(ISC)² Blog

Cybersecurity Industry News Review – March 21, 2023

KillNet is bad for your health, TikTok facing further bans, ransomware impacts cancer test results, Russia allegedly increasing its cyberwarfare efforts. By Joe Fay Microsoft Demonstrates How KillNet Is Bad for Our Healthcare Sector Microsoft has highlighted a rise in DDoS attacks on healthcare organizations, mapping a three-fold increase in attacks over three months. It said it tracked 10 to 20 attacks per day on healthcare organizations on Azure in November but was seeing 40 to 60 per day in February. The attack mix changed over this time, it added, with over half of attacks now being UDP floods, with... Read more →

Cybersecurity Industry News Review – March 14, 2023

The U.K. Online Safety Bill triggers a security rebuke from WhatsApp, the Czech Republic concerned about TikTok, an international law enforcement effort shuts down the NetWire RAT infrastructure, while a study suggests workforce malaise towards reporting security incidents. By Joe Fay WhatsApp Would Leave U.K. Rather Than Break Encryption WhatsApp would pull its end-to-end encrypted messaging service in the U.K., rather than submit to any requirement to weaken its privacy stance to comply with the U.K. government’s Online Safety Bill. WhatsApp chief Will Cathcart said that 98 per cent of its users were outside the U.K., and ALL users wanted... Read more →

We Heard You: Updates to the (ISC)² Ethics Questions

Earlier this year, several (ISC)² members reached out to us regarding the candidate background qualifications that we ask all individuals as part of their endorsement process after passing an (ISC)² exam. The question on our eligibility review asked candidates: “Have you ever been involved, or publicly identified, with criminal hackers or hacking?” We heard you loud and clear. Being involved in “hacking” – especially in regard to learning how systems work, researching vulnerabilities or general curiosity and learning – doesn’t make you ineligible for (ISC)² certification. The use of the term “hacker” has changed significantly over the years, and we... Read more →

Software Security Testing – Hidden Thoughts Can Cost You

Tricky Business Software development is a tricky business. When you think of all that can go wrong, the possibilities can be overwhelming. From coding errors, to borrowed libraries, to myriad other causes, the need for testing is fundamental to the development process. Testing can uncover many of the errors or oversights that can occur. Failure to effectively test prior to release can be very costly. Fortunately, the software security lifecycle includes testing methodologies to prevent many of these errors. As a security professional, understanding testing techniques is an extremely important job responsibility. If you are on the technical side of... Read more →

(ISC)² Supports NIST Encouragement of Inclusive Cybersecurity Terminology

Commonly used cybersecurity terms such as “blacklisting” and “whitelisting” may be discontinued if the National Institute of Standards and Technologies (NIST) efforts are successful. The agency wants to eliminate terms with problematic connotations from speech and written documents and replace them with neutral, more precise wording. “Using inclusive language can help people from diverse backgrounds feel more welcome and encourages precise, high quality work,” the agency explains in recently issued guidance document on the matter, NISTIR 8366. The purpose of the effort is threefold: Develop documentary standards Use inclusive language in verbal communication during meetings and negotiations Create documentation on... Read more →

Can the U.S. election process be hacked?

While election security has been a concern for many countries, the possibility of cybersecurity threat impacting the U.S. presidential election is of top concern. (ISC)² member Dr. Carnell Council, CISSP addresses the multiple steps in the voting process that could face vulnerabilities and how each step can be better secured. With different systems, networks and devices come a different set of vulnerabilities. Dr. Council's full article can be found in Security Magazine. Read more →

NY Department of Financial Services Brings First Enforcement Action under its Cybersecurity Regulation

By Paul Lanois, SSCP, CIPP, CIPT, CIPM On Tuesday, July 21, 2020, the New York Department of Financial Services (NYDFS) announced that it has brought its first enforcement action pursuant to the NYDFS Cybersecurity Regulation against a large title insurer, First American Title Insurance Company (“the Company”), alleging multiple failures to protect their consumers' sensitive personal information. According to the Statement of Charges and Notice of Hearing issued by the NYDFS, the Company maintained a database with millions of documents containing sensitive personal information, including bank account numbers and statements, mortgage and tax records, Social Security numbers, wire transaction receipts,... Read more →

A Lifeline: Patient Safety and Cybersecurity

By Lee Kim, JD, CISSP, CIPP/US, Director, Privacy and Security, HIMSS The most valuable part of the healthcare system is the patient. Patient safety is paramount in the healthcare sector. With the digitization of healthcare information, the free flow of information comes at a price. We need to be responsible stewards of healthcare information. Patients entrust us with their healthcare information and their lives. Those of us in the healthcare cybersecurity field have the unique task of protecting and securing patient information yet ensuring that the information is available on demand—especially when critical, life threatening situations arise. The Vulnerabilities of... Read more →

#ISC2Congress: Global Factors Driving Data Privacy Regulation (Part 2)

By Andrea Little Limbago, Chief Social Scientist, Virtru Limbago presented during the Governance, Risk and Compliance track at the 2019 (ISC)2 Security Congress in Orlando. The session, Global Factors Driving Data Privacy Regulation, explained data localization, how it is progressing and what that means for organizations. In two parts, Limbago recounts the information covered in her session. In the previous post, we discussed the growing influence of digital authoritarianism, which has now contributed to nine consecutive years of a decline in internet freedoms across the globe. We’ll now turn to two other competing global influences that are further shaping data... Read more →

#ISC2Congress: Global Factors Driving Data Privacy Regulation (Part 1)

By Andrea Little Limbago, Chief Social Scientist, Virtru Limbago presented during the Governance, Risk and Compliance track at the 2019 (ISC)2 Security Congress in Orlando. The session, Global Factors Driving Data Privacy Regulation, explained data localization, how it is progressing and what that means for organizations. In two parts, Limbago recounts the information covered in her session. On October 29, the internet turned 50. Despite original aspirations of a free and open internet, the modern internet is increasingly segmented and shaped by political boundaries. Included within broader technological shifts such as 5G, artificial intelligence, and the internet of things, these... Read more →

CEOs: Cybersecurity Will Be a Major Challenge in the Coming Decade

Cybersecurity concerns remain top of mind for global CEOs as they weigh the challenges their organizations will face in the next five to 10 years. A new report by global management consultancy EY reveals that cybersecurity tops the list of concerns for CEOs, along with income inequality and job loss caused by technology advances. The findings in EY’s 2019 CEO Imperative Study confirm earlier research showing that chief executives view cybersecurity threats as one of their most daunting challenges. Adding to the problem, the EY study reveals that CEOs lack confidence in the C-suite’s ability to address these challenges. Only... Read more →

GDPR – One Year On

by Dr. Sanjana Mehta, Head of Market Research Strategy - EMEA May 25 marks the first anniversary since the European Union’s General Data Protection Regulation (GDPR) came into force. After a two-year preparation process, the regulation came into effect a year ago tomorrow, harmonizing data security, data protection, data retention and data usage laws across the EU member states. It also has significant ramifications for companies outside the EU that hold personal information relating to EU citizens and organizations. Failure to comply with the GDPR can and will result in fines and other legal sanctions. The GDPR has already had... Read more →

Happy Data Privacy Day!

By Marie E. Olson, CISM, CISSP, FIP Deputy Chief Privacy Officer, The Boeing Company This year, Data Privacy Day will spotlight the value of information. Whether you’re an individual looking to better manage your privacy and how your data is collected and shared, or a business collecting, using and storing that information, remember: Personal information is like money. Value it. Protect it. Data Privacy Day began in the United States and Canada in January 2008 as an extension of the Data Protection Day celebration in Europe. Data Protection Day commemorates the January 28, 1981, signing of Convention 108, the first... Read more →

Weekly Security Headlines: Hearings, guidelines and news

New guidelines, increased government oversight, and mounting stress in cybersecurity With the 4th quarter underway, we are starting to see lots of predictions about what the cybersecurity industry can expect to see come 2018. Thinking about the future makes it easy to forget about what is happening right now, though. Let’s take a look back at the news that happened this week to remind us of where we are, before we focus too much on where we’re going. Arguably the biggest industry-wide news of the week was the Senate Commerce Committee hearing, “Protecting Consumers in the Era of Major Breaches.... Read more →

Security Headlines: World Cup, IT and everything in between

Pardon our absence on the blog this past week. Hurricane Irma had plans of her own, but we’re back in business and ready to break down the top security headlines for the week of September 11, 2017: The fear of foreign hacking is not just related to elections or national security. England is worried about World Cup information. The silver lining of Equifax is that cybersecurity stocks are up. So I guess that’s a win? Password123 is still not a good idea, but could relaxing password policy increase security? The Hill has questions about the Equifax hack. Still waiting on... Read more →

Security Headlines: Spying & Stealing

Spying, stealing, defacing. It’s been a busy week. These are the top security headlines for the week of August 28, 2017: The U.S. Navy says there’s no evidence of a cyber attack in the crash of the USS John S. McCain – but hypothetically, this is how it would work. Reuters reports cyber spies are using malware to target India and Pakistan – including decoy clickbait with Reuters reports. Yes, you read that right. Hurricane Harvey is a once in a 1,000 years disaster, but be careful before you donate. Scammers are registering domains to collect “donations” for bogus organizations.... Read more →

Being the Fly on the Wall: The latest observations from the (ISC)² Member’s GDPR Task Force

By Yves Le Roux, CISSP, CISM, Co-Chair, Europe, Middle East and Africa Advisory Council (EAC) Recently our GDPR Task Force has found that despite efforts to prepare for the incoming regulation, many practitioners are finding that there is actually a lot more to do than originally anticipated, and are still in “discovery mode” about what data they hold. Data being fragmented and contained within individual business units means that knowing where data sets reside and mapping their flow is proving challenging. Businesses have just realised the mammoth task ahead of them Many businesses are still stuck in the initial stages... Read more →

Tracking Members’ Progress with GDPR: Europe’s New Data Protection Regulation

By Yves Le Roux, Co-Chair (ISC)² EMEA Advisory Council (EAC) and Chair of its GDPR Task Force. Download the 12 Areas of Activity and their key supporting tasks The (ISC)² EMEA Advisory Council is turning to its professional membership to measure the readiness of organizations and security departments for the General Data Protection Regulation (GDPR) and highlight the challenges they are facing in the effort to become compliant by May 2018. We are doing this by bringing people who are actively working on implementation projects together either on monthly international calls and, as of this month, in face-to-face workshops hosted... Read more →

Moving to a Culture of Trust in Digital Transformation - Perspectives from the Healthcare Industry

The move to a paperless system to improve health and social care is an ambition central to many governments around the world. (ISC)² recently held a roundtable event in London, United Kingdom (UK) inviting several people who work within the sector and the country’s National Public Health Service (NHS) to explore a range of current issues, including the reasons why patients were showing a reluctance to trust efforts to protect their personal data. The aim was to bring together perspectives from many areas of the healthcare industry and give them the opportunity to talk freely and anonymously about the opportunities... Read more →

ISLA Winner: Jennifer Chermoshnyuk

The 2016 Americas Information Security Leadership Awards (ISLA®) were held in conjunction with (ISC)²’s Security Congress in Orlando, Florida in September. Jennifer Chermoshyuk, paralegal – media and technology practices, legal holds manager at the law firm of Davis Wright Tremaine in Seattle, WA was named the winner of the Up-and-Coming Information Security Professional Award. Jennifer, an alumna of the University of Washington, holds a bachelor’s degree in political science, as well as a certificate in information security and risk management from the university. The title “paralegal” may seem unique for an information security professional, but Jennifer has more than 15... Read more →