ISFMT Biography: Leighton Johnson is the CTO and Senior Security Engineer for Information Security and Forensics Management Team (ISFMT), a provider of computer security, forensics consulting & certification training. He most recently was the CIO for a 450 person directorate within Lockheed Martin IS&GS covering 7 locations within the Eastern and Midwestern parts of the U.S. He is a member of the CSA CloudSIRT working group developing the model for collaboration among cloud providers, responders and users, as well as a member of the IS Alliance – NIST joint working group on VOIP SCAP security. He recently served as Security Operations Program Manager for a US DOD Field Agency, based in Arlington, VA. He is a contributing author to the “Encyclopedia of Information Assurance”, ISBN: 978-1-4200-6620-3, where he contributed two chapters on Security Incident Response and Configuration Management. He has over 35 years experience in Computer Security, Software Development and Communications Equipment Operations & Maintenance. Primary focus areas have included computer security, information operations & assurance, software system development life cycle focused on modeling & simulation systems, systems engineering and integration activities, database administration, business process & data modeling. He teaches Digital and Network Forensics courses at Augusta State University. He holds CISM (Certified Information Security Manager), CISA (Certified Information Systems Auditor), CISSP (Certified Information Systems Security Professional), CIFI (Certified Information Forensics Investigator), CSSLP (Certified Secure Software Lifecycle Professional) and MBCI (Certified Member Business Continuity Institute) credentials. Abstract: Cyber risk assessment of cyber crime events and activities The new Internet, Web2.0, Virtualization, Cloud Computing and the proliferation of cyber crime have all pointed out the need for a new model for risk assessment is needed in evaluating and performing cyber risk assessments. This presentation will present current cyber crime activity information in the context of performing risk assessments and risk management in the modern Internet-driven world. Brief discussions of methodologies and techniques utilized in Network Forensics, Web-based investigations, and Internet crime evidence collection and custody are presented. The laws, ethics, regulations and boundaries for these cyber risk assessments are next presented to help clarify positions and policies. Finally, the needed interrelations for the assessment process to be successful are presented; these include technical, management, law enforcement and civil relationships with professionals and organizations. |
Workshops > cs-ga-2011 >