Speakers

Dr. Eugene Spafford
Professor of Computer Science,
Purdue University
*Security 7 Award Winner

Eugene H. Spafford is one of the most senior and recognized leaders in the field of computing. He has an on-going record of accomplishment as a senior advisor and consultant on issues of security, education, cybercrime and computing policy to a number of major companies, law enforcement organizations, academic and government agencies, including Microsoft, Intel, Unisys, the US Air Force, the National Security Agency, the GAO, the Federal Bureau of Investigation, the National Science Foundation, the Department of Energy, and two United States Presidents. With nearly three decades of experience as a researcher and instructor, Spafford has worked in software engineering, reliable distributed computing, host and network security, digital forensics, computing policy, and computing curriculum design. Spafford serves on a number of advisory and editorial boards, and has been honored several times for his writing, research, and teaching on issues of security and ethics.

Dr. Eugene Spafford is a professor with an appointment in Computer Science at Purdue University, where he has served on the faculty since 1987. He is also a professor of Philosophy (courtesy), a professor of Communication (courtesy)and a professor of Electrical and Computer Engineering (courtesy). He is the Executive Director of the Purdue University Center for Education and Research in Information Assurance and Security (CERIAS).

As of 2007, Spafford is also an Adjunct Professor of Computer Science at the University of Texas at San Antonio, and is the executive director of the Advisory Board for the university's new Institute for Information Assurance.

Kevin Mandia, CISSP
CEO and President MANDIANT

Kevin Mandia is an internationally-recognized expert in the field of information security. He has been involved with information security for over fifteen years, beginning in the military as a computer security officer at the Pentagon. He has assisted attorneys, corporations, and government organizations with matters involving information security compliance, complex litigation support, computer forensics, expert testimony, network attack and penetration testing, fraud investigations, computer security incident response, and counterintelligence matters.

Prior to forming MANDIANT, Mandia built the computer forensics and investigations group at Foundstone. As technical and investigative lead, Mandia responded on-site to dozens of computer security incidents per year. He assisted numerous financial services and large organizations in handling and discretely resolving computer security incidents. He also led Foundstone’s computer forensic examiners in supporting numerous criminal and civil cases.

An extremely experienced instructor, Mandia developed specialized classes in investigating computer crime for the Federal Bureau of Investigations as well as developed specialized training for the United States Attorney’s Office, United States Secret Service, United States Air Force, State Department, the Royal Canadian Mounted Police, and other government agencies. Mandia is co-author of Incident Response: Performing Computer Forensics (McGraw-Hill, 2003) and Incident Response: Investigating Computer Crime (McGraw-Hill, 2001).

Joel Snyder
Senior Partner, Opus One

Joel Snyder is an expert at helping companies build larger, faster, safer and more reliable networks, and has done so since 1981 when he signed on with CompuServe Research and Development. For more than a decade, Snyder has been a member of the ISO and ITU committees that write network standards. Additionally, Snyder is a technical editor for Information Security magazine. He has authored several books, hundreds of articles for technical publications, and has trained thousands of people privately and at conferences around the world on networking, security, messaging and VPNs. He's helped more than 150 companies with their networking, e-mail and security problems. Snyder has spoken at many industry events and among the most popular presenters at previous Information Security Decisions conferences.

Dr. Herbert “Hugh” Thompson Ph.D
Chief Security Strategist, People Security

Dr. Herbert H. Thompson is chief security strategist at People Security and a world-renown expert in application security. He heads the company's security education program and also directs research projects for some of the world's largest corporations.

He has co-authored four books on the topic including, How to Break Software Security: Effective Techniques for Security Testing (with Dr. James Whittaker, published by Addison-Wesley, 2003), and The Software Vulnerability Guide (with Scott Chase, published by Charles River 2005).

Thompson has spent years creating methodologies that help clients build demonstrably more secure software and has trained developers, architects, security testers and executives at some of the world's largest software companies including Microsoft, HP, Motorola, IBM, Cisco, Symantec, and SAIC.

Dr. Thompson has delivered talks and keynotes at key conferences and Fortune 500 corporations, writing industry-defining books and articles on software security, and interacting with the press. He has been interviewed by top news organizations including CNN, ABC, Fox News, MSNBC, HBO, BusinessWeek, Forbes, Associated Press, and the Washington Post. Thompson has also delivered award-winning keynotes on software security throughout the United States, Europe and Asia at conferences such as RSA, Forrester Security Summit, Eclipsecon, STAR, and Gartner. Additionally, he has authored more than 60 academic and industrial publications on software security and frequently writes for such industry publications as Dr. Dobbs Journal, IEEE Security & Privacy, CSO Magazine, Network World, CIO Update, and ACM Queue.

As chief security strategist at People Security, Thompson heads He earned his Ph.D. in Applied Mathematics from Florida Institute of Technology, where he remains on the graduate faculty and also holds the CISSP certification.

Christofer Hoff, CISSP, CISA, CISM, IAM
Chief Architect of Security Innovation, Unisys Corporation

Christofer Hoff is Unisys Corporation's chief architect of security innovation. Reporting to the VP of Worldwide Innovation, he collaborates closely with Unisys sales, marketing, the CTO office, Security Pillar for Strategic Program Office (SPO) and key Unisys business unit leaders around the world. Hoff proactively develops strategies for innovation and success as well as unlocking maximum value for the corporation and customers in the area of information security, survivability and assurance. Prior to Unisys, Hoff served as Crossbeam Systems' chief security strategist, responsible for the company's overall security strategy and product management efforts. Hoff also served as the chief information security officer and director of Enterprise Security Services for WesCorp, a $25 Billion Financial Services Cooperative and used his expertise gained as founder and CTO of a national security consulting company which provided services to the Fortune 500 and service provider customers. He is a featured speaker at numerous information security events and is an accomplished and accredited technical instructor.

Adrian Lane
Senior Security Strategist, Securosis

Adrian Lane is a senior security strategist with 22 years of industry experience, bringing over a decade of C-level executive expertise to the Securosis team specializing in database architecture and data security. By having been part of the vendor community with stints at Ingres & Oracle, as well as an IT customer in the role of CIO, Lane provides a business oriented perspective to security implementations. Prior to joining Securosis, Lane was the CTO at the database security firm IPLocks, where he was responsible for product & technology vision, market strategy, PR and security evangelism. Lane has also served as the vice president of Engineering at Touchpoint, three years as the CIO of the brokerage CPMi, and two years as the CTO of the security and digital rights management firm Transactor/Brodia.

Eric Holmquist
VP, Director of Operations Risk Management, Advanta Bank Corp.

Eric Holmquist has over 25 years experience in the financial services industry and is a frequent industry author and speaker. He is responsible for the development and oversight of the bank's operational risk management program. In addition, Holmquist chairs the bank's MIS Council, an oversight group that provides governance with regard to standards, methods and production of financial and operational reports and the management of enterprise data. Holmquist also acts as the bank's information security officer with responsibility for oversight of the bank's information security strategy as well as acting as a liaison to the Board of Directors.

Holmquist chairs the operational risk management for IT committee through the Risk Management Association, a nationwide trade group based in Philadelphia focused on sound risk management practices in the global financial services industry. Holmquist is the author of Risk-Sizing ORM – Scaling Operational Risk Management For The Small To Mid-sized Market, is a contributing author to Operational Risk 2.0 (2007) and The Advanced Measurement Approach to Operational Risk (2006), both by Incisive Media and writes periodic articles on operational risk management topics for OpRisk & Compliance Magazine

Eric V. Leighninger
Chief Security Architect, Allstate Insurance Company

Eric Leighninger has over 22 years of information security experience. He is responsible for creating and articulating the information security architectural vision, communicating that vision to the enterprise, creating security architecture models and roadmaps, and validating information security architectures against enterprise requirements. He currently is leading the design and development an enterprise-wide identity management initiative comprising identity provisioning and management, authentication and authorization services and directory services. He also developed and managed the Allstate Cryptographic Technology Implementation Program which provides integrated cryptographic services e.g., PKI, digital signatures, data and file encryption and key management for users and applications.

Leighninger was director of research for the Deloitte & Touche (D&T) eBusiness Technology Center which provided security and e-business expertise along with technology evaluation and development support to the D&T world-wide consulting practice.

Richard E. Mackey, ISACA/CISM
VP, SystemExperts

Richard Mackey is regarded as one of the industry's foremost authorities on distributed computing infrastructure and security. He has advised leading Wall Street firms on overall security architecture, virtual private networks, enterprise wide authentication, and intrusion detection and analysis. He also has unmatched expertise in the Open Software Foundation Distributed Computing Environment.

Prior to joining SystemExperts, he was the director of collaborative development for The Open Group (the merger of the Open Software Foundation and X/Open), where he was responsible for the integration of Microsoft's ActiveX Core with DCE and DCE Release 1.2. Mackey is an original member of the DCE Request for Technology technical evaluation team and was responsible for the architecture and defining the contents of the Distributed Computing Environment Releases 1.1 and 1.2. Before The Open Software Foundation, Mackey was a member of the Cronus Distributed Computing Environment research project at BBN Corp. The Cronus Project, which explored fundamental mechanisms in distributed security, adaptive user interfaces and object-oriented technology, was one of the intellectual forerunners to MIT's Project Athena and OSF's DCE. Mackey also previously worked in hardware and software development in communications and fiber optics at RCA. Mackey has been a frequent speaker at major conferences such as Giga, USENIX, Uniforum and Networld + Interop and has taught tutorials on developing secure distributed applications.

Spyro Malaspinas, CISSP, CISA, CISM, GCIH, QSA/QPASP
Principal, ThreeFactor Security

Spyro Malaspinas, is an accomplished Information Security consultant with over ten years of service providing expert counsel to financial services, health care, hospitality, gaming, telecommunication and hi-tech industry clientele. As a security and compliance practitioner, leader, and innovator Malaspinas has been a key contributor in the management and architecture of some of the largest corporate networks in the world. With technical expertise and distinct knowledge of IT operations environments, regulatory and compliance standards, security operation centers, and financial networks, Malaspinas has leveraged Six Sigma concepts and innovative data models to streamline security processes and compliance programs.

Prior to founding ThreeFactor Security, an independent security and compliance consulting practice, Malaspinas served as the PCI practice leader for Symantec Corp. where he provided expert counsel to Level 1 merchants and Service Providers with footprints all over the world. He spent 4 years working for two of the largest managed security service providers in the world, VeriSign and IBM. While with VeriSign's managed security services, Malaspinas was responsible for the architecture, deployment, and management for thousands of security devices worldwide.  With IBM Global Services he served as a security architect and security engineer for multinational Fortune 50 accounts. Through the course of Malaspinas' evolving security practice he has achieved, and currently maintains, over a dozen different security licenses and certifications.

David Mortman, CISSP
CSO-In-Residence, Echelon One

David Mortman is a thought leader in the information security community and provides his counsel to Echelon One’s clients. Previously Mortman was chief information security officer for Siebel Systems Inc. where he was responsible for Siebel Systems’ world wide IT security program and led Siebel’s product security and privacy efforts. Prior to Siebel, Mortman was the manager of IT security at Network Associates where, in addition to managing data security he deployed and tested all of its security products before they were released to customers. A CISSP, member of USENIX/SAGE and ISSA and a repeat speaker at the RSA conference, Mortman is a member of the Executive Security Action Forum and has spoken at InfoSecurity, BlackHat and DefCon. Mortman sits on a variety of advisory boards including Qualys, Teros and Sygate.

Andrew Moore
Senior MTS of CERT at the Software Engineering Institute, Carnegie Mellon University

Andrew Moore is a senior member of the Technical Staff of the CERT Program at the Software Engineering Institute at the Carnegie Mellon University. Moore explores ways to improve the security, survivability, and resiliency of enterprise systems through insider threat and defense modeling, incident processing and analysis, and architecture engineering and analysis. Before joining the SEI in 2000, he worked for the Naval Research Laboratory investigating high assurance system development methods for the Navy. He has over twenty years experience developing and applying mission-critical system analysis methods and tools, leading to the transfer of critical technology to both industry and the military.

While at the NRL, Moore served as member of the US Defense Science and Technology review (Information Technology TARA) panel on Information Assurance; the International Technical Cooperation Program, Joint Systems and Analysis Group on Safety-Critical Systems, (TTCP JSA-AG-4); and the Assurance Working Group of DARPA’s Information Assurance Program.  He has served as principal investigator on numerous projects sponsored by NSA and DARPA.  He has also served on numerous computer assurance and security conference program committees and working groups.  Moore has published a book chapter and a wide variety of technical journal and conference papers. His research interests include computer and network attack modeling and analysis, IT management control analysis, survivable systems engineering, formal assurance techniques, and security risk analysis.

Vik Phatak
CEO, NSS Labs

Vik Phatak is CEO of NSS Labs, the leading independent security product testing and certification lab, as well as one of the information security industry’s foremost thought leaders on vulnerability management and threat protection. Most recently, he served as CTO for Trustwave (ATW), the world’s largest PCI assessor where he was instrumental in addressing technology and compliance issues. In 2002, he founded Lucid Security and developed one of the leading IPS appliances for enterprise-class environments. Prior to Lucid, Phatak served as global manager of enterprise internet and security Services at Teleflex, a publicly-traded global manufacturing company, and served as a co-founder of Intermedia Sciences Group, Inc., a security consulting firm.

Mike Rothman
Chief Blogger , Security Incite

Mike Rothman is Security Incite's president and principal analyst and author of The Pragmatic CSO.

Starting his career as a programmer and a networking consultant, Rothman joined META Group in 1993 and spearheaded META's initial foray into information security research. During his five years in research, he also covered a variety of other networking, electronic commerce, and messaging topics.

Rothman left META in 1998 to found SHYM Technology, a pioneer in the PKI software market and then took VP Marketing roles at CipherTrust and TruSecure, providing experience in marketing, business development, and channel operations for both product and services companies.

Diana Kelley
Partner, SecurityCurve

Diana Kelley has 17 years of experience creating secure network architectures and business solutions for large corporations and delivering strategic, competitive knowledge to security software vendors. She founded SecurityCurve in April 2003 and returned as a partner in January 2008. Before returning to SecurityCurve she was the vice president and service director for the Security and Risk Management Strategies (SRMS) service at Burton Group. Prior to joining Burton, Kelley was the executive security advisor for CA's eTrust Business Unit where she was responsible for advising customers on strategic security solutions.

Kelley speaks frequently at major conferences, including RSA, WiFi Planet, BlackHat, InfoSec World, NetWorld/InterOp, The Internet Security Conference, and ComDex. She has been quoted in publications such as Information Security magazine and The Wall Street Journal as a security expert. She co-authored the book Cryptographic Libraries for Developers and has authored numerous White Papers and research documents.

Security 7 Award Winners

Mark T. Weatherford, CISSP, CISM
Executive Officer, California Office of Information Security and Privacy Protection

Mark Weatherford is an experienced information security professional whose career spans both the public and private information security sectors. Appointed by Governor Schwarzenegger to his present position as executive officer of the California Office of Information Security and Privacy Protection, Weatherford has broad authority over the State’s information security and privacy activities. In this role, he is responsible for California state government information security and privacy program policy, standards, and procedures and also for coordinating the activities of state agency information security officers to ensure compliance. He also oversees the first-in-the-nation office of privacy protection, which provides information and education for consumers on identity theft and other privacy issues, as well as privacy practice recommendations for business and other organizations. 

With a proven ability to manage complex technical programs at all levels of the organizational structure, Weatherford has extensive executive and operational experience in the information and cyber security arena. In his former role as the chief information security officer for the State of Colorado, he was appointed by two successive governors to develop and lead the state information security program. 

While on active duty in the Navy, Weatherford was responsible for leading the U.S. Navy’s Computer Network Defense operations and the Naval Computer Incident Response Team. After joining the Raytheon company, his leadership was instrumental in establishing the first Security Operations Center for the Navy/Marine Corps Intranet program, which consolidated all naval network and information assurance operations at three central facilities in the United States.

Mark Burnette, CPA, CISA, CISSP, CISM, CITP, CRP
Executive Director of IT Operations & Security
Gaylord Entertainment Company

Mark Burnette is the executive director of IT operations and security for Gaylord Entertainment Company, the fastest growing specialty lodging and entertainment organization in America. Burnette has company-wide responsibilities for Gaylord’s IT infrastructure function, including desktops, servers, databases, the network, and information security. His responsibilities span numerous properties and attractions and more than 14,000 employees across the country. In addition to his strategic leadership, he is responsible for coordinating IT compliance with business regulatory requirements such as Sarbanes-Oxley and Payment Card Industry standards. A passionate and seasoned IT leader, Burnette was named the 2005 Information Security Executive of the Year at the Executive Alliance ISE Southeast Awards in March 2005.

Recognized as a security expert by technology think-tank Gartner, Burnette has been featured as a subject matter expert on ABC and CBS television affiliates numerous times, in print media such as CSO magazine and Secure Enterprise, and is a noted author and a frequent speaker to international conferences and specialty groups such as ISACA, IMA, IIA, & ISSA, and on College and University campuses across the United States. Burnette is a founding member of the Middle Tennessee Chapter of the Information Systems Security Association (ISSA) and finished his third term as President of the Chapter in 2006. He is the chairman of the board and master of ceremonies of InfoSec Nashville, a major annual Information Security conference that is hosted in Nashville and draws security experts and executives from across the United States. In addition, he is a co-founder of the Southeast CSO Council, a community for senior security leaders in the Southeastern US, as well as the InfoSec sector leader for the State of Tennessee Office of Homeland Security Advisory Council.

Marc S. Sokol, CISM, CHS-III
Vice President/Chief Security Officer/Corporate Head of Operational Risk Management
Guardian Life Insurance Company of America

Marc Sokol is the executive accountable and responsible for defining, coordinating, and leading operational risk management and corporate governance programs in the areas of information security, physical security, investigations, fraud prevention, privacy, regulatory compliance, crisis/emergency management, and business continuity across all of Guardian and its subsidiaries. He is a member of Guardian's executive risk management committee that reports into its board of directors' audit committee and is chairman of Guardian's executive operational risk management subcommittee.

Sokol is also a director on the board of directors of the Financial Services Information Sharing and Analysis Center, which was established by the financial services sector in the late 1990’s in response to Presidential Directive 63. That directive - later updated by 2003's Homeland Security Presidential Directive 7 - mandated that the public and private sectors share information about physical and cyber security threats and vulnerabilities to help protect the U.S. critical infrastructure.  FS/ISAC membership is endorsed by the U.S. Department of the Treasury, the Office of the Comptroller of Currency, the Department of Homeland Security (DHS), the United States Secret Service, and the Financial Services Sector Coordinating Council. In fact, both Treasury and DHS rely on the FS/ISAC to disseminate critical information to the financial services sector in times of crisis.

With almost 20 years of leadership experience implementing, leading, and managing information security, physical security, fraud prevention, investigations, governance, and operational risk management and compliance programs for a number of top national and global financial services and security companies, along with active participation in information sharing organizations including the FS/ISAC, the LOMA CISO Council, and law enforcement associations including NYPD Project Shield and US Secret Service NY Electronic Crimes Task Force, Sokol has been a significant, valued, and industry respected contributor and thought leader for advancing security in the financial services industry.

Martin Valloud
Systems Administrator, Enterprise Platforms Team
Rogers Communications Inc.

Serving the Enterprise Platforms group at Rogers Communications, Martin Valloud works with patch Management, Security, Scripting and Auditing on the company's servers, always looking for ways to improve, secure and automate the overall Security on the environment. Rogers Communications is a leading North American provider ofwireless voice and data communications services cable television, cable telephony and high-speed Internet access. Prior to Rogers Communications, Valloud served on Fusepoint Managed Services one of the biggest leading providers of managed IT solutions in Canada as a senior network operations engineer.

Michael Mucha
CISO, Stanford Hospital

Michael Mucha is a 12 year veteran in enterprise security, and the CISO of Stanford Hospital, a globally-recognized, $1.6 billion revenue medical center on the campus of Stanford University. Prior to joining Stanford, he was a senior developer for the Managed Security Services division of Exodus Communications, where he wrote security-as-a-service and lights-out management software serving over 1000 managed security customers in 46 datacenters worldwide.

William C. Boni
Corportate Vice President
CISO, Motorola

William C. Boni has spent his entire professional career as an information protection specialist and has assisted major organization’s in both the public and private sectors. For 30 years, beginning as a Special Agent in U.S. Army Counter-intelligence, Boni has helped a variety of organizations design and implement cost-effective programs to protect both tangible and intangible assets.  In a wide range of assignments Boni has assisted clients in safeguarding their digital assets, especially their key intellectual property, against the many threats arising from the global Internet.  In addition, he has pioneered the innovative application of technologies including computer forensics, intrusion detection and others, to deal with incidents directed against electronic business systems.

Boni has served as a consultant in several professional service organizations and now works as the Corporate Vice President and Chief Information Security Officer of Motorola Information Protection Services.  He is responsible for the company's overall program to protect critical digital proprietary information, intellectual property and trade secrets.  He also directs the people, processes and technology programs that safeguard the company's global network, computer systems and electronic business initiatives.

Boni has been quoted by leading print publications such as the Wall Street Journal, US News & World Report the Financial Times, LA Times, and CIO Magazine. He has also appeared on many network broadcasts including Prime Time Live, CNN and CNN/fn discussing espionage and cyber crimes directed against American high technology corporations.  Other assignments in his distinguished career include work as a U.S. Army counter-intelligence officer; Federal agent and investigator; investigator and security consultant; Vice President of Information Security for First Interstate Bank; and project security officer for “Star Wars” programs and other defense work with Hughes Aircraft Company and Rockwell.  

Security Research Panel: Speakers

Dave Aitel
Founder and CTO, Immunity

Dave Aitel is the founder and CTO of Immunity. Prior to starting Immunity Aitel was a consultant with @stake and a research scientist with the National Security Agency. His background lies in Linux and Unix systems, however, his focus changed to Windows exploitation after founding Immunity, and in more recent years has expanded to include web applications and engine development for CANVAS such as MOSDEF, the engine's C compiler. Aitel continues to write CANVAS exploits and conduct security research while leading the technical direction of Immunity. He also runs the popular industry mailing list DailyDave and often serves as a source for analysis and opinion on new threats, as reflected in various media coverage

Alexander Sotirov

Alexander Sotirov has been involved in the security community since 1998, when he started contributing to Phreedom Magazine, a Bulgarian underground technical publication. For the past ten years he has been reverse engineering software, researching vulnerabilities and developing advanced exploitation techniques. His most recent work includes the discovery of the ANI vulnerability in Internet Explorer and Firefox, the development of the Heap Feng Shui browser exploitation technique and bypassing of the exploitation mitigations on Windows Vista. His professional experience includes positions as a security researcher at Determina and VMware.

Sotirov is a regular speaker at industry and hacker security conferences around the world, including CanSecWest, BlackHat and Recon. He has also served on the program commitee for the USENIX Workshop on Offensive Technologies and is one of the organizers, and a member, of the panel of judges of the Pwnie Awards.

Thomas Ptacek
Matasano

Thomas Ptacek brings over 10 years of product development and security research experience to Matasano. Ptacek has owned technical operations at Chicago’s most popular ISP, authored Insertion, Evasion, and Denial of Service, a landmark paper which broke every shipping intrusion detection product on the market, and at Arbor Networks led the development of a security product deployed on the backbone of virtually every tier-1 ISP worldwide.

Billy Hoffman
Manager of HP's Web Security Research Group, HP Software

Billy Hoffman leads research focused on Web 2.0 threats, automated discovery of Web application vulnerabilities, and web crawling technologies. Hoffman has worked in the security space since 2001 after he wrote an article on cracking software for 2600: The Hacker Quarterly and learned that people would pay him to be curious.

Over the years, Hoffman has worked on a variety of projects including reverse engineering file formats, micro-controllers, JavaScript malware, and magstripes. His work has been featured in Wired, Make magazine, Slashdot, G4TechTV, and in various other journals and Web sites. Prior to HP, he was the lead security researcher at SPI Dynamics, which was acquired by HP in 2007.

Hoffman is regular presenter at security conferences including RSA, Black Hat USA, Black Hat Japan, InfoSec, AJAXWorld, and Toorcon. He is also the author of the book Ajax Security (Addison Wesley in December 2007.)