(ISC)² Blog

Survey Says: CISSP and CCSP Among the Most In Demand IT Certifications of 2021

The (ISC)² CISSP and CCSP certifications have recently racked up more recognition from global staffing firm Robert Half. The company’s 2021 Technology Salary Guide looked at the trends and skills impacting technology professionals, as well as the most in-demand IT certifications today. The (ISC)² programs were two of the top 15 in demand certifications highlighted in a CRN story on the topic. Why Are CISSP and CCSP So In Demand? The COVID-19 pandemic shined an even brighter spotlight on the global cybersecurity workforce shortage. While the industry is making strides to fill the talent gap, the pandemic placed greater emphasis... Read more →

Challenges and Misconceptions of Certificate Revocation in PKI

By Qamar Peer Bellary Sadiq, CISSP, CCSP Public Key Infrastructure is the most commonly used technology in security space for the purpose of establishing Authentication, Data Integrity, Non-Repudiation, email encryption, SSL/TLS with X.509 Certificates (also known as Digital Certificate). Digital Certificate is a form of a digital identity document in the digital world and helps identify users, entities and servers. PKI is an amalgamation of a suite of protocols, people, processes and technologies that must work in a synchronized manner to create, store, distribute, manage and revoke digital identities. However, there exists real world challenges, pitfalls and misconceptions around Certificate... Read more →

The Future of Cybersecurity in Higher Education: Four Possible Scenarios

A new report by the higher education technology association EDUCAUSE imagines four possible future scenarios of cybersecurity trends in colleges and universities. The report takes into account technology, environmental, economic and political trends to develop the scenarios, while also acknowledging evolving cybersecurity practices and data governance and privacy trends. The goal of EDUCAUSE’s “Horizon Report” is to provide information and analysis to help higher education institutions “learn, plan, and act on all that is influencing higher education information security, now and in the future.” At the same time, the report acknowledges that planning for the future is an inexact science.... Read more →

Global Achievement Awards - What's new in 2021?

Nominations are now open for the (ISC)² Global Achievement Awards. These awards recognize individuals whose excellence, leadership and volunteer efforts have significantly advanced the cybersecurity industry and contributed to the vision of inspiring a safe and secure cyber world. Most awards are open to both (ISC)² members and non-members, though self-nomination is not permitted. Individual awards for cybersecurity professionals throughout their career include: (ISC)² Government Professional Award (ISC)² Rising Star Professional Award (ISC)² Mid-Career Award (ISC)² Senior Professional Award Additionally, the following awards which were previously selected exclusively by the (ISC)² Board of Directors are now open to nominations from... Read more →

Technology and the New Frontier of the Healthcare Industry (The Internet of Medical Things)

The New Face of Healthcare Healthcare is currently undergoing a digital transformation that rivals the development of autonomous vehicles in the automobile industry. In fact, there are connections between improved healthcare and autonomous vehicle development. Digital transformation is a buzzword that evokes many grand ideas. In healthcare, one article succinctly articulated it: “Digital transformation in healthcare is the positive impact of technology in healthcare”. Some of the positive outcomes of digital transformation in healthcare include the rise of telemedicine, the development of internet-enabled medical devices, and medical practice and education via virtual reality technology. These developments are enhanced by the... Read more →

How You Can Take The CISSP Exam From Home

For a limited time – February 22-28, 2021 – (ISC)² is pilot testing the option to take the CISSP online exam from home. Last year, as the COVID-19 pandemic emerged, we accelerated our exploration of enabling candidates to take the CISSP exam online. While all (ISC)² exams are, and will remain, available to be taken in person at test centers with health and safety measures in place, we are happy to be able to offer an alternative in the course of this pilot test. When is the CISSP Online Exam Available? You can take your CISSP exam online next week... Read more →

The Weeds and Flowers of Information Security

Why it is essential to have experience - and not JUST to pass the CISSP Growing The Garden of InfoSec Think about your path in information security. It took a lot of work and study. No one is born knowing information security, and no child in any playground has ever said “when I grow up, I want to get a CISSP credential”. Information security is one of the most popular professions right now, and it is anticipated that the demand for qualified information security professionals will continue to grow for the foreseeable future. Any great garden requires serious care and... Read more →

Garfield Teaches Hawaii Students how to be Safe and Secure Online

The nonprofit Center for Cyber Safety and Education (Center) is providing 1,300 local elementary students with a Garfield-led online safety education program, thanks to a donation from area cybersecurity professionals. With the gift from the (ISC)² Hawaii Chapter, media specialists serving the seven elementary schools at the Leilehua Complex will conduct the award-winning Garfield’s Cyber Safety Adventures lesson with students before they go on spring break. The online instructor-led lesson allows students to learn digital citizenship through interactive storybooks, online class discussions, and engaging Garfield cartoons via their home computer. “It’s rewarding to collaborate with professional organizations that want to... Read more →

Responsibility and Accountability in the Cloud: Where Does the Buck Stop?

In the early days of cloud computing, many executives became enamored with the idea that they would no longer be responsible for the “headaches” of an on-premises data center. Things like cooling, physical security, hardware upgrades and uninterruptable power supplies all would shift to the cloud providers. But the shifting of certain responsibilities does not also mean the transfer of accountability… So who is responsible for what in the cloud and how can shared accountability be navigated? The shared responsibility model is a nice theory, but here’s how its practical application gets tricky. Read the blog. Read more →

How Do I Advance My Career in the Cybersecurity Field?

By Mike Privette, CISSP A question I often get asked is, "How do I advance my career in the cybersecurity field?" tl;dr: Figure out for yourself what "advancement" means (i.e., more money, better title, more challenging problems to solve, etc.) Market yourself and ask others for help to achieve what you want Build a brand an audience around #1 and #2 About Me I've spent more than 15 years operating in, building, and leading cybersecurity programs at several Fortune 500 companies in the Financial Services industry. I'm also the Founder & Managing Principal of Fraction Consulting, where I get to... Read more →

Cybersecurity Predictions for 2021 from the (ISC)² Community of Security Professionals (Part 2)

By Diana-Lynn Contesti, CISSP-ISSAP, ISSMP, CSSLP, SSCP John Martin, CISSP-ISSAP, CISM Richard Nealon, CISSP-ISSMP, SSCP, SCF In part one of this blog series, we discussed privacy, remote access (aka Work from Home), insider threats, data leakage, Zero Trust Architecture (ZTA) and security architecture. To continue this discussion, we believe that 2021 will still see folks working from home; thus, the risks due to insider threats and data leakage will continue to grow. However, we believe that there are other concerns for information security professionals, including edge computing, 5G, IoMT/IoT, AI and ransomware. Edge Computing Edge Computing is a distributed computing... Read more →

Exceptions to Security Policy - What are they and how to deal with them?

By Yuri Braz, CISSP, CRISC, PMP Information Security, or cybersecurity, has become more relevant every day. One of the main reasons is because information has become the main asset of most companies. Thus, this information needs to be safeguarded or companies would not be able to create value for society and its shareholders. Large institutes, such as (ISC)², help to develop and democratize the information security field, so that today the majority of medium and large companies have an information security policy. An infosec policy is the first step towards risk governance, essential for the practice of due care and... Read more →

Quick Survey: SolarWinds Incident

The SolarWinds cyber incident has dominated security headlines since the end of December. (ISC)2 wants to hear opinions from practitioners in the field on what impact it really had. Take our quick survey today to make your thoughts known: https://www.surveymonkey.com/r/ISC2SolarWindsPulseSurvey On March 30th, (ISC)2 will host a webinar to discuss the results and hear firsthand from your colleagues in the field. Registration will open soon. Read more →

The Importance of a Good Software Security Policy

Policy is Everywhere Think of every company you have ever worked for. Whether it was a job in a warehouse, or employment in an office, there was always a policy to follow. In fact, when you think back to your earliest days, your family also had policies. Policies are the rules established to keep order within a group. Sometimes, policies are not followed, or are simply ignored. According to a report issued by the Federal Aviation Administration, one of the primary causes of policy failure is a lack of available, current, or well written documentation. That was followed by the... Read more →

How Small Businesses and Big Enterprises Structure Their Cybersecurity Teams

When it comes to cybersecurity, bigger may not always be the best indicator of effectiveness. (ISC)2 research reveals organizations of all sizes have similar strategies when it comes to structuring their cybersecurity teams. Set aside bigger technology budgets for a moment and focus on people; Look at how small and midsized businesses (SMBs), and enterprises align their cybersecurity talent by functional roles within their organizations. What you’ll find are striking similarities. These findings – based on the (ISC)2 2020 Cybersecurity Workforce Study – suggest size has little bearing on how organizations structure their cybersecurity operations. Furthermore, study participants by and... Read more →

Using a Crisis Wisely

Upskilling in times of uncertainty and change is a prudent career decision By Tony Vizza, CISSP, CCSP The saying “everything happens for a reason” is often invoked as a message of support during times of hardship or adversity. While it may be difficult to apply to a crisis on the scale and impact of the COVID-19 pandemic, the resiliency that we as individuals develop during such difficult times can make us stronger and better prepared for whatever comes next. A crisis comes with danger, but it also comes with opportunities. While the tourism, travel and retail sectors have been devastated... Read more →

Addressing the Human Element of Security: Awareness & Training Programs

Did you ever hear the story about the hyphen that cost 80 Million dollars? In the infancy of the United States’ space program, a programming error resulted in a forced abort of a rocket early in its flight to prevent possible injury along its crash path. Or how about the time a pilot miscalculated the required fuel for a flight from Montreal to Edmonton? These are both fatal examples of how human error can have serious consequences. In our hyper-connected world, our errors can have damaging consequences. Sometimes, the harm can be minor, such as the “Melissa” macro virus of... Read more →

CISSPs from Around the Globe: An Interview with Melissa Parsons

The Certified Information Systems Security Professional (CISSP) certification is considered to be the gold standard in information security. This is so because of all the doors that certification opens to a CISSP professional. Those doors lead to many different types of positions and opportunities, thus making the information security community dynamic and multifaceted. In support of this diversity, (ISC)² has launched a series of interviews to explore where CISSP certification has led security professionals. Last time Angus Macrae shared his CISSP experience. This installment features Melissa Parsons, Senior Consultant in Cyber Security for KPMG Canada. She has notable success driving... Read more →

Employment for Security Analysts to Grow 31% by 2029

Demand for cybersecurity professionals will stay strong through the remainder of the decade, according to U.S. Bureau of Labor statistics. In the 10-year period between 2019 and 2029, employment of information security analysts will grow by 31%, according to the bureau’s Occupational Outlook Handbook. The projected growth rate is more than seven times higher than the national job growth average of 4%, and roughly three times that of the 11% projected growth in IT-related occupations. The reason for the high growth rate for information security analysts is no secret to anyone in the industry. As the bureau notes: “Cyberattacks have... Read more →

Remote Work During the Pandemic: What We Got Wrong

By Stephen Fried, CISSP As COVID-19 began to spread rapidly across the globe in 2020, many organizations moved their employees off company premises and enabled large "work from home" efforts. Nobody knew how long this would last, but we assumed we could work remotely for a few months until this thing worked itself out, then return to the office and get back to "normal." We were very wrong. We weren’t just wrong about the length of the crisis; we were wrong about how our employees defined “home.” What we didn’t anticipate is that the pandemic would force companies to rethink... Read more →