(ISC)² Blog

(ISC)² Closing the Cybersecurity Workforce Gap

The following letter was sent by (ISC)² CEO Clar Rosso to all (ISC)² members and associates, sharing insights into several developments at (ISC)² focused on addressing the workforce gap and creating cybersecurity career opportunities for more people worldwide. Dear Members, I hope you share my tremendous pride in our association as today we announce three significant milestones in our collective efforts to address the global workforce gap by making cybersecurity careers accessible to more people around the world. First, our newest certification, (ISC)² Certified in Cybersecurity, is now operational. More than 1,500 individuals, who passed the exam during our pilot... Read more →

Become an (ISC)² Candidate – No Exam, Experience or Fees Required

Today, (ISC)² launched a new initiative so that anyone can join our association as an (ISC)² Candidate. When you become an (ISC)² Candidate, you’ll gain access to many of the benefits and resources that (ISC)² certified members and Associates of (ISC)² enjoy – but with no exam, work experience, and, for a limited time, no fee required. Who should become an (ISC)² Candidate? We created (ISC)² Candidate for those interested in pursuing an (ISC)² certification or a career in cybersecurity. If you’re looking to join the cybersecurity workforce, this program is ideal for you! If you’ve been working in cybersecurity... Read more →

Latest Cyberthreats and Advisories - August 26, 2022

IT fiascos in healthcare, a dramatic rise in cyberattacks and an FBI warning highlight this week’s cybersecurity news. Here are the latest cybersecurity threats and advisories for the week of August 26, 2022. Threat Advisories and Alerts Credential Stuffing Attacks Target Legitimate Online Customer Accounts The FBI warns that cybercriminals are using proxies and configurations to mask credential stuffing attacks on US businesses. Credential stuffing attacks occur when stolen username and password combos are used to take over legitimate accounts. The attacks can cause victims financial loss, reputation damage and downtime. To mitigate attacks, the full IC3 report advises businesses... Read more →

Poll: Cybersecurity Professionals Want Remote Work Options

As organizations consider recalling workers back to the office, many are finding resistance – and in some cases, open revolt. Employees have become accustomed to the work-from-home (WFH) lifestyle and they aren’t necessarily willing to trade it for commutes and cubicles. Most want the choice of whether to stay home, return to the office or a combination of both, and many cybersecurity professionals are among them. A new (ISC)² member poll looks at how organizations are changing remote work policies in 2022 and what it means for worker satisfaction. The poll found the most satisfied cybersecurity professionals have the choice... Read more →

The ‘Hottest’ IT Security Technologies in 2022

Did you catch The ‘Hottest’ IT Security Technologies in 2022 webinar? If not, we are here to share the key takeaways. Steve Piper, CISSP, CEO and Founder of CyberEdge Group joined moderator Brandon Dunlap in this initial kickoff of a five-part webinar series discussing key insights from the 2022 Cyberthreat Defense Report. This webinar focused on which security technologies are most widely deployed and most planned for acquisition in 2022. The 2022 Cyberthreat Defense Report is now in its 9th year and surveys 1,200 IT security and decision-makers and practitioners in organizations of 500+ employees. The survey is designed to... Read more →

New to Cybersecurity? Use These Career Hacks to Get a Foot in the Door

The need for cybersecurity professionals has been building for years, and nearly exponentially since the beginning of the global pandemic. At this point, it’s painfully evident there’s a wide talent gap in the field, and research proves it — the global workforce needs an influx of 2.7 million cybersecurity professionals to meet demand.1 In a recent survey of cybersecurity professionals, more than three-quarters said it’s “extremely or somewhat difficult to recruit and hire security professionals.”2 A majority (95%) said the cybersecurity skills shortage and its associated impacts have not improved over the past few years, and close of half (44%)... Read more →

Black Hat USA 2022: Are Cybersecurity Tool Standards on the Way?

One of the biggest challenges cybersecurity teams face, aside from constantly having to foil threat actors, is to integrate data from the various tools they use to protect their organizations. But relief may be on the way in the form of the Open Cybersecurity Schema Framework (OCSF), which aims to establish an interoperability standard. News of the creation of OCSF came during Black Hat USA 2022 in Last Vegas last week. The framework boasts participation from 18 of the IT industry’s biggest names, including Amazon AWS, IBM, Palo Alto Networks, Splunk and Salesforce. Such a standard would simplify the lives... Read more →

(ISC)² and Others Commit to Closing the Cybersecurity Workforce Gap While at the White House

On July 19, National Cyber Director Chris Inglis hosted the National Cyber Workforce and Education Summit at the White House. The event focused on “improving skills-based pathways to cyber jobs, educating Americans” and finding solutions for bridging the cyber workforce gap. (ISC)² CEO Clar Rosso attended the summit and introduced the new (ISC)² initiative to pledge one million Certified in Cybersecurity as our global commitment to close the workforce gap and expand diversity in cyber. Attendees of the summit included government officials such as Ambassador Susan E. Rice, White House Domestic Policy Advisor; Secretary of Commerce Gina M. Raimondo; Secretary... Read more →

(ISC)² Pledges One Million Certified in Cybersecurity

At (ISC)² we are committed to positively impacting the cybersecurity industry in a big way. The board of directors and (ISC)² leadership is pleased to announce that we will provide free entry-level cybersecurity certification exams and self-paced educational program courses to one million new professionals starting a career in cybersecurity. The One Million Certified in Cybersecurity pledge is our global commitment that expands on the (ISC)² ‘100K in the UK’ initiative, which promised 100,000 free exams and course enrollments for U.K. residents earlier this year. (ISC)² CEO Clar Rosso attended the Cyber Workforce and Education Summit at the White House... Read more →

How Long Does it Take to Train Entry-Level Cybersecurity Team Members?

When hiring managers onboard new cybersecurity staff, there is typically an expectation that some learning on the job will be necessary. This is certainly the case when new hires are entry- and junior-level practitioners. But when can you expect those less-experienced new hires to perform their tasks independently? Depending on experience levels, they can be ready to contribute on their own in as little as six months, according to new research by (ISC)². The findings, published in the (ISC)² Cybersecurity Hiring Managers Guide, reveal that more than a third of hiring managers (37%) believe entry- and junior-level hires are ready... Read more →

Hiring Managers Lead on Entry-Level Cybersecurity Job Descriptions

Cybersecurity recruitment has long been a challenge, and companies often exacerbate the situation by setting unrealistic expectations, especially for entry- and junior-level roles. A common misstep is to require qualifications and years of experience that few junior jobseekers have. In an industry with a workforce gap of 2.7 million worldwide, cybersecurity teams remain understaffed, potentially putting their organizations at risk. So, it pays to have a more realistic view of what to expect when devising a strategy to attract candidates for all cybersecurity roles. Changing Expectations Hiring managers are starting to grasp the wisdom of moderating their expectations when seeking... Read more →

How can you find and retain new cybersecurity talent?

In the latest (ISC)² Think Tank webinar “How to Hire and Develop Entry- and Junior-Level Cybersecurity Practitioners” three hiring managers tackled the question of how to fill the workforce gap by sharing their insights and firsthand experiences. Jon France, (ISC)² CISO, Becky Goza, Senior Manager of Information Security for Love’s Travel Stops and Saju Thomas Paul, Head of Threat Hunting Service for Atos were guided through an engaging conversation following the recent release of the (ISC)² Cybersecurity Hiring Managers Guide by moderator Brandon Dunlap. Hiring from Within In the first live poll, panelists were surprised to see attendees report that... Read more →

Infosecurity Europe: A show so secure a train strike couldn’t break it!

Infosecurity Europe is unquestionably the biggest and most significant cybersecurity conference and event on the European calendar, a mainstay that is enjoyed by the entire industry and that serves as an important opportunity for members to meet each other and engage with the (ISC)² team on our stand. Like so many key industry events, Infosecurity Europe has been operating as a virtual event for the last two years due to the pandemic but made a triumphant return to physical being this year along with a move to a brand new venue. 2022 saw the show move from London’s Olympia Exhibition... Read more →

Unconscious Bias: How to Understand, Identify and Manage It

We all have unconscious bias. In fact, our ability to use pattern recognition and informed judgement can be a benefit in many professions, especially cybersecurity. However, unconscious biases in areas of hiring, mentoring, promoting or developing staff could hamper efforts to build the cybersecurity workforce and to diversify the individuals who make up this group. (ISC)² has partnered with Cyversity, an organization whose mission is to achieve consistent representation of women and underrepresented minorities in the cybersecurity profession, to offer a series of free webinars addressing unconscious bias. The first webinar in this series – Understanding Unconscious Bias – will... Read more →

SECURE North America | Users Aren’t the Weakest Link, They’re Your Allies

Security teams should stop treating users as the weakest link in security and, instead, turn them into allies in building a strong security culture. This was the message from Shelly Epps, HCISPP, Director of Security Program Management at Duke Health, who delivered a presentation this week at the (ISC)² SECURE North America virtual event. “If you are relying upon users for your security, you’ve effectively already failed,” she said. Instead, organizations need to develop comprehensive, multidimensional programs that keep users engaged. Traditionally, Epps said, organizations have built security programs around compliance obligations and PowerPoint-based lists. Programs tended to be punitive,... Read more →

How can your organization find and develop the next generation of cybersecurity?

Last week (ISC)² released the (ISC)² Cybersecurity Hiring Managers Guide: Best Practices for Hiring and Developing Junior Talent built on the latest research to help organizations grow their teams and retain top talent. The report highlighted the top technical skills, non-technical skills and personality attributes hiring managers seek and how organizations can benefit from unique recruiting and professional development strategies. In a recent volunteer survey, we asked members with hiring experience what trends they are seeing in the industry. Many mentioned technological shifts expedited by the pandemic including remote work, virtual interviews and hybrid work environments. They also noted a... Read more →

ENTRY-LEVEL CYBERSECURITY JOBS KEY TO SOLVING WORKFORCE GAP

Facing an acute shortage of qualified cybersecurity professionals, hiring managers are recruiting entry- and junior-level practitioners to their teams. The latest (ISC)² research captured in our Cybersecurity Hiring Managers Guide reveals this practice enables organizations to build stronger and more resilient cybersecurity teams. The findings come from a poll of 1,250 hiring cybersecurity managers who hire entry- and junior-level practitioners for small, mid-size and large organizations in the United States, Canada, United Kingdom and India. The cybersecurity skills gap currently stands at 2.7 million worldwide, forcing hiring managers to deprioritize experience when choosing candidates who show promise. Managers are less... Read more →

How can mentorship help the cybersecurity workforce gap?

The 2021 (ISC)² Cybersecurity Workforce Study suggested that the global cybersecurity workforce needs to grow 65% to effectively defend organizations’ critical assets. To protect their systems, employees and data organizations need creative solutions for recruitment, training and retention to maintain safe operations. “Many organizations continue to repeat the mistakes of focusing their time and energy on hunting down and competing for a select few cybersecurity “All Stars” instead of strategically developing their teams at all skill levels to create a sustainable, long-term investment in their security personnel.” (2021 (ISC)² Cybersecurity Pursuers Study) The 2021 (ISC)² Cybersecurity Pursuers Study found that... Read more →

Update on (ISC)² Entry-Level Cybersecurity Certification Pilot

More than 1,400 individuals have taken the new (ISC)² entry-level cybersecurity certification exam during the pilot phase which began in January 2022. Scheduling for the pilot is currently available through August 26 and anyone interested in sitting for the “no experience required” exam may do so through an authorized Pearson VUE test center. Before a certification exam becomes fully operational, the pilot tests undergo a rigorous process of exploration, research, and validation necessary to ensure the qualification meets its intended purpose. All exams administered during the pilot phase thus far are currently undergoing this review and analysis. When the pilot... Read more →

Journey Into Cybersecurity – Conversations with Cyber Newcomers, Part 2

In the second portion of this blog series, we are sharing member stories from those with four to six years of experience in cybersecurity. We asked members about their entry into cyber from their first positions to today and what advice they have for newcomers. Do you have advice for incoming cyber professionals? Weigh in on the (ISC)² Community conversation “How to start a career in cybersecurity?” Brian Bresnahan, CISSP, Senior Security Analyst | United States Prior to migrating to a security role, I programmed voice and video systems for 15+ years. I also had extensive data center experience with... Read more →