Sylvain Hirsch, Cyber Security Professional at Mandiant (now part of Google Cloud)

Intelligence Driven Incident Response
The usage of Intelligence to efficiently identify, drive and respond to cyber-attacks

In today’s world, cyber criminals are leveraging ransomware and multifaceted extortion campaigns with unprecedented frequency. The sophistication and the complexity of cyber attacks are also increasing. Consequently, organization should implement processes and leverage intelligence to efficiently detect, identify, and respond to cyber threats.

This presentation will focus on Incident Response and Intelligence and will explain how the usage of effective threat intelligence enables organizations to efficiently identify and eradicate Advanced Persistent Threats (APTs.)

The first section will discuss the response processes that should be implemented to investigate, respond, and eradicate cyber threats.

The second section will focus on threat intelligence and how effective intelligence helps organizations to gain strategical, operational, and tactical advantage on the adversaries. It will also include best practices on how intelligence should be handled and processed to be integrated into the cyber defense functions.

The last section of this presentation will discuss a real-live engagement illustrating how accurate, timely, actionable intelligence permits to identify APT 39 cyber espionage activities while investigating an unrelated ransomware attack.

Roundtable 1: Sylvain Hirsch, Cyber Security Professional at Mandiant (now part of Google Cloud)

From the Frontline to the Board 
For the last decade, the pace of digitalisation has been increasing, along this growth the number of destructive cyber attacks and cyber espionage activities has been on the rise. To withstand and mitigate the impact related to cyber attacks, organisations have to develop a clear, realistic, and efficient cyber resilience strategy.

First, this roundtable discussion will discuss the benefits of leveraging frontline experience and threat intelligence to prioritise and enhance cyber capabilities, drive risk-management, and support cyber investment decisions.

Then, this roundtable will holistically cover the main factors to successfully build an efficient and realistic cyber strategy. Although there is no “one size fits all” cyber strategy, common factors for success and best practices enabling organisations to achieve their defined cyber maturity will be discussed. The “quick wins” to rapidly uplift organisations’ cyber maturity along with the development of long-term advanced capabilities will also be discussed.

This roundtable will finally cover the “human” factor that enables organisations to strengthen their cyber resilience overall. The benefits and methodologies that can be applied to raise the organisation’s cyber awareness, improve the cyber security teams’ skills through relevant targeted simulations, and enhance the top management’s cyber knowledge will be discussed.


Roundtable 2: Clemens Sauerwein, Assistant Professor of Security Engineering at Leopold-Franzens Universität Innsbruck

The Role of Information Quality in SOCs
SOCs obtain information about vulnerabilities, threats, and attacks from a variety of information sources. Although this information is used as input for resource-intensive or securing business-critical processes, the quality and reliability of the information collected varies greatly. For this reason, we want to discuss criteria and metrics for assessing the quality of security information used in SOCs. Finally, let us develop a practical framework for the quality assessment of security information.


Roundtable 3: Kudelski Security

(Details will follow)
xxx


Roundtable 4: xxx 

xxx
xxx