Informal dinner&drinks in Zagreb

"Pivnica Medvedgrad", a nice brewery/pub in the city centre, Ilica Street 49, Zagreb
Google maps directions: https://maps.app.goo.gl/EjXGoumHD1rg8w1fA

We will meet in the pub, as we have a reserved space for our group.

Registration starts
Welcome from the Hosts, Organisers and Sponsors

MEETING ROOM: Business Showroom

Welcome to both groups:

- Hrvatski Telekom, 15' welcome speech & presentation
- Mr. Andrija Višić, ETIS Central Office, "Updates from ETIS" (5 min speech)
- Sponsors welcome: Spamhaus; Ripjar (3 min speech each)

Splitting into 2 groups
Introductions Roundtable

Meeting Room: Business Showroom

Company Updates

Meeting Room: Business Showroom

Each company is allocated 2 minutes to present recent challenges, threats, incidents, projects, and future plans. Also delivering expectations from this 2-day meeting. New members of the group may prepare a longer presentation.

Coffee Break
To-Be-Confirmed: "Developing logging and monitoring capabilities in the Network Logging domain"

Meeting Room: Business Showroom

Roundtable input (5-10 min long) from selected participants on:

- Current Logging and Monitoring Practices
- Log Retention and Compliance
- Security Information and Event Management (SIEM) used daily
- Threat Detection & Response
- Automation and Orchestration
- Log Data Quality and Integrity
- Evolving Threat Landscape
- Future Needs and Innovation
- Case Studies and Real-World Examples

Confirmed Presentations:
- Dag Bredahl, Telenor Norway

Discovery Tooling and Security Tooling

Meeting Room: Business Showroom

Confirmed presentations:
- "Blocking of IOCs in Security Tooling", by Mitchell Good, BT, 20' + Q&A
- "Presentation on Discovery tooling for asset discovery and risk identification", by David Nairn, BT, 20' + Q&A

Lunch Break
Incidents • sharing session on most recent experiences

Meeting Room: Business Showroom

Participants can prepare presentations on their experience with at least 1 recent incident. Any slides shared are expected to be sent to av@etis.org 3 working days in advance of the meeting, mentioning the TLP level.

Reserved slots:
- "LockBit" Fabian Marquardt, Deutsche Telekom, 20'
- "Aggregators", by Vodafone Germany, 30'

Coffee Break
SS7 security • updates on most recent threats

Meeting Room: Business Showroom

Members can prepare presentations of their most recent activities related to fighting threat actors on the SS7 security landscape.

Toolkits will be presented, along with advocacy activities related to a specific threat actor.

Please share presentation proposals with Andrija Višić at av@etis.org

Walking tour (finishing in the restaurant)

We will take a guided tour from the entrance of Hotel Dubrovnik (Location link: https://maps.app.goo.gl/fejPpsAADPpxTMM47) through the Zagreb old town and finalise our tour in the restaurant where we all meet for a community dinner.

Community Dinner in a nearby Restaurant

"SOL Tapas" restaurant, Ban Josip Jelacic Square 9, Zagreb, which is just a short walk away from the Hotel Dubrovnik or at the end of our walking tour if you are joining us for the tour.

Google Maps Directions: https://maps.app.goo.gl/f26eQxeq6XDMFmaD8

Joint Session with Anti-Abuse working group: "How to leverage generative AI in Cybersecurity"

Meeting Room: Business Showroom

Please share presentation proposals with Andrija Visic at av@etis.org.

Reserved slots:
- COMBIS and Croatian Telecom SOC, 20' presentation
- How Telcos are Adapting to new Regulatory Environments (NIS2, AI Act, CS Act), presentation
- Developing better AI and LLM/Chat style solutions, vendor presentation
- Update from ETIS Central Office, Andrija Visic, ETIS

Other TBC

Coffee Break
Joint Session for both Groups: "Suppliers' Demos"

Meeting Room: Business Showroom

Each sponsor of the ETIS meeting will have a 15' slot + Q&A

- Ripjar, 15'

Splitting into 2 groups

CERT-SOC: Meeting Room: Business Showroom
AAWG: Meeting Room: Big One

Cyber Threat Intelligence and Emerging Threats

Meeting Room: Business Showroom

Presentation 1: "Quad7 Botnet und Entra ID attacks", by Fabian Marquardt, DT, 30'

Discussion, 10'

Lunch Break
Presentations from Hrvatski Telekom

Meeting Room: Business Showroom

Suggested:
- "CoPilot Experiences in telco security departments", (TBC)
-

How Cyber Exercises are organised in European telcos

Meeting Room: Business Showroom

Please share presentation proposals with Andrija Višić at av@etis.org

A mix of presentations (KPN) and table top exercises ("Backdoor breaches Card Game", Swisscom) for all attendees of the CERT-SOC WG

Presentation from Arnim Eijkhoudt, KPN on the ways to use the ETIS MISP (10')

Wrap up, Outstanding Questions & Future Topics

Meeting Room: Business Showroom

Roundtable: What to discuss in our next ETIS CERT-SOC WG meeting?