Abstract: 

Ransomware is rightly listed as the top cybersecurity threat because it works. It's a simple approach that supports a profitable business model. This session will examine current cyber defence recommendations with regard to their effectiveness, and propose that continually improving the prevailing best practice is a "one step behind" approach. Going back to basics, we will show how leveraging the way PCs are used in business, together with some new and old technologies, can deliver a more effective alternative ransomware defence than the status quo. The European Union Agency for Cybersecurity together with the UK’s National Cyber Security Centre both state that ransomware continues to be the top cybersecurity threat. It is cybercriminals who drive the bulk of these strikes, exploiting the fact that organisations have still not found a way of staying ahead of this kind of attack. And with the potentially massive financial returns of the ransomware business, cybercriminals have great success in evading capture.

The problem with current ransomware defence best practice is that it relies on identifying patterns and behaviours that we already know represent malicious activity. We all know that cybercriminals are experts in devising new ways of staying one step ahead of these systems. And they are in a position where they can try attacks millions of times, with success being measured in small percentages. We, however, need to block 100% of attacks. Rather than playing roulette with data by burdening your teams with meaningless checks and restrictions, why not remove the human element to achieve 100% data protection?
This session will examine the shortfalls of current recommendations around handling ransomware. We will then suggest a fresh and simple approach which leverages normal business practices so that we no longer have to rely on attempting to identify all attacks. And to mitigate the data exfiltration side of the extortion, we propose how all data should be considered sensitive, rather than having to work out where to apply the strongest information controls.

Takeaways:
Common techniques like full disk encryption, placing sensitive data in secure data stores, and zero trust architecture aren’t as effective as they should be.
Find out various human-caused and IT policy problems that hinder data security for organizations
Learn a different approach to data security management that doesn’t try to keep all cybercriminals out all of the time and yet considers all data equally important.

Bio: 

Jerald Ray is the Chief Operations Officer of SecureAge Technology. Jerald has an extensive technology and international business background due to his more than 15 years of experience in process engineering, consulting and global finance in the U.S. and Asia Pacific Region. He began his career as a Production Research Engineer at the Konica Corporation, then served as a Technical Solutions Advisor for a large Japanese Disney affiliate, and later applied his advanced economics training as a Global Investment Analyst for the leasing division of the Industrial Bank of Japan (now known as Mizuho Bank). Leveraging his Japanese language skills, Jerald also worked as a Process and Optimization Consultant in Amsterdam for a joint venture between the Japan Management Association Consultancy (JMAC) and the Ford Motor Company.
In the U.S., Jerald provided international business risk analysis while at SAIC (Science Applications International Corporation), and independently crafted Asian market entry strategies as a consultant to several U.S. IT security and related technology firms.

Jerald received his technical education in Operations Research Engineering from Cornell University, and later supplemented that with Degrees in International Economics and Comparative Policy Analysis at the University of Florida and the University of California, San Diego.