IT Security Insights 2018

• How does the strategy respond to the new challenges in an increasingly digitized society?
• What measures have been taken and what will happen in 2019

Good ability to handle information security incidents is a must for managing the threat to ICA's business. 

• How incident management is linked to the company's security process and what components are included to enable the company to be able to handle a security incident
  
• How they handle personal data incidents at the company
• Do you have the required skills?
• How much resources are required for this task?

Takeaways:

• What is important to find out before the incident occurs, about your cloud supplier when it comes to BCP
• Different situations that may occur and which you must have a plan for if they happen 
• Connect your own BCP-plan to the Cloud suppliers, what should you think about and manage

How the evolution to 5G is going to have an impact on Enterprise security when it comes dealing with ubiquitous connectivity, the increase of data globally and the way that IT professionals will have to think about deployment of large scale networks, as in the case with IOT.

Social engineering is nothing new, but it has become the “king of attacks”, being (relatively) easy to deploy and requiring minimal commitment from the attackers’ side. Key takeaways:

• The 6 influence principles (by Dr.Cialdini) and how these principles are utilized to improve the success rate of social engineering attacks
• The driving forces of what makes us “click on the link” and how we should defend against them
• What one can do to prevent these types of social engineering attacks

Key takeaways:

How identity management and access governance helps manage security risk – protect sensitive information, ensure compliance, avoid accidental or illegitimate access, and data theft. Learn how efficient identity management maintains business agility – by providing timely and appropriate access for your employees.

Takeaways on some key aspects of the DPO-role:

• Who could or should take on this role in your organisation? (The battle between competences)
• Why should you appoint a DPO? (Or should you?!) How to perform the regulated tasks of the DPO in a manner that adds value to the organisation.
  
• (Can the DPO combine its independent role and its montoriting duties with a proactive, supporting approach?)

In todays environment a lot of valuable data are carried around in the laptops of executives, sales representatives and road warrior engineers/ consultants. The threats to these data are numerous:The laptop can be stolen, dropped or damaged, USB inserted which contains viruses and many more.

• How do we adress these threats? 
• Which routines can be introduced?
• How can the business value at stake be presented to decision makers within the company?

With all the news around security in the last year, our end users are bombarded with security news from various sources, and are at risk of burning out with "Security fatigue". At the same time, enterprises are more reliant than ever on these users acting responsibly and engaging with an organisation's Security functions. 

Takeaways:

• How do we keep these users engaged in the face of this pressure?

This round table will focus in creating an IT security agenda that focuses on the most important aspects for your organization

Takeaways:

• What security measures does your organization need to have in place?
• How do you know what to prioritize?
  
  

GDPR took effect on the  25th  of May and will be followed by many more laws and requirements. 

Takeaways:

• How can an Information Security Management System (ISMS) help the organisation with compliance and faster adapting to new requirements
• How to get the management commitment 
• Implement privacy controls in your audit routine

With a new era of privacy regulations upon us, security and compliance professionals are making the GDPR and a top priority. It is essential to build a roadmap with both privacy and security in mind. 

Takeaways:

• You will learn the importance of privacy management within the context of your existing security and compliance ecosystem –– how it fits into the larger puzzle, why it has been precariously overlooked in the past, and how it can be seamlessly integrated as a function among the information security, information technology, risk management, audit and compliance, as well as legal areas in your organisation
• Lessons learned in the GDPR era and how privacy management can support security and GRC teams

In 2016 EnterCard Group put a lot of efforts to develop own understanding of data protection measures required by GDPR; what is already in place and what should be added. In 2017 and beginning of 2018 we worked on archiving our GDPR goals. 2018- is a year when we analyse outcome of our work and maintain our achievements. So is there anything to do after GDPR implementation? Is there room for improvement and do we need it? 

This presentation is dedicated to following questions:

• We are compliant! What’s next?
• Technical solutions vs policies and corporate culture. What would work best for your company?
• Data breach without breach. Is absence of data minimization and privacy by design an actual personal data breach?

The session explores information security in modern digital eco-systems, with focus on new needs; behaviour, culture and relevant technology. Learn how to step up an IT Security and Information Strategy that captures a more holistic relationship with today's and future needs.

Takeaways:

• The aim is that the listener should have a basic understanding of behaviours and cultures as risks and threats in digital ecosystems
• Another aim is that the listener should have a basic understanding of why a more holistic view is required in digital ecosystems
• The final goal is to have the listener have a very basic knowledge of where to start in the new strategy regarding security work in their systems

Initiatives, challenges and projects conducted before and after the 25th of May. Shared experiences after the 25th of May:

• Hired a management consultant firm to help them with the implementation, Intensified the work with which processes to keep soft and which to add application/database support. The number of hours and the resources needed was ramped up significantly for the implementation of the application/database support
• Nobody knew how to implement this, least of all Datainspektionen
• Best knowledge within Management consulting firms
• How to guide DI to better understanding/getting answers?
• How to avoid doing same work/mistakes at every company