Building a Practical Information Security Program

Jason Andress (CISSP, ISSAP, CISM, GPEN) is a seasoned security professional with a depth of experience in both the academic and business worlds. Presently he carries out information security oversight duties, performing penetration testing, risk assessment, and compliance functions to ensure that critical assets are protected. Jason has taught undergraduate and graduate security courses since 2005 and holds a doctorate in computer science, researching in the area of data protection. He has authored several publications and books, writing on topics including data security, network security, penetration testing, and digital forensics. Mark Leary possesses over 30 years of experience in security management and technical intelligence holding several positions of responsibility in IT security management for government agencies and commercial firms. Mark currently performs as Vice President and Chief Information Security Officer for Xerox Corporation, the world’s leading global enterprise for business process and document management with sales approaching $23 billion. Marks holds a Doctorate in Management, MBA with a concentration in Project Management, Dual Masters in Security and IT Management, and holds several professional certifications (CISSP, CISM, CGIET, and PMP). He also serves as an Adjunct Professor for the University of Maryland and Industry Advisor to the Rochester Institute of Technology.

• Why We Need Security ProgramsDevelop a Security StrategyIntegrate Security into the OrganizationEstablish a Security OrganizationDevelop a Security PolicyManage the RisksProtect the DataManage the Security of Third Parties and VendorsConduct Security Awareness and TrainingDevelop Metrics to Measure Program Effectiveness