(ISC)² Blog

LATEST CYBERTHREATS AND ADVISORIES - AUGUST 12, 2022

Cyberattacks hit global companies, critical vulnerabilities discovered in top tech products and the top malware strains of 2021 make headlines this week. Here are the latest cybersecurity threats and advisories for the week of August 12, 2022. Threat Advisories and Alerts CISA and ACSC List the Top Malware Strains of 2021 A joint cybersecurity advisory has been released by CISA and ACSC. The advisory names the top malware strains of 2021, which include Agent Tesla, AZORult, Formbook, GootLoader, LokiBot, MOUSEISLAND, NanoCore, Qakbot, Remcos, TrickBot and Ursnif. The malware strains consist of ransomware, information stealers, trojans (RATS) and banking trojans. To... Read more →

#ISC2Congress: Empower Your Weekend with Training

Build confidence for exam day or expand your knowledge by attending Official (ISC)² Pre-Conference Training the weekend ahead of (ISC)² Security Congress. Participate by arriving in Las Vegas a couple of days early or maximize your time by joining in online on Saturday, October 8 and Sunday, October 9. Learn from (ISC)² Authorized Instructors and gain a holistic understanding of the essential topics in the course of your choice. Your instructor – who holds the certification they are teaching – provides expert knowledge with experience from practice. You will engage in thought-provoking discussions within your class and expand your education... Read more →

(ISC)² and F5 Examine OWASP’S “Top 10” Report on New Web Application Security Risks

In late 2021, the Open Web Application Security Project® (OWASP®) Foundation released a revised list of the 10 most critical security risks to web applications. The OWASP Top 10 list is the foundation’s flagship project for guidance on securing web applications. (ISC)² hosted a webinar in which Byron McNaught from the application security company F5 discussed key changes in the Top 10 and how to use the list as a foundation for protecting applications. The webinar highlighted the fact that while the OWASP Top 10 had remained largely unchanged for nearly 20 years, the 2021 version included significant updates. For... Read more →

Submit Your Comments to NIST Regarding HIPAA Security

On July 21, The National Institute of Standards and Technology (NIST) published revised Special Publication 800-66, “Implementing the [HIPAA] Security Rule: A Cybersecurity Resource Guide,” and is accepting comments on the revised draft guidance until September 21. (ISC)² is encouraging members with expertise in this area to submit their comments on the proposed changes to NIST prior to deadline. This updated guidance is aimed at helping healthcare organizations that fall under the regulatory umbrella of the Health Insurance Portability and Accountability Act’s (HIPAA) Security Rule. According to NIST, the updated NIST SP 800-53’s latest draft has mapped all the elements... Read more →

#ISC2Congress Theme: EMPOWER

The (ISC)² Security Congress 2022 theme is EMPOWER and together, we intend to do just that! Empower your future by joining thousands of leading cybersecurity experts from around the world October 10-12 to collaborate in- person at Caesars Palace in Las Vegas, NV or virtually from your home or office.   Join us as we empower a safer, more secure cyber world with 100+ inspiring sessions covering topics such as: cloud security, human factors, information security management, cyber crime, data protection, mobile security, ransomware, Zero Trust and many more. Once registered, search by your topic of interest to strategically plan... Read more →

Latest Cyberthreats and Advisories - August 5, 2022

High profile ransomware attacks, vulnerabilities in popular technology products and a widespread investment scam in Europe. Here are the latest cybersecurity threats and advisories for the week of August 5, 2022. Threat Advisories and Alerts Critical Vulnerability Found in VMware Products VMware has released a security update to patch a critical vulnerability in several of their products, including VMware Workspace ONE Access, vRealize Automation and Identity Manager. If the vulnerability isn’t patched, bad actors with network access could obtain admin privileges. VMware customers using the affected products are recommended to upgrade to the latest version immediately. ​​Source: https://www.csa.gov.sg/en/singcert/Alerts/al-2022-033 CISA Warns... Read more →

#ISC2CONGRESS - Why you won’t want to miss it!

(ISC)² Security Congress is the must-attend cybersecurity conference delivering high-value education, training and networking to attendees for over a decade. “The grown-up version of Black Hat”, according to IT Pro, cybersecurity experts from all over the supply chain gather at Security Congress to share their ideas, challenges and goals, plus discuss the future of the industry. You can expect to encounter representatives from all sectors of the field, from vendors to public officials and CEOs to students. (ISC)² Security Congress is a collaborative mind meld that will leave you feeling empowered and engaged in the cybersecurity community. If it’s your... Read more →

#ISC2Congress: From National Security to Cartel Infiltration – Ciaran Martin and Robert Mazur to Keynote

We’re excited to share that Ciaran Martin and Robert Mazur are joining the keynote lineup – alongside Ian Bremmer and Carey Lohrenz – at this year’s (ISC)² Security Congress. Ciaran Martin founded the UK National Cyber Security Centre (NCSC) in 2016. Under his tenure as CEO, the NCSC attracted worldwide acclaim as the leading authority in cybersecurity across the globe. Ciaran is currently a professor of Public Management at the University of Oxford’s Blavatnik School, specializing in cybersecurity as well as the relationship between technology and public policy. “Ciaran Martin’s achievements as head of the UK National Cyber Security Centre... Read more →

State Policymakers Tackling Cyber Issues Including Ransomware

In 2021, North Carolina became the first state to prohibit state agencies and local government entities from paying a ransom following a ransomware attack. This, first-of-its-kind, state law also prohibits public entities from communicating with a malicious actor following a ransomware attack. Instead, they will have to consult with the North Carolina Department of Information Technology when they experience such an attack. On June 28, 2022, Florida Governor Ron DeSantis signed HB 7055. Effective, July 1, 2022, it requires all state agencies report cybersecurity and ransomware incidents, and that every state employee receives substantive training in cybersecurity. New York, Pennsylvania,... Read more →

SSCP Exam – Changes on the Way!

On November 1, several changes will be made to the SSCP exam. We are excited to share that the SSCP exam will be available in four more languages. Currently, the SSCP exam is available in English and Japanese, but come November it will also be available in Chinese, Korean, German and Spanish. In addition to these new languages, we will be updating the length of the SSCP exam. As announced earlier this year for both the CISSP exam and CCSP exam, 25 pre-test (unscored) items will be added. These items do not impact the pass/fail result of your exam, but... Read more →