IT Security Insights 2021

ISO 27000 series requires risk assessments and an asset register linked to classification also plays a big role. Assets are key for both these activities but what approaches to assets would yield great results for the organization today?

Key Takeaways:

• What was behind the “system” approach?
• What assets should we protect today?
• How does this affect the classification schemes and risk assessment approaches?
• All in context of an organization that wants to benefit from using ISO 27000 series

Since the Court of Justice of the European Union’s ruling in "Schrems II", companies have been eagerly anticipating detailed guidance from regulators in how to manage EU data transfers to third countries, and particularly those that rely on standard contractual clauses. Those recommendations have now been released by the European Data Protection Board, as well as new SCCs by the European Commission.

Key Takeaways:

• The presentation will discuss how to take a risk-based approach to the EDPB’s guidelines, an overview of the new SCCs, and the way ahead for international data transfers

Powered by necessity, 2020 saw a gigantic boost for digital strategies. This helped to maintain critical services through online availability but it also gave new incentives for cyber criminals claiming their share of the profit. In this session, Gerdhard will share the latest threats the world has been experiencing, and explain how corporations managed to recognize fight them.

Cyber crises or crises with digital aspects are increasingly becoming potential scenarios for various organizations. This development must be considered by crisis management and response groups as well as leadership in any organization. In this session, Sarah Backman introduces 5 steps for developing or improving organizational capacity to efficiently deal with cyber crises.

In this live workshop, learn how Zero Trust and Least Privilege Can Secure Access to Your Critical Resources. With the majority of large organisations using Active Directory (AD) and Azure AD (AAD) to control user permissions and access, it is a primary target of attackers. With the rise of privileged access management (PAM) as an aspect of functions that AD/AAD controls, PAM must be a critical part of any operational and security strategy for privileged resources.

Key takeaways:

• How to enhance privileged security for your hybrid AD environment
• What is Zero Trust
• How to achieve Zero Trust by using just-in-time activation of privileged accounts and entitlements
• In addition, you will see a demo of Zero Trust from One Identity.

Network Security as-a-service:

One of the most profound shifts we've been hearing about is that legacy appliance-based approaches, that our customers around the globe are using to secure their networks, aren't working anymore. Evolving your network for remote work has opened it up to risks.

Key Takeaways:

• Join Cloudflare's session to discover how delivering network security at the edge - not data centers - can better protect your applications, your data, and your users.
  

The cybersecurity landscape has evolved significantly from the earliest days of AVprotection in the 1990s. Business customers can now choose from a variety ofoptions to architect a security stack, including vendors in the EDR, MDR, and XDRspaces. But what do these acronyms mean and how do they differ? And, more importantly,what benefits do they offer to enhance your existing security posture and to preventcyberattacks and the loss of business-critical data?

Key  Takeaways:

The CSA Cloud Controls Matrix (CCM) is a cybersecurity control framework for cloud computing. In this session Surinder will  discuss how this framework can be used to help improve security posture of the respective cloud environment with clear roles and responsibilities.

Keynote Background:

All around us, we see organizations (temporarily) bite the dust in the battle against criminals. Their operations halted, data held ransom or worse: published. At NCC Europe’s incident response practice, we help organizations fight the good fight on a daily basis. We experience up close how ransomware attacks evolve, and are continuously reminded of the ruthlessness of the attackers, notwithstanding their attempts at public relations through feel good interviews. In this talk, Erik will talk you through ransomware’s evolution of the years, the latest tricks up criminals’ sleeves and the most common points for improvement that we identify among our customers.

Key Takeaways:

•  If AI is not self-aware, are computers truly still fast enough that they can build a complete picture of what is normal and respond and block in real time what is not normal from a cyber perspective?
• Can this approach work and how? Is AI able, on a network level, to provide a new and truly unique layer of cyber security?
• Are there real examples of actual recent ransomware software strains and how AI defeats it in real time using anomaly detection and AI blocking?