Gartner Security & Risk Management Summit 2019 5 - 7 August / Tokyo

As complexity continues to grow and risks, threats and vulnerabilities multiply with no end in sight, how can security and risk management leaders move beyond reacting? Attendees will learn how to think differently about their role in value preservation and value creation, and how finding sweet spots in a human to machine continuum can help. This is the security and risk management leaders’ new imperative.

There is no such thing as a perfect, universally appropriate model for security organizations. Every enterprise must develop its own model, taking into consideration basic principles, practical realities and the challenges of digital transformation. This presentation will address the following key issues:
- What are the trends and challenges in security organization design?
- What are the factors that influence security organization?
- What are the current best practices and contemporary conceptual design models for security organization?

Many midsize enterprises are struggling to attract and retain cybersecurity talent. Join us for this peer-driven discussion on how to manage with a small team. How have you successfully overcome these constraints? When is a managed service the answer? What makes the most sense to keep in-house? Preregistration is required.

[Qualification Criteria]
CISO or executive management-level security and/or risk decision maker for an enterprise-wide program or business unit with revenue
of more than $250 million. Chief information security officer or equivalent level executive from a public-sector (government, education, and not-for-profit) organization with more than 1,000 employees.

Enterprises have to accelerate to take the initiative not only for cyberattacks, but also for inside threats. In addition, legal compliance, business globalization, consumerization and the IT megatrends such as cloud, mobile, social and big data are forcing security leaders to mend their ways. In this session, we describe the key points security leaders must consider in such situations surrounding the enterprise.

The rapid adoption of SaaS applications such as Microsoft’s O365, Salesforce and others is driving enterprises to rearchitect their networks, so that remote offices can achieve direct internet access with SD-WAN and other techniques. Enterprises will be purchasing more cloud-based security services and fewer appliances. Here, we will highlight best practices that enable a smooth transition to the adoption of cloud-based security services.

Digital Workplace brings a lot of new technology to Japanese enterprises and the organization will require new leadership to CISOs in the digital age. This session will introduce the new approach and leadership for our security aligned to the new technologies for digital workplace.

[Qualification Criteria]
CISO or executive management-level security and/or risk decision maker for an enterprise-wide program or business unit with revenue
of more than $250 million. Chief information security officer or equivalent level executive from a public-sector (government, education, and not-for-profit) organization with more than 1,000 employees.

Effective cybersecurity is predicated on a defensible program. This presentation introduces and discusses the characteristics of a defensible security program. Key issues:
- What are the components of a cybersecurity program?
- What makes the program defensible to key stakeholders?

As the second largest economy, China continues to attract businesses to enter the market and expand as these businesses grow. But, security and risk leaders face a set of unique challenges. How to understand these challenges and apply best practices will enable CISOs and risk leaders to assure business successes.

Blockchain has become a much-hyped technology with a lot of potential. Yet, with cyber threats and data breaches, is this technology secure? As blockchain becomes more mainstream, CISOs must understand the security and privacy implications. What are the security risks of different models blockchain trust? What are the PKI issues inherent in blockchain and what's the best way to address them?

A new era is about to begin. There is a need for infrastructure strategy for the new world which is not an extension so far. It is assumed to be digital, mode 2, cloud.
In this session, we describe the next-generation infrastructure strategy, IT organization and people’s way of thinking to accelerate preparation for disruption.

This roundtable is an opportunity to learn from your peers on how they have expanded the scope of their chief compliance officers' (CCO) role to incorporate privacy regulations.

[Qualification Criteria]
CISO or executive management-level security and/or risk decision maker for an enterprise-wide program or business unit with revenue
of more than $250 million. Chief information security officer or equivalent level executive from a public-sector (government, education, and not-for-profit) organization with more than 1,000 employees.

As complexity continues to grow and risks, threats and vulnerabilities multiply with no end in sight, how can security and risk management leaders move beyond reacting? Attendees will learn how to think differently about their role in value preservation and value creation, and how finding sweet spots in a human to machine continuum can help. This is the security and risk management leaders’ new imperative.

Enterprises have to accelerate to take the initiative not only for cyberattacks, but also for inside threats. In addition, legal compliance, business globalization, consumerization and the IT megatrends such as cloud, mobile, social and big data are forcing security leaders to mend their ways. In this session, we describe the key points security leaders must consider in such situations surrounding the enterprise.

The threat level and risk to midsize enterprises continue to rise with the volume and frequency of attacks, while the resources available to defend against them remain flat. Join us for a discussion about how you can identify the most appropriate technologies and prioritize the actions you can take to protect your organization and manage risk effectively.

This session is a good fit for you if your organization has between five and 50 people in IT and an IT budget between $5 million and $30 million. We prequalify attendees for midsize enterprise sessions based on annual revenue between $50 million and $1 billion.

Companies that responded that DR site has sufficient deal to business continuity are less than 30% of the total (Gartner survey). Although more than a certain number of companies are dealing with this, there is a high possibility that there is a shortage of large-scale disaster countermeasures. On the other hand, there are various options for technologies to realize DR based on IT infrastructure, and it is difficult to judge appropriately.
In this session, we will answer participants' questions interactively, focusing on actions to be performed and comparative consideration points etc., as it is now.

In the age of digitalization, "data" is considered as the source of business value. In Japan, many organizations are launching data-focused businesses but on the other hand, privacy risk is also increasing like never before. In this session, we describe the key points organizations must consider in such situations surrounding the enterprise.
(Although this session may include a discussion of related legal issues, Gartner does not provide legal advice or services, and its research or guidance should not be construed or used as such. The client is strongly advised to consult with their own legal counsel in considering and applying the advice and recommendations contained in this session.)

Regional and country-specific privacy mandates continue to increase. Mapping commonalities and managing risks for differences are crucial for security and risk leaders. This presentation offers a guide on reusing GDPR compliance investment for other major privacy requirements.

As complexity continues to grow and risks, threats and vulnerabilities multiply with no end in sight, how can security and risk management leaders move beyond reacting? Attendees will learn how to think differently about their role in value preservation and value creation, and how finding sweet spots in a human to machine continuum can help. This is the security and risk management leaders’ new imperative.

Application security continues to be a significant challenge for many organizations. This session covers the current outlook for application vulnerabilities and application security programs, as well as the newest developments in application security practices and technologies.

Digital business activities such as IoT have huge impact to coverage and capability of IT division. IT would cover not only employee’s business process optimization but OT and IoT which has totally different requirement for networking and security. This session will focus on new security strategies through networking in digital era for CIO, CISO and network/security leaders in the organization especially network architecture, segmentation, traffic performance and security management etc.

Digital Workplace brings a lot of new technology to Japanese enterprises but SRM leaders are still challenged by not having a whole picture of security for cloud and mobile in the digital age. This session will introduce the approach and leadership for our security aligned to the new technologies for digital workplace.

Early promises of easy, secure and universal authentication through unique personal traits have been unfulfilled for decades, but in the past 10 years we have seen a surge in interest and adoption. Are biometric methods the way forward for every enterprise?
● How does biometric authentication differ from other orthodox methods?
● Where is biometric authentication most popular today — and what are the pitfalls?
● How do biometric technologies fit in an enterprise identity corroboration strategy?

Cloud, mobile, mode 2 and digital business: It is urgent for all companies to securely protect "data" that expands the type and storage location. In this session, we show the concepts necessary for security leaders to tackle data security.

Left to itself, SaaS becomes an unruly pet. Data shares open to the Internet, regulatory noncompliance, overspend and collaboration sprawl negatively impacts everyone.
What are the problems with SaaS?
What processes and policies can help manage SaaS use?
What tools can help govern SaaS?

Endpoints security challenges are rising to new levels of complexity as the definition blurs across clouds, BYO, workstations, mobile, wearable, “things” and pure software. This session will address:
1) How are endpoint security risks expanding?
2) What are the primary attack trends that will influence the strategic requirements for endpoint security?
3) Which technologies and practices will protect endpoints in 2025?

Like AI before it, quantum computing and related quantum technologies like quantum key exchange, quantum random number generation and homomorphic encryption are poised to make huge changes to the technology landscape as they mature. What are the important quantum computing technologies that will impact your business? How long will established security tools like RSA change?

Orthodox, credential-based authentication does not scale to the needs of digital business. Here, we discuss how new analytics-centric identity corroboration tools facilitate a CARTA (Continuous Adaptive Risk and Trust Assessment) approach to user authentication.
Key issues:
- What are the weaknesses of orthodox methods?
- How can IAM leaders evaluate and meet user authentication needs?
- How will enterprises benefit from taking a strategic CARTA approach?

Organizations are experimenting with artificial intelligence in security. As evaluation procedures mature, the first disillusions happen. This session will review the state of AI and machine learning usage in various security and risk management areas, and give CISOs recommendations to:
1. Navigate toward AI marketing
2. Define evaluation principle for solutions adding new algorithmic approaches to existing security fields
3. Prepare to avoid or minimize the backlash when results are not up to expectations

EDR (Endpoint Detection and Response) has increased its presence, rapidly integrating with EPP (Endpoint Protection Platform). Endpoint security is fundamentally changing its form. In this session, the analyst interactively answers questions from participants about the trend of Endpoint Security.

Cloud security remains a top priority. This presentation summarizes the problems, recommended processes, and new product types to address three key issues:
What are the unique risks associated with public cloud service providers, and how can they be controlled?
What are the unique security challenges of IaaS and how can they be mitigated?
What are the unique control challenges of SaaS, and how can they be addressed?

Digital workplace, public cloud and IoT bring a lot of traffic between the internet and it has a huge impact to capability of internet gateway and its security resources. This session is a good opportunity for network/security leaders to share these challenges and find the direction to solve them together.

Application security testing is challenged by the pace and complexity of application development and questions exist around the value they add. In this session， we will cover how application security testing technologies might advance in the coming years or how alternatives may emerge.

Applications are changing, yet most organizations still protect their applications with traditional defenses. Serverless, mobile and single page JavaScript applications are only a few examples. New attacks arise, such as the ones operated by the Magecart group. This session will illustrate how security leaders can avoid this trend from becoming a security failure.
How are applications changing with digital business?
What application security strategies can accommodate this change?
Which tools and techniques can protect against new threats?

Robotic Process Automation allows to automate repetitive tasks and is rapidly being adopted. RPA bots are often used to automate finance and accounting operations. Security leaders should put best practices in place to avoid fraud, data breaches and data leakage from RPA bots. This presentation will highlight what the most common mistakes are and how to correct them.
1. What is RPA and what are the risks?
2. What are the best practices that SRM should follow to secure RPA?

Enterprise architecture evolves, but network segmentation remains a foundational element for network security leaders. While the principle is not new, finding the right balance between security and agility remains difficult. Many network segmentation projects fail before they reached the expected objective. Successful network security design projects require to:
1. Understand what segmentation should achieve, and what are the required complementary approaches
2. Leverage best practices for zoning decision, policy management and segmentation enforcement
3. Know where to start, and when to stop

A new era is about to begin. There is a need for infrastructure strategy for the new world which is not an extension so far. It is assumed to be digital, mode 2, cloud.
In this session, we describe the next-generation infrastructure strategy, IT organization and people’s way of thinking to accelerate preparation for disruption.

This session will highlight the latest trends in network-based advanced threat detection, including new techniques for anomaly detection. We will address challenges such as the growing percentage of encrypted traffic and its impact on threat detection. Attendees will learn about the key vendors in the market.

When building a security operation center, or trying to improve the visibility over threats, an abundance of new technologies overwhelm security leaders with too many options. This session will highlight the benefits and compare the use cases for the most useful security analytics tools. Technologies covered in this session include: SIEM, network traffic analysis, user behavior analytics, endpoint detection and response, intrusion detection, full packet capture and SOAR.