CPE: 1.5 hours

Field of Study: Communication

Knowledge Level: Basic

Prerequisites: None

The cybersecurity threats organizations are facing today are increasingly more complex than past threats. Given the complex technology landscape, many organizations struggle to effectively manage technology risks with the limited cybersecurity skillsets and resources available to them. The mindset around cybersecurity at organizations has shifted from “if” a cyber event will occur to “when” it will happen, and organizations are struggling to effectively prepare a response for when that incident occurs.

The goal of this session is to discuss current cybersecurity risks and threats organizations are facing and how an effective cyber resilience program can help manage these risks. We will discuss the key components of a cyber resilience program including preventative, detective, response, and recover controls. We will also discuss pragmatic strategies used by organizations to improve their cybersecurity posture.

During this session, the speaker will:

1. Provide education on common threats and vulnerabilities
2. Discuss common risks and approaches to evaluating those risks within organizations
3. Present case studies on cyber resilience and organizational preparedness
4. Offer success stories of other organizations facing similar challenges

CPE: 1 hour

Field of Study: Auditing

Knowledge Level: Basic

Prerequisites: None

Cyber security is and will remain a key focus for our boards and audit committees. The traditional skillset for IT Audit limits our ability to assess and provide assurance over cyber security risks. Turning to third parties can help, but the demand for cyber security assurance is great, and the coverage that third parties can provide is limited based on traditional budgets.

To address the gap between our skillset and the demand for cyber security assessments, McDonald's has partnered with a third party to develop a “penetration testing light” assessment that IT Audit can deliver. This increases the engagement of our team, as internal audit is growing its skills and assessing the most relevant risks for the organization. This also enables internal audit to leverage our third-party partners more strategically, providing them with assessments that are more challenging and targeted.

During this session, we will take you through our journey, covering the following topics:

1. Identifying and measuring the organization’s cyber security assessment gap
2. Making the case for building a “Penetration Testing Light” service in IT Audit and designing the assessment based on the organization's needs
3. Identifying and hiring IT Auditors that are ready for the cyber security metamorphosis as well as selecting a third party to be your trusted advisor and training partner
4. Partnering with Information Security and legal to ensure that your assessments are safe, sanctioned, and best serve to improve security in your organization

After completing this session, participants should be able to:

1. Learn about the latest cybersecurity trends
2. Understand how teams typically evaluate cybersecurity risks
3. Understand leading methods used to evaluate cybersecurity risks
4. Learn from an audit team’s penetration testing experience

CPE: 1 hour

Field of Study: Auditing

Knowledge Level: Basic

Prerequisites: None

Artificial intelligence or “AI” is often referred to though the capabilities of AI are generally not well understood as well as the value that may be obtained. There isn’t yet even a single set of AI terminology that can be agreed upon to use. Tanmay will answer the questions of what AI is, what it's capable of, what it’s not capable of, and how might AI be used by internal auditors in their professional and personal lives.

During the presentation, Tanmay will display transforming examples of this power.

CPE: 1.5 hour

Field of Study: Information Technology

Knowledge Level: Basic

Prerequisites: None

History teaches us that seemingly impregnable security measures can be breached by clever attackers. The same holds true for cybersecurity. A clever cybercriminal or nation-state can often side-step an organization's regulatory IT security controls (e.g., GLBA, HIPAA, PCI, SOX) and implemented "defense-in-depth" security products in order to "capture the flag".

Part 2 of the presentation will more broadly explore how to deny an attacker the opportunity to successfully complete an exploit. With this knowledge, organizations can begin plugging their security holes that determined cyber attackers strive to discover.

The learning objectives for this session are:

1. Understand why regulatory security controls and defense-in-depth security products may be insufficient for broadly protecting computers, mobile devices and applications from determined cyberattackers.
2. Understand the kinds of exploits that cyberattackers are using to side-step implemented security controls.
3. Understand the need to think "outside-the-box" in order to discover potential exploits on that may be used by cyberattackers.
4. Learn techniques for denying cyberattackers the opportunity to successfully perform a cybercrime.

CPE: 1 hour

Field of Study: Auditing

Knowledge Level: Basic

Prerequisites: None

CPE: 1 hour

Field of Study: Auditing

Knowledge Level: Basic

Prerequisites: None