ISC2 Blog

From Silo to Synergy between Cybersecurity and Privacy in the U.S.

The International Association of Privacy Professionals (IAPP) and (ISC)² recently collaborated on a webinar, bringing a panel together to shine a light on the intersection of cybersecurity and privacy. Bringing together a conversation between Cobun Zweifel-Keegan from IAPP (Moderator), Ron Woerner, an independent CISO/Forrester consultant, and Robin Andruss from Skyflow. By John E. Dunn “The nice thing about standards is that there are so many to choose from.” - Grace Hopper After the early optimism of the internet era, data has turned into a problem, with privacy crystallizing many of the most pressing issues. One way to understand this is... Read more →

Cybersecurity Industry News Review - May 30, 2023

By Chris Green It’s all one big simulation – for training at least, Netflix steps up password sharing clampdown, new training to improve supply chain security and Ireland invests in its cybersecurity development capability. NCSC Releases Training to Address Supply Chain Risk Prompted by the growing concern of attacks and disruption to the supply chains serving the U.K. and its allies, the country’s National Cyber Security Centre (NCSC) has launched two e-learning packages for procurement specialists and cybersecurity professionals to help both sides of the supply chain challenge better address the perceived risk. The training packages focus on two areas.... Read more →

Analysis: Ransomware In 2023 – Same Old Vulnerabilities, Bigger Ransoms, And Plenty of Pain

By John E. Dunn The 2023 Sophos State of Ransomware report found that while the number of ransomware attacks stabilized, larger victims are paying more than ever. Are they simply getting used to paying up? Ask CISOs which cyberthreat they worry about on a day-to-day-basis and the first name on most lists will be ransomware. It’s been like this for a while and judging from the recently published 2023 Sophos State of Ransomware report, there is no sign that the phenomenon is going to relent any time soon. A virtue of the Sophos study is that it is vendor agnostic... Read more →

Latest Cyberthreats and Advisories - May 26, 2023

By John Weiler Job ad scam snares victims in Southeast Asia, a fake Pentagon explosion highlights the dangers of AI and cybercriminals pounce on voice cloning technology in the latest move to develop an advantage. Here are the latest threats and advisories for the week of May 26, 2023. Threat Advisories and Alerts Updated #StopRansomware Guide Published by CISA and Partners As ransomware techniques and tactics continue to evolve, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and partner agencies have updated the #StopRansomware Guide, which was initially released in 2020. The guide serves as a comprehensive resource for organizations... Read more →

Infosecurity Europe 2023 Preview – Our Pick of the Keynote Sessions

In the first of two previews of Infosecurity Europe 2023, we look at our top picks for unmissable keynote sessions across the three days of the conference, held at ExCel in London from June 20-22. By John E. Dunn As the pivotal cybersecurity conference in the region, every Infosecurity Europe conference is oriented to topical themes. This year is no exception, with the speaker lineup covering everything from the on-going anxiety of cyberwar, how zero trust can be made to work once it leaves the drawing board, and the never-ending puzzle of assessing supply chain risk. The following is our... Read more →

Get Ready For (ISC)² Congress – Keynote Speakers Announced

It’s time to make your plans to join us in Nashville, Tennessee, with five visionary keynotes announced alongside industry-leading education, new career resources, exhibitor showcases and much more. The road to (ISC)² Security Congress is getting busier by the day, with just over 150 days until the doors open at the Gaylord Opryland Resort in Nashville, Tenn., starting on October 25. Five keynote speakers have been announced who will frame the conference over three days and give attendees a wealth of new ideas and perspectives to take back and use in their organizations and communities. The keynote speakers are: Rumman... Read more →

Cybersecurity Industry News Review - May 23, 2023

By Joe Fay US DoJ offers $10 million reward for ransomware bandit. Spyware firm rewards lobbyists. Bots drive digital fraud. China bans memory chipmaker Micron over “network security” and Taiwan hit with cyber nasty barrage. U.S. DoJ Offers Multimillion Reward for Prolific Russian Ransomware Merchant The U.S. Department of Justice (DoJ) has put a $10 million bounty on a Russian national accused of conspiring to deploy three key ransomware variants. The agency has accused Mikhail Pavlovich Matveev, aka Wazawaka, aka m1x, aka Boriselcin, aka Uhodiransomwar, of “conspiring to transmit ransom demands, conspiring to damage protected computers, and intentionally damaging protected... Read more →

Open Call for (ISC)² Board of Directors Nominations

Nominations are open for the (ISC)² Board of Directors. If you’re interested in serving as a Board member, this is your opportunity to nominate yourself for election! What do Board members do? The (ISC)² Board of Directors is made up of certified (ISC)² members who volunteer their time and expertise to help guide our association forward. The Board is responsible for providing strategic direction, as well as governance and oversight to (ISC)². They develop policies and procedures, grant certifications and enforce the (ISC)² Code of Ethics. The Board of Directors meets for quarterly for Board meetings – attended by (ISC)²... Read more →

Eliminating Stigma Around Mental Health in the Cybersecurity Profession

May is Mental Health Awareness Month, a time to promote education about mental wellness and reduce stigma surrounding mental health issues. In professions like cybersecurity, where workers can become overwhelmed while combating constant cyber threats or experience burnout from working long hours, it’s important to recognize when you need to take a step back and prioritize your mental health. There is still a lot of stigma surrounding discussions of mental health, especially in the workplace. Given that mental health issues are very personal, we don’t often discuss them at work, which can lead many people to suffer in silence. Sharing... Read more →

Latest Cyberthreats and Advisories - May 19, 2023

WordPress’s Elementor is vulnerable (again), the U.S. Department of Transportation is breached, 5.8 million medical records are posted online after PharMerica incident. Here are the latest threats and advisories for the week of May 19, 2023. By John Weiler Threat Advisories and Alerts Australian and U.S. Governments Release Advisory on BianLian Ransomware Group The Australian Cyber Security Centre (ACSC) has released a joint cybersecurity advisory with the U.S. outlining typical threat vectors and signs of ongoing attacks by the BianLian ransomware group. It is a relatively new group that uses trusted Remote Desktop Protocol (RDP) credentials to gain network access... Read more →

The Top Five Cloud Native Risks

By Dave Cartwright, CISSP Cloud-first strategies now the norm for most businesses, but in the rush to go cloud, mistakes were made. We look at the five biggest cloud mistakes, so you don’t repeat them. The cloud is here to stay. The days are gone of senior managers seeing the cloud as a security-risky “someone else’s network” whose security and uptime can’t be relied upon. Even risk-averse markets such as banking are adopting cloud-first strategies. According to one source, cloud spend in the banking sector is destined to increase by around 16% in the next year or so, while a... Read more →

Target Cybersecurity Chief Says Zero-Ing in On Threat Is Central to Cyber Risk Excellence

By Joe Fay At the recent (ISC)2 Governance Risk and Compliance event, the cybersecurity head of U.S. retailer Target put threats, risk management and third-party relationships under the spotlight. The head of cyber risk at U.S. store giant Target has revealed how the grocery-to-homeware retailer approaches cybersecurity and risk. Brenda Bjerke, senior director of cybersecurity at Target, where she leads cyber risk management globally, pointed to three key differentiators in her team’s approach to cyber risk excellence: threat; partnerships; and culture. Speaking at the first (ISC)2 Governance Risk and Compliance (GRC) event, which is now available for on-demand replay, Bjerke... Read more →

3 Asian Tech Pioneers You Should Know

May is Asian and Pacific Islander Heritage Month, a time to celebrate the contributions and legacies of individuals of Asian and Pacific Islander descent. While the month is usually celebrated with an emphasis on groups in the United States, at (ISC)2, we want to uplift the diverse Asian and Pacific Islander communities across the globe. In honor of this year’s theme, “Advancing Leaders Through Opportunity,” we’ve put together a list of inspiring Asian pioneers who are making a big impact in the cybersecurity space. Raj Samani Raj Samani is a computer security expert who is the Chief Scientist for cybersecurity... Read more →

Cybersecurity Industry News Review - May 16, 2023

By Joe Fay A week of surprises as a decade long data exposure is revealed in the car industry and Western allies move to shut down Russian malware. US And Allies Deploy PERSEUS To Cut Off Russia’s Snake Malware US authorities and allied governments claimed last week to have disrupted a massive Russian controlled malware operation that had been running for over 20 years. The US Justice Department and FBI said its operation “MEDUSA” had been aimed at a “global peer-to-peer network of computers compromised by sophisticated malware, called “Snake”, attributed to a unit within Centre 16 of Russia’ FSB.... Read more →

Latest Cyberthreats and Advisories - May 12, 2023

By John Weiler A Russian espionage tool infiltrates 50 countries, updates on the Western Digital breach and over a million patients impacted in NextGen Healthcare breach. Here are the latest threats and advisories for the week of May 12, 2023. Threat Advisories and Alerts Russian Cyber Espionage Tool 'Snake' Found in Over 50 Countries The U.K., U.S. and their allies released a cybersecurity advisory pertaining to state-sponsored malware known as "Snake." Developed and used by Russia's Federal Security Service (FSB) for almost 20 years, Snake has infiltrated government networks, research facilities and journalistic entities across 50 countries. The malware operates... Read more →

Real Talk with CCSPs: An Interview with Shubhra Deo

Often in cybersecurity, we encounter professionals who never intended or expected to pursue security at all. In fact, when we spoke with Shubhra Deo, she revealed that her introduction to cybersecurity started as a mere curiosity. It eventually led to her gaining the experience, and sitting for two exams that earned her the CISSP, and the CCSP credentials. Her story shows how important curiosity can be in accelerating one’s career. Q: Could you tell us a little about your current job, and what attracted you to cybersecurity? A: I am currently working as a Head, Data Security & Privacy. Back... Read more →

(ISC)² Member Poll Suggests Concern Over Rapid Progress Of AI

By John E. Dunn AI should be regulated as soon as possible, says most (ISC)² members surveyed. But stopping it – even for a short period – is probably now impossible. In the face of the recent open industry letter calling for a pause in development of artificial intelligence (AI) technology, a group of (ISC)2 members were asked if they agreed with the likes of Apple co-founder Steve Wozniak and Tesla/SpaceX head Elon Musk. Overall, of the 163 members and candidates who participated, over a third (34.3%) agreed with this idea, with 58.9% against and 6.7% expressing no opinion. While... Read more →

Cybersecurity Industry News Review - May 9, 2023

Former Uber CSO avoids jail time over breach coverup. Cyber insurers lose over act of war exclusion. CISA warns over suspect communications suppliers as Cisco tells customers to ditch vulnerable kit. By Joe Fay Ex-Uber CSO Joe Sullivan Gets Fine, Probation but No Jail Time For Data Breach Coverup Uber’s former chief security officer Joe Sullivan has been spared jail for his role in covering up a 2016 data breach at the ride sharing giant. Sullivan was instead hit with a $50,000 fine, three years’ probation, and a 200-hour community service order, despite prosecutors pushing for a 15 month prison... Read more →

March-April (ISC)² News and Insights CPE Quiz Is Now Live

(ISC)² Members can earn CPE credits by answering questions based on the articles we have published over the last two months. The last two months have represented a profound period for the cybersecurity industry. The White House published its Cybersecurity Strategy, US tech bank SVB collapsed into state control, details emerged of how the U.K.’s Royal Mail dealt with ransomware demands, we celebrated the contribution of women to our industry and society, ChatGPT really started to worry everyone and a collaboration of security agencies advanced a Security By Design ethos. When it came to writing the latest (ISC)² News and... Read more →

LATEST CYBERTHREATS AND ADVISORIES - May 5, 2023

T-Mobile is breached again, cyberattacks increase 7% globally and ransomware attacks are hit by inflation. Here are the latest threats and advisories for the week of May 5, 2023. Threat Advisories and Alerts NCSC Releases Interactive Media to Help Kids Stay Safe Online The U.K.’s National Cyber Security Centre (NCSC) has released interactive media to help educate children and teens about the risks of the internet. For 7-11-year-olds, the video game CyberSprinters teaches kids about passwords, the cloud and other cybersecurity topics. For 11-14-year-olds, the interactive video CyberFlix highlights common scams that pre-teen and teenagers face on the internet, which... Read more →