Agenda
Thursday, 10 October 2024
“Navigating the Vulnerability Minefield & Enabling the Age of AI”
Please note that 1:1 meetings will be running throughout the day.
Registration & Check-In
Welcome to the 9th Security Edge: Navigating the Vulnerability Minefield & Enabling the Age of AI
Jim Berry - CEO & Founder at ADAPTSecurity is in the spotlight more than ever, bringing new opportunities as well as risks. With Australia under high profile attack, the Government dreams of national cyber resilience with evolving legislation – while our organisations chase digital growth and agility for their dispersed workforces, driving the focus on verification, compliance, and trust.
Meanwhile AI and Quantum computing start to scale the threats, but also new ways to protect our data, people, and customers.
This makes the new financial year a pivotal one for Security leadership. To navigate and protect so many vulnerabilities, while also enabling a business driven to adopt AI at speed – we must deliver on security leadership and culture.
Join the community at ADAPT Security Edge, bringing together our regional enterprise and government cyber heroes to connect, learn and inspire in these challenging times.
Our theme, debated by over 25 experts and 130 local security leaders, will define a powerful day’s agenda, codifying the latest research and lessons learned for memorable and practical ways to lead teams, give organisational direction, and improve capabilities.
ADAPT Research: Cyber Resilient & AI Ready
Gabby Fredkin - Head of Analytics & Insights at ADAPTADAPT’s research and advisory team reveal the latest local fact-based insights from over 500 detailed 2024 surveys from our region’s top CIOs, CISOs, CTOs Heads of Data and Digital responsible for over 40% of our GDP.
This session will assist you in comparing their resource allocation, investment priorities, barriers and unique challenges of Australian Cyber leaders and the Business leaders you serve. Helping you to benchmark and validate your priorities and thinking, Gabby will reveal the core findings distilled from your aggregated pre-event surveys and examine which Security, AI and data protection strategies are generating value.
Get an Edge: Making the Most of Your Day
Tenar Larsen - Head of People & Performance, Executive ProgramsGlobal CISO Keynote: Making the Most of a Crisis, Risk Reduction, and IT/OT Controls
Ahmad Douglas - CISO at Commscope USA Byron Connolly - Head of Programs at ADAPTAhmad became CISO of CommScope eighteen months ago, and in his first weeks the organisation faced a severe ransomware attack spanning multiple core platforms. This shook the organisation, evolved his role and impact of his function right from the start – with real life training on managing a breach and evolving executive perspective on risk.
A Fortune 1000 company, listed on the Nasdaq stock since 2013: CommScope designs and manufactures advanced network infrastructure products and employs over 30,000 employees. They’re comparable to many Australian organisations, a manufacturing company, modernising from legacy, with smaller teams, needing to attract the right talent, where managing the cost of IT is essential to the company’s success.
He’ll share lessons learned and practical tips on:
- How to gain the C-suite and boardroom consensus necessary for essential change.
- Adopting a strategy and mindset of incremental risk reduction.
- Leading and building teams: culture, optimism, rest, and retention without the salary budgets.
- IT/OT network segmentation and controls – and protecting the crown jewels.
Ahmad’s prior experience includes: CSO of Equifax Workforce Solutions; Head of InfoSec & Risk Mgmt (Xfinity Home) for Comcast; Senior Director Global InfoSec at VISA; and Business InfoSec Officer & Research Scientist at Los Alamos National Labs.
The World Today: Cybersecurity in the Age of AI with Palo Alto Networks
Dr Helen Teixeira - Consulting Director, CRM (Unit 42) at Palo Alto NetworksAI is revolutionising enterprises. For over a decade, AI has boosted productivity and introduced risks. In the past 18 months, the adoption of Generative AI has skyrocketed, impacting every major department across the enterprise. This technology is also changing the nature of attacks and how we defend against threats.
Join us as we delve into the implications and risks of the weaponisation of AI. Gain a deeper understanding of the threat landscape, the target’s of today’s attackers, and the emerging AI-powered threats that organisations face. We will also share considerations for building and consuming Generative AI securely within your organisation.
Morning Break
Refreshments, Snacks & Connections
The 9 Steps: What a CISO Needs to Know and Measure in Privacy, AI Ethics & Data Governance
Michelle Dennedy - Co-Founder & CEO at Privacy CodeMichelle was VP & Chief Privacy Officer at Cisco as well as McAfee, where she raised awareness and create tools to promote privacy, quality, respect, trust, and asset-level possibilities for data. As a visionary in the field of privacy and the IT industry, she brings together multifaceted approaches that provide real privacy protections to drive business value. A licensed attorney, Michelle led security and privacy initiatives, ranging from regulatory compliance, privacy engineering, advocacy and education efforts, and litigation. She is the co-author of ‘The Privacy Engineer’s Manifesto: Getting from Policy to Code to QA to Value.’
Security teams play a vital role in data governance, privacy engineering, compliance, authentication, optimisation and the UX for digital products across every business.
We now live in a world where bad data means bad CX which means customer churn, making all responsible for good Data Quality and Governance frameworks.
Michelle will share 9 steps to improve the people, process, and tech components of data frameworks. Talking on how to incorporate privacy into your cyber efforts, how to get the most out of your work.
- Ensuring the compliance of new digital products dual impact authentication
- Managing data governance and communication between C-level and cross functional groups
- How to get the metrics in place to control risk and ethical AI
- Getting ready to cope with and manage the data impact of AI
- Frameworks to improve and articulate consistent 3rd party privacy management
As a CISO – learn how to build your program, how to prove it, then how to manage uncertainty, risk and liability.
Attack Trends: How Phishing as a Service and AI have Revolutionised Email Bourn Attacks
Antonio Rancan - Senior Sales Engineer at Abnormal SecurityPhishing-as-a-Service is now a thing. It’s cheap, cloud managed and comes with support. It side-steps MFA and allows criminals into your Microsoft, Google, Apple and Github accounts. Combine this with Generative AI and now threat actors have sophisticated phishing attacks with cleverly crafted language at their fingertips.
In this talk, I’ll show real examples of the threats coming from Ph-a-a-S and examples of how Gen-AI is being used to develop sophisticated attacks. I’ll also discuss how good AI can be used to fight bad AI and the onslaught of cleverly crafted phishing.
Adaptive Cloud and Security | Proactive Risk Mitigation Strategies in Hybrid + Multicloud Environments
Matt Boon - Senior Research Director at ADAPT Enrico Conte - Chief Information Security Officer (CISO) at IMB Bank Naran McClung - Head of Azure at Macquarie Cloud ServicesOrganization’s are increasingly adopting hybrid and multicloud environments in an attempt to reduce cloud costs and mitigate risk. However, with these benefits come significant security challenges that demand adaptive and proactive risk mitigation strategies.
Hear from Enrico Conte – Chief Information Security Officer (CISO) at IMB Bank & Naran McClung – Head of Azure at Macquarie Cloud Services in conversation with Matt Boon, ADAPT’s Senior Research Director as they discuss the unique risks associated with hybrid and multicloud setups, including data breaches, compliance issues, and the complexities of managing multiple cloud platforms.
Key topics will include:
- The skills and safeguards needed to innovate in multicloud environments
- Governance and compliance strategies within a multicloud environment
- Reducing risk exposure through multi-layer security and data governance
ADAPT Executive Insight Roundtables - share with confidence under the Chatham House Rule
Attend your preselected roundtable to participate in a peer discussion moderated by ADAPT analysts with subject matter experts.
Lessons Learned Helping Protect Australians as the Nation's Leading Telco
Clive Reeves - Deputy CISO at Telstra Mick Stephens - Head of Security Strategy & Sales Excellence at TelstraAs Australia’s leading telecommunications and technology company, Cyber Security is at the forefront of everything Telstra does. It’s not just about implementing security measures; it’s about designing, building, and managing security for its vast global network using a range of technologies and controls, and integrating cyber security seamlessly into every aspect of its organisation.
As a critical infrastructure provider, Telstra continuously invests in its security capabilities, to help stay ahead of new security threats. At the heart of its comprehensive security capability is the operation of a well-established Security Operations Centre (SOC), harmonising IT/OT environments, and advancing the implementation of organisation wide zero trust, supported by cutting edge SASE technology.
Join Clive Reeves, Deputy CISO APAC at Telstra and Mick Stephens, Telstra Security’s Head of Sales Strategy in this private roundtable to delve into our transformational journey, gain insights from our experiences and explore the evolving strategies for mitigating sophisticated threats in today’s landscape.
Debate how to:
- Affect change in a large organisation and present the story.
- Lock down data without compromising CX.
- Position security at the front of transformation and change.
- Move SASE and Zero Trust beyond a concept.
The Evolution of Security Awareness Training: The Critical Elements You Must Have in Place to Ensure Success
Joe Gillett - Head of Oceania at KnowBe4Successful Security Awareness Programs include ongoing, relevant and engaging training and awareness with an opportunity to apply new skills and knowledge with simulated social engineering activities.
The evolution of these programs results in changing behaviour with the ultimate goal of creating a security culture. Whether you call it security culture or human risk management, the steps to take and levers to pull can be complex and sometimes out of the focus area of IT Professionals.
During this session, Joe Gillett and team will share real-life examples with actionable guidance, giving attendees the advantage they need to ensure their program succeeds, create a security culture, and mitigate human risk.
Why Organisations Need a SaaS Security Program for Their SaaS Ecosystem
Andrew Simbaqueba - Regional Sales Director, APAC at AppOmniRecent research shows that 78% of organisations store sensitive data in SaaS applications, yet very few understand the security posture of their critical SaaS applications. In the wake of high-profile breaches such as MS Midnight Blizzard and the Snowflake attack, there has never been a more critical time to adopt proactive measures to protect your sensitive data within SaaS applications.
Workshop Takeaways:
- Best practices for SaaS application security.
- Common types of data exposure & risk in SaaS applications.
- Strategies for detecting threats and mapping compliance requirements:
- How robust SaaS security enhances business resilience.
- The ROI & business value of investing in SaaS security programs.
Accelerating Cloud Security To Enable AI: How Security Teams Can Adopt a New Operating Model To Enable AI Adoption
Matt Preswick - Enterprise Solutions Engineer at WizCloud and Artificial Intelligence (AI) are empowering organisations to meet their business goals quickly and effectively, however, also presents a tectonic shift for cyber security teams. Today, CISO’s are forced to enable the adoption of Cloud and AI use cases at the speed of dev, requiring new operating models to continue to protect their environments and eliminate critical risks.
Join this session to learn how you can enable your team to build faster in the cloud, ensuring security, Dev and DevOps can work together in a self-service model built for the scale and speed of your cloud and AI developments.
Peer Networking Seated Lunch
Lunch Roundtable: Data Protection, Evolved: Harnessing AI to Secure Your Data
Antonie Falco - CTO in Residence, APJ at ZscalerRecent breaches have compromised millions of Australians’ data, revealing the complexities of modern data security. Traditional methods are failing under the strain of complex products, visibility gaps, alert overload, and slow response times.
ADAPT’s April 2024 Survey of Australian CISOs highlights data security risks as their top concern. As digital business models evolve and organisations migrate data to the cloud, leaders see data privacy as mission-critical. With enterprises managing 45-90 security tools, a unified data protection strategy is essential. However, many businesses still use data architectures not designed to counter evolving security threats.
Join us for an exclusive lunch roundtable with security peers and experts to discuss pioneering smarter, more streamlined data protection strategies. We will explore:
- Leveraging AI for Enhanced Security: Improve threat visibility and response times
- Empowering a Proactive Security Posture: Strategies to enhance data security
- Securing New Data Loss Vectors: Protections against emerging threats
- Integrated Data Protection: How a unified approach improves data control
- Monitoring Data in Motion: Best practices for protecting moving data
ADAPT Executive Insight Roundtables - share with confidence under the Chatham House Rule
Attend your preselected roundtable to participate in a peer discussion moderated by ADAPT analysts with subject matter experts.
Protect Against Identity-Based AI Attacks
Ewan Thomas - APJ Presales Architects & Specialists Leader at OktaJoin our roundtable as we discuss:
• AI as an Accelerator for Your Business: Explore how the rapid adoption of cloud services, SaaS applications, and remote work, accelerated by AI technologies, has fundamentally transformed business operations. Understand how AI can help navigate the fragmented IT and security landscape, integrating resources and identities across a complex web of systems and infrastructures.
• AI Fueling Threat Actors: Examine how the shift to the cloud and the expansion of the attack surface have been leveraged by threat actors using AI. Delve into the challenges security teams face in keeping up with AI-enhanced threats and the pace of change in the threat landscape.
• Organizational View on AI and Associated Risks: Discuss how siloed security approaches and disparate tools can hinder visibility and slow down threat detection and response. Learn how organizations view AI, both as a tool for improving security and as a potential risk, especially with the growing complexity of enterprise IT environments and the increasing number of endpoints, cloud-based applications, and mobile devices. Discover strategies to effectively secure digital identities in this evolving landscape.
Quantum Readiness – a Blueprint for Unleashing Crypto-Agility and Modernisation
Daniel Sutherland - RVP of ANZ at DigiCert Lindsay Hansen - Director SE Team, APJ at DigiCertIn the ever-evolving landscape of digital transformation, organisations are facing unprecedented challenges in securing and scaling their cryptographic infrastructure. Yet the need for crypto agility has never been more critical as companies grapple with risks posed by advanced technologies such as AI, emerging threats like Post Quantum Cryptography (PQC), and the complex web of compliance mandates, management hurdles, and technology transformations.
Join a lively roundtable discussion with a panel of your peers to gain actionable strategies as we explore:
- Reducing IT resource burdens and costs through centralised certificate management
- Preventing costly business outages and addressing potential security vulnerabilities
- Building private and public trust while eliminating human error
Don’t miss this opportunity to learn best practices and elevate your organisation’s cryptographic resilience. Be part of the conversation that prepares for a quantum-safe future and shapes the future of secure digital landscapes.
API Security, Where Do the Risks Lie in Our Increasingly Distributed Workplace?
Troy Leliard - API Security Specialist at AkamaiApplications run our world and your business. They also introduce security vulnerabilities that multiply as we become ever more connected.
This interactive Roundtable with an ADAPT Analyst and front line insight from Akamai will discuss:
- Automating protections and customisation to your organisation’s threat landscape
- Going beyond the OWASP API Security Top 10, can leveraging machine learning provide higher detection accuracy?
- Tactics to ensure your applications remain available even during attacks.
Afternoon Break
Refreshments, Snacks & Connections
Panel: How to Articulate the Risk, to Get the Support, to Protect and Enable?
Peter Hind - Principal Research Analyst at ADAPT Kylie Watson - CISO at DXC Technology Donald Elliott - CIO at Cricket Australia Olivia Loadwick - Partner at McKinsey & CompanyHow can Security leaders win the resources and executive support they need to help protect and enable the business? We ask two national CIOs and a leading consulting CISO.
- How to understand the C-level and the Board’s risk appetite
- How best to articulate the narrative to the ELT?
- Stakeholder Management to ensure compliance with Critical Infrastructure, APRA and Soci regulations
- Elevating the role of CISO and your hard working Security team
Local leaders will give frank advice and practical tips.
The World Class CISO
David Gee - CIO, CISO, Board Advisor, NED & AuthorDavid has over 25 years’ experience in CIO and CISO roles across different industries and countries. At Macquarie Group he served as Global Head Technology, Cyber and Data Risk, prior to that as CISO for HSBC Asia Pacific which accounts for 80% of their global profits. His career as a CIO spans Metlife, Eli Lilly and Credit Union Australia. David was winner of CIO of the Year 2014, at CUA where successfully completed a significant Transformation with new Core Banking, Online and Mobile Banking systems.
He is past Chairman for the FS-ISAC Strategy Committee and awarded Global Leaders Award in 2023 for his contributions to the cybersecurity industry.
David has been a Partner-level Strategic IT consultant with KPMG, EY and ICG. Also has been a VC Partner, Fintech Advisor and Innovation Consultant. David’s most recent book – the Aspiring CIO & CISO was published in July 2024. David is writing his second – A Day in the Life of a CISO with CISOs from around the world.
- How to be a World Class CIO & CISO?
- How can you hire a World Class CIO & CISO?
- What to do in your first 90 Days?
- The Elevator for your next CIO & CISO role.
Insights from the Front Line: Open Source Risk, Bots, Disruption and Talent
Byron Connolly - Head of Programs at ADAPT David Robinson - Co-founder at Internet 2.0As a former army intelligence officer, cocreator of the Cloaking firewall and Malcore, and one of Australia’s most successful cyber exports – David’s involved in the end to end of protection, detection, and disruption.
You’ll find him behind the scenes: supporting Ukraine against Russia, fighting North Korean hacks, disrupting ransomware gangs, working with all major US Departments, protecting the world’s richest individuals, analysing social media engineering for both sides of the US political race, and assessing the number of bots, rather than humans, currently active on social media platforms.
His organisation is part of Biden’s Counter Ransomware Initiative. His team wrote the targeting framework for the Australia government’s current disruption policy. He’s now moved offshore to maximise what he can do for the cyber space, and we’re dialling him in live for a valuable final session of the day.
Discussing under the Chatham House Rule:
- The Open Source vulnerability minefield
- What do you need to know and do about current geopolitics
- A ransomware and disruption update
- Why CISOs need to keep an eye on social platforms
- Preparing for your company to make and take crypto payments
- Advice for sourcing and leading the best technical team
Closing Comments
Security Edge Peer Networking Drinks
An opportunity to stay, mingle and meet other attendees over drinks and food and discuss the day.