BrightTALK at RSA - John DiMaria: GDPR, Critical Infrastructure & IoT Security

If you are part of a security organization and noticing the constant resource competing with product feature development, you may have wondered how to further accelerate security work assigned to product teams. How can security best integrate with feature development to reserve engineering resources for security projects? Our team has developed an approach to provide clearer visibility into the security work that needs to be done. It also enabled us to be better aligned with the existing product development process.

In this webcast we Ningjing Gao, Principal Technical Program Manager for Security at Adobe, will talk about what we did to improve our processes and shared additional best practices that can help you make it more efficient and effective for product teams to build security into everything they do at your organization.

As attacks on software supply chains and critical applications not only continue but accelerate, we need to extend a next-generation zero-trust model into cloud workloads during runtime. To understand why runtime remains a choice target for threat actors, look no further than the recent SolarWinds and Microsoft Exchange server attacks. Both exploits executed undetected and undeterred in runtime, easily evading existing security measures such as threat hunting and EDR/EPP tools.

Zero trust is a powerful concept, but many think it only applies to users, devices, and networks. Implementing a next-generation Zero-Trust model, one that incorporates application-aware workload protection, can ensure that only the right code and processes can execute, regardless of the threat environment.

In their Market Guide for Cloud Workload Protection Platforms, Gartner specifically recommends extending zero trust security, stating: “At runtime, replace antivirus-centric strategies with “zero-trust execution.”
Join security experts from Virsec as they discuss the challenges of protecting an expanding attack surface area with cloud, hybrid, and container environments and detail the need for application-awareness and effective runtime protection. Get best practices for security implementations for workloads that ensure vulnerability protection with granular application control, system integrity assurance, and advanced memory protection at runtime.

If cloud environments are locked down by default and everything is already being logged, is cloud network traffic analysis really helpful? It turns out that even in the cloud, network telemetry data can ensure investigations are fast and hunts are conclusive. As we’ve learned from breaches like Sunburst, network telemetry provides essential evidence for catching threats other tools miss.


Join experts from Google Cloud Security and Corelight to learn how collection and analysis of cloud network traffic leads to better threat detection and response. We will discuss:
- Common misconceptions about network telemetry
- Cloud traffic monitoring use cases
- Solutions to implementation challenges

As the world changes, third-party risk management requirements change too. So, what can you expect in 2021? How can you prepare for what’s ahead? We’ve helped implement thousands of third-party risk management programs, and in doing so, we’ve seen how organizations’ needs have evolved. There are proactive measures you can take to stay ahead of the curve. But in order to execute against and adapt to these third-party risk trends, you need to first know what the future holds. In this session, we’ll answer the following questions:
What are the latest trends for third-risk management?
How your organization adapt to current and future trends?
What can you do to future-proof your third-party risk management program?
Where can you go to keep up-to-date with new third-party risk trends as they emerge?

Associations and trade unions asked the judge of the "Conseil d'État, the highest French administrative court - to suspend the partnership between the Ministry of Health and Doctolib, arguing that the hosting of vaccination appointment data by the subsidiary of an American company posed risks with regard to access requests by the American authorities.
This recent ruling by the supreme administrative court of justice could provide some guidance on developing a legal framework and establishing some technicals controls that could protect them from the long arm of European regulators and the fine they might levy - Some light at the end of the Tunnel for DPO and Cloud Service Provider (CSP) ?

A quick review of the importance of Cloud adoption and its impact in the Financial Sector, barriers and opportunities. Focus on the regulation requirements and particularly on what would be necessary in relation with the future Cloud Certification Scheme proposed by ENISA.

The cloud is more dynamic now than ever before. How do you keep up with development while thwarting off threats? Learn how to fend off threats and turning security into an enabling force behind enterprise digital transformation.

If you think that you are doing encryption right while remaining compliant with regulations like GDPR, you might be wrong. In this talk Frederik will cover various encryption controls including an application layer encryption approach that incorporates zero-trust principles for data access. If you are worried about your sensitive data staying safe in the cloud, this talk is for you.

EMEA Summit 2021 - NTT Data presentation

In this fireside chat, we hear from Greg Day, chief security officer for EMEA, who takes us through newcomers into public cloud as well as real-world transitions to put security into existing deployments. Talking across contracts and data sovereignty/analysis through to process consideration and consequences, Greg perfectly frames these, not as scaremongering, but instead with a pragmatic approach to security. Attendees will learn that whilst securing your cloud native workloads can be daunting, there are standard ways of putting your organisation in the right place. Lastly we get a glimpse into the future of securing workloads and how to be ready for that.

Enterprise IT environments are getting exponentially more complex with the booming adoption of cloud computing. To attain seamless security and compliance, the key is to shift to open cloud platforms that interoperate with each other.
This new model allows organizations to build security natively into their IT infrastructure, and to take a risk-based approach supported by an always updated global IT asset inventory. It’s the only way to have the scale, speed, accuracy, visibility and context needed to protect today’s hybrid and dynamic IT infrastructures.
As IT teams embrace cloud services, mobility, containers, DevOps and other innovations, the job of security teams gets harder, especially if they have a heterogeneous stack of tools that are difficult and costly to deploy, integrate and manage. With such a siloed and fragmented toolset, visibility into the IT environment narrows, tasks can’t be automated, false positives abound, and security teams struggle to detect and respond quickly to threats.
With an open cloud platform, organizations can replace their stack of legacy point solutions with a set of natively integrated, cloud-based security and compliance applications and services. The open platform has also offer a true risk-based approach to security, continuously balancing technology risks with business context.

In the wake of the COVID-19 public health crisis, many enterprises' digital transformations are on an accelerated track to enable employees to work from home. CSA developed and distributed a survey to better understand the current cloud security concerns, challenges, and incidents. In this webinar, Yitzy Tannenbaum, Product Marketing Manager from Algosec will cover the results including...
- current cloud adoption
- complexity of the modern-day network
- who's responsible for cloud security
- misconfigurations and outages

Since its debut in 2013, the Cloud Control Matrix (CCM) v3.0.1 has become the most comprehensive and globally adopted security framework for assessing security risk of cloud providers. With the emergence of new technologies and the evolution of the cloud certification landscape, CCM needs to reflect this continuous change. Through the commitment and collective knowledge of 18 teams led by highly experienced cloud security experts, CCM v4 is now available with significant updates to the previous version. This session will provide a presentation and overview of: - CCMv4 domains and new control requirements, - A draft version of the new CCMv4 “implementation guidance”, - The new Shared Security Responsibility Model (SSRM) controls for helping CSPs and CSCs delineating CCM controls implementation responsibilities, - The enhanced Consensus Assessment Initiative Questionnaire (CAIQ) v4.0 following the upgrade to CCMv4.0, - Mapping exercises of CCMv4.0 to other well-known standards, as performed by the CCM WG, - The latest activities for the development of CCMv4.0-Lite.

*Introduction music by: Bensounds.com

Panel Discussion

Security and privacy are twins when it comes to providing tools to secure the users' data. However, they are un-identical twins; they are different. Security relates to the protection of data from threats, such as hackers, while privacy encompasses how personal data is collected, managed, stored and shared. Enterprises today are realizing the importance of both, since business impact will be immense if these issues are ignored.

MODERATOR : Tze Meng TAN (Head of Data Cloud Department, Digital Infrastructure and Services Division, MDEC)
PANELISTS:
- Madhav CHABLANI (Chairman, CSA NCR Chapter & Consulting CIO, TippingEdge Consulting)
- Riwzi WUN (Partner, RHTLaw Asia)
- Sarbojit M BOSE (Education Director, CSA Singapore Chapter & CCSK Instructor)

How privacy & security professionals can cooperate to achieve better compliance with laws & standards, reduce risks & costs to their organization

The pandemic has caused drastic changes in the way in which most entities operate. In this new ecosystem, cloud services have become the primary source of computing and processing capabilities. Increased use of cloud services requires increased workforce to manage and operate these systems, and ensure that compliance requirements are met and best practices maintained. Cloud services encompass numerous privacy and security issues. At a time when privacy and security professionals are scarce, organization may help increase efficiency and do more with less if they can encourage privacy and security professionals to cooperate in their tasks.
In this session we will discuss some of the new privacy and security issues that cloud users and providers may be facing, and how cooperation between privacy and security professionals might help increase efficiency.

The presentation will look at obligations and desired responses arising from data breaches.