ISC2 Blog

Will Banks Adopting Open-Source Leave Them More Open to Supply Chain Cyber Attacks?

One of the biggest vindications of open-source software in recent years has been its widespread adoption by the finance sector. By Joe Fay In its 2022 State of Open Source in Financial Services report, the Fintech Open Source Foundation (FINOS) found that 87% of respondents agreed that open source is “valuable to the future” of the industry, with open-source consumption and the use of open standards seen as top factors in increasing productivity. Banks and other institutions have clearly decided it makes no sense to constantly develop their own software from the ground up when open-source alternatives exist. This not... Read more →

New cybersecurity express-learning opportunities with (ISC)² Skill-Builders

Cybersecurity never stands still. It’s a constantly evolving field that requires constant learning to stay in front of cyberthreats. (ISC)² Skill-Builders are a new way to stay current and demonstrate your knowledge of emerging cybersecurity topics. The quick, on-demand learning from cybersecurity’s leading professional organization features content created by industry experts. Learning activities focused on real-world activities ensure the content is accessible and relevant. Anyone can access the courses anytime, anywhere. (ISC)² Skill-Builders dive into the following focus areas: Entry-Level Cybersecurity Skill-Builders - Learn valuable fundamental skills as you pursue a career in cybersecurity. Cloud Security - Get up to... Read more →

Cybersecurity Industry News Review - June 6, 2023

$400 million fund for AI and robotics start-ups, OpenAI to fund cybersecurity efforts while research shows that cybercriminals are targeting the friends and families of high-value organization executives. By Chris Green IQ Capital Gears Up For ‘Deep Tech’ Investment London-based venture investor IQ Capital has successfully raised $400 million (£320 million) across two funds, which it plans to invest in an array of so-called ‘deep tech’ start-ups focused on tech areas including artificial intelligence (AI), robotics, quantum computing and others. The venture capital firm primarily invests in seed to Series A stage startups in the UK and Europe. Its previous... Read more →

Infosecurity Europe 2023 Preview – Our Pick of the Keynote Sessions

In the first of two previews of Infosecurity Europe 2023, we look at our top picks for unmissable keynote sessions across the three days of the conference, held at ExCel in London from June 20-22. By John E. Dunn As the pivotal cybersecurity conference in the region, every Infosecurity Europe conference is oriented to topical themes. This year is no exception, with the speaker lineup covering everything from the on-going anxiety of cyberwar, how zero trust can be made to work once it leaves the drawing board, and the never-ending puzzle of assessing supply chain risk. The following is our... Read more →

Practitioners Point to Zero Trust As Key To User Access Security

By Chris Green Nearly 4,000 cybersecurity professionals weighed in and 55% feel Zero Trust is the most impactful to keep organizations secure. The debate over the most effective form of access control has been waging for as long as computers have had individual logins. Whether its passwords, two-factor authentication, location-based authentication, password-less login – the debate is split. Or is it? In a survey conducted by (ISC)² on LinkedIn ahead of World Password Day revealed the extent to which zero trust policies are being embraced as part of stricter authentication practices. The poll of nearly 4,000 cybersecurity professionals revealed that... Read more →

Password Myths vs. Reality

By Er. Tapan Jatakia, CC Tapan is a researcher, innovator, mentor and advisor in the domains of cybersecurity and threat intelligence with a passion for interweaving data science, machine learning and artificial intelligence along with IT/cybersecurity to study and conduct research and development. World Password Day is an annual event celebrated on the first Thursday of May to promote password security awareness and best practices. May 7, 2013, marked the first observance of World Password Day, which aims to raise awareness about the significance of employing robust, distinct, and intricate passwords for safeguarding online accounts and personal data. World Password... Read more →

RSA Conference Day One: Disruption Key to Keeping Bad Actors At Bay

Day One of the RSA Conference opened with keynotes diagnosing a security identity crisis, while offering AI, platforms, and big dose of disruption as the cure for what ails the cybersecurity world. By Joe Fay The 2023 RSA Conference kicked off in San Francisco this week, with human delegates being confronted with speaker after speaker declaring that AI is taking over much of their jobs. Opening the conference, RSA CEO Rohit Ghai said that over the years, the core purpose of security platforms has evolved, but “in the AI era, it is security first, followed by convenience and compliance.” “AI... Read more →

Cybersecurity Industry News Review - April 25, 2023

Europe’s Air Traffic Control (ATC) agency under DDoS attack. Eavesdropping police in the U.K. spared massive fine. Numbers emerge after NCR ransomware attack. Hackers hit gold in secondhand routers. By Joe Fay “Pro-Russian” Hackers Dive Bomb European Air Traffic Control Agency Europe’s air traffic control agency, Eurocontrol, has been fighting off a cyberattack by pro-Russian hackers since April 19. The attack appears to have been a DDoS targeting the agency’s website. Pro-Russian group Killnet claimed to have launched a “100 hour” marathon against Eurocontrol. The agency declined to detail the nature of the attack but said its safety operations had... Read more →

SEC Cybersecurity Proposals Survey Exposes Need for Board-Level Cyber Skills

Respondents highlight the need for appointing and developing more board-level cybersecurity expertise, while some are concerned that disclosure regulations unintentionally risk helping criminals alongside improving investor transparency. By Joe Fay U.S. Securities and Exchange Commission (SEC) proposals to boost cybersecurity reporting requirements for publicly traded firms have not resonated with (ISC)² members in a survey, with over half unaware of the proposals and a fifth suggesting they could benefit threat actors inadvertently through providing investors with enhanced disclosure. In 2022, the SEC proposed new rules on cybersecurity that impact publicly traded companies, with standards for disclosures around cyber security risk... Read more →

#IdentityManagementDay - Best Practices to Help Keep Your Organization Secure

By Chinatu Uzuegbu, CISSP, CEO/Managing Cyber Security Consultant at RoseTech CyberCrime Solutions Ltd. We kicked off the Identity and Access Management Processes from the Top-Level Management approach. The Identity and Access Management Security Steering Committee is a group of C-Suites leaders, also referred to as the respective Data and Asset Owners from the various Business Units of my organization. The group met and established the governing policy around the Identity and Access Management Processes. The governance covers the Mandatory Access Control Policy and Trust Policy of the organization which are automatically enforced as the baselines on default. The governance of... Read more →

LATEST CYBERTHREATS AND ADVISORIES - APRIL 7, 2023

The U.S. government takes down another dark web forum, Western Digital suffers a cyberattack and the fastest acting ransomware to date. Here are the latest threats and advisories for the week of April 7, 2023. By John Weiler Threat Advisories and Alerts Websites Built with Elementor Pro and WooCommerce under Attack Millions of WordPress websites using the popular Elementor Pro website builder and the WooCommerce plugin have been exposed to a serious security vulnerability. The flaw, which affects Elementor Pro versions 3.11.6 and earlier, allows malicious actors to change the default user privileges to include administrator access. The vulnerability was... Read more →

CYBERSECURITY INDUSTRY NEWS REVIEW - APRIL 4, 2023

UK government potentially skimps on senior cyber role salary as the NCSC calls for more investment in people, Microsoft talks up the potential for ChatGPT and the US moves to ban spyware. By Joe Fay U.K. Treasury Tries to Drive Down Inflation with Paltry Cybersecurity Salary The U.K.’s Treasury department is looking for an “experienced” Head of Cyber Security willing to work for £55,500. The successful candidate will be “working at the heart of Government in a time of momentous change and offering a level of exposure and challenge that is hard to find anywhere else”. Amongst other things, they... Read more →

Latest Cyberthreats and Advisories - March 17, 2023

Cybercriminals pounce on SVB collapse, privacy concerns around ChatGPT and the FBI warns of a rise in crypto scams. Here are the latest threats and advisories for the week of March 17, 2023. By John Weiler Threat Advisories and Alerts FBI Warning: Cryptocurrency Investment Schemes on the Rise The U.S. Federal Bureau of Investigation (FBI) is warning internet users of an increase in cryptocurrency investment scam schemes, which defrauded victims of over $2 billion in 2022. Cybercriminals (usually located overseas) use social media platforms, dating apps, professional networking apps and other online means to connect with targets. The criminals then... Read more →

Latest Cyberthreats and Advisories - February 3, 2023

Cybercriminals for hire, Hive ransomware is busted and the JD Sports breach impacts millions of sportswear buyers. Here are the latest threats and advisories for the week of February 3, 2023. Threat Advisories and Alerts U.S. Security Agencies Warn of Malicious Use of RMM Software A joint cybersecurity advisory issued by the U.S. National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA) and Multi-State Information Sharing and Analysis Center (MS-ISAC) warns that legitimate remote monitoring and management (RMM) software is being used for malicious purposes. After cybercriminals gain access to target networks, they use the software as a “backdoor... Read more →

Latest Cyberthreats and Advisories - January 27, 2023

Alerts from national cybersecurity agencies, gaming developer attacks and the Mailchimp/FanDuel breach. Here are the latest threats and advisories for the week of January 27, 2023. Threat Advisories and Alerts CISA Publishes Report to Help Protect Schools from Cyberthreats The recent surge in cyberattacks against the education sector has led the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to release a report addressing the issue. The COVID-19 pandemic made educational institutions increasingly vulnerable to cyberthreats, as virtual learning became widespread and led to the rapid adoption of new and untested technologies. The report titled “Partnering to Safeguard K-12 Organizations from... Read more →

SSCP Members – We Need Your Input

The SSCP certification is held by more than 7,000 professionals around the world. Known for its technical rigor, the members who hold this qualification are typically working in areas like IT administration, networks security, security operations or incident response. The exam was last refreshed in November 2021 which that means it is time for us to begin the process again. We announced last week that the CISSP will be starting the revision process in January and so will the SSCP. We need to hear from you, the certification holders. As we prepare for a Job Task Analysis (JTA) Study Workshop... Read more →

Latest Cyberthreats and Advisories - November 18, 2022

Beware the BatLoader, the NSA calls for more memory-safe programming language use and ransomware causes more trouble in Australia….Here are the latest threats and advisories for the week of November 18, 2022. Threat Advisories and Alerts Researchers Sound Alarm on Dangerous BatLoader Malware Dropper A dangerous new malware loader with features for determining whether it's running on business or home computers has begun rapidly infecting systems worldwide over the past few months. Researchers at VMware Carbon Black claim the threat, dubbed BatLoader, is being used to distribute a variety of malware tools including a banking Trojan, an information stealer, and... Read more →

OT: The New Gold Mine for Hackers and How CDS Can Secure It

By Dr. Fulvio Arreghini, CSSLP, Head of International Sales at INFODAS GmbH. Fulvio is a CDR of the Italian Navy (reserve). He has an Master Degree in communication engineering and a PhD in Information engineering. During his active service in the Navy he’s been working mainly in the areas of Secure Tactical Communication and Command and Control systems, acting often also as security officer and risk manager. Since 2020 in the private sector, he joined Infodas at first as solution architect to later become head of international sales. Cyberattacks to operational technology (OT) are on the rise and the providers... Read more →

The ‘Hottest’ IT Security Technologies in 2022

Did you catch The ‘Hottest’ IT Security Technologies in 2022 webinar? If not, we are here to share the key takeaways. Steve Piper, CISSP, CEO and Founder of CyberEdge Group joined moderator Brandon Dunlap in this initial kickoff of a five-part webinar series discussing key insights from the 2022 Cyberthreat Defense Report. This webinar focused on which security technologies are most widely deployed and most planned for acquisition in 2022. The 2022 Cyberthreat Defense Report is now in its 9th year and surveys 1,200 IT security and decision-makers and practitioners in organizations of 500+ employees. The survey is designed to... Read more →

Latest Cyberthreats and Advisories - August 19, 2022

Big tech breaches, the rise of callback phishing and joint advisories issued by CISA…here are the latest cybersecurity threats and advisories for the week of August 19, 2022. Threat Advisories and Alerts Cybercriminals Exploit Zimbra Vulnerabilities CISA and MS-ISAC have issued a joint advisory in response to active exploitation of multiple vulnerabilities against Zimbra Collaboration Suite (ZCS). Cybercriminals may target unpatched ZCS security holes in government and private sector networks. Organizations who didn’t make the appropriate updates upon patch release should assume they’ve been compromised and follow the recovery steps in the CISA advisory. Source: https://www.cisa.gov/uscert/ncas/alerts/aa22-228a CISA and the FBI... Read more →