OFFICIAL PUBLISHER
Special discount for readers! Save $300 on standard registration with code GEC
Gartner Security & Risk Gartner Management Security & Risk Management Summit Summit 2018 2018 Special discount for readers! Save $300 on standard registration with code GEC
October 22 - 23 / Dubai, UAE
October 22 - 23 / Dubai, UAE gartner.com/me/security gartner.com/me/security
Securing Digital Business: Adapt. Transform. Scale. Discover the latest research and recommendations to transform
Special discount for readers! Save $300 on standard registration with code GEC
Gartner Security & Risk Management Summit 2018 October 22 - 23 / Dubai, UAE gartner.com/me/security
Securing Digital Business: Adapt. Transform. Scale. Discover the latest research and recommendations to transform your security strategy and build resilience across the enterprise. Special discount for readers! Save $300 on standard registration with code GEC
Š 2018 Gartner, Inc. and/or its affiliates. All rights reserved. Gartner is a registered trademark of Gartner, Inc. or its affiliates. For more information, email info@gartner.com or visit gartner.com.
GARTNER SRM SUMMIT 2018
MEA
OCTOBER 2018
03
Adopt. Transform. Scale
Gartner Security and Risk Management Summit, Dubai
Transform your cyber-security, risk management, compliance, and data security strategies Prepare to meet the pace and scale of today’s digital business at Gartner Security & Risk Management Summit 2018. Build resilience through leading-edge research and thinking on key topics such as mobile security, cloud security, privacy and securing the Internet of Things (IoT). The summit will provide the latest information on new threats and emerging technologies such as AI, machine learning, analytics and blockchain—while helping you address the ongoing shortage of skilled staff. Join the world’s CISOs and top security and risk management professionals to hone your leadership capabilities and gather the information you need to enable digital business in a world of escalating risk.
CONTENTS OF THE PREVIEW
DARKTRACE
MCAFEE
QUALYS
IntelligenceDriven Approach
Security for Combating Locking Horns Transformation Modern with Legacy Threats with AI
SAI GLOBAL
CENTRIFY
MIMECAST
All-inclusive Approach to Risk and Compliance
Empowering Trust in Zero Trust
At the Heart of Email Security Ahead. Alert. Abreast
PALADION
SPIRE SOLUTIONS
ATTIVO
Deception Redefined
04
G A R T N E R A N A LY S T C O M M E N T
MEA
OCTOBER 2018
Only 65 Percent of Organizations
Have a Cybersecurity Expert
According to the survey, many CIOs consider growth and market share as the top-ranked business priority for 2018. Growth often means more diverse supplier networks; different ways of working, funding models and patterns of technology investing; as well as different products, services and channels to support.
ROB MCMILLAN, RESEARCH DIRECTOR AT GARTNER.
D
espite 95 percent of CIOs expecting cyberthreats to increase over the next three years, only 65 percent of their organizations currently have a cybersecurity expert, according to a survey from Gartner, Inc. The survey also reveals that skills challenges continue to plague organizations that undergo digitalization, with digital security staffing shortages considered a top inhibitor to innovation. Gartner’s 2018 CIO Agenda Survey gathered data from 3,160 CIO respondents in 98 countries and across major industries, representing approximately $13 trillion in revenue/public sector budgets and $277 billion in IT spending. The survey indicates that cybersecurity remains a source of deep concern for organizations. Many cybercriminals not
only operate in ways that organizations struggle to anticipate, but also demonstrate a readiness to adapt to changing environments, according to Rob McMillan, research director at Gartner. “In a twisted way, many cybercriminals are digital pioneers, finding ways to leverage big data and web-scale techniques to stage attacks and steal data,” said Mr. McMillan. “CIOs can’t protect their organizations from everything, so they need to create a sustainable set of controls that balances their need to protect their business with their need to run it.” Thirty-five percent of survey respondents indicate that their organization has already invested in and deployed some aspect of digital security, while an additional 36 percent are actively experimenting or planning to implement in the short term. “Taking a risk-based approach is imperative to set a target level of cybersecurity readiness,” Mr. McMillan said. “Raising budgets alone doesn’t create an improved risk posture. Security investments must be prioritized by business outcomes to ensure the right amount is spent on the right things.”
Business growth introduces new attack vectors According to the survey, many CIOs consider growth and market share as the top-ranked business priority for 2018. Growth often means more diverse supplier networks; different ways of working, funding models and patterns of technology investing; as well as different products, services and channels to support.
“The bad news is that cybersecurity threats will affect more enterprises in more diverse ways that are difficult to anticipate,” Mr. McMillan said. “While the expectation of a more dangerous environment is hardly news to the informed CIO, these growth factors will introduce new attack vectors and new risks that they’re not accustomed to addressing.”
Continue to build bench strength The survey revealed that 93 percent of CIOs at top-performing organizations say that digital business has enabled them to lead IT organizations that are adaptable and open to change. “Cybersecurity is faced with a welldocumented skills shortage, which is considered a top inhibitor to innovation,” Mr. McMillan said. “Finding talented, driven people to handle the organization’s cybersecurity responsibilities is an endless function.” According to Gartner, while most organizations have a role dedicated to cybersecurity expertise, and therefore appreciate its needs, the cybersecurity skills shortage continues. Gartner recommends that chief information security officers (CISOs) continue to build bench strength through innovative approaches to developing the security team’s capabilities. Gartner clients can read more in the report “The 2018 CIO Agenda: Security and Risk Management Insights on Becoming a Digital CISO.”
06
G A R T N E R A N A LY S T C O M M E N T
MEA
OCTOBER 2018
Worldwide Security Spending Will Reach
$96 Billion in 2018, Up 8% from 2017
60 percent of organizations will invest in multiple data security tools such as data loss prevention, encryption and data-centric audit and protections tools, up from approximately 35 percent today.
RUGGERO CONTU, RESEARCH DIRECTOR AT GARTNER
G
artner, Inc. forecasts worldwide security spending to total $96.3 billion in 2018, an increase of 8 percent from 2017. Organizations are spending more on security as a result of regulations, shifting buyer mindset, awareness of emerging threats and the evolution to a digital business strategy. “Overall, a large portion of security
spending is driven by an organization’s reaction toward security breaches as more high profile cyberattacks and data breaches affect organizations worldwide,” said Ruggero Contu, research director at Gartner. “Cyberattacks such as WannaCry and NotPetya, and most recently the Equifax breach, have a direct effect on security spend, because these types of attacks last up to three years.” This is validated by Gartner’s 2016 security buying behavior survey*. Of the 53 percent of organizations that cited security risks as the No. 1 driver for overall security spending, the highest percentage of respondents said that a security breach is the main security risk influencing their security spending. As a result, security testing, IT outsourcing and security information and event management (SIEM) will be among the fastest-growing security subsegments driving growth in the infrastructure protection and security services segments (see Table 1). Gartner analysts said that several other factors are also fuelling higher security spending.
WORLDWIDE SECURITY SPENDING BY SEGMENT, 2016-2018 (MILLIONS OF CURRENT DOLLARS) SEGMENT
2 01 6
2017
2018
I d e n t i t y A c c es s M a n a g e m e n t
3, 9 1 1
4,279
4,695
I n f r a s t ru c t u r e P r o t e c t i o n
1 5 , 1 56
16,217
17,467
N e t w o r k S e c u r i t y Eq u i p m e n t
9 , 7 89
10,934
11,669
Security Services
4 8 , 796
53,065
57,719
C o n s u m e r S ec u r i t y S o f t w a r e
4 , 5 73
4,637
4,746
T O TA L
8 2 , 225
89,133
96,296
SOURCE: GARTNER (DECEMBER 2017)
Gartner forecasts that by 2020, more than 60 percent of organizations will invest in multiple data security tools such as data loss prevention, encryption and data-centric audit and protections tools, up from approximately 35 percent today. Skills shortages, technical complexity and the threat landscape will continue to drive the move to automation and outsourcing. “Skill sets are scarce and therefore remain at a premium, leading organizations to seek external help from security consultants, managed security service providers and outsourcers,” said Mr. Contu. “In 2018, spending on security outsourcing services will total $18.5 billion, an 11 percent increase from 2017. The IT outsourcing segment is the second-largest security spending segment after consulting.” Gartner predicts that by 2019, total enterprise spending on security outsourcing services will be 75 percent of the spending on security software and hardware products, up from 63 percent in 2016. Enterprise security budgets are also shifting towards detection and response, and this trend will drive security market growth during the next five years. “This increased focus on detection and response to security incidents has enabled technologies such as endpoint detection and response, and user entity and behavior analytics to disrupt traditional markets such as endpoint protection platforms and SIEM,” said Mr. Contu.
Many Challenges One Partner
AT A GLANCE 750+ CLIENTS Clients in GCC, Levant, North Africa & the Indian Sub-continent
15+ COUNTRIES Supporting our valuable clients in 15+ countries
9.8 / 10 In Customer Satisfaction Index
7 AWARDS won in the last 18 months
OUR SOLUTIONS Threat Exposure Management
EDR & Threat Hunting
Business Risk Intelligence (BRI)
Deception & Response Platform
Email Authentication As A Service
Employee Powered Information Security
Third Party Risk Management Platform
IT Management & Monitoring Tools
1504, Jumeirah Business Center 3, Cluster Y – Jumeirah Lakes Towers, Dubai, United Arab Emirates T: +971 4 427 9940 | F: +971 4 428 9038 | E: info@spiresolutions.com | W: spiresolutions.com
08
EXHIBITOR SHOWCASE
MEA
OCTOBER 2018
MCAFEE
Intelligencedriven Approach Brief us about your security portfolio as of 2018. How does your customer/clientele and geographical presence look like? Our portfolio includes industry leading solutions for cloud security, data protection & encryption, endpoint security, network security, security management, server security, security analytics, SIEM and web security. Specifically, in terms of cloud security solutions, our portfolio includes McAfee Skyhigh Security Cloud, McAfee Virtual Network Security Platform (McAfee vNSP) and McAfee Cloud Workload Security (McAfee CWS).
In a sentence, define your organizations prime security vision? McAfee provides security solutions that protect data and stop threats from device to cloud, using an open, proactive, and intelligence-driven approach.
What are you showcasing at the Gartner Security Symposium 2018? Firstly, MVISION, a new portfolio in McAfee family featuring innovations that offer a single point of visibility, comprehension and control across your digital estate. With the flexibility to manage and deploy both McAfee, third-party and even the security that’s built-in on modern devices, MVISION supports your current and evolving security needs as
you migrate to the cloud and to newer secure operating systems. Secondly, we will expose to you our Cloud security platform which enables organisations to accelerate their business by giving them total control over their data in the cloud. Come and discover more and meet us at our booth.
What have been some of the biggest blind spots or areas of concern this year within the enterprise security space and how should industry leaders be looking to solve them? Visibility & Control is a major challenge facing enterprises today, leading to weakening of security defences over time. With organisation perimeters melting in to cloud and number of security events rapidly increasing, being proactive against advanced threat requires smart approaches. This isn’t helped by the ongoing talent shortage. To overcome these challenges, organizations should consider: • Openness & Modularity during data collection – this enables organizations to better manage the data deluge in Sec Ops • Human Machine teaming for key incidents – this greatly increases efficiency • Extended perimeters leveraging CASB technology – this provides complete visibility into content, context, and user activity across SaaS, PaaS, and IaaS environments
VIBIN SHAJU, DIRECTOR – SALES ENGINEERING, SOUTHERN EUROPE AND MIDDLE EAST
Which trend do you forecast for the region’s security landscape in the days to come? • Attacks targeting users are on the rise – as an example, ransomware-based attacks have risen by 56% in the last 4 quarters. As defences have improved, profitability of traditional ransomware attacks have declined so attackers are shifting their focus to high net-worth individuals, sabotage, and business disruption. • Privacy concerns are on the rise with more and more corporations exploring new ways to capture data. It is getting extremely difficult to protect against this, and we will see a significant increase in breaches and discoveries of corporate malfeasance • While Machine Learning is used to defend against threats, it is also an avenue for attackers to come up with new threats, fuelling an arms race in machine-supported actions from defenders and attackers. Human-machine teaming has tremendous potential to swing the advantage back to the defenders
EXHIBITOR SHOWCASE OCTOBER 2018
MEA
09
QUALYS
Security for Transformation Brief us about your security portfolio as of 2018. How does your customer/clientele and geographical presence look like? As a revolutionary unified architecture powering more than 15 Qualys security and compliance Cloud Apps, the Qualys Cloud Platform offers customers a streamlined solution for avoiding the cost and complexities of managing multiple security vendors. By automatically gathering and analyzing security and compliance data from IT assets anywhere in one single-pane view, the Qualys Cloud Platform gives customers the scalability, visibility, accuracy and breadth of capabilities to fight cyber attacks and build security into their digital transformation initiatives. The Middle East is a key location for many of our multi-national customers and partners and we are seeing significant investments in security infrastructure across the region to support further growth.
In a sentence, define your organizations prime security vision? Qualys helps organizations streamline and consolidate their security and compliance solutions in a single platform and build security into digital transformation initiatives for greater agility, better business outcomes and substantial cost savings.
What are you showcasing at the Gartner Security Symposium 2018? At the Gartner Symposium, Qualys will showcase its new products and solutions
such as the Web Application Firewall (WAF), Continuous monitoring (CM), CertView, CloudView and Out-of-Band Configuration Assessment (OCA). Qualys experts will be conducting demonstrations at the stand.
What have been some of the biggest blind spots or areas of concern this year within the enterprise security space and how should industry leaders be looking to solve them? In recent times, it has been a challenging period for information security professionals, with major breaches taking place frequently, and the targets of such attacks varying. Often, the similarities between these strikes is that outdated security practices are in place to protect modern cloud infrastructure and DevOps practices, making it easy for hackers to succeed. A key component for building security into digital transformation efforts is to insert Infosec processes, people and tools into the DevOps software development and delivery pipeline. The reason: The mobile and web apps, and web services coming out of DevOps teams tend to be the vehicles for new digital transformation initiatives. In other words, developers are at the center of these projects. Thus, the role for security is to facilitate the availability and use of automated security tools for developers, so that code can be scanned for vulnerabilities, misconfigurations and other security issues early and often in the software lifecycle. This will make code cleaner, assets more secure, and give the security team a new
HADI JAAFARAWI, MANAGING DIRECTOR, QUALYS MIDDLE EAST
role: Helping and supporting developers collaboratively and throughout the software lifecycle, sharing the joint goal of delivering secure apps quickly. If security teams embrace this opportunity, DevOps is transformed into DevSecOps – an enhanced model in which security is embedded and involved with developers and IT ops staff at every step of an application’s lifecyle.
Which trend do you forecast for the region’s security landscape in the days to come? A rising threat and trend for organisations is vulnerabilities that go undetected, which pose some of the greatest threats. Those that linger unpatched for weeks or at times even months, offer hackers easy opportunities to breach systems. Organisations in the region are no longer ignoring the need to implement rigorous cyber security solutions and adopt preventative methods to ensure that individual data points, IT assets, networks and infrastructure deployed in the cloud are protected against vulnerabilities.
10
EXHIBITOR SHOWCASE
MEA
OCTOBER 2018
DARKTRACE
Combating Modern Threats with AI Brief us about your security portfolio as of 2018. How does your customer/clientele and geographical presence look like? Darktrace’s cyber AI is deployed across 7000 networks in 105 countries around the world. Our customers base spans multiple industry verticals, from 10-person hedge funds to global banks as well as government organisations. The Enterprise Immune System’s strength is that it is agnostic with regards to the kinds of networks it can defend, from cloud and virtualized networks through to IoT and industrial controls systems, our AI is actually defending and responding to cyber-threats across these diverse digital environments.
In a sentence, define your organizations prime security vision? For cyber AI to be a business enabler for organizations in every sector, all over the world, that arms defenders with machines that can fight back against increasingly stealthy, fast-moving threats wherever they emerge across the digital estate.
What are you showcasing at the Gartner Security Symposium 2018? This year we will be showcasing how Darktrace’s Enterprise Immune System mimicks the intelligence of the human immune system, to not only detect subtle threats, but autonomously respond to
them in seconds. Just as our human bodies protect us from the majority of dangerous viruses and pathogens, some dangers are still able to enter our bodies. The same applies to cyber security – some threats will get in. Darktrace forms a ‘pattern of life’ of any network, by modeling the interactions between every device and user on the network in real time, and differentiating between ‘normal’ and ‘abnormal’ behavior. By spotting the subtly unusual, the technology can detect threats in their earliest stages and deliver digital antibodies to quarantine and stop threats from doing damage.
What have been some of the biggest blind spots or areas of concern this year within the enterprise security space and how should industry leaders be looking to solve them? Over the past year, we’ve seen hacks on everything from coffee machines to fingerprint scanners. With more and more devices connected to the internet, enterprises’ attack surface are expanding rapidly, and attackers are now targeting non-traditional IT to gain a foothold into the network from which they can move laterally. The cloud and IoT create blind spots on the network that traditional security tools fail to catch. AI will be indispensable in detecting and autonomously responding to threats that emerge
ELIZABETH DE FREITAS, REGIONAL MANAGER, DARKTRACE
across the virtual and physical parts of a network.
Which trend do you forecast for the region’s security landscape in the days to come? As companies in Middle East continue to embrace the digital revolution they will face the full spectrum of modern attacks from low and slow nation state attacks to fast-moving ransomware. Unable to fill the cyber security skills gap, we will have to turn to AI technologies to respond to this new era of threat. AI’s fundamental ability to handle massive complexity at unprecedented scale will be – and, for thousands of organizations across the world, already is – increasingly vital for cyber security. Disrupting incidents before they can escalate into crises, and freeing up time for security teams to prioritise the most important issues will be a key priority in the days and months to come for cyber defenders in the region.
EXHIBITOR SHOWCASE OCTOBER 2018
MEA
11
PALADION
Locking Horns with Legacy Brief us about your security portfolio as of 2018. How does your customer/clientele and geographical presence look like? We have a strong and growing base of customers whom we protect in the Middle East. Last year we added a significant number of MDR customers. Summit attendees will be able to access some of these case studies at our booth. We protect them both globally and regionally. We have global SOCs staffed with over 1,000 of the world’s top cyber security experts that protect our partners in the Middle East, and we also developed, earlier this year, the region’s first AI-driven SOC to ensure our partners in the Middle East receive priority support.
In a sentence, define your organizations prime security vision? A breach is inevitable – we focus on swift detection and response, so you can prevent catastrophic damages. A simple statement, but there’s a bit to unpack there. First, we protect our customers against all four types of attacks— known attacks by known attackers, unknown attacks by known attackers, known attacks by unknown attackers, and, most important, unknown attacks by unknown attackers. This fourth group of attacks—unknown attacks by unknown attackers—are the most challenging for organizations to overcome, and we have defending against these attacks our specialty. Second, we protect our partners at every stage of an attack. We designed our AI-driven Managed Detection and
Response program to cover every stage of a potential attack. That includes threats that have not reached you yet (via Threat Anticipation) and threats you didn’t know were already lurking in your system (via Threat Hunting).
What are you showcasing at the Gartner Security Symposium 2018? We will primarily showcase our AIdriven MDR solution. We launched this program—the industry’s first fully AIdriven Managed Detection and Response solution—earlier this year at Gartner’s security and risk summit at Maryland, United States. At this summit, we are excited to let attendants get their hands on the program. We will have an exhibition space where we will run demos of our platform, and discuss the real-world success stories and case studies we have so far produced by deploying our program at top organizations.
What have been some of the biggest blind spots or areas of concern this year within the enterprise security space and how should industry leaders be looking to solve them? As surprising as it might sound, many enterprises are still focused primarily on traditional security measures—such as attempting to protect their perimeter and defending against known threats. This is despite the fact enterprises have all-but dissolved their perimeter through digitization, and now face more and more unknown attacks sent by unknown attackers. We don’t mean to pick on enterprise
AMIT ROY, EXECUTIVE VICE PRESIDENT & REGIONAL HEAD FOR EMEA, PALADION
security teams here. The reality is most teams are very skilled and hard working. But they are already overloaded dealing with traditional security threats, and they lack the resources required to build internal capabilities like advanced analytics and AI-driven response required to handle today’s advanced threats.
Which trend do you forecast for the region’s security landscape in the days to come? We expect to see more regional organizations realize they cannot handle nextgeneration threats on their own. We saw this recently with a new client of ours. They are a financial firm in the Middle East. They built a strong traditional internal security team that was able to maintain compliance and to protect their crown jewels from known threats. But they lacked the ability to monitor all of their assets 24/7, and they were unable to detect—let alone respond to—new advanced threats. They simply lacked the resources to develop these capabilities internally, so they called us. We speak to organizations like this every day, and expect their numbers to grow substantially as more organizations realize just how unprotected they really are.
12
EXHIBITOR SHOWCASE
MEA
OCTOBER 2018
ATTIVO NETWORKS
Deception Redefined Brief us about your security portfolio as of 2018. How does your customer/clientele and geographical presence look like? In response to the high demand from the region, Attivo Networks expanded its worldwide presence in 2016 by opening an office in the Middle East. The Attivo Networks ThreatDefend™ Detection and Response Platform represents the next generation of distributed deception solutions and has been built to outmaneuver modern-day attackers that bypass other security solutions. The solution provides a powerful security control for early and accurate in-network threat detection and changes the asymmetry against attackers. As the most comprehensive and scalable deception platform, Attivo dynamic traps, bait, and lures provide threat deception for the wide range of today’s evolving attack surfaces including networks, cloud, data centers, remote offices, IoT, medical IoT, ICS-SCADA, infrastructure, telecommunications, and POS networks. By turning the environment into a virtual “hall of mirrors,” deception disrupts an attacker’s reality and imposes increased cost as they are forced to decipher what is real versus fake.
In a sentence, define your organizations prime security vision? Attivo Networks vision is to provide accurate and efficient detection of in-network threats using threat deception in order to derail attacks, reduce attacker dwell time,
and simplify incident response.
What are you showcasing at the Gartner Security Symposium 2018? At Gartner Security Symposium 2018, Attivo will illustrate the critical role that deception technology is playing in early and accurate in-network threat detection and accelerated incident response. The company will be showcasing the Attivo Networks® ThreatDefend™ Deception and Response solution, which provides immediate detection value by accurately alerting on attacker engagement with decoys or attempts to use deception credentials, most notably early in the attack cycle. .
What have been some of the biggest blind spots or areas of concern this year within the enterprise security space and how should industry leaders be looking to solve them? With rapidly expanding networks and evolving attack surfaces, many organizations are still searching for an efficient way to reduce dwell time and increase in-network visibility. Early and accurate detection and remediation of in-network threats is more critical than ever before. To stay ahead of modern attackers, organizations should consider adding deception-based detection technology to their security arsenal for early detection and accelerated incident response. Deception provides an extremely efficient approach for reducing dwell time and
RAY KAFITY, VICE PRESIDENT, MIDDLE EAST, TURKEY AND AFRICA, ATTIVO NETWORKS
gives organizations the upper hand against cybercriminals.
Which trend do you forecast for the region’s security landscape in the days to come? As the velocity and sophistication of security threats continue to rise, in-network threat detection and response must move to the top of every organization’s priority list to reduce their potential for being breached. Furthermore, formal regulations will likely be enacted and heavily applied to organizations that do not implement a minimum standard of prevention, detection, and response technology. Organizations are being challenged to shift from a perimeter-based defense to one that balances detection controls and formalized incident response plans. The previous year saw early adopters embrace deception technology for early detection and detection monitoring controls to catch attackers throughout the kill chain attack phases. In 2019, detection technology deployment will continue to increase as will threat intelligence information sharing programs that facilitate collaboration and automate incident response.
Visit us at Gitex 2018 Dubai World Trade Centre Hall 6, C6-01
14
EXHIBITOR SHOWCASE
MEA
OCTOBER 2018
SAI GLOBAL
All-inclusive Approach to Risk and Compliance Brief us about your security portfolio as of 2018. How does your customer/clientele and geographical presence look like? SAI Global offers a new perspective on risk with a range of risk and security solutions, content and services that address a number of global risk and compliance requirements, including cybersecurity risk, data privacy and GDPR, regulatory compliance and vendor risk management. SAI Global operates in all regions of the globe with offices across the Americas, Europe, APAC and the Middle East. Our clients operate in a wide number of industry verticals including Financial Services, Manufacturing, Technology, Oil & Gas, Healthcare and Life Sciences.
In a sentence, define your organizations prime security vision? In today’s always-on environment, organizations are exposed to more risks and new complex and fast-moving challenges to brand and reputation than we could ever have imagined ten years ago. We help organizations manage their risk and compliance program, influencing and shaping employee ethics and behaviors and giving Boards and executives strategic risk insight to drive business performance.
What are you showcasing at the Gartner Security Symposium 2018? SAI Global recently introduced SAI360, the most comprehensive suite of Integrated Risk Management
(IRM) solutions, that begins to bind our market-leading risk and compliance capabilities, learning content and services together. Our customers, along with leading industry analysts, signaled there is now a need to take an integrated approach to managing risk. It can no longer be effectively managed in silos; it needs to be connected. SAI360 represents a more open, integrated and all-inclusive approach to risk and compliance that will enable our customers with better assessment processes, compliance, ethics and values learning, risk culture and to use data more strategically to meet the risk and resilience challenges they face.
What have been some of the biggest blind spots or areas of concern this year within the enterprise security space and how should industry leaders be looking to solve them? We’ve seen huge changes in the GRC software landscape owing to a range of factors, including increased risk from digital transformation, intangible assets such as brand reputation increasingly driving business decisions and customers now using a wide range of different solutions, resulting in a fragmented risk management technology architecture. We believe IRM provides this strategic, collaborative, and aggregated view of risk and compliance. It enables organizations to respond and adapt to change and disruption quickly and helps you to better understand the full scope of risk. It also allows you to be more innovative when responding to new risks presented
ROB VAN STRATEN, EXECUTIVE VICE PRESIDENT, SAI GLOBAL
by digital initiatives, in addition to the ever-present change in the risk and compliance landscape organizations operate within.
Which trend do you forecast for the region’s security landscape in the days to come? The implications of a cyber-attack and subsequent theft of personal data for organisations that receive and store vast amounts of personal data, brings the fragility of consumer trust to the fore. Companies must take data security seriously to ensure ongoing viability. The most effective means of preventing reputational and financial damage is adopting a proactive approach to cybersecurity detection and response. By implementing a robust risk management framework, an organisation will provide itself with a solid foundation for avoiding a crisis in the first place, and a better framework for managing one if and when it occurs. This helps the organisation reduce reputational and financial damage.
EXHIBITOR SHOWCASE OCTOBER 2018
MEA
15
CENTRIFY
Empowering Trust in Zero Trust Brief us about your security portfolio as of 2018. How does your customer/clientele and geographical presence look like? Centrify delivers Zero Trust Security through the power of Next-Gen Access. The Centrify Zero Trust Security model assumes that users inside a network are no more trustworthy than those outside the network. Centrify verifies every user, validates their devices, and limits access and privilege. Centrify also utilizes machine learning to discover risky user behavior and apply conditional access — without impacting user experience. Centrify’s Next-Gen Access is the only industry-recognized identity & access management solution that uniquely converges Identity-as-a-Service (IDaaS), enterprise mobility management (EMM) and privileged access management (PAM). Over 5,000 worldwide organizations, including over half the Fortune 100, trust Centrify to proactively secure their businesses.
In a sentence, define your organizations prime security vision? Our vision is to provide the next dimension security in the age of access. When organizations think Zero Trust Security, they will think Centrify.
What are you showcasing at the Gartner Security Symposium 2018? We will be showcasing our world-class identity and access management solutions and demonstrate how these can help organizations secure their identities
and critical data. We will also advocate the new security mandate - never trust, always verify based on a zero-trust security approach. We plan to increase the awareness of our solutions through presentations and product demonstrations at the event. Our experts will be available to meet visitors and share how Centrify has helped many prestigious organisations globally as well as in the region to modernise their approach to business, adopt new models and take fascinating initiatives with the peace of mind that their identities and critical data are secure.
What have been some of the biggest blind spots or areas of concern this year within the enterprise security space and how should industry leaders be looking to solve them? The threat landscape is changing rapidly with a frightening sophistication and pace of data breaches. With 80 percent of breaches involving privilege credential misuse and 81 percent of breaches involving weak, default or stolen passwords, the need to rethink security with a Zero Trust Security model has never been more critical. Many security leaders are turning to Zero Trust approaches that remove trust from the equation completely, shunning the traditional “trust but verify” approach and replacing it with a “never trust, always verify” mandate. According to a February 2017 commissioned study conducted by Forrester Consulting on behalf of Centrify, when enterprises implement identity best practices, the chance of a breach decreases by 50
KAMEL HEUS, REGIONAL MANAGER – MIDDLE EAST & AFRICA, CENTRIFY
percent and technology costs decrease by 40 percent.
Which trend do you forecast for the region’s security landscape in the days to come? Compromised accounts are today’s leading cause of data breach in the Middle East. In this age of access, trying to build policy that keeps data secure, without stopping user productivity, requires a massive security rethink. Risk-based access improves security and user experience. It uses machine learning to define and enforce access policies, based on user behavior. Through a combination of analytics, machine learning, user profiles, and policy enforcement, access decisions can be made in real time to streamline low-risk access, step up authentication requirements when risk is higher, or block access entirely. Not only does risk-based access provide real-time security, but it also flags high-risk events, and elevates them to IT’s attention – speeding analysis and greatly minimizing the effort required to assess risk across today’s hybrid IT environment.
16
EXHIBITOR SHOWCASE
MEA
OCTOBER 2018
MIMECAST
At the Heart of Email Security Brief us about your security portfolio as of 2018. How does your customer/clientele and geographical presence look like? We are focusing on offering cyber resilience for email, unlike other vendors who tend to focus on defence only strategies. Many of our customers have moved or are moving their email services to the hosted or cloud such as Microsoft Office 365. Mimecast believes staying ahead of new email attack trends is critical but it’s equally important to be prepared for the days when something does get through. So, if a breach occurs, you can keep email flowing with our continuity offering, recover from ransomware quickly and safely with our secure and multipurpose archive, and get your employees back online and operational as fast as possible. From a geographical perspective, we are now making significant headway in Dubai but there is still so much opportunity in the rest of the UAE. Our next biggest opportunity is Saudi Arabia and we’re starting to see some traction in this important market. In a sentence, define your organizations prime security vision? Mimecast makes business email and data safer millions of employees worldwide with cloud-based security, archiving and continuity services.
What are you showcasing at the Gartner Security Symposium 2018? We will showcase our full-range of advanced email security and data protection services, including new enhance-
ments to Mimecast Targeted Threat Protection that are designed to stop IDN attacks that spoof your domain name or those of your supply chain partners with international characters. In addition to this, Mimecast will also focus on the importance of the human firewall, following Mimecast’s recent acquisition of cybersecurity training and awareness platform, Ataata.
What have been some of the biggest blind spots or areas of concern this year within the enterprise security space and how should industry leaders be looking to solve them? The right security staffing resources combined with employee awareness and education are key. Organisations need to invest in third-party threat intelligence, assess and deploy leading technologies, conduct ongoing threat analysis, automate remediation services and deliver inline user education to help employees be more aware and guarded. I’m confident that email will remain the vector of choice for attackers. If email isn’t part of an organisation’s core security strategy, it can become a major vulnerability. It’s the number-one vector used to execute cyberattacks like malware delivery, phishing, Business Email Compromise, and for spreading threats that are already internal to your organisation. Furthermore, security is everybody’s responsibility and an effective awareness and training programme for staff is therefore vital. One off or annual training isn’t enough to build a powerful human firewall. You need to find creative
JEFF OGDEN, GENERAL MANAGER, MIMECAST MIDDLE EAST.
methods to educate employees in realtime through coachable moments and learning opportunities.
Which trend do you forecast for the region’s security landscape in the days to come? No digital transformation strategy is complete without having security at the heart of it. But in a cloud-first and data-rich world, the attack surface has expanded past the traditional IT perimeter and every employee has become the easiest route into an organisation. Employees will therefore need to be front and centre of security strategies – which includes how to operate and keep working productively during an attack.
EXHIBITOR SHOWCASE OCTOBER 2018
MEA
17
SPIRE SOLUTIONS
Ahead. Alert. Abreast Brief us about your security portfolio as of 2018. How does your customer/clientele and geographical presence look like? Spire Portfolio comprised of world’s best known niche security solutions Vendors: l Rapid7 – Threat Exposure / Vulnerability Management Platform l Endgame – Endpoint Detection and Response l Security Scorecard – Third Party Risk Management tool l Flashpoint – Business Risk Intelligence l EmailAuth – Email Authentication As A Service l HumanFirewall – Employee Powered Information Security l Attivo Networks – Deception and Response Platform l SolarWinds – IT Management Software and Monitoring Tools We are covering META region and have major Focus on GCC. Currently we have 750+ Customers across the region.
In a sentence, define your organizations prime security vision? While working with a selective range of technology partners we bring niche solutions to the market that do not create one problem while solving others.
What are you showcasing at the Gartner Security Symposium 2018? At the Event we will showcase: Rapid7 – Threat Exposure / Vulnerability Management Platform; Endgame – Endpoint Detection and Response;
Security Scorecard – Third Party Risk Management tool; EmailAuth – Email Authentication As A Service and HumanFirewall – Employee Powered Information Security
What have been some of the biggest blind spots or areas of concern this year within the enterprise security space and how should industry leaders be looking to solve them? A recent Verizon Data Breach Report highlighted that approximately 70% of Cyber Breaches are a result of poor third-party security. With more and more digitalization and business-to-business transactions, a company is only as strong as its weakest 3rd party ! In light of this, it becomes imperative to be able to take stock of an organisations partners, vendors and supply chain. Current methods are cumbersome, too manual, not scalable and offer at best, only a “snapshot in time” security perspective. To address this, we have recently brought Security Scorecard to the region. The solution provides external (internet facing) security hygiene of any company…. quickly, continuously and non-intrusively. Basically, an external hackers initial view of the organization. Security Scorecard evaluates the external security posture against 10 parameters including network security, application security, patching cadence etc, and produces a detailed and overall grade score. An organization can now quickly prioritize which 3rd parties to work with. Apart from 3rd party vendor risk management, the other popular use cases include self-assessment
SANJEEV WALIA, PRESIDENT AND FOUNDER OF SPIRE SOLUTIONS.
and monitoring as well as benchmarking against industry peers.
Which trend do you forecast for the region’s security landscape in the days to come? Digital transformation brings with it significant risks from ever-evolving cyber threats perpetrated by cyber criminals which have the motivation, capability, and intent to exploit the vulnerabilities in digital technologies for commerce and government services. With bigger, more sophisticated threats prevention is not enough, thus we will see more focus on timely detection and response to potential security hacks techniques. In addition, as OT network is no longer disconnected, it becomes attractive for attackers who have a potential path from the internet, through the IT network and into the critical devices. Growing number of connected devices is simply providing more attack vectors: with this increase in number of threats, IoT security will become a top concern and big issue for businesses in the Middle East.
18
G A R T N E R A N A LY S T C O M M E N T
MEA
OCTOBER 2018
Top Six Security and Risk Management Trends Business leaders are becoming increasingly conscious of the impact cybersecurity can have on business outcomes. Gartner, Inc. said that security leaders should harness this increased support and take advantage of six emerging trends, to improve their organization’s resilience while elevating their own standing.
Demanding Increased Emphasis on Data Liabilities Customer data is the lifeblood of everexpanding digital business services. Incidents such as the recent Cambridge Analytica scandal or the Equifax breach illustrate the extreme business risks inherent to handling this data. Moreover, the regulatory and legal environment is getting ever more complex, with Europe’s GDPR the latest example. At the same time, the potential penalties for failing to protect data properly have increased exponentially. PETER FIRSTBROOK, RESEARCH VICE PRESIDENT AT GARTNER.
Trend No. 1: Senior Business Executives Are Finally Becoming Aware That Cybersecurity Has a Significant Impact on the Ability to Achieve Business Goals and Protect Corporate Reputation Business leaders have not always been receptive to this message, but a recent string of high-profile incidents have changed sentiment. “Business leaders and senior stakeholders at last appreciate security as much more than just tactical, technical stuff done by overly serious, unsmiling types in the company basement,” said Peter Firstbrook, research vice president at Gartner.
Trend No. 2: Legal and Regulatory Mandates on Data Protection Practices Are Impacting Digital Business Plans and
Trend No. 3: Security Products Are Rapidly Exploiting Cloud Delivery to Provide More-Agile Solutions “Avoid making outdated investment decisions,” advised Mr. Firstbrook. “Seek out providers that propose cloud-first services, that have solid data management and machine learning (ML) competency, and that can protect your data at least as well as you can.”
Trend No. 4: Machine Learning Is Providing Value in Simple Tasks and Elevating Suspicious Events for Human Analysis Gartner predicts that by 2025, ML will be a normal part of security solutions and will offset ever-increasing skills and staffing shortages. But not all ML is of equal value. “Look at how ML can address narrow and well-defined problem sets, such as classifying executable files, and be careful not to be suckered by hype,” said Mr. Firstbrook. “Unless a vendor can explain in clear terms how its ML implementation enables its product
to outperform competitors or previous approaches, it’s very difficult to unpack marketing from good ML.”
Trend No. 5: Security Buying Decisions Are Increasingly Based on Geopolitical Factors Along With Traditional Buying Considerations Increased levels of cyber warfare, cyber political interference, and government demands for backdoor access to software and services have resulted in new geopolitical risks in software and infrastructure buying decisions. Recent government bans against Russian and Chinese firms are obvious examples of this trend. “It’s vital to account for the geopolitical considerations of partners, suppliers and jurisdictions that are important to your organisation,” said Mr. Firstbrook. “Include supply chain source questions in RFIs, RFPs and contracts.”
Trend No. 6: Dangerous Concentrations of Digital Power Are Driving Decentralization Efforts at Several Levels in the Ecosystem The internet is driving a wave of centralization, one obvious example of which is cloud computing. While there are many benefits (some outlined above), a good security team should be accounting for the risks too. “Evaluate the security implications of centralization on the availability, confidentiality and resiliency of digital business plans,” said Mr. Firstbrook. “Then, if the risks of centralization could seriously threaten organizational goals, explore an alternative, decentralized architecture.”
AUSTRALIA AZERBAIJAN BAHRAIN BOTSWANA CANADA CHINA EGYPT FRANCE GHANA
INDIA INDONESIA ITALY KAZAKHSTAN KENYA MALAYSIA MAURITIUS NEW ZEALAND NEPAL
34
PARTICIPATING COUNTRIES
NIGERIA OMAN RUSSIA SAUDI ARABIA SCOTLAND SINGAPORE SRI LANKA SPAIN SOUTH AFRICA
SWITZERLAND THAILAND TURKEY UAE UNITED KINGDOM US ZIMBABWE
50 QUALIFYING ROUNDS
3,700 C-LEVEL EXECUTIVES
FOR MORE VISIT: www.gecopen.com CONTACT: ronak@gecmediagroup.com, vineet@gecmediagroup.com, bharat@gecmediagroup.com
20
G A R T N E R A N A LY S T C O M M E N T
MEA
OCTOBER 2018
GARTNER
Worse Before Better Why is the Gartner Security summit the must attend event in the region today for security professionals Security is a broad topic that touches every aspect of an organization’s business model, processes and technology. We are bringing 13 of our top security analysts to the summit. They cover security topics for endpoints, data, network, operational technology, application and development, identity management, business continuity and more.
What is the buzz at this year’s summit The GCC is on high alert. Countries in the GCC have 3-5 times the number of infected systems than the global average. Our global survey finds that the average cybersecurity maturity for organizations in the GCC is still below the global average (2.74 vs 3.22). Regional regulatory bodies such as ADSIC and SAMA are providing guidance and mandate standards, on top of global regulations such as GDPR. However, organizations are scrambling and often unable to meet regional and global regulatory requirements. We found that spending on cybersecurity in the GCC has grown to US$1.8B which translates to a 11% growth. Unfortunately however, much of that money is spent on the wrong things. Most organizations emphasize preventive controls but are seriously underinvested in detection, response and prevention. Consider the fact that nation states are using state-sponsored malware to flood
the region. We saw very sophisticated attacks, targeting wealth and focusing on destruction, rather than cybercriminals that use extortion. These nation state attacks specialize in penetrating traditional security prevention mechanisms. To counter this, we need to strengthen our defenses by making security more adaptive, and assume that penetration will eventually occur. When it does, we need to be prepared to respond to it efficiently and effectively.
What are the trends you forecast for the region Unfortunately, things are going to get worse before they get better, but there are also some bright spots. Regulatory pressure continues to increase. Overall, the GCC has to catch up to global norms in security maturity, and while that includes security spending, the most important part will be to structure the security organization within the company and make security is a business function. There still is a global skills shortage, and that is not going to get better anytime soon. The most mature organizations (in terms of security) will automate and outsource where possible, combined with creative approaches to confront the skills shortage. The trick is to focus on business outcomes through a staffing framework that anticipates skills requirement in advance. Adjusting job descriptions, working with universities and incubators, using cyber ranges are tactics that are paying off. Cloud usage is finally starting to ramp up in the GCC and we foresee an increase
FELIX GAEHTGENS, RESEARCH DIRECTOR AT GARTNER
in investment in cloud and data security as a result.
Can you shed some light on the CISO’s digital transformation journey The GCC region is a hotspot for rapid innovation and adoption of new technologies. Ambitious government strategies and private investment are driving transformative initiatives. CISOs are under a lot of pressure to keep up with these rapid developments. This is the time to lead, not to follow. New technologies such as Blockchain, cloud and containers will underpin these initiatives. But as new technology transforms business models, CISOs must transform cybersecurity initiatives themselves. Think of how the definition security has evolved. The traditional triad of confidentiality, availability and integrity now has new requirements: privacy, safety and reliability – this is because cybersecurity directly impacts our physical safety and well-being. We have had thousands of interactions with CISOs caught in this exciting, and yet daunting transformation, and look forward to sharing best practices and experiences in a special CISO track at our summit.
K E Y FA C T S
MEA
OCTOBER 2018
21
KEY INSIGHTS ON EMERGING TECHNOLOGIES ONLY 1 IN 25 CIOS HAVE DEPLOYED AI IN THEIR ORGANIZATION
ONLY 65 PERCENT OF THEIR ORGANIZATIONS CURRENTLY HAVE A CYBERSECURITY EXPERT BY 2020, 60% OF DIGITAL BUSINESSES WILL HAVE SUFFERED A MAJOR SERVICE FAILURE
MORE THAN 100 BILLION LINES OF CODE ARE CREATED ANNUALLY, AND HACKERS PRODUCE SOME 120 MILLION NEW VARIANTS OF MALWARE EVERY YEAR.
BY 2025, ML WILL BE A NORMAL PART OF SECURITY SOLUTIONS
CHATBOTS WILL BE INTEGRATED ACROSS 25 PERCENT OF ALL CUSTOMER SERVICE AND SUPPORT OPERATIONS BY 2020
5 EMERGING TECH TRENDS : DEMOCRATIZED AI, DIGITALIZED ECOSYSTEMS, DO-ITYOURSELF BIOHACKING, TRANSPARENTLY IMMERSIVE EXPERIENCES, UBIQUITOUS INFRASTRUCTURE
60 PERCENT OF SECURITY BUDGETS WILL BE IN SUPPORT OF DETECTION AND RESPONSE CAPABILITIES BY 2020.
HOW CAN SECURITY LEADERS BE EMPOWERED TO DRIVE RESULTS What’s Important
What’s Dangerous
What’s Real
Innovating for Value
Start from an Enterprise-Wide Risk perspective
Adopt Integrated Risk Management (IRM) Practices
Build a strong foundation of communication
Urgent Crisis and Threat
Create visibility into assets and ecosystems
Design for resilience at Multiple Levels
Use analytics and automation as a force multiplier
Technology Transformation
Empower others to be part of risk management
Challenge conventional wisdom on risks and controls
Select adaptable and adaptive risk controls
EXPLORE THE SECURITY IMPACT OF IOT, AI, BLOCKCHAIN AND OTHER EMERGING TECHNOLOGIES. ADAPT YOUR TECHNOLOGIES
KEY THEMES AT GARTNER SRM 2018
LEARN HOW TO TRANSFORM YOUR ORGANIZATION, INCLUDING YOUR LEADERSHIP SKILLS, TO SUPPORT RAPID CHANGE. TRANSFORM YOUR ORGANIZATION
SCALE UP FOR THE DIGITAL ECOSYSTEM
SCALE UP CAPABILITIES IN HOUSE AND ACROSS YOUR DIGITAL ECOSYSTEM, DESPITE A SHORTAGE OF ADVANCED IT SKILLS.
22
K E Y FA C T S
MEA
OCTOBER 2018
PROGRAMS TO LOOK FORWARD
RISK & BUSINESS RESILIENCE: MANAGE RISK TO UNDERPIN THE DIGITAL BUSINESS TRANSITION
SECURITY OPERATIONS & ARCHITECTURE: THE TECHNICAL INSIGHTS PROGRAM CISO CIRCLE: PROVIDES AN ENHANCED EXPERIENCE THROUGH EXCLUSIVE CUTTING EDGE RESEARCH AND NETWORKING OPPORTUNITIES.
KEY TOPICS AT GARTNER SRM
RANSOMWARE RESPONSE
GCC THREAT LANDSCAPE
CONTEXTAWARE DIGITAL TRUST
ADAPTIVE SECURITY ARCHITECTURES
DATA SECURITY AND CLASSIFICATION
CLOUD AND EMERGING TECHNOLOGY SECURITY
SECURITY ANALYTICS AND ANOMALY DETECTION
IDENTITY GOVERNANCE AND ACCESS MANAGEMENT
ENDPOINT AND NETWORK SECURITY
SECURITY AWARENESS AND CAPACITY BUILDING
APPLICATION SECURITY
BUSINESS CONTINUITY MANAGEMENT (BCM)
WHAT CAN CISOS EXPECT FOR GARTNER SRM ASK THE HACKER SESSION: CHRIS VALASEK, RENOWNED WHITE-HAT HACKER SO YOU WANT TO REPORT ON DIGITAL BUSINESS RISK TO THE BOARD
WRITING IT RISK AND CYBERSECURITY SERVICE DESCRIPTIONS WITH BUSINESSCENTRIC VALUE STATEMENTS
LESSONS LEARNED IN THE EQUIFAX BREACH AND OTHER INCIDENTS
GETTING YOUR MESSAGE ACROSS
CISO CIRCLE LUNCH
Sophos @ GITEX 2018 Visit Sophos booth SR-D4 in Rashid Hall.
Intercept X for Server Unmatched Server Protection Protect the critical applications and data at the core of your organization, with these essential protections: • Deep Learning Neural Network: Protects against never-before-seen malware • Anti-Exploit: Prevents an attacker from leveraging common hacking techniques • Server Lockdown: Provides application whitelisting with a single click
Get Free Trial www.sophos.com/server
Endpoint Security Software Vendor of the Year
Best Encryption Vendor of the Year
Best UTM Vendor of the Year
Innovative Vendor in Endpoint Security
For more information please contact: salesmea@sophos.com
Top Vendor Endpoint Security of the Year
24
AGENDA
MEA
OCTOBER 2018
AG E N DA
D AY 1 / M O N D AY , 2 2 O C T O B E R , 2 0 1 8 07:45 AM - 05:15 PM 08:30 AM - 09:00 AM 08:30 AM - 09:00 AM
Registration and Information Which Detection Methodology Makes Sense? Gorka Sadowski, Research Director, Gartner Digital Business KPIs and Risk: Identifying and Then Measuring Value John A. Wheeler, Research Director, Gartner Gartner Keynote: Scaling Trust and Resilience — Cut the Noise and Enable Action
09:15 AM - 10:15 AM
Rajpreet Kaur, Sr Research Analyst, Gartner Sam Olyaei, Principal Research Analyst, Gartner Steve Riley, Research Director, Gartner Magic Quadrants of Key Network Security Technologies (Firewall, Web
10:00 AM - 10:20 AM
Application Firewall, Intrusion Prevention System) Rajpreet Kaur, Sr Research Analyst, Gartner Blockchain, Is This Stuff Secure? How CISOs Can Evaluate the Secu -
11:00 AM - 11:30 AM
rity Risks of Blockchain David Mahdi , Research Director, Gartner
11:00 AM - 11:30 AM
Network Segmentation in the Modern Data Center Rajpreet Kaur, Sr Research Analyst, Gartner Enterprise Firewalls, CASBs and Secure Web Gateways: Untangling
11:00 AM - 11:30 AM
the Feature Snarl Jon Amato, Research Director, Gartner Endpoint Detection and Response Roundtable
11:00 AM - 12:00 PM
Ian McShane, Research Director, Gartner Eric Ouellet, Research VP, Gartner
11:00 AM - 12:30 PM
Workshop: Crisis Communications After a Security Incident David Gregory, Research Director, Gartner CISO Circle Lunch: Lessons Learned in the Equifax Breach and Other
12:15 PM - 01:30 PM
Incidents John A. Wheeler, Research Director, Gartner Guest Keynote: Digital Transformation and Cybersecurity – Friends or Foes? Amer Sharaf, Director of Compliance Support and Alliances, Dubai
01:45 PM - 02:45 PM
Electronic Security Center Abdulkareem Binsheha, General Manager in the Policies and Standards, National Cybersecurity Authority (NCA) in the Kingdom of Saudi Arabia.
FROM GARTNER’S DESK OCTOBER 2018
03:00 PM - 03:30 PM 03:00 PM - 03:30 PM
MEA
Making Application Control Manageable Jon Amato, Research Director, Gartner How to Develop Cloud Security Skills Steve Riley, Research Director, Gartner Beat the Odds — Plan for Success With Identity Governance and
03:00 PM - 03:30 PM
Administration Felix Gaehtgens, Research Director, Gartner Ask the Analyst: Tips for Selecting the Right Security Analytics Tools
03:00 PM - 03:45 PM
for Your SOC Gorka Sadowski, Research Director, Gartner
04:25 PM - 04:45 PM 04:45 PM - 05:45 PM 05:00 PM - 05:45 PM 05:00 PM - 05:45 PM
Magic Quadrant for Cloud Access Security Brokers Steve Riley, Research Director, Gartner Roundtable: How Blockchain and eIDs Will Affect Governments David Mahdi , Research Director, Gartner State of the Threat Landscape in the GCC, 2018, 2018 Gorka Sadowski, Research Director, Gartner CISO Circle : Five Questions on AI That CISOs Should Answer Sam Olyaei, Principal Research Analyst, Gartner Ask the Analyst: Why You Must Consider Data Privacy When Building
05:00 PM - 05:45 PM
Your IoT Initiative Nader Henei n, Research Director, Gartner
05:00 PM - 05:45 PM 05:00 PM - 05:45 PM
State of Risk Management 2018 John A. Wheeler, Research Director, Gartner State of Organizational Resilience 2018-2019 David Gregory, Research Director, Gartner
25
26
FROM GARTNER’S DESK
MEA
OCTOBER 2018
AG E N DA
D AY 2 / T U E S D AY , 2 3 O C T O B E R , 2 0 1 8 08:30 AM - 05:30 PM
Registration and Information Gartner Keynote - Defending Networks From An Attacker’s Perspective
09:00 AM - 09:45 AM
Chris Valasek, Principal Autonomous Vehicle Security Architect & Renowned “White Hat” Hacker, Cruise Automation
09:45 AM - 10:30 AM
Networking Refreshment Break Magic Quadrants of Key Network Security Technologies (Firewall, Web
10:00 AM - 10:20 AM
Application Firewall, Intrusion Prevention System) Rajpreet Kaur, Principal, Analyst, Gartner Roundtable: How Can Midsize Enterprises Leverage Microsof t’s Security
10:15 AM - 11:15 AM
and IAM Capabilities? Steve Riley, Sr Director, Analyst, Gartner CISO Circle: Ask The Hacker
10:15 AM - 11:15 AM
Chris Valasek, Principal Autonomous Vehicle Security Architect & Renowned “White Hat” Hacker, Cruise Automation
10:30 AM - 11:15 AM
GDPR the Day After: 3 Myths and 6 Key Capabilities Discussed Nader Henein, Sr Director, Analyst, Gartner Managing the Insider Threat — Why Employee Monitoring Is No Longer
10:30 AM - 11:15 AM
Taboo Jonathan Care, Sr Director, Analyst, Gartner
10:30 AM - 11:15 AM
Manage Privileged Access to Reduce Security Risks and Increase Agility Felix Gaehtgens, Sr Director, Analyst, Gartner Penetration Testing Experience, the Good, the Bad, the Ugly
10:30 AM - 11:30 AM
Mohammad AlNasser, Director of Information Security, Tamkeen Technologies
12:00 PM - 01:15 PM 01:00 PM - 02:00 PM
Networking Lunch Roundtable: Inside Employee Monitoring — Use Cases and Benefits Jonathan Care, Sr Director, Analyst, Gartner How to Hunt for Security Threats
01:15 PM - 02:00 PM
Jon Amato, Sr Director, Analyst, Gartner Sam Olyaei, Sr Principal, Analyst, Gartner
01:15 PM - 02:00 PM
If You Thought Securing Your IT Was Difficult, Try Securing Your OT Wam Voster, Sr Director, Analyst, Gartner A CISO’s Perspective: How to Secure Your Organization’s Blockchain
01:15 PM - 02:00 PM
Initiative Scott Carlson, Information Security Officer, Sweetbridge, Inc.
01:15 PM - 02:00 PM
State of Data Security 2018 David Mahdi, Sr Director, Analyst, Gartner
FROM GARTNER’S DESK OCTOBER 2018
MEA
27
Workshop: The Importance of Carrying Out a Business Impact Analysis 02:15 PM - 03:45 PM
(BIA) David Gregory, Sr Director, Analyst, Gartner
02:15 PM - 03:45 PM
The Importance of Carrying out a Business Impact Analysis (BIA) David Gregory, Sr Director, Analyst, Gartner The 2018 Magic Quadrant for Endpoint Protection Platforms
03:00 PM - 03:20 PM
Ian McShane, Research Director, Gartner Eric Ouellet, VP, Analyst, Gartner Prateek Bhajanka, Research Analyst, Gartner Improving the Business Relevance of the Security and Risk Management
03:00 PM - 03:30 PM
Program Abdullah Al Barwani, CISO, Omantel A Business Centric, Service-Based Risk Assessment Framework
03:00 PM - 03:30 PM
Pillairkulam Parthasarathy, Chief Security Officer & Senior Vice President, First Abu Dhabi Bank (FAB)
03:00 PM - 03:30 PM 03:30 PM - 04:00 PM
Supply Chain and Third Party Cybersecurity Framework Nourah Al-Sohmi, Cybersecurity Governance Specialist, Saudi Aramco Networking Refreshment Break Getting a Successful EDR Deployment in Your Organization
04:00 PM - 04:45 PM
Ian McShane, Research Director, Gartner Eric Ouellet, VP, Analyst, Gartner
04:00 PM - 04:45 PM 04:00 PM - 04:45 PM
State of Fraud Prevention and Payment Security Jonathan Care, Sr Director, Analyst, Gartner How to Approach Security in an Aligned IT/OT World Wam Voster, Sr Director, Analyst, Gartner Endpoint Security: The Convergence of EPP and EDR
04:00 PM - 04:45 PM
Eric Ouellet, VP, Analyst, Gartner Prateek Bhajanka, Research Analyst, Gartner
04:00 PM - 05:00 PM
Roundtable: Security Talent and Career Development David Mahdi, Sr Director, Analyst, Gartner Workshop: Starting a Security Monitoring, Detection and Res ponse
04:00 PM - 05:30 PM
Initiative Mark Nicolett, Managing Vice President, Gartner
05:00 PM - 05:30 PM 05:00 PM - 05:30 PM 05:00 PM - 05:30 PM
State of Endpoint and Mobile Security, 2018 Jon Amato, Sr Director, Analyst, Gartner The 5 Security Roles You Must Plan for in the Digital Era Sam Olyaei, Sr Principal, Analyst, Gartner Steps to Begin With SOC Journey for an Enterprise in the Middle East Rajpreet Kaur, Principal, Analyst, Gartner
10
Characteristics of a Master CIO
It is not about a certain skill set or knowledge of a technology. To become a Master CIO, one should embrace and promote these 10 characteristics:
#1 Act as business leaders more than IT leaders
#2 Be subject to business metrics
#3 Have an industry vision
#4 Look for additional capabilities outside of IT #5 Have high emotional intelligence and focus on “people skills”
#6 Are bimodal leaders with successful business narratives #7 Apply coaching or visionary leadership styles more than “command and control” #8 Promote a culture ready for anything as part of their strategy #9 Focus on innovators first, not on innovations
#10 Have a “values first” mentality and recognize the wider benefits that accrue through the “purpose economy”
Gartner Symposium/ITxpo 2019 will help you cement your place as a leader, partner or both. Join us in March in Dubai, UAE and explore new ways of thinking and find the trusted insights and guidance you need to lead your organization with confidence.
Gartner Symposium/ITxpo 2019 4 – 6 March 2019 / Dubai, UAE / gartner.com/me/symposium / #GartnerSYM © 2018 Gartner, Inc. and/or its affiliates. All rights reserved. Gartner and ITxpo are registered trademarks of Gartner, Inc. or its affiliates. For more information, email info@gartner.com or visit gartner.com.