Healthcare and public health organizations are under threat and expected to spend a cumulative $125 billion on cybersecurity from 2020 to 2025. But they will reap little return on this investment if the security controls they employ fail. And they do. What's worse, they fail silently so that breaches keep occurring, even when security leaders are confident that their organizations are protected. Verizon estimates that 82 percent of enterprise breaches should have been stopped by existing security controls but weren't, and the healthcare sector ranks among the highest in the rate of severe security flaws. CISOs are under pressure to pinpoint silent failures and deliver risk assessment and mitigation data that is accurate, comprehensive, and current. It’s only possible if they know what security controls they have in place and how effective they are at detecting and preventing real-world attacks. To improve cybersecurity effectiveness, security teams are transitioning to a threat-informed defense strategy with the MITRE ATT&CK framework, a purple team construct of red and blue teams, and an automated testing platform combined into an engine of optimization.

In this talk, author and former DoD Chief Strategy Officer for Cyber Policy Jonathan Reiber will:

-      outline the evolution of threat-informed defense,

-      discuss the value of MITRE ATT&CK and purple team operations, and

-      show security teams how to move forward towards cybersecurity effectiveness.

Participants will leave with:

-      a clear plan for how to affect change in their organizations and

-      deliver results to safeguard our most important data.