DATABYTE - ISACA€¦ · 3 DATABYTE DETROIT CHAPTER ISACA – YOUR ‘YEAR-ROUND’ PARTNER FOR PROFESSIONAL GROWTH efore Dinner Topic -Data Encryption Awards and Recognition

March 15, 2017 ISACA Detroit Chapter Meeting

Student’s Night

Pre-Dinner Topic: Data Encryption Pre-Dinner Speakers: Bhaskar Kakulavarapu, CISSP, CISM After-Dinner Topic: From the Bored Room to the Boardroom, Taking Control of your Security Program After-Dinner Speaker: Jason Merkel, CISM, CISSP, ISSEP

Date: Wednesday, March 15, 2017 Time: 4:30 - 5:00 Registration & Networking 5:00 - 6:00 Pre-Dinner Presentation 6:00 - 6:45 Dinner 6:45 - 7:45 After-Dinner Presentation Location: VisTaTech 18600 Haggerty Road Livonia, MI 48152

Cost: Advance Online Registration Only: Walk-In Fees: $20.00 Member $40.00 Member $30.00 Non-Member $50.00 Non-Member $10.00 Student and Retiree $10.00 Student and Retiree

PRESIDENT VICE PRESIDENT TREASURER SECRETARY Keith Cheresko, JD, CIPP/US/IT Greg Boehmer, CISA, CIA, CFE, CGEIT Ryan Hodges, CISA, CISSP Juman Doleh-Alomary, MScE, CISA, Privacy Associates Int’l LLC CISSP, CISM, CRISC, CRMA, PMP Deloitte & Touche CISM, CRISC, ISO27001 [email protected] Deloitte & Touche [email protected] Wayne State University [email protected] [email protected]

VOLUME 31 # 7 REGION 4 CHAPTER 8

DATABYTE

The Chapter must provide the number of reservations by 12:00 pm on the Friday prior to the Chapter meeting. Advance online registration closes at noon on Friday, March 10, 2017. If you have made a reservation and cannot attend, please contact Geralyn Jarmoluk at [email protected], or 248-762-7421 prior to the above noted deadline for refunds. Walk-in registration is available at an increased fee. Reservations not cancelled prior to the above-noted dead-line cannot be refunded as we are committed to the caterer for the meals ordered.

DIRECTORS

Brad Barton, CISA Lear Corporation 248-707-9372 Derrick Buckingham, CISA, CISSP, CISM, CRISC Detroit Medical Center 313-729-8816 Doug Copley, CISM, CISSP, CISA, CIPP, CIPT Forcepoint 517-204-5701 Shannon Desjardins, CPA, CISA, CRISC Blue Cross Blue Shield of Michigan 586-201-1603 Michele M. Dawson, CPA, CISA Beaumont Health Systems 734-637-9270 Michael A. Forrest, CISA, CGEIT Flagstar Bank 248-312-5435 Chris Johnson, CISA Lear Corporation 248-417-7472 Bhaskar Kakulavarapu, CISSP, CISM Comerica 248-925-7001 Linda Kearney, CISA, CISM, CIA, CIPP-US Fiat Chrysler Automobiles 586-219-9041 Charles Murray, CPA, CISA KPMG LLP 313-320-4566 D. Robert Okopny, PhD, CIA, CFE, CMA Eastern Michigan University 734-487-0246 Sajay Rai, CPA, CISSP, CISM Securely Yours LLC 248-723-5224 Malini Sarma, CISA General Motors 313-667-2878 Carrie Schrader, CISA, CBM, CFE, CGEIT, CRISC GM Financial 586-817-8590 Melvin B. Taylor, CISA, CISM General Electric 248-761-5671 Doug Wahr, CFE, CISA, CRMA, CISSP Auto Club Group (AAA) 313-436-7277 Manish Zaveri, CISA, CPA FordDirect 248-739-0104

2

DATABYTE

DETROIT CHAPTER ISACA – YOUR ‘YEAR-ROUND’ PARTNER FOR PROFESSIONAL GROWTH

Dear Detroit Chapter Members, It feels like we just cycled through all four seasons in about three weeks. The trees and plants are certainly confused as much as I am. There is one thing I am not confused about – it is the quality of our ISACA Detroit Chapter volunteers, lead-ers and especially the members. We now have outsider validation. The K. Wayne Snipes Award presented by ISACA International is given to ISACA Chapters that meet established criteria. We have been notified that the Detroit Chapter was awarded an Honorable Mention for our region. (For those of you who have downloaded our mobile app, this may be old news . . . not so subtle hint to check out the app if you have not already had a chance to do so.

We are exploring your interest in a CSX Fundamentals Exam Review Course for the near future. And while we wait for feedback, we would like to make you aware of the Northwest Ohio ISACA Chapter’s full-day CSX Fundamentals review program. The program is scheduled for Wednesday, March 22, 2017 tentatively from 8:30 - 4:30 (an all-day program although specific time may change) to be held at the University of Toledo Main Campus, University Computing Center. There is a minimal $25 cost for ISACA members in good stand-ing as of March 1st. More information is included in this DataByte edition. A note of caution for those who work in financial services and do business in New York. The New York State Department of Financial Services has issued a rule specifying certain minimum cybersecurity requirements for those subject to its rule. The rule took effect March 1, 2017. A cybersecurity program includes risk assessments, cybersecurity policies, a CISO, pen and vulnerability assessments, and com-pliance certification by the board or senior officer. If yours is considered a covered entity, there is plenty of audit work required – prompt-ly if not already undertaken. Depending on interest, we may arrange a presentation on the specifics for an upcoming meeting. I have re-ceived a few requests for a possible update on the EU General Data Protection Regulation. If this topic is of interest to you, please let me or any of the board members know. Thanks for your attention, and since this is March it’s time to get ready for non-stop college basketball. (There will be cheers from some and groans from others). Best regards,

Keith Cheresko, JD, CIPP/US/IT

ISACA Detroit Chapter President

February Speakers Greg Boehmer, Robert Carton and Allen Hillaker with I SACA Program Chair, Malini Sarma

February Speakers Matt Kipp and Shane O’Donnell with ISACA Academic Relation Chair, Sajay Rai

3

DATABYTE

DETROIT CHAPTER ISACA – YOUR ‘YEAR-ROUND’ PARTNER FOR PROFESSIONAL GROWTH

Before Dinner Topic - Data Encryption Encryption is the process of changing information in such a way as to make it unreadable by anyone except those recipients who have a secret phrase (also referred to as a "key") which allows the recipient to convert the unreadable data back to its original, read-able form. Businesses use encryption it to protect corporate secrets, govern-ments’ use it to secure classified information, and many individu-als use it to protect personal information to guard against things like identity theft. The topic on data encryption covers a brief introduction on cryp-tography technology, history, types of cryptographic algorithms available, uses of cryptography in securing the data and data communication channels, example of a simple encryption algo-rithm and how it works, key management, challenges of imple-mentation and support. Before Dinner Speaker - Bhaskar Kakulavarapu, CISSP, CISM has over 30 years of IT work experience and 20 years in IT Security. Bhaskar has performed roles as programmer, systems administra-tor, technology manager at Lear Corporation, Global Internet and Extranet service manager at Delphi, and has been working as a consultant in various Information Security roles. Bhaskar is cur-rently working as an Information Security Architect at Comerica Bank.

He has interacted with senior management, technology council and executive management, contributed to strategic planning and presented technology roadmaps. Bhaskar is a key participant and contributor for security policy development, technical minimum baseline standards, security architecture and solutions and stand-ards mapping to business requirements.

Bhaskar has managed information security assurance through information security compliance and governance activities, confi-dentiality, privacy, compliance and vulnerability management, incident management, investigations, risk assessments, exception gap analysis, compensating controls, residual risk mitigation plans, DR and BCP. He has also managed global services and global teams with effective communication and maintained ser-vices with effective SLA, KRI and KPI metrics.

Bhaskar is a key contributor to the development of ANX, and spo-ken at many conferences on ANX services.

As a guest speaker at U-M Dearborn campus and LTU, he spoke on network security and ethical hacking, wireless network security, firewalls and network routing, information security and incident management.

Bhaskar is a volunteer instructor for CISM review classes.

Professional Training and Certifications:

Certified in CISM, CISSP & Six-Sigma Green-belt

Training Completed Leadership development, CEH, VMWare boot-camp, PMP, CCNP, and Data Networks

Awards and Recognition

Received outstanding achievement award in 1999 from AIAG for contributions to ANX development, chairperson for security group for ANX services.

Received outstanding achievement award in 1988 from Unisys for development of business application using 4GL language and relational databases including process and data recovery

Professional Affiliations: Member (ISC)2, ISACA, and Detroit ISACA Chapter Board member

After Dinner Topic - From the Bored Room to the Boardroom, Tak-ing Control of Your Security Program This presentation will highlight the need for cybersecurity (and infor-mation security) to happen at the right level in order to have securi-ty aligned with business objectives. Subthemes throughout include organizational culture considerations to ensure solutions are fielded with the highest potential for success and the need to keep up with the times to stay ahead of the bad guys.

Why protect? Know your enemy and the value of your re-sources

Current and future trends in cyber threats Security: Business issue or technology problem? Importance of… (may go into baselining, training, monitoring,

threat intelligence) Who should be accepting risks? Security is everywhere (the bored room) Selling security: Alignment of business outcomes (the board-

room) The secret sauce: Taking control!

After Dinner Speaker - Jason Merkel, CISM, CISSP, ISSEP Founder and Strategic Advisor at 3fold Solutions Mr. Merkel is an accom-plished security leader with comprehensive experience establishing global information security management programs and enhancing cybersecurity operations within Fortune 100 companies, small busi-nesses, and Federal organizations. He has been designing and implementing security solutions for over 17 years and has diverse experience working with global infrastruc-tures, data centers, software development, and cloud/virtual envi-ronments in life sciences / healthcare, software, finance, manufac-turing, travel, and Federal/DoD industries. Before opening his own company in 2016, he has worked for Booz Allen Hamilton and Hewlett-Packard Enterprise, along with some not-so-familiar niche firms!

4

Attend up to 4 Chapter Meetings FREE

In these difficult times, the ISACA Detroit Chapter Board wants to help. If you are unemployed, laid-off, or are not currently receiving a paycheck, we have some good news. It’s during times such as these that maintaining a network of peers and maintaining your level of training is so very important. We are, therefore, offering to allow you to attend up to four (4) meetings FREE. You must regis-ter for each meeting through the Membership Chairman by sending an e-mail stating that you are currently out of work and wish to attend the meeting. The e-mail must be received prior to the meeting registration close for that meeting. Please send your email to Mike Forrest at: [email protected].

Photo Disclaimer: ISACA Detroit Chapter may capture images from meetings and events on film or digital media for publication and marketing purposes.

Welcome New ISACA Detroit Chapter Members

Robert Franklin Maryann Fredrick Danielle Lia Brendan Canty Yasmin Kasmikha Karen Ben-Shahak Ilsa Astrit Jonuzi Robert Duhart Gary Kapanowski Hang Pryor Shirali Patel Luke Donald Arjun Reddy Sumeet Chhawri Alison Ulicny James Tartamella Matt VanValkenburg Sriram Chengjeri

February Chapter Meeting Raffle Winners

David Lefever Edward Priebe Steven Monato Karen Lamerton Unsal Yetkin John Heymes Donna Jones Doug Wahr Unsal Yetkin David Lefever Robert Yanik Brian Kaetz John Giampa

DATABYTE

DETROIT CHAPTER ISACA – YOUR ‘YEAR-ROUND’ PARTNER FOR PROFESSIONAL GROWTH

The ISACA Detroit Chapter Certification Committee Wishes to Congratulate the following Newly Certified

Catherine Kelly CISM Matthew Schick CISA Kenneth Heskett CISA Rohan Dsouza CISA Jennifer Fiebelkorn CISA George Farha CISA Cady Ann Chin CISA Khaleel Suhrawardy CISM

The ISACA Detroit Chapter Certification Committee Wishes to Congratulate the following members who Passed the

December 2016 ISACA CISA Certification Exam

Tabitha White Ilkhomjon Amanov Ross Klein Mohamad Shajera Edward Priebe Jennifer Fiebelkorn Martin Coffman James Pauline Mir Haque Stephen Marsh Khanh Dang Akash Verma Andrew Cabaj George Farha Jeffrey Sisolak Melissa Garrett Kathleen Welch Kenneth Heskett John Hock Matthew Schick Adi Dzinic Simone Charter-Harris Jeffrey Cook

The ISACA Detroit Chapter Certification Committee Wishes to Congratulate the following members who Passed the December 2016 ISACA CISM Certification Exam

Ernest Billingsley Catherine Kelly John Ghostley

The ISACA Detroit Chapter Certification Committee Wishes to Congratulate the following members who Passed the December 2016 ISACA CRISC Certification Exam

Lola Foster Joseph Pelukas Jeffrey Kuhlman Brandon Pilcher Irene Ruthven

ISACA Detroit Chapter Spring Seminar The Detroit Chapter of ISACA is happy to announce the upcoming spring seminar covering two important topics: “Agile Development, Controls & Audit”, and “Conducting a Cyber Security Assessment”. The first topic will focus on the audit, control and security issues related to Agile Devel-opment and Operations, while the second topic will focus on the risk and control issues related to cyber security including key controls and how to audit them. The instructor for both topics will be John Tannahill. John is an independ-ent Information Security and Audit Services Consultant who works in the areas of information security in large information systems environments and networks. He has particular technical expertise with Windows 2008/2012; Unix/Linux; Oracle/Microsoft SQL Server and Internet securi-ty. This two-day seminar will be held on May 1 and May 2 (Monday and Tuesday) at the Michigan State University Management Education Center, 811 W. Square Lake Road in Troy, MI 48098. Class will begin at 8:30am and will conclude around 5:00 pm. A light breakfast and lunch will be served each day. Those attending will be awarded 15 hours of continuing professional education (CPE) credits. The cost of the two day seminar will be $100 for Professional ISACA members and Student ISACA members, $275 for Professional non-ISACA members and $125 for Student non-ISACA members. Both non-ISACA member fees include a one year mem-bership in both ISACA International and the Detroit Chapter. Enrollment can be completed by visiting the Events section of the ISACA Detroit web-site at: http://www.isaca.org/detroit So mark your calendar for this important date and take advantage of one of the unique opportunities associated with being a member of ISACA. For more information and to register please click the following link: http://www.cvent.com/d/p5qjsq Day 1 – Agile Development, Controls & AudiT Introduction to Agile Introduction to DevOps Agile Security & Control DevOps Security & Control Audit Tools and Techniques

Day 2 - Conducting a Cyber Security Assessment Understand NIST Cyber Security, Frameworks and Audit Tools Cyber Security Concepts, Trends, and Controls Critical Security Controls and Related Audit Objectives and Steps

5

DATABYTE

DETROIT CHAPTER ISACA – YOUR ‘YEAR-ROUND’ PARTNER FOR PROFESSIONAL GROWTH

March 15, 2017 Menu Classic Caesar Salad

Spinach Salad with Bacon, Red Onion and Eggs Tilapia au Poivre, Creamed Vidalia Onion Sauce

Chicken Breast Marsala with Sautéed Mushrooms and Shallots Ricotta Stuffed Tortellini, Wilted Arugula, Fresh Tomato and Garlic

Roasted Redskin Potatoes and Roasted Seasonal Root Vegetables Fresh Baked Bread

Dessert

Annual Detroit Chapter of ISACA Scholarship Competition

ISACA Detroit is excited to announce our 4th Annual Scholarship Competition. This competition is designed to enrich the experience of students by providing them with a “real world” experience. The com-petition consists of contestants working on a case study and present-ing their conclusions to a panel of industry professionals who will play the role of potential future employers. The contestants not only have an excellent chance to win some cash, but the 1st place university also earns the right to display the ISACA Detroit trophy (just like a Stanley Cup) for the next year. So, let the competition begin. This year the competition will start on March 31, 2017 at 6 pm and end on April 2, 2017 at around 4 pm. The format of the competition is as follows: You are free to form a team. It is recommended that the team con-

sist of two students, one with a background of IT auditing or assur-ance, and the second with a background of IT Security.

A university may send multiple teams to the competition.

Teams will be competing for three scholarships: 1st place is $4,000, 2nd place is $2,500 and 3rd place is $1,500. The winners will get a certificate and the 1st place team university will get the “ISACA De-troit Cup”. And, of course, all participants will get honorable mention on ISACA’s website and monthly newsletter.

Like last year, it is also possible that the judges give out more than one 1st place, 2nd place and 3rd place awards. Last year, we had two teams who received 1st place awards of $4,000 each and two teams received 3rd place awards of $1,500 each.

Teams will be issued a case study at 6 pm on March 31, 2017. Teams will be expected to work on the case study till Noon of April 2, 2017. At that time, the teams will present their report to the judg-es. The presentation will be held at Eastern Michigan University, Owen Building at 300 West Michigan Ave, Ypsilanti, MI 48197. The winners will be announced after all the teams have presented (around 3 pm on April 2, 2017).

The case study will be made available on March 31, 2017 at 6 pm via email.

Register today at the following link: http://www.cvent.com/d/8vq50b/1Q

The ISACA Detroit Chapter CISA / CISM / CRISC / CSX EXAM REVIEW CLASSES

The ISACA Detroit Chapter is pleased to offer CISA, CISM, CRISC, and CSX (new) review classes in preparation for the 2017 Exam Window (May 1 – June 30) exams. The classes will be held at the Eastern Michigan Uni-versity (EMU) site in Livonia (6 Mile and Haggerty - directions will be provided upon registration). The classes, including a mock exam, will be held on the following dates from 5:00 p.m. to 8:30 p.m.:

Tuesday, March 21 CISA Domain Tuesday, March 28 CISA, CISM, CRISC Domains Tuesday, April 4 CISA, CISM, CRISC Domains Tuesday, April 11 CISA, CISM, CRISC, CSX Domains Tuesday, April 18 CISA, CISM, CRISC, CSX Domains Tuesday, April 25 CISA, CISM, CRISC, CSX Domains/Mock Exams Tuesday, May 9 CISA Mock Exam

NOTE: A schedule of the domains that will be covered each session will be sent to all participants by our Chapter Administrator. The cost for each of the CISA, CISM, CRISC or CSX review courses is $100 per person. No dinner or beverages will be provided – Attendees are encouraged to bring a snack and a beverage. There is also a minimum enrollment requirement – if enrollment does not reach at least 5 students per course, the low enrollment sessions will be cancelled and your money refunded. Enrollees will be notified by Friday, March 17th if the sessions are cancelled. For registration, please visit our Chapter’s web site (www.isaca-det.org). The registration will begin on Wednesday, March 1st and will close on Wednesday, March 15th. If you have questions, please feel free to contact me at [email protected]. Charles J. Murray, CISA, CPA ISACA Detroit Chapter Certification Director

Announcing ISACA Detroit Smart Device App

The ISACA Detroit Chapter Communications Committee is happy to an-nounce the availability of a smart device App designed to provide current

and important information on several membership benefits and activities. This App is now available for both Apple and Android devices and can be installed by following the steps below. Making this App availa-ble to our membership is just one in a series of improvements being researched and planned by the Communications Commit-tee. We are anxious to meet our membership’s expectations for effective communications and any and all ideas are welcomed. If you have a suggestion, please send an email message to: Brad Barton, Chair of the Communi-

cations Committee, ([email protected]) or reach out to any of our Board members to submit your suggestion.

The ISACA Detroit Communications Committee

6

ADVERTISE IN THE DATABYTE NEWSLETTER

¼ Page $50.00 ½ Page $100.00 Full Page $200.00

Contact Geralyn Jarmoluk at [email protected]

or Mike Forrest at [email protected]

DATABYTE

DETROIT CHAPTER ISACA – YOUR ‘YEAR-ROUND’ PARTNER FOR PROFESSIONAL GROWTH

Detroit IIA and ISACA Spring Training Social Event March 28, 2017

Tuesday March 28, 2017 – 5:00 to 7:00 pm Start time is directly after Tuesday’s Spring

Training Sessions

Cost: IIA and ISACA Detroit Chapters will provide select subsidized drinks and appetizers at:

Lucky Strike 44325 Twelve Mile Road

Novi, Michigan (p) (248) 374-3420

(less than 3 miles from the Suburban Collection Showplace)

Our 2017 Sponsors

Platinum Vendor

Gold Vendors

7

DATABYTE

DETROIT CHAPTER ISACA – YOUR ‘YEAR-ROUND’ PARTNER FOR PROFESSIONAL GROWTH

Spring Training Chapter News The Detroit Chapters of IIA and ISACA are proud to co-sponsor the 18th Annual Spring Training. Once again, the Spring Training Committee has ob-tained some of the top trainers in auditing from around the country to provide their personal expertise to our members. As you all know, this is our 18th year for the seminar and it has gained out-of-state recognition. Do not miss your opportunity to get the training you need. A number of classes sell out each year! Don't miss out on the opportunity to network with your peers, enhance your skills, and learn about new products and services in the market-place. Please click the following link to view more information on this event, register, and/or download the Spring Training brochure. IIA & ISACA 18th Annual Spring Training The Spring Training Committee

TRACK MON MARCH 27 TUES MARCH 28 WED MARCH 29

A Accounting Fraud; Deterrence,

Detection & Remediation

(Paul Zikmund)

Auditing Ethics & Compliance Programs & Controls

(Paul Zikmund)

Fraud Deterrence; Keys to Successful Mitigation of Fraud Risk

(Paul Zikmund)

B Facilitation Skills

(Keith Levick)

Collaborative Negotiations

(Keith Levick)

Performance Coaching

(Keith Levick)

C The 21 Irrefutable Laws of

Leadership

(Don Levonius)

Sometimes You Win, Sometimes You Learn

(Don Levonius)

The 15 Invaluable Laws of Growth

(Don Levonius)

D

Risk-Based Approach to IT Infrastructure Security &

Control Assessments

(John Tannahill)

Cloud Computing Security & Audit

(John Tannahill)

Cyber Security & Emerging Risk Areas

(John Tannahill)

E Auditing Strategic Risks

(Greg Duckert)

F Successful Audit Data Analytics (Hands-On)

(Jim Tarantino)

G Internal Audit School

(Hernan Murdock)

H Project Management for Auditors

(Kathleen Crawford)

I

Implementing COSO 2013: Real-World Applications & Best

Practices

(Jim Roth)

Risk Management Assurance: Developing Your Internal Audit

Strategy (Jim Roth)

J CANCELLED Auditing IT Out-

source Environment (Norm Kelson)

Auditing CyberSecurity Governance and Controls (Roger Herbst)

K

Understanding & Auditing Cryptography for

CyberSecurity Applications (Roger Herbst)

CyberSecurity of Microsoft Windows Server & Active Directory

(Ken Cutler)

L-1

Auditor’s Guide to CyberSecurity Vulnerability and Penetration Testing

(Ken Cutler)

8

The March 15, 2017 ISACA Chapter Meeting

will be held at:

VisTaTech Center on the Schoolcraft College Campus East side of Haggerty Road between 6 & 7 Mile Roads

18600 Haggerty Road Livonia, MI 48152 Phone: (734) 462-4610

DATABYTE Geralyn Jarmoluk, Editor

P.O. Box 43 Romeo, MI 48065

[email protected] 248-762-7421

DATABYTE

DETROIT CHAPTER ISACA – YOUR ‘YEAR-ROUND’ PARTNER FOR PROFESSIONAL GROWTH

2016-2017 ISACA Committees

Academic Relations

Sajay Rai (Chair)

Michele Dawson

Ryan Hodges

Bhaskar Kakulavarapu

Robert Okopny

Manish Zaveri

Bylaws, Policies & Proce-dures

Greg Boehmer (Chair)

Keith Cheresko

Linda Kearney

Charles Murray (Chair)

Certification Michele Dawson

Michael Forrest

Steve Rogers (Non-Board Volunteer)

Brad Barton (Chair)

Keith Cheresko

Doug Copley

Communications Juman Doleh-Alomary

Ryan Hodges

Chris Johnson

Bhaskar Kakulavarapu (Webmaster)

Facilities

Carrie Schrader (Chair)

Ryan Hodges

Linda Kearney

Membership Michael Forrest (Chair)

Doug Wahr

Nominating & Audit Brad Barton (Chair)

Linda Kearney

Program

Malini Sarma (Chair)

Greg Boehmer

Keith Cheresko

Doug Copely

Juman Doleh-Alomary

Seminars

Manish Zaveri (Chair)

Brad Barton

Carrie Schrader

Doug Wahr

Melvin Taylor (Chair)

Social Committee Ryan Hodges

Malini Sarma

Juman Doleh-Alomary (Chair)

Spring Training Shannon Desjardins

Mike Forrest