Government Information Security Podcast

What does it take for an information security professional to make it into the United States Secret Service?

We asked Kevin Sanchez-Cherry, IT Security Specialist within the agency's Information Security Operations. In this exclusive interview, Sanchez-Cherry discusses:

Sanchez-Cherry is an IT Security Specialist for the United States Secret Service's Information Security Operations sub-division and is responsible for leading the Secret Service's Certification and Accreditation (C&A) Program and Information Systems Security Officer (ISSO) Program. He also assists in the management of the enterprise Information Assurance (IA) Program for the Secret Service.

Prior to joining the Secret Service in 2006, Mr. Sanchez-Cherry served two years as Principal Security Specialist with the Department of Commerce's Office of IT Security, Infrastructure and Technology (ITSIT), and was responsible for monitoring the agency's operating units' compliance with Federal and Department IT security requirements, laws and guidance.

In an exclusive interview, Bachman, Education Manager for the Association of Certified Fraud Examiners (ACFE), discusses:

Bachman, CFE, MBA, is responsible for seminar development and the educational content of all ACFE conferences and online learning. Most recently he worked in Higher Education as director of an audit unit and was project manager on several IT implementations specializing in security. His largest fraud investigation for over $1.5 million was conducted during this time.

Previously Bachman worked in or consulted for retail, real estate, manufacturing and has done extensive small business consulting where he has actively worked a number of fraud cases. His fraud investigation experience extends back to the mid- 70's and has continued throughout today. He became a CFE in 1993.

Know what scares security expert John Pescatore the most? The image of a remote employee sitting at a home office or public setting, plugging into an unsecured network, accessing critical business data via a personal laptop or PDA.

Organizations have never had so many security risks in so many remote locations, says Pescatore, VP and Distinguished Analyst with Gartner, Inc. Mitigating these risks will be among the primary challenges for information security leaders in 2010. In a discussion of security trends, Pescatore offers insight on:

Pescatore has 31 years of experience in computer, network and information security.

Prior to joining Gartner, he was senior consultant for Entrust Technologies and Trusted Information Systems, where he started and managed security consulting groups. His previous experience includes 11 years with GTE, as well as employment with NSA and the U.S. Secret Service.

Enterprise Risk Management (ERM) is a topic of interest throughout an organization - and increasingly at the board of director level.

But how does a security leader engage the board on ERM - and keep it engaged?

Pete Fahrenthold of Continental Airlines and RIMS discusses:

Fahrenthold is the Managing Director of Risk Management and the ERM Team Leader for Continental Airlines. He has over 20 years of risk management experience. Prior to entering the risk management field, he worked in public accounting and in various corporate functions including financial reporting, treasury operations, and employee benefits management.

He is currently the Vice Chair of the RIMS ERM Development Committee, and he is the Chair of the AFP Risk Newsletter Editorial Advisory Board.

But how does this transition impact privacy and compliance within an organization? What are the ramifications for IT and security departments?

Kim Singletary, Solutions Marketing for McAfee, discusses:

Singletary was Director of Compliance Solutions for Solidcore prior to the McAfee acquisition. She has 15 years of Product Management and Marketing roles with companies specializing in outsourced IT services for critical infrastructure both traditional datacenter services, MSSP and SAAS. Her expertise has been in developing and growing security, compliance and managed services for the Fortune 500 which included roles at SAVVIS Communications, Frontier Communications and Global Crossing.

To quell the rising tide of information breaches and to protect government and key civilian IT systems, the idea of regulating IT and data is gaining ground among those who shape federal law and policies.

If such regulation comes about, Rep. Yvette Clarke, D-N.Y., will be involved in shaping authorizing legislation, by virtue of her chairmanship of the House Homeland Security Subcommittee on Emerging Threats, Cybersecurity and Science and Technology.

Clarke, in an interview with GovInfoSecurity.com, said any such law or regulation must not hamper innovation.

In the interview, Clarke discusses:

Clarke represents one of the country's most ethnically diverse Congressional districts, New York's 11th in central Brooklyn, which includes some of the borough's most recognizable sites: Prospect Park, Grand Army Plaza, Brooklyn Botanical Gardens, Brooklyn Museum of Art and the Brooklyn Library. The 11th is the nation's third smallest Congressional district by area - 12.05 square miles - and the smallest represented by a woman.

The congresswoman was interviewed by GovInfoSecurity.com Managing Editor Eric Chabrow.

Martin Libicki spends a lot of time studying and thinking about the intersection of national security and information technology as a senior management scientist at the think tank RAND Corp. And in a just-released report he authored, Cyberdeterrence and Cyberwar, Libicki argues that strategic cyber warfare shouldn't be a priority for America's armed services.

The key word here is strategic. Cyber warfare, as a strategy, would unlikely cause the enemy to disarm as does conventional warfare. Zap an adversary's PC, and it can be replaced for $300. Cyber assault the enemy, and the opponent more likely than not will figure out how to defend itself against similar, future attacks.

Yet, he said, cyber should be considered as an ancillary weapon by the military during tactical military operations. For instance, the military could disable the enemy's computer systems used to launch missiles. "In many ways, it's not very expensive to generate an offensive cyberwar capability, and though the odds of success aren't guaranteed, there may be circumstances in which the odds are fairly high enough that it's worthwhile in taking the chance and carrying out a cyber attack in conjunction with physical warfare," Libicki said.

In the interview, with GovInfoSecurity.com managing editor Eric Chabrow, Libicki explains why:

Libicki joined RAND in 1998. His research focuses on the relationship of IT to national security and other public policy goals. He previously worked for the Navy on industrial preparedness and what is now the Government Accountability Office's energy and minerals division. Libicki received his Ph.D. in industrial economics and master degree in city planning from the University of California at Berkeley and bachelor degree in mathematics from the Massachusetts Institute of Technology.

There are myriad threats to children as they explore their online universe. And to counter these threats is Safe and Secure Online, a new interactive presentation that brings information security professionals into classrooms to give sound advice to 11-14-year-old children.

Delivered by (ISC)2, Safe and Secure Online relies on material developed by former school teachers, but delivered by certified information security professionals.

David Melnick of Deloitte and (ISC)2 discusses:

Melnick is a principal in security and privacy services within the audit and enterprise risk services practice in the Los Angeles office of Deloitte and brings more than 17 years of experience designing, developing, managing and auditing large scale secure technology infrastructure. Melnick has authored several technology books and is a frequent speaker on the topics of security and electronic commerce.

Erich Spengler, professor at Moraine Valley Community College near Chicago, discusses:

Spengler has over 20 years experience in Information Systems and holds an MBA from Loyola University of Chicago and an MS in Computer Science from the University of Illinois - Springfield. In addition to serving as a tenured professor of Computer Integrated Technologies at Moraine Valley Community College, Erich also serves as a Guest Lecturer at Northwestern University and as the Director and Principle Investigator for the National Science Foundation (NSF) Regional Center for Systems Security and Information Assurance (CSSIA @ www.cssia.org). Erich holds several industry certifications including CISSP.

Though fingerprint and iris scans have advantages over passwords and magnetic identity cards as a means to grant access to IT systems, in many instances, the biometric technologies aren't ready to be employed alone, says Myra Gray, director of the U.S. Army's Biometrics Task Force.

"Actually, it's an outstanding method for good, strong identity assurance," Gray said in an interview with GovInfoSecurity.com. "But before we go throwing out passwords and usernames, I'd like to articulate that biometrics is one tool of many. It should be part of the portfolio that's used to protect against identity theft."

Gray explained that three things exist to prove ones identity: What you know, such as a password; what you have, a magnetic card or token; and what you are - "something that's uniquely you" - an iris, a fingerprint

"The power, it not just picking one over other, but setting up a construct that utilizes all of those as appropriate" Gray said. "You probably don't need all three of those to buy coffee at the 7-Eleven. but if you were to get into a super-secure facility somewhere, you may very well want to substantiate a methodology to getting into that facility that utilize all three of those methods: What you are, what you have and what you know."

In the interview, with GovInfoSecurity.com Managing Editor Eric Chabrow, Gray discusses the:

The Biometrics Task Forces leads Department of Defense activities to program, integrate, and synchronize biometric technologies and capabilities and to operate and maintain DoD's authoritative biometric database to support the national security strategy.

Gray, who has headed the task force since July 2007, also serves as executive manager of DoD biometrics. She joined the Defense Department 24 years ago as a Naval mathematician, rising through the ranks, with her last position as assistant secretary of the Army for acquisition, logistics and technology in the Future Force Integration Office. She holds a doctorate in research and engineering management from Southeastern Institute of Technology in Huntsville, Ala.

GovInfoSecurity.com last month interviewed Lisa Swan, deputy director of the Biometrics Task Force. Click here to listen to Biometrics: From Kabul to Washington, the podcast interview with Swan.