1. Ireland Chapter
www.isaca.ie | @isacaireland
3rd October 2014

2. PAGE 1
Thecenter of
cybersecurity
knowledge
and expertise.Created by the leading minds in the field, Cybersecurity Nexus™ (CSX) brings
you a single source for all things cybersecurity. From certification, education
and training — to webinars, workshops, industry events, career management
and community — you’ll find everything you need to take your career to the
next level. And, we’ve designed CSX to help you every step of the way, no
matter what your level of experience. Connect with the resources, people and
answers you need… visit us today at isaca.org/cyber.
CYBERSECURITY NEXUS
TM
PAGE 2 AGENDA
PAGE 3 WELCOME
PAGE 4 THOUGHT LEADERSHIP CORNER
PAGE 10 GROUND BREAKING INITIATIVE SPOTLIGHT
PAGE 12 KEYNOTE ABSTRACTS
PAGE 14 ASSURANCE TRACK ABSTRACTS
PAGE 15 CYBERSECURITY TRACK ABSTRACTS
PAGE 16 RISK TRACK ABSTRACTS
PAGE 17 PRIVACY TRACK ABSTRACTS
PAGE 18 ENTERPRISE GOVERNANCE TRACK ABSTRACTS
PAGE 19 APPLICATION SECURITY TRACK ABSTRACTS
PAGE 20 KEYNOTE SPEAKERS BIO
PAGE 21 TRACK SPEAKERS BIO
PAGE 23 PERSONAL NOTES
PAGE 25 CONFERENCE MAP & CPE DISCLAIMER
PAGE 26 CONFERENCE SPONSORS

3. AGENDA
Morning Keynotes
TEA BREAK 11:00 - 11:15 Morning Tracks
Amar Singh The Trust Deficit; Why it's time to Invest in
Trust Now
Founder of Giveaday and the Cyber
Executive Bootcamp Series. Chair of
Isaca's Security Advisory Group
John Walker The Yellow Brick Road of InsecurityCTO and Director, CSIRT Cyber Forensics and
Research at Cytelligence
John Linkous When Business People Attack! Strategies to
Counter Rogue Infrastructure and Behaviors
Founder and Chief Executive Officer,
InterPoint Group
Patrick Curry Intelligence Led SecurityDirector, MACCSA (Multinational Alliance for
Collaborative Cyber Situational Awareness)
Neil Curran Welcome To ConferencePresident, ISACA Ireland09:00
11:15
11:50
12:25
Assurance Location: Canal Foyer
Measuring Control Effectiveness
John Mitchell
Managing Director, LHS Business Control
Cybersecurity Location: Hogan Mezz II
Effective Defense Strategies for Cyber
Security Threats
Alonso Jose da Silva II
Technical Manager, Tempest Security Intelligence
Risk Location: Naly Foyer
Dealing with the insider threat
Matt Lemon
Global Head of Information Security, Daon
The Imperative of Risk Based Audit
Planning. A Case Study from a Large
Complex Organisation
Joe Ryan
Head of Change Management and Innovation - HSE
Detecting Unknown Malware: Memory
Forensics and Security Analytics
Fahad Ehsan
Associate Director, Security Research and Analytics
Supply Chain Risk Management
Richard Hollis
Director Risk Factory
APT, a tale without a dragon?
Panagiotis Droukas
IS Auditor, Bank of Greece
Getting the Most Out of SIEM Data in
Big Data
Dr. Char Sample
Carnegie Mellon University / CERT
Weaponising Cybercurrencies
GMark Hardy
President, National Security Corporation
DELEGATE REGISTRATION 08:00 - 09:00
Location: Mezz II Foyer
MORNING KEYNOTES
Location: Hogan Mezz II
Morning Keynotes
Graham Cluley The rise of the targeted attack - how
organisations and enterprises are fighting a
new enemy
Independent Computer Security Analyst
Theresa Payton A CIO's Fireside Chat: Is it Possible to Make
Money, Maintain Customer Privacy & Trust, and
Fight Cyber Crime?
CEO and President, Fortalice Solutions, LLC
16:00
CONFERENCE CLOSING 17:00
TEA BREAK 15:40 - 16:00 AFTERNOON KEYNOTES
Location: Hogan Mezz II
LUNCH 13:00 - 14:00 Afternoon Tracks
14:00
14:35
15:10
Privacy Location: Hogan Mezz II
#SNS #Google Glass #Video Surveillance
#Quadcopter #Natural person - Will the
future EU Regulation be applicable?
Carolina Moura
Legal Consultant, Macedo Vitorino & Associados
Enterprise Governance Location: Canal Foyer
The ISM Method - A Simple and Effective
Management System for COBIT Compliance.
How a Principle Based Approach Beats Rule
Based Requirements.
Jan van Bon
Chief Editor, Inform-IT
Application Security Location: Naly Foyer
Revisiting XSS Sanitization
Ashar Javed
Research Assistant, Ruhr University Bochum
Privacy Risk Assessments are not easy, so
think different
Gerard Smits
Privacy Advisor, Toendra Beheermaatschappij
GRC Tool Implementation
Raef Meeuwisse
Functional Architect, AdaptiveGRC
Agile Project need Agile Controls
and Audit
Christopher Wright
Director, Wright-Canda Consulting Ltd
Harmonising Privacy Compliance in an
Interconnected World
David Fagan
Commercial Lawyer, Business Legal
GRC and the new COSO framework – Whole
being greater than the sum of parts –
Integration benefits and Challenges,
holistically viewed
Swaminathan (Swami) RV
Senior Director, Maclear GRC
Reducing Risk Through Code Review
Gary Robinson
Project Leader, OWASP
PAGE 2

4. Ireland Chapter
www.isaca.ie | @isacaireland
PAGE 3
WELCOME
Gold Sponsors
Silver Sponsors
Bronze Sponsor
AllState Northern Ireland
2MCSIMPLE SOLUTIONS
FOR A COMPLEX WORLD
British Computer Society Information Risk Management and Assurance (BCS IRMA)
Chartered Institute of Internal Auditors (IIA)
Cloud Security Alliance Ireland (CSA)
International Association of Privacy Professionals (IAPP)
International Cyber Threat Task Force (ICTTF)
Irish Computer Society (ICS)
Irish Information Security Forum (IISF)
Irish Reporting and Information Security Service (IRISS-CERT)
ISC2 Irish Chapter (ISC2)
Northern Ireland Microsoft Technologies User Group (NIMTUG)
OWASP Ireland (OWASP)
Supporting Organisations
Welcome to the ISACA Ireland 2014 Conference “GRC 2.0 Breaking Down The Silos”
Dear Conference Attendee:
Thank you for joining us at this year’s conference. A lot of exciting activities will be going on today, as we share
knowledge on the most critical IT and business issues facing our organisations. Discussions held here will help us
better understand the challenges today and the solutions needed for tomorrow.
Themed “GRC 2.0 Breaking Down The Silos”, the conference features twenty-four sessions providing networking
opportunities and insights into the latest thinking in the fields of Assurance, Cybersecurity, Risk, Privacy/Compliance,
Application Security and Enterprise Governance. We work in a domain where breaking silos and encouraging greater
collaboration, information sharing and pushing information security, risk and compliance higher up the corporate
agenda is of critical importance.
We would like to take this opportunity to thank our conference sponsors and supporting organisations for their
continued support and we invite our delegates to make the most of the literature provided by them at the exhibitor
stands over the duration of the conference.
Our appreciation goes out to all our conference speakers who have given up their time to speak at the conference.
We wish to thank the conference committee for their significant contribution and hard work towards making the
conference a success.
Your feedback is very important to us. If you have any further comments, please do not hesitate to contact any
ISACA Ireland Committee Member. We encourage you to become an active part of the sessions and thank you for
taking time out of your busy schedule to attend the conference.
Neil Curran, CISA, CISM, CGEIT, CRISC‫‏‬ Robert E Stroud, CGEIT, CRISC
Chapter President of ISACA Ireland International President of ISACA

5. PAGE 4
THOUGHT LEADERSHIP CORNER
You cannot have privacy without security but if we are not
careful in the way we implement security, privacy is compro-
mised. Individual privacy is crucial to protect and support the
many freedoms and responsibilities that we possess in a
democracy. However, the laws of society, around the globe,
have reached a point at which the law cannot keep up with the
advancement of technology and the constant change technol-
ogy brings to our lives. Those technological changes are
important and helpful in many ways, but they are overwhelming
our system, and our individual privacy is the canary in our
technological coal mine. If the law can’t keep up to protect
individual privacy, then what responsibility do companies have
to protect privacy? Does your company leave privacy
relegated to a compliance activity or is this considered a
strategic point of differentiation in the marketplace?
WHY IS PRIVACY IMPORTANT?
The ability for us as individuals to maintain parts of our lives as
private remains crucial to democracy, a thriving global
economy, and our personal well-being. Privacy is not about
avoiding embarrassment or hiding bad behavior; privacy is
about choice. In many cases people who expose their ideas or
their personal posteriors online choose to do so. In those cases
in which people were exposed through someone else’s choice,
such as a hacker, the people exposed felt that their privacy was
violated.
You may not realize it, but you and your customers are
connected to the Internet all day, and the cyberazzi are with
you every digital step of the way. Cyberazzi are data compa-
nies that follow you and your customers around, tracking and
storing your habits and behaviors so they can sell that informa-
tion to those who hope to profit from knowing all about you.
Perhaps your company is part of the cyberazzi or you employ
them. The Cyberazzi can provide a valuable service by
helping your company know your customers better so that you
can serve them better, but where should they draw the line?
Business behaves similarly, taking full advantage of all the
resources available to companies for profit and competitive
advantage. Consumers do not expect companies to hold
themselves back from exploring the data they deliver to
companies every minute of every day but they do expect you to
protect it.
DON'T WAIT FOR GOVERNMENT REGULATIONS - BUST
THE SILOS AND SET CLEAR LIMITS
In the aftermath of World War II, privacy was recognized legally
and culturally as a fundamental human right in Europe by the
European Convention on Human Rights. Each nation in the EU
enacted legislation implementing these official statements. The
EU member states created additional protections when they
adopted the Lisbon Treaty Establishing the European Commu-
nity and the Charter of Fundamental Rights. Both of these
enhanced the protection of personal rights and freedom in the
processing of personal data as a fundamental right. Mean-
while, US businesses are regulated under relatively lax federal
data laws and a patchwork quilt of state based laws. Take
heed because any company that collects data in Europe must
comply with the more protective laws there, in Canada, and
elsewhere.
NOW IS THE TIME TO ACT
As a company, you may track yourself and your customers
using the everyday technology and conveniences that we have
become highly dependent upon. Many companies start off
correctly by delegating the protection of privacy to a Privacy
Officer or a Risk Officer and then ask them to make sure the
company is in “compliance” with geographic laws. This is not
enough to truly protect the privacy of your customers’ data or to
protect them if your company’s network defenses are
breached. If your company waits until standards of compliance
are decided, it might be your company that gets made an
example of through the court system, regulatory bodies, or
even the court of public opinion in setting the standard.
Take the next 15 minutes to ask yourself if you have you busted
down the silos in your company.
Use these questions to guide the conversation:
1. Do we know where all the silos of customer data are stored
and does our privacy or risk officer have visibility into the
tools and policies protecting that data?
2. What is our digital “shredding” strategy when we no longer
need the customer data that we collected?
3. What is our specific strategy for assessing the risk around
our customer data and any big data and behavioral
analytics tied to our customers?
4. Have we practiced an enterprise-wide digital disaster?
This digital disaster would simulate the theft of sensitive
and confidential information and would include all
departments such as legal counsel, risk, marketing,
customer service, finance/accounting, your executive, the
board, and your technology department.
5. Are we building new silos of customer data right now
without an enterprise strategy for protecting that data?
Many of our individual and essential liberties, such as freedom
of speech and the freedom of assembly, must be protected. If
we are to enjoy personal freedom and security, these depend
on privacy, obscurity, and anonymity to reach their full expres-
sions. We have spent the past decades allowing intrusive
technologies to crawl deep into our lives without making a
stand for limiting their reach. Do not let our privacy slip away
because we were all too hypnotized by shiny new technology
to pay attention to what was happening all around us. Compa-
nies have stood by, for the most part, waiting for regulations to
tell them what to do. The time has come for all of us, including
companies, to take a stand and to raise our voices that
individual privacy must be protected. Be a thought leader and
take a stand on how you will protect your customers’ privacy.
Be bold and communicate your strategy to them. Your custom-
ers will thank you.
Theresa Payton, Former White House CIO, CEO of Fortalice
Solutions and co-author of the new book: Privacy in the Age of
Big Data: Recognizing Threats, Defending Your Rights, and
Protecting Your Family
BUSTING THE SILOS TO PROTECT CUSTOMER PRIVACY MAKES US ALL MORE SECURE

6. t: +353 1 2101711 e: info@espiongroup.com www.espiongroup.com follow us on
Oracle Day
HOw Are YOu respOnding
tO digitAl disruptiOn?
register tOdAY:
oracle.com/goto/uk/oracledays
JOin us At One OF
3 eVents
Dublin - 12th November
Manchester - 18th November
London - 19th November

7. PAGE 6
I spend a lot of time reviewing risk registers. It is an amusing
adjunct to my job as an IS auditor. ‘Amusing’, I hear you say. ‘How
can something so serious be amusing’? Well, it’s the law of
unintended consequences. The three things on a risk register which
often cause me to chuckle are: the inherent risk score; the controls;
the residual risk score. Why the amusement? Primarily, because of
the optimism of the creators of these important pieces of informa-
tion. Let me explain each in turn. The inherent (raw, or gross risk)
is where you would be without any controls in place. It comprises
two components: likelihood (possibility) and consequence (impact).
So if you were (say) a large on-line auction house assessing the
likelihood and consequence of an unauthorised person stealing
your customer database, then without any controls in place you
would likely score the equation as high likelihood and high conse-
quence. If you used a red/amber/green (RAG) status it would be
red/red. You would probably assess this as undesirable and decide
to put some control(s) in place. Now the risk equation is remarkably
fickle and often you find you can only manage one side of it. In this
case you could probably reduce the likelihood side of the equation
by using some form of access control and privilege allocation.
Indeed, you may decide this is so good that you reduce the
likelihood of unauthorised access to low (green). But what about the
consequence if unauthorised access is obtained? Well, it is still
disastrous and should be scored as high (red). So the score has
changed from red/red to green/red. Which is still pretty frightening,
but as you have dealt with one side of the mess you convince your
superiors (if they are even interested) that you have reduced the
risk. Even more so if you make the mistake of multiplying the two
attributes together, which many risk charlatans do. Here is an
example. Let’s assume that we have a range of one to five for each
attribute. In the original no control (inherent) scenario, we score
each attribute as five and multiply them together to give an inherent
risk score of twenty-five. After putting in our access control we now
rescore the likelihood as one, but the consequence remains at five.
Multiply one by the other and our risk score is now five, an apparent
five-fold reduction in risk. What a result! However, a low likelihood
is not a ‘no’ likelihood and if our access control is breached we are
in serious trouble. However, using the multiplication mechanism it
does not look that bad. After all, it’s only a five.
The introduction of the access control has reduced the likelihood of
a breach from red to green, but then only if the control is
one-hundred percent effective. This is where the skill of control
evaluation comes in and is this component which causes me so
much amusement. In the case of the eBay breach we know that an
internal employees’ access credentials were breached. Once ‘they’
have your access credentials, then they have your privileges. They
effectively become you and no amount of intruder detection is going
to prevent them from doing everything that you are allowed to do.
No alarms are triggered; just you doing your job. Which is why it
took a couple of months for the breach to be noticed. Now it is a
dichotomy to me that organisations appear to have different authen-
tication criteria for internal and external access. For the former it is
usually a simple user ID and password, while for the latter it is often
a one-time password generator. I know a number of banks where
this holds true and have never figured out why they discriminate
between the two; especially when internal staff often have greater
privileges than external users. Breaches occur because of a combi-
nation of complacency and trust. Neither of which are a control. If
we assume that the eBay breach was not conducted by an insider
(and we are told that this was the case), then the attacker gained the
access credentials of a privileged staff member. If a couple of
simple authentication factors, say the one-time password generator
with a token, had been a requirement, then the attack would have
been thwarted at birth. Truly moving the likelihood from red to
green. You notice that it still does nothing to lower the consequence
which remain red.
I use a simple pseudo-mathematical mechanism to score control
effectiveness for both likelihood and consequence, which I will not
elaborate on here due to the word count imposed by the editor. I use
this on every so-called control in the risk register to see if the risk is
really mitigated by the control. The answer is usually depressing to
the risk owner who often asks ‘what else can I do’? The answer is
to employ a control expert (beware of charlatans). S(he) may
depress you even more, but at least you will truly know the risks that
you a living with. On a more positive note the resulting dialogue
often raises both risk awareness and control effectiveness. IT
people tend to be the optimistic Tiggers from Winnie the Pooh,
whereas us IS auditors are the pessimistic Eyhaws. However,
unlike Eyhaw we have some pretty good tools to support our views
on the effectiveness of your controls.
John Mitchell is Managing Director of LHS Business Control, a
corporate governance consultancy. He is a member of BCS Council
and Chair of the Information Risk Management and Assurance
(IRMA) specialist group.
THOUGHT LEADERSHIP CORNER
MANAGING RISK IS ALL ABOUT EFFECTIVE CONTROL

8. Attend the RSAArcher GRC Summit EMEA 2014
on November 4th in London.
This year’s EMEA Summit promises to be the best one yet; the premier EMEA wide event for governance,
risk and compliance professionals. Discover the opportunity that lies ahead for your organization when
you learn about a risk intelligence approach to GRC. Hear from RSAArcher GRC experts and leading
organizations that use RSAArcher GRC solutions. This complimentary event will be held at the Chelsea
Football Club in London and includes an exciting agenda, breakout sessions, guest speakers and
numerous networking opportunities to meet with your GRC peers. Register now, as places are limited.
http://www.emc.com/campaign/global/archer/rsa-archer-grc-summit-2014-emea.htm
ISACA Ireland Chapter Certification “ Top Three” Roll of Honour
ISACA certifications are recognized globally as an industry standard and in many cases as a job prerequisite for IT audit, assurance, control,
governance, risk, compliance and security related positions. Our certifications can help you as a professional demonstrate your expertise and
abilities to both your company and peers.
ISACA Ireland is delighted to recognize chapter members who have achieved a “Top Three” exam score while taking one of our CISA, CISM,
CGEIT or CRISC certification exams. Those members were recently recognized at an award ceremony which took place at the 2014 Chapter
Annual General Meeting (AGM) on the 18th of September 2014. The ISACA Ireland Committee wishes to congratulate the current roll of honour
members and is looking forward to adding further members to the roll of honour as future certification exams take place.
For further information on this initiative, please email certification@isaca.ie
Gillian Buckley
Filipe Cardoso
Ian Cooke
Neil Curran
James Fitzpatrick
Eoin Fleming
Sarah Goodwin
Annemarie Lilly
Lisa Magee
Karin Mulvihll
Stephen O'Boyle
Sinead O'Connell
Sean Whelan
Terence Wymer
Niall Ahern
Helen Barron
Stephen Breen
Ambrose Ewins
Colm Fahy
Colm Fegan
Derek Fitzgerald
Desmond Fitzmaurice
Kelvin Garrahan
Brendan Gormley
John Handley
Marc Hanlon
Marc Hanna
John Haren
Conor Hogan
Brain Honan
Austin McCartney
Joseph McDonagh
Stephen O'Boyle
Frank O'Keeffe
Mairtin O'Sullivan
David Ryan
Terence Wymer
Mark Cawley
Hugh Clyne
Noel Comerford
Andrew Cooke
Barry Corish
Niall Cronin
Neil Curran
Colm Daly
Richard Day
Peter Diggins
Austin Dunne
Marc Hanlon
Keith Healy
Jennifer Hurley
Alan Kelly
Jacek Krajewski
Colm Lennon
Roy Madden
Jacqueline Manning
Ronan McCabe
Paul McKiernan
James McLoughlin
Gary McPartland
Damien Moran
Sandra Murphy
Eileen O'Mahony
Mairtin O'Sullivan
Neil Relihan
David Robert
Dave Ryan
Barbara Sheedy
Ciaran Treacy
Everett Breakey
Ian Cooke
Neil Curran
Francis Derwin
Colm Lawlor
Ger OMahony
Judit Pongracz
DerekPowell

9. PAGE 8
ICT regulators tend to follow a rule-based approach. Although – if asked – they
soon enough admit that they actually don’t believe it is the right approach. They
would love to see their target audience being so well organized that they can
stand up to any test. So they know a rule-based approach starts at the wrong end
of the stick. But still – they always start at that end of the stick. Makes you wonder
why....
Healthcare
Healthcare institutions are increasingly facing tough demands in the field of
information security. In practice this is often expressed in terms of ISO27001
controls. Dutch healthcare regulators use a local standard, NEN7510, which is
almost identical to ISO27001. In 2010, the regulators decreed that all healthcare
institutions had to meet a subset of 33 controls, out of the full set of 125 controls
in NEN7510. This NEN standard was recently updated to follow ISO27001:2013,
but the set of controls used for healthcare institutions is still largely the same.
In their audits, the regulators didn’t demand hard scores, instead they empha-
sized that the organization should rather be able to show that they were system-
atically working towards a better score on the selected controls. In fact, the
regulators stimulated the institutions to improve their quality in a methodical way,
so that they would improve their assessment score in the next audit. In practice
however, they are still auditing against the same set of controls. This approach is
now stimulated even further, because the full set of NEN7510 requirements was
recently promoted to law for any healthcare organization using the unique citizen
registration number in their systems.
Finance
This approach is very similar to what is currently happening in the financial world:
in the Netherlands, that sector is also sampled by means of a (self) assessment.
The supervisor in this case is the Dutch national bank (De Nederlandsche Bank,
DNB), and the controls they use are derived from COBIT, enriched with guidance
from ISO27002. But the situation is essentially the same: a control-based
approach (rule-based) does not lead to the desired result. Instead, banks,
pension funds and insurance companies should turn to a quality management
approach that produces the desired information security assurance inside-out.
In the mean time, healthcare institutions have learned to achieve at least maturity
level 3 (CMMI), with a methodical approach based on the ISM Method, within a
year, and level 4 is within reach shortly after. Not by following a rule-based
approach, but by means of gradual improvement. “Old wine in new bottles,
PDCA, been there, done that....”. The standard response. But when you look at
the daily practice of our most elusive experts, with all the certificates you can think
of on their wall, they always start on the rules end of the stick, using best practice
guidance from sources like ITIL, COBIT, ASL, BiSL, and other frameworks. Hey,
and why not? Nobody ever got fired for hiring an ITIL consultant, or a COBIT
consultant, or ....
Dot on the horizon
The essence is that the road to information security is not walked by trying to start
at the controls end of the stick – whether there are 33 or 125, they still represent
tricks. And the real trick is that you should turn it around: if you manage to teach
the organization an integrated and systematic way of managing their work, you
are leading them to a dot on the horizon.
"If you want to build a ship, don't drum up people to collect wood and don't assign them tasks and
work, but rather teach them to long for the endless immensity of the sea."
Dots on the horizon will be changing all the time, but walking the road to the horizon will largely stay
the same.
The method
The method that Dutch organizations have learned to use is the ESM Method –
Enterprise Service Management, developed in 2005. ESM is a method to get in
control of any type of service organization, or any combination of service sections
in an organization. The information management domain has proven to be a very
grateful domain for ESM, because organizations had to gain ultimate control over
their IT services, as a result of the ever growing dependency on IT. The IT specific
application of the generic ESM Method was called the ISM Method: Integrated
Service Management. In practice, ESM was applied to various other service
domains, including the “business information management” domain (where it is
labeled FSM - Functional Service Management), and to combinations of IT and
other service sections (e.g. medical technology, education), where the term ISM
or ESM was used.
In IT organizations, the ISM Method focuses on the management system (the
engine), and on the turnaround the management and staff need to make to adopt
a systematic approach to their work. It takes 13 weeks to get all (existing)
instruments in place in a fully standardized project, and then 6-9 months are
spent teaching the organization to apply the method to get used to a systematic
step-by-step improvement approach.
The results of the ISM Method are attracting lots of attention: organizations can
achieve improvement goals (like ISO27001 or COBIT controls) in shorter times
and at lower cost then before – and the results are lasting. Tool providers,
consulting organizations, game developers, and trainers in the Netherlands are
now adopting the method to create a new market; one with a much better
cost/benefit ratio for their customers.
The big turnaround
The major advantage of starting at the other end of the stick is that you invest in
an efficient and effective systematic approach, that can be applied again and
again in a cyclic improvement strategy – as Shewhart and Deming taught us half
a century ago. The new IT world is full of that approach, but only as long as it
concerns technology: SCRUM, LEAN, DEVOPS.... It’s about time the manage-
ment consultants join the bandwagon and pick up what Eliyahu Goldratt wrote
down on the Theory of Constraints.
And following a rule-based approach is not what Goldratt, Deming and Shewhart
meant.
In the Netherlands, the first finance organizations now work on their management
system from a systematic inside-out approach, starting at the other end of the
stick – even though their regulators confront them with rules to be followed and
controls to be achieved - preferably by the letter, if you believe your auditor.
Within a year they grow 2 levels on a 5-level maturity scale. Their road is the
same, even though their dot on the horizon will differ.
Banks, insurance companies, pension funds, hospitals, nursing homes, care
clinics, most of them still need to make the big turnaround to a systematically
assured quality management. Luckily, they all aim for the same (improvement)
and they all can use the same trail to their dot on the horizon following a standard-
ized methodical approach that saves time, money, and worries. But the biggest
advantage lies in the simplicity that it buys you. If your 'inside' is put together well,
it doesn’t matter much what stick they use to measure you.
Jan van Bon, Inform-IT, Knowledge Center for Service Management
THOUGHT LEADERSHIP CORNER
The wrong end of the stick

10. Certification Europe
Block 20A, Beckett Way,
Park West Business Park,
Dublin 12, Ireland.
t: + 353 1 642 9300
info@certificationeurope.com
certificationeurope.com
DUBLIN - LONDON - BELFAST - MILAN - ISTANBUL - OSAKA
LET’S TALK ABOUT YOU!
CONFIDENCE | ASSURANCE | CERTAINTY
/certificationeurope
@certeurope_
/company/certification-europe
CHANGING
STANDARD
THINKING
FROM YOUR
BACK OFFICE TO
THE FOREFRONT
OF THE MARKETS.
Wherever you work
to secure your next
business opportunity,
we are there to
help make it real.
Across your network.
And around the world.

11. PAGE 10
Recently, a charity, the British pregnancy Advisory
Service BPAS, was fined a significant amount by the UK's
information Commissioner's office or ICO.
A summary of what happened: An opportunist hacker,
who had anti-abortion views, tried and succeeded. He
found an unlocked door to an information treasure trove.
The advisory service was unaware that they were retain-
ing information collected from the public and storing it, for
several years. Fortunately the data was not leaked as the
police got to him on time.
Regardless, the ICO decided to penalise the charity and
served it a £200,000 monetary penalty notice. The
primary reason: A serious contravention of the Seventh
Data Protection Principle. Part of the ruling included the
following: “In particular, BPAS failed to take appropriate
technical and organisational measures against the
unauthorised processing of personal data stored on the
BPAS website"
The Custodians
Charities are custodians of not only personal information
but as I call it super private and extremely sensitive
information. This may not be true in some cases but in
many cases charities support the vulnerable, the needy
and those who are unable to defend for themselves. To
offer this help charities understandably must collect and
process information that a regular organisation selling a
fizzy drink would not need to for example.
Let’s take one example of a medical charity: a charity
offering advice on cancer would need and would probably
want to collect as much personal medical information
about the subject and possibly the subject’s relatives to
offer help advice and guidance. All of this information has
to be stored, processed, protected and importantly it has
to be available to those who need it so that they may offer
the necessary services to the members.
Charities and Cyberspace
Given the amount of information and the dependency on
the information it is totally understandable and completely
natural that charities are embracing cyberspace as much
as other organisations. They are rightfully seeking the
benefits that cyberspace and technology have to offer
and that includes embracing the services in the cloud and
embracing cyberspace in general. But there is a problem.
The benefit of adopting the Internet leads to the same
consequences that a commercial organisation would
have to face up to. That of being exposed to the hostilities
of cyberspace, the hostilities off the opportunist hackers
often don’t think of consequences who often wonder
aimlessly in cyberspace looking for the next attack, the
next victim and in the case of the British pregnancy
advisory service, mentioned in the introduction, this is
exactly what happened.
No Distinctions between a charity and a regular firm.
In an article in 2013, titled "Public won't cut charities slack
on data protection issues, warns ICO” published by the
http://www.civilsociety.co.uk/ the ICO makes it very clear
that, for example, when it came to complaining about
misuse of call data, in their opinion “..the people pushing
that button (reporting a possible misuse of their data) on
our website are not drawing distinctions about who has
contacted them – they just see this as nuisance market-
ing”
The number one priority, after survival, for charities is cost
effective operations. Information security data protection
IT optimisation etc. are all good to have however, they are
not often a priority for most. In fact most charities probably
don’t have complicated and structured IT organisations.
job titles awarded to one individual to save costs and
focus on their primary objective of giving back to the
community.
The Time is Now!
The GiveADay platform allows Charities to tap into High
Calibre Professionals to combat cybercrime. Up to 100
high calibre IT & Data security professionals, including
CISOs, VPs and CTOs from different UK organisations
have signed up and committed to give a day to help
charities in all aspects of IT, Security & Data Privacy.
Charities including Great Ormond Street Hospital, Future
First and Cancer Research have already signed up to the
GiveADay scheme prior to its official launch on October
9th 2014.
Trust is Vital
In the end, charities, or the third sector as they are often
referred to, rely on the trust of their sponsors, donors and
beneficiaries to function. A cyber breach that compro-
mises personal and sensitive information could severely
impact the delicate fabric of trust that all parties place in
charities. It is time for the skilled and experienced
amongst us to step up and share our knowledge and
support them.
GiveADay is a non-profit organisation.
www.GiveADay.co.uk.
GROUND BREAKING INITIATIVE SPOTLIGHT
Preventing the lethal breach - Supporting charities in cyberspace

12. Johannes Van Thorr
Stephen Wright
Introducing Cobit 5 Online
COBIT 5 online gives you
more flexibility than ever
before
Practitioners turn to
COBITÆ as a trusted
resource for delivering
results. From reducing risk to
improving operational
efficiencies to supporting
organizational goals, the
tools and resources available
help you deliver on stake-
holder needs.
Now online, with new
profession-focused guid-
ance, COBIT is even more
valuable, relevant and
usable than ever before.
New Customizable Goals
and RACI Planner Tool
Make Implementation Easy
Customize your workflow and
stay in control of projects by
aligning goals, practices,
activities and roles with
stakeholder requirements.
• Translate stakeholder needs
into actionable goals
• Expose gaps in critical
IT-related activities
• Streamline day-to-day
processes
• Ensure value delivery on
stakeholder needs
Gain access to the insights, tools and guidance you need to
deliver results.

13. PAGE 12
KEYNOTE ABSTRACTS
THE TRUST DEFICIT; WHY IT'S TIME TO INVEST IN TRUST NOW!
Amar Singh - Founder of Giveaday and the Cyber Executive Bootcamp Series. Chair of Isaca's Security Advisory Group
Most organisations have specialists in one or more of specialisms including Audit, Cybersecurity, Risk Management, Privacy
Management, Application Security, Enterprise Governance, Compliance, Threat Modelling & Standards.
Often a combination of exacting targets and organisational structures means that these professionals end up working in silos
resulting in little or no cross departmental interaction. There is no suggestion that these vaulted environments lead to increased
cyber attacks or data breaches. However, there is a direct casualty of this introverted approach and it is TRUST. Customer trust,
investor trust and employee trust.
This may not matter much to some, but in the IoT future a critical vulnerability in a car engine’s operating system may not only lead
to an embarrassing recall. It could lead to a catastrophic mass exploit. It will lead to a decimation of Trust.
THE YELLOW BRICK ROAD OF INSECURITY
John Walker - CTO and Director, CSIRT Cyber Forensics and Research at Cytelligence
2014 is a, a year in which the term ‘Cyber Security’ has on occasion become synonymous with failure. The tagline Cyber Security
also represents a topic which is discussed at much length by Professionals – a conversation in which the words ‘Cyber’ and
‘Security’ tend to appear in the same sentence as related bedfellows. However, with a backdrop of adversity, security breaches,
hacks, and well publicised exposures, with the associated consequences, it would seem that on occasions there is a distinct
lacking of appreciation of what ‘Cyber’ and ‘Security’ mean when conjoined.
In this Keynote, Walker will introduce some case-studies and facts, and seek to demonstrate just where organisations can go
wrong on their Yellow Brick Road to achieving their Security Mission objectives.
INTELLIGENCE LED SECURITY
Patrick Curry - Director, MACCSA (Multinational Alliance for Collaborative Cyber Situational Awareness)
• The 15-nation Multinational Experiment 7 (MNE7) concluded that 80% of major cyber incidents had a real world crisis manage
ment impact, and organisations that didn?t share cyber information were 90% ineffective. Intelligence-led security depends on
collaboration. Consequently, MNE7 nations required the implementation of its Information Sharing Framework for Collaborative
Cyber Situational Awareness (CCSA), which MACCSA has been formed to do.
• What is collaborative cyber situational awareness
• The requirement for collaborative risk management, cyber controls frameworks standards and interoperable assurance across
organisations.
• The MACCSA Information Sharing Framework and supporting capabilities
• Federated trust
• Taxonomies and interoperability
• Transport mechanisms and security automation
• Threat info sharing, collaborative risk management and more
• Implementation maturity and motivation for business adoption
• Links with counter-fraud, cyber-crime and crisis management
• Related US, EU, industry sector and international activities.
• The role of international standards
• The motivations for adoption.

14. Ireland Chapter
www.isaca.ie | @isacaireland
WHEN BUSINESS PEOPLE ATTACK! STRATEGIES TO COUNTER ROGUE INFRASTRUCTURE AND BEHAVIORS
John Linkous - Founder and Chief Executive Officer, InterPoint Group
Historically, the job of GRC constituents – including risk management, information security (IS), IT, and others – has been to bring
order and structure to the enterprise for the purposes of both efficiency and improved governance… and because without them,
Really Bad Things® are more likely to happen. Unfortunately, business has often been a rule breaker rather than a rule follower,
operating counter to these GRC structures under the belief that they are a hindrance rather than an enabler, slowing down growth
and adding an undue burden of compliance and other due diligence costs. GRC practitioners, on the other hand, have had to not
only battle the technical aspects of implementing processes and controls to reduce risk, but also trying to win the hearts of minds
of the very same business constituents that view them with suspicion.
Periodically, business and GRC come into alignment, but generally only when the business is threatened, such as with financial
sanctions for non-compliance, or fears of becoming the next Target or Home Depot due to poor IS controls. But as the fictional Dr.
Ian Malcolm wisely identified, “Nature… finds a way.” Today, we see new fissures forming in the business/IS relationship, driven in
large part by cloud infrastructures and emboldened business leaders who have no qualms about engaging in new delivery
systems that provide new capabilities and efficiencies – even when these structures circumvent GRC structures in the process. In
this presentation,
John Linkous will present real-world anecdotes of how business constituents ? ranging from individuals to entire business units ?
“go rogue”, why they do it, and what GRC professionals can do to stem the tide and close the risk gap that these behaviours
present.
THE RISE OF THE TARGETED ATTACK - HOW ORGANISATIONS AND ENTERPRISES ARE FIGHTING A NEW ENEMY
Graham Cluley - Independent Computer Security Analyst
Internet companies are used to fighting traditional hackers, but how well prepared are they to protect their valuable data when the
enemy might be not just organised criminals, but nation states with significant technical and financial resources?
As giants like BAE, Google, Lockheed Martin, Qinqtiq, and the Australian secret service have all been hit by cyber espionage,
what hope is there for the rest of us?
Security veteran Graham Cluley explains that the recent revelations by NSA whistleblower Edward Snowden have raised aware-
ness about the risks of state-sponsored espionage, not just targeting other governments - but also the very real possibility that
intelligence agencies are interested in hacking into the systems of companies to gather information about business plans, steal
intellectual property or spy on individuals.
Cluley explains that even small businesses are potential victims of state-sponsored espionage, compromised by hackers as part of
a deeper disguised attack against more obvious targets.
As some of the world's biggest tech companies are revealed to have been snooped upon by intelligence agencies, Cluley
describes the methods and techniques used in such attacks, and what can be done by companies to best protect the privacy of
customers and maintain trust.
A CIO'S FIRESIDE CHAT: IS IT POSSIBLE TO MAKE MONEY, MAINTAIN CUSTOMER PRIVACY & TRUST, AND FIGHT
CYBER CRIME?
Theresa Payton - Former Whitehouse CIO & CEO and President Fortalice Solutions, LLC
Theresa will shine the spotlight on the challenges that a CIO and the wider IT Governance family faces meeting the expectation of
supporting the goals of their organisation and those of their boards and their regulators; while maintaining customer privacy & trust,
and staying ahead of the curve on cybercrime.
PAGE 13
KEYNOTE ABSTRACTS

15. ASSURANCE TRACK ABSTRACTS
APT, a tale without a dragon?
Panagiotis Droukas - IS Auditor, Bank of Greece
A series of recent fraud incidents targeting e-banking customers in Greece put the spotlight on APT. In my presentation, I will try to detail the series of events that led us to the discovery
of a carefully orchestrated and executed plan to defraud e-banking customers and some useful conclusions after this incident:
• Fraudsters have become more sophisticated and well organized. The spear phishing e-mails were well-written and
their targets were treated with a personalized message. Also, a network of money mules was set-up in advance in
order to cover their tracks and distract the police.
• Traditional e-banking transaction verification controls like OTP dongles proved useless as the malware installed to
each e-banking victim was able to modify webpages and perform wire transfers without the client's consent.
• The anti-fraud software, usually overlooked by the Information Security Officer, proved to be a valuable ally in
discovering and managing the whole crisis. Also, non IT controls, like imposing transaction limits or blocking
suspicious transactions, proved more efficient than IT controls in this case.
• Too many authorities are responsible for handling such issues including the Greek banking association, the central
bank and the police to name just a few. Usually they are too busy fighting turf wars between them than putting out
the fire.
Parts of this presentation will be also delivered in "IDC Cloud Computing, Enterprise Mobility and Datacenters Roadshow", scheduled for September 19th in Athens, Greece. Please note
that only the modus operandi of the fraudsters will be presented and not the details of the banks that were the target of this attack.
Measuring Control Effectiveness
John Mitchell - Managing Director, LHS Business Control
Capability Maturity Modelling (CMM) is a powerful tool for gaining consensus, but is too judgemental for measuring the capability of a process to deliver its objectives. ISO 15504 provides
an internationally accepted way of assessing whether a process will meet its objectives, but is difficult to assess without an understanding of risk management. Whatever method is
chosen there is a need to measure the effectiveness of any controls which are relied on to manage risk. Although the concepts of prevention, detection and reaction controls are well
understood measuring their individual effectiveness is fraught with difficulty. This session will provide a solution which can be applied in any situation where the need for something more
than judgemental assurance is required.
Risk Analysis in the view of IS Auditors
Claudio Cilli - Professor, University of Rome “La Sapienza”
The audit approach is different from IT Auditor’s and Internal Auditor’s point of views, even for the IT. The objectives of risk analysis are often different, even both aimed to company
mission success and protection. An IS Auditor with knowledge of Internal Auditor?s approach can better perform his duties, resulting in a more comprehensive and convincing result.
In this presentation will be shown the two different philosophies with a comparison of various methodologies. In addition, the role of CobIt, as risk assessment and risk management tool
will be demonstrated with many examples. A case study with a description of author’s specific risk analysis method will end the session.
PAGE 14

16. Ireland Chapter
www.isaca.ie | @isacaireland
PAGE 15
Detecting Unknown Malware: Memory Forensics and Security Analytics
Fahad Ehsan - Associate Director, Security Research and Analytics
The main purpose of the presentation is to show the audience how open-source tools can be used to develop an in-house automated Memory Forensics Solution, which has the capability
to detect 'unknown' malware. A demo of this solution will be shown, and how it can be used to find 'unknown' malware. This solution is based on the speakers personal research.
Presentation will start with a quick introduction to the concept of Unknown Malware, followed by recent trends in malware detection. The 'On-Host Forensics' is latest development, with
tools like Mandiant Redline, Carbon Black, Bromium becoming popular. These tools provide 'Host Based' malware detection capabilities relying on Memory Forensics techniques.
Memory Forensics has been a traditional Incident response technique. With latest tools many of the Manual steps involved in Memory Analysis can be automated. Malware can be
detected based on intelligence feeds or statistical analysis by 'On-host Forensics' tools.
While each of these tools have their strengths, ;the speaker ;would like to show how open source tools like 'Volatility' can be utilised to extract memory fragments automatically and feed
this data to an analytics engine. The speakers analytics engine is based on SQL server, capable of processing data from 100s of machines simultaneously. In this POC solution, the clients
send their Memory Analysis from Volatility every 30 minutes and the analytics engine processes data through automated jobs.
Approach one - Traditional way of finding malware, using Threat Intelligence and IOCs :Fahed will simulate a Threat Intelligence feed, and show howthe solution can be used to detect
malware based on data received from OpenIOC or Cybox.
Approach Two - Finding Malware by benchmarking your environment: Speaker will perform analysis on Memory fragments to identify changes on the hosts using Security Analytics
Engine. The engine keeps track of changes on the host and identifies anomalies by comparing against last known state.
This will be followed by suggestions how such a solution can be deployed in an enterprise environment with the pros and cons.
The presentation will end with sharing where Memory Forensics sits within the Security Analytics space today. And what can we expected from it in the future as Security Analytics
Solutions mature.
Effective Defense Strategies for Cyber Security Threats
Alonso Jose da Silva II - Technical Manager, Tempest Security Intelligence
Organizations are increasingly rallying around a new way approach on how to think about cybersecurity and manage their risk. Intelligence-driven security, or threat-based defence, has
been defined as a risk management strategy that addresses the threat component of risk, incorporating analysis of adversaries, their capabilities, objectives, doctrines and limitations. This
approach to cybersecurity has not appeared out of a vacuum, but has directly evolved from the identified limitations of the traditional perimeter-based security model, focused mostly on
static defences and defending against known attacks. Forward-looking organizations, mostly in the military, defence and financial services sectors, have started adopting new strategies for
defending their networks, based on continuously collecting, analysing and understanding how the threat operates, and leveraging information from previous attacks to predict and protect
against future breaches. Traditional strategies focus mostly on the vulnerability component of risk, while intelligence-driven security leverages the current wealth of information on the
threat component of risk, ultimately leading to a more effective security posture. Adopting a threat-based defence approach recognizes the need to shift from mostly prevention-oriented
practices to building capabilities around incident response, identifying attackers while they are still inside the network and preventing them from acting on their core objectives (exfiltrating
sensitive data, for example). Leveraging information on the tactics, techniques and procedures (TTPs) used by the threat is key to preventing future breaches, since there is an economic
incentive for adversaries to repeat their modus operandi and reuse tools and techniques between attacks.
Organizations are increasingly rallying around a new way approach on how to think about cybersecurity and manage their risk. Intelligence-driven security, or threat-based defence, has
been defined as a risk management strategy that addresses the threat component of risk, incorporating analysis of adversaries, their capabilities, objectives, doctrines and limitations. This
approach to cybersecurity has not appeared out of a vacuum, but has directly evolved from the identified limitations of the traditional perimeter-based security model, focused mostly on
static defences and defending against known attacks. Forward-looking organizations, mostly in the military, defence and financial services sectors, have started adopting new strategies for
defending their networks, based on continuously collecting, analysing and understanding how the threat operates, and leveraging information from previous attacks to predict and protect
against future breaches. Traditional strategies focus mostly on the vulnerability component of risk, while intelligence-driven security leverages the current wealth of information on the
threat component of risk, ultimately leading to a more effective security posture. Adopting a threat-based defence approach recognizes the need to shift from mostly prevention-oriented
practices to building capabilities around incident response, identifying attackers while they are still inside the network and preventing them from acting on their core objectives (exfiltrating
sensitive data, for example). Leveraging information on the tactics, techniques and procedures (TTPs) used by the threat is key to preventing future breaches, since there is an economic
incentive for adversaries to repeat their modus operandi and reuse tools and techniques between attacks.
Getting the Most Out of SIEM Data in Big Data
Dr. Char Sample - Carnegie Mellon University / CERT
Big Data presents both opportunities and challenges to our current understanding of SIEM data. The very nature of Big Data allows for individuals to derive whatever is desired from the
data, however, how do we gather meaningful information? Understanding how to get the most out of Big Data requires a mind shift that is opposite the training of security professionals.
This talk begins by defining Big Data and the key architectural components of Big Data, it then moves to an explanation of data lineage and how data lineage can be used to inform and
structure queries. Finally, we will provide examples that illustrate how SIEM data can be expanded in the Big Data environment to provide greater network situational awareness.
CYBERSECURITY TRACK ABSTRACTS

17. PAGE 16
RISK TRACK ABSTRACTS
Detecting Unknown Malware: Memory Forensics and Security Analytics
Fahad Ehsan - Associate Director, Security Research and Analytics
Threats to our networks, infrastructure and corporate information come from many places. We spend extraordinary amounts of our sparse budgets on putting in technical controls to
keep external attackers out. We usually incorporate IPS and IDS systems with automated monitoring and alerting, sitting and waiting for the next port scan.
Independent research shows that whilst the external attacker is a real and ever present risk, the greater risk comes from within our organisations and from the very staff we work with.
Whether it?s malicious or accidental, incidents that originate internally cost far more to resolve and can cause more damage than other types of attacks. Security Awareness Training
only goes so far and helps to reduce the accidental leakage but what should organisations be doing to monitor incidents or attacks that originate from within and from the malicious
insider intent on committing fraud or theft? This presentation will show some of the ways that we can build a framework that can monitor and prevent the insider threat.
Bitcoin is dead. Long live Bitcoin. Satoshi Nakamoto was no dummy. In the early days, he (they) mined over 1,000,000 Bitcoins when nobody really cared. If Bitcoin (or any other
cybercurrency) were to increase in value at the rate it did last year, someone will be holding a massive currency weapon. George Soros destabilized the British Pound in 1992 and made
over ?1,000,000,000 profit. In the largest counterfeiting operation in history, Nazi Germany devised Operation Bernhard to destabilize the British economy by dropping millions of pound
notes from Luftwaffe aircraft. If the holder of a giga-cybercurrency has a currency digital weapon that works frictionlessly in milliseconds, against whom will he target it? Can it
destabilize an entire government? Can it be continuously reused for blackmail? What should governments be doing now to plan for this contingency and fight back? We'll discuss an
entirely new class of information weapon -- digital cryptocurrency -- and how it might either change the course of history, or be relegated to the ash heap of failure.
These days the security integrity of business data is only as secure as the weakest supplier to that business. 3rd party connectivity and shared information requirements have become
the common denominator in assessing the risk to business information these days. This presentation details the ten simple steps in establishing and maintaining good information
security risk management procedures across your supply chain. The presentation is based on processes and void of commercial content.
Weaponising Cybercurrencies
GMark Hardy - President, National Security Corporation
Securing the Chain: Supply Chain Risk Management Best Practices
Richard Hollis - Director Risk Factory

18. Ireland Chapter
www.isaca.ie | @isacaireland
PAGE 17
PRIVACY TRACK ABSTRACTS
#SNS #Google Glass #Video Surveillance #Quadcopter #Natural person - Will the future EU Regulation be applicable?
Carolina Moura - Legal Consultant, Macedo Vitorino & Associados
From the several different ways a natural person may engage in digital image processing with no commercial purpose, the use of Social networks, Google Glass and video
surveillance assume particular relevance in order to understand if they are or not liable according to Data Protection Law, considering that one's picture, given certain conditions, is
personal data.
Both the Directive 95/46/CE as well as the Future Regulation approved by the EU Parliament are not applicable to the processing of personal data by a natural person in the course
of its own exclusively personal or household activity, however it is not clear what means exclusively personal or household activity neither in the Directive neither in the Future
Regulation if we think in public spaces.
The present analysis is extremely important to understand the companies’ role in order to know if they act as co-controllers sharing its liability with natural persons or are processors.
Harmonising Privacy Compliance in an Interconncted World
David Fagan - Commercial Lawyer, Business Legal
Organizations are increasingly rallying around a new way approach on how to think about cybersecurity and manage How to ensure your business maximises its potential
seamlessly in multiple jurisdictions, while still complying with fragmented and diverse privacy laws in each jurisdiction.
Modern international businesses are generally joined up entities with various business arms stretching across continents, but with a common leadership and goals. Jurisdictions are
not the same. Even for countries within the European Union, there are extreme diversities of objective, and method, when it comes to compliance. When one moves outside of
Europe the diversity of the objectives, and the practical out workings, of privacy laws becomes even more stark.
In this session, David Fagan will lead delegates through the various stages of achieving an integrated commercial objective when leading a project team from concept through to
finalisation of compliance documents, registration, and delivery of completed project.
Privacy Risk Assessments are not easy, so think different
Gerard Smits - Privacy Advisor, Toendra Beheermaatschappij
Data protection officers are struggling with assessing risks when it comes to privacy. That is not strange, because we learned the wrong things about privacy. Privacy has been the
domain of lawyers and they think differently. They say: ?make sure you comply with the law?. But law is always lagging behind. So step 1, before assessing risks, let?s talk about
what is privacy and what are its dependencies. This is for most DPO?s the first problem they encounter.
Assessing privacy risks: step 2, be aware that it is not assessing IT security risks alone, it goes further. Privacy is an issue that runs through the complete organization. So the
approach is organization wide. Look and think different, put up a new set of glasses. A lot of potential privacy risks are cloaked and hard to find.
When you have found your potential privacy risks, you want to quantify them. Tough cookie: as most tools are superficial and not helping because they don’t take into account what
privacy is about and its dependencies. So step 3: have a look at Privacy Risk Assessment 2.0 (PRA 2.0). Quantify privacy risks using methodologies from the health and safety
domain.
So taking a risk based approach and PRA 2.0can help to identify and quantify your privacy risks in a more structural way. It will not give you a baseline but provides input to your
privacy program. So start looking at privacy from a different view.

19. PAGE 18
GRC and the new COSO framework – Whole being greater than the sum of parts – Integration benefits
and Challenges, holistically viewed
Swaminathan (Swami) RV - Senior Director, Maclear GRC
The new COSO framework is slated for mandatory adoption / transition from Dec 2014. The COSO framework adoption is critical to the success of any organization in serving its
mission and achieving its strategic goals within an effective governance, risk management and compliance context. The COSO framework affects how risks are defined in terms
of appetite, managed, how the culture and tone at the top encourages appropriate behaviour, the quality and contextual correctness and robustness of managerial decisions, and
the ever-growing importance of the resiliency of the enterprise to identify and react to change — all for the purpose of ensuring that the strategic business objectives are achieved
within the realms of risk and control perimeters. The importance of working on the improving the risk appetite dialogue between executive management and the board of directors
and on cascading risk tolerances downward into the organization in appropriate areas to supplement the performance management process is of paramount importance. COSO
helps add immense value to the key emerging attributes in business behaviour ? Governance, Strategy, business planning, execution, risk management, monitoring and adapting
to process changes within an enterprise
GRC Tool Implementation
Raef Meeuwisse - Functional Architect, AdaptiveGRC
For most people, GRC is a catchy marketing term that promises big and delivers small. In this session we look at how to overcome the challenges, to help deliver much greater
value and savings regardless of your GRC toolset. Measuring, monitoring and managing all GRC activities more efficiently across any organization is achievable. In this session
we look at the drivers for organization-wide GRC systems. We also look at:
1. What are the different GRC activities?
2. Where did they come from? and
3. Why do they overlap and collide so much?
We also take a real case study of a global company and explore their stepped approach to transition from multiple legacy processes and systems into one GRC framework,
achieving savings in technology costs, substantial improvements in productivity & reporting and earlier identification of risks.
The ISM Method - A Simple and Effective Management System for COBIT Compliance. How a Principle Based
Approach Beats Rule Based Requirements.
Jan van Bon - Chief Editor, Inform-IT
In the Dutch finance sector, the governing banking organization (DNB) oversees compliance with a number of information security requirements. DNB based their requirements
on COBIT, with ISO27002 as a supporting database. Dutch financial organizations now need to comply with a selection of 54 of these requirements.
Service organizations are basically the same, whatever their unique business is. When organizations have the same business, they can use the same management system. A
new process-based method for managing service organizations in a generic way has come up in the Netherlands ? with great success: the ISM Method, Integrated Service
Management. ISM has been applied many times to (IT) service organizations, enabling the implementation of ITIL?s best practices in a very effective way.
IT service organizations in the finance sector now turn to the ISM Method to comply with the requirements issued by DNB. In essence, they turn the problem around by first
getting fundamentally in control of their service organization with the ISM Method. This is their Principle Based Approach. A cross reference from their management system to the
DNB requirements they need to comply with, then solves any performance challenge in the most efficient way possible. Using a well-structured management system proves to
solve most of the generic requirements without additional effort. The rest can be managed using their ISM management system.
The big advantage of their Principle Based Approach lies in the time-resistant assurance of their performance. Embedding the ISM Method in their organizational structure
prepares them for any Rule Based Approach that might vary in time. Updated requirements can build on a solid management system, and compliance can be managed in the
most efficient way.
This presentation will demonstrate how the ISM Method works, and how the compliance to a set of COBIT based rules was managed.
ENTERPRISE GOVERNANCE TRACK ABSTRACTS

20. Ireland Chapter
www.isaca.ie | @isacaireland
PAGE 19
APPLICATION SECURITY TRACK ABSTRACTS
The Agile approach to system development is one way that CIOs are aiming to deliver more projects in shorter timescales at lower costs. This can be at the cost of control ?
especially if addressing risks and controls is seen as an overhead rather than adding real benefit to the project. Audit and control managers need tools to help ensure systems
are fit for purpose and do not compromise controls compliance. Project teams can create a lot of confusion and distractions – for example saying that there is no need for audit
and control.
Is it possible to achieve the right balance between Agile development and control? This session will provide an introduction to the culture and jargon of the Agile approach. It will
also provide tools and tips for developing or auditing controls and governance in this environment. This will enable you to be an effective part of the project team, ensuring
compliance with good governance and that the delivered product has adequate controls embedded during development. This reduces the risk of failure and the total overall cost
of the project if controls have to be added later
Agile Project need Agile Controls and Audit
Christopher Wright, Director, Wright - Canda Consulting Ltd
This session describes a governance process for management to control the security, quality and maintainability of software projects using the developers Code Review as a gate
in the SDLC. Regardless of the development methodology, the combination of development standards and peer code review can allow an organization to ensure security tasks
are considered and measured by developers themselves during project implementation. This session relates the topic of Code Review into the overall project life-cycle,
referencing BSIMM V and regulatory compliance's (e.g. PCI DSS) to suggest methods for moving security oversight to the developers themselves.
Reducing Risk Through Code Review
Gary Robinson - Project Leader, OWASP
The online WYSIWYG "What You See Is What You Get" editors or rich-text editors are nowadays an essential component of the web applications. They allow users of web
applications to edit and enter HTML rich text (i.e., formatted text, images, links and videos etc) inside the web browser window.
This talk will first demonstrate how to break the top 25 online WYSIWYG editors powering thousands of web applications. We show XSS bypasses for top WYSIWYG editors like
TinyMCE, Jive, Froala, CKEditor etc. We will share stories of how we were able to XSSed WYSIWYG editors of sites like Twitter, Yahoo Email, Amazon, GitHub, Magento, and
CNET etc.
After breaking almost all WYSIWYG editors in the wild, this talk will present a sanitizer (very easy to use, effective and practical solution) which is based only on '11 chars + 3
regular expressions' and will show how it will safe you from an XSS in HTML, attribute, script (includes JSON context), style and URL contexts. An XSS challenge has been
announced and 78K+ XSS attack attempts were unable to bypass the sanitizer.
Revisiting XSS Sanitization
Ashar Javed - Research Assistant, Ruhr University Bochum

21. PAGE 20
KEYNOTE SPEAKERS BIO
Theresa Payton
Cybersecurity Authority & Identity Theft Expert Former White House CIO
The specter of a massive cyberattack is the most urgent concern confronting the nation's information technology infrastructure today, an issue Theresa Payton understands better
than anyone. Through the lens of years of experience in high-level private and public IT leadership roles, Payton delivers sought-after solutions that strengthen cyber-security
measures and neutralize e-crime offenders. Payton is one of America's most respected authorities on Internet security, net crime, fraud mitigation, and technology implementation. As
White House Chief Information Officer from 2006 to 2008 -- the first woman ever to hold that position -- she administered the information technology enterprise for the President and
3,000 staff members. Prior to working in federal government, Payton held executive roles in banking technology at Bank of America and Wells Fargo.
As founder of Fortalice, LLC, a security, risk, and fraud consulting company, she now lends her expertise to organizations large and small, helping them improve their information
technology systems against emerging, amorphous cyber threats. In 2010, she was named by Security Magazine as one of the top 25 "Most Influential People in Security." She serves
as a cyber expert for the syndicated program America Now and is co-author of Protecting Your Internet Identity: Are You Naked Online?
Payton candidly equips audiences with far-reaching lessons on how to protect the growing millions who use the Internet daily as well as the organizations who are on the front lines of
fending off rapidly evolving, infrastructure-crippling cyberattacks.
Graham Cluley
Independent Computer Security Analyst and award winning security blogger.
Graham Cluley is an award-winning security blogger, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been
employed by companies such as Sophos, McAfee and Dr Solomon's. He has given talks about computer security for some of the world's largest companies, worked with law
enforcement agencies on investigations into hacking groups, and regularly appears on TV and radio explaining computer security threats.
Graham Cluley was inducted into the InfoSecurity Europe Hall of Fame in 2011, and was given an honorary mention in the "10 Greatest Britons in IT History" for his contribution as a
leading authority in internet security.
Follow him on Twitter at @gcluley.
Professor John Walker MFSoc CRISC CISM ITPC CITP SIRM FBCS FRSA
CTO and Director of CSIRT, Cyber Forensics, and Research at Cytelligence Ltd
Visiting Professor at the School of Science and Technology at Nottingham Trent University [NTU], Visiting Professor/Lecturer at the University of Slavonia [to 2015], CTO and
Company, Director of CSIRT, Cyber Forensics, and Research at Cytelligence Ltd, architect of the Cytelligence OSINT Platform, Practicing Expert Witness, ENISA CEI Listed Expert,
Editorial Member of the Cyber Security Research Institute (CRSI), Fellow of the British Computer Society (BCS), Fellow of the Royal Society of the Arts, an Associate Researcher
working on a Research Project with the University of Ontario, and a Member, and Advisor to the Forensic Science Society.
John is also a contributor to the Digital Forensics Publication, and is a Member of the Information Security Buzz Expert Panel.
Amar Singh
Information Security GRC Expert, founder of GiveADay and the Cyber Executive Bootcamp Series.
Chair of ISACA's Security Advisory Group
Amar is an industry acknowledged expert and is regularly quoted in the media. He is sought after to speak and share his insights by some of the largest and most respected
organisations in the world. A business focused, sector independent, trusted advisor and consultant, Amar Singh has more than 16 years experience in information & cyber security,
data privacy, project delivery, policy and operations. Amar is engaged as a trusted advisor and interim C level executive by organisations to help reduce their risk exposure, deploy
post incident remediation, build security teams, increase cyber resiliency and mature their information security and data privacy posture. Amar's client profile includes News
International (now News UK), Siemens, the BBC, Reuters, BP, ATOS, Gala Coral, Cable & Wireless, SABMiller and other big names.
Amar Singh is an interim executive available to help and guide clients with all their Cyber security and Data Privacy needs. In addition, he delivers trusted value as a Senior Analyst at
Kuppinger Cole and holds a voluntary position as Chair of ISACA's UK Security Advisory Group.
Amar is the founder of GiveADay, the worlds first professional exchange platform bringing together professionals and charities.
John Linkous
Founder and CEO, InterPoint Group
Trusted technology advisor to CIOs, CTOs, and CISOs at the Fortune 500 level, a successful technology entrepreneur, a frequently sought-after speaker and author, and a hands-on
security and compliance expert who has been in the data center as well as the boardroom throughout my entire career. Over twenty years in the technology industry -- most of it spent
in security and compliance - I’ve leveraged my experience to establish a proven track record of improving organizations through rational, business-driven approaches to technology,
security and compliance program development and management.
Patrick Curry OBE CEng MIET MBCS
Director, MACCSA (Multinational Alliance for Collaborative Cyber Situational Awareness)
Patrick is currently working with leading companies and also UK government departments to extend the national implementation of federated trust and in the coordination of cyber
defence. 14 years in transatlantic and european secure collaboration and the sharing of sensitive information. To enable this, there has been a huge effort on identity management
and federated trust.
Patrick is a main facilitator between the US DoD and aerospace industry on the alignment of part marking standards and Unique IDentification of tangible assets to enable Total Asset
Visibility. The new agreement is being implemented worldwide.
Previous military career in operational planning, equipment maintenance, procurement, information management, IT management and logistics.

22. Ireland Chapter
www.isaca.ie | @isacaireland
PAGE 21
TRACK SPEAKERS BIO
Professor Claudio Cilli, PhD, CISA, CISM, CGEIT, CISSP, CSSLP, CIA, CRISC, M.Inst.IS
Department of Computer Science University of Rome "La Sapienza" - Italy
Dr. Claudio Cilli, graduated with honours at the University of Rome, is an university teacher and a professional Information Security consultant. Professor on Computer Science at the University of Rome, with KPMG he
was responsible of many IS Audit projects. Senior level data processing professional with 15 years experience in computer security/audit and 22 years of Information System experience, systems design and
programming, computer operations and applications programming. Designed EDP systems, including the computer, software, installation and user training. Consultant to American companies who supply the U.S.
Department of Defence.
With many big firms he is responsible of IS Audit and security projects, which include both for civil and military sectors, information systems for production, software quality, security of the information systems and
installations. Designed and implemented systems based on mainframes and distributed architecture, including Disaster Recovery and both data and physical security, information and site protection.
Speaker in AFCEA (Armed Forces Communications & Electronics Associations) Europe seminars.
Authored and published in several specialised books and magazines. He is frequently invited as speaker in many international conferences and seminars.
Alonso Jose Da Silva II
International Technical Manager at Tempest Security Intelligence - UK
Alonso is a senior IT/Telecoms Engineer with over 10 years of experience in IT, with an emphasis on security, infrastructure and training. He has a thorough knowledge of IP networks and
worked with the biggest multinational players in the IT industry. He thrives on a quickly changing and demanding environment and is a passionate and effective communicator - he looks
back on 6 years of training experience as a Microsoft Instructor and a University Lecturer.
Panagiotis Droukas
IS Auditor, Bank of Greece - Greece
Panagtiotis Droukas holds a BSc and an MSc in Computer Science and an MSc in Economics and Finance. He has extensive experience since 1998 in the fields of information systems
security and audit. Panagiotis has been involved in large assurance projects in the financial sector regarding core banking systems implementation and migration, BCP/DRP as well as
regulatory compliance assessments while working for Emporiki Bank and Bank of Greece. In 2010 he was seconded to European Banking Authority for the implementation of a
European-wide regulatory reporting application. He is a member of the BoD of ISACA Athens Chapter for the last six years.
Fahad Ehsan
Security Analytics at UBS AG - Singapore
Fahad works with UBS AG, where he is a lead architect with the Security Analytics team. His other areas of expertise include Malware Reverse Engineering and Memory Forensics. He
recently delivered a Vulnerability Management Platform, which is widely used within the Bank. Throughout his 7-year career, he has held various roles in Security Research & Engineering,
Consultancy, SOC and C#/SQL dev teams.
Ashar Javed
Research Assistant, Ruhr University Bochum - Chile
Ashar Javed is a research assistant in Ruhr University Bochum, Germany and working towards his PhD. He has been listed ten (`X`) times in Google Security Hall of Fame,
Twitter/Microsoft/Ebay/Adobe/Etsy/AT&T Security Pages & Facebook White Hat. He spoke in the main security venues like Hack in the Box, DeepSec, OWASP Spain and OWASP
Seminar@RSA Europe.
Matt Lemon
Global Head of Information Security, Daon - Ireland
Matt Lemon is Global Head of Information Security for Daon and was educated in the UK with an MSc in Computer Security and Forensics. Matt holds the ISACA CISA and CISM
qualifications, is a Fellow of the Irish Computing Society and Chartered IT Professional. Matt has worked in the ICT industry for 20 years and held positions in public and private sector as
well as in advisory roles. His particular area of expertise is IT Governance and digital forensics. Trained and accepted as an Expert Witness in IT, he also spent time in court giving
evidence or opinions.
G Mark Hardy CISSP, CISM, CISA, GSLC
President CardKill Inc. and National Security Corporation - USA
G. Mark Hardy serves as President of National Security Corporation, an information security management consulting firm he founded in 1988. He has been providing cyber security
expertise to government, military, and commercial clients for over 30 years, and is the author of over 100 articles and presentations on security, privacy, and leadership. He serves on the
U.S. National Science Foundation's CyberWATCH Advisory Board, and is a retired U.S. Navy Captain. He wrote and taught information operations curriculum for NATO military officers. A
graduate of Northwestern University and the U.S. Army War College, he holds a BS in Computer Science, a BA in Mathematics, a Masters in Business Administration, a Masters in
Strategic Studies, and is designated as a Certified Information Systems Security Professional (CISSP) and Certified Information Security Manager (CISM).
Richard Hollis
Director, Risk Factory - UK
Richard Hollis is the Chief Executive Officer for Risk Factory Ltd, an information security risk management consulting firm specialising in providing cost-effective, independent information
risk management services. Richard possesses over 25 years of “hands on” skills and experience in designing, implementing, managing and auditing information security programs.
Over the course of his career Richard has served as Director of Security for Phillips, Paris, and Deputy Director of Security for the US Embassy Moscow Reconstruction Project as well as a
variety of sensitive security positions within the US government and military. In addition to his work with Risk Factory, Richard serves on several security technology company boards and
security industry advisory councils.
A celebrated public speaker, Richard has presented to hundreds of audiences across the world on a wide variety of information risk management topics and techniques. As a recognised
industry authority, he has published numerous articles and white papers and appeared on national and international broadcast news shows as well as being cited in a wide range of press
including the BBC, MSNBC, Radio 4, the Financial Times, Time magazine and various others.
David Fagan
Owner at Business Legal - Ireland
David Fagan is a commercial lawyer. Until recently he was a partner in the largest international commercial law firm in Ireland, with offices in 47 locations around the globe, and with 200
staff in Ireland. Recently, he has set up own consultancy practice in conjunction with a number of other equally experienced lawyers and professionals, Business Legal. David has been
involved in:
• Managing and leading multi-jurisdictional legal privacy projects across Europe, Africa, Asia and the Middle East.
• Dealing with Privacy issues in Courts, and with Regulators.
• Advising on practical matters such as transferring data to non EU servers, marketing restrictions etc.

23. PAGE 2
PAGE 22
TRACK SPEAKERS BIO
Raef Meeuwisse
Functional Architect, AdaptiveGRC - UK
Raef Meeuwisse is the Functional Architect of AdaptiveGRC, the 1st company in the world to offer a ‘1 data source / 0 replication’ GRC software solution. Raef is a CISA, a UK Certified
Program Manager and member of the ISACA London Chapter. He has experience consulting with most of the leading technology companies. Prior to AdaptiveGRC, he ran a
multi-standard Global Vendor Technology Audit Service for a Fortune 50 company. He enjoys debating all things GRC.
Dr. John Mitchell PhD, CEng, CITP, MBA, FBCS, CISA, CFIIA, QiCA, CGEIT, CFE
Managing Director, LHS Business Control - UK
Dr. Mitchell is an international authority on corporate governance, the control of computer systems, the investigation of computer crime and the impact of regulatory and compliance issues
on the delivery of IT services. He has over 30 years practical control experience and an international reputation for advising organisations on their governance strategies and associated
methodologies. This is coupled with a strong academic background, which includes research, extensive publications and teaching at the post-graduate level. John has been an expert
witness in a number of high profile UK criminal cases and he has been featured in a major British computing publication as the ‘IT Detective’.
Carolina Moura
Legal Consultant, Macedo Vitorino & Associados - Ireland
Carolina Moura is a Legal Consultant in the Personal Data Protection (hereinafter “PDP”) area with a passion for technology. Having worked as Solicitor/Barrister in one of the best
Portuguese Law firms, Carolina moved to Dublin and completed a specialization and a master thesis in PDP. Since then Carolina has been invited multiple times to be a speaker in
Conferences related to PDP. As an exemple the Portuguese PDP Authority and the University of Lisbon invited her to be lecturer of the session "Privacy and online social networks: from
the Directive 95/46/CE to the new EU General Regulation" and the University also invited her to be a guest Professor in the PDP Advanced Course.
Gary Robinson
Project Leader, OWASP - N. Ireland
Gary Robinson is a Senior Security Analyst at one of the largest financial institutions in the world. With over 15 years experience as a software developer, architect and security analyst, he
has successfully implemented improvements to the security SDLC processes of multiple companies, integrating security industry best practices with existing company policies. Gary is also
a co-project leader on the OWASP Code Review guide and is involved with other OWASP projects.
Swaminathan RV
Senior Director, Maclear GRC - India
A seasoned banking / audit / GRC practitioner / professional with over a decade and a half of progressive/enriching experience, SRV , in addition to his honours in Commerce degree, has
a Level 9 Masters ‘degree in Governance and risk from University College, Dublin. He is an active member of ISACA, the Institute of Internal auditors with current licence in CISA, CIA,
CFSA, CRMA and CCSA. His passion is to contribute to the continuous enrichment and growth of BFSI /GRC/Audit best practices /risk and controls governance and strategic business
process outsourcing globally and has worked in Ireland/US/India & EMEA
Dr. Char Sample
Carnegie Mellon University - CERT - USA
Dr. Char Sample is an academically and professionally experienced cyber security professional with over 20 years experience in network security and software engineering. Internet
security experiences include expertise with firewalls, IDS, IPS, Anomaly Detection, DNS, DNSSEC, Mail, routing, authentication, encryption, secure network architectures, cloud computing
(IaaS and PaaS), Unix internals and most recently threat intelligence. Dr. Sample defended her dissertation in 2013 “Culture and CNA Behaviors”, this cross-discipline research topic
represents her most recent area of research.
Gerard Smits CIPP/E, CRISC, CISSP
Privacy, IT security, Growth Management Advisor Toendra Beheermaatschappij - Netherlands
Gerard Smits is a seasoned manager and have worked for several multinationals, before starting to work as an independent consultant with an emphasis on privacy, IT security and growth
management. His pragmatic view and creativity provides him the tools to look at problems from different perspective. He has an IT background supplemented with executive education in
finance, legal and strategy. He divides his time on consultancy, research and building tools which helps his clients to be more effective.
Christopher Wright
Director, Wright-Canda Consulting Ltd. - UK
A Certified Agile ScrumMaster, with over 30 years experience of providing financial and IT advisory and risk management advice. Assignments include a number of project risks and
business control reviews. For the past 5 years Chris has seen a significant change from traditional to Agile project management. He has developed a number of techniques and tools to
provide fit for purposes controls and governance frameworks within these revised approaches, has spoken at ISACA and BCS sessions and trainings on Agile, published a book on the
subject and is currently on a working group for APM looking at Agile Governance.
Jan Van Bon
Chief Editor, Inform-IT - Netherlands
Jan van Bon has been a driving force in the field of IT Service Management for the last 25 years. After a decade of academic research he started his work in IT in the late 1980's, in the
Netherlands. He has been heavily involved in ITIL, ITSMF, and several innovative projects ever since. He produced more than 80 books, in up to 16 languages, with thousands of expert
authors and reviewers from all over the world, on a broad range of IT Management topics, including the very first pocket guide on COBIT.
Jan is the founder and Chief Editor of the ITSM Library, and of several knowledge portals like the ITSM Portal. As a practitioner he is involved in supporting many organization improvement
projects.
Jan is deeply involved in the development and management of the new Dutch standard for Service Management organizations: the ISM Method.

24. Ireland Chapter
www.isaca.ie | @isacaireland
Notes:
PAGE 23

25. PAGE 24
Notes:

26. 16.3m 23m
25.2m21.8m
25.6m36m
81.6m 24m
18.6m
30.3m
12.2m
9.7m
4.2m
11.6m
13.2m
9.5m
19m
Pitch
Window
Hogan Mezzanine I / II
Hogan Mezz I
KitchenStairs
Escalators
Bar
WC
WC
Hogan Mezz II
Nally FoyerMezz II FoyerMezz I Foyer
Canal Foyer
Not to scale.
Entrance/Exit
Entrance/Exit
LEVEL 4
Delegate Registration Mezz II Foyer
Morning Keynotes Hogan Mezz II
Assurance Canal Foyer
Cybersecurity Hogan Mezz II
Risk Naly Foyer
Privacy Hogan Mezz II
Application Security Naly Foyer
Enterprise Governance Canal Foyer
Afternoon Keynotes Hogan Mezz II
LOCATION:
Continuing Professional Education Credits
To maintain Certified Information Systems Auditor (CISA), Certified
Information Security Manager (CISM), Certified in the Governance of
Enterprise IT (CGEIT) and, or Certified in Risk and Information Systems
Control(CRISC) certifications, certificationholders are required to earn 120
CPE over a three-year reportingperiod and a minimum of 20 CPE in each
cycle year in accordance with ISACA’s continuing professional education
(CPE) policy.
Attendees can upto 7 CPE credits for attending the ISACA Ireland 2014 Conference. You will receive
an email post-conference stating the number of CPE credits that you are eligible for. Please retain
that email with your CPE documentation. Note that you can only claim hours for sessions which you
attend. CPE policies for each certification, as well as details on how to report your CPE hours, are
available on ISACA’s Web site at www.isaca.org.

27. PAGE 26
CONFERENCE SPONSORS
Thank you to our Sponsors for their support in making the ISACA Ireland 2014 Conference a great success!
Gold Sponsors
Silver Sponsors
We provide expertise to our clients on Identification, Protection, Compliance and Management
of their Information. We work with clients across all industry sectors and business functions. We
solve their Information challenges through a combination of Consultancy, Technology, Research
and Training. We provide these innovative solutions so that our clients feel protected, assured
and empowered, confident in the knowledge that their challenges have been met.
Established in 2009 as part of a collaboration with RSA Archer, 2MC was formed to deliver a global threat
management solution to one of the UK’s largest retail banks. In a market dominated by product vendors,
2MC seeks to address this technology-led imbalance with independent but complementary business-led
consulting and services. The three elements of people, processes, and technology ring true with a GRC
programme and it is this focus that 2MC applies to bring this balance to our clients projects. Our consultants
have extensive knowledge gained over many years acting as risk, compliance, and security practitioners
within large corporations. They have a firsthand grasp of the challenges and needs facing organisations and
have honed their skills in over 80 successful Archer GRC projects. Our business consultants work closely
with our solution architects and product consultants who have a deep and proven expertise in solution
design, configuration and technology integrations.
Confidence - Assurance – Certainty Established in Dublin in 1999, Certification Europe is in a league of its
own among accredited certification bodies worldwide. In the local and international environment, we are
proud of our expertise, and we are an authority in Information Security Management Systems (ISO 27001).
We work in partnership with our clients ensuring that their certification becomes a valuable asset: we
provide training, gap analysis and expert opinion. We also help international government organisations as
well as private companies create and assess their very own assurance frameworks.
Engineering for extreme performance and efficiency, while engineering out IT complexity and
cost: that’s how Oracle enables its more than 400,000 customers in 145-plus countries to
accelerate innovation and deliver the best experience to their own customers.
RSA, The Security Division of EMC, is the premier provider of security, risk and compliance
management solutions for business acceleration. RSA helps the world’s leading organizations
solve their most complex and sensitive security challenges. These challenges include managing
organizational risk, safeguarding mobile access and collaboration, proving compliance, and
securing virtual and cloud environments. Combining business - critical controls in identity
assurance, encryption & key management, SIEM, Data Loss Prevention, Continuous Network
Monitoring, and Fraud Protection with industry leading eGRC capabilities and robust consulting
services, RSA brings visibility and trust to millions of user identities, the transactions that they
perform and the data that is generated. For more information, please visit www.RSA.com and
www.EMC.com.
2MCSIMPLE SOLUTIONS
FOR A COMPLEX WORLD
Citi, the leading global bank, has approximately 200 million customer accounts and does business in more
than 160 countries and jurisdictions. Citi provides consumers, corporations, governments and institutions
with a broad range of financial products and services, including consumer banking and credit, corporate and
investment banking, securities brokerage,transaction services, and wealth management.
EY is a global leader in assurance, tax, transaction and advisory services. The insights and quality services
we deliver help build trust and confidence in the capital markets and in economies the world over. We
develop outstanding leaders who team to deliver on our promises to all of our stakeholders. In so doing, we
play a critical role in building a better working world for our people, for our clients and for our communities.
Integrity Solutions is the largest IT Security specialist in Ireland and the fastest growing in the UK. Their
expertise is depended upon to secure the networks, infrastructure and information of some of the largest
companies in Ireland and the UK. They offer a wide range of security services including Managed Security,
Security testing, Incident Handling, Security Integration and Governance, Risk and Compliance services.

28. Getting an ISACA®
certification doesn’t just say you’re well read or
well connected. It announces that you have the expertise and insight
to speak with authority. The credibility that it adds lets you create
value for your enterprise. Your certification is more than a credential,
it’s a platform that can elevate your career.
Register at www.isaca.org/register14
“I’M RECOGNIZED FOR
MY CERTIFICATION.
I’M VALUED FOR
WHAT I DO WITH IT.”
— KETAN DHOLAKIA, CISM, CRISC
MANAGING PARTNER, MACLEAR
CHICAGO, ILLINOIS, USA
ISACA MEMBER SINCE 2007
Register online to save US $75 — www.isaca.org/register14
13 December 2014
Final Registration Deadline: 24 October 2014
Register online to save US $75!
NEXT EXAM DATE: