RhythmWorld Security Conference
September 22–24, 2020
RhythmWorld 2020
RhythmWorld Security Conference is going virtual. Access the latest in security, LogRhythm best practices, and LogWars Capture the Flag (CTF) event for free — from anywhere across the globe.
About RhythmWorld Security Conference
RhythmWorld is the ultimate cybersecurity conference to access the tools and skills you need to grow as a security professional and enhance your security operations.
LogRhythm is proud to invite you to our fourth annual security conference. Join us for three days of learning, entertainment, and innovation. Don’t miss deep-dive learning sessions, comprehensive training, access to technical LogRhythm experts, and an epic virtual CTF event.
Why Attend?
Discover Security Trends and Best Practices
Stay on the forefront of security trends and topics with sessions lead by industry experts.
Gain New Skills and Participate in Interactive Sessions
Bring key insights back to your organization and have fun along the way.
Learn from LogRhythm Practitioners and Experts
Discover the latest LogRhythm capabilities and solutions designed to strengthen your security operations.
Share and Collect Insights from Peers
Hear how other industry experts are solving their business challenges with LogRhythm.
Connect with Your LogRhythm Community
Grow relationships with your LogRhythm peers and connect with like-minded security professionals.
RhythmWorld 2020 Speakers
RhythmWorld Security Conference works hard to bring you cybersecurity leaders from across the industry to provide you with the latest perspectives and thought leadership to drive your security operations.
Please check back as we continue to add speakers!
RhythmWorld Sponsors
Connect with our sponsors to find the right technology and services for your organization.
Platinum Sponsors
Gold Sponsor
LogWars Sponsor
Interested in Sponsoring RhythmWorld 2020?
Don’t miss this opportunity to showcase your brand across the world, demonstrate your innovative solutions, and engage with hundreds of security professionals. To learn more about the sponsorship packages available, please reach out to: EventsMarketing@LogRhythm.com
Agenda
View, browse, and sort the growing list of keynotes, sessions, and breakouts by track and level. Check back often, as we will be adding more sessions and speakers. Please note that session dates and times are subject to change.
Content Agenda
Day 1 | Sept. 22 | 6:00-7:00am MST
US & Europe Keynote
Mark Logan, President & CEO LogRhythm
Digital transformation has accelerated in the world and cyber attacks have increased in parallel. Organizations are pivoting to adapt to these rapid changes and protect their community of customers, employees, and their interests. The work of security professionals is more important now than ever before. Join LogRhythm CEO Mark Logan and guests in this opening RhythmWorld keynote to learn what is happening in the cyber market, hear from industry luminaries, and an overview of the innovations the company has in store to empower security executives and professionals to do their best work.
Day 1 | Sept. 22 | 6:00-7:00am MST
APAC Keynote
Mark Logan, President & CEO LogRhythm | Abid Adam, Group Chief Risk & Compliance Officer, Axiata Group Berhad
Digital transformation has accelerated in the world and cyber attacks have increased in parallel. Organizations are pivoting to adapt to these rapid changes and protect their community of customers, employees, and their interests. The work of security professionals is more important now than ever before. Join LogRhythm CEO Mark Logan in this opening RhythmWorld keynote to learn what is happening in the cyber market, hear from one of the world’s top CISO’s, Abid Adam of Axiata Group Berhad, and an overview of the innovations LogRhythm has in store to empower security executives and professionals to do their best work.
Day 1 | Sept. 22 | 6:00-7:00am MST
Cybersecurity Implications On Society – It’s Security’s Time To Shine
Jinan Budge, Principal Analyst Forrester
It is increasingly becoming clear that cybersecurity decisions have broader societal implications than ever before. In 2020 and beyond, technology promises to change our own experience and enhance our way of life, significantly. Society and humanity increasingly depend on tech to work, learn, and socialise. But that dependence is also making our technology, and us, targets. To be successful in this new era, CISOs, executives, and security professionals will need to double the efforts to navigate the maze of organizational politics and detractors, engage with the business and place people and culture at the heart of your security program to influence change. Jinan Budge shares insights to help you focus your vision and approach team, organizational and external security culture change as strategically as you would any other part of your security program.
Day 1 | Sept. 22 | 6:00-7:00am MST
The Modern and Evolving Security Leader: Security Executive Panel
James Carder, CSO, LogRhythm | Kip James, VP, CISO, TTec | Chris Mitchell, CISO, City of Houston
The role of a security executive is not for the faint of heart. Once a purely technical role, the responsibilities of the security leader has grown, as have their importance to the business. Today you can find them developing an enterprise-wide IT security strategy and in the board room working towards reducing risks and empowering business outcomes.
Learn from our panel of experienced Security Executives as they provide insights into their biggest challenges, key strategies to support organizational goals, ways security can enable and contribute to business, and ways their role has continuously evolved.
Moderated by James Carder, LogRhythm Chief Security Officer.
You’ll learn:
- Advice to build and develop a security program
- Actionable tips to build a partnership with your board
- What the modern security executive looks like
- Key metrics and KPIs to show the value of your security operations program
- How your security program can enable business and become a point of differentiation
Day 1 | Sept. 22 | 6:00-7:00am MST
Overcoming the Skills Shortage for Modern and Effective Security Operations Panel
Andrew Hollister, LogRhythm Labs & Security Advisor to the CSO | Andrew Costis, Senior Threat Researcher, VMware Carbon Black | Randall Otto, Director, Global Recruiting, LogRhythm
In a perfect world, your organization would staff a 24×7 SOC with highly talented cybersecurity professionals to secure its IT environment. But the truth is, a seemingly endless stream of new and complex cyber-attacks has driven the demand for qualified professionals through the roof and the number of unfilled positions has soared.
While there is no one-size-fits-all approach to solving the cybersecurity skill gap, our panel of experts will provide practical advice for finding and building a team with the right set of skill. Panelists will also discuss critical skill sets and outline resources to help you grow in your cybersecurity career.
Moderated by Andrew Hollister, Senior Director of LogRhythm Labs.
You’ll learn:
- Global state of cybersecurity and recruiting
- Approaches to overcome the cybersecurity skill gap
- Tips to build experience and diversity in your security team
- Ways to grow your career
Day 1 | Sept. 22 | 6:00-7:00am MST
Educational Partnerships Panel
Joe Murdock, Faculty, UC Denver | Jim Kowatch, CEO, InfoSec Learning | Barry Krauss, Director of Training, LogRhythm | Jordan Kent, LogRhythm
Please check back for more information.
Day 1 | Sept. 22 | 6:00-7:00am MST
Managing Security and Operational Risk in Critical Infrastructure Panel
James Carder, CSO, LogRhythm | Jeff Schmidt, CEO, Avertium
Attacks on operational technology (OT) have been on the rise the for decades. The rise began with the Stuxnet worm that attacked Programmable Logic Controllers (PLCs) in SCADA systems and has increased sharply in the last few years. Not only do these attacks threaten national interests, but as OT continues to be vital in day to day operations, overall business continuity is also endangered. As such, detecting OT threats has become a top priority as governments and organizations around the world implement programs and deliver mandates to protect critical infrastructure and business operations, across all sectors and verticals.
While limiting security and operational risk is a crucial issue, sometimes it’s easier said than done. Join this panel to hear security experts from across industries discuss business challenges, ways to evaluate risk, and strategies to reduce business risk with operational technology.
Moderated by James Carder, LogRhythm Chief Security Officer.
You’ll learn:
- Overview of operational risk and technologies associated with different critical industry
- How security plays a role in operations and achieving business continuity
- Ways your peers have effectively met business challenges
- Recommendations to manage security and operational Risk
Day 1 | Sept. 22 | 6:00-7:00am MST
Women in Security Power Panel
Cindy Zhou, CMO, LogRhythm | Sam King, CEO, Veracode | Avani Desai, Founder & President, Schellman & Company
We’ve all seen the headlines, women make up 26% of all computing related jobs and for the cybersecurity industry, it’s even less at 20%. For women of color, it’s down to the single digits. The Women in Security power panel aims to inspire young women to build a career in cybersecurity, and discuss how men can help by mentoring and partnering with women. This distinguished panel features executives at the helm of leading cybersecurity companies including Sam King, CEO of Veracode, and Avani Desai, President of Schellman & Company.
Moderated by LogRhythm CMO Cindy Zhou, the session will dive into the unique challenges women face in the industry, learn about the panelists’ career journey, and leadership philosophy.
Day 1 | Sept. 22 | 6:00-7:00am MST
Gh0st Hunting with Netmon DPA Rules (And Other Cool Stuff)
Dan Crossley, Manager, Enterprise Sales Engineering, LogRhythm
Most customers use LogRhythm NetMon for network traffic visibility, but the NetMon Deep Packet Analytics (DPA) engine takes network analytics to a whole new level. DPA rules can detect malware communications such as C2 traffic & Domain Generation Algorithms (DGA’s), SMB & DNS vulnerabilities, ICMP tunneling and more!
The intention of this technical deep dive is to provide practical solutions to common network threat detection problems.
In this talk, I will introduce NetMon Deep Packet Analytics rules by using them to solve five example use-cases:
- Detecting Gh0st Rat communications
- Detecting a vulnerability to EternalBlue
- Detecting a DNS exploit to Windows Domain Controllers known as ‘SIGRed’
- Detecting a possible malware DGA activity
- Detecting ICMP tunneling
Day 1 | Sept. 22 | 6:00-7:00am MST
Threat Hunting with NetMon: Tales From the SOC
Eric Brown & Brian Coulson
Getting to know your network data is difficult in a DevOps environment. How do you know what’s a threat, a bad practice, misconfiguration, etc. How do you focus on finding threats and weeding out the other observations?
Through threat hunting and using the tools available in the LogRhythm SOC, we’ll demonstrate how to use NetMon, and the LogRhythm SIEM to hunt for network threats based on real use cases observed at LogRhythm.
Day 1 | Sept. 22 | 6:00-7:00am MST
Effective Ways to Leverage NetworkXDR in Your Environment
Ramy Ahmad
There’s nothing like having visibility into the internal activity of endpoints for detecting threats; but you can’t always deploy an agent on every system or get logs from them. The beauty of network monitoring is the wide visibility it provides into the interactions between endpoints, servers and the Internet at large, all with a relatively few points of observation throughout your network, and without touching any endpoints.
In this real training session, join Ramy Ahmad, LogRhythm sales engineer, as he discusses different real-life use cases to increase visibility into your network. These scenarios including:
- Tracking Operational Technology (OT) and Internet of Things (IoT): OT has historically received little attention from IT and IoT is still perceived to be emerging. However, both of these areas deserve vigilance and you might be very surprised when you start analyzing it on your network DNS – The bad guys depend on DNS for finding their infrastructure (e.g. command & control) and they exploit it as a communications. If you aren’t analyzing DNS queries on your network, you’re missing out.
- Database Traffic: At the end of the day, data is the number one thing you are trying to protect and said data lives on databases (DB). The reality is that few DB admins will permit a SIEM agent on their delicately tuned database servers. The network is a non-intrusive way of getting visibility to that plane of activity. Ramy will show you database traffic flows you didn’t even know were present. In fact, the whole Equifax breach could have been detected much sooner if they’d been monitoring DB traffic.
- Detecting Ransomware and Clear Text Passwords: Stay tuned on this one – it’s interesting!
Day 1 | Sept. 22 | 6:00-7:00am MST
The Power of NetMon
Soren Frederiksen & Travis Holland
The LogRhythm Network Monitor is an extremely powerful tool, that can really enhance your security posture. The standalone Netmon appliance will give you the ability to closely monitor activity on the network looking for suspicious or excessive traffic and alert you to potential security issues. Integrating the system with the LogRhythm SIEM will enhance this ability and allow you to correlate suspicious activity observed on individual computers with suspicious network activity.
This presentation will show examples of suspicious network activity. It will demonstrate how the Network Monitor is able to capture and alert on this behavior.
Day 1 | Sept. 22 | 6:00-7:00am MST
Adding a Custom Log Source
Adam Shackleford & Brian Albrecht
Please check back for more information.
Day 1 | Sept. 22 | 6:00-7:00am MST
SAM Service and Best Practices to Keep Your LogRhythm Platform Healthy
Brian Stern & Ashley Howard
Please check back for more information.
Day 1 | Sept. 22 | 6:00-7:00am MST
Designing and Architecting a Resilient Enterprise Logging Architecture With LogRhythm
Dan Crossley, Andrew Pettet, & Jake Haldeman
Please check back for more information.
Day 1 | Sept. 22 | 6:00-7:00am MST
Ingesting API-Based, JSON-Formatted Logs Using Python, Filebeat, and Open Collector
TBA
Please check back for more information.
Day 1 | Sept. 22 | 6:00-7:00am MST
LogRhythm DX and You: Learn Troubleshooting Tips and Tricks for Your Linux DX
Heather Janelle
Please check back for more information.
Day 1 | Sept. 22 | 6:00-7:00am MST
LogRhythm Troubleshooting
Justin Henning & Joseph Mastromarino
Please check back for more information.
Day 1 | Sept. 22 | 6:00-7:00am MST
Cyberthreat Intelligence Using LogRhythm
Oliver Gheorghe & Sander Bakker
Please check back for more information.
Day 1 | Sept. 22 | 6:00-7:00am MST
Detecting Ransomware in Your Network
Sean Heffley & Tim Peck
Please check back for more information.
Day 1 | Sept. 22 | 6:00-7:00am MST
Unleash the Power of Analyze
Travis Holland & Chris Phares
Please check back for more information.
Day 1 | Sept. 22 | 6:00-7:00am MST
Parsing Custom Logs for Threat Intelligence
Travis Killen & Stefen F. Austin
Please check back for more information.
Day 1 | Sept. 22 | 6:00-7:00am MST
Introducing: LogRhythm.Tools PowerShell Module
Eric Hart, Matt Willems, & Gene Cupstid
Interacting and integrating services through REST APIs can be a challenge. LogRhythm.Tools, a Windows PowerShell module, has been developed to expand the accessibility of LogRhythm’s RESTful APIs. Through this session we will present the capabilities of this toolkit as a method to interact, integrate, and expand your use of LogRhythm. LogRhythm.Tools has been written with efficiency, flexibility, and reliability as its core principals.
Join in our session to learn the origins of LogRhythm.Tools, step through demonstrations that span from simple examples through to solving complex tasks, and learn how you can get started exploring this new resource. Presented by co-creators Eric Hart, a LogRhythm Technical Account Manager, and Gene Cupstid, source title, and Product Manager Matt Willems.
You’ll learn:
- A new, easier, way to integrate with the LogRhythm APIs
- Demonstrated examples based on real world use cases
- Where to find additional information
- How you can get started using LogRhythm.Tools
Day 1 | Sept. 22 | 6:00-7:00am MST
The 5 SmartResponse Plugins You Need TODAY
Jake Haldeman & Sam Straka
Please check back for more information.
Day 1 | Sept. 22 | 6:00-7:00am MST
SOAR in the Cloud
Jason Miller, CEO, BitLyft | Mike Skeith, Director of SOC Operations, BitLyft | Steve Forsyth, Director of Product Development, LogRhythm | Zack Rowland, Strategic Integrations Engineer, LogRhythm
When your finance department is getting phished, the time to fully mitigate can make all the difference in the cost to your organization. We know that automation must be utilized, but how to achieve responses at the scale and speed required to fend off the modern attacker?
This presentation will show how Amazon Web Services technologies can be leveraged to power incident responses with the scale required for today’s defender. The session will include a demonstration of an AWS Step Function that takes potential phishing emails IOCs as input and uses Lambda serverless functions to create verdicts and take mitigating actions.
Our partner BitLyft will join us to provide real-world use cases insights.
Attendees can expect to learn:
- How AWS Step Functions bring cloud-scale orchestration to your automated responses
- How AWS Lambda enables integration of cloud-scale automation
- The basic building blocks and workflow for a Phishing response solution
Day 1 | Sept. 22 | 6:00-7:00am MST
Panel: Ransomware vs Analytic CoPilots: Use Cases and Threat Hunting
Jake Haldeman, Manager Sales Engineering Operations, LogRhythm | Tim Peck, Analytic CoPilot Consultant, LogRhythm | Aaron Beardslee, Analytic CoPilot Consultant, LogRhythm
Many LogRhythm customers struggle after the deployment to tune their system properly – to weed out false positives and focus in on the real threats. This can be a challenge to do correctly. The LogRhythm Analytic Co-Pilot team is here to help! In this session will get to know two Analytic Co-Pilot Engineers and discuss war stories and how they stay on top of the latest threats. We’ll also get a chance to meet the WARMIND where they test malware and ransomware to help ensure AIE rules are tuned properly.
In this session you’ll learn:
- What Analytic Co-Pilot is
- What experience some of our Analytic Co-Pilot Engineers have
- How they help other customers
- How they test and safely detonate Ransomware for learning and testing
Day 1 | Sept. 22 | 6:00-7:00am MST
Purple Teaming
Brian Coulson, Principle Threat Research Engineer, LogRhythm | Steve Forsyth, Director of Product Management, LogRhythm | Dan Kaiser, Sr. Threat Research Engineer, LogRhythm | Sally Vincent, Threat Research Engineer, LogRhythm
Security organizations must continually assess and improve the efficacy of their security program. They do so by identifying detection gaps and measuring response and remediation times to active threats. Purple team engagements, in which the red team and blue team collaborate to simulate threats, are a focused and structured means to assess detection capabilities and measure the speed of response.
The MITRE ATT&CK framework is an invaluable resource towards planning purple team engagements. MITRE ATT&CK provides a knowledgebase of adversarial behaviors that can be used for scenario planning and a set of techniques against which to determine completeness of coverage.
Join this webinar to learn how get started with purple teaming in your organization and how to take full advantage of LogRhythm Case, Case Playbooks and Case Tags in orchestrating a successful purple team engagement. Steve Forsyth, the Director of Software Development and the LogRhythm Labs will demonstrate a purple team exercise based on MITRE ATT&CK techniques attributed to APT29.
You’ll learn:
- The theory, goals and requirements of purple team engagements
- Planning a purple Team engagement around the MITRE ATT&CK framework
- How to use LogRhythm Case, Case Tags and Playbooks to structure your purple team engagement
- Using attack simulation tools such as Red Canary Atomic Red Team in your purple team engagement
Day 1 | Sept. 22 | 6:00-7:00am MST
Beating the Pen Testers: Rules and Investigations to Plant the Blue Team Flag
Curtis Huff
Please check back for more information.
Day 1 | Sept. 22 | 6:00-7:00am MST
Automating Adversarial Emulation With LogRhythm Echo
Dan Crossley & Imran Hafeez
Please check back for more information.
Day 1 | Sept. 22 | 6:00-7:00am MST
Improving Threat Hunting With LogRhythm
Marcos Schejtman & Luis Castaneda
Please check back for more information.
Day 1 | Sept. 22 | 6:00-7:00am MST
MITRE ATT&CK and the Juptyr Notebook
Brian Coulson, Sally Vincent, & Dan Kaiser
Please check back for more information.
Day 1 | Sept. 22 | 6:00-7:00am MST
Threat Hunting With MITRE ATT&CK Technique “X”
Brian Coulson, Sally Vincent, & Dan Kaiser
Please check back for more information.
Day 1 | Sept. 22 | 6:00-7:00am MST
LogRhythm Labs and Lessons Learned in the First Year of Creating MITRE ATT&CK AI Engine Detection Rules
Brian Coulson, Sally Vincent, & Dan Kaiser
On April 9th, 2019, LogRhythm Labs released the MITRE ATT&CK Module, with a focus on high efficacy technique detections. Since our initial release, we’ve learned a lot regarding what techniques are the most valuable to detect, how to optimally threat hunt using the techniques, and where we should focus next in our MITRE ATT&CK technique detections.
Dan Kaiser, threat research senior engineer, Sally Vincent, threat research engineer, and Brian Coulson, principal threat research engineer, will focus heavily on MITRE ATT&CK Technique: PowerShell, ID: T1059.001. Microsoft PowerShell is a modular shell native in Windows, and with PowerShell 7, also works on Linux and Mac. PowerShell enables users, and administrators to do tasks in a very efficient way. It also is heavily abused by adversaries performing malicious actions. How does LogRhythm Labs design a detection for a technique that can be used for good, and bad? We will present our challenges from additional logging requirements, detecting PowerShell usage, testing PowerShell detections, and how you can take detections that event heavily and create actionable alarms.
Key takeaways
- MITRE ATT&CK Technique development process
- Tips and Tricks on tuning techniques to become actionable alarms in your environment
- Focus on many ways PowerShell can be detected
Day 1 | Sept. 22 | 6:00-7:00am MST
Malware Analysis 101
Dan Crossley & Sally Vincent
Please check back for more information.
Day 1 | Sept. 22 | 6:00-7:00am MST
Hands-on Labs
Please check back for more information.
Day 1 | Sept. 22 | 6:00-7:00am MST
LogWars Capture the Flag
Please check back for more information.
Hands On Labs
Tail in Web and Search Improvements
Details to be updated
Basic Threat Hunting – Using FIM to Detect Unauthorized Access
Details to be updated
Life of a Case – SOC 101
Details to be updated
Building Dashboards and Drilldown Layouts
Details to be updated
Building AI Engine Rules
Details to be updated
Getting Started with and Building Kibana Dashboards
Details to be updated
Add Kibana to Your LogRhythm XM
Details to be updated
Open Collector 101 – Deploy an Open Collector
Details to be updated
Open Collector 202 – Import Community Device Support
Details to be updated
Open Collector 303 – Create Device Support
Details to be updated
Building and Using Contextualization Actions
Details to be updated
Getting Started with SmartResponse Plugins
Details to be updated
Building SmartResponse Plugins
Details to be updated
LogRhythm API 101
Details to be updated
Getting Started with ECHO
Details to be updated
Basic Log Source Lifecycle
Details to be updated
Log Source Troubleshooting and Tuning
Details to be updated
Advanced Log Source Data Management
Details to be updated
Getting Started with LogRhythm Phishing Intelligence Engine (PIE)
Details to be updated
Building and Using Playbooks
Details to be updated
Tuning AI Engine Rules
Details to be updated
Monitoring Your Deployment
Details to be updated
Writing NetMon DPA Rules
Details to be updated
Getting Started with the LogRhythm.Tools PowerShell Module
Details to be updated
Purple Teaming MITRE Technique X with LogRhythm RespondX
Details to be updated
Custom Log Source Creation
Details to be updated
Frequently Asked Questions (FAQs)
Why did RhythmWorld shift to a virtual event?
We are facing a truly unprecedented situation. The coronavirus pandemic has affected all our families, our businesses, our communities, and our way of life. To ensure the safety of our customers, partners, and employees we have chosen to move RhythmWorld to a virtual event. We hope that a free virtual experience will provide opportunities for our global network to learn, grow, and engage.
What is the cost to attend RhythmWorld 2020?
RhythmWorld Security Conference is a completely free virtual experience for LogRhythm customers, partners, and members of our security community.
What technology will be required to participate in the virtual RhythmWorld?
The digital security conference will be web-based. All you need to participate is your computer and a reliable internet connection.
I’ve already registered for RhythmWorld 2020 in Denver. Will I be refunded for the in-person event?
If you already registered for RhythmWorld 2020, you will receive a full refund for the price of admission. Our events team will be contacting you shortly with details.
Will I be refunded for my lost travel and accommodation costs?
LogRhythm will not refund customers and partners for lost travel and accommodation costs. If you booked a hotel room, please contact your hotel directly, The Hyatt Regency Denver Convention Center can be contacted at 877-803-7534 or click here to find contact information by region.
When will an agenda become available?
Stay tuned — the agenda is actively being updated to share news on keynotes, sessions, breakouts, and interactive activities. Please stay tuned for the full list of sessions and speakers.
Will RhythmWorld 2020 include a LogWars Capture the Flag (CTF) event?
We are planning to host an epic virtual LogWars CTF as part of RhythmWorld 2020. Details about how to register and participate will be provided closer to the event.
I am interested in becoming a sponsor of the virtual RhythmWorld 2020. What opportunities are available?
We’re excited to offer a unique sponsor experience for RhythmWorld 2020. To learn more about the sponsorship packages available, please reach out to EventsMarketing@LogRhythm.com.
Register for RhythmWorld Security Conference
By entering in RhythmWorld Security Conference you agree to the Event Registration Terms.
