Steve Riley on Security : conferences and seminars

Reading list from “How IT will change in the next 10 years”

Steve Riley — Mon, 24 Nov 2008 22:39:10 GMT

At Windows Connections two weeks ago, during my keynote speech “How IT will change in the next 10 years and why you should care,” I mentioned several books worth reading. Many of you have asked for the list; here it is:

The Cathedral and the Bazaar by Eric S. Raymond
The Wisdom of Crowds by James Surowiecki
We Are Smarter Than Me by Barry Libert, Jon Spector, Don Tapscott
The World Is Flat by Thomas L. Friedman
The Innovator's Dilemma by Clayton M. Christensen
The Long Tail by Chris Anderson
The Speed of Trust by Stephen M. R. Covey
What Got You Here Won't Get You There by Marshall Goldsmith
Outsourced (the movie)

Also remember that I mildly panned Digital Economy by Harbhajan Kehal and Varinder P. Singh; my assertion was that the next 10 years will bring about a social economy instead, one that includes the digital natives you’ll all be hiring and selling to now or very soon. They’re the ones who are building it, so you might as well adapt.

TechEd 2009: Never too early to start planning

Steve Riley — Mon, 25 Aug 2008 21:25:45 GMT

What's on your mind? What do you want to learn more about? Tell me, tell me...

Oh, and for 2009 I plan to stay at TechEd US for both weeks. I want to start spending more time with developers -- they need some security love too :)

Videos of some of my presentations

Steve Riley — Tue, 05 Feb 2008 21:14:38 GMT

TechNet Spotlight features videos of many presentations from our TechEd conferences. Here are some of mine.

It's 11:00 PM, do you know where your data is?
IT Forum: TechEd Europe, November 2007
The fortified data center in your future
TechEd US, June 2007
Windows Mobile 6 security in depth
TechEd US, June 2007
Making the tradeoff: be secure or get work done
TechEd US, June 2007
Defending layer 8: how to recognize and combat social engineering
IT Forum: TechEd Europe, November 2006
Windows Vista firewall and IPsec enhancements
IT Forum: TechEd Europe, November 2006

All of my videos on TechNet Spotlight
There are older videos, too, including a four-part security basics series with Jesper Johansson.

My presentations at TechEd 2007

Steve Riley — Fri, 13 Apr 2007 01:47:00 GMT

Hello everyone! Yes, it's been a while since I've written. I've been pretty busy lately with a security roadshow in Southeast Asia. It's become an annual thing, it's a lot of fun, and I get to spend a good amount of time in what's becoming my favorite area of the world.

Anyway, the planning for TechEd 2007 is well underway. This year I have five presentations (SEC 303 is repeated), I've put the abstracts below. I'll sign up for TechEd Connect soon, the hosters are working to fix a problem with my ID. And during the event, as usual, when I'm not speaking I'll hang out in the exhibition or cabana area. My time that week is your time, so don't be afraid to sit down and have a chat. It's one of the highlights of the event for me.

SEC203 Making the Tradeoff: Be Secure or Get Work Done
Are you the kind of security person who enables a setting just because it's there? Do your users constantly seek ways to bypass all your fine-tuned security, just so they can do their jobs? Every security decision your organization makes ought to consider the security-usability (or even the security-usability-cost) tradeoff. While perfect security seems an admirable goal, in reality we must remember that usability often will trump our strongest desires. If people can't get work done, they'll either circumvent the security (without understanding they just created new attack vectors) or your company will simply lose out to your competitors. Steve Riley discusses several examples of real-world tradeoffs and helps you learn how to navigate the tradeoff in your own organization.

SEC301 The fortified data center in your future: Build it now and they will come
Relax for a moment. Let your mind wander to thoughts of your corporate network—with its myriad authentication schemes, its haphazard collection of client computers in various states of (non)conformance, its proliferation of access methods, its data centers with too many ways in and out. Feel like you want to just burn it all down and start over? Well, perhaps you should—and when you do, you can implement something that’s simpler, more secure, well managed, and less expensive. Over the years, Steve Riley has hinted at this idea, advocating the demise of the traditional corporate network, with its no longer useful distinction between “inside” and “outside.” Instead, organizations should move toward using the Internet as their infrastructure, where all clients and a physically and electronically fortified data center live “live on the ‘net.” The question, then, is how to build this data center? Effective security and management are absolutely essential to realize this vision. Steve will show how combining the Microsoft ForeFront family of security products with the System Center family of management solutions provides the necessary foundation for building your data center of the future—today. Don’t delay, because your business competitors are already doing it!

SEC303 It's 11:00 P.M., Do You Know Where Your Data Is?
Long gone are the days when you knew your data was safe because it resided only in your data center. The explosive proliferation of laptops, notebooks, handheld computers, smartphones, removable drives, and Internet file storage demands that we rethink how we protect information. Because it's the information the bad guys are after, and because the information flows so freely from device to device, our obligation is to protect the information. People want to work wherever they can find a computer and an Internet connection. How can you do this safely? Steve Riley considers strategies and explore technologies to help you solve a number of thorny problems: how to classify mobile data, how to keep track of where it is, and how to control its movement. We explore the new Data Encryption Toolkit for Mobile PCs, technical guidance and deployment tools that help you plan and implement EFS and BitLocker throughout your enterprise, with lower cost and extended centralized management and control. One question we will ponder: maybe it's time to do away with the locked-down desktop?

MBL409 Microsoft Windows Mobile 6 Security In-Depth
Seems like Windows Mobile 5 came out just the other day, but yes, version 6 is now ready. We listened to your feedback and incorporated several enhancements and new capabilities to make Windows Mobile 6 truly enterprise ready. We take an in-depth look at how Windows Mobile now supports Rights Management Services (enabling you to work with protected Office documents), a new certificate enrollment process, encryption of storage card contents, and more. We also review existing security features that are important for enterprises to understand and implement. Join Steve Riley as he shows you how Windows Mobile 6 can become your trusted platform for secure mobile access to corporate information.

Speaking at TechMentor and WinConnections again

Steve Riley — Wed, 19 Jul 2006 20:06:00 GMT

Looks like this is becoming a regular thing for me. I like both these events very much. Their smaller size allows me to spend more time with individual folks between sessions.

TechMentor is 9-13 October in Las Vegas. I'm delivering three presentations:

Windows Vista system integrity technologies
Windows Vista firewall and IPsec enhancements
Attacker trends and techniques: an update

Windows Connections is 6-9 November, also on Las Vegas. I'm delivering four presentations:

Keynote: Learn your future in 60 minutes!
Windows Vista system integrity technologies
Windows Vista firewall and IPsec enhancements
How Microsoft deploys Windows Mobile

Hope to see you at one of these events!

Update to my appearances

Steve Riley — Fri, 10 Mar 2006 23:48:00 GMT

Some dates have changed: we had to move the days for the Southeast Asia roadshow in Viet Nam. Also, I'm speaking at MEDC (Mobile and Embedded DevCon) this year -- a presentation on how Microsoft's IT department secures mobile computing. I've updated the calendar here: http://blogs.technet.com/steriley/archive/2006/01/25/418058.aspx.

Security summits and seminars around the world

Steve Riley — Wed, 25 Jan 2006 13:16:00 GMT

Wow! After what seemed like a too-short month off (December), the work has resumed with vigorous intensity. Here are my public appearances in the coming weeks and months:

24 Jan : Beyond the Firewall security seminar in Jakarta
7-8 Feb : I.T. Professional's Conference in Mumbai (Bombay)
27-28 Feb : community gathering and security seminar in Adelaide
1-2 Mar : community gathering and security seminar in Brisbane
6 Mar : community gathering and security seminar in Melbourne
16 Mar : security pre-conference in Taipei
20-24 Mar : TechMentor spring conference in Orlando
28 Mar - 6 Apr : security road show throughout southeast Asia
    28 : Manila
    30 : Bangkok
    4 : Kuala Lumpur
    6 : Jakarta
9-12 Apr : Windows Connections spring conference in Orlando
13 Apr : Security Matters summit in Atlanta
26 Apr : security seminar in Hong Kong
3-5 May : Southeast Asia security roadshow resumes
    3 : Ho Chi Minh City
    5 : Hanoi
8 May : Security Matters summit in New York
10 May : MEDC (Mobile and Embedded DevCon) in Las Vegas
23-24 May : Institute for Applied Network Security forum in Dallas

If you're available when I'm in your city, register and attend the event. It'll be a lot of fun, I promise!

My music

Steve Riley — Tue, 08 Nov 2005 20:37:00 GMT

Those of you who've seen me speak at various events know that I like to play my own music before the presentations begin. In industry parlance, this is called "walk-in music." My experience, though, is that many times the music they provide is better described as "walk-in, lie down, and go night-night music"! Think about it: a romantically darkened room, often with the temperature set a bit too warm, a stomach full of lunch (sure, it's conference food, but it's fuel)...

So I bring my own music. Yeah, it's trance music straight out of some of the biggest clubs in the world. But it works! It keeps people awake, energizes them, and is interesting to listen to. Because many of you seem curious about the music, here's a sampling.

Chicane: Live from Palladium
you can get this and many other wonderful mixes from Trance Addict
Talla 2XLC: Live at Technoclub SSL
also from Trance Addict
Angels of Trance
an album of female vocal trance, wonderful stuff
Epic Trance Ascension
ethereral and melodic trance hits
Hands to Heaven
an album full anthems that always gets the dance floor moving
House Trancemissions vol. 1
my first electronic music purchase; fascinating blend of trance and house with soaring melodies and vocals
Trance 'n' Bass
interesting blend of trance and drum-and-bass; on the heavy side
4 Strings: Believe
good collection of anthems by one of the better trance artists

Some videos of me

Steve Riley — Sat, 24 Sep 2005 06:13:00 GMT

Microsoft UK has posted videos of various European events of the past year. Various speakers are featured, including Andreas Luther, Dennis Karlinsky, Eileen Brown, Graham Calladine, Jesper Johansson, John Craddock, Justin Alderson, Kalpit Jain, Kimberly Tripp, Mark Licata, Mark Cribben, Mat Young, Paul Cullimore, Rafal Lukawiecki, Ryan Burkhardt, Sally Storey, Scott Schnoll, Steve Riley, and Travis Wright.

My solo session is TCP/IP for security administrators

And also the IT Forum 2004 precon with Jesper, Practicing better than best: Getting and staying secure the right way
Part 1
Part 2
Part 3
Part 4
Part 5

Updated TechEd worldwide -- new China dates

Steve Riley — Mon, 25 Jul 2005 07:02:00 GMT

The dates for TechEd China have changed (venue issues), and I've added another city. Here's the updated list:

Europe, in Amsterdam (4-8 July)
Japan, in Yokohama (2-5 August)
Asia, in Singapore (24-26 August)
New Zealand, in Auckland (28-31 August)
Australia, in Gold Coast (31 August - 2 September)
China, in Shanghai (19-20 September)
China, in Beijing (23-25 September)
Taiwan, in Taipei (27-29 September)
Hong Kong (3-6 October)
South Africa, in Sun City (23-26 October)

TechEd 2005 Worldwide

Steve Riley — Fri, 17 Jun 2005 01:25:00 GMT

As usual, I'm speaking at several TechEds around the world. Here's the list:

Europe, in Amsterdam (4-8 July)
Japan, in Yokohama (2-5 August)
Asia, in Singapore (24-26 August)
New Zealand, in Auckland (28-31 August)
Australia, in Gold Coast (31 August - 2 September)
China, in Shanghai (15-17 September)
China, in Beijing (19-21 September)
Taiwan, in Taipei (27-29 September)
Hong Kong (3-6 October)
South Africa, in Sun City (23-26 October)

Plan to come if you can...it'll be fun!

All done for another year: TechEd US 2005

Steve Riley — Fri, 17 Jun 2005 01:17:00 GMT

Ah well, antother TechEd has come and gone. These have become my most favorite events -- the amount and quality of customer interaction simply increases year after year. You know you guys are really finally starting to understand it all! :) I get better questions that show a higher level of understanding the real problems, the threats, and the solutions. It's really wonderful to see.

A deep thanks for all the positive comments in the evaluations. It humbles me to know that you truly appreciate the work I'm doing; you should know that I'm doing it for you.

I've posted all my PowerPoint decks, including the Sunday pre-conference, on my web site. You can find them here. Feel free to reuse whatever materials you'd like in presentations of your own. Enjoy, and be sure to let me know if you have any questions.

TechEd US 2005

Steve Riley — Wed, 13 Apr 2005 00:25:00 GMT

This year at TechEd I have three sessions. The policy talk is really a lot of fun, I guarantee it'll make you think! The privacy talk I am co-presenting with my good friend Byron Hynes (http://spaces.msn.com/members/byronphynes).

Security policies? Ugh, just give me a firewall
Start | Programs | Firewall | Rules | Add rule | Permit all hosts destination port 4695/tcp. Um, why did you just do that? Was there a business justification for creating that hole, and was the decision backed up by your security policy? You do have an up-to-date, regularly reviewed policy, right? Surprisingly (or not), security policies in many organizations are hidden, reflect thinking ten years ago, or simply don't exist. All security decisions should be based on business needs and guided by relevant, timely, and flexible policies. Steve Riley will help you understand why it's important to have a security policy, how to encourage end-user participation, and provide suggestions on what makes up a good policy.

Protecting Privacy on the Microsoft Platform: "paper security" vs. real security
In the era of proliferating privacy regulations worldwide, encryption requirements are everywhere. However "encryption" doesn't necessarily mean protection -- if we hand over the keys to a robber, then he's going to get in our house despite the lock on the doors. We'll discuss various encryption approaches that organizations have proposed or deployed, and distinguish between those that merely satisfy a simple "checkmark" on a privacy auditor's list, and those that actually provide the protection that was intended by the regulations. We'll also explore encryption options in Windows and delve into how Windows protects important secrets.

Secure remote access
Remote connections extend your network's perimeter far and wide across the globe, often into networks that you know very little -- or nothing -- about. Because remote access to corporate networks is critical for business these days, it's absolutely essential that you take the necessary steps to protect your own network and your remote clients from threats that lurk along the way. Basic requirements include not only strong user authentication but also knowledge of the remote computers and configurations that erect barriers against attack. Depending on the needs of your user community, some might require the flexibility of full IP-based virtual private networks (VPNs), others might need only simpler Terminal Server or web-based "remote display" access. Technologies for secure remote access include Windows Routing and Remote Access Services (RRAS), VPN quarantine, strong authentication with smart cards, securing Terminal Server over the Internet, and web-based remote access to internal services. Steve Riley will help you understand the unique security requirements for various kinds of remote access and how to deploy the appropriate technology safely, to keep your network assets and your information protected.

Go to http://www.microsoft.com/events/teched2005/default.mspx to register!