The National Institute of Standards and Technology is updating the Cybersecurity Framework to keep pace with the evolving cybersecurity risks, standards, and technology landscape.  The NIST Cybersecurity Framework, originally developed for critical infrastructure sectors, is now viewed as foundational to securing organizations of all sectors and sizes around the world.  Join this session to learn about the update process, including areas of focus, for the Cybersecurity Framework 2.0, as well as share your feedback about the use and potential improvements to the Framework. 

There are many options to choose from when selecting a framework for your cybersecurity program and typically your choice comes down to your industry vertical. We will have a discussion on the most commonly used enterprise level frameworks, what is needed to adopt them and how they provide benefit to your organization. Our expert panel will:

• Evaluate some of the best practices for structural alignment with capabilities and solutions, and which security controls are needed for audit
• Analyze how to align IT with OT, as well as the overarching organizational strategy needs and roadmaps
• Discuss ways to not only support governance structure internally, but also ensure regulation and other external requirements are met

Cyber defense is increasingly becoming more important to the federal government’s overarching administrative agenda. There is an important need from the various organizations (CISA, DOE CESER, etc.), to incentivize the transition from collaboration, to cooperation within these distinct entities.
This panel will cover these strategies and will:

• Discuss ways to collaborate across public/private as well as intra- and inter-sector entities to thwart and stay ahead of adversaries targeting critical infrastructures
• Debate whether or not the 20-year evolution of cyber information/threat sharing is still working, and, if not, how can it be improved
• Assess the opportunities for mutual aid and defense from the government to various sectors

In the wake of the terrorist attacks from September 11, the Maritime Transportation Security Act (MTSA) was implemented across the commercial shipping industry in the United States. With the rise and evolving threat of cybersecurity attacks during the past decade, the Coast Guard has worked with public and private partnerships at America's ports to leverage the MTSA and enhance cybersecurity mitigation and resiliency at these ports. The industries operating in America's ports are critical components of multiple supply chains and often fall into multiple critical infrastructure categories. Key takeaways include actionable insights to:  

• Leveraging existing partnerships within the port to address cybersecurity vulnerabilities
• Taking action within an existing regulatory framework to address cybersecurity vulnerabilities
• Information sharing and analysis to bridge to public/private communication gap

Healthcare is among the most targeted critical infrastructure sectors. How are healthcare sector entities - and their CISOs and security teams - working with their peers, industry competitors, government agencies and information sharing organizations to help fend off the rising cyberthreats striking from so many different directions?  This session will:

• Spotlight Information sharing and other collaborative healthcare sector cybersecurity efforts – where progress is being made
• Identify cybersecurity resources for the private and public health sectors, and what else is still much needed
• Explore ways healthcare organizations and their security leadership can become more proactive in addressing sector cyber threats and risks

Since the late 90’s, our critical infrastructure has been under documented attack from various APTs, groups affiliated with nation states to include Russia. Russia’s directed cyber-attacks on the Ukraine are well documented, as is the intended blast radius to include the US and allies, which has been ramped up since the February 2022 invasion of the Ukraine. So how do we defend our critical infrastructure from this now and into the future? Our cybersecurity advice has not changed, merely has evolved to associate advice given for IT to also include OT and IoT basic hygienic solutions. Expect to learn key practices from our session, in which our panel of experts will:

• Discuss incident response plans that can proactively defend your organization against a number of potential threats
• Assess the best strategies to build a defensible architecture, and ensure network security is properly monitored in the process
• Look at the most effective vulnerability and patch management testing methods

If you talk to the energy sector, they will weave resilience into their cybersecurity discussions. For example, the electric, oil and gas, transportation, water and telecommunications sectors will look at cyber differently than health or financial sectors. Generally, the water, electric, and oil and gas sectors have more similarities and interdependencies than any other Critical Infrastructure sector combined. Our panel will shed light on some of the most effective cross-sector resilience strategies and will:

• Discuss the best ways to adopt a framework and best communications and operational methods to achieve this
• Analyze the performance of scenario-based risk assessments to inform business continuity and emergency response plans that enable effective resourcing
• Assess the broader regulatory and operational requirements that guide these critical business decisions

All content from Day 1 will be available on demand from 9 AM - 5 PM ET on Day 2, Friday November, 18th. Don’t miss the chance to log-in and consume any content you may not have had the chance to see at your own convenience.