With increased impetus toward a cashless economy being driven by the recent demonetization drive by the Govt of India. There is an imminent need to look at the security robustness of the cashless and electronics transactions in the country and the potential for fraud, even as the economy steams ahead with encouraging its adoption.

With digitization occurring across all spheres of life, the financial sector needs new forms of authentication technologies to deal with new age threats. Against this backdrop, it would be imperative to know where does the critical infrastructure sectors stand when it comes to securing the underlying technology infrastructure that will be the enablers for digital finance and banking against the new regulatory requirements and standards. The state of the art being followed in this regard in the financial sector also holds best practices and lessons for the entire market.

The session will discuss:
• What are the shortfalls and what needs most attention from policy makers, practitioners and business leaders?
• What are some new innovative authentication techniques that can be used to secure electronic transactions
• Next generation regulatory demands to tackle breaches
• What are lessons from cashless initiatives around the world

Born from nation-state espionage, hundreds of tools and services are now available for assembly into custom-built attack suites fit for almost any purpose, at scale. As these attacks are gaining momentum and sophistication, and India being the target for China and other nation states, we need to adapt our defenses accordingly. To do that effectively, we must clearly understand how and why our enemy functions. Drawing parallels from fighting terrorism and emulating the model to apply to the nation’s information security charter.

The session we will discuss:

• The current statistical scale and scope of targeted attacks;
• The threat actors executing these attacks and their motivations for doing so, including financial gain, personal identity information (PII) and terror;
• The types of valuable data and/or critical infrastructure they are now targeting;
• Where resources should be focused to defend against these evolving threats.

Enterprises are pouring billions of dollars into preventing threat actors from infiltrating the organizations. Yet, the rising level of breaches shows that dedicated threat actors will penetrate the organization. This suggests the problem is not a technological one, but rather one of strategy in dealing with cyber threats.

The session will propose a new collective defense approach, and new strategies that focus on addressing the new gaps in the people, process and technology factors in dealing with cyber protection.

This session will discuss:

• Real-life, first-person accounts of compromised cases, and how such experiences underscored the need for a new paradigm in cyber protection;
• The changing depth and breadth of advanced threats and whether we see the whole picture;
• New and effective strategies to combat today’s advanced threats.

Visibility has been the biggest challenge for every security practitioner and the exponential increase in volume of incidents, threat intelligence and advisories that a typical security team needs to sift through on a daily basis on the one hand; and the sophistication and stealth employed by advanced targeted attacks on the other; the possibility of detecting an intrusion is like finding a needle in a haystack. Detection and visibility – especially in the case of a stealthy attacker – is always post-facto, if at all, ensuring that the attacker always has the upper hand.

Traditional approaches are failing to effectively scale to address contemporary challenges and a fresh look at visibility is necessary for active threat hunting, which deception technology can provide. By adopting broad military deception strategies from the real world to cybersecurity deception technology puts the narrative squarely back in the hands of the defender in the event of an intrusion.

The session will discuss:

• Making incident response and remediation an active, near real-time process;
• Detecting early warning system that gives practitioners the chance to determine motives;
• Turning the haystack into just needles, focusing on mal-intent, rather than drab IoCs or tools;
• How can deception tech be effectively incorporated into the security strategy?

The Supreme Court of India announced that ‘Right to Privacy’ is a fundamental right of Indian citizens. What is its implication on information security and what it means to CISOs given that the digital economy makes it imperative to share the data of the individual?

While a dedicated privacy legislation/mandate doesn’t yet exist in the country With this landmark ruling, companies will have little choice but to improve their data privacy posture. This will not only improve the domestic ecosystem but will also bring India at par with other geographies globally in terms of data protection and privacy.

What are the implications for security functions and what do CISOs need to prepare for?

The panel comprising information security, legal, cyber law and privacy experts will debate on:

• How CISOs need to handle organizational privacy;
• Impact on security and data privacy policies within enterprises;
• Control frameworks and standards for managing data privacy relevant to the Indian context.

Enterprises are battling with the challenge of account takeover and cash out with no signs left behind. Despite years of trying to figure out who is liable for corporate account takeover incidents, we are no closer to an answer.

While many of these incidents have been resolved out of court before judges could rule on primary responsibility, the question remains: Who is liable? Is it the business whose credentials were stolen, or the institution that failed to spot and stop anomalous behavior?

Because of the significant pain and losses attached to account takeover fraud, financial institutions need to do more to avoid it in the first place.

Is it possible to instill sound SDL (security development lifecycle) practices into device manufacturers as the number of IoT devices proliferate to over one trillion in the next few years? In our rush to connect everything together, secure connectivity and information handling is frequently an afterthought, if ever even a thought at all.

Practices are improving, with more refinements on the way. But hope, as they say, is not a strategy. An alternative to waiting for built-in security to gestate is to bolt it on. Several gatekeeper on boarding solutions exist for brokering the relationship between enterprise and device, limiting connectivity in controlled phases, and managing patch levels, authorization and connectivity to within acceptable limits.

Session will discuss:

• Design philosophy for a future-ready secure IoT infrastructure;
• Contemporary strategies and technologies for securing IoT;
• The evolving attack landscape for IoT;
• What enterprise practitioners need to prepare for.