Steven B. Lipner is a pioneer in cybersecurity with over forty years’ experience as a general manager, engineering manager, and researcher. He retired in 2015 from Microsoft where he was the creator and long-time leader of Microsoft’s Security Development Lifecycle (SDL) team. While at Microsoft, Lipner also created initiatives to encourage industry adoption of secure development practices and the SDL, and served as a member and chair of the SAFECode board.
Lipner joined Microsoft in 1999 and was initially responsible for the Microsoft Security Response Center. In the aftermath of the major computer “worm” incidents of 2001, Lipner and his team formulated the strategy of “security pushes” that enabled Microsoft to make rapid improvements in the security of its software and to change the corporate culture to emphasize product security. The SDL is the product of these improvements.
At Mitretek Systems, Lipner served as the executive agent for the U.S. Government’s Infosec Research Council (IRC). At Trusted Information Systems (TIS), he led the Gauntlet Firewall business unit whose success was the basis for TIS’ 1996 Initial Public Offering. During his eleven years at Digital Equipment Corporation, Lipner led and made technical contributions to the development of numerous security products and to the operational security of Digital’s networks.
Throughout his career, Lipner has been a contributor to government and industry efforts to improve cybersecurity. Lipner was one of the founding members of the U.S. Government Information Security and Privacy Advisory Board and served a total of over ten years in two terms on the board. He has been a member of nine National Research Council committees and is named as coinventor on twelve U.S. patents. He was elected in 2015 to the National Cybersecurity Hall of Fame and holds an appointment as adjunct professor of computer science at the Institute for Software Research, School of Computer Science of Carnegie Mellon University.
Howard A. Schmidt brings to SAFECode talents in business, defense, intelligence, law enforcement, privacy, academia and international relations, gained from a distinguished career spanning 40 years. In addition to his role as Executive Director of SAFECode, Howard serves as a partner in the strategic advisory firm, Ridge-Schmidt Cyber, an executive services firm that helps leaders in business and government navigate the increasing demands of cybersecurity. He served as Special Assistant to the President of the United States and the Cybersecurity Coordinator for the U.S. federal government. In this role Mr. Schmidt was responsible for coordinating interagency cybersecurity policy development and implementation and for coordinating engagement with federal, state, local, international, and private sector cybersecurity partners.
Previously, Howard was the President and CEO of the Information Security Forum (ISF). Before ISF, he served as Vice President and Chief Information Security Officer and Chief Security Strategist for eBay Inc., and formerly operated as the Chief Security Officer for Microsoft Corp. He also served as Chief Security Strategist for the US-CERT Partners Program for the U.S. Department of Homeland Security. Howard also brings to bear over 26 years of military service. Beginning active duty with the U.S. Air Force, he later joined the Arizona Air National Guard. With the AF he served in a number of military and civilian roles culminating as Supervisory Special Agent with the Office of Special Investigations (AFOSI). He finished his last 12 years as an Army Reserve Special Agent with Criminal Investigation Division’s (CID) Computer Crime Unit, all while serving over a decade as police officer with the Chandler Police Department.
Howard holds a bachelor’s degree in business administration (BSBA) and a master’s degree in organizational management (MAOM) from the University of Phoenix. He also holds an Honorary Doctorate degree in Humane Letters. Howard was an Adjunct Professor at GA Tech, GTISC, Professor of Research at Idaho State University and Adjunct Distinguished Fellow with Carnegie Mellon’s CyLab and a Distinguished Fellow of the Ponemon Privacy Institute. Howard is a Ham Radio operator (W7HAS), a private pilot, outdoorsman and an avid Harley-Davidson rider.
Eric Baize is the head of Product Security and Trusted Engineering at EMC Corporation. In his role, Mr. Baize leads EMC’s Product Security Office with company-wide responsibility for all aspects of product security including vulnerability response, security development lifecycle, implementation of common security technology, and supply chain risk management. He also oversees the definition of EMC’s security and integrity practices to protect engineering systems and product code.
Throughout his career, Mr. Baize has been passionate about building security into technology and processes. Since joining EMC in 2002, he played a central role in EMC’s evolution in security and was a founding member of the leadership team that drove EMC’s acquisition of RSA Security in 2006. He later led RSA’s strategy for cloud and virtualization. Prior to joining EMC, Mr. Baize held various positions for Groupe Bull in Europe and in the US.
Mr. Baize also serves as Chairman of the SAFECode board of directors and on the BSIMM board of advisors. He holds a Master of Engineering degree in Computer Science from Ecole Nationale Supérieure des Télécommunications de Bretagne, France. He is a Certified Information Security Manager, holder of multiple U.S. patents, author of international security standards and a regular speaker at security conferences in the US and Europe.
Frances Paulisch drives cross-company initiatives related to software and to IT security for products and solutions. These activities include strategic topics, best practice sharing, reporting, and training. A main focus of her work is empowering cross-functional teams to work together well over the whole development lifecycle. In particular with a focus on how to realize not only the set of features but also other relevant attributes such as performance, security, scalability etc. At Siemens she has driven the development of a role-based “Software Curriculum” qualification program which is established as one of the global core learning programs at Siemens. Dr. Paulisch has over 20 years experience in software engineering and management areas.
She is also active member of the global software engineering community, playing an active role in various major software conferences such as the International Conference on Software Engineering. She is also Chair of the Advisory Board of the IEEE Software magazine.
She received her doctorate in software engineering at the University of Karlsruhe in Germany and her Masters in Computer Science at Purdue University.
David Lenoe is Director, Secure Software Engineering at Adobe. In his role, Lenoe manages the Product Security Incident Response Team (PSIRT) dedicated to responding to and communicating about security issues, as well as the Adobe Secure Software Engineering Team (ASSET) responsible for ensuring Adobe’s products are designed, engineered and validated using security best practices. Lenoe is also responsible for Adobe’s vulnerability information sharing via the Microsoft Active Protections Program (MAPP). Lenoe represents Adobe on SAFECode’s Board of Directors.
Lenoe joined Adobe as part of the Macromedia acquisition in 2004. At Macromedia, Lenoe held several management and engineering positions in the areas of product security, product management and quality assurance.
Lenoe earned a BA in Japanese language and literature from Connecticut College.
Adobe is changing the world through digital experiences. For more information, visit www.adobe.com.
Edward Bonver is a technical director and software security architect on the product security team under the Office of the CTO at Symantec Corporation. In this capacity, Mr. Bonver is responsible for working with software developers and quality assurance (QA) professionals across Symantec to continuously enhance the company’s software security practices through the adoption of methodologies, procedures, and tools for secure coding and security testing. He is a software security evangelist, leading Symantec’s security training initiative, and assisting product teams across the company with all aspects of building software security into the product development lifecycle. Mr. Bonver joined Symantec in 2004. Prior to joining Symantec he held software engineering positions at Digital Equipment Corporation, Nbase, and Zuma Networks.
Mr. Bonver is a frequent speaker at global security events and conferences. In addition to representing Symantec on the SAFECode Board of Directors, he is also on the board of the Open Web Application Security (OWASP) Los Angeles chapter, and is a co-organizer of OWASP California regional application security conferences and summits.
Mr. Bonver is a Certified Information Systems Security Professional (CISSP) and a Certified Secure Software Lifecycle Professional (CSSLP). He holds a master’s degree in computer science from California State University, Northridge, and a bachelor’s degree in computer science from Rochester Institute of Technology.
David Doughty is the Director of Product Security Engineering at Intel Corporation. In 2003 he led the formation of Intel’s security assurance initiative. Mr. Doughty drove the creation of robust programs to prevent the introduction, detect the presence and respond to vulnerabilities in all Intel products and services. He is currently a board member of SAFECode, the Software Assurance Forum for Excellence in Code.
Prior to joining Intel in 1997, Mr. Doughty worked in the Design Automation Industry where he led the development of commercial and proprietary tools to support the design and validation of semiconductors.
Mr. Doughty earned his Bachelor’s degree in Computer Engineering from the University of California, San Diego.
Gerold Huebner, Chief Product Security Officer (CPSO) at SAP AG , owns SAP’s Product Security Strategy and is the legal advisor for assuring right data protection functionalities in SAP applications. Mr. Huebner authoritatively drives Security Development Lifecycle Processes at SAP across all development units. In his role as CPSO he is the guiding Chief Expert on all product security topics including SAP’s internal Product Standard for Security, Static Code Analysis and Testing practices, Security Awareness and Security Development Trainings, Security Research and Security Response.
Mr. Huebner’s accomplishments before SAP include 11 years with Microsoft in numerous strategic engagements wherein as a member of the Corporate Trustworthy Computing Team he represented the company as a Government Security Director, internationally. Before joining Microsoft Mr. Huebner was a public officer at the data protection supervisor for the state of Baden-Württemberg. Mr. Huebner has a degree in law and has specialized on data protection and security.
As head of the Securability Center of Excellence and Product Vulnerability Response teams Anders Magnusson is responsible for managing all aspects of the Secure Software Development Lifecycle at CA Technologies – including securability training and testing, architecture reviews, usage of 3rd party components and vulnerability response activities.
During his tenure at CA Technologies, Anders has held a number of different roles and responsibilities. After his start as a pre-sales technician in Europe, he spent several years working as liaison between corporate management in US and technical managers in Europe, Asia and South America. He later leveraged this experience as a software architect, designing standards for product development as well as best practices for solutions spanning multiple products.
Anders developed and continues to manage the Foundational Requirements for CA Solutions which establish basic standards for all products – such as accessibility, scalability, securability and upgradeability. Anders is a member of the CA Council for Technical Excellence and has contributed as a principal author for publications such as CA Technology Exchange, CA Green publications and a multitude of Best Practices documents.
Glenn Pittaway has spent nearly two decades working in IT security. After studying Jurisprudence at Oxford, he moved into computing, joining Microsoft Limited in 1993, and Windows security Program Management in 1999. He joined Trustworthy Computing Security in 2007, to work on assurance and certification strategy. Glenn runs the Government Security Program and Microsoft Transparency Centers, and spends most of his time working through software security assurance concerns with Governments worldwide.