Government Information Security Podcast

In terms of payments, privacy and third-party relationships, U.S. security leaders have much to learn from - and share with - their peers in the U.K. and elsewhere in the world.

This is the perspective of Adrian Davis, a senior research consultant with the UK-based Information Security Forum.

In an exclusive interview, Davis discusses:

Davis heads the Leadership and Management group within the Research and Services Team of the Information Security Forum, responsible for delivering client-facing projects. His team covers topics such as the role and effectiveness of information security; the role and skills of information security professionals from junior analyst to the Chief Information Security Officer and Chief Security Officer; managing and assessing information security in third parties; assessing the possible near-term threats to organizations; and cloud computing.

His prior experience includes international project management, the creation and implementation of project and program offices, risk management and strategy formulation.

Davis has chaired the Marcus Evans SecurIT event for the last two years (2008 and 2009) and is a regular speaker at major conferences, including RSA and RSA Europe.

Insider crimes are among the biggest threats to public and private sector organizations. And yet too many groups continue to struggle to prevent or even detect these crimes.

In an exclusive interview, Dawn Cappelli of Carnegie Mellon University's Software Engineering Institute, discusses:

Cappelli is Technical Manager for the Threat and Incident Management Team of the CERT Technical Staff at Carnegie Mellon University's Software Engineering Institute (SEI). She has over 25 years experience in software engineering, including programming, technical project management, information security, and research. She is technical lead of CERT's insider threat research, a CyLab-funded project including the Insider Threat Study conducted jointly by the U.S. Secret Service and CERT. Before joining CERT in 2001, Cappelli was the Director of Engineering for the Information Technology Development Center of the Carnegie Mellon Research Institute (CMRI). Cappelli has a BS in Mathematics and Computer Science from the University of Pittsburgh.

What do these events mean for the financial regulatory agencies - especially in terms of securing access to sensitive data?

John Bordwine, Public Sector CTO at Symantec, tackles this question, discussing:

As the Symantec Public Sector CTO, Bordwine currently serves as a trusted advisor, providing guidance on the development of products and solutions that meet government requirements and certifications specifically focused on the Public Sector markets. His responsibilities also include all technical activities related to Public Sector customers, which includes federal, state, and local government agencies, and education industries. In addition to these responsibilities, he also provides guidance to other Symantec business units around specific requirements to the Public Sector industry.

Previously, Bordwine spent over five years with McAfee as the Public Sector CTO and Senior Director of Security Engineering.

He has spoken at numerous highly-acclaimed security events, including SANS Institute events, FOSE, AFITC, and US Government agency-specific functions. Bordwine holds a Top Secret clearance and served in the US Army Signal Corps where his last assignment was with the White House Communications Agency.

One theme repeated by every major Obama administration officials speaking RSA Conference 2010, the IT security conference held in early March in San Francisco, was the need for the government and business to work together to protect the nation's critical IT systems.

Among those listening to these officials was Steve Elefant, chief information officer of payment processor Heartland Payment Systems, a victim of a 2009 breach considered the largest criminal breach of card data ever, exposing information on upward of 100 million cards.

In an interview with Information Security Media Group Executive Editor Eric Chabrow, Elefant discusses the impact of the breach on Heartland's relationship with the government and other financial institutions to secure critical IT systems operated by the private sector.

GovInfoSecurity.com's Executive Editor Eric Chabrow ran into Hathaway at the RSA Conference 2010 in San Francisco earlier this month, just after the White House issued a declassified summary of CNCI, a series of initiatives aimed at securing federal government information assets and the nation's critical IT infrastructure. Besides responding to a question whether declassifying parts of CNCI was a good idea, Hathaway also addressed:

Hathaway left government service last summer, forming an IT security consultancy. Among her clients: Harvard Kennedy School's Belfer Center for Science and International Affairs and Cisco.

Hathaway is a protégé of retired Adm. Mike McConnell, who resigned a year ago as the nation's National Intelligence director, returning to the management consultancy Booz Allen Hamilton. Under McConnell, Hathaway served as a senior adviser and cyber coordination executive. She chaired the National Cyber Study Group, contributing to the development of the CNCI. That led to her appointment as director of the Joint Interagency Cyber Task Force in January 2008. At Booz Allen, where she first worked with McConnell, Hathaway served as a cybersecurity strategist, leading the information operations and long-range strategy and policy support business units.

In February 2009, President Obama charged Hathaway to conduct a wide-ranging, 60-day interagency review the government's cybersecurity plans and activities and gave her the title acting senior director for cyberspace for the National Security and Homeland Security Councils.

Hathaway, who holds a BA from American University and a special certificate in information operations at the U.S. Armed Force Staff College.

Here are other interviews and stories about Hathaway from the GovInfoSecurity.com archives:

Axelrod is currently executive advisor for the Financial Services Technology Consortium. Previously, he was a director of Pershing LLC, a BNY Securities Group Co., where he was responsible for global information security. He has been a senior information technology manager on Wall Street for more than 25 years, has contributed to numerous conferences and seminars, and has published extensively. He holds a Ph.D. in managerial economics from Cornell University, and a B.Sc. in electrical engineering and an M.A. in economics and statistics from Glasgow University. He is certified as a CISSP and CISM.

At the RSA Conference 2010, Paul Smocer of BITS and the Financial Services Roundtable discusses:

Smocer, VP of Security at BITS, a division of the Financial Services Roundtable, leads the group's security program. Smocer has over 30 years' experience in security and control functions, most recently focusing on technology risk management at The Bank of New York Mellon and leading information security at the former Mellon Financial. While at Bank of New York Mellon and at Mellon, Smocer was actively engaged with BITS as a member of its Vendor Management Working Group, as 2005 Chair of its Security Steering Committee, and as 2004 Chair of its Operational Risk Committee.

What's new in information security certifications? In an exclusive interview at RSA Conference 2010, W. Hord Tipton, Executive Director of (ISC)², discusses:

Tipton is the executive director for (ISC)², the global leader in educating and certifying information security professionals throughout their careers. Tipton previously served as president and chief executive officer of Ironman Technologies, where his clients included IBM, Perot Systems, EDS, Booz Allen Hamilton, ESRI, and Symantec. Before founding his own business, he served for five years as Chief Information Officer for the U.S. Department of the Interior.

How will the Payment Card Industry Data Security Standard (PCI DSS) be amended, and when?

These are the key questions in payments security, and Bob Russo, GM of the PCI Security Standards Council, is prepared to start answering them. In an exclusive interview conducted at RSA Conference 2010, Russo discusses:

Russo brings more than 25 years of high-tech business management, operations and security experience to his role as the general manager of the PCI Security Standards Council. Russo guides the organization through its crucial charter, which is focused on improving data security standards for merchants, banks and other key stakeholders involved in the global payment card transaction process. To fulfill this role, Russo works with representatives from American Express, Discover Financial, JCB, MasterCard Worldwide and Visa International to drive awareness and adoption of the PCI Data Security Standard.

As director of federal network security at the Department of Homeland Security's National Cybersecurity Division, Matt Coose is helping shepherd the Trusted Internet Connection initiative, which aims to reduce the number of connections linking executive branch IT networks to the Internet to 100 or fewer from thousands upon thousands.

The basic concept behind TIC, initiated in 2007 by the Bush administration, is that by drastically reducing the number of access points, the government could more easily monitor and identify potentially malicious traffic.

In the interview, Coose:

Coose, a West Point graduate and former Army captain, was interviewed by GovInfoSecurity.com's Eric Chabrow.