ISC2 Blog

Security does not end with Implementing Controls

In cybersecurity, threat actors are relentless. To keep systems safe, we need a process of controls to oversee the entire chronology of a potential attack scenario – protection before an attack happens, effective mitigation and correction during an attack, and recovery afterwards. The tools of defense are vital, but not enough. Organizations need to decide how to deploy these tools, how much to spend, how to train people, and how to ensure they maintain compliance with industry standards and governance/risk (GRC) requirements. Security controls must be organized and described in a way that non-IT people – employees and executives alike... Read more →

(ISC)² Addresses the Cybersecurity Workforce Gap with New Entry-Level Cybersecurity Certification Pilot Program

In an effort to introduce more talent into the cybersecurity workforce, make cybersecurity a more accessible, inclusive and diverse profession, and close the cybersecurity skills gap, (ISC)² will pilot a new entry-level cybersecurity certification exam as part of its portfolio of industry qualifications. The entry-level certification will provide students, new entrants and career changers with clear and attainable professional development and career pathways from day one. In addition, it will give employers the confidence that new entrants into the sector have a solid grasp of the right technical, ethical and operational practices on which to build and learn. As a... Read more →

CCSP vs. CCNA and CCNP Data Center: What Are the Key Differences?

When asked how CISOs could better address the impact of the cybersecurity skills shortage, the most popular suggestion was to increase the overall commitment to training, according to The Life and Times of Cybersecurity Professionals report from Enterprise Strategy Group and the Information Systems Security Association. In fact, security professionals must continue developing their professional skills or put their organizations at a competitive disadvantage, according to 91 percent of respondents. But with so many training and certification options out there, which most effectively demonstrates the broad knowledge and skills required to secure cloud environments? Let’s compare three leading cybersecurity certifications:... Read more →

How Continuous Monitoring is a Driver of Effective Risk Management

Continuous Monitoring (CM) as the ability to maintain ongoing awareness of information security, vulnerabilities, and threats to facilitate risk-based decision making. The ultimate objective of CM is to determine if the security and privacy controls implemented by an organization continue to be effective over time considering the inevitable changes that occur in the environment in which the organization operates. Continuous Monitoring removes the limitations of manual or one-time assessments and facilitates real-time risk management through automating monitoring processes. CM benefits businesses in many ways by providing visibility into undiscovered system components, misconfigurations, vulnerabilities, and unauthorized changes, which can potentially expose... Read more →

CCSP vs. AWS Cloud Certified: Which One for Cloud Security?

Organizations worldwide are facing new security challenges presented by cloud computing, as most legacy security tools fail to meet the requirements of dynamic, distributed, virtual cloud environments. In fact, 81% of organizations say traditional security solutions don’t work at all in cloud environments or have only limited functionality, according to the 2021 Cloud Security Report by Cybersecurity Insiders. To fill those gaps, global opportunities for cybersecurity professionals specializing in cloud security are many. But with so many certifications out there, which option most effectively demonstrates the broad knowledge and skills required to secure any cloud environment? Let’s compare three leading... Read more →

Ensuring Disaster Recovery and Business Continuity in the Cloud

Organizations are experiencing their fair share of ransomware attacks in the cloud. And the reality is, they aren’t always able to recover. Complexity in the cloud doesn’t just prolong recovery efforts. In some cases, it foils them completely. Companies must be able to recover from data destruction events to avoid potential business losses as well as civil penalties. The need for disaster recovery and business continuity has never been stronger. Here’s why and how you can bring cloud-based disaster recovery to the rescue. Read the full article. Want to learn more about CCSP? To learn more about how the CCSP... Read more →

The Importance of Adopting a Risk Management Approach to Security and Privacy

With businesses’ digital transformation initiatives accelerated during the pandemic, cyber risks are no longer an issue of the IT department. Cyber risks are business risks threatening the very existence of highly digitized and interconnected organizations. Companies are compelled to address those risks before they impact their operations. Risk management is the process of identifying, assessing and controlling risks to an organization’s business, assets, revenue, productivity and reliability. Risk management informs decision making on the investments, policies and practices to mitigate threats and minimize their adverse effects. A risk management approach benefits an organization in many ways as it strengthens their... Read more →

CCSP vs. Professional Cloud Security Manager: How Do They Compare?

Cybersecurity isn’t only a national security issue making headlines almost daily — it’s at the top of the list of imperatives for organizations, public and private. In fact, a majority (73%) rate their security readiness only average or below average, according to the 2021 Cloud Security Report by Cybersecurity Insiders. And that unease extends to the cloud. Though cloud-based security solutions offer significant advantages, resistance to migrating to the cloud continues to exist. Those surveyed say staff expertise and training continues to rank as the highest barrier (53%) to cloud adoption. That realization is leading more enterprises and individuals to... Read more →

CISSP - Tales of the Unexpected

We have all heard the old adage how big surprises can come in small packages. If you are a candidate who is studying for the CISSP exam, or if you are in the early stages of considering studying for the exam, you may be surprised that at all the opportunities that are available from a single certification. However, when taken in context with the benefits of the CISSP credential, very few other certifications carry the same respect and career-boosting potential as the CISSP. It is understandable why one might hesitate at reaching for what is often referred to as the... Read more →

Mastering Identity and Access Management in the Cloud

The migration of business services, apps and data in the cloud has blurred traditional corporate perimeter. Legacy security solutions, based on securing the perimeter, are no longer adequate to address cloud security challenges and risks. Businesses need to evolve their traditional identity and access management (IAM) program to safeguard the access to their cloud-based assets and data. Digital identities are the foundation of modern IAM and organizations need to establish strong authentication methods to protect these identities. Weak IAM policies result in identities and credentials being vulnerable and compromised. Attackers are leveraging these stolen and compromised credentials to infiltrate corporate... Read more →

CISSPs from Around the Globe: An Interview with James Wright

The Certified Information Systems Security Professional (CISSP) certification is considered to be the gold standard in information security. This is so because of all the doors that certification opens to a CISSP professional. Those doors lead to many different types of positions and opportunities, thus making the information security community dynamic and multifaceted. In support of this, (ISC)² has launched a series of interviews to explore where CISSP certification has led security professionals. In our last interview, we met Jason Lau. In this installment, we meet James Wright. He is a cybersecurity technologist with The Walt Disney Company. He is... Read more →

READY for (ISC)² Events of the Future

(ISC)² CEO Clar Rosso recently joined Megan Gavin, director of global events, for a webinar as part of the series Inside (ISC)². The two executives candidly discussed the 2021 (ISC)² Security Congress, taking place October 18-20, as well as the future of all (ISC)² global events. Megan shared that while Security Congress is changing from hybrid to virtual, the agenda, content, number of sessions and speakers will not be impacted, and the shift provides an opportunity for us to provide another world-class virtual conference. “As much as we’re disappointed that we will not see you in person, we are dedicated... Read more →

Is the CISSP Right for Me?

No matter where you are in your cybersecurity career journey – a college graduate looking for your first professional role, an experienced staff member aiming to step into leadership, or a veteran manager wanting to expand your expertise – (ISC)² cybersecurity certifications can help you achieve your goals. With nine certifications to choose from (including our three CISSP concentrations), it may be difficult to know which qualification is right for you. The CISSP is the most well-known (ISC)² certification, with roughly 150,000 card-carrying members around the world, but that doesn’t mean it’s best for everyone. How to Know if CISSP... Read more →

CCSP Certification vs. CCAK Certificate: What Are the Distinctions?

Cloud security tops the list of technical concepts and systems those seeking a career in cybersecurity should pursue, according to the 2021 Cybersecurity Career Pursuers Study. The research also points to the benefits of upskilling current IT teams to become cybersecurity experts in the face of the worldwide skills shortage. Clearly, cloud security certification is a smart move for enterprises and individuals. But with so many credentials out there, how can you determine which one is right for you? Let’s look at two options: Certified Cloud Security Professional (CCSP) vs. Certificate of Cloud Auditing Knowledge (CCAK). Certification vs. Certificate: What... Read more →

Code Red: Hospitals Are Facing a Major Ransomware Threat

As the U.S. healthcare system struggles to cope with the COVID-19 pandemic, it has been fighting another major battle – ransomware. Nearly half (48%) of hospitals, according to a new study, have had to disconnect their networks in the past six months because of ransomware. Midsize hospitals are especially at risk, according to the study, Perspectives in Healthcare Security, conducted by Ipsos for CyberMDX and Philips. It found that while large hospitals reported an average shutdown of 6.2 hours at a cost of $21,500 per hour, midsize hospitals averaged nearly 10 hours at a cost of $45,700 per hour. The... Read more →

CCSP vs. Cloud+: How Do They Stack Up?

As more organizations move their operations to the cloud for the benefits of improved efficiency, better scalability and faster deployment, a majority (96%) of cybersecurity professionals say they are concerned about public cloud security, according to the 2021 Cloud Security Report by Cybersecurity Insiders. It comes as no surprise, then, that spikes in demand for cybersecurity professionals specializing in cloud security span the globe. For cybersecurity professionals, the incentives to pursue cloud certification are many — but so are the number of cloud cert options out there. To help narrow the pool, let’s look closely at two globally recognized, vendor-neutral... Read more →

Thinking about CAP or CISSP? Here’s How They Compare.

The Certified Authorization Professional (CAP) and Certified Information Systems Security Professional (CISSP) credentials. Both globally renowned certifications are held by experts deeply skilled and experienced in cybersecurity. What are the key distinctions you should consider if you’re weighing which one to pursue? CAP-certified security professionals have proven their skills in effectively advocating for risk management solutions to authorize systems that will support an organization’s mission within regulatory-mandated requirements. CISSP-certified professionals have been evaluated on their knowledge, skills, and ability to design, engineer, and manage an organization’s security posture. While a CISSP-credentialed professional has strong general knowledge of one regulatory requirement... Read more →

Asset Visibility – Breaking the Fourth Wall in Cybersecurity

As a cybersecurity professional, you probably spend most of your day honing your craft, refining your technical skills. While this is important, there are other focal points that should not be neglected. One of these is your responsibility to know all of the assets that are present in your organization. Achieving full asset visibility is a difficult endeavor. The inventory and classification process alone requires not only technical knowledge, but also the ability to discover those entities that are invisible to you. This is a deeper subject than the specious tool-based promises of cataloging “Shadow IT”. Asset visibility can be... Read more →

Containers in the Cloud: Key Benefits and Challenges

Container deployments are on the rise and expected to increase over the next 12 months. At the same time, container security incidents are rising exponentially. What types of security challenges are causing these events and, in turn, forcing organizations to delay application deployment? Before answering, we need to understand why security challenges are currently emerging. Containers have been around since the early 2000s, yet developers didn’t begin using them until recently. Subsequently, organizations are only now beginning to realize their potential – and four areas that make container security uniquely tricky. Read the full article. Read more →

Navigating the Troubled Waters of Risk Management

The nature of organizations is to evolve and adapt to changes and the risks associated with these changes. Businesses migrate to the cloud deploying a multitude of platforms, move their data in the cloud, and employ containerized services not only to survive change but to thrive in this challenging environment. Even though all these technological advancements benefit businesses in many ways, they equally create new risks. The cybersecurity landscape is evolving together with the technological one. Cybersecurity risks have “escaped” from the siloed environment of IT departments and have become business risks. This is where the role of a Certified... Read more →