Agenda day 2
Wednesday, 26 August 2020, Sandton Convention Centre

Plenary Session

Opening address from the Chair

Michael Avery , Michael Avery, Anchor, Classic Business FM

Keynote International keynote address: How to fix the humans: Cyber security and human factors

Suelette Dreyfus , Suelette Dreyfus, academic specialist, School of Computing and Information Systems, University of Melbourne (Australia)

You’ve built the biggest, strongest cyber security wall ever. Then your organisation’s staff unlocks the front door to welcome in the intruders. AI is touted as the magic fix for solving the weakness of human factors in the cyber security chain. But the technology is seen as immature relative to need and is perceived as taking more time and budget to implement than is worth the pay-off. Most of all, there is no ‘press a button and problem’s solved’ solution here – there is no replacement for human IT managers understanding what such systems recommend and why. Trust and transparency in AI platforms handling cyber security are essential – but will vendors provide this?

This keynote will look at what the international academic research finds about human factors in cyber security. What are they and what approaches can be used to address them? This isn’t just about understanding human behaviour, it’s also about how organisations can make their security responses fit with the humans, instead of demanding the humans fit security programmes and protocols. Some IT security experts recommend punitive measures against employees who repeatedly don’t attend to cyber security – but is it realistic to punish the busy C-suite exec? Are there better ways to win security for your organisation?

Keynote News from the kingdom and tales from the colonies

Uri Rivner , Uri Rivner, chief cyber officer & co-founder, BioCatch (Israel)

Major attacks have rocked the online shores of the UK and US! In the UK, a tsunami of social engineering scams is encouraging thousands of victims to move their entire account's worth to criminal hands. Meanwhile, the US is fighting two tidal waves: a steep increase in account opening fraud due to identity data hacks and synthetic ID scams, and massive campaigns targeting its new real-time P2P money transfer scheme. Can these new threats be stopped? In this uniquely interactive keynote, Uri will ask the audience’s help by going through a series of real-world cases and ask delegates to make a difficult call: is this is a fraudster or a genuine user?


Best practice in threat intelligence collaboration and sharing

Jason Jordaan , Jason Jordaan, principal forensic analyst, DFIR Labs

When one looks at critical attacks in the physical world, such as the Japanese attack on Pearl Harbour in World War II, or the 9/11 attacks against the World Trade Centre and the Pentagon, intelligence failures were identified that could have mitigated the impact of the attacks, if not stopping them altogether. We see the same thing happening in the cyber world, where intelligence efforts are fragmented, not only within government, but also in the private sector. If you look at the South African situation, our cyber threat intelligence environment is segmented and fractured, and there is significant distrust. We are not alone in this. So how do we try and improve the situation? How do we improve our ability to share threat intelligence to protect us all, and to collaborate on common threats? This presentation will explore some of the mechanisms and frameworks currently in operation around the globe aimed at improving our ability to share cyber threat intelligence that is meaningful, as well as how we can better collaborate against a common enemy, the cyber threat actors:

• Identifying the common problems in threat intelligence collaboration and sharing

• What do we actually mean by threat intelligence?

• Uniting against a common threat

• Building networks of trust

• Intelligence frameworks and platforms

Panel Discussion What is needed to encourage more local collaboration in threat intelligence?

Craig Rosewarne , Craig Rosewarne, managing director, Wolfpack Information Risk
Susan Potgieter
Kiru Pillay, chief director: Cybersecurity Operations, Department of Communications and Digital Technologies
Adv Paul Louw, senior deputy director public prosecutions, National Prosecuting Authority of South Africa
Jason Jordaan, principal forensic analyst, DFIR Labs


Welcome by Track Chair

Winston Hayden , Winston Hayden, independent management consultant and advisor

Pushing the SOC left for the love of AppSec and the sake of containers

O'Shea Bowens , founder and CEOO'Shea Bowens, founder and CEO

As a defender, we've seen the landscape change over the past few years. A shift to cloud, better endpoint detection capabilities and overall acceptance of leveraging threat intelligence. All these items are advantages for SOC personnel, but how are we incorporating application security? How the heck are we securing our containers? The idea of "shifting left" is based on secure SDLC, but how do we build detection, response and monitoring of applications and containers into the SOC? The normal gambit of next-generation firewalls and anti-virus products aren't applicable as applications differ from build to build. This presentation will focus on building out capabilities to help defenders identify vulnerable containers, attacks against the application, detection mechanisms and how to leverage this information for triage.

• Understanding how to build secure containers.

• Identifying layer 7 non-traditional attacks against your application.

• Identifying attacker movement inside your container.

• Learn tactics and techniques to aid your SOC approach to ‘shifting left’.

Cloud security and cloud access security brokers (CASB)


Open source software and the implications for security

DevSecOps: How to implement security into the different stages of the software development life cycle

Gus Clarke , Gus Clarke, head of Security, Tari Labs

Closing remarks from the chair and close of Day Two

Track Two: Blue/red team strategies

This track will focus on the offensive and defensive tools, technologies and strategies that your blue and red teams should be considering. Topics such as incident response, threat hunting and vulnerability management.

Welcome from the Track Chair

Wicus Ross , Wicus Ross, senior security researcher, Orange Cyberdefense

Endpoint detection and response; Preparing your organisation for a cyber attack

Warren Hero , Warren Hero, CIO, Webber Wentzel
Roy Fisher, consultancy director, F-Secure Consulting

Most modern-day cyber attacks start with an endpoint compromise. Deployment of an endpoint detection agent before a cyber attack is therefore crucial but by no means the silver bullet for detection and response as a whole; problems can and do arise from an over-reliance on EDR-aligned solutions. As will be demonstrated in this talk, EDR technology requires the insights and understanding of a highly skilled security team. The information and data it generates is indeed powerful, but alone this technology cannot defeat a skilled attacker’s ability to contextualise and circumvent complex situations and environments. In response to this contention, Warren Hero, Webber Wentzel’s Chief Information Officer will discuss the then and now of preparing his organization for a cyber attack while Roy Fisher, F-Secure’s Consulting Director, provides context regarding the sophisticated nature of modern attackers and why equal insight and skills are required to counter such threats. You will learn:

  • Practical examples of how sophisticated attackers bypass modern technology
  • How to balance technology with human insight
  • Tips for building a resilient defence team

Incident Response bloopers: When IR goes wrong

Veronica Schmitt , Veronica Schmitt, lead forensic analyst, DFIR Labs

In the digital age, we are moving more progressively to an interconnected world. This leads to more incidents taking place and the spotlight being placed on how an incident is handled. Instead of highlighting how it should be done, Veronica will show how it should not be done and the reasons why. The presentation will draw from her personal experiences within the industry and cases that she has investigated. Veronica will also focus on the volatile nature of the incident response evidence available.

  • Understand some fundamental errors made during an incident
  • Understand the effect that making errors will have on digital evidence
  • Gain a better understanding of the overall pitfalls of Incident Response when not done right
  • Learn the correct way to handle Incident Response

Topic to be confirmed

Cyril Baloyi , Cyril Baloyi, group chief technology officer, City of Johannesburg

Effective vulnerability management

Kudakwashe Charandura , Kudakwashe Charandura, director – Cybersecurity, SNG Grant Thornton

The rise of cyber attacks requires greater focus and investment into cyber security. A common thread in all cyber attacks is the exploitation of a vulnerability or a weakness in existing systems. It is thus imperative for businesses to assess their systems and processes to identify any vulnerabilities and plug them, before cyber criminals exploit them. The session will unpack vulnerability management and offer practical solutions to effectively identify, prioritise and resolve vulnerabilities and protect businesses from cyber attacks.

  • What are vulnerabilities? What is vulnerability management?
  • What solutions can we use to identify vulnerabilities?
  • How can organisations identify, prioritise and effectively resolve vulnerabilities?

Closing remarks from the chair and close of Day Two


Gold Sponsor

Silver Sponsors

Bronze Sponsors

Display Sponsors