David Mecham

Global Head Cyber Security Threat Informed Defence @Bupa Global

Chelmsford, GB

Reporting directly to the Group Information Security Officer I lead the delivery of the Threat Informed posture across Bupa. Working with the Group Red Teaming, Application Security and Digital Foot Printing leads. Achievements so far include: Led the strategy and adoption of the Centre for Threat Informed Defence framework throughout the Bupa market units. Using a threat Informed approach, we were able to move from a qualitative model to an evidence-based model (quantitative data) providing control assurance. The establishment of the threat led approach led to improved collaboration between teams and sharing of data with other areas of the business. Established focus and fusion teams to prioritise findings from red teams, security optimisation and validation platform etc and perform remediation steps through the resolver teams. Built strong relationship with a security vendor to develop enterprise-wide control validation testing to provide control effectiveness, identification of gaps and monitor for environmental drift. Initiated the development of control integrations with key vendors to enhance the capability of the validation testing giving greater visibility into control effectiveness, along with use cases that have been developed to integrate the enterprise threat intelligence platform into the control validation. This has given confidence to the Board and regulators that the operational effectiveness of the controls is optimal Led an enterprise-wide Active Directory Trusts Assessment. The idea of AD (Active Directory) Trust Analysis was pitched to a vendor who took on board and developed such a capability into their existing product suite. This solution enables aids Bupa in its quest to map the use of AD (Active Directory) Trusts and base decisions on usage whether to remove or look at alternative approach to connectivity. Through our analysis of usage and future requirements, the threat of lateral movement was reduced