training Institute (MISTI) where responsibilities included: Information Security curriculum, advanced IT Audit course development, and chairing major IS and Business Continuity Planning (BCP) conferences and symposia.

Ken is a frequent and much-in-demand speaker on a wide array of IS and IT Audit topics. He has over 30 years of experience in IS, IT auditing, quality assurance, BCP, and information services. He has been performing different forms of IT Auditing projects and services since 1979. Ken has been a long-time active participant in international government and industry security standards initiatives including the President's Commission on Critical Infrastructure Protection, Generally Accepted System Security Principles (GSSP), Information Technology Security Evaluation Criteria (ITSEC), US Federal Criteria, and Department of Defense Information Assurance Certification Initiative.

Ken is the primary author of the widely acclaimed Commercial International Security Requirements (CISR), which offers a commercial alternative to military security standards for system security design criteria, and is the co-author of the original NIST SP 800-41, "Guidelines on Firewalls and Firewall Policy". Ken has also published works on the intricacies of Information Security, security architecture, disaster recovery planning, wireless security, vulnerability testing, firewalls, single sign-on, and Payment Card Industry Data Security Standard (PCI DSS).