(ISC)² Blog

(ISC)² Closing the Cybersecurity Workforce Gap

The following letter was sent by (ISC)² CEO Clar Rosso to all (ISC)² members and associates, sharing insights into several developments at (ISC)² focused on addressing the workforce gap and creating cybersecurity career opportunities for more people worldwide. Dear Members, I hope you share my tremendous pride in our association as today we announce three significant milestones in our collective efforts to address the global workforce gap by making cybersecurity careers accessible to more people around the world. First, our newest certification, (ISC)² Certified in Cybersecurity, is now operational. More than 1,500 individuals, who passed the exam during our pilot... Read more →

Become an (ISC)² Candidate – No Exam, Experience or Fees Required

Today, (ISC)² launched a new initiative so that anyone can join our association as an (ISC)² Candidate. When you become an (ISC)² Candidate, you’ll gain access to many of the benefits and resources that (ISC)² certified members and Associates of (ISC)² enjoy – but with no exam, work experience, and, for a limited time, no fee required. Who should become an (ISC)² Candidate? We created (ISC)² Candidate for those interested in pursuing an (ISC)² certification or a career in cybersecurity. If you’re looking to join the cybersecurity workforce, this program is ideal for you! If you’ve been working in cybersecurity... Read more →

#ISC2Congress: Empower Your Career

The Career Center is back at (ISC)² Security Congress, and this year it’s hybrid! Open October 10-12, the Career Center will offer on-site and virtual events on the first two days, with the final day reserved exclusively for virtual sessions. In Vegas, the Career Center will be just outside of the Expo Hall in the Octavius Ballroom at Caesars. Virtual attendees can find the Career Center in the online conference space alongside the sessions. Registered attendees will receive an email with the appointment registration open date, anticipated for two weeks prior to Security Congress.   The Career Center, produced by ClearedJobs.net,... Read more →

(ISC)² Certified in Cybersecurity Entry-Level Certification Officially Launches!

We are excited to announce that more than 1,500 individuals, who passed the exam during our pilot program, are now on their path to full certification with the (ISC)² Certified in Cybersecurity℠, our entry-level certification. These newly awarded certified cybersecurity professionals are unique in that they were the first candidates to participate in our pilot program, providing valuable insight and guidance as we launched this new certification. We thank these candidates for their patience and participation. They have proven they have the strong problem-solving abilities, communication skills, strategic thinking skills and an eagerness to learn needed to be successful cybersecurity... Read more →

Latest Cyberthreats and Advisories - August 26, 2022

IT fiascos in healthcare, a dramatic rise in cyberattacks and an FBI warning highlight this week’s cybersecurity news. Here are the latest cybersecurity threats and advisories for the week of August 26, 2022. Threat Advisories and Alerts Credential Stuffing Attacks Target Legitimate Online Customer Accounts The FBI warns that cybercriminals are using proxies and configurations to mask credential stuffing attacks on US businesses. Credential stuffing attacks occur when stolen username and password combos are used to take over legitimate accounts. The attacks can cause victims financial loss, reputation damage and downtime. To mitigate attacks, the full IC3 report advises businesses... Read more →

Poll: Cybersecurity Professionals Want Remote Work Options

As organizations consider recalling workers back to the office, many are finding resistance – and in some cases, open revolt. Employees have become accustomed to the work-from-home (WFH) lifestyle and they aren’t necessarily willing to trade it for commutes and cubicles. Most want the choice of whether to stay home, return to the office or a combination of both, and many cybersecurity professionals are among them. A new (ISC)² member poll looks at how organizations are changing remote work policies in 2022 and what it means for worker satisfaction. The poll found the most satisfied cybersecurity professionals have the choice... Read more →

The ‘Hottest’ IT Security Technologies in 2022

Did you catch The ‘Hottest’ IT Security Technologies in 2022 webinar? If not, we are here to share the key takeaways. Steve Piper, CISSP, CEO and Founder of CyberEdge Group joined moderator Brandon Dunlap in this initial kickoff of a five-part webinar series discussing key insights from the 2022 Cyberthreat Defense Report. This webinar focused on which security technologies are most widely deployed and most planned for acquisition in 2022. The 2022 Cyberthreat Defense Report is now in its 9th year and surveys 1,200 IT security and decision-makers and practitioners in organizations of 500+ employees. The survey is designed to... Read more →

New to Cybersecurity? Use These Career Hacks to Get a Foot in the Door

The need for cybersecurity professionals has been building for years, and nearly exponentially since the beginning of the global pandemic. At this point, it’s painfully evident there’s a wide talent gap in the field, and research proves it — the global workforce needs an influx of 2.7 million cybersecurity professionals to meet demand.1 In a recent survey of cybersecurity professionals, more than three-quarters said it’s “extremely or somewhat difficult to recruit and hire security professionals.”2 A majority (95%) said the cybersecurity skills shortage and its associated impacts have not improved over the past few years, and close of half (44%)... Read more →

Latest Cyberthreats and Advisories - August 19, 2022

Big tech breaches, the rise of callback phishing and joint advisories issued by CISA…here are the latest cybersecurity threats and advisories for the week of August 19, 2022. Threat Advisories and Alerts Cybercriminals Exploit Zimbra Vulnerabilities CISA and MS-ISAC have issued a joint advisory in response to active exploitation of multiple vulnerabilities against Zimbra Collaboration Suite (ZCS). Cybercriminals may target unpatched ZCS security holes in government and private sector networks. Organizations who didn’t make the appropriate updates upon patch release should assume they’ve been compromised and follow the recovery steps in the CISA advisory. Source: https://www.cisa.gov/uscert/ncas/alerts/aa22-228a CISA and the FBI... Read more →

Black Hat USA 2022: Are Cybersecurity Tool Standards on the Way?

One of the biggest challenges cybersecurity teams face, aside from constantly having to foil threat actors, is to integrate data from the various tools they use to protect their organizations. But relief may be on the way in the form of the Open Cybersecurity Schema Framework (OCSF), which aims to establish an interoperability standard. News of the creation of OCSF came during Black Hat USA 2022 in Last Vegas last week. The framework boasts participation from 18 of the IT industry’s biggest names, including Amazon AWS, IBM, Palo Alto Networks, Splunk and Salesforce. Such a standard would simplify the lives... Read more →

New U.S. Legislation Introduced to Help Small Business Provide Cybersecurity Training

The Small Business Cybersecurity Act, S.4701 has been introduced by U.S. Sen. Maggie Hassan, D- N.H. Designed to bolster small businesses' cybersecurity by providing funding to Small Business Development Centers. In 2020, Senator Hassan worked to secure federal funding to such centers including the New Hampshire Small Business Development Center's Cybersecurity Review program. The funds can be used to help Small Business Development Centers provide cybersecurity training for small business employees and administer reviews of small business's cybersecurity. The bill would authorize $20 million in 2023 and every year thereafter to the Small Business Administration (SBA). Key aspects of the... Read more →

Effective Security Using Zero Trust Architecture

By Jagadish Paranthaman, CISSP, Global Cybersecurity Solutions Architect at Avanade Zero Trust is a cybersecurity model centered around an end-to-end approach for resource and data protection with a principle not to trust completely but conduct continual verification. Zero Trust assumes the non-existence of a perimeter. It is not a product but a collection of architectural premises and security patterns encompassing identity, endpoints, networks and hosting infrastructure, applications, and data. Zero Trust Architecture is achieved through solutions that sit between requesting subject (identity) and a fulfilling resource (service or application). Solutions can be a combination of agent-based, cloud-based or enterprise deployment... Read more →

Latest Cyberthreats and Advisories - August 12, 2022

Cyberattacks hit global companies, critical vulnerabilities discovered in top tech products and the top malware strains of 2021 make headlines this week. Here are the latest cybersecurity threats and advisories for the week of August 12, 2022. Threat Advisories and Alerts CISA and ACSC List the Top Malware Strains of 2021 A joint cybersecurity advisory has been released by CISA and ACSC. The advisory names the top malware strains of 2021, which include Agent Tesla, AZORult, Formbook, GootLoader, LokiBot, MOUSEISLAND, NanoCore, Qakbot, Remcos, TrickBot and Ursnif. The malware strains consist of ransomware, information stealers, trojans (RATS) and banking trojans. To... Read more →

#ISC2Congress: Empower Your Weekend with Training

Build confidence for exam day or expand your knowledge by attending Official (ISC)² Pre-Conference Training the weekend ahead of (ISC)² Security Congress. Participate by arriving in Las Vegas a couple of days early or maximize your time by joining in online on Saturday, October 8 and Sunday, October 9. Learn from (ISC)² Authorized Instructors and gain a holistic understanding of the essential topics in the course of your choice. Your instructor – who holds the certification they are teaching – provides expert knowledge with experience from practice. You will engage in thought-provoking discussions within your class and expand your education... Read more →

(ISC)² and F5 Examine OWASP’S “Top 10” Report on New Web Application Security Risks

In late 2021, the Open Web Application Security Project® (OWASP®) Foundation released a revised list of the 10 most critical security risks to web applications. The OWASP Top 10 list is the foundation’s flagship project for guidance on securing web applications. (ISC)² hosted a webinar in which Byron McNaught from the application security company F5 discussed key changes in the Top 10 and how to use the list as a foundation for protecting applications. The webinar highlighted the fact that while the OWASP Top 10 had remained largely unchanged for nearly 20 years, the 2021 version included significant updates. For... Read more →

Submit Your Comments to NIST Regarding HIPAA Security

On July 21, The National Institute of Standards and Technology (NIST) published revised Special Publication 800-66, “Implementing the [HIPAA] Security Rule: A Cybersecurity Resource Guide,” and is accepting comments on the revised draft guidance until September 21. (ISC)² is encouraging members with expertise in this area to submit their comments on the proposed changes to NIST prior to deadline. This updated guidance is aimed at helping healthcare organizations that fall under the regulatory umbrella of the Health Insurance Portability and Accountability Act’s (HIPAA) Security Rule. According to NIST, the updated NIST SP 800-53’s latest draft has mapped all the elements... Read more →

#ISC2Congress Theme: EMPOWER

The (ISC)² Security Congress 2022 theme is EMPOWER and together, we intend to do just that! Empower your future by joining thousands of leading cybersecurity experts from around the world October 10-12 to collaborate in- person at Caesars Palace in Las Vegas, NV or virtually from your home or office.   Join us as we empower a safer, more secure cyber world with 100+ inspiring sessions covering topics such as: cloud security, human factors, information security management, cyber crime, data protection, mobile security, ransomware, Zero Trust and many more. Once registered, search by your topic of interest to strategically plan... Read more →

Latest Cyberthreats and Advisories - August 5, 2022

High profile ransomware attacks, vulnerabilities in popular technology products and a widespread investment scam in Europe. Here are the latest cybersecurity threats and advisories for the week of August 5, 2022. Threat Advisories and Alerts Critical Vulnerability Found in VMware Products VMware has released a security update to patch a critical vulnerability in several of their products, including VMware Workspace ONE Access, vRealize Automation and Identity Manager. If the vulnerability isn’t patched, bad actors with network access could obtain admin privileges. VMware customers using the affected products are recommended to upgrade to the latest version immediately. ​​Source: https://www.csa.gov.sg/en/singcert/Alerts/al-2022-033 CISA Warns... Read more →

#ISC2CONGRESS - Why you won’t want to miss it!

(ISC)² Security Congress is the must-attend cybersecurity conference delivering high-value education, training and networking to attendees for over a decade. “The grown-up version of Black Hat”, according to IT Pro, cybersecurity experts from all over the supply chain gather at Security Congress to share their ideas, challenges and goals, plus discuss the future of the industry. You can expect to encounter representatives from all sectors of the field, from vendors to public officials and CEOs to students. (ISC)² Security Congress is a collaborative mind meld that will leave you feeling empowered and engaged in the cybersecurity community. If it’s your... Read more →

#ISC2Congress: From National Security to Cartel Infiltration – Ciaran Martin and Robert Mazur to Keynote

We’re excited to share that Ciaran Martin and Robert Mazur are joining the keynote lineup – alongside Ian Bremmer and Carey Lohrenz – at this year’s (ISC)² Security Congress. Ciaran Martin founded the UK National Cyber Security Centre (NCSC) in 2016. Under his tenure as CEO, the NCSC attracted worldwide acclaim as the leading authority in cybersecurity across the globe. Ciaran is currently a professor of Public Management at the University of Oxford’s Blavatnik School, specializing in cybersecurity as well as the relationship between technology and public policy. “Ciaran Martin’s achievements as head of the UK National Cyber Security Centre... Read more →