Switzerland under attack

18^th September 2024 • Courtyard by Marriott Zurich North, Zurich

It’s been a year of intense cyber bombardment. Is Switzerland doing enough to fight back?

A threat to both the public and private sectors

It has been another busy year for cybersecurity professionals in Switzerland as global trends in threats and attacks have played out locally.

So, most obviously, the critical danger posed by third parties has been highlighted by two of the most prominent recent breaches:

A US security company, providing communication technology to defence firms globally, fell victim to a cyberattack. The Swiss Air Force was among the entities affected. Switzerland’s Federal Department of Defence has officially confirmed the data breach and is currently investigating the incident.

Hackers are believed to have stolen tens of thousands of documents from the US company “Ultra Intelligence & Communications”. Around 30 gigabytes of partly sensitive and classified documents are believed to have ended up on the darknet.

And investigations into a 2023 attack have finally revealed that sensitive Swiss federal government data, including classified documents and log in credentials, were leaked by the Play ransomware group following an attack on IT service provider Xplain in 2023.

Three reports by the FDPIC said that neither the Federal Office of Police (Fedpol) nor the Federal Office of Customs and Border Security (FOCBS) had clearly agreed with Xplain the conditions under which personal data could be stored on the latter’s servers as part of support services.

In addition, Xplain had not taken any appropriate measures to ensure data security or information protection, the reports said.

As well as breaches, there have been developments in regulations and legislation. The Federal Information Security Act (ISA), which only entered into force on 1 January 2024, is already being amended with an obligation to report cyberattacks for operators of pre-defined ‘critical infrastructures’.

The new far-reaching reporting obligation applies to cyberattacks "in Switzerland" even if the IT resources concerned are located abroad — as long as the incident has an impact on Switzerland.

So, what are the lessons Swiss CISOs can learn from the last 12 months? And what do the new reporting regulations mean for security and governance functions within Swiss organisations?

Come to the e-Crime & Cybersecurity Congress Switzerland to find out:

• How your fellow cybersecurity professionals are coping with these challenges day-to-day
• How you can use resilience regulations to build truly risk-based approaches to defend the assets and processes that really matter
• What practical steps you can take to get better supplier visibility and understanding
• How to economically enhance the security built into Cloud infrastructure and applications with selected additional technologies

The e-Crime & Cybersecurity Congress Switzerland will look at how security should evolve from both a technology and a human perspective. Join our real-life case studies and in-depth technical sessions from the security and privacy teams at some of the country’s leading organisations.