Meeting New CSC Guidelines for SSL Certificate Management
- Thursday, June 4th, 2015 at 1:00 PM EDT (17:00:00 UTC)
- Barb Filkins and Kevin Bocek
You can now attend the webcast using your mobile device!
The revelation of Heartbleed, POODLE, BEAST and other critical technical vulnerabilities has undermined confidence in the technology behind SSL/TLS certificates. But the sloppy way that certificates are handled by corporate security have made it far more difficult to trust "secure" certificates. Hundreds of thousands of bogus certificates make attackers or Man in the Middle attack points look legitimate - not to mention the Certificate Authorities suspected of issuing bogus certificates due to their own mismanagement.
It is possible, with strict discipline and adherence to the right security procedures, to filter out the worst of the bogus credentials and still take advantage of the web's most common authentication mechanism.
Attend this webcast to learn:
- Risks to corporate security from sloppy certificate sourcing and handling and how to identify them
- Type of vulnerabilities plaguing token-based security - even from legitimate Certificate Authorities
- How to put evaluate your SSL/TLS exposure
- How to put processes and policies in place to address them and integrate those controls into day-to-day operations with purposeful, automated certificate management
- How to measure progress and ultimate improvement in efficient and secure control of certificate use and authentication
Register for this webcast and be among the first to receive the associated whitepaper developed by Barb Filkins
View the associated whitepaper here.
Sponsored By: Venafi
Barb Filkins, a senior SANS analyst who holds the CISSP and SANS GSEC (Gold) and GCH (Gold) certifications, has done extensive work in system procurement, vendor selection and vendor negotiations as a systems engineering and infrastructure design consultant. Most recently she's been involved with HIPAA security issues in the health and human services industry with clients ranging from federal agencies (DoD and VA), municipalities and commercial businesses, focusing on issues related to automation - privacy, identity theft and exposure to fraud, as well as the legal aspects of enforcing information security. Barbara sees security as an interaction of policy, process, platforms, pipes AND people.
Kevin Bocek is responsible for security strategy and threat intelligence at Venafi. He brings more than 16 years of experience in IT security with leading security and privacy leaders including RSA Security, Thales, PGP Corporation, IronKey, CipherCloud, nCipher, and Xcert. His research using Venafi's TrustNet certificate-reputation service confirmed that the mail server used by Secretary of State Hilary Clinton used no encryption or security certificates for her first three months in office, leaving her credentials vulnerable to data theft that might have allowed her email to be monitored for far longer than three months. In 2013, Bocek led the Venafi investigation that showed how Edward Snowden used cryptographic keys and digital certificates to breach the NSA.
He is sought after for comment by media such as Wall Street Journal, New York Times, Washington Post, Forbes, Fortune, BBC, Sueddeutsche Zeitung, USA Today, Associated Press, Guardian, and Telegraph along with security press including SC Magazine, Dark Reading, and Network World.