(ISC)² Blog

How can you find and retain new cybersecurity talent?

In the latest (ISC)² Think Tank webinar “How to Hire and Develop Entry- and Junior-Level Cybersecurity Practitioners” three hiring managers tackled the question of how to fill the workforce gap by sharing their insights and firsthand experiences. Jon France, (ISC)² CISO, Becky Goza, Senior Manager of Information Security for Love’s Travel Stops and Saju Thomas Paul, Head of Threat Hunting Service for Atos were guided through an engaging conversation following the recent release of the (ISC)² Cybersecurity Hiring Managers Guide by moderator Brandon Dunlap. Hiring from Within In the first live poll, panelists were surprised to see attendees report that... Read more →

Four Steps to Using Metrics to Defend Your Security Budget

By Diana-Lynn Contesti (Chief Architect, CISSP-ISSAP, ISSMP, CSSLP, SSCP), and Richard Nealon (Senior Security Consultant, CISSP-ISSMP, SSCP, SABSA SCF) Ever find yourself in a struggle to defend your security budget or to introduce a change? This guide is a baseline to help you present the risk your organization faces. We (CISOs) believe in notifying management regularly on the risk health of an organization and know the best time to approach management for funding is directly after a security breach. However, none of us want that to happen, so we find ourselves struggling to defend the current security budget when trying... Read more →

How to Create Successful CISSP and CCSP Study Groups

The (ISC)² Pittsburgh Chapter is seeing great success by providing study sessions for both the CISSP and CCSP exams. While participating in a study group does not guarantee passing the exam, it does; however, help to connect with others, put learning into practice and implement study tips. We asked the Pittsburgh Chapter about their recipe for success in hosting study groups and having a high pass rate. If other chapters would like to replicate their success, they need to: Have a passionate leader run the sessions. Invite many people to join, even outside of the local geography. Offer both in-person... Read more →

Center for Cyber Safety and Education Begins Program Updates to Increase Impact

Since its inception, the Center for Cyber Safety and Education and (ISC)² have worked to increase awareness of the importance of cyber safety and ensure that people around the world have a safe online experience. The Center has done this through several initiatives, including Garfield’s Cyber Safety Adventures program which taught more than 300,000 students how to stay safe online, with the help of Garfield the cat. Globally, (ISC)² aims to strengthen the cybersecurity profession, which is changing as rapidly as the interconnected world in which we all live. As (ISC)² increases its overall impact, the Center is entering into... Read more →

Infosecurity Europe: A show so secure a train strike couldn’t break it!

Infosecurity Europe is unquestionably the biggest and most significant cybersecurity conference and event on the European calendar, a mainstay that is enjoyed by the entire industry and that serves as an important opportunity for members to meet each other and engage with the (ISC)² team on our stand. Like so many key industry events, Infosecurity Europe has been operating as a virtual event for the last two years due to the pandemic but made a triumphant return to physical being this year along with a move to a brand new venue. 2022 saw the show move from London’s Olympia Exhibition... Read more →

Unconscious Bias: How to Understand, Identify and Manage It

We all have unconscious bias. In fact, our ability to use pattern recognition and informed judgement can be a benefit in many professions, especially cybersecurity. However, unconscious biases in areas of hiring, mentoring, promoting or developing staff could hamper efforts to build the cybersecurity workforce and to diversify the individuals who make up this group. (ISC)² has partnered with Cyversity, an organization whose mission is to achieve consistent representation of women and underrepresented minorities in the cybersecurity profession, to offer a series of free webinars addressing unconscious bias. The first webinar in this series – Understanding Unconscious Bias – will... Read more →

SECURE North America | Users Aren’t the Weakest Link, They’re Your Allies

Security teams should stop treating users as the weakest link in security and, instead, turn them into allies in building a strong security culture. This was the message from Shelly Epps, HCISPP, Director of Security Program Management at Duke Health, who delivered a presentation this week at the (ISC)² SECURE North America virtual event. “If you are relying upon users for your security, you’ve effectively already failed,” she said. Instead, organizations need to develop comprehensive, multidimensional programs that keep users engaged. Traditionally, Epps said, organizations have built security programs around compliance obligations and PowerPoint-based lists. Programs tended to be punitive,... Read more →

How can your organization find and develop the next generation of cybersecurity?

Last week (ISC)² released the (ISC)² Cybersecurity Hiring Managers Guide: Best Practices for Hiring and Developing Junior Talent built on the latest research to help organizations grow their teams and retain top talent. The report highlighted the top technical skills, non-technical skills and personality attributes hiring managers seek and how organizations can benefit from unique recruiting and professional development strategies. In a recent volunteer survey, we asked members with hiring experience what trends they are seeing in the industry. Many mentioned technological shifts expedited by the pandemic including remote work, virtual interviews and hybrid work environments. They also noted a... Read more →

SECURE North America | Apple Stories: How Technology Has Mediated Technology Through History

If you’ve ever wondered about the relationship between privacy and apples, privacy expert J. Trevor Hughes explained the connection during a session at the (ISC)² SECURE North America one-day virtual event. “Privacy is a fundamental human truth,” he said. “It has existed since the dawn of time.” In fact, he said, privacy concerns started after Adam and Eve committed the crime that got them expelled from the Garden of Eden. They ate an apple they weren’t supposed to. Since then, privacy perceptions and concerns have evolved as new threats in the form of new technologies – flexible film, the telephone... Read more →

ENTRY-LEVEL CYBERSECURITY JOBS KEY TO SOLVING WORKFORCE GAP

Facing an acute shortage of qualified cybersecurity professionals, hiring managers are recruiting entry- and junior-level practitioners to their teams. The latest (ISC)² research captured in our Cybersecurity Hiring Managers Guide reveals this practice enables organizations to build stronger and more resilient cybersecurity teams. The findings come from a poll of 1,250 hiring cybersecurity managers who hire entry- and junior-level practitioners for small, mid-size and large organizations in the United States, Canada, United Kingdom and India. The cybersecurity skills gap currently stands at 2.7 million worldwide, forcing hiring managers to deprioritize experience when choosing candidates who show promise. Managers are less... Read more →

How can mentorship help the cybersecurity workforce gap?

The 2021 (ISC)² Cybersecurity Workforce Study suggested that the global cybersecurity workforce needs to grow 65% to effectively defend organizations’ critical assets. To protect their systems, employees and data organizations need creative solutions for recruitment, training and retention to maintain safe operations. “Many organizations continue to repeat the mistakes of focusing their time and energy on hunting down and competing for a select few cybersecurity “All Stars” instead of strategically developing their teams at all skill levels to create a sustainable, long-term investment in their security personnel.” (2021 (ISC)² Cybersecurity Pursuers Study) The 2021 (ISC)² Cybersecurity Pursuers Study found that... Read more →

U.S. State and Federal Funding for Cybersecurity is on the Rise

Cybersecurity has come to the forefront of state and federal policy over the past few years. In 2021, there were over 285 pieces of legislation related to cybersecurity introduced in state legislative sessions. In 2022, there were over 300 pieces of legislation introduced at the state level. The White House has made it clear that increasing funding and adding additional cybersecurity initiatives is a priority of the administration. The $1.2 trillion dollar Infrastructure Investment and Jobs Act was signed by President Biden in November 2021 and included $1 billion for grants to improve state, local, tribal and territorial government cybersecurity.... Read more →

(ISC)² Concludes Online Proctored Exams Do Not Meet Exam Security Standards

Recognizing that potential barriers to certification globally are the time and resources some candidates must invest to travel to a test center, as well as ongoing health and safety concerns from the pandemic, (ISC)² began exploring online proctoring in 2021 for its cybersecurity certifications, including the renowned (ISC)² CISSP.  After two extensive pilot programs using the most stringent security protocols available, (ISC)² has concluded that online proctored exams do not satisfy its standards for security and integrity for exam administration.    During both pilot tests, (ISC)² and its leading exam delivery and security partners, documented widespread irregular exam results, clear violations... Read more →

Just Released: 2022 (ISC)² Security Congress Agenda!

Ready. Set. Vegas and Beyond! We are looking forward to our first-ever hybrid (ISC)² Security Congress on October 10-12. This year’s event will have something for everyone, whether you decide to attend in person at Caesars Palace in Las Vegas or virtually. More than 100 breakout sessions will cover all of the hot and trending topics in today’s cybersecurity climate including, but not limited to, incident response, Zero Trust, AI, IoT, cloud security, building and maintaining resilient cybersecurity teams and much more. View the Security Congress agenda now, including some of our most anticipated sessions: Are Deepfakes Really a Security... Read more →

Update on (ISC)² Entry-Level Cybersecurity Certification Pilot

More than 1,400 individuals have taken the new (ISC)² entry-level cybersecurity certification exam during the pilot phase which began in January 2022. Scheduling for the pilot is currently available through August 26 and anyone interested in sitting for the “no experience required” exam may do so through an authorized Pearson VUE test center. Before a certification exam becomes fully operational, the pilot tests undergo a rigorous process of exploration, research, and validation necessary to ensure the qualification meets its intended purpose. All exams administered during the pilot phase thus far are currently undergoing this review and analysis. When the pilot... Read more →

The United States Department of Justice Will no Longer Prosecute Ethical Hackers

The U.S. Department of Justice (DOJ) announced last week it will not bring charges under federal hacking laws against security researchers and ethical hackers who act in good faith. This decision stems from a landmark 2021 ruling where the Supreme Court ruled in favor of a police officer who was charged with accepting a kickback for accessing the database as a serving police officer, and another for violating the Computer Fraud and Abuse Act (CFAA). The CFAA, became law in 1986 and is widely criticized as outdated. The federal law dictates what constitutes computer hacking, specifically “unauthorized” access to a... Read more →