1. IBM Threat Index
1.1. access to huge data pools, 180 countries, maps new threats and attack patterns
1.2. billions of data points, IR engagements, domain tracking etc
2. XDR Strategy
2.1. XDR + ZT together
2.1.1. use all XDR and telemetry in your enviroment
2.1.2. key detections, enhancing EDR
2.1.3. do not rely just on SIEM and SOC monitoring
2.1.4. PPT perspective
2.1.5. IBM
2.1.5.1. pandemic was the catalyst
2.1.5.2. get the best telemetry
2.1.5.3. detect and take action
3. Zero Trust
3.1. It is a journey towards better protection, detection, & response
3.1.1. access resournces
3.1.2. how do you assume breach
3.1.3. do you have the right playbooks?
3.2. it is a vision, ZTA (Architecture) technical implementation of the vision
3.2.1. we cannot innately trust endpoints
3.2.2. vision - right access at the right time especially on cloud
3.2.3. customer of experience is seamless
3.2.3.1. cloud
3.2.3.2. on premise
3.2.3.3. hybrid
3.2.4. ZTA is framework
3.2.4.1. look beyond perimeter
3.2.4.2. work from anywhere
3.2.4.2.1. explicit access
3.2.4.2.2. micro segmentation
3.2.4.2.3. manage every device, application, individual
4. IBM Cybersecurity Conference
4.1. XFORCE
4.1.1. Incident Command - team comes together to respond, handbooks, tools alert, bring rapid response when it's needed
4.2. Manufacturing is the top target for threat actors
4.2.1. threat actors disrupt = profit
4.2.2. low tolerance for downtime and willing to pay
4.2.3. OT is a viable target
4.3. War in Ukraine
4.3.1. Mainstream media is often not our friend, it may sound worse than it is. Russia will continue to be a threat, not a new threat
4.3.2. Have an active incident response plans, keep doing and do better
4.3.3. What questions do boards ask
4.3.3.1. what can you tell me what I don't know
4.3.3.2. breaches will always hit the brand
4.3.3.3. investing in cyber is not an option
4.3.3.4. tell me what I don't know, are we prepared?
4.3.4. #1 question, based on what we are seeing, what do we need to do differently.
4.3.4.1. continue to monitor the threat landscape, zero day, covid etc. making sure we have heightened awareness, respond and tune our infrastructure, prioritize remediation actions. We know partner with key partners to do more of the same is key.
4.3.4.2. attention, we've been looking at this for a while, USGOV, partners, threat sharing others in the industries
4.3.4.3. concerns around collateral damage, how do we take lessons learned from 2017, Not petya, active directory, addressed most of the lessons learned from other companies
5. Malware attacks,
5.1. 3k increase in 1ot
5.2. ICS 50% rise
5.3. phishing top infection vector
5.4. Cloud is the new target, Linux is widely used in this area
5.5. 17th month average lifespan of ransomware gangs
5.5.1. early summer, late fall, low in January