(ISC)² Blog

How Will $1.9 Billion for Cybersecurity Protect American Infrastructure?

The U.S. House of Representatives is scheduled to vote on a $1 trillion bipartisan infrastructure bill on September 30, 2021. Back in August, the U.S. Senate passed the bill, which included $1.9 billion for cybersecurity initiatives. According to The Hill, the funds will go toward securing critical infrastructure against attacks, helping vulnerable organizations defend themselves and providing funding for a key federal cyber office, among other initiatives. The House is now set to vote on the bill, and if passed, it will go to the President for his signature. But what exactly are the cybersecurity provisions within the Infrastructure Investment... Read more →

How Continuous Monitoring is a Driver of Effective Risk Management

Continuous Monitoring (CM) as the ability to maintain ongoing awareness of information security, vulnerabilities, and threats to facilitate risk-based decision making. The ultimate objective of CM is to determine if the security and privacy controls implemented by an organization continue to be effective over time considering the inevitable changes that occur in the environment in which the organization operates. Continuous Monitoring removes the limitations of manual or one-time assessments and facilitates real-time risk management through automating monitoring processes. CM benefits businesses in many ways by providing visibility into undiscovered system components, misconfigurations, vulnerabilities, and unauthorized changes, which can potentially expose... Read more →

CCSP vs. AWS Cloud Certified: Which One for Cloud Security?

Organizations worldwide are facing new security challenges presented by cloud computing, as most legacy security tools fail to meet the requirements of dynamic, distributed, virtual cloud environments. In fact, 81% of organizations say traditional security solutions don’t work at all in cloud environments or have only limited functionality, according to the 2021 Cloud Security Report by Cybersecurity Insiders. To fill those gaps, global opportunities for cybersecurity professionals specializing in cloud security are many. But with so many certifications out there, which option most effectively demonstrates the broad knowledge and skills required to secure any cloud environment? Let’s compare three leading... Read more →

CISSPs from Around the Globe: An Interview with AJ Yawn

The Certified Information Systems Security Professional (CISSP) certification is considered to be the gold standard in information security. This is so because of all the doors that certification opens to a CISSP professional. Those doors lead to many different types of positions and opportunities, thus making the information security community dynamic and multifaceted. In this installment, we talk to AJ Yawn. AJ tells us about his motivation for setting it up his own business, his passion for mentoring and opening up pathways into cybersecurity, and why he thinks (ISC)² Chapters are a great place for networking and accelerating your career.... Read more →

Exclusive Resources and Discounts From Your (ISC)² Membership

Your (ISC)² membership comes with more than being a leading industry expert. The “Exclusive Resources and Discounts” page located behind the member login gains you access to discounted event pricing, Member Perks and partner resources. Discounts and deals are commonplace in large corporate settings, but today’s work climate has experienced a shift in traditional roles. InfoSecurity Magazine recently discussed this trend in “The Gig Economy: A New Battleground for Cybersecurity.” Stating that businesses’ increasing tendency to employ independent contractors and freelancers instead of full-time workers is making IT contracting an increasingly common gig economy role. Our 2020 Cybersecurity Workforce Study's... Read more →

Ensuring Disaster Recovery and Business Continuity in the Cloud

Organizations are experiencing their fair share of ransomware attacks in the cloud. And the reality is, they aren’t always able to recover. Complexity in the cloud doesn’t just prolong recovery efforts. In some cases, it foils them completely. Companies must be able to recover from data destruction events to avoid potential business losses as well as civil penalties. The need for disaster recovery and business continuity has never been stronger. Here’s why and how you can bring cloud-based disaster recovery to the rescue. Read the full article. Want to learn more about CCSP? To learn more about how the CCSP... Read more →

The Importance of Adopting a Risk Management Approach to Security and Privacy

With businesses’ digital transformation initiatives accelerated during the pandemic, cyber risks are no longer an issue of the IT department. Cyber risks are business risks threatening the very existence of highly digitized and interconnected organizations. Companies are compelled to address those risks before they impact their operations. Risk management is the process of identifying, assessing and controlling risks to an organization’s business, assets, revenue, productivity and reliability. Risk management informs decision making on the investments, policies and practices to mitigate threats and minimize their adverse effects. A risk management approach benefits an organization in many ways as it strengthens their... Read more →

CCSP vs. Professional Cloud Security Manager: How Do They Compare?

Cybersecurity isn’t only a national security issue making headlines almost daily — it’s at the top of the list of imperatives for organizations, public and private. In fact, a majority (73%) rate their security readiness only average or below average, according to the 2021 Cloud Security Report by Cybersecurity Insiders. And that unease extends to the cloud. Though cloud-based security solutions offer significant advantages, resistance to migrating to the cloud continues to exist. Those surveyed say staff expertise and training continues to rank as the highest barrier (53%) to cloud adoption. That realization is leading more enterprises and individuals to... Read more →

Ransomware Groups Reinvest Capital to Improve Attack Methods

Ransomware is big business, and it’s getting even bigger. Some successful ransomware groups now operate as efficient organizations, reinvesting the proceeds from ransom payments to grow the business and refine attack methods. Instead of relaunching the same tried-and-true attacks that have generated their handsome profits, ransomware groups are using the money to invest in R&D, an approach resembling series A financing rounds. As reported by SC Magazine, larger ransomware groups are becoming more professionalized, even holding conferences, hiring web design teams and placing want ads to build their businesses. “Ransomware, like any business, is a complex economy,” SC Magazine reported.... Read more →

Is There Really a Shortage in Cloud Security Skills?

Is there a cloud security skills shortage? It depends on who you ask. Prior to the pandemic, the world was immersed in cloud technology – everyone, it seemed, had a migration strategy. Then the global lockdown happened. We collectively added a layer of priority to the cloud as tens of millions of people started to rely on it for work and communications in ways we hadn’t before. Cloud is a highly complex and continually evolving set of technologies and protocols. Finding team members with the right background is a challenge, making it seem like there’s a substantial shortage of skilled... Read more →

CISSP - Tales of the Unexpected

We have all heard the old adage how big surprises can come in small packages. If you are a candidate who is studying for the CISSP exam, or if you are in the early stages of considering studying for the exam, you may be surprised that at all the opportunities that are available from a single certification. However, when taken in context with the benefits of the CISSP credential, very few other certifications carry the same respect and career-boosting potential as the CISSP. It is understandable why one might hesitate at reaching for what is often referred to as the... Read more →

National Small Business Week: 10 Best Practices for Small Business Cybersecurity

A recent survey conducted by CNBC and Momentive found that 56% of small business owners are not concerned about being the victim of a cyberattack in the next year and that only 28% of them have a response plan in place in case of a cyberattack. This does not bode well for their longevity, as other industry data shows that 60% of small businesses that suffer a data breach will be out of business within six months. The high cost of remediation and the potential for reputational damage can be more than most small businesses can withstand. Many times, the... Read more →

Poll: Cyber Pros Say White House Cybersecurity Summit Is a Step in the Right Direction

The Biden Administration held a summit on August 25 with technology, finance, energy and education leaders to discuss ways to bolster cybersecurity, both for individual companies and the nation as a whole. Companies represented included some of technology’s biggest names such as Apple, Amazon, Google, IBM and Microsoft. Some organizations announced commitments to improve security controls and practices across the supply chain and to invest in education. Apple committed to working with suppliers to drive the adoption of measures such as multifactor authentication and event logging. Google plans to invest $10 billion on zero-trust programs, software supply chain security and... Read more →

What is the impact of software supply chain security challenges?

Digital innovation creates competitive advantage and value for every type of business. Three things are common among corporate software engineering teams: They seek faster innovation They seek improved security They utilize a massive volume of open source libraries Faster innovation does not mean that developers need to reinvent the wheel. Instead, faster innovation demands efficient reuse of code, which has led to a growing dependence on open source and third-party software libraries. Developers are using artifacts into public software repositories (npm, Maven Central, PyPI, NuGet Gallery, RubyGems, etc.) as reusable building blocks. This is the definition of the modern software... Read more →

Are You the Keymaster?

By Juan Asenjo, Ph.D., CISSP If you grew up in the 80s, you will remember the line: “Are you the keymaster?” from the original Ghostbusters movie. In the film, a malevolent force takes hold of Louis Tully - played by none other than Rick Moranis - to turn him into the keymaster that enables evil spirits to overtake numerous sites in New York. Fast-forward to the real world in 2021, and while we have not seen ghosts overrun our cities, what we have seen is a rapid proliferation of bad actors trying to besiege the defenses of virtual machines (VMs)... Read more →

Mastering Identity and Access Management in the Cloud

The migration of business services, apps and data in the cloud has blurred traditional corporate perimeter. Legacy security solutions, based on securing the perimeter, are no longer adequate to address cloud security challenges and risks. Businesses need to evolve their traditional identity and access management (IAM) program to safeguard the access to their cloud-based assets and data. Digital identities are the foundation of modern IAM and organizations need to establish strong authentication methods to protect these identities. Weak IAM policies result in identities and credentials being vulnerable and compromised. Attackers are leveraging these stolen and compromised credentials to infiltrate corporate... Read more →

Want a Cybersecurity Job? Keep Up with Industry Developments

Hardly a day goes by without some sort of cybersecurity news. Often, it’s bad news – an organization somewhere has been breached and the information of thousands of users has been compromised. For those who work in cybersecurity, keeping current on cybersecurity news and developments is essential. You can learn something from each new threat and attack. Threat intelligence is collected and disseminated continuously to help cybersecurity teams manage risk and prepare incident response strategies. If you’re trying to break into the industry, the requirement to stay up to date on cybersecurity developments starts now. You need to be aware... Read more →

CISSPs from Around the Globe: An Interview with James Wright

The Certified Information Systems Security Professional (CISSP) certification is considered to be the gold standard in information security. This is so because of all the doors that certification opens to a CISSP professional. Those doors lead to many different types of positions and opportunities, thus making the information security community dynamic and multifaceted. In support of this, (ISC)² has launched a series of interviews to explore where CISSP certification has led security professionals. In our last interview, we met Jason Lau. In this installment, we meet James Wright. He is a cybersecurity technologist with The Walt Disney Company. He is... Read more →

Do You Hire Cyber Pros? Let’s Talk!

Are you responsible for hiring members of the cybersecurity team at your organization? Then we want to hear from you! (ISC)² is looking to meet with professionals who hire cybersecurity practitioners, specifically entry level staff. We are holding a two-day virtual meeting for this purpose which is scheduled for September 27-28, 2021. It will run from 8:30 a.m. to 4:30 p.m. (EST). If you’re interested and available for those two days, please send an email that includes your position and organization you work for to [email protected] no later than September 15, 2021. The number of available seats is limited. Respondents... Read more →

READY for (ISC)² Events of the Future

(ISC)² CEO Clar Rosso recently joined Megan Gavin, director of global events, for a webinar as part of the series Inside (ISC)². The two executives candidly discussed the 2021 (ISC)² Security Congress, taking place October 18-20, as well as the future of all (ISC)² global events. Megan shared that while Security Congress is changing from hybrid to virtual, the agenda, content, number of sessions and speakers will not be impacted, and the shift provides an opportunity for us to provide another world-class virtual conference. “As much as we’re disappointed that we will not see you in person, we are dedicated... Read more →