North America CACS Track Descriptions 

 

Track 1:  Accelerating IT Audit Concepts

111—Business Impact of IT Audit Issues

Jeff Roth, CISA, CGEIT
Information Systems Assurance Engineer
Parsons

After completing this session, you will be able to:

  • Recognize that greater business knowledge increases the relevance of IT audit results and recommendations.
  • Identify the business impact and quantify the risk of audit findings
  • Discuss issues with key stakeholders with great ease and in terms they are able to appreciate and address

121—Developing a Risk-based Audit Plan

Phil Flora, CISA
Principal
FloBiz & Associates, LLC

After completing this session, you will be able to:

  • Identify standards related to risk assessment and audit planning
  • Provide risk management framework examples for application/use in identifying organizational risks
  • Determine ways that COBIT and Risk IT can be used to facilitate the risk assessment process
  • Identify challenges & opportunities in the information gathering process
  • Provide risk assessment/audit planning process/steps for the total audit universe
  • Determine methods/approaches to communicate audit planning process results for review/approval

211—Data Analytics for IT Governance Controls

Michael T. Hoesing, CISA
Faculty
University of Nebraska at Omaha

After completing this session, you will be able to:

  • Identify topical areas in a mainframe environment that are candidates for data analysis (change management, logical access, configuration management, job scheduling, and more)
  • Identify data sources needed to perform analysis of the above areas
  • Develop analysis techniques using typical audit department tools
  • Report exceptions to assist with control remediation

221—Networking and Building Relationships

Debbie Lew, CISA, CRISC
Senior Manager
Ernst & Young, LLP

After completing this session, you will be able to:

  • Gain an understanding of the benefits and basics of effective networking including the fine art of small talk
  • Keep track and expand pool of contacts
  • Develop both an internal and external network
  • Follow up and Follow through after making contact to produce meaningful results and build relationships
  • Learn other ways to network other than meeting in social situations

231—Auditors Guide to Process Improvement, Innovation and Business Process Management

Shawna M. Flanders, CISA, CISM, CRISC
Productivity Specialist
PSCU-FS

After completing this session, you will be able to:

  • Differentiate between Project Management, Auditing, Process Improvement and Process Innovation, and understand the benefit to the organization
  • Identify where and how a Risk Management Framework can be applied in an organization
  • Recognize the risks and rewards, and tools of Business Process Management
  • Conduct an audit for reviewing processes or applications with Process Improvement and/or BPM (or CRM) components
  • Conduct an audit on a BPM application
  • Conduct an audit on a Process Improvement Project

241—Embedding Data Analytics in Your Process and Continuous Fraud Auditing

Brooke Miller
Audit Manager
RLI Insurance Company

Sean Scranton, CISA, CISM, CRISC
Director, IT Audit
RLI Corp

After completing this session, you will be able to:

  • Understand how to embed data analytics in the audit process
  • Transition to a continuous auditing approach
  • Identify and prevent fraud and funds leakage
  • Use red-flag indicators to reduce false positives, be risk focused, and save time in continuous auditing

311—Career Development for IT Auditors

Derek Duval
Owner
Duval Search Associates

After completing this session, you will be able to:

  • Identify key technical skills requirements
  • Learn how to garner needed business knowledge
  • Identify the 10 habits of highly successful audit professionals
  • Brand truth and myths
  • Conceptualize career advancement
  • Gain a perspective of some future challenges you will face

321—An Integrated Approach to Process-based IT Audit Using Quality and Information Security Management Systems

Ashit Dahal, CISA, CISM, CGEIT, CRISC
Managing Consultant and Sr. Manager
eDelta Consulting

After completing this session, you will be able to:

  • Discover key requirements of Integrated Management Systems as applied to enterprise IT environment
  • Define, assess and evaluate the process-based audit approach implementing conventional checklist-based audit methodology
  • Adopt and deploy integrated and process-based IT audit approach to conduct value-based audit of the organization’s IT and IS systems
  • Plan and implement effective process-based audit approach using “PEAR” tool
  • Demonstrate compliance with applicable requirements like SAS-70, PCI-DSS, COBIT

331—Design and Deliver Report Presentations that Speak to Your Target Audience and Drive Action

Janelle Brittain
CEO
Dynamic Performance Institute, LLC

After completing this session, you will be able to:

  • Design the report presentation to meet the goals for that audience
  • “Speak the Language” of the report listeners to increase their understanding and acceptance
  • Keep yourself in control when others are defensive
  • Positively handle delivering the “Bad News”
  • Handle any Q&A with finesse

411—Migrating to COBIT 5 for Auditors

Anthony Noble, CISA
VP IT Audit
Viacom

Rob Johnson, CISA, CISM, CGEIT, CRISC
SVP GTO-Audit/IT Risk
Bank of America

After completing this session, you will be able to:

  • Understand the COBIT 5 content equivalent from COBIT 4.1
  • Recognize how the new content/guidance of COBIT 5 enhances the auditor’s effort
  • Realize how auditors can use this revised and new content in their audit work

421—Auditing the Intangible: Tangible Techniques for Assessing the Internal Control Environment

Industry Expert

After completing this session, you will be able to:

  • Explore the challenges faced in assessing an internal control environment
  • Learn practical techniques for obtaining indirect evidence through periodic audits
  • Assess the strength of the control environment by drawing inferences about “soft” controls from “hard” evidence
  • Present a compelling audit proposition by interconnecting risks faced across entity, process and system levels

 Return to Event Page


Track 2:  Tools and Techniques for IT Audit Programs

112—What is Virtualization and How Do I Audit It?

Rick Schnierer, CISA, CRISC
Associate Vice President, Internal Audit
Nationwide Insurance

Chris Tennant, CISA, CRISC
Audit Consultant, Internal Audit
Nationwide Insurance

After completing this session, you will be able to:

  • Understand the fundamentals of virtualization and supporting architecture
  • Develop and execute a risk based audit for VMware ESX servers
  • Identify best practices for securing VMware ESX servers, access to the management console, and other key configurations related to virtual servers
  • Leverage the lessons learned from our review and apply this to your environment

122—The Keys to Assessing Risk when Sharing Data with Service Providers

Dave Kovarik, CISM
Director, Information & Systems Security/Compliance
Northwestern University, Information Technology

After completing this session, you will be able to:

  • Recognize the process established to assess the control environment of the service provider
  • Understand the risk inherent with sharing data with a 3rd party
  • Help convey the risk to the client
  • Assist the client in making an informed decision in the selection of a vendor

132—Auditing Mobile Computing/Consumerization of IT

Deron Grzetich, CISM
Manager
KPMG LLP

After completing this session, you will be able to:

  • Understand why utilizing the most current software and applications is critical and how to test them
  • Develop a policy to ensure compliance and a process to protect against violations
  • Create a recovery policy for protecting the mobile user and information stored on mobile devices

212—Auditing Your Unix and Linux Operating Systems

Mike Schiller, CISA
Director of Global Server, Database, and Storage Infrastructure
Texas Instruments

After completing this session, you will be able to:

  • Perform audits on Unix and Linux systems, focusing on the following areas:
    • Account management and password controls
    • File security and controls
    • Network security and controls
    • Audit logs
    • Security monitoring and general controls
  • Access tools and resources for performing Unix and Linux audits

222—Microsoft SQL Database Auditing

Don Campanaro, CRISC
Sr. Auditor
National Grid

Janet Pietrofere, CISA, CRISC
Global Digital Risk & Security Compliance Manager
National Grid

After completing this session, you will be able to:

  • Learn how to adapt the user and schema design to maximize SQL server reliability and to ensure that your enterprise is able to maximize delivered analytics
  • Identify the audit and security review objectives right for your enterprise
  • Discover what audit services are required to determine underlying design and implementation to ensure reliability

232—Auditing Oracle ERP

Reshad Alam
IT Audit Manager
Regal Beloit

Tim Van Ryzin, CISA, CISM
Director, Security & IT Risk Management
Regal Beloit

After completing this session, you will be able to:

  • Understand the Oracle ERP environment
  • Recognize the key risks in Oracle ERP
  • Learn the Oracle ERP layers and controls
  • Identify business processes and controls
  • Become familiar with controls consideration for existing and new ERP environment
  • Leverage tools to manage audit and compliance for Oracle ERP

242—Networking and Telephony

Scott M. Baron, CISA, CRISC
Director - Digital Risk and Security - Governance
National Grid

After completing this session, you will be able to:

  • Learn how to classify a boundary between data and voice networks
  • Recognize vulnerable areas, the risks they pose to the business activity and how to mitigate them
  • Determine how to analyze your enterprise’s telephony traffic
  • Identify necessary configuration monitoring to ensure data is not compromised

312—The Risk and Exposure of Today’s Top Web Application Security Risks (OWASP Top 10)

Kevin Nibler
Senior Manager, Security and Audit Services
Canaudit Inc.

After completing this session, you will be able to:

  • Understand how web applications are being leveraged by malicious individuals
  • Implement controls to minimize organizational risk
  • Recognize proper mitigation and risk control tables
  • Become familiar with and utilize OWASP’s list of the Top 10 Most Critical Web Application Security Risks

322—SAP: Segregation of Duties for SAP and Oracle

Alfred John Bacon, CISA, CISM, CRISC
Senior Consultant, Internal Controls
PETROBRAS

After completing this session you will be able to:

  • Grasp the importance of Segregation of Duties in the business scenario
  • Understand the main issues involved in SOD analysis and why a structured database solution is necessary in large ERP environments
  • Plan an SOD project, with a clear view of the main stumbling blocks
  • Have a clear view of the need for business user involvement in the cleaning-up stage and in defining compensating controls
  • Know what is missing in the business objects GRC Access Control reports
  • Understand the difficulties in defining and documenting compensating or mitigating controls
  • Present a business case for implementing an SOD tool

332—ITIL and CMM Assessments for IT Operations

Sameer Gupta
Director
KPMG LLP

After completing this session, you will be able to:

  • Understand the purpose of an IT Maturity Model and where can it be leveraged
  • Understand the differences in ITIL and CMMI models
  • Learn about a model that covers aspects of both ITIL and CMMI
  • Take a deeper dive into assessing one of the capabilities of this model
  • Review reports that be generated from such an assessment

412—Tips, Techniques and Tools for Completing a PCI Self Assessment Questionnaire (SAQ)

William L Wayland, CISA
Risk Advisory Services
Experis (Formerly Jefferson Wells)

After completing this session, you will be able to:

  • Identify a process enabling a company with limited resources to plan and execute an initiative to verify, and if necessary, remediate compliance with PCI-DSS requirements
  • Utilize a customized Excel workbook designed with specific requirements for tracking and subsequent consolidation into the SAQ
  • Understand how to integrate other regulations (ex. Massachusetts Privacy Law 201 CMR 17.00) to check for compliance
  • Discuss other approaches to working with Acquirers and the Payment Brands

Return to Event Page


Track 3:  Make Your Data Secure

113—Automating IT Data Collection and Compliance for GRC Controls

Jason Creech
Director, Policy Compliance
Qualys

After completing this session, you will be able to:

  • Integrate IT asset discovery mechanisms to dynamically update the IT asset repository
  • Establish detailed configuration controls and policy mappings
  • Deploy automated general computer control (GCC) collection
  • Avoid configuration control self-assessment and measurement
  • Leverage complementary solutions to maximize your IT GRCM investment

123—Does Your Organization Need a Risk Management Plan for Personally Identifiable Information Data?

Jeff Kalwerisky
Senior Director, Information Security & Technical Training
CPEInteractive, Inc.

After completing this session, you will be able to:

  • Understand scope and definition for the concept of Personally Identifiable Information (PII)
  • Understand some of the major business risks associated with storing and processing PII
  • Understand the compliance issues associated with PII in North America, Europe, Asia and the Pacific Rim
  • Discuss the data privacy issues associated with use of mobile devices with geolocation capabilities
  • Understand policies, roles and responsibilities required for adequate protection of PII, using the Massachusetts and California Data Breach laws as examples
  • Understand the risks involved with third parties such as contractors, customers, and vendors
  • Determining whether your corporation has PII, where it is located, and whether it is needed
  • Develop an action plan for compliance and build a PII compliance framework
  • Identify where to focus on an evaluation of PII risk and integrate PII compliance into the entity-wide compliance program

213—Records and Information Management: Understanding the Risks and Operational Challenges

David Melnick, CISA
Principal, National Privacy and Data Protection Practice
Deloitte

After completing this session participants will be able to:

  • Demonstrate understanding of evolution of records and information life cycle management programs including overview knowledge of key drivers around regulatory compliance, eDiscovery, records retention, and operational document management
  • Recognize specific risks and the regulatory landscape and related implications around information management
  • Analyze how to develop an enterprise integrated strategy around information management and to understand the security and privacy implications to the program
  • Engage in a case-study based discussion of implementing an Enterprise Approach to Integrated Information Management

223—Recent Legal and Technical Trends in Privacy and Data Protection

Kenneth B. Leissler
Managing Director
Protiviti Inc.

Wayne C. Matus
Partner, Leader of the Information Law & Electronic Discovery Practice
Pillsbury Winthrop Shaw Pittman

After completing this session, you will be able to:

  • Develop an understanding of the changing US and global legal and technical landscape in security and privacy
  • Identify a business-driven plan to ensure solutions are keeping up with changes
  • Understand the current legal environment
  • Design solutions to ensure your organization and information is secure

233—Using Encryption Technologies to Protect Data

Alfred John Bacon, CISA, CISM, CRISC
Senior Consultant, Internal Controls
PETROBRAS

After completing this session, you will be able to:

  • Understand the planning process for the use of data encryption technologies
  • Grasp the required building blocks of a data encryption process
  • Build threat models for each different instance of data protection
  • Develop a plan to mitigate the risks identified in the threat modeling process
  • Gain a clear view of the management decisions involved in using encryption
  • Comprehend the risks involved in badly managed encryption solutions

243—Data Breach and Trade Secret Theft: How a Holistic Approach Can Protect Your Assets

William Hardin
Director
Navigant

Brad Pinne
Director
Navigant

After completing this session, you will be able to:

  • Gain a perspective on applicable regulations and compliance requirements
  • Understand the risk factors associated with data breaches and trade secret thefts
  • Identify controls and data management best practices that help mitigate the risk
  • Discover key considerations for creating and implementing an incident response plan
  • Learn how IT can facilitate effective data breach and trade secret theft investigations

313—Developing and Deploying an Enterprise Strategy for Information Loss Prevention

Kevin Novak, CISM
Chief Information Security Officer and IT Risk Manager
Northern Trust

After completing this session, you will be able to:

  • Draft a set of core requirements for your deployment
  • Identify teams that need to be involved
  • Engage in informed discussions about legal concerns/impacts (from a non-attorney perspective)
  • Develop a solid understanding of your resource requirements
  • Avoid pitfalls encountered by other organizations

323—Understanding and Mitigating System, Compliance and Legal Consequences of Cloud Computing

Michelle V. Crawford, CISA
Assistant Professor
Alabama State University

After completing this session, you will be able to:

  • Understand the common terms and definitions of cloud computing
  • Understand the business benefits and business considerations of cloud computing
  • Recognize the compliance and legal consequences of cloud computing and its financial and strategic impact on an organization
  • Explain typical steps of a risk assessment and/or audit review and understand the implications for organizations
  • Understand the impact and changes of cloud computing on information security and/or audit plans

333—Reform of the European Union Data Protection Framework—A US Perspective

Charlie Blanchard, CISA, CISM, CRISC
Manager
Deloitte

After completing this session, you will be able to:

  • Gain an understanding of the January 2012 European Commission’s first draft of the EU Data Protection Framework
  • Learn how the broadening of the scope—EU rules will apply if personal data is processed abroad—by all companies including those in the United States—that are active in the EU market
  • Understand the single set of rules on data protection, valid across the EU and how it replaces the current patchwork of national rules in 27 member states
  • Recognize the increased responsibility and accountability for those processing personal data
  • Be familiar with the penalties of up to € 1 million or up to 2% of the global annual turnover of a company for violations

413—A New Opportunity for IT Professionals: PS-Prep™ Audit

Lynnda M. Nelson, Moderator
President
ICOR

Paul Burck
President
Orion

Kathy Glynn
Founder
GAP Resources

Scott Richter
Director—Planning & Development
ANSI-ASQ National Accreditation Board

James Nelson
President
Business Continuity Services, Inc.

Marcus Pollock
Chief
Standards and Technology Branch (FEMA/DHS)

Timothy Woodcome
Director
Conformity Assessment, NQA-USA (Certifying Body)

After completing this session, you will be able to:

  • Understand the basics of the 3 new standards that measure business continuity program effectiveness and how they will impact the IT Auditor
  • Understand the purpose of the Private Sector Preparedness initiative and how it relates to the organization
  • Describe how to prepare the organization for the audit process for PS-Prep™ certification as both an internal auditor and an auditor consultant
  • Share this information with the senior management team

Return to Event Page


Track 4:  What’s Around the Corner?

114—Emerging IT Risks Panel Discussion

Jill Farrington—Moderator
Partner
KPMG LLP

David Baker, CISA
Sr. Manager, Professional Practices
Sara Lee

Scott M. Shinners, CISA
Finance Director
ConAgra Foods Inc.

After completing this session, you will be able to:

  • Understand risks in cloud, big data, mobile devices and social media
  • Develop processes to mitigate these risks

124—Emerging IT Risks Roundtable

Jill Farrington—Moderator
Partner
KPMG LLP

Mary Ann Stoltenberg-Smith, CISA, CISM, CRISC
Vice President & IT Audit Manager
Federal Reserve Bank of Chicago

David Baker, CISA
Sr. Manager, Professional Practices
Sara Lee

Scott M. Shinners, CISA
Finance Director
ConAgra Foods Inc.

Join this interactive session for specific table discussions on cloud, big data, mobile devices and social media.

After completing this session, you will be able to:

  • Understand the risks and practical approaches used by industry peers and organizations
  • Benchmark your organization

134—A Lesson for Leaders: How to Attract and Retain Top Personnel in Today’s Economy

Derek Duval
Owner
Duval Search Associates

After completing this session, you will be able to:

  • Identify five critical questions in the hiring and selection process
  • Understand how to implement an effective onboarding and employee recognition program that leads to engagement and productivity
  • Create accountability for results
  • Utilize critical communications required for engagement and retention

214—Changing the C-Suite Perception of Internal Audit

Princy Jain, CRISC—Moderator
PricewaterhouseCoopers

Linda Glaub
Sr. Director Internal Audit
Citrix Systems, Inc.

Abhijit Pandit, CISA
Director
Adobe Systems, Inc.

Scott Moreland, CISA, CRISC
VP, Director of Internal Audit
Raymond James Financial

Dan Williams
Senior Vice President, Internal Audit
Darden

After completing this session, you will be able to:

  • Understand how internal audit is viewed today by the C-Suite
  • Recognize the how landscape is changing
  • Identify how Internal audit is a strategic partner of C-Suite
  • Participate in case studies

224—Healthcare Security: Learning from Rigorous Government Security Requirements

Todd Fitzgerald, CISA, CISM, CGEIT, CRISC
Director, Global Information Security
ManpowerGroup

After completing this session, the participant will be able to:

  • Leverage 11 years of government healthcare progressive security focus to develop a roadmap for your own healthcare organization
  • Approach a government audit with preparation vs. surprise
  • Apply NIST 800-53 standards to healthcare security
  • Determine appropriate risk levels of audit issues
  • Apply technical and non-technical security solutions to key problem areas

234—Mobile Device Security, Privacy, and Data Protection

Michael Davis
Chief Executive Officer
Savid Technologies, Inc.

After completing this session, you will be able to:

  • Understand the top 10 mobile security risks and solutions to address each
  • Realize privacy concerns with employees using their own mobile devices
  • Understand how to assess an organization’s unique mobile risks
  • Recognize the various technologies used to reduce mobile security risk
  • Identify tips and techniques to audit a mobile security program
  • Communicate and discuss mobile security risks with the organization

244—SAP: Real Time Controls in the SAP Environment

Steve Oberhauser, CISA
Senior Manager
KPMG

After completing this session, you will be able to:

  • Understand Governance, Risk and Compliance in an SAP environment
  • Comprehend SAP’s GRC Access and Process Control
  • Identify the new features and functionality provided in SAP GRC version 10
  • Recognize the key settings to be reviewed and why
  • Learn from the observations of recent implementations

314—Data Security & Privacy: Can it Be Institutionalized?

Sophia Schell, CRISC
IBM

After completing this session, you will be able to:

  • Creating Process to Balance Benefits & Potential Impacts
  • Establishing Comprehensive Management System
  • Fostering Security Conscious Culture
  • Focusing on People Dimension with Organizational Change Practices
  • Leveraging COBIT 5

324—Is IT Still Relevant? Communicating Trends and Risks Found in the New Technology Landscape

Robert E Stroud, CGEIT, CRISC
Vice President Strategy and Innovation
CA Technologies

After completing this session, you will be able to:

  • Communicate the top industry trends in technology and communicate their impacts
  • Understand where the ISACA guidance is located and how to use it
  • Communicate the top industry risks with new technologies
  • Apply ISACA guidance to one’s role

334—Incident Management

Jeff Roth, CISA, CGEIT
Information Systems Assurance Engineer
Parsons

After completing this session, you will be able to:

  • Identify incident detection and recording
  • Recognize investigative techniques and diagnosis
  • Determine resolution and recovery
  • Establish and evaluate incident framework management

414—Understanding Your Data Flow: Using Tokenization to Secure Data

Ulf Mattsson
CTO and co-founder
Protegrity

After completing this session, you will be able to:

  • Understand vulnerabilities and solutions for storing data in the cloud and outsourced environments
  • Use a business risk approach to measure and position established and emerging data security options
  • Implement a best practices approach to evaluate different options for data tokenization and encryption
  • Understand data protection strategies and case studies for compliance with data security mandates
  • Review case studies to gain understanding on how to stay out of scope for PCI DSS
  • Communicate and report data protection cost efficiency with different approaches

424—How to Protect Your Network when Social Media Drives Malware Delivery Vehicle

Paul Henry
Security Analyst and Forensic Expert
Lumension

After completing this session, you will be able to:

  • Implement a solid defense strategy against the excessive malware trends exploding within social networking platforms
  • Determine how to employ reliable protection security methods when utilizing social media technologies in the enterprise
  • Understand the necessary actions needed to immediately enhance an organization’s security posture, without having to make new technology investments or prohibit employees’ use of social networking tools
  • Recognize the various malware attack campaigns within various social media platforms and how to avoid these evolving risks

Return to Event Page


Track 5:  Managing IT Governance and Compliance Issues

115—IT Governance Considerations with Mobile Computing

Phil Lageschulte, CGEIT
Partner
KPMG

Martin Sokalski
IT Audit Manager
KPMG LLP

After completing this session, you will be able to:

  • Understand the benefits and impact of mobile computing and Bring Your Own Device (BYOD)
  • Understand the threat landscape of mobile computing
  • Develop a mobile computing policy and governance structure
  • Assess and mitigate mobile computing risks

125—Regulator Hot Topic Panel

Panel of Industry Experts


135—Trends in Compliance and Regulations

Panel of Industry Experts


215—Implementing COBIT Quickstart in a Healthcare Organization

Nelson Gibbs, CISA, CISM, CGEIT, CRISC
Consultant

After completing this session, you will be able to:

  • Contrast COBIT and COBIT Quickstart to help identify when Quickstart may be appropriate for deployment
  • Define a roadmap for COBIT Quickstart implementation
  • Recognize where COBIT Quickstart needs to be supplemented to meet regulatory requirements
  • Understand how to use COBIT Quickstart as a preliminary step in deploying a more comprehensive control framework

225—Data Quality and Data Classification-Comparisons, Efficiencies and Success Factors

Gary Alterson, CISA, CRISC
Senior Consultant
Neohapsis

After completing this session, you will be able to:

  • Identify the differences in data quality and data classification initiatives
  • Articulate external regulatory drivers for both data quality and data classification
  • Understand key components of data quality initiatives
  • Explain key components of data classification initiatives
  • Leverage synergies between data quality and data classification within data governance and information security programs

235—eDiscovery: Trends, Leading Practices, Risks, and Controls

Scott M. Shinners, CISA
Finance Director, Internal Audit IT
ConAgra Foods, Inc.

After completing this session, you will be able to:

  • Identify major areas of legal and regulatory risk related to poorly controlled data governance programs
  • Clarify the nature and extent of the business, legal, and IT risks associated with ESI related to potential litigation
  • Describe the elements of an effective e-Discovery risk management program
  • Assist management with necessary steps to identify and mitigate the risks associated with e-discovery
  • Articulate ways to improve data governance by leveraging existing organizational efforts related to compliance, data privacy, and information security
  • Discuss the critical elements of an internal audit over the e-Discovery program

245—Healthcare Privacy and Security Landscape in 2012

Cliff Baker
Chief Strategy Officer
HITRUST Alliance

Todd Fitzgerald, CISA, CISM, CGEIT, CRISC
Director, Global Information Security
ManpowerGroup

After completing this session, you will be able to:

  • Appreciate the current acceleration of security and privacy activities occurring in healthcare
  • Understand the new regulatory developments and challenges including Stage 1—Meaningful use risk assessment and expectations for Stage 2, accounting for disclosures
  • Examine impact of Health Information Exchanges
  • Prepare for expected enforcement activities —OCR proactive HIPAA Audits, CMS Audits, State Action
  • Choose between compliance approaches such as SSAE-16, PCI for Healthcare, HITRUST Common Security Framework, Third Party/Vendor/Business Associate Due Diligence

315—Certificates – The New Authentication: Risks and Remediation

Paul Turner
Vice President, Product & Customer Solutions
Venafi

After completing this session, you will be able to:

  • Understand the critical role that SSL and SSH keys and digital certificates play in protecting mission-critical assets
  • Describe the requirements and process flow to discover the population of keys and certificates
  • Summarize the process of analyzing a key and certificate population to quantify the severity of an organization’s risk
  • Provide high-level overview and best practices for encryption asset lifecycle, key lengths and algorithms, and access control mechanisms for SSL and SSH keys and certificates that should be in place to mitigate the risks
  • Identify the IT and InfoSec consequences of real-world case studies of worst case encryption key and certificate management practices
  • Know where to obtain the high level information to organize a discovery and analysis

325—Beyond Compliance: Reduce Operation Risk and Cost While Complying

Sven Skoog, CRISC
Sr. Managing Consultant, Cybersecurity & Privacy
IBM

After completing this session, you will be able to:

  • Take the fear and uncertainity of compliance away to focus on benefits of cloud computing
  • Reduce cost with a long term best practice approach
  • Learn leading technology that help cut costs and reduce risk
  • Discuss customer case studies

335—Review FFIEC Supplemental Guidance on Internet Banking Authentication, Combat Internet Banking Risks

Russ Horn, CISA, CRISC
COO
CoNetrix

After completing this session, you will be able to:

  • Recognize threats to Internet banking
  • Understand new guidance associated with Internet banking
  • Conduct an Internet banking risk assessment
  • Identify compensating controls to reduce the risk of Internet banking
  • Develop Internet banking policies
  • Discover ways to educate customers on the risks of Internet banking

415—IT Governance: Myth to Reality

Michael Bargerhuff, CRISC
Manager, IT Governance, Risk and Compliance
Ultimate Software

After completing this session, you will be able to:

  • Integrate the IT governance role into the strategic mission of the company
  • Become a catalyst for strategic direction, maturity, optimization, and security
  • Forge meaningful partnerships with security, risk, audit, and business departments
  • Implement meaningful and compelling metrics to reflect governance health in real time
  • Dramatically minimize overhead attributed to compliance and risk related functions
  • Become the defacto ‘go to’ across the enterprise for consulting advice on new projects, initiatives, and enhancements

425—Information Warfare: Because Weapons Aren’t Always Made of Steel

Brian Contos
Director Global Security Strategy
McAfee

After completing this session, you will be able to:

  • Recognize several modern attack vectors
  • Better understand the threats from the attacker’s perspective after witnessing a demonstration of real-life hacks
  • Analyze the nation-states and their supporters and sympathizers to expand the presentation beyond the technical issues and better understand the “who” and “why”
  • Explore several case studies as they relate to the mitigation of advanced, targeted, attacks by aggressors with strong motivation as well as financial and technical means


Return to Event Page


Track:  6 Top 11!–Top Audit and Security Issues

116—NEW for 2012: Emerging IT Audit Risks

Michael Juergens, CISA, CGEIT, CRISC
Principal
Deloitte

After completing this session, you will be able to:

  • Identify the top 10 emerging technology risks that IT auditors must know now
  • Understand the specific nature of these risks and how they can impact the business
  • Know what tactical steps should be taken to manage and to mitigate these risks from an IT audit perspective
  • Evaluate these risks allowing the IT audit function to drive more strategic value to the enterprise

126—System Authentication: The New Risk and 7 Steps to Audit and Remediate

Jeff Hudson
CEO
Venafi

After completing this session, you will be able to:

  • Share some of the assessments performed at unnamed large institutions and discuss what was found
  • Discuss how to obtain the information from an organization’s network and perform the analysis to assess that organization’s environment

136—Auditing Cloud Computing and Outsourced Operations

Mike Schiller, CISA
Director of Global Server, Database, and Storage Infrastructure
Texas Instruments

After completing this session, you will be able to:

  • Perform audits of both cloud computing and other forms of outsourced IT operations
  • Leverage a full understanding of terminology and definitions for cloud computing and other forms of IT outsourcing
  • Understand a step-by-step audit approach and explanation of risks addressed

216—In the Crosshairs of Social Engineering Attacks

Eric Olson
Vice President of Product Strategy
Cyveillance, Inc.

After completing this session, you will be able to:

  • Recognize the weaknesses of policies and technologies that allow criminals to circumvent these defenses
  • Identify the educational shortcomings that allow personnel to be exploited
  • Determine the latest vectors being exploited by sophisticated criminals
  • Evaluate technologies today that can help protect against socially engineered attacks
  • Outline best practices for protecting against socially engineered attacks

226—Secure Coding: Best Practices

Industry Expert

After completing this session, you will be able to:

  • Determine whether an organization has a good secure coding practice
  • Understand the OWASP Top 10 vulnerabilities
  • Integrate OWASP Top 10 vulnerabilities into the secure coding practice
  • Approach for performing secure code reviews
  • Approach for developing a secure coding baseline
  • Identify commercial and open source tools to help establish and maintain a secure coding practice
  • Comprehend how to audit a secure coding practice

236—Reduce Cloud Security and Compliance Risks by Automating Privileged Accounts

Adam Bosnian
EVP Americas and Corporate Development
Cyber-Ark Software

After completing this session, you will be able to:

  • Understand how to proactively and systematically reduce risk within cloud-based or virtualized environments around ‘High Value Infrastructure Targets’
  • Manage the security and audit challenges of shared administrative accounts and embedded application identities
  • Recognize the potential return on investment from automated privileged account management
  • Learn new technologies for securing, managing and updating critical accounts, including identities embedded in all applications across the virtual enterprise
  • Manage the administrative and application accounts for thousands of applications, servers, network devices, and databases
  • Discover how to ensure administrative and application identities and passwords are changed regularly, highly guarded from unauthorized use and closely monitored, including full activity capture and recording

246—Social Media Risk and Mitigation Guidance

Rumy Jaleel-Khan, CISA, CRISC
Senior Manager
Deloitte

Mike Wyatt, CISA
Director, Security and Privacy Services
Deloitte & Touche LLP

After completing this session, you will be able to:

  • Identify social media vulnerabilities
  • Develop risk assessment metrics to align the social media activities with the overall business objectives
  • Recommend a social networking policy to increase employees’ security awareness of information that can be shared over social networks
  • Review an audit program incorporating the risks
  • Identify approaches to address social media risks and threats

316—Identify and Eradicate: The Top Security Threats to Banks in 2012

Russ Horn, CISA, CRISC
COO
CoNetrix

After completing this session, you will be able to:

  • Identify the top information security risk to financial institutions
  • Recognize trends in security threats to financial institutions
  • Discover emerging security threats to financial institutions
  • Conduct an information security risk assessment
  • Explore recommendations to deal with current and future security threats
  • Identify ways to educate employees and customers on information security

326—After the Breach

Ray Soriano, CISA, CISM, CRISC
Director
Deloitte & Touche LLP

After completing this session, you will be able to:

  • Recognize the current limitations of legacy security controls in a cloud computing environment
  • Overcome concerns with loss of control and visibility of data as it moves to cloud computing environments
  • Prepare for new requirements for cloud security
  • Utilize industry initiatives to drive cloud adoption and strategies

336—How to Conquer the Social Media Landscape: The Vanguard Experience

Theodore H. Wolff, CISA
Senior Manager
Vanguard

After completing this session, you will be able to:

  • Understand Vanguard’s business case for social media
  • Learn from Vanguard’s experience in recognizing social media risk
  • Experience the Vanguard journey to operationalize and sustain effective procedures to mitigate social media risk
  • Gain insight from the audit of Vanguard’s social media operation
  • Discuss risk and reward opportunities with social media based on industry experiences

416—Protecting Your Mobile Devices

Nelson Gibbs, CISA, CISM, CGEIT, CRISC
Consultant

After completing this session, you will be able to:

  • Analyze the evolution towards mobile computing
  • Identify key risks for mobile devices
  • Describe the architecture of common mobile operating systems including Android and iOS
  • Explain strategies and techniques for securing mobile devices
  • Discuss resources available to plan and perform a mobile device audit

426—WikiLeaks: Are You the Next Target?

Richard Payne, CISM, CGEIT, CRISC
Associate Partner
IBM Business Consulting Service

After completing this session, you will be able to:

  • Identify the information security failures that allowed US Government secrets to be stolen
  • Define an effective controls strategy that mitigates the risks of data theft
  • Determine what assets within their own organization represent attractive targets for thieves
  • Evaluate the “size of market” for stolen data, and the agendas that drive the WikiLeaks community
  • Defend organizations against “insider threat”

Return to Event Page


Track 7:  Managing Risk and Exposure

117—Enterprise Risk Management Essentials

James Ambrosini, CISA, CRISC
Director
Protiviti

After completing this session, you will be able to:

  • Understand the difference between ERM and typical risk management activities
  • Learn fundamental concepts for a successful ERM implementation
  • Walk through a case study from a company implementing ERM in a high-risk industry and examine their methodology and artifacts
  • Understand how organizational risk affects companies’ risk tolerance, and what to look out for, by examining a classic case of risk management failure

127—IT Risk Management Life-cycle and Enabling IT with GRC Technology

Debbie Lew, CISA, CRISC
Senior Manager
Ernst & Young, LLP

Steven F. Jones
Senior Manager
Ernst & Young LLP

After completing this session, you will be able to:

  • Gain an understanding of the key components of a comprehensive risk management program
  • Gain an understanding of the IT risk management life cycle to identify, assess, monitor and report on IT-related risks including identifying opportunities to improve or optimize
  • Determine types of enablers available including COBIT and Risk IT to facilitate the IT risk assessment process including awareness of how technology can operationalize risk management processes
  • Obtain an overview of GRC technology, industry landscape, business drivers, benefits, trends and challenges
  • Gain an understanding of how technology can be used to enable IT risk management processes to potentially reduce the cost of IT risk management, compliance and audit, streamline reporting, better manage risk, and deliver insight for better decision making.

137—Reduce IT Risk through Improved Management and Planning

Gary Alterson, CISA, CRISC
Senior Consultant
Neohapsis

After completing this session, you will be able to:

  • Articulate how IT risk management supports ERM objectives
  • Develop an IT risk universe that supports business decision making
  • Design a risk taxonomy that enables comparable and common representations of risk
  • Facilitate a continuous IT risk assessment and remediation planning process grounded in Risk IT

217—The Opportunity in Risk and Security Trends

Tom Patterson, CISA, CGEIT, CRISC
Associate Partner
IBM Global Services

After completing this session you will be able to:

  • Understand why new domains require more information aggregation and sharing across organizations
  • Address challenges to protecting information and complying with restrictions on data use
  • Recognize the risks associated with the failure to protect and secure sensor event data are far higher than the risks usually associated with IT event data
  • Learn how and why each industry domain has developed their standards independently, challenging the ability to integrate command and control operations
  • Identify critical decisions in real time
  • Distinguish how to make decisions instantly, especially in a crisis, depends on real time monitoring and tracking of people and high value assets which can be abused and attacked

227—What Color is Your Information Risk Today?

Jim Hurley
Managing Director, IT Policy Compliance
Symantec Corporation

After completing this session, you will be able to:

  • Understand why finding answers to “What color is our information risk—today?” is the most important question
  • Document the practices of organizations that are able to answer this question today
  • Evaluate the index for brand, reputation, headline, revenue and customer retention risks for their own organization and be able to explain it to colleagues
  • Identify and evaluate practices in their own organization that will most reduce the risks
  • Leverage interactive self-assessments after the conference to align change in your organization and cope with waves of “information anywhere”

237—Security Auditing and Governance for Healthcare Providers

Tom Turo, CISM, CRISC
Information Security Manager
Adventist Health System

Sharon Finney, CISM
Corporate Data Security Officer
Adventist Health System

Steve Stallard
CISO
Orlando Health

Christi Rushnell
VP Information Technology
Health First

After completing this session, you will be able to:

  • Learn methods for deploying sound security policies and guidelines
  • Acquire tools used for security training and awareness
  • Understand auditing methods of end users on need to know
  • Discover risk assessments of providers and the continuous improvements to reduce risk
  • Develop automated auditing methods and custom templates
  • Ascertain remediation processes

247—Black Holeistic Disaster Recovery: How to Limit Losses

Donald Gallien, CISA, CISM
Vice President, Audit Leader
American Express

David Maberry
Chief Risk Officer
American Fidelity Assurance Company

After completing this session, you will be able to:

  • Engage executives with meaningful BCP/DR audit issues
  • Identify and report BCP issues the executives will care about
  • Apply practical audit steps for identifying inherently flawed business continuity and disaster recovery plans
  • Message BCP and DR issues with impact
  • Complete “Sell the Chief Risk Officer” case studies

317—Establish & Maintain Information Security Oversight

Daniel Dec, CISA, CISM
Principal Consultant
Cognizant Technology Solutions

After completing this session, you will be able to:

  • Establish a sustainable information security governance program within a MSP model
  • Understand how effective oversight increases effectiveness of security programs
  • Utilize KPI and KRI’s to show incremental performance and risk management progress
  • Leverage metrics to understand and articulate segmented risk profiles

327—SaaS: How to Secure the Services Your Team Provides

Michael Davis
Chief Executive Officer
Savid Technologies, Inc.

After completing this session, you will be able to:

  • Recognize how firms are transitioning security or audit teams to provide a menu of services
  • Understand the business need and how the services are used
  • Manage the team as a service provider

337—CFO and CIO: Partners or Opponents?

Daniel Dec, CISA, CISM
Principal Consultant
Cognizant Technology Solutions

After completing this session, you will be able to:

  • Understand the priorities of a CFO and a CIO, and recognize the different scenarios for alignment
  • Comprehend how CFOs and CIOs each perceive technology risk
  • Recognize the perspective of compliance requirements from a CFO and a CIO’s lens
  • Learn how third party risks affect the office of CFO and office of CIO
  • Realize how the CFO and CIO, working together, deliver and sustain a compliant and secure IT environment

417—How to Make Enterprise Governance Risk and Compliance (eGRC) Work for You

Kevin Novak, CISM
Chief Information Security Officer and IT Risk Manager
Northern Trust

After completing this session, you will be able to:

  • Clearly articulate how eGRCs can be used to complement an enterprises IT Risk Management program
  • Integrate IT Risk into an Enterprise Corporate Risk framework
  • Clearly articulate goals and objectives for an effective eGRC strategy
  • Bring the right teams to the table for planning a long term eGRC strategy, and keeping those teams engaged
  • Estimate resource requirements for supporting an eGRC program
  • Avoid some pitfalls encountered by other organizations while planning and deploying an eGRC

Return to Event Page


Pre-Conference Workshops

WS1—Control and Security of Web Applications (two day)

Kevin Nibler
Senior Manager, Security and Audit Services
Canaudit Inc.

As web applications quickly grow more common, complex and critical they increasingly become easy, lucrative targets for attackers and a growing risk to the organizations that employ them. In order to asses, manage and mitigate this risk, IT auditors must understand: how web applications work, how they are being leveraged by malicious individuals and what controls can be implemented to minimize organizational risk.

This workshop will provide attendees a hands-on glimpse at the technologies under the hood of today’s web applications, so they know how they operate, hands-on examples of common vulnerabilities, so they understand their risk and exposure, discussion of controls, so they understand proper mitigation and risk control tables and a practice audit so they can return to their organization’s confidence in their ability to independently perform a basic web application penetration test and vulnerability assessment. This session will heavily reference OWASP’s list of the Top 10 Most Critical Web Application Security Risks, include case studies of high profile breaches and examples and cover basic concepts such as HTML, JavaScript, PHP, ASP, SQL, session IDs, and cookies.

After completing this workshop, you will be able to:

  • Understand modern web application architecture
  • Understand and explain the risk and exposure of the today’s top web application security risks (OWASP Top 10)
  • Understand the controls needed to mitigate today’s top web application security risks
  • Perform basic web application penetration tests
  • Use provided risk/control tables to perform basic web application vulnerability assessments

WS2—IT Risk Management (two day)

Shawna M. Flanders, CISA, CISM, CRISC
Productivity Specialist
PSCU-FS

This workshop is designed to provide valuable information and hands-on experience for both IT risk professionals and IT auditors.

This two-day workshop describes the principles of IT risk management, the responsibilities and accountability for IT risk, how to build up awareness, and how to communicate risk scenarios, business impact and key risk indicators utilizing ISACA’s Risk IT framework and the process model that includes risk governance, risk evaluation, and risk response. The workshop will explain how ISACA’s Risk IT framework relates to COBIT and how it can help to achieve best practices in IT risk management. The workshop will provide practical guidance on how to integrate IT risk management into ERM, establish and maintain a common risk view, and make risk-aware business decisions and how to maintain an operational risk profile, assess and respond to risk, as well as how to collect event data, monitor risk, and report exposures and opportunities.

After completing this workshop, you will be able to:

  • Apply key deliverables necessary to develop and maintain an effective risk management program following the Risk IT Framework
  • Explain how the new Risk IT framework relates to COBIT
  • Evaluate implementation and operational issues
  • Integrate IT risk management with ERM
  • Audit/Evaluate the risk management program

WS4—Performing IT Audits: A Practical Approach (one day)

Phil Flora, CISA
Principal
FloBiz & Associates, LLC

This workshop will include the primary aspects of how to conduct a risk-based IT audit using professional standards and will also include all parts of the audit engagement: planning, fieldwork, reporting and a high-level overview of the annual risk assessment process. During the workshop you will receive a hands-on sample of performing an IT audit. The participant activities will provide real life examples to reinforce the learning concepts. Performance of the audit activities will result in determining the efficiency and effectiveness of the identified operations, processes, programs, projects and initiatives based on the audit objectives.

After completing this workshop, you will be able to:

  • Understand the relationship between annual risk assessment and engagement planning
  • Learn to develop audit objectives
  • Develop audit programs that identify the primary risk areas based on the allocation of limited audit hours
  • Practice key elements of the audit process
  • Establish a focused testing plan for primary process controls
  • Summarize the audit results to communicate effectively with management

WS5—Server Virtualization Security and Audit (one day)

Michael T. Hoesing, CISA
Faculty
University of Nebraska at Omaha

(Updated for 2012 and returning as one of 2011’s highest rated workshops.)

Virtualization is the tool that has created fl uidity in the IT server infrastructure. This has enabled new approaches to data center compilation (public cloud, private cloud). This course is designed to give the auditor a background in server virtualization, the risks associated with that implementation, control or security techniques to mitigate those risks, and approaches, tools, and techniques to gather evidence to assure that those controls and security tools are working as intended.

****Laptops Required for this workshop.

After completing this workshop, you will be able to:

  • Recognize risk and controls that are unique to a virtualized server environment
  • Recognize the risks and controls that carry over from the physical server world, maybe in a different form, to the virtual server environment
  • Develop standards documents and audit programs based on industry guidance from vendors (VMware), government (DISA), and independent organizations (Center for Internet Security)
  • Customize an audit program based on a draft 17 page example program that will be provided to participants
  • Identify assessment tools applicable to virtualization, including free tools and commercial tools
  • Apply manual assessment/evidence-gathering techniques to a live virtual server and management console
  • Run basic assessment tools against a virtualized server and understand the components tested, or not tested and how the evidence was gathered (proprietary and public domain protocols such as XCCDF)
  • Assess the future direction of virtualization architecture (ESXi without a console operating system) and its impact on risk, controls and assessment procedures
  • Map testing procedures to a current compliance standard such as PCI/DSS

Return to Event Page


Post-Conference Workshops

WS6—Cloud Computing Audit and Assurance Issues (one day)

Dan Cimpean, CISA, CGEIT
Partner
Deloitte Enterprise Risk Services

Cedric Lempereur, CISA, CISM
Senior Manager
Deloitte

(Updated for 2012 and returning as one of 2011’s highest rated workshops.)

In performing their activity, risk managers, IT auditors or security managers face challenges in defining a framework that covers the main security information assurance topics implied by cloud computing. A number of frameworks have been developed and can serve as a basis for further cloud computing risk identification and assessment. A good preparation and understanding of challenges ahead will allow professionals to provide value-added, concrete and actionable recommendations to be applied.

After completing this workshop, you will be able to:

  • Identify key trends in cloud computing from an assurance perspective
  • Discuss current and emerging risks related to the use of cloud computing
  • Define a cloud computing Information Assurance Framework (CCIAF)
  • Address cloud computing risks starting with the Assurance Framework

WS7—Data Loss Prevention

Kyle Harvey, CISA
IT Risk and Assurance Manager
Ernst & Young LLP

Chip Wentz, CISA, CISM, CGEIT
Senior Manager—Advisory Services
Ernst & Young LLP

Confidential client data, internal financial details, organizational strategies and intellectual property, are crucial to organizations integrity. Preservation of this data is vital; failure to do so has an impact on organizational reputation and may also incur financial consequences. Today data is expanding and changes exist in where data resides.

After completing this workshop, you will be able to:

  • Understand data loss requirements
  • Design a policy and program that works for your organization
  • Manage your compliance requirements

Return to Event Page

 


Special Events

Welcome Reception

Sunday, 6 May 2012; 5:30PM–7:30PM

Join us for the opening event of North America CACS. A highly interactive environment in an informal setting, this is an ideal time to begin networking with your peers and engage with many of the speakers. Do not miss this opportunity to reunite with friends and colleagues from around the world, and meet seasoned professionals as well as newcomers.


Solution Center Reception

Tuesday, 8 May 2012; 5:00PM–6:30PM

The Solution Center Reception marks the official opening of the InfoExchange. Interact with exhibitors and continue to network with peers while exploring the newest products and services available to IT professionals. Exhibitors will be on hand to demonstrate products and answer questions. Join us for this valuable event.


Networking Reception

Wednesday, 9 May 2012; 6:00PM–8:00PM

Tropical fun, sunshine and YOU!

Unwind with us at the North America CACS Networking Event for a few hours of relaxation, food, drinks and entertainment poolside at the Loews Royal Pacific. Be a part of the tropical décor and wear your favorite (or least favorite) tropical shirt for a chance to win some fun prizes! Stay for the grand prize drawing of a complimentary registration to the 2013 North America Conference in Dallas, Texas!


Spotlight Education Sessions

Tuesday, 8 May 2012; 5:15PM – 6:30PM
Wednesday, 9 May 2012; 10:15AM – 12:15PM

Return to Event Page