DXCTechTalk

@DXCTechnology actively shares what it sees in the security landscape with other partners... zero days, real/potential threats and in the future we will be talking about detection models that can be "trained" by companies since the "flow" of every client is dif.

Starts with risk assessment and then into specific tooling requirements eg encryption

Most enterprise have been migrating for some time from EDI to Secure APIs with SAML Authentication and Encryption for Data-in-Motion. Sensor and sensitivity data flowing from partners into Data Lakes is a key concern today...

@cnokkentved this problem of information flow past corporate boundaries is important in #ecosystem plays... how are you seeing companies like @immuta having an impact?

So its a significant area fo the security team to be engaged from the outset. And then to be monitoring. There is a lot of regulation in or coming that deals with this - GDPR being the most well known

@DanHushon @cnokkentved You're talking/asking about @ImmutaData

@DanHushon not heard of that yet, as most companies are modernizing basic stuff like Identity & Access Mgmt, Data-In-Motion Encryption and APIs. We are seeing a lot of applications of #blockchain for Active Ingredients in #LifeSciences and #Food industries lately

yes, thanks...

@immutadata is applying ML to flow data across trading partners to "automate" the appropriate reg/policy/rule enforcement to enable lower friction/risk ecosystems to emerge

Here is some usful tips/guidance https://www.ncsc.gov.uk/collection/supply-chain-se...

@DanHushon there are a lot of solutions emerging in the application of AI in Integrated Risk Mgmt space. Looks like #immutadata efforts to create a machine-readable regulatory format to allow for direct embedding of AI/ML algorithms into the disseminated datasets will be an edge.

the usual thing of 'DevOps' is a reorg (not just a tool you buy, or a new hire)

#DevOps also a culture... cannot just shift/assign risk... #ExtremeOwnership?

security is not supposed to be an afterthought, but rather embedded in the development culture of any enterprise or government organization. So #DevSecOps for building threat & vulnerability resilient code needs to become part of the DNA business technologies

yes and the merging of the dev/sec/ops cultures breaks down traditional org silos thus @cpswan's comments

another issue is the 100:10:1 ratio that's normal for dev:ops:sec staffing levels. Sec is thin on the ground and hence needs lots of leverage