CISO Says: Interview with Ivan Holman, Group Information Security Officer, EWI

BitSight’s Peer Analytics allows organisations to understand their security programme performance at a more granular level, providing visibility to develop achievable improvement plans, allocate resources appropriately & consistently measure outcomes.

In this session you will learn how to:
• Determine the level of security performance that your company should attain to be ‘best-in-class’
• Profile organisations for communication and benchmarking purposes.
• Understand how specific risk vectors drive security performance.
• Determine the initial conditions for BitSight Forecasting

Join the Guide to Your (ISC)² Membership in EMEA webinar to learn more about these topics and others including:

- CPE opportunities, member benefits and getting involved
- Updates on (ISC)² news, developments and changes in your region
- Your membership requirements summarized
- Who are the (ISC)² EMEA team and how we can help you
- Focus discussions
- Q&A session

If you ask Gartner about the problems with today’s EDR technologies, they will say most solutions don’t deliver EDR capabilities in an operationally feasible or complete manner.

The purpose of an EDR solution is to provide advanced detection & response capabilities to complement an EPP solution. At SentinelOne, we deliver the very best of EDR & EPP in a highly differentiated manner and in one single lightweight agent.

Join us and learn about a new EDR- Active EDR - a new world of EDR capabilities and user experience. Explore how to:

- Eradicate benign alert noise, focus on what’s important.
- Optimise threat hunting time with curated and focused story lines.
- Maximise staff efficiency and let staff become expert threat hunters.

Traditional methods of filtering traffic have relied upon a knowledge of the network and transport behaviours of the applications running across the network. Whilst most applications being run across the network use standard ports, many threat actors will use methods to obfuscate their communications by abusing these standards, with port spoofing being one such example. This represents a challenge when gathering traffic to ensure that this simple evasion method does not create a blind spot to your security countermeasures.

Join us for this webinar to learn more about how you can:

•Ensure that the Application traffic regardless of port spoofing gets to the right tool
•Improve tool efficiency by discarding irrelevant Application traffic
•Filter the traffic based on the application rather than the IP & Port

DNS is a ubiquitous network service which has a front row seat when it comes to malware activities. Most organizations neglect to consider the scale and simplicity of using DNS as a visibility and control point. DNS servers are also home to a wealth of essential operational data that can accelerate incident investigation.
This session will discuss the role that DNS could and should play in security architecture and operations as well as identify how DNS itself is increasingly used as an attack vector by malicious actors.

Encrypting data-in-transit with SSL/TLS is standard practice among organisations today. Important security initiatives, such as built-in web browser warnings and stronger legislative GDPR changes, have significantly improved privacy awareness and helped to prevent data breaches. However, cybercriminals commonly hide threats within encrypted payloads and use encrypted channels to propagate malware and exfiltrate data, knowing they can bypass traditional security inspection solutions.

Join us for this webinar to learn more about:

• Challenges with encrypted traffic and risks to your business
• How to efficiently decrypt and orchestrate traffic to reduce latency
• How to intelligently manage decryption and re-encryption across your entire security inspection solutions (IPS, NGFW, DLP, WAF, Anti-Malware, etc.)

New year. New resolutions. Every year we make the pledge to eat healthier and exercise more. What is good for the waistline is also good for your phishing defense posture. With more than 90% of breaches attributed to successful phishing campaigns – now is the time to think about how to prepare and prevent attacks. In this session you’ll hear about 10 resolutions for your phishing defense programs that will make your organisation more secure.
Some of the topics covered include:
- How to empower humans to be part of the solution
- Best practices to balance automation with human intuition
- How the latest features and technologies can make your life easier

Every organisation can, and at some point will be breached. Gone are the days where investing only in preventive security technologies such as firewalls, endpoint protection and proxy servers were considered ‘state-of-the-art’. Instead, security best practices have evolved to build capabilities that detect attacks early, and to respond if all detection and prevention measures have failed. Today’s modernised approach is essential in helping the business recover quickly after a major attack - and helping the CISO keep their job.

So, your technologies have evolved, but has your approach to data collection? Do you have the right data for detection and response - or do you need to adapt for the future?

Join this webinar with Splunker, Matthias Maier to walk through 20 security use cases already used by leading organisations. You’ll hear the most relevant questions for each use case, and discover which device or application within your infrastructure can be used to find the answers. Forty minutes later, you’ll be set to take away your learnings, validate them in your own environment, and identify the most relevant gaps that need to be addressed for your business.

Security incidents such as malware infections can cause damage and disruption that propagates far beyond the organisation, affecting its reputation, brand value and customer loyalty.

Security ratings are impacted by these, giving an independent view into potential areas where security resources could be focused.

In this webinar, Tiago Pereira from BitSight will explain how and why botnet infections are a key metric of the effectiveness of your security posture, discuss their impact on external security ratings and how to effectively deal with infections affecting your organisation's rating.

Join the Guide to Your (ISC)² Membership in EMEA webinar to learn more about these topics and others including:
- CPE opportunities, member benefits and getting involved
- Updates on (ISC)² news, developments and changes in your region
- Your membership requirements summarized
- Who are the (ISC)² EMEA team and how we can help you
- Focus discussions
- Q&A session

Organisations today rely on their business-critical applications and literally cannot function without these systems. They are the heartbeats and nerve centres of the modern enterprise, the fulcrums on which supply chains, operations, accounting, HR, payroll and e-commerce depend. No wonder then that these tools and the data they generate are also being targeted by attackers keen to bring their targets to a standstill. But most of time companies are failing to protect these ‘crown jewels’ assets and they rely instead on a paradigm from the last century: focusing on perimeter security and generic defences that don’t prioritise or protect the most important tools and services.

Tune in to this webcast to hear about exclusive new research data on the state of modern security defences and get expert advice on how to protect your most important systems.

Most organisations have multiple products and services, from multiple vendors and suppliers to address their cybersecurity needs. The lack of integration and inability to share critical information results in silos of technology that cause inefficiency, lack of agility, limited visibility and a poor security posture. How can an organisation solve and streamline this improve their cybersecurity operations? Join Infoblox and (ISC)² for an examination of how Infoblox and Fortinet have joined together to assist organisations in improving their security operations and reducing time to containment.

CrowdStrike’s latest Cyber Intrusion Services Casebook continues to shine a light on how quickly attackers can gain access into an organisation. This webcast, drawn from real-life engagements from the past 12 months, takes a deep dive into the advanced and ever-evolving tactics, techniques, and procedures (TTPs) used by today’s most dangerous attackers.

We’ll discuss the following key trends:

-There is no slowdown in adversaries’ invention and brazenness
-Attackers operate quickly and at depth — waiting patiently to achieve their objectives
-Attackers are often hiding in plain sight

After years of debate over whether to impose new cybersecurity regulations on companies, the General Data Protection Regulation (GDPR) went into effect in Europe in May 2018. Already we’re seeing data breach victims ordered to pay fines under the new rules, and cookie disclosure notices are popping up on more websites than ever.
But what about the bigger picture: Is GDPR working? How would we know? We'll explore these and other issues, including an examination of what the data tells us as well as stories from GDPR implementation.

During episode 1 in our Trust No One Series, we heard about the origins of Zero Trust. Episode 2 showed us how Banco Santander started their Zero Trust journey.

In this Part 3, Duo will demonstrate how they deliver Zero Trust models to their customers.
You’ll leave with a hands-on basic understanding of how to deploy Duo to a cloud-based web-application.

Duo has been a pioneer in bringing Zero Trust models to the commercial market, allowing organisations to protect themselves quickly and easily.

Josh Green, Solutions Engineer, Duo Security
Richard Archdeacon, Advisory CISO, Duo Security

In the third of the series exploring BitSight Security Ratings, we will be focusing on the challenge of third party supplier risk management:

- How can we manage suppliers using the dimensions of inherent risk impact and residual risk appetite?
- How can we place suppliers cyber risk posture into context of our business?
- How can we continuously monitor and remediate according to sensible risk prioritisation?

Bob Lewis (former head of External Cyber Assurance and Monitoring, Barclays UK) will be discussing real life examples with Nick Trigg from BitSight.