17:00 – 17:30 Threat Modelling und Security Requirement Specification: Wie wird das heute in Lehre und Industrie gelebt? (In Deutsch)
Silvan Leuenberger Dozent HSLU und Director Cyber Defense Center / Chief Cyber Defense Officer, Member of the Executive Board, Swiss Post Cybersecurity AG
Silvan Leuenberger unterrichtet seit acht Jahren das Modul Secure Requirement Engineering und Programming an der HSLU. In seinem Unterricht zeigt er, wie Software-Systeme mit einem klar definierten, standardisierten Vorgehen sowie den passenden Techniken und Tools möglichst sicher entwickelt werden können. Ein zentraler Schwerpunkt seines Moduls ist das Threat Modelling: Dabei werden potenzielle Gefahren systematisch identifiziert, analysiert und anhand eines risikobasierten Ansatzes priorisiert. So stellt er sicher, dass die knappen Ressourcen effizient eingesetzt werden und die Sicherheit dort gestärkt wird, wo es am meisten Wirkung erzielt um Mensch, Technologie und Tooling best möglich zu vereinen.
17:30 - 18:00 Strategic Regulatory Positioning & Digital Sovereignty in Europe: What are cutting edge progresses in Application Security? (In English)
Amitabh Singh, Head of Application Security Europe (Appscan) HCL Software
The accelerating evolution of EU cybersecurity legislation is reshaping the foundations of procurement, compliance, and digital risk governance across the Union. In response, sovereign Application Security testing platforms have become integral instruments for operationalizing the EU’s secure-by-design principles and ensuring technological sovereignty within critical digital infrastructures. These capabilities are essential to enabling EU and EFTA institutions, agencies, and public sector bodies to comply with the Cyber Resilience Act (CRA), the NIS2 Directive, the Digital Operational Resilience Act (DORA), and forthcoming EU certification frameworks. This presentation examines the regulatory alignment and technical readiness of leading sovereign AppSec solutions, their role within the European cybersecurity ecosystem, and the strategic pathways for supporting institutional stakeholders in meeting evolving Union-level security and resilience obligations.
18:00 - 18:30 Shift Left in the Software Development Lifecycle – Best Practices and Lessons Learned
Christoph Lutz, Head of Security (Engineering), Avaloq
By shifting security left, organizations reduce risk, minimize rework, accelerate delivery, and strengthen resilience across the product ecosystem. This field report outlines practical strategies for embedding security across the Software Development Lifecycle (SDLC)—from planning to deployment—so that vulnerabilities are caught early, fixed quickly, and prevented entirely. The approach goes beyond tooling: it focuses on culture, automation, organizational alignment, and continuous learning as the core drivers for a sustainable Application Security (AppSec) posture.
Ca. 18:45 Apéro-Riche und Socializing.
Wir heissen Sie herzlich Willkommen.
Frank Heinzmann, Studiengangleiter BSc Information& Cyber Security, HSLU, Organisator SecTalk
Prof. Dr. Bernhard Egger, Studiengangleiter BSc Information& Cyber Security, HSLU
Ron Porath, Dozent, HSLU
