Come See Us At RSA!

I remember walking by the RSA conference on the way to visit my sister at work. We were walking to coffee and I told her that I was going to attend that conference one day. It was not something that I could afford on my own at the time nor would my company fund the trip. 

I wanted to know all the cool new security things and I wanted to know it so frickin’ bad. I did not attend that year or even the next year. It took four or five new job positions before I was in a place that my company found value in sending me to a security conference. Well, they were not really nerd girling over Ron Rivest and cryptography. They were interested in gaining the newest regulations coming down the pipeline. It was a mutually beneficial trip.

I remember signing in at the registration desk and receiving the badge with my name and I have to say that I felt at that point that I had made it. I was official and for a few minutes the imposter syndrome was not at my feet. I was sent to the next part of the registration queue and I felt so fancy as I was handed a backpack filled with swag. I was on cloud 9 as I walked about with my badge and backpack. I felt like the cool kid. 

It was the most amazing week. I went to session after session and took notes that I still use today. I walked through the vendors and wanted to know more and more about each product because they were all cool. I also amassed an insane amount of swag that caused a trip to the local Target to get another suitcase to haul it all home.

Why am I telling you all of this? Well, once I went to RSA there was a new dream. I wanted to speak at RSA. I wanted to share all the cool knowledge that was floating around in my head. So, I submitted a topic last fall. I remember receiving the email that said - YES! For some reason my first submission was accepted - I did not know what even to think about it because I assumed it would take years of submitting before being selected. Except it was not, it was on the first try and I am stoked to be running a workshop with my sister. 

SO, if you are going to RSA this year and need something to do at 8:30am on Monday the session name is Inviting Users to the P.I.C.N.I.C Instead of Poking Fun at Them (LAB1-M01). It is a learning lab where there will be empowerment on user and tech side to create a better working environment instead of PICNIC (problem in chair, not in computer) labels. There are stickers and sharpies AND not to mention that I will be showing how cyber’s weakest link does not have to be that way.

Comments

Post a Comment

Popular posts from this blog

Understanding Protection (SC)

Understanding Protection (SC) These controls focus on protecting system boundaries, communications, and preventing unauthorized data exposure. Let's break down the key SC controls with examples. SC-1: Policy and Procedures This foundational control requires documented policies and procedures for system and communications protection. Example: SYSTEM AND COMMUNICATIONS PROTECTION POLICY Version: 2.1 Last Updated: 2025-01-02 1. PURPOSE This policy establishes requirements for protecting the organization’s cloud infrastructure and communications. 2. SCOPE Applies to all cloud systems within the authorization boundary. 3. POLICIES 3.1 Encryption Requirements - All data in transit must use TLS 1.2 or higher - All data at rest must use FIPS 140-2 validated encryption - Key rotation required every 365 days 3.2 Network Security - All external connections must traverse a DMZ - Firewall rules follow deny-by-default principle - Monthly review of access control lists 4. PROCEDURES 4.1 Firewall ...
Read more

Security Assessment (SA) Controls

The Security Assessment (SA) family of controls, derived from NIST 800-53 Revision 5, plays a pivotal role in keeping systems secure over time. What Are the Security Assessment (SA) Controls? The SA family of controls focuses on ensuring that security controls are assessed for their effectiveness and are continuously monitored throughout the life of the system. This means checking whether the security measures in place are not only effective but remain effective and up-to-date as time progresses. For FedRAMP Moderate, these controls are crucial because: They ensure security controls are evaluated regularly. They support continuous monitoring for vulnerabilities or weaknesses. They establish corrective actions when necessary. SA-1: Security Assessment and Authorization Policies and Procedures Control Overview SA-1 requires the development of security assessment and authorization (A&A) policies and procedures. These procedures outline the process for conducting security assessm...
Read more

FedRAMP Moderate Rev 5 SI Controls

  In this post, I'll break down each SI control in FedRAMP Moderate Rev 5 and provide tips.   SI-1: System and Information Integrity Policy and Procedures The key to a strong base is well-documented policies and procedures.  For SI-1, organizations must: - Develop and maintain system and information integrity policies that address purpose, scope, roles, and responsibilities - Define procedures for implementing security controls - Review and update these documents at least annually Example:  Create a System and Information Integrity Policy document that includes: - Malware protection requirements with procedures - System monitoring procedures - Software and firmware update processes - Security alert handling processes and procedures - Error handling protocols  SI-2: Flaw Remediation Flaw remediation is key for maintaining system security.  Organizations must: - Identify, report, and correct system flaws promptly - Test software updates before deployment...
Read more