Gartner Security & Risk Management Summit 2019 19 - 20 August / Sydney, Australia

As complexity continues to grow and risks, threats and vulnerabilities multiply with no end in sight, how can security and risk management leaders move beyond reacting? Attendees will learn how to think differently about their role in value preservation and value creation, and how finding sweet spots in a human to machine continuum can help. This is the security and risk management leaders’ new imperative.

Risk management is to security as dental hygiene is to preventing tooth decay and considered as sexy a topic. As in, it's not sexy at all, yet it is the proven effective way to manage, prevent, and reduce harm. No wonder it's been a struggle for large and small organizations and governments to even get a handle on security basics. It stands to reason that in the 20+ year history of professional cyber security product and service offerings that have spawned a multi-billion dollar security industry, the sexiest solutions have thrived, while the workhorse basics often fail to survive. With a young security industry still developing metrics around what practices and products can actually help prevent breaches, the world continues with a global dependence on technology that we lack the capacity as an industry to secure effectively now, and in the future. Join security industry veteran and pioneer Katie Moussouris, as she corrects some popular misconceptions about the efficacy of one of the sexiest, yet least effective on a grand scale, security trends that she herself helped ignite: bug bounties. We will go on a data-driven journey that spans labor markets, black markets, and bug markets. The arc of Internet history can bend toward sustainable security, if we correct our trajectory calculations soon.

Earlier this year， Gartner published updated guidance on how to better run this foundational security process. This presentation will go over this new way of doing vulnerability more effectively. Why Gartner made some significant changes to guidance on this critical process? What does the new RBVM actually look like? How to bring this to life inside your own security programs.

Mitre’s ATT&CK framework， while relatively new， is gaining traction in many security operations teams around the world. This session will be part introduction to the ATT&CK framework， pros and cons， use cases for it， that might not have been heard using Gartner CARTA framework where applicable. What is this framework about? How is it applicable in security operations and how it relates to Gartner CARTA framework? What you can do with a framework like this in your security operations program?

This session will discuss the following issues on threat intelligence. Key points to be thinking about to get value from Threat Intelligence. Key use cases we see clients implementing successfully. Key technologies being adopted in modern security programs for intelligence lead initiatives. PLEASE NOTE: For end-users only. Preregistration is required.

Good information security hygiene is a must， but many organizations lose focus on getting the basics right， leading to an unjustified level of confidence in risk posture. Join us and learn: What are the key activities， capabilities and practices for organizations? What are the activities that you can delay or even skip entirely? Why doing the basics is more important than ever.

Many of our cyber security experiences play out like Greek tragedies. But, frankly, better tragedy than comedy. Tragedy holds lessons for us. It is a very human condition; it reminds us of the costs of inattention, the need for inspiration, and to pay close attention to people.
As CISOs and CIOs we can use the tools and reminders of tragedy to strategic effect. The keynote will consider how cyber is understood and how perceptions may be recast to place humans at the centre of cyber, touching on the missions of the ANU’s Cyber Institute.

You’ve had a busy few days attending sessions across five tracks. What we’d like to do is give you not so much a summary of what you saw but instead what you didn’t get a chance to see. In this final keynote, each Track Manager will distill the main messages from each track and highlight the main action points that you can implement in 2019 and 2020.