GAYLORD CONVENTION CENTER
AT NATIONAL HARBOR, MD
TUESDAY & WEDNESDAY, SEPTEMBER 24 & 25

FAIR
CONFERENCE2019

HOW TO BUILD A
QUANTITATIVE RISK MANAGEMENTPROGRAM WITH FAIRCHAIRMAN’SWELCOMEThe evidence is clear. Cyber andtechnology risk management expectations
and practices continue to advance toward
quantitative methods, and FAIR is theindustry standard that enables that
advancement. So the question is nolonger “can it be done” or even “should it
be done”, but rather “how to accomplish
the transition.”
Consequently, the 2019 FAIR Conference isfocused on helping organizations identify
a path towards building quantitative risk
management programs that are most
likely to be successful given theirobjectives, resources, and constraints.
Leaders in the industry who have begun
the journey will share their successes andchallenges, as well as the strategies thathave allowed them to make progress.
With FAIRCON19, members of the FAIR
community will have an opportunity tomeet in person, establish trusted
conversations, and aid one another inelevating our profession to a higher level.

JACK JONESCHAIRMANFAIR INSTITUTE

1

Bringing leaders in information and operational risk
management together to explore FAIR best practices that
produce greater value, align with business goals, andprepare for digital transformation.

The only enterprise grade cyber risk
management solution based on FAIR.
You Don’t Have To Be
A Super Hero To Build
A FAIR Program

Risklens Can Help
TRUSTED BYFORTUNE 1000 CISOs

THE AGENDA

3

DAYONE

TUESDAY,SEPTEMBER 24

7:30 - 9:00 AM

Registration and Breakfast

9:00 - 9:15 AM

Welcome Remarks
Nick Sanna, President, FAIR Institute9:15 - 10:00 AM

Conference Keynote: Enabling Risk Management
Programs That Actually WorkJack Jones, Chairman, FAIR Institute, EVP R&D, RiskLens

10:00 - 10:45 AM

Presentation: Defining the Goals of an Effective
Risk Management Program
Moderator: Jack Jones, Chairman, FAIR Institute
Christopher Porter, CISO, FannieMae
Omar Khawaja, CISO, Highmark Health
Emery Csulak, Deputy CIO for Cybersecurity/CISO,
U.S. Department of Energy
Joey Johnson, CISO, Premise Health

10:45 - 11:15 AM

Networking Break

11:15 AM - 12:00 PM Panel: Building a Cybersecurity Program with a
Risk Management Framework & FAIR
Moderator: Jack Freund, Director Risk Science, RiskLens
Kevin Stine, Chief of the Applied Cybersecurity Division, NIST
Ian Amit, CSO, Cimpress
Jason Martin, GRC Team Manager, Highmark HealthMichael Parisi, Vice President Assurance Strategy, HITRUST
12:00 - 1:00 PM

Networking Lunch & Guest Presentation:
The View from U.S. Congress
Rep. Jim Langevin, Co-Chair Congressional
Cybersecurity Caucus

4DAYONE
1:00 - 2:00 PM

TUESDAY,SEPTEMBER 24"Starting with FAIR" (Beginner Track)
Presentation: A Crash Course on Quantitative vs.
Qualitative
Evan Wheeler, CISO, Financial Engines"Advanced Users" Track
Presentation: Closing the Risk Management Loopwith Cyber Risk Quantification
Greg Rothauser, Enterprise Business Information
Security Officer (BISO), MassMutual

2:00 - 2:30 PM

Networking Break

2:30 - 3:30 PM

Presentation: Am I Mature Enough to Adopt FAIR?
Uncovering the True Success Factors
Mary Faulkner, Dir. of Information Security,
Thrivent Financial
Ben Storm, Info Sec Risk Analyst, Thrivent Financial
Presentation: Operationalizing Risk Quantificationin Business Processes
Jack Whitsitt, SVP and FAIR Team Lead, Bank of America

3:30 - 4:00 PM

Networking Break

4:00 - 5:00 PM

Presentation: Various Stages of FAIR Adoption
Geoji Paul, Director, Information Security Risk,
Centene Corporation
Nathan Thomack, Cyber Security Risk Manager, Emerson
Case Study: Scoping Enterprise Risk Assessments
Keith Weinbaum, Enterprise Risk Management Architect,
Quicken Loans

6:00 - 10:00 PM

5Social Event at Cadillac Ranch
186 Fleet St, Oxon Hill, MD 20745

DAYTWO WEDNESDAY,SEPTEMBER 25
7:30 - 9:00 AM

Breakfast & Networking

9:00 - 9:05 AM

Opening Remarks

9:05 - 09:45 AM

Keynote Address: Why Digital Business Needs IRM& Risk Quantification
John Wheeler, Global Research Leader Risk Management Technology, Gartner

09:45 - 10:45 AM

Presentation: Use Case Panorama How Quantification Enables Risk-Aligned Decision Making
Moderator: Chris Patteson, Executive Director
Risk Transformation Office, RSA
Alex Rogozhin, VP, Info Sec Data Intelligence, BB&T
Laura Voicu, Senior Security Architect, Swisscom
Luke Domet, Technology Risk and Information
Security Professional, Fidelity Investments
India Sutton, Global Cyber Risk Management Specialist,
Daimler Mobility AG

10:45 - 11:15 AM

Networking Break

11:15 AM - 12:00 PM Presentation: How to Measure Risk with Limited andMessy Data: Overcoming the Myths
Doug Hubbard, President, Hubbard Decision Research
12:00 - 1:30 PM

Awards Luncheon
FAIR Business Innovator
FAIR Champion
FAIR Ambassador

6

DAYTWOWEDNESDAY,SEPTEMBER 25

1:30 - 2:15 PM

Pen Testing Your Board Pitch: An Interactive Exercise
Moderator: Kim Jones, FAIR Institute Advisory Board Member
James Lam, Head of Risk Committee, Director, E*TRADE,
NACD 100 Fellow
Chris Inglis. Board of Directors Member, FedEx, KeyW,
Huntington BankFAIR Institute Cyber Risk Management Workgroup

2:15 - 2:45 PM

Networking Break

2:45 - 3:30 PM

Case Study: Integrating Strategic Intelligence and FAIR
Musso Shaikh, Program Manager, Cyber Threat Intelligence,
Fannie Mae
Panel: Integrating Cyber Into ERM
Moderator: Evan Wheeler, CISO, Financial Engines
Greg Barna, Executive Director of Operational Risk
Management, DTCC
Yael Nagler Fmr. Global Enterprise Information & Technology
Risk, BlackRockMichael Kenney, VP of Operational Risk, Freddie Mac

3:30 - 3:45 PM

Networking Break

3:45 - 4:45 PM

Case Study: Using FAIR to Take the Headache out ofConsidering Cyber Insurance for Your Business
Jeremy Alexander, Sr. Risk Expert, Walmart
Managing Organizational and Third-party Risk in the Age of
Digital Transformation: Practical Lessons andData-influenced Considerations
Tom Baine, VP, RiskRecon
Wade Baker, Co-Founder, Cyentia Institute
Chris Golden, Director of Information Security, Horizon Blue
Cross Blue Shield of New Jersey

4:45 - 5:00 PM

7

Closing Remarks

THE EMCEESDONNA GALLAHERPRESIDENT AND CEO, NEW OCEANS ENTERPRISES,FAIR INSTITUTE ADVISORY BOARD MEMBER
Ms. Gallaher is the
President & CEO of New
Oceans Enterprises, LLC
providing Cybersecurity and Data Privacy Risk
Advisory and Program Management Services as a
virtual CISO and risk officer. She has served as a
C-Level Strategic Advisor in IT and Cyber Strategy
for multiple global companies including Wipro,
SunGard, ABB Software, First Advantage and
InComm Financial Services. Ms. Gallaher serves on
the Board of Advisors for the FAIR Institute and as
the Founder and Chapter President of the Atlanta
FAIR chapter.

9:00 - 9:15 AM
Welcome Remarks

KIM JONESDIRECTOR, SECURITY OPERATIONS, INTUIT,
FAIR INSTITUTE ADVISORY BOARD MEMBER
Kim L. Jones is a 32-year
intelligence, security, andrisk
management
professional with expertise in information security
strategy; governance & compliance; security
operations; and risk management. Professor
Jones is a former Chief Security Officer who has
built, operated, and/or managed information
security programs within the financial services,
defense, healthcare, manufacturing, and businessoutsourcing industries.

9

Wednesday
1:30 - 2:15 PM - Moderator
Pen Testing Your Board Pitch: An
Interactive Exercise

THE SPEAKERS

SPEAKERSNICK SANNAPRESIDENT, FAIR INSTITUTE
Nick is President andFounder of the FAIR
Institute and the CEO of
RiskLens who is responsible for the definition andthe execution of the company strategy. In 2015,
Nick championed the creation of the Institute, anexpert organization, focused on helping
organizations
manageinformation
andoperational risk from the business perspective. As
such, Nick serves as the President of the FAIR
Institute to help Risk Officers and CISOs get a seatat the business table by leveraging the FAIR
standard.

9:00 - 9:15 AM
Welcome Remarks

JACK JONESCHAIRMAN, FAIR INSTITUTEJack is one of theforemost authorities in
the field of information risk management. He has
worked in technology for over 30 years, the past 28
years in information security and risk
management. He has a decade of experience as a
Chief Information Security Officer (CISO) with threedifferent companies, including a Fortune 100
financial services company. He is the author andcreator of the Factor Analysis of Information Risk
(FAIR) framework. He writes about that system inhis book Measuring and Managing Information
Risk: A FAIR Approach, which was inducted into
the Cyber Security Canon in 2016.

9:15 - 10:00 AM
Conference Keynote: Enabling Risk
Management Programs That
Actually Work
10:00 - 10:45 AM - Moderator
Presentation: Defining the Goals ofan Effective Risk Management
Program

10

SPEAKERSCHRISTOPHER PORTER

CISO, FANNIE MAE
FAIR INSTITUTE ADVISORY BOARD MEMBER
Christopher Porter is the
CISO for Fannie Mae andhelps to communicate
the importance of information security across theenterprise and to mature and innovate Fannie
Mae's defense and response capabilities. Porter has
over 15 years of experience in IT and security
industries. In his previous role at Verizon, Porter wasa lead analyst and author of Verizon's Data Breach
Investigations Report series. Porter is a member ofthe Advisory Board for the McIntire School ofCommerce M.S. in MIT at the University of Virginia
as well as the Board of Directors at the FAIR
Institute.

10:00 - 10:45 AM
Presentation: Defining the Goals ofan Effective Risk Management
ProgramOMAR KHAWAJA

CISO, HIGHMARK HEALTH
Omar Khawaja is vicepresident
andchief
information security officer (CISO) for Highmark
Health, a national health and wellness organizationand the second largest integrated financing anddelivery network by revenue in the United States. In
his current role, Mr. Khawaja oversees information
security and risk management for the Highmark
Health portfolio of leading health care businesses
that employ more than 40,000 people and serve
millions of Americans in 50 states. Mr. Khawaja was
the 2018 Business Innovator award winner.

11

10:00 - 10:45 AM
Presentation: Defining the Goals ofan Effective Risk Management
ProgramSPEAKERS

EMERY CSULAK

DEPUTY CIO FOR CYBERSECURITY/CISO,
U.S. DEPARTMENT OF ENERGYPRESIDENT,
FAIR INSTITUTE
Emery Csulak is the Chief
Information
Security
Officer (CISO) and Deputy
Chief Information Officer for Cybersecurity at the
Department of Energy (DOE). He leads theintegrated Joint Cybersecurity Coordination Center(iJC3) and the DOE Big Data Platform (BDP) for
ensuring enterprise operational visibility, analytics,
and threat hunting. He manages the cybersecurity
strategy, policy, and oversight of $1.5B annual IT
investment. Previously, Mr. Csulak served as the CISO
and Senior Official for Privacy for the Centers for
Medicare and Medicaid Services (CMS). In thisposition, he established and led the CMS
Cybersecurity Integration Center for a $2.6B IT
program.

10:00 - 10:45 AM
Presentation: Defining the Goals ofan Effective Risk Management
ProgramYour workforce
needs work.
Identify cybersecurity skills gaps
putting your organization at risk.
And then fill them.
cybervista.net

12

SPEAKERSJOEY JOHNSONCISO, PREMISE HEALTH
Since 2009 Joey Johnson
has served as the Chief
Information
Security
Officer at Premise Health, the nation’s leading
provider of direct access employer sponsoredhealth and wellness centers for employees withnearly 650 facilities across America. Prior to joining
Premise Health, Joey was the Chief Security Officer
for the United States Department of Commerce,
Office of Computer Services. He has over 20 years ofexperience in the cyber-security industry including
leadership roles in both the public and private
sectors, with a focus on organizations in the federal
government, defense, information technology,
healthcare, and transportation industries.

10:00 - 10:45 AM
Presentation: Defining the Goals ofan Effective Risk Management
Program

KEVIN STINECHIEF OF THE APPLIED CYBERSECURITY
DIVISION, NIST
Mr. Kevin Stine is theChief of the Applied
Cybersecurity Division in the National Institute ofStandards
andTechnology’s
Information
Technology Laboratory. In this capacity, he leads
NIST collaborations to improve cybersecurity andprivacy risk management through the effective
application of standards, best practices, andtechnologies. The Applied Cybersecurity Divisiondevelops cybersecurity and privacy guidelines,
tools, and reference architectures in diverse areasand is home to several priority programs including
the Cybersecurity Framework.

13

11:15 AM - 12:00 PM
Panel: Building a Cybersecurity
Program with a Risk Management
Framework & FAIRSPEAKERS

IAN AMIT

CSO, CIMPRESS
Ian Amit is the Chief
Security
Officerat
Cimpress, a publicly traded global technology
company with presence in over 45 countries. He
has been a security practitioner and a hacker forover 20 years, with his career spanning executive
leadership positions with companies such as
Amazon, ZeroFox, IOActive, Aladdin, and more. He
is one of the founders of the Penetration Testing
Execution Standard, a co-founder of the Tel Aviv
DEFCON group, serves on the board of directors of
BSides Las Vegas, and serves on several advisoryboards of security companies.

11:15 AM - 12:00 PM
Panel: Building a Cybersecurity
Program with a Risk Management
Framework & FAIRJACK FREUND, PhD

DIRECTOR OF RISK SCIENCE, RISKLENS
Dr. Jack Freund is aleading voice in cyber risk
measurement and management. He is an expert
at using risk quantification to implement, mature,and sell information risk and security programs.
Jack is currently serving as Director, Risk Science at
RiskLens and previously worked for TIAA as
Director, Cyber Risk. The book Jack co-authored on
quantifying risk (Measuring and Managing
Information Risk: A FAIR Approach) was inducted
into the Cybersecurity Canon in 2016. Jack’s
writings have appeared in the ISSA Journal,
Homeland Security Today, and the @ISACA
newsletter.

11:15 AM - 12:00 PM - Moderator
Panel: Building a Cybersecurity
Program with a Risk
Management Framework & FAIR

14

SPEAKERSJASON MARTINGRC TEAM MANAGER,HIGHMARK HEALTHCISO, PREMISE HEALTH
As part of the Cyber Risk
Management
team,
Jason Martin is responsible for coordinating andproducing FAIR-based risk assessments and has
been a key contributor in shaping the program.
Jason leads a team within the Information Security
and Risk Management department at HM Health
Solutions, a subsidiary of Highmark Health, one of
the largest integrated financing and healthcaredelivery systems in the United States.

11:15 AM - 12:00 PM
Panel: Building a Cybersecurity
Program with a Risk Management
Framework & FAIRMICHAEL PARISIVICE PRESIDENT ASSURANCESTRATEGY, HITRUSTMichael Parisi has led
over 500 controls-related
engagements primarily in the healthcare andfinancial services industries. He has extensive
experience with third-party assurance reporting
including
HITRUST
readiness,
HITRUSTcertification, SOC 1, SOC 2, SOC 3, Agreed Upon
Procedure and customized AT-101 engagements.
He has extensive knowledge of financial reporting
and regulatory standards through his external
audit and consulting experience, including
Sarbanes Oxley, HIPAA, NIST, CMS and state
specific standards.

15

11:15 AM - 12:00 PM
Panel: Building a Cybersecurity
Program with a Risk Management
Framework & FAIRSPEAKERS

EVAN WHEELER

CISO, FINANCIAL ENGINESFAIR INSTITUTE ADVISORY BOARD MEMBER
Evan Wheeler is an expert
in information security
andoperationalriskmanagementfororganizations in many critical infrastructure
sectors. Wheeler has extensive experience
presenting business resilience and cyber threat
profiles to board committees, managing
international teams, working directly withregulators and overseeing security operations. He isa specialist in building and running risk programsfor organizations in highly regulated environments.

Tuesday
1:00 - 2:00 PM
Presentation: A Crash Course on
Quantitative vs. Qualitative
Wednesday - Moderator
2:45 - 3:30 PM
Panel: Integrating Cyber Into ERM

Security Platform
Across Your Extended Enterprise
CampusIoT

Data Center

Cloud

OT

www.Forescout.com

The Leader in Device Visibility and Control

SPEAKERS

GREG ROTHAUSERENTERPRISE BUSINESS INFORMATIONSECURITY OFFICER (BISO), MASSMUTUAL
Greg Rothauser has beenworking in Information
Technology for over 15 years, with the last 10 in
information security and risk. Currently, he is acting
as Enterprise Business Information Security Officer(BISO) for MassMutual, a Fortune 100 mutual
insurance and financial services company andspearheading a project to transform and mature
their risk assessment and management service.

1:00 - 2:00 PM
Presentation: Closing the Risk
Management Loop with Cyber Risk
Quantification

MARY FAULKNER

DIR. OF INFORMATION SECURITY,THRIVENT FINANCIAL
Mary Faulkner is Directorof Information Security at
Thrivent Financial in Appleton, Wisconsin. Mary has
led Global IT organizations driving maturity inInformation Security and Network and Security
Operations. She has over 20 years of experience inInformation Security, Litigation Advisory Services
and IT Audit. Mary has served a number ofindustries in security advisory roles to include
technology, insurance, retail, gaming, government,
automotive, and manufacturing.

17

2:30 - 3:30 PM
Presentation: Am I Mature Enoughto Adopt FAIR? - Uncovering theTrue Success Factors

SPEAKERSBEN STORMINFO SEC RISK ANALYST,THRIVENT FINANCIAL
Ben
Storm
is
an
Information Security Risk
Analyst at Thrivent Financial in Appleton,
Wisconsin with over five years of experience. Ben’s
primary focus is building and operationalizing
Thrivent Financial’s information security risk
management methodology. Ben’s experiencespans policy, standards, security technologies,
project management and analytics. Prior to joining
Thrivent, Ben spent five years in Information
Technology working within the healthcare
industry.

2:30 - 3:30 PM
Presentation: Am I Mature Enoughto Adopt FAIR? - Uncovering theTrue Success Factors

JACK WHITSITTSVP & FAIR TEAM LEAD, BANK OF AMERICAJack Whitsitt is a SeniorVice President at Bank ofAmerica leading a team building a FAIR-based
Information Security Risk Quantification and
Forecasting program. Prior to working at the bank,he spent 15 years working his way up and throughmultiple information security roles and has hadnational and internationally scoped information
security and risk responsibilities, including: building
an MSSP SOC capability, pipeline sector-wide risk
analysis, and critical infrastructure incident
response.

2:30 - 3:30 PM
Presentation: Operationalizing
Risk Quantification in Business
Processes

18

SPEAKERSGEOJI PAULDIRECTOR, INFORMATION SECURITY,CENTENE CORPORATION
Geoji Paul is a Director of
Security
Risk
Management at Centene where he leads a team of
information risk analysts who conduct qualitativeand quantitative risk analysis. Prior to Centene,
Geoji was a Director of Information Security at
Express Scripts. His responsibilities at Express
Scripts includes setting of the Information Security
strategy through policies and standards, creating
security awareness among the 25,000+ employeesof the company, heading the metrics & analytics
division of Information Security and leading the risk
quantification program.

4:00 - 5:00 PM
Presentation: Various Stages of
FAIR Adoption

NATHAN THOMACKCYBER SECURITY RISK MANAGER, EMERSONNathan has over 10 years
experienceofITarchitecture, design, and operational information
security. This comprehensive background enables
the design of tailored solutions to unique business
requirements while still meeting compliance anddata protection standards. Nathan is experienced
with multiple mergers and acquisitions and thedesign of new IT project architecture and has
expertknowledge
infirewalldesign,implementation, and support.

19

4:00 - 5:00 PM
Presentation: Various Stages of
FAIR Adoption

SPEAKERS

KEITH WEINBAUM

ENTERPRISE RISK MANAGEMENT ARCHITECT,QUICKEN LOANS
Keith has worked at
Quicken Loans for 21
years and is currently an Enterprise Risk Architectwith the Enterprise Risk Management groupwhich covers ERM for Quicken Loans and 10 othersister companies. He built the Information Security
function and led it for 10 years. From there he built
the Enterprise Risk Management function which
he led for 6 years. He oversaw the implementationof FAIR which has been a centerpiece in how mostrisk is measured enterprise-wide. As an Architect
he now exclusively focuses on improving risk
management-related processes.

4:00 - 5:00 PM
Case Study: Scoping Enterprise
Risk Assessments

JOHN WHEELERGLOBAL RESEARCH LEADERRISK MANAGEMENT TECHNOLOGY, GARTNER
Mr.
Wheelerisarecognized expert and afrequent speaker/author on the effective use of risk
management practices in large, complex
organizations, as well as midsize businesses. His
major
areas
of
specialty
includeenterprise/operationalriskmanagement,
executive leadership and corporate governance.
He has 30+ years of professional experience in avariety of executive management, financial
operations, risk management and IT-related roles.
Prior to joining Gartner, has served as a Senior Vice
President and Senior Risk Officer within the
Corporate Risk Management division at a major
U.S. financial services company.

Wednesday
9:05 - 09:45 AM
Keynote Address: Why Digital
Business Needs IRM & Risk
Quantification

20

SPEAKERSCHRIS PATTESONEXECUTIVE DIRECTORRISK TRANSFORMATION OFFICE, RSA
Chris Patteson has morethan
two
decadesexperience as a practitioner, leader, and innovator
within Governance Risk and Compliance andIntegrated
RiskManagementinthemanufacturing, technology, and logistics sectors.
Prior to joining RSA, he managed a team of data
scientists and application developers to build new
methods, models, and architectures for managing
fraud and cargo security for a global logistics
organization. Chris continues to drive innovation inadvanced data modeling techniques and creating
actionable intelligence for managing risk.

Wednesday
09:45 - 10:45 AM - Moderator
Presentation: Use Case Panorama How Quantification Enables
Risk-Aligned Decision Making

LUKE DOMETCENTER OF EXCELLENCE LEADTECHNOLOGY RISK ASSESSMENTS
FIDELITY INVESTMENTS
Luke Domet is a Principal
Technology Risk Analyst
within the Enterprise Technology Risk & Analytics
business unit at Fidelity Investments. Luke Domet
leads the Risk Assessment Center of Excellence
within the Enterprise Technology Risk & Analytics
business unit at Fidelity. His team is responsible for
executing quantitative risk assessments across all
operations technology platforms. Prior to joining
Fidelity, Luke was a technology and management
consultant in the public services sector leading
process modernization engagements for federal
and state government clients.

21

Wednesday
09:45 - 10:45 AM
Presentation: Use Case Panorama How Quantification Enables
Risk-Aligned Decision Making

3D Vendor Risk @ Scale(SM)Using the Power of FAIR

ALEX ROGOZHIN

VP, INFO SEC DATA INTELLIGENCE, BB&T
Alex Rogozhin is avisionary
information
security data science and engineering leader for
BB&T bank. Alex enables business stakeholders toachieve optimal balance between operational
efficiency and cybersecurity posture by providing
end-to-end visibility of cybersecurity program
through the use of data and analytics. In his current
role, Alex built the information security analytics
program from the ground-up, he has recruited andcurrently leading a high-performing data science /engineering team.

Wednesday
09:45 - 10:45 AM
Presentation: Use Case Panorama How Quantification Enables
Risk-Aligned Decision Making

22

SPEAKERSLAURA VOICUSENIOR SECURITY ARCHITECT, SWISSCOM
Laura is an experienced
andhighlyskilledenterprise architect, who has received her MSc in
Physics and PhD in Computer Science. She is aleader in enterprise and data architecture,quantitative risk analysis, and cloud computing.

Wednesday
09:45 - 10:45 AM
Presentation: Use Case Panorama How Quantification Enables
Risk-Aligned Decision Making

INDIA SUTTONGLOBAL CYBER RISK MANAGEMENTSPECIALIST, DAIMLER MOBILITY AG
India Sutton brings over
10 years of experience
providing risk management direction to financial
service organizations. As a Global Cyber-Risk
Management Specialist at Daimler Mobility AG,
India supports initiatives to manage cyber risk
within company tolerance across 43+ countries.
India began her career with the Federal Deposit
Insurance Corporation, focused on overseeing
cybersecurity risk at large, complex banks.

23

Wednesday
09:45 - 10:45 AM
Presentation: Use Case Panorama How Quantification Enables
Risk-Aligned Decision Making

SPEAKERSDOUG HUBBARD

FOUNDER, HUBBARD DECISION RESEARCH
Mr. Hubbard is theinventor of the powerful
Applied Information Economics (AIE) method,which has helped solve a variety of business issues,
including IT and cybersecurity benefits and risks,and has received critical praise from Gartner andForrester Research. His books – including How to
Measure Anything in Cybersecurity Risk
(co-authored with Richard Seiersen) - have soldover 140,000 copies in eight languages; three are
required reading for the Society of Actuaries exam
prep. Mr. Hubbard is also published in theprestigious journal Nature as well as The American
Statistician, CIO Magazine, and others.

Wednesday
11:15 AM - 12:00 PM
Presentation: How to Measure
Anything in Cybersecurity Risk: An
Executive Overview

JAMES LAM

HEAD OF RISK COMMITTEE, DIRECTORE*TRADE, NACD 100 FELLOW
James
Lam
was
recognized in the 2017
NACD Directorship 100 as one of “the mostinfluential directors in the boardroom community.”
He sits on the Board of Directors at E*TRADE
Financial Corporation where he serves as the
Chairman of the Risk Oversight Committee and asa member of the Audit Committee. In nearly 35
years in the risk management field, Lam has held
the Chief Risk Officer job at both Fidelity
Investments and GE Capital Markets Services.

Wednesday
1:30 - 2:15 PM
Pen Testing Your Board Pitch: An
Interactive Exercise

24

SPEAKERSCHRIS INGLISBOARDS OF DIRECTORS, FEDEX, KEYW,
AND HUNTINGTON BANKJohn C. (Chris) Inglis is aformer Deputy Director of
the National Security Agency (2006-2014), currently
serving as the Looker Distinguished Visiting
Professor of Cyber Studies at the United States
Naval Academy and on the Boards of Directors for
FedEx, KeyW, and Huntington Bank. He is a
Managing Director at Paladin Capital Group, is amember of the US Defense Science Board, leads
the intelligence panel for US Strategic Command’s
Strategic Advisory Group, and is a commissioner on
the Congressionally mandated U.S. Cyberspace
Solarium Commission.

Wednesday
1:30 - 2:15 PM
Pen Testing Your Board Pitch: An
Interactive Exercise

MUSSO SHAIKHPROGRAM MANAGER, CYBER THREATINTELLIGENCE, FANNIE MAE
Musso Shaikh is theProgram Manager in
Cyber Threat Intelligence at Fannie Mae where she
is charged with implementing a cyber risk
quantification program based on FAIR (Factor
Analysis of Information Risk). She brings aseasoned perspective to her work that is groundedin extensive experience of translating risk scenarios
into both qualitative and quantitative impact
statements to support key business decision
making. Prior to coming to Fannie Mae, Musso
contracted at WorldCom, Ford Motor Company
and Boeing in process improvement andtechnology audit initiatives.

25

Wednesday
2:45 - 3:30 PM
Case Study: Integrating StrategicIntelligence and FAIRSPEAKERS

GREG BARNAEXECUTIVE DIRECTOR, OPERATIONAL RISKMANAGEMENT, DTCC
Greg
Barna
heads
Operational
Risk
Management for the Systemically ImportantFinancial Market Utilities (SIFMUS) at DTCC. He
oversees a team that partners with DTCC’s
businesses and support functions to manage
operational risk exposure, establishing protocols for
identifying, reporting, escalating, and remediating
operational risks. Prior to joining DTCC, Greg
managed the Commodities Valuation and Risk
Control team overseeing North Americancommodities trading businesses at Credit Suisse
and was also an Energy Trader at Bank of America.

27

Wednesday
2:45 - 3:30 PM
Panel: Integrating Cyber Into ERMSPEAKERSYAEL NAGLER

FMR. GLOBAL ENTERPRISE INFORMATION &TECHNOLOGY RISK, BLACKROCK
Yael is passionate about
helpingcompanies
establish a security culture and manage risks to
improve their overall cyber risk posture. Having
spent 20 years working in Fortune 10 Financial
Services and Technology companies, sheapproaches security and information risk withbusiness context and an awareness of the evolving
landscape. She is trusted by C-Level executives toquickly understand the business drivers and deliver
strategic and measurable outcomes based on
current operational risks and aligned to company
objectives.

Wednesday
2:45 - 3:30 PM
Panel: Integrating Cyber Into ERMMICHAEL KENNEY

VP OF OPERATIONAL RISK, FREDDIE MAC
As Vice President of
Operational Risk, Michaelleads the first line of defense risk management for
financial crimes, privacy and information security,business resiliency, vendor management andcompliance with regulatory requirements. Mikeand his team establishes the risk direction byaligning the Multifamily Governance Frameworkwith the business operating model. He continually
improves governance by understanding themultifaceted drivers that effect risk environment.

27

Wednesday
2:45 - 3:30 PM
Panel: Integrating Cyber Into ERM

JEREMY ALEXANDER
SR. RISK EXPERT, WALMART
Jeremy is a seasoned
professional with a broad
range of experience in the technology, retail, andtransportation sectors spanning information
security, strategy, change management, executive
customer finance support, financial planning andanalysis, process improvement, actuarial analysis,risk management, merchandising, and pricing. He
is Open FAIR certified and holds his B.S. and M.S. inmathematics from Henderson State University
and the University of Arkansas, respectively.

Wednesday
3:45 - 4:45 PM
Case Study: Using FAIR to Take the
Headache out of Considering
Cyber Insurance for Your Business

28

SPEAKERS

TOM BAINESVP OF MARKETING, RISKRECON
Thomas Bain is Senior Vice
President of Marketing for
RiskRecon. He leads all Global Marketing initiatives forthe company, including strategic go-to-market,
analyst, market research, communications, digitalmarketing, demand generation, and partner
marketing. Previous to RiskRecon, Bain was Vice
President, Marketing with Morphisec, an Israel-based
endpoint security company. He has held leading roles
including Chief Marketing Officer with Centripetal
Networks, and Vice President, Global Marketing
CounterTack (now GoSecure). He's held Marketing
positions withSecurity Innovation, Q1 Labs (an IBM
company) and Application Security, Inc. (a Trustwave
company).

Wednesday
3:45 - 4:45 PM
Managing Organizational and
Third-party Risk in the Age of
Digital Transformation:
Practical Lessons andData-influenced Considerations

WADE BAKER

CO-FOUNDER, CYENTIA INSTITUTE
Dr. Wade Baker is a
Co-Founderofthe
Cyentia Institute, which focuses on improving
cybersecurity knowledge and practice throughdata-driven research. He’s also a professor in
Virginia Tech’s College of Business, teachingcourses for the MBA and MS of IT programs. Prior tothis, Wade held positions as the VP of Strategy at
ThreatConnect and was the CTO of Security
Solutions at Verizon, where he had the great
privilege of leading Verizon’s annual Data Breach
Investigations Report (DBIR) for 8 years.

29

Wednesday

3:45 - 4:45 PM
Managing Organizational and
Third-party Risk in the Age of
Digital Transformation:
Practical Lessons andData-influenced Considerations

SPEAKERSCHRIS GOLDENDIRECTOR OF INFORMATION SECURITY, HORIZONBLUE CROSS BLUE SHIELD OF NEW JERSEY
Chris Golden is currently
theDirectorofInformation Security for Horizon Blue Cross Blue
Shield of New Jersey. He is responsible for bothtactical and strategic decision making related tosecurity policy, governance risk and complianceand third-party risk management. Prior to Horizon,
he was the Director of Cybersecurity Strategic
Planning for DTCC, the IT backbone to Wall Street.
Chris retired from the United States Air Force as aColonel after more than two decades of service tothe country.

31

Wednesday

3:45 - 4:45 PM
Managing Organizational and
Third-party Risk in the Age of
Digital Transformation:
Practical Lessons andData-influenced Considerations

SPEAKERSCONGRESSMAN JIM LANGEVIN
CO-CHAIR CONGRESSIONALCYBERSECURITY CAUCUS
Congressman
Jim
Langevin is a senior
member of theHouse Armed Services
Committee, where he is the Chairman of theIntelligenceandEmerging
ThreatsandCapabilities Subcommittee, and of the House
Committee on Homeland Security. A national
leader on securing our nation’s technology
infrastructure against cyber threats, Langevinco-founded the Congressional Cybersecurity
Caucus to increase awareness around the issue
and co-chaired the Center for Strategic andInternational Studies (CSIS) Commission on Cyber
Security for the 44th Presidency, which madepolicy recommendations to President Obama.

12:00 - 1:00 PM
The View from U.S. Congress

As co-chair of the bipartisan Congressional Career and Technical Education Caucus, Langevinadvocates to improve and increase access to training that gives students and workers the skills thatbest fit the needs of expanding industries. He has successfully fought for strong CTE funding under
the Carl D. Perkins Vocational and Technical Education Act and, in Rhode Island, has worked to foster
employer-educator partnerships and career training programs across a variety of career fields.
A voice for those facing serious challenges, Langevin championed passage of a bipartisan bill to
expand services for families caring for their elderly and disabled loved ones and authored abreakthrough law to protect foster youth. He is a strong advocate for inclusion and independence forpeople with disabilities, and helped pass the ADA Amendments Act that strengthened theprotections of the Americans with Disabilities Act.
Langevin was inspired to enter public service by the tremendous outpouring of support he received
during the most challenging time of his life, after a gun accident paralyzed him at age 16 and left him
a quadriplegic. He is driven by a belief that everyone deserves a fair opportunity to make the most of
their talents.
After serving as secretary for the state’s Constitutional Convention in 1986, Langevin won election to
the Rhode Island House of Representatives, and in 1994, became the nation’s youngest Secretary ofState. His leadership resulted in reforms to Rhode Island’s outdated election system and a landmark
report documenting widespread violations of the state’s Open Meetings Law. He served in that role
until winning election to Congress in 2000.

31

THANKYOU
FAIR INSTITUTE SPONSORSFAIRCON 19 SPONSORSNOTES33

NOTES

34

/FAIRInstitute/company/fair-institute/www.fairinstitute.org