If yesterday we announced the finalists for the “Best CIO” award, today we do the same with the “Best CISO” awards of the Byte TI Awards 2024 that will be presented next Thursday, September 26. In the “Best CISO” category, proposals from around 120 candidates have been submitted, which shows the growing importance of cybersecurity in organizations. As in the case of CIOs, the final winner will be announced at the same awards ceremony and will be chosen from one of these five finalists.
Finalists for “Best CISO” at the 2024 Byte TI Awards
Mabel Gonzalez, CISO of SERMAS
«We have developed the project for the protection of the identity of SERMAS workers, with tools to protect the active directory from identity-based attacks and authentication protocol vulnerabilities. For them, we have created instructions to reinforce identity security and we have contracted the platform based on CrowdStrike’s “Falcon” technology, thanks to European CIBERAP funds,” says Mabel González, finalist for the Byte TI 2024 Awards.
“CrowdStrike Falcon Identity Threat Protection” is capable of detecting and stopping breaches directly related to identity in real time in a complex hybrid identity environment, with a single sensor and a unified threat interface. With the implementation of this solution, SERMAS has achieved: • Real-time visibility regarding the health status, from a security perspective, of its Active Directory environment, showing its level of exposure to threats and giving recommendations on lines of improvement, best practices and evaluating the level of exposure to risk. • Functionalities for the detection, protection and blocking of attack attempts based on authentication protocol vulnerabilities. • Behavioral analysis capabilities for all Active Directory identities, allowing risk levels to be defined in real time, as well as establishing detection policies, password changes, blocking and conditional access to corporate resources.
Manuel Serrano Rubio, CISO of Atresmedia Group
The project presented by Manuel Serrano has a history of several decades. Over the years, this cybersecurity enthusiast has carried out a Definition of the cybersecurity strategy of the Atresmedia Group taking into account the context in which it operates, including the environment, the business model, the applicable regulations, technological evolution, the presence of remote offices, convergence and its presence on the Internet. • Definition of the action plan with the exceptional measures that allowed a reinforcement of security against certain threats derived from the conflict between Russia and Ukraine. • Incorporation of the production/broadcast environments of television and radio engineering into the cybersecurity functions. • Evolution of the Information Security Model (MSI), adapting it to the best information security practices, within an ad hoc Information Security Management System (ISMS) that incorporates the new business, context, technological and organizational needs required by the transformation in the Group’s companies. • Consolidation and homogenisation of the security measures and technologies applied, grouped into three concepts: protection, detection and response, encompassing the different environments: cloud, workstation, servers, storage and communications. • Expansion and improvement of security in the area of protection and prevention, facilitating early warning, learning and forensic analysis in the face of possible incidents that may put corporate information and business continuity at risk. • Cooperation with different benchmark organisations in the field of security. • Implementation of a managed, vigilant and resilient cybersecurity service, providing value and adapted to the needs of Atresmedia. This has allowed the communications group to increase the level of security against incidents or attacks, minimising the impact on the business.
Luis Paredes, CISO and CTO of Ingesan
The processes of defining, developing, validating and submitting proposals for tenders are critical for a service company such as Ingesan. Therefore, the protection of these processes and of the confidential and sensitive information of these proposals, against cybersecurity risks as well as the loss, impersonation or leakage of data during these tender processes can have devastating consequences, from non-awarding, non-payment of invoices corresponding to the service provided, to irreparable damage to the reputation of the Ingesan brand. For this reason, the department headed by Luis Paredes, implemented an authentication system for outgoing email and information protection because, as he assures, “it is not only a security measure, but also an investment in the trust and credibility of the organization. The information classification and protection project, which is part of the 2023-2025 Information Security Master Plan approved by the Ingesan Management Committee, although it combines several cybersecurity solutions, has been successfully implemented with wide acceptance by users, and without affecting the different tenders that Ingesan works on daily.
Enrique Rubio Manzanares, CISO of SegurCaixa Adeslas
The CISO of SegurCaixa Adeslas, Enrique Rubio Manzanares, states that “we have been implementing security projects and measures for several years now, and this means having a complex and extensive security ecosystem or platform. In addition, many of these projects do not take into account what is going to be done in the future or the initiatives that they will have to coexist with in some way. In this situation, we realized that it was very important to periodically review whether the platform covers our needs and complies with the requirements that have been established.” For this reason, the cybersecurity department decided to launch a Tactical Security Plan, in order to strengthen the company’s security platform. With this, the company has also achieved the following additional benefits:
– Review that the functionalities are maintained and that the solution or project carried out maintains its properties.
– Establishing priorities or new initiatives to be implemented in the future.
– Ensure that the services provided by third parties to the company operate as expected.
– The project allows the company to prepare and verify the controls that will later be audited in the security certifications it has.
– Allows different responsibilities to be assigned to the different profiles in the area.
In short, as stated by the finalist of the Byte TI 2024 Awards for “Best CISO”, the project “is a way to consolidate what we are doing, since this tactical plan, which is here to stay permanently and periodically, is a double check. Some of the points of improvement that we have found have helped us to apply AI technologies to solve them and that has also led to economic efficiencies.”
Josep Bardalló, CISO and DPO of Recoletas Salud
The RECcybercompliance project of Grupo Recoletas has consisted of the implementation of a comprehensive cybersecurity and privacy compliance management framework, optimizing compliance with current regulations and preparing for future regulations, adjusted to the current environment of the group (in a phase of high growth and with constant acquisitions). This strategy has allowed Grupo Recoletas to obtain certifications such as ISO 27001 and ENS, and to comply with NIS2 before the end of 2024, as well as to prepare for future legislation such as the Cyber Resilience Act (CRA), the AI Act and the European Health Data Space. A dynamic approach has been established, based on security controls from recognized frameworks, such as the NIST Cybersecurity Framework (NIST CSF 2.0), ISO 27001:2022, ISO 27701, ENS, CIS Controls and Mitre ATT&CK. This project emphasizes monitoring, continuous auditing and risk management, including supply chain security and efficient evidence collection. The result is a flexible and scalable strategy that allows adaptation to new regulations. The risk-based approach prioritizes the efficient implementation of security controls and ensures the accountability necessary to demonstrate compliance and encourage continuous improvement.
