1. Background

Year after year, in Beltug’s annual Priorities Compass, security themes are highly represented in the Top 10 of the priority list of CIOs and digital technology leaders. The importance of security is reflected in the many security-related Beltug activities. Issues and topics around cyber security in particular have climbed to a very high position amongst the priorities.

To address the growing interest, Beltug launched the Security task force in March 2021. Its scope covers a broad range of aspects of IT- and OT security within the business domain.

This task force focuses more on the strategic/managerial perspective, rather than the day-to-day activities of the members of the task force. Subjects that have been discussed include: OT security, security by design, security awareness, passwordless authentication, cloud security, zero trust, frameworks to evaluate risk, authentication, operational risk management and SASE.

2. Scope and mission

The task force provides a platform for experts to exchange experiences and best practices. Beltug uses the findings and suggestions to inform its members, and to develop new tools, papers and activities, if and when relevant.

This specialist task force makes suggestions and recommendations to Beltug regarding lobbying efforts that can be undertaken in the field of security. Areas include the NIS Directive and the EU Cybersecurity Act with its implementation in Belgium, to name only a few. Beltug also has regular concertations with and collaborates with the Centre for Cybersecurity Belgium.

Conclusions, best practices and insights may be communicated to the other members via the usual Beltug activities. Organisation of events is not in the scope of this initiative, as that is already part of the regular Beltug activities.

The set-up of the task force is flexible, informal, consensual and determined together with the members of the task force. Beltug facilitates the task force. If needed, Beltug cuts the knot on decisions to be taken, always with a view on the interests of the Beltug community and the constructive functioning of the task force.

The task force takes more of a strategic/managerial point of view and discusses less the day-to-day activities of the members of the task force. Subjects that have been discussed include: OT security, security by design, security awareness, passwordless authentication, cloud security, zero trust, frameworks to evaluate risk, authentication, operational risk management, SASE.

3. Members: who can apply?

Interested Beltug members can apply at info@beltug.be.

Typically, task force members are security experts: whether security is a specific part of their day-to-day responsibilities, or instead directly impacts on their responsibilities. They must be Beltug members, from the user side, and participation in task forces is included in their membership (note: a Corporate Basic membership allows your organisation to participate in 1 task force, with a Corporate Premium membership, your company can have delegates in as many task forces as you want). They are knowledgeable people with a high willingness to share their expertise.

Task force members may come from all areas of the companies and organisations.

The Security task force may not be used in any way for commercial purposes.

4. Participation

The Security task force meets on a regular basis, to be determined by the task force members. Members are expected to share their experiences, come up with topics, present topics in meetings, and attend the gatherings on a regular basis.

Meetings take place both online and in-person. As trust is crucial in order to share information and this trust is built when members know each other personally, regular participation is expected.

On occasion, the task force may invite non-member guests who have specific expertise or experience in the topic being addressed.

5. Confidentiality

Meetings follow the Chatham House Rule: participants are free to use the information received, but neither the identity nor the affiliation of the speaker(s), nor that of any other participant, may be revealed. However, the conclusions of the task force’s conversations can be used to share knowledge and best practices with the Beltug community.

When needed, meetings also use the traffic light protocol (TLP): the member sharing information signals how widely the information can be circulated beyond the task force.

• TLP RED: the information can only be shared with the task force and, in extreme cases, orally only. This means that the Chatham house rule doesn’t apply
• TLP AMBER: the information can only be shared within the task force members’ own organisations, limited to relevant people (need-to-know basis)
• TLP GREEN: the information can be shared within the relevant community, but not published
• TLP WHITE: the information can be freely distribution, only limited by copyrights

6. Potential conflicts of interest

In the event of a potential conflict of interest in an issue being discussed, the concerned member will not be involved in the determination of Beltug’s position.