(ISC)² Blog

Legislation Watch: 2021 State Cybersecurity Roundup and States to Watch in 2022

A Look Back at 2021 In 2021, 45 states and Puerto Rico introduced or considered 301 pieces of legislation dealing with cybersecurity. Of those 45 states, 35 enacted bills pertaining to cybersecurity. Topics covered in adopted state legislation include strengthening security measures for protecting government agencies and resources, cybersecurity training, data, ransomware, resources and the creation of task forces, studies and commissions. North Carolina became the first state to pass a law that would prohibit government entities from paying ransomware demands. Indiana passed legislation that requires reporting for all incidents related to ransomware. Both Connecticut and Utah passed bills that... Read more →

U.S. Cyber Command Operation Targets ‘Real-life Cyber Threats’

A U.S. Cyber Command (USCYBERCOM) task force has conducted “its first offensive cyber effect operation against real-life cyber threats.” Details of the operation have not been published, but the military says offensive cyberspace operations are “intended to project power by the application of force in or through cyberspace.” News of the operation, conducted by USCYBERCOM’s Cyber National Mission Force (CNMF) from February to August 2021, came in a news release from the Maryland Air National Guard’s 175th Cyber Operations Group, which took part in the mission. “USCYBERCOM’s CNMF plans, directs and synchronizes full-spectrum cyberspace operations to deter, disrupt and, if... Read more →

What's Next for Cybersecurity in 2022?

What does next year have in store for the cybersecurity industry? The “Top Five Cybersecurity Predictions for 2022” webinar presented by Steve Piper, CISSP, Founder & CEO of CyberEdge overdelivers and gives us TEN predictions for the coming year. The webinar, moderated by Brandon Dunlap, Leadership Partner, Security & Risk Management at Gartner, opens by covering the good, bad and ugly of 2021 and then moves to an engaging cybersecurity forecast for 2022. In the presentation, Steve mentions his regret in limiting the title to just five predictions, and expands upon the list by adding five honorable mentions. Top Five... Read more →

MEET THE RECIPIENTS OF THE 2021 (ISC)² GOVERNMENT PROFESSIONAL AWARD

The (ISC)² Government Professional Award recognizes government cybersecurity leaders whose commitment to excellence has helped to improve government information security and advance an in-demand workforce. The recognition is given to individuals whose initiatives have improved the areas of technology, process/policy or workforce and has led to significant developments in the security posture of a department, agency or entire government. We had a chance to learn more about the 2021 (ISC)² Government Professional Award honorees and their contributions to a safer and more secure cyber world. Asia-Pacific Region (ISC)² Government Professional Award Honoree Group Captain Amorn Chomchoey, CISSP is Acting Deputy... Read more →

House Delays U.S. Infrastructure Bill Vote – Cybersecurity Funding in Jeopardy? And What Security Practitioners Say Needs to be Prioritized

The U.S. House of Representatives was scheduled to vote on the $1.2 trillion bipartisan infrastructure bill (H.R. 3684) on September 30, but the vote has been delayed for an undetermined length of time. With roughly $1.9 billion allocated to bolstering critical infrastructure security, helping vulnerable organizations defend themselves, and providing funding for a crucial federal cyber office, key budget items hang in the balance, threatening critical infrastructure security among other priorities. (ISC)² conducted an online poll of 226 cybersecurity practitioners—nearly half of which work for an organization responsible for securing critical infrastructure data—to gauge their reaction to the infrastructure bill,... Read more →

How Will $1.9 Billion for Cybersecurity Protect American Infrastructure?

The U.S. House of Representatives is scheduled to vote on a $1 trillion bipartisan infrastructure bill on September 30, 2021. Back in August, the U.S. Senate passed the bill, which included $1.9 billion for cybersecurity initiatives. According to The Hill, the funds will go toward securing critical infrastructure against attacks, helping vulnerable organizations defend themselves and providing funding for a key federal cyber office, among other initiatives. The House is now set to vote on the bill, and if passed, it will go to the President for his signature. But what exactly are the cybersecurity provisions within the Infrastructure Investment... Read more →

Poll: Cyber Pros Say White House Cybersecurity Summit Is a Step in the Right Direction

The Biden Administration held a summit on August 25 with technology, finance, energy and education leaders to discuss ways to bolster cybersecurity, both for individual companies and the nation as a whole. Companies represented included some of technology’s biggest names such as Apple, Amazon, Google, IBM and Microsoft. Some organizations announced commitments to improve security controls and practices across the supply chain and to invest in education. Apple committed to working with suppliers to drive the adoption of measures such as multifactor authentication and event logging. Google plans to invest $10 billion on zero-trust programs, software supply chain security and... Read more →

NIST Has Come Out With Its Own Ransomware Guidance | #RansomwareWeek

As we close out #RansomwareWeek here on the (ISC)² blog, a timely piece of news comes from The National Institute of Standards and Technology (NIST) in the form of new draft guidance for organizations concerning ransomware attacks, according to reporting by Infosecurity Magazine. As the body responsible for one of the most revered standards frameworks in the world, NIST’s entry into the discussion is remarkable. According to the Infosecurity Magazine article, “The Cybersecurity Framework Profile for Ransomware Risk Management features advice on how to defend against the malware, what to do in the event of an attack, and how to... Read more →

U.S. Government Equates Threat of Ransomware with Terrorism | #RansomwareWeek

Welcome to #RansomwareWeek on the (ISC)² Blog. Ransomware attacks are receiving increased exposure in global news coverage with recent high-profile incidents at SolarWinds and Colonial Pipeline. These events have prompted many companies who previously may have felt secure in their practices to take a deeper look at their security measures and engage in deeper conversations surrounding threat management, cybercriminals, and cybersecurity training. This week we’ll be providing content resources that may be helpful to you, the reader, as your organization wrestles with ransomware prevention and remediation policies and best practices. As the first item in this week’s coverage, the massive... Read more →

Updates to the (ISC)² CAP Exam. What is Changing?

Earlier this year, we announced an upcoming update to the Certified Authorization Professional (CAP) certification. This (ISC)² certification exam will be updating on August 15, 2021. During the last Job Task Analysis (JTA), the decision was made to expand the CAP to reflect the more diverse day to day work of professionals who were earning the certification. What started built primarily for U.S. government professionals using the Risk Management Framework (RMF) has now expanded to professionals working in the private sector and or organizations around the world. We spoke with the Content Development Manager here at (ISC)², Toni Hahn, about... Read more →

FBI: Cybercrime Shot Up in 2020 Amidst Pandemic

In 2020, as the world grappled with a fast-spreading global pandemic, the FBI received more than 2,000 complaints each day, totaling 791,790 for the year. This represents a 69% increase from the previous year and a total of U.S. $4.2 billion in losses, according to data collected by the FBI’s The Internet Complaint Center (IC3). Cybercriminals employed all manner of schemes to target businesses and individuals, including phishing, spoofing and tech support fraud, the FBI reported. The costliest cybercrimes were against businesses, involving Business E-mail Compromise (BEC) schemes that added up to U.S. $1.8 billion in losses from 19,369 reported... Read more →

Biden Administration Seeks $9 Billion for Emergency Cybersecurity Improvements

The new President’s administration is asking Congress to allocate U.S. $9 billion in emergency funds to fortify the federal IT and cybersecurity infrastructure. Although cybersecurity didn’t get much attention during the presidential campaign, the move indicates that protecting federal systems from cyber attacks is a key priority and focus area for the new administration. The spending proposal is part of a COVID-19 response package proposed by the Biden administration. The sense of urgency to strengthen cybersecurity stems from a massive data breach in December 2020, which affected a number of federal agencies, including the U.S. Treasury Department and U.S. Department... Read more →

Can the U.S. election process be hacked?

While election security has been a concern for many countries, the possibility of cybersecurity threat impacting the U.S. presidential election is of top concern. (ISC)² member Dr. Carnell Council, CISSP addresses the multiple steps in the voting process that could face vulnerabilities and how each step can be better secured. With different systems, networks and devices come a different set of vulnerabilities. Dr. Council's full article can be found in Security Magazine. Read more →

Help Shape the UK Cyber Security Council by becoming a Trustee

Professionalizing the world of cybersecurity education and training is a major focus area for the UK Government, especially in the new realities we find ourselves in. It included plans in its National Cyber Security Strategy in 2016 to develop the cyber security profession, including creating a UK Cyber Security Council to focus on professional development, professional ethics, thought leadership, influence and outreach. Late last year, the Department for Digital, Culture, Media and Sport commissioned the creation of the Council through a consortium of cyber security professional bodies – including (ISC)² –known as the Cyber Security Alliance. (ISC)² has been diligently... Read more →

Study: Pandemic Boosts Cybersecurity Demand

Demand is up for cybersecurity solutions and services as businesses try to cope with the effects of the COVID-19 pandemic. In a survey of technology firms, industry association CompTIA found that customer inquiries regarding cybersecurity were up by 36% in April -- second only to inquiries about communications, collaboration and A/V technologies. The increased demand for cybersecurity and collaboration technologies makes sense in light of the sudden increase in work-from-home (WFH) numbers. The ranks of remote workers shot up as a result of stay-at-home and lockdown directives issued by governments in efforts to manage the spread of COVID-19. Recent (ISC)2... Read more →

In support of federal legislation to support our cybersecurity workforce

(ISC)² has sent a letter to Senator Jacky Rosen (D-NV) in support of proposed bipartisan legislation that would direct the Secretary of Commerce, in coordination with relevant agencies, to establish “grand challenge” competitions to achieve high-priority breakthroughs in cybersecurity, including expanding our cybersecurity workforce, defending against artificial intelligence threats, and protecting our nation against cyberattacks. The proposed Cyber Leap Act of 2020 can be read here: https://www.commerce.senate.gov/services/files/60A3EF97-3FE3-47D9-A5B9-04E2A8AE2200 In a press release issued by Senator Rosen, who is a member of the Committee on Commerce, Science, and Transportation, she said about the bill: “We put our nation at risk if we... Read more →

New York’s New Data Breach Security Laws Increase Data Privacy and Provide Security Controls Guidance

By Paul Lanois, SSCP, CIPP, CIPT, CIPM and Eric Tierling, CISSP, CIPP/E The landscape of privacy and related legislation in the United States continues to get more interesting. Despite the California Consumer Privacy Act (CCPA) being the talk of the town for privacy and security professionals, New York also put something noteworthy in place, called the “Stop Hacks and Improve Electronic Data Security Act,” or SHIELD Act, in short. Not only is it relatively prescriptive, but it also encompasses cybersecurity obligations that are particularly relevant for security professionals. The SHIELD Act of New York was signed into law in July... Read more →

A Lifeline: Patient Safety and Cybersecurity

By Lee Kim, JD, CISSP, CIPP/US, Director, Privacy and Security, HIMSS The most valuable part of the healthcare system is the patient. Patient safety is paramount in the healthcare sector. With the digitization of healthcare information, the free flow of information comes at a price. We need to be responsible stewards of healthcare information. Patients entrust us with their healthcare information and their lives. Those of us in the healthcare cybersecurity field have the unique task of protecting and securing patient information yet ensuring that the information is available on demand—especially when critical, life threatening situations arise. The Vulnerabilities of... Read more →

#ISC2Congress: Global Factors Driving Data Privacy Regulation (Part 2)

By Andrea Little Limbago, Chief Social Scientist, Virtru Limbago presented during the Governance, Risk and Compliance track at the 2019 (ISC)2 Security Congress in Orlando. The session, Global Factors Driving Data Privacy Regulation, explained data localization, how it is progressing and what that means for organizations. In two parts, Limbago recounts the information covered in her session. In the previous post, we discussed the growing influence of digital authoritarianism, which has now contributed to nine consecutive years of a decline in internet freedoms across the globe. We’ll now turn to two other competing global influences that are further shaping data... Read more →

#ISC2Congress: Global Factors Driving Data Privacy Regulation (Part 1)

By Andrea Little Limbago, Chief Social Scientist, Virtru Limbago presented during the Governance, Risk and Compliance track at the 2019 (ISC)2 Security Congress in Orlando. The session, Global Factors Driving Data Privacy Regulation, explained data localization, how it is progressing and what that means for organizations. In two parts, Limbago recounts the information covered in her session. On October 29, the internet turned 50. Despite original aspirations of a free and open internet, the modern internet is increasingly segmented and shaped by political boundaries. Included within broader technological shifts such as 5G, artificial intelligence, and the internet of things, these... Read more →