It was once said that if Security and Compliance were in a relationship the status would be "It's Complicated". This discussion will aim to help you understand this relationship and how it can be beneficial or a mere distraction to an organization's overall security posture.
- Define "Secure" and "Compliant".
- Does compliance merely raise awareness about security shortcomings?
- What is the relationship between Security and Compliance?
- Being Secure and being Compliant are mere points in time, how can we best develop a process to ensure we are always striving to a secure and compliant state?
- How does Security impact and/or influence Compliance?
- How does Compliance impact and/or influence Security?
- How do you balance these extremes: "We will be Secure and ignore compliance" vs. "We will be compliant but ignore security"
Since 2017, GTA has invested in dozens of cyber start-ups and funds and supported multiple cyber nonprofits and projects. Ron has served on the Board of Directors for a number of GTA’s portfolio companies and has been a steadfast mentor and advisor to many founders. Ron has also supported a variety of cyber nonprofits and think tanks, with both his substantive expertise and through philanthropic funding.
From 2002 to 2016, Ron was the co-founder and CEO of Tenable Network Security. Under Ron’s leadership, Tenable grew to 20,000 customers, raised $300m in venture capital, and grew revenues to $100 million annually; this positioned the company for a successful IPO in 2018, where it was valued at $3 billion.
Prior to founding Tenable, Ron was a cyber industry pioneer. Ron developed Dragon, one of the first commercial network intrusion detection systems, and he also ran risk mitigation for one of the first cloud companies. While serving as a US Air Force officer, Ron deployed network honeypots in the mid 90s for the US Defense Department (DOD) and served as a penetration tester at the National Security Agency (NSA), participating in some of the nation’s first cyber exercises.
For these efforts, Ron received in 2020 both the Northern Virginia Technology Council Cyber Investor of the Year award and the Baltimore Business Journal Power 10 CEO award.
Wendy Nather is the Senior Research Initiatives Director at 1Password. She previously led strategic engagements at Cisco and served as Research Director at both the Retail ISAC and 451 Research, where she covered application security, threat intelligence, security services, and emerging technologies.
A former CISO in both the public and private sectors, Wendy headed IT security for the EMEA region of Swiss Bank Corporation’s investment banking division (now UBS) and for the Texas Education Agency. She is co-author of The Cloud Security Rules and has been recognized as an SC Magazine “Woman in IT Security Power Player,” a Reboot Leadership Awards “Influencer,” and a 2021 inductee into the Infosecurity Europe Hall of Fame.
Wendy serves on the board of Sightline Security, is a Senior Fellow with the Atlantic Council’s Cyber Statecraft Initiative, and sits on the IST Ransomware Task Force steering committee. She is based in Fort Collins, Colorado.
Alex Wood has over 20 years of experience in Information Security is currently the CISO for The Anschutz Corporation. Alex has managed security programs and services at major companies across verticals, including telecommunications, energy, healthcare, entertainment, travel, and financial services. Additionally, Alex has served as a Director on the International Board of the Information System Security Association (ISSA) and is Past-President of the ISSA Denver Chapter. Alex is also Co-host of the Colorado = Security Podcast. Alex received a Bachelor of Arts from Grinnell College and a Masters of Applied Science in Computer Information Systems Security from the University of Denver.
Jon Fredrickson is the Information Security and Privacy Officer for Blue Cross and Blue Shield of Rhode Island. He graduated from the University of Rhode Island with a B.A. in Economics. Prior to joining BCBSRI, Jon was the CISO of Southcoast Health and has had various other IT Security positions in healthcare, services and manufacturing. During the past 15 years of working in the IT security field, Jon has developed a pragmatic approach to implementing cybersecurity solutions and assisting his organizations in properly measuring and managing cyber and privacy risk. Jon is a member of the Association for Executives in Healthcare Information Security, the Healthcare Sector Coordinating Council (HSCC) Cybersecurity Working Group (CWG), and is a Certified Information Security Manager.
Jim Hietala, is Vice President, Security for The Open Group, where he manages security and risk management programs and standards activities, He has participated in the development of several industry standards including O-ISM3, O-ESA, and the Open FAIR Body of Knowledge. He led the development of the Open FAIR standards and the certification program for risk analysts, and a joint Open Group and SIRA risk management practices survey project. He also led the development of compliance and audit guidance for the Cloud Security Alliance’s v2 publication.
