Podcasts

Robert gives us a glimpse of what he’ll be discussing on the Keynote stage. The rising tide of threats, both nation state and criminal, in particular ransomware and how it is changing. We have seen a tidal wave of ransomware in the last 2 years, a growing sophistication in its delivery and what it does once it’s delivered. The second thing is the supply chain, CISOs are realising that everything is connected to this big ecosystem of vendors and suppliers and each of these represents some threat. Considering the events of last weekend, the Kaseya attack in the US, really brings home these two areas, the combination of a sophisticated ransomware attack delivered through the supply chain. 

Are we seeing a Cyber Cold War? When you look around at he number of state sponsored cyber attacks and their increased severity against critical infrastructure and even health services, it is clear that there is an escalation. Ian draws some analogies in history on how wars have started in the past and how technology has been a key player. He argues that we can all see from around us that the situation is getting worse and we need to shore up our defences because the reason a lot of these attacks succeed is because we our defences weak in many areas. This is everyone’s problem.

Learn from Aston Martin’s innovative approach to cyber threat intelligence management, essential now in the face of a massive surge in cyber criminality and learn how they have integrated that into futures design. With the surge of ransomware and new tactics such as info stealers, businesses have to continue to defend their organisation against current threats, while keeping an eye on what’s in the horizon. Aston Martin’s case study will discuss how their process informs and helps plan delivery and development over the next decade.

CAPLOCK won this year’s DCMS Award for the Most Innovative Cyber Security SME for their revolutionary new educational organisation, they have redesigned higher education to plug the skills gap, at speed and at scale. They are helping bust myths that cyber is not all about tech, their curriculum is built around what industry needs. They are even helping re-skill those in the armed forces. They are seeing there are so many roles available and that the industry really open to taking people on with transferrable skills from other sectors.

“This is a massive achievement and lovely to be recognised as an educational organisation that is rethinking the way things are normally done. Education and that skills gap is a problem that needs solving, we are really trying to change the sector in the way it’s done.” They also say that Infosecurity Europe is hugely important to the industry, it brings the whole community together and was a key element in their research in developing their business.

Shift to working from home and hybrid working, have created new threats, such as sharing devices, use of shadow IT, and all the cues to act securely have gone,. The traditional awareness we normally had has gone, and we have been too slow to adapt to these changing threads and changing contexts. The fact that 90% of cyber attacks start with the human user, Tim argues that behavioural change is key to creating solutions. 

Rick suggests that companies should be looking to protect their information assets, their data, which can lead to publicised incidents where sensitive data is breached. Another threat which is more prevalent he says, is ransomware which is becoming one of major threats to 2021.

To help limit the risk and help prevent these threats Rick shares some solutions. He says that big and small companies tend to miss basics: Vulnerability assessments, understanding threat landscape, regular patching, making sure there are no easy targets on their cloud environment. Look also at monitoring techniques such as SOC.

Shiri discusses the management of opensource which is arguably the biggest revolution we had in the last 10 years, but companies need to be aware of issues that can arise from it. Her tips include first of all create a bill of materials, so you know which opensource code you are using right through to understanding the legal requirements of using it. 85% of vulnerability of open source have often been fixed in later updates, so it’s worth making sure you keep up-to-date versions.

Ransomware is one of the biggest threats right now, Nick suggests. There are so many threats that a CISO has to deal with, but one of the foundational strategies has to be how to mitigate against ransomware. Just in the last month we have seen a memo come from the Whitehouse urging companies to take 5 key steps to protect themselves against ransomware, which also filtered through into GCHQ who issued similar. Nick discusses the importance of segmenting the network, because if you assume that an attack is going to breach the perimeter (which is a widely held belief right now) you are going to want to limit lateral movement.

Root of the challenge for companies is that adversaries always seem to be a couple of steps ahead of where the defence is, Richard says. One of the best things companies can do is to close the gap between offence and defence. Of course you have the traditional threats, ransomware, cloud security, phishing attacks but also threats to industrial control systems and critical infrastructure. He urges a holistic approach to understand your environments and prepare for the next phase. Monitor, take a step back and take a full assessment of your “crown jewels"

John puts a call out for the the world of software development and the world of security to come together, to work more closely. He argues that software development is moving incredibly quickly, and security is finding it hard to keep up with it. He describes the specific challenges in keeping up to date with the new vulnerabilities being identified in code and being published. He suggests we need to break down those silos between the people who create the code and those who operate the software, we need to work together and have collective responsibility to create a more secure environment.

Rob discusses how many companies do not have an effective security operation, their cybersecurity defences are not being deployed efficiently. They might have them in place, but the signals aren’t been processed quick enough, so something that could have been dealt with in a day by a SOC, are being ignored and can endi up being major incidents. Also he suggest that there are many technical threats, insider threats, ransomware, but also supply chain incidents, including where third-party providers bring an inherent risk to you through the supply chain. One key takeaway is do not to focus on buying more tech, but treat security as a board level issue and like a long term problem.

Meha calls for holistic operational risk management. With organisations having to sift through a plethora of international guidelines and standards, ensuring operational resilience and understanding liability risks in the event of a disruption is key to helping business as usual in the case of a cyber attack or human error. She also proposes there is a benchmark and appropriate methodologies to understand what 3rd parties need to do for compliance.

Meha Shukla is Director at Skill Formation Ltd and Researcher at University College London. She will be speaking at Infosecurity Europe 2021 on Tuesday 13th July. Meet her in person by registering for the Infosecurity Europe event.

Quentyn discusses how we can’t eliminate third-party risk unless you do it all yourself, you have to understand that their risk is for risk and if they have a data breach or security incident that you’ve understood the liability you’re carrying. As well as regular security reviews of your third-party provider services, he also suggests starting at the perimeter, what exposures are on the internet and what does that look like to an attacker?

Quentyn Taylor is Director EMEA Infosecurity at Canon EMEA. He will be speaking at Infosecurity Europe 2021 on Wednesday 14th July. Meet him in person by registering for the Infosecurity Europe event.

Milos suggests you look at your business initiatives and strategic goals and then base different types of security around these, including data protection assessments. Also abide by domestic laws especially if you are a global company, have legal agreements on both sides and have NDAs, CDAs in place, conduct security risk assessments and know the flow. Look at the different standards, for instance ISO 29 will give you insight into how good your processes are. Education and Communication are also key.

Milos Pesic is the Global Head of Information & Cyber Security at Make Ltd. He will be speaking at Infosecurity Europe 2021 on Wednesday 14th July. Meet him in person by registering for the Infosecurity Europe event.

Benjamin advises putting processes in place to evaluate, assess and manage the vendors, rate them, make sure you have a right to audit. Also ask them what frameworks they have in place, are they subject to regulatory standards like PCI or SOCs. What reports can they share to show they are adhering to those standards? If they have cyber insurance it gives you an idea of the level of maturity that the third party is at and how well they will treat your data.

Benjamin Corll is VP of Cybersecurity at Coats. He will be speaking at Infosecurity Europe 2021 on Tuesday 13th July. Meet him in person by registering for the Infosecurity Europe event.

We are thrilled to announce the Wendy Nather is the 2021 Hall of Fame Inductee. We asked Wendy what she thought of being inducted into the Infosecurity Hall of Fame “it’s a very big deal, Infosecurity Europe is such an important conference for everyone to attend, because it brings so many diverse perspectives. The conference is a highlight of my year, it’s a terrific honour.”  Wendy also mentions the importance of the start up booths exhibiting at the show, to learn what they are working on, because they are the seeds of what we’ll be doing in the future. So, it’s an opportunity to learn from both the big companies and the smaller ones.

Maxine Holt, Senior Research Director, Omdia Ensuring companies have access to the applications, data and services with require in a secure manner, ensuring BYOD are secure enough to provide access. Supporting staff who are working remotely in terms of mental health is also key. Combining people, process and technology is key, the “sticking plaster” employed at the beginning of the pandemic, is slowly being peeled back to reveal a dish-mash of security controls that require serious review to make them fit-for-purpose in this reset normality.

Steve Wright, Partner, Privacy Culture Without peer review and with increased pressure people are more likely to make mistakes and try the easy route if they’re not sure. With the 400% increase in cyber crime, to mitigate risk organisations would be best to carry out a proper assessment on the whole impact of remote working, data, IT, general operations. Refresher training is essential, but so it supporting the mental health of those who are remote working so they don’t feel isolated..