/uploads/2018/09/logo-4th.png)
Save the date for the 4th CISO 360 Congress 2020!
17-19 June 2020, VP Plaza Espana Design – Madrid
Read more about 4th CISO 360 Congress in Madrid here
See highlights from the 3rd CISO 360 Congress
Registration is now closed
Connecting minds to build global resilience and trust in cybersecurity
From 19-21 June 2019, CISO leaders from around the world united in this trusted space to benchmark progress and challenges on cybersecurity priorities in the wonderful city of Rome for the 3rd CISO 360 Congress. The programme was designed to enhance interaction and facilitate discussion around the key challenges and critical topics confronting CISOs and leaders in technology and business in a ‘closed door’ environment. Benchmark approaches, strategies and tools to pre-empt the emerging opportunity and risk horizon. What are role expectations and business technologies we should expect in the years to come? What can be learned from perspectives beyond the security sphere?
- 2.5 action-packed days – to benchmark and network with CISO peers
- 55+ speakers – truly international speaker panel who was hand-picked to share their experiences
- 360 perspectives – taking CISOs beyond the security ‘echo chamber’
- Trusted partner ratio – reputable providers to the security industry who have agreed not to talk product and who will add genuine value to the discussions
- Only one Rule – CISO 360 Congress was held under The Chatham House Rule. No press was in attendance
- Pulse Innovate Report – written by a Pulse professional Editor will be shared after the event to capture the key points (unattributed) – a useful tool beyond the event itself!
Main themes for Rome 2019
- Cyber defence, privacy and trade-offs – geopolitical, economic and cybercrime threats in a VUCA world
- Digital innovation and security by resilience – CISO and CIO as enablers of business innovation
- Cybercrime, intelligence and response strategy – prevention; remediation; offensive security; intelligence
- Security culture, privacy and data explosion – identities, culture and trust
- Supply chain, operational resilience and security – risk and governance; the supply chain in crisis
- Talk to the Board, investment and IP leverage – opportunities in cybersecurity for business value
International Speaker Panel 2019
Chaired by
- Marcus Alldrick, Former CISO, Lloyd’s of London. Currently Senior Advisor Risk, Compliance – Congress Chairman
- Prof. Dr. Robert Coles, Visiting Professor, Royal Holloway, University of London – Roundtable Chairman
Keynotes
- Caspar Berry, Professional Poker Player (UK)
Challenging the Way we Think about Risk Taking and Decision Making!
- Jim Hinton, Founder, Lawyer, Patent & Trademark Agent, Own Innovation (Canada)
Cybersecurity and Intellectual Property: How can we leverage IP within cybersecurity to add business value?
- Ken Munro, Security Writer, Car Hacker and IoT Destroyer!
How Supply Chain Flaws Become Endemic
- Dr. Victoria Baines, Visiting Associate, Oxford Internet Institute (UK)
What can exercises in future thinking tell us about the cybersecurity and international diplomacy challenges that we need to prepare for?
- Dvir Rubinshtein, Aviation Security Operation Center Manager Security, Emergency & Cyber Division, Israel
Cyber Resilience for the Aviation Sector to Enhance Overall Cyber Preparedness
- Michael Colao, CISO/Head of Security Function, AXA
Governance of the Source: Private Equity Risk in the Cybersecurity Supply Chain
International Speaker Panel (Speaker bios here)
- Adam Drabik, CISO, Opel Vauxhall Finance (UK)
- Aftab Afzal, Co-Founder & CRO, CyberCyte (UK)
- Amy Lemberger, Cybersecurity Director, GSMA (UK)
- Andrew Mabbitt, Director, Fidus Information Security (UK)
- Ben Bulpett, EMEA Identity Platform Director, SailPoint (UK)
- Ben Jeffreys, Senior Executive, Nominet (UK)
- Professor Ing. Claudio Cilli, Dipartimento di Informatica, Università degli Studi di Roma “La Sapienza” and President, ISACA Rome Chapter (Italy)
- Colette Hanley, Global Head of Privacy, Nokia Group (UK)
- David Cripps, Frmr CISO, SETL and Investec (UK)
- Dawn M Jackson, Global Cyber Threat, Intelligence Manager, Willis Towers Watson
- Des McGuckian, IT Project Manager, Transport for London (TfL) (UK)
- Dvir Rubinshtein, Aviation Security Operation Center Manager & Aviation Security Expert, Security Division, Israel
- Edvinas Pranculis, Vice President, Global Sales Operations | Data Protection Officer (DPO), SOC Prime (Lithuania)
- Dr Eduardo Solana, Senior Lecturer of Cryptography and Security, University of Geneva (Switzerland)
- Edward Ayman Ganom, Head of Information Security, The Commercial Bank (P.S.Q.C) (Qatar)
- Fabian Libeau, VP, EMEA, RiskIQ (UK)
- Friedelien Brockerhoff, General Manager: Group Information Security Program, MTN (South Africa)
- Gadi Evron, Chairman of the Board, Israeli CERT (IL-CERT) (Israel)
- George Eapen, Global CISO and Head of Cyber Security, Petrofac (UAE)
- Graeme Cantu-Park, Head of Global Security Operations, The Hut Group (UK)
- Irene Corpuz, Manager, Strategy and Future Department, HCT and Board of Advisors, OWASP Middle East (UAE)
- James Gosnold, Head of Cyber Technology Services, Department of Work and Pensions (DWP) (UK)
- James Linton, Threat Researcher, Agari (UK)
- Joel Stradling, Research Director, GlobalData (Spain)
- Justin Shaw-Gray, Director UK&I, Synack (UK)
- Lee Barney, CISO, Retail/eCommerce (UK)
- Lee Cartmell, Group Chief Information Security Officer, Stagecoach Group (UK)
- Marc Lueck, CISO, Zscaler (UK)
- Marco Misitano, President, (ISC)2 Italy Chapter (Italy)
- Mariana Pereira, Director, Darktrace (UK)
- Mark Ampleford, Head of Security Division, Barclay Simpson (UK)
- Márk Félegyházi, CEO, Avatao (Hungary)
- Mark Snel, CISO – Information Security and Corporate Security, Signify (The Netherlands)
- Martyn Booth, CISO, Euromoney Institutional Investor PLC (UK)
- Matt Middleton-Leal, GM EMEA & APAC, Netwrix (UK)
- Necati Ertuğrul, Founder & CTO, CyberCyte (UK)
- Lady Olga Maitland, Chairman, Copenhagen Compliance (UK)
- Olivier Pfeiffer, Head of Finance and Critical Infrastructure Markets, ID Quantique (Switzerland)
- Paul Brucciani, Head of Commercial Business Development, UK, Garrison Technology (UK)
- Paul Heffernan, CISO, Revolut (UK)
- Paul Hopkins, Global Head Cyber Strategy & Secure by Design, Vodafone (UK)
- Paulo Glórias, Regional Director, BitSight (Portugal)
- Riccardo Bianchi, Global BUIT, Chief Information Security Officer, DHL Global Forwarding (Germany)
- Richard Matti, Director, NetClean (Sweden)
- Richard Davis, Global Cybersecurity Strategy, ProofPoint (UK)
- Rich Turner, VP EMEA, CyberArk (UK)
- Rob Robinson, Director of Security and Network, Company85 (UK)
- Robert Shaw, Senior Security Advisor, United Nations
- Dr Sally Leivesley, Director, Newrisk Ltd, A Founder Member, The Exercise Group7 (TEG7) (UK)
- Simon Legg, Group CISO, JLT Group (UK)
- Tim Varkalis, Group Security – Threat Intelligence Lead, AXA (UK)
- Tom Gamali, Group Chief Information Security Officer & Global Head of Business Resilience, Abdul Latif Jameel Company Ltd (Kuwait)
- Dr Stefano Zanero, Cybersecurity Professor and Entrepreneur, Politecnico di Milano
- Dr Victoria Baines, Visiting Associate, Oxford Internet Institute (UK
- Dr Vasileios Karagiannopoulos, Senior Lecturer in Law and Cybercrime, Institute of Criminal Justice Studies, University of Portsmouth (UK)
- Vipul Asher, Privacy Consulting Manager, OneTrust (UK)
Trusted benchmarking, networking and practical case uses for cybersecurity leaders…
Designed in the knowledge that who you meet can be just as important as what you learn, drinks receptions, breakfasts, coffee breaks, prize draw and extended lunches enable delegates to network with industry leaders and put themselves at the heart of discussions alongside those who make the world’s cybersecurity go around!
Our key differentiators include:
- Fully immersive agenda – exciting debates, think tanks, roundtables
- A truly international and multi-faceted speaker panel – we bring together CISO to CISO benchmarking; non security perspectives and influencers and the supply chain community
- Trust-based community meeting in an inspiring and open sharing environment
- CISO 360 networking experience – see details of the dedicated receptions, dinners, cultural activities. Enduring connections are guaranteed.
- Natural integration between inhouse security, supply chain and technology innovators – we are part of the same jigsaw!
View Pulse Educate Training Courses
Thank you to our Sponsors of the 2019 CISO 360 Congress
Platinum
/uploads/2017/11/T-Telstra-L-Pos-Blue-CMYK.png?width=320&height=100&name=T-Telstra-L-Pos-Blue-CMYK.png)
Gold
/uploads/2018/09/CYBERARK-horizontal-logo_RGB_300dpi.png?width=499&height=100&name=CYBERARK-horizontal-logo_RGB_300dpi.png)
/uploads/2018/09/Agari-logo-png-cropped.jpg?width=463&height=100&name=Agari-logo-png-cropped.jpg)
Silver
Bronze
Lunch Sponsor
Panel Sponsors
Exhibition Sponsor
Supporting Associations
Security training – 3rd CISO 360 Congress, Rome
Pulse Conferences is offering 2 half day security refresher courses in the afternoon on the 19th June 2019. Please view the course outlines below.
Pricing
- Price per course: £1,000 + VAT
- Special 5-day package (before 12 April 2019): Congress + 1 Course: £2,000 + vat (save £200!)
- Special 5-day package (after 12 April 2019): Congress + 1 Course: £2,500 + vat (save £200!)
Book for your Security training course and 3rd CISO 360 Congress here
- Crisis Management and Supply Chain Resilience
- Security and Resilience Leadership
Crisis Management and Supply Chain Resilience
Crisis Management and Supply Chain Resilience
Sally has a UK Home Office background and trained as a Scientific Advisor to respond to all aspects of nuclear attack and chemical, biological and radiological events. She plans, directs and participates in major exercises concerning critical components of industry and specialises in testing catastrophic threat impacts on critical functions of business. She has experience in all phases of risk assessment, planning, crisis management and post-loss recovery including psychological interventions in communities post-disaster. Sally is a respected media adviser on public protection and is a member of the Register for Security Engineers and Specialists (RSES).
About the Instructor
Dr Sally Leivesley PhD Lond., MSPD, BA(Hons) Qld., FICPEM, FRSA, MACE, MIABTI, Director, Newrisk Limited and TEG7 LLP
/uploads/2017/09/dr-sally.jpg)
Sally has a UK Home Office background and trained as a Scientific Advisor to respond to all aspects of nuclear attack and chemical, biological and radiological events. She plans, directs and participates in major exercises concerning critical components of industry and specialises in testing catastrophic threat impacts on critical functions of business. She has experience in all phases of risk assessment, planning, crisis management and post-loss recovery including psychological interventions in communities, post-disaster. Sally is a respected media adviser on public protection and is a member of the Register for Security Engineers and Specialists (RSES).
Security and Resilience Leadership
Security and Resilience Leadership
Robert is a security, intelligence and EOD executive with a UK Military background. He has broad strategic and operational experience and has advised senior staff, diplomats and government officials on aspects of security, intelligence, threat analysis, crises management, and resilience strategies. He has been the UN Security and EOD Advisor; Liaison officer for the UNMAS and UNOPS and has experience with NATO, the GCC, African Union, OSCE, EUPOL, FCO and others. Robert is a respected expert, has specialist research background on suicide bombing and has provided thematic briefs on worldwide security issues relevant to UNMAS/UNOPS missions.
About the instructor
Robert Shaw, Senior Security Advisor, United Nations
Robert Shaw is a security, intelligence and EOD executive with a UK Military background. He has broad strategic and operational experience and has advised senior staff, diplomats and government officials on aspects of security, intelligence, threat analysis, crises management, and resilience strategies. He has been the UN Security and EOD Advisor; Liaison officer for the UNMAS and UNOPS and has experience with NATO, the GCC, African Union, OSCE, EUPOL, FCO and others. Robert is a respected expert, has specialist research background on suicide bombing and has provided thematic briefs on worldwide security issues relevant to UNMAS/UNOPS missions.
Supporting Associations 2019
/uploads/2018/09/ISACA-Rome-logo-from-web.png?width=200&height=200&name=ISACA-Rome-logo-from-web.png)
As an independent, nonprofit, global association, ISACA engages in the development, adoption and use of globally accepted, industry-leading knowledge and practices for information systems. Previously known as the Information Systems Audit and Control Association, ISACA now goes by its acronym only, to reflect the broad range of IT governance professionals it serves.
Visit here
/uploads/2019/04/Official-Chapter-Seal.jpg?width=200&height=200&name=Official-Chapter-Seal.jpg)
The (ISC)² Italian Chapter provides thought leadership and guidance for security professionals in Italy. As the only official (ISC)² course provider in Italy, the Chapter hosts official trainings for Security Leaders as well as networking opportunities and knowledge sharing.
www.isc2chapter-italy.it
In Search of Answers to Big Questions
Written by our inhouse resident editor, Lyndsay Turley, an experienced communicator and cybersecurity advocate for over 15 years.
/uploads/2019/05/Supply-Chain-angst-%E2%80%93-blog-photo.jpg?width=1300&height=571&name=Supply-Chain-angst-%E2%80%93-blog-photo.jpg)
The World will be listening in Rome, send your thoughts within a 60-second video. Be a part of the CISO 360 Video Panel
CISO 360 Video Panel
For over 15 years I have been an active participant in the development of the information and cybersecurity profession. Recognising its unique position as one of the first areas of practice to emerge on a global scale, I have enjoyed the opportunity to watch it evolve beyond its technical roots and begin to take its place as a core competence within organisations today. This is of course an evolution that is far from complete, and there is as much if not more activity aimed at defining what it means to be a cybersecurity professional today as ever. The big questions driving such activity today tell an intriguing story of how far it has come.
For example, in the early days of my time working with (ISC)2, a nonprofit professional certification organisation, I asked members if they considered themselves to be an IT professional or a risk professional. The answer was always split down the middle. I suspect that this remains the case today as people find themselves pursuing opportunities across managerial, operational and specialist areas. Today many people tell me that they profess to be both. We also often sought to answer how they should support ‘the business’ and demonstrate a return on investment. These two questions haven’t gone away, but I have noted they are being superseded by others that suggest the profession is assumed to be doing this already. In addition to the traditional focus on the changing vulnerability and threat landscape, we are increasingly (and perhaps finally) engaging in high-level discussion with the potential to drive, rather than just react to the environment in which we are working.
Cyber security, risk and governance professionals are moving from protecting to also ensuring that security is embedded in the technologies and trends that are driving digital transformation today; its experience extends to tackling geopolitical, and business and economic, as well as criminal concerns. This has been illustrated by the questions shaping the discussions at the Pulse CISO 360 conferences and round tables that I have attended over the last 12 months. And given the ability to speak freely afforded by the events being staged under Chatham House Rule, they have prompted some lively debate.
One example – What responsibilities does the CISO have in driving Innovation?– had the 70 CISO’s participating in the Talk to the Board conference last November reviewing their commonly defensive stature with vendors and considering a more open approach to the innovation process. Delegates at the subsequent Artificial Intelligence (AI) and Machine Learning round table in March helped me see the reliance on such a dynamic: real-world corporate data is needed for AI to meet the expectations of a cyber security community struggling to manage the complexity they face today. This is a discussion that Pulse will be continuing at the 3rd CISO 360 Congress in Rome June 19-21.
Another example – should technology be a strategic concern within international diplomacy– is also set to be discussed at this year’s CISO 360 Congress. The international dominance and lack of governance of social media platforms and tech giants has become a diplomatic football over the last year as countries question each other’s decisions to invest in technology suppliers. Debate will draw out the depth of understanding from the Pulse community around the ethical, commercial and diplomatic concerns that are now only beginning to be explored within mainstream media. It aims to produce insights that can be of value and influence beyond professional practice.
Given the strategic importance of these debates, Pulse is working to open them to a wider audience. Following a leading example from the World Economic Forum, everyone active and interested in cyber security, risk and governance is invited to pick one of our Big Questions and send their thoughts within a 60-second video. These include:
should technology be a strategic concern within international diplomacy?
What responsibilities does the CISO have in driving Innovation?
How can we assure AI/ML augments a more, rather than less secure world?
How can we manage in a world plagued by disinformation?
Responses will be featured here and at the CISO Congress as they help to progress the global discussions that are taking place. You don’t have to attend Congress to participate, just have an opinion that you are happy to share.
The World will be listening in Rome, I encourage my colleagues in the industry to have their say.
CISO 360 Video Panel
On the Pulse
Unpicking the Barriers to Artificial Intelligence in Cybersecurity
Frank insights from our conferences and delegates.
Written by our inhouse resident editor, Lyndsay Turley, an experienced communicator and cybersecurity advocate for over 15 years.
/uploads/2018/09/London-film-museum-bond-car.png)
Cybersecurity has been an intense area of focus for the development of Artificial Intelligence (AI) capabilities as an opportunity to gain control of skills shortages, the overwhelming volumes of data involved, and the ever-changing threat landscape. Earlier this year, Pulse worked with Blackberry Cylance to host the AI 360 Roundtable, where 40 chief information security officers (CISO) and other cyber security leaders gathered at the London Film Museum’s Bond in Motion exhibit to examine the impact machine learning and artificial intelligence (AI) is having on their work. The case histories shared on the day and covered in the latest Pulse Innovation Report revealed projects that are delivering promising results and that ambitions for the technology are high. However, there was also a healthy dose of cynicism, and a few barriers preventing companies from investing significantly.
I believe these barriers—which reveal more about the state of cybersecurity management than they do the advancement of the technology itself –became the most useful insights to emerge on the day. Delegates shared experiences with competitive forces and siloed ambitions drawing on the research and development budget; a lack of business-level sponsorship; and poor visibility into the complex environments in which AI could be useful. Ironically, the complexity and volumes of data that cyber leaders are grappling with today, had those deploying it recognising that companies need to take a leap of faith and deploy AI to build a picture of the value it could deliver.
The key technical concern, AI’s ‘black box syndrome’ whereby the tech produces outcomes but does not explain the processes or logic behind them continues to undermine our security leaders’ trust in the ability of machines to make the right decisions. It was interesting however to see this concern fade as the discussions developed:
“It shouldn’t be too surprising that a room full of technology risk and security leaders, trained to question and anticipate problems, would express a reticence to trust AI. Our group was particularly concerned that AI does not offer an explanation of its logic; it just produces results and it can be difficult to just accept them,” writes Blackberry Cylance‘s Anton Grashion, within the event’s official report. “Those of us who work with AI hear this a lot: We also find that people are unclear about what they want to have explained, or why they want an explanation. … the need for explanation became less of a concern as the discussion turned to examining the specific challenges to which AI could be deployed. With very narrow AI applications – to stop malware, for example – the explanation of what is happening was accepted. In other areas, the outcomes seem to negate the need to understand how they were reached.”
Overall, there were few in the room who denied the inevitability of AI advancing to support complex analysis as case histories reveal insights that haven’t been possible with human analysis alone. The group also admitted this was demonstrating a very real and current risk of relying on that human analysis.
Insights shared suggest AI is demonstrating genuine opportunity to cope with the relentless pace of change, volumes of unstructured data, and the ongoing development of complexity within corporate environments. But it’s technology that works in a highly contextual way, reflecting and evolving with the environment in which it is operating. Corporate cybersecurity and risk managers won’t be able to just sit back and wait for the technology to mature; they’ll have to invest in the time, budget and creative thinking needed to play a more active role in its development.
Download the full report_ AI 360 Roundtable Pulse Innovate Report
Lyndsay Turley
May 2019
Pulse will be continuing this conversation as part of its annual 3rd CISO 360 Congress in Rome June 19-21. Join keynotes, case studies and panel discussions in Rome to benchmark with fellow CISOs on practical case uses of AI and ML for cybersecurity. Learn more about how you can join us and contribute within a confidential, professionally-charged environment.
Official Video – 3rd CISO 360 Congress 2019
Quantum Risk : Benchmarking the Discussion
By Dr. Eduardo Solana, University of Geneva
/uploads/2019/06/3rd-CISO-360-for-events-calendar.jpg?width=1300&height=434&name=3rd-CISO-360-for-events-calendar.jpg)
Quantum computing is one of those horizon scanning topics that almost always comes when chief information security officers (CISO) and other cybersecurity leaders get the chance to look to the future. These conversations tend to focus on understanding when, practically, computer scientists will have developed the capacity to build a quantum computer able to knock out the current levels of encryption that are so widely relied upon today.
It’s a question that has been asked for quite a long time: I first heard it over 20 years ago, when I started my own research into the subject. Today, there are a fair few who speculate that it will be a matter of years not decades, maybe even months. Of this I am not so sure. I am clear, however, that the time has come for a dedicated discussion on the impact of Quantum Computing on Cybersecurity—including the influence it may or should already be having today. I am pleased therefore to have the opportunity of staging it at CISO 360 Congress 2019, alongside my industry colleague Dr. Gregoire Ribourdy, CEO, ID Quantique. Our aim is to focus on the developing technology and inherent risks, not necessarily the often explored ethics concerns, within an interactive debate on Quantum Proofing IT Infrastructure, and there are plenty of questions to consider.
For cybersecurity quantum technology is developing as a double-edged sword. Advances in Quantum technologies have already been made to allow the generation of high-quality random numbers based on quantum entropy, for example for encryption key generation. Quantum physics is also already being applied to future-proof key distribution for symmetric encryption solutions, with deployments happening today. Such technical advances offer the opportunity to strengthen our capacity for security. Alongside these developments, however significant levels of investment continue to be poured into the research-driven development of that quantum computer, most of it by large global companies that treat it as an R&D prize. The question of when it will arrive is likely to remain a difficult to predict, closely guarded secret, but few doubt its inevitability.
It’s fair to say that anticipation of this arrival is already having an impact today. It is for example increasingly believed that traditionally encrypted data is already being hoovered up by those with an interest in it, whether that be potentially legitimate or otherwise, for when the quantum computer will be available to crack the encryption. I am also hearing rising levels of concern about industry sleep walking into the quantum era, creating a gaping window of opportunity for significant levels of attack before the quantum solutions needed to thwart them are more widely deployed.
There is a public as well as business interest with the potential to impact economies, supply chains and other electronic ecosystems, not just individual organisations. It may be unrealistic or even unfair to expect individual businesses and industry to add to their armouries at this stage. Even whether adding to the arms race is likely to afford the desired levels of protection is a question worth exploring. Most senior Information security leaders appreciate that a technology solution, however advanced or sophisticated, is only part of the risk mitigation mix: It will not provide a panacea for such a wide-reaching concern.
The challenges we currently grapple with every day to genuinely understand and govern cyber risks, increase visibility of the vulnerabilities, stay on top of developing tactics, and future-proof defences could become more acute in the quantum era. Legacy systems remain at the heart of this struggle today. Perhaps, the quantum debate required today is quite likely to be less about the capabilities of the technology itself and more about the need to assure agility to withstand a significant change in any technology over which we have a widespread reliance. There are tactical and strategic issues to consider, including taking stock of the encrypted estate, the lifecycle of data and information, the applicability of standards that guide our management, compliance risk and more which are all relevant discussion points.
There will be companies that are already looking in contextual detail at these issues for their organisations. I look forward to gaining the benefit of their and other’ perspectives on the day.
Register for the CISO 360 Congress to attend Dr. Eduardo Solana’s Innovation Insights Keynote