{"id":177,"date":"2014-03-12T18:29:50","date_gmt":"2014-03-13T00:29:50","guid":{"rendered":"http:\/\/cybersecurity.bellevue.edu\/?p=177"},"modified":"2021-08-30T13:12:50","modified_gmt":"2021-08-30T19:12:50","slug":"my-tweets-from-the-2014-rsa-conference","status":"publish","type":"post","link":"https:\/\/cybersecurity.bellevue.edu\/index.php\/2014\/03\/12\/my-tweets-from-the-2014-rsa-conference\/","title":{"rendered":"My Tweets from the 2014 RSA Conference"},"content":{"rendered":"

The RSA 2014 Conference took place in San Francisco February 24-28.\u00a0 <\/span>It\u2019s the top gathering of information security and risk professionals in the world with over 25,000 attendees.\u00a0 <\/span>I had the privilege to attend (and lead a CISO panel<\/a>).\u00a0 <\/span>While I was there, I used twitter (@ronw123<\/a>) to record my thoughts of the sessions<\/a> and events<\/a>.\u00a0 <\/span>Below is a snapshot with commentary:<\/span><\/p>\n

Security Awareness and education was a common theme throughout the conference.\u00a0 <\/span>The industry is finally realizing it\u2019s about the humans and people will always be the weakest security link<\/span><\/p>\n

\u201c@<\/s>ddkirsch<\/b><\/a>: Heard at #RSAC<\/span> \u2014 Even my Mom knows that #<\/s>HTTPS<\/span> isn’t a plural of HTTP. #<\/s>ITsecurity<\/b><\/a>\u201d < too bad
\nso many moms, dads, & kids don’t<\/p>\n

Chris Hadnagy (@<\/s>humanhacker<\/span><\/a> & Social-Engineer.org<\/a>) talked about, \u201cSocial Engineering: When the Phone is More Dangerous than Malware<\/a>.\u201d \u00a0<\/span><\/span><\/p>\n

Wow! Even<\/span> @<\/s>humanhacker<\/span><\/a> <\/span>got caught w\/ phishing. It can happen to you. There are no stupid users, just uneducated
\nones. <\/span>@<\/s>SocEngineerInc<\/span><\/a> <\/span><\/p>\n

@<\/s>humanhacker<\/span><\/a> @<\/s>SocEngineerInc<\/span><\/a> showing stats from http:\/\/hackmageddon.com<\/a><\/span><\/span><\/span>. Scary. But there’s hope. \ud83d\ude42<\/p>\n

Jack Jones (@<\/s>JonesFAIRiq<\/span><\/a>) had a great presentation titled, \u201cEnding Risk Management Groundhog Day<\/a>.\u201d\u00a0 <\/span>He didn\u2019t even realize that there was a running panel from 2008-2010 that I was on with the name \u201cSecurity Groundhog Day\u201d (2008<\/a>, 2009<\/a>, 2010<\/a>). \u00a0<\/span>Jack is the father of FAIR<\/a> and provides great ideas for proactively using risk management practices to manage security. <\/span><\/p>\n

Get off the “Hamster Wheel of Pain.” Stop repeating past errors. @<\/s>JonesFAIRiq<\/span><\/a> @<\/s>alexhutton<\/span><\/a> [Note: I\u2019ve learned
\nthat this comes from \u201cThe Phoenix Project<\/a>\u201d]<\/p>\n

@<\/s>JonesFAIRiq<\/span> “Policies need to be clear, concise, and useful… & written to a 9th grade level.”<\/p>\n

@<\/s>JonesFAIRiq<\/span> “We’re really good at fixing symptoms, but not root causes.” #<\/s>1problem <\/span>is asking the right questions about risk.<\/p>\n

Info Risk Mgmt Groundhog Day. Dude… Really… Again. It’s d\u00e9j\u00e0 Vu all over again. <\/span><\/p>\n

Presentations on risks and threats are now commonplace at the RSA Conference. Here are thoughts on talks by Adam Shostack (@<\/s>adamshostack<\/span><\/a>), Pete Lindstrom (@<\/s>SpireSec<\/span><\/a>), and Andy Ellis (@<\/s>csoandy<\/span><\/a>). <\/span><\/p>\n

@<\/s>adamshostack<\/b><\/a> talking New Foundations of Threat Modeling<\/a>. Asking & answering 4 questions about threat modeling and the right ways to find good threats. [Note: He has a new book out on Threat Modeling.]<\/span><\/p>\n

@<\/s>SpireSec <\/b><\/a>just mentioned the Hand Rule (see http:\/\/<\/span>en.wikipedia.org\/wiki\/Calculus_<\/span>of_negligence\u00a0<\/span>\u2026<\/span><\/a>).
\nSo few security \/ risk professionals know anything about it.<\/span><\/p>\n

@<\/s>SpireSec<\/b><\/a> – Being a contrarian in security makes you normal. Meaning we seek the truth even if it may hurt.<\/p>\n

\u201c@<\/s>csoandy<\/b><\/a>: The true problem of a Prisoner\u2019s Dilemma Scenario is that it disregards the Game Manager.\u201d < tying Game Theory to security<\/span><\/p>\n

NIST released the first version of the Framework for Improving Critical Infrastructure Cybersecurity<\/a> on February 12, 2014.\u00a0 <\/span>Of course, this generated a few comments:<\/span><\/p>\n

The NIST Cybersecurity Framework, Here we are *again* writes @georgevhulme<\/span><\/span><\/b><\/a><\/s>, Engage http:\/\/bit.ly\/1ffzuMY\u00a0<\/a><\/span><\/span><\/span>
\n#<\/span><\/s>infosec<\/span><\/a><\/p>\n

News from #<\/s>RSAC<\/span> – DHS working with MS-ISAC on offering managed security services to state\/local gov’t who adopt Cybersecurity framework.<\/p>\n

The National Cyber Security Alliance (NCSA) held a twitter session where they asked pointed questions on encouraging kids to StaySafeOnline<\/a>. <\/span><\/p>\n

@<\/s>StaySafeOnline<\/span><\/a> & others are great! The material is there. It’s getting it out to people who need it the most. #<\/s>securitychat<\/span><\/a> #<\/s>ChatSTC<\/span><\/a><\/p>\n

Should there be a license to drive on the Information Superhighway? IOW: Required Education? #<\/s>securitychat<\/span><\/a> #<\/s>ChatSTC<\/span><\/a><\/span><\/p>\n

We need to challenge more Cybersecurity professionals to get out and educate. Make it required for certifications? #<\/s>SecurityChat<\/span><\/a> #<\/s>ChatSTC<\/span><\/a><\/span><\/p>\n

@<\/s>STOPTHNKCONNECT<\/span><\/a> #<\/s>securitychat<\/span><\/a> #<\/s>ChatSTC<\/span><\/a> A7: Reach the kids at their level. Don’t talk down to them. Challenge them to teach their parents.<\/span><\/p>\n

Of course, one of the hot topics was NSA Surveillance:\u00a0 <\/span><\/span><\/p>\n

\u201cUnderstanding NSA Surveillance: The Washington View #<\/s>RSAC<\/span>\u201d < what’s legal may not be wise – said by both Hayden & Clarke<\/p>\n

We need a real debate at #<\/s>RSAC<\/span> on the NSA, not pontificating and opinions. High School Debate did it last Nov. see http:\/\/<\/span>bit.ly\/MZJVrQ<\/span><\/a>.<\/p>\n

Last, but hardly least is my frustration in the opening keynote of attendees spending their time on their devices and not meeting others. <\/span><\/p>\n

Listen #<\/s>RSAC<\/span> peeps! Stop playing with your phones and start meeting someone new. The greatest minds in Cybersecurity are
\nhere.<\/p>\n

These are my quick, but not complete thoughts. No doubt they will lead to many blogs in the future.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

The RSA 2014 Conference took place in San Francisco February 24-28.\u00a0 It\u2019s the top gathering of information security and risk professionals in the world with over 25,000 attendees.\u00a0 I had the privilege to attend (and lead a CISO panel).\u00a0 While I was there, I used twitter (@ronw123) to record my thoughts of the sessions and […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_wpcom_ai_launchpad_first_post":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[11,18,8,3,35],"tags":[],"class_list":["post-177","post","type-post","status-publish","format-standard","hentry","category-human-aspects","category-online-safety-tips","category-security-education","category-security-management","category-threat-modeling"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/cybersecurity.bellevue.edu\/index.php\/wp-json\/wp\/v2\/posts\/177","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cybersecurity.bellevue.edu\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurity.bellevue.edu\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cybersecurity.bellevue.edu\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurity.bellevue.edu\/index.php\/wp-json\/wp\/v2\/comments?post=177"}],"version-history":[{"count":4,"href":"https:\/\/cybersecurity.bellevue.edu\/index.php\/wp-json\/wp\/v2\/posts\/177\/revisions"}],"predecessor-version":[{"id":996,"href":"https:\/\/cybersecurity.bellevue.edu\/index.php\/wp-json\/wp\/v2\/posts\/177\/revisions\/996"}],"wp:attachment":[{"href":"https:\/\/cybersecurity.bellevue.edu\/index.php\/wp-json\/wp\/v2\/media?parent=177"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurity.bellevue.edu\/index.php\/wp-json\/wp\/v2\/categories?post=177"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurity.bellevue.edu\/index.php\/wp-json\/wp\/v2\/tags?post=177"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}