Cyber Resilience Manifesto with Francesco Chiarini

The tribe opens its virtual door to our CISO community, to exchange ideas, evaluate the good, the bad and the ugly, challenge the status quo, and share lessons learned.

Today we welcome Francesco Chiarini, Global Head of Technology Resilience at Sandoz and Calin Gheorghiu, VP, Cyber Resilience Risk at Standard Chartered Bank. They are respectively Chief Researcher and Principle Researcher at High Value Target and creators of the Cyber Resilience Manifesto. Today’s session will be moderated by CISO Tribe founding member and seasoned CISO, Ivan Milenkovic.

Can't make it on this date? No worries, just register and you will receive a link to the video directly after the event....

Cyber Resilience Manifesto

Cyber resilience has become a trendy, all-purpose concept on which everyone can hang whatever they like. If we want our organizations and ecosystems to become more 'cyber resilient', it makes sense to first establish common ground on what cyber resilience actually means. It is not synonymous to cybersecurity, and it is more than just adding response and recovery to prevention into a cocktail blender.

[1] Francesco and Calin will explain the differences between cybersecurity and cyber resilience. It will help the audience in understanding resilience concepts and how they can be applied to complement their current cybersecurity efforts, such as:

# Adding high value targets [adversary view] in addition to high value assets [business view], to focus defenses where they matter most. [Definitions can be hard, but certain systems are highly targeted by threat actors because they perform functions critical to trust and are thus stepping-stones into everything else].

# Recognizing that harm may occur and how to maximize mission achievement despite that by adopting strong engineering practices [reducing magnitude of impact in addition to reducing likelihood and keeping adversaries from doing harm].

# Applying the concept of threat-informed architecture beyond threat-informed defense.

# Adopting a selective but in-depth set of cyber resilience measures and controls on top of the broad but wide existing defensive cybersecurity controls.

# Adding extreme but plausible threat scenarios to severe but plausible scenarios. Expanding the scope from adversaries who go after the less protected and the most vulnerable, to adversaries who may pivot, potentially causing unknown harm to the organization as a whole.

[2] After setting the terminology baseline, we will evaluate the five strategic pillars of Cyber Resilience and how they interconnect, what a good cyber resilience approach and strategy looks like and how to build it as an extension of current cybersecurity practices in different domains and departments.

[3] Finally, Calin will present use cases that can help you get started with or advance cyber resilience best practices within your organization. Recognizing the different audiences and organizations participating we will evaluate strategic, tactical and operational use cases with different efforts, impact and timeframes, from strategic benchmarking your current organizational cyber resilience posture to fixing a specific security issue by applying Cyber Resilience best practices.

You're invited to join discussions on high value targets, critical asset taxonomy, threat informed defense, defensible architecture, threat modeling, best-in-class cyber resilience frameworks, cyber resilience architectural concepts and methodologies & Cyber Resiliency as an enabler for Secure System Engineering, valuable research and work done & in progress by High Value Target, MITRE, CERT US, CISA, NIST, ISSA….and much more of anything that’s mostly NOT included in today’s resilience discussions.

Your speakers:

Francesco Chiarini is the Global Head of Technology Resilience at Sandoz, where he is responsible for defining and delivering the organization’s Cyber Resilience capabilities. Prior to Sandoz, he was Global Head of Cyber Resilience & Security Architecture at Standard Chartered Bank, and Director of Global Threat Management, Incident Response and Cyber Resilience at PepsiCo. As a researcher, Francesco focuses on preparing companies for complex attacks by introducing the concept of High Value Target and supporting industry adoption of Cyber Resilience engineering & architecture best practices. Francesco is founder and chair of the ISSA Cyber Resilience Special Interest Group with 2000+ associates worldwide. He founded FIRST’s Consumer Packaged Goods Special Interest Group, is co-author of the World Economic Forum’s Cyber Resilience index and has ongoing collaborations with MITRE, NIST, ENISA and OASIS Open.

Calin Gheorghiu is the VP, Cyber Resilience Risk at Standard Chartered Bank, where he is engaged in the development of a Cyber Resilience program built upon an in-depth technical, adversarial view focused critical asset identification methodology. Calin joined Standard Chartered Bank (SCB) as a cyber resilience architect, with the aspiration of laying the foundations & shaping the vision of an industry-leading threat-informed risk management strategy to prepare against the threats of tomorrow. His current research focuses on threat modeling, cyber resilience risk quantification & hybrid framework adoption. With almost a decade of experience in IT and cyber security, he has held a series of tactical & management roles, ranging from solution architecture, incident response & threat intelligence. Calin holds the Director of Cyber Resilience Practice & Adoption chair in the ISSA Cyber Resilience SIG.

Ivan Milenkovic is a seasoned cybersecurity leader with over 2 decades of experience in addressing cyber and infosec challenges across various sectors and industries. He served as the Group CISO at a leading global provider of customer experience and business solutions (BPO where he oversaw the security strategy, governance, and operations for 140,000+ employees and clients worldwide (60+ countries). Ivan has built global Cyber Operations and Resilience Centres, has been responsible for cyber solutions and services acquisitions and delivered successful projects and worked across US, Europe, Africa, Asia, and Australia. Ivan is holder of the prestigious S-CISO certification, Lead instructor and mentor for CISO 2.0 Program, Founding member of the pan-European CISO Tribe and member of various other notable cyber communities.

Agenda:

15h00: Welcome -- Wim Stoffelen, CISO Tribe (NL)

15h05: Introduction by your moderator -- Ivan Milenkovic, CISO Tribe (UK)

15h10: Presentation -- Francesco Chiarini (Czech Repulic) and Calin Gheorghiu (Poland)

15h35: Q&A Session -- Audience, Francesco, Ivan and Wim

15h55: Closing remarks and next events -- Wim