ISC2 Blog

Analysis: White House Cybersecurity Policy Maker - Secure Open Source Software Even If It Benefits ‘Adversaries’ We Should Do It Anyway

By Joe Fay Resiliency is the endgame of the U.S. approach to internet and software security. The U.S. has a vested interest in creating a secure and resilient internet and software ecosystem, even if it means its “adversaries” also benefit, a White House cybersecurity leader told the State of Open Conference in London late last week. During a panel session on international security policy, Sal Kimmich, director of open source at EscherCloudAI, AI DevSecOps, said researchers uncovering vulnerabilities could face pressure from nation states, and there needs to be a way of protecting them. Microsoft director of open source strategy,... Read more →

Analysis: Could NIST’s Cybersecurity Framework 2.0 be the beginning of international best practice?

By John E. Dunn It’s been nearly seven years since the 1.1 revision of NIST’s Cybersecurity Framework. What might be coming in version 2.0? Since its release in 2014, NIST’s Cybersecurity Framework (CSF) has grown into the one of the world’s most influential cybersecurity references for best practice and planning. In January, the world finally caught sight of the draft CSF Concept Paper that will form the basis of the next version 2.0 overhaul due for release around mid-2023. From this draft, it is clear that the CSF is developing fast, taking on new and much wider ambitions since the... Read more →

Latest Cyberthreats and Advisories - January 6, 2023

The LockBit ransomware gang apologizes, Google settles privacy lawsuits and cybercriminals impersonate brands and the U.K. government. Here are the latest threats and advisories for the week of January 6, 2023. Threat Advisories and Alerts Cybercriminals Impersonate Brands with Search Ads And Fake Sites The U.S. Federal Bureau of Investigation (FBI) has issued a warning that cybercriminals are directing internet browsers to malicious sites via search ads. How does the scam work? Bad actors build a fake website that impersonates a legitimate brand and then advertises it to appear at the top of search results. Once browsers click the ad,... Read more →

Policy Brief – U.S. Cyber Threat Intelligence, Part 2: Summary, Recommendations & Challenges

By Aaron Weathersby, CISSP. Aaron is the Chief Information Officer for Charles R. Drew University of Medicine and Science and holds a Doctor of Science in Cyber Security from Marymount University. He is an Information Technology professional with over 18 years of experience focused on cybersecurity issues. Executive Summary: This policy brief was created to summarize the Biden Administration’s Executive Order on Improving Cyber Security through the lens of Cyber Threat Intelligence. This brief is geared towards those public and private entities required to implement the mandated elements within the EO. The brief details critical findings, recommendations, and challenges with... Read more →

Policy Brief – U.S. Cyber Threat Intelligence, Part 1: Introduction & Background

By Aaron Weathersby, CISSP. Aaron is the Chief Information Officer for Charles R. Drew University of Medicine and Science and holds a Doctor of Science in Cyber Security from Marymount University. He is an Information Technology professional with over 18 years of experience focused on cybersecurity issues. Abstract: A policy brief on the May 2021 White House Executive Order 14028 requiring the improvement of the nation’s cybersecurity through the lens of Cyber Threat Intelligence. A summative read geared towards federal agencies and government contractors who must implement the order. In this brief an exploration of the current state of cybersecurity... Read more →

Working with the U.S. Government: An Overview of the U.S. Cybersecurity Maturity Model Certification

By Dustin Perkins, CISSP, Senior Governance, Risk and Compliance Consultant for the US Region of CyberCX. Cybersecurity has proven a growing interest and concern among both the private and public sectors and, for those contracted to do business with the U.S. Department of Defense, this is increasingly important with the protection of potentially sensitive information by those in the private sector. On the heels of Federal Information Security Management Act (FISMA), every government agency is hyper focused on developing a hardened level of cyber hygiene by which to mitigate as much risk as possible. The Department of Defense is fulfilling... Read more →

YOUR CYBERSECURITY EXPERIENCE IS NEEDED FOR CREATING NEW U.S. FTC REGULATIONS

The Deadline is Approaching, Your Voice Can Make a Difference in Protecting Privacy The U.S. Federal Trade Commission (FTC) is looking for public input regarding new cybersecurity regulations. (ISC)² members and trained cybersecurity professionals can provide valuable insight into best practices in protecting people’s privacy. The FTC is seeking public comment on whether it should implement new trade regulation rules or other regulatory alternatives concerning the ways in which companies collect, aggregate, protect, use, analyze, and retain consumer data, as well as transfer, share, sell, or otherwise monetize that data in ways that are unfair or deceptive. On August 22,... Read more →

New U.S. Legislation Introduced to Help Small Business Provide Cybersecurity Training

The Small Business Cybersecurity Act, S.4701 has been introduced by U.S. Sen. Maggie Hassan, D- N.H. Designed to bolster small businesses' cybersecurity by providing funding to Small Business Development Centers. In 2020, Senator Hassan worked to secure federal funding to such centers including the New Hampshire Small Business Development Center's Cybersecurity Review program. The funds can be used to help Small Business Development Centers provide cybersecurity training for small business employees and administer reviews of small business's cybersecurity. The bill would authorize $20 million in 2023 and every year thereafter to the Small Business Administration (SBA). Key aspects of the... Read more →

Submit Your Comments to NIST Regarding HIPAA Security

On July 21, The National Institute of Standards and Technology (NIST) published revised Special Publication 800-66, “Implementing the [HIPAA] Security Rule: A Cybersecurity Resource Guide,” and is accepting comments on the revised draft guidance until September 21. (ISC)² is encouraging members with expertise in this area to submit their comments on the proposed changes to NIST prior to deadline. This updated guidance is aimed at helping healthcare organizations that fall under the regulatory umbrella of the Health Insurance Portability and Accountability Act’s (HIPAA) Security Rule. According to NIST, the updated NIST SP 800-53’s latest draft has mapped all the elements... Read more →

Infosecurity Europe: A show so secure a train strike couldn’t break it!

Infosecurity Europe is unquestionably the biggest and most significant cybersecurity conference and event on the European calendar, a mainstay that is enjoyed by the entire industry and that serves as an important opportunity for members to meet each other and engage with the (ISC)² team on our stand. Like so many key industry events, Infosecurity Europe has been operating as a virtual event for the last two years due to the pandemic but made a triumphant return to physical being this year along with a move to a brand new venue. 2022 saw the show move from London’s Olympia Exhibition... Read more →

U.S. State and Federal Funding for Cybersecurity is on the Rise

Cybersecurity has come to the forefront of state and federal policy over the past few years. In 2021, there were over 285 pieces of legislation related to cybersecurity introduced in state legislative sessions. In 2022, there were over 300 pieces of legislation introduced at the state level. The White House has made it clear that increasing funding and adding additional cybersecurity initiatives is a priority of the administration. The $1.2 trillion dollar Infrastructure Investment and Jobs Act was signed by President Biden in November 2021 and included $1 billion for grants to improve state, local, tribal and territorial government cybersecurity.... Read more →

The United States Department of Justice Will no Longer Prosecute Ethical Hackers

The U.S. Department of Justice (DOJ) announced last week it will not bring charges under federal hacking laws against security researchers and ethical hackers who act in good faith. This decision stems from a landmark 2021 ruling where the Supreme Court ruled in favor of a police officer who was charged with accepting a kickback for accessing the database as a serving police officer, and another for violating the Computer Fraud and Abuse Act (CFAA). The CFAA, became law in 1986 and is widely criticized as outdated. The federal law dictates what constitutes computer hacking, specifically “unauthorized” access to a... Read more →

(ISC)2 Supports Members with Thoughtful Response to SEC Proposed Rule on Cybersecurity Reporting

On March 9, 2022, the SEC released new proposed rules relating to cybersecurity risk management, incident reporting, and disclosure for investment advisers and funds. The proposed rules would require advisers and funds to adopt and implement policies and procedures that are designed to address cybersecurity risks. Advisers and funds would be required to review and assess the design and effectiveness of their cybersecurity policies and procedures; and prepare a report describing the review, explaining the results, documenting any incident that has occurred since the last report, and discussing any material changes to the policies and procedures since the last report.... Read more →

(ISC)² Advocates for Membership – Shares Opinions on Proposed UK Standards and Pathway

In 2018, the UK’s Department for Digital, Culture, Media and Sport (DCMS) funded the creation of the UK Cyber Security Council, which launched in March 2021. The UK government will look to the council as the authority on the cyber profession as it works to implement and enforce consistent standards for the industry. In January 2022, DCMS issued a public consultation on proposals to develop the cybersecurity profession in the UK. The proposal looks to provide clarity to the industry by looking at similar established fields such as accounting, law, and engineering that already have professional standards and pathways in... Read more →

What Concerns Cyber Pros Most About the Invasion of Ukraine

As the invasion of Ukraine continues alongside a pronounced increase in online disruption aimed at the main sanction-imposing economies, speculation is rampant that a barrage of related cyberattacks on Western allies will at some point result in a mega breach or worse – an incident that may affect critical infrastructure and damage public utilities or vital data stores. To better understand how cybersecurity professionals are assessing the situation, we conducted a poll of (ISC)² members. More than 260 (ISC)²-certified cybersecurity professionals from 41 countries participated, including Ukraine and the Russian Federation. They represent 33 different industries, with the most in... Read more →

Legislation Watch: 2021 State Cybersecurity Roundup and States to Watch in 2022

A Look Back at 2021 In 2021, 45 states and Puerto Rico introduced or considered 301 pieces of legislation dealing with cybersecurity. Of those 45 states, 35 enacted bills pertaining to cybersecurity. Topics covered in adopted state legislation include strengthening security measures for protecting government agencies and resources, cybersecurity training, data, ransomware, resources and the creation of task forces, studies and commissions. North Carolina became the first state to pass a law that would prohibit government entities from paying ransomware demands. Indiana passed legislation that requires reporting for all incidents related to ransomware. Both Connecticut and Utah passed bills that... Read more →

U.S. Cyber Command Operation Targets ‘Real-life Cyber Threats’

A U.S. Cyber Command (USCYBERCOM) task force has conducted “its first offensive cyber effect operation against real-life cyber threats.” Details of the operation have not been published, but the military says offensive cyberspace operations are “intended to project power by the application of force in or through cyberspace.” News of the operation, conducted by USCYBERCOM’s Cyber National Mission Force (CNMF) from February to August 2021, came in a news release from the Maryland Air National Guard’s 175th Cyber Operations Group, which took part in the mission. “USCYBERCOM’s CNMF plans, directs and synchronizes full-spectrum cyberspace operations to deter, disrupt and, if... Read more →

What's Next for Cybersecurity in 2022?

What does next year have in store for the cybersecurity industry? The “Top Five Cybersecurity Predictions for 2022” webinar presented by Steve Piper, CISSP, Founder & CEO of CyberEdge overdelivers and gives us TEN predictions for the coming year. The webinar, moderated by Brandon Dunlap, Leadership Partner, Security & Risk Management at Gartner, opens by covering the good, bad and ugly of 2021 and then moves to an engaging cybersecurity forecast for 2022. In the presentation, Steve mentions his regret in limiting the title to just five predictions, and expands upon the list by adding five honorable mentions. Top Five... Read more →

MEET THE RECIPIENTS OF THE 2021 (ISC)² GOVERNMENT PROFESSIONAL AWARD

The (ISC)² Government Professional Award recognizes government cybersecurity leaders whose commitment to excellence has helped to improve government information security and advance an in-demand workforce. The recognition is given to individuals whose initiatives have improved the areas of technology, process/policy or workforce and has led to significant developments in the security posture of a department, agency or entire government. We had a chance to learn more about the 2021 (ISC)² Government Professional Award honorees and their contributions to a safer and more secure cyber world. Asia-Pacific Region (ISC)² Government Professional Award Honoree Group Captain Amorn Chomchoey, CISSP is Acting Deputy... Read more →

House Delays U.S. Infrastructure Bill Vote – Cybersecurity Funding in Jeopardy? And What Security Practitioners Say Needs to be Prioritized

The U.S. House of Representatives was scheduled to vote on the $1.2 trillion bipartisan infrastructure bill (H.R. 3684) on September 30, but the vote has been delayed for an undetermined length of time. With roughly $1.9 billion allocated to bolstering critical infrastructure security, helping vulnerable organizations defend themselves, and providing funding for a crucial federal cyber office, key budget items hang in the balance, threatening critical infrastructure security among other priorities. (ISC)² conducted an online poll of 226 cybersecurity practitioners—nearly half of which work for an organization responsible for securing critical infrastructure data—to gauge their reaction to the infrastructure bill,... Read more →