(ISC)² Blog

SSCP Creates Point of Entry to Cyber Career

If you’re looking to break into the field of cybersecurity – and workforce research shows, we need you to join us – (ISC)²’s SSCP certification may be the way to go. Certification Magazine recently wrote about the SSCP certification as a solid point of entry for aspiring security professionals. The certification is ideal for those in “boots on the ground” positions within security operations. The SSCP exam is highly technical and focused on hands-on knowledge skills. The certification is ideal for security analysts, systems engineers, database administrators and others responsible for the day-to-day operations of securing their organizations critical assets.... Read more →

A First-Hand Experience with CISSP CAT

Patrick Strijkers is a 43-year-old information risk security officer at a pension funds firm in the Netherlands. He works in the IT security department in security incident management. Patrick’s employer runs a job rotation program, allowing him to gain experience in a variety of roles, with his next position coming invulnerability management this September. He holds the following security certifications: CompTIA Security+ CompTIA Network+ EC-Council Certified Ethical Hacker v8 EC-Council Certified Security Analyst v8 EC-Council Computer Hacking Forensics Investigator v8 Rapid7 Nexpose Rapid7 Metasploit Pro Patrick’s goal last year was to earn his CISSP certification. He attended a five-day boot... Read more →

A Growing Nuisance: How to Fend Off Bad Bots

Bad bots make up more than one third of internet traffic, and although some of them try to influence elections and feed conflict on social media, most are targeting business websites, according to a newly published report. Set loose across the internet, armies of bad bots constantly carry out a multitude of misdeeds against businesses in just about every industry. Their activities include scraping prices by competitors looking to gain an upper hand in price SEO searches, stealing proprietary content, taking over accounts with stolen credentials, perpetrating credit card fraud, skimming money from gift card accounts and executing DDoS (distributed... Read more →

Data Privacy Laws in Europe and California a Boon to Jobseekers

The sweeping new privacy law that went into effect in the European Union in May has significantly boosted demand for data protection expertise, according to job postings site Indeed. A report from the popular recruitment site found that job openings for data protection officers (DPO) have skyrocketed 829 percent since 2016 as organizations took steps to comply with the General Data Protection Regulation (GDPR). The need for the expertise is about to get even greater, thanks to a newly approved data privacy law in California, the world’s fifth largest economy. The new law was rushed through the state’s legislation to... Read more →

Don't be a sitting duck in the next OT cyberattack

By Ravindra Krishna, CISSP In a recent Operational Technology (OT) cyberattack, Monero Crypto-currency mining malware was discovered in the ICS network of a water utility company located in Europe. The company found the malware during a routine monitoring check of their OT network and confirmed that the malware infected five servers including the Human machine interface (HMI), which is used to control and manage physical components of OT networks. This attack provides further evidence that OT networks are not simply vulnerable, but actually easy targets. The Post-Stuxnet OT Cyberattack Era I believe that we can divide OT attacks into two... Read more →

Cloud Security Concerns Grow as Incidents Rise

As investments in public cloud computing continue to grow, so do cloud-related security incidents. Over the past 12 months, 18 percent of organizations have experienced a cloud security incident, double the number reported in the previous 12-month period, according to a recent report. Not surprisingly, concerns over cloud security also are rising, with more than nine out of 10 cybersecurity professionals – 91 percent, to be exact – saying they are worried about it. This, too, represents an increase from the previous polling period, when 81 percent of cybersecurity professionals expressed similar fears, and reverses a multiple-year downward trend. The... Read more →

Attacks Happen. Be Ready.

A data breach hits headquarters at 3 a.m. Are your critical assets secure? Hire (ISC)²-certified cybersecurity professionals to prepare for, prevent and recover from attacks. Read more →

Is the CISO Well Positioned to Mitigate Operational Risk?

by Tamer Gamali, CISSP, CISO Mashreq Bank, and member of the (ISC)² EMEA Advisory Council Is the CISO well positioned to mitigate operational risk? (ISC)² will be asking this probing question of Security leaders at the kick-off session for Infosecurity Europe’s Leaders Programme in London next month. A round table discussion conducted under the Chatham House Rule, the session creates an opportunity to offer up frank comment and illuminate the challenges currently hampering companies from appreciating and truly gaining control of cyber risks. Infosecurity Europe’s Leaders Programme is open to CISOs and Heads of Information Security, who are the final... Read more →

Associate of (ISC)²: Thien Phan

Name: Thien Phan (ISC)² Exams Passed: CISSP and CCSP Title: Cybersecurity, Privacy and IT Risk Associate Employer: PricewaterhouseCoopers (PwC) Location: New York City, NY, U.S.A. Education: MBA degree and Bachelor’s Degree in Management Information Systems (MIS) from Binghamton University Years in IT: 1 year Years in cybersecurity: 1 year Cybersecurity certifications: Security+, CCNA Cyber Ops How did you decide upon a career in cybersecurity? It was back in my third year of college when I interned for a multimedia company as a database administrator. I did not know much about how different technologies worked together. I was introduced to the... Read more →

Two Steps to a Robust Security Culture

By Kwinton Scarbrough, CISSP In the midst of the business and technology merge, organizations of all industries have started their journey into the cognitive era of cybersecurity. In this era, it is essential for a business to have an IT security strategy to govern how the organization will protect itself from internal and external cyber threats. However, what commonly fails to align to IT security strategy is the organization’s overall security culture. IT security strategy can only be effective if there is a strong security culture embedded into the very fabric of the company’s operations. Today, I will cover the... Read more →

HCISPP Spotlight: Debi Carr

Name: Debi Carr Title: CEO and Consultant Employer: D. K. Carr and Associates, LLC Location: Christmas, FL, U.S.A. Years in IT: 28 years Years in cybersecurity and/or privacy: 20 years Cybersecurity certifications: HCISPP, CAHIMS How did you decide upon a career in healthcare security and/or privacy? As a practice manager of a healthcare practice, I was appointed the “Privacy and Security” Officer when HIPAA went into effect. I was also responsible for overseeing the technology in the practice through the years. As a result, I began educating myself on security and privacy protocols. Why did you decide to pursue your... Read more →

People and technology: a two-pronged approach to closing the skills gap

By Wesley Simpson, COO, (ISC)² Some have called the skills gap in IT and cybersecurity a national security crisis. Yet, it’s one that most everyone in the industry doesn’t know how to solve. Many look to automation and other technologies as a solution to the problem. Others foster relationships that will fill the pipeline and attract new talent. But there is no ONE solution. Instead, organizations need to both build and buy the talent they need. The growing gap between skills needed and qualified candidates is not a problem that technology alone can solve, but it is one that is... Read more →

Associate of (ISC)² Spotlight: Rachel Phillips

Name: Rachel Phillips, PMP, Assoc. (ISC)² (ISC)² Exam(s) Passed: CISSP Title: Cybersecurity Analyst Location: Seattle, WA, U.S.A. Education: M.S. Information Technology (Security and Assurance) and B.S. Business Administration (New Media and Internet), Kaplan University Years in IT: 10 Years in Cybersecurity: 3 Cybersecurity Certifications: Associate of (ISC)² Rachel Phillips, PMP, Assoc. (ISC)² is an influencer and sought-after contributor for her views and leadership in technology and security. She holds a Master’s in IT with emphasis in Information Security and Assurance, and a Bachelor’s in Business Administration from Kaplan University. As a cybersecurity analyst, she provides oversight and assurance of meeting... Read more →

Throwback Thursday: Security Congress in Austin

Last year’s Security Congress in Austin was our largest one yet with nearly 2,000 cybersecurity professionals in attendance. You know what they say, everything is bigger in Texas! Our first independent Congress featured 139 educational sessions, as well as vendors presenting in the Solutions Theater, (ISC)² member focus groups, Cloud Security Alliance (CSA) Summit and the Information Security Leadership Awards (ISLA) Americas ceremony and celebration. If you attended last year, you saw the excitement and enthusiasm from staff, speakers and attendees. If you were unable to attend, you’re in luck – you can watch some of the top sessions from... Read more →

SSCP Spotlight: Wai Sheng Cheng

Name: Wai Sheng Cheng Title: Security Analyst Employer: Cboe Global Markets Location: Kansas, U.S.A. Degree: Master of Science, Information Systems Engineering, Johns Hopkins University Years in IT: 6 Years in information security: 3 Cybersecurity certifications: SSCP How did you decide upon a career in cybersecurity? I decided on a career in cybersecurity when my email account was first compromised in 2011. I learned about this when my friends and family called to ask if I had sent out emails asking for money. As an engineer-in-training, I was curious to know why and how this had happened. It was through this... Read more →

SSCP Spotlight: Timothy Meryweather

Name: Timothy Meryweather Title: IT Auditor Location: Greater Los Angeles Area Degree: Bachelor of Science Years in information security: 6 Cybersecurity certifications: SSCP (ISACA: CISA, CRISC) How did you decide upon a career in cybersecurity? Our Audit Department’s Senior IT Auditor needed help and I was transferred from Background Licensing. Right place, right time. I possess a guardian spirit and have mostly worked in similar areas of employment: U.S. Marine, Deputy Sheriff, Police Officer, Private Security/Life Safety, casino surveillance, background licensing investigator. With my investigative training background, it was a natural migration into auditing the cybersecurity of information technology. Why... Read more →

Limited Time Opportunity: Free Forensics Lab

For a limited time, (ISC)² is excited to offer the opportunity for members to pilot an interactive, online, self-paced free CPE credit opportunity that incorporates a practical hands-on lab learning experience. This Cyber Forensics Incident Recovery lab is designed to provide you with a deeper understanding of how to extract evidence from a suspect’s hard drive. We are eager to offer this course, which includes demonstrations, hands-on lab practical application and concludes with an assessment to ensure understanding of the learning objectives. You’ll learn key concepts, watch demos, work through the hands-on lab and test your knowledge. Following completion of... Read more →

SSCP Spotlight: Simon Morgan

Name: Simon Morgan Title: IT Systems Engineer Employer: LSA Systems Ltd. Location: Billericay, U.K. Degree: HND in Computing Years in IT: 15 Years in information security: 3 Cybersecurity certifications: SSCP How did you decide upon a career in cybersecurity? Information security has always interested me. The ever-present risks that business and individuals face from cyber-attacks and threat actors drives me to try and help protect them to the best of my ability. It is an exciting field to be in that has new and interesting challenges on a daily basis. Not only this, but going forward in my career I... Read more →

CCSP Spotlight: David Schneider

Name: David Schneider Title: Senior Cyber Security Threat Engineer Employer: Garmin International Location: Olathe, KS, U.S.A. Degree: BA, BS, MS Years in IT: 20 Years in cybersecurity: 12 Cybersecurity certifications: CCSP, CISSP, CISM, CISA, GWAPT, CIS LI How did you decide upon a career in cybersecurity? I became interested in cybersecurity while doing software development. When working as a developer, I started becoming interested in secure coding methods and what I could do to make what I was working on more secure from both a technical and end-user perspectives. I started enjoying other aspects around information security and felt that... Read more →

SSCP Spotlight: Sohail Awad

Name: Sohail Awad Title: Engineer Employer: Freelancer Location: U.K. Degree: Master of Science in Computer Security Years in IT: 16 Years in information security: 12 Cybersecurity certifications: SSCP, CCNA Security, CCNA R/S What security skills and knowledge would you count as relevant to your current role, and ambitions for the future? Every skill or bit of knowledge I gain is relevant to my role as they help me to see the big picture and better tailor the solutions I create and develop. The SSCP, in essence, is designed to deliver that vision. I have found the secure programming techniques, data... Read more →