Credit Union Information Security Podcast

What are the key risk management challenges for the nation's credit unions, and how can they best meet them? Wendy Angus, Director of Risk Management at the National Credit Union Administration (NCUA), discusses: The biggest risk management issues facing credit unions today; How credit unions can overcome these challenges; Advice to institutions looking to improve their approach to risk management. Prior to joining NCUA in 1996, Angus worked as an examiner with the Office of Thrift Supervision and an auditor in the securitization and asset sale operation at the Resolution Trust Corporation. During her 13 years at NCUA, she has played many roles within the agency. Beginning December 14, 2009, she became the Director of Risk Management in the Office of Examination and Insurance. In this position, she serves as the primary caretaker of the National Credit Union Share Insurance Fund, oversees administrative action nationwide, quarterly call report data collection and analyses, and works with the regional

What are the new year's top trends in banking, payments and security? Javelin Strategy & Research has just released its Top 10 Trends report for 2010. James Van Dyke, president of Javelin, discusses: Top headlines from the new report; Biggest threats to banks, payments and security; The "next big thing" in banking. Van Dyke is founder and president of Javelin Strategy & Research. Javelin is the leading provider of independent, quantitative and qualitative research for payments, multi-channel financial services, security and fraud initiatives. Javelin's clients include the largest financial institutions, card issuers and technology vendors in the industry.

Information security is the hot career option for professionals in 2010 and beyond. This is the prediction of David Foote of Foote Partners, the FL-based consultancy that tracks IT skills and competencies. In a look ahead at 2010 and beyond, Foote discusses: the security careers "bubble" and how it began; the wave that has driven the surge in security jobs; predictions for 2010-2012. Foote has long been one of the nation's leading industry analysts tracking, analyzing and reporting on IT workforce management and compensation practices, trends and issues. His columns, articles and contributions appear regularly in dozens of publications. As Foote Partners' CEO and Chief Research Officer since 1997, David leads a senior team of experienced former McKinsey & Company, Gartner, META Group, and Towers Perrin analysts and consultants, and former HR, IT, and business executives, in advising governments and corporations worldwide on increasing performance and managing IT's impact on their businesses and custome

Malware is increasingly sophisticated, and social media are the common new venues for attacks. These are the headlines from the latest Cisco Annual Security Report. Patrick Peterson, Cisco senior fellow, offers highlights of the report, discussing: Top trends and threats; The risks to specific vertical industries and government agencies; The message to information security professionals looking to stay ahead of the threats. Peterson, Chief Security Researcher, is also a Cisco Fellow -- a position that is reserved for individuals whose technical contribution has made a material impact not only within Cisco, but also in the industry as a whole. As a security technology evangelist, Peterson leads research projects to understand cutting-edge criminal attacks and business models and developing the technologies to combat them. Peterson chairs the technical committee for the Messaging Anti-Abuse Working Group (MAAWG) and the authentication committee for the Authentication and Online Trust Alliance. He is a frequ

The Advanced Persistent Threat - what exactly is it, and how are organizations vulnerable? Ron Gula, CEO of Tenable Network Security, explains the threat and the challenges to mitigating it. In an exclusive interview, Gula discusses: Why some organizations are especially vulnerable; Strategies and solutions that are most effective against the threat; Where to start if you feel your organization is exposed.

It's been over one year now since banking regulators began examining institutions for compliance with the Identity Theft Red Flags Rule. What have been the common deficiencies, and what will examiners be expecting in year two? Jeff Kopchik, senior policy analyst with the Federal Deposit Insurance Corporation (FDIC), discusses: The three key deficiencies of Red Flags compliance; How examiners will approach Red Flags exams in 2010; Ways institutions can improve their Red Flags compliance. Kopchik was the Team Leader of the FDIC's 2004 study "Putting an End to Account-Hijacking Identity Theft." He was the FDIC's primary representative on the FFIEC staff working group that drafted the 2005 guidance on Authentication in an Internet Banking Environment. Kopchik was also involved in interagency rulemaking efforts to comply with the Fair and Accurate Credit Transactions (FACT) Act, and was involved in the creation and implementation of the Gramm-Leach-Bliley Act (GLBA) interagency information security guidelines

Marcus Ranum has a unique take on the biggest information security threats to organizations and individuals. A renowned expert in secure systems and design, Ranum, currently the CSO of Tenable Network Security, offers a new look at topics such as the risks of cloud computing and what he calls the myth of cyber warfare. In an exclusive interview, Ranum discusses: The biggest security concerns of 2010; Which threats get the least attention; Why penetration testing is often a waste. Ranum, since the late 1980s, has designed a number of groundbreaking security products including the DEC SEAL, the TIS firewall toolkit, the Gauntlet firewall and NFR's Network Flight Recorder intrusion detection system. He has been involved in every level of operations of a security product business, from developer, to founder and CEO of NFR. Marcus has served as a consultant to many FORTUNE 500 firms and national governments, as well as serving as a guest lecturer and instructor at numerous high-tech conferences. In 2001, h

Interview with Jay Foley of the Identity Theft Resource Financial scams and incidents of medical identity theft are on the rise - and they're among the main threats to business and consumers in 2010. This is the warning from Jay Foley, executive director of the Identity Theft Resource Center. In an exclusive interview, Foley discusses: The major ID theft threats and trends for 2010; The industries most at risk; What information security professionals can do to help prevent ID theft. Responding to an explosive rise in identity theft crimes, Jay and Linda Foley established the Identity Theft Resource Center (ITRC) in 1999 in order to provide education and victim assistance to consumers and businesses. As Executive Director of the ITRC, Jay is today recognized nationally as an expert on identity theft issues. Frequently addressing national, state and community organizations, Jay travels throughout the United States providing training for businesses, consumers and law enforcement. He has appeared befo

Interview with Wade Baker and Alex Hutton of Verizon Business Earlier this year, Verizon Business unveiled its much-heralded 2009 Data Breach Investigations Report. Now, the company has just released its 2009 Supplemental Data Breach Report, which reveals the 15 most common attacks against organizations. In an exclusive interview, Wade Baker and Alex Hutton of Verizon Business discuss: The trends uncovered in the supplemental report; How the threat landscape varies by industry; What organizations and individuals can do to better protect themselves. Baker, research and intelligence principal with Verizon Business, has more than 10 years of IT and security experience. His background spans the technical-managerial spectrum from system administration and web development to data analysis and risk management. He is one of the primary authors of the groundbreaking Verizon Business Data Breach Investigations Report. Hutton, research and intelligence principal with Verizon Business, has served as a consult

What's ahead for information security professionals in 2010? Barbara Massa, VP of Global Talent Acquisition at McAfee, Inc. speaks to the results of the new Information Security Today Career Trends Survey, discussing: How the results speak to the maturity of the information security profession; The survey's message to CISOs; The value of recruitment and retention in the year ahead. Massa joined McAfee in June, 2009. For the 10 years prior to joining McAfee, Barbara led the Talent Acquisition function at EMC and Documentum respectively (Documentum was acquired by EMC in December of 2003.) Barbara's prior work includes leadership positions in the recruiting organization at Cadence Design Systems and at an external recruiting firm.

Business risks have grown in size and complexity in 2009. How, then, must risk management evolve to meet the challenges of 2010? James Pajakowski, EVP of Global Risk Solutions with Protiviti, shares his insight on: The risk management trends for 2010; How information security professionals must meet the new challenges; What's most misunderstood about risk management today. Pajakowski oversees the delivery of Protiviti's services in the areas of finance and transactions, operations, technology, litigation, governance, risk, and compliance. He previously served as managing director and head of the Business Risk practice. He also was one of five founding members of the Protiviti Operating Committee, which was responsible for establishing Protiviti's vision and strategy and overseeing financial and administrative matters during the company's first five years. Prior to Protiviti, Pajakowski was a partner with Arthur Andersen, where he started his career in 1982. He has more than 25 years of professional serv

In terms of information security, what is the state of auditing as we end 2009 - and what are the trends foreseen for 2010? Warren Stippich Jr., Practice Leader of the Chicago Business Advisory Services Group of Grant Thornton LLP, discusses: Audit trends; Where organizations are most vulnerable; How audit practices can be improved. Stippich has over 18 years experience working with multi-national, entrepreneurial, and high-growth companies. He brings experience to the business risk consulting and internal audit services areas from both the public accounting firm and industry perspectives. He leads many Sarbanes- Oxley consulting and internal audit services projects for a wide-array of publicly traded businesses with international operations. He has worked extensively with international internal audit, Sarbanes-Oxley and business consulting assignments in Europe, China, Southeast Asia, Central and South America and Canada

When it comes to protecting their customers' identities, how do the major banking institutions rate? Javelin Strategy & Research has just released a new Banking Identity Safety Scorecard that ranks the major institutions. In an exclusive interview about the report, James Van Dyke discusses: How the scorecard was developed and what it tells; The significance of this year's ratings; Lessons learned about identity protection for banking institutions of all sizes. Van Dyke is founder and president of Javelin Strategy & Research. Javelin is the leading provider of independent, quantitative and qualitative research for payments, multi-channel financial services, security and fraud initiatives. Javelin's clients include the largest financial institutions, card issuers and technology vendors in the industry.

No question, the information security professional's role has evolved in recent years. How, then, has the need for ongoing professional education also changed? And what role must risk management play in today's security organization? In an exclusive interview, Mark Lobel of PricewaterhouseCoopers and ISACA, discusses: The role of professional education in information security; The evolution of risk management; How organizations and professionals must respond to the challenges of 2010. Lobel, CISA, CISM, CISSP, is a member of ISACA's Security Management Committee. He has over 25 years business experience, with the first eight in the Entertainment and Media industry and then, after his MBA, with PricewaterhouseCoopers. He is an internationally recognized security and controls professional with experience designing, benchmarking and assessing organizational security strategies and technologies. He is experienced at designing, assessing, implementing and penetration testing enterprise security. Lobel

We've experienced two waves of the H1N1 pandemic. What lessons have we learned? Sue Kerr, President of Continuity First, a business continuity/disaster recovery consultancy, talks about how organizations have handled H1N1. She also discusses: the state of BC/DR; Challenges facing organizations today; 2010 trends and career opportunities. Kerr is also the president of the Old Dominion Association of Contingency Planners, Education Director for the National Association of Contingency Planners and a previous member of the Disaster Recovery Journal Editorial Advisory Board. She has been active in setting standards for the industry as well as training others. She has spoken at various conferences and has done training for corporations, governmental organizations as well as the community. She has been published in industry journals and has been interviewed multiple occasions as a subject matter expert. She is a Certified Business Continuity Professional through the Disaster Recovery Institute. In addition

How much do you actually know about time and the critical role it plays in your organization? In a preview of his new webinar, Time: The Hidden Risks -- How to Create Compliant Time Practices, Bill Sewall discusses: Why time is such a critical business issue; Risks and opportunities presented by time; What organizations most misunderstand about the concept. Sewall is an Information security, compliance and risk management specialist with 30 years experience as a corporate attorney and general counsel, CIO, information security officer, and operational risk manager. Most recently, Sewall spent 10 years as a senior executive information security officer in Citigroup, including management of the IS training and awareness program and responsibility for the Citigroup IS Policy and Standards. In his career, Sewall has managed information security compliance requirements for one of the largest financial services organization in the world, implemented that institution's information security program at the busine

Interview with Kent Anderson of Encurve LLC Cybersecurity, forensics, risk management -- what will be the core security skills needed in organizations in 2010? In an exclusive interview, Kent Anderson, founder and managing director of Encurve LLC, as well as a member of ISACA's Security Management Committee, discusses: The core security skills now needed by organizations; How these skills are acquired today; Ways security professionals can take charge of their own development. Anderson is considered a leading authority on security, with more than 22 years of experience in the field. He has held positions as SVP of IT Security and Investigations with an international business risk consultancy, as Director in the Dispute Analysis & Investigations group of PricewaterhouseCoopers, and as the European Information Security Manager for Digital Equipment Corp.

What have been the biggest privacy issues of 2009, and what emerging trends should you watch heading into 2010? We posed these questions to J. Trevor Hughes, Executive Director of the International Association of Privacy Professionals (IAPP). In an exclusive interview, Hughes discusses: The role of the IAPP; Key legislation in the U.S. and internationally; Where organizations need to improve privacy protection. Hughes is an attorney specializing in e-commerce, privacy and technology law. In his role as Executive Director of the IAPP, Hughes leads the world's largest association of privacy professionals. Hughes has provided testimony before the U.S. Congress Commerce Committee, the U.S. Senate Commerce Committee, the U.S. Federal Trade Commission, and the EU Parliament on issues of privacy and data protection, spam prevention and privacy-sensitive technologies. He is a member of the first class of Certified Information Privacy Professionals (CIPPs) and is co-author (with D. Reed Freeman, Jr.) of "Pri

There are a number of new regulatory compliance and security initiatives that means changes for financial institutions. But do these changes also open the doors to potential fraudsters? Kris VanBeek, SVP of Information Systems at Digital Federal Credit Union, discusses: How some of these changes might attract fraudsters; What banking institutions can do thwart attacks; Fraud trends he's tracking as we head into 2010. VanBeek is a banking/security leader with deep experience in banking and regulatory compliance. Prior to joining DCU five years ago, he spent time as a supervisory manager at the Federal Reserve Bank of Boston; data center manager at Fiserv; senior IT specialist and examiner with the Federal Deposit Insurance Corporation. Digital Federal Credit Union is a not-for-profit financial cooperative owned by and operated for its members. DCU was chartered in October of 1979. DCU serves more than 350,000 members and their families in all 50 states. DCU is the largest credit union headquartered in

It's time for information security professionals to give back to their communities - to reach out and educate businesses, schools and citizens about cybersecurity and other relevant issues. This is the message from John Rossi, professor of systems management/information assurance at National Defense University. In an exclusive interview, Rossi discusses: Why security professionals should practice outreach; Potential venues for public speaking How to get started. Rossi is a Professor of Systems Management/Information Assurance in the Information Operations and Assurance Department at the National Defense University (NDU) Information Resources Management College (IRMC). Prior to joining the NDU/IRMC faculty, he was a computer scientist for information security, research, and training with the U.S. Federal Aviation Administration Headquarters. He was Security Division Manager of the U.S. Department of Energy's Nuclear Weapons Production Security Assessments Program and National Program Manager for Computer