Swiss CISO Summits take place three times a year. This overview details past events.
march 2016

Event Details
Keynote 1: Privacy 2.0: What to expect from the new data protection laws in Europe? Speaker: David Rosenthal, Homburger AG: Privacy 2.0 20 years after their creation, the data protection laws in Europe are
Event Details
Keynote 1: Privacy 2.0: What to expect from the new data protection laws in Europe?
Speaker: David Rosenthal, Homburger AG: Privacy 2.0
20 years after their creation, the data protection laws in Europe are being revised completely. This is true also for Switzerland. While in some areas life will become easier, in particular for multinationals, overall, the costs of data protection compliance will increase. In addition, fines will increase in case of non-compliance. This presentation will provide an update on what is going on, an overview of key changes in law to expect in the upcoming years, and the resulting challenges companies will have to deal with, with a particular focus on Switzerland.
David Rosenthal, counsel at Homburger AG, is one of the opinion leaders in the area of data protection in Switzerland. He has authored a commentary on the Swiss Data Protection Act. He also regularly advises companies on data protection compliance issues and disputes as well as the Swiss government, e.g. in connection with its projects to revise Swiss law. He co-heads the IT law practice at Homburger, one of the largest Zurich business law firms, acts as the secretary of the Swiss Association of Corporate Data Protection (VUD) and the Swiss Association of E-Discovery and Investigations (SeDIV) and he lectures at ETHZ and at the University of Basel. Before getting in to the legal profession, he worked as a journalist and software developer.
Keynote 2: Integration of Information Digital Rights Management (DRM) in IT Infrastructure and Business Processes: challenges and experience sharing
Speaker: Marek Pietrzyk, UBS AG
Integration of Digital Rights Management (DRM) in IT Infrastructure and Business Processes: challenges and experience sharing. The initial step in DRM is policy development in order to protect bank‘s sensitive customer data from unauthorized internal access and uncompliant disclosure, as well as to fulfil bank‘s regulatory obligations, protect its reputation and avoid financial fines. Evaluation of efficient data protection solutions is the base for a successful implementation. Application of leading edge technology for mastering both, usability and overall complexity was of paramount importance when implementing and deploying DRM. A review of the impact on daily business processes and end-user experience of the data protection solution is assessing DRM’s business performance. Recommendations in form of a six-step program for establishing a balanced ecosystem for managing sensitive data conclude the presentation.
Marek Pietrzyk, director and program manager of the UBS client data confidentiality programme DRM is responsible for cost effective implementation of the bank’s sophisticated cyber defence requirements on client data protection. In various positions such as business analyst, strategy consultant, IT architect and project manager, he gained more than twenty years of experience as information security practitioner in the financial industry. He is an author of several publications on software architecture and requirements management and is distinguished speaker at major information security, identity management and e-crime conferences with focus on data protection.
Time
(Tuesday) 12:00
Location
EMA House, Zürich
Nordstrasse 1, 8006 Zürich
may 2016

Event Details
Keynote 1: Corporate Security is an Ecosystem Speaker: Alain Beuchat, UBS Corporate Security cannot be successfully implemented without including employees, clients, vendors and third-parties in an overall security concept. This seems straightforward and
Event Details
Keynote 1: Corporate Security is an Ecosystem
Speaker: Alain Beuchat, UBS
Corporate Security cannot be successfully implemented without including employees, clients, vendors and third-parties in an overall security concept. This seems straightforward and logical. However it is a difficult undertaken as the perception of risk, the amount of resources and budget and priorities is usually quite different across the several actors. This presentation will show some of the challenges and potential ways to integrate clients and third-parties in a Corporate Security ecosystem.
Alain Beuchat is Group Information Security Officer at UBS. Alain focuses on adapting the bank‘s Cyber Security defense and Data Protection framework to the evolving threat landscape. Alain has more than 20 years of experience in the domains of IT risk management and information security primarily in the financial and telecommunication industry. He has occupied several positions as information security officer, security consultant and security engineer.
Keynote 2: Threat Intelligence – A Key Piece Towards Achieving Improved Understanding
Speaker: Mark Barwinski, PwC
Increasingly information is under threat of corruption, destruction, or theft. Better understanding the context of these attacks and who is behind them may lead to not just faster recovery from a compromise, but also proactive defence against known tactics, techniques, and procedures. Integrating a Cyber Threat Intelligence Fusion Center into your architecture complements a holistic defensive posture through enriched pertinent information.
Mark Barwinski is Director for Threat Intelligence and Incident Response at PwC Switzerland. He joined PwC following 11 years of cyber related experience attained at the U.S. Department of Defense in Washington D.C., Germany, Afghanistan, and Canada. He has served in a variety of leadership and liaison roles supporting military operations, defending the Global Information Grid (GiG), and promoting joint discovery and response efforts among partner states. Focused on leveraging actionable information acquired from intelligence and incident response activities, he will highlight the benefits of an integrated Cyber Threat Intelligence Fusion Center into a corporate security architecture.
Time
(Tuesday) 12:00
october 2016
18oct12:00CISO Summit No. 8: Cybersecurity as part of integral corporate security

Event Details
Keynote 1: Protecting the enterprise: IT risk and security in the overall corporate context Speaker: Domenico Salvati How does information technology contribute to the protection of the enterprise? What is its role in
Event Details
Keynote 1: Protecting the enterprise: IT risk and security in the overall corporate context
Speaker: Domenico Salvati
How does information technology contribute to the protection of the enterprise? What is its role in the overall corporate security context? Domenico Salvati highlights the context in which corporate boards perceive cyber security. While the important role of cyber security is unquestioned today, IT risk and security experts tend to overlook the fact that it is (only) one piece of the overall security puzzle. To further advance cyber security, the CISO needs to position it within a corporate security framework.
To sharpen the role of cyber security in the corporate context, Domenico merges the Governance, Risk and Compliance (GRC) and the Three Lines of Defense models and positions cybersecurity within this comprehensive view of the enterprise. A third concept rests on terminology and is concerned with “events” and (security) “measures”. As will be shown, the aforementioned concepts underlying information technology are also suited to position other corporate risk and compliance functions in a corporate context (cybersecurity being one of them). In conse- quence, this view of the overall corporate security context yields the opportunity to create a well-tuned reporting system including other functions such as compliance management or data protection to name a few.
For over ten years Domenico Salvati has worked in positions such as “IT Risk Response & Mitigation”, “IT Risk Compliance and Oversight” and “Operational IT Security” most of these for a large Swiss bank. During this period, he also researched the “Management of Information System Risks” at the Swiss Federal Institute of Tech- nology in Zurich (ETHZ) for which he gained his PhD. Since 2010 he holds the position of Enterprise Risk Manager for a large health insurer in Switzerland. With the change from information security to enterprise risk management, Domenico gained a new view on cyber and IT security and will share this with the audience.
Keynote 2: Cyber insurance: What is the scope and by when insurance option is a valuable option?
Speaker: Willi Stössel, Swiss Re Corporate Solutions
Cyber insurance has emerged from data risks and business continuity risk coverage to holistic approaches in order to help enterprises dealing with residual risk. Insurance is the last line of defense for many enterprises before self-carrying the nancial loss of risks. Bruce Schneier introduced the following philosophical concept cybersecurity measures are good to reduce the insurance fee, but there are little arguments only to stretch this border. In the presentation Willy Stössel, a senior experts from SwissRe provides insights on expected corporate cybersecurity measures and their impacts as well as dependencies when offering insurance contracts.
Willy Stössel, is Head of Cyber, Technology & Construction at Swiss Re Corporate Solutions 2007 on-going. The team is responsible for writing primary and excess liability covers for large industrial companies on a worldwide basis. Willy has been instrumental in launching Swiss Re‘s Cyber Liability products and building a large worldwide portfolio of Technology E&O related risks. Prior to this role, he was responsible for the underwriting various other industry segments including heavy machinery, utilities and pharmaceutical companies. He has close to 20 years of experience in the insurance industry and has been always focused on risk transfer of large cooperations.
Time
(Tuesday) 12:00
january 2017
24jan12:00CISO Summit No. 9: Next Generation Corporate Cyber Defence

Event Details
Keynote 1: Best of Breed Security Architecture: Protection Level and Borders of State-of-the-Art Speaker: Rajesh Nair, Detecon (Schweiz) AG Moving on from the traditional focus of defense in depth, there is a need
Event Details
Keynote 1: Best of Breed Security Architecture: Protection Level and Borders of State-of-the-Art
Speaker: Rajesh Nair, Detecon (Schweiz) AG
Moving on from the traditional focus of defense in depth, there is a need to come ever closer to being able to understand security from a business context. Architecting a security solution then becomes even more an integra- ted approach between the IT and Business teams, with Operations becoming more central in the entire chain. Additionally the architecture design extends outside the organizational boundaries speci cally in highly integrated environments. This presentation will explain state-of-the-art security architecture from a different «highest security» perspective.
Rajesh Nair worked with Swissgrid from 2009 in various roles covering Strategy, Archi- tecture, Cyber security and as the Chief Information Of cer. The main focus of his work in Swissgrid was the design and implementation of Swissgrid Architecture, building up a central capability to monitor and control the Swiss National Transmission grid. He led a team of over 120 ICT experts. He was responsible for the Corporate and Industrial IT of Swissgrid as well as for the design and operation of certain critical pan European ICT infrastructures. Rajesh has been in the Energy industry for over 20 years and has worked for ABB, Deloitte Consulting, Suntec and Alstom. He has also had various functional roles leading from Financial controlling, Product development, Strategy, Project Executi- on and General Management in these companies, which gives him a balanced corporate view on technology. From Oct 2016, Rajesh has been a part of the Detecon team, working on a number of strategic initiatives mainly on the topics Cyber Security, Big data and New technologies.
Keynote 2: Detection and Response: Empowered by Intelligence led Security Operations
Speaker: Will Semple, PwC
Observing the market, a relevant shift in security budgets has happened towards detection and response in recent years: By today it is a well-known fact, that anybody will be breached. Readiness for detection and response is the key for mastering the situation and means storing data over a long period (two or more years), understanding the intelligence management lifecycle on strategic, tactical operational and technical level as well as the attack models. Content Detection needs threat intelligence, security analytics and use cases, against which the data are screened. Finally, knowing about a potential breach, in the rst step a veri cation is necessary: if the breach is con rmed prepared measures which can be invoked timely help to master the situation.
This presentation highlights background on the functional principles, how detection and response really work.
Will Semple is a Leader in the PwC Cyber Security Practice responsible for Managed Threat Detection and Response Services, Advanced Security Operations and a Security Analytics SME. Will works with PwC clients globally helping to solve some of the their most challenging cyber risk questions. Prior to PwC Will has served as Head of Global Threat for the New York Stock Exchange, managing cyber risk from nation state attackers, industrial espionage, hacktavism and cybercrime related incidents. Will was later appointed CISO for the European, APAC and Commercial business units of the NYSE overseeing EU and US Regulator interactions for the Exchange on Cyber matters. Will has actively contributed to the industry by serving as Chair of a European Council working group on Network Information Sharing and Incident Response and assisted in the formulation of policy and legislation for Cyber Security in the EU.
Time
(Tuesday) 12:00
Location
Zunfthaus zur Schmiden, Zurich
Marktgasse 20, Zurich
may 2017

Event Details
Keynote: Security Startups: Global trends in security startup investments and the digital identity revolution in Switzerland Speaker: Thomas Dübendorfer, President Swiss ICT Investor Club (SICTIC) Information security is in dire need of innovation
Event Details
Keynote: Security Startups: Global trends in security startup investments and the digital identity revolution in Switzerland
Speaker: Thomas Dübendorfer, President Swiss ICT Investor Club (SICTIC)
Information security is in dire need of innovation as attackers are getting more and more sophisticated, better funded and run better targeted attacks. Thanks to security startups, new cyber defense methods and more secure systems are transferred from research or military to products used daily by corporations around the globe. The talk will show investments in security startups globally that are contributing to innovation and which areas are especially hot. Furthermore, the talk will discuss how to work with a security startup as a corporate customer and which risks to be aware of. Finally, I‘ll highlight some recent developments on digital identities in Switzerland, which will be essential for the security of online business transactions as they are at the core of many digital business processes.
Thomas Dübendorfer is the president of the Swiss ICT Investor Club (SICTIC), an IT security expert and angel investor. He is the co-founder of several Internet technology based start-ups in Switzerland, including Contovista, Frontify, Spontacts and YES Europe AG. He has shaped the Information Security Society Switzerland (ISSS) as president for five years. He has lectured on network security for ten years at ETH Zurich and is the co-founder and chairman of swisssecurity.org, which connects the leaders of all key information security organizations active in Switzerland. He has served in a variety of technology leadership, research, development, teaching, board and consulting roles. He has worked as software engineer in Silicon Valley and seven years as tech lead for fraud detection, security and privacy engineering projects at Google and has received three prestigious EMG awards from the Google founders.
First-hand presentations from startups
Instead of a second speaker we have been inviting eight well selected and distinguished security startups (Futurae, Notakey, Cybellum, IRONSCALE, Minerva, Morphisec, Dathena, and Fireglass) to present in a Pecha Kucha style presentation (7 Minutes) the company and the strategy, functional specification and early adopter case studies of the product.
Innovative “World Coffee” style discussion
The discussions will be between the participants and the startups representative in world coffee style: 15 minutes discussion with each founder / delegate in small groups of 3-5 participants.
Time
(Tuesday) 12:00
october 2017

Event Details
Keynote I: Addressing General Threats and APT: Experience with an all-in-one approach Speaker: Stefan Lüders Like any other enterprise, university and organization, CERN is under permanent cyber-attack: automatic scans, script-kiddies, white hats, hacktivists,
Event Details
Keynote I: Addressing General Threats and APT: Experience with an all-in-one approach
Speaker: Stefan Lüders
Like any other enterprise, university and organization, CERN is under permanent cyber-attack: automatic scans, script-kiddies, white hats, hacktivists, but also through advanced persistent threat (APT) actors trying to infiltrate the organization. Given CERN’s academic environment, however, CERN cyber-security must be well balanced with CERN’s academic mandate and the free and open operation of its assets. This presentation shall outline CERN’s computing environment, the identified cyber-risks associated with it, and the various measures implemented and deployed in order to prevent, protect and detect any kind of cyber-attack.
Stefan Lüders, PhD, graduated from the Swiss Federal Institute of Technology in Zurich and joined CERN in 2002. 2009 on-going, he is heading the CERN Computer Security Incident Response Team as CERN’s Computer Security Officer with the mandate to coordinate all aspects of CERN’s computer security – office computing security, computer centre security, GRID computing security and control system security – whilst taking into account CERN’s operational needs. Dr. Lüders has presented on computer security and control system cyber-security topics at many different occasions to international bodies, governments, and companies, and has published several articles.
Keynote II: Communication throughout incidents and crisis
Speaker: Juan Carlos Lopez Ruggiero
The communication concept in security incidents and crisis management is a subject that involves three disciplines with common elements: Security, Risk and Compliance. By identifying how to communicate, it means knowing how to handle it. The speaker will bring up communication processes and notions used in case of incidents and crises and share some “do and dont’s” from real environments with an eye on the imminent GDPR regulation. Three basic aspects of the speech are:
- The Incident must stay underground.
- The Incident can be communicated internally, but to a limited group (still secret).
- The Incident must be brought to media.
Juan Carlos Lopez Ruggiero is global Risk and Security Executive with 20+ years experience in implementing complex IT solutions in Risk Management, Cyber Security, Regulatory Compliance and Quality Management across multiple countries and industries. He lead IT organizations in implementing COSO, COBIT, ERM, ISO 27001, 6SIGMA, ISO 31000 and CMMI tenets, Lean Manufacturing strategies, and metric-based management. Having been the global CISO and Chief Risk Officer for Royal Philips, Juan Carlos is currently the CSO for DXC Technology in Switzerland and GDPR Lead for the EMEA region. He owns a degree in Law and speaks at least 7 languages fluently.
Time
(Wednesday) 12:00
Location
Culture and Congress Centre Luzern (KKL)
Europaplatz 1, 6005 Luzern
january 2018

Event Details
Keynote I: How to crack the problem of insider threats – practical experiences Speaker: Igor Podebrad The starting point and rst line of defense against insider threats is
Event Details
Keynote I: How to crack the problem of insider threats – practical experiences
Speaker: Igor Podebrad
The starting point and rst line of defense against insider threats is always a well-designed awareness campa- ign. But awareness itself is just a piece in a complex puzzle. Identifying core information assets and its threat model leads to the risks. These risks will be evaluated with a business impact analysis such that transparency of the risk exposure is reached and can trigger an internal discussion for addressing this topic on executive level.
As second and third line of defense measures such precise description of processes i.e. process frameworks, multidimensional attribution of data, four or multiple eyes principle during execution and control, Chinese Walls (the strict segregation of duties and critical or contradicting roles), as well as technical measures such as log- ging of relevant actions and their context frameworks, adequate monitoring, evaluation and alarming schemes are effective in mitigation of insider threats. In special areas additional cameras will help to defend against insi- der threats and have evidence, in case it happens anyway. Experience, which measures have proven as effective, and which measures did not meet the expectation, will be shared.
Igor Podebrad is Group Chief Information Security Of cer at Commerzbank AG, Germa- ny. In addition, he is adjunct professor for digital forensics and cybercrime at university of applied sciences Brandenburg at Havel, owns a PhD from Freie Universität Berlin and relevant research experience in secure computer architectures in collaboration with Helmut Schmidt Universität of the German defense forces in Hamburg. His work experience comprises management positions with tasks in IT security standards, thread analysis, digital forensics and threats mitigation & defense.
Keynote II: What kind of insider threats must we expect and how can we optimize effective counter measures?
Speaker: Andrea Gergen
The cyber security industry is developing more and more sophisticated solutions to make it even more complex for external attackers and insiders to steal the crown jewels of the company. Besides implementing these new solutions, companies are concentrating on implementing policies and awareness programs to mitigate the risk that arising from insiders, the weakest link in the cyber security processes.
Trends are showing that on the one hand the attack surface, i.e. motivations and possibilities for insider threats, is continuing to grow and on the other hand the cyber security programs are concentrating to build more com- plex solutions, additional barriers and more awareness programs. The speaker presents a holistic view about the current state, future trends and a potential way, how to get more out of the current measures by taking an insider-type-centric view.
Andrea Gergen is director in the area of cybersecurity and privacy at PwC Switzerland. In her function as lead of the Cyber-as-a-Service (CaaS) team she is supporting clients in transforming security solutions into an end to end working, risk and cost optimized security platform. Andrea has over 15 years of experience in IT- and strategy consulting in different industries like nancial services, telecommunication, pharma, chemical and automotive focusing on the implementation and transformation of IT security service management, process- and service optimization and standardization, IT strategy ma- nagement and innovation as well as Business Transformation Management.
Time
(Tuesday) 12:00
Location
Zunfthaus zur Schmiden, Zurich
Marktgasse 20, Zurich
may 2018

Event Details
IoT and Industrial Control Systems (ICS) – Concepts, Risks, and the new Role for the CISO Internet of Things (IoT) services, Industrial Control Systems (ICS)
Event Details
IoT and Industrial Control Systems (ICS) – Concepts, Risks, and the new Role for the CISO
Internet of Things (IoT) services, Industrial Control Systems (ICS) and Supervisory Control and Data Acquisition (SCADA) are connected today to internet via the corporate network. In many corporationsthese systems are in separate network security zones, with strong firewalls in-between. The securityrisks of these technologies come from many sides, internal devices as well as mass installation from outside such as DDoS attacks from COTS cameras world-wide directed on a few servers. For both security risks CISO must elaborate security plans. With two leading speakers, one from research and innovation, one from an early adopter of the upcoming technologies the discussion at the round table will be introduced and stimulated.
IoT services, Industrial Control Systems (ICS), Supervisory Control and Data Acquisition (SCADA), Industry 4.0 and Digital Transformation are pending issues in any enterprise, and future business success will depend on timely and proper application and integration of these new concepts. In this context the CISO’s organisation must be included in such projects and provide solutions for security and resilience in the three phases „protect, detect and response“.
As usual, the goal of Summit 13 is to learn from the speakers, from each other and from the background material which will be distributed before the meeting for exploring today’s baseline and designingeffective and efficient security solutions in these new fields.
Time
(Tuesday) 12:00
october 2018

Event Details
For a long time it has been well-known and well-recognized that information security policies are the cheapest and most effective tool to increase security.
Event Details
For a long time it has been well-known and well-recognized that information security policies are the cheapest and most effective tool to increase security. However a proper strategy to reach the precious goals set in the policy is needed. This is where things start getting complicated in practice: The implementation of Information Security Strategies.
More often than not the term “Information Security Strategy” is defined circumstantially and thusdoes not possess a commonly agreed upon, well established meaning. It could represent the real implementation strategy of a security policy, but it is often used as an umbrella term for several high- level documents forming the foundation for information security governance in a company. In general, the Information Security Strategy needs to be well-tuned to the enterprise needs and socio-cultural ecosystem. If this is done successfully the implementation of and adherence to the strategy will fall into place smoothly. If the socio-cultural eco- system is not ready, a change program will help to pre- pare for the next steps.
The Information Security Strategy is a context related document, and must be different before the cloud, with the cloud, with anywhere / any time work and with massive IoT inclusion in to the com- pany’s network. In addition, changes in society and new behavior of youngsters will challenge the CISO for having a buy-inn. To be successful in the long term, societal change needs to be modelled,understood and taken into account. Careful, early verification of the applied models can help to avoidobstacles and lengthy discussions.
At the 14th Swiss CISO Summit you will hear two leading speakers. One giving a retrospective on theexperience of aligning the strategy during his first 100 days in his new position as CISO, and the otherproviding a research and innovation perspective which will give some essential background and intro- duce the round table discussions.
As usual, the goal of Summit 14 is to learn from the speakers, from each other and from the material distributed before the meeting for exploring today’s most recent tendencies in preparing, governing and implementing successfully high-level information security steering documents.
Time
All Day (Tuesday)
january 2019

Time
All Day (Tuesday)
Location
Zunfthaus zur Schmiden, Zurich
Marktgasse 20, Zurich
may 2019

Event Details
Third Party Security and Patching: How to face this major vulnerability? In analyzing root causes of incidents, third party security and patching is strongly represented as a solution to attacks
Event Details
Third Party Security and Patching: How to face this major vulnerability?
In analyzing root causes of incidents, third party security and patching is strongly represented as a solution to attacks around 80% of the time. It is, thus, an utmost and urgent issue that needs addressd.
From the perspective of attackers, it is essential to run the attack-business well, which is why they invest 10-20% of their time investigating the weakest point in the targets’ defense concepts. Well protected multi-billion-dollar global companies are hard targets to hit, but their suppliers, their contractors, their clients and partners are often protected on a SME level only.
Against this background, the weakest links are often represented by a third party, which is an ideal situation for hackers to get an easy hook in to the well protected castle.
There are many statistical reports on patching., With an observed share of 50% of patched systems functioning 10 days after a patch has been implemented, it is clear that the patching sequence is in many cases far less effective than what it should be. However, the other 50% of systems are vulnerable with known weaknesses for which attack suits can be downloaded from the internet or the darknet. For any hacker, these are easy targets that can be conquered at very low cost.
The theory behind the topic is really very easy to understand, however, counter measures need many careful steps. There are two enlightening presentations on this topic in this summit. The first one deals with third party and patching issues in procurement and creates a binding framework for security issues in partnerships. The second one is based on real-time measurements in which the partners are controlled with software and information will be presented on the real important issues of how the observed weaknesses can be presented and eliminated.
As usual, the goal of Summit 16 is to learn from the speakers, from each other and from the material distributed before the meeting in order to explore today’s most compelling trends in addressing the information and cyber security challenges with the best set of controls.
Time
All Day (Tuesday)
october 2019
15octAll DayCISO Summit No 17: Security Culture - how to measure, change and optimize?

Event Details
Culture could be considered as “the ideas, customs, and social behavior of a particular people or society” and represents commonalities of specific groups of people, including beliefs in specific values.
Event Details
Culture could be considered as “the ideas, customs, and social behavior of a particular people or society” and represents commonalities of specific groups of people, including beliefs in specific values. Typically, most people think that culture is rather static than dynamic.
Our observation of the recent past depicts fast changes in technological and communicative means such as the internet, smartphones, group building (including on-line groups), innovation and societal integration. An additional factor is the seamless mixture of societies, such that we work today naturally in teams from many nations, while 50 years ago, we immediately felt a difference, even from people of another city in Switzerland.
As a security offi cer, we are concerned with all three issues simultaneously: fast changes, a seamless mixture of people with different origin, and nearly any mixture of beliefs and values. Without governance and clear direction, companies might develop a nearly unlimited number of very different odd subcultures. Now begins our tasks to care for a forward-directed and agile security culture, which adapts continuously to new situations.
We will get a report from Swisscom (main issue: business IT, Mobility, and cloud) and from SBB (Main issues OT, digitization, industrial control systems), and how they approach this enormous challenge. First turn around the employees to accept net technology, processes and human interaction, and then demand on top of these aspects a new security culture. How to keep motivation at a high level, create identification with the security controls, and protect the IPR and the data? How to measure these aspects, and how to select the best option in specific situation for well-defined change program? Now we welcome you in the world of the 17th Swiss CISO Summit.
Time
All Day (Tuesday)
january 2020
28janAll DayCISO Summit No 18: Cloud Security: Impact on Risks, Control and Security

Event Details
The perception of cloud services has changed dramatically: in the beginning, there were statements from national administrations that deeply distrusted cloud services and dis-encourage
Event Details
The perception of cloud services has changed dramatically: in the beginning, there were statements from national administrations that deeply distrusted cloud services and dis-encourage organisations to move their data and operations to cloud service providers. Today the largest banks closed a deal for their highly sensitive data with a cloud provider: the world has changed.
The gap may be explained by changes within the cloud architectures including options to use strong customer-managed encryption keys to ensure ownership and privacy for the application and data.
A purey one-to-one relation between cloud providers and organizations may be reality for some at the moment. However, a multi-cloud approach is more likely to be adopted by a majority of organizations to mitigate systemic risks, use differentiated services and optimize costs. Not a core topic, but inte- resting for us as individuals, we relate to multiple cloud providers (e.g. WhatsApp, Twitter, Skype, etc.) even when we are unaware of it.
We can conclude that cloud usage is today a preferred model to profit from the economy of scale effects of hardware and operating system maintenance, but even more from the highly sophisticated security management: The larger the cloud provider is, the more people work in security engineering, security operations and therefore provide a service on higher level. The numbers in the background are enormous and can be between 50 to 5.000 professional security engineers. Happily, organizations can select from a variety of service providers, such that after a contractual period, a change is feasible. But what are the exit scenarios, what needs to be prepared when already when entering the contract?
Andrew Hutchison (T-Systems) will present some of the key challenges for a hybrid cloud environ- ment from a security perspective. Rolf Becker (UBS) will elaborate on UBS’s approach considering the requirements of one of the most sensitive cloud user groups. These keynotes will introduce and stimulate the discussion with questions such as how do we negotiate with cloud providers to use of private encryption keys, how to test security concepts and how to create preparedness for switching between cloud providers.
Time
All Day (Tuesday)
Location
Zunfthaus zur Schmiden, Zurich
Marktgasse 20, Zurich
september 2020

Event Details
Traditionally, Development and Operation were two separate streams of activities, separated by long and intense testing, to guarantee a near incident free and secure operation. Time-to-market is a
Event Details
Traditionally, Development and Operation were two separate streams of activities, separated by long and intense testing, to guarantee a near incident free and secure operation. Time-to-market is a key issue and defines from the business side the performance and flexibility of a company at the market. The goal to speed up the entire process from development until production is from all business lines accepted and paramount for business success. Security requirements are different for various applications. We have attracted two keynotes presenting critical applications in the rail and financial sector, both taking advantage of innovative combination between develop- ment and operation, while maintaining a very high level of security.
Olaf Zanger will present Smartrail 4.0, a concept of complete digitization of railway operation. In this case study the engineering process is predominant, including all quality and safety requirements. Smartrail 4.0 is using agile methods, and Olaf will present how the safety process can be adapted for secure software develop- ment. The main goal is to provide the highest possible software quality in a “mandatory fail-safe system”.
Christian Reinhard and Arno Aukia will present the Finnova secure banking operation platform, which is based on DevOps in development and operation: Agile development processes, container platforms and tools used for operational security engineering are core topics. From the technology partner, the focus is on DevOps pipe- line and technology, and from the core banking application side, the focus is on the experience of setting up these systems, testing it, and handling risk assessment and security issues.
At this 19th Swiss CISO Summit we offer a forward looking topic, which is often the blind spot in the eyes of the security office. I am convinced, that the topic is very important and that we need to advance the security in the agile DevOps issues, and a sound understanding of risks.
Time
All Day (Wednesday)
Location
Zunfthaus zur Schmiden, Zurich
Marktgasse 20, Zurich
november 2020
04novAll DayCISO Summit No 20: Ransomware: Prevention, Early Detection and Response

Event Details
After a longer period of E-banking fraud, the resistance of the merging better protected E-banking against the hacker’s penetration attempt was increasing so much, that the business model
Event Details
After a longer period of E-banking fraud, the resistance of the merging better protected E-banking against the hacker’s penetration attempt was increasing so much, that the business model did not work out for the hackers anymore. The hackers needed to find a new source for their income.
The new source is primarily ransomware, which made them develop trojan horses, install them on the victim’s system, and encrypt the data of the system. The victim cannot work anymore and does not see his data. At this points the hacker start negotiating, how much money they want, for releasing the crypto keys, such that the victim can reuse his data.
Customers having a real offline backup, just install their data again, and work further. But there are quite a few corporations having mirrored server system, which protects very well against hard drive failure, but not at all against crypto locker software.
A crypto locker ransomware as well as other ransomware (e.g. payment for not publishing of embarrassing or confidential data) needs time to be placed in an evaluated system. This system selects hackers very carefully. And several steps are needed until the final key will be pressed when all data encrypt. During this period, Computer Emergency Response Teams (CERT) and Security Operation Center (SOC) may find indicator of compromise and can potentially mitigate the upcoming catastrophe.
Our debate will examine strategies which were successful in specific cases and share strategies which not succeeded before the system was under hacker’s control. And we will look at these strategies before the incident happened and at the response: How to negotiate with the hackers, how to start fighting, what means fighting for the victim, and how likely is success? How does the requested amount change when the fight continues for longer time? Which type of support we need in such situation, and how we can get this support? And is it wise to look for partners before the incident?
The first presentation from Frank Herberg (Switch) prepares the ground for broad discussion, how detection of indicators of compromise work, and how to respond to these. In addition, some response options are debated. The second presentation from Johannes Dohren (PwC) presents a true war story and demonstrates lively “what fighting against hacker” really means.
With this setup we expect to serve the community with an inspiring exchange for being better prepared and have more options to react on hackers attempt to harm us.
Time
All Day (Wednesday)
Location
Hotel Ador Sorell
Laupenstrasse 15
january 2021
january 2022

Event Details
Against the background of ever-increasing and more rewarding criminal activities: Dear CISO, how are you preparing your organization for the future? Scenario, Attack Pressure, Strategies, and Actions
Event Details
Against the background of ever-increasing and more rewarding criminal activities: Dear CISO, how are you preparing your organization for the future? Scenario, Attack Pressure, Strategies, and Actions
In 2020 Germany suffered losses of 220 billion Euro related to cyber security incidents, according to the asso- ciation Bitcom. Scaling this down to Switzerland will result in more than 22 billion CHF, more than four times the Swiss military budget. Hackers are rewarded with good money, and they re-invest the money in better tech- nology for attacking. This dream budget of hackers is not available in the counterpart, the CISO offices, which must defend their IT infrastructures. How to communicate the new conditions towards executive offices and get them aware that early investment into the security office might be better than sponsoring hackers later?
The pressure towards hackers to get caught is relatively small, especially if they operate from countries
with no contracts with Switzerland regarding law enforcement and countries not cooperating with other law enforcement agencies. The hacking business has better profitability rates than drug and other criminal businesses. Hackers realized that the ransom works better when attacking critical infrastructure. Of course, they need more and new knowledge when attacking SCADA and ICS, but investments will pay back soon,
as e. g. the colonial pipeline case demonstrated.
The Corona home office period displaces secure corporate working spaces to warm and beautiful homes. However, the security measures are not on the same level, and through diverse family interaction in the same net will the attack surface grow. In other words, hackers have easier access.
Innovation of technology is not to stop: Internet of things, cloud shift, choices of networks (4G, 5G, fiber, DSL), cellphones which have enormous computing and storage capacity, and the new generation of software open up for further attacks.
Against this background, we will discuss how security should be shaped in the following strategic period:
- What are the intentions of the top executives in respect to security? To which function should CISO report? And how should CISO deal with the new pressure of the management, which wants more reporting, more reliable security, and more control over the security function?
- Which strategies must be followed to succeed with security in the next period?
- How to reorganize security and security offices for counter-fighting attacks in the new area?
- Which actions are most urgent to be taken?
- How to speed up the implementation of security measures for new technologies the company has procu-red?Against this background, we want to have an open exchange stimulating each other to have a better picture of preparedness and a greater awareness of the many options to deal with the new and more challenging situation.
Time
January 25 (Tuesday) - February 1 (Tuesday)
february 2022

Event Details
Against the background of ever-increasing and more rewarding criminal activities: Dear CISO, how are you preparing your organization for the future? Scenario, Attack Pressure, Strategies, and Actions
Event Details
Against the background of ever-increasing and more rewarding criminal activities: Dear CISO, how are you preparing your organization for the future? Scenario, Attack Pressure, Strategies, and Actions
In 2020 Germany suffered losses of 220 billion Euro related to cyber security incidents, according to the asso- ciation Bitcom. Scaling this down to Switzerland will result in more than 22 billion CHF, more than four times the Swiss military budget. Hackers are rewarded with good money, and they re-invest the money in better tech- nology for attacking. This dream budget of hackers is not available in the counterpart, the CISO offices, which must defend their IT infrastructures. How to communicate the new conditions towards executive offices and get them aware that early investment into the security office might be better than sponsoring hackers later?
The pressure towards hackers to get caught is relatively small, especially if they operate from countries
with no contracts with Switzerland regarding law enforcement and countries not cooperating with other law enforcement agencies. The hacking business has better profitability rates than drug and other criminal businesses. Hackers realized that the ransom works better when attacking critical infrastructure. Of course, they need more and new knowledge when attacking SCADA and ICS, but investments will pay back soon,
as e. g. the colonial pipeline case demonstrated.
The Corona home office period displaces secure corporate working spaces to warm and beautiful homes. However, the security measures are not on the same level, and through diverse family interaction in the same net will the attack surface grow. In other words, hackers have easier access.
Innovation of technology is not to stop: Internet of things, cloud shift, choices of networks (4G, 5G, fiber, DSL), cellphones which have enormous computing and storage capacity, and the new generation of software open up for further attacks.
Against this background, we will discuss how security should be shaped in the following strategic period:
- What are the intentions of the top executives in respect to security? To which function should CISO report? And how should CISO deal with the new pressure of the management, which wants more reporting, more reliable security, and more control over the security function?
- Which strategies must be followed to succeed with security in the next period?
- How to reorganize security and security offices for counter-fighting attacks in the new area?
- Which actions are most urgent to be taken?
- How to speed up the implementation of security measures for new technologies the company has procu-red?Against this background, we want to have an open exchange stimulating each other to have a better picture of preparedness and a greater awareness of the many options to deal with the new and more challenging situation.
Time
January 25 (Tuesday) - February 1 (Tuesday)
may 2022

Event Details
In light of ever-increasing and more rewarding criminal activities, “Zero Trust” promises a solution. But what does it mean, and how to implement it? Zero
Event Details
In light of ever-increasing and more rewarding criminal activities, “Zero Trust” promises a solution. But what does it mean, and how to implement it?
Zero Trust is perceived as a practical approach in today’s cloud-first world. But what does it take to move from a Zero Trust strategy to active implementation? Gartner recommends as best practices for building a Zero Trust foundation the following measures:
- Create a secure, standard federated identity management system
- Apply adaptive access for more granular resource and access control
- Roll out user-to-application segmentation (Zero Trust Network Access (ZTNA))
Today, a cloud-first strategy can be considered default and promotes building software directly in the cloud rather than building on-premises and migrating to the cloud. The goal is to create software faster and reduce the overhead associated with on-premises resources and cloud migration.
Platform advantages of a Cloud-First approach are flexibility, less overhead, more resources available without investments i.e. cost-effective upgrades, Improved recovery abilities, support options from the cloud provider, faster release cycles, and an integrated option for collaboration. And the business advantages embrace innovation, new business models, new composition and design of applications.
A central role in the cloud and Zero Trust plays secure identities: with two and more factors, we can nail down the acting identity and make them responsible for their actions.
The Zero-Trust-Modell (NIST 800-207) applies the following principles:
- Permanent control: access must be controlled at any time for any resources.
- Limitation of impact: by segregation, the impact of a compromise is limited. Later movement is not possible.
- Automated context detection and reaction: behavioral data are analyzed, and the contexts of all information technologies (Identity, End-device, Workload, etc.) are gathered and processed such that targeted responses are enabled.
These nice “promises” are compelling. First, however, we need to reflect on how to implement Zero Trust, which steps must be taken, and whether the security gain justifies investments and work effort. The more fine- grained we implement access control, the more work must be invested in the design and implementation of access control: What is the CISO’s experience? Where to cut the refinement of access control to limited efforts? And by when is the second line of defense (SOC) the better option?
We want to have an open exchange for creating a sharp picture of prerequisites for the success of implementing Zero Trust and having resilience success in defending our system against new forms of attack.
Time
All Day (Tuesday)
Location
Zunfthaus zur Schmiden, Zurich
Marktgasse 20, Zurich
october 2022

Event Details
At first glance, vulnerability management does not look very attractive. However, for many enterprises, engaging with the processes around vulnerability and asset management is very beneficial. It lowers
Event Details
At first glance, vulnerability management does not look very attractive. However, for many enterprises, engaging with the processes around vulnerability and asset management is very beneficial. It lowers the attack surface relevantly.
Before starting with vulnerability management, the processes of the organizations must be mature and well defined: This means that patch management, lifecycle management, and adjunct processes are established on a high maturity level. In addition, it includes the perception turnaround from patch management for fewer errors to patch management as a strategic security activity.
It is a well-recognized fact that asset management will never be 100% perfect, but approaching a state of “near perfect” is highly desirable. It includes hardware, software (applications), middleware, firmware, and services like encryption (note: remember SSL heart bleed). In addition, the link between assets and responsibilities is of critical importance, where a group or a person may be responsible for an asset entity or an asset entity group.
Two levels of automation we face today: the automation of software production with DevOps and DevOpsSec, which is not relevant for this context. But the automation and orchestration of vulnerability scanners are highly relevant. Main processes must be efficient and automated; meanwhile, zero-day-exploits must be followed and evaluated still hand-picked. Those two approaches must be connected and tuned to each other.
Another issue is the gravity of CVSS rating depending on the respective security zone they show up: The rating may differ from the systematic rating because of enhanced or diminished business impact. The number of false positives, i.e. of false alarm is paramount. Unless this number is sufficiently low, these systems bring no value for the company. Finally, the everyday day routine, including the human factor within groups and between groups, plays a major role in the success of the next generation of vulnerability management.
Time
(Tuesday) 12:15 - 19:00
january 2023

Event Details
It is very simple: CISOs need more security investments to improve security. Decision-makers want to innovate businesses and create more revenue. In this role, decision-makers
Event Details
It is very simple: CISOs need more security investments to improve security.
Decision-makers want to innovate businesses and create more revenue. In this role, decision-makers must be risk-takers: no risk means no new business. On the other hand, CISOs feel responsible for the company’s security and hate to have serious incidents. The anger would be even higher if a serious incident could be avoided with a recently rejected security project proposal. And the natural tendency of CISOs is to be risk averse. CISO must be aware of this opposing attitude of the decision-makers.
In the analysis of optimizing this ecosystem, there are two tools CISOs are using:
Reporting: This is how decision-makers receive information: There was sufficient education for them, and they know how to process the information.
Risk communication and reporting: Cyber risks are not in the core competence of decision-makers. And cyber risks are competing with many other risks for funding. The usual way of risk evaluation, likelihood, and anticipated damage is somewhat shaky because it is often a quite heuristic approach. Science and companies are developing new tools for making the risk assessment process more transparent and with better traceability. Does this change the mind of the decision-maker? Of course, there is still a gap between formal risk and business impact. But only business impact is relevant for decision-makers, and CVSS vulnerability scoring does not usually trigger any action.
Addressees of these efforts are board and executive management. Both addresses have different roles, and we want to elaborate on these roles and the variation between the various companies that will be present.
This summit aims to enrich each other with strategies, a successful mix of reporting and risk communication, and a topic and methodologies that look great but could be better in this context. Marcel Zumbühl will open the board perspective. We can learn how to prepare the communication with the most important facts and eliminate all that bothers the decision maker but has no real effect.
As a result, we hope less work will result because prepared information is more targeted and tuned to the decision maker. And probably, in some cases, also a new dimension of humility because we have better acceptance and understanding of the decision maker’s views.
Time
(Tuesday) 12:00 - 19:00
Location
Zunfthaus zur Schmiden, Zurich
Marktgasse 20, Zurich