(ISC)² Blog

HOT CYBERSECURITY TECHNOLOGIES

By Ruchika Sachdeva, CISSP, Certified Lead Auditor ISO 27001, Partner Trainer ISO 27001 with PECB. With the advent of the pandemic, the plethora of enterprises has turned inside out. The accelerated digital business has led to an exponential increase in cognition of both the service providers as well as the user community. Nevertheless, the hacktivists (a combination of hacker and activist) have found a persistent playground to play their part and constantly outsmart modern cyber security technologies. As per the Cost Of Data Breach Report (CODB), there has been 10% increase in the average total cost of a breach, 2020-2021.... Read more →

Summary of March Inside (ISC)2 Webinar: Stay Vigilant

As the war in Ukraine rages on, (ISC)² leaders took the opportunity to remind cybersecurity practitioners in the most recent Inside (ISC)² webinar of a simple but essential message: Be vigilant. As the hostilities continue, it is possible the war will spill over into the cyber realm, said Jon France, who joined (ISC)² in January as the organization’s first CISO. Cyber is the “fourth plain after land, sea and air” in the Ukraine war, he said. France joined CEO Clar Rosso and Board of Directors Chairperson Zachary Tudor for the quarterly webinar, during which they provided updates on the organization’s... Read more →

U.S. Cyber Command Operation Targets ‘Real-life Cyber Threats’

A U.S. Cyber Command (USCYBERCOM) task force has conducted “its first offensive cyber effect operation against real-life cyber threats.” Details of the operation have not been published, but the military says offensive cyberspace operations are “intended to project power by the application of force in or through cyberspace.” News of the operation, conducted by USCYBERCOM’s Cyber National Mission Force (CNMF) from February to August 2021, came in a news release from the Maryland Air National Guard’s 175th Cyber Operations Group, which took part in the mission. “USCYBERCOM’s CNMF plans, directs and synchronizes full-spectrum cyberspace operations to deter, disrupt and, if... Read more →

The Importance of Security Control Baselines

For cybersecurity professionals, baseline management is vital because any asset not properly configured can become a security vulnerability. Baselines are fundamental to managing projects of all types and this is especially important in cybersecurity, where everything is a race against time and against very guileful opponents. Although baseline management seems like time-consuming “record keeping,” it is in fact the only way to know where you are, how your assets are operating, what has changed, and what needs to be changed. Not only does this help ensure the safety and security of the assets under your watch, it also helps with... Read more →

(ISC)² Celebrates Cybersecurity Awareness Month With Treasure Trove of Knowledge Building Resources

It’s October! And that can mean only one thing. It’s time to kick off the annual Cybersecurity Awareness Month, hosted by the National Cyber Security Alliance (NCSA) and the Cybersecurity & Infrastructure Security Agency (CISA). With remote work the new normal for most and ransomware attacks at peak fever pitch, there’s no time like now to learn about cybersecurity, or for those in the know, for a refresher on some of the common pitfalls to avoid in order to keep your data safe. In celebration of this month of best practices discovery, (ISC)² created a one-stop-shop to find helpful cybersecurity... Read more →

National Small Business Week: 10 Best Practices for Small Business Cybersecurity

A recent survey conducted by CNBC and Momentive found that 56% of small business owners are not concerned about being the victim of a cyberattack in the next year and that only 28% of them have a response plan in place in case of a cyberattack. This does not bode well for their longevity, as other industry data shows that 60% of small businesses that suffer a data breach will be out of business within six months. The high cost of remediation and the potential for reputational damage can be more than most small businesses can withstand. Many times, the... Read more →

What is the impact of software supply chain security challenges?

Digital innovation creates competitive advantage and value for every type of business. Three things are common among corporate software engineering teams: They seek faster innovation They seek improved security They utilize a massive volume of open source libraries Faster innovation does not mean that developers need to reinvent the wheel. Instead, faster innovation demands efficient reuse of code, which has led to a growing dependence on open source and third-party software libraries. Developers are using artifacts into public software repositories (npm, Maven Central, PyPI, NuGet Gallery, RubyGems, etc.) as reusable building blocks. This is the definition of the modern software... Read more →

Are You the Keymaster?

By Juan Asenjo, Ph.D., CISSP If you grew up in the 80s, you will remember the line: “Are you the keymaster?” from the original Ghostbusters movie. In the film, a malevolent force takes hold of Louis Tully - played by none other than Rick Moranis - to turn him into the keymaster that enables evil spirits to overtake numerous sites in New York. Fast-forward to the real world in 2021, and while we have not seen ghosts overrun our cities, what we have seen is a rapid proliferation of bad actors trying to besiege the defenses of virtual machines (VMs)... Read more →

Challenges and Misconceptions of Certificate Revocation in PKI

By Qamar Peer Bellary Sadiq, CISSP, CCSP Public Key Infrastructure is the most commonly used technology in security space for the purpose of establishing Authentication, Data Integrity, Non-Repudiation, email encryption, SSL/TLS with X.509 Certificates (also known as Digital Certificate). Digital Certificate is a form of a digital identity document in the digital world and helps identify users, entities and servers. PKI is an amalgamation of a suite of protocols, people, processes and technologies that must work in a synchronized manner to create, store, distribute, manage and revoke digital identities. However, there exists real world challenges, pitfalls and misconceptions around Certificate... Read more →

Cybersecurity Predictions for 2021 from the (ISC)² Community of Security Professionals (Part 2)

By Diana-Lynn Contesti, CISSP-ISSAP, ISSMP, CSSLP, SSCP John Martin, CISSP-ISSAP, CISM Richard Nealon, CISSP-ISSMP, SSCP, SCF In part one of this blog series, we discussed privacy, remote access (aka Work from Home), insider threats, data leakage, Zero Trust Architecture (ZTA) and security architecture. To continue this discussion, we believe that 2021 will still see folks working from home; thus, the risks due to insider threats and data leakage will continue to grow. However, we believe that there are other concerns for information security professionals, including edge computing, 5G, IoMT/IoT, AI and ransomware. Edge Computing Edge Computing is a distributed computing... Read more →

Exceptions to Security Policy - What are they and how to deal with them?

By Yuri Braz, CISSP, CRISC, PMP Information Security, or cybersecurity, has become more relevant every day. One of the main reasons is because information has become the main asset of most companies. Thus, this information needs to be safeguarded or companies would not be able to create value for society and its shareholders. Large institutes, such as (ISC)², help to develop and democratize the information security field, so that today the majority of medium and large companies have an information security policy. An infosec policy is the first step towards risk governance, essential for the practice of due care and... Read more →

Remote Work During the Pandemic: What We Got Wrong

By Stephen Fried, CISSP As COVID-19 began to spread rapidly across the globe in 2020, many organizations moved their employees off company premises and enabled large "work from home" efforts. Nobody knew how long this would last, but we assumed we could work remotely for a few months until this thing worked itself out, then return to the office and get back to "normal." We were very wrong. We weren’t just wrong about the length of the crisis; we were wrong about how our employees defined “home.” What we didn’t anticipate is that the pandemic would force companies to rethink... Read more →

How Access Control and Network Segmentation Can Protect Your Assets

Businesses are increasingly dependent on emerging technology and reaping its benefits to provide better quality of services, change the way they collaborate and interact with employees and customers. Corporate data is being moved to multi-cloud environments, while the adoption of containers helps the fast and agile development of applications. IoT devices and sensors provide businesses with an abundance of data useful for timely and accurate decision making. An Expanding Threat Landscape However, businesses are not the only ones taking advantage of this technology. Criminals, as well, are following suit. According to the Verizon DBIR 2020 report, cloud assets were involved... Read more →

Absolute Zero

By Allan Caton, CISSP, CISM, CCSP, CISMP Most companies are migrating from an environment of legacy, on-premise systems to the cloud which will result in a hybrid environment. Market forces are driving the push toward usable, mobile technology and the always-on, always-available, ubiquity of web-based applications. This shift will include both customers and all types of enterprise users – including employees, contractors, vendors, partners, etc. This shift to a decentralized, identity-centric operating model brings with it the absolute requirement to consider the security of the user identities, devices and data which comprise the enterprise estate. The future of identity management,... Read more →

From Y2K to NYC Parking Meters: Have We Learned Anything About Complacency in Cybersecurity?

Software glitches like the Y2K bug and its recent echoes, such as the New York City parking meter failure serve to remind us of the complacency that often settles into organizational culture, and which allows security threats to turn into full-on failures. The New York City parking meter failure was soon eclipsed by the enormity of the COVID-19 pandemic, which has occupied the world’s attention ever since. But this story should not be forgotten, because it has roots that extend far back into the past and – more importantly – has serious implications for computing and threat management far into... Read more →

RETHINKING SECURITY PREDICTIONS FOR 2020 FROM THE (ISC)² COMMUNITY OF SECURITY PROFESSIONALS

By Diana-Lynn Contesti, CISSP-ISSAP, ISSMP, CSSLP, SSCP and John Martin, CISSP-ISSAP In February 2020, we put together our thoughts on Security Predictions for the upcoming year in a two-part series (Part 1, Part 2). Little did we know that COVID-19 would happen and change the way that folks work in our organizations, nor we as security practitioners work. In our original blog, we suggested that the following issues would be of concern to the industry: Data Privacy changes Lack of secure coding practices 5G and WiFi-6 Phasing out passwords Lack of perimeters Backups and their role with ransomware We believe... Read more →

10 Critical Skills for the Cybersecurity Workforce

With breach rates growing and cyberattacks becoming a daily occurrence for business, IT leaders are looking to beef up their security teams. This is good news for anyone who is considering a career in information security. But as new talent begins to navigate breaking into the field, many may wonder: What skills should I focus on developing for a security career? Most security hiring managers are looking for a blend of skills and backgrounds. Here are 10 things you need to enter the cybersecurity workforce today. Technical prowess While some career paths in security may not require technical skills, many... Read more →

Study: Pandemic Boosts Cybersecurity Demand

Demand is up for cybersecurity solutions and services as businesses try to cope with the effects of the COVID-19 pandemic. In a survey of technology firms, industry association CompTIA found that customer inquiries regarding cybersecurity were up by 36% in April -- second only to inquiries about communications, collaboration and A/V technologies. The increased demand for cybersecurity and collaboration technologies makes sense in light of the sudden increase in work-from-home (WFH) numbers. The ranks of remote workers shot up as a result of stay-at-home and lockdown directives issued by governments in efforts to manage the spread of COVID-19. Recent (ISC)2... Read more →

Study: Small Businesses Are More Focused on IoT Investments Than Cybersecurity

More than twice as many small businesses are investing in Internet of Things (IoT) technologies than in cybersecurity, according to recent research. And while this may raise some red flags, it is possible that small businesses are spending less on cybersecurity for justifiable reasons. A poll conducted by Survey Monkey for business network CNBC says 44% of small businesses are planning to invest in IoT while only 20% plan to invest in cybersecurity. Naturally, this raises the very real concern that companies may purchase technology without properly securing it. Doing so, of course, would be a mistake. As a whole,... Read more →

Cyber Threats Are Spiking as Remote Worker Ranks Soar

The number of people working from home is skyrocketing as the COVID-19 pandemic forces companies to close offices and practice social distancing. The sudden explosion of makeshift home office environments is adding to the burden of already overtaxed cybersecurity workers, who now face the massive task of trying to protect a remote workforce against cyber threats. While cybersecurity professionals put in extra hours to handle the situation, the increasing ranks of remote workers are catching the attention of another group – cyber attackers. Cyber criminals are betting that many of these hastily outfitted work-from-home environments will not have the same... Read more →