(ISC)² Blog

The Need For Eyes Everywhere – Asset Security

A Playing Field Without Any Boundaries Have you ever been assigned the task of asset security in an organization? At first glance, asset security seems pretty simple, almost boring. After all, what’s the big deal tracking some laptops and mobile phones. However, once you dive into the details of what an asset is, you may quickly find yourself with the feeling that the entire earth has become overtaken by quicksand. The asset security responsibilities of an information security professional can be so vast, as to leave one feeling that they have no firm footing. Assets are anything that imparts value... Read more →

The Digital Future Needs Cybersecurity Leaders

We’re sure you have heard this before: the rate of technological change is accelerating. It is unpredictable and unprecedented. As the World Economic Forum acknowledges, the fourth industrial revolution brings “developments in previously disjointed fields such as artificial intelligence and machine learning, robotics, nanotechnology, 3D printing and genetics and biotechnology [that] are all building on and amplifying one another.” This unprecedented disruption of society by technology introduces many changes in the workforce as well. In the words of the World Economic Forum “more than a third of the desired core skill sets of most occupations will be comprised of skills... Read more →

The Human Element of Zero Trust

One weak link in a chain is all that’s needed to topple a cyberdefense. Sometimes this comes down to an errant line of code in a hastily developed API, inadequate penetration testing, or old, unpatched, exploitable code hidden deep within a legacy system. But more often than not, it’s because of the actions of an individual – a single person who clicks on a malware payload within a phishing email, or who allows someone to physically access a workplace unchallenged, or whose work-from-home office features a Wi-Fi router that was never properly secured. Effective cybersecurity demands a zero trust platform.... Read more →

Not All Life Savers Wear White Coats

by Anastasios Arampatzis During the COVID-19 public health crisis, cyber criminals took advantage of people’s growing need for information about the pandemic to launch an increased number of attacks against healthcare providers. The exponential growth of these cyberattacks is posing a considerable threat to civil society, government institutions, and most particularly, the healthcare sector. Despite a wake-up call following the WannaCry crisis, healthcare cybersecurity still lags. As a result, in this time of emergency, cyberattacks may not only have an economic and reputational cost, they may also have an impact on human life. To help healthcare organizations focus on the... Read more →

Positive View of Cybersecurity Professionals And How To Attract People to the Field

The cybersecurity profession is suffering from a peculiarly positive perception problem: People outside the industry view the job with such high regard that it seems beyond their reach as a viable career option for themselves. The newly released 2020 (ISC)² Cybersecurity Perception Study, which polled 2,500 people across the U.S. and the U.K. who are not working in the cybersecurity field, found that the traditional image of cybersecurity professionals as mysterious characters working in the shadows has been replaced by one of smart, talented people and the “good guys fighting cybercrime.” It’s a welcome change for those in the industry... Read more →

Remote Working Underscores the Need for Qualified Cybersecurity Professionals

Remote working is here to stay The COVID-19 pandemic has brought many changes to our lives: social distancing, face masks, and WFH (work from home). Based on health scientists’ advice to protect society and driven by the need to maintain business continuity, private and public sector organizations have directed their employees to work from home. The change in work habits is enormous: according to the Bureau of Labor Statistics, only 29 percent of Americans were able to work from home before the COVID-19 era. However, remote working is here to stay. According to a recent Gartner survey, 74% of enterprises... Read more →

Keeping Your Cup From Overflowing

As published in the July/August 2020 edition of InfoSecurity Professional Magazine By Michael M. Hanna, CISSP Defenders of the cyber domain carry a significant weight because of the demands placed upon them. In addition to the technical skills needed to protect companies and entire communities, cybersecurity professionals must have the know-how to protect information systems and data that support national security requirements, critical infrastructure and/or sensitive customer details. Our actions directly serve to protect and sup-port our families, significant others, friends and colleagues. These responsibilities surely carry a weight for us all and incur considerable stress. How could they not?... Read more →

under pressure. under control.

As published in the July/August 2020 edition of InfoSecurity Professional Magazine By Deborah Johnson How to stay sane and manage stress during a most unusual time, no matter where you live and work. Every day, cybersecurity professionals face pressure, from the daily demands of protecting data and people’s privacy to the worst-case scenarios of a breach’s financial and reputational repercussions. That’s nothing we didn’t already know. But what’s changed in the past six months is the level and severity of those demands since the world’s response to COVID-19 required companies, citizens and cybersecurity professionals to abruptly pivot in almost all... Read more →

The Value of CSSLP Certification Is Surging

The (ISC)² Certified Secure Software Lifecycle Professional (CSSLP) certification has earned a place in a list of 10 IT certifications with the most increased value over the past year. Researcher Foote Partners collected compensation data from more than 3,300 employers in the U.S. and Canada to compile the list as part of its 2020 IT Skills and Certifications Pay Index report. The index calculates certification value based on the percentage of salary that accounts for a certification. CSSLP holders earn 13% on top of their base salary, according to the research. The index gives holders – or those planning to... Read more →

Same as It Ever Was: The Catch-22 of Cybersecurity Experience Remains a Problem

The Catch-22 that has affected the cybersecurity profession since its inception remains a serious problem, according to a newly released report. To get a job in cybersecurity, many organizations require hands-on experience, but gaining that experience requires having a previous cybersecurity position in the first place. This conundrum is a challenge cybersecurity talent is fighting to overcome. The report is based on a study of 327 cybersecurity professionals in late 2019 and early 2020 by the Enterprise Strategy Group (ESG) for the Information Systems Security Association (ISSA). The findings underscore the need for more training and certification, and more creative... Read more →

The 7 Benefits of SSCP to Highly Successful Security Practitioners

In a world that is constantly changing, the immediate future of emerging technologies looks exciting and promising. Rapid advances over the next five years may help humanity solve some of the biggest challenges like the climate crisis, our ability to cure illnesses, understanding the universe and our microcosmos, and improving productivity through business automation. Despite the obvious benefits technology brings, it has also created many cybersecurity and privacy challenges. The overall business risk has increased because of the changing and expanding threat landscape. Cyber criminals are also leveraging these technologies to launch their malicious actions, which are more sophisticated than... Read more →

Why Cybersecurity is a Great Choice for an Exciting Career

Cybersecurity is becoming increasingly important as more businesses collect, share, and use more and more data as part of their practices. The news headlines have been dominated by security incidents affecting the personal data of millions of people around the world. The importance of cybersecurity is underscored by the cost of a breach, with IBM estimating the average cost of a data breach in the United States being $8.19 million. Zero unemployment is not a dream! The cybersecurity industry has a zero percent unemployment, which make it an attractive statistic. It certainly is a great reason for everyone, either IT... Read more →

Help Shape the UK Cyber Security Council by becoming a Trustee

Professionalizing the world of cybersecurity education and training is a major focus area for the UK Government, especially in the new realities we find ourselves in. It included plans in its National Cyber Security Strategy in 2016 to develop the cyber security profession, including creating a UK Cyber Security Council to focus on professional development, professional ethics, thought leadership, influence and outreach. Late last year, the Department for Digital, Culture, Media and Sport commissioned the creation of the Council through a consortium of cyber security professional bodies – including (ISC)² –known as the Cyber Security Alliance. (ISC)² has been diligently... Read more →

Advice from 3 Cyber Pros on Getting Certified

There is no question that now is a great time to break into cybersecurity as a career. (ISC)² research shows the shortage of skilled security resources is approaching 3 million globally. Getting into this line of work can be approached from many different angles. Whether you are an experienced professional looking to make a pivot into security or a college student exploring the field, the right preparation, network and credentials can make all the difference. We asked three cyber professionals about their journey into security and the advice they would give to up-and-comers in the field. Here’s what they shared.... Read more →

Report: Cybersecurity Understaffing Lowers Ability to Handle Cyber Threats

Understaffing in cybersecurity teams remains a major challenge for organizations, with 62% of respondents in a recent ISACA survey saying they are struggling with it. And even though the number of understaffed organizations fell by seven percentage points from last year, staffing issues are making some organizations more vulnerable to cyberattacks. Concerns over the ability to respond to threats are widespread, according to ISACA’s State of Cybersecurity 2020 Survey Part 2 report, which gathered responses from 2,000 respondents in 102 countries. Only 21% of respondents in “significantly understaffed” organizations say they are completely or very confident in their organization’s ability... Read more →

10 Critical Skills for the Cybersecurity Workforce

With breach rates growing and cyberattacks becoming a daily occurrence for business, IT leaders are looking to beef up their security teams. This is good news for anyone who is considering a career in information security. But as new talent begins to navigate breaking into the field, many may wonder: What skills should I focus on developing for a security career? Most security hiring managers are looking for a blend of skills and backgrounds. Here are 10 things you need to enter the cybersecurity workforce today. Technical prowess While some career paths in security may not require technical skills, many... Read more →

Study: Pandemic Boosts Cybersecurity Demand

Demand is up for cybersecurity solutions and services as businesses try to cope with the effects of the COVID-19 pandemic. In a survey of technology firms, industry association CompTIA found that customer inquiries regarding cybersecurity were up by 36% in April -- second only to inquiries about communications, collaboration and A/V technologies. The increased demand for cybersecurity and collaboration technologies makes sense in light of the sudden increase in work-from-home (WFH) numbers. The ranks of remote workers shot up as a result of stay-at-home and lockdown directives issued by governments in efforts to manage the spread of COVID-19. Recent (ISC)2... Read more →

In support of federal legislation to support our cybersecurity workforce

(ISC)² has sent a letter to Senator Jacky Rosen (D-NV) in support of proposed bipartisan legislation that would direct the Secretary of Commerce, in coordination with relevant agencies, to establish “grand challenge” competitions to achieve high-priority breakthroughs in cybersecurity, including expanding our cybersecurity workforce, defending against artificial intelligence threats, and protecting our nation against cyberattacks. The proposed Cyber Leap Act of 2020 can be read here: https://www.commerce.senate.gov/services/files/60A3EF97-3FE3-47D9-A5B9-04E2A8AE2200 In a press release issued by Senator Rosen, who is a member of the Committee on Commerce, Science, and Transportation, she said about the bill: “We put our nation at risk if we... Read more →

5 Ways to Break Down the Cybersecurity Experience Barrier

Appropriate experience is one of the biggest hurdles to overcome when trying to land a job in information security. In fact, a poll from Tripwire finds most job seekers (80%) say they need more experience to be considered for many of the roles they apply for in infosec. The survey, conducted via Twitter, also found lack of certification or appropriate training (20%) were other issues keeping people from security jobs. There’s no question landing that first gig in security can be difficult. But there are practical ways to stand out and get the attention of hiring managers, even without a... Read more →

Bank On It

As published in the March/April 2020 edition of InfoSecurity Professional Magazine By Shaun Aghili, DBA, CISSP-ISSMP, CCSP, CISA and Bobby Swar, Ph.D. In May 2018, two major banks in Canada—Bank of Montreal and Canadian Imperial Bank of Commerce—received email threats from malicious hackers claiming to have gained access to customers’ sensitive information. The attackers demanded $1 million in cryptocurrency from each bank or they would publicly release customers’ information. The successful attacks on these banks led to 90,000 customers’ account information being compromised and an undisclosed amount of money lost as the result of the security breaches. In recent years,... Read more →