The FT Managing Cyber Risk in Critical Infrastructure will focus on cybersecurity as a vital aspect of national security. Senior managers and security experts from some of the world’s biggest companies will be joined by government ministers and officials, software developers, consultants, lawyers and academics to discuss the threats and how to manage them.
FT Managing Cyber Risk in Critical Infrastructure
Protecting the nation's essential industries
London Stock Exchange Group
National Cyber Security Centre
Cyber resilience is a major concern for businesses and governments globally – but for companies that make up critical national infrastructure, watertight security is an imperative. Industries such as energy, transport, healthcare and telecommunications are essential to the smooth running of the nation; disruption in these sectors has immediate implications, not just for the economy but for every aspect of society. What happens when a national power system is disabled by a cyber-aggressor? What about a medical supply chain, or a military computer network?
We cannot isolate our critical national infrastructure to minimise the risk of attack – but we must ensure that companies in these industries are especially secure and resilient. How can the public and private sectors collaborate and share strategies for cyber defence? What measures should government organisations use to coordinate national and international policies for the security of infrastructure?
Jamie Shea is NATO’s Deputy Assistant Secretary General for Emerging Security Challenges, and has been an international public servant and member of the international staff for 38 years. Previous positions at NATO have included Director of Policy Planning in the Private Office of the Secretary General, Deputy Assistant Secretary General for External Relations, Director of Information and Press, and Assistant to the Secretary General for Special Projects. He is a recipient of the NATO medal for Meritorious Service.
Dr Shea has been involved with several prominent academic institutions. For 20 years, he was a professor at the Collège d’Europe, Bruges. He was also a visiting lecturer at the University of Sussex and associate professor of International Relations at the American University, Washington DC. He has lectured at the Brussels School of International Studies at the University of Kent, and at the Security and Strategy Institute of the University of Exeter. He is a Senior Transatlantic Fellow of the German Marshall Fund of the United States and a Senior Fellow at the London School of Economics.
Dr Shea is a member of the Advisory Board, Security and Defence Programmes at Chatham House, a member of the Policy Council at the World Economic Forum, and founder of Security and Defence Agenda Brussels. He is also heavily involved in the European Policy Centre and Friends of Europe, two of Brussels’ most active and influential think tanks. Dr Shea is a regular writer, lecturer and conference speaker on NATO and European security affairs and on public diplomacy, political communication and many other areas of contemporary international relations. He holds a D.Phil. in Modern History from Oxford University.
Val Rahmani was appointed to the Board of the London Stock Exchange Group in December 2017. She has previously been a non executive director of Aberdeen Asset Management and is currently a non executive director of US listed companies RenaissanceRe Holdings and Computer Task Group.
During her distinguished career, Ms Rahmani spent almost 30 years at IBM, working in a variety of positions both in the UK and in the US including roles heading up internet security systems and infrastructure management services. She also spent three years as Chief Executive Officer of Damballa, a computer security firm.
Jaya Baloo is Chief Information Security Officer for KPN Telecom, the Dutch landline and mobile telecommunications company. Her focus is on secure network architecture design, and she has completed projects ranging from Lawful Interception, Deep Packet Inspection, VoIP & Mobile Security to designing national MPLS infrastructures and ISP architectures. She has been working internationally in information security for 15 years and has worked for other telecom providers including Verizon and France Telecom.
Alex Campbell is part of EY’s EMEIA Advisory Centre for cyber security and has over 20 years’ experience delivering large cyber transformation programmes for global organisations spanning across technology, process and people. He leads cyber for EY’s energy and infrastructure sector having regularly provided thought leadership and presented at leading industry events on the protection of critical infrastructure and data from cyber threats. He was also invited to participate at the G7 cyber security in the energy sector workshop in Japan, the output of which informed a joint statement of the G7 energy ministers on cyber security collaboration and protection of critical infrastructure.
Dexter Casey is the Group CISO for Centrica PlC. He has 17 years of information security experience, primarily in the capital markets. He built and led the first European security team for Morgan Stanley. He has held senior security director positions at Credit Suisse, HSBC, Willis Towers Watson, Royal Mail Group and Global Blue.
Kevin Duffey is an advisor to the London Digital Security Centre and leads the Cyber Rescue Alliance. He specialises in helping Board-level executives to lead business recovery when digital defences are breached.
Mr Duffey has worked in "cyber" and "security" for three decades and his past roles included: CEO Nordics, CEO Asia, and Board member of Logica's 6,000 person UK business. As Group GM at International SOS, he oversaw the evacuation of 4,000 people during the Arab Spring and helped over 10 million individuals travel safely abroad. Early in his career, he helped launch the first mobile phone networks in several countries, and was elected among the 100 inaugural members of the GSM Association Hall of Fame.
Professor Doctor Udo Helmbrecht is the Executive Director of the European Union Agency for Network and Information Security (ENISA). He has been in this position since 2009. His experience in the field of security has been acquired through work in a variety of areas, including the energy industry, insurance, engineering, aviation, defence, and the space industry. In 2010 he was appointed honorary professor at the Universität der Bundeswehr Munich, Germany. He became the president of the German Federal Office for Information Security (BSI) in 2003. He studied physics, mathematics and computer science at Ruhr-University, Bochum, and in 1984 he was awarded a PhD in Theoretical Physics.
Dan Jeffery is the Head of Innovation & Delivery at NHS Digital’s Data Security Centre. The DSC is the health sector leader in data security, and assures critical systems within the health and care sector overall. It functions as the trusted centre and technical authority for threat intelligence for the system and sector-wide incident management, and the gateway to the NCSC, distilling best practice and working with the NCSC on improving health and care’s response to cyber threat. Mr Jeffery heads up the Innovation and Delivery function, working with users, industry and other key stakeholders to drive better cyber preparedness, security, and resiliency, while enabling enhanced patient outcomes across health and care in an increasingly digitised operational environment.
Mr Jeffery has worked on a variety of national and international programmes across the public and private sector. Prior to joining NHS Digital, he worked at a leading technology consulting organisation where he was the lead for Security Strategy and Risk for government clients in the UK. This role included the development of national level cyber strategies, operating models, as well as the delivery of complex programmes and projects to a number of large diverse organisations.
Dr Kevin Jones
Dr Kevin Jones is Head of Cyber Security Architecture, Innovation and Scouting at Airbus, leading a global network of teams, projects and collaborations including research & innovation and technology scouting for cyber security across IT, ICS and Product security. He is active in the cyber security research community, has published numerous papers and holds a number of patents within the domain. He also works closely with government agencies on cyber security topics, in addition to European programmes such as the EU Cyber Security Public Private Partnership. He is a Member of the BCS, IEEE, ISACA, and ISC2 and is accredited as a Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), and ISO27001 Lead Auditor. Dr Jones holds a BSc in Computer Science and MSc in Distributed Systems Integration from De Montfort University, Leicester where he also obtained his PhD.
Rosa Kariger is the global CISO of Iberdrola, the Spanish multinational electricity company. It employs 31,000 people in dozens of countries around the world, and is one of the world’s largest companies by market capitalisation. Ms Kariger is responsible for cyber security governance, intelligence and oversight for the IT and OT environments in all countries where the company operates – mainly Spain, UK, US, Mexico and Brazil. Since she joined Iberdrola in 1997, she has held different positions as internal consultant and global risk manager. Before being appointed as the Group’s CISO, in February 2016, she was the Group’s Deputy CRO. She holds a Master’s Degree in Industrial Engineering from the Polytechnic University of Madrid and has participated in the Executive Development Program (PDD) from IESE Business School, and the Global Leadership Program from IMD Business School.
Adam Maskatiya is Managing Director, UK and Ireland for Kaspersky Lab. Prior to joining the company as General Manager in June 2017 he was a Director at KPMG UK, where he led client relationships in the technology, media and telecommunications sector in the firm’s International Markets Group business. Before that he held senior leadership positions at global software houses, including CA Technologies & Novell. Cyber security has always been at the core of Mr Maskatiya’s focus, leading transformation and change for clients as they seek to manage their risk in a rapidly evolving digital landscape. He started his career at Computacenter UK and graduated in Economics from Hull University.
Peter Merker joined Skyguide, the Swiss air navigation services provider and critical infrastructure component of the Swiss Federation, in 2016 to take over information security. His role is to accelerate security maturity in light of a unique technology transformation program in the Air Traffic Management industry. Mr Merker draws on almost 2 decades of experience in information security. He started his career in a global consultancy and contributed on a multitude of different security programs in the banking, consumer goods and pharmaceutical sectors before joining a chemical manufacturing company where he created and lead their information security program.
Yuri Rassega was appointed Chief Information Security Officer (CISO) at Enel, the large Italian gas and electricity distribution company, in June 2016. Prior to that, between 2014 and 2016, he was Enel’s Head of the ICT Global Solution Centre AFC, HR and Procurement, and between 2004 and 2014 he headed the Group’s Global ICT Audit Function. He joined Enel in 2001 as the Head of ICT Function in Enel Hydro. Before joining Enel, Mr.Rassega worked in several roles in the ICT industry. These roles involved the development of ERP, SCADA, ACS, and ICS solutions for a variety of clients and facilities. His experience in technology and telecommunication companies ranges from coding and digital electronics engineering, to consulting, entrepreneurial and senior management.
Lawrence Slade has been Chief Executive of Energy UK since 2015. He was Energy UK's first Chief Operating Officer when it was formed in 2012 and had specific executive responsibility for all energy supply activities including retail markets, smart metering & grids, energy efficiency and consumer engagement.
Mr Slade has been involved in the energy industry since the late 1990s working in countries all over the world to build an understanding of the geopolitics of energy and both how the sector is central to everyday life and supports thriving economies. He previously ran the Energy Retail Association and the Society of Petroleum Engineers, expanding the society's operations in Russia, the Caspian and Africa. He was also Deputy Chief Executive and Technical Director of the Energy Institute in London.
David Smith is the Chief Information Security Officer for Nuix. He recently retired as an Assistant Special Agent in Charge for the U.S. Secret Service, where he spent more than twenty-four years specializing in computer forensics, information security management, and cyber crime training and investigations.
Andrew Tsonchev oversees Darktrace’s OT security offerings, providing cyber defense solutions for industrial environments. He has worked extensively across all aspects of technical and commercial operations, and advises Darktrace’s strategic Fortune 500 customers on advanced threat detection, machine learning and autonomous response. He has a technical background in threat analysis and research, and holds a first-class degree in Physics from Oxford University and a first-class degree in Philosophy from King’s College London.
David Bond is the Financial Times' Security and Defence Editor. Based in London, he was previously European Media Correspondent where he covered some of the biggest and best-known companies and media brands in the world.
Before joining the FT, and after a brief period working in communications as a consultant with Milltown Partners, his last role in journalism was as the BBC’s Sports Editor. Mr Bond led BBC News’ on-air coverage of major national and international sports stories on flagship programmes such as the BBC 1 News at Ten and Radio 4’s Today Programme. He covered the London 2012 Olympics, the 2010 South Africa World Cup and FIFA’s decision to award the 2018 and 2022 World Cups to Russia and Qatar.
Mr Bond moved into broadcasting after a lengthy career as a national newspaper sports journalist. He was Sports Editor of the Daily Telegraph but also worked as a sports reporter for the Sunday Times and the London Evening Standard.
Hannah Kuchler is a San Francisco Correspondent for the Financial Times, writing about technology with a particular focus on cyber security and social media. She enjoys telling the story of the Silicon Valley to the FT's broad international audience, wading through the complex world of cyber security to warn about the threats and attacks faced by companies and the new generation of start ups springing up to protect them. Ms Kuchler has worked for the FT for eight years in the US, Europe and Asia, covering everything from Chinese Internet companies to British politics.
Dan Thomas has been the Financial Times’ deputy companies editor since March 2016. Mr Thomas was previously the FT’s telecoms editor, having worked as a telecoms correspondent since 2011. Prior to that, he worked as the FT’s property correspondent. He has also reported for FT Money and FT Weekend’s personal finance supplement. Prior to joining the FT in March 2007, he was an assistant editor for Property Week.
Mr Thomas holds a postgraduate degree in journalism from City University and a BA in English and Philosophy from Manchester University. He was named Business Journalist of the Year at the LSL Property Awards and awarded IBP News Reporter of the Year – both in 2010.
Agenda - 28th Jun
8:00amRegistration & Breakfast
9:00amChair’s Opening Remarks
Hannah Kuchler, San Francisco Correspondent, Financial Times
Ciaran Martin, CEO, NCSC
9:30amPanel: threats to critical national infrastructure (CNI) companies – how are they different?
- What are the typical cyber risks faced by critical infrastructure? How can companies in this space identify their specific vulnerabilities?
- Ukrainian power stations, the UK’s National Health Service, Wolf Creek or the Rye Brook dam: what can be learned from recent high-profile attacks on critical infrastructure companies?
- Which risks are common to all critical sectors, and which are unique? What can different industries learn from each other?
- What are the most effective methods of prevention and detection? Are vulnerability assessments the key to managing and mitigating cyber risk?
- What new cyber threats are likely to emerge in the future? How can CNI firms prepare themselves?
Jaya Baloo, CISO, KPN Telecom
Dan Jeffery, Head of Innovation and Delivery, NHS Digital
Yuri Rassega, CISO, ENEL
Professor Buck Rogers, CISO, Bank of England
Andrew Tsonchev, Director of Technology, Darktrace Industrial
Moderated by: Hannah Kuchler, San Francisco Correspondent, Financial Times
10:15amKeynote Presentation: the international outlook
Marina Kaljurand, Chair, Global Commission on the Stability of Cyberspace
11:05amScenario Planning: boardroom simulation of a catastrophic attack
CEOs must be ready to lead business recovery during a breach, by anticipating operational challenges and avoiding mistakes made by their peers. This panel considers the cascade of commercial consequences that follow a major cyber-attack.
Panellists will explain how the shock, speed and ambiguity of a large data breach can paralyse large companies. Company reputations can be damaged, revenues reduced and customers harmed by poor executive decision making. This panel will consider several of the Executive Decision Points that confront operational leaders during an effective Boardroom Simulation. The audience will also be invited to consider issues around:
- Triage: where to deploy limited resources
- Collaboration: who to involve and call on for support
- Values: how to make urgent decisions during extended uncertainty
Dexter Casey, CISO, Centrica
Mark Hughes, CEO, Security, BT Group
Gary Miles, Detective Chief Inspector, Cyber Crime Unit, Metropolitan Police
Val Rahmani, Board Member, London Stock Exchange
Lawrence Slade, CEO, Energy UK
Moderated by: Kevin Duffey, Managing Director, Cyber Rescue Alliance
Adam Maskatiya, General Manager UK & Ireland, Kaspersky Lab
1:20pmPanel: securing the critical supply chain
Critical national infrastructure cannot function without the support of third parties providing services, software or equipment. Internet service providers and messaging services, consultants and contractors bringing in specialist skills, security firms fitting physical alarms and sensors, external recruiters to help plug the skills gap – the list of organisations involved in critical operations is endless, and as a result the supply chain is becoming ever more complicated. Each of these external services comprises IT, people and physical assets – and all are vulnerable to failure or malicious behaviour.
- How can CNI companies quantify and understand the risk they are exposed to through their supply chain?
- Suppliers (and their suppliers) often have wide and long-term access to their clients’ data and systems. How can this access be better monitored?
- Automation and the Internet of Things are making the transport industry smarter and more connected than ever before. But what are the risks of these new technologies? By increasing interconnectivity and interoperability, are companies simply providing more points of entry for cyber aggressors?
- How can smaller providers be kept as secure and resilient as the large CNI companies that use them? Once one company's defences have been breached, how can we prevent cyber aggressors compromising entire critical supply chain?
Jeff Hutchinson, CIO, Bombardier
Dr Kevin Jones, Head of Cyber Security Architecture and Innovation, Airbus
Adam Maskatiya, General Manager UK & Ireland, Kaspersky Lab
Peter Merker, CISO, Skyguide
Moderated by: Dan Thomas, Deputy Companies Editor, Financial Times
2:05pmSpotlight on Budget: funding an effective cyber security strategy
- Experts maintain that “basic hygiene” is a crucial foundation for effective cybersecurity strategy – but what does this entail in practice for CNI firms? What are the must-haves in terms of cyber security, and how can companies calculate a sensible budget for them?
- How can CNI companies of all sizes — from small power generation plants to global pharmaceutical manufacturers — balance budget constraints with the need to secure their industrial network environments? Should cybersecurity budget scale up in line with the size of the company?
- Is it always a case of spending money to make money? Does effective cyber security demand investment into system overhaul – or can we bolster legacy IT systems to make them work harder?
Alex Campbell, Associate Partner, EMEIA Advisory Centre – Cyber Security, EY
Rosa Kariger, CISO, Iberdrola
Interviewed by: Hannah Kuchler, San Francisco Correspondent, Financial Times
2:35pmExploring Communication Strategies: how to maintain credibility after a hack
- If there is a breach, what are the options for first response? Should the alarm be raised immediately, or does admitting to the breach represent a further security risk?
- Stakeholders, customers, lawyers, press: many different groups need to be informed, but companies must ensure they retain in control of the information. How can corporate communications teams ensure that all parties are briefed in a consistent, coordinated and timely manner?
- Essential industries must continue to operate effectively, hacked or not. What kind of business continuity plans need to be implemented?
- How can businesses protect their reputation longer-term? Does the press demand a scapegoat to blame for the breach?
Exclusive speaker: NCSC Director
James Lyons, Head of Media and Public Affairs, NHS England
Interviewed by: David Bond, Security and Defence Editor, Financial Times
David Smith, CISO, Nuix
3:50pmNational Cyber Strategies: bridging the public-private divide
Many governments have a national strategy for coping with cyber threat, a crucial component of which is the protection of critical infrastructure. But the usefulness of centrally-planned strategies is often questioned, especially given the ingenuity of cyber criminals to circumvent whatever defences are erected. In today’s interdependent and interconnected world, the security of the critical ecosystem requires concerted efforts of public-private partners around the globe.
- How do national cyber security strategies deal with critical infrastructure? Is the approach similar in every country, or do some countries take a different approach and achieve better results?
- How are governments working with corporations to ensure that the nation’s essential industries have the best protection possible? How can they develop one policy framework that can be applied across a range of threat vectors?
- Public CNI organisations often contract private companies to deliver certain services, and so they must deal with the vulnerabilities that could be caused by any flaws in these commercial products. How can the public and private sectors forge partnerships to secure the whole supply chain? This kind of collaboration might be effective in terms of security, but does it raise data privacy issues?
- What are the differences between the public and private sector organisations? How do they overcome their differences in funding levels, for example, or transparency obligations?
- What legislation is on its way? What kind of laws can companies expect to minimise "grey zones" in cyberspace about what is allowed and what is prohibited?
Lord James Arbuthnot, Chairman, Information Assurance Advisory Council
Udo Helmbrecht, Executive Director, ENISA
Arne Schönbohm, Director, BSI (German Federal Office for InfoSec)
Erik Wennerström, Director General, Swedish National Council for Crime Prevention
Moderated by: David Bond, Security and Defence Editor, Financial Times
4:35pmClosing Keynote: nation-state cyber espionage
Jamie Shea, Deputy Assistant Secretary General for Emerging Security Challenges, NATO
4:55pmChair’s Closing Remarks
Hannah Kuchler, San Francisco Correspondent, Financial Times
5:00pmNetworking Drinks Reception
Early Bird Ticket (ends 30 March)
Standard Summit Ticket
Associate Sponsor (4)
Darktrace is the world’s leading machine learning company for cyber defense. Created by mathematicians from the University of Cambridge, Darktrace’s Industrial Immune System technology uses AI algorithms that mimic the human immune system to defend industrial networks of all types and sizes. In an era where OT and IT are increasingly converging, Darktrace’s technology is uniquely positioned to provide full coverage of both enterprise and industrial environments. By applying advanced machine learning and AI algorithms, Darktrace Industrial defends critical infrastructure across the world, and is relied upon by leading energy providers, utility companies and manufacturers to secure their ICS and SCADA environments. Headquartered in San Francisco and Cambridge, UK, Darktrace has 33 offices worldwide.
Kaspersky Lab is a global cybersecurity company founded in 1997. Kaspersky Lab’s deep threat intelligence and security expertise is constantly transforming into security solutions and services to protect businesses, critical infrastructure, governments and consumers around the globe. The company’s comprehensive security portfolio includes leading endpoint protection and a number of specialised security solutions and services to fight sophisticated and evolving digital threats. Over 400 million users are protected by Kaspersky Lab technologies and we help 270,000 corporate clients protect what matters most to them.
LogRhythm, a leader in security intelligence and analytics, empowers organisations around the globe to rapidly detect, respond to and neutralise damaging cyber threats. The company’s patented award-winning platform uniquely unifies next-generation SIEM, log management, network and endpoint monitoring, and advanced security analytics. In addition to protecting customers from the risks associated with cyber threats, LogRhythm provides unparalleled compliance automation and assurance, and enhanced IT intelligence.
LogRhythm is consistently recognised as a market leader. The company has been positioned as a Leader in Gartner’s SIEM Magic Quadrant report for four consecutive years, named a ‘Champion’ in Info-tech Research Group’s 2014-15 SIEM Vendor Landscape report, received SC Labs ‘Recommended’ 5-Star rating for SIEM and UTM for 2016 and earned Frost & Sullivan’s 2015 Global Security Information and Event Management (SIEM) Enabling Technology Leadership Award. LogRhythm is headquartered in Boulder, Colorado, with operations throughout North and South America, Europe and the Asia Pacific region.
Nuix (www.nuix.com) understands the DNA of data at enormous scale. Our software pinpoints the critical information organisations need to anticipate, detect and act on cybersecurity, risk and compliance threats.
Our intuitive platform identifies hidden connections between people, objects, locations and events – providing real-time clarity, control and efficiency to uncover the key facts and their context.
Innovation partner (1)
Innovate UK is the UK’s innovation agency. Innovate UK works with people, companies and partner organisations to find and drive the science and technology innovations that will grow the UK economy - delivering productivity, new jobs and exports. Our aim at Innovate UK is to keep the UK globally competitive in the race for future prosperity. For further information and to stay updated on our latest news visit www.gov.uk/innovateuk, follow us on Twitter at @innovateuk or subscribe to our YouTube channel at www.youtube.com/InnovateUK.
Presented by (1)
The Financial Times is one of the world’s leading business news organisations, recognised internationally for its authority, integrity and accuracy. In 2016 the FT passed a significant milestone in its digital transformation as digital and services revenues overtook print revenues for the first time. The FT has a combined paid print and digital circulation of more than 910,000 and makes 60% of revenues from its journalism.
Supporting Partner (3)
Established six years ago, Financial IT is the venue where the FinTech community makes itself heard. Innovation is the common feature of the companies that we work with. Some are FinTech disruptors, posing a direct challenge to established institutions. Others are technology companies, providing solutions that produce positive outcomes for the institutions and their clients. We provide a digital platform for multimedia and editorial content, rankings and overviews of major industry events.
Financial IT magazine is published four or six times a year in digital form. It is also available in print form at trade events through media partnerships. We believe that our competitive edge comes from our established relationships with financial IT companies and institutions, the breadth of the solutions described and the quality of content. Financial IT provides a detailed map of the ever-changing space where the broadly defined financial services sector meets the IT sector.
The ICLG series provides current and practical comparative legal information on a range of practice areas. These comprehensive guides follow a question and answer format to ensure thorough coverage of each topic within different legal systems worldwide. Each guide draws together the collective expertise of our contributors to provide a valuable and convenient resource, updated annually.
The ICLG series provides a practical insight for general counsel, government agencies and private practice lawyers, keeping them abreast of law and policy globally.
All guides are available free to access at www.iclg.com.
CBR Online provides the latest news and analysis for the technology sector through its website and daily newsletter, as well as exclusive premium content; dedicated, independent research studies; and the CBR Dining Club exclusive networking events for senior IT managers. Subscribe to our newsletter and read the latest here.