7th SIGS Technology Conference 7th/8th September 2020 – Cyber Security Day 2020

Keynotes

CyberProof, Tony Velleca, CEO

Tony is the CISO at UST Global and CEO of CyberProof, a UST Global company. As the visionary leader behind innovative cyber solutions, Tony is driving the rapid growth of CyberProof and leveraging its capabilities to keep UST Global on the forefront of security.
Tony previously co-founded and was the CTO at huddle247.com, rated by PC Magazine as one of the top virtual workspace solutions in 2000. Before huddle247.com, he worked for Boeing (formerly McDonnell Douglas) and Rolls-Royce, Inc., where he spent most of his career in conceptual design and optimization of propulsion systems for next-generation commercial and military aircraft.
Tony holds a BS degree in Aerospace Engineering from Georgia Institute of Technology and an MBA (Honors) from University of California, Irvine.

Is AI Working? How AI is Disrupting Security Operations

Organizations across a wide range of industries are talking about increased AI adoption this year. In the world of cyber security, AI has enormous potential: It is crucial for Level 1 SOC analysts who need to enrich alerts and address the problem of “alert fatigue,” and helps Level 2 analysts in processing large quantities of data – aiding human decision-making and prioritizing next steps. Yet, there are inherent dangers in applying AI to ever-increasing fronts of activity – as AI is effective as a cyber security tool only when bots are “trained” by people with the necessary expertise.
Learning Outcomes:

  • Probe how Level 1 and Level 2 analysts can leverage AI
  • Explore “alert fatigue” and how AI contributed to the explosion of alerts SOCs handle
  • Identify limiting factors in applying AI to ever-increasing fronts of human activity
  • Understand “reinforcement learning” and why it is crucial to successful AI implementation
  • Highlight the key role of high-level cyber experts in facilitating faster detection and response

Farsight Security, Paul Vixie, CEO and Co-Founder

Dr. Paul Vixie is an Internet pioneer. Currently, he is the Chairman, CEO and cofounder of Farsight Security, Inc. Dr. Vixie was inducted into the Internet Hall of Fame in 2014 for work related to DNS and anti-spam technologies. He is the author of open source Internet software including BIND 8, and of many Internet standards documents concerning DNS and DNSSEC. In addition, he founded the first commercial anti-spam company (MAPS, 1996), the first non-profit Internet infrastructure software company (ISC, 1994), and the first neutral and commercial Internet exchange (PAIX, 1991). In 2018, he cofounded SIE Europe UG, a breakthrough European data sharing collective to fight cybercrime.

Dr. Vixie earned his Ph.D. from Keio University for work related to DNS and DNSSEC in 2010.

Consent, Alignment and Cooperation in the Internet Era

Much of the actions and habits of humans from the real world (the so-called "Meatspace") are relatively clearly reflected on the Internet (cyberspace). However, for some parts of the human puzzle there is no obvious place on the playground of the Internet, which has led to an unexpected change in society through its digital nervous system, the Internet.

Are we only in the post-Westphalian age or - as many claim - in a post-national age?

Freddy Dezeure, Trusted Advisor, Board and Advisory Board Member in startup companies and C-Suite trainer

Freddy Dezeure graduated from the KUL in Belgium, with a master of science in engineering in 1982. He was CIO of a private company from 1982 until 1987. He joined the European Commission in 1987 where he held a variety of management positions in administrative, financial and operational areas, in particular in information technology. He set up the EU Computer Emergency and Response Team (CERT-EU) for the EU institutions, agencies and bodies in 2011 and made it into one of the most mature and respected CERTs in Europe. Until May 2017 he held the position of the Head of CERT-EU. Presently, he is an Independent Management Consultant providing strategic advice in cybersecurity and cyber-risk management and acting as Board Member and Advisory Board Member in several high tech companies.

MITRE ATT&CK: The Sequel

MITRE ATT&CK has become very popular in the past year. This session helps you to put the Framework into practice, using realistic examples, demonstrating available community tools and showing how to use analytics to identify adversarial techniques in your network. It will also provide an example of ATT&CK based purple teaming. You will gain valuable insights and return home with useful resources.

Mandiant, Jeff Hamm, Technical Director

Jeff Hamm has been employed with Mandiant since 2010 and is a Technical Director helping improve operations and internal process in the Managed Defense services. He was formerly assigned to the Europe region, where he managed a team that conducts forensic examinations and incident response. He also works part-time as an adjunct lecturer at NTNU (Norwegian Science and Technology University) in Gjøvik, Norway since 2011. There he provides intense practical labs based on real world computer forensic incidents using both Windows and Linux servers and attacker systems. He has co-authored “Digital Forensics” edited by Andre Arnes in 2017. The book is designed for academia and practitioners. He was a Deputy with the Oakland County Sheriff’s Office in the State of Michigan, USA for over 11 years. He worked four years with the Sheriff’s Office as a Computer Crimes Detective and Forensic Examiner and three years as a first-line supervisor (Sergeant). Jeff has significant experience in the computer forensic field and obtained his CFCE (Certified Computer Forensic Examiner) in 2003. He obtained his ACE (AccessData Certified Examiner) in 2008, his EnCE (EnCase Certified Examiner) in 2010, and his GCFA (GIAC Computer Forensic Analyst) in 2010. He has been instructing in the field of computer forensics since 2004 at IACIS (The International Association of Computer Investigative Specialists).

Critical Thinking in the SOC: Level Up Analytical Skills

Our SOC and security analysts are faced by an ever increasing volume of alerts and security incidents that need to be reviewed against ever tightening time constraints. Critical thinking and decision making can help us improve internal methodology when reviewing alerts. This can assist us when reviewing our mountain of alerts by being more efficient and effective when making determinations of risk and whether or not an alert was a true positive. One way to do this is to examine others experiences when it comes to what more can be done or even should be done. Let’s remove some of our biases and try to think outside of the box.

In this presentation, I’ll discuss some useful steps for applying critical thinking that can be used to take level up your decision making and analysis. This can provide additional value to your organization or customer. I’ll demonstrate where these steps could have been used to improve security alert analysis from case studies. Finally, I’ll follow up with tips on creating confident, actionable remediation recommendations.

Workshops and Roundtables

Cloud Security Alliance Dutch Chapter, Peter van Eijk, Board Member

Peter van Eijk is one of the world’s most experienced cloud trainers. He has developed multiple cloud courses and delivered them on many continents. In the past he has worked for Deloitte as an IT strategy and risk consultant, as a project delivery manager at EDS and Dutch Rail, as Technical Director of an Internet provider, and as a researcher and assistant professor at University of Twente, where he also received a PhD. He has also written extensively in the trade press.

CSA Training Certified Cloud Security Knowledge (CCSK)

The Certificate of Cloud Security Knowledge (CCSK) demonstrates that you have the skills and knowledge to ensure that cloud services are implemented and utilised within your organisation with the appropriate security controls in place. This includes technical as well as management and governance domains.
Further information and registration (separately) at https://www.sig-switzerland.ch/csa-ccsk/

Credit Suisse AG, Kai-Michael Schramm, IT S&A Security Architecture

Kai Schramm graduated in 2006 with Ph.D. with a focus on side channel attacks and cryptanalysis. Since then he worked in various companies, in the areas of information risk management and cyber security. Kai is working as a cyber security architect and strategist in the IT Strategy & Architecture team at Credi Suisse.

Kai has been responsible for developing an encompassing security strategy for Credit Suisse which spans all areas of security, delivering end-to-end security services that enable a resilient and safe business environment and drive innovation in line with strategic business and IT goals with a focus to protect the reputation of the CS brand and maintain client trust.

How to Develop and Execute a Security Strategy

Example of the systematic development and execution of a security strategy at CS driven by various factors such as top down strategies, capability roadmaps, internal stakeholder demand, SWOT analysis and numerous rounds of syndication and project portfolio alignment.

Exabeam, Richard Cassidy, Senior Director, Security Strategy

Richard Cassidy has been consulting to businesses on cyber security strategies and programs for more than 19 years, working across highly regulated industries including finance, insurance, retail, manufacturing, government and military. During his career, Richard has been heavily engaged in the design and implementation of solutions, helping organisations in evolving security, compliance, risk management, data assurance, automation, orchestration & response practices.

Richard’s security operations experience includes managing CERT, breach response teams, threat intelligence & hunting teams, as well as teaching customers a practical understanding of how their data and assets are targeted by cyber-criminal groups, driving effective security practices and mitigation strategies.

Exabeam, Samantha Humphries, Security Strategist

Samantha has 20 years of experience in cyber security, and during this time has held a plethora of roles, one of her favourite titles being Global Threat Response Manager, which definitely sounds more glamorous than it was in reality. She has defined strategy for multiple security products and technologies, helped hundreds of organisations of all shapes, sizes, and geographies recover and learn from cyberattacks, and trained anyone who’ll listen on security concepts and solutions.

In her current regeneration, she’s thoroughly enjoying being a part of the global product marketing team at Exabeam, where she has responsibility for EMEA, SaaS, plus anything that has “cloud” in the name. Sam’s a go-to person for data compliance related questions, and has to regularly remind people that she isn’t a lawyer, although if she had a time machine she probably would be.

She authors articles for various security publications, and is a regular speaker and volunteer at industry events, including BSides, IPExpo, CyberSecurityX, The Diana Initiative, and Blue Team Village (DEFCON).

Rebooting the SOC

Abstract: Security Operations Centres are commonplace in today’s enterprise. Most have grown organically over the years, from a people, process, and technology perspective. Organic growth unfortunately fosters some challenges, which can sometimes be difficult to unpick. Consider if you could start over again, with the learnings you have gained… What would your rebooted SOC look like?

During this roundtable session, join your peers to share your learnings, and discuss what you would do differently if you could reboot your SOC.

Freddy Dezeure, Trusted Advisor, Board and Advisory Board Member in startup companies and C-Suite trainer

Freddy Dezeure graduated from the KUL in Belgium, with a master of science in engineering in 1982. He was CIO of a private company from 1982 until 1987. He joined the European Commission in 1987 where he held a variety of management positions in administrative, financial and operational areas, in particular in information technology. He set up the EU Computer Emergency and Response Team (CERT-EU) for the EU institutions, agencies and bodies in 2011 and made it into one of the most mature and respected CERTs in Europe. Until May 2017 he held the position of the Head of CERT-EU. Presently, he is an Independent Management Consultant providing strategic advice in cybersecurity and cyber-risk management and acting as Board Member and Advisory Board Member in several high tech companies.

Workshop: Frameworks, Mappings and Metrics: Optimize Your Time as CISO or Auditor

Many organizations are already using cybersecurity frameworks like ISO 27000 or NIST CSF. However, overarching cybersecurity regulations with cross-sector compliance obligations for “critical” or “vital” infrastructure have recently been issued. This is for example the case in the EU (the NIS directive and its national transpositions and the GDPR). In addition, most organizations are also required to comply with sectoral regulatory requirements and these vary sometimes significantly by country or region. A good example is the financial sector, with myriad regulations imposing different requirements across the globe.

As a result, CISOs spend almost half of their time on compliance activities, addressing similar concerns but tailoring responses to slightly different requests from their Board, their internal auditors, external auditors, clients and regulators.

This training will provide guidance to reduce duplication of efforts and to become more effective in managing cyber-risks. Participants will learn about the recent evolution in Frameworks, Mappings between Frameworks which can be used to translate internally used models to references used by other stakeholders and Metrics allowing more control for the CISO and help him/her to report on the way risk is managed and mitigated. It will provide insights in what works in practice, by sharing real-world experience.

Further details and registration (separately) at https://www.sig-switzerland.ch/frameworks-mappings-and-metrics/

IronNet Cybersecurity, Justin Coker, Vice President EMEA

Responsible for IronNet’s Europe, Middle East and Africa business, Justin Coker has 32 years of software sales and sales management experience with the last 22 years specialising in enterprise cyber security management.

Prior to joining General (Ret.) Keith Alexander at IronNet Cybersecurity in 2019, Justin spent 14 years at Skybox Security as VP EMEA and prior to that he managed Symantec's UK & Ireland Retail Finance team for 5 years.

Justin is a passionate cybersecurity evangelist and regularly speaks at CISO events and has recently contributed a chapter in the book “CISO, Defenders of the Cyber Realm”. He has been a committee member for the White Hat Ball for the last 3 years, the UK’s premier black tie charity dinner event in aid of NSPCC’s Childline charity.

He holds a Bachelor of Arts degree in Business Studies and is a member of the Chartered Institute of Marketing.

Sun Tzu and the ‘Art of War’ - Collective Defence - How do we crowdsource our cyber army against a collective enemy?

We will explore Sun Tsu's ancient principles of war and apply them to modern day cybersecurity. No company can stand alone against a modern, collaborative ecosystem of cyber threats. Staying ahead of the threat requires a new method of defense, one that applies behavioral detection capabilities and crucially - enables organisations to co-operate on defense at machine speed, utilising "defensive economies of scale". We will share how this new defensive approach is already being successfully utilized to protect half of the US's energy sector against some of the world's most advanced threat actors

JTI (Japan Tobacco International), Sami Haqqani, Information Security Awareness Manager

Sami has been involved in the Information Security field for more than 25 years. He has wide experience in different areas of the information security field and has been involved in system security administration, conducting data centre and application security reviews, developing, and managing information security governance activities, such as policy and risk management, change control, BCS and DRP.

Throughout his career, he has always had to address the challenge of making employees aware of information security issues. He quickly came to the realization that merely attaching responsibility for awareness to an already long list of responsibilities and activities was not the most effective method of addressing what is possibly the biggest threat to an enterprise’s information resources. As a result, he presented a business case to management for the creation of a position dedicated to ensuring that employees understood what Information Security means and its importance to the well-being of the organization and employees. For the last three years, he has held this position at JTI.

To find out more about Sami’s work experience check his LinkedIn profile.

An approach to make employees cyber-secure

Information Security experts have long lived with the thought that the bad guys only need to find one weakness to gain entry to our crown jewels. And so, we have developed a whole host of technical solutions to try and create layered defenses to keep the bad guys out.

But, have we forgotten that arguably the weakest point in this ever-connected world is the squishy carbon-based life form using the devices?

What are we doing about making our family, friends and colleagues more resilient and robust? How is Information Security Awareness handled at your organizations? How can we make it better and more effective?

This will be a story of how one organization radically rethought its approach to making its employees cyber-secure and an opportunity to share ideas and experiences on how to be more effective in this area.

Kenna Security, Simon Black, Pre-Sales Systems Engineer EMEA

Simon’s role as systems engineer and technical lead includes supporting end user engagements for enterprise accounts as well as channel and MSSP partners. Prior to Kenna, Simon was an Enterprise Pre-Sales Technical Account Manager with Qualys for two and a half years. He has worked as a technical security lead/specialist since 1998 within partners, distributors and vendors such as Azlan, (part of TechData), Symantec and Citrix.

Kenna Security, Stephen Roostan, VP EMEA

Stephen has over a decade of experience in cyber security and transformation projects, his role at Kenna is to rapidly grow the EMEA organisation to meet the customer demand for risk-based vulnerability management. Prior to Kenna he held senior sales roles at Forcepoint, Citrix and Imperva, focusing on IT solutions for complex, enterprise requirements. Steve has a passion for driving equality, alongside enabling flexibility at work for modern living. He has held steering committee roles in companies looking to close the gender pay gap and develop careers for working parents, and strives to find and support equality initiatives across the workplace and industry.

Risk-based, time-critical vulnerability management: 4 Steps for Success

Join Steve and Simon to find out how to leverage data science through the lens of cyber risk to quickly deliver multiple value streams across an organisation. This session will show how to empower security, devops, and management with a “self-service” approach that both improves cyber security, and delivers measurable efficiency gains to both IT Security and Development teams.

  • Assessing the scale of the problem, including research from The Prioritization to Prediction report series, an ongoing research initiative with the Cyentia Institute
  • Comparing vulnerability management strategies and benchmarking against industry metrics
  • Defining how success should be measured in your organisation
  • How to deliver a risk-based, self-service approach that enables ITOps/DevOps to be part of the remediation task force

Klaus Haller, IT Project Manager and Solution Architect

Klaus Haller is a Senior IT Project Manager and Solution Architect with experience in Data Management & Analytics, Information Security and Compliance, Business Analysis, and Software Engineering and Testing. He likes applying his analytical skills and technical creativity to deliver solutions for complex projects with high levels of uncertainty.

Klaus is a Computer Science graduate from TU Kaiserslautern (Germany) and the Swiss Federal Institute of Technology (ETH) in Zurich and publishes frequently articles reflecting his work experience in the IT industry. To find out more about his work, check his homepage: http://www.klaus-haller.net

Data-driven Organizations: What's new for information security?

With data being the new oil, IT and information security organizations have to reinvent themselves. Old-fashioned security mechanisms such as anti-virus software, firewalls, access control, and physical security remain important. However, new technologies such as big data and data lakes pose new technological as well as compliance, process, and reputational challenges. In other words: Companies have to learn how to secure the “new oil”, i.e., their data and information, as good as possible while enabling the business to innovate by providing smooth and dynamic access to information when needed.

This round table discussion is an opportunity to share your experiences, to ask your questions, and to learn from your peers.

Mandiant, Alister Shepherd, Managing Director for the Middle East & Africa and the Government Services Lead for EMEA

Please check his details here

Mandiant's Introduction to Cyber Crime for Executives

The Mandiant Introduction to Cyber Crime for Executives was developed to educate senior staff on cyber-crime and incident response. During the course, instructors will walk students through a scenario based on real world intrusions involving sophisticated attackers. The scenario is provided from both the attacker and victim perspectives.
Further information and registration (separately) at https://www.sig-switzerland.ch/cyber_crime/

Mandiant, Jeff Hamm, Technical Director

Jeff Hamm has been employed with Mandiant since 2010 and is a Technical Director helping improve operations and internal process in the Managed Defense services. He was formerly assigned to the Europe region, where he managed a team that conducts forensic examinations and incident response. He also works part-time as an adjunct lecturer at NTNU (Norwegian Science and Technology University) in Gjøvik, Norway since 2011. There he provides intense practical labs based on real world computer forensic incidents using both Windows and Linux servers and attacker systems. He has co-authored “Digital Forensics” edited by Andre Arnes in 2017. The book is designed for academia and practitioners. He was a Deputy with the Oakland County Sheriff’s Office in the State of Michigan, USA for over 11 years. He worked four years with the Sheriff’s Office as a Computer Crimes Detective and Forensic Examiner and three years as a first-line supervisor (Sergeant). Jeff has significant experience in the computer forensic field and obtained his CFCE (Certified Computer Forensic Examiner) in 2003. He obtained his ACE (AccessData Certified Examiner) in 2008, his EnCE (EnCase Certified Examiner) in 2010, and his GCFA (GIAC Computer Forensic Analyst) in 2010. He has been instructing in the field of computer forensics since 2004 at IACIS (The International Association of Computer Investigative Specialists).

Follow Up "Critical Thinking in the SOC: Level Up Analytical Skills"

This roundtable discussion is a follow up on the keynote.

Agenda (subject to change):

Introduction

  • Critical Thinking
    • Identifying Symptoms or Root Cause
    • Rush to a Decision Under Pressure
    • Biases and Jumping Ahead to Conclusions
      • Confirmation Bias
      • Overconfidence Bias
      • Availability Heuristic
    • Consequence of Recommendations
    • Risk!
      • Webshell on an internal system versus an Internet facing webserver
Useful Steps for Analysis
  • Peel the onion! “5 Why’s of Thinking: Why did this happen, why did that happen, repeat 5 times to find root cause”
  • 80/20 Rule (Perato Principal): Focus on 20% of effort that drives 80% value
    • Choosing which analysis to do and how to handle the results that come out
    • Going that one extra step beyond the easy answer and ask what does this mean can make the difference between identifying an attack or not
  • Asset Querying
    • Including Google Searching for Internet Facing Devices
  • Account Context
  • Application Context
  • Identify Crashed Legitimate Applications
  • Leave Bias Behind (i.e. Pentesting vs. Actual Attack) (Confirmation Bias)
  • Use Succinct, Accurate Language
  • Peer Review
    • Don’t use the same steps as the original Analyst
    • Ask critical questions “Why” conclusions were made and why recommendations were made
    • Don’t focus just on the answer
Create Pointed Recommendations and Potential Risks
  • 7 So What’s? Thinking about consequences and avoid problems you might knowingly cause
  • Think Logically About Potential Risk
  • Create Actionable Recommendations
  • Use Active Voice in Recommendations
  • Consider the CISO, CIO, Manager, and other analysts may have turned over when a vulnerability or concern re-appears. Questions

Qualys, Marco Rottigni, Chief Technical Security Officer EMEA

Marco is a result driven professional with nearly 30 years’ experience in IT and 20 years in Security space. He is a natural born Evangelist and Sales Engineer who loves the technology he deals with.

He worked for many companies such as Esker, SCO, Stonesoft, McAfee, Fireeye and managed many European teams and projects. Joining Qualys in 2018 as Chief Technical Security Officer EMEA, Marco’s responsibility is to deliver Qualys technical vision, to pitch Qualys unique advantages and competitive differentiators to strategic customers and partners, while collecting feedback about customers experience with Qualys solutions across the EMEA region.

Open discussion – How do you workflow your security?

We all work within technology landscapes, rich of a very varied digital biodiversity. Starting with thought-provoking questions, we will discuss about the best practices to cope with these cyber-species.

From understanding what we have to assessing the vulnerable surface; from prioritizing the remediation based on exposure and exploitability to patching; from measuring the effectiveness of security programs to validating the compliance posture.

Do we have workflows in place? Do we have the right capabilities? Is there room for improvement?

Ricoh USA, Inc., David Levine, Vice President Corporate and Information Security, CSO

David Levine is Vice President of Corporate and Information Security & CSO for Ricoh USA, Inc. In this role, he has responsibility for operational security, security strategy, security policy, corporate and physical security, access management, eDiscovery and litigation support and some compliance functions. Levine chairs Ricoh’s Security Advisory Council, leads Ricoh’s Global Virtual Security team and is routinely engaged in customer opportunities to discuss risk and security.

Levine has held a wide and diverse variety of positions during his 24-year tenure with the company, including IT engineering, project management, vendor management, Six Sigma and Technology Infrastructure and End User Services leadership, giving him a great perspective on technology, the business and security.

Levine is a member of Forrester Research’s Security & Risk Leadership Board, the FBI’s InfraGard Program and is an Atlanta Governing Body Co-Chair with EVANTA. Levine is a frequent speaker and writer. He holds a Bachelor of Arts degree in Information Systems with minors in Computer Science and Business from Eckerd College.

Third Party Risk Management, the Chaos Continues!

This is a topic I have both written and spoken about in the past and quite frankly I haven’t seen much progress over the past few years. We all need a way to evaluate and determine the risk associated with our partners/third parties/solution providers etc., but we still struggle with effective and or meaningful ways to do so. Join me for this interactive roundtable discussion while we discuss explore what’s working today, what’s not working and ideas for solving the problem!

Spoiler Alert – A 700+ question Yes and No answer spreadsheet isn’t the answer!

SentinelOne, Florian Hammers, Solution Architect

Florian Hammers has been working in the Endpoint Security space for more than 10 years in several technical roles. In the recent past he focused on Incidence Response and Threat Hunting. Since 2019 he is covering the DACH-Region for SentinelOne as a Solution Architect.

The Threat Hunting Challenge

Why EDR (Endpoint Detection & Response) should be key in your endpoint strategy.

In this session we will discuss how EDR solutions have evolved over the years, why the technology is drifting towards a combination of EPP and EDR and how AI can help to discover and stop attacks earlier. Based on real samples we will demonstrate how attackers adapt to the new trends and what we can do to keep on their heels.

Swiss Mobiliar, Thomas Schaefer, Expert in the CISO Office

For more than ten years he has been working for Swiss Mobiliar, nearly ten years as Head of IT-GRC, mainly responsible for risk management in IT and IT security. Until his retirement in summer of 2020 he will continue to support the CISO Office.

Formerly, he had different roles and functions (primarily developer, project manager, line manager ...) in various companies, working on a broad range of topics like ERP for mail order, engineering for life science, customer specific software development in technical environment, environmental measurement technology, semiconductor manufacturing and photogrammetry/cartography.

Smart Change Selection by yourself - not the ones pushed by the experts!

We are living in a world where change is the only constant. Topics like digitalization, cloud transformation, agility, devops and a lot more up to climate change are to be considered when developing an enterprise, a strategy or even a service or a product. The mass of possibilities is overwhelming. Therefor it is an imperative to find a way to select the right topics, the changes important in the local context, not the ones pushed by the experts on the green table. Smart change selection is the key.

At this roundtable, we will discuss how to identify and select the most important smart changes for your strategy or services.

Ted Demopoulos, Independent Consultant

Ted Demopoulos’ professional background includes over 30 years of experience in Information Security and Business, including over 25 years as an independent consultant. Ted helped start a successful information security company, was the CTO at a "textbook failure" of a software startup, and has advised several other startups.

He is a frequent speaker at conferences, conventions, and other business events, author of "Infosec Rock Star: How to Accelerate Your Career Because Geek Will Only Get You So Far" and two other books.

Ted conducts Leadership and Information Security Bootcamps for The SANS Institute, and is the principal of Demopoulos Associates, a consulting organization specializing in information security.

Critical Professional Skills for Cyber Security Professionals

Like many security professionals, Ted Demopoulos began his career as a pure technologist. “Getting better” simply involved “becoming more technical” – learning new technologies, existing technologies better and the like.

However, there are other critical professional skills besides technical ones, skills that make us more efficient, more listened to, and more effective. Certainly, these include communication skills, planning, leadership, time management (or simply getting the most important things done) and many more.

In this session we will discuss what the most important professional skills are for cyber security professional and ways to improve and become a more effective and efficient cyber security professional, one who is listen to more often and who gets more important tasks done.

Transmit Security, Kilian Zantop, System Engineer Global Accounts

Kilian works since more than 30 years in the industry – mainly in Cyber Security - bringing new technologies to the market. Kilian was founding member of two security VARs in Switzerland. He has been leading deployment of new technology across complete enterprises in different industries like Finance, Insurance, Pharma and many other.

Lately he worked seven years at Palo Alto Networks as System Engineer taking care of global customers. His current workplace is at Transmit Security who provides a low code/no code approach to IAM and fraud prevention. He likes to tackle complex challenges and solve them with reasonable but creative solutions.

Password less – Google has it, can you do it? An open discussion about the obstacles in regular companies

Cybercrime is set to cost the global economy $2.9 million every minute in 2020 and some 80% of these attacks are password-related. Knowledge-based authentication – whether with PINs, passwords, passphrases, or whatever we need to remember – is not only a major headache for users, it is costly to maintain. For larger businesses, it is estimated that nearly 50% of IT help desk costs are allocated to password resets, with average annual spend for companies now at over $1 million for staffing alone.

According to a recent Ponemon survey, employees worldwide spend an average of 11 hours each year entering or resetting their password. For a company of 15,000 employees, on average, this represents a direct productivity loss of $5.2 million. There will be costs associated with transitioning to a passwordless ecosystem but they are expected to be rapidly offset by the productivity boost alone.

This round table discussion is an opportunity to share experiences and learn from peers discussing the passwordless in Enterprises on real world examples and best practices - what works & what not, what’s your next best move instead.

Event Partner

Media Partner

X
X
X
X