↓ Agenda Key
Visionary speaker presents to entire audience on key issues, challenges and business opportunities
Keynote Presentations give attending delegates the opportunity to hear from leading voices in the industry. These presentations feature relevant topics and issues aligned with the speaker's experience and expertise, selected by the speaker in concert with the summit's Content Committee." title="Keynote Presentations give attending delegates the opportunity to hear from leading voices in the industry. These presentations feature relevant topics and issues aligned with the speaker's experience and expertise, selected by the speaker in concert with the summit's Content Committee.
Panel moderated by Master of Ceremonies and headed by four executives discussing critical business topics
Executive Visions sessions are panel discussions that enable in-depth exchanges on critical business topics. Led by a moderator, these sessions encourage attending executives to address industry challenges and gain insight through interaction with expert panel members." title="Executive Visions sessions are panel discussions that enable in-depth exchanges on critical business topics. Led by a moderator, these sessions encourage attending executives to address industry challenges and gain insight through interaction with expert panel members.
Solution provider-led session giving high-level overview of opportunities
Led by an executive from the vendor community, Thought Leadership sessions provide comprehensive overviews of current business concerns, offering strategies and solutions for success. This is a unique opportunity to access the perspective of a leading member of the vendor community." title="Led by an executive from the vendor community, Thought Leadership sessions provide comprehensive overviews of current business concerns, offering strategies and solutions for success. This is a unique opportunity to access the perspective of a leading member of the vendor community.
End user-led session in boardroom style, focusing on best practices
Think Tanks are interactive sessions that place delegates in lively discussion and debate. Sessions admit only 15-20 participants at a time to ensure an intimate environment in which delegates can engage each other and have their voices heard." title="Think Tanks are interactive sessions that place delegates in lively discussion and debate. Sessions admit only 15-20 participants at a time to ensure an intimate environment in which delegates can engage each other and have their voices heard.
Interactive session led by a moderator, focused on industry issue
Led by an industry analyst, expert or a member of the vendor community, Roundtables are open-forum sessions with strategic guidance. Attending delegates gather to collaborate on common issues and challenges within a format that allows them to get things done." title="Led by an industry analyst, expert or a member of the vendor community, Roundtables are open-forum sessions with strategic guidance. Attending delegates gather to collaborate on common issues and challenges within a format that allows them to get things done.
Overview of recent project successes and failures
Case Studies allow attending executives to hear compelling stories about implementations and projects, emphasizing best practices and lessons learned. Presentations are immediately followed by Q&A sessions." title="Case Studies allow attending executives to hear compelling stories about implementations and projects, emphasizing best practices and lessons learned. Presentations are immediately followed by Q&A sessions.
Discussion of business drivers within a particular industry area
Focus Groups allow executives to discuss business drivers within particular industry areas. These sessions allow attendees to isolate specific issues and work through them. Presentations last 15-20 minutes and are followed by Q&A sessions." title="Focus Groups allow executives to discuss business drivers within particular industry areas. These sessions allow attendees to isolate specific issues and work through them. Presentations last 15-20 minutes and are followed by Q&A sessions.
Analyst Q&A Session
Moderator-led coverage of the latest industry research
Q&A sessions cover the latest industry research, allowing attendees to gain insight on topics of interest through questions directed to a leading industry analyst." title="Q&A sessions cover the latest industry research, allowing attendees to gain insight on topics of interest through questions directed to a leading industry analyst.
Several brief, pointed overviews of the newest solutions and services
Taking the form of three 10-minute elevator pitches by attending vendors, these sessions provide a concise and pointed overview of the latest solutions and services aligned with attendee needs and preferences." title="Taking the form of three 10-minute elevator pitches by attending vendors, these sessions provide a concise and pointed overview of the latest solutions and services aligned with attendee needs and preferences.
Pre-determined, one-on-one interaction revolving around solutions of interest
Executive Exchanges offer one-on-one interaction between executives and vendors. This is an opportunity for both parties to make key business contacts, ask direct questions and get the answers they need. Session content is prearranged and based on mutual interest." title="Executive Exchanges offer one-on-one interaction between executives and vendors. This is an opportunity for both parties to make key business contacts, ask direct questions and get the answers they need. Session content is prearranged and based on mutual interest.
Open Forum Luncheon
Informal discussions on pre-determined topics
Led by a moderator, Open Forum Luncheons offer attendees informal, yet focused discussions on current industry topics and trends over lunch." title="Led by a moderator, Open Forum Luncheons offer attendees informal, yet focused discussions on current industry topics and trends over lunch.
Unique activities at once relaxing, enjoyable and productive
Networking opportunities take various unique forms, merging enjoyable and relaxing activities with an environment conducive to in-depth conversation. These gatherings allow attendees to wind down between sessions and one-on-one meetings, while still furthering discussions and being productive." title="Networking opportunities take various unique forms, merging enjoyable and relaxing activities with an environment conducive to in-depth conversation. These gatherings allow attendees to wind down between sessions and one-on-one meetings, while still furthering discussions and being productive.
3:00 pm - 4:30 pm
4:30 pm - 6:00 pm
6:00 pm - 7:00 pm
7:00 pm - 8:30 pm
8:30 pm - 10:00 pm
7:00 am - 7:55 am
8:00 am - 8:10 am
8:10 am - 8:50 am
While Information Security has existed for decades, Enterprise Risk Management (ERM), as a formal and holistic practice, is much newer yet already has taken pre-eminence over its forebear. What is the CISO, who in many ways has toiled in invisibility, infamy, or ignominy to do when faced with the issue of being supplanted by the Chief Risk Officer, just as enterprise demand for and focus on security has reached all-time heights? Savvy CISOs will recognize this new, broader need for holistic visibility into, and management of, overall enterprise risk and will position themselves for success by looking beyond traditional information security boundaries and engaging business partners around all enterprise risk.
8:55 am - 9:35 am
9:45 am - 10:15 am
As mobile devices continue to proliferate, security becomes a bigger and more serious issue. While initial security threats were contained to data loss through lost and stolen devices, the leveraging of targeted cyber security threats has created a dual problem for carriers. The first is the PR nightmare of increasing public perception that mobile security breaches of all types are a carrier and not end user issue. The second is the threat that hundreds of millions of powerful connected devices represent to backbone carrier networks themselves. In this environment mobile providers must make investments in security technologies that protect the network from directed threats (from both known and unknown connections) and extend that protection bubble out to subscribers.
The 2014 Verizon Data Breach Investigations Report was released recently and declares 2013 the “year of the retailer breach”, unsurprising given the attacks on Target, Michaels, Neiman-Marcus and other retailers. For the second year in a row the report shows retailers to be one of the most heavily attacked industry verticals and the new structure of the report shows that the number one channel of attacks was, by far and away, threats against and compromises of the PoS system yet for all that the report offers nothing more than old school, pat security solutions such as “Use AV”, “Limit Remote Access” and “Segment the Network”. While these are all fine techniques to apply to increase base level security stance, the time has come for retailers to get out of the security dark ages and begin to take cutting edge approaches that respect the increased focus bad actors are giving their businesses.
10:20 am - 10:50 am
The breadth and depth of security threats that are targeting the modern enterprise are bordering on overwhelming, but they’re not alone as the breadth and depth of security solutions are also bordering on overwhelming. When security managers have to respond to alerts and warnings from dozens of security systems, and CISOs have to make strategic decisions based on fragmented data, it’s hard to argue that security is improving. Security Information and Event Management (SIEM) platforms that aggregate the vast quantities of data, correlate diverse events, and filter the signal from the noise are allowing enterprises to get back ahead of the curve and make appropriate tactical and strategic decisions.
10:55 am - 11:25 am
Though Mobile Device Management (MDM) has become the de facto mobile computing security platform offering the ability to control devices, and contain critical data, only 50% of organizations have deployed an MDM platform. Not all MDM platforms are equal, nor are the needs of individual adopters. How then should the enterprise make the best of us of the selected tool, ensuring the right level of protection while avoiding the infringement of individual rights? The key to efficient and effective deployment is balancing the protection you need, the capabilities of the tool selected, and the demands to be placed on mobile users.
Over the last few years, as cloud and mobile technologies have taken hold within the enterprise, the concept of the network perimeter has dissolved, and with it the concepts around traditional network security. The broad scale adoption of IoT technologies however will make this first phase of network disaggregation seem trivial in comparison as enterprises begin to connect to not just thousands but millions of disparate and divergent endpoints. To ensure appropriate security in such a dispersed networking world and entirely new paradigm to security will be required that encompasses not just wildly diverse types of devices in wildly diverse locations, but the threat of low-powered, low complexity endpoints that have no internal capacity for monitored and managed security capabilities.
11:30 am - 12:00 pm
Cloud delivered computing services, whether Software, Platform, or Infrastructure as a Service offer the potential of significant business advantages such as reduced cost and increased flexibility. These advantages however come with very real risks, chief among them security concerns and the risk of data and compliance breaches – how do you secure what you can’t see, touch, and control? Combining security solutions that are tied more closely to the data that is to be protected with more comprehensive monitoring and management platforms is the key to ensuring protection in a world where the cloud simply cannot be ignored.
From a technology standpoint, as a “society” the world of business has gone through two distinct stages in the evolution of its information security focus. The first addressed network based protection and preventative controls such as firewalls and anti-malware. The second looked at data-centric and detective controls such as encryption and intrusion/extrusion monitoring. Since breaches continue to occur at a record pace, what is need new is clearly a new evolution, one that pushes towards individual focused security through granular user monitoring and management as provided by solutions such as Identity and Access Management. While IAM isn’t a new technology field, it is one whose time has come and CISO need to begin investing in modern-day, light-weight, easy to implement IAM solutions now to stay ahead of the curve, and reduce enterprise threats.
• The breach onslaught demonstrates that existing security solutions are incapable of defending current threats
• Enterprises need to begin looking at security from an activity perspective rather than an artifact perspective
• IAM provides activity insight, and therefore threat awareness, no other platform can equal
12:05 pm - 12:35 pm
Cloud delivered computing services, whether Software, Platform, or Infrastructure as a Service offer the potential of significant business advantages such as reduced cost and increased flexibility. These advantages however come with very real risks, chief among them security concerns and the risk of data and compliance breaches – how do you secure what you can’t see, touch, and control? Join our panel as we explore both the security and compliance issues inherent in Cloud deployments, look at the hidden issues that first time Cloud adopters may simply not be aware of, and discuss through solutions that can be used to address these challenges and allow enterprises to fully and firmly embrace the Cloud.
Building security into your enterprise processes, and integrating it with your existing technology investments has never been more critical or complicated than it is in this era of decentralized computing, and ever-tightening compliance requirements. Furthering this complication is the impact that partnering deals can have since infrastructure, applications, and even data may no longer be under your direct control. To be able to ensure efficient and effective security capabilities you need to understand the nature of the threats that exist today, the impact a sourcing relationship can have on these threats, and the mitigation strategies and tools key industry leaders are using to address the challenge.
12:40 pm - 1:40 pm
1:45 pm - 2:15 pm
In today’s environment there can be no arguing that a comprehensive IT Security program is a de facto requirement for every organization. Such a program needs to address the full range of security threats that can be leveraged against an organization, needs to be integrated into whatever regulatory and governance requirements exist, but beyond that it needs to be accessible, consumable, and actionable by everyone that is influenced by it, or interacts with it. Building a program that is shared through social channels and relies on the collaborative input of employees and constituents for not only creation but enforcement will drive higher levels of adoption, responsiveness and, ultimately, protection.
When it comes to implementing network security infrastructure there are two schools of thought: use best-of-breed point solutions, or go with all round consolidated platforms. Pros and cons abound for either approach revolving around varying levels of protection, integration, and administrative overhead but the increasing complexity of current security infrastructure is showing a winning approach. Even though consolidated solutions may offer greater benefits in the long run, no one exists in a green-field situation when it comes to network and infrastructure security so careful planning is required to ensure the necessary protection.
2:20 pm - 2:50 pm
The discussion around the convergence of physical security and information security dates back over a decade, but though much was made of the concept in the early 2000’s little was actually done and the buzz faded. Flash-forward to today however and the buzz is back because of the increased focus on holistic risk management, the increased pressure of greater compliance requirements, and the increased demand for every aspect of the business to be a value generator. CISOs and CIROs need to evaluate the opportunities for both technology convergence (streamlining platforms) and organizational convergence (streamlining roles) to meet new threat protections mandates.
2:55 pm - 3:25 pm
Volume, variety, velocity, veracity; all four of the hallmarks of Big Data have a clear fit in the world of security as the number of threats grows, their natures diverge, the speed with they are encountered (and subsequently have to be dealt with) accelerates, and the need to be ever more accurate enhances. As enterprises have made significant investments in Big Data programs and analytics platforms, they are beginning to reap real benefits in terms of business efficiency and innovation. The time then has come to begin applying those same principles and platforms to the security challenges facing enterprises to allow for faster, more effective overall security.
3:30 pm - 4:00 pm
It may seem self-evident, but email is still the predominant form of business communication whether in B2B or B2C channels with business sending over 100 billion emails each and every day. Not all of this traffic is legitimate, desired, or safe however with estimates that as much as 90% of all email traffic can be considered spam or worse. In this environment businesses need to ensure that the email they send is viewed as trustworthy, and that the mail they receive is safe of threats. To do this email authentication is imperative and DMARC, Domain-based Message Authentication, Reporting, and Conformance is the gold standard. While DMARC policies are published to public DNS servers and already protect up to 60% of mailboxes for the most part these are public mailboxes from consumer email providers and many business are still on the outside looking in. Savvy IT Leaders know that they need to leverage commercial solutions that streamline DMARC management for their own email infrastructure to ensure they are protected from threats, and able to communicate with partners, clients, and prospects.
For years the security focus of the enterprise was to build a hardened perimeter at the edge of the network, an impenetrable shell that kept the good out and the bad in. Over the last few years this model has fallen by the wayside. Technologies such as Cloud and Mobility have pushed the enterprise beyond its traditional perimeter while increased levels of partnership have created inroads through that shell. As a result, infrastructure based security is no longer sufficient or appropriate and enterprises everywhere are having to make the shift to a new security paradigm, one that is centered on the data itself, not on the infrastructure that houses it.
4:05 pm - 4:35 pm
While security breaches are certainly nothing new, their visibility is increasing and as it increases it places increased pressure on the enterprise to set themselves up for success. To do this, then, is it time to (re)consider the reporting structure of the information security group and the CISO directly? Though these roles have grown up under the umbrella of IT as a whole, in many ways the responsibilities run parallel to those of general IT and forcing them into a reporting structure where they are secondary potentially compromises the opportunity for the CISO, and the information security group, to achieve the success demanded by the enterprise. Has the time come for the CISO to rise in stature and become a peer to the CIO rather than a direct report?
There’s no other way to say it than bluntly; Information Security is a white-hot field within Information Technology as a whole – over the last dozen years it has gone from after-thought, to scapegoat, to critical enterprise success factor. As a result, the need for capable and qualified Information Security specialists, whether front-line Analysts, mid-level Managers, or top level CISOs is at an all-time high, but personnel and skills availability is sinking to an all-time (at least in terms of supply and demand ratio) low. There simply isn’t enough expertise in existence to go around, or enough education occurring to create it. In this environment, senior Information Security leaders are having to get creative in their pursuit of the people, performance, and passion necessary to address this capability shortfall.
4:40 pm - 5:20 pm
Best practice in most enterprises, at least as far as the CIO and CISO goes, is to squash Shadow IT wherever it is encountered. Shadow IT, the argument goes, leads to a world of data and integration problems for the IT department, and significant amounts of unknown and unquantifiable risk for the information security group. A small but vocal minority however is beginning to advocate for Shadow IT as a catalyst of innovation, citing the increases in productivity and creativity by allowing enterprise staff to find their own out of the box solutions to organizational problems. CISOs can allow their organizations to have their cake (Shadow IT) and eat it too (still be secure) by following a few simple steps that allow them to build in security regardless of user activity.
5:20 pm - 6:30 pm
6:30 pm - 8:00 pm
8:00 pm - 10:00 pm
7:00 am - 8:00 am
8:10 am - 8:50 am
For many years the CIO, has struggled with the concept of IT-Business alignment and finding ways to ensure that the IT department and the Lines of Business with which it integrates have a common understanding and ability to communicate. Now, as the CISO and the information security department grow out of the IT shadow, they increasingly find themselves in the same position. Their challenge however is greater in that the concepts of IT security are in many ways more abstract than those of generalist IT, and their activities often run counter to the goals of the rest of the organization. CISOs must learn for the trials and tribulations of the CIO and the IT department, and find common ground with the business, to ensure they can hear what their partners are saying, while communicating their own points in understandable terms.
8:55 am - 9:35 am
More and more C-level executives are realizing that cyber security is not just an IT function given the far-reaching and direct impact that cyber security threats can have on current and future business operations. As is evidenced in recent reports from security providers such as Mendicant, McAfee, SentinelOne and others, cyber espionage attacks by APT actors are breaching organizations both large and small, public and private. Whether the objective is Intellectual Property (IP), M&A information, financial records, or other business-sensitive protected data losses can result in significant brand, reputation, and financial impacts. To counter these risks, CISOs need to realize that traditional security techniques are insufficient, and that a new tier of security solutions are required to defend against the APT attack.
9:45 am - 10:15 am
In many ways ERM, or Enterprise Risk Management, has become just another buzz word that is bandied around without any clear understanding of its meaning, any clear understanding of its value, or any clear understanding of how it can be achieved. ERM is not a project or a task on a list to be checked off. Instead it is a fundamental change in how an enterprise approaches the way it conducts its business to ensure that all possible impacts to its capital and earnings are identified, quantified, and mitigated. Such a sweeping paradigmatic shift isn’t something that can be taken on lightly and enterprises seeking to just place a check mark next to a to do list line item will be sorely disappointed in their results.
Verizon’s 2014 Data Breach Investigation Report has recently been released, and the statistics, as they pertain to the public sector are nothing less than staggering as public entities reported over forty-seven thousand security incidents. A significant reason for this is US government agency reporting requirements that demand the reporting of even minor incidents, rules that other organizations do not have to comply with. More telling is that only Financial Services organizations suffered more incidents with confirmed data loss than various public entities. The messaging then is clear; the public sector is under sustained and concerted attack, and the need to take action has never been stronger. Join us as we discuss the nature of the challenges that afflict the public sector and explore strategies for dealing with the tidal wave of attacks.
10:20 am - 10:50 am
As with all things in life, the focus on how to conduct enterprise security ebbs and flows between varying degrees of reactivity and proactivity. In the old school “Security 1.0” world, where the focus was almost completely on network security, efforts were in general proactive in nature with firewalls and anti-malware seeking to prevent threats before they even occurred. This didn’t work so well and so “Security 2.0” focused on reactivity, wrapping things like encryption around the data so that even if a breach occurred, the loss would be mitigated. Yet breaches, and losses, continue to occur. So if primarily proactive security doesn’t work, and if primarily reactive security also doesn’t work, how then do we find the right balance between the two to find a security posture that does work?
10:55 am - 11:25 am
Social media is the least hyped and potentially least adopted of the so-called disruptive technologies, at least by enterprises in general. This doesn’t mean that employees are embracing these tools personally however, nor does it mean that enterprises should continue to avoid them. The fact of the matter is social platforms allow for incredible levels of interaction that when harnessed can lead to significant creativity and productivity gains allowing enterprises that adopt and encourage the use of social collaboration platforms to be more successful than their non-social peers. But every newly adopted technology brings with it unique problems and so it is the CISOs job to provide the secure landscape within which this social collaboration, both internal and external, sanctioned and not, can occur.
Of all the risk management issues that present themselves to the modern-day CISO, perhaps the most difficult to address is that of privacy. In and of itself, privacy is no different a challenge than protecting any other sensitive information, however the multi-jurisdictional impacts of the issue due to wildly differing laws between the US and European countries (as well as Canada, another country with strong privacy laws) make this an issue that is often times overwhelming to address. CISOs must work diligently to ensure that their privacy efforts conform with the standards of any jurisdiction with which they might work, where their data might be held and this is an almost overwhelming task.
11:30 am - 12:00 pm
Since regulatory (and industry) compliance became a notable “thing” in the early-mid 2000’s it has been intimately linked with information security and often times has been the lever (or hammer) by which enterprises made necessary investments in security. But being “compliant” and being “secure” aren’t the same thing, and in too many cases enterprises that were perfectly compliant have been perfectly breached. A new focus is needed; one that respects that while security and compliance are not the same thing, they are working towards the same goal (a reduction in overall enterprise risk exposure) and sees that compliance flows from security.
As enterprise IT is increasingly being delivered by mobile computing platforms, the nature of security threats, as well as the manner in which security is delivered is changing. Mobility pushes computing well beyond the traditional network perimeter meaning not only are new security paradigms are required to protect devices and data from direct threats, but the network itself from threats leveraged through those devices. While traditional security measures aren’t dead, by themselves they are certainly no longer sufficient, and IT departments must invest in new technologies, new processes, and new approaches to ensure sufficient levels of enterprise protection.
12:05 pm - 12:45 pm
The importance technology plays within an enterprise will only continue to gain momentum as more developers, engineers, and programmers enter the workforce. As these segments continue to grow, so does the diversity of the workforce within the technology field. For a field that is severely constrained by a talent and skills gap, this influx of bodies can only be a good thing. Beyond the basic ability to deliver of identified capabilities a diverse workforce, whether cultural or gender influenced offers a whole that is more than the sum of the parts. Finding ways to drive and increase diversity in IT then should be a key focus for every IT executive.
12:45 pm - 12:55 pm
1:00 pm - 2:00 pm