AGENDA AT A GLANCEDAY ONE DAY TWO DAY THREE Delivering Pragmatic & Value-Adding Security Information Security Risk: A Comprehensive & Balanced Risk Management Approach CISO Roundtable – Applying Your Information Security Experience to Deliver Beneficial Results CHAIRED BY DAY ONE: Marcus Alldrick, CISO, Lloyd’s DAY TWO: Michael Colao, Global CISO & Director Information Management, Dresdner Kleinwort DAY THREE: Charles V. Pask, Managing Director, ITSEC Associates Ltd • • • • • • • • • • • SPEAKER PANEL Alastair MacWillson, Managing Director of Global Security Practice, Accenture Andreas Wuchner-Bruehl, Global Head of IT Security, Novartis Pharma AG Berthold Kerl, Managing Director, Head of IT Security Governance, Deutsche Bank AG Bill Pepper, Recently Director of Security Risk Management, Computer Sciences Corporation Charles V. Pask, Managing Director, ITSEC Associates Ltd Dr. Cheryl Hennell, Head of IT Security and Information Assurance, Openreach Daniel Barriuso, Head of IT Risk EMEA, Credit Suisse Dave Pope, Head of Information Security - Information Assurance Group, DVLA David Tyrrell, Country Sales Manager, UK, Everett Dr. Alastair MacWillson, Managing Director of Global Security Practice, Accenture Dr. Eduardo Gelbstein, Adjunct Professor, Webster University (Geneva), Former Advisor to the UN Board of Auditors and Former Director, UN International Computing Centre Dr. Eduardo Solana, Senior Lecturer, University of Geneva Eddie Schwartz, Vice President, Chief Security Officer, NetWitness Edward P. Gibson, FBCS*, Chief Cyber Security Advisor, Microsoft Ltd, UK Floris Van Den Dool, Security EMEA Lead, Accenture Dr. Frank Marsh, Associate, BurrillGreen Ltd Janet Day, IT Director, Berwin Leighton Paisner LLP Jay Libove, Recently Global Data Protection Manager, Transcom Worldwide Joel Bernard, Sales Development Manager, Seagate Technology John Colley, Managing Director EMEA, (ISC)2 EMEA Jorge Pinto, Chief Security Officer, InfoSec.ONline.pt, Portugal Julia Harris, Head of Information Security, BBC Marcus Alldrick, CISO, Lloyd’s Mark Chaplin, Senior Research Consultant, Information Security Forum Mark Concar, AEB Data Security Director, Standard Chartered Bank Mark Logsdon, Information Risk Management, Barclays Michael Colao, Global CISO & Director Information Management, Dresdner Kleinwort Neil Jarvis, Head of IT Security, IT Risk and Business Continuity, DHL Exel Supply Chain Paul Hopkins, Head of Network Vulnerability Intelligence e-Security Group, University of Warwick Paul Wood, Group Chief Security Officer, Aviva Paula J. Chlebowski, Head of Group Information Security, HSBC Holdings plc Pedro Pombo Rodrigues, Manager – Technology Consulting Security Practice, Accenture Phil Genge, Head of Information Security, Nationwide Building Society Philippe Huard, Sales Development Manager, Seagate Technology Quentyn Taylor, Director of European Information Security, Canon Europe Ray Stanton, Global Head of Business Continuity, Security & Governance Practice, BT Richard Hollis, CEO, Orthus Ltd. Robert Coles, Global CISO, Merrill Lynch Sarb Sembhi, President, ISACA London Chapter Tony Crilly, Managing Director, Saladin Technical Services plc Valerie Jenkins, Head of Information Security, Zurich Financial Services Walid Kamal, VP, Technology Security Risk Management, DU Telecom, United Arab Emirates • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • SPONSORS Gold Sponsor Silver Sponsor Lead CISO Roundtable Sponsor Cocktail Sponsor Lunch Sponsor Gigabyte Exhibition PANEL • Measuring true security benefits while avoiding reliance on key performance indicators • Can the trust brought by online security really drive bottom line results? • Adopting cost cutting strategies versus maintaining business security & sustainability • Top tips to create value between information security & the business • Understanding the urgent imperative for your business • Steering a top security team through the global downsizing trend • Finding new ways to do things Chaired by: Ray Stanton. Head of Information Security . Gibson. CISO. Sales Development Manager. Novartis Pharma AG LOCK UP THE DATA . Credit Suisse. Associate. Lloyd's THE FUTURE OF INFORMATION SECURITY Michael Colao. FBCS*. Global CISO & Director Information Management.Information Assurance Group. Head of Information Security . UK SECURING INFORMATION THROUGH TIMES OF EXTENSIVE CHANGE – CASE STUDY Mark Concar. BT Panellists: Edward P. Country Sales Manager. Head of Information Security. BBC. Standard Chartered Bank HOW TO USE YOUR INFORMATION SECURITY SKILLS TO ADD TO THE BOTTOM LINE – CASE STUDY Quentyn Taylor.KEYNOTE Dr.NOT THE CEO. Global Head of IT Security. VP.CASE STUDY Phil Genge. BurrillGreen Ltd WHAT DOES WORLDCLASS LOOK LIKE? David Tyrrell. AEB Data Security Director. Security & Governance Practice. Head of IT Risk EMEA. DU Telecom. Zurich Financial Services LINING UP ASSURANCE & IDENTIFYING YOUR TOP INFORMATION RISKS: INTERNAL AUDIT & INFORMATION SECURITY – CASE STUDY Dave Pope. Dave Pope.PRE-EVENT: TUESDAY 9TH JUNE 2009 19:00 – 21:00 WELCOME DRINKS RECEPTION IN THE GARDENS OF MARRIOTT HOTEL – KINDLY SPONSORED BY: CISO SUMMIT DAY ONE: WEDNESDAY 10TH JUNE 2009 Delivering Pragmatic & Value-Adding Security 08:00 08:30 REGISTRATION & COFFEE CHAIRMAN’S OPENING Marcus Alldrick. Alastair MacWillson. Daniel Barriuso. Frank Marsh. Global Head of Business Continuity. Accenture FROM A TIME OF CRISIS COMES A TIME OF CHANGE . Managing Director of Global Security Practice. Chief Cyber Security Advisor. Seagate Technology IS INFORMATION SECURITY RELEVANT TO YOUR BUSINESS STRATEGY? Dr. DVLA. Walid Kamal. Director of European Information Security. Nationwide Building Society MORNING COFFEE BREAK & EXHIBITION MANAGING INFORMATION SECURITY FOR STRATEGIC ADVANTAGE – CASE STUDY Andreas Wuchner-Bruehl. Technology Security Risk Management. Valerie Jenkins. DVLA. Dresdner Kleinwort BALANCING ENTERPRISE RISK IN THE NEW NORMAL . Canon Europe AFTERNOON TEA BREAK & EXHIBITION 08:40 09:40 10:10 10:40 11:10 11:40 12:05 12:45 13:00 14:00 14:35 15:05 15:35 16:05 .Information Assurance Group. United Arab Emirates. Head of Information Security. Head of Information Security. Julia Harris. Everett UK LUNCH MARRIOTT RESTAURANT– KINDLY SPONSORED BY: CREATING VALUE & TRUST BETWEEN INFORMATION SECURITY & THE BUSINESS DURING DIFFICULT TIMES: TRANSFORMING INFORMATION SECURITY TO MISSION-CRITICAL SECURITY . SAFEGUARDING DATA WITH SEAGATE SELF-ENCRYPTING HARD DRIVES Joel Bernard. Microsoft Ltd. Richard Hollis. Group Chief Security Officer.DELIVERING GLOBAL CONSISTENCY IN INFORMATION SECURITY – CASE STUDY Paula J. Dresdner Kleinwort. President. Orthus Ltd. Adjunct Professor. UN International Computing Centre CHAIRMAN’S CLOSE OF DAY ONE COACH LEAVES FROM OUTSIDE MARRIOTT HOTEL LOBBY CISO PORT & WINE TASTING RECEPTION. Global CISO. Former Advisor to the UN Board of Auditors and Former Director. Global CISO & Director Information Management. Deutsche Bank AG. ITSEC Associates Ltd Panellists: Berthold Kerl. Aviva Group THE COMMON SENSE & NONSENSE OF JUSTIFYING SECURITY INVESTMENTS – CASE STUDY Dr. Geneva. Merrill Lynch. Chlebowski.. HSBC Holdings plc HUMAN ERROR: THE TOP SECURITY CONCERN IN A MULTI-NATIONAL ORGANISATION? – CASE STUDY Paul Wood. LISBON: KINDLY SPONSORED BY: 17:00 17:35 18:05 18:35 18:50 19:00 . Managing Director. CEO. Head of IT Security Governance. Managing Director. Pask. Michael Colao. Sarb Sembhi.16:30 MANAGING THE INSIDER THREAT & DETECTING MASSIVE CONTROL FAILURES – IS THIS A ROLE FOR TODAY’S SECURITY CHIEFS? – PANEL Managing insider access risk • How far to police or trust staff. Eduardo Gelbstein. & how to maintain thought leadership across highly networked groups of staff •Protecting your organisation from the greed of top execs: a valid role for today’s CISO? Chaired by: Charles V.21:00 . Robert Coles. ISACA London Chapter COP TO CONSULTANT . Webster University. Head of Group Information Security. Vice President. CISO. Jorge Pinto. Dr. Associate. Eddie Schwartz. Eduardo Solana. Chief Cyber Security Advisor. (ISC)2 EMEA LUNCH INTERACTIVE SESSIONS – PLEASE SELECT YOUR PREFERRED BREAK-OUT TOPIC BREAK-OUT B: THE CONVERGING WORLDS OF PHYSICAL & DIGITAL SECURITY – INTERACTIVE SESSION! Dr. Manager – Technology Consulting Security Practice. Barclays WHY SECURE CODING IS NOT ENOUGH John Colley. CEO. Chief Security Officer. AFTERNOON TEA BREAK & SPONSORS’ PRIZE DRAW – PASSPORT TO PRIZES! 15:00 15:30 15:55 . Accenture “SUPERPHREAK": WHATEVER HAPPENED TO MODEM SECURITY? Richard Hollis. DHL Exel Supply Chain.PANEL • What are the top 3 technology risks & trends on your priority list? • How has the global financial crisis & the uncovering of recent high profile frauds impacted your approach to security? • How to manage social networking vulnerabilities • The threat of social engineering to hijack sensitive information • How will emerging risks (malware & attack vectors. Head of IT Risk EMEA. Recently Director of Security Risk Management. Territory Sales. Southern Europe. Head of IT Security. Lloyd's MANAGING THIRD PARTY DATA SECURITY – CASE STUDY Daniel Barriuso. NetWitness Corporation. Neil Jarvis. BurrillGreen Ltd 08:35 09:10 09:40 10:10 10:40 11:25 12:25 13:00 14:00 BREAK-OUT A: SECURITY & PRIVACY ASSURANCE IN OUTSOURCING & OFFSHORING A NEW CHALLENGE Bill Pepper. OUR INFORMATION. IT Risk and Business Continuity. Credit Suisse WHAT EVERY CISO SHOULD KNOW ABOUT INDUSTRIAL ESPIONAGE: MANAGING THE BROADER THREATS TO INFORMATION SECURITY Tony Crilly. Chief Security Officer.ONline.pt. Portugal.CISO SUMMIT DAY TWO: THURSDAY 11TH JUNE 2009 Information Security Risk: A Comprehensive & Balanced Risk Management Approach 08:00 08:30 COFFEE CHAIRMAN’S RE-OPENING Michael Colao. Orthus Ltd. Aviva Panellists: Edward P. Global CISO & Director Information Management. University of Warwick THE PORTUGUESE NATIONAL ID CARD PROGRAMME –CASE STUDY Pedro Pombo Rodrigues. MORNING COFFEE BREAK & EXHIBITION UNDERSTANDING THE GLOBAL THREAT ENVIRONMENT: WHAT ARE THE KEY EMERGING INFORMATION SECURITY & E-CRIME RISKS TODAY? . viruses) affect your organisation? • What are your plans to test your security strategy & take a proactive stance? • Recommendations going forward Chaired by: Paul Wood. Managing Director. Seagate Technology. Group Chief Security Officer. Microsoft Ltd. InfoSec. Saladin Technical Services plc. University of Geneva AWARENESS RAISING: MAKING ‘THE RISK. Dresdner Kleinwort PATCH MANAGEMENT: INCREASINGLY A FACET OF EFFECTIVE RISK MANAGEMENT – CASE STUDY Marcus Alldrick. Computer Sciences Corporation 14:30 PRIVACY ENHANCING TECHNOLOGIES (PET's) – ACADEMIC INSIGHTS Paul Hopkins. FBCS*. Senior Lecturer. Head of Network Vulnerability Intelligence e-Security Group. Gibson. Frank Marsh. Philippe Huard. Managing Director EMEA. YOUR RESPONSIBILITY’ & OTHER AWARENESS MATERIAL – CASE STUDY Mark Logsdon. Information Risk Management. IT Risk and Business Continuity. Information Security Forum CLOSE OF DAY TWO COACH LEAVES FROM OUTSIDE MARRIOTT HOTEL LOBBY FOR SINTRA TOUR & DINNER AT RESTAURANTE PISCINAS AZENHAS DO MAR . Head of IT Security. Global CISO & Director Information Management. Frank Marsh. Dresdner Kleinwort. University of Warwick.16:25 SECURITY VS. Head of Network Vulnerability Intelligence e-Security Group. Mark Chaplin. Michael Colao. Marcus Alldrick. Senior Research Consultant.searches? • What is the privacy role of the CISO? • Should there be a "privacy officer" separately from the Security team? • How does a CISO balance the need for privacy during investigations? • Do you prevent. Recently Global Data Protection Manager. Information Security Forum. PRIVACY . DHL Exel Supply Chain PROTECTING INFORMATION IN THE END USER ENVIRONMENT Mark Chaplin. Janet Day. allow and monitor or allow & not monitor? Who sets the rules? Chaired by: Dr.CASE STUDY Neil Jarvis. CISO. Senior Research Consultant. Lloyd's.PANEL • What do we mean by privacy? Information about us? Information belonging to us? Space we regard as ours like a phone or bag? Our physical privacy . Berwin Leighton Paisner LLP CONSUMER APPLICATIONS: CREATING SECURITY PROBLEMS? . BurrillGreen Ltd Panellists: Jay Libove. IT Director.KINDLY SPONSORED BY: 16:55 17:25 18:00 18:30 . Transcom Worldwide. Associate. Paul Hopkins. and 5-minutes to present the key learning points from each session back to the full group after the break. Cheryl Hennell Supported by: Marcus Alldrick Notes by: Paul Wood SESSION 6: SERVICE PROVIDERS – WHAT TO EXPECT FROM THEM –REAL ENGAGEMENT STORIES – PANEL & OPEN QUESTIONS FROM AUDIENCE Lead Facilitator: Floris Van Den Dool Supported by: Michael Colao Notes by: Eddie Schwartz SESSION 7: OPTIONAL . Pask SESSION 2: IT RISK METRICS: WHAT’S WRONG WITH THEM & WHAT NEEDS TO BE FIXED TO MAKE THEM WORK Lead Facilitator: Eddie Schwartz Supported by: Mark Chaplin Notes by: Marcus Alldrick MORNING COFFEE BREAK SESSION 3: TO BE CONFIRMED Lead Facilitator: Michael Colao Supported by: Eddie Schwartz Notes by: Floris Van Den Dool LUNCH SESSION 4: BREAKOUT SESSIONS The group will break into two teams for specific discussions. 30-minutes of group discussion.30 MINUTE CLOSE SESSION FOR REAL-LIFE SECURITY INCIDENTS This is an opportunity for those who have agreed to a confidentiality agreement in advance to attend a ‘closed door’ 30 minute session where participants can discuss real life information security incidents & discuss possible solutions. SESSION 4B: MORE REGULATION & LEGISLATION ON THE WAY . Cheryl Hennell 09:10 – 10:00 10:00 – 11:00 11:00 – 11:20 11:20 – 12:20 12:20 – 13:20 13:20 – 14:05 SESSION 4A: EMERGING THREATS – ARE THERE ANY NEW ISSUES OR ARE THEY JUST OLD ISSUES REHYPED? Lead Facilitator: Charles V. Pask SESSION 1: RISK DECISION TAKING: ARE DECISIONS MORE INSTINCT THAN INFORMED JUDGEMENT? Lead Facilitator: Marcus Alldrick Supported by: Floris Van Den Dool Notes by: Charles V. Each team will have the support of 4 facilitators.HOW CAN SENSITIVE INFORMATION STAY FAITHFUL TO ITS ORGANISATION? Lead Facilitator: Dr.CISO ROUNDTABLE: FRIDAY 12TH JUNE 2009 Applying Your Security Experience to Deliver Beneficial Results 08:30 – 09:00 09:00 – 09:10 REGISTRATION & COFFEE CISO Roundtable Sponsored by: WELCOME. including a 10-minute presentation by the facilitator. Pask Supported by: Mark Chaplin & Eddie Schwartz Notes by: Michael Colao 14:05 – 14:20 14:20 – 14:35 14:35 – 15:35 FEEDBACK FROM THE BREAKOUT SESSIONS TO THE FULL GROUP AFTERNOON TEA BREAK SESSION 5: NEW INTERACTIVE SESSION . GROUP INTRODUCTIONS & SETTING OF AGENDA PRIORITIES Chaired by: Charles V.DO WE NEED IT & SHOULD IT BECOME MORE PRESCRIPTIVE? Lead Facilitator: Marcus Alldrick Supported by: Paul Wood & Floris Van Den Dool Notes by: Dr. 15:35 – 15:50 15:50 – 16:20 Lead Facilitator: Paul Wood Supported by: All Facilitators 16:20 CLOSE OF DAY . Before that Marcus was Head of Information Security for Abbey National plc. a Senior Computer Scientist at CSC where he was Technical Director of the DSS Information Security Laboratory. . Cheryl Hennell. Mr. developing secure information systems. both in the UK and in its overseas locations. Group Chief Security Officer. Department of State. CISO. Development & Globalisation for the BT Business Continuity. Cheryl is an active CISSP & has recently been appointed as an ambassador for Childnet delivering training sessions in schools. information security. Schwartz has a B. Since 1996 has been working in Financial Technology in London. Her academic interests lie in the analysis & design of information systems. SVP of Operations at Guardent. Prior to joining the ISF Mark was responsible for information security at a multinational FTSE 250 company.I. in-house training courses. working in IT Advisory & specialising in information security strategy definition & implementation. regulation and legislation. Mr. He has since lived in three continents & has lectured globally on security technology issues. business-oriented approach to managing information risk. Global CISO & Director Information Management. The Office of Population. Senior Research Consultant. Cheryl was a Senior Lecturer at the University of Portsmouth. From Jul 99 – Apr 06 he was the Chief Security Officer for UBS Investment Bank. Eddie Schwartz. He is a member of the ISSA Advisory Board. fraud.ABOUT THE CISO ROUNDTABLE 2009 FACULTY: CHAIRMAN: Charles V. standards. he was Chief Technology Officer of ManTech Information Systems and Technology Corporation. Previously. Security & Governance Practice. He graduated from the Massachusetts Institute of Technology in 1987 where he studied Mathematics & Computer Science. Marcus was a Principal Advisor for KPMG. CISO for Nationwide Insurance. In April 06 he assumed the appointment of Group Chief Security Officer for Aviva Group. Schwartz has advised a number of security companies. a leading UK bank. Currently he is helping a number of organisations with the security aspects of outsourcing as well as outsourced security services. Openreach Prior to her current position. He joined the Civil Aviation Authority / National Air Traffic Services as the Head of Corporate Security. She designed. including public training courses. This role means that Michael is both the Global Head of Information Security for the Bank as well as the Global Head of Data Protection and Privacy. while complying with the requirements of internal standards. He has worked in diverse roles from consultancy to information security governance and strategy for blue-chip organisations. EVP and General Manager for Global Integrity/Predictive Systems. Mark is also responsible for the ISF’s Standard of Good Practice for Information Security. part of Barclays plc & Europe’s largest credit card issuer. He worked in a number of security roles within government from 1974 until he retired in 1995 from the Directorate of Security Policy. a founder member & now Director on the Board of IISP & a member of many other professional security forums. He has a strong side-interest in computer forensics & in the management of digital evidence. Mark runs global research projects for the ISF on all aspects of information security.S. including governance. Information Security Forum Mark is an information risk management professional with over 18 years of experience in IT and information security. Managing Director. NetWitness Corporation Eddie is Chief Security Officer of NetWitness and has 25 years experience in the information security and privacy fields. Mr.& IT security. Floris has been active in IT consulting & security for 20 years & lectures at Erasmus University in Rotterdam on the topics like Computer Architectures. Aviva Paul has over 30 years experience in the security arena.S. FACILITATORS: Marcus Alldrick. Security EMEA Lead. Paul Wood. He was awarded the MBE in the 1995 New Years’ Honours List. More recently Charles was the Global Head of Strategy. Vice President. Censuses & Surveys & as a European consultant for a blue chip organisation. Marcus has worked in IT for over 30 years. Pask has over 20 years’ experience in IT.S. IT audit. business continuity & disaster recovery. contracts. Michael Colao. Prior to joining Lloyd’s. a position he held for six years following seven years as Information Risk and Security Manager for Barclaycard. Chief Security Officer. & was the Information Security Manager for Alliance & Leicester plc prior to joining MIS. Head of IT Security and Information Assurance. He is the Director of Information Management. in Information Technology Management from the George Mason University School of Management. Following 3 decades in the IT industry working for the Ministry of Defence. Accenture Floris provides services to several of Accenture’s main clients across all industries. and a Foreign Service Officer with the U. Mark Chaplin. in Information Security Management and an M. counter-terrorist & executive protection. he has responsibility for all aspects of security across the Group. risk management and compliance. Senior and Line Management. ITSEC Associates Ltd Charles is responsible for delivering global IT security & IT audit services. Dr. He believes in a risk-based. at the Ministry of Defence. Pask. she entered academia. IT auditing & Security. Dresdner Kleinwort Michael has been with Dresdner Kleinwort since 1999. with responsibilities for all aspects of physical & information security. Lloyd's In his role at Lloyd’s Marcus is responsible for ensuring that risks to information are understood & adequately mitigated in a cost effective manner throughout the organisation. specialising in information risk & security for the latter 17 years. conferences & symposiums. & digital forensics. Paul is a regular speaker on security matters. and served on the Executive Committee for the Banking Information Technology Secretariat (BITS). he was a Director with MIS Training. & that assurance to this effect is provided to Executive.& Director of Information Security Institute (ISI) European & Middle East e-Security Services. Floris Van Den Dool. developed & led lectures on the BSc (Hons) Digital Forensics degree for the University of Portsmouth. Previously. dealing with crime.