CISO Summit No. 11: Detection of Threats and APT

Keynote I: Addressing General Threats and APT: Experience with an all-in-one approach

Speaker: Stefan Lüders

Like any other enterprise, university and organization, CERN is under permanent cyber-attack: automatic scans, script-kiddies, white hats, hacktivists, but also through advanced persistent threat (APT) actors trying to infiltrate the organization. Given CERN’s academic environment, however, CERN cyber-security must be well balanced with CERN’s academic mandate and the free and open operation of its assets. This presentation shall outline CERN’s computing environment, the identified cyber-risks associated with it, and the various measures implemented and deployed in order to prevent, protect and detect any kind of cyber-attack.

Stefan Lüders, PhD, graduated from the Swiss Federal Institute of Technology in Zurich and joined CERN in 2002. 2009 on-going, he is heading the CERN Computer Security Incident Response Team as CERN’s Computer Security Officer with the mandate to coordinate all aspects of CERN’s computer security – office computing security, computer centre security, GRID computing security and control system security – whilst taking into account CERN’s operational needs. Dr. Lüders has presented on computer security and control system cyber-security topics at many different occasions to international bodies, governments, and companies, and has published several articles.

Keynote II: Communication throughout incidents and crisis

Speaker: Juan Carlos Lopez Ruggiero

The communication concept in security incidents and crisis management is a subject that involves three disciplines with common elements: Security, Risk and Compliance. By identifying how to communicate, it means knowing how to handle it. The speaker will bring up communication processes and notions used in case of incidents and crises and share some “do and dont’s” from real environments with an eye on the imminent GDPR regulation. Three basic aspects of the speech are:

• The Incident must stay underground.
• The Incident can be communicated internally, but to a limited group (still secret).
• The Incident must be brought to media.

Juan Carlos Lopez Ruggiero is global Risk and Security Executive with 20+ years experience in implementing complex IT solutions in Risk Management, Cyber Security, Regulatory Compliance and Quality Management across multiple countries and industries. He lead IT organizations in implementing COSO, COBIT, ERM, ISO 27001, 6SIGMA, ISO 31000 and CMMI tenets, Lean Manufacturing strategies, and metric-based management. Having been the global CISO and Chief Risk Officer for Royal Philips, Juan Carlos is currently the CSO for DXC Technology in Switzerland and GDPR Lead for the EMEA region. He owns a degree in Law and speaks at least 7 languages fluently.