IT Security Insights 2020

Critical infrastructure requires different aspects for risk management to be considered and enforce different priorities when designing the infrastructure due to potential impact from failures, but still the basics of cyber security remain the same. In this session we will touch some of the concerns in relations to sectors of critical infrastructure addressing following questions; 

• What specific risks are necessary to manage?
• How can providers of infrastructure products assist?
• Is it feasible to use cloud services?

This presentation will explore how the "New Swedish National Security Protection Act" is putting a lot of demands on those who are engaged in “Security sensitive activities” 

Key takeaways:

• How does the protection Act apply to a multinational and global business?
• For whom is the Swedish National Security important?
• Who is responsible for Swedish National Security?
• Who will pay for the needed investments?

In this keynote, Christian talks about the challenges facing the Swedish Police authority. Due to the nature of police work modern tools, high availability and mobility is needed without compromising information security and confidentiality. By combining information security and technical testing and surveillance the police authority allows modernization with a high degree of control.
Key  takeaways:

• How do you stay on top of  IT-security in a complex environment and a rapid development pace? 

Having investigated over 1,500 cyber incidents worldwide in 2019 across a wide range of industries, Andrew will share battle-tested insights – a deep dive into the growing sophistication and latest threats, as well as actionable steps to strengthen preparedness, detection and response within your organization. 

Key takeaways:

• What are the latest developments in ransomware, and how does the growing trend of data exfiltration impact organizations?
• The ever-present threat posed by social engineering, and examples of how a strong security culture can help mitigate it

Drawing on industry research, best practices and case studies, we’ll explore why enterprises must address end-of-life data more efficiently and precisely than ever before. We will show you how enterprises can ensure data security throughout the data lifecycle, comply with data protection laws, and align data disposal policies with regulators and environmental goals.We’ll also look at how to target regulated data within traditional endpoints (including remote workplaces), live environments (onsite or in the cloud) and decommissioned IT assets (drives and devices). You’ll also learn how application integrations and cross-vendor cooperation can help you comply with regulations and secure your data.

Takeaways:

• Current innovations and best practices for data sanitization in the post-Covid hybrid work environment
• Adequate and inadequate disposal methods for active data and end-of-life IT assets
• How many large enterprises are putting data at risk with current practices
• How data erasure supports environmental stewardship and social responsibility policies
• How to address sensitive data in the cloud (including AWS and Azure public clouds) and overcome data migration “spillage”
• Best practices for automation and integration into third-party asset management solutions like ServiceNow

In this session Pcysys will discuss the value Automated Penetration Testing brings by enabling continuous risk validation and raising and maintaining your cyber resilience to the highest level. Get a glimpse of how this unique technology will provide you with prioritized cost-effective remediation and improve your network's cyber security posture.

• Why is manual penetration not enough?
• How does Automated Penetration testing work?
• How can Automated Penetration testing reduce cost, increase security resilience and provide contextualized remediation suggestions?
• How can automated penetration testing enable you to continuously validate your risk and challenge all of your security investments?

The mass expansion and proliferation of IT, IoT and OT devices poses new questions to network security: Legacy and vulnerable devices, non-compliant and misconfigured endpoints, and IoT and OT devices must all be identified. Without a complete picture of connected devices across network domains, the ability to act quickly to mitigate risks is all but lost.The increased inter-connectivity across the campus, data center, cloud and operational technology, drives a further growth in complexity in today’s networks and associated security risks

Key Takeaways:

• Please join Forescout Technologies, Inc. in this session to learn how to build and deploy network segmentation at scale.

Your vendors often handle your most sensitive data. This presents new challenges as third-party risk, security, privacy, legal and IT teams struggle to vet and manage the vendors they rely on most. 
Key takeaways:

• OneTrust will discuss emerging vendor management trends and breaks down how risk exchanges are key to more efficient business operations
  
  

The future of network security is in the cloud! - There have been several major shifts in computing technology, networking, mobility and cloud. Each has caused us to rethink the ways in which we do business. In this presentation, James will provide some insights into how we got here, what the future may hold, and what you can do today to better enable your digital business. 

In this round table session John will use the ENISA definition of security measures for operators of essential services (OES) to discuss what best practice and baseline security measures to be applied and relate it to our joint experience from working with cyber security. 

The targeted sectors for this session include; Energy (Electricity, Oil & Gas), Transport (Air, Rail, Water, Road), Financial & Banking, Healthcare, Drinking Water Supply & Distribution, Digital Infrastructures.

The expansion of regulatory frameworks in multiple domains (e.g. PSD2, NIS, GDPR) had led to increased focus in how organizations manage their Information Security and how they verify that the deploy effective controls. One of the verifications methods suggested is the execution of a penetration test on regular (or well-defined) intervals. But, do these mandatory penetration tests add value to the target organization? Or is it just to check one more box in a long compliance checklist? 

Key takeaways:

• What are your experience with penetration testing?
• How can one select the most appropriate vendor for the activity?
• What do you (as a customer of the test) want to see more of (or less of)?

The TIBER-EU has been developed by the European Central Bank. The purpose is to establish a common framework for testing, and improving, resilience against sophisticated cyber attacks. The TIBER-EU framework has been designed for companies and organizations that are part of the core financial infrastructure, whether national or European. However, it can also be used for all types or sizes of companies and organizations in the financial and even in other sectors.
Key takeaways:

• Advantages and disadvantages of TIBER EU?
• What obstacles need to be crossed to implement TIBER EU?
• How can / should we prepare for the introduction of the TIBER EU framework?
• How will TIBER EU affect your organization and your daily work?  

It is hard to keep track of our it-environment as new initiatives are taken, transformation to cloud and mobility is constantly moving. This session is a discussion about how we manage to take control over a complex situation and how we decide what countermeasures are needed to obtain adequate security.

Key takeaways:

• How do we keep track of all attack vectors in our it-environment?
• Guidelines, standards, ways-of-working.
• How do we avoid overlapping, cluttering and gaps in our protection?
• Who has the IT-security map for real?
• How do we define enough?

In this round table session, Secana will explore information security awareness and cyber hygiene as a mean to improve cyber security within organizations and, by extension, in society at large. The session will entail discussions on best practices to improve information security awareness within organisations in various sectors and at various levels, including training initiatives and exercises.

Key takeaways:

• What does it mean to have sufficient information security awareness/cyber hygiene in an organisation?
• What role does information security awareness play in the enhancement of societal cybersecurity and resilience?
• What measures have been proven effective to improve information security awareness in organisations?
• How can training initiatives and exercises improve information security awareness and skills within an organisation?

We’re seeing a deeper convergence of compliance, privacy, and cybersecurity as key elements of a core business strategy. This round table will explore whether security leaders are equipped to support the business and how security can influence other areas of the business without posing obstacles.  

Key takeaways:

• Successful examples of security leaders effectively working with and supporting the general counsel, compliance, and other areas of the business
• How security leaders can help structure a privacy management program that’s embraced by the business
• The role of security and compliance leaders in the implementation of AI projects to avoid biases and oversight

This round table session will be hosted by Conny Larsson and Martin Bergling  who are both Board Members at SIG Security.

Key takeaways:

• "Everything should be outsourced to the cloud!"- But is there information that cannot be outsourced? If so, which one?- How can one handle a separation between the two types of information?

• Our confidence in the cloud suppliers- Can we have confidence in that security requirements are met? How?- What role does the Cloud Act and Patriot Act play for our trust in suppliers affected by these requirements?
• Conflicts of interest between new business opportunities and regulatory changes- How should legislation or other regulation be modified so that new business opportunities, e.g. based on cloud services or other new technology, can be utilized?- Is it eg appropriate to specify requirements and conditions in law, or should they be given in regulations or other directions from the regulator or supervision authorities?
• About 95% of personal data incidents reported to the Swedish Data Inspection Board (‘Datainspektionen’) are closed, and as a private individual you can never receive relevant compensation in a possible dispute.- Can we, as individuals or companies, trust GDPR to work?- Or is GDPR and ‘Datainspektionen’ just window dressing?

The Swedish tax agency does not think that just smoothing och tuning  it's old processes is enough to maintain trust from it's own customers. If we want people and businesses to keep paying tax voluntarily, we need to step up and offer them the possibility to handle tax in their own preferred environment, integrated in real time transactions. To pull this through, we need completely new technical solutions and business models. This offers many serious challenges, not the least from an it-security perspective.

Key takeaways:

• Everyone is talking API´s, and so are we. But why has it been so hard for us to walk the talk? 
• Why is the API strategy so crucial for our transformation? 
• Securing data and the integrity of the customer in house is hard enough; How will we manage security if we share your data to others? 
  
  

Today's increased cyber attacks and breaches have prompted us to act fast and with precision thanks to the new emerging technologies. With Ai, Machine Learning, Blockchain, Big Data, IoT and Cloud, it's  safe to say we are facing a paradigm shift.

Key takeaways:

• What are biggest challenges in terms of the new landscape?
• Do we have sufficient skilled security workforce to drive current and future projects? Or do we need the same people in the near future as we have now?

Even when your organization has deployed and configured modern security controls, applied patches and refined policies, can you be assured no attack vectors still exist from mistakes and human error? By the current way you are checking your security, how can you know that you haven’t made your security posture vulnerable? Are you able to prioritize your security projects to remediate issues that could directly impact your most critical digital assets?

Join Tilman while hes discusses the most advanced attack simulation modeling system available for today’s complex networks and get decisive answers:

 A photograph of the current challenges in adapting Cybersecurity policies and discipline across the continuum of IT and OT. Existing risks and vulnerabilities in extending the perimeter of Cybersecurity protection across operating environments in critical infrastructures, factories, and office environments with an explosion of IOT devices and gateways. The cultural challenges of understanding what are the differences between the well standardised world of IT and the heterogenous world of operations and industrial controls. The session presents several use cases and examples from several segments. It highlights the practical challenges from companies in automotive, transport, energy and public sector who are implementing projects at the global level and are faced with significant change management processes

Ket Takeaways:

• What IT-OT security approaches have been tried and failed . Which have worked and Why?
• What are the key principles underlying a positive outcome?
• What are the overall benefits in mitigating what is in essence the reputation risk of large and complex organisations?
• What can we expect from future developments?