ISACA Canberra Conference 2023

ISACA Canberra

Join the experts at ISACA Canberra’s premier conference!

Hotel Realm

Chapter Events 2023

2023 Chapter Meetings and Events for our members to claim CPD points, network and learn about the happenings in the industry from a diverse range of presenters.

<h2>I﻿SACA Canberra Conference 2023</h2>Join the experts for this year’s event, which will provide attendees valuable knowledge and practical strategies for leveraging AI and emerging technologies in their organizations, while also ensuring that they are doing so responsibly and with an eye towards risk management and assurance.Up to 8 CPE points can be awarded for full program attendance!<h3>THEME: AI &amp; EMERGING TECHNOLOGY</h3><h3>Subthemes: security, social impact, data, audit, governance, risk &amp; compliance</h3>This multi-stream conference will provide a forum for attendees to engage with leading experts, executives and senior government officials in the field, participating in informative sessions while networking with peers. On conclusion of the conference, you are invited to stay for networking, canapes and drinks from 5:30 pm to 7:00 pm.Learning ObjectivesOver the course of this one-day event participants will:<ul><li>Enhance their understanding and management of the potential risks and challenges associated with implementing emerging technologies and AI</li><li>Explore the social impact of these technologies and how they can be used to create positive change in society.</li><li>Understand the importance of governance, assurance, and audit when implementing emerging technologies and AI to ensure compliance and mitigate risk.</li></ul><h3>Sponsors</h3>M﻿ajor - <a href="https://synergygroup.net.au/" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer">Synergy Group</a>G﻿old - <a href="https://www.unsw.edu.au/canberra" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer">UNSW</a> , <a href="https://cybercx.com.au/" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer">CyberCX</a>, <a href="https://www.axonius.com/" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer">Axonius</a> S﻿ilver - <a href="https://www.protiviti.com/au-en" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer">Protiviti</a> , <a href="https://www.ey.com/en_au" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer">EY</a> , <a href="https://www.telos.com/" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer">Telos</a> C﻿ommunity Partner - <a href="https://www.anu.edu.au/" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer">Australian National University</a> , <a href="https://www.awsn.org.au/" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer">AWSN</a> <a href="https://www.protiviti.com/au-en" target="_blank" data-msys-clicktrack="0" rel="nofollow noopener noreferrer"></a>Location: Hotel Realm, 18 National Circuit, Canberra ACT 26009:00 AM to 5:30 PM - Conference5:30 PM to 7:30 PM - Networking Drinks &amp; Canapes / Synergy After PartyFirst round CLOSE - 9 June 2023Second round CLOSE - 25 June 2023Confirmation of selection first rounds - 14 July 2023Third round CLOSE - 30 July 2023CALL FOR ABSTRACTS IS NOW CLOSED

Plenary

Conference Open & Welcome to Country

AI: The good, the bad and the ugly

The presentation will provide an overview of the governance, risk, compliance, and cybersecurity aspects associated with AI. It will address the attacks, challenges, and strategies in managing AI systems within regulatory frameworks, mitigating risks, ensuring compliance, and safeguarding against cyber threats in the rapidly evolving AI landscape. Key takeaways 1. GRC consideration for AI systems 2. AI-related cybersecurity risks 3. AI-related attacks 4. AI Strategy and governance

Security concerns of AI systems

The panel will provide insights into the practice of establishing and enforcing ethical, regulatory, and operational frameworks to ensure the secure, ethical, and compliant use of emerging technology. Key considerations for the panel include ethical principles, regulation, risk management, control mechanisms, audit and social impact.

Panel - Governing Systems Safely and Responsibly

Conference Close & Door Prizes

Networking & Drinks

Join us at the Synergy Group Offices for drinks to close off the conference in style! Mick Mahy, defense partner, will speak on 'The Defence and National Security Lense on Cyber Security', amongst which we will have refreshments, snacks and relax after an action-packed day.

Synergy Group After-Party

Synergy Group - Security

To achieve mission-critical cyber needs, organizations must focus on several key areas. First, ensure cyber worthiness by conducting risk assessments, implementing a robust security architecture, maintaining system integrity, and employing secure development practices. Second, achieve assurance and uplift through security policies, audits, continuous monitoring, a security-aware culture, and incident response planning. Third, enhance resilience by implementing backup and recovery mechanisms, redundant systems, and disaster recovery plans. Finally, prioritize security leadership with a dedicated CISO, establish a governance framework, and foster a culture of security awareness among people. By addressing these aspects comprehensively, organizations can achieve mission-critical cyber needs effectively.

A Practical Approach to Cyber Security Architecture and Design

Discover how to integrate security into sourcing for improved procurement, contracting, and supply chain practices. Join this session to explore key considerations at each stage of the procurement lifecycle, addressing cybersecurity risk for buyers and sellers in government and private sectors. Learn from industry experts as they share commercial insights on: • Framework and principles for cyber security risk management in the public and private sectors. • Mitigating security risk throughout the contracting lifecycle. • Balancing security, speed, and customer experience in procurements with time constraints. • Fostering business partnerships instead of obstructing progress, avoiding 'shadow contracting.' • Adopting security by design as a foundational approach, not just a quick fix. • Tailoring procurement strategies to align with business and security needs. Case study: Secure sourcing in a high-speed government environment.

Build security into sourcing

How insecure are cheap Internet of Things (IOT) devices. A technical deep dive into the security of a cheap(AU$50) garage door opener, to determine how secure, or not it is. As a cyber security professional, how can a home user make an informed decision about home IoT devices? Specifically, an internet connected garage door opener will be used as a case study. Vulnerabilities found in other similar IoT devices will be summarised, along with their severity. A deep dive into the security of a specific, cheap (au$50), garage door opener will be presented. The findings of this deep drive will be put in the context of cyber risk for home use, as opposed to the corporate context.

Are consumer IOT devices really that risky?

The tension between censorship and free speech is now dividing democratic societies. Governments will soon enforce a steady stream of top-down reporting and compliance rules associated with AI and digital traffic. Regulation, reportage and compliance can stifle human creativity under an avalanche of bureaucratic form-filling and classifications. What can we do to protect ourselves from system overload? In this context, why is First Nations Science and Knowledge an important guiding principle? Why is diversity and inclusion important for business?

 Notes from inside "the Matrix"

How many hours a week do you spend on compliance reporting? How is your journey going to Essential 8 compliance? How do you plan to fill the gaps in Essential 8 that the new world of cloud presents? This session will cover our massive global experience in helping organisations simplify compliance on a pathway to better cyber resilience. Andrew will take you through a quantified risk management that will enable you to better understand your organisational cyber risk level, effectively communicate to stakeholders, and orchestrate risk mitigation – presenting measurable business outcomes from your security investments. We'll also share global experience working with government and law enforcement.

Turning Government Agencies Compliance Challenges into Cyber Resilience

How can organisations protect themselves in threat and risk landscapes that continue to evolve quickly through the advent of emerging technologies? In this presentation, Chris Coyne and Dasun Rajapakse explore the tools available for organisations to assess and manage IT supply chain risks, as well as key considerations when designing governance and assurance arrangements to provide comfort over evolving technology risks.

 Managing Supply Chain risk From AI and Emerging Technology

Cyberattacks go beyond network security, affecting an enterprise's data, integrity, values, reputation, and brand. Cognitive hacking exploits dis-mis-mal-information, manipulating perception and exploiting psychological vulnerabilities to alter behavior. This transforms online influence campaigns into a cyber problem, demanding solutions within the cyber environment. AI-generated disinformation, growing in sophistication, amplifies social tensions and unsettles communities. However, the extent of intentional weaponization on populations without their knowledge remains unclear. Quantifying the implications and extent of disinformation damage proves challenging due to the difficulty in linking specific measurable indicators. Social media platforms, as commercial entities, balance financial incentives with an appearance of social responsibility. As Big Tech intensifies censorship, questions persist regarding the effectiveness of this approach in resolving the disinformation dilemma.

Comprehending disinformation and online influence in the digital age

AI & Emerging Technology

Local AI models present a distinctive future threat because, unlike centralised AI services like OpenAI’s GPT, they can be operated on consumer infrastructure and are likely to be almost impossible to regulate. The presentation will examine realised and hypothetical malicious uses cases of local AI models by demonstrating practical threat scenarios. Key takeaways: • Even if AI regulators get regulations right tomorrow, the state of play has already irrevocably changed due to the existence of open-source models. • Savvy threat actors will no longer be limited by their human resources for social engineering campaigns – the high end of town has received a huge force multiplier. • The minimum standards for security will increase, which might impact security market dynamics by pushing demand up to the market leaders and innovators and starving the mid-low market.

Examining threat actor use of unregulatable open-source AI models

Anthony will consider who owns the copyright in AI generated works - both written and artistic - whether those works are creation or imitation, and whether law reform is required to meet the challenge of an unlimited stream of newly created works.

Who owns the copyright in AI generated works?

Developing an awareness of the Australian Governments stance on critical technology, research institutions talent development and ability to produce high quality research and private industry adoption of AI technologies.

 Australia vs the World - How Governments are Treating Generative AI

Should the development and application of AI be seen a monumental opportunity or a monster risk? While AI has the potential to be an effective, efficient and powerful tool, it also can introduce significant risks with its use. Some of these risks are well understood and can be managed using proven and mature processes. Other risks, especially those associated with the use of AI on a large scale, are not as easily identified or even known. In this presentation, we consider how AI can be applied; the corresponding opportunities and risks; and the fundamental elements of an effective control framework.

AI: The devil in disguise or a 'giant leap for mankind

"Learn about the opportunities and risks brought with the latest advances in AI technology knows as Generative AI and how enterprises may approach this technology and start adopting it in a safe and measured way. Some of the topics that will be discussed include: - Generative AI' risks & controls for an organisation - Organisation Adoption of Generative AI - Upcoming EU AI Act - Australia’s AI Ethics Principles"

 Generative AI: risks and opportunities for enterprise

OSINT practitioners routinely construct and deploy online personas to access publicly available content online. Online personas provide a mechanism to manage attribution and acquire content from unique or bespoke recesses of the internet. Recent developments in generative artificial intelligence (AI) have changed the way we build and deploy online personas. These AI tools and techniques have implications for spear phishing and other malicious socially engineered attacks in the cyber security domain. In this session we are going to take a look at generative AI and social engineering. We will then discuss the implications for socially engineered attacks and possible defensive measures for cyber security practitioners. OUTLINE -Generative AI: Some Basics -Generative AI: implications for cyber security -Generative AI for Reconnaissance and Social Engineering -Detecting adversarial use of AI --Gen-AI and facial recognition --ZeroGPT --Fact checking and verification tool

 From ChatGPT to HackGPT - AI and Spear Phishing: Some takeaways from OSINT

Risk, Gov & Data

Cyber Security Programs are challenged by the sprawl of devices, device types, and the quantity of solutions continues to skyrocket and environments only grow more siloed and complex. But there’s good news: Asset data can now be harnessed to transform your cyber security program. Today’s “asset intelligence” moves from a spreadsheet approach to an API-driven, rich and always up-to-date view into all assets via integrations of existing solutions, data correlation at scale, and querying capabilities to find and respond to gaps. Join this session to learn how asset intelligence improves security hygiene, allocate resources, accelerate incident responses and remediates gaps.

Harnessing asset data to transform your cyber security program

Data is the fuel for the AI technologies that continue to emerge. A focus on the fundamentals of good data practice is therefore a powerful tool in the pursuit of responsible AI technologies. At a time when industries and governments continue to deal with a ‘trust deficit’ however, it is increasingly apparent that our pursuit of good governance needs to address fundamentally human considerations as well as the growing number of technical challenges we face in the design of responsible systems. This presentation explores data governance and the development of socially-just data policies as foundations for systems that are both innovative and responsible. After sharing some of the rationale for this approach, it will provide attendees with a framework for data and AI practice that encompasses social as well as technical considerations of trust, risk and security.

Fundamental data practices for dynamic AI futures

In this presentation David will provide an overview of what machine learning is and then discuss an approach to apply traditional audit techniques to audit an environment dependent on machine learning.

Applying the fundamentals: Auditing Machine Learning

The presentation series will start highlighting why and how advanced decision analytics and artificial intelligence can contribute to supply chain & logistics decision. The content would be suited to “Artificial Intelligence and Explainable Artificial Intelligence in Complex Business Decision Making Problems”. Later part of the presentation will include- 1. Transparent and Explainable Supply Chain Risk Management for Large Organisations 2. Developing Analysis Tools for Resilient Supply Chain Management: The Biofuel Supply Chains Case Study. 3. The Intelligent Supply Chain Risk Management Framework by Counterfactual Explanation. 4. Modelling Sustainable and Robust Supply Chains

UNSW Supply Chain & AI Speed Session

It won’t be long before your agency uses its own generative AI. The release of OpenAI’s GPT-4 has demonstrated the power of AI as a productivity tool. We will see language models being tailored to the enterprise's own data and jargon. These will be smaller, more efficient, and faster than the general language models increasing productivity, meeting ethical, trust and explainability concerns. Enterprise-level AI will leverage large volumes of unstructured language data (e.g., any text information: white papers and articles, contracts, claims, grant applications, presentations, emails, customer interactions, online content, comments, system documentation etc.) for multiple use cases.

Generative AI: Reinventing Enterprise Information Management

Risk management is a critical activity requiring proper execution to ensure supply chain operations run smoothly. The first step of this activity is risk identification, in which the risk manager should proactively identify the risk events of interest for further analysis. Undertaking risk identification manually, however, is tedious and time-consuming. With the increased sophistication and capability of advanced computing algorithms, various eminent supply chain researchers have called for the use of artificial intelligence techniques to increase efficiency and efficacy when performing their tasks. In this presentation, I explain how AI can assist risk managers to proactively identify the risks to their operations.

 An AI-based Framework for Proactive Risk Identification

Our {communityGuidelinesLink} describe the sort of content we prohibit on Eventbrite. If you suspect an event may be in violation, you can report it to us so we can investigate.

To report other categories of prohibited or illegal content, submit {link}