Image

Nir Valtman

Information Security Executive. Public Speaker. Vlogger.

My official profile Bio

Nir heads the product & data security for Finastra. Beforehand, he was the CISO at Kabbage and worked at NCR in several roles, including heading the application security across the software solutions portfolio and leading the divisional information security group as the Retail CISO. Furthermore, as part of his previous positions, he was working in several security leadership, application security, penetration testing and systems infrastructure security positions.
Nir is a frequent speaker at leading conferences around the world, including Black Hat, Defcon, RSA, BSides, and OWASP.
Nir has a Bachelor of Science in Computer Science but his knowledge is mainly based on cowboy learning and information sharing with the techno-oriented communities.

Pending Patents

A Virtual Reality (VR) system and method are provided that integrates transaction processing. A VR session customer transaction information is obtained and a transaction is concluded with the transaction information during the VR session.
More
A request for access to a user's account is made to an authenticator. The authenticator sends a request for access to the user associated with the user's account. In response to user authorization, the authenticator sends an access link to a service engineer. The service engineer access the link to access the user's account with limited and restricted access. When a remote service session associated with the activated access link is terminated, the authenticator sends a termination of session notice to the user.
More
A user identifier to a user is received over a messaging platform. The user identifier is mapped to a user identity that includes an identity mapping to a plurality of other user identifiers for the user that are used over other messaging platforms by the user.
More
A user is initially registered during a session with a messaging platform through an out-of-band registration communication. When a user attempts to make a payment within the session or within subsequent sessions with the messaging platform or subsequent sessions with different messaging platforms, the user is presented token names representing registered forms of payment within the user's session. The selected token name is mapped outside the session to specific registered payment details and the payment processing is processed on behalf of the user during the session but through out-of-band session communications. Confirmation of payment is then sent back to the user in a session communication.
More
A user is initially trained for voice authentication within a messaging platform session. After training and during the same session or a different session with the messaging platform session or with a different messaging platform, and when the user requests during such session a sensitive operation be performed on behalf of the user with an external service, a randomly generated voice challenge is delivered to the user during that session. If a returned voice recording from the user is authenticated in response to the issued voice challenge, then the sensitive operation is performed on behalf of the user during the session.
More
A user is assigned an initial risk score during a session with a messaging platform. During the session, the user attempts an operation with an external service. One or more additional authentication factors are requested from the user to dynamically lower the initial risk score. The lowered risk score is processed with the external service to perform the operation on behalf of the user during the session.
More
An Operating System (OS) command launcher or loader is newly obfuscated each time a command is successfully processed by the OS command launcher. Moreover, a binary for the OS command launcher is validated each time a command is attempted to be processed for execution by the OS command launcher.
More
Podcasts

Appears

CISOs are in sales because of him.

Sp4rkCon
blackhat

Contact Information

Feel free to drop me a line at nir valtman.org.
You can also reach out via or .
My PGP is here.

bsides

Detailed Info

My resume is availabe here.

Public Speaking

  • ISE® Southeast Executive Forum
    February 6

    Participated in the panel on the topic "Forward-Thinking Perspective".

  • Georgia Tech Lecture Series
    January 18 | Video

    Presented the lessons learned on how to scale an information security program at a startup and the delicate balance of building a diligent foundation without stifling innovation and growth.

  • CyberHub Summit
    October 10

    Participated in a pannel discussion related to how GDPR changed the business and privacy globally.

  • FIN:CODE USA
    September 17

    Keynoted about Container Security (101 level)

  • Hacker Halted
    September 14

    Deep tehnical dive to container security.

  • DevSecCon Boston
    September 11

    Presented a technical talk about how to attack and defend containerized solutions.

  • Israel CyberWeek - CloudDay
    June 18 | Video

    Represented the FinTech security aspects in a pannel discussion.

  • O'Reilly Security
    October 30

    Executive level presentation on how to scale application security in a diverse engineering organization.

  • SANS Secure DevOps Summit
    October 22 | Presentation

    Presented my jorney to secure 100 products.

  • Black Hat USA
    July 23 | Video

    Presented how to scale application security.

  • Sp4rkCon (Walmart's Info Sec Conference)
    April 1

    Presented the attacks and defenses in the Retail industry.

  • RSA Conference
    February 15 | Presentation

    Trained the audience on how to mature the application security practices.

  • Black Hat USA
    August 3 | Video

    Demonstrated how to bypass the security mechanisms provided by the payment points of interaction, e.g. PinPads. The summary of this talk was covered on 30+ languages.

  • BSides Las Vegas
    August 2 | Video

    Demonstrated how to bypass the security mechanisms provided by the payment points of interaction.

  • ToorCon
    October 24

    Technical deep dive into security orchestration an automation on Amazon Web Services.

  • Defcon
    August 8 | Video

    Presented how to orchestrate and automate security on Amazon Web Services within a few minutes.

  • Black Hat Asia
    March 26 | Video

    Introduced an open source tool to orchestrate and automate security on Amazon Web Services.

  • Defcon
    August 8 | Video

    Presented my research about Bug Bounty Programs.

  • Defcon
    August 7 | Video

    Showcased how point of sale (POS) attacks can be executed and provided thoughts on how to cope with them.

  • Black Hat USA
    August 6 | Video

    Presented how to attack and defend points of sale.