The Rust programming language makes some strong claims about the security of Rust code. In this webcast, David Svoboda and Joe Sible will evaluate the Rust programming language from a cybersecurity perspective. They will examine Rust's security model, both in what it promises and its limitations. They will also examine how secure Rust code has been seen in practice and conclude with discussing the overall maturity and stability of the Rust ecosystem. What attendees will learn:  The Rust Security Model Limitations of the Rust Security Model Rust code in the current vulnerability ecosystem Rust code stability and maturity 

The Rust programming language makes some strong claims about the security of Rust code. In this webcast, David Svoboda and Joe Sible will evaluate the Rust programming language from a cybersecurity perspective. They will examine Rust's security model, both in what it promises and its limitations. They will also examine how secure Rust code has been seen in practice and conclude with discussing the overall maturity and stability of the Rust ecosystem. What attendees will learn: <ul> <li>The Rust Security Model</li> <li>Limitations of the Rust Security Model</li> <li>Rust code in the current vulnerability ecosystem</li> <li>Rust code stability and maturity</li> </ul>

Will Rust Solve Software Security?

Historically, a lot of discussion in software security focused on the project level, emphasizing code scanning, penetration testing, reactive approaches for incident response, and so on. Today, the discussion has shifted to the program level to align with business objectives. In the ideal outcome of such a shift, software teams would act in alignment with business goals, organizational risk, and solution architecture and would understand that security practices are integral to business success. However, the shift from project- to program-level thinking brings lots of challenges. In this webcast, Hasan Yasar and Joe Yankel discuss the top 5 challenges and barriers to implementing DevSecOps practices and describe some solutions for overcoming them. What attendees will learn:  The DevSecOps ecosystem and how it aligns with business objectives The DevSecOps challenges and barriers How to overcome the top 5 challenges Practical solutions for your business needs How your system architecture drives your DevSecOps ecosystem 

Historically, a lot of discussion in software security focused on the project level, emphasizing code scanning, penetration testing, reactive approaches for incident response, and so on. Today, the discussion has shifted to the program level to align with business objectives. In the ideal outcome of such a shift, software teams would act in alignment with business goals, organizational risk, and solution architecture and would understand that security practices are integral to business success. However, the shift from project- to program-level thinking brings lots of challenges. In this webcast, Hasan Yasar and Joe Yankel discuss the top 5 challenges and barriers to implementing DevSecOps practices and describe some solutions for overcoming them. What attendees will learn: <ul> <li>The DevSecOps ecosystem and how it aligns with business objectives</li> <li>The DevSecOps challenges and barriers</li> <li>How to overcome the top 5 challenges</li> <li>Practical solutions for your business needs</li> <li>How your system architecture drives your DevSecOps ecosystem</li> </ul>

Top 5 Challenges to Overcome on Your DevSecOps Journey

Classic tool suites that are used to process network flow records deal with very limited detail on the network connections they summarize. These tools limit detail for several reasons: (1) to maintain long-baseline data, (2) to focus on security-indicative data fields, and (3) to support data collection across large or complex infrastructures. However, a consequence of this limited detail is that analysis results based on this data provide information about indications of behavior rather than information that accurately identifies behavior with high confidence. In this webcast, Tim Shimeall and Katherine Prevost discuss how to use IPFIX-formatted data with detail derived from deep packet inspection (DPI) to provide increased confidence in identifying behavior. 

Classic tool suites that are used to process network flow records deal with very limited detail on the network connections they summarize. These tools limit detail for several reasons: (1) to maintain long-baseline data, (2) to focus on security-indicative data fields, and (3) to support data collection across large or complex infrastructures. However, a consequence of this limited detail is that analysis results based on this data provide information about indications of behavior rather than information that accurately identifies behavior with high confidence. In this webcast, Tim Shimeall and Katherine Prevost discuss how to use IPFIX-formatted data with detail derived from deep packet inspection (DPI) to provide increased confidence in identifying behavior.

Improving Analytics Using Enriched Network Flow Data

In this webcast, Tom Scanlon, Matthew Walsh and Jeffrey Mellon discuss approaches to using data science and machine learning to address cybersecurity challenges. They provide an overview of data science, including a discussion of what constitutes a good problem to solve with data science. They also discuss applying data science to cybersecurity challenges, highlighting specific challenges such as detecting advanced persistent threats (APTs), assessing risk and trust, determining the authenticity of digital content, and detecting deepfakes.   What attendees will learn:  Basics of data science and what makes for a good data science problem How data science techniques can be applied to cybersecurity Ways to get started using data science to address cybersecurity challenges 

In this webcast, Tom Scanlon, Matthew Walsh and Jeffrey Mellon discuss approaches to using data science and machine learning to address cybersecurity challenges. They provide an overview of data science, including a discussion of what constitutes a good problem to solve with data science. They also discuss applying data science to cybersecurity challenges, highlighting specific challenges such as detecting advanced persistent threats (APTs), assessing risk and trust, determining the authenticity of digital content, and detecting deepfakes.   What attendees will learn: <ul> <li>Basics of data science and what makes for a good data science problem</li> <li>How data science techniques can be applied to cybersecurity</li> <li>Ways to get started using data science to address cybersecurity challenges</li> </ul>

How Can Data Science Solve Cybersecurity Challenges?

As Artificial Intelligence permeates mission-critical capabilities, it is paramount to design modular solutions to ensure rapid evolution and interoperability. During this webcast, we’ll discuss some of the primary quality attributes guiding such design, and how a Next Generation Architecture can facilitate an integrated future state. What attendees will learn:  current challenges facing AI engineering approaches to promoting interoperability across AI solutions considerations for facilitating modularity and reuse in design 

As Artificial Intelligence permeates mission-critical capabilities, it is paramount to design modular solutions to ensure rapid evolution and interoperability. During this webcast, we’ll discuss some of the primary quality attributes guiding such design, and how a Next Generation Architecture can facilitate an integrated future state. What attendees will learn: <ul> <li>current challenges facing AI engineering</li> <li>approaches to promoting interoperability across AI solutions</li> <li>considerations for facilitating modularity and reuse in design</li> </ul>

AI Next Generation Architecture

All technology acquired by an organization requires the support of (or integration with) components, tools, and services delivered by a diverse set of supply chains. However, the practices critical to addressing supply chain risks are typically scattered across many parts of the acquiring organization, and they are performed in isolated stovepipes. This situation causes inconsistencies, gaps, and slow response to crises. The Acquisition Security Framework (ASF) addresses this problem by combining leading cyber practices that help organizations manage supply chain risk and define the collaborations critical to securely acquiring, engineering, and operating software-reliant systems. The goals, practices, and processes that structure the ASF have been demonstrated as effective for managing risk and improving resilience. The ASF is consistent with published guidelines for supply chain risk management from ISO, NIST, and DHS. What attendees will learn: This webcast will introduce attendees to the ASF and demonstrate the ways in which the ASF provides a roadmap to help organizations build security and resilience into a system rather than “bolt on” these characteristics after deployment. The webcast will also examine how, following deployment, the ASF guides the ongoing management of system risk and resilience as the technology, threats, and requirements evolve over the system’s lifecycle. ASF includes  leading security and resilience practices critical to supply chain risk management a pathway for proactive process management that fosters effective collaboration across the range of stakeholders responsible for acquiring, developing, and deploying software-reliant systems 

All technology acquired by an organization requires the support of (or integration with) components, tools, and services delivered by a diverse set of supply chains. However, the practices critical to addressing supply chain risks are typically scattered across many parts of the acquiring organization, and they are performed in isolated stovepipes. This situation causes inconsistencies, gaps, and slow response to crises. The Acquisition Security Framework (ASF) addresses this problem by combining leading cyber practices that help organizations manage supply chain risk and define the collaborations critical to securely acquiring, engineering, and operating software-reliant systems. The goals, practices, and processes that structure the ASF have been demonstrated as effective for managing risk and improving resilience. The ASF is consistent with published guidelines for supply chain risk management from ISO, NIST, and DHS. What attendees will learn: This webcast will introduce attendees to the ASF and demonstrate the ways in which the ASF provides a roadmap to help organizations build security and resilience into a system rather than “bolt on” these characteristics after deployment. The webcast will also examine how, following deployment, the ASF guides the ongoing management of system risk and resilience as the technology, threats, and requirements evolve over the system’s lifecycle. ASF includes <ul> <li>leading security and resilience practices critical to supply chain risk management</li> <li>a pathway for proactive process management that fosters effective collaboration across the range of stakeholders responsible for acquiring, developing, and deploying software-reliant systems</li> </ul>

Addressing Supply Chain Risk and Resilience for Software-Reliant Systems

Understanding and articulating cybersecurity risk is hard. With the adoption of DevSecOps tools and techniques and the increased coupling between the product being built and the tools used to build them, the attack surface of the product continues to grow by incorporating segments of the development environment. Thus, many enterprises are concerned that DevSecOps pipeline weaknesses can be abused to inject exploitable vulnerabilities into their products and services. Using Model Based Systems Engineering (MBSE), a DevSecOps model can be built that considers system assurance and enables organizations to design and execute a fully integrated DevSecOps strategy in which stakeholder needs are addressed with cybersecurity in all aspects of the DevSecOps pipeline. An assurance case can be used to show the adequacy of the model for both the pipeline and the embedded or distributed system. While builders of embedded and distributed systems want to achieve the flexibility and speed expected when applying DevSecOps, reference material and a repeatable defensible process are needed to confirm that a given DevSecOps pipeline is implemented in a secure, safe, and sustainable way. What Attendees will Learn:  an approach to evaluate and mitigate the risk associated with attackers exploiting DevSecOps pipeline weaknesses and vulnerabilities how to structure an assurance case around the core capabilities of a DevSecOps pipeline 

Understanding and articulating cybersecurity risk is hard. With the adoption of DevSecOps tools and techniques and the increased coupling between the product being built and the tools used to build them, the attack surface of the product continues to grow by incorporating segments of the development environment. Thus, many enterprises are concerned that DevSecOps pipeline weaknesses can be abused to inject exploitable vulnerabilities into their products and services. Using Model Based Systems Engineering (MBSE), a DevSecOps model can be built that considers system assurance and enables organizations to design and execute a fully integrated DevSecOps strategy in which stakeholder needs are addressed with cybersecurity in all aspects of the DevSecOps pipeline. An assurance case can be used to show the adequacy of the model for both the pipeline and the embedded or distributed system. While builders of embedded and distributed systems want to achieve the flexibility and speed expected when applying DevSecOps, reference material and a repeatable defensible process are needed to confirm that a given DevSecOps pipeline is implemented in a secure, safe, and sustainable way. What Attendees will Learn: <ul> <li>an approach to evaluate and mitigate the risk associated with attackers exploiting DevSecOps pipeline weaknesses and vulnerabilities</li> <li>how to structure an assurance case around the core capabilities of a DevSecOps pipeline</li> </ul>

Does your DevSecOps Pipeline only Function as Intended?

As a Software Engineering community, we started to hear new words with new definitions to achieve some challenges with deciding the shelf life of said terms. Some examples include: DevOps is dead, long live NoOps, SecOps, NoCode, SRE, GitOps, and recently Platform Engineering. We often confuse these terms in order to achieve certain software engineering job types. Then the organization decides to implement one or a combination of these terms and restructures the engineering team. However, it can often be cumbersome because many tech professionals are still unfamiliar with the technologies and “new buzzwords” are required to implement a complete SW delivery pipeline to meet the business needs. It is becoming very challenging to find the right way. We should all step back and ask ourselves “what is our why” to deliver new capabilities in a timely, affordable, and secure way. Let’s discuss how we can clear up this word puzzle and find our journey. What Attendees will Learn: • How to align your business objectives with your SW engineering practices? • What is the science behind DevOps? • Understand role vs responsibility • How do I get started on implementing true DevOps? • How to become an agile to overcame new obstacles?

As a Software Engineering community, we started to hear new words with new definitions to achieve some challenges with deciding the shelf life of said terms. Some examples include: DevOps is dead, long live NoOps, SecOps, NoCode, SRE, GitOps, and recently Platform Engineering. We often confuse these terms in order to achieve certain software engineering job types. Then the organization decides to implement one or a combination of these terms and restructures the engineering team. However, it can often be cumbersome because many tech professionals are still unfamiliar with the technologies and “new buzzwords” are required to implement a complete SW delivery pipeline to meet the business needs. It is becoming very challenging to find the right way. We should all step back and ask ourselves “what is our why” to deliver new capabilities in a timely, affordable, and secure way. Let’s discuss how we can clear up this word puzzle and find our journey. What Attendees will Learn: • How to align your business objectives with your SW engineering practices? • What is the science behind DevOps? • Understand role vs responsibility • How do I get started on implementing true DevOps? • How to become an agile to overcame new obstacles?

Finding Your Way with Software Engineering Buzzwords

Infrastructure as code (IaC) is a concept that enables organizations to automate the provisioning and configuration of their IT infrastructure. This concept also aids organizations in applying the DevOps process (plan, code, build, test, release, deploy, operate, monitor, repeat) to their infrastructure. Ansible is a popular choice within the IaC tool landscape for realizing this goal.

Infrastructure as code (IaC) is a concept that enables organizations to automate the provisioning and configuration of their IT infrastructure. This concept also aids organizations in applying the DevOps process (plan, code, build, test, release, deploy, operate, monitor, repeat) to their infrastructure. Ansible is a popular choice within the IaC tool landscape for realizing this goal.

 Infrastructure as Code Through Ansible

The lack of qualified cybersecurity professionals in the United States is a threat to our national security. We cannot adequately protect the systems that our government, economy, and critical infrastructure sectors rely on without an appropriately sized cyber workforce. By some estimates, there are over 700,000 cybersecurity job openings across the United States, with 39,000 of those in the public sector alone. Fortunately, the federal government recognizes that the cyber workforce needs to be strengthened and is implementing efforts to address this need at a national strategic level. In this webcast, we will examine how to use principles and concepts from Agile development to help cyber workforce development initiatives remain adaptable and effective in the continuously evolving landscape of the cyber domain.

The lack of qualified cybersecurity professionals in the United States is a threat to our national security. We cannot adequately protect the systems that our government, economy, and critical infrastructure sectors rely on without an appropriately sized cyber workforce. By some estimates, there are over 700,000 cybersecurity job openings across the United States, with 39,000 of those in the public sector alone. Fortunately, the federal government recognizes that the cyber workforce needs to be strengthened and is implementing efforts to address this need at a national strategic level. In this webcast, we will examine how to use principles and concepts from Agile development to help cyber workforce development initiatives remain adaptable and effective in the continuously evolving landscape of the cyber domain.

Applying the Principles of Agile to Strengthen the Federal Cyber Workforce

Each webinar features an SEI researcher discussing their research on software and cybersecurity problems of considerable complexity. The webinar series is a way for the SEI to accomplish its core purpose of improving the state-of-the-art in software engineering and cybersecurity and transitioning this work to the community. The SEI is a federally funded research and development center sponsored by the U.S. Department of Defense and operated by Carnegie Mellon University. The SEI Webinar Series is produced by SEI Communications Outreach.

Software Engineering Institute (SEI) Webcast Series

Watch Jeff Boleng, Robert Schiela, Samuel Procter, Lena Pons, and Nathan VanHoudnos discuss "Three Software Innovations that DoD Needs Now".

Watch Jeff Boleng, Robert Schiela, Samuel Procter, Lena Pons, and Nathan VanHoudnos discuss "Three Software Innovations that DoD Needs Now".

Three Software Innovations that DoD Needs Now

Watch this lively discussion in which we answered attendee questions on all things Agile and DevOps.

Watch this lively discussion in which we answered attendee questions on all things Agile and DevOps.

Agile and DevOps: Your Questions. Our Answers.

Resilience

During this webinar, Dr. Shannon examined the questions, science, and technology that builds trust with customers, other organizations, and society to ensure their security and privacy, and our own resilience and accountability.

During this webinar, Dr. Shannon examined the questions, science, and technology that builds trust with customers, other organizations, and society to ensure their security and privacy, and our own resilience and accountability.

Weaving a Fabric of Trust: Ensured Security, Privacy, Resilience, and Accountability

Have software's repeated successes, and the assumption that they will continue endlessly, discounted perceptions of its importance among leadership in civilian government, national defense, and national security organizations?

Have software's repeated successes, and the assumption that they will continue endlessly, discounted perceptions of its importance among leadership in civilian government, national defense, and national security organizations?

Is Software Spoiling Us?

This webinar focused on the development and application of combined data analytics and offered several examples of analytics that combine domain resolution data, network device inventory and configuration data, and intrusion detection.

This webinar focused on the development and application of combined data analytics and offered several examples of analytics that combine domain resolution data, network device inventory and configuration data, and intrusion detection.

Four Valuable Data Sources for Network Security Analytics

Watch this webcast to gain insights into effective metrics programs in government settings.

Watch this webcast to gain insights into effective metrics programs in government settings.

Three Secrets to Successful Agile Metrics

In this discussion-focused webinar, Bob Binder and SuZ Miller will discuss 5 key questions that government organizations contemplating embarking on adopting automated test techniques and tools in an Agile environment are likely to have.

In this discussion-focused webinar, Bob Binder and SuZ Miller will discuss 5 key questions that government organizations contemplating embarking on adopting automated test techniques and tools in an Agile environment are likely to have.

Five Keys to Effective Agile Test Automation for Government Programs

This webinar summarizes much of what the SEI has learned in its eight years of researching and facilitating adoption of Agile and Lean methods in software-reliant systems in government.

This webinar summarizes much of what the SEI has learned in its eight years of researching and facilitating adoption of Agile and Lean methods in software-reliant systems in government.

Practical Considerations in Adopting Agile-Lean in Government Settings

In this webinar, we discuss topics to consider when planning a large modernization project and share mitigation strategies for executing the modernization effort.

In this webinar, we discuss topics to consider when planning a large modernization project and share mitigation strategies for executing the modernization effort.

5 Things You Need to Know About Leading a Successful Large IT Modernization Project

Learn why secure coding practices are important to reduce common programming errors that lead to vulnerabilities.

Learn why secure coding practices are important to reduce common programming errors that lead to vulnerabilities.

Secure Coding Best Practices

Learn the importance of developing security requirements in the same time frame as functional requirements.

Learn the importance of developing security requirements in the same time frame as functional requirements.

Security Requirements Engineering

Last summer's Wired article describing vulnerabilities in the Jeep shows that software is being created and deployed with exploitable, yet avoidable, security flaws. So far, the automotive attacks have been largely demonstrations. However, successful cyber-attacks have been carried out on steel furnaces in Germany and the electrical grid in Ukraine. Insecurely written software in cyber-physical systems places people and property in jeopardy. Fortunately, there are many techniques available to those building software for cyber physical systems that can greatly reduce their vulnerability. This talk starts with an in-depth review of the Jeep scenario. It then examines how security can be introduced throughout the software development lifecycle to blunt such vulnerabilities.

Last summer's Wired article describing vulnerabilities in the Jeep shows that software is being created and deployed with exploitable, yet avoidable, security flaws. So far, the automotive attacks have been largely demonstrations. However, successful cyber-attacks have been carried out on steel furnaces in Germany and the electrical grid in Ukraine. Insecurely written software in cyber-physical systems places people and property in jeopardy. Fortunately, there are many techniques available to those building software for cyber physical systems that can greatly reduce their vulnerability. This talk starts with an in-depth review of the Jeep scenario. It then examines how security can be introduced throughout the software development lifecycle to blunt such vulnerabilities.

Secure Software Development Landscape

For two decades, the SEI has been instrumental in the creation and development of the field of software engineering known as software architecture. An architect whose skills and capabilities match a project's needs is more likely to be successful. So what are those skills? In this webinar, SEI researchers and an industry colleague discussed in two talks What Makes a Good Software Architect? John Klein and Andrew Kotov on Skills and Knowledge of Successful Architects Ipek Ozkaya and Michael Keeling on Architects Design Trade-off Toolbox: Balancing Agility and Technical Debt What viewers will learn: How the technical skills needed by a software architect change throughout a system's lifecycle and how this influences the architect's success How architects should be the champions of product quality while making the right (and timely) design trade-offs

What Makes a Good Software Architect?

A surprisingly large number of different types of testing exist and are used during the development and operation of software-reliant systems. We have identified nearly 200 of these general types of testing and there are many additional types that are application-domain specific. While most testers, test managers, and other testing stakeholders are quite knowledgeable about a relatively small number of testing types, many people know very little about most of them and are unaware that others even exist. One way to understand so many types of testing is to classify them into a taxonomy that groups similar testing types together. One way to organize them is by the types of questions they answer. Specifically, types of testing can be categorized by the five Ws and two Hs: what, when, why, who, where, how, and how well. Understanding these different types of testing is important because different types of testing tend to uncover different types of defects and multiple testing types are needed to achieve sufficiently low levels of residual defects. Whereas not all of these testing types are relevant on all projects, a complete taxonomy can be very used to help discover the ones that are appropriate and ensure than no relevant type of testing is accidentally overlooked. Such a taxonomy can also be useful as a way to organize and prioritize one's study of testing. This tutorial introduces the attendee to our taxonomy of testing types, thereby clarifying the grand scope of testing and enabling the attendee to better select the appropriate types of testing to for their specific needs.

A Taxonomy of Testing Types

SEI Chief Operating Officer, Robert F. Behler discusses Cyber-Vulnerabilities in Aviation Today.

SEI Chief Operating Officer, Robert F. Behler discusses Cyber-Vulnerabilities in Aviation Today.

Cyber-Vulnerabilities in Aviation Today

Will Dormann discusses a tool that shows whether a connection to the web is secure and what information is being transmitted.

Will Dormann discusses a tool that shows whether a connection to the web is secure and what information is being transmitted.

Web Traffic Analysis with CERT Tapioca

Rotem Guttman discusses how mission-readiness can be assessed at a DoD scale.

Rotem Guttman discusses how mission-readiness can be assessed at a DoD scale.

Generalized Automated Cyber-Readiness Evaluator (ACE)

About the Webinar DevOps is all about delivering business value as rapidly as possible. Embracing its philosophies goes beyond implementing automation and tooling to speed software development and delivery. DevOps is a culture of communication and collaboration. For many of us, shifting to this new culture can create organizational "culture shock," or discomfort by those suddenly subjected to an unfamiliar culture, way of life, or set of attitudes. DevOps is not something you purchase or have implemented by a DevOps Engineer. Instead, a shared vision and common goals across teams and team members are critical to making a successful culture transformation. Join us for a discussion about ways to shift organizational culture to achieve DevOps. We will highlight communication tools and movements, such as ChatOps. DevOps is all about teams working together to continually improve their processes and achieve their shared business goals. With cross-functional teams, documentation must be in place. We will discuss strategies for curating information repositories that fit how a team works. Also, project and team management are core components of ensuring that team members are able to work efficiently and don’t get lost in meetings and context switching. Automated tools further enhance communication by exposing project data to everyone.

Culture Shock: Unlocking DevOps with Collaboration and Communication

Sound cyber intelligence practices can help organizations prevent or mitigate major security breaches. For several years, researchers at the SEI have been examining methodologies, processes, technology, and training to help organizations understand what it means to perform the work of cyber intelligence. To spur further development and advance understanding in this important area, the SEI launched the Cyber Intelligence Research Consortium, aimed at helping organizations make better judgments and quicker decisions related to cyber intelligence. The consortium's membership consists of practitioners and decision makers from multiple sectors, including government, energy, banking, defense contracting, and academia. At this webinar SEI practitioners will provide a detailed overview of the consortium's work during this inaugural year. Efforts for this year include how-to guides for navigating key analytical practices and technologies, tradecraft labs, and an in-person crisis simulation event. Webinar participants will also receive a guide for evaluating intelligence they can use in their own organizations.

Sound cyber intelligence practices can help organizations prevent or mitigate major security breaches. For several years, researchers at the SEI have been examining methodologies, processes, technology, and training to help organizations understand what it means to perform the work of cyber intelligence. To spur further development and advance understanding in this important area, the SEI launched the Cyber Intelligence Research Consortium, aimed at helping organizations make better judgments and quicker decisions related to cyber intelligence. The consortium's membership consists of practitioners and decision makers from multiple sectors, including government, energy, banking, defense contracting, and academia. At this webinar SEI practitioners will provide a detailed overview of the consortium's work during this inaugural year. Efforts for this year include how-to guides for navigating key analytical practices and technologies, tradecraft labs, and an in-person crisis simulation event. Webinar participants will also receive a guide for evaluating intelligence they can use in their own organizations.

Advancing Cyber Intelligence Practices Through the SEI's Consortium

In this webinar, John Haller and Matthew Butkovic of the CERT Division of the Software Engineering Institute will discuss real-world incidents, including recent industrial control system attacks and incidents affecting Department of Defense capabilities, and the lessons that organizations should take away. The session will focus on the lifecycle of supply chain relationships and introduce concepts to help organizations manage them more effectively. Managing the risks of depending on external entities and supply chains to support critical services has increasingly become an area of concern for both the federal government and private critical infrastructure organizations. External dependencies may consist of business partners that your organization relies on, cloud services such as data processing, or storage facilities. Or these dependencies may take the form of reliance on public infrastructure such as transportation or the electrical grid. The webinar speakers, John and Matthew, will discuss the HAVEX malware attacks on industrial control system vendors, which were reported to the security community in June 2014. For supply chain risk management, a key lesson from the HAVEX case is the importance of having a process to identify and prioritize external dependencies. The speakers will also explore and discuss methods for addressing this problem in a realistic, reliable way. Also covered in the webinar are the lessons for third-party risk management that organizations should take away from recent attacks on DoD-affiliated transportation contractors. The speakers will explain how to correctly scope and build security programs around key, organizationally critical services. The speakers will discuss how your organization can learn from these incidents, including best practices around forming relationships with external entities and managing the relationship over time to support your organization's incident management and situational awareness processes. The webinar closes with a recap of key supply chain risk management capabilities and an update to CERT research into the state of these capabilities across U.S. critical infrastructure sectors.

Lessons in External Dependency and Supply Chain Risk Management

What is this?
1 quote, 3 ideas & 1 question from a carefully curated podcast episode.
Every Monday & Wednesday.

Want a 3rd insight and episode every week? Email me at curation@owltail.com.

OwlTail

OwlTail 1-3-1

The best podcast episodes on non-current politics. Covering topics such as universal basic income, democracy, poverty & justice and more. For anyone interested in learning more about politics that affect that world, not just now, but in the longer term. Add episodes you're interested into your queue below!