Security is solved at the round table.

The thirtieth CISO Club meeting opens with the Cyber Resilience Act, communication during an incident, passing responsibilities to suppliers, the practical use of AI tools and asset management. The date and venue may still change.

• CRA - opening the topic and walking through the basic requirements for organisations
• How to make communication transparent during an incident?
• Which responsibilities should be passed on to suppliers?
• Using AI tools - use cases and the new threats they bring
• Asset management (choosing a CMDB, populating it, asset ownership)

• The current state of post-quantum encryption and quantum computers
• AI agentic vs. AI automation vs. cyber security
• What to do so that cyber security is perceived positively in the organisation?
• Where do risks in the organisation come from? How to set a baseline?

• What to do and how to defend against ransomware?
• Attacking the supply chain is often easier than attacking the original target
• The human factor and insider threats, a major source of attacks
• Are you dealing with geopolitics and hybrid threats? You will be.

• News from public administration
• Exit procedure - and what about plan B (BCM)? Case: our key provider is leaving
• Disaster recovery tests
• Role-based training for non-security teams (HR, legal...) - how to do it?
• LLM and open AI - how are we going to monitor AI?

• Deploying macOS into enterprise architecture
• Connecting BCM and incident response
• Generative artificial intelligence - how to get a grip on it in the organisation?
• How to run a good table top exercise - advice, recommendations, experience
• Network segmentation and protection (from the outside world, under the Cyber Security Act, separating employees) - how to do it well and efficiently?

• How to approach secure development?
• External development must be a natural part of the central code repository and of secure development verification
• What the acronyms SCA, SAST, DAST and IAST mean and how to work with them
• Are there penetration testing applications that actually work?
• How to verify a product delivered by a specific vendor?

• First steps to securing brownfield IT infrastructure
• Shadow IT
• Is AI in security already business as usual?
• How to handle the security of AI applications, what to focus on?
• How to deal with ransomware incidents?

• ICT risk management - how to do it, which system to use, ideas and simplifications
• New decrees of the national security authority to the Cyber Security Act
• IDM - how to start rolling it out in the organisation
• Business owner and IT owner - convincing the business owner, the never-ending job of pointing out the benefits
• DAST
• Artificial intelligence - simple steps; a human can be wrong, can a computer?

• Experience with implementing DAST
• Implementing DORA and NIS2 in practice
• Network detection and response (cloud and on-prem)
• How to motivate and retain members of the security team?

• AI - to protect or not to protect, and how? (LLM firewall)
• TLPT - how to implement it?
• How to choose between a local and a global cloud provider?
• Hints and tips for raising productivity at the same cost
• Ways to deploy break glass procedures alongside PAM

• Cloud security
• How to deploy PAM?
• Digital supply chain risk
• Phishing, our daily bread

• How the national security authority will approach NIS2
• The new ISO update and its impact on companies
• Experience with thin clients
• Current cyber threats and protection
• Which communities we use to share information
• GRC, cloud, EA and more

• How to approach the security of artificial intelligence?
• Training is no longer enough, we need long-term education
• How to improve the company's readiness for hybrid attacks and how to spot an industrial spy?
• What do you expect from this year? Where is information security heading - new types of attacks, new security toys
• Risk management - what to do with accepted risks?

• How is a security budget created and worked with afterwards?
• Compliance - what it covers in the company and how it connects to information security
• Awareness (new trends, virtual learning, artificial intelligence)
• PAM - how it is used
• Open source risk assessment
• Source code risk assessment
• Zero Trust (VPN-less access)

• Security KPIs - the work of information security can be reported
• Experience with vulnerability and patch management
• How to set up application control?
• Who owns the use case in SIEM?

• How to manage cloud security through the three lines of defence
• Which applications and tools should IT Ops manage and what should IT security do so that the three lines of defence are not broken?
• Shadow IT in the organisation - can it be detected and sized, and how to work with it?
• IoT in organisational security - a proven approach to managing and removing IoT
• How to meet the Cyber Security Act requirements when third parties are not obliged to sign a contract
• Security awareness - the recommended routes
• Active Directory in OT

• Developing the people who report to you in security
• Leading people - the security team as a team of shared values, tied directly to the company's values
• What is companies' attitude to startups?
• Application control review
• Threat model - how to build it and who is responsible for what?

• How does a clean desk policy work in practice?
• How to create and protect work zones for sharing sensitive data?
• Working outside Slovakia (health and safety, taxes...)
• Background checks for employees working abroad
• Segregation of duties within the security team

• Comparing AWS / Azure / Google cloud services from a security perspective
• The process for using cloud compliance security
• SOC and using threat intelligence in practice, incident management software - hands-on experience with deployment and operation
• Experience with running Pentera and similar tools in companies
• Changes in standards: NIS2, the new ISO 27002
• A new view of ICT security in the light of events around us

• Setting up and using IDM
• DLP - how to set the rules
• macOS - minimum requirements
• Security in the cloud

• Bringing macOS into the company - how to meet security requirements built around a different system
• Detecting, categorising and escalating incidents
• Security incident handling and incident management in the cloud
• How to free your colleagues' hands, or setting DLP right - what can actually be configured?
• Password management in the company - password access manager versus a password wallet

• Education in information security, how to develop it, KPIs and growing talent
• Cloud security (initial review, contracts, logging, protection)
• Security and connecting hybrid environments
• DLP in a bank - how to set it up, manage controls and connect local DLP with the cloud
• Disruptive development versus security (supporting the business, controlling fast changes and development in agile teams)
• Dealing with legacy infrastructure in production

• The Zero Trust concept and brand protection
• How to approach a backup strategy?
• Encrypting data in development environments
• Current attacks in Slovakia and the region
• Supply chain attacks
• Dark web markets and what attackers are interested in today

• Users' bad habits and what to do about them - can a bad habit be stopped quickly?
• Administrators' bad habits
• Combined attacks - the nightmare: the cases we know and how to defend against them
• Will a red team test help us? Experience from a real test
• Backup strategy
• Encrypting data in development environments

• Setting a security strategy in the company, BCM and COVID-19 - sharing experience for non-IT areas, DNS security
• Future cybercrime - what to prepare for in the coming years?
• Network behavioral analyzer - sharing deployment experience and capabilities
• Antivirus is not obsolete - how to deploy it correctly and what it should do (antivirus, DLP, ATP, central information exchange and management)
• Analysing malware from a sandbox, EDR metadata and hands-on experience with honeypots

• Commenting on the Cyber Security Act - going through the most serious comments
• An audit under the Cyber Security Act - a nightmare, or a good thing?
• Security when people work from home - how much can be outsourced?
• Experience with risk management
• Macs as a work tool
• How to train people you cannot even see - rethinking training during the pandemic

The club's first online meeting. The main topic was how people in the CISO role responded to changes in company processes, purchases of new hardware and the move of employees to home office. The second part outlined what will matter once the COVID-19 measures end.

• How CISOs responded to changes in company processes and to buying new hardware from a security perspective
• The pros and cons of moving employees to home office
• How to re-verify processes that are new and yet already running?
• How to prepare for the future and what awaits us once the measures end?

The third CISO Club meeting was devoted to information security in industry. Members and the chairman discussed how essential information security is and how far it is deployed in industry, how to handle incidents and how to protect the cloud.

• Why information security is essential and how far it is deployed in industry
• Incident handling for security incidents - remediation, reporting, internal and external collection of forensic evidence
• The cloud and how to protect it
• Security in the agile world and how it connects to the security world

The autumn meeting was split into two blocks: fraud (online fraud detection, employee fraud) and SIEM - how to deploy the technology, which data to collect and how to report so that both business and IT accept it.

• Online fraud detection system - implementation experience, where and why to deploy it
• Fraud management and employee fraud - protection and employee background investigations
• SIEM - how to deploy the technology, which data to collect, monitor and evaluate
• Types of reporting and the importance of monitoring
• The security dilemma - what to deploy first so that SIEM is accepted by both business and IT

The meeting looked at the new architecture of information systems security and its impact on how companies operate, including the newly adopted Cyber Security Act and its alignment with the ISO 27000 standard.

• The Cyber Security Act and its decrees, and aligning them with ISO 27000
• Moving security services to microservices and the emphasis on protecting them
• Cloud and risk management - handling risks including BCM, physical security, IT, outsourcing and the GDPR
• Raising security awareness - simple, catchy solutions and the bigger picture

The club's inaugural meeting, held at the Qubit conference in Prague, looked at how the CISO role is perceived, cooperation with DPOs, cloud and data, artificial intelligence and ePrivacy.

• CISO - how the role is perceived and cooperation with DPO colleagues, splitting responsibilities across the business
• Cloud and data - how cloud is perceived, the dangers of using it, how to secure it
• Sharing and storing data across several companies
• Artificial intelligence and how to secure it, ePrivacy