(ISC)² Blog

3 Pro Tips for Moving from IT to Security

Already have a background in IT? Here are three tips for moving toward a more security-focused role. Take a cue from Goldilocks: Go after the industry certification that’s “just right.” This entails pursuing a credential that helps augment technical skills with security practices. Many choose the SSCP for its balance between the foundational and technical. SSCP allows you to prove a technical understanding without having to seek a more entry-level certification. Change your perspective to layer security into the work you’re already doing. Moving from IT to security is a natural evolution. Once you’ve gained the requisite knowledge and put... Read more →

SSCP vs. CISSP Exams: How are they different?

You’re considering a cybersecurity certification and the SSCP and CISSP are both on your list. After comparing the material, you’re thinking there’s a good bit of overlap between the two. But is there, really? And if you sit for one exam would you be able to sit for the other without additional study or preparation? These are excellent questions. In fact, we hear them a lot. And the reality is, there ARE commonalities, which is true for most things in the field. However, these two certifications are wholly different and were developed from two distinct perspectives. In many ways, the... Read more →

CEOs: Cybersecurity Will Be a Major Challenge in the Coming Decade

Cybersecurity concerns remain top of mind for global CEOs as they weigh the challenges their organizations will face in the next five to 10 years. A new report by global management consultancy EY reveals that cybersecurity tops the list of concerns for CEOs, along with income inequality and job loss caused by technology advances. The findings in EY’s 2019 CEO Imperative Study confirm earlier research showing that chief executives view cybersecurity threats as one of their most daunting challenges. Adding to the problem, the EY study reveals that CEOs lack confidence in the C-suite’s ability to address these challenges. Only... Read more →

Small Businesses Not the Weakest Link in the Supply Chain, Study Shows

A new (ISC)2 study suggests that small businesses may get too much attribution for causing security breaches for their large enterprise clients. While it’s true that enterprises have suffered breaches caused by third parties, they are more likely a result of actions by a large partner, not a small business. The Securing the Partner Ecosystem study, which polled respondents both at large enterprises and small businesses, revealed about one third of enterprises (32%) have experienced a breach caused by a third party, but in these cases, large partners are more likely to blame (54%) than small business partners (46%). Only... Read more →

Cybersecurity Falls Short in Organizations Undergoing Digital Transformation

While C-level executives understand the need for cybersecurity as their organizations undergo digital transformation, they aren’t prioritizing it enough, according to a recent Deloitte report based on a survey of 500 executives. The report, “The Future of Cyber Survey 2019,” reveals a disconnect between organizational aspirations for a “cyber everywhere” future and their actual cyber posture. One area where this is evident is in budgeting, with organizations allocating only 14% of their digital transformation budgets to cybersecurity. Further evidence is how often cyber appears on the agendas of company board meetings. Cybersecurity makes it to the agenda of 49% of... Read more →

CSSLP Spotlight: John Kent

Name: John Kent Title: Manager IT, DevSecOps Employer: FedEx Location: Irving, Texas Education: BAAS Computer Science, MS Cybersecurity Years in IT: 37 Years in cybersecurity and/or privacy: 13 Cybersecurity certifications: CSSLP, CEH, CHFI How did you decide upon a career in security software development? My passion for software development began in 1981 and launched my career in 1987. It wasn’t until my first exposure to pen test results in 2005 that I understood software design, development, test and operations from a much wider perspective. There was so much more to programming than creating working software — it had to be... Read more →

Heavy Industrial Companies Grapple with Cybersecurity Problems

Companies in heavy industrial industries such as mining, oil and gas, electricity and chemicals have become a major target for cybercrime. But securing these companies is complicated as they must not only protect their IT infrastructure but also their OT (operational technology) assets. Cybersecurity solutions and tools that work in IT environments do not transfer well to the OT side, potentially harming industrial devices. “Even merely scanning these devices for vulnerabilities has led to major process disruptions,” according to a recent McKinsey article. But even though the same tools aren’t effective for both environments, links between OT and IT are... Read more →

CISSP Spotlight: Renju Damodaran

Name: Renju Damodaran Title: Senior Manager, Cyber Risk Services Employer: Wipro Limited Location: Boston, MA Education: BS, Information Systems from BITS, Pilani. Years in IT: 20 Years in cybersecurity: 16 Cybersecurity certifications: CISSP, CISA, SABSA SCF How did you decide upon a career in cybersecurity? Back in the day (early 2000s), I was involved in setting up IT infrastructure for a startup company. I started interacting with information security professionals from external consulting firms and developed an interest in security as a profession. I learned BS7799 framework and landed an information security officer role in ING Vysya Bank (now known... Read more →

SSCP Creates Point of Entry to Cyber Career

If you’re looking to break into the field of cybersecurity – and workforce research shows, we need you to join us – (ISC)²’s SSCP certification may be the way to go. Certification Magazine recently wrote about the SSCP certification as a solid point of entry for aspiring security professionals. The certification is ideal for those in “boots on the ground” positions within security operations. The SSCP exam is highly technical and focused on hands-on knowledge skills. The certification is ideal for security analysts, systems engineers, database administrators and others responsible for the day-to-day operations of securing their organizations critical assets.... Read more →

A First-Hand Experience with CISSP CAT

Patrick Strijkers is a 43-year-old information risk security officer at a pension funds firm in the Netherlands. He works in the IT security department in security incident management. Patrick’s employer runs a job rotation program, allowing him to gain experience in a variety of roles, with his next position coming invulnerability management this September. He holds the following security certifications: CompTIA Security+ CompTIA Network+ EC-Council Certified Ethical Hacker v8 EC-Council Certified Security Analyst v8 EC-Council Computer Hacking Forensics Investigator v8 Rapid7 Nexpose Rapid7 Metasploit Pro Patrick’s goal last year was to earn his CISSP certification. He attended a five-day boot... Read more →

A Growing Nuisance: How to Fend Off Bad Bots

Bad bots make up more than one third of internet traffic, and although some of them try to influence elections and feed conflict on social media, most are targeting business websites, according to a newly published report. Set loose across the internet, armies of bad bots constantly carry out a multitude of misdeeds against businesses in just about every industry. Their activities include scraping prices by competitors looking to gain an upper hand in price SEO searches, stealing proprietary content, taking over accounts with stolen credentials, perpetrating credit card fraud, skimming money from gift card accounts and executing DDoS (distributed... Read more →

Data Privacy Laws in Europe and California a Boon to Jobseekers

The sweeping new privacy law that went into effect in the European Union in May has significantly boosted demand for data protection expertise, according to job postings site Indeed. A report from the popular recruitment site found that job openings for data protection officers (DPO) have skyrocketed 829 percent since 2016 as organizations took steps to comply with the General Data Protection Regulation (GDPR). The need for the expertise is about to get even greater, thanks to a newly approved data privacy law in California, the world’s fifth largest economy. The new law was rushed through the state’s legislation to... Read more →

Don't be a sitting duck in the next OT cyberattack

By Ravindra Krishna, CISSP In a recent Operational Technology (OT) cyberattack, Monero Crypto-currency mining malware was discovered in the ICS network of a water utility company located in Europe. The company found the malware during a routine monitoring check of their OT network and confirmed that the malware infected five servers including the Human machine interface (HMI), which is used to control and manage physical components of OT networks. This attack provides further evidence that OT networks are not simply vulnerable, but actually easy targets. The Post-Stuxnet OT Cyberattack Era I believe that we can divide OT attacks into two... Read more →

Cloud Security Concerns Grow as Incidents Rise

As investments in public cloud computing continue to grow, so do cloud-related security incidents. Over the past 12 months, 18 percent of organizations have experienced a cloud security incident, double the number reported in the previous 12-month period, according to a recent report. Not surprisingly, concerns over cloud security also are rising, with more than nine out of 10 cybersecurity professionals – 91 percent, to be exact – saying they are worried about it. This, too, represents an increase from the previous polling period, when 81 percent of cybersecurity professionals expressed similar fears, and reverses a multiple-year downward trend. The... Read more →

Attacks Happen. Be Ready.

A data breach hits headquarters at 3 a.m. Are your critical assets secure? Hire (ISC)²-certified cybersecurity professionals to prepare for, prevent and recover from attacks. Read more →

Is the CISO Well Positioned to Mitigate Operational Risk?

by Tamer Gamali, CISSP, CISO Mashreq Bank, and member of the (ISC)² EMEA Advisory Council Is the CISO well positioned to mitigate operational risk? (ISC)² will be asking this probing question of Security leaders at the kick-off session for Infosecurity Europe’s Leaders Programme in London next month. A round table discussion conducted under the Chatham House Rule, the session creates an opportunity to offer up frank comment and illuminate the challenges currently hampering companies from appreciating and truly gaining control of cyber risks. Infosecurity Europe’s Leaders Programme is open to CISOs and Heads of Information Security, who are the final... Read more →

Associate of (ISC)²: Thien Phan

Name: Thien Phan (ISC)² Exams Passed: CISSP and CCSP Title: Cybersecurity, Privacy and IT Risk Associate Employer: PricewaterhouseCoopers (PwC) Location: New York City, NY, U.S.A. Education: MBA degree and Bachelor’s Degree in Management Information Systems (MIS) from Binghamton University Years in IT: 1 year Years in cybersecurity: 1 year Cybersecurity certifications: Security+, CCNA Cyber Ops How did you decide upon a career in cybersecurity? It was back in my third year of college when I interned for a multimedia company as a database administrator. I did not know much about how different technologies worked together. I was introduced to the... Read more →

Two Steps to a Robust Security Culture

By Kwinton Scarbrough, CISSP In the midst of the business and technology merge, organizations of all industries have started their journey into the cognitive era of cybersecurity. In this era, it is essential for a business to have an IT security strategy to govern how the organization will protect itself from internal and external cyber threats. However, what commonly fails to align to IT security strategy is the organization’s overall security culture. IT security strategy can only be effective if there is a strong security culture embedded into the very fabric of the company’s operations. Today, I will cover the... Read more →

HCISPP Spotlight: Debi Carr

Name: Debi Carr Title: CEO and Consultant Employer: D. K. Carr and Associates, LLC Location: Christmas, FL, U.S.A. Years in IT: 28 years Years in cybersecurity and/or privacy: 20 years Cybersecurity certifications: HCISPP, CAHIMS How did you decide upon a career in healthcare security and/or privacy? As a practice manager of a healthcare practice, I was appointed the “Privacy and Security” Officer when HIPAA went into effect. I was also responsible for overseeing the technology in the practice through the years. As a result, I began educating myself on security and privacy protocols. Why did you decide to pursue your... Read more →

People and technology: a two-pronged approach to closing the skills gap

By Wesley Simpson, COO, (ISC)² Some have called the skills gap in IT and cybersecurity a national security crisis. Yet, it’s one that most everyone in the industry doesn’t know how to solve. Many look to automation and other technologies as a solution to the problem. Others foster relationships that will fill the pipeline and attract new talent. But there is no ONE solution. Instead, organizations need to both build and buy the talent they need. The growing gap between skills needed and qualified candidates is not a problem that technology alone can solve, but it is one that is... Read more →