ISC2 Blog

(ISC)² DEI Summit: Amplifying Our Impact

(ISC)² held its first annual global DEI summit on Wednesday, July 12, at George Mason University in Arlington, Virginia. The theme of the in-person summit, "Amplifying Our Impact: Advancing DEIB in Cybersecurity," brought cybersecurity leaders together to discuss how they can ensure the cyber ecosystem is a more diverse, equitable, and inclusive space for incoming and existing talent. The all-day event fostered a unique opportunity for professionals in the government, nonprofits, academia and the private industry to learn insightful information from peers who hail from places around the world, such as Australia, Europe, and Africa. Attendees gained a deeper understanding... Read more →

SEC Votes To Adopt Rules Expanding Cybersecurity Reach and Disclosure

By Tara Wisniewski, EVP, Advocacy, Global Markets and Member Engagement, (ISC)² Summary The U.S. Securities and Exchange Commission (SEC) last week voted to adopt significant new rules relating to how publicly traded companies act and disclose cybersecurity-related risk and incidents. While U.S. healthcare providers, financial services firms and other critical infrastructure operators must, by law, report data and network breaches, no all-encompassing U.S. federal breach or incident disclosure law currently exists. However, the new rules passed by the SEC commissioners leave considerable ambiguity, particularly regarding the definition and measure of risk, along with not making a definitive ruling on cybersecurity... Read more →

Critical Next Steps for Transitioning Military

Transitioning military personnel - come to learn valuable insights from a panel of recruitment experts as they discuss “Critical Next Steps for Transitioning Military '' on Thursday, October 26 at 3:05 pm CT in the Career Center at (ISC)2 Security Congress. Meet the Panel This military transition discussion will feature Kirsten Renner, Tiffany Robbins, and Michael McCoy. Kirsten Renner, Talent Engagement Lead at Accenture Federal Services is a passionate supporter of active-duty service members, veterans, and transitioning military job seekers, in addition to being a proud Army mom. Kirsten has a history of providing resume reviews and guidance to transitioning... Read more →

Latest Cyberthreats and Advisories - July 28, 2023

The myth of Mac’s malware invincibility, ransomware attacks skyrocketed in June and North Korean actors found to be behind the JumpCloud breach. Here are the latest threats and advisories for the week of July 28, 2023. Threat Advisories and Alerts Vulnerability Leaves 900,000 MikroTik Routers Open to Attack An estimated 900,000 MikroTik routers may be vulnerable to attack due to a new security flaw. The vulnerability (CVE-2023-30788) can provide cybercriminals entry into an organization’s network. "The worst-case scenario is that an attacker can install and execute arbitrary tools on the underlying Linux operating system," said security researcher Jacob Baines. Considering... Read more →

Cybersecurity Industry News Review – July 18, 2023

Are cybersecurity professionals able to shape policy, the White House tackles smart device quality standards, the MOVEit breach keeps moving and a new resource for understanding maritime cyber threats. Survey To Look at Involvement of Cybersecurity Professionals in UK Policy Development Jen Ellis, founder of NextJenSecurity and also an Advisory Board Member for the U.K. Cabinet Office's Government Cybersecurity Advisory Board has launched a survey and is looking to understand the extent of involvement of frontline cybersecurity professionals in the U.K.’s cybersecurity policymaking process. This survey investigates whether cybersecurity professionals in the U.K. are interested in participating in, and have... Read more →

Report Finds Up To One In 10 Data Breaches Caused By Developers And Sysadmins

Errors by developers and sysadmins emerged as an important data breach cause in Verizon’s 2023 Data Breach Investigations Report (DBIR). What the report doesn’t mention is the increased pressure on professionals to stop data breaches at a time of skills shortages and budget caps. By John E. Dunn “If only business networks didn’t have users to worry about. Cyberattacks would be a thing of the past,” is a mildly subversive thought that must have crossed the minds of most sysadmins in a darker moment. It’s widely understood that users do things they shouldn’t do, including bypassing, ignoring or misunderstanding security... Read more →

Infosecurity Europe: Are Universities Turning Out Cyber Graduates with The Right Skills?

Are today’s graduates being trained to cope with future challenges? A panel of practitioners debated whether current graduates are coming away with what they need to progress. By John E. Dunn If you’re looking to hire cybersecurity people, it’s easy to devote all your attention to today’s skills problems. The biggest of these right now is simply a lack of candidates with the right skills and qualifications. This drives up costs in an industry that has yet to reach a consensus on how shortages might be addressed without simply kicking the problem into the deep future. Next, you have to... Read more →

Infosecurity Europe: Are Certifications a Barrier to Widening the Cybersecurity Talent Pool?

Is the importance of certifications at risk of turning them into check box hiring aids for organizations in a hurry? A CISO panel at this week’s Infosecurity Europe conference weighed up the arguments. By John E. Dunn Certifications are a signal of personal achievement, professional development, and hiring credibility. But at a time of skills shortages are they at risk of being misunderstood and misapplied in ways that might sometimes turn them into a barrier to better cybersecurity? It’s a complex topic that was given an airing at this week’s Infosecurity Europe conference session What’s the Point of Cyber Security Certifications?... Read more →

Creating a Platform for Women to Excel in Cybersecurity

By Santosh Rajashekar, CISSP The field of cybersecurity plays a crucial role in safeguarding our increasingly digitalized world against cyber threats. However, it has historically been dominated by men, resulting in significant underrepresentation of women and non-binary. This lack of diversity hampers innovation and limits the industry's potential, creating a knowledge and skills gap that could otherwise benefit the field of cybersecurity. Despite efforts to encourage women to join the industry, barriers to entry and inadequate support persist. Women in cybersecurity often encounter gender bias, a scarcity of mentorship opportunities, and limited access to resources that could facilitate career advancement.... Read more →

Here’s how to take your career higher into the cloud

The urgency for cloud security professionals worldwide is unrelenting. Even as cloud technology advances, bad actors are becoming more sophisticated. There’s always a need for new solutions to mitigate cyberattacks. Adding to the challenges for organizations short on cloud security talent, international regulators are constantly raising the bar for operating securely in the cloud. Keeping up with this perpetual change requires continuous learning. Cybersecurity professionals must take the time to stay up-to-date in order to succeed, and that includes cloud security. For those just entering the field or seriously considering it, investing in learning is a strategic way to start... Read more →

Dark Reading Unveils Inaugural CISO Advisory Board

Industry panel underlines the value of certification as majority are CISSPs. By Joe Fay Cybersecurity publication and community Dark Reading has announced the members of its first CISO Advisory Board, who will help advise its staff and journalists, ensuring the views of real-world cybersecurity professionals are recognized. Kelly Jackson Higgins, Editor-in-Chief of Dark Reading, said in a statement that the Advisory Board would deliver direct insights on the security issues facing all types of organizations. “Our editors will then apply this crucial, first-hand knowledge to continue to deliver meaningful content for our readers.” The Advisory Board also highlights the important... Read more →

Cybersecurity Industry News Review - June 6, 2023

$400 million fund for AI and robotics start-ups, OpenAI to fund cybersecurity efforts while research shows that cybercriminals are targeting the friends and families of high-value organization executives. By Chris Green IQ Capital Gears Up For ‘Deep Tech’ Investment London-based venture investor IQ Capital has successfully raised $400 million (£320 million) across two funds, which it plans to invest in an array of so-called ‘deep tech’ start-ups focused on tech areas including artificial intelligence (AI), robotics, quantum computing and others. The venture capital firm primarily invests in seed to Series A stage startups in the UK and Europe. Its previous... Read more →

Infosecurity Europe 2023 Preview – Our Pick of the Keynote Sessions

In the first of two previews of Infosecurity Europe 2023, we look at our top picks for unmissable keynote sessions across the three days of the conference, held at ExCel in London from June 20-22. By John E. Dunn As the pivotal cybersecurity conference in the region, every Infosecurity Europe conference is oriented to topical themes. This year is no exception, with the speaker lineup covering everything from the on-going anxiety of cyberwar, how zero trust can be made to work once it leaves the drawing board, and the never-ending puzzle of assessing supply chain risk. The following is our... Read more →

Eliminating Stigma Around Mental Health in the Cybersecurity Profession

May is Mental Health Awareness Month, a time to promote education about mental wellness and reduce stigma surrounding mental health issues. In professions like cybersecurity, where workers can become overwhelmed while combating constant cyber threats or experience burnout from working long hours, it’s important to recognize when you need to take a step back and prioritize your mental health. There is still a lot of stigma surrounding discussions of mental health, especially in the workplace. Given that mental health issues are very personal, we don’t often discuss them at work, which can lead many people to suffer in silence. Sharing... Read more →

Practitioners Point to Zero Trust As Key To User Access Security

By Chris Green Nearly 4,000 cybersecurity professionals weighed in and 55% feel Zero Trust is the most impactful to keep organizations secure. The debate over the most effective form of access control has been waging for as long as computers have had individual logins. Whether its passwords, two-factor authentication, location-based authentication, password-less login – the debate is split. Or is it? In a survey conducted by (ISC)² on LinkedIn ahead of World Password Day revealed the extent to which zero trust policies are being embraced as part of stricter authentication practices. The poll of nearly 4,000 cybersecurity professionals revealed that... Read more →

Beyond Username and Password: Protecting Your Digital Identity

By Elango Balusamy, CC Elango is an accomplished technology leader with 20+ years of experience building high-performance engineering organizations for high-tech and financial services businesses across multiple geographies. With an in-depth understanding of governance, compliance, regulatory, and cybersecurity requirements of ASEAN markets. In today's digital age, we use a multitude of digital products and services, one thing common across them is how we identify ourselves in the digital world. Username and password was the de facto standard to prove identity, with the growth of the digital landscape, newer and sophisticated techniques are catching up. While Single Sign On (SSO) and... Read more →

Password Myths vs. Reality

By Er. Tapan Jatakia, CC Tapan is a researcher, innovator, mentor and advisor in the domains of cybersecurity and threat intelligence with a passion for interweaving data science, machine learning and artificial intelligence along with IT/cybersecurity to study and conduct research and development. World Password Day is an annual event celebrated on the first Thursday of May to promote password security awareness and best practices. May 7, 2013, marked the first observance of World Password Day, which aims to raise awareness about the significance of employing robust, distinct, and intricate passwords for safeguarding online accounts and personal data. World Password... Read more →

CYBERUK Day 2: AI Developments Could Democratize Advanced Cyber-Capabilities, Says Security Minister

Nation state attacks, the rapid evolution of cybersecurity attacks and the technology behind them pose a sustained risk to the U.K. and its allies unless new defensive capabilities are brought to the fore. By John E. Dunn The U.K. must rapidly develop cybersecurity capabilities if it is to hold back cybercriminals energized by nation state programs, new business models in ransomware, and the rapid evolution of artificial general intelligence (AGI), minister of state for security Tom Tugendhat, MP told the CYBERUK conference in Belfast. Opening the second day of the National Cyber Security Centre (NCSC) annual industry conference, Tugendhat painted... Read more →

#IdentityManagementDay - Best Practices to Help Keep Your Organization Secure

By Chinatu Uzuegbu, CISSP, CEO/Managing Cyber Security Consultant at RoseTech CyberCrime Solutions Ltd. We kicked off the Identity and Access Management Processes from the Top-Level Management approach. The Identity and Access Management Security Steering Committee is a group of C-Suites leaders, also referred to as the respective Data and Asset Owners from the various Business Units of my organization. The group met and established the governing policy around the Identity and Access Management Processes. The governance covers the Mandatory Access Control Policy and Trust Policy of the organization which are automatically enforced as the baselines on default. The governance of... Read more →

(ISC)² Supports Cyber Newcomers

With more than 14,000 new Certified in Cybersecurity members joining (ISC)² last year and an additional 180,000+ Candidates gearing up to earn their first certification, (ISC)² will be supporting these cyber newcomers every step of the way. Recently, the Center for Cyber Safety and Education held its first Birds of a Feather: Newbies in Cyber webinar to promote an open dialogue and space for those leaning toward a career in cybersecurity, career changers and anyone interested in joining the field with questions. Within this conversation, we heard many of the questions and concerns that have been echoed across our social... Read more →