Presentation fr奪n GRC 2015 den 20 maj. Kontakta g辰rna talaren om du har n奪gra fr奪gor. Hela schemat f旦r eventet hittar du h辰r: http://www.transcendentgroup.com/sv/har-har-du-hela-schemat-for-grc-2015/
Carsten Maartmann-Moe, a white hat hacker and penetration tester, gave a presentation about how attackers gain domain admin privileges after an initial breach. He explained that domain admin is like "god mode" since it allows impersonating anyone, installing anything, and destroying everything due to single sign-on. He then showed that domain admin is often obtained through default passwords, poorly configured middleware/platforms, vulnerabilities in internal web apps, password sweeping, Oracle/SQL databases, GPOs, Linux systems, and legacy software. Maartmann-Moe demonstrated how an attacker could use an Oracle database, weak passwords, or JBoss to obtain domain admin privileges. His key recommendation was to focus on patching, configuration
Personlig integritet m旦jligg旦rare eller hinder f旦r verksamheten?Transcendent Group
油
Frukostseminarium om "personlig integritet m旦jlighet eller hinder f旦r verksamheten?", 24 november 2015, Rigoletto, Stockholm.
mne: Heta fr奪gor inom privacy: ny EU-lagstiftning, safe harbor och big data
Talare: Lars Vinden och Christina Falk, Transcendent Group
mne: Praktiska erfarenheter av att bygga en kultur och organisation f旦r att hantera b奪de utmaningar och m旦jligheter inom privacy
Talare: Caroline Olstedt Carlstr旦m, Klarna
Presentation fr奪n GRC 2014 den 15 maj. Kontakta g辰rna talaren om du har n奪gra fr奪gor. Hela schemat f旦r eventet hittar du h辰r: http://www.transcendentgroup.com/sv/har-har-du-hela-schemat-for-grc-2014/
Presentation fr奪n GRC 2014 den 15 maj. Kontakta g辰rna talaren om du har n奪gra fr奪gor. Hela schemat f旦r eventet hittar du h辰r: http://www.transcendentgroup.com/sv/har-har-du-hela-schemat-for-grc-2014/
Dutch authorities opened an investigation in 2015 into TS Dutch holding company for allegedly paying bribes in Uzbekistan. The US Department of Justice and Securities and Exchange Commission also investigated claims of bribery related to transactions in Uzbekistan and Azerbaijan. Vimpelcom ultimately paid $795 million in penalties to US and Dutch authorities for violations of the Foreign Corrupt Practices Act. A report also found weaknesses in Telenor's oversight of its ownership in Vimpelcom, though no Telenor employees were directly involved in corrupt actions. Telenor's CEO and general counsel resigned in relation to the matter.
Rundabordssamtal kring FISK:en - hur till辰mpas f旦rordningen i praktiken och t...Transcendent Group
油
Presentation fr奪n GRC 2014 den 15 maj. Kontakta g辰rna talaren om du har n奪gra fr奪gor. Hela schemat f旦r eventet hittar du h辰r: http://www.transcendentgroup.com/sv/har-har-du-hela-schemat-for-grc-2014/
Nya IT-s辰kerhetshot och trender i en v辰rld av l旦sningarTranscendent Group
油
Presentation fr奪n GRC 2014 den 15 maj. Kontakta g辰rna talaren om du har n奪gra fr奪gor. Hela schemat f旦r eventet hittar du h辰r: http://www.transcendentgroup.com/sv/har-har-du-hela-schemat-for-grc-2014/
Utvecklandet av en strategisk plan f旦r din internrevisionsaktivitetTranscendent Group
油
Presentation fr奪n GRC 2015 den 20 maj. Kontakta g辰rna talaren om du har n奪gra fr奪gor. Hela schemat f旦r eventet hittar du h辰r: http://www.transcendentgroup.com/sv/har-har-du-hela-schemat-for-grc-2015/
Hur kan kvaliten f旦rb辰ttras p奪 din internrevisionsaktivitet vad fungerarTranscendent Group
油
The document discusses ways to improve the quality of internal audit activities, emphasizing the need for a balance between meeting customer expectations and adhering to professional standards. It highlights collaboration, stakeholder engagement, and the implementation of quality assurance and improvement programs as key strategies. The text also suggests developing a client service culture and strategic planning to align internal audit functions with organizational goals.
The document discusses the importance of quality in internal auditing, highlighting the need for conformance to standards and the perceived value of internal audit activities by both auditors and customers. It emphasizes the role of a Quality Assurance and Improvement Program (QAIP) that includes internal and external assessments to ensure compliance and effectiveness. The document outlines various factors affecting the perception of internal audit value, including stakeholder relationships and the challenges in implementing systematic quality work.
Mobila enheter och informationss辰kerhetsrisker f旦r nyb旦rjarenTranscendent Group
油
Presentation fr奪n GRC 2015 den 20 maj. Kontakta g辰rna talaren om du har n奪gra fr奪gor. Hela schemat f旦r eventet hittar du h辰r: http://www.transcendentgroup.com/sv/har-har-du-hela-schemat-for-grc-2015/
Sk辰rpta krav f旦r informationss辰kerhet IT verksamhet och ins辰ttningssystemTranscendent Group
油
Presentation fr奪n GRC 2015 den 20 maj. Kontakta g辰rna talaren om du har n奪gra fr奪gor. Hela schemat f旦r eventet hittar du h辰r: http://www.transcendentgroup.com/sv/har-har-du-hela-schemat-for-grc-2015/
Nasdaq-Bwise is a leading provider of enterprise governance, risk management, and compliance (GRC) software, aimed at helping organizations manage key risks while improving accountability and efficiency. The document outlines various aspects of conduct risk and highlights the main areas of GRC including operational, compliance, and financial risks. It also discusses how technology facilitates risk management processes and emphasizes Nasdaq's long-term commitment to the GRC industry.
Frig旦r m旦jligheterna i ditt data fem enkla s辰tt att analysera data f旦r att ...Transcendent Group
油
Presentation fr奪n GRC 2014 den 15 maj. Kontakta g辰rna talaren om du har n奪gra fr奪gor. Hela schemat f旦r eventet hittar du h辰r: http://www.transcendentgroup.com/sv/har-har-du-hela-schemat-for-grc-2014/
Erkan Kahraman, Chief Trust Officer at Projectplace, gave a presentation on cloud services and security. He discussed Projectplace's security program and ecosystem which covers all aspects of cloud risks. Top customer concerns with cloud include legislation, privacy, security, and data ownership. The chief threats to cloud security are data breaches, loss, and account hijacking. Security measures discussed included encryption, access control, and monitoring. Ensuring customer trust requires considering location of data, terms of service, retention policies, and other factors. Government access to data varies by country and transparency reports provide some insight into requests.
This document discusses the increasing complexity of access control and the need for next generation access control solutions. It outlines 7 trends driving this complexity, including increased data sharing and regulation, identity management for many types of users, and big data analytics. It argues that traditional static access control models are no longer sufficient and that attribute-based access control (ABAC) is needed to enable fine-grained, dynamic access decisions based on multiple attributes. The document provides an overview of how ABAC works and how Axiomatics provides software to implement ABAC for applications, databases, and policy management and review.
The document presents insights on penetration testing as part of internal audits, emphasizing its role in assessing security controls and identifying vulnerabilities. It highlights the importance of planning, execution, and reporting during penetration tests and provides practical recommendations for effectively sourcing and managing such tests. Ultimately, it concludes that while penetration testing cannot conclusively answer if an organization is secure, it can indicate areas for improvement and risk reduction.
Presentation fr奪n GRC 2014 den 15 maj. Kontakta g辰rna talaren om du har n奪gra fr奪gor. Hela schemat f旦r eventet hittar du h辰r: http://www.transcendentgroup.com/sv/har-har-du-hela-schemat-for-grc-2014/
Presentation fr奪n GRC 2014 den 15 maj. Kontakta g辰rna talaren om du har n奪gra fr奪gor. Hela schemat f旦r eventet hittar du h辰r: http://www.transcendentgroup.com/sv/har-har-du-hela-schemat-for-grc-2014/
Dutch authorities opened an investigation in 2015 into TS Dutch holding company for allegedly paying bribes in Uzbekistan. The US Department of Justice and Securities and Exchange Commission also investigated claims of bribery related to transactions in Uzbekistan and Azerbaijan. Vimpelcom ultimately paid $795 million in penalties to US and Dutch authorities for violations of the Foreign Corrupt Practices Act. A report also found weaknesses in Telenor's oversight of its ownership in Vimpelcom, though no Telenor employees were directly involved in corrupt actions. Telenor's CEO and general counsel resigned in relation to the matter.
Rundabordssamtal kring FISK:en - hur till辰mpas f旦rordningen i praktiken och t...Transcendent Group
油
Presentation fr奪n GRC 2014 den 15 maj. Kontakta g辰rna talaren om du har n奪gra fr奪gor. Hela schemat f旦r eventet hittar du h辰r: http://www.transcendentgroup.com/sv/har-har-du-hela-schemat-for-grc-2014/
Nya IT-s辰kerhetshot och trender i en v辰rld av l旦sningarTranscendent Group
油
Presentation fr奪n GRC 2014 den 15 maj. Kontakta g辰rna talaren om du har n奪gra fr奪gor. Hela schemat f旦r eventet hittar du h辰r: http://www.transcendentgroup.com/sv/har-har-du-hela-schemat-for-grc-2014/
Utvecklandet av en strategisk plan f旦r din internrevisionsaktivitetTranscendent Group
油
Presentation fr奪n GRC 2015 den 20 maj. Kontakta g辰rna talaren om du har n奪gra fr奪gor. Hela schemat f旦r eventet hittar du h辰r: http://www.transcendentgroup.com/sv/har-har-du-hela-schemat-for-grc-2015/
Hur kan kvaliten f旦rb辰ttras p奪 din internrevisionsaktivitet vad fungerarTranscendent Group
油
The document discusses ways to improve the quality of internal audit activities, emphasizing the need for a balance between meeting customer expectations and adhering to professional standards. It highlights collaboration, stakeholder engagement, and the implementation of quality assurance and improvement programs as key strategies. The text also suggests developing a client service culture and strategic planning to align internal audit functions with organizational goals.
The document discusses the importance of quality in internal auditing, highlighting the need for conformance to standards and the perceived value of internal audit activities by both auditors and customers. It emphasizes the role of a Quality Assurance and Improvement Program (QAIP) that includes internal and external assessments to ensure compliance and effectiveness. The document outlines various factors affecting the perception of internal audit value, including stakeholder relationships and the challenges in implementing systematic quality work.
Mobila enheter och informationss辰kerhetsrisker f旦r nyb旦rjarenTranscendent Group
油
Presentation fr奪n GRC 2015 den 20 maj. Kontakta g辰rna talaren om du har n奪gra fr奪gor. Hela schemat f旦r eventet hittar du h辰r: http://www.transcendentgroup.com/sv/har-har-du-hela-schemat-for-grc-2015/
Sk辰rpta krav f旦r informationss辰kerhet IT verksamhet och ins辰ttningssystemTranscendent Group
油
Presentation fr奪n GRC 2015 den 20 maj. Kontakta g辰rna talaren om du har n奪gra fr奪gor. Hela schemat f旦r eventet hittar du h辰r: http://www.transcendentgroup.com/sv/har-har-du-hela-schemat-for-grc-2015/
Nasdaq-Bwise is a leading provider of enterprise governance, risk management, and compliance (GRC) software, aimed at helping organizations manage key risks while improving accountability and efficiency. The document outlines various aspects of conduct risk and highlights the main areas of GRC including operational, compliance, and financial risks. It also discusses how technology facilitates risk management processes and emphasizes Nasdaq's long-term commitment to the GRC industry.
Frig旦r m旦jligheterna i ditt data fem enkla s辰tt att analysera data f旦r att ...Transcendent Group
油
Presentation fr奪n GRC 2014 den 15 maj. Kontakta g辰rna talaren om du har n奪gra fr奪gor. Hela schemat f旦r eventet hittar du h辰r: http://www.transcendentgroup.com/sv/har-har-du-hela-schemat-for-grc-2014/
Erkan Kahraman, Chief Trust Officer at Projectplace, gave a presentation on cloud services and security. He discussed Projectplace's security program and ecosystem which covers all aspects of cloud risks. Top customer concerns with cloud include legislation, privacy, security, and data ownership. The chief threats to cloud security are data breaches, loss, and account hijacking. Security measures discussed included encryption, access control, and monitoring. Ensuring customer trust requires considering location of data, terms of service, retention policies, and other factors. Government access to data varies by country and transparency reports provide some insight into requests.
This document discusses the increasing complexity of access control and the need for next generation access control solutions. It outlines 7 trends driving this complexity, including increased data sharing and regulation, identity management for many types of users, and big data analytics. It argues that traditional static access control models are no longer sufficient and that attribute-based access control (ABAC) is needed to enable fine-grained, dynamic access decisions based on multiple attributes. The document provides an overview of how ABAC works and how Axiomatics provides software to implement ABAC for applications, databases, and policy management and review.
The document presents insights on penetration testing as part of internal audits, emphasizing its role in assessing security controls and identifying vulnerabilities. It highlights the importance of planning, execution, and reporting during penetration tests and provides practical recommendations for effectively sourcing and managing such tests. Ultimately, it concludes that while penetration testing cannot conclusively answer if an organization is secure, it can indicate areas for improvement and risk reduction.
Solvency ii and return on equity; optimizing capital and manage the riskTranscendent Group
油
This document discusses Solvency II requirements, return on equity, risk appetite, and risk management frameworks. It introduces Solvency II's three pillars for quantitative capital requirements, qualitative requirements, and reporting. It describes how return on equity measures profitability for shareholders and how Solvency II requires linking capital to actual risks. It defines risk appetite, tolerance, and capacity, and how boards should establish a risk appetite. Finally, it outlines how to optimize capital allocation, the roles of risk and compliance functions, and the connection between returns, capital, risk-taking, and risk management programs.
Presentation fr奪n GRC 2015 den 20 maj. Kontakta g辰rna talaren om du har n奪gra fr奪gor. Hela schemat f旦r eventet hittar du h辰r: http://www.transcendentgroup.com/sv/har-har-du-hela-schemat-for-grc-2015/
2. Kom ih奪g syftet: spirit of the
law
息TranscendentGroupSverigeAB2016
3. En ny riskbed旦mning f旦r TF-risker
verksamhetens
riskexponering
riskkategorier
tj辰nster och produkter
kundstock - segmentering
betalningsstr旦mmar
transaktionsm旦nster
beteenden
n辰tverksanalys
near neighbours/peer groups
transaktionstyper
distributionskanaler och
outsourcing
geografisk dimension
syfte och art
mer?
息TranscendentGroupSverigeAB2016
4. Inte samma som AML!
pengarna finns i det finansiella systemet
ursprunget 辰r oftast lagligt
finansiera finansieringen
mindre belopp
annan frekvens
ekonomiska f旦reningar/stiftelser
insamlingar (v辰lg旦renhet)
varor/fastigheter
alternativa betalningssystem.
息TranscendentGroupSverigeAB2016
5. Modus Operandi
Kund/konto:
har m奪nga mobiltelefonnummer/andra abonnenter registrerade p奪 ett
eller flera konton
har en second cardholder
anv辰nder e-postadresser som inte inneh奪ller namnreferenser
reser till konfliktomr奪den eller l辰nder som gr辰nsar till dem,
transaktioner som ATM-uttag eller k旦p p奪 kontokort (exempelvis
flygbiljetter), vilande konton
anv辰nder valutav辰xlingstj辰nster och eller betaltj辰nstleverant旦rer
maximerar krediter och tar nya
organiserar finansiering och samlingar: enkla metoder s奪som
旦verf旦ringar exempelvis via Swish eller bitcoin.
息TranscendentGroupSverigeAB2016
6. tg辰rder
Screening mot sanktionslistor r辰cker inte.
Riskbed旦mningen m奪ste 辰ven belysa riskerna f旦r TF.
Andra scenarion 辰n de f旦r AML beh旦vs f旦r monitorering, andra
riskv辰rden, tr旦skelv辰rden, beteendeanalys och s奪 vidare.
Inkludera andra typer av transaktionstyper i monitoreringen.
Stoppa, neka, bromsa transaktioner till h旦griskomr奪den.
Screening av avs辰ndare och mottagare samt
meddelande/transaktionsinfo vid betalningar inte bara till/fr奪n
utlandet observera: h辰r pratar vi om tempo!
Kartl辰gg och analysera n辰tverket kring en specifik kund eller
transaktion.
息TranscendentGroupSverigeAB2016
7. Diskussionspunkter
profiling
the need for speed
andra kompetenser internt
regelverkskrockar
feedback fr奪n polisi辰ra instanser
samarbete inom branschen.
息TranscendentGroupSverigeAB2016