Taneva Osaka

The increasing sophistication of cyberattacks and the accelerating pace of digitalization are making security risks surrounding businesses and organizations increasingly serious. Meanwhile, a shortage of personnel to combat these risks is a major challenge, and "old ways of defending" are becoming obsolete. This session will address the current state and challenges surrounding security personnel, and explore new approaches needed in the coming era from the perspective of practitioners working in the field. Talent development, knowledge sharing, and connections that transcend organizational and corporate boundaries will be crucial forces supporting security in the future. From "someone protects" to "everyone protects." What should we change, and what kind of future should we aim for, to achieve sustainable security? We will explore clues to these questions together with the participants.

Even though the necessity of security measures is understood, many people face challenges such as "the field staff aren't taking action," "they're not cooperating," and "the value isn't being communicated to management." Behind this lies not only a problem with technology and countermeasures, but also a problem with "communication." In this session, a communication expert and a security practitioner will take part in a dialogue. Addressing the challenges faced in daily work, such as communication within teams, with other departments, and between superiors and subordinates, they will explain the mindset and practical methods of communication that gets through to others and leads to action.
You will take away know-how that can be used regardless of your position or organization, such as technical writing and explanation structuring to convey technical content clearly, and communication skills to engage stakeholders.

Even if guidelines and rules for AI utilization are established, there is no guarantee that they will be correctly understood in the field and translated into actual actions. What are the factors that render AI governance meaningless, such as shadow AI, inappropriate use of generative AI, and differing judgments across departments?
In this session, through a panel discussion among corporate practitioners, we will identify points that need to be reviewed in your company's AI governance and organize the challenges from the perspectives of policies and guidelines, operation, monitoring, education, and organizational culture. Furthermore, we will consider specific next actions that will lead to behavioral changes at the operational level.
Transforming AI governance from a "rule-making initiative" to a system that is understood, chosen, and followed at the operational level. You will take away practical tips for increasing its effectiveness.

"We've created AI usage guidelines, but we're not sure if they're actually working in practice." "We feel they need reviewing, but we don't know where to start." "We want to gain the necessary perspectives and practical knowledge to formulate them in the future."
This session is an interactive workshop for information security and AI governance professionals who have these kinds of concerns.
Using a template guideline and challenge cards, groups will consider what rules, operations, visualization, and training are necessary to address the challenges anticipated when using AI.
Rather than simply adding prohibited actions to the list, our aim is to design guidelines that are followed in practice and can be continuously improved.
Through this workshop, you will visualize the current state and gaps in your company's guidelines and prioritize the elements that are lacking. You will take home the completed draft guidelines along with specific next actions that your company will take after the session.

キャリアは計画ではなく、歩いてきた轍がつくる。
琉球大学・海洋学科卒からNECのCISOに至った講師が、パーツモデル・箱庭・スキルのかけ算という3つの視点で、セキュリティの責任者がこれまでの経験を武器に変え、明日から新たな轍を刻むためのヒントを語ります。

When considering employee training, issues such as "how to increase attendance rates," "how to reduce the open rate of targeted attack emails," and "how to demonstrate a return on investment" are often discussed. However, beyond these lies a more fundamental question: "how to cultivate employees' judgment skills?"
In this workshop, participants will learn experientially about the background behind biases and oversights in judgment, and the importance of "pauses" for making appropriate decisions, by analyzing real-world examples. Participants will share their perspectives and ideas with each other, reflect on their company's training programs, and explore the learning mechanisms truly necessary to cultivate judgment skills. With feedback from the instructor, participants will develop actionable insights that can be taken back to their workplaces.

Cybersecurity has developed primarily through technical measures, and management and operational systems have also been established. But as AI and automation advance, what role should humans play? What should we protect, what should we permit, and what risks should we accept? How should we use technology, and how should we respond to its consequences? These decisions involve the values and responsibilities of individuals and organizations.
People get tired, anxious, trust, and try to fulfill their responsibilities. Attackers exploit these traits to manipulate judgment. However, trust and a sense of responsibility are also essential qualities that support work and organizations. Human vulnerabilities cannot be patched up like technology. It is necessary for people to remain human, acknowledge their weaknesses, regain their judgment, and utilize their strengths.
This lecture will begin with human judgment and vulnerabilities and then move on to the role that humans will play in the age of AI. We will explore how to connect each individual's knowledge, experience, and strengths to the organization's defense, and how security can lead these efforts. Furthermore, we will consider the role of communities in sharing wisdom, experimenting, and supporting each other with colleagues outside the organization. We will reconsider how to cultivate the resilience of both individuals and organizations by viewing security as a "safety mechanism" that supports organizational activities and growth.