virtual data center?

Co-loCated with

May 17-21, 2009 n las Vegas, NVMaNdalay Bay CoNVeNtioN CeNter

save up to $600 when you register by april 17Colleague Connections guaranteed –

Your organization’s implementing a Virtual data Center? Beware of the risks. 9 New economy

security Management Challenges? We’ll

give you tools. 11 Trend Micro’s John Maddison says

security works in the Cloud. But does

compliance? 7 Verizon’s Peter Tippett knows where the Crime really happens. 7 Is Web 2.0 a

security threat? 8 New government: security

boon or Compliance Bear? 10 Plus: Why you

can’t afford not to attend SX (see inside).

decisive security Management in turbulent times

room rates as low as $69!

Csisx.com

save up to $600 when you register by april 17. register today at Csisx.com.

CSI SX ’09: Security Exchange

Today, organizations are increasingly migrating to cost-saving technologies, such as virtualization, Web-based applications and services, and cloud computing—all coming with a certain level of security risk.

Security threats are ever-present and increasing in sophistication and aggression, We’re seeing an upward trend of more and more data breaches and amplified insider threats.

Regulatory requirements are only becoming more stringent. Forty-six states now have a data breach notification law on the books, and stiffer security regulations are expected to come from the federal government.

Add to that increasing pressure on security personnel to demonstrate the value of their security investments, as well as a security industry long overdue for reform—and it’s clear that security professionals must not only work to stay on top of their game, but are challenged as never before.

CSI SX will give you the information and tools you need to act decisively and confidently in this new environment. You’ll increase your value to your organization, as you help your organization increase its value and protect its assets. We’ll help you avoid making costly mistakes. You can’t afford not to be here.

who attends Csi?CSI SX ’09 is designed for information security and IT professionals of all levels: executives, directors, managers and staff. Anyone needing to gain an understanding of the emerging security issues and solutions that will affect the industry, how security fits into the overall organizational business plan, or the technical aspects of security will benefit from this event.

decisive security Management in turbulent times

the right ProgramWe’ll focus on the security implications of virtualization, web 2.0 applications and cloud computing; plus compliance issues. We’ll also give you management tools and strategies useful anytime, but indispensible during this period of uncertainty and turmoil.

the right FormatCSI SX features unique extended multi-speaker “summit sessions”, where topics are discussed in-depth from a variety of perspectives. Attend all sessions in a summit track or mix and match. Either way, you’ll receive benefit far beyond that of traditional conference lectures.

the right speakersWe’ve invited keynotes, speakers and moderators who will keep the discussions focused and make sure you have a comprehensive understanding of the topic and issues. You’ll hear from your peers as well—and, you’ll get to know them.

interop exhibitionPlus, you get free admittance to the Interop Exhibition, collocated with CSI SX. The Exhibition features over 400 IT exhibitors, including over 100 vendors of security and compliance products and services.

CSI SX is your best defense against today’s unprecedented challenges. Save up to $600 when you register early — make plans today to attend.

thank you to our Csi sX sponsorglobal education sponsor

Media sponsors

Csi Members receive $200 off Csi sX – Join now and save. see page 14. 1

Table of Contents

table of Contents

2 ConferenceataGlance

4 WhattoExpectatSX

5 CSISXMainThemes

6 general sessions

8 web 2.0 summit

9 Virtualization summit

10 Compliance summit

11 Management tools

12 Post-Conference workshops

14 Membership

15 Hotel&Travel

16 RegistrationInstructions

Make the Connections at Csi sX

There are lots of excellent reasons to attend CSI SX: Security Exchange this May. In today’s uncertain (or certainly unfavorable) economic climate, security cannot take a back seat. Cyber crime is on the rise, cost-saving measures your company may be employing can open up new vulnerabilities, and compliance regulations are growing more complex by the day.

But one excellent, and perhaps even top of the list reason to attend SX, are the opportunities to meet others. I’ve always introduced people informally at CSI events, but now it seems more important than ever that you have enough friends in the business. The smaller setting of CSI SX allows and encourages the meaningful type of exchange that extends even beyond the event.

So if you’d like to ensure at least a connection or two, send me a note after completing your (paid please) SX registration and I’ll set up a short, confidential phone call with you to get a sense of your interest areas and projects and work up a list of a few other people you definitely should meet.

We know budgets are tight. For the first time ever, CSI SX gives you the value-add of significant highlights of all four breakout tracks. It’s a chance to “attend” the entire conference and like getting four tracks for the price of one (see page 3).

Additionally, we’ve negotiated rates at the conference hotel and nearby hotels well below 2008 prices, from as low as $69/night (see page 15).

I look forward to speaking with you, and seeing you in May.

Robert Richardson, Director, [email protected]

P.S. If you’re not a CSI Member, join now! Save $200 off the conference registration by joining CSI for only $224, and we’ll keep you updated all year long (see page 14).

P.P.S. We’ve made the 5-day package an especially good deal—and fully maximize your travel budget also. Add workshops to the conference (see page 12).

about Computer security institute (Csi)

As the original and leading information security membership organization, Computer Security Institute (CSI) is where security professionals go to learn and share the latest thinking on security strategies and to meet other members. CSI holds two conferences annually—CSI SX in the Spring and the CSI Annual Conference in the Fall—as well as other events and webcasts throughout the year. CSI publishes the Alert reports (members-only) as well as the annual CSI Computer Crime & Security Survey.

save up to $600 when you register by april 17. register today at Csisx.com.2

Conference-at-a-Glance

WeB SuMMIT

9:30 am - 11:45 am

1:30 pm - 2:30 pm

12:00 pm - 1:30 pm

geNeral sessioNs iNClude:



2:45 pm - 3:45 pm

4:00 pm - 5:00 pm

VIrTualIzaTIoN SuMMIT CoMPlIaNCe SuMMIT

9:30 am - 11:45 am

1:30 pm - 2:30 pm

12:00 pm - 1:30 pm lunch

lunch

2:45 pm - 3:45 pm

4:00 pm - 5:00 pm

9:30 am - 11:45 am

Slimmerbudgetsmayleadtoslimmerinfrastructure,whichmaymeanmorphingbusinessfunctionsintocloudcomputingandWebapplications;buttheWebisadangerousplace.Jeremiah grossman,founderandchieftechnologyofficerofWhiteHatSecuritywillguideadiscussionofemergingthreatstoWebsecurity—howboth vulnerabilities and legitimate functionalities can be exploited,andhowsocialnetworkingandInternetmobiledevicesexacerbatethedangers.

Usingvirtualizationtoconsolidatethedatacenterwill save your organization moneyonhardwareandoperationalcosts.Yetavirtualizeddatacentermightcostmoretomanageandsecure.steve orrin,directorofsecuritysolutionsforIntelwillguideadiscussionontheexploits and challenges specific to virtualized environments,andhowthey’recompoundedinthecloud.

RatherthanteachingmillionsofWebsitedeveloperstowritesecurecode,wouldn’titjustbeeasiertohavea few truly secure web browsers?ExpertsledbyJahan Moreh,vicepresidentofengineeringofU1Technologies,discusshowbrowsersandWebplatformscanbeeasily exploited,howtheycanbeimproved,andhowGoogleChrome,IE8,andmobilephoneplatforms’browsersmatchup.CloudcomputingmaymakeWebsecuritymattersworse,butcloud-basedsecuritytoolsmaymakeallsecurityeffortseasier.

Havingfullyoutlinedtheproblem,todaywefocus on solutions.Howdowehardenthesoftinfrastructureunderbelly,securethevirtualmachine’sperimeterandprotectalltheconnectivetissueinbetween?Expertsoutlinewhat solutions are currentlyavailableandwhatsolutionsarestillneeded.Thedayendsbydemonstratinghowvirtualization itself can be applied to improve security.

WeB SuMMIT VIrTualIzaTIoN SuMMIT CoMPlIaNCe SuMMIT

suNday, May 17

MoNday, May 18

tuesday, May 19

robert richardson, Director,CSIthe economy’s effect on security

Jerry dixon, InfragardCyber security Priorities for the New administration

tanya Forsheit and Nolan goldberg, ProskauerRoseLLPCan you Prove Compliance in the Cloud?


Conference-at-a-Glance Conference-at-a-Glance

social engineering and Vulnerabilities in the equities Markets

Dave Marcus,DirectorofSecurityResearchAvertLabs,McAfee

CoMPlIaNCe SuMMIT

Vendor Consolidation: are you winning or losing?

John Murphy,Principle,DataForesight

the risk assessment toolkit Tom Hasman, InformationAssuranceAnalyst,

SRAInternational,Inc.Daniel Van Belleghem,VP,InformationAssurance,

NCIInformationSystems

slaying the red dragon: Countering the advanced Persistent threat

Wendi rafferty,DirectorofFederalServices,Mandiant

lunch

lunch

Balancing act — empowering technical workers without increasing security risksCheryl Traverse,PresidentandCEO,Xceedium

Beyond tools: Making Progress towards holistic sdlC security

ramon Krikken,Analyst,BurtonGroup

Therearealreadytoomanysecurityandprivacyregulationstokeeptrackof,andnewthreatsandanewpresidentialadministrationmayaddmore.Jeremiah dewey,ITsecurityofficeroftheNationalWeatherServiceandBrad smith,directoroftheComputerInstituteoftheRockies,alongwithotherexperts,willaddresstheoverriding challenges of all compliance efforts,plusparticularchallengesofindividualregulations.

Ondaytwo,expertsledbyM. Peter adler,partneratPepperHamiltonLLP,detailhowtoleverageoperationalcontrolsandaunifiedcomplianceframeworktoobtain,maintainandprovecompliancewithaglutofregulationsinamoreeffectiveandlessonerousway—makingbothyouandyourauditorshappy.Weincludeadiscussionofhowsecurityregulationsandstandardsmaychangein2009and2010,andhowtheyshouldchangetoaccommodatevariousriskmodelsandbe more effective than a paperwork exercise.

Post Conference Workshops

Wednesday, May 208:30 am – 4:30 pm

• Computer Forensics Kickstart

• Creating an integrated Compliance Framework

• get the Jump on security: Vista (win 7)

• your First 90 days: how to hit the ground running in information security

Thursday, May 218:30 am – 4:30 pm

• Building an information security Program

• enterprise security architecture: a Business-driven strategy

• how to Complete a risk assessment in a week or less

CoMPlIaNCe SuMMIT

Bonus sX Videos

Can’t be in four sessions at once? We’ve got you covered—we’ve got video-cams whirling in all four breakout rooms, cause you’re going to need all this stuff.

attendees will have exclusive access to substantial video highlights of all four tracks after the event.

tanya Forsheit and Nolan goldberg, ProskauerRoseLLPCan you Prove Compliance in the Cloud?

MaNageMeNT ToolS

MaNageMeNT ToolS

Plus other sPeaKers

Plus other sPeaKers

Plus other sPeaKers

dr. Peter tippett, Verizoninside the worst data Breaches

lisa lorenzin, JuniperNetworksNaC deployment on speed

John Maddison, TrendMicro anti-Malware for the Cloud


What to Expect at SX

Enterprise security programs are a unique mixture of strategic management and keen understanding of complex technologies and technological issues. CSI SX: Security Exchange builds on a 35-year CSI tradition of building technical expertise with strategic decision-making as the end goal.

Each day at CSI SX begins with a two-hour general session. Rather than having one keynote take up a full hour (tepid introductory joke, brief history of the Internet, once every three conferences someone makes you wake up and notice), we bring you three or four shorter presentations. The hit rate is instantly higher. And each presentation is designed to define and highlight key issues that you’ve told us need to be front and center:

• Virtualization• Web2.0• Compliance• CloudComputing

And running throughout it all—how are you going to manage change in a climate that is wracked with uncertainty?

summit sessionsThe general session presentations lead somewhere. There are plenty of conventional conference sessions to attend, but there are also three series of Summit Sessions. These are moderated sets of sessions within the conference where a select group of experts engage in open forums, brief presentations and debates on a variety of “hot button” topics—diversity of opinion guaranteed.

You’ll come away with a fuller understanding of the issues and how they affect your organization, allowing you to draw your own conclusions and action plan.

the right Program, the right Format, the right People

interop exhibitionWith more than 400 exhibitors, the Interop Expo is full of new technologies and ideas waiting to be discovered. Identify IT solutions to cut costs, increase revenue and significantly improve your competitive advantage.

Comprehensive IT Expo

Tuesday,May19•10:00am–5:00pmWednesday,May20•10:00am–5:00pmThursday,May21•10:00am–3:00pm

See what’s new, learn what’s cutting edge and identify technology must-haves for your business. Interop is the best place to gather information to build your IT roadmap.

Cloud Computing Zone. The cloud is coming. Sort through the hype and identify the right solutions for you.

Security & Compliance Zone. Evaluate the latest solutions to protect your network and your business.

Mobile Business Zone. Mobility is hotter than ever. Find the best way to enable mobile workers.

Start Up City. Meet emerging companies with innovative solutions for the business technology marketplace.

wisdom exchangedAnd a lot of business cards too. The key to a successful conference is meeting people you can learn from and add to your network. You’ll meet people here— it’s that kind of vibe. You’ll find that they’re tackling the same tough jobs that you are, dealing with the same issues of internal support. A lot of the people you’ll meet are top-notch CSI speakers. The overall attendee to speaker ratio at last year’s SX approached 5-to-1. And our speakers want to be there—they don’t jet in and out. It’s an experience you can’t match anywhere else.


CSI SX Main Themes

VirtualizationThetwo-dayVirtualizationSummit‘track’at SX will provide in-depth answers to questions such as:

•Whatarethetruecostsofrunningandsecuring a virtual environment?

•Howdothevulnerabilitieswithinand possible exploits of virtualization technology stack up against the benefits?

•Canvirtualizationbeusedasasecuritytool?

•Whataretherisksofusingvirtualizationin a cloud environment?

•Howdoyoudetermineifvirtualizationisright for your organization?

We’ll also discuss virtualization’s use in cloud computing—how cloud providers can assume some of the management challenges of a virtualized environment, and how the cloud makes some virtualization security risks even more threatening.

Web 2.0Thetwo-dayWeb2.0Summit‘track’at SX will provide in-depth answers to questions such as:

• Whatisonyoursecurebrowserwishlist, and how do Microsoft Azure, Google Chrome, Internet Explorer 8 and other projects stack up?

• Areanyofthenewbrowsersandplatforms truly prepared for cloud computing, and is the cloud is ready to handle business-critical activities?

• Howdoyoubalancethebenefitscloudcomputing can provide (great defenses against denials of service), against the risk of exacerbating the Web’s already considerable security and compliance troubles?

• Howdoyoumeasuretheeffectivenessof your organization’s security efforts?

TheWeb2.0SummitwillshowyouhowtoembraceWeb2.0nowassecurelyas is currently possible, and how to effectively work with Web developers now to head off the security problems of the future.

ComplianceAtthetwo-dayComplianceSummit‘track’of SX, we’ll address these questions and more:

• Canweimplementvirtualizationandstay compliant with PCI?

• Whataffectwillthenewpresidentialadministration have on security legislation?

• Whatchangesshouldbemadetosecurity and privacy regulations to make compliance efforts less burdensome and to enforce measures that truly advance security?

• Whatwillthefuturewillbringforprivacyand security regulations and standards?

You’ll come away knowing how to use security metrics, operational controls and a unified compliance framework to reduce certification and accreditation complexities, streamline compliance efforts and provide auditors and executives with the information they need.

Management ToolsAn unprecedented economy brings a host of new security concerns—now is the time to learn how to address them. In addition, our new government may bring about some changes that you should be prepared for.

The sessions in this track will focus on questions such as:

• Intheeventofamergeroracquisition,will your organization inherit new compliance complications?

• Iftheproviderofyourperfectsecuritysolution goes out of business, are you prepared with Plan B?

• Howdoyoustaysafeduringthisperiodof uncertainty?

Cloud TamingNo single conference track could rope in the entire topic of cloud security, so we’ve developed CSI SX to offer focal points on cloud security throughout. Starting withtheVirtualizationSummitonSunday,continuing with numerous sessions on Web2.0,rightthroughtotheGeneralSessions on Tuesday, you’ll learn how to tame the clouds.

There are a few driving forces that are radically changing security this year. We are focusing SX in these areas—new technologies your organization will be exploring—that can’t be ignored. CSI SX will help you weigh security risk against business value, and show you how to keep your organization secure, no matter which road you’ve gone down.

“ From a conference organization perspective, I think that the CSI setup was revolutionary. I’d like to see this kind of discussion become the focus at more of the conferences I attend.”

– Pamela Dingle, Information Systems Integrator, Nulli Secundus


General Sessions

Lisa Lorenzin is a Principal Solutions Architect with Juniper Networks, specializing in security solutions, and a contributing member of Trusted Network Connect (TNC), a work group of the Trusted Computing Group (TCG) that defines an open architecture and standards for endpoint integrity and network access control. She has worked in a variety of Internet-related roles for the past 13 years, with more than a decade of that focused on network and information security. Lorenzin’s experience in data center, government and enterprise environments, as well as her active participation and service in local user groups, has brought her a thorough understanding of the challenges network administrators and users face in today’s world of expanding regulations and increasing security threats.

John Maddison, vice president of Core Technology Solutions, John Maddison is responsible for product management of all core technology solutions including antivirus, anti-spam, web threat protection, and behavioral monitoring solutions. John has held several positions at Trend Micro, including general manager of the network security services (NSSG) team and director of product management for the gateway and client service products. Prior to joining Trend Micro,hewasseniordirectorofproductmanagementatVinaTechnologies.Hehasalsohelddirectorofproductmanagementpositions at Lucent Technologies and Octel Communications.

Robert Richardson has served as Director at CSI since 2003,havingworkedITinvariouscapacitiesfortwentyyears.He’sgivenkeynotepresentationsonthreecontinents,oftenspeaking about the CSI Computer Crime and Security Survey, an undertaking he directs each year. Based outside Philadelphia, he occasionally serves as an adjunct teacher of computer science at Swarthmore College.

Peter Tippett is vice president of Innovation and Technology forVerizonBusinessandisthechiefscientistofthesecurityproduct testing and certification organization, ICSA Labs. An information security pioneer, Tippett has led the computer securityindustryformorethan20years,initiallyasavendorofsecurity products, and over the past 16 years, as a key strategist. Heiswidelycreditedwithcreatingthefirstcommercialanti-virusproductthatlaterbecameNortonAntiVirus.Tippettisbest known for his creation of enterprise risk metrics, and large risk intelligence and compliance management programs for enterprises. Tippett has written many articles and papers on IT and information security and was the founding executive publisher of Information Security Magazine.

Jerry DixoncurrentlyservesasInfragard’sVicePresidentforGovernmentRelations.HeisalsotheDirectorofAnalysisfor Team Cymru, and was the former Executive Director of the National Cyber Security Division (NCSD) & US-CERT, of the DepartmentofHomelandSecurity.Hecurrentlyservesasamember of the CSIS Cyber-Commission on Cyber-Security for the 44th President and a member of the Advisory Board for Debix, an Identity Theft Protection Company.

Tanya Forsheit is a partner in the Litigation and Dispute Resolution Department of Proskauer’s Los Angeles office, and a member of Proskauer’s Privacy and Data Security Practice Group. Tanya has extensive experience handling complex commercial and appellate litigation for corporate and individual clients before federal and state courts at all levels. Tanya is certified as an information privacy professional by the International Association of Privacy Professionals (IAPP) and frequently writes and speaks on recent developments in federal and state privacy laws. She is the lead editor and a frequent contributor to the Proskauer Privacy Law Blog, (proskaueronprivacy.com),selectedin2008forinclusionintheLibrary Of Congress historic collection of Internet materials.

Nolan M. Goldberg is an associate in the Litigation and Dispute Resolution Department and a member of the Patent Law Practice of Proskauer Rose LLP in New York. As an intellectual property litigator, his practice focuses on patent, trademark, and trade secret litigation and counseling. Mr. Goldberg’s work has included patent and trade secret litigations and negotiations concerning optical cross-connects; voice overInternetprotocol(“VoIP”);barcodescanners;computernetworking; financial business methods and software, including securities settlement, fail management and trade execution and reporting software; data storage; handheld computers, least-cost routing, pharmaceuticals; cardiac electro-stimulatory devices; and prosthetics.

We’ve invited these speakers and several others to fully update you on the challenges in their respective areas

of expertise, and show you how to go about thinking about, finding and implementing the solutions.

speaker Bios


General Sessions

sunday, May 17Robert Richardson Director, CSI

The Economy’s Effect on Security: How is the economic downturn affecting security budgets and security companies’ stock prices?

Despite several high-profile acquisitions, the security industry is faring better than the rest of the market. Enterprise security budgets are similarly insulated from the deadliest of the budget cuts. Will it last?

Peter Tippett Vice President of Innovation and Technology, Verizon Business

Inside the Worst Data Breaches: How do the worst data breaches REALLY happen?

In2008theVerizonBusinessInvestigativeResponseTeamreleased a report that compiled forensic data gleaned from over 500 forensic engagements handled by the team over a four-year report. The results were both frightening and surprising. At CSI SX PeterTippett,vicepresidentofinnovationandtechnologyatVerizonBusiness,willdigintothemostexcitingfindingsofthe2009report.

Monday, May 18 Jerry Dixon Vice President, Government Relations, Infragard

Cyber Security Priorities for the New Administration: How should the new administration change government policies

and practices to protect the nation’s critical infrastructures from cyber threats?Are new security and privacy regulations on the horizon—and if so will they be a welcome sight or a worrisome one? Jerry Dixon, member of the CSIS Commission on Cyber Security, will highlight the most exciting elements of the Commission’s Recommendations for the 44th Presidency, and update us on how the recommendations have been received by the new administration, the legislature and the security industry.

John Maddison Vice President, Core Technology Solutions, Trend Micro, Inc.

Anti-Malware for the Cloud: How are attackers and malware authors already capitalizing on cloud computing,

and what’s their next move? Attackers are already darkening the promise of cloud computing and very little has been done to deal with it. On the other hand, some security vendors see ways to embrace the cloud as a better way to supply security services. On either side of the cloud picture, how will anti-malware companies respond?

tuesday, May 19Tanya Forsheit Partner,Proskauer Rose LLP

Nolan Goldberg Associate,Proskauer Rose LLP

Can You Prove Compliance in the Cloud?: How can cloud users prove compliance with security, privacy and e-discovery laws without access to logs? Cloud resources are owned by a third party—who may not share their log files with you, auditors or forensic investigators. Cloud users cannot be sure what server they’re accessing, who else can access it, where in the world their server is located or when the data moves to another server. With cloud computing’s superior load-balancing capabilities, scaling issues melt away—but so do forensic data. Which legal responsibilities can you pass on to the cloud service providers and which must you answer for?

Lisa Lorenzin Principal Solutions Architect – Security Solutions, Juniper Networks

NAC Deployment on Speed: Want to see someone else rapidly deploy an enterprise NAC solution

before you attempt it yourself? Before heading to the Interop exhibition hall—open to all CSI attendees Tuesday through Thursday—get a glimpse into how NAC was deployed in the Interop network operations center; built, secured and maintained by engineers from over 20companiesinlessthanthreeweeks.Thiscasestudyshows how to tackle (and how not to tackle) NAC’s biggest challenges—redundancy, cross-platform supplicants, unmanaged endpoints, a heterogeneous environment and mission-critical user resources.


Web 2.0

MorphingmorebusinessfunctionsintoWeb2.0applicationsoffersbothirresistiblebusinessopportunities and undeniable security threats. The security management challenges posed byWeb2.0applications,suchassocialnetworkingsitesandmicroblogs,arenumerous,asare the security vulnerabilities inherent in the underlying Internet infrastructure and scripting languages.Howdoyoubalancethebenefitsagainsttherisks?

sunday, May 171:30 pm – 3:45 pm

Criminals are using the Web as a vector, and crafting more sophisticated, exceptionally targeted attacks (often capitalizing on the uncertain economy). Who are the prime targets? The Web Summit begins by examining pervasive vulnerabilities in Web-based applications and Web programming languages, and then digging into the myriad ways attackers can and are exploiting these vulnerabilities. The discussion continues with how to assess the effectiveness of your efforts to both secure your organization’s own Web site and protect your sensitive data from attacks launched from other vulnerable Web sites.


Who needs to exploit vulnerabilities when there are plenty of malicious ways to use legitimate applications? Social networking sites and Internet-capable mobile devices have created demand for an explosion of unvetted Web apps, and have created a culture in which personal information, business information, images, videos and audio files are all widely (and sometimes indiscriminately) shared. Is the answer simply to block those sites and devices? This segment of the Web Summit will discuss whether there are better ways to effectively manage these risks to data security—even when end users are off the clock and outside the network.

Monday, May 181:30 pm – 2:30 pm

Criminals have already had grand success using the Web as an attack platform. Will cloud computing make attackers’ job even easier, and exacerbate the already considerable risks of using Web applications for business-critical functions? On Monday, the Web Summit examines the risks of cloud computing, taking a look at what some cloud service providers are currently doing to secure cloud users’ assets.


Despite the risks, cloud computing can also be used for good. Monday afternoon we’ll look at how the widely distributed nature and superior load-balancing capabilities of the cloud can provide a tremendous defense against denials of service. Further, at how cloud-based and other Web-based security tools may actually bolster security efforts.


What about the browser? A browser is in a place to both protect the local device from Web-borne threats and thwart attacks that take place solely within the Web; yet none of the market-leading browsers are having success at either aim. The Web Summit wraps up by deciding what we should ask of next-gen browsers and Web-based platforms, and examining how IE8 and Google Chrome stack up.

ModeraTors

JereMIaH groSSMaN

FounderandChiefTechnologyOfficer,WhiteHatSecurity

JaHaN MoreH

VPofEngineering,U1Technologies

sPeaKers

TreY ForD

Director,SolutionsArchitecture,WhiteHatSecurity,Inc.

raFal loS

SeniorSecurityConsultant,HewlettPackardApplicationSecurityCenter

DaVID PerrY

GlobalDirectorofEducation,TrendMicro,Inc.

eDWarD SCHWarTz

ChiefSecurityOfficer,NetWitness

rYaN SHerSToBIToFF

ChiefSecurityEvangelist,PandaSecurity

MICHael SuTToN

VP,SecurityResearch,Zscaler

rYaN WalTerS

DirectorofSecuritySolutions,CSL,NorthropGrumman

web 2.0 summitsunday, May 17 & Monday, May 18 • 1:30 PM – 5:00 PM


Virtualization

While virtualization’s greatest security benefit is how it enables resource isolation (i.e. putting each egg in its own basket), virtualization’s greatest security risk is how it enables resource consolidation (i.e. putting too many eggs in one basket). And while virtualization saves money on hardware and operational costs, a virtual environment could costmoretosecure.Howdoyoudecideonwhetherornotvirtualization is right for your organization?

sunday, May 171:30 pm - 2:30 pm

The virtualization summit begins with a run-down of the technological security risks of a virtualized environment, including: vulnerabilities within the virtualization software itself; virtualization-based malware, and; exploits of legitimate, but poorly secured, virtualization features, like live virtual machine migration. The speakers will then discuss how realistic these threats are today.


The challenges of managing a virtualized environment may pose a greater threat than the technological risks. The ease with which virtual machines can be copied and moved may cause “virtual machine sprawl,” which ups the difficulty of keeping an accurate inventory, proving compliance and managing patching. The summit speakers will delve into these and other virtualization management challenges.


Virtualizationtechnologyiswhatmakescloudcomputingpossible.Yetwhenyoustoredatainthecloud, you have no access to the underlying infrastructure—you must rely on cloud service providers to do that. During this part of the summit, speakers will discuss cloud service providers’ security agendas, and what cloud users can do to secure their virtual machines stored in the cloud.

Monday, May 18 1:30 pm - 2:30 pm

Though security managers cannot sink their hands into the guts of a cloud provider’s virtualization infrastructure, they can within their own networks. Monday, the summit begins by discussing solutions to securely roll out and configure the underlying virtualization infrastructure, and how to further lock it down using security appliances and trusted computing methods.

Monday, May 182:45 pm - 3:45 pm

Soft underbelly aside, a virtualized environment has additional processes in need of securing, for example, the interactions between different virtual machines residing on the same hardware. The summit speakers discuss why security tools optimized for a virtualized environment are necessary, andprovideupdatesonhowsecurityvendorshaveappliedtheVMsafeAPIsreleasedbyVMware.

Monday, May 184:00 pm - 5:00 pm

But virtualization’s not all bad. The speakers end the day with an education in how virtualization itself can be used as a security tool, by harnessing its superior powers of resource isolation and other capabilities. The summit closes as speakers and attendees together add everything up and calculate whether or not your virtualization will benefit your organization more than it will cost.

ModeraTor

STeVe orrIN

DirectorofSecuritySolutions,Intel

sPeaKers

JoSH CorMaN

PrincipalSecurityStrategist,

IBMInternetSecuritySystems

STeVe HaNNa

DistinguishedEngineer,Juniper;TrustedComputingGroup

MICHael legarY

FounderandExecutiveConsultant,

Seccuris,Inc.

BIll MCgee

FounderandVicePresident,

ProductsandServices,ThirdBrigade

DeNNIS Moreau

ChiefTechnologyOfficerandFounder,

Configuresoft

Virtualization summitsunday, May 17 & Monday, May 18 • 1:30 PM – 5:00 PM


Compliance

IT, legal, human resources and accounting departments all have different standards and regulations to comply with, with different auditing processes and different reports to generate. Even infrequentchangestoFISMA,PCI,SOX,HIPAA,GLBA,HSPD-12,FDCC,SAS70orBASELIIcanmake compliance seem impossible.


You want to be secure. You want to be compliant. You want to support your business by adopting a risk-based approach. Is it possible to achieve all three of these aims, and retain your sanity? The Compliance Summit begins to answer this question by first, examining the overriding operational challenges common to all compliance efforts—including how to collect and manage a glut of logs and how to maintain business operations during audits and forensic investigations.


There’s no way to keep up with without swallowing at least a spoonful of alphabet soup. The summit continues by examining a few specific challenges of individual regulations, including government contractors’ FISMA responsibilities and virtualization’s impact on PCI-DSS.


The road to compliance should not be traveled solely on the power of paperwork. This segment of the Compliance Summit will outline how to achieve compliance by building upon a compliance-savvy architecture and establishing compliance-savvy operational controls.


There’s got to be an easier way, right? Isn’t there a way to streamline the process so that many requirements are satisfied at once, instead of in piecemeal fashion every time a new rule comes out? Isn’t there a way to generate a report that will make all the auditors happy? On day two, the Compliance Summit describes how to harness the power of a unified compliance framework, making it possible to maintain and prove compliance with multiple regulations in a more efficient and less onerous way. Untangle certification and accreditation complexities. Provide auditors, courts, forensic investigators and executives with the information they need. Free yourself from the trappings of alphabet soup.


At the end of the day, are any of these regulations improving security and privacy? The Compliance Summit closes with a discussion of the changes lawmakers and regulatory agencies are considering and how laws and standards should be changed to make them more effective and less onerous. Should regulatory bodies change their mandates, so they are based on standards, allow for varying risk models and adapt to ever-changing technologies and attacks? Are standards bodies keeping up with the times, and what challenges should they provide guidance on next?

ModeraTors

M. PeTer aDler

Partner,PepperHamiltonLLP

JereMIaH DeWeY

ITSecurityOfficer,NationalWeatherService

BraD SMITH

Director,ComputerInstituteoftheRockies

sPeaKers

JaMeS BIggS

President,JDBiggs&AssociatesInc.

CHrISToPHe BrIgueT

ChiefTechnologyOfficer,Exaprotect

DorIaN CougIaS

FounderandLeadAnalyst,UnifiedComplianceFramework

CHrIS FarroW

Director,Configuresoft

JaMeS FINN

Principal,BusinessRecovery,Unisys

roBerT MarTIN

PrincipalEngineer,MITRECorporation

JoHN PIroNTI

ChiefInformationRiskStrategist,Getronics

Compliance summitsunday, May 17 & Monday, May 18 • 1:30 PM – 5:00 PM


Management Tools

social engineering and Vulnerabilities in the equities Marketssunday, May 17, 1:30 pm – 2:30 pm

daVe MarCusDirectorofSecurityResearchandCommunications,AvertLabs,McAfee

In this sensitive economy, stock prices are naturally prone to vacillation, but in tough times, stocks are also in particular danger of intentional manipulation by cybercrimi-nals. Learn how criminals can manipulate stock prices by exploiting the equities and derivatives marketsí vulnerabilities and predictable patterns—like Microsoft stock’s predictable fluctuations on and around Patch Tuesday. Discover how criminals can disguise their profiteering by purchas-ing stock in forms like put-out options. Hearrealexamplesofstockexploitationand learn how to protect your companyís stock from the same dangers.

Vendor Consolidation: are you winning or losing?sunday, May 17, 2:45 pm – 3:45 pm

JohN MurPhyPrincipal,DataForesight

A growing trend of acquisitions is narrow-ing the security vendor market to a small number of monolithic security providers. The integration and ease of administration with such a provider can be seen positive-ly, yet the applications your organization is forced to implement may not be consistent with your organization’s goals or needs. Which do you choose—a single vendor or the best of breed? This discussion will explore all aspects of this challenging decision, including how an organization of any size can use vendor consolidation to its advantage and what criteria to use in deciding whether or not to buck the con-solidation trend.

the risk assessment toolkitsunday, May 17, 4:00 pm – 5:00 pm

toM hasMaNInformationAssuranceAnalyst,SRAInternational,Inc.

daNiel VaNBellegheMVP,InformationAssurance,NCIInformationSystems

You know that risk assessments can be leveraged to make your security program more efficient and effective—but do you have the tools to conduct an efficient and effective risk assessment? Get famil-iar with the best tools and techniques, including automated tools for vulnerability assessments and analytical techniques for facilitating interviews and measuring management and operational controls. Attendees will take away an understanding of: NIST security controls, a comprehen-sive risk assessment process, techniques for interpreting and documenting assess-ment results, and best practices for the presentation of results.

slaying the red dragon—Countering the advanced Persistent threatMonday, May 18, 1:30 pm – 2:30 pm

weNdi raFFertyDirector,FederalServices,Mandiant

A knowledgable attacker, with extensive resources at their disposal, is crafting an attack aimed directly at your organiza-tion. Learn what specific threat vectors APT attackers typically use, the attackers’ methods for moving laterally throughout a network once they have compromised as little as one machine and how attacks are escalated once the victim’s incident response capabilities have been observed. Areal-lifeVPNsubversionattack,andtheappropriate tactical and strategic coun-termeasures, will be examined in detail. Leave with strategies you can immediately employ to fight targeted attackers within your own organization.

Balancing act—empowering technical workers without increasing security risksMonday, May 18, 2:45 pm – 3:45 pm

Cheryl traVersePresidentandCEO,Xceedium

Your employees are your greatest asset, but they also represent an increas-ing threat to your business reputation, continuity and proprietary information, as do contractors, consultants, vendor partners and others who require access to critical IT infrastructure. Additionally, many companies struggle with the cost and complexity of automating compliance for high-risk users. Security awareness, policies and education provide a critical first line of defense. This session will give you further tips and best practices to bal-ance IT security with operational efficiency, and demonstrate ways to enable—even empower—high-risk internal and external users without exposing the organization to unnecessary risk.

Beyond tools: Making Progress towards holistic sdlC securityMonday, May 18, 4:00 pm – 5:00 pm

raMoN KriKKeNAnalyst,BurtonGroup

For many organizations the term “software security” simply means the use of bug testers; but while these tools are important, they may require overwhelming effort for underwhelming results. Implementing people, process, and technology controls in the software development lifecycle ensures that the highest levels of assurance can be achieved. Starting at the concept phase, having the right people perform the right tasks in the right way creates a holistic approach with the broadest possible coverage. By creating combinations of controls, overall effectiveness and efficiency increase, and you ensure that your organization puts scarce resources to the best use.

Howcanintelligent,effective,proactivesecuritybeachievedamidgreatuncertainty?Theglobaleconomyisstruggling. The variety of security service providers and the organizations that employ them are being winnowed down by mergers and acquisitions. Burgeoning legions of laid-off workers herald a growing insider threat. Attackers are artfully taking advantage of uncertaintytocommitnewtargetedattacks.Riskassessmentbecomesfarcicalwheneverythingseemsrisky.Herearesomesessions that will help you take command of the changes coming your way.


Post-Conference Workshops

Wednesday, May 20 • 8:30 aM – 4:30 PM

Computer Forensics KickstartMarK sPeNCerVicePresidentofElectronicEvidence,FirstAdvantageLitigationConsulting

Please note: This is a hands-on workshop; a laptop is required to attend this workshop.

This fast-paced hands-on workshop will provide you with exposure toallthemajorcomponentsofcomputerforensics–identification,preservation, analysis, and reporting.

Instructor Mark Spencer will draw upon his extensive experience in both the public and private sectors to lead the class through applying the proper tools to a “seized” hard drive in a case involving employee wrongdoing. Commercial and open-source tools designed to forensically tackle different types of electronic data will be applied during the investigation.

Computer Forensics Kickstart has been designed to prepare you to select and implement computer forensics tools that will be critical to successful investigations.

You Will Learn•Learnwhichtoolsarenecessarytoconductsuccessful

computer forensics investigations •Howtoconstructpropersearches•Toacquiredataatrestandinmotion•Howtocreateaprofessionalreportstructure

Creating an integrated Compliance FrameworkdaVid lyNasFounder,DavidLynasConsultingGroup

Are you inundated by standards, regulations, and governance and compliance requirements?

The reality is that in the current environment the burden can only get heavier.

But if you have to change your security framework every time a new standard or approach comes along then that framework has failed you.

This class will show you how to design, deliver and support an overarching framework to manage your way through the abundance of diverse standards, legislation, regulation and security requirements and that integrates fully and seamlessly with your existing IT and business practices.

You Will Learn•Howtocreateaholisticframeworkforimplementing

& managing standards•Developingcompliance&riskmanagementroles&responsibilities•Leveragingtheroleofgovernance&compliance•Buildingapolicy&compliancearchitecture•Control&opportunitymodelingtogain‘bestbangforthe

security buck’

get the Jump on security: Vista (win 7)Brad sMithDirector,ComputerInstituteoftheRockies

Please note: This is a hands-on workshop; a laptop is required to attend this workshop.

Understand Microsoft’s new security model and how to make it work foryou.You’llbedazzledbyover300diagnostictoolsbuiltinVista(Win7)andhowsimpletheyaretouse.

Using information gathered from multiple sources—including private discussions with developers, beta testers, inside MS sources and personal investigation—this workshop will help you master the next generation of Microsoft client now!

You Will Learn•ThebasicsecurityconceptthatMicrosoftusesfortheirnew

product line. •HowtotametheUACandunderstandwhyitreallyexists.•Howtoverbalizewhyyourprogramsdon’trunwithVista(Win7)

and how to quickly fix the problem. •ThreegreatimprovementsinVista(Win7)andhowtheycan

be used to increase your security •HowtomakeVista(Win7)selfbootingUSBdrivesforsimple

enterprise rollout, diagnostic or just a great live boot USB OS.

your First 90 days: how to hit the ground running in information securitythoMas PeltierPresident,ThomasR.PeltierAssociates,LLC

You have just been named to head up the information security program for your organization. As first impressions are lasting impressions, what are your first tasks in this new role?

Based on the survey results of over 40 industry-recognized information security experts, we’ll help you create your checklist. Learn what these industry experts identified as the key issues you need to address to be successful. We’ll examine how to use short-term objectives to develop a long-term plan and how to adjust the plan after each incremental objective is met to ensure the greatest possibility of success.

You Will Learn•Whatstepsyoushouldtaketogiveyouandtheinformation

security program the best chance for success. •Whatstepstotakeandwhatpitfallstoavoid.•Whyitisimportanttopublishyourclearanddefinitiveobjectives

for your first 90 days. •Howtoputasecurityprogramtogetherwithlittleornostaff

or budget.


Thursday, May 21 • 8:30 aM – 4:30 PM

Post-Conference Workshops

Building an information security Program: soup to Nutstodd FitzgeraldSystemsSecurityOfficer,NationalGovernmentServices

Organizations are merging, reorganizing, requiring that more be done with fewer resources, and reacting to government regulations at a faster pace. Meanwhile, the threats to the organizational information assets are increasing as information is no longer contained solely within the corporate brick and mortar walls. This comprehensive workshop will provide the roadmap for the security officer to define their role, establish a strategic vision, develop the necessary security functions, and turn the vision into reality through security projects and actions.

You Will Learn•Thekeycomponentsnecessarytobuildaneffective,cost-

conscious information security program•Riskanalysis/managementandSystemsSecurityPlans•Howtosellandcommunicateinformationsecuritytoexecutives/

Board of Directors•Toaddressregulatorystandards/frameworkcompliancethrough

security governance initiatives•ToleveragepersonalitydifferencesusingMBTI™tobuildeffective

teams•Communicatingwithandmaximizingthevalueofinternaland

external auditors

how to Complete a risk assessment in a week or lessthoMas PeltierPresident,ThomasR.PeltierAssociates,LLC

Learn the tools and skill set needed to complete a successful risk assessment in 5 days, or less.

Using the Facilitated Risk Analysis and Assessment Process (FRAAP) methodology, this workshop will examine different ways to improve the risk assessment process so that it will work best for you and your organization. FRAAP, a world-wide qualitative risk assessment process, was developed for those with limited time and budgets. Leave with all of the materials needed to successfully conduct a risk assessment when you return to your work place.

You Will Learn•Differencebetweenriskanalysisandriskassessment•ToconductariskassessmentusingFRAAPmethodology•Pre-andPost-FRAAPdeliverables•TouseGapAnalysis

enterprise security architecture: a Business-driven strategy daVid lyNasFounder,DavidLynasConsultingGroup

Using the world’s most successful free-use and open-source methodology and framework

for creating Security Architecture, this class delivers immediate benefit and value. Find out how to use the most proven security architecture design and management processes and how to develop a comprehensive strategy for the creation of a security architecture that genuinely meets the needs of your organization. Ensure that the security needs of your business are met completely and are designed, delivered and supported as an integral part of your IT management infrastructure.

You Will Learn•Howtodeliversuccessfulsecurityarchitecture•HowtoapplySecurityengineeringprinciples,methods&

techniques•Howtoengineerbusinessrequirementsinmeaningfulterms•HowtocreateanduseabusinessAttributesProfile•Howtousebestpracticetoolssuchasdomain&trustmodeling

“ Very informative with real-life examples. I would recommend this class [Computer Forensics Kickstart]

to everyone.” — Lisa Lafleur, Incident Response Lead, Raytheon

“ This [Risk Assessment class] was exactly the information I needed. Tom’s knowledge and presentation skills are fantasic. This session was conducted so well that I will be able to use this methodology immediately.”

— David Skinner, VP Information Systems, Farm Credit Services

“ Very well done. Tom’s knowledge was outstanding. His presentation skills were excellent. Thank you.”

— Anna Sherony, CSO & CPO, Sammons Financial Group


Membership

Questions about CSI Membership? Phone: (212) 600-3026 or [email protected] Join online at GoCSI.com

Questions about CSI SX Conference?Phone: (866) 535-9002 or (212) [email protected]

Join Now and saveYou’ll receive a $200 discount on your conference pass, plus the benefits above. To join, register for CSI SX ’09 and choose the “+ Membership” package.

If you are already a CSI member, simply provide your membership number when registering online.

•Ten in-depth Alert security reports: These comprehensive reports provide a “deep dive” on emerging security issues and solutions, going beyond the weekly news stories. Designed to prepare you for challenges now and around the corner, you’ll get the level of information that will actually make a difference in the way you perceive and practice security. The reports, delivered electronically, will give you the background and confidence to make the decisions and recommendations that will benefit your organization, and your career.

Upcoming issues will tackle how to secure Internet-capable mobile devices and how to manage change in a challenging economy.

•$200savingsatCSIconferences: Attend either CSI SecurityExchange,May17-21,2009inLasVegas,NVorCSI2009,October24-30,2009inNationalHarbor,MDand your CSI membership (almost) pays for itself.

•SecurityResourceCenter: Need to research a technology or strategy but don’t know where to start? Want to know what the experts have to say about how security should fit intotheorganization?HeadtotheCSIResourceCenter,to find insightful articles on topics ranging from end-user awareness and risk management to identity management and virtualization—available to read and download—CSI Members only.

Recent additions include: “Can Businesses Prove Compliance in the Cloud?” “Is Secure Browsing in Web 2.0aMyth?”and“ThereareBetterAnswerstoSecurityofSocialNetworksThan‘Don’tUseThem’”.

•Awareness solutions at significant discounts: Technology is a huge part of security, but so is careful training of front-line staff. CSI has created three leading components for successful awareness training and we make them especially affordable for the CSI community.

Join Csi for only $224—save $200 on Csi sX and get all these benefits:

REPRODUCTION WITHOUT PERMISSION IS PROHIBITED. ALL RIGHTS RESERVED.

Virtualization:Security enabler or security threat? Has anyone stopped to ask?

A virtual infrastructure might enable better security, but it defi nitely demands it.

Virtualization creates as many security management issues as it solves. Plus, paradoxically, while

virtualization’s greatest security benefi t is how it enables resource isolation (e.g. putting each egg

in its own basket), virtualization’s greatest security risk is how it enables resource consolidation

(e.g. putting too many eggs in one basket). Virtualization may be the buzzingest buzzword of the moment, which makes it exceedingly dif-

fi cult to decipher the truth through the din. Virtualization technology comes in many forms and

suffers from a glut of redundant terms. For the purposes of this article, we’ll focus on what

are sometimes called “system” virtual machines or “hardware” virtual machines or hitherto just

VMs—logical entities that behave just like physical entities (be they servers or workstations),

executing complete operating systems. The virtualization infrastructure Atop the server/workstation hardware runs the virtualization software product. The product of

choice may include a variety of applications, but the heart of the product—the software providing

the virtualization layer—is the VMM (which usually stands for “virtual machine monitor,” but is

occasionally translated to “virtual machine manager”), and the heart of the VMM is the hypervisor

(some of which are open-source, like Xen, for example). Some hardware—most notably, AMD-

V and Intel VT chips—contains support for virtual machines, but virtualization software can still

run atop hardware without this component. (Note one linguistic peccadillo: sometimes the term

“hardware virtual machine” or “HVM” is used in the manner described above, in the previous

paragraph. Other times, however, this term is used to describe the virtual machine-enabled hard-

ware itself, and not the VM running on top of it.)

“ I have been in the information security arena for over 20 years. I believe in and have experienced the absolute benefits of being a member of CSI. CSI’s content, staff and information are above reproach!”

— Dr. Pamela Fusco, Chief Security Strategist, Financial Services Network

“ CSI repeatedly proves their command of the issues facing Information Security professionals by constantly shadowing the paradigm shifts and being first to collect the appropriate movers and shakers, keeping their members informed. Every organization should require at least one CSI member on their security team.”

— Lee R. Allen, Senior Analyst, Altria Client Services

Download a free sample Alert Special Report on Virtualization at GoCSI.com.

save $200 on Csi sX Now! stay CurreNt oN the latest seCurity treNds as a Csi MeMBer


Hotel & Travel

airline discounts

The Mandalay Bay Convention Center is located approximately 5 miles from McCarran International Airport. We have negotiated airline discounts with the following airlines:

JETBLUE DISCoUNT

Save 5% on flights to and from the event with promo code “interop”atwww.jetblue.com/promo.

AMERICAN AIRLINES DISCoUNT

Save 5% on domestic and international flights to and from the event with promo code “A3359AW” at www.aa.com.

ground transportation

TAXI SERVICE

Approximately $15 from McCarran International Airport. Please note: Taxis will not accept credit card payments.

SHUTTLE

Shuttle service to and from McCarran International Airport & immediateLasVegasareaavailable.

Shuttle service may be available from other CSI SX contracted hotels toheadquarterhotel,TheMandalayBayHotel.

DRIVING AND PARKING

Mandalay Bay Convention Center provides complimentary parking. Please visit www.ManadalayBay.com for driving directions.

Conference organizers have negotiated special hotel rates for CSI SX attendees at the hotels listed.

• Saveupto52%over2008prices

• Getthebestpossiblerates–EVENIFRATESDROP AFTER YoU BooK*

• Nochargesforcancellationorchangesmade 72+ hours before the event

* If the published rate of your room drops below the rate at time of booking, your reservation will automatically be adjusted to the lower rate. Buyer protection applies only to reservations booked through the CSI SX group codes, for the hotels and nights listed. Deadlines (as indicated) and other restrictions may apply. For further information, please contact [email protected].

MaNdalay Bay CoNVeNtioN CeNter

3950LasVegasBlvdSouth LasVegas,NV89119

Room Rate: $169; $109 Wednesday & Thursday

Reservations must be made online. Go to CSIsx.com for details.

Rate Guarantee: MandalayBay/THEhotel,Sun-Thur,May17-21until4/27/09*

luXor hotel


Room Rate: $129;$79Wednesday & Thursday; $149 Friday & Saturday

Reservations can be made online. Go to CSIsx.com for details.

By phone:702-262-4450orToll-freeat877-848-2527Group Code: CSIS09P - CSI SX Security ExchangeRate Guarantee: Mon-Wed,May18-20until4/21/09*

eXCaliBur hotel


Room Rate: $66; $91 Friday & Saturday

Reservations can be made online. Go to CSIsx.com for details.

By phone: 800-937-7777-AskforRoomReservationsGroup Code: XCSIEXRate Guarantee: Sun-Thur,May17-21,until4/27/09*

Customer Service Support: Email:[email protected]•Phone:(415)947-6967,toll-free(866)535-9002

Lowest Price Guarantee!* Rates below 2008 Prices!

Conference location hotel other hotels


Registration Instructions

registration and Payment deadlines

• Acheck,moneyorderorcreditcardinformationmust accompany your registration.

• Registrationsreceived(viafaxormail)afterMay16,2009at1:00PM(Pacific Time) will be processed at the on-site registration center at Mandalay Convention Center.

• IfyourmembershipcannotbeverifiedbyCSIatthetimeofregistration, you will be charged the non-member fee.

• Whileon-siteregistrationswillbeaccepted,westronglyrecommendyou register early to save time and money.

• Registrationsarenotconfirmedandclassesarenotreserveduntilfullpayment is received.

Cancellation Policy

• IfyouneedtocancelyourConferenceorWorkshoppass, you may do so for a full refund, less a nonrefundable $150.00 service charge until Friday, May 1, 2009. Sorry, cancellations are not accepted after 5/1/2009.

• Ifyouareunabletoattendtheevent,westronglyrecommendthatyou send a substitution in your place. Registrants who register prior to or after the cancellation deadline date who do not cancel in writing by the deadline date are liable and will be charged for the full registration fee. To make a change to your registration, please download the Registration Change Form for cancellations, substitutionsorchangesathttps://www.cmpevents.com/images/RegChangeRequest.pdfandfaxitto(415)947-6011forprocessingor mail your request to:

CSISX2009 UBM Events Registration Department 600HarrisonStreet,6thfloor SanFrancisco,CA94107

Payment Policies

Full payment of conference and tutorial registration fees must accompany your completed registration form. Checks, travelers checks, money orders,VISA,MasterCardandAmericanExpressareacceptedforpaymentinU.S.fundsonly.Checksshouldbemadepayableto‘CSISX2009’inUSDdrawnonUSbank.Internationalattendeesmayalsopayvia bank transfer. To qualify for early registration discounts, registration form and payment must be received on or before the cut-off date.

Bank Wire Transfers and Electronic Funds Transfers (EFT’s): Wire transfer transaction document from your bank MUST accompany registration form. Registrations will not be processed and class selections cannot be guaranteed without a copy of the Wire transfer transaction document from your bank. Please reference the name of the registrants on the transfer, and include a copy of the bank transfer document with your faxed or mailed registration form.

All fees payable in U.S. Dollars only. FEDWIRE and SWIFTWIRE transfer should be directed to:

J.P. Morgan Chase Bank, Account: UBMi Princeton Inc. New York, NY USA Account Number: 400936003 ABA#:021000021SWIFTCode:CHASUS33TaxpayerIDNumber:13-3117413

Four easy ways to register

1. Register online: at the CSI Web site: CSIsx.com

2. Fax: the registration form on the next page, with payment information,to(415)947-6011

3. Mail: the registration form and payment to:

CSISX2009ConferenceRegistration Attn: Rafael Robles 600HarrisonStreet SanFrancisco,CA94107

4. Call:(415)947-6967;(866)535-9002

Conference discounts available

1. Early Bird Discount Save up to $600 on Conference fee when you register beforeApril17,2009.

2. Member Discount CSImembersreceive$200offtheNon-Memberconference

registration fee. See registration form for details.

3. Package Passes For best savings, choose the 5-Day Expert Pass and save

over $500 on the cost of a two-day workshop.

4. Team Discounts

•Registerthreeormorefromthesamecompanyatthesame time, and each will receive a $50 discount. To register your group, please complete a registration form for each member of your group. Once completed, fax yourregistrationformsto(415)947-6011.Additionalregistrations from the same company added at a later date will not be entitled to the group discount. Contact CSIRegistrationSupportat(415)947-6967,tollfree(866)535-9002,[email protected] more information.

•Tenormorefromthesamecompanyreceivea$100 discount per person off the price of a conference pass. For details on large group discounts, contact Frank [email protected](212)600-3356.

Continuing Professional education (CPe) Credits

Attendees earn:

•18CPEunitsfortheconference(Sunday–Tuesday) •8CPEunitsforeach1-dayworkshop

Special service for CISSPs:

CSI will automatically forward your earned CPE units to (ISC)2 upon completion of training if we have your certificate number. Please provide your certificate number in the space provided on the registration form.

how to registerOnline: www.CSIsx.com By Fax: 415-947-6011

By Mail: CSI SX Conference Registration, Attn: Rafael Robles 600 Harrison Street, San Francisco, CA 94107

Questions? Contact us at [email protected], 415-947-6967 OR 866-535-9002, 9 AM-4 PM PST.

Please print or type information. To submit multiple registrations, please copy and complete this form for each registration.

atteNdee iNForMatioNPromo Code

member #

name

ComPany

job title

address 1

address 2

City state/ProvinCe

ziP/Postal Code Country

email address

Phone

CISSP #

PayMeNt Method Payment in U.S. funds, drawn on a U.S. bank, MUST accompany this form for your registration to be processed.

q CheCk enClOSed Check number (made payable to CSI SX ‘09): ___________ Amount: $___________CRedIT CARd AUThORIZATIOn q MasterCard q VISA q American Express q I would like to use my credit card to charge my attendance.name on Card

Card number

3 or 4 digit seCurity Code exP. date

Cardholder signature

billing address (if different from above):

q BAnk WIRe/eleCTROnIC PAyMenTWire Transfer Transaction Document from your bank MUST accompany registration form. Registrations will not be processed and class selections can not be guaranteed without a copy of the Wire Transfer Transaction Document from your bank. Contact us at [email protected] for CSI bank details.

Persons under the age of 18 are not permitted at CSI SX, including infants. Event is open only to trade participants and is not open to the public. Recording devices and cameras, still or video, are prohibited. Attendee consents to any recording of the event by CSI SX ‘09 or its designees. Students admitted by prior arrangement only.

Cancellations Substitutions & Upgrades: If you need to cancel your CSI SX Conference registration, you may do so for a full refund, less a $150.00 service charge until May 1, 2009. Attendees who register prior to or after the deadline date, who do not cancel in writing by the deadline date are liable for the pass cost and will be charged for the full registration fee. Sorry, no refunds are available for no-shows. If you are unable to attend the event, we recommend that you send a substitution in your place. Please fax your cancellation or substitution request to 415-947-6011 or email to [email protected].

Written requests for a downgraded pass must be received no later than May 1, 2009 for a full refund on the difference of registration fees between the value of the original and downgraded pass. Sorry, requests received after May 1, 2009 cannot be accommodated. Upgrade pass requests must be submitted in writing and faxed to 415-947-6011 along with payment information for the difference in value. CSI reserves the right to rescind any registration and in that event will return 100% of the registration fee. All dates and times of the CSI SX program are subject to change.

If you have a disability and require special assistance, contact us at [email protected] by May 1, 2009.

Copyright © 2009 UBM Internalional Media. All rights reserved. A United Business Media company.

Please indicate conference package and/or workshops you will be attending, and tally the total. Registration form must be accompanied by payment.

CSI SX 5-day expert Pass (5 days) * May 17–21, Sun–Thurs.Access to all 5 days of CSI events: CSI SX Conference, May 17–19, plus two 1-day CSI Workshops, May 20–21. Access to the Interop Exhibition Tuesday–Thursday. (see * below for workshops included in this package)

eARlyBIRd

(on or before 04/17/09)

RegUlARPRICe

(4/18/09-5/16/09)

On-SITe(on or after 5/17/09)

eARlyBIRd

(on or before 04/17/09)

RegUlARPRICe

(4/18/09-5/16/09)

On-SITe(on or after 5/17/09)

q

CSI MeMBeRS nOn-MeMBeRS

CSI SX 4-day Master Pass (4 days) * May 17–21, Sun–Thurs.Attend the 3-day CSI SX Conference, May 17–19, plus one 1-day CSI Workshops, May 20 or May 21. Access to the Interop Exhibition Tuesday–Thursday. (see * below for workshops included in this package)

q

CSI SX Conference Pass (3 days) May 17–19, Sun–Tues.Attend the 3-day CSI SX Conference, May 17–19. Access to the Interop Exhibition Tuesday–Thursday.

q

2 Workshops (2 days) *May 20 & 21, Wed–Thurs.Attend two 1-day CSI Workshops only, May 20 & 21, no Conference.(see * below for workshops included in this package)

q

1 Workshop (1 day) *May 20 or 21, Wed or Thurs.Attend one 1-day CSI Workshop only, May 20 or 21, no Conference.(see * below for workshops included in this package)

q

Flex Pass (5 days) * May 17–21, Sun–Thurs.Unlimited access to the CSI SX Conference, and your choice of Interop Conference including Mobile Business tracks, Cloud Summit, Energy Camp, CIO Boot Camp, NAC Day, Virtualization Day and Workshops. (Choice of one full-day program each day, Sunday–Thursday).

q

expo PlusMay 19–21, Tues–Thurs.All the benefits of the Expo Only Pass, plus admittance to Tuesday Attendee Party, CSI SX Conference bag, preferred seating at Keynotes, and one free session from the CSI SX Conference.

q

expo OnlyMay 19–21, Tues–Thurs.Access to Interop Exhibition, Security & Compliance Zone, Cloud Zone, Mobile Business Zone and InteropNet Tours. Bonus Admission to Interop and CSI Keynotes, and a full calendar of free sessions.

q

CSI MembershipJoin now and receive member pricing ($200 off).

q

qComputer Forensics Kickstart (Wednesday, May 20)

qCreating an Integrated Compliance Framework (Wednesday, May 20)

qGet the Jump on Security: Vista (Win 7) (Wednesday, May 20)

qYour First 90 Days: How to Hit the Ground Running in Information Security (Wednesday, May 20)

qBuilding An Information Security Program (Thursday, May 21)

qEnterprise Security Architecture: A Business-Driven Strategy (Thursday, May 21)

qHow to Complete a Risk Assessment in a Week or Less (Thursday, May 21)

*PleASe nOTe: Workshops require preregistration. If you have chosen a package that includes a workshop, please select the workshop(s) you plan to attend below.

TOTAl

$2,395 $2,595 $2,795 $2,595 $2,795 $2,995

$1,995 $2,195 $2,395 $2,195 $2,395 $2,595

$1,395 $1,595 $1,795 $1,595 $1,795 $1,995

$1,590 $1,790 $1,990 $1,590 $1,790 $1,990

$795 $895 $995 $795 $895 $995

$2,695 $2,895 $3,095 $2,895 $3,095 $3,295

$150 $195 $295 $150 $195 $295

FREE $50 $100 FREE $50 $100

RegISTRATIOn FORMwww.CSIsx.com

May 17–21, 2009 • Las vegas, Nv • MaNdaLay Bay

$224 $224 $224

save up to $600 when you register by april 17. register today at Csisx.com.

11 West 19th Street 3rd FloorNew York, NY 10011(866) [email protected]

save up to $600 when you register by april 17 Csisx.com

May 17-21, 2009las Vegas, NV

MaNdalay Bay CoNVeNtioN CeNter

who will be there?

what will happen at Csi sX?

• dozens of expert speakers who’ll share the latest security strategies

• security professionals who’ll exchange experience, ideas and business cards

• in-depth coverage of: Virtualization, Cloud and web 2.0 security (including mobile devices); Compliance, security Management, and more

• Colleague connections will be made (see page 1).

• get your registration in by april 17 for best savings. Pre-registered attendees save over the onsite fees.

• we make it easy — see inside front cover and page 1.how can i convince my boss to send me?

when should i register?

deCisiVe seCurity MaNageMeNt iN turBuleNt tiMes