COVID-19 Cybersecurity attacks: Cybersecurity technologies to identify, protect, detect, respond and recover are extremely important, but not sufficient. HumanOS upgrade is required to safely use the Internet and it is not only about training and awareness. It is about the way users must behave online and the IT community must openly acknowledge system vulnerabilities. Humans are the weakest and strongest links in Cybersecurity.

The tenets of zero trust are well defined in NIST SP 800-207, but have many architects truly taken them on-board? Are we exhibiting a familiarity bias: over-trusting certain mechanisms and failing to properly ascertain their trustability, as we are required to?  Are we ignoring others, which provide useful evidence of trustability?  Are we looking too much at the actual network we are trying to protect, and disregarding unmanaged devices, IoT/OT/ICS, BYOD?  Is EDR, as is mandated by EO M-22-01, the right approach, or an initial step on the road?  How do we expect our adversaries to behave, and how do we counter that threat in the way we architect our zero trust environments?

It’s no secret that public cloud has provided the technical catalyst to the healthcare industry’s long-overdue modernization and the keys to the kingdom in terms of its globalization. The resulting access to usable swaths of data is invaluable – and high risk. In this talk, I will explore the unimaginable potential of global data sets and applications, the complexities of addressing multiple compliance frameworks, and the critical strategies security teams must embrace to ensure success.

The need for agility has never been more important as healthcare organizations revise their processes and applications at an unprecedented pace, and that, in turn, has underscored the need for business-critical application performance, stability and security. As IT leaders guide their teams through ongoing business transformation demands to meet business needs and customer expectations, it is critical to examine how the essential applications are managed and how risk is calculated to drive improvement. Join Sharat Chander, Senior Director of Java Product Management at Oracle, for an insightful discussion to learn how to modernize Java applications while mitigating risk.

Most organisation’s IT infrastructures remain fragile to cyber attacks, especially the current scourge of ransomware operators sweeping across all verticals and all countries across the globe.  Becoming cyber resilient to these kinds of attack is an emergent property, not a collection of products you can buy.  In this session James will discuss those emergent properties and how he has seen organisations best achieve them using best-practice frameworks and solid engineering principles.

Washington State was the first U.S. epicenter of the COVID-19 pandemic, and as CISO of UW Medicine Cris Ewell was supporting the first responders. How is his security organization most different today than it was a year ago? Hear his approach to:

• Work from anywhere
• Supply chain risk
• Medical device security
  

Millions of dollars are spent annually to set up SOCs in the healthcare industry and yet, in just the last two years alone, 89% of healthcare organizations have experienced a data breach. Why are SOCs failing? Listen as ISMG’s Tom Field interviews Exabeam’s Chief Strategy Officer Gorka Sadowski to learn more about why SOCs always fail when built under the current operating model. And what to do to make SOCs successful using a simple maturity model based on outcomes and use cases.  

Omar Khawaja, CISO of Highmark Health, describes his organization’s journey to enhance its security program while serving the needs of the business and providing internal customers with ease-of-use.

In this exclusive interview Khawaja will discuss:

• How security programs must serve the business;
• The goals of a business-centric security program;
• How security leaders must avoid saying “no,” and instead demonstrate “here’s how”;
• Treating the business like a paying client.
  

Not only are cybercriminals installing ransomware to encrypt data and freeze up systems, some attacks have evolved with the exfiltration of sensitive patient data and double extortion schemes. In some cases, backup systems are being hit as well, hampering recovery efforts from these attacks. But what are the critical steps and latest  strategies that healthcare sector entities can take to prevent falling victim to these highly disruptive and dangerous attacks, especially as they escalate during the COVID-19 pandemic?

After the SolarWinds attack, how can an entity ever trust that any vendor’s security incident won’t become their own next crisis? Healthcare sector entities in particular deal with a complex digital supply chain that range from critical IT vendors to suppliers of life-saving network-connected patient gear, and all the other players – known and maybe unknown – in-between. Our panel will discuss:

• Digital supply chain challenges spotlighted during COVID-19;
• Healthcare sector lessons emerging from the SolarWinds and other major vendor attacks;
• Lessons from the Urgent/11 IPnet vulnerabilities;
• Cloud vendors and change management issues; 
• Vetting and trusting third-parties – including their software patches.
  

What’s the status of FDA’s latest guidance and other efforts to help strengthen the cybersecurity of medical devices – especially amid the surge in COVID-19 remote patient monitoring and shortages of certain critical medical equipment? How are medical device makers implementing better security controls and best practices, and what are healthcare delivery organizations doing to keep their patients and data safe from the latest threats facing devices? Our panel will discuss these issues, plus:

• The ongoing challenges involving legacy devices issues and outdated third-party software;
• Vulnerability disclosures and patching;
• Third-party components and a “Cybersecurity Bill of Materials”;
• What the SolarWinds attack and connected medical devices have in common.

All content from Day 1 will be available on demand from 9 AM - 5 PM ET on Day 2, Wednesday, July 13th. Don’t miss the chance to log-in and consume any content you may not have had the chance to see at your own convenience.