Phishing 101: How Employees Are Targets
Presented by Jon Waldman
This discussion will highlight the advancements in cybercrime and social engineering that are targeting our people resources. Best practices will be discussed for processes necessary to improve the weakest links in our institutions. With a reliable process, we can measure the level of risk and implement effective risk mitigating controls.

Incident Response - Plan to Fail Well
Presented by Buzz Hillestad
In this session, core steps required for most incidents will be highlighted and specialized components for DDOS, malware, ransomware, CATO, and unauthorized access incident types will be examined. Explore the importance of incorporating forensic analysis procedures into your standard procedures to better address emerging threats and decrease liability.

Responsibilities of the Information Security Officer
Presented by Cody Delzer
Building a strong Information Security Program is a fundamental component to a successful ISO. We will review various regulatory guidance that outlines ISO responsibilities and reporting structures. Additionally, various educational paths that can help develop your skills in the future.

Third Party and Fourth Party Management
Presented by Jon Waldman
In recent years, financial institutions have seen a significant amount of new guidance on third party risk management and new terms coined such as Fourth Party Management. FFIEC Cybersecurity Assessments Tool (CAT) encourages financial institutions to expand questioning around third party risk management practices and suggests more rigorous oversight. We will explore best practices for Vendor Management, Third Party Risk Management, Fourth Party Management and Customer Risk Management.

25 Baseline Controls Banks Struggle to Implement
Presented by Shane Daniel
Over 1200 financial institutions have completed their Cybersecurity Assessment using our complementary assessment solution. SBS has analyzed the results and identified the top 25 most common baseline controls not implemented by financial institutions. These are controls that financial institutions MUST complete regardless of their inherent risk score. This session reviews these 25 controls, as well as practical solutions your institution can use to implement these controls. We will also discuss the next steps beyond the assessment to provide a comprehensive cybersecurity framework which institutions can repeatedly follow.

FFIEC Information Security Handbook Review
Presented by Cody Delzer
In September 2016, the FFIEC completely rewrote the Information Security Handbook. The Handbook represents an integration of concepts from Cybersecurity Guidance, Management Guidance, and other elements released in the past 10 years.

What Directors Need to Know About Cybersecurity
Presented by Cody Delzer
A financial institutions’ Board of Directors has the ultimate responsibility for securing customer information, as well as the responsibility for approving financial investments into cybersecurity, creating accountability throughout the institution for security operations, and setting clear expectations for management.

SSAE18, SOC 1, SOC 2 - What Do I Need?
Presented by Shane Daniel
We will explore the different types of SOC reports provided by vendors and highlight the best items that should be requested from vendors. Each of these reports serves a different purpose and will provide different value to your institution. In addition to what reports to ask for, we will explore them in detail to highlight what to look for and how to fill in the gaps to ensure your understanding security to the “same extent”.

Today's Ransomware Threat, Don’t Lose Your Data (And Your Business)
Presented by Jon Waldman
Join us to recap the statistics related to ransomware and learn how to prepare for this growing threat. Numerous published best practices will be reviewed to assist our institutions to build stronger defenses. Lessons learned from case studies captured from real world ransomware tragedies will be reflected on.

Testing Your Information Security Program in 2021 
Presented by Cody Delzer
There are three phases to creating an Information Security Program for financial institutions: 1) planning and preparation, 2) implementation, and 3) testing and verification. When it comes to testing your ISP, one of the big questions you should ask – both of yourself and your auditor(s) – is “where does our risk really lie?” Are you testing your ISP because you have to, or are you testing your ISP because you really want to protect your institution and your customer’s data from a cyber attack?