(ISC)² Blog

Breaches Increased in 2019, but the Number of Exposed Records Declined

The number of U.S. data breaches bumped up 17% in 2019 but despite the increase, the volume of sensitive consumer records that were exposed declined substantially by 65%, according to a newly published report. These statistics are a complete reversal of what happened in 2018, when the number of exposed consumer records soared by 126% and breaches declined by 23%, according to the Identity Theft Resource Center’s (ITRC) End-of-Year Data Breach Report for 2019 Data breaches tracked in 2019 in the United States jumped to 1,473, from 1,257 in the previous year, the report revealed. Meanwhile, 164,683,455 sensitive records were... Read more →

Register to Learn About Cybersecurity Workforce Study in CIS Webinar

This is one you won’t want to miss. (ISC)² Director of Cybersecurity Advocacy, John McCumber, will walk through the 2019 Cybersecurity Workforce Study results in a webinar hosted by the Center for Internet Security this Wednesday, February 12 at 12:30 p.m. ET. In an era of high-profile data breaches and devastating cyber attacks, cybersecurity impacts every individual and every organization. But (ISC)² research also shows that those in the field are optimistic that those challenges can be overcome if organizations take the right approach to growing the workforce and building strong cybersecurity teams. The presentation, titled “The Cybersecurity Workforce Shortage... Read more →

Security Predictions for 2020 from the (ISC)² Community of Security Professionals (Part 2)

By Diana-Lynn Contesti, CISSP-ISSAP, ISSMP, CSSLP, SSCP and John Martin, CISSP-ISSAP Continued discussion from Security Predictions for 2020 from the (ISC)² Community of Security Professionals (Part 1) Internet of Things (IoT), Industrial Internet of Things (IIoT) and Operating Technology (OT) related to the state of digital certificates The issue is not just self-signed digital certificates or expired certificates. Many of these devices have digital certificates, which need to be managed via a Key Management System and maintained. The fallout, of course, is that without proper controls, these devices can and will be compromised. Currently, the onus is on the consumer... Read more →

Security Predictions for 2020 from the (ISC)² Community of Security Professionals (Part 1)

By Diana-Lynn Contesti, CISSP-ISSAP, ISSMP, CSSLP, SSCP and John Martin, CISSP-ISSAP Cyber-attacks will impact businesses on a larger scale in 2020 and will affect those who are unprepared, whether it is attributed to human error or other disasters. In an effort to combat some of the issues faced by corporations, it is time for CEOs to grasp the mettle and officially buy-in with their security practitioners’ advice. We have all seen various vendors make predictions for Information Security for 2020. These predictions include an increase in targeted Ransomware, threats to the 2020 Elections in the U.S. and other countries, and... Read more →

Wanted: Cloud Security Skills

As demand for cloud computing grows, so does the need to secure it. In a survey of its Technology Executive Council members, CNBC found that cloud and software-defined security are among the C-suite’s top technology strategies for 2020. As reported in this video, cloud computing tops the list, and it’s followed by machine learning, artificial intelligence and software-defined security. The CNBC Technology Executive Council has nearly 150 executives in various industries, 70% of whom participated in the survey. The survey shows that securing cloud environments is a major priority – not only for the C-suite but also for cybersecurity workers.... Read more →

Switching from Other Fields to Cybersecurity Is Profitable

Here’s a bit of good news for anyone contemplating a career in cybersecurity: Cybersecurity workers who started their careers in other fields tend to get paid more than career-long cybersecurity professionals, according to new research. As reported by Security Boulevard, a survey conducted by Cynet, which makes breach detection tools, reveals that cybersecurity professionals with equivalent experience earn about the same regardless of whether they have a degree in computer science or a related engineering field. But those who started their careers outside of cybersecurity command higher salaries, a strong indication that employers – in the face of a skills... Read more →

Most Employers Don’t Pay Full Cost of Certifications

One of the most common complaints cybersecurity professionals voice about their employers is that they have to pay for certifications out of their own pockets. It’s not a trivial issue, since workers consider certifications their number one career hurdle, according the (ISC)2 Cybersecurity Workforce Study 2019. Based on study findings, most employers don’t pay their cybersecurity workers’ certification fees. Considerably fewer than half of respondents in the study (37%) say their employers pay for them while 21% say they share the cost with employers. More than one third of respondents (35%) pay for all of their own cybersecurity certification costs.... Read more →

So You Have Decided to Become Cyber Security Certified, Now What?

By Tony Vizza, CISSP, CCSP, Director for Cyber Security Advocacy - APAC at (ISC)² Toward the end of 2019, I met many aspiring women and men who approached me and said, "Tony, I want to become cyber security certified, how do I do it?" If you are reading this article, it is likely that you have made a conscious decision to do so. Congratulations on taking this step in furthering your career, skills and knowledge. You have made the decision to demonstrate to the wider world your hard-gained experience, knowledge and skills in cybersecurity and to prove to yourself that... Read more →

How Culture Makes Us Safer

As published in the September/October 2019 edition of InfoSecurity Professional Magazine By Wesley Simpson, COO There’s an untapped resource hiding in security departments that many of us may consider an intangible or even undefinable asset. When strengthened, it can have a drastic effect on an organization’s security and contribute to its overall value stream. I’m talking about building a strong culture within your cybersecurity team. There are some very tangible practices you can deploy within your team that can have a huge impact on engagement and satisfaction and make your business more secure at the same time. One way to... Read more →

How To Navigate An Uncertain Job Horizon

As published in the September/October edition of InfoSecurity Professional Magazine By Deborah Johnson Advice on how to mitigate a sudden job loss due to redundancy, recession or ‘rightsizing’. Diana Contesti was a business continuity planner at a major steel manufacturer in Hamilton, Ontario, when a recession hit the Canadian steel industry in the early 1990s. The economic contraction forced companies to cut jobs. Her employer called it “rightsizing” when leadership announced it would cut approximately 3,000 positions. The layoffs were based on seniority by department, and based on that criterion, Contesti knew she was out. “I was extremely worried. I’m... Read more →

A Lifeline: Patient Safety and Cybersecurity

By Lee Kim, JD, CISSP, CIPP/US, Director, Privacy and Security, HIMSS The most valuable part of the healthcare system is the patient. Patient safety is paramount in the healthcare sector. With the digitization of healthcare information, the free flow of information comes at a price. We need to be responsible stewards of healthcare information. Patients entrust us with their healthcare information and their lives. Those of us in the healthcare cybersecurity field have the unique task of protecting and securing patient information yet ensuring that the information is available on demand—especially when critical, life threatening situations arise. The Vulnerabilities of... Read more →

AI and Machine Learning In Demand – Top Jobs of 2019

Last week, LinkedIn released its third-annual Emerging Jobs Report, which highlights the fastest-growing jobs around the world. Topping the list in the United States is Artificial Intelligence Specialist, with 74% annual growth over the past four years. “This is the third year in a row a role related to machine learning or artificial intelligence has topped the list, and we can only expect demand to increase,” says Guy Berger, the principal economist at LinkedIn. AI is now applied across a variety of industries, including computer software, information technology and services, higher education and consumer electronics to name a few. Indeed.com... Read more →

Job Satisfaction Is High Among Cybersecurity Workers

Cybersecurity professionals face plenty of challenges in their work – there’s always something new to learn, cyber attackers are relentless and security teams are usually short-staffed. Still, nearly two-thirds of cybersecurity professionals (66%) say they are satisfied with their jobs. But that number jumps to 72% among cybersecurity workers whose employers pay for their certifications, according to the 2019 (ISC)2 Cybersecurity Workforce Study. For professionals whose organizations pay for only part or none of their certification costs, the number drops to 63%. This is an important finding for employers who are trying to build their cybersecurity teams. Currently there is... Read more →

Cyber Threats to Healthcare on the Rise

Hospitals are set up to fight infections, but not necessarily the kind that has been plaguing healthcare institutions lately – malware. A new report estimates that cyber threats against healthcare targets increased 60% since January, surpassing the total number of threats identified in all of 2018. The most common threat targeting the healthcare industry is Trojan malware, which increased 82% in the third quarter from Q2, according to the report by Malwarebytes, Cybercrime Tactics and Techniques: The 2019 State of Healthcare. Most of the Trojan attacks involved Emotet and TrickBot, which are the two most dangerous Trojans around since 2018.... Read more →

Cybersecurity Is the Top Concern for Midmarket Executives

Nearly half of midmarket executives (47%) in a newly released quarterly report cited cybersecurity as their top concern for the coming year. The Middle Market Indicator report, by Chubb and the National Center for the Middle Market (NCMM), shows that cybersecurity topped the list of concerns for the second quarter in row. The concern isn’t surprising. Any executive who pays attention to the cyber threat landscape is bound to feel trepidation about the potential for cyber attacks against their organization. A study published by The Conference Board earlier this year found that cybersecurity is the top business concern for U.S.... Read more →

Workforce Study: Most Cyber Workers Started Their Careers Elsewhere

Unlike doctors or engineers, most cybersecurity professionals didn’t set out to work in their chosen field. In fact, more than half started their careers elsewhere and eventually made the move to cybersecurity. But once they make the move, most decide to stay. Nearly two thirds of cybersecurity professionals (65%) intend to stay in the field until they retire, thanks to high demand for their skills and the challenging nature of the work, according to the (ISC)2 Cybersecurity Workforce Study, 2019. The desire to stay indicates most are finding fulfillment in the field, even if working in cybersecurity wasn’t their original... Read more →

(ISC)2 Leaders Honored by SC Magazine as Europe’s Most Influential Women in Cybersecurity

Gender diversity in the cybersecurity industry is a key issue as we seek to create a larger, more representative, balanced and welcoming industry for all. As the (ISC)2 2019 Cybersecurity Workforce Study revealed, a global shortage of more than four million trained cybersecurity professionals exists, and women represent just 30% of the current workforce, meaning recruitment and advancement of women is a strategic imperative to limiting, if not closing, the gap. A separate report by (ISC)2 published earlier this year highlighted the surge of women into senior roles, but confirmed that there remains much more work to do to both... Read more →

Some Cyber Roles are Overstaffed While Others Are Understaffed

As organizations struggle to staff their cybersecurity teams, new (ISC)2 research reveals they also may be suffering from an imbalance in the distribution of team member roles. Positions that currently appear overstaffed include compliance, forensics and operational technology security while jobs in security operations, security administration and risk management seem to be understaffed. This creates a need for CISOs and cybersecurity managers to take a close look at their teams and figure out what adjustments to make. Keeping too many people in certain roles while understaffing other positions potentially makes it harder for an organization to build and maintain effective... Read more →

Strategies for Building a Cybersecurity Dream Team

As organizations struggle to fill cybersecurity vacancies due to a worldwide shortage of 4 million professionals, they should consider implementing strategies to attract qualified candidates and prevent experienced staff from leaving. The (ISC)2 Cybersecurity Workforce Study 2019 lays out four strategies organizations should consider: Address cybersecurity team members’ needs with training and career development opportunities. Properly set internal expectations about applicant qualifications to widen the search for candidates as much as possible. Target recent college graduates and workers with degrees relevant to cybersecurity. Grow your cybersecurity team from within with further development and cross-training opportunities. All of these strategies are... Read more →

Help Wanted: Cybersecurity Workers

On November 1, 2019 CNBC’s Nightly Business Report featured the growing need for qualified cybersecurity workers in their “Help Wanted” segment. The (ISC)2 Cybersecurity Workforce Study, 2019 served as the foundation of this story, which pointed to the newly reported shortage of 4 million trained cybersecurity professionals worldwide. Cybersecurity analyst Mandi Ingersoll of TDI Security, a cybersecurity firm in Washington, D.C., began her career in cybersecurity in the U.S. Navy. She chose to stay in the field after retiring from military service. “It’s interesting because it’s always something new.” TDI’s CEO, Paul Innella, CISSP-ISSMP says the firm has had trouble... Read more →