COVID-19 has resulted in increased digitization across sectors, with the enterprise cybersecurity leaders suddenly finding themselves tasked with securing a new hybrid workforce and defending their largest-ever attack surface. The trend has led to data proliferation, and organizations struggle to handle the sheer volume of data in this new regime. What are the threats to watch and technologies to embrace during the pandemic and beyond, particularly when the abundance of valuable information has captured subversive elements' attention? At the same time, cybercriminals have breached networks and compromised millions of records, not only causing revenue losses but impacting brand reputation?

Enterprises consider 2021 to be the decade of digital trust as the country's top leadership emphasizes cybersecurity to have a tremendous impact on the nation's society and economics.

This exclusive keynote session describes:

• Changing threat landscape and lessons from the pandemic;
• Key priorities for 2021

Speaker:
Dr. Amirudin Wahab, Chief Executive Officer, CyberSecurity Malaysia

The year 2021 will see an increase in organized cybercrime activities, APTs, and ransomware attacks targeted at the critical infrastructure organizations across South East Asia. Also, the remote workforce. Economic stress. Pandemic fatigue has made created a "perfect storm" for an increase in security breach risks. What can you do to improve monitoring, detection, and mitigation of the risks in these unique conditions?

This exclusive session details:

• Insight into Malaysia's Cybersecurity Master Plan for 2020-24 for tackling new threats;
• Enhancing predictive, preventive, and response capabilities using AI & ML techniques;
• How enterprises can use SASE and 'zero trust' models to fight new threats.

Enterprises traditionally used on-premises IAM software to manage identity and access policies. With companies adopting cloud services, the process of managing identities is getting more complicated. Therefore, adopting cloud IAM solutions becomes a logical step. However, mapping single sign-on users and IAM roles can become challenging as users can have multiple functions that span several cloud accounts.

The session will discuss:

• How best to manage IAM roles in the cloud;
• What does cloud IAM include;
• On-prem IAM Vs. Cloud IAM.

The need for enhanced business agility and secure remote access to support digital transformation has led to the adoption of the security access service edge, or SASE, model among enterprises. Some say, CISOs now don't have to procure individual discrete security solutions and tie it into the network security layer; instead, they can source from one logical place using the SASE security model.

The session discusses:

• Factors security teams need to evaluate when considering SASE adoption;
• Why SASE is the next evolution for network security;
• Why identity is paramount in the SASE model.

As enterprises strive to defend against future threats, the new buzz word XDR, a unified security and incident response platform, helps streamline and simplify security management.

This is emerging as a next-generation endpoint environment that requires next-generation defenses.

The session discusses:

• How is the endpoint attack surface and attacks evolving in 2021?
• How to enhance SoC capabilities to have proactive warnings of threats?
• Where does XDR fit into these?

As technology continues to take hold of business transactions, it is of little surprise that the businesses are subject to a host of cyber-attacks, including business email compromise or BEC scams. One way to reduce the BEC scam's damage is to apply the principle o least privilege and create a detailed enterprise risk management plans that spell out procedures to secure accounts. Giving all employees access to payment information outside of their normal job functions can multiply the problem. While the advantages of access controls are known to all, the practical application remains a challenge.

The session discusses:

• Shortcomings in efforts to detect BEC scams;
• Defining and managing access controls in a non-static environment;
• The best processes for investigating these scams using DMarc technology.

Speaker:
Madan Oberoi, Cyber Innovation and Outreach, INTERPOL

Today's big challenge facing enterprise security is the 'dark web,' an ungoverned and seemingly ungovernable internet area where you can browse and communicate with complete anonymity. Through the use of dark web and crypto currencies, criminals have been able to very successfully run 'crime-as-a-service' model. The business and the security agencies have been able to make very little, if any, impact. What can be done to make your enterprises' cybercrime - resilient', and how should law enforcement respond to this menace.

The session will discuss:

• Challenges posed by Dark web and crypto currencies for enterprise security;
• How is law enforcement responding to the investigation process and building technical capabilities;
• New techniques and approaches being used to combat security threats from the 'dark web'.

As enterprises adopt IoT products, are they ensuring that security is part of the design from the beginning and implementing micro-segmentation? This is the challenge that every CISO encounters.

Since IoT devices can be made cheaply and quickly, they may lack adequate security features. Security expert Bruce Schneier, a co-author of the Atlantic Council's report, says IoT needs to be regulated for security, just like the nutritional content of baby food or the fire resistance of kid's pajamas.

Enterprises need to focus on baseline security requirements while building IoT products.

The session discusses:

• Security threats posed by IoT systems;
• Implementing a micro-segmentation strategy to address security;
• Using artificial intelligence and machine learning within IoT products.

Speaker:
AJ Eserjose, Regional Director, OT-ISAC, Singapore

Asset owners and operators are experiencing a convergence of IT and OT in this era of digital transformation, which is resulting in increased cyber risk to industrial control systems. Legacy ICS components are not designed to embrace this digital transformation and the heightened liability that accompanies it.

It has become imperative to redefine security architecture to build and improve the cyber resiliency of ICS in this connected world, and equip teams and systems to prevent or respond to sophisticated threats and actors now taking advantage of this new environment.

The session discusses:

• Security threats posed by connected systems;
• Making security part of the design from the beginning and implementing micro-segmentation strategy to build cyber resilience;
• Maximizing the value of information and threat intelligence sharing in addressing ICS risk.

Every DevOps team's end goal should be evolving into a fully-fledged DevSecOps program. Putting the 'Sec' in DevOps helps remediate common security vulnerabilities that open up significant risk and a noticeable reduction in time and cost to fix them. Unfortunately, moving to an efficient DevSecOps program isn't always easy. It's both an operational and a cultural change for most companies, but successful implementation results speak for themselves. In this session, we will discuss:

• Critical elements of a successful DevSecOps program;
• How applications need to communicate with each other;
• Challenges of securely developing microservices-based applications.

TWith the COVID-19 throwing up enormous challenges at the CISOs, forcing them to take a good, hard look at viable security projects, the one that tops the list is risk-based vulnerability management. This is the "last mile effort" involved in already joint bulk vulnerability assessment and telemetry and bringing in additional information in the form of threat intelligence.

The session discusses:

• How to ascertain which vulnerabilities are likely to be exploited;
• How to proactively manage risk and make a strategic decision with dynamic and continuous visibility;
• Discovering the gaps in processes and tools.

Organizations have widely adopted a 'zero trust' architecture based on the principle of least privilege during the pandemic. ZTNA is fast replacing traditional VPN approaches for employee remote access, improving flexibility, agility, and scalability of application access. As the 'zero trust' approach continues to evolve, organizations' challenges lie in implementing this approach not in silos but across environments, both in the cloud and on-prem.

The session discusses:

• New technologies to achieve zero trust framework;
• Can ZTNA provide more granularity to third party access;
• How will 'zero trust' evolve in 2021.

The popular SolarWinds hack, the supply chain attack that implanted a backdoor in the Orion network monitoring software pushed to 18,000 of the firm's customers, is considered to be potentially the most significant intrusion in our history.

The campaign's full scale, including all of the tactics, techniques and procedures being used by attackers remaining unknown, has left most enterprises across the regions in a state of shock.

What are the lessons the CISOs need to learn from this attack? Do you have a process to evaluate your vendor's security policies and frameworks?

The panel will discuss:

• How should the risk framework of supply chain vendors evolve;
• The risks posed by different kinds of vendors;
• Defining security by design approach while evaluating the third party products.

Implementing an adaptive, risk-based authentication process for remote system access proves effective as more staff members work from home during the COVID-19 pandemic. Simultaneously, CISOs are endowed with balancing security versus convenience is a great program by itself that is working out several authentication standards.

Enterprises have adopted adaptive authentication standards to enhance security based on the user's risk profile and behavior. Some say, by using analytics and machine learning, this adaptive approach enables organizations to offer appropriate access while minimizing the use of multifactor authentication.

The session discusses:

• Managing administrative access to systems;
• Innovations in the area of customer identity and access management that improve users' experiences;
• Moving away from multifactor authentication and password-based authentication.

Today, the cybersecurity industry faces numerous challenges, including persistent nation-state threats, unconnected security systems, and a severe shortage of skilled professionals. A threat intelligence solution can address each of these issues and many more. But raw data must not be confused with intelligence. So, how does cyber threat intelligence turn into an actionable process?

• How does threat intelligence data get produced;
• How to maximize the value of threat intelligence information sharing;
• How threat intelligence can help tackle nation-state threats.
• How threat intelligence can help tackle nation-state threats.

Ransomware is one of the fastest-growing cybersecurity threats during the pandemic, resulting in the increased damages running into billions of dollars and breaking down the new trends in online extortion threats. To this point, the focus of ransomware defenses has been on detection, and experts say it's time to shift to protection - and even recovery. And backups are now the critical battlefield in this war. Is there a way to mitigate the risks posed by these attacks? Experts say enterprises need to move from file-based security to a behavior-based approach.

The session discusses:

• Latest troubling ransomware trends;
• Shifting from defensive strategies to protection and recovery;
• How to move away from multifactor authentication and password-based authentication.

How to strategize and see security in a new light amidst new challenges. The emergence of technologies such as IoT, skill shortage, insider threats, and cloud movement has posed the most significant risks for enterprises in the current times, which are amplified by increasing phishing attacks, targeted attacks, disruption, distortion, and deterioration.

A panel of experts discuss:

• Risks posed by increased digitization and cloud disruption;
• Use of right technologies in the adaptive era
• Use of predictive analytics and active defense in detecting threats;
• Cybersecurity investments in 2021