APIs are a crucial enabler for digital transformation and microservices. This session will delve into the API threat landscape and provide actionable tasks in taming these challenges. The presentation plan will include “Why API Security is on every CISO’s mind,” “Typical API Security Challenges,” “Best Practices for Tackling API Security,”

Our hackers are diverse, so shouldn't we be? Improving diversity and inclusion in the cyber security profession will be critical to closing the industry's well-documented skills gap. The industry presents a complex picture, showing diversity with higher levels of representation than the wider technology industry in some cases, such as LGB and female representation and cyber professionals feeling confident in being themselves in the workplace.

While many mature SOC’s have been adopting the MITRE ATT&CK framework since its launch in 2015 to provide a global knowledge base of threat activity, techniques and models, it’s the outside of the SOC frameworks that business leaders, compliance and risk teams, risk insurers and industry are placing their emphasis on.
The session will discuss the link between compliance and the SOC and whether or not your organization is using these frameworks to protect your organizations against modern threats while providing evidence outside of the SOC to demonstrate adherence to the framework’s controls.
•What are the clear links between compliance and your organizations SOC?
•How is your business using these frameworks to protect the organization?
•Is it important to provide evidence outside of your SOC?

Boards have always found it simple to appreciate and justify the use of locks, keys, and cameras to protect essential infrastructure. However, as security risks have migrated deeper into cyberspace and become more complicated, it has become more difficult for boards to determine how effective information security officers are.
All of this is changing. Following the pandemic, boards are mandating organisational resilience and attempting to establish a brand that promotes an effective security culture. There are currently security committees that are monitored by qualified board members. Most importantly, cybersecurity risk as a fundamental determinant in third-party transactions and commercial engagements such as M&A, where security is increasingly becoming a competitive advantage desired by investors.

By 2025, 45% of organizations worldwide will have experienced attacks on their software supply chains (Gartner) which are only becoming increasingly complex due to the changes in how modern software is built. These trends, together with new federal regulations, requires organizations to take action to ensure the security and integrity of their software. But this is easier said than done.

During the session you will:
•Discuss how the software supply chain is becoming more complex and a greater attack vector
•Explore new challenges that this complexity is creating as well as new regulatory obstacles
•Discuss mitigation strategies throughout the software development processes and environment

The adaptive security model is a cybersecurity strategy that focuses on prevention, detection, and response. The adaptive approach ignores standard perimeter concepts and believes that there is no distinction between safe and unsafe.
This is a critical paradigm shift, especially in light of the move to cloud services and ubiquitous computing outside of the company.

With a crippling cybersecurity skills shortage, it's never been more vital to invest in continuous cybersecurity education and training. Whether it's keeping ahead of emerging new technologies or ensuring that junior team members have clearly defined growth paths - investment in education and training helps cybersecurity teams respond faster, improve defensive posture, and increase retention of valuable employees. But building an effective education program can be time-consuming, and divert focus from priority one - keeping the organization safe.
In this talk, Leonid Belkind, Co-Founder and CTO at Torq, will discuss how to right-size training and education opportunities for your team, and how to use real-world attacks and threats as opportunities to help junior team members enrich skills. He'll focus on three areas:
•How to keep teams current on new threats, attack vectors, and technology trends
•Establishing effective mentorship programs to help junior team members quickly acquire new skills
•How to balance training and learning opportunities against mission-critical work that demands focus.

Boards have always found it simple to appreciate and justify the use of locks, keys, and cameras to protect essential infrastructure. However, as security risks have migrated deeper into cyberspace and become more complicated, it has become more difficult for boards to determine how effective information security officers are.
All of this is changing. Following the pandemic, boards are mandating organisational resilience and attempting to establish a brand that promotes an effective security culture.
There are currently security committees that are monitored by qualified board members. Most importantly, cybersecurity risk as a fundamental determinant in third-party transactions and commercial engagements such as M&A, where security is increasingly becoming a competitive advantage desired by investors.

It’s now or never to modernize security. Apps live in the cloud, teams work remotely, and cyber threats exploit the excessive trust built into outdated, perimeter-based approaches. Change is only accelerating, with new risks to mitigate, new standards to comply with, and new geopolitical pressures to navigate.

This panel session – led by Trey Guinn, Field Technologist, Cloudflare – will explore how organizations can adapt to these changes. In particular, the conversation will explore successful strategies to take advantage of the power and promise of the Internet as a new type of corporate network.

Designing a secure application from the start is far more cost effective than playing whack-a-mole with security vulnerabilities in production. We will explore simple techniques to get developers thinking about security at the design stage, before they start writing code.
Poll:
•How do you currently implement security at the software or system design stage?

Social media is no longer just another means by which to communicate with one another, it has become a source of cybersecurity intelligence as well as a threat vector unto itself. The threat is just not cyber but one of brand and reputation. In the age of mis and disinformation all organizations, all organizations cannot continue to ignore the impact that social media has on brand, reputation and trust.