ISACA Chapter Programs

Risk IT - Special One Day Workshop
-by Brian Barnier of ValueBridge Advisors

Date: April 15, 2010 (8:00 AM - 4:30 PM) light breakfast, lunch, snacks & beverages included
Location: Deloitte, 2800 Floor - 1055 Dunsmuir Street, Vancouver

Cost: $299 plus GST for ISACA members

Invited Audience:
CIOs, CxOs, Senior Management, IT Governance, IT Management, Business Continuity, Information Security Management, Risk Management, and IT Assurance professionals. 

Overview:
Effective management of business risk has become an essential component of IT governance. Leading the drive to help enterprises mitigate risks, ISACA has developed

• The Risk IT Framework: Based on COBIT (free download for members)
• The Risk IT Practitioner Guide: Based on COBIT (free download for members)

The purpose of this intermediate level workshop is to help those responsible for risk management or assurance.

• Understand how the Risk IT Framework can help them manage IT risk; and

• Explore how practical guidance and techniques in the Practitioner Guide can help them implement IT risk management.

Seating is limited to 25 to ensure maximum class interaction and personal attention so register early.  Registration is now open to ISACA Vancouver members.  Registration will be opened to non-members on March 12, 2010.

Facilities, food and beverage - courtesy of Deloitte.

Printed workshop material will be provided - courtesy of KPMG

Prerequisites:

Participants should be familiar with the risk assessment and management process.

Workshop Outline:

• Explores the elements of IT risk management - the principles, who is responsible for IT risk, how to build awareness, and how to communicate risk scenarios, the business impact and key risk indicators;

• Introduces the Risk IT framework and the process model that includes risk governance, risk evaluation and risk response;

• Explains how the framework relates to COBIT and how it can help to achieve best practices in IT risk management;

• Examines the implementation and operational issues of the framework;

• Explores how to integrate IT risk management into an enterprise wide risk management program, establish and maintain a common risk view and make risk-aware business decisions; and

•  Elaborates on how to maintain an operational risk profile, assess and respond to risk, as well as how to collect event data, monitor risk and report exposures and opportunities.

Workshop Objectives:

• Participants will understand and learn:

• The nature of IT risk and apply it to their own organization;

• The key principles of IT risk management;

• How the Risk IT process model can help to manage IT risk;

• How to implement IT risk management using the practical guidance and techniques in the Risk IT Practitioners Guide; and

• How to apply risk management principles through practical case studies.

Instructor Biography:

Brian Barnier brings a unique perspective to business-IT management. With a split career between "the business" and IT, he works to bridge two sets of needs to get greater business benefits from IT.  He also has a unique vantage point because of his experience in practical projects, best practices committees, research and teaching professional education across industries and countries.  His research on "what works" in risk management with a co-author at MIT Sloan CISR has been published in several publications, most recently the ISACA Journal.  In 2009, he presented to over 1000 people in live events and nearly as many in webinars.  In addition to writing widely in various business and IT management publications, he serves on the editorial board for EDPACS.  He is currently with ValueBridge Advisors and previously was with IBM, Lucent and AT&T.

Brian is a member of the ISACA's IT Enterprise Risk Management Task Force that created the Risk IT Framework.  He chairs the ISACA IT-GRC Conference Program Committee; writes for the ISACA Journal, COBIT Focus, and chapter newsletters; and serves on ISACA's CACS Task Force, IT Governance Forum Core Faculty and Professional Influence and Advocacy Committee.

Registration:
To register for this event, please have your contact information and membership number ready before calling the ICABC Professional Development Department at 604-681-3264 or email pdreg@ica.bc.ca.  Please note that the course fee must be paid in full at the time of registration by VISA, MC, or AMEX.

Past Events

Additional Request...Survey to identify factors influencing decisions on implementation of continuous auditing software and the impacts on auditors and audited firms. 

A Masters students at Sauder School of Business at UBC, is conducting research on the factors that influence decisions on implementation of continuous auditing software and the impacts on auditors and audited firms, and is requesting 5 minutes of your time to respond to a survey to support this research.  The student has agreed to provide feedback on the results to our ISACA members, the survey is anonymous and does not require any personal or company information. Thank you for your time and support.

http://www.surveymonkey.com/s/2LBF33X 

The Vancouver Chapter of Institute of Internal Auditors
Progress Through Sharing Training Session

Topic: Internal Audit in an Economic Downturn - What has changed?

Date: January 28, 2010 (Thursday)
Time: 11:30AM to 2:00PM (1 CPD hour)
Location: The Sutton Place Hotel

Full details and registration (PDF, 107KB)

Topic:  Social Media, Friend or Foe? The Opportunities and Risks for Organizations Using Social Media Platforms
-by Marty Yaskowich, Business & Strategy Director, Tribal DDB Vancouver and Dan Pontefract, Senior Director/Head of Learning and Collaboration, TELUS

Invited Audience:
CIOs, IT Governance, Information Security Management, IT Assurance as well as Marketing, Communication and Business Strategy professionals.
 

Overview:
The unstoppable rise of social media is creating opportunities for many organizations and individuals.  At the same time, the use of social media introduces new risks that must be addressed to mitigate pitfalls.  This session will provide our audience information about the opportunities and the risks for using social media.

Marty Yaskowich will provide examples of how digital and social trends and tools are making it easier and more effective to communicate with a wider audience than ever before. He will provide a deep evaluation of social media and mobile-based tools available today along with great case studies of organizations that are doing it well and advise on how to overcome some of the obstacles you may face in your organization.

Dan Pontefract will discuss the risks associated with the use of social media (Web 2.0 and Enterprise 2.0).  What happens if Web 2.0 tools, applications and websites begin infiltrating your organization when you are not prepared or without an Enterprise 2.0 strategy?  Dan will cover the following areas during his presentation:

¡¤         An overview of Web 2.0 and Enterprise 2.0;

¡¤         The link between Web 2.0 and Enterprise 2.0;

¡¤         The good: when 2.0 goes right for your company;

¡¤         The bad: when 2.0 goes wrong for your company;

¡¤         Pitfalls and hiccups other organizations have suffered; and

¡¤         Best practices for your 2.0 company or organization.

Biographies:

Marty Yaskowich is the Business and Strategy Director for Tribal DDB Vancouver and is the lead digital strategist for the Canadian Tourism Commission, Vancouver Convention Centre, Tourism Kelowna and the BC Dairy Foundation. Before joining Tribal in 2005, Marty managed integrated and interactive marketing programs for clients that included Starbucks, Amazon.ca, ADT Security Canada and DaimlerChrysler's US Product and Sales division. Prior to entering the advertising field, Marty was a successful journalist and broadcaster.

Born and raised in Saskatchewan, Marty is an accomplished speaker on a host of Internet-related topics. He is a graduate of the UBC Internet Marketing program, is a Certified Internet Marketing strategist and holds a Bachelor of Arts degree from the University of Regina. He is member of the International Interactive Marketing Association and the BC Chapter of the American Marketing Association.

Dan Pontefract is the Senior Director / Head of Learning & Collaboration at TELUS.  He is responsible for the overarching strategy of Learning 2.0 at the company; the shift to a social, informal and formal learning and collaboration model for all 35,000+ team members. In addition to these actions, Dan is chair of the TELUS 2.0 Adoption Council; a cross-functional group of leaders aimed to help drive a culture of collaboration and engagement across the organization.  He is uniquely skilled to ensure an organization can move from traditional based learning to non-traditional based learning inclusive of asynchronous modalities such as social media, video, eLearning, podcasts, virtual classroom and other social learning / social networking opportunities.

Dan's career is interwoven with both corporate and academic experience, coupled with an MBA, BA, B.Ed and multiple industry certifications and accreditations.  Prior to joining TELUS in late 2008, Dan held senior positions with SAP, Business Objects, Crystal Decisions and BCIT.

Social Media Opportunities.pdf (9582KB)

Social Media Risks.pdf (2892KB)

ISMS User Group BC fall meeting on ISO 27001, Quantum Computing & PCI Compliance

More details (520KB)

SANS Vancouver 2009 - Free SANS @NIGHT sessions November 14, 15 & 16
-by SANS instructors

Invited Audience:
CIOs, IT Governance, Information Security Management, and IT Assurance professionals.

Overview:
SANS is offering 3 one hour evening talks on the following topics absolutely free!

1.     Incorporating Advanced MitM Attacks in Your Penetration Testing Regimen

- Bryce Galbraith

- Saturday, November 14 * 7:15 pm - 8:15 pm 

What else can be done when traditional attack vectors like remote exploits and weak passwords fail, start the report? No way! MitM attacks can open up systems that might otherwise be impregnable: systems with strong passwords, that are fully patched, that are protected by ACLs and employ other best practices. Inconceivable, right!? This presentation will cover how you can crack these tough nuts on your next penetration test by influencing layers 2-7 of the OSI Model. Bryce will discuss the tools and techniques needed to launch a wide variety of MitM-based attacks that leverage common scenarios found in most organizations today.

2.     Advanced Forensics Techniques: Catching Hackers on the Wire

- Jonathan Ham

- Sunday, November 15 * 7:15 pm - 8:15 pm

Digital forensics is about more than just hard drive analysis. Packet captures, web proxies, Snort alerts, and other sources of network-based evidence can help investigators track an attacker's activities throughout an organization. Jonathan Ham presents a couple of scenarios in which an advanced investigation of network-based evidence can yield a richer understanding of events. We'll spend an hour exploring sources of evidence that we can use to close the loop faster, and get better results in both incident response and investigation. "No hard drive? No problem!"

3.     Behind the Scenes of Internet Piracy: Coming to a network near you

- Chad Tilbury

- Monday, November 16 * 7:00 pm - 8:00 pm

Chad Tilbury spent over two years as Hollywood's point man on the front lines of the global Internet piracy war. Let him show you the dark underbelly of Internet piracy that few have seen or experienced.

This talk aims to expose the shadowy sources of Internet piracy, describe how pirate infrastructure is configured and secured, show how content is propagated, and discuss where you might find pirate activity on your own servers. Chad will describe how Internet piracy fits within the big picture of international trafficking of pirate goods, discuss links to syndicates and organized crime and explain why pirates are willing to take big risks amidst increasingly vigilant law enforcement activity.

Registration:
Please register directly with SANS http://www.sans.org/vancouver09/night.php

November Education Session:  10 things IT Professionals need to know about PCI DSS
-by Doug Steele, Partner ¨C Business Risk Services, Grant Thornton LLP

Date: Tuesday, November 10, 2009
Time: Lunch followed by the Education Session - 12:00 p.m.-2:00 p.m. (2 CPE hours)
Cost: ISACA Member - $40; Non-members - $50; Seating is Limited!
All lunch sessions include a full 3 course lunch.
Location: The Sutton Place Hotel - 845 Burrard Street, Vancouver

Invited Audience:
CIOs, IT Governance, Information Security Management, and IT Assurance professionals.

Overview:
The Payment Card Industry Data Security Standard (PCI DSS) is a worldwide information security standard developed by the five founding payment brands of the PCI Security Standards Council.  The standard applies to all organizations which hold, process, or pass cardholder information from any card branded with the logo of American Express, Discover, JCB, MasterCard and Visa. 

In this presentation, Doug will cover the following areas of PCI:

• An overview of what the PCI Security Standards Council is and what power it has.
• An overview of the PCI DSS.
• Who is affected by it?
• Who needs to comply with it?
• What are the different levels of compliance?
• What is the role of the QSA?
• Is the QSA review and audit?
• What is a ASV and how it is different from QSA?
• A review of common tips and traps.

Presentation PDF (208K)

 Biography:

Doug Steele leads Grant Thornton's Business Risk Services Practice for British Columbia.  Doug has fifteen years of experience advising public companies, private companies and the public sector in the areas of internal controls and risk management, internal audit, project management, enterprise resource planning (ERP) systems, information systems security and information technology risk management.  Doug is a Chartered Accountant (CA) and Certified Information Systems Auditor (CISA).  In addition, Doug is a PCI Qualified Security Assessor (QSA) and has assisted organizations achieve PCI compliance.

October Education Session: Business Continuity Planning: the basics and alternative approaches
-by Andrew Boulton - Manager of Technology, Risk and Security, BDO Dunwoody LLP

Date: Tuesday, October 13, 2009
Time: Lunch followed by the Education Session - 12:00 p.m.-2:00 p.m. (2 CPE hours)
Cost: ISACA Member - $40; Non-members - $50; Seating is Limited!
All lunch sessions include a full 3 course lunch.
Location: The Sutton Place Hotel - 845 Burrard Street, Vancouver

Invited Audience:
Board Members, CIOs, CxOs, Senior Executive Management, IT Governance, Information Security Management, Risk Management, and IT Assurance professionals.
 
Overview:
Today's business world is more complex and hectic than ever. Rapid technological change, global geopolitical unease and a perceived upsurge in natural disasters threaten the stability of society. Disaster, be it imminent or far-off, minor or major, can strike your business at any time. Being prepared for 'worst-case scenario' situations is crucial to maintaining viability and functionality in times of crisis.  The solution: Business Continuity Planning (BCP).
 
In this presentation, Andrew will walk attendees through the basics of Business Continuity Planning by looking at the following major steps involved in a successful planning process:
¡¤         Understanding the organization;
¡¤         Determining an appropriate BCP strategy;
¡¤         Developing and implementing a BCP response; and,
¡¤         Exercising and maintaining the BCP framework. 
 
This presentation will incorporate the principles laid out by the Business Continuity Institute and BS 25999 (ISO 17799/27001), the gold standard for BCP.
 
Acknowledging that in this current economic climate there may be resistance by senior management to design and implement a comprehensive Business Continuity Plan, Andrew will also discuss ways to streamline the process as well as present some alternative risk-based approaches for less comprehensive business continuity programs.

Presentation PDF
 

Biography:
Andrew M Boulton is a Manager, Technology Risk and Security at BDO Dunwoody LLP.
Andrew graduated with a Bachelor of Science degree in 2000 followed by a Master of IT in 2001, each from the University of Queensland, Australia. Prior to joining BDO, Andrew worked in IT security evaluation and certification with the Australian Department of Defence where he was a Senior Certifier administering the security evaluation program for the Australian Government. He also ran his own IT consultancy company for small application development, network design and support.
 
Since joining BDO, Andrew has been responsible for the delivery of Technology Risk Management services including the areas of Enterprise Security IT control design and evaluation for financial statement audits, CEO/CFO certification and risk mitigation engagements, IT Assurance, Business Continuity Management, Data Management, and Common Criteria Evaluation Support.  Andrew also delivers services including IT feasibility and project implementations, service auditor reports, and IS specialist involvement in financial statement audits.
 
Andrew currently holds the CISA, CISSP, GCIH and GSEC certifications and is a member of ISACA, ISC2, ISSA, GIAC, the SANS Institute, and the IIA.

September Education Session: Sources of Information Risk at time of Financial Crisis 
   -by Dr. Victoria Lemieux, Centre for the Investigation of Financial Electronic Records

Thursday, May 21, 2009, 12pm-2pm (2 CPE hours)

Painting IT Green - What is Sustainability and How does IT play a role?

Social and environmental issues have been discussed in many industries for decades. In the last few years, however, sustainability issues (e.g. climate change, community involvement, waste, water etc.) have risen as business issues at a breathtaking speed. In The 2009 Ernst & Young business risk report, 'Radical Greening' moved from being ranked 9th in 2008 to 4th in 2009. Social, environmental, market political and technology drivers have converged to create a powerful, fast-emerging demand for sustainability in all areas of the economy.

During this session, participants will gain a better understanding of the key business concepts of sustainability and climate change, the recent regulatory changes and the ways in which companies can prepare for a carbon-constrained and sustainability driven future. The speakers will also discuss the role that IT function plays in the sustainability field, the business value in integrating sustainability in IT, and the potential IT risks that may result from the transformation of greener IT systems, infrastructures and processes.

Presenters' Backgrounds:
Tom Wong is a Partner with Ernst & Young in Vancouver's Advisory Services. Tom brings 18 years of experience delivering business strategy by bridging technology capabilities with business needs. He also helps his clients in the areas of governance, risk mitigation and process optimization.
Tom regularly writes and speaks on governance and controls topics at international conferences and professional association events.

Meg Fricke is the Vancouver Regional Market Leader for Climate Change and Sustainability Services. Meg has over 5 years of experience providing sustainability and greenhouse assurance projects as well as sustainability and climate change advisory engagements for both private sector and government clients. Meg recently transferred to Canada from the Australian Climate Change and Sustainability Services team.

Karen Kwok is a Senior Consultant in Ernst & Young's Advisory Services in Vancouver. She has over 4 years of IT risk and business processes experience for clients in Canada, U.S. and China. Karen has helped many of her clients with business issues related to IT.
________________________________________________________________________

Monday, June 8th, 2009, 12pm-2pm (2 CPE hours)

Annual General Meeting

We are very pleased to present the following topic for this year's AGM. We recommend registering early as we anticipate spaces to fill up quickly.

AGM Speaker Topic and Description:

"Privacy and Information Security Governance"

David Loukidelis, BC's Information and Privacy Commissioner, will speak about how our privacy laws impact the design and operation of information systems. He will also discuss current and evolving challenges for business and government in keeping personal information secure and talk about the role of information security professionals in IT governance designed to protect privacy.

Bio:
In November of 2005, British Columbia's Legislative Assembly unanimously appointed David Loukidelis to a second six-year term as Information and Privacy Commissioner for British Columbia. An independent officer of the Legislature, he oversees compliance with British Columbia's Freedom of Information and Protection of Privacy Act and Personal Information Protection Act.

David's experience in access to information and privacy issues goes back to 1990. Since becoming Commissioner in 1999, he has written hundreds of access to information appeal decisions, privacy complaint decisions, public reports and policy materials. He has also participated in privacy and access to information policy development both nationally and internationally through a variety of working groups and forums. He also teaches access to information and privacy law at the University of Victoria's Faculty of Law.

David, who qualified as a lawyer in 1985, clerked at the Supreme Court of Canada, has a graduate law degree from Oxford University and has an M.A. from the University of Edinburgh.

AGM Schedule:
During Lunch prior to Education Session:
Opening address by 2008/2009 outgoing President
2008/2009 Board election proceedings
Membership address from the 2008/2009 incoming President

---------------------------------------------------------------------------------------------------------------

Tuesday April 21, 2009 12pm - 2pm

Surviving the PCI Audit – A Level 1 Merchant Perspective

-By Shawn R. Chaput, Chief Architect & Executive Consultant, Privity Systems Inc.
--------------------------------------------------------------------------------

Time & Location
Tuesday, April 21st, 2009, 12pm-2pm (2 CPE hours)
The Sutton Place Hotel, 845 Burrard St., Vancouver. The lunch session includes a 3 course lunch. Cost: Member $40, non-Member $50. Seating is limited.

Registration: To register for this event, please call the ICABC Professional Development Department at 604-681-3264 or email pdreg@ica.bc.ca

When registering, please include all pertinent information, including the session you wish to register for, your name, mailing address, telephone number, and which association you are a member of, including membership number. Please note that your registration must be paid for at the time of registration - we cannot invoice for these sessions. Please contact the ICABC Professional Development Department by phone at 604-681-3264 to provide a VISA, MC, or AMEX number if you do not wish to provide this information by email.
________________________________________________________________________

Overview:
The dreaded IT audit; at one point nearly every company is forced to deal with it. PCI has made that fear a reality for a large number of companies. Of course, many of these companies are ill equipped to deal with this requirement and have, as a result, become victims of their audit, fearing the annual process.

But all is not lost. During the process of managing two independent Level One PCI audits from the customer side, an optimal approach to ensuring PCI success has been developed. By taking control of the audit process you can ensure PCI audit success and no longer fear your annual obligations. These principles are easily extended to Level 2, 3 and 4 merchants as well. During this presentation, you will learn how to handle these audits in order to demonstrate your organization security program’s maturity and become an audit victor.
________________________________________________________________________

Bio:
Shawn R. Chaput, CISA, CISM, CGEIT, CISSP, ISSAP, ISSMP, CIPP/C, CFE, CIA, PMP, ABCP. Chief Architect & Executive Consultant, Privity Systems Inc.

Shawn R. Chaput is an Executive Security Consultant and Chief Architect for Privity Systems Inc. in Vancouver, Canada. With a past of working for large consulting firms like IBM and EDS, he has over 14 years tenure in IT and more specifically within the Security, Privacy, Audit and Compliance professions. As a trusted business advisor to many large and well known organizations, Mr. Chaput tends to fill the role of Chief Information Security Officer, either in an interim facility or more “on demand” as the skills are required. His role has lead him to advise executive management how to effectively govern and manage IT risk; design enterprise security architectures, strategies & plans; develop cost-effective and sustainable security management policies and practices for governance frameworks. Shawn has also led a number of significant cost projects to implement and deploy a variety of security solutions or security aspects of engineering projects. His experiences in the Information Security arena have extended from the transportation industry, telecommunications, oil and gas, natural resources, higher education, retail, financial, health care and public sector. He actively participates in the Canadian Advisory Committee for the ISO Joint Technical Committee 1, which develops the ISO/IEC 27000 series Security Standards and has also contributed to several articles and books for ISACA, ITGI and ISC2. He is also a contributing member of the ISACA Standards Board.

Presentation PDF