The National Institute of Standards and Technology is updating the Cybersecurity Framework to keep pace with the evolving cybersecurity risks, standards, and technology landscape.  The NIST Cybersecurity Framework, originally developed for critical infrastructure sectors, is now viewed as foundational to securing organizations of all sectors and sizes around the world.  Join this session to learn about the update process, including areas of focus, for the Cybersecurity Framework 2.0, as well as share your feedback about the use and potential improvements to the Framework.

There are many options to choose from when selecting a framework for your cybersecurity program and typically your choice comes down to your industry vertical. We will have a discussion on the most commonly used enterprise level frameworks, what is needed to adopt them and how they provide benefit to your organization. Our expert panel will:

• Evaluate some of the best practices for structural alignment with capabilities and solutions, and which security controls are needed for audit
• Analyze how to align IT with OT, as well as the overarching organizational strategy needs and roadmaps
• Discuss ways to not only support governance structure internally, but also ensure regulation and other external requirements are met

Cyber defense is increasingly becoming more important to the federal government’s overarching administrative agenda. There is an important need from the various organizations (CISA, DOE CESER, etc.), to incentivize the transition from collaboration, to cooperation within these distinct entities.
This panel will cover these strategies and will:

• Discuss ways to collaborate across public/private as well as intra- and inter-sector entities to thwart and stay ahead of adversaries targeting critical infrastructures
• Debate whether or not the 20-year evolution of cyber information/threat sharing is still working, and, if not, how can it be improved
• Assess the opportunities for mutual aid and defense from the government to various sectors

In this interview Kiersten Todt cites important cyber engagement efforts between government and industry.  Joint Cyber Defense Collaborative (JCDC) has enabled the sharing of important cyber information between government and industry stating that the “To see the JCDC in real life be effective in industry-government work in what happened with Logj4 Shell and then with the Russian invasion of Ukraine … made a difference.”

Kiersten Todt is Chief of Staff at CISA.

In the wake of the terrorist attacks from September 11, the Maritime Transportation Security Act (MTSA) was implemented across the commercial shipping industry in the United States. With the rise and evolving threat of cybersecurity attacks during the past decade, the Coast Guard has worked with public and private partnerships at America's ports to leverage the MTSA and enhance cybersecurity mitigation and resiliency at these ports. The industries operating in America's ports are critical components of multiple supply chains and often fall into multiple critical infrastructure categories. 

Key takeaways include actionable insights to:  

• Leverage existing partnerships within ports to address cybersecurity vulnerabilities
• Take action within an existing regulatory framework to address cybersecurity vulnerabilities
• Facilitate information sharing and analysis to bridge the public/private communication gap

Since 2016, election security has emerged as one of the newest and most urgent aspects of critical infrastructure protection. And Elvis Chan of the FBI's San Francisco office has been at the forefront of assessing and mitigating election security threats. In this session, Chan will:

• Address the latest threats to election integrity
• Explain the stepped-up effort of the U.S. government in general and FBI in particular
• Describe the shifting cyber threat landscape post-Russia's invasion of Ukraine

Healthcare is among the most targeted critical infrastructure sectors. How are healthcare sector entities - and their CISOs and security teams - working with their peers, industry competitors, government agencies and information sharing organizations to help fend off the rising cyberthreats striking from so many different directions?  This session will:

• Spotlight Information sharing and other collaborative healthcare sector cybersecurity efforts – where progress is being made
• Identify cybersecurity resources for the private and public health sectors, and what else is still much needed
• Explore ways healthcare organizations and their security leadership can become more proactive in addressing sector cyber threats and risks

In this interview Mex Martinot discusses the future of IT and OT convergence in the energy sector.  He also addresses how the threat landscape is set to evolve and the protective measures that must be taken, accordingly. Listen and learn people, process and technology best practices that will safeguard IT and OT environments. 

Mex Martinot is Vice President and Global Head of Industrial Cybersecurity at Siemens Energy and a CyberEdBoard member. 

Since the late 90’s, our critical infrastructure has been under documented attack from various APTs, groups affiliated with nation states to include Russia. Russia’s directed cyber-attacks on the Ukraine are well documented, as is the intended blast radius to include the US and allies, which has been ramped up since the February 2022 invasion of the Ukraine. So how do we defend our critical infrastructure from this now and into the future? Our cybersecurity advice has not changed, merely has evolved to associate advice given for IT to also include OT and IoT basic hygienic solutions. Expect to learn key practices from our session, in which our panel of experts will:

• Discuss incident response plans that can proactively defend your organization against a number of potential threats
• Assess the best strategies to build a defensible architecture, and ensure network security is properly monitored in the process
• Look at the most effective vulnerability and patch management testing methods

The energy sector puts significant resources into building systems that are resilient. These efforts have traditionally been focused on capacity building and preparing for potential natural disasters. The challenge of resilience changes when preparing for and recovering from a cyber-attack that may not be limited to a particular geographic area.  This discussion will:

• Address practices that ensure energy resilience in the digital age
• Identify systems and processes required to mitigate risk across the industry
• Provide insights on how energy companies can work better with others across the value chain to improve cybersecurity

If you talk to the energy sector, they will weave resilience into their cybersecurity discussions. For example, the electric, oil and gas, transportation, water and telecommunications sectors will look at cyber differently than health or financial sectors. Generally, the water, electric, and oil and gas sectors have more similarities and interdependencies than any other Critical Infrastructure sector combined. Our panel will shed light on some of the most effective cross-sector resilience strategies and will:

• Discuss the best ways to adopt a framework and best communications and operational methods to achieve this
• Analyze the performance of scenario-based risk assessments to inform business continuity and emergency response plans that enable effective resourcing
• Assess the broader regulatory and operational requirements that guide these critical business decisions

All content from Day 1 will be available on demand from 9 AM - 5 PM ET on Day 2, Wednesday, November 18th. Don’t miss the chance to log-in and consume any content you may not have had the chance to see at your own convenience.