Security Culture

• Most of the participants highlighted the power of positive enablement culture.
• We have talked for ages about moving from NO to KNOW-HOW; this movement is still in progress.
• Sharing the benefits and positive stories significantly impacts the user base and the management.
• At some point, we took the “safety team position at the end of the line.” Now, thanks to cyber's business importance and increasing positive approach, we are moving ahead.
• Using “Snowball Dogs” as scapegoats or other joint and relatable enemies has excellent power.
• The next step is to build systems that give positive feedback to users when they do the right thing. This would help them conditionalize good behavior.
• The next level would be to use AI to give immediate feedback if people report real attacks. That would have a huge motivation boost effect.

Artificial Intelligence

• Should it be used
• Using it for malicious purposes & defense purposes
• Biases it has
• How to handle sensitive information / PII
• It is used anyway, so how do we enable it?
• How can we better understand if vendors value providing AI instead of just labeling it? Here, the evidence-based conversation is beneficial.

Evidence-based Security

• How can we drive the Cyber Security implementation based on data instead of gut feeling?
• How to avoid liability/culpability (SolarWinds)
• How to integrate the Cyber Risk mgmt. With Enterprise Risk management. And make it part of the normal ERM flow, so the C-Level understands better.

Business Value of Cyber Security

• The standard view was to establish a good relationship with C-Level and discuss, e.g., around the framework above.
  
• We are still seen as a cost center in many organizations.
• When establishing trust, having a positive enablement mindset and acknowledging what the C-level / their teams already are doing well will help.

OT-Security

• We heard an extreme case of OT security, where the implementation times are very long and products are out of support when they are put into use.
• We agreed, though, that similar (not necessarily as extreme) cases exist in many other industries, such as Medical and Semiconductor.

Deep Dive into Nation State Attack and How to Manage It

What People Say About This Case Study

SME for Peer Roundtables

These notes, resources and "Unmasking the Digital Onslaught: Navigating the Cybersecurity Conspiracy” was created by globally-renowned CISO advisor and LinkedIn’s Top Information Security Voice Petri Kuivala.

Having spearheaded security strategy for major enterprises worldwide, Petri brings unparalleled real-world experience investigating major breaches and counseling executives during times of crisis. 

Petri works with boards, CISOs, vCISOs, global CISOs, VP Information Security, VP IT Security, Security Awareness Directors, Director of Security Awareness, Cyber Security Architect, Behavior and Culture, and Human Risk Managers, assisting them in challenging their thinking…