As of 6/3 the following nominations for Board of Directors positions have been received:

Todd Waskelis, President
Scot Sakelarios, Vice President
Peter Brym, Membership Director
Wayne Morrison, Communications Director
Gary Dentremont, Treasurer
Ken Wilson, Secretary/Treasurer
Bob Witmer, Secretary

If there is any additional interest in holding a position on the Board, please send an email to our Nominations committee at nomination@issanh.org.

We will be having the May Chapter meeting on Tuesday, May 18th, 6:30 PM at the Portsmouth Public Library.  The topic for this meeting will be "IT Security Governance & Compliance", presented by Thomas Golash. 

Abstract:
-------------
.Today’s enterprise faces many challenges.  Among these challenges is the number of compliance and governance rules that they must abide by.  Compliance initiatives such HIPAA, PCI and SOX have often placed significant burdens on many organizations.  Now partners and other business associates are placing additional governance demands such as requiring ISO 27002 compliance in order to conduct business with them.  This discussion will provide a overview about these compliance rules and the demands they make upon the business. 

Please RSVP via the web site.

Join us on Tuesday, November 17th, 6:00 PM at the Manchester City Library, as our guest speaker, Ed Adams, President and CEO of Security Innovation, will explore "Real Risks & True Protections - Threats Technology Can & Cannot Protect Against". 

About the Presentation:
There isn’t a security threat that you can think of that some security company’s marketing literature doesn’t promise a solution for. But despite the zeal of marketers there are still some threats to enterprise information
technology that the industry is just beginning to address. Take the phishing phenomenon for example. The premise here is pretty simple: send an email to a user and lie about where you’re sending it from (a bank is always good), tell them they have to urgently log into their account, provide a legitimate looking web link to click on in the message body and then steal their account info as they enter it onto an authentic-looking web page. There are a few technology issues here. The first is that many of the standard email protocols allow one to lie pretty easily about where a message is coming from. The second problem is that the average user doesn’t know if they’re at the legitimate banking site or not; it al looks like one big, complicated URL. This talk highlights the challenges that IT managers face when combating current and future threats. The talk vividly illustrates the limits of current technologies and takes a look forward to how evolving needs will be met.

About our Speaker:
Ed Adams is the President and CEO of Security Innovation, the independent authority on application security risk assessment, risk mitigation and education. He is a seasoned software executive with successful leadership experience in various-sized organizations that serve the IT security and quality assurance industries.

Mr. Adams is the founder and business owner of the Application Security Industry Consortium, Inc. (AppSIC), an association of industry technologists and leaders establishing and defining cross-industry application security guidance and metrics. He is on the board of the National Information Security Group (NAISG).

No stranger to the podium, Mr. Adams has presented to thousands at numerous seminars, software industry conferences, and private companies. He has contributed written and oral commentary for business and technology media outlets such as New England Cable News, Associated Press, CSO Magazine, SC Magazine, Boston Globe, CIO Update, Wall Street Reporter, Investors Business Daily, Optimize and CFO Magazine.

Mr. Adams is in the process of writing a book titled “Information Security Management: Survival Guide”, which will be published by Wiley & Sons and is due out in 2010. He also has maintains a blog with CSO Magazine and is a columnist for CIO Update.

Chapter Meeting Details:

DATE:   Tuesday, November 17th, 6:00 - 8:00 PM
LOCATION: Manchester City Library Auditorium, 405 Pine Street, Manchester, NH 03103

Join us on Thursday, October 8th, 6:30 PM at the Portsmouth Public Library, as our speakers will explore "Governance, Risk & Compliance" and "The Evolution of SIM, SEM and SIEM".

About our speakers:

Bruce Beck, Vice President of Sales and Business Development for Avior Computing.
Mr. Beck has over 30 years of successful sales, business development and management experience in the technology industry, primarily focused on early stage companies.  Mr. Beck significantly contributed to the successful IPOs of three companies where he was an executive.

Mr. Beck joined Avior Computing in 2006, an emerging leader in the Governance Risk and Compliance (GRC) market, as the 3rd employee with responsibility for Sales and Business Development. Avior Computing’s customers include Cigna, Huntington National Bank, United Parcel Services, Guardian Insurance and Pearson Publishing. 

Mr. Beck earned a BS in Business Administration and a minor in Computer Science from the University of Illinois and a Masters in Finance from Boston College.  He is an avid competitive golfer.  Mr. Beck and his wife reside in North Hampton, New Hampshire.
 
Mark Carboni, Technology Consultant at RSA, The Security Division of EMC. 
Mark has over 26 years of technology experience spanning various disciplines, interacting and collaborating with a diverse group of solution seekers, from C level and below.  Mark specializes in providing Security Information and Event Management [SIEM] solutions to NY and New England enterprise customers.

Presentation Abstracts:

Governance, Risk & Compliance

The Executive Board of any large enterprise wants to know that the organization is appropriately protected against potential risk. The ultimate objective of risk management is to define and understand the risk tolerances of the enterprise, manage to those tolerances; optimizing the risk/return of the business. In addition, increased accountability and transparency is being demanded of corporate executives and boards of directors from both customers and regulatory agencies. Renewed enforcement and enhancements of regulatory requirements are becoming more evident and the costs associated with compliance are increasing significantly. This is occurring at the same time that resources are being stretched thin, if not altogether eliminated.

It has been estimated that spending on Governance, Risk & Compliance (GRC) exceeded $32 billion in 2008[i]. Budget priorities are becoming more focused on enterprise and operational risk management. As enterprises continue to spend time, money and resources on GRC, finding effective and economically sound ways to identify and manage the processes and procedures implicit in GRC is an enterprise imperative.

GRC is not just one particular subject, discipline or endeavor. It is the attempt to develop a unified approach to interrelated tasks and events within an enterprise, including among other things:
· risk management
· policy management
· compliance management
· continuity of business management
· asset management
· audit management
· threat management
· incident/event management
· vendor management

In my presentation I will provide an overview of the elements of a GRC program and provide an overview of what to look for in tools to implement a GRC program. I will also relate IT GRC to Operational Risk Management and highlight overlaps and differences.

The Evolution of SIM, SEM and SIEM

Check back here soon...