ISC2 Blog

CCSP vs. EXIN Cloud Certifications: What are the Differences?

Worldwide end-user spending on public cloud services is forecast to grow 23.1% in 2021 to total $332.3 billion, up from $270 billion in 2020, according to the latest forecast from Gartner. Spending on cloud management and security services, specifically, is expected to grow 12% in the next year, from approximately $16 billion in 2021 to about $18 billion in 2022. Demand for cybersecurity experts specializing in cloud security is skyrocketing worldwide. But with so many cloud certifications out there, how do you know which one is right for you? (ISC)² Certified Cloud Security Professional specifically focuses on cloud security, testing... Read more →

New! Improvements to Your (ISC)² Cybersecurity Online Continuing Education

Growing your knowledge and earning continuing professional education (CPE) credits has never been easier. The education platform (ISC)² Learn has been fully revised to provide an updated and improved user experience. This refresh includes an improved navigation process with easier access to your courses and support. When you sign in to your (ISC)² member account, visit My Courses to see the changes and view instructional videos designed to help you navigate your courses. Homepage Highlights The new navigation bar and welcome banner link to store, awards, support and FAQs. Courses are now sortable, allowing you to pin your favorites and... Read more →

Security does not end with Implementing Controls

In cybersecurity, threat actors are relentless. To keep systems safe, we need a process of controls to oversee the entire chronology of a potential attack scenario – protection before an attack happens, effective mitigation and correction during an attack, and recovery afterwards. The tools of defense are vital, but not enough. Organizations need to decide how to deploy these tools, how much to spend, how to train people, and how to ensure they maintain compliance with industry standards and governance/risk (GRC) requirements. Security controls must be organized and described in a way that non-IT people – employees and executives alike... Read more →

(ISC)2 Cybersecurity Workforce Study: Skills Gap Narrows But More Help Is Needed

The global cybersecurity skills gap narrowed over the past year, from 3.1 million to 2.7 million people, and job satisfaction got a substantial boost, according to the newly-published 2021 (ISC)2 Cybersecurity Workforce Study. The narrower skills gap reflects an increase in people joining the field, the study found. “For 2021, our study estimates there are 4.19 million cybersecurity professionals worldwide, which is an increase of more than 700,000 compared to last year.” However, the gap in Asia-Pacific (APAC) was reduced by 500,000 this year, overshadowing the increased deficits in all other regions where the gap has actually increased. Roughly one-third... Read more →

CISSP: The Time is Now

Different personality types, different approaches to life, and different styles of learning; these qualities are what make us all unique, helping us to add our perspective to make the world a better place. However, when trying to pass a rigorous exam, these distinctive qualities can seem like a hindrance, causing some to doubt their abilities to succeed. Fortunately, the people at (ISC)² recognize and celebrate that not all people have the same approach. (ISC)² has taken great measures to create study materials to meet a variety of learning styles, and needs, giving each candidate an equal chance of success. Whether... Read more →

MEET THE RECIPIENTS OF THE 2021 (ISC)² GOVERNMENT PROFESSIONAL AWARD

The (ISC)² Government Professional Award recognizes government cybersecurity leaders whose commitment to excellence has helped to improve government information security and advance an in-demand workforce. The recognition is given to individuals whose initiatives have improved the areas of technology, process/policy or workforce and has led to significant developments in the security posture of a department, agency or entire government. We had a chance to learn more about the 2021 (ISC)² Government Professional Award honorees and their contributions to a safer and more secure cyber world. Asia-Pacific Region (ISC)² Government Professional Award Honoree Group Captain Amorn Chomchoey, CISSP is Acting Deputy... Read more →

#ISC2Congress - Diversity: The Key to Cybersecurity’s Future

You could say one of the purposes of the annual (ISC)² Security Congress is to deliver an industry status check. How is the cybersecurity industry doing, what could be better, and what are the biggest challenges it faces? This year’s Congress, which took place virtually from October 18 - 20, addressed a host of pressing topics in the industry, from combatting ransomware to zero trust implementation to protecting critical infrastructure against foreign adversaries. One of the biggest challenges though is to attract more diversity into the cybersecurity workforce to counter the shortage of personnel in the field. It was a... Read more →

What Is Different About Cloud Security?

The principles of data protection are the same whether your data is stored in a traditional, on-premises data center or in a cloud environment. What is different is the way that you apply those principles. Moving data to the cloud introduces novel cybersecurity risks, challenges, and the threat surface. This novelty requires a new approach to data security. Cloud security is the protection of data, applications, and infrastructures involved in cloud computing environments. Traditional security controls are not adequate to mitigate and protect against the new threats in cloud environments. Establishing and sustaining a robust and effective cloud security posture... Read more →

#ISC2Congress - Critical Infrastructure a Main Focus of Security Congress 2021

Protecting critical infrastructure and associated challenges was a recurring theme during (ISC)² Security Congress 2021, which took place virtually from Monday to Wednesday this week. It was the subject of various sessions and came up during a keynote session delivered by Chris Krebs, former director of the Cybersecurity and Infrastructure Security Agency (CISA). Krebs said critical infrastructure needs to be hardened against foreign adversaries that might have an interest in disrupting it at some point. CISA and other agencies are working to come up with standards and practices for infrastructure security. And they are looking for input from the cybersecurity... Read more →

#ISC2CONGRESS - Lisa Forte Keynote: Insider Threats A Bigger Challenge Than Ever

In one of the most sobering presentations about the current state of security delivered during (ISC)² Security Congress 2021, security expert Lisa Forte said no matter how many protective measures an organization takes, it can never achieve zero risk. Insider threats are always a possibility. Forte, co-founder of Red Goat Cyber Security, used her keynote speech on the third and final day of Security Congress to drive home the point that insider threats have gotten harder to identify. Not only does technology make it easier to steal data, bad actors also can manipulate insiders into becoming unwitting spies. And that’s... Read more →

#ISC2CONGRESS - Lessons Learned from the Baltimore Ransomware Attack

Martin R. Okumu lived through the ransomware attack on the City of Baltimore in 2018, which affected 90% of the municipality’s applications. As the then-director of IT infrastructure for the city, he learned a lot of valuable lessons about defending against and recovering from a ransomware attack. On Tuesday afternoon, he shared those lessons with (ISC)² Security Congress 2021 attendees during a virtual session. He is now the Chief Information Officer for the City and County of San Francisco. In many ways, Okumu said, Baltimore was not prepared for the attack. The city did not have a cyber incident response... Read more →

#ISC2CONGRESS - Adam Steltzner Keynote: Perseverance and Ingenuity Will Get Us through the Pandemic

"Perseverance” and “Ingenuity” aren’t just the names of spacecraft on Mars; they are also the human qualities we need to get us through the post-pandemic world, said Adam Steltzner, chief engineer and mission leader of NASA's Mars 2020 mission. Steltzner, who works at NASA’s Jet Propulsion Laboratory (JPL) in Pasadena, CA, was the keynote speaker on the second day of the (ISC)² Security Congress 2021, taking place virtually through Wednesday, October 20. After NASA landed the nuclear-powered “Curiosity” rover on Mars in 2012, the agency worked to send another rover to the Red Planet. That rover, “Perseverance,” landed on Mars... Read more →

#ISC2CONGRESS - Panel: DEI Initiatives Come Down To Choosing Talent

Picking up on the theme of diversity, equity and inclusion (DEI) that (ISC)² CEO Clar Rosso says is critical to solving the cybersecurity skills gap, a panel discussion on Monday addressed the challenges that get in the way of successful DEI implementations. Several themes emerged during the late-afternoon panel session, which was part of (ISC)2 Security Congress 2021, taking place virtually this week: Don’t expect change to occur immediately Diversity, equity and inclusion requires a step-by-step approach Keep talking about the issue so it stays at the forefront Measure success by looking at numbers within the organization The session, moderated... Read more →

#ISC2CONGRESS - Chris Krebs Keynote Address: Fighting Cyber Adversaries Requires New Thinking and Approaches

The number of connected devices will continue to increase in the next five years, widening the attack surface for cyber adversaries. If we hope to have a fighting chance against them, we need a shift in thinking about defenses as well as increased cooperation between the private sector and government. That was the message delivered by Chris Krebs in the opening keynote of (ISC)2 Security Congress 2021, taking place virtually today through Wednesday. His keynote was the first of about 130 sessions scheduled for the three-day event. Krebs is the former director of the Cybersecurity and Infrastructure Security Agency (CISA),... Read more →

#ISC2Congress - CEO Welcomes Virtual Attendees and Urges Them to Focus on Strong Team Development

(ISC)² CEO Clar Rosso kicked off Security Congress 2021 this morning and wasted no time addressing two of the industry’s most pressing topics – the workforce gap and the need for diversity in cybersecurity. This year’s Congress, taking place today through Wednesday, is once again virtual as a result of the COVID-19 pandemic. In welcoming attendees to the yearly event, Rosso had some praise for the cybersecurity community. “You’ve proven yourself ready for any challenge,” she said. “For almost two years, in the midst of an ongoing pandemic and unrelenting threats, you continue onward, defending our critical assets and keeping... Read more →

(ISC)² Addresses the Cybersecurity Workforce Gap with New Entry-Level Cybersecurity Certification Pilot Program

In an effort to introduce more talent into the cybersecurity workforce, make cybersecurity a more accessible, inclusive and diverse profession, and close the cybersecurity skills gap, (ISC)² will pilot a new entry-level cybersecurity certification exam as part of its portfolio of industry qualifications. The entry-level certification will provide students, new entrants and career changers with clear and attainable professional development and career pathways from day one. In addition, it will give employers the confidence that new entrants into the sector have a solid grasp of the right technical, ethical and operational practices on which to build and learn. As a... Read more →

Meet the Recipients of the 2021 (ISC)² Diversity Global Achievement Awards

The (ISC)² Diversity Award honors individuals who have made significant contributions to building a more diverse workforce in the cybersecurity community. Asia-Pacific Region (ISC)² Diversity Award Honoree Neha Malhotra, CISSP, CCSP is the Vice President, Tech & Cybersecurity Operational Risk Manager at JP Morgan Chase, and was earlier working within Cyber Security Attack Surface Management at Credit Suisse. Neha is an information & cybersecurity professional based in Singapore, with more than 15 years of IT and leadership experience within the BFSI, consulting and manufacturing sectors. Neha was nominated for her advocacy work mentoring and serving as a career advisor for... Read more →

What Would You Say to the CEO about Hiring for the Cloud?

We asked CISSPs and CSSPs around the world, “If you could say anything to your CEO about hiring for the cloud, what would it be?” Respondents said one of the biggest challenges facing cloud specialists and senior executives in the C-suite is the difference in what each side holds as priority. While senior executives are as passionate as cloud experts about protecting their organization and ensuring security and growth for the long-term — their interests are built around issues of fiscal responsibility. At the same time, cloud specialists seek to explore the people, processes and tools that will help ensure... Read more →

The Importance of Correctly Scoping Your Information Systems

The decision to authorize (or not) an information system to operate within an organization is the result of an on-going project that needs to be dealt effectively to be successful and prevent your business from being exposed to unwanted threats. As NIST highlights, authorization to operate (ATO) is a “management decision to explicitly accept the risks” from operating an information system. An authorizing officer needs not only have executive buy-in to fulfill their project, but they need to possess the foundational knowledge required to avoid project scope creep. An (ISC)² Certified Authorization Professional (CAP) is the practitioner who can exercise... Read more →

CCSP vs. CCNA and CCNP Data Center: What Are the Key Differences?

When asked how CISOs could better address the impact of the cybersecurity skills shortage, the most popular suggestion was to increase the overall commitment to training, according to The Life and Times of Cybersecurity Professionals report from Enterprise Strategy Group and the Information Systems Security Association. In fact, security professionals must continue developing their professional skills or put their organizations at a competitive disadvantage, according to 91 percent of respondents. But with so many training and certification options out there, which most effectively demonstrates the broad knowledge and skills required to secure cloud environments? Let’s compare three leading cybersecurity certifications:... Read more →