Software Engineering Institute (SEI) Webcast Series

This webcast will assist professionals and executives communicate risk concerns despite the cacophony and distraction posed by technical details and other organizational demands using the new OCTAVE FORTE approach. Practical tips for risk appetite development and application will be discussed.

This webcast covered the implementation of an automated, continuous risk pipeline that demonstrates how cyber-resiliency and compliance risk can be traced to and from DevSecOps teams working in the SDLC program and project levels. It will include integration of asset management, DevSecOps tooling, policy-to-procedure platform and risk management platform.

For more than two decades, Carnegie Mellon University's Software Engineering Institute (SEI) has been instrumental in the creation and development of the field of software architecture. In our past webcasts, What Makes a Good Software Architect? (https://www.youtube.com/watch?v=CbLJC...) and What Makes a Good Software Architect (2019 Edition)? (https://www.youtube.com/watch?v=UFqys...), we have discussed what makes a good software architect. The range of knowledge and skills involved can be daunting, particularly given the pace of change in technologies and practices. In this session, a panel of architects will discuss their personal paths to becoming software architects and how they have helped others on that journey.

Artificial intelligence (AI) holds great promise to empower us with knowledge and scaled effectiveness. To harness the power of AI systems, we can—and must—ensure that we keep humans safe and in control. This session will introduce a new user experience (UX) framework to guide the creation of AI systems that are accountable, de-risked, respectful, secure, honest and usable.

In this webcast, as a part of National Cybersecurity Awareness Month, our experts will provide an overview of the concept of cyber hygiene, which bears an analogy to the concept of hygiene in the medical profession. Like the practice of washing hands to prevent infections, cyber hygiene addresses simple sets of actions that users can take to help reduce cybersecurity risks. Matt Butkovic, Randy Trzeciak, and Matt Trevors will discuss what some of those practices are, such as implementing password security protocols and determining which other practices an organization should implement. Finally, they discuss the special case of phishing—which is a form of attack that can bypass technical safeguards and exploit people's weaknesses—and how changes in behavior, understanding, and technology might address this issue.

What attendees will learn

• Key findings from the CERT Division of the SEI, and the CERT-RMM team, in identifying commonalities among cyber practices and aligning them to CERT-RMM practices

• The CERT Division's 11 cyber hygiene areas, comprising 41 CERT-RMM practices that are paramount to every organization's success

• What organizations can do to change behavior, understanding, and technology to implement good cyber hygiene

Misuse of authorized access to an organization's critical assets is a significant concern for organizations of all sizes, missions, and industries. We at the CERT National Insider Threat Center have been collecting and analyzing data on incidents involving malicious and unintentional insider since 2001, and have worked with numerous organizations across government, industry, and academia to develop and validate controls and best practices to address these concerns. In this webcast, as a part of National Insider Threat Awareness Month, our experts provided an overview of the ongoing research in this area, and answered questions about how the threat landscape continues to evolve, and what organizations can and should do to address insider threats. What attendees will learn: • Key findings from the CERT National Insider Threat Center's research into the different types of insider incidents – motivations, vulnerabilities, and common attack paths • How the insider threat landscape has changed over time, and what's to come in the future • What organizations can do to deter, detect, and mitigate insider threats from employees and trusted business partners

Ritwik Gupta and Elli Kanal explain what ransomware is, what it can do to your computer, and how you can help prevent infections using the concept of cyber hygiene. Ransomware is a type of malware that encrypts the files on a computer, preventing the user from accessing them. The attacker then extorts the user by requesting a ransom in exchange for the key that unlocks the files. In this Cyber Talk episode, Ritwik Gupta and Elli Kanal explain how ransomware can infect a computer, and they discuss examples of how criminals have targeted single computers as well as large systems to explain what can happen when ransomware infects a system. To prevent ransomware attacks, Gupta and Kanal explain the concept of "cyber hygiene," which refers to a set of basic practices that users can perform to decrease the risk of getting infected by malware. They stress the importance of developing an awareness for cyber hygiene, especially after the advent of the Internet of things, which has increased the number of devices that are susceptible to infection, including phones, cars, refrigerators, and more.

Rotem Guttman and Zach Kurtz explain what deepfakes are, how they work, and what kind of content it's possible to create with current techniques and technology. The term "deepfake" refers to the use of machine learning to produce content for essays or to modify photos and videos. When it comes to photos and videos, the images are often so realistic that viewers are not able to tell that they are fake. In this Cyber Talk episode, Rotem Guttman and Zach Kurtz explain the kinds of machine learning that people use to create deepfakes, how they work, and what kind of content it's possible to produce with current technology. Rotem and Zach also cover the techniques people use to create fraudulent content. Such techniques include using an actor to film a video and then replacing the actor's face with someone else's, as well as more advanced methods that can reproduce a person's body movements, voice, speech, and facial expressions to make that person appear to say or do something that he or she did not actually say or do. Finally, they discuss the current limitations of these technologies and techniques, and they forecast advances that might occur in the coming years.

Rotem Guttman and April Galyardt describe how machine learning (ML) fits into the bigger picture of artificial intelligence (AI) and discuss the current state of AI. Currently, there is an enormous amount of interest in machine learning and artificial intelligence and what these new technologies can create for the present and future. In this SEI Cyber Talk episode, Rotem Guttman and April Galyardt discuss how machine learning fits into the bigger picture of artificial intelligence. They describe some of the current applications for machine learning as well as some of its limitations, including examples of machines reaching unexpected results, producing miscalculations because of contextual changes in the data they analyze, and introducing bias into their calculations. The participants also discuss possible use cases for and changes to machine learning that could occur in the mid to near future, including how machine learning might describe and explain its analyses for users to take appropriate action or to learn why the machine made certain decisions.

Recently, the Department of Homeland Security (DHS) released a warning about DNS hijacking and how website owners can protect themselves against it. To explain what DNS hijacking is and how adversaries use it to steal sensitive information, Elli Kanal and Daniel Ruef give a high-level overview of how DNS and network traffic work. They discuss how servers communicate with each other, what kind of information servers send to each other and why, and how adversaries can hijack that information. Finally, Elli and Daniel give some advice about what website owners might do to monitor their websites to make sure that adversaries have not hijacked their DNS.