Credit Union Information Security Podcast

In terms of payments, privacy and third-party relationships, U.S. security leaders have much to learn from - and share with - their peers in the U.K. and elsewhere in the world.

This is the perspective of Adrian Davis, a senior research consultant with the UK-based Information Security Forum.

In an exclusive interview, Davis discusses:

Davis heads the Leadership and Management group within the Research and Services Team of the Information Security Forum, responsible for delivering client-facing projects. His team covers topics such as the role and effectiveness of information security; the role and skills of information security professionals from junior analyst to the Chief Information Security Officer and Chief Security Officer; managing and assessing information security in third parties; assessing the possible near-term threats to organizations; and cloud computing.

His prior experience includes international project management, the creation and implementation of project and program offices, risk management and strategy formulation.

Davis has chaired the Marcus Evans SecurIT event for the last two years (2008 and 2009) and is a regular speaker at major conferences, including RSA and RSA Europe.

Financial institutions and their customers are experiencing a frightening range of fraud scams. Where are their greatest risks?

Mike Urban, Senior Director of Global Fraud Solutions at FICO, discusses:

Urban has 15 years experience in fraud management. He currently serves as senior director, Fraud Solutions, for FICO. He analyzes fraud issues and trends to provide continuous improvements in fraud detection technology. He also regularly works with law enforcement to help prosecute criminals and has been responsible for uncovering several crime rings in the US.

As a renowned industry expert, Urban regularly speaks about fraud trends, best practices and solutions to industry groups. He has been quoted in numerous publications including the New York Times, MSNBC, Computer World, American Banker and ATM & Debit News. He has also written articles that have appeared in such publications as DM Direct, Bank Technology News and the ISSA Journal.

He is also a founding executive committee member of the Global ATM Security Alliance (GASA), and is a member of and the American Society of Industrial Security (ASIS). Urban is a steering committee member for the Santa Fe Group Vendor Council, which is a collaborative forum of fraud, risk and compliance vendors who work as industry activists on non competitive fraud issues.

His industry recognition includes GASA Crime Fighter of the Year 2005 and ATMIA Most Influential Member of the Year 2004.

Over the past year or so, since the Heartland Payment Systems breach, we've heard a lot about the Payment Card Industry Data Security Standard (PCI DSS). What does 'PCI compliant' mean? Can a PCI compliant organization be breached? What's the role of the Qualified Security Assessor (QSA)?

Peter Spier, Senior Risk Management Consultant with Fortrex Technologies, has written a recent guest blog on PCI compliance, and in an exclusive interview offers insight on:

Spier is President of the ISACA Western New York Chapter and a Senior Risk Management Consultant at Fortrex Technologies based in Frederick, Maryland. Peter attained his graduate degree from Syracuse University's School of Information Studies and over the course of 12 years of experience, has earned Certified Information Security Manager (CISM), Certified Information Systems Security Professional (CISSP), Project Management Professional (PMP), Qualified Security Assessor (QSA), Information Technology Infrastructure Library (ITIL) Foundation version 3, and HITRUST CSF Assessor certifications; among other credentials.

In this exclusive interview, Jason Vander Meer of RealTick discusses his organization's DLP strategy, and the solution he deployed from Code Green Networks.

Additionally, Dan Udoutch of Code Green Networks offers advice for organizations faced with similar DLP challenges.

Vander Meer is currently responsible for Information Security and IT Infrastructure Project Management at RealTick®, the electronic trading industry's premier global, multi-broker, broker neutral, cross-asset Execution Management System (EMS). He joined RealTick in 2005, and has since been the lead of managing Information Security risk assessment and mitigation. Vander Meer has a MS degree in Information Technology and Information Assurance from DePaul University in Chicago.

Udoutch is the President and CEO of Code Green Networks. As a 25+ year Sales, Marketing and CEO veteran of Silicon Valley, Dan has a unique set of skills and successes with bringing innovative and market leading solutions to the Enterprise customer. He held significant executive-level roles at notable firms including Commerce One, NavTeq and Netscape Communications. Earlier in his career he worked for IBM and Tandem delivering mission critical solutions to various industries including financial services and healthcare.

Insider crimes are among the biggest threats to public and private sector organizations. And yet too many groups continue to struggle to prevent or even detect these crimes.

In an exclusive interview, Dawn Cappelli of Carnegie Mellon University's Software Engineering Institute, discusses:

Cappelli is Technical Manager for the Threat and Incident Management Team of the CERT Technical Staff at Carnegie Mellon University's Software Engineering Institute (SEI). She has over 25 years experience in software engineering, including programming, technical project management, information security, and research. She is technical lead of CERT's insider threat research, a CyLab-funded project including the Insider Threat Study conducted jointly by the U.S. Secret Service and CERT. Before joining CERT in 2001, Cappelli was the Director of Engineering for the Information Technology Development Center of the Carnegie Mellon Research Institute (CMRI). Cappelli has a BS in Mathematics and Computer Science from the University of Pittsburgh.

What do these events mean for the financial regulatory agencies - especially in terms of securing access to sensitive data?

John Bordwine, Public Sector CTO at Symantec, tackles this question, discussing:

As the Symantec Public Sector CTO, Bordwine currently serves as a trusted advisor, providing guidance on the development of products and solutions that meet government requirements and certifications specifically focused on the Public Sector markets. His responsibilities also include all technical activities related to Public Sector customers, which includes federal, state, and local government agencies, and education industries. In addition to these responsibilities, he also provides guidance to other Symantec business units around specific requirements to the Public Sector industry.

Previously, Bordwine spent over five years with McAfee as the Public Sector CTO and Senior Director of Security Engineering.

He has spoken at numerous highly-acclaimed security events, including SANS Institute events, FOSE, AFITC, and US Government agency-specific functions. Bordwine holds a Top Secret clearance and served in the US Army Signal Corps where his last assignment was with the White House Communications Agency.

One theme repeated by every major Obama administration officials speaking RSA Conference 2010, the IT security conference held in early March in San Francisco, was the need for the government and business to work together to protect the nation's critical IT systems.

Among those listening to these officials was Steve Elefant, chief information officer of payment processor Heartland Payment Systems, a victim of a 2009 breach considered the largest criminal breach of card data ever, exposing information on upward of 100 million cards.

In an interview with Information Security Media Group Executive Editor Eric Chabrow, Elefant discusses the impact of the breach on Heartland's relationship with the government and other financial institutions to secure critical IT systems operated by the private sector.

Recent ACH fraud schemes aren't just siphoning money from business banking accounts - they're eroding the trust relationship between small-to-midsize businesses and their banking institutions.

This is the main finding of the new 2010 Business Banking Trust Study conducted by Guardian Analytics and the Ponemon Institute.

In an exclusive interview, Terry Austin, CEO of Guardian Analytics, discusses:

Prior to joining Guardian Analytics, Austin served as CEO and president of MarketLive, a leading provider of eCommerce platform solutions, where he created a scalable business strategy, assembled a world-class executive team and led successful fundraising efforts. He was previously president of worldwide marketing and sales at Good Technology, a provider of mobile computing solutions, where he spearheaded the company's rapid growth from 10,000 to over 500,000 subscribers and facilitated its acquisition by Motorola in January 2007. Austin has also served as president of EMEA and executive vice president for Manugistics, a market leading provider of enterprise software. He started his career at Accenture, where he ultimately led an $80 million consulting practice as a lead partner.

Axelrod is currently executive advisor for the Financial Services Technology Consortium. Previously, he was a director of Pershing LLC, a BNY Securities Group Co., where he was responsible for global information security. He has been a senior information technology manager on Wall Street for more than 25 years, has contributed to numerous conferences and seminars, and has published extensively. He holds a Ph.D. in managerial economics from Cornell University, and a B.Sc. in electrical engineering and an M.A. in economics and statistics from Glasgow University. He is certified as a CISSP and CISM.

At the RSA Conference 2010, Paul Smocer of BITS and the Financial Services Roundtable discusses:

Smocer, VP of Security at BITS, a division of the Financial Services Roundtable, leads the group's security program. Smocer has over 30 years' experience in security and control functions, most recently focusing on technology risk management at The Bank of New York Mellon and leading information security at the former Mellon Financial. While at Bank of New York Mellon and at Mellon, Smocer was actively engaged with BITS as a member of its Vendor Management Working Group, as 2005 Chair of its Security Steering Committee, and as 2004 Chair of its Operational Risk Committee.