About
Articles by Maarten
-
The Operationalization of Norms and Principles on Cybersecurity
The Operationalization of Norms and Principles on Cybersecurity
With two simultaneous processes getting underway in the UN General Assembly's First Committee, the UN Group of…
Activity
-
If you're attending the [un]prompted conference in San Francisco this upcoming week, don't miss this great talk by two of our leading AI security…
If you're attending the [un]prompted conference in San Francisco this upcoming week, don't miss this great talk by two of our leading AI security…
Shared by Maarten Van Horenbeeck
Experience & Education
-
Adobe
View Maarten’s full experience
See their title, tenure and more.
or
Licenses & Certifications
Volunteer Experience
-
Startup Mentor
National CoE
- Present 4 years 6 months
Science and Technology
Startup mentor for the National Centre of Excellence on Cybersecurity of India.
-
Advisory Board Member
Forum International de la Cybersécurité
- 4 years 1 month
Science and Technology
Member of the Advisory Board of Forum FIC, the international cybersecurity forum.
-
Lead Expert - IGF BPF on Cybersecurity
United Nations
- 8 years 6 months
Science and Technology
I contributed as Lead Expert to the Best Practices Forum (BPF) on Incident Response Teams in 2014 and 2015, and to the BPF on Cybersecurity in 2016-2022.
-
-
Volunteer Disaster Service Worker
California Governor's Office of Emergency Services
- Present 7 years 10 months
Disaster and Humanitarian Relief
-
-
Family Mentor
International Rescue Committee
- 3 years
Disaster and Humanitarian Relief
Volunteered as a mentor and guide to refugee families from Burma that were resettled in the greater Seattle area. Taught English and helped them with day-to-day issues of life.
Publications
-
Cybersecurity Culture, Norms and Values
Internet Governance Forum
See publicationThis background paper serves as introduction to the wider area of culture, norms and values in cybersecurity, and was developed in the context of the Best Practices Forum on Cybersecurity in the IGF.
-
The future of Internet governance and cyber-security
Elsevier: Computer Fraud and Security
See publicationIt's often unclear to Internet users who it is that actually makes the decisions that make their connection work. This is because the Internet, by definition, is a complex system that is not managed by a single organisation. In order for your connection to be successful, you use hardware built by a hardware vendor, protocols developed by Internet engineers in loose technical groups such as the Internet Engineering Task Force (IETF), networks operated by a third party and a website operated by…
It's often unclear to Internet users who it is that actually makes the decisions that make their connection work. This is because the Internet, by definition, is a complex system that is not managed by a single organisation. In order for your connection to be successful, you use hardware built by a hardware vendor, protocols developed by Internet engineers in loose technical groups such as the Internet Engineering Task Force (IETF), networks operated by a third party and a website operated by the organisation with which you're actually interacting. That organisation probably uses a whole set of other vendors, such as content delivery networks or cloud providers, to provide the service.
You use hardware and software from a variety of vendors, protocols developed by Internet engineers in loose technical groups and networks operated by third parties. Maarten Van Horenbeeck of the Forum of Incident Response and Security Teams examines how this mish-mash of organisations and standards fits together and what makes it work. -
The Key to Better Cybersecurity: Keep Employee Rules Simple
Harvard Business Review
See publicationIt’s a common adage that employees are the weak link in corporate cybersecurity. But I believe they are also the best defense, if they are given policies that are easy to follow and not too numerous and complex. Employee security training and best practices need to be user friendly and simple to be effective.
-
Incident Response Capacity Building in the Americas
Organization of American States
The Forum of Incident Response and Security Teams (FIRST) is a global association of incident response teams members in over 70 countries, that enables them to respond more effectively to security incidents by providing access to best practices, organizing events and providing computer security incident response team (CSIRT) education. This paper explores some of the experiences FIRST has had catering to such a wide constituency, our view on incident response capability, and what organizations…
The Forum of Incident Response and Security Teams (FIRST) is a global association of incident response teams members in over 70 countries, that enables them to respond more effectively to security incidents by providing access to best practices, organizing events and providing computer security incident response team (CSIRT) education. This paper explores some of the experiences FIRST has had catering to such a wide constituency, our view on incident response capability, and what organizations can do to improve the overall state of cybersecurity in the region.
Other authors -
-
Establishing and Supporting Computer Security Incident Response Teams (CSIRT) for Internet Security
Internet Governance Forum
This paper is the outcome document of discussions that were held from September of 2013 through November of 2015, identifying best practices in developing Computer Security Incident Response Teams (CSIRT). It addresses potential misconceptions in the roles and responsibilities of these organizations, and factors that improve trust between them and their constituents.
Other authors -
-
Cooperation is key to Africa's security future
SC Magazine
See publicationThis was a guest opinion on the development of cybersecurity across the African continent, published in SC Magazine, as well as Communications Africa and the African Business Review.
-
Culture, ethnicity and their impact on risk communication
Communicating for Diversity, UFI Publishing
Cultural and ethnic diversity in society have sharply increased over the past years. Minority Hispanic groups within the US, as well as African ethnic groups in European cities have grown significantly. This paper identifies how contemporary risk communication, in order to be successful, needs to take these two aspects into account. It introduces the reader to a number of starting points related to cultural interpretation. It also finds that fragmentation of communications media is an important…
Cultural and ethnic diversity in society have sharply increased over the past years. Minority Hispanic groups within the US, as well as African ethnic groups in European cities have grown significantly. This paper identifies how contemporary risk communication, in order to be successful, needs to take these two aspects into account. It introduces the reader to a number of starting points related to cultural interpretation. It also finds that fragmentation of communications media is an important enabling factor in reaching the correct target audience, but also poses additional risk regarding the interpretation of its content.
-
The SANS Internet Storm Center
WOMBAT Workshop on Information Security Threats Data Collection and Sharing
See publicationThis paper serves to introduce the SANS Internet Storm Center, and more specifically, its data collection and analysis processes pertaining to information security incidents. It reviews both the technical means of collection as those that rely on human input, and describes the various analysis and output processes. In addition, it provides some case studies on how incidents are handled using the tools available.
-
Deception on the network: thinking differently about covert channels
Proceedings of 7th Australian Information Warfare and Security Conference
See publicationThe concept of covert channels has been visited frequently by academia in a quest to analyze their occurrence and prevention in trusted systems. This has led to a wide variety of approaches being developed to prevent and identify such channels and implement applicable countermeasures. However, little of this research has actually trickled down into the field of operational security management and risk analysis. Quite recently a number of covert channels and enabling tools have appeared that did…
The concept of covert channels has been visited frequently by academia in a quest to analyze their occurrence and prevention in trusted systems. This has led to a wide variety of approaches being developed to prevent and identify such channels and implement applicable countermeasures. However, little of this research has actually trickled down into the field of operational security management and risk analysis. Quite recently a number of covert channels and enabling tools have appeared that did have a significant impact on the operational security of organizations. This paper identifies a number of those channels and shows the relative ease with which new ones can be devised. It identifies how risk management processes do not take this upcoming threat into account and suggests where improvements would be helpful.
-
Belgium's Intelligence Community: New Challenges and Opportunities
Journal of Information Warfare
See publicationBelgium’s intelligence function has been heavily criticized, predominantly regarding
its effectiveness and professionalism. Some voices have even gone as far as to propose
abolishment of part of the intelligence community. This paper identifies why efficient
intelligence gathering is more than ever a requirement for both the Belgian and European
leadership. It reviews Belgium’s intelligence history and studies the roots of its criticisms.
Instead of proposing intelligence…Belgium’s intelligence function has been heavily criticized, predominantly regarding
its effectiveness and professionalism. Some voices have even gone as far as to propose
abolishment of part of the intelligence community. This paper identifies why efficient
intelligence gathering is more than ever a requirement for both the Belgian and European
leadership. It reviews Belgium’s intelligence history and studies the roots of its criticisms.
Instead of proposing intelligence ‘reform’, it identifies important parameters of how
contemporary intelligence should be conducted, and how the intelligence services can adapt
within the constraints that apply to them.
Patents
-
Risk scoring in a connected graph
Issued US 10,728,272
A method and apparatus for risk scoring in a graph are disclosed. In the method and apparatus, a graph includes a first node that is connected with a node of a plurality of nodes using a communication link of a plurality of communication links. A plurality of link risk measures are then determined, whereby a link risk measure of the plurality of link risk measures pertains to the communication link of the plurality of communication links. Furthermore, a risk measure associated with the first…
A method and apparatus for risk scoring in a graph are disclosed. In the method and apparatus, a graph includes a first node that is connected with a node of a plurality of nodes using a communication link of a plurality of communication links. A plurality of link risk measures are then determined, whereby a link risk measure of the plurality of link risk measures pertains to the communication link of the plurality of communication links. Furthermore, a risk measure associated with the first node is determined based at least in part on the plurality of link risk measures. The risk measure is monitored to determine if one or more conditions placed on the risk measure are met and one or more actions are taken as a result of the one or more conditions being met.
Other inventors -
-
Event-based data path detection
Issued US 10,560,338
A method and apparatus for path detection are disclosed. In the method and apparatus, a data path may link two path-end nodes in a network. Event data for the network may be received and may be used to determine, for each node resident on the path, proximity measures to each path-end node. The proximity measure of network nodes may be evaluated to determine whether a path exists between the two path-end nodes.
Other inventors -
-
Techniques for data routing and management using risk classification and data sampling
Issued US 10,511,619
Techniques described and suggested herein include various systems and methods for determining risk levels associated with transiting data, and routing portions of the data in accordance with the determined risk levels. For example, a risk analyzer may apply risk classifiers to transiting data to determine overall risk levels of some or all of the transiting data. A traffic router may route transiting data according to determined risk profiles for the data. A sandbox may be implemented to…
Techniques described and suggested herein include various systems and methods for determining risk levels associated with transiting data, and routing portions of the data in accordance with the determined risk levels. For example, a risk analyzer may apply risk classifiers to transiting data to determine overall risk levels of some or all of the transiting data. A traffic router may route transiting data according to determined risk profiles for the data. A sandbox may be implemented to compare, for a given input, expected and observed outputs for a subset of transiting data, so as to determine risk profiles associated with at least the subset.
Other inventors -
-
Static analysis-based tracking of data in access-controlled systems
Issued US 10,467,423
Method and apparatus for identifying a flow of data from a first data store to a second data store are disclosed. In the method and apparatus, a service may send the data from the first data store to the second data store, whereby the service may be associated with an access control policy that specifies whether the service is permitted to send or receive the data. The access control policy may be used as a basis for the evaluation of executable instructions of the service, and evaluation of…
Method and apparatus for identifying a flow of data from a first data store to a second data store are disclosed. In the method and apparatus, a service may send the data from the first data store to the second data store, whereby the service may be associated with an access control policy that specifies whether the service is permitted to send or receive the data. The access control policy may be used as a basis for the evaluation of executable instructions of the service, and evaluation of the executable instructions may be used to identify the first data store or the second data store.
Other inventors -
-
Secure streamlined provisioning of remote access terminals
Issued US 10,187,362
A method and system are provided that create a limited use secure environment (LSE) image such as a limited use operating system installation that can be booted from a removable medium (e.g. CD or flash drive). The limited use secure environment is a limited purpose OS, web browser, etc. that prevents undesired activities. When the limited use secure environment boots, it initiates a pairing operation in which a pairing code and user credentials are conveyed to an authorization server. Once the…
A method and system are provided that create a limited use secure environment (LSE) image such as a limited use operating system installation that can be booted from a removable medium (e.g. CD or flash drive). The limited use secure environment is a limited purpose OS, web browser, etc. that prevents undesired activities. When the limited use secure environment boots, it initiates a pairing operation in which a pairing code and user credentials are conveyed to an authorization server. Once the pairing code and credentials are confirmed, a provisioning service provides configuration credentials to the limited use secure environment to enable the limited use secure environment to establish a secure connection through a gateway to resources of interest.
Other inventors -
-
Identifying sensitive data writes to data stores
Issued US 10,114,960
Techniques for detecting access to computer system data by applications running on a computer system are described herein. Data access event log entries are recorded, the log entries including one or more metadata items associated with how the computer system application accessed the computer system data. The log entries are analyzed using correlations with other computer system events and, if improper access is detected, one or more operations relating to the type of data accessed and the type…
Techniques for detecting access to computer system data by applications running on a computer system are described herein. Data access event log entries are recorded, the log entries including one or more metadata items associated with how the computer system application accessed the computer system data. The log entries are analyzed using correlations with other computer system events and, if improper access is detected, one or more operations relating to the type of data accessed and the type of violation are performed to mitigate the improper data access.
Other inventors -
-
Analyzing distributed datasets
Issued US 9,960,975
Techniques for analyzing a dataset may be provided. For example, a configuration file may be accessed. The dataset may be analyzed based on a condition identified in the configuration file. A report may be generated and transmitted based on the analysis. Another report generated based on an analysis of another dataset according to another configuration file may be accessed. The dataset may be further analyzed based on this report to determine if a reported observation may also be associated…
Techniques for analyzing a dataset may be provided. For example, a configuration file may be accessed. The dataset may be analyzed based on a condition identified in the configuration file. A report may be generated and transmitted based on the analysis. Another report generated based on an analysis of another dataset according to another configuration file may be accessed. The dataset may be further analyzed based on this report to determine if a reported observation may also be associated with the dataset. If so, a confirmation may be generated and transmitted.
Other inventors -
-
Event-based data path detection
Issued US 9,838,260
A method and apparatus for path detection are disclosed. In the method and apparatus, a data path may link two path-end nodes in a network. Event data for the network may be received and may be used to determine, for each node resident on the path, proximity measures to each path-end node. The proximity measure of network nodes may be evaluated to determine whether a path exists between the two path-end nodes.
Other inventors -
-
Detecting network attacks based on network requests
Issued US 9,756,058
Based on an access of a client device to the network-based document, information associated with this access may be recorded. The information may be analyzed to determine whether a condition associated with the direct access may be violated. An issue may be detected with the client device access based on a determination that the condition may be violated.
Other inventors -
-
Techniques for Data Routing and Management using Risk Classification and Data Sampling
Issued US 9,661,011
Techniques described and suggested herein include various systems and methods for determining risk levels associated with transiting data, and routing portions of the data in accordance with the determined risk levels. For example, a risk analyzer may apply risk classifiers to transiting data to determine overall risk levels of some or all of the transiting data. A traffic router may route transiting data according to determined risk profiles for the data. A sandbox may be implemented to…
Techniques described and suggested herein include various systems and methods for determining risk levels associated with transiting data, and routing portions of the data in accordance with the determined risk levels. For example, a risk analyzer may apply risk classifiers to transiting data to determine overall risk levels of some or all of the transiting data. A traffic router may route transiting data according to determined risk profiles for the data. A sandbox may be implemented to compare, for a given input, expected and observed outputs for a subset of the transiting data, so as to determine risk profiles associated with at least the subset.
Other inventors -
-
Detecting network attacks based on a hash
Issued US 9,473,516
Techniques for analyzing access to a network-based document may be provided. For example, a portion of the network-based document for hashing may be identified. A client hash of the portion may be accessed. The client hash may be based on an access of a client to the network-based document over a network. A provider hash of the portion may be also accessed. The provider hash may be based on a trusted version of the portion. The client hash and the provider hash may be compared. Based on the…
Techniques for analyzing access to a network-based document may be provided. For example, a portion of the network-based document for hashing may be identified. A client hash of the portion may be accessed. The client hash may be based on an access of a client to the network-based document over a network. A provider hash of the portion may be also accessed. The provider hash may be based on a trusted version of the portion. The client hash and the provider hash may be compared. Based on the comparison, an issue associated with the access to the network-based document over the network may be detected.
Other inventors -
-
Detecting network attacks based on network records
Issued US 9,426,171
Techniques for analyzing access to a network-based resource may be provided. For example, a client record associated with the access to the network-based resource over a network may be compared to a provider record. The client record may indicate an address of the network based resource and can be received from a computing resource. The provider record can also indicate the address and can be received from a trusted computing resource. Based on the comparison, an issue associated with the…
Techniques for analyzing access to a network-based resource may be provided. For example, a client record associated with the access to the network-based resource over a network may be compared to a provider record. The client record may indicate an address of the network based resource and can be received from a computing resource. The provider record can also indicate the address and can be received from a trusted computing resource. Based on the comparison, an issue associated with the access to the network-based resource over the network may be detected.
Other inventors -
-
Automatic fraudulent digital certificate detection
Issued US 8,966,659
A computing device analyzes digital certificates received from various different sites (e.g., accessed via the Internet or other network) in order to automatically detect fraudulent digital certificates. The computing device maintains a record of the digital certificates it receives from these various different sites. A certificate screening service operating remotely from the computing device also accesses these various different sites and maintains a record of the digital certificates that…
A computing device analyzes digital certificates received from various different sites (e.g., accessed via the Internet or other network) in order to automatically detect fraudulent digital certificates. The computing device maintains a record of the digital certificates it receives from these various different sites. A certificate screening service operating remotely from the computing device also accesses these various different sites and maintains a record of the digital certificates that the service receives from these sites. In response to a request to access a target site the computing device receives a current digital certificate from the target site. The computing device determines whether the current digital certificate is genuine or fraudulent based on one or more of previously received digital certificates for the target site, confirmation certificates received from the certificate screening service, and additional characteristics of the digital certificates and/or the target site.
Other inventors -
Languages
-
Dutch
Native or bilingual proficiency
-
French
Limited working proficiency
-
German
Limited working proficiency
-
English
Full professional proficiency
Recommendations received
15 people have recommended Maarten
Join now to viewOther similar profiles
-
Graydon McKee - MSIA, CISSP
Graydon McKee - MSIA, CISSP
My personal/professional website: http://www.graydonmckee.com <br> <br>► BRIEFLY: I help SMB and enterprise-level companies protect shareholder value, market share, revenue and brand reputation through the protection sensitive information and assets. I establish information security programs which constantly assess the security posture of the network environment / security architecture and introduce a diverse portfolio of viable, context specific information security solutions to protect company assets, revenue, and liquidity. I believe an integrated blended approach to information security improves a company’s competitive edge and promotes agility in a dynamic marketplace.<br><br>► SKILLS: I’m skilled in Leadership, strategic thinking, information security, compliance, controls, policy, business technology, IT Security among others. I have held positions as both an internal resource as well as a consultant. Over the years in my roles as a consultant, I have seen and analyzed many different IT environments. I have learned what solutions work (and why) and what do not (and why). I have managed globally diverse teams of 10 or more individuals. I am an effective communicator able to adjust my message for my audience be they technical, business oriented, or executive level. I’m adept at managing diverse relationships and inspiring others. I enjoy collaborative environments and facilitating joint solutions to complex problems. <br><br>► EXPERIENCE: I started my career as a technical resource providing network administration and end user support before moving into management consulting in information security. Over the years I’ve developed an expertise in addressing the protection of information and intellectual property in the following industries: Consumer Electronics, Printing and Packaging, Consulting, Overseas Manufacturing, Software Development and Distribution, Financial Sector, Educational Institutions, and the Public Sector. I’ve experience addressing audit and compliance to many information security guidelines such as (but not limited to) GDPR, CCPA, SOX, PCI DSS, GLBA, FISMA, C-TPAT, HIPAA and numerous international data protection and privacy laws. <br><br><br>
Explore more posts
Explore top content on LinkedIn
Find curated posts and insights for relevant topics all in one place.
View top contentOthers named Maarten Van Horenbeeck
1 other named Maarten Van Horenbeeck is on LinkedIn
See others named Maarten Van Horenbeeck