(ISC)² Blog

Is Your Security Team Cloud Ready?

Cloud services play a key role in the digital transformation and operation of today’s enterprises. Yet security teams are often left out of planning these initiatives, increasing the level of risk organizations will face. Security is an integral part of adopting cloud services, without being a barrier to innovation. More and more enterprises are migrating their data and applications to the cloud. The variations in implementations and environments create a level of complexity for IT security teams to monitor cloud services while keeping them secure. Is your internal team poised to shape secure cloud strategy and innovation? If it isn’t,... Read more →

Report: Impact of COVID-19 on Enterprise IT Security Teams

How has the COVID-19 pandemic affected enterprise IT security organizations around the world? And how are they rethinking their priorities and investments as a result? Find answers and insights inside CyberEdge Group’s Impact of COVID-19 on Enterprise IT Security Teams Report, sponsored by (ISC)². This comprehensive survey of 600 cybersecurity professionals representing 7 countries and 19 industries reveals an in-depth study of how COVID-19 has altered enterprises and how they are responding. The research shows: A 114% increase in remote workers during the pandemic 67% of responding organizations are experiencing IT security staffing challenges 75% claim COVID-19 has increased their... Read more →

Can I Ask You A Question?

The Many Advisory Roles of a CISSP A Long and Prosperous Career Throughout your cybersecurity career, you will spend a lot of time in the world of identify, protect, detect, respond, and recover. Sometimes, the skills required for the job can range from the mundane, such as running a phishing campaign, to some nail-biting, all-nighters of remediation (after someone ignored your carefully crafted phishing campaign and clicked on a malicious link). Your skills were not easily acquired. Perhaps you derived these skills from tinkering with machinery, dumpster-diving, and everything in between. Information security research has transitioned to more sophisticated tools... Read more →

Patch Management in IT and OT Environments

The evolution of the cyber threat landscape highlights the emerging need for organizations to strengthen their ability to identify, analyze, and evaluate cyber risks before they evolve into security incidents. Although the terms “patch management” and “vulnerability management” are used as if they are interchangeable, this is not the case. Most are confused because applying patches is one of the many ways available in our arsenal to mitigate cyber risks. What is Patch Management? Patch management is a strategy for managing patches or upgrades for software applications and technologies and involves the acquisition, testing, and installation of multiple patches to... Read more →

What Do You Do When No One Is Watching

The Internal and External Struggles of Ethics and the CISSP Credential As Old As Mythology All students of information security have heard of the Caesar cipher and the Spartan Scytale. These early encryption methods demonstrate the craftiness of the human mind. Encryption has evolved and become more sophisticated. Encryption has been instrumental in the advancement of society. Can you think of another ancient mental construct of humanity that has remained static, yet is no less important to the functioning of society? Let’s consider the topic of ethics. The concept of ethics has existed since ancient times, and the subject is... Read more →

How Do Security Controls Help Implement a Corporate Security Policy?

A corporate security policy is the cornerstone document of a company’s risk management. Does your business have the appropriate security controls in place to implement the policy, or is the policy a forgotten document in a dusty drawer? Although most companies have established security policies at the strategic level these are not always enforced, because they lack foundational support at the tactical level. The key to solving this is knowledgeable and skilled security practitioners who can take the lead and implement security controls aligned to the policy’s goals. Many security incidents may have been avoided if the proper security controls... Read more →

The HR Manager's Guide to Mitigating Cyber Attacks in Healthcare

by Anastasios Arampatzis Cyberattacks in the Healthcare Industry are Increasing The use of technology in the healthcare sector can be both life-saving and life-threatening. Advancements in technology, like 3D printing, virtual reality, robotics, and Internet of Medical Things (IoMT), improve the ability of healthcare organizations to provide better care for their patients. At the same time, criminals leverage this new technology to execute their malevolent causes by either stealing protected health information (PHI) and other sensitive data or disrupting the operation of healthcare providers. The recent COVID-19 pandemic serves as a good example of the attack vectors criminals are using.... Read more →

The Need For Eyes Everywhere – Asset Security

A Playing Field Without Any Boundaries Have you ever been assigned the task of asset security in an organization? At first glance, asset security seems pretty simple, almost boring. After all, what’s the big deal tracking some laptops and mobile phones. However, once you dive into the details of what an asset is, you may quickly find yourself with the feeling that the entire earth has become overtaken by quicksand. The asset security responsibilities of an information security professional can be so vast, as to leave one feeling that they have no firm footing. Assets are anything that imparts value... Read more →

How to Get the Experience You Need to Pursue SSCP Certification

By David Bisson All IT professionals who want a lucrative career should consider expanding their skill set to include security. Now is an opportune time to do so, because security is continuing to grow in importance for businesses and organizations. As noted in “Why Add Security to Your Skill Set and How to Do It,” about 44% of corporate boards participate in their organization’s digital security strategy. An even greater proportion (58%) receive security briefings on at least a quarterly basis. Boards are paying greater attention to security so that they can help keep their organizations out of the headlines.... Read more →

The Digital Future Needs Cybersecurity Leaders

We’re sure you have heard this before: the rate of technological change is accelerating. It is unpredictable and unprecedented. As the World Economic Forum acknowledges, the fourth industrial revolution brings “developments in previously disjointed fields such as artificial intelligence and machine learning, robotics, nanotechnology, 3D printing and genetics and biotechnology [that] are all building on and amplifying one another.” This unprecedented disruption of society by technology introduces many changes in the workforce as well. In the words of the World Economic Forum “more than a third of the desired core skill sets of most occupations will be comprised of skills... Read more →

The Human Element of Zero Trust

One weak link in a chain is all that’s needed to topple a cyberdefense. Sometimes this comes down to an errant line of code in a hastily developed API, inadequate penetration testing, or old, unpatched, exploitable code hidden deep within a legacy system. But more often than not, it’s because of the actions of an individual – a single person who clicks on a malware payload within a phishing email, or who allows someone to physically access a workplace unchallenged, or whose work-from-home office features a Wi-Fi router that was never properly secured. Effective cybersecurity demands a zero trust platform.... Read more →

How Important Is Cybersecurity in M&A?

Even though cybersecurity considerations have become part of the mergers and acquisitions (M&A) process, data breaches remain commonplace at acquired companies, raising suspicions that cybersecurity doesn’t get as much attention as it should, according to a recent TechCrunch article. “The fact that data breaches are still increasing and can cause negative financial impact that will be felt long after the deal has closed highlights a greater need for acquirers to continue to improve their approach and address cyber threats,” the article says. The author makes it a point to mention that “past or potential cyber threats are no longer ignored... Read more →

Can the U.S. election process be hacked?

While election security has been a concern for many countries, the possibility of cybersecurity threat impacting the U.S. presidential election is of top concern. (ISC)² member Dr. Carnell Council, CISSP addresses the multiple steps in the voting process that could face vulnerabilities and how each step can be better secured. With different systems, networks and devices come a different set of vulnerabilities. Dr. Council's full article can be found in Security Magazine. Read more →

How HR can Improve Corporate Cybersecurity

Cybercrime is one of the greatest threats to business Security breaches are becoming more targeted and costly. IBM estimates that the average cost of a data breach in the United States being $8.19 million. In the U.K., the government’s Cyber Security Breaches Survey 2019 shows that one in three businesses (32%) suffered an attack or breach in the previous 12 months. As businesses adopt emerging technologies to boost their productivity, enhance collaboration and minimize spending, they open themselves to new risks and challenges. The overall business risk has increased because of the expanding threat landscape. Cyber criminals are also leveraging... Read more →

The Value of CSSLP Certification Is Surging

The (ISC)² Certified Secure Software Lifecycle Professional (CSSLP) certification has earned a place in a list of 10 IT certifications with the most increased value over the past year. Researcher Foote Partners collected compensation data from more than 3,300 employers in the U.S. and Canada to compile the list as part of its 2020 IT Skills and Certifications Pay Index report. The index calculates certification value based on the percentage of salary that accounts for a certification. CSSLP holders earn 13% on top of their base salary, according to the research. The index gives holders – or those planning to... Read more →

The Problem With Cyberhygiene

Alert fatigue, password change resistance, and poor cyberhygiene are just a few of the challenges that security specialists face. Human beings do not like being forced into habits, even when it is for their own well-being or that of the organization they work for. It’s a quirk of human nature that we have a hard time contemplating abstract notions of danger, especially when it’s introduced to us by others. Humans are guided in part by instinct and reflex. So if we cannot perceive danger through our physical senses, then we cannot process it accurately. When it comes to cyberhygiene activities,... Read more →

The 7 Benefits of SSCP to Highly Successful Security Practitioners

In a world that is constantly changing, the immediate future of emerging technologies looks exciting and promising. Rapid advances over the next five years may help humanity solve some of the biggest challenges like the climate crisis, our ability to cure illnesses, understanding the universe and our microcosmos, and improving productivity through business automation. Despite the obvious benefits technology brings, it has also created many cybersecurity and privacy challenges. The overall business risk has increased because of the changing and expanding threat landscape. Cyber criminals are also leveraging these technologies to launch their malicious actions, which are more sophisticated than... Read more →

Why Cybersecurity is a Great Choice for an Exciting Career

Cybersecurity is becoming increasingly important as more businesses collect, share, and use more and more data as part of their practices. The news headlines have been dominated by security incidents affecting the personal data of millions of people around the world. The importance of cybersecurity is underscored by the cost of a breach, with IBM estimating the average cost of a data breach in the United States being $8.19 million. Zero unemployment is not a dream! The cybersecurity industry has a zero percent unemployment, which make it an attractive statistic. It certainly is a great reason for everyone, either IT... Read more →

Beware of TMI: Cyber Crooks Are Watching

Research conducted since the start of the COVID-19 pandemic shows an increase in cyber threats as cybercriminals try to take advantage of users working remotely. What most users may not realize is that they could be making it easier for threat actors to target them. Here’s how: Every time a user posts a picture of his or her remote office setup on social media or participates in a videoconference, the user unwittingly may be revealing personal or company information that threat actors can exploit. In an opinion piece published by the Wall Street Journal, a cybersecurity expert warned about the... Read more →

Bank On It

As published in the March/April 2020 edition of InfoSecurity Professional Magazine By Shaun Aghili, DBA, CISSP-ISSMP, CCSP, CISA and Bobby Swar, Ph.D. In May 2018, two major banks in Canada—Bank of Montreal and Canadian Imperial Bank of Commerce—received email threats from malicious hackers claiming to have gained access to customers’ sensitive information. The attackers demanded $1 million in cryptocurrency from each bank or they would publicly release customers’ information. The successful attacks on these banks led to 90,000 customers’ account information being compromised and an undisclosed amount of money lost as the result of the security breaches. In recent years,... Read more →