ISC2 Blog

Policy Brief – U.S. Cyber Threat Intelligence, Part 2: Summary, Recommendations & Challenges

By Aaron Weathersby, CISSP. Aaron is the Chief Information Officer for Charles R. Drew University of Medicine and Science and holds a Doctor of Science in Cyber Security from Marymount University. He is an Information Technology professional with over 18 years of experience focused on cybersecurity issues. Executive Summary: This policy brief was created to summarize the Biden Administration’s Executive Order on Improving Cyber Security through the lens of Cyber Threat Intelligence. This brief is geared towards those public and private entities required to implement the mandated elements within the EO. The brief details critical findings, recommendations, and challenges with... Read more →

Latest Cyberthreats and Advisories - December 23, 2022

Ransomware hits hard around the world – again, Cybercriminals steal food and Fortnite’s developer is fined millions. Here are the latest threats and advisories for the week of December 23, 2022. Threat Advisories and Alerts Criminal Actors Use BEC Attacks to Steal Large Food Shipments Three U.S. government agencies – The Federal Bureau of Investigation (FBI), the Food and Drug Administration Office of Criminal Investigations (FDA OCI) and the U.S. Department of Agriculture (USDA) – have issued a joint warning to food suppliers that their industry is seeing an uptick in business email compromise (BEC) attacks. Criminal actors are impersonating... Read more →

(ISC)² Top-Ranked Webinars of 2022 by Region

From fighting the ever-present ransomware threat to securing cloud infrastructures to honing identity management practices, the past year’s showcase of (ISC)² webinar topics was wide-ranging and thought-provoking. A cursory look at the topics we tackled throughout 2022 provides a reflection of the activity in the cyber landscape and the threats that weighed most heavily on cybersecurity professionals. We asked attendees to rate the webinars they attended, and here’s what we found: North America Email threats were prominent on the minds of cybersecurity professionals over the past year, as evidenced by highest-ranked webinar, Incredible Email Hacks You'd Never Expect. The session... Read more →

Seasons Greetings from (ISC)2

Dear (ISC)² Members, Associates and Candidates: I hope this message finds you well. As 2022 comes to an end, I am grateful for the opportunity to reflect on the past year and all we have achieved together. Launching an entry-level certification – the first new (ISC)² certification in more than five years – was a feat unto itself. More importantly, though, it demonstrates our commitment to creating new pathways into cybersecurity for many career-hopefuls. We are happy to already have welcomed more than 5,500 new Certified in Cybersecurity (CC) holders into our membership ranks. Enabling anyone passionate about a cybersecurity... Read more →

Policy Brief – U.S. Cyber Threat Intelligence, Part 1: Introduction & Background

By Aaron Weathersby, CISSP. Aaron is the Chief Information Officer for Charles R. Drew University of Medicine and Science and holds a Doctor of Science in Cyber Security from Marymount University. He is an Information Technology professional with over 18 years of experience focused on cybersecurity issues. Abstract: A policy brief on the May 2021 White House Executive Order 14028 requiring the improvement of the nation’s cybersecurity through the lens of Cyber Threat Intelligence. A summative read geared towards federal agencies and government contractors who must implement the order. In this brief an exploration of the current state of cybersecurity... Read more →

(ISC)2 CEO Discusses UK and Global Cyber Challenges at Chatham House

UK cybersecurity leaders recently gathered for a Chatham House members event panel in London to discuss the heightened need for a skilled workforce, the effects the COVID-19 pandemic had on the global cyber workforce and developing skills for the next generation of cyber professionals. (ISC)2 CEO Clar Rosso was joined by CEO of the UK Cyber Council Simon Hepburn, and Parliamentary Private Secretary, Cabinet Office Ruth Edwards MP, as well as First Attaché to the UK, Cybersecurity and Infrastructure Security Agency (CISA) Julie Johnson as they sat down to address issues and potential solutions to the global workforce gap. Clar... Read more →

SSCP Members – We Need Your Input

The SSCP certification is held by more than 7,000 professionals around the world. Known for its technical rigor, the members who hold this qualification are typically working in areas like IT administration, networks security, security operations or incident response. The exam was last refreshed in November 2021 which that means it is time for us to begin the process again. We announced last week that the CISSP will be starting the revision process in January and so will the SSCP. We need to hear from you, the certification holders. As we prepare for a Job Task Analysis (JTA) Study Workshop... Read more →

Latest Cyberthreats and Advisories - December 16, 2022

The rise of new ransomware gangs, cyberattacks on Uber and California’s Department of Finance make headlines this week. Here are the latest threats and advisories for the week of December 16, 2022. Threat Advisories and Alerts U.K. Government Sets New Standards for App Security The U.K. government has requested that app store developers and operators voluntarily follow a code of practice to protect consumers from malicious apps and actors. The code consists of eight principles, including requests to keep apps up-to-date, implement a vulnerability disclosure process, provide clear feedback to developers and more. The guidance comes at a time when... Read more →

2022 (ISC)² Member Bloggers

The success of our membership-driven organization is closely linked to the effort that each certification holder puts into the organization. At (ISC)², we are fortunate to have a highly engaged membership that actively contributes to our success through volunteer opportunities. Our volunteers take on myriad tasks, from helping to organize events to speaking at conferences to developing certification exams. Another important way that members volunteer their time is by contributing informative blogs on timely cybersecurity topics that expand our knowledge base and help peers gain new insights into the cybersecurity field. (ISC)² members contribute blogs in two ways. One is... Read more →

(ISC)² Annual Meeting Outcomes - Bylaws Amendments and 2023 Board of Directors

The (ISC)² Annual Meeting was held today (December 14, 2022), and below are the key outcomes from the meeting: Bylaw Vote Results The (ISC)² Board of Directors submitted bylaw amendments to the membership. The amendments were put to a vote from October 19-November 19, 2022. Results of the vote were as follows: 6,545 members voted “AGAINST APPROVAL” 2,628 members voted “FOR APPROVAL” 292 members voted to “ABSTAIN” The proposed amendments have not passed. During the meeting, (ISC)² and the Board recognized the need to engage further with membership before proposing future amendments. We are committed to working with members, including... Read more →

Calling All CISSPs! Help Shape the CISSP Exam

As you know, cybersecurity is a constantly changing field. In order to maintain the accuracy, relevance and excellence of (ISC)² exams, we regularly conduct Job Task Analysis (JTA) studies to review and update exam outlines. JTAs are a methodical process used to determine tasks that are performed in the field by credential holders, as well as the knowledge and skills required to execute those tasks successfully. This review process is continual for all (ISC)² certifications, resulting in regular updates to exams and exam outlines. Coming up next month, the CISSP will be taking its next step in the certification lifecycle... Read more →

Level Up Your Cloud Security Skills and Your Career Options

As organizations, applications, and users alike continue their journey toward the cloud, the demand for cybersecurity professionals with experience in cloud security increases. The knowledge and skills gap are the biggest concerns for all cloud-first organizations. According to the 2022 Cloud Security Report, lack of qualified staff is ranked as the biggest operational security headache trying to protect cloud workloads, while lack of qualified staff and knowledge was also echoed as the most challenging aspect of cloud compliance. Vendor certifications offer technical expertise The tech giants like Amazon, Google, and Microsoft, have listened to these concerns and invested an enormous... Read more →

Latest Cyberthreats and Advisories - December 9, 2022

Chinese actors attack North America, Cuba ransomware and vendors start their predictions for 2023…. Here are the latest threats and advisories for the week of December 9, 2022. Threat Advisories and Alerts CISA Sounds the Alarm on Cuba Ransomware The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) have released a joint advisory about Cuba ransomware. Although the ransomware references the Republic of Cuba, there is no indication that the threat actors have any connection to the country. Five critical U.S. infrastructure sectors continue to be the target of attacks: Healthcare and Public Health,... Read more →

Working with the U.S. Government: An Overview of the U.S. Cybersecurity Maturity Model Certification

By Dustin Perkins, CISSP, Senior Governance, Risk and Compliance Consultant for the US Region of CyberCX. Cybersecurity has proven a growing interest and concern among both the private and public sectors and, for those contracted to do business with the U.S. Department of Defense, this is increasingly important with the protection of potentially sensitive information by those in the private sector. On the heels of Federal Information Security Management Act (FISMA), every government agency is hyper focused on developing a hardened level of cyber hygiene by which to mitigate as much risk as possible. The Department of Defense is fulfilling... Read more →

What It Takes to be a Cybersecurity Professional: The Non-Technical Skills You Need

Organizations around the world are being targeted – often from an unseen enemy. Cyberthreats are a plague on systems and data, and combatting them is costly and time-consuming. In order to defend against bad actors, organizations need the talent and skills on staff to detect and mitigate cyberthreats. This has led to massive opportunity in the field of cybersecurity. Research shows the global workforce needs a staggering influx of 2.7 million cybersecurity professionals to meet demand.1 Cybersecurity is a strong career choice for many reasons. It offers opportunities globally and in all industries. There are more than 50 career paths... Read more →

Latest Cyberthreats and Advisories - December 2, 2022

World Cup fraud, Chinese tech bans and a social media cyberstorm hit headlines this week. Here are the latest threats and advisories for the week of December 2, 2022. Threat Advisories and Alerts NCSC Urges Christmas Shoppers to be Vigilant As Christmas shopping kicks into gear, the UK’s National Cyber Security Centre (NCSC) has launched a campaign releasing a series of secure online shopping articles to spread awareness about cybercrime this festive season. During this same time last year, thousands of holiday shoppers were scammed, resulting in £15.3m being stolen and victims losing on average £1,000 per person. Shoppers can... Read more →