KuppingerCole's Advisory stands out due to our regular communication with vendors and key clients, providing us with in-depth insight into the issues and knowledge required to address real-world challenges.
Compare solution offerings and follow predefined best practices or adapt them to the individual requirements of your company.
Meet our team of analysts and advisors who are highly skilled and experienced professionals dedicated to helping you make informed decisions and achieve your goals.
Meet our business team committed to helping you achieve success. We understand that running a business can be challenging, but with the right team in your corner, anything is possible.
As a prelude to the captivating “Capture The Flag” competition, this session reveals what is in store for the second day of KuppingerCole's Cyberevolution conference. It provides a comprehensive overview, introducing the exciting concept of the CTF event, detailing the format, and introducing the various teams demonstrating their cybersecurity prowess. From observing industry veterans to identifying emerging talent, attendees will gain valuable insight into the strategies and approaches employed in this live competition.
This session will set the context for a dynamic event that blends competition, camaraderie, and practical problem-solving. Join us to understand the upcoming CTF competition, where theory and practice converge to challenge and inspire.
As a prelude to the captivating “Capture The Flag” competition, this session reveals what is in store for the second day of KuppingerCole's Cyberevolution conference. It provides a comprehensive overview, introducing the exciting concept of the CTF event, detailing the format, and introducing the various teams demonstrating their cybersecurity prowess. From observing industry veterans to identifying emerging talent, attendees will gain valuable insight into the strategies and approaches employed in this live competition.
This session will set the context for a dynamic event that blends competition, camaraderie, and practical problem-solving. Join us to understand the upcoming CTF competition, where theory and practice converge to challenge and inspire.
When doing business in China, there are unique cybersecurity risks and complexities to consider. Experts in this field discuss these challenges in depth, pointing out potential vulnerabilities and strategies for prevention. The conversation covers topics such as China's cyber laws, the difficulties of technology collaboration, risks to intellectual property, and the importance of strong risk management strategies.
Additionally, the panel will explore how the business environment in China is changing and provide advice on how companies can secure their digital presence while striving for success in this market. The insights gained from this panel are invaluable for organizations looking to safely navigate this complex terrain.
The realm of cloud security has been extensively covered in books and articles, yet a crucial aspect remains ripe for exploration. It revolves around the fundamental understanding of what your cloud service provider offers and, equally vital, where your responsibilities lie in the realm of cloud security.
When embarking on the journey of adopting a cloud service, the foremost question to answer is, "What aspects of security do I need to oversee?" In a traditional on-premises setting, roles are distinct: IT manages infrastructure, information and cybersecurity handles security, and application developers bear the responsibility for code integrity. However, the landscape is evolving, with many organizations embracing DevOps, where these responsibilities are often shared, and the lines between development and operations blur or vanish.
Regardless of organizational structure, the majority of security obligations reside within your company's domain when you use an on-prem environment. Transitioning from an on-premises environment to a cloud environment presents one of the most intricate challenges—a more intricate shared responsibility model for security.
In the context of cloud security, two paramount concerns need close attention.
The first is the risk of misconfiguration. In a cloud environment, misconfigurations can inadvertently expose sensitive data and vulnerabilities, underscoring the critical importance of ensuring that cloud services and resources are set up correctly to mitigate such risks.
The second concern is insider attacks. Cloud users often lack influence over the staff of cloud service providers, making it essential to consider the possibility of insider threats. While cloud service providers typically promise robust security measures in place, it's crucial for organizations to implement their own layers of security to safeguard against insider attacks and unauthorized access, fortifying the shared responsibility model in the cloud.
In my presentation, I will delve into these intricacies, providing valuable insights and real-world examples of what your cloud service provider can do, irrespective of your specific needs and/or preferences.
Fraud is a major cost to businesses worldwide. Banking, finance, payment services, and retail are some of the most frequent targets of fraudsters. However, insurance, gaming, telecommunications, health care, cryptocurrency exchanges, government assistance agencies, travel and hospitality, and real estate are increasingly targeted as cybercriminals have realized that most online services trade in monetary equivalents. After years of being the focus of cybercriminals, banking and financial institutions are more likely to be better secured than other industries, meaning that fraudsters are increasingly likely to attack any potentially lucrative target if given the opportunity. Fraud perpetrators are continually diversifying and innovating their Tactics, Techniques, and Procedures (TTPs).
The most prevalent types of fraud businesses, non-profit organizations, and government agencies experience today are:
Account Takeover (ATO) Fraud - occurs when fraudsters use breached passwords, phishing, social engineering and credential stuffing attacks to execute unauthorized transactions.
Account Opening (AO) Fraud – also called New Account Fraud or Synthetic Fraud, often happens as a result of using stolen identities or assemblages of personal information to create synthetic digital IDs.
In this session we will provide an overview of Fraud Reduction Intelligence Platforms and show the highlights of our latest research in this area.
As governments around the world increasingly turn to artificial intelligence (AI) to enhance their security, a myriad of complex challenges emerge. This presentation delves into the multifaceted landscape of applying AI to secure government operations.
Paul Fisher delves into the multifaceted approach required to foster trustworthiness within complex software supply chains. This discussion begins by delineating the critical components of software supply chains and the potential risks associated with each link—from development and deployment to maintenance and decommissioning.
Key to establishing a chain of confidence is the adoption of transparent processes and tools that provide verifiable evidence of security at each step. The audience will be introduced to Software Bill of Materials (SBOM), cryptographic signing, and continuous integration/continuous deployment (CI/CD) pipelines fortified with automated security checks.
The talk will also consider the human aspect, emphasizing the need for cultivating a culture of security awareness and collaboration among stakeholders. This includes not only developers and security professionals but also suppliers, distributors, and end-users.
Finally, the talk will provide actionable insights and strategies for organizations to audit, monitor, and continuously improve their software supply chains.
Cyber risk isn’t just a technical problem but a strategic one. Through Cyber Risk Quantification CISO’s are enabled to quantify the financial benefit of their cyber security strategy and are empowered to communicate with the Executive Board on eye-level and get the buy-in that you need. Join this session to learn how other companies are finally getting full transparency on their cyber exposure, ensuring not only they’re making the right investments in cyber security but also getting the right ROI of such investments.
At first, some insights into the background, purpose and history of the e-IDAS regulation are provided and the difference between the previous and the currently proposed e-IDAS version are explained very shortly. Core part of the presentation addresses the impact and main challenges, including the concerns expressed by various stakeholder groups. Finally, the expected timeline is given.
In his talk, Martin Kuppinger, Principal Analyst at KuppingerCole Analysts, will look at the role of identity security for succeeding in the digital journey and its impact on secure journeys, convenient journeys, and digital enablement of the 3C - customers, consumers, and citizens. He will discuss the role of identity security, the perfect organizational setup, and the business impact of doing digital identity right and secure.
The past weeks again have demonstrated that cybersecurity and geopolitics are inseparable. Cyber attacks have become a common element in geopolitical crisis as an additional vector for concrete attacks, but also for MDM (Misinformation, Disinformation, Malinformation). This also means that CISOs nowadays must take a broader perspective beyond technology. Geopolitics impact the cybersecurity of organizations, and organizations must adapt to this, both by adjusting their organizational structures and cybersecurity spendings as by extending their risk management approaches in a way that also helps in assessing the concrete cybersecurity impact of geopolitics.
How can I effectively address cybersecurity vulnerabilities within my organization? Also, what are the implications of the Cyberresilience Act for this? EDITH, the European Digital Innovation Hub for Hesse, has extended an invitation to Dr. Steven Arzt, a cybersecurity expert from the Fraunhofer Institute for Secure Information Technology SIT, for a #DigiTalk session discussing best practices for Coordinated Vulnerability Disclosure.
Coordinated Vulnerability Disclosure (CVD) is the process with which ethical hackers report vulnerabilities in software and systems to manufacturers and system operators. Researchers commonly often assess the security status of a system or product independently, i.e., without a formal invitation, contract or integration into a company’s strategy. While these unasked-for vulnerability reports are still considered an insult by some companies, others openly embrace their value for strengthening the company’s IT security by interacting with the hacking and research communities. In his talk, Dr. Arzt shows how a proper CVD process can greatly benefit companies and the wider IT security community at the same time. It is shown how CVD can not only help identify and fix vulnerabilities, but also send a strong positive message about a company’s attitude towards IT security.
This interactive workshop will provide a practical approach to understanding and applying Zero Trust principles in creating your cybersecurity architecture.
We will focus on transitioning from traditional security perimeters to an identity-driven Cybersecurity Mesh, acting as the backbone for implementing the Zero Trust model. A detailed case study will guide you through the initial stages of incorporating Zero Trust principles into your current security landscape, identifying potential challenges, and offering methodical solutions.
The session will center on active learning through real-world examples, where participants will gain hands-on experience in shaping a resilient Cybersecurity Fabric. The workshop will conclude with participants developing a personalized roadmap to integrate Zero Trust principles into their cybersecurity systems seamlessly.
Join us to kickstart your Zero Trust journey, navigate its intricacies, and move towards a secure future with real-world applications and interactive problem-solving guidance.
