ISC2 Blog

Cybersecurity Industry News Review – 31 January 2023

By: Joe Fay U.S. looks for half a million cybersecurity professionals, ransomware victims less likely to pay up, analyst warns on Chinese smart device spy threat…but RSA encryption safe from Quantum cracking for now. U.S. struggles with shortage of cybersecurity pros New research suggests the U.S. is short over half a million cyber security workers, though demand cooled slightly in the last two months of 2022. The total number of employed cybersecurity workers held steady at 1.1 million through 2022, according to figures from Cyberseek, the National Initiative for Cybersecurity Education at NIST and CompTIA-backed workforce analytics site. The supply-demand... Read more →

Royal Mail “cyber incident” is an ongoing cyberattack CEO admits to MPs

By: Joe Fay Simon Thompson, CEO of the U.K.’s Royal Mail, has confirmed in a session with MPs that the crippling of its ability to send parcels and letters abroad was down to a “cyberattack” and that it was “ongoing”. Thompson said that investigations into the attack on the U.K. postal operator – one of the most high-profile attacks on the country’s critical infrastructure to date – were continuing, but so far there was no evidence that personal data of customers had been compromised. The U.K. National Crime Agency (NCA) and National Cyber Security Centre (NCSC) have been investigating the... Read more →

How are you marking data privacy day?

By: Joe Fay Data Privacy Day (known as Data Protection Day in Europe) falls this Saturday (January 28) and if you haven’t worked out how to mark the day yet, tech vendors and organizations are more than willing to help. The international event began as Data Protection Day in Europe in 2007, under the auspices of the Council of Europe, and has since been taken up in the U.S. and other countries. Cisco marked it by releasing its 2023 Data Privacy Benchmark Study, which found that 92% of organizations recognized they need to do more to reassure customers about how... Read more →

Latest Cyberthreats and Advisories - January 27, 2023

Alerts from national cybersecurity agencies, gaming developer attacks and the Mailchimp/FanDuel breach. Here are the latest threats and advisories for the week of January 27, 2023. Threat Advisories and Alerts CISA Publishes Report to Help Protect Schools from Cyberthreats The recent surge in cyberattacks against the education sector has led the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to release a report addressing the issue. The COVID-19 pandemic made educational institutions increasingly vulnerable to cyberthreats, as virtual learning became widespread and led to the rapid adoption of new and untested technologies. The report titled “Partnering to Safeguard K-12 Organizations from... Read more →

No experience, No Problem – (ISC)² Recruits 140,000 Individuals Interested in a Cybersecurity Career

(ISC)² launched a new initiative for individuals pursuing or considering a career in cybersecurity. The goal? To create new pathways to cybersecurity career success and decrease the global workforce gap. Within three months of launching this initiative, we had more than 110,000 individuals sign up to become (ISC)² Candidates. The offering provides education courses, study materials and resources to help prepare those looking to enter cybersecurity. Additionally, the aim is to encourage (ISC)² Candidates to pursue the recently launched entry-level certification (ISC)² Certified in Cybersecurity (CC). The immediate success of (ISC)² Candidates showed us there was no shortage of interest... Read more →

How to Earn Your (ISC)² Certification

We are excited to have more than 130,000 individuals become (ISC)² Candidates since launching in September 2022. Many of them will go on to earn their Certified in Cybersecurity (CC) as part of our One Million Certified in Cybersecurity pledge. For those new to (ISC)², or those who’ve had their sights set on their CISSP for years now, you may not be sure exactly how you become (ISC)²-certified. Your certification is more than a single exam. There are three steps to earn your (ISC)² certification: Step 1: Pass your exam Step 2: Submit your certification application Step 3: Pay your... Read more →

Latest Cyberthreats and Advisories - January 20, 2023

TikTok is fined for a privacy violation, major corporations suffer breaches and Vice Society attacks another school. Here are the latest threats and advisories for the week of January 20, 2023. Threat Advisories and Alerts U.K. School Survey Reveals Surprising Findings A new survey by London Grid for Learning (LGfL) and the National Cyber Security Centre (NCSC) revealed that the uptick in cyberattacks on the U.K. school system may not be as bad as first thought. The survey, of more than 800 schools, revealed that 78% of them had suffered at least one cybersecurity incident. Other interesting findings showed that... Read more →

Real Talk with CCSPs An interview with Vanessa Leite, CCSP, CISSP

We often hear that cybersecurity certifications have a global reach. When we spoke with Vanessa Leite we learned how true that actually is. Vanessa holds several certifications, including vendor-specific ones, along with the CISSP and CCSP credentials from (ISC)². She exemplifies the idea of “stepping out of one’s comfort zone”. Vanessa’s joy of sharing her knowledge, as well as her thirst for continual learning, are deeply motivating. Q: What job do you do today, Vanessa? A: I am a principal cyber strategy and consulting with a Global Cyber Security company. What that means, is basically it is an executive-level role,... Read more →

Latest Cyberthreats and Advisories - January 13, 2023

Cybercriminals attack schools, the FCC looks to change data breach rules and artificial intelligence alters the cybersecurity landscape. Here are the latest threats and advisories for the week of January 13, 2023. Threat Advisories and Alerts How Businesses Can Securely Use MSP Services Managed Service Providers (MSPs) offer a popular and effective way for businesses to outsource their IT. While an MSP’s service can bring productivity gains and cost savings, they can also pose an added security risk. After all, an MSP customer will typically provide the MSP with administrative access to their data, increasing their attack surface. To stay... Read more →

Predictions 2023, Part 1: What will the new year bring for the InfoSec Community?

By Diana-Lynn Contesti, CISSP-ISSAP, ISSMP, CSSLP, SSCP In recent years, we have seen the threat landscape become increasingly complex as threat actors use sophisticated techniques to exploit vulnerabilities of weak passwords, missing patches and antiquated software, thus gaining access to corporate networks. With attacks rising within industrial control systems (ICS), operating technologies (OT) and the internet of things (IoT), we are seeing the development of new terminologies emerge (e.g., patch lag or security resilience), and the list goes on. In 2023, we can expect to see the following: Staffing shortages because of the increased need to thwart cyberattacks and, as... Read more →

Help Shape the CGRC Exam – Formerly Known As CAP

As practitioners know all too well, it is paramount to remain up to date with the changing landscape of cybersecurity. We regularly conduct Job Task Analysis (JTA) studies to review exam content and outlines to ensure the accuracy, relevance and excellence of all (ISC)² exams. The Certified in Governance, Risk and Compliance (CGRC), formerly known as the Certified Authorization Professional (CAP) exam, was last refreshed in 2021. The certification is undergoing a name change to more accurately reflect the knowledge, skills and abilities required to earn and maintain this certification. As part of our regular updates to exams, it is... Read more →

Latest Cyberthreats and Advisories - January 6, 2023

The LockBit ransomware gang apologizes, Google settles privacy lawsuits and cybercriminals impersonate brands and the U.K. government. Here are the latest threats and advisories for the week of January 6, 2023. Threat Advisories and Alerts Cybercriminals Impersonate Brands with Search Ads And Fake Sites The U.S. Federal Bureau of Investigation (FBI) has issued a warning that cybercriminals are directing internet browsers to malicious sites via search ads. How does the scam work? Bad actors build a fake website that impersonates a legitimate brand and then advertises it to appear at the top of search results. Once browsers click the ad,... Read more →

(ISC)² New Jersey Chapter Hosts International Event with 500 Attendees

The (ISC)² New Jersey Chapter held their first virtual international event, which hosted more than 20 thought leaders and 500 registered chapter member attendees. The International (ISC)² Chapter Conference, SECON International, took place virtually, on December 1, 2022, and delivered intriguing content on various cybersecurity topics. The conference featured Ted-talk style presentations across three tracks during a three-hour event. The New Jersey Chapter hopes that by sharing their successes, it can help other chapters to either replicate their event or encourage them to join this conference in the future. This event was a collaboration between several (ISC)² chapters on a... Read more →

CISSP-ISSAPs – We Need Your Input

With more than 150,000 CISSPs around the world, some of you have asked – what's the next step? For many of you, that next step is one of the CISSP concentrations focused on security architecture, engineering or management. The CISSP-ISSAP exam was last updated in October 2020, which means we are beginning the process of a refresh again. (ISC)² is holding a Job Task Analysis (JTA) Study Workshop (tentatively scheduled for February 6-8), we are asking those who hold this (or any) CISSP concentration to review the current CISSP-ISSAP Exam Outline and let us know the following: Do you believe... Read more →