Autumn Online Summit

Join Infosecurity Magazine Editor, Beth Maundrill, as she welcomes our audience to this year’s online summit and gives you a preview of the content line up for the week.

About Beth Maundrill
Beth is the Editor at Infosecurity Magazine. She joined the team in August 2022 and has spent her career dedicated to business-to-business journalism and publishing. In 2013 Beth completed her degree in politics and international relations at the University of Reading and went on to work at a defence and aerospace publishing house for six years. She has also spent time writing about technology developments in the supply chain and global trade. With a strong focus on writing and producing content in technology-focused fields she took the plunge into the world of cyber security in 2021.

Insecure behaviours are continuing to proliferate and this is despite that cybersecurity breaches are regularly a newsworthy item on mainstream media and despite the fact that the advice given by cybersecurity teams hasn't varied much since the inception of this practice 20-30 years ago. As a community, we need to start asking ourselves, if the messaging on how to keep safe has been consistent, why is it not working?

Perhaps the real question here is, who is the real compromising position? Those on the periphery of security who are not heeding our advice?

Or is it security professionals who refuse to compromise, leading to workarounds and other dangerous behaviours?

Join me as we ask these very questions and look at ways we can build a stronger security culture in our organisations.

About Lianne Potter
As the Head of SecOps for the largest greenfield technology transformation project in Europe, Lianne is building a leading edge security team from scratch to meet the needs of a modern retail organization while empowering her team to think innovatively to create new standards in best practices.

Lianne has delivered talks across the globe to share her vision for a new type of security function.

Drawing upon her expertise as a cyber-anthropologist (through her consultancy, The Anthrosecurist), her practical experience as a security-focused software developer and as a security practitioner; Lianne combines the human and the technical aspects of security to evangelize a cultural security transformation.

In 2021 she won two other awards for Security Leaders of the Year 2021 and Woman of the Year in the Enterprise category.

“It’s not if, but when” an idiom we hear relentlessly in the cybersecurity world which sadly often rings true. Most organizations will experience a breach at some point, if they haven’t already, even with the best cybersecurity practices in place. What is therefore important is that the cybersecurity team, and the wider business, has a robust plan to deal with an incident when it happens so it doesn’t lead to data being stolen, a ransom demand or network outages. Join our panel of experts who will guide you thorough the world of incident response planning in this session.

Three key learnings to expect from the session:
- Common Mistakes Unveiled: Gain insights into the typical errors organizations make when crafting incident response programs and learn how to avoid these pitfalls to strengthen your cybersecurity posture.
- Effective Response Strategies: Discover the key elements necessary for designing incident response programs that enable swift, effective organizational responses, reducing the impact of breaches, data theft, or network disruptions.
- Continuous Improvement: Understand the importance of ongoing evaluation and refinement of your incident response procedures, ensuring your organization remains agile and adaptive in the face of evolving cyber threats.

Presenters:
Serge Droz, Senior Technical Advisor, Swiss Federal Department of Foreign Affairs & Member of the Board, FIRST | Maria Else, Manager, Portfolio Management, Lifecycle Services EMEA, Rockwell Automation | Francesco Chiarini, Founder & Chief Researcher, High Value Target

Organizational cyber risk has become significantly more complex in recent years, driven by factors like rapid digitization, a plethora of regulations and growing reliance on third parties and outsourcing.

In this landscape, annual assessments are insufficient to understand and manage evolving cyber risks to your business. Therefore, organizations must continuously monitor and embed security risk management into their organizational management processes.

This is where governance comes in. In this session, a panel of experts will offer advice on undertaking effective governance and risk management, tailored to your organization. They will share their approaches, best practices and lessons learned.

Our experts will help you:
- Understand the fast-moving cyber-risk landscape and its future evolution
- Learn about the emergence of governance in cybersecurity and its growing importance
- Realize the skills and tools needed to understand and manage cyber-risks efficiently

Presenters:
Ian Hill, Director of Information and Cyber Security, UPP | Mark Ward, Senior Research Analyst, Information Security Forum (ISF) | Laure Lydon, Senior Director, Security Governance & Assurance, Babylon | Martin Whitworth, Lead Cyber Risk Expert, Analytical Innovation, S&P Global Ratings | Matt Phillips, Director, Guidehouse

- Gain an in-depth understanding of the cybersecurity challenges facing industrial organizations.
- Learn about the solutions that will succeed in securing your production line, from strong authentication to zero trust.
- Explore how WALLIX PAM4OT enhances remote access security for efficient and secure production operations.

Google, Apple and Microsoft awarded record-breaking prizes to bug hunters in 2022, with Google alone delivering $12m in bug bounties. During the same year, the pentesting industry disclosed over 25,100 vulnerabilities – a 4000 spike compared with the previous year. Now, in 2023, even tech darling OpenAI is betting big on bug bounties, offering up to $20,000 for ChatGPT users reporting vulnerabilities.

Join this session to learn why organizations are increasingly adopting offensive cyber programs and the challenges that they face when incorporating them into their overall cyber-defensive posture.
- Understand why defensive cyber along is not sufficient to prevent cyber-attacks
- Learn the differences between pentesting, bug bounties, red/blue/purple teaming
- Understand how to adapt these programs to your business
- Explore how offensive cyber programs will be critical to securing generative AI tools

Presenters:
Jon Medvenics, Chief Hacker, Heretek | Katie Paxton-Fear, Ethical Hacker, Traceable | Donald Donzal, CMO, TCM Security & Founder, The Ethical Hacker Network | Hani Momeninia, Purple Team Operative, City Electrical Factors

Early in 2023 a critical security threat was discovered in the MOVEit Transfer file transfer software that enables attackers to steal data from organizations. To date it is estimated that the ransomware gang behind the attack, Clop, could make up to $100m from the incident. MOVEit is a classic example of a software supply chain attack where attackers exploit a third-party system to gain access to bigger fish. Join this session to understand how you can prevent your organization falling victim to a supply chain attack and what to do if it happens to you.

During this session our experts will discuss:
- What tools are most important when managing the security/access of third parties you work with
- How far do software bills of materials (SBOMs) help mitigate the risks of supply chain attacks
- How to develop a mature incident response plan that enables quick and effective coordination with third parties

Presenters:
Paul Holland, Head of Research, Information Security Forum (ISF) | Rafe Pilling, Director of Threat Research, Secureworks Counter Threat Unit | Mark Nicholls, Head of Information Security, Ramsay Health Care UK | Sanja Kekić, Cyber Pathway for Women Manager, DAI | Chrissa Constantine, Solutions Architect, Synopsys

Cybersecurity is a constantly evolving field, and misconceptions can thrive. During this session, A leading CISO joins Infosecurity Magazine to bust some of the biggest myths in cybersecurity today including:

- Antivirus software provides complete protection
- A Firewall is all you need
- Strong passwords are enough to keep you protected
- You’ll know when you’ve been hacked
- Only large organizations are targeted
- Cybersecurity is solely an IT problem
- You must have a technical background to understand cybersecurity

About Jon France
Information Security professional and CISO at (ISC)² serving as advocate for security and risk management activities, skills development and awareness amongst all users of technology across industry as well as within (ISC)².
Jon is a CISSP and has more than 25 years of experience building and leading diverse technology and security teams, setting and executing strategy and delivering programs that empower stakeholders and operations while effectively managing risk across media and telecommunications sectors.
Driven by a passion for technology and security in the tech enabled era, where societal reliance on technology is pervasive for social, economic, and physical health. Focusing on raising resilience of the broader tech ecosystem, the systems and architectures that are used and the data that flows through it, ultimately protecting the users and consumers.
Prior to joining (ISC)² Lead the industry security function at GSMA, a member lead organization representing Mobile Operators and the wider telecommunications industry. Responsible for ensuring that the mobile sector anticipated and addressed security and fraud threats across the mobile ecosystem by working closely with operators, vendors, governments, regulators, standards bodies and industry leadership.

Join Infosecurity Magazine Editor, Beth Maundrill, as she welcomes our audience to the second day of this year’s online summit.

About Beth Maundrill
Beth is the Editor at Infosecurity Magazine. She joined the team in August 2022 and has spent her career dedicated to business-to-business journalism and publishing. In 2013 Beth completed her degree in politics and international relations at the University of Reading and went on to work at a defence and aerospace publishing house for six years. She has also spent time writing about technology developments in the supply chain and global trade. With a strong focus on writing and producing content in technology-focused fields she took the plunge into the world of cyber security in 2021.

Managing cyber risk has become a complicated task for security leaders, amid surging cyber-attacks, widening threat surfaces, and expanding regulations and supply chains. In this landscape, it is essential that CISOs properly understand their business and its priorities to develop an appropriate risk management strategy.

During this session, Andrew Smeaton, CISO at Afiniti, will present a practical guide for CISOs on developing, and maintaining a tailored risk management program.

Join this webinar to learn:
• How to utilize security frameworks most appropriate to your organization
• Build a sustainable vulnerability management program
• Work closely with the board and c-suite in managing this process

2023 has been the year of AI and since ChatGPT burst onto the scenes cyber adversaries have developed similar tools to carry out phishing attacks, business email compromise and other online scams. Most cybersecurity pros are of the view that this is just the tip of the ice burg when it comes to how cybercriminals could use AI.

Yet it’s not all bad news: AI also promises to help defenders enhance threat detection and response. Join this session to hear experts discuss the latest developments in AI threats and how you can protect your organization in this rapidly changing environment.

Take part in this session to:
- Learn how threat actors are using AI today, with tools like WormGPT emerging
- Understand how AI can tip the balance toward defenders
- Gain insights beyond the buzz about how AI is being used in cybersecurity

Presenters:
Zaira Pirzada, VP, Product Marketing, Hive Pro | Dan Lohrmann, Field CISO, Presidio | Mary Carmichael, Director, Risk Advisory, Momentum Technology & member of ISACA's Emerging Trends Working Group | Regina Bluman, Cyber Security Advisor, Pinsent Masons

Compromised identities are one of the leading causes of data breaches, and initial access brokers on the darkweb are currently making a killing. Despite the issues, identity and access management continues to be a key challenge for many organizations, especially those who are operating across multiple cloud environments, are working in remote environments and are embarking on digitization projects. Understanding who has access and what privileges they have across your network is more important now than ever before.

Hear from experts about proven strategies for bolstering your organization's identity and access management in this session.

Join this session to learn:
- Why a centralized view and proper access management is important
- How to integrate your IAM solution with your existing security stack
- Is there still a place for Zero Trust or has the buzz died down?

Presenters:
Dr Fred Kwong, VP and CISO, DeVry University | Andrew Hay, CISO, Lares Consulting | Linda Betz, FS-ISAC | Fred Rica, Partner, BPM

Your customers' accounts are targets of new forms of consumer identity fraud, driven in part by the malicious use of AI. Cybercriminals are targeting your business with a new level of sophistication, using AI for misuse. Businesses can use AI as a defensive measure to protect their customers from new and emerging forms of identity fraud, such as fake or synthetic identities, credential hacks, SMS phishing (“smishing”), new account fraud, and automated attacks, among others.

Join identity professionals from PwC and ForgeRock to learn more about:
· Emerging patterns of sophisticated identity attacks
· New techniques and tools for fraud prevention
· Best practices for managing the risks of generative AI (refer to PwC’s Responsible AI Framework found at https://www.pwc.com/us/en/tech-effect/ai-analytics/managing-generative-ai-risks.html)

Presenters:
Loren Russon, SVP of Product & Technology, Ping Identity | Lisa Meepummarin, Director, Consulting Solutions, PwC | Brian Mozinski, Principal, Cybersecurity, IT Security, Privacy and Risk, PwC

Colonial Pipeline continues to be one of the most infamous incidents in recent cyber history and the cybersecurity industry still reels at the idea of a repeat incident. Critical National Infrastructure (CNI) has a unique set of challenges when it comes to cybersecurity, not only are the technical environments complex but the consequence of a cyber-attack can ultimately be life-threatening.

This panel session will provide a comprehensive overview of the cybersecurity challenges facing critical infrastructure sectors, such as energy, transportation, healthcare and more.

Join this session to hear about:
- Emerging threats and attack vectors targeting critical infrastructure
- Why securing converging IT and OT environments is critical
- How organizations outside of CNI can learn from their approach to cybersecurity
- What companies can do to keep critical services running when incidents occur

Presenters:
Katherine Hutton, Product Manager, OT Cybersecurity | Pam Nigro, VP of Security and Security Officer, Medecision | Steve Trippier, Group CISO, Anglian Water

Most of us by now know that there is a workforce shortage in cybersecurity, the gap currently stands at 3.4m people according to (ISC)2’s annual workforce study. Against this backdrop, how can CISOs successfully recruit for a role and what should they be looking for? Hear from someone who’s found success in this area, knows the best way to attract the right candidate and why thinking outside of the cybersecurity box could work for your team development.

Presenters:
Jenai Marinkovic, Executive Director, CISO, Advisory Board, and Melissa Elza, Co-founder, GRC for Intelligent Ecosystems Foundation (GRCIE)

About Jenai Marinkovic
Jenai is a multidisciplinary technologist and strategist with 20 years of experience in architecting, building and securing systems at scale. She has designed and operated in real-time over the top streaming ecosystems that power live sports, gaming, and entertainment. She’s also worked in biomedical manufacturing and laboratory diagnostics, healthcare tech and robotics in agriculture.
Jenai’s worked with artificial intelligence, its impact on diversity and inclusion as well as improving human empathy towards machines. She has expertise in designing the next generation security experiences necessary to support digital transformation She has built and run design, architecture, innovation, engineering, security and operations teams. Her security expertise spans security architecture, engineering, defense, and forensics and invented a cyber defense framework for large scale breaches based on American football. Jenai has worked for large enterprise brands including DIRECTV, Electronic Arts, Beckman Coulter and international investigations firms such as Kroll.
In addition to her position at TiroSecurity, she is also on the Technology Advisory Board for Beyond Design Agency, Founder of NextCISO Apprenticeship, and Member of the ISACA Emerging Trends Working Group.

Are you ready to get your crystal ball out? Predicting the future can be difficult business but based on the past 12 months we can make some educated guesses as to what is going to impact the cybersecurity world in the year ahead. Our panel of experts have been living cybersecurity 24/7/365 and will provide their insights into what they believe will be some of the biggest trends for 2024 and what industry professionals should be prioritizing. This session will also provide you with the opportunity to grill our experts on what you think will be the biggest issues facing the cybersecurity world.

Join us to discuss trends including:
- Threat actor trends: Taking on the growing threat posed by deepfakes
- Cybersecurity solution trends: Understand what the vendors are offering and what you really need to explore
- Q-Day: How can we win the race to secure systems and data against quantum-enabled cyber-attacks

Presenters:
Jason Rebholz, CISO, Corvus Insurance | Mike Morris, Director, Center for Cyber Education, Western Governors University | Margareta Petrovic, Global Managing Partner Cybersecurity Consulting & Service Integration, Tata Consultancy Services | Dr Rockya Fofana, CEO, Elite CI Consulting