Cloud Security Summit

The seventh Cloud Security Summit at SecTor will take place on Tuesday, October 4, 2022 at the Metro Toronto Convention Center (MTCC) in downtown Toronto.

The Cloud Security Summit is Canada’s leading cloud security event featuring keynote speakers, panel discussions and networking opportunities, and provides an invaluable opportunity for every security professional to engage with leaders and discuss the future of cloud security.

The Details

Date: Tuesday October 4, 2022.

Price: $99

Registration: To register for the 2022 Cloud Security Summit at SecTor visit sector.ca/register and add it to your SecTor conference registration.

SecTor 2022: Conference sessions take place on Wednesday October 5 and Thursday October 6, 2022. The full conference schedule will be available closer to the event.

Venue: The Cloud Security Summit at SecTor will be held on Level 700 in the South Building of the MTCC. More information on how to get there is available at sector.ca/travel.

cSA_Summit_Crowd_cropped

Agenda

 

10:00 – 10:15 Welcome -Dave Millier / Bruce Cowper
10:15 – 11:00 Keynote #1: Kellman Meghu – How I Learned To Stop Worrying And Love The Cloud
11:00 – 11:45 Panel #1: Moderator: Dave Millier – Cloud Threat Detection in Complex Environments
11:45 – 13:00 Lunch Break
13:00 – 13:45 Keynote #2: Jay Chen – A ransomware actor looks at the clouds: attacking in a cloud-native way
13:45 – 14:30 Panel #2: Moderator: Laura Payne Dealing with Identity
14:30 – 14:55 Afternoon Break
14:55 – 15:40 Keynote #3: Fernando Montenegro Trends and Challenges in ‘Securing Cloud’
15:40 – 16:25 Keynote #4: Rodrigo Montoro The deFAULT truth of AWS shared responsibility model
16:25 – 16:30 Closing Remarks Dave Millier / Bruce Cowper

*Timing and content subject to change

Speakers, Sessions, Bios

Below is the lineup from the Cloud Security Summit at SecTor 2022. Expand each one to read more about each speaker and their presentation. You can also watch the full library of 2015, 2016, 2017, 2018 and 2019 CSA Summit at SecTor sessions here.

Dave Millier

Dave Millier is a serial entrepreneur, off-road motorcycle rider and food lover. Dave has been involved in cybersecurity for almost 25 years. He founded the InfoSec company Sentry Metrics, one of Canada’s most successful MSSPs. After the sale of Sentry Metrics, Dave’s lifelong passion for reading led him to finally sit down and write his first book, Breached! In late 2014, Dave launched Uzado (http://www.uzado.com), a cloud-based InfoSec company focused on helping companies simplify cybersecurity by answering the questions “what now?” or “what next?” Dave sold Uzado in 2019. Dave is currently the CSO of Quick Intelligence (https://www.quickintel.com), a boutique VAR and cybersecurity consulting company.

Bruce Cowper

A self-proclaimed IT security and privacy geek, Bruce is the co-founder of SecTor. He is also a founding member of the Toronto Area Security Klatch (TASK), and an active member of numerous other security and privacy related organizations across North America.

Bruce co-founded SecTor because of his passion to bring IT, security and privacy awareness and knowledge sharing to the community. When he isn’t organizing events with Brian, you’ll usually find him at Microsoft’s Redmond, WA headquarters where today he manages Microsoft’s security policies and standards program.

Aside from his passion for IT, Bruce is an avid traveler, scuba diver and award-winning craft-brewer.

Lessons learned supporting customers in the cloud – common pitfalls and risks moving from traditional architecture to software defined networks and services. Things you should avoid or at least consider, when moving to the cloud.

Kellman Meghu

Raised my children with a firewall ; shamed a large airline into using SSL for check-in ; front line for the security as some of the biggest corporations went online for the first time ; 20 years of helping every sector define, deploy, and defend their infrastructure ; Thinks learning a new programming language is a great way to relax on holiday ; Dreams in key/value pairs ; Obsessed with putting everything in containers ; Loving every minute of it.

Dave Millier

Dave Millier is a serial entrepreneur, off-road motorcycle rider and food lover. Dave has been involved in cybersecurity for almost 25 years. He founded the InfoSec company Sentry Metrics, one of Canada’s most successful MSSPs. After the sale of Sentry Metrics, Dave’s lifelong passion for reading led him to finally sit down and write his first book, Breached! In late 2014, Dave launched Uzado (http://www.uzado.com), a cloud-based InfoSec company focused on helping companies simplify cybersecurity by answering the questions “what now?” or “what next?” Dave sold Uzado in 2019. Dave is currently the CSO of Quick Intelligence (https://www.quickintel.com), a boutique VAR and cybersecurity consulting company.

Due to the fundamental difference between the cloud-native and on-premises IT infrastructure, existing ransomware will not be effective in cloud environments. The predominantly Windows-based ransomware will not work well in predominantly Linux-based cloud workloads. The file I/O operations that traditional ransomware relies on won’t be efficient in API-based cloud workloads. Ransomware actors will need new TTPs to achieve successful disruption and extortion.

What are the weaknesses that attackers are likely to exploit? What types of cloud resources are more susceptible to ransomware attacks? How may ransomware disrupt cloud workloads? This research aims to identify the possible TTPs using the knowledge of known ransomware and cloud security incidents. This talk will demonstrate various POC attacks that abuse a handful of APIs to quickly render a large amount of cloud-hosted data inaccessible.

Finally, we will show how well-architected infrastructure and certain cloud-native guardrails can effectively make cloud workloads much more resilient to ransomware attacks. The audience should leave with knowledge of ransomware’s risks, threats, and defense strategies in the clouds.”

Jay Chen

Jay Chen is a security researcher with Palo Alto Networks. He has extensive research experience in cloud-native, public clouds, and edge computing. His current research focuses on investigating the vulnerabilities, design flaws, and adversary tactics in cloud-native technologies. In the past, he also researched Blockchain and mobile cloud security. Jay has authored 20+ academic and industrial papers.

Laura Payne

Laura has built a career spanning nearly 20 years at one of Canada’s largest financial institutions, including over a decade working in information security. Her experience covers a variety of domains, including information security governance and risk, security operations and engineering, and security leadership. Laura is passionate about bringing people together to solve problems in today’s increasingly complex technical landscape. Outside of work, Laura is actively engaged in mentoring professionals seeking to join the Information Security field, while also volunteering on the advisory board of SecTor, Canada’s largest security conference. In addition, Laura chairs the program advisory committee for Seneca College’s School of Information Technology Administration & Security. Laura holds an Honours Bachelor of Applied Science in Systems Design Engineering from the University of Waterloo.

The delivery and consumption of cloud-based services in its many forms is here to stay. Security teams are now tasked with helping secure an environment and delivery model that is in some cases similar but, in others, radically different than before. Much has changed since the early days of trying to secure cloud, and innovations in how to do so come from different directions. This session explores some of the key trends and challenges in securing cloud, ranging from handling multi-cloud to the importance of cloud permissions management.

Fernando Montenegro 

Fernando is a Senior Principal Analyst on Omdia’s cybersecurity research team, based in Toronto, Canada. He focuses on the Infrastructure Security Intelligence Service, which provides vendors, service providers, and enterprise clients with insights and data on network security, content security, and more.

Fernando’s experience in enterprise security environments includes network security, security architecture, cloud security, endpoint security, content security, and antifraud. He has a deep interest in the economic aspects of cybersecurity and is a regular speaker at industry events.

Before joining Omdia in 2021, Fernando was an industry analyst with 451 Research. He previously held a variety of operations, consulting, and sales engineering roles over his 25+ years in cybersecurity, always focusing on enterprise security at organizations including vArmour, RSA, Crossbeam, Hewlett Packard, and Nutec/Terra. Fernando holds a Bachelor of Science in computer science and different industry

Problems/concepts about Policy Permissions, Misconfigurations and Monitoring/Use Cases

Rodrigo Montoro

Rodrigo “Sp0oKeR’’ Montoro has more than 20 years of experience in Information Technology and Computer Security. Most of his career worked with open source security software (firewalls, IDS, IPS, HIDS, log management, endpoint monitoring), incident detection & response, and Cloud Security. Currently, he is Head of Threat & Detection Research at Clavis Security. Before that, he worked as Cloud Researcher at Tenchi Security, Head of Research and Development at Apura Cyber Intelligence, SOC/Researcher at Tempest Security, Senior Security Administrator at Sucuri, Researcher at Spiderlabs. Author of 2 patented technologies involving innovation in the detection field. One is related to discovering malicious digital documents. The second one is in how to analyze malicious HTTP traffic. Rodrigo has spoken at several open source and security conferences (Defcon Cloud Village, OWASP AppSec, SANS (DFIR, SIEM Summit & CloudSecNext), Toorcon (USA), H2HC (São Paulo and Mexico), SecTor (Canada), CNASI, SOURCE, ZonCon (Amazon Internal Conference), Blackhat Brazil, BSides (Las Vegas e SP)).

2022 Cloud Security Summit Sponsors

ArcticWolf
GOLD

Crowdstrike
GOLD

ForgeRock
GOLD

Lookout
GOLD

Qualys
GOLD

Rubrik
GOLD

Securonix
GOLD

Sysdig
GOLD

Menlo Security
SILVER

Sonatype
SILVER

Teleport
SILVER

Sponsorship opportunities for the 2022 Cloud Security Summit are now available. If you’re interested in becoming a sponsor, please email sponsorship@sector.ca.