ISC2 Blog

Thinking about a Career in Cloud Security? Follow this Path.

As more critical data and assets move to the cloud, they’ve become prime targets for cybercriminals. Organizations worldwide need cloud security professionals who understand the evolving complexities to identify and mitigate security risks. Complicating matters, most are operating under a multicloud strategy that uses two or more cloud service providers. Are you ready to take your career higher into the cloud? (ISC)², creator of the leading advanced cybersecurity certification, the CISSP®, recommends these specific steps. Become an (ISC)² Candidate. Begin your journey by joining (ISC)², the world’s leading cybersecurity professional organization, more than 450,000 members, associates and candidates strong. As... Read more →

API Security Best Practices in the Hybrid Multi-Cloud Digital World

Interconnected and distributed systems have made the role of APIs critical to enabling discreet connectivity between systems but can create additional risk. By Dave Cartwright, CISSP Application Programming Interfaces (APIs) are notoriously difficult to secure, particularly if they are internet-facing. As one source puts it: “APIs are designed to facilitate communication between different systems and applications, which means they are inherently exposed to various external actors. This exposure increases the attack surface, making them attractive targets for malicious actors”. So, what can we do to make the best of a challenging concept? In a (ISC)² webinar, Byron McNaught from the... Read more →

Latest Cyberthreats and Advisories - July 21, 2023

The cybercriminal version of ChatGPT, BreachForums’ founder pleads guilty and FBI warns of tech support scam. Here are the latest threats and advisories for the week of July 21, 2023. By John Weiler Threat Advisories and Alerts CISA Factsheet Offers Security Advice for Companies Transitioning to the Cloud The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has published the Free Tools for Cloud Environments factsheet to help protect companies migrating to the cloud. The factsheet provides cloud security guidance on how organizations can safeguard their data and critical assets from vulnerabilities, anomalies and other cyberthreats. CISA has encouraged organizations to... Read more →

New cybersecurity express-learning opportunities with (ISC)² Skill-Builders

Cybersecurity never stands still. It’s a constantly evolving field that requires constant learning to stay in front of cyberthreats. (ISC)² Skill-Builders are a new way to stay current and demonstrate your knowledge of emerging cybersecurity topics. The quick, on-demand learning from cybersecurity’s leading professional organization features content created by industry experts. Learning activities focused on real-world activities ensure the content is accessible and relevant. Anyone can access the courses anytime, anywhere. (ISC)² Skill-Builders dive into the following focus areas: Entry-Level Cybersecurity Skill-Builders - Learn valuable fundamental skills as you pursue a career in cybersecurity. Cloud Security - Get up to... Read more →

Here’s how to take your career higher into the cloud

The urgency for cloud security professionals worldwide is unrelenting. Even as cloud technology advances, bad actors are becoming more sophisticated. There’s always a need for new solutions to mitigate cyberattacks. Adding to the challenges for organizations short on cloud security talent, international regulators are constantly raising the bar for operating securely in the cloud. Keeping up with this perpetual change requires continuous learning. Cybersecurity professionals must take the time to stay up-to-date in order to succeed, and that includes cloud security. For those just entering the field or seriously considering it, investing in learning is a strategic way to start... Read more →

Infosecurity Europe 2023 Preview – Our Pick of the Keynote Sessions

In the first of two previews of Infosecurity Europe 2023, we look at our top picks for unmissable keynote sessions across the three days of the conference, held at ExCel in London from June 20-22. By John E. Dunn As the pivotal cybersecurity conference in the region, every Infosecurity Europe conference is oriented to topical themes. This year is no exception, with the speaker lineup covering everything from the on-going anxiety of cyberwar, how zero trust can be made to work once it leaves the drawing board, and the never-ending puzzle of assessing supply chain risk. The following is our... Read more →

The Top Five Cloud Native Risks

By Dave Cartwright, CISSP Cloud-first strategies now the norm for most businesses, but in the rush to go cloud, mistakes were made. We look at the five biggest cloud mistakes, so you don’t repeat them. The cloud is here to stay. The days are gone of senior managers seeing the cloud as a security-risky “someone else’s network” whose security and uptime can’t be relied upon. Even risk-averse markets such as banking are adopting cloud-first strategies. According to one source, cloud spend in the banking sector is destined to increase by around 16% in the next year or so, while a... Read more →

Real Talk with CCSPs: An Interview with Shubhra Deo

Often in cybersecurity, we encounter professionals who never intended or expected to pursue security at all. In fact, when we spoke with Shubhra Deo, she revealed that her introduction to cybersecurity started as a mere curiosity. It eventually led to her gaining the experience, and sitting for two exams that earned her the CISSP, and the CCSP credentials. Her story shows how important curiosity can be in accelerating one’s career. Q: Could you tell us a little about your current job, and what attracted you to cybersecurity? A: I am currently working as a Head, Data Security & Privacy. Back... Read more →

Analysis: Cloud Native Open-Source World to Chew on SLSA 1.0, Kubernetes Flaws, and Tool Sprawl

By Joe Fay Security high on the agenda for the cloud and software supply chain world. The open-source cloud native world assembled in Amsterdam recently for the Cloud Native Computing Foundation (CNCF) Kubecon, where supply chain security and tools overload were both on the agenda. One key announcement at the Kubernetes conference was the unveiling of a fully-fledged v1.0 of SLSA (Supply Chain Levels for Software Artifacts), the Google originated supply chain security framework which is overseen by the Open Source Security Foundation. SLSA is targeted at the source and build steps of the software delivery lifecycle. The new release... Read more →

Real Talk with CCSPs: An Interview with Panagiotis Soulos

“Cloud is the present, and the future. It affects everything, every day, both in business and our personal lives.” With these words Panagiotis Soulos summarizes his philosophy of why the CCSP credential is important to any cybersecurity professional. Panagiotis holds the position of the Global Information Security Manager in Global Information Security at Intrum. We recently had the opportunity to learn more about his career. Q: What is your current position at Intrum? A: I recently changed positions, moving from Information Security Officer, into leading a new unit that will be help Intrum to manage and control all aspects of... Read more →

Can a Barista Become Your Next SOC Analyst?

Spoiler alert: the obvious answer is not always the correct one! Migrating services, apps and data to the cloud is both promising and challenging. The advantages of scalability, flexibility, reduced operational costs and supporting a hybrid workforce can be eliminated by the challenges of cloud security and talent gap. Those two challenges are closely interrelated as it is demonstrated by numerous surveys. For example, the (ISC)² Cloud Security Report 2022 indicates that: 93% of organizations are moderately to extremely concerned about the massive skills shortage of qualified cybersecurity professionals 57% admit this lack of staff expertise makes cloud compliance challenging... Read more →

Essential Team Building for Strong Cloud Security

Dependence on the cloud in the modern era is no secret. The growth in cloud applications for both professional and personal use has proved unrelenting as critical applications and services are made solely available through cloud access. In a press release, Gartner predicted a 20.4% increase in end-user spend on cloud applications in 2022, and forecasts another 20% growth in 2023. As spend increases, so does availability, creating an ongoing chicken-and-egg dynamic that will only strengthen the need for robust security measures. The Importance of Cloud Security Despite its ubiquity, cloud adoption remains a point of concern for many organizations.... Read more →

Real Talk with CCSPs An interview with Vanessa Leite, CCSP, CISSP

We often hear that cybersecurity certifications have a global reach. When we spoke with Vanessa Leite we learned how true that actually is. Vanessa holds several certifications, including vendor-specific ones, along with the CISSP and CCSP credentials from (ISC)². She exemplifies the idea of “stepping out of one’s comfort zone”. Vanessa’s joy of sharing her knowledge, as well as her thirst for continual learning, are deeply motivating. Q: What job do you do today, Vanessa? A: I am a principal cyber strategy and consulting with a Global Cyber Security company. What that means, is basically it is an executive-level role,... Read more →

Level Up Your Cloud Security Skills and Your Career Options

As organizations, applications, and users alike continue their journey toward the cloud, the demand for cybersecurity professionals with experience in cloud security increases. The knowledge and skills gap are the biggest concerns for all cloud-first organizations. According to the 2022 Cloud Security Report, lack of qualified staff is ranked as the biggest operational security headache trying to protect cloud workloads, while lack of qualified staff and knowledge was also echoed as the most challenging aspect of cloud compliance. Vendor certifications offer technical expertise The tech giants like Amazon, Google, and Microsoft, have listened to these concerns and invested an enormous... Read more →

Real Talk with CCSPs an Interview with Matt Lee, CCSP

What do you get when you cross a teacher with an entrepreneur who also has a passion for cybersecurity? You get Matt Lee. Matt is the Senior Director of Security and Compliance at Pax8, where he is a force multiplier in the mission to empower Managed Service Providers (MSP) to continue to grow in their security knowledge and operability. We recently had a chance to speak with Matt about his experiences, and to offer some solid advice to those who are looking to enhance their cloud security. Q: Could you tell us a little about your background, and how you... Read more →

Avoiding Cloud Security Fails - Excerpts from (ISC)² Security Congress 2022

By Chinatu Uzuegbu, CISSP, CEO/Managing Cyber Security Consultant at RoseTech CyberCrime Solutions Ltd. (ISC)² Security Congress 2022 was a huge success with engaging speakers from around the world filled with insights. The theme of this year’s event was Empower a Safer, More Secure Cyber World and they certainly inspired many to do so. In this blog, we would be sharing the excerpts from Top Cloud Security Fails and How to Avoid Them delivered by Karl Ots, CISSP, Head of Cloud Security, EPAM and Linkedin Learning Instructor. (ISC)² Security Congress attendees can earn CPE credits by watching this and all other... Read more →

Cloud Security and The Portable Career

Over the past two years, the workforce has changed in unimaginable ways. Hybrid work is now the norm, leadership strategies have evolved to encompass the new way of work, and workers are taking the time to decide if they actually like their job. We have witnessed the highest resignation numbers in decades – according to the World Economic Forum, 4.4 million workers left their jobs in September 2021 alone! However, the Great Resignation can be your Great Opportunity, especially if you are pursuing a career in cloud security. The Great Resignation brings Great Opportunities You have probably seen headlines about... Read more →

Real Talk with CCSPs: An interview with Jonas Björk, CCSP

What is the true value of a cybersecurity certification? Many people may underestimate the depth of knowledge that is required to earn the designation of a certified security professional. Along with that, many do not recognize the global reach of a certification. We spoke to Jonas Björk, of Cygate, which is a Swedish telecommunications organization. His decades-long passion for cybersecurity is only eclipsed by his love of skateboarding. Jonas attested to both the gravity of knowledge required, and the value of the Certified Cloud Security Professional (CCSP) credential. His sincere and candid conversation is extremely motivating. Q: What is your... Read more →

CCSP Exam – Many Changes on the Way!

On August 1, several changes will be made to the CCSP exam. We are excited to share that the CCSP exam will be available in four more languages. Currently, the CCSP exam is available in English and Japanese. We will also be offering the CCSP exam in Chinese, Korean, German and Spanish beginning in August. In addition to these new languages, we will be updating the length of the CCSP exam. As announced earlier this year for the CISSP exam, 25 pre-test (unscored) items will be added to the exams in all languages. These items do not impact the pass/fail... Read more →

CLOUD: A SHAKESPEAREAN DRAMA?

By John Iliadis, PhD, CISSP-ISSMP, CMgr MCMI, CRISC. John is an IT Infrastructure Manager; he also serves as a Board Member of (ISC)² Hellenic Chapter. Opinions expressed herein do not express the views or opinions of any third party or employer. Cloud migrations probably evoke emotions of love and hate at the same time, to most cybersecurity professionals. Going cloud (or not) presents a kind of dilemma that was first expressed some 400 years ago. Hamlet was the first one, To Cloud or Not to Cloud? The past ten years have been a turbulent period. Global financial crises emerged, while... Read more →