(ISC)² Blog

Responsibility and Accountability in the Cloud: Where Does the Buck Stop?

In the early days of cloud computing, many executives became enamored with the idea that they would no longer be responsible for the “headaches” of an on-premises data center. Things like cooling, physical security, hardware upgrades and uninterruptable power supplies all would shift to the cloud providers. But the shifting of certain responsibilities does not also mean the transfer of accountability… So who is responsible for what in the cloud and how can shared accountability be navigated? The shared responsibility model is a nice theory, but here’s how its practical application gets tricky. Read the blog. Read more →

The Importance of a Good Software Security Policy

Policy is Everywhere Think of every company you have ever worked for. Whether it was a job in a warehouse, or employment in an office, there was always a policy to follow. In fact, when you think back to your earliest days, your family also had policies. Policies are the rules established to keep order within a group. Sometimes, policies are not followed, or are simply ignored. According to a report issued by the Federal Aviation Administration, one of the primary causes of policy failure is a lack of available, current, or well written documentation. That was followed by the... Read more →

Addressing the Human Element of Security: Awareness & Training Programs

Did you ever hear the story about the hyphen that cost 80 Million dollars? In the infancy of the United States’ space program, a programming error resulted in a forced abort of a rocket early in its flight to prevent possible injury along its crash path. Or how about the time a pilot miscalculated the required fuel for a flight from Montreal to Edmonton? These are both fatal examples of how human error can have serious consequences. In our hyper-connected world, our errors can have damaging consequences. Sometimes, the harm can be minor, such as the “Melissa” macro virus of... Read more →

How Access Control and Network Segmentation Can Protect Your Assets

Businesses are increasingly dependent on emerging technology and reaping its benefits to provide better quality of services, change the way they collaborate and interact with employees and customers. Corporate data is being moved to multi-cloud environments, while the adoption of containers helps the fast and agile development of applications. IoT devices and sensors provide businesses with an abundance of data useful for timely and accurate decision making. An Expanding Threat Landscape However, businesses are not the only ones taking advantage of this technology. Criminals, as well, are following suit. According to the Verizon DBIR 2020 report, cloud assets were involved... Read more →

Survey: CISSP Is the Most Valuable Security Certification for 2021

The (ISC)2 Certified Information Systems Security Professional (CISSP) certification has won top marks from a 90,000-member LinkedIn community of cybersecurity professionals. The group selected the certification as the most valuable from a list of 50 leading cybersecurity industry certifications and courses. The Information Security Careers Network (ISCN) asked the LinkedIn community, which is composed of ISCN members, to rate their top certifications in order to compile a list of the top 10 most desirable certifications for 2021. The list included certifications from other associations and vendors, as well as the (ISC)2 Certified Cloud Security Professional (CCSP). Why is the CISSP... Read more →

Is Your Security Team Cloud Ready?

Cloud services play a key role in the digital transformation and operation of today’s enterprises. Yet security teams are often left out of planning these initiatives, increasing the level of risk organizations will face. Security is an integral part of adopting cloud services, without being a barrier to innovation. More and more enterprises are migrating their data and applications to the cloud. The variations in implementations and environments create a level of complexity for IT security teams to monitor cloud services while keeping them secure. Is your internal team poised to shape secure cloud strategy and innovation? If it isn’t,... Read more →

Cybersecurity Workforce Study: Certifications Boost Salaries by an Average of $18,000

Almost two thirds of cybersecurity professionals (63%) currently are pursuing, or planning to pursue, security-related certifications, according to the (ISC)² 2020 Cybersecurity Workforce Study. Certifications deliver multiple benefits, including increased earning power and better career opportunities. The study found that security certifications on average boost salaries by $18,000, from an average of $67,000 to $85,000. That alone is a significant motivator, although cybersecurity professionals typically don’t limit their choice of employment to earning potential alone. They tend to value attributes such as career advancement opportunities and work/life balance as much or more. Of course, certifications are about more than boosting... Read more →

CISSP Online Exam? Explaining the (ISC)² Pilot Test

Earlier this week, (ISC)² announced the opening of registration for a limited number of online examinations as part of a pilot test for online proctoring. Prior to this pilot test, (ISC)² exams have only been available at Pearson VUE test centers, but during the past year, the COVID-19 pandemic forced test centers to close. While most test centers are now open, and health and safety measures are in place for test-takers, we have taken the first step in exploring the possibility of future online exams for CISSP and other (ISC)² certifications. During select dates in February, we will be running... Read more →

CISSPs from Around the Globe: An Interview with Angus Macrae

The Certified Information Systems Security Professional (CISSP) certification is considered to be the gold standard in information security. This is so because of all the doors that certification opens to a CISSP professional. Those doors lead to many different types of positions and opportunities, thus making the information security community dynamic and multifaceted. In support of this, (ISC)² has launched a series of interviews to explore where CISSP certification has led security professionals. Last time we met Jerome Leach and discovered his experience with the CISSP certification. This installment features Angus Macrae. He is Head of Cyber Security at King’s... Read more →

Cybersecurity Consultant: Are More CISSPs Embracing the Gig Economy?

The gig economy has grown rapidly in recent years and now includes more than one third of U.S. workers who describe themselves as consultants, freelancers or self-employed. It isn’t surprising then that 31% of organizations say that consultants and contractors are the top source they tap into for cybersecurity talent, according to the (ISC)² 2020 Cybersecurity Workforce Study. In fact, this group is the second-most popular talent source overall, just after new university graduates. The largest number of consultants (40%) work with small and mid-sized businesses (SMB), which could include small sole-proprietary businesses (think a self-employed CISSP starting his or... Read more →

Can I Ask You A Question?

The Many Advisory Roles of a CISSP A Long and Prosperous Career Throughout your cybersecurity career, you will spend a lot of time in the world of identify, protect, detect, respond, and recover. Sometimes, the skills required for the job can range from the mundane, such as running a phishing campaign, to some nail-biting, all-nighters of remediation (after someone ignored your carefully crafted phishing campaign and clicked on a malicious link). Your skills were not easily acquired. Perhaps you derived these skills from tinkering with machinery, dumpster-diving, and everything in between. Information security research has transitioned to more sophisticated tools... Read more →

A Recipe for Avoiding Software Failures

Have you ever baked something, only to see it fail due to the lack of a key ingredient? For instance, a cake will not rise if you add baking powder after you realize it was forgotten in the original ingredient list. The same is true for many failed endeavors. The addition of a critical component after the project is completed does little to improve the original plan. In many cases, it introduces unintended complexity that sets off a cascading series of problems. As a security professional, you probably can name a list of software that was released too early, requiring... Read more →

Patch Management in IT and OT Environments

The evolution of the cyber threat landscape highlights the emerging need for organizations to strengthen their ability to identify, analyze, and evaluate cyber risks before they evolve into security incidents. Although the terms “patch management” and “vulnerability management” are used as if they are interchangeable, this is not the case. Most are confused because applying patches is one of the many ways available in our arsenal to mitigate cyber risks. What is Patch Management? Patch management is a strategy for managing patches or upgrades for software applications and technologies and involves the acquisition, testing, and installation of multiple patches to... Read more →

The Benefits of HCISPP Extend Beyond Certification

Rebel, Yell! In late 2019, the phrase “OK, Boomer” started being used by millennials toward the elders who preceded them mockingly. This behavioral pattern isn’t new. Younger generations have always rebelled against their elders. Even in cultures where the elderly population is highly respected, the younger generations have developed their own language, music, art, literature and customs. The difference now is that this is the first time that the elderly out-number the younger members of society. This trend is projected to continue for the next 40 years. While some may see this as a troubling number, for those who work... Read more →

Study: Certifications Boost Salaries Substantially

While skills shortages remain a major challenge in cybersecurity, those who work in the field have ample opportunities to boost their salaries. And one sure way to get better pay is by earning certifications, according to a new study by training services provider Global Knowledge. “Learning a new skill or earning a certification can result in a raise upwards of $12,000 a year,” according to the Global Knowledge 2020 IT Skills and Salary Report. The figure applies to IT professionals as a whole but is especially relevant to cybersecurity professionals considering that the report says, “cloud computing and cybersecurity certifications... Read more →

What Do You Do When No One Is Watching

The Internal and External Struggles of Ethics and the CISSP Credential As Old As Mythology All students of information security have heard of the Caesar cipher and the Spartan Scytale. These early encryption methods demonstrate the craftiness of the human mind. Encryption has evolved and become more sophisticated. Encryption has been instrumental in the advancement of society. Can you think of another ancient mental construct of humanity that has remained static, yet is no less important to the functioning of society? Let’s consider the topic of ethics. The concept of ethics has existed since ancient times, and the subject is... Read more →

It’s Time to Test Your CISSP Knowledge!

Take the CISSP practice quiz to find out if you’re ready for the exam The CISSP certification is the ideal credential for those with the technical and managerial competence, skills, and experience to design, engineer, implement, and manage an overall cybersecurity program. Considered the industry’s premier security credential, the CISSP differentiates leaders giving them the competitive advantage across the industry. The CISSP covers eight broad domains, so it’s no surprise that preparing for the exam can be a daunting task. To help you assess your readiness, we’ve developed the CISSP practice quiz. The free online quiz is designed to test... Read more →

How Do Security Controls Help Implement a Corporate Security Policy?

A corporate security policy is the cornerstone document of a company’s risk management. Does your business have the appropriate security controls in place to implement the policy, or is the policy a forgotten document in a dusty drawer? Although most companies have established security policies at the strategic level these are not always enforced, because they lack foundational support at the tactical level. The key to solving this is knowledgeable and skilled security practitioners who can take the lead and implement security controls aligned to the policy’s goals. Many security incidents may have been avoided if the proper security controls... Read more →

CPEs for CISSPs at #ISC2Congress

(ISC)² Security Congress is virtual for the first time this year making it even easier for CISSPs, and all certified (ISC)² members, to earn CPEs. Taking place November 16-18, we’ll been presenting 3 expert keynotes, a Town Hall meeting, virtual expo hall and networking opportunities, along with nearly 50 hours of educational breakout sessions. To attend, you’ll need to create an account and purchase your pass for the conference. Member pricing is U.S. $395 for an All Access Pass which is your best value for price and CPEs. Keynote sessions will be available on-demand for 60 days after the event.... Read more →

The HR Manager's Guide to Mitigating Cyber Attacks in Healthcare

by Anastasios Arampatzis Cyberattacks in the Healthcare Industry are Increasing The use of technology in the healthcare sector can be both life-saving and life-threatening. Advancements in technology, like 3D printing, virtual reality, robotics, and Internet of Medical Things (IoMT), improve the ability of healthcare organizations to provide better care for their patients. At the same time, criminals leverage this new technology to execute their malevolent causes by either stealing protected health information (PHI) and other sensitive data or disrupting the operation of healthcare providers. The recent COVID-19 pandemic serves as a good example of the attack vectors criminals are using.... Read more →