(ISC)² Blog

Wanted: Software Developers with a Security Mindset

The modern software developer faces an enormous amount of challenges. From continuously creating innovative apps to ensuring high quality and meeting tight deadlines, developers need to cope with many responsibilities. As a result, security is still one of the last priorities on many developers’ minds during the software development lifecycle. Vulnerable Apps Increase Cyber Threats Despite that the 2020 Verizon Data Breach Investigations Report indicates that most data breaches happen through vulnerable web applications, many developers are still hesitant to adopt a security mindset. Even though the news headlines are filled with the names of companies being compromised every day,... Read more →

Hush – This Data Is Secret

Is There Ever Too Much Data? As a security practitioner, you know that businesses are fuelled not only by people but by data. Years ago, the phrase “Big Data” was a new, innovative way to gain a business advantage. Now, big data is the norm. When we think of all the data that has been gathered, we must stop and wonder about what is contained in that data. Many important, and often private details are stored about the clients of a particular business. Over time, it became clear that this data, if obtained by criminals, could be damaging to an... Read more →

Under the Hood: Inside (ISC)² Exam Development Cycle

Clar Rosso, (ISC)² CEO and Casey Marks, Chief Product Officer and VP, (ISC)² recently hosted the latest in our new Inside (ISC)² webinar series, a quarterly series designed to give members a glimpse of the latest developments from inside the association, as well as an opportunity to ask questions. The March 23 session included milestones from the first quarter, as well as a deep dive into (ISC)²'s process for developing exams and certifications. Q1 Recap Rosso kicked off the discussion with a recap of the association’s response to the pandemic, and its transition to online learning. Recognizing that 2021 still... Read more →

CISSPs from Around the Globe: An Interview with Mari Aoba

The Certified Information Systems Security Professional (CISSP) certification is considered to be the gold standard in information security. This is so because of all the doors that certification opens to a CISSP professional. Those doors lead to many different types of positions and opportunities, thus making the information security community dynamic and multifaceted. In support of this, (ISC)2 has launched a series of interviews to explore where CISSP certification has led security professionals. Last time we spoke to Chris Clinton. This installment features Mari Aoba, a security analyst at Japan Security Operation Center. What job do you do today? I... Read more →

Why would a lawyer ever need an Information Security Professional?

The First Thing We Do, Let's Kill All the Lawyers The phrase “let’s kill all the lawyers” comes from William Shakespeare’s play, King Henry VI, Part 2. This is one of the most misinterpreted lines in all of Shakespeare’s works, and it is often used inaccurately, expressing a dislike for attorneys. This is not the way that Shakespeare intended it. Shakespeare was not one to suggest the slaying of lawyers as a way to cure society’s problems. As an information security professional, have you often found yourself frustrated by the growing collection of cyber-based rules, guidance, regulations, and contemplations that... Read more →

How To Get It Right With Cybersecurity Training

The cybersecurity team can be a challenging one for organizations to keep engaged and happy. Talent is scarce, turnover and burnout rates are high. That’s why employers have to keep existing teams engaged in their profession, and current on the latest threats and defenses. To accomplish this, every organization needs a formal, standards-based cybersecurity training and education program for the employees responsible for securing their critical assets. What are the key components of a training program? Whatever an organization’s unique circumstances, three major tenets must guide any training effort: Security is an obligation, not an option. Evolving technology and constantly... Read more →

Healthcare Security – Security with Life and Death Consequences

A Day in the Life Cybersecurity remains one of the most exciting technology jobs and one of the top sought-after positions by many technology professionals. It is also one of the most difficult positions for an employer to fill. Why is this the case? When you think about cybersecurity, the mind often drifts towards the good versus evil of technology. Cybercriminals are seemingly everywhere, seeking to make a digital dollar off of the vulnerabilities of unsuspecting individuals and organizations. The security practitioner, on the other hand, is the sleuth who hunts down and neutralizes the threats, remediating the vulnerabilities. All... Read more →

6 Tips to Integrate Security into Agile Application Development

The fast and innovative nature of modern business requires enterprises to become competitive and disrupt their markets. The best way to do that is to incorporate agile methodologies into operational processes. Software development is a business function transformed by agile methodologies. Agile Software Development Benefits Businesses Agile software development is the method of developing high-quality software solutions, web applications and mobile applications, where the requirements and implementations evolve through the collaborative effort of cross-functional teams and their customers. Agile software development focuses on continuous software delivery and requires change even in late development stages. Businesses benefit from agile software development... Read more →

CISSPs from Around the Globe: An Interview with Chris Clinton

The Certified Information Systems Security Professional (CISSP) certification is considered to be the gold standard in information security. This is so because of all the doors that certification opens to a CISSP professional. Those doors lead to many different types of positions and opportunities, thus making the information security community dynamic and multifaceted. In support of this, (ISC)2 has launched a series of interviews to explore where CISSP certification has led security professionals. Last time we heard from Melissa Parsons. This installment features Chris Clinton. He is CTO and co-founder of Naq Cyber, he is an advocate of helping small... Read more →

What Are the Phases of an Incident Response Plan?

Disaster recovery is now a normal part of business operations. However, before the year 2000, disaster recovery was a “nice to have” addition to a business. Then, the “Y2K” bug became the impetus that brought disaster recovery to the forefront of business preparedness. Next, in 2001, the rise of terrorism brought new attention to the need for businesses to prepare for disasters. As time progressed, incidents such as the blackout of 2003 that shut down the northeastern United States for a day, made many recognize that disaster recovery centers could not be on the same power grid, let alone at... Read more →

Survey Says: CISSP and CCSP Among the Most In Demand IT Certifications of 2021

The (ISC)² CISSP and CCSP certifications have recently racked up more recognition from global staffing firm Robert Half. The company’s 2021 Technology Salary Guide looked at the trends and skills impacting technology professionals, as well as the most in-demand IT certifications today. The (ISC)² programs were two of the top 15 in demand certifications highlighted in a CRN story on the topic. Why Are CISSP and CCSP So In Demand? The COVID-19 pandemic shined an even brighter spotlight on the global cybersecurity workforce shortage. While the industry is making strides to fill the talent gap, the pandemic placed greater emphasis... Read more →

Technology and the New Frontier of the Healthcare Industry (The Internet of Medical Things)

The New Face of Healthcare Healthcare is currently undergoing a digital transformation that rivals the development of autonomous vehicles in the automobile industry. In fact, there are connections between improved healthcare and autonomous vehicle development. Digital transformation is a buzzword that evokes many grand ideas. In healthcare, one article succinctly articulated it: “Digital transformation in healthcare is the positive impact of technology in healthcare”. Some of the positive outcomes of digital transformation in healthcare include the rise of telemedicine, the development of internet-enabled medical devices, and medical practice and education via virtual reality technology. These developments are enhanced by the... Read more →

How You Can Take The CISSP Exam From Home

For a limited time – February 22-28, 2021 – (ISC)² is pilot testing the option to take the CISSP online exam from home. Last year, as the COVID-19 pandemic emerged, we accelerated our exploration of enabling candidates to take the CISSP exam online. While all (ISC)² exams are, and will remain, available to be taken in person at test centers with health and safety measures in place, we are happy to be able to offer an alternative in the course of this pilot test. When is the CISSP Online Exam Available? You can take your CISSP exam online next week... Read more →

The Weeds and Flowers of Information Security

Why it is essential to have experience - and not JUST to pass the CISSP Growing The Garden of InfoSec Think about your path in information security. It took a lot of work and study. No one is born knowing information security, and no child in any playground has ever said “when I grow up, I want to get a CISSP credential”. Information security is one of the most popular professions right now, and it is anticipated that the demand for qualified information security professionals will continue to grow for the foreseeable future. Any great garden requires serious care and... Read more →

Responsibility and Accountability in the Cloud: Where Does the Buck Stop?

In the early days of cloud computing, many executives became enamored with the idea that they would no longer be responsible for the “headaches” of an on-premises data center. Things like cooling, physical security, hardware upgrades and uninterruptable power supplies all would shift to the cloud providers. But the shifting of certain responsibilities does not also mean the transfer of accountability… So who is responsible for what in the cloud and how can shared accountability be navigated? The shared responsibility model is a nice theory, but here’s how its practical application gets tricky. Read the blog. Read more →

The Importance of a Good Software Security Policy

Policy is Everywhere Think of every company you have ever worked for. Whether it was a job in a warehouse, or employment in an office, there was always a policy to follow. In fact, when you think back to your earliest days, your family also had policies. Policies are the rules established to keep order within a group. Sometimes, policies are not followed, or are simply ignored. According to a report issued by the Federal Aviation Administration, one of the primary causes of policy failure is a lack of available, current, or well written documentation. That was followed by the... Read more →

Addressing the Human Element of Security: Awareness & Training Programs

Did you ever hear the story about the hyphen that cost 80 Million dollars? In the infancy of the United States’ space program, a programming error resulted in a forced abort of a rocket early in its flight to prevent possible injury along its crash path. Or how about the time a pilot miscalculated the required fuel for a flight from Montreal to Edmonton? These are both fatal examples of how human error can have serious consequences. In our hyper-connected world, our errors can have damaging consequences. Sometimes, the harm can be minor, such as the “Melissa” macro virus of... Read more →

How Access Control and Network Segmentation Can Protect Your Assets

Businesses are increasingly dependent on emerging technology and reaping its benefits to provide better quality of services, change the way they collaborate and interact with employees and customers. Corporate data is being moved to multi-cloud environments, while the adoption of containers helps the fast and agile development of applications. IoT devices and sensors provide businesses with an abundance of data useful for timely and accurate decision making. An Expanding Threat Landscape However, businesses are not the only ones taking advantage of this technology. Criminals, as well, are following suit. According to the Verizon DBIR 2020 report, cloud assets were involved... Read more →

Survey: CISSP Is the Most Valuable Security Certification for 2021

The (ISC)2 Certified Information Systems Security Professional (CISSP) certification has won top marks from a 90,000-member LinkedIn community of cybersecurity professionals. The group selected the certification as the most valuable from a list of 50 leading cybersecurity industry certifications and courses. The Information Security Careers Network (ISCN) asked the LinkedIn community, which is composed of ISCN members, to rate their top certifications in order to compile a list of the top 10 most desirable certifications for 2021. The list included certifications from other associations and vendors, as well as the (ISC)2 Certified Cloud Security Professional (CCSP). Why is the CISSP... Read more →

Is Your Security Team Cloud Ready?

Cloud services play a key role in the digital transformation and operation of today’s enterprises. Yet security teams are often left out of planning these initiatives, increasing the level of risk organizations will face. Security is an integral part of adopting cloud services, without being a barrier to innovation. More and more enterprises are migrating their data and applications to the cloud. The variations in implementations and environments create a level of complexity for IT security teams to monitor cloud services while keeping them secure. Is your internal team poised to shape secure cloud strategy and innovation? If it isn’t,... Read more →