What security controls really matter?

The types of threat actors and their strategies have evolved significantly during the last decade. We will explore whether security standards in various industry sectors have adapted sufficiently to address these changes.

The main classes of threat actors have specific objectives, and they adopt threat strategies that are suited to achieving their objectives. In this talk I refer to threat strategies as an outcome-oriented perspective of how they operate, rather than the detailed threat tactics.

Threat actor groups tend to target different industry sectors, and so these sectors have particular threat strategies that are most relevant to defend against.

Have security standards adapted to how these threat strategies have clustered for particular industry sectors? What are some of the key principles that should apply for security standards in major industry sectors?