(ISC)² Blog

CCSP vs. Microsoft Azure Certified Security Engineer Associate — How Does Vendor Focus Factor In?

Adoption and usage of the cloud is evolving to combine with technologies like artificial intelligence, the Internet of Things, 5G and more, according to Sid Nag, Research Vice President at Gartner. “In other words,” he says, “cloud will serve as the glue between many other technologies that CIOs want to use more of, allowing them to leapfrog into the next century as they address more complex and emerging use cases.” With cloud roles expanding and so many certifications out there, which option offers cybersecurity experts the flexibility to grow with the coming waves of opportunity? Let’s compare two popular options,... Read more →

What is Relevant Work Experience for CISSP?

In order to become fully certified as a CISSP, you must not only pass a rigorous experiential exam, but meet the CISSP work experience requirements. CISSP candidates are required to have a minimum of five years of cumulative work experience in two or more of the eight domains of the CISSP CBK. There are a few paths to accumulate this time: Education You can satisfy one year of work experience with either a college degree or an approved certification. You can apply either of the below to meet one year of the requirement: A four-year college degree or regional equivalent... Read more →

CCSP vs. Google Cloud Certified-Professional Cloud Security Engineer: Which Shows Broader Mastery in Cloud Security?

A surge of organizations are moving their operations to the cloud for the benefits of improved efficiency, better scalability and faster deployment. But with the wave of migration to the cloud come more threats than ever before. The cloud is giving bad actors a more expansive set of targets, as well as new tools to conduct attacks, says Or Azarzar, Co-founder and CTO of Lightspin, in an article in Dark Reading. With so many risks for cyberattacks targeting the cloud, which certification demonstrates a broader understanding and skillset to protect cloud security? Let’s compare two cloud certs, (ISC)² Certified Cloud... Read more →

Bringing Cybersecurity to the Board (and Vice Versa)

The Role of the Board in Effective Risk Assessment The growing sophistication of cybercrime is making it a necessity for companies to discuss its challenges and defense methods regularly at the board level. The results of an attack may involve refusal of an insurance company to pay, the potential for class action lawsuits, infections that penetrate too deep into the IT system to be removed, and violation of data protection rules. Boards and directors must approach cybersecurity as an enterprise-wide risk management issue. They must embrace their organization’s cyber risk appetite and understand the types of internal and external threats... Read more →

Data Consistency Storage in the Cloud

In cloud computing environments, files are not stored in a hierarchical way. Most cloud architectures use a combination of splitting data vertically, horizontally and replication to improve response times, scalability, availability and fault tolerance. This is called object storage. Objects are accessible through APIs or through a web interface. Object storage introduces new challenges related to data consistency, which are not present in relational databases. One of the more fundamental decisions cloud professionals need to make is whether they will choose eventual consistency for data in corporate systems or strong consistency. Selecting a data consistency model is a decision that... Read more →

A Safe and Secure Way to Decommission

When it comes time to decommission data storage systems, there is much that must be planned and thoroughly carried out. It’s not just about the activity, it is also about due diligence, oversight, and proof. Data that appears to have been deleted is often still recoverable, and in many cases, people make mistakes, such as forgetting a second backup exists somewhere else, or forgetting to verify that a destruction has been successfully and completely deployed. Human errors like this are referred to as unintentional insider threats, since they lead to the potential of data theft, litigation, and penalties. It is... Read more →

How to Prepare for CISSP Exam Day

By deciding to take the CISSP exam, you’ve chosen to further your education and showcase your knowledge and experience by achieving the world’s premier cybersecurity certification. Soon, you will join the ranks of more than 147,000 global leaders committed to a safe and secure cyber world. Make a Timeline As you prep for your CISSP exam, first consider your experience level and determine a timeline that fits for your current workload and lifestyle. The amount of time you need to dedicate to studying can vary based on your experience. Do you have questions about creating a CISSP study plan? Learn... Read more →

The Best Way to Start Your Cloud Security Career

Where do you begin your journey in InfoSec? What do you need to study? How do you even get started in a vast field with so many areas, and so many opportunities? These questions often haunt a new InfoSec candidate, sometimes causing them to freeze, doing nothing for fear of taking the wrong path. Everywhere you look, it is apparent that cloud computing is not only the future of Information Security, it is happening right now. If you are asking the question of where to begin, there is no better place to look than cloud security. Along with that, while... Read more →

Insider Threats Can Turn Your Cloud Security Into a Storm

Insiders can become a real threat to organizations migrating to the cloud because they do not have to breach any external security fences. Insider threats could either come in the form of a human error or as a malicious action. Human errors in cloud security configurations could result in sensitive data and asset disclosure, loss or theft. On the other hand, malicious insiders misuse authorized access to an organization’s cloud assets to overcome security controls and launch their malicious actions. Insiders are a growing risk to cloud security because insider attacks are hard to detect and respond to and they... Read more →

The Importance of Security Control Baselines

For cybersecurity professionals, baseline management is vital because any asset not properly configured can become a security vulnerability. Baselines are fundamental to managing projects of all types and this is especially important in cybersecurity, where everything is a race against time and against very guileful opponents. Although baseline management seems like time-consuming “record keeping,” it is in fact the only way to know where you are, how your assets are operating, what has changed, and what needs to be changed. Not only does this help ensure the safety and security of the assets under your watch, it also helps with... Read more →

Rookies Needed - Experience Required

Are Employer Demands Contributing to the Cybersecurity Skills Gap? You’ve seen the job posting. It starts, “Looking for a cybersecurity specialist. Must have a master’s degree, certifications and 10 years of experience,” followed by, “This is an entry-level position with non-compensated job shadowing requirements.” These unrealistic expectations are the obstacles many cybersecurity professionals face once they complete their studies and rigorous exams. It’s an unfair barrier to entry. Clearly, hiring a person to work in any department in any organization is a risk. It costs money to locate, attract, assess, interview, hire, onboard and train someone, and it’s many months... Read more →

CCSP vs. Symantec Certified Cloud Credentials: How Do They Compare?

The mounting cybersecurity challenges facing organizations worldwide show no sign of slowing. Not only the shortage of qualified cybersecurity staff but also the lack of security awareness and skills among employees remain the biggest concerns, according to the 2021 Cloud Security Report by Cybersecurity Insiders. Global need for cybersecurity experts specializing in cloud security is growing demand for certification. But with so many credentials out there, which most effectively demonstrates the broad knowledge and skills required to secure any cloud environment? Let’s compare three leading certifications: (ISC)² Certified Cloud Security Professional (CCSP) vs. Symantec Certified Specialist-Administration of Symantec Cloud Workload... Read more →

The Dawn of True IoT Security

Internet of Things (IoT) devices are now everywhere. Ever since the earliest devices started to appear on the market, in homes, and worse, in corporations, security professionals have sounded the alarm about how these devices were built with no security in mind. Now, the National Institute of Standards and Technology (NIST) has released new draft guidance documents on securing these devices, both before release, as well as acquisition, and integration. These new publications will serve both corporations and consumers in a positive way. However, like any technical directions, the ideas set forth are only effective in capable and qualified hands.... Read more →

(ISC)² Cybersecurity Entry-Level Certification Exam Topics Announced

To fill the cybersecurity workforce gap, we need to address the workforce shortage facing the industry, especially among entry- and junior-level positions. Creating an entry-level certification will help encourage new professionals to begin a cybersecurity career. After surveying cybersecurity experts on the most important domains, or subject matter areas, for new professionals, we have published the preliminary exam outline for the upcoming entry-level cybersecurity certification pilot program. This exam outline will allow the pilot program candidates to know which subjects they should be familiar with prior to taking the exam. Since this is an exam pilot program, topics are subject... Read more →

CCSP vs. Microsoft Certified: Azure Administrator Associate — How Does Vendor Focus Factor In?

Adoption and usage of the cloud is evolving to combine with technologies like artificial intelligence, the Internet of Things, 5G and more, according to Sid Nag, Research Vice President at Gartner. “In other words,” he says, “cloud will serve as the glue between many other technologies that CIOs want to use more of, allowing them to leapfrog into the next century as they address more complex and emerging use cases.” With cloud roles expanding and so many certifications out there, which option offers cybersecurity experts the flexibility to grow with the coming waves of opportunity? Let’s compare two popular options,... Read more →

CISSPs from Around the Globe: An Interview with Dr. Christine Izuakor

The Certified Information Systems Security Professional (CISSP) certification is considered to be the gold standard in information security. This is so because of all the doors that certification opens to a CISSP professional. Those doors lead to many different types of positions and opportunities, thus making the information security community dynamic and multifaceted. In this installment, we talk to influential trailblazer Dr. Christine Izuakor. Christine shares with us her incredible story as the youngest student and first African-American woman to achieve a P.hD in Security Engineering, how she planned her journey to achieve her dream job and how her passion... Read more →

The Threat of Insecure Interfaces and APIs

Application programming interfaces (APIs) allow applications to communicate with each other, simplifying software development. Developers add functionality from other existing solutions or build applications using services by third-party providers. APIs have become the drivers for businesses digital transformation initiatives opening up their apps and data to partners, suppliers and customers. Besides their increased applicability and benefits, APIs are often the source of security concerns and threats because businesses fail to secure them. Surveys have identified that authentication, vulnerabilities and visibility are the key pain points, enabling malicious actors to exploit insecure APIs and turn them into attack vectors. Despite the... Read more →

Security does not end with Implementing Controls

In cybersecurity, threat actors are relentless. To keep systems safe, we need a process of controls to oversee the entire chronology of a potential attack scenario – protection before an attack happens, effective mitigation and correction during an attack, and recovery afterwards. The tools of defense are vital, but not enough. Organizations need to decide how to deploy these tools, how much to spend, how to train people, and how to ensure they maintain compliance with industry standards and governance/risk (GRC) requirements. Security controls must be organized and described in a way that non-IT people – employees and executives alike... Read more →

(ISC)² Addresses the Cybersecurity Workforce Gap with New Entry-Level Cybersecurity Certification Pilot Program

In an effort to introduce more talent into the cybersecurity workforce, make cybersecurity a more accessible, inclusive and diverse profession, and close the cybersecurity skills gap, (ISC)² will pilot a new entry-level cybersecurity certification exam as part of its portfolio of industry qualifications. The entry-level certification will provide students, new entrants and career changers with clear and attainable professional development and career pathways from day one. In addition, it will give employers the confidence that new entrants into the sector have a solid grasp of the right technical, ethical and operational practices on which to build and learn. As a... Read more →

CCSP vs. CCNA and CCNP Data Center: What Are the Key Differences?

When asked how CISOs could better address the impact of the cybersecurity skills shortage, the most popular suggestion was to increase the overall commitment to training, according to The Life and Times of Cybersecurity Professionals report from Enterprise Strategy Group and the Information Systems Security Association. In fact, security professionals must continue developing their professional skills or put their organizations at a competitive disadvantage, according to 91 percent of respondents. But with so many training and certification options out there, which most effectively demonstrates the broad knowledge and skills required to secure cloud environments? Let’s compare three leading cybersecurity certifications:... Read more →