Tag Archive for: Barcamp

Janine Wolff

BarCamp “Infor­mation Security Management in Credit Insti­tu­tions” — 19 September 2019

In cooper­ation with SRC Security Research & Consulting GmbH, Bank-Verlag GmbH hosts a BarCamp on the subject of “Infor­mation Security Management in Credit Insti­tu­tions”. The event will take place on 19 September 2019 at the premises of Bank-Verlag in Cologne.

The Federal Financial Super­visory Authority (BaFin) has also defined the new function of the Infor­mation Security Officer with the “Banking Super­visory Require­ments for IT” (BAIT). He or she controls the infor­mation security process and reports directly to management. What this theory looks like in practice will be examined in more detail on 19 September at the BarCamp “Infor­mation Security Management in Credit Institutions”.

The BarCamp Principle

A BarCamp is an open conference with practical workshops. The workshops serve the exchange and discussion among the partic­i­pants. At the beginning, the partic­i­pants themselves develop the contents and the agenda, which they then develop further. There are no prede­fined speakers or proce­dures to be found in a BarCamp. Instead, this principle relies on the (moderated) exchange of experience.

BarCamp “Infor­mation Security Management in Credit Institutions

The BarCamp “Infor­mation Security Management in Credit Insti­tu­tions” gives Infor­mation Security Officers as well as all those respon­sible for infor­mation and IT security management at credit insti­tu­tions the oppor­tunity to exchange infor­mation on topics such as BAIT audits, service provider management or risk management. In addition, contacts can be estab­lished and expertise expanded. The coffee breaks can be used for individual discus­sions. At the end of the event, a “get-together” provides an in-depth exchange among the participants.

The SRC Speakers

Four experts from different areas of SRC will share their knowledge and expertise with the participants.

Sandro Amendola, deputy head of the evalu­ation body at SRC, is respon­sible for the topic “IT compliance in the banking industry”. In addition, he develops security concepts and security require­ments for payment trans­action proce­dures on behalf of the German banking industry, among others.

Jochen Schumacher is respon­sible for commu­ni­ca­tions at SRC. He concen­trates on product management, the technical and editorial support of the website as well as the planning, imple­men­tation and moder­ation of events.

Florian Schumann is Head of IT at SRC. In addition, he is an infor­mation security consultant and qualified auditor according to § 8 (a) BSIG for critical infrastructures.

Dr. Deniz Ulucay works at SRC as a consultant for infor­mation security. His focus is on the devel­opment of ISMSs, in particular for operators of critical infra­struc­tures. He is also respon­sible for the devel­opment and imple­men­tation of security concepts.

Regis­tration & Schedule

Further infor­mation about the regis­tration and the course of the BarCamp on the topic “Infor­mation security management in Credit Insti­tu­tions” can be found in this flyer (GER) and on the website of Bank-Verlag. Here you can register directly online for the event and bring in the topics that are important and inter­esting for you and thus help to determine the course and outcome of the BarCamp “Infor­mation Security Management in Credit Institutions”.

For further questions Mrs. van Kessel is at your disposal (Tel. 0221/5490–161, andrea.vankessel(at)bank-verlag.de).

KRITIS 2018
Janine Wolff

Critical Day 2018 | Knowledge and experience in a lively exchange

The Critical Day

On 25 April 2018 the first Critical Day took place at the SRC Conference Centre. This was the premiere of a series of events that offers a top-class platform for exchange. This is primarily aimed at repre­sen­ta­tives of companies that operate a critical infra­structure (KRITIS). The Critical Day serves above all to establish personal contacts and to exchange experi­ences and best practices on IT and physical security of critical infrastructures.

The Schedule

After the arrival of the first partic­i­pants, a lively exchange on the topics began. At the start of the Critical Day, the fully booked hall documented the partic­i­pants’ need for information.

Top-class speakers gave an overview of the topic KRITIS. Isabel Münch, Head of CK3 and repre­sen­tative of the Federal Office for Infor­mation Security (BSI), explained the proce­dures and processes in the super­visory authority. Randolf Skerka, Head of SRC and respon­sible for the topic of auditing according to §8a (3) BSIG, described the first experi­ences from the perspective of the auditing body. The Klinikum Lünen was the first to provide proof of the audit according to §8a (3) BSIG. Ralf Plomann, Head of IT at Klinikum Lünen, gave impressive insights into the devel­opment of hospital organ­i­sation in prepa­ration for the audit. Prof. Dr. med. Andreas Becker, who made it clear that sound industry expertise is an essential and indis­pensable corner­stone of a meaningful exami­nation, rounded off the morning.

The expert presen­ta­tions gave the partic­i­pants a 360° view of the require­ments of the BSI audits, which were largely and with good reason vaguely formulated.

At the end of the morning the visual artist Frank Rogge described his view on the questions of criti­cality in the field of artistic creation.

The afternoon was completely dedicated to the main interests of the partic­i­pants. Under the moder­ation of Jochen Schumacher, co-organiser at SRC, the afternoon was arranged.

The partic­i­pants indepen­dently organized the various contents for nine sessions.

The most signif­icant results of the afternoon

From the session ” Submitting certi­fi­cation findings to the BSI ” it became clear that the BSI does not expect, for example, any “classical” findings or devia­tions formu­lated down to the last technical detail. A roughly described framework of devia­tions and a description of a course of action in the test report is useful. Never­theless, an appro­priate measure must be in place for each risk within a critical infra­structure. This is of enormous impor­tance for the BSI.

The BSI wishes to cooperate closely with the various Kritis companies. The aim is to strengthen the security of IT in Germany.

In the session ” IT Security Awareness in the company ” Ralf Plomann presented the method and imple­men­tation of measures at the Lünen Hospital. The individual approach would be very important here. Every individual in the company would be respon­sible for IT security. In the individual address, every employee would have to be picked up where he is at the moment. According to Plomann, this is especially the case because almost no one would read guide­lines any more. Therefore, more creative approaches should be chosen. Ralf Plomann’s wish for the future: “Awareness for IT security should start at school from upper secondary level”. In the course of the next session, a clear trend towards e‑learning platforms for improving awareness emerged.

In another session, the partic­i­pants focused on the safe and simple defin­ition of the scope. The pyramid model was partic­u­larly favoured in the discussion. The service classified as critical is the best starting point for defining the scope. For example, when it comes to the critical infra­structure of a sewage treatment plant, the defin­ition of the scope requires identi­fying and deter­mining which systems clarify the water, what effects a failure would have and how this failure can be compen­sated by other methods to maintain the critical service.

With this method you system­at­i­cally move to the outer perimeter. If you get to systems that are no longer critical, the limit of the scope is reached.

Conclusion of the first “Critical Day” from SRC’s point of view

An example of the fasci­nating atmos­phere was the contin­u­ation of the bilateral commu­ni­cation of the partic­i­pants between the individual sessions. The feedback proved that the partic­i­pants were able to make many new contacts and gain insights from other KRITIS projects.

The overall positive response of the partic­i­pants shows us as SRC that the Critical Day is a useful hub for the exchange of infor­mation on KRITIS projects between the partic­i­pants. Our thanks goes to all partic­i­pants who contributed funda­men­tally to the success of the Critical Day with their open-mindedness and commitment.

We regard the Critical Day as a successful exper­iment. This motivates us to start preparing for a follow-up event.