(ISC)² Blog

Wearing It With Pride: How showing off your (ISC)2 credentials can make a difference

By Tony Vizza, CISSP, CCSP, Director for Cyber Security Advocacy - APAC at (ISC)² “Tony, why did you get into cyber security?,” I am often asked. Truth be told, I had an interest in IT from a very young age. In second grade, my classroom had an early model Apple which the teacher did not know how to use and which I taught her. In high school, I took computer studies as a subject. Following this, I enrolled and completed an undergraduate degree in computer science. My first job after graduation was as a programmer and network administrator within a... Read more →

Cybersecurity’s Top Needed Skill: Cloud Security

The cloud today has become what Forrester calls “a turbocharged engine powering digital transformation around the world.” Digital transformation is propelling worldwide cloud service market projected growth from $182.4B in 2018 to $331.2B in 2022. Yet the cybersecurity skills shortage threatens safe cloud adoption and cloud security is the number one technology area most impacted by the shortfall. Because of this, many cybersecurity experts are finding themselves pushed by their employers to expand their expertise to the cloud. That was certainly the case for Nanditha Rao, Information Security Senior Advisor and Olayinka “Olay” Ladeji, Senior Principal Program Manager, Cloud Operations.... Read more →

CISSP Engineering Concentration Exam Updates

Earlier in the year, we announced an upcoming update to the CISSP-ISSAP certification exam. Coming in November, the CISSP-ISSEP exam will also be updated. The CISSP-ISSEP is a concentration certification exam for those who already hold the CISSP. The concentration recognizes certification for those who have the keen ability to practically apply systems engineering principles and processes to develop secure systems. Those who hold it have the knowledge and skills to incorporate security into projects, applications, business processes and information systems. When the updated exam blueprint takes effect starting on November 13, 2020, the CISSP-ISSEP exam will be reduced from... Read more →

(ISC)² CAP Members - We Need Your Help

It’s time again for another (ISC)² Job Task Analysis (JTA) study, this time for the CAP certification. We frequently review and update our content outlines (aka exam blueprints) of our credentialing examinations. If you’re not familiar, the JTA is a methodical process used to determine tasks that are performed by credential holders and knowledge and skills required to perform those tasks successfully. As we prepare for a review of the CAP exam, we would like to hear from our CAP members! We would like you to comment on the new and emerging cybersecurity issues that should be addressed, but are... Read more →

White Paper on Cloud Security Risks - And How To Mitigate Them

Cloud security today is touted as better than ever. So how do we explain the ever-increasing number of data breaches? According to the new white paper, Cloud Security Risks & How to Mitigate Them, the disconnect arises from a shared security model. Cloud Service Providers protect the datacenter, but customers are responsible for safeguarding their own data, and focus is shifting from the provider to the customer. To reduce risks, cloud customers must take charge of data security. This is no small feat as many are in a period of transition and facing a wide range of threats… Insufficient access... Read more →

CISSP Ranks Sixth in Salary-Earning Potential

(ISC)²’s Certified Information Systems Security Professional (CISSP) is currently the sixth highest paying IT certification, according to newly published research. CISSP-certified cybersecurity professionals earn salaries averaging more than $140,000. The CISSP is one of just six IT certifications commanding salaries above $140,000, which places them on the 15 Top-Paying IT Certifications for 2020 compiled by training company Global Knowledge. The list contains salaries ranging from an average of $117,000 for Citrix Certified Professional – Virtualization to nearly $176,000 for Google Certified Professional Cloud Architect. The list’s top four certifications are either in cloud computing or cybersecurity, confirming that demand in... Read more →

Breaches Increased in 2019, but the Number of Exposed Records Declined

The number of U.S. data breaches bumped up 17% in 2019 but despite the increase, the volume of sensitive consumer records that were exposed declined substantially by 65%, according to a newly published report. These statistics are a complete reversal of what happened in 2018, when the number of exposed consumer records soared by 126% and breaches declined by 23%, according to the Identity Theft Resource Center’s (ITRC) End-of-Year Data Breach Report for 2019 Data breaches tracked in 2019 in the United States jumped to 1,473, from 1,257 in the previous year, the report revealed. Meanwhile, 164,683,455 sensitive records were... Read more →

(ISC)2 Expands Cybersecurity Awareness Efforts in Australia with Strategic Partnership

In yet another sign that (ISC)2 is working to increase its international efforts and alliances, today we’re excited to announce a new strategic partnership with the Australian Information Security Association to work jointly toward a safer and more secure cyber world. As the press release outlines: “. . . the Strategic Partnership Agreement . . . recognises (ISC)2 certifications as the global standard for cybersecurity certifications that AISA members can aspire to and achieve. AISA will run quarterly certification sessions to its membership for (ISC)2 certifications including the CISSP, CCSP and SSCP, among others. AISA will promote to its members... Read more →

Security Predictions for 2020 from the (ISC)² Community of Security Professionals (Part 2)

By Diana-Lynn Contesti, CISSP-ISSAP, ISSMP, CSSLP, SSCP and John Martin, CISSP-ISSAP Continued discussion from Security Predictions for 2020 from the (ISC)² Community of Security Professionals (Part 1) Internet of Things (IoT), Industrial Internet of Things (IIoT) and Operating Technology (OT) related to the state of digital certificates The issue is not just self-signed digital certificates or expired certificates. Many of these devices have digital certificates, which need to be managed via a Key Management System and maintained. The fallout, of course, is that without proper controls, these devices can and will be compromised. Currently, the onus is on the consumer... Read more →

Security Predictions for 2020 from the (ISC)² Community of Security Professionals (Part 1)

By Diana-Lynn Contesti, CISSP-ISSAP, ISSMP, CSSLP, SSCP and John Martin, CISSP-ISSAP Cyber-attacks will impact businesses on a larger scale in 2020 and will affect those who are unprepared, whether it is attributed to human error or other disasters. In an effort to combat some of the issues faced by corporations, it is time for CEOs to grasp the mettle and officially buy-in with their security practitioners’ advice. We have all seen various vendors make predictions for Information Security for 2020. These predictions include an increase in targeted Ransomware, threats to the 2020 Elections in the U.S. and other countries, and... Read more →

CISSP Once Again Recognized by SC Media

With RSA Conference in San Francisco fast approaching, SC Media has once again announced the finalists for its annual awards program. Winners will be announced at the SC Awards dinner and presentation on February 25 at the Intercontinental San Francisco. We’re proud to say that the CISSP has once again been recognized as one of the industry’s Best Professional Certification Programs for 2020 after receiving a Finalist designation in that category. The CISSP was also the winner at last year’s ceremony. The SC Awards are recognized throughout the cybersecurity industry as the crowning achievement for IT security, and winners are... Read more →

Certified Secure Software Lifecycle Professional Exam Updates

Last week, IBM’s Security Intelligence blog reported on the highly-discussed cybersecurity skills shortage – and in particular, how some areas are lacking in talent more than others. “Software development is one of the areas most starved of security attention,” wrote Irene Michlin. If you’ve set your sights on specializing in software development cybersecurity, the CSSLP certification is for you. Based on the results of the job task analysis conducted in 2019, the exam will be changing in several ways when it is published later this year. The number of items and the time allowed for the exam will be reduced... Read more →

No Limits, No Excuses: Commit to Certification in 2020

Why are goal-oriented individuals more likely to thrive professionally? Because they know where they want to go. But accomplishing anything meaningful takes drive and dedication. Most of all, it requires a clearly defined plan and inspiration to stay on track. A milestone like achieving (ISC)2 certification is a powerful motivator, especially when you consider the rewards that come with it. Was 2019 the year you wanted to earn an (ISC)2 credential to enter a high-demand field, enhance your cybersecurity skills or increase job security? Perhaps you even started preparing, but got sidetracked by life’s demands. We really do get it…... Read more →

Wanted: Cloud Security Skills

As demand for cloud computing grows, so does the need to secure it. In a survey of its Technology Executive Council members, CNBC found that cloud and software-defined security are among the C-suite’s top technology strategies for 2020. As reported in this video, cloud computing tops the list, and it’s followed by machine learning, artificial intelligence and software-defined security. The CNBC Technology Executive Council has nearly 150 executives in various industries, 70% of whom participated in the survey. The survey shows that securing cloud environments is a major priority – not only for the C-suite but also for cybersecurity workers.... Read more →

Most Employers Don’t Pay Full Cost of Certifications

One of the most common complaints cybersecurity professionals voice about their employers is that they have to pay for certifications out of their own pockets. It’s not a trivial issue, since workers consider certifications their number one career hurdle, according the (ISC)2 Cybersecurity Workforce Study 2019. Based on study findings, most employers don’t pay their cybersecurity workers’ certification fees. Considerably fewer than half of respondents in the study (37%) say their employers pay for them while 21% say they share the cost with employers. More than one third of respondents (35%) pay for all of their own cybersecurity certification costs.... Read more →

So You Have Decided to Become Cyber Security Certified, Now What?

By Tony Vizza, CISSP, CCSP, Director for Cyber Security Advocacy - APAC at (ISC)² Toward the end of 2019, I met many aspiring women and men who approached me and said, "Tony, I want to become cyber security certified, how do I do it?" If you are reading this article, it is likely that you have made a conscious decision to do so. Congratulations on taking this step in furthering your career, skills and knowledge. You have made the decision to demonstrate to the wider world your hard-gained experience, knowledge and skills in cybersecurity and to prove to yourself that... Read more →

How To Navigate An Uncertain Job Horizon

As published in the September/October edition of InfoSecurity Professional Magazine By Deborah Johnson Advice on how to mitigate a sudden job loss due to redundancy, recession or ‘rightsizing’. Diana Contesti was a business continuity planner at a major steel manufacturer in Hamilton, Ontario, when a recession hit the Canadian steel industry in the early 1990s. The economic contraction forced companies to cut jobs. Her employer called it “rightsizing” when leadership announced it would cut approximately 3,000 positions. The layoffs were based on seniority by department, and based on that criterion, Contesti knew she was out. “I was extremely worried. I’m... Read more →

SSCPs: We Need Your Input

(ISC)² regularly conducts Job Task Analysis (JTA) studies to review and update the content outline (or exam blueprint) of its credentialing examinations. A JTA is the methodical process used to determine tasks that are performed by credential holders and knowledge and skills required to perform those tasks successfully. Results of the JTA study link a candidate’s examination score directly to the domain knowledge being tested. The existing exam blueprint for SSCP will be reviewed in early 2020. In preparation for the upcoming review, we would like to hear from our SSCP members regarding new and emerging IT cyber security issues... Read more →

Job Satisfaction Is High Among Cybersecurity Workers

Cybersecurity professionals face plenty of challenges in their work – there’s always something new to learn, cyber attackers are relentless and security teams are usually short-staffed. Still, nearly two-thirds of cybersecurity professionals (66%) say they are satisfied with their jobs. But that number jumps to 72% among cybersecurity workers whose employers pay for their certifications, according to the 2019 (ISC)2 Cybersecurity Workforce Study. For professionals whose organizations pay for only part or none of their certification costs, the number drops to 63%. This is an important finding for employers who are trying to build their cybersecurity teams. Currently there is... Read more →

Cyber Threats to Healthcare on the Rise

Hospitals are set up to fight infections, but not necessarily the kind that has been plaguing healthcare institutions lately – malware. A new report estimates that cyber threats against healthcare targets increased 60% since January, surpassing the total number of threats identified in all of 2018. The most common threat targeting the healthcare industry is Trojan malware, which increased 82% in the third quarter from Q2, according to the report by Malwarebytes, Cybercrime Tactics and Techniques: The 2019 State of Healthcare. Most of the Trojan attacks involved Emotet and TrickBot, which are the two most dangerous Trojans around since 2018.... Read more →