Schedule

A core design principle of SABSA is that it can and should integrate with other security frameworks, in this presentation Bruce will walk through the different stages in the SABSA development Lifecycle and appropriate MITRE projects that can be integrated. Bruce is also interested to hear how other people apply MITRE projects and to build a group to develop a white paper on the subject for the TSI.

The Digital Operational Resilience Act is an extensive set of requirements across five main pillars: ICT Management, ICT Incident Reporting, Digital Operational Resilience Testing, Third Party Risk, and Information Sharing Agreements. In support of the Act, a number of technical standards have been released for consultation. In this presentation, we explore the demands that DORA will put on the security team, and the current thinking in how they can be satisfied.

This paper embarks on an exploration of that intersection. We delve into how archiving strategies can enhance security, ensure compliance, and bridge the gap between business context and security architecture. Specifically, we focus on the Conceptual Layer and the Contextual Layer of the SABSA framework.

Key Themes:

1. Conceptual Layer and Archival Principles: We analyse how the Conceptual Layer of SABSA aligns with archival principles, to define how archivists can contribute to a robust security foundation.
2. Contextual Layer and Business Context: The Contextual Layer of SABSA considers business imperatives, and we explore how archival practices can provide context for security decisions around data governance, compliance, and risk mitigation.

As cyber threats become increasingly sophisticated, the need for adaptive security strategies is more critical than ever. This presentation will explore the concept of co-design for cybersecurity professionals. In short co-design can be defined as: “Co-design involves collaborating with a diverse team to identify and understand problems, develop solutions, and test their implementation to improve outcomes and experiences.”

A co-design framework that integrates technical expertise with human dynamics will be introduced. Co-design is creating with, not for. It brings together different stakeholders to foster sustainable practices and robust solutions that between technical and non-technical teams is important to craft effective organisational cybersecurity strategies. The intent is to help create non-cyber organisational stakeholders to can become agents of change, and that collaborative knowledge sharing among diverse stakeholders becomes essential.

A case study demonstrating how co-design framework can be used for implementing a simple yet complex issue that is password policy for an enterprise organisation who has different stakeholder requirements (eg a developer, non-technical end user, CISO, Legal and HR personnel), technical necessities (architecture, technical integrations etc)and conflicting technical controls (eg NIST, ISO27001k, CIS Controls, PCI DSS) through the phases of

• pre-design: understand people’s experiences in the context of their lives: past, present, and future

• generative: produce ideas, insights, and concepts that may then be designed and developed

• evaluative: assess, formatively or summatively, the effect or the effectiveness of products, spaces, systems, or services

• post design: Investigate how people actually experience the product, service, or space

The presentation will cover practical strategies for implementing co-design in cybersecurity, addressing both technological and organisational challenges. This framework aims to offer actionable strategies for effectively incorporating a co-design approach into cybersecurity policy, procedures and practices.

While there are several contributing factors to the decline of the Soviet Union, perhaps the most significant was that of Chernobyl meltdown, confirmed when Gorbachev remarked that it “was perhaps the real cause of the collapse of the Soviet Union.”

In this SABSA presentation we will use SABSA framework and supporting methodologies to explore the people, process and technology failures that lead to the release of 400 times more radiation than that of the Hiroshima atomic bomb.

We will use this and other international nuclear near misses such as Three Mile Island and the UK Windscale fire as a rich canvas to explore common cyber security architecture failures and successes, highlighting systemic risk transfer across enterprises and government and focusing on some of the opportunities that have since manifested.

The presentation demonstrates SABSA techniques including domain modelling, trust modelling and risk modelling to decompose complex interactions and unpack the architectural failures that ultimately lead to the decline of the Soviet Union.

In this session, we will discuss via an interactive session:

1. The top challenges and issues faced with business transformation
2. 7 things that companies who are getting this right are doing
3. Together co-design your organistion’s approach

The audience will walk away with practical actionable steps in their own co-designed approach to securing their business transformation, whilst hearing of common challenges and practical approaches other organisations are taking.

Businesses are increasingly looking toward automation to streamline processes, improve productivity, and “enhance operational efficiency”. A naïve security team might be afraid of the risk that automation poses. But, using a SABSA perspective, we can see that risk from a different angle and recognize it as an opportunity: both to focus on what is important to the business and to reduce the exposure of systems to the human factor.

Through real-world examples, we will illustrate how automation can enhance security posture and minimize the impact of human errors on an organization. We’ll also explore the various ways automation can support security risk assessment, such as enhancing anomaly detection and fortifying defense mechanisms. We’ll also discuss the importance of controls to ensure that automation doesn’t fail. Facilitated by a member of your friendly neighborhood automation team, participants can expect to discuss the best ways to communicate and partner with groups modifying their processes so that security can take advantage of a rare chance to course-correct across their organization.

This session will explore the researched and proven methods in behavioural psychology and look to propose an approach using what we know about human psychology to increase the care, and positive outcomes from each touchpoint with our organisations to embed cybersecurity at scale.

Building on the foundational tenets of from frameworks such as SABSA, we will dive into practical approaches to improve the way cybersecurity teams incentivise and reward positive cybersecurity behaviours, leading to better security outcomes for the organisation.

Attendees will leave the session with a fresh take and practical next steps on how research-backed behavioural psychology methods in communication and recognition can meaningfully contribute to furthering our goal of securing our organisations. Dialling up the honey and tempering the vinegar to a palatable portion.

Using elements of the SABSA security architecture toolbox the needs of the organisation and team were assessed, language was normalised and helpful explanatory diagrams were drafted. This foundation allowed the team to have a shared view of program goals, terms of success and how to  mutually support each other to great effect.

This is not a story of a perfect enterprise implementation of SABSA within an organisation. That would be a tall tale and COSAC doesn’t tolerate those kindly.

This is a story of thoughtful experimentation, iteration, growing at the pace of trust and a ‘wabi sabi’ mindset. It is a story of successes and the practical lessons learned over time. And yeah, it features a few novel SABSA models.

It is September 1^st 2006, and a content update has been published by a then global security vendor, an enterprise software powerhouse, no different than most times of the day each day. Only this time this latest ‘virus signature’ contains a particularly unfortunate false positive, an erroneous detection that will detect a critical system file of the world’s most-used server operating system as malware. Within eight hours a new replacement signature is released, yet a further eight days passes before the resolution of the second-waive of consequence is achieved, that at first went unnoticed. Sound familiar?

To quote the then Vice President in charge of this research & development lab: “We play with bombs, sometimes…well, eventually you expect one will explode in your face”. In those days it did make the global tech news, even some business news, but went unnoticed by the mainstream or general public.

On July 19^th 2024 something similar occurred with a current global security vendor, however this time in a cloud-based, as-a-Service, IoT-world the impact and reach was fast, heard and felt by millions from Fortune-100s to everyday members of society trying to buy groceries on a Friday evening.

The media began their coverage with much of it pointing the blame at the wrong party, or where more accurate they still filled in the unknowns and gaps with speculation or poor “techie jargon” jokes. Meanwhile impacted organisations began looking to their CISOs and heads of cyber security for a solution…to make it go away, to “terminate with extreme prejudice”.

Whether we walk out of our houses into public or walk into a bank or store from the street, we don’t even consciously think of the fact that we are crossing a boundary or that each boundary that we cross is beholden to a set of rules that we learn to follow from a young age. One can even go so far as to say that each of these boundaries defines and protects a zone. The Oxford dictionary defines a zone as “an area or stretch of land having a particular characteristic, purpose, or use, or subject to particular restrictions”. Why is it then that we make it so incredibly difficult for ourselves to define and traverse zones in modern business environments? In this session we will explore how we can use an adapted version of SABSA domain modelling to define and manage zones within a modern enterprise and use these zones to create and communicate security information flows and controls to stakeholders concisely and consistently.

This session will explore how leveraging threat intelligence can enhance boardroom engagements, ensuring that board members grasp the implications of cyber risks and make informed decisions.

Audience will gain insights into selecting and tailoring key metrics that resonate with board members, aiding in strategic planning and risk management. The discussion will cover the integration of threat intelligence into boardroom conversations to enhance situational awareness, improve incident response readiness, and inform cyber risk governance.

The session will also contain a case study, leveraging public data from prominent regulatory activity in Australia to illustrate what constitutes reasonable and proportionate control measures. These enable defensible postures and promote prudent investment prioritisation discussions with Board and Executives.

The session will be delivered by two seasoned and highly respected cyber leaders in Australia who will bring real-world learnings from across a wide range of industries.

Some of these can be about putting capability in place to prevent risks occurring or monitoring movement in known risks. Roy Hill took a different approach for its FY25+ Cybersecurity Strategy by using concepts around traceability and other SABSA principles to build a strategy directly linked to organisational strategy and business priorities.

She will also outline how these frameworks can be customised to meet the unique needs of any organisation.

The session is designed to benefit all participants, as the insights and tips shared can be applied across all different types of organisations with tangible improvements to governance and management practices.

As SABSA architects we are taught to approach this work with a high degree of consultation, concern for shared understanding and need for logical consistency. This is best done as a team, because we can only win together.

Sarit and Kirk will share experiences collected from architects who had different degrees of success working with teams. These case studies will be used to discuss the importance of a collaborative team-based approach to the work of the enterprise security architect.

Game Theory started with von Neumann’s On the Theory of Games Strategy paper in 1928 and the theory and was extended in the 1950s to consider its application to Nuclear Strategy by the RAND corporation.

In this presentation Bruce will discuss the background of Game Theory, how it has evolved and how it can be applied to cyber security threat modelling activities. The session will then open up to the room to discuss people’s experiences using Game Theory in their threat modelling activities. The session will close with resources and an approach people can take back to their workplaces.

Those wishing to give a talk at the rump session must submit a short abstract, no more than one page long, according to one of the following procedures:

• Electronic submission: Send email to the rump session chair David Lynas at [email protected]
• Hardcopy submission at conference: Hand the submission to David Lynas at the conference before noon on Wednesday 26th February.

Submissions should include a requested amount of time for the presentation. An anticipated absolute maximum of four minutes will be allocated for each presentation.

This is a unique competition format that uses real client scenarios and deliverables to see which team will reign supreme! Whether you are a seasoned enterprise architect or security architect, or just looking to try something different to build and enhance your skills, this session will provide a unique opportunity to prove and hone your architecture chops. Many practitioners come out of self-study or training armed with new skills, but struggle with applying them in complex situations and under tight time frames. Not to mention, there may be a limited number of practitioners in their organization (or region for that matter) to learn from. The primary goals for this session are to build relationships with other practitioners, to learn from each other on different ways to apply techniques to solve problems, and setup situations where we can creatively apply and adapt our skills. This is not a session where you will sit and listen to a presenter telling you how to do something.

Past attendees of the Design-Off have marked this as one of the highlights of the conference and we hope you will leave feeling the same way. Each year we feature a unique customer and problem set, so if you have attended in a previous year, be assured that this year will present a new and different challenge. This year we have several tweaks planned based on feedback from past attendees that we think will further enhance the experience!

Teams are made of people with different skill sets and skill levels, and team members will be actively engaging each other and trying to find the best way to meet the challenges. This is not a competition in using a specific formal methodology or framework (although they will definitely come in handy), but is meant to be an exercise in applying these techniques in a ways that most effectively meet the client’s needs. Each year’s winners proved their mettle through several challenges, demonstrating skills in listening to clients, applying risk management, demonstrating business value, and effectively communicating with the client. There can be only one winning team, however all participants will learn from the experience. Where else can you see how different groups of high level security practitioners apply their skills to address the same problem? That said, you will want to win this! The winning team members not only get bragging rights, but will be announced on the SABSA LinkedIn group, and each member will receive a personal acknowledgment on their LinkedIn Page congratulating them on their achievement! Other spot prizes may be awarded by the moderators in addition to this to recognize outstanding efforts of participants.

A few of the hardest problems SABSA architects face are working alone, and getting started where there are challenges. These design workshops not only build teams from people who may have never worked together before, they challenge the groups to quickly overcome challenges to deliver actionable architecture quickly. It can be done; this activity proves it.

Wider adoption is still lagging, however, with a number of commonly cited arguments against its use:

• Qualitative methods (risk matrices) aren’t perfect, but they’re good enough
• We couldn’t possibly have enough data to quantify cyber risk
• Statistical modelling is too difficult; our stakeholders won’t understand it

In this workshop, we aim to debunk some of the common misconceptions surrounding quantitative methods. Participants will:

• Learn about statistical loss modelling and cyber risk quantification techniques.
• Use the Open FAIR^TM framework to model cyber losses.
• Understand the limitations of using Open FAIR^TM with SABSA-based architectures.
• Participate in hands-on modelling activities with enterprise quantitative tools.
• Apply these concepts to real-world case studies.

By using the D&D 5e TTRPG system, cybersecurity tabletop exercises can be gamified, adding an element of randomness, unpredictability and fun to the simulations. Participants can take on roles, such as security analysts or executives, and work together to solve challenges that are presented in the game. This approach not only makes the simulations more engaging but also provides an opportunity for participants to practice decision-making under pressure.

The D&D 5e system is well-suited for this purpose due to its flexibility and versatility. It allows for a wide range of cybersecurity scenarios and challenges to be created and can accommodate varying levels of experience and skill among participants.

Come and join us for a game of Hackers & Crackers (H&C) where we will be using the D&D 5e TTRPG system in a cybersecurity tabletop crisis simulation.

Due to the rapid growth, many of the delivery centres were operating in their own bubbles and using their own operating models, service definitions, delivery processes, playbooks, runbooks, people management processes, SLAs, metrics and technology stacks. This caused a high degree of inconsistency in the quality, delivery methods and collaboration between the centres, especially when providing services to clients with global footprints.

In this session we will look at how SABSA was used in this transformation journey and the value and impact that it has had on the organization.

Part 1: Context – Setting the context of the requirements and putting the necessary governance in place (Program Governance Model)

Part 2: Setting the baseline – Creating a way to consistently communicate priority and value through language and terminology (Business Attributes & Glossary)

Part 3: Organization – Creating a repeatable organization model based on priorities, requirements, skills and technology (Domain Model & Talent Program)

Part 4: Performance Targets – Creating internal and external facing KPIs and SLAs to measure performance

Part 5: Processes – Creating repeatable operational processes

Part 6: Delivery Method – Updating existing mandated delivery methods to reflect and implement changes

Through the lens of a real-world case study, we will explore the strategic, customer-centric, and technological dimensions of this critical aspect of modern business. Participants will gain invaluable insights into:

• Strategic Business Approach that aligns vision with Identity
• The Customer Journey: Designing for Trust and Convenience
• Technology Implementation: Architecture and Integration
• Lessons Learned: Navigating Challenges and Achieving Success
• The Road Ahead: Future Initiatives and Emerging Trends

The Masterclass will conclude with an open forum for participants to ask questions, share experiences, and discuss potential collaborations. Attendees will leave with a comprehensive understanding of  an industrialized Digital Identity implementation and will be primed to embark on their own transformative Digital Identity journeys.

In this workshop we will begin to explore the challenge of how to aggregate risk in a complex environment to help determine which mission objectives are most at risk.  We understand single weaknesses and single risks well, but once things get complex it becomes complicated to understand how the risk compounds.  Averages don’t do the trick; neither does plotting all the risk on a graph.  Actuarial science has solutions, but these solutions require years of data we don’t have.  This collaborative workshop will dive into this risk problem to discuss the specific challenges and collectively try to uncover a path forward.

Separate Registration is required: Register

At the TSI Forum, The SABSA Institute (TSI) and the TSI Liaison Group (LG) will provide their latest updates.

The TSI Forum also includes a question-and-answer session, and an opportunity to meet and interact with The SABSA Institute Board of Trustees (Directors) and LG members.

Agenda:

• Introduction to TSI (for non-members)
• The SABSA Institute update
• Liaison Group EMEA & North America update
• Liaison Group APAC update
• Questions & Answers session
• Networking: Meet the SABSA Institute Board of Trustees and Liaison Group Members

Speakers:

• Gareth Watters – TSI Board Trustee
• Kirk Nicholls – TSI Board Trustee – Chair APAC Liaison Group