CISO Forum

Designed for senior level security leaders to discuss, share and learn innovative information security and risk management strategies, Securityweek’s CISO Forum will take place in 2021 as a virtual event. The forum will address issues and challenges that are top of mind for today’s security leaders and what the future looks like as chief defenders of the enterprise. (SecurityWeek’s CISO Forum has been running since 2014 as a live event at the Ritz-Carlton, Half Moon Bay.)

Watch Sessions from 2020 on Demand Now

Thank You 2020 Sponsors!

Diamond Sponsors

F5 Logo


Chris Forbes
CISO, Forbes Asset Management
Chris Forbes is CISO at Forbes Asset Management
Mary Gardner, CISO at F5
Mary Gardner
CISO at F5
Mary Gardner is Chief Information Security Officer (CISO) at F5. In this role, she is responsible for F5’s corporate-wide information security management efforts, along with strategic planning, governance, and controls.
Fredrick Lee, Gusto
Fredrick ‘Flee’ Lee
Chief Security Officer at Gusto
Fredrick "Flee" Lee is the Chief Security Officer at Gusto, where he leads information and physical security strategies including consumer protection, compliance, governance and risk.
Zack Moody
Head of Global Information Security at AVX Corporation
Zack Moody is Head of Global Information Security at AVX Corporation
Nipun Gupta, Deutsche Bank
Nipun Gupta
VP, Cyber Security Strategy & Innovation at Deutsche Bank
VP, Cyber Security Strategy & Innovation at Deutsche Bank
Anne Marie Zettlemoyer
Anne Marie Zettlemoyer
VP, Security Engineering at Mastercard
VP of Security Engineering and Divisional Security Officer at Mastercard
John Lambert, Microsoft
John Lambert
GM, Microsoft Threat Intelligence Center
John Lambert holds the title of Distinguished Engineer and is the General Manager of the Microsoft Threat Intelligence Center.
Justin Berman, Dropbox
Justin Berman
Head of Security at Dropbox
Justin Berman is the Head of Security at Dropbox,
Ash Ahuja, Gartner
Ash Ahuja
VP, Leadership Partner for Cyber Security & Risk Management, Gartner
CISO in Residence and Coach, VP Leadership Partner Cyber Security & Risk Management at Gartner
Patrick Pushor
Technical Evangelist at Orca Security
Orca Security
Sounil Yu
CISO-in-Residence, YL Ventures
Sounil Yu is CISO-in-Residence at YL Ventures and was previously the Chief Security Scientist at Bank of America.
Ryan Naraine
Editor-at-Large at SecurityWeek
Ryan Naraine is Editor-at-Large at SecurityWeek

Diamond Sponsors

Platinum Sponsor

Gold Sponsors

Silver Sponsors

Gartner predicts that by 2022, approximately 30% of enterprises will adopt a risk-based approach to vulnerability management*. One of the greatest challenges cybersecurity and IT professionals face is the proliferation of security vulnerabilities, and the ability to prioritize their mitigation and remediation efforts. By combining vulnerability measures (CVSS and severity) with insights into how these vulnerabilities may be accessed and exploited via the network, you’ll have the context to identify and address vulnerabilities that pose the greatest threat to critical business assets.

As a security professional or executive, you can increase your security team’s value by focusing on risk over threats — even if you currently struggle to relate your role to your organization’s bottom line, or feel like you’re drowning in data that lacks context.

Join Stu Solomon, chief operating officer, Recorded Future for a live discussion on how to shift your organization toward risk-based cybersecurity.

Attendees will walk away with:
• An understanding of how security intelligence helps teams make better decisions based on contextual data and metrics
• Methods for how to create a persistent information advantage for better security - with a focus on being profitable
• A comprehensive framework that emphasizes risk over threats and learn how to create

NASA didn’t market the complexities and PhDs required to get to space, they just showed off something really cool: a person flying.

We are in pivotal times. Pivotal in terms of technology innovations like the cloud and APIs driving global economic growth and opportunity. Disastrous in terms of them leaving without us, growing the security landscape, and not taking any of our best practice controls with them.

In this keynote, we are going to level set on the facts of our threat landscape, how breaches occur, and put them in context to help prioritize risk. And then we are going to pivot risk treatment into business and personal impact stories hoping to land our zero-gravity moment.

Cyber adversaries are not “sophisticated”, rather they are pragmatic. They have mastered the art of staying one step ahead of our controls. The endpoint, still the nexus of the cyber challenge, has become difficult for adversaries to maintain persistence on, due to advances in AI/ML, EDR, and Threat Intelligence. The battlefield is defined by the "time advantage" that either side has over the other. Hence, both APTs and criminal ransomware groups have adapted by going “further down the stack”, and they have arrived at firmware, hardware, and driver level TTPs (Tactics, Techniques, Procedures) that now plague enterprises across myriad threat scenarios ranging from supply chain, to malware, to insiders, IOT, and more. There is a dire lack of visibility here, and attackers are enjoying the omnipotence and indefinite persistence that platform-layer TTP’s provide.

This talk will challenge fundamental assumptions we make about cyber risk, by exposing platform security for what it is: the very foundation of trust, integrity, confidentiality and availability upon which the rest of the computing and cyber stack are built. We say we want a Zero Trust strategy, yet we haven’t protected the foundation itself that attackers are targeting. Welcome to platform security, hold on tight.

Asset management doesn’t have the hype as some of the other topics in cybersecurity, but it’s a foundational challenge that’s only getting worse. In this session we’ll show why teams still struggle to get a straight answer about assets in 2020, a simple approach, and how Axonius customers are able to get a comprehensive asset inventory, uncover security gaps, and automatically validate and enforce security policies.

More defenders are joining the field of information security than ever before. While sharing and collaboration are common, infosec stubbornly remains an experience driven field that slows advancement. How can we increase the rate of learning for defenders everywhere? This keynote presentation will talk about a more contributor-friendly and vendor neutral model of infosec that speeds sharing know-how and learning.

If we truly reflect on the type of models that we tend to emulate when designing enterprise security controls, the best comparison is that of North Korea: tightly controlled regimes with constant monitoring; restricted information flows to prevent exfiltration of secrets; forced use of specific operating systems and images; and severe penalties for non-compliance, up to and including termination. Even buzzwords like “Zero Trust” seems to reflect the state of how people treat each other in North Korea.

Is this the model of enterprise security that we really want? Can we strive for something better… like Norway, where people are free to interact and innovate to meet each other’s needs and drive economic growth? In this session, we plan to compare and contrast enterprise security models to understand what choices we have when we design our enterprise security controls, and how each choice that we take can make our environment look more like Norway or more like North Korea.

Web and mobile apps now represent the single most lucrative set of targets for cybercriminals – which means that application security has never been more important. Together, our combined F5 and Shape Security solutions deliver a comprehensive application security stack that marries best-in-class defenses with the simplicity and ease of a single vendor.

Attend this session to learn how F5 and Shape Security can help you achieve:

• Reduction in fraud and abuse losses
• Measurable cost savings for hosting and bandwidth costs
• Detection and mitigation from vulnerability exploits to denial-of-service attacks
• Better application performance and uptime

Cyber risk is a top of mind concern for those at the executive level however, it remains a challenge to oversee largely due to the gap between the technical and business sides of an organization. There is a way to bridge this divide, making the information relevant and understood by both parties. Anomali, Senior Sales Engineer, Thomas Graves, will demonstrate several use cases to show how Anomali gathers and associates intelligence on threat actors, malware, campaigns, vulnerabilities, and tactics, techniques and procedures (TTPs) to support strategic intelligence reporting for CISOs. Strategic intelligence reports support senior leadership's ability to understand how adversary TTPs align with the organization's defensive controls, highlighting gaps in the defensive posture. These use cases show you how to stay ahead of the bad guys, join the discussion.

The ability to remotely execute code is often the cornerstone of an attack, but bad actors also attempt to reduce their footprint by abusing legitimate credentials combined with network, application and operating system functionality, and new cloud capabilities to remotely access systems and find high risk data. Patrick Pushor, Technical Evangelist at Orca Security, will explore modern lateral movement threats, mitigation strategies, and examine new vectors with the shift to the cloud while sharing key findings from Orca's 2020 State of Public Cloud Security Report.

Do you agree that we need to market the impact of security differently to get the attention of end-users, business owners, and boards?

On this panel, F5 will be talking to senior executives to understand where they think security is failing, and where it is succeeding, and how that translates to what we know are the biggest security risks to any organization. And because no security team will ever scale to address all risk, we are going to discuss what we need from our Vendors to close the gap.

Security teams are bombarded by noise daily – false positives, alerts without enough context, and incomplete data. Recorded Future's natural-language processing and machine-learning powered platform builds quantitative risk around IOCs based on the threat landscape.

During this presentation, Recorded Future will showcase how to consolidate data from 1M+ sources into relevant "intelligence cards" that analysts can use to make judgements during their day-to-day workflows, specifically around vulnerability management. Tune in for this live session to learn how all of this data can be programmatically extracted into SIEM tools, such as Splunk ES, to scale efficiency gains throughout a security organization.

Our “CISO concerns” panel returns for 2020! Zero-Day vulnerabilities. Targeted attacks. “Trusted” insiders walking out the door with corporate secrets. Privacy. Compliance. Board Meetings. These are just a few of the headaches today’s security leaders are faced with on a daily basis. With security executives more accountable than ever, and an increasingly sophisticated threat landscape, this panel of security chiefs will discuss what is top of mind for them and what the future looks like as chief defenders of the enterprise.

Event Details