(ISC)² Blog

Cyber Threats Are Spiking as Remote Worker Ranks Soar

The number of people working from home is skyrocketing as the COVID-19 pandemic forces companies to close offices and practice social distancing. The sudden explosion of makeshift home office environments is adding to the burden of already overtaxed cybersecurity workers, who now face the massive task of trying to protect a remote workforce against cyber threats. While cybersecurity professionals put in extra hours to handle the situation, the increasing ranks of remote workers are catching the attention of another group – cyber attackers. Cyber criminals are betting that many of these hastily outfitted work-from-home environments will not have the same... Read more →

What is Cryptography?

By Javvad Malik, CISSP Can You Explain Encryption to Me? From: Thomas, Kevin Sent: 24 August 2019 10:43 To: Malik, Javvad Subject: Encryption Jav I’m updating the presentation pack for this months management meeting. Can you send me a short description of encryption so the SLT can better understand the solution. Kev From: Malik, Javvad Sent: 24 August 2019 11:03 To: Thomas, Kevin Subject: Encryption Hi Kevin, Encryption is the process of transforming information using an algorithm to make it unreadable to anyone except those possessing special knowledge, usually referred to as a key. The result of the process is... Read more →

Let’s Work Together

As published in the November/December 2019 edition of InfoSecurity Professional Magazine By Michael Bergman, CISSP An (ISC)2 member details a software security integration system that eliminates that ’50-page security policy’ for developers. Unless your organization is gifted with resources, your software development teams do not have a dedicated first-line-of-defense function that integrates controls and makes it easier for developers to secure the products they build. Instead developers, particularly those using Agile for project management, typically are handed a 50-page security policy document and told to “implement that along with your functional requirements, all within your two-week sprint cycle.” The result... Read more →

Healthcare is the Preferred Target of Cyber Attackers

U.S. healthcare institutions are under constant attack from cybercriminals, and unless hospitals take concrete steps to protect themselves, the situation won’t get any better. In 2019, the healthcare industry was the number one target for cyber attackers, with the cost of breaches totaling $4 billion, according to a new report. 2020 Vision: A Review of Major IT & Cybersecurity Issues Affecting Healthcare, published by security intelligence firm CyberMDX, provides an in-depth look at the causes and types of cybersecurity threats affecting the industry, as well as recommendations for healthcare institutions to fortify their cyber defenses. Attacks on healthcare are prevalent,... Read more →

Threat Hunting: Is Your Security Operation Ready to Launch Such a Program?

As published in the November/December edition of InfoSecurity Professional Magazine. It could be a blended attack as slick as a multichannel marketing campaign. Or a spontaneous crime of opportunity by a single dis-gruntled employee. It could even be an innocent configuration error. When a threat exists, there will be indicators. The perennial challenge is to hunt for signs in the right places and to isolate the signal from the noise. How best to find—and remove, where possible—such threats remains up for debate. Lance Cottrell, chief scientist at Ntrepid, approaches threat hunting less as a specific set of techniques than as... Read more →

UNDER ATT&CK: How MITRE’s methodology to find threats and embed counter-measures might work in your organization

As published in the November/December 2019 edition of InfoSecurity Professional Magazine By Naresh Kurada, CISSP Threat modeling is gaining even more attention with today’s dynamic threat environment. The sophistication of threat actors and development of advanced tactics, techniques and procedures (TTPs) has put a brighter spotlight on the process of finding vulnerabilities by incorporating the attacker’s point of view. There are several threat modeling approaches and techniques to consider. Often, these can be classified as asset-centric, system-centric, people-centric or risk-centric. For instance, Microsoft’s STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service and Elevation of Privilege) is system-centric, while PASTA... Read more →

Breaches Increased in 2019, but the Number of Exposed Records Declined

The number of U.S. data breaches bumped up 17% in 2019 but despite the increase, the volume of sensitive consumer records that were exposed declined substantially by 65%, according to a newly published report. These statistics are a complete reversal of what happened in 2018, when the number of exposed consumer records soared by 126% and breaches declined by 23%, according to the Identity Theft Resource Center’s (ITRC) End-of-Year Data Breach Report for 2019 Data breaches tracked in 2019 in the United States jumped to 1,473, from 1,257 in the previous year, the report revealed. Meanwhile, 164,683,455 sensitive records were... Read more →

Security Predictions for 2020 from the (ISC)² Community of Security Professionals (Part 2)

By Diana-Lynn Contesti, CISSP-ISSAP, ISSMP, CSSLP, SSCP and John Martin, CISSP-ISSAP Continued discussion from Security Predictions for 2020 from the (ISC)² Community of Security Professionals (Part 1) Internet of Things (IoT), Industrial Internet of Things (IIoT) and Operating Technology (OT) related to the state of digital certificates The issue is not just self-signed digital certificates or expired certificates. Many of these devices have digital certificates, which need to be managed via a Key Management System and maintained. The fallout, of course, is that without proper controls, these devices can and will be compromised. Currently, the onus is on the consumer... Read more →

Cyber Threats to Healthcare on the Rise

Hospitals are set up to fight infections, but not necessarily the kind that has been plaguing healthcare institutions lately – malware. A new report estimates that cyber threats against healthcare targets increased 60% since January, surpassing the total number of threats identified in all of 2018. The most common threat targeting the healthcare industry is Trojan malware, which increased 82% in the third quarter from Q2, according to the report by Malwarebytes, Cybercrime Tactics and Techniques: The 2019 State of Healthcare. Most of the Trojan attacks involved Emotet and TrickBot, which are the two most dangerous Trojans around since 2018.... Read more →

Cybersecurity Is the Top Concern for Midmarket Executives

Nearly half of midmarket executives (47%) in a newly released quarterly report cited cybersecurity as their top concern for the coming year. The Middle Market Indicator report, by Chubb and the National Center for the Middle Market (NCMM), shows that cybersecurity topped the list of concerns for the second quarter in row. The concern isn’t surprising. Any executive who pays attention to the cyber threat landscape is bound to feel trepidation about the potential for cyber attacks against their organization. A study published by The Conference Board earlier this year found that cybersecurity is the top business concern for U.S.... Read more →

SSCP vs. CISSP Exams: How are they different?

You’re considering a cybersecurity certification and the SSCP and CISSP are both on your list. After comparing the material, you’re thinking there’s a good bit of overlap between the two. But is there, really? And if you sit for one exam would you be able to sit for the other without additional study or preparation? These are excellent questions. In fact, we hear them a lot. And the reality is, there ARE commonalities, which is true for most things in the field. However, these two certifications are wholly different and were developed from two distinct perspectives. In many ways, the... Read more →

Making Cyber Threats Big Data Manageable

By Adrian Winckles Director of Cyber Security, Networking and Big Data Research Group, Anglia Ruskin University Whilst figures differ depending on which report you read, Gartner estimates the average time between a breach and detection to be about 285 days. By this time, an attacker has long gone. With all the security products in an enterprise network today, why is this still so long? One reason maybe because threat detection is a big data problem. Particularly for network traffic based solutions. A handful of probes, or mirror ports, across a high-speed enterprise network and you could be capturing Terabytes of... Read more →

HCISPP Spotlight: Rema Deo

Name: Rema Deo Title: Managing Director Employer: 24By7Security, Inc. Location: Coral Springs, Florida Education: MBA Years in IT: 25+ Years in Cybersecurity: 5+ Cybersecurity Certifications: HCISPP How did you decide upon a career in healthcare security and/or privacy? I have been in risk management technology and compliance technology career for banking for several years, so when it was time for a change, Cybersecurity and Compliance related work was a logical next choice. 24By7Security has a client portfolio consisting of healthcare organizations as well as several other industries. Healthcare security and privacy work is still more nascent compared to financial technology,... Read more →

A First-Hand Experience with CISSP CAT

Patrick Strijkers is a 43-year-old information risk security officer at a pension funds firm in the Netherlands. He works in the IT security department in security incident management. Patrick’s employer runs a job rotation program, allowing him to gain experience in a variety of roles, with his next position coming invulnerability management this September. He holds the following security certifications: CompTIA Security+ CompTIA Network+ EC-Council Certified Ethical Hacker v8 EC-Council Certified Security Analyst v8 EC-Council Computer Hacking Forensics Investigator v8 Rapid7 Nexpose Rapid7 Metasploit Pro Patrick’s goal last year was to earn his CISSP certification. He attended a five-day boot... Read more →

Don't be a sitting duck in the next OT cyberattack

By Ravindra Krishna, CISSP In a recent Operational Technology (OT) cyberattack, Monero Crypto-currency mining malware was discovered in the ICS network of a water utility company located in Europe. The company found the malware during a routine monitoring check of their OT network and confirmed that the malware infected five servers including the Human machine interface (HMI), which is used to control and manage physical components of OT networks. This attack provides further evidence that OT networks are not simply vulnerable, but actually easy targets. The Post-Stuxnet OT Cyberattack Era I believe that we can divide OT attacks into two... Read more →

Associate of (ISC)²: Thien Phan

Name: Thien Phan (ISC)² Exams Passed: CISSP and CCSP Title: Cybersecurity, Privacy and IT Risk Associate Employer: PricewaterhouseCoopers (PwC) Location: New York City, NY, U.S.A. Education: MBA degree and Bachelor’s Degree in Management Information Systems (MIS) from Binghamton University Years in IT: 1 year Years in cybersecurity: 1 year Cybersecurity certifications: Security+, CCNA Cyber Ops How did you decide upon a career in cybersecurity? It was back in my third year of college when I interned for a multimedia company as a database administrator. I did not know much about how different technologies worked together. I was introduced to the... Read more →

SSCP Spotlight: Wai Sheng Cheng

Name: Wai Sheng Cheng Title: Security Analyst Employer: Cboe Global Markets Location: Kansas, U.S.A. Degree: Master of Science, Information Systems Engineering, Johns Hopkins University Years in IT: 6 Years in information security: 3 Cybersecurity certifications: SSCP How did you decide upon a career in cybersecurity? I decided on a career in cybersecurity when my email account was first compromised in 2011. I learned about this when my friends and family called to ask if I had sent out emails asking for money. As an engineer-in-training, I was curious to know why and how this had happened. It was through this... Read more →

Holiday Risks: Shopping Scams in Retail, Travel and Hospitality

UPS, FedEx, USPS and other delivery workers have been on overdrive for weeks. Online shopping can ease the stress of the season, but is it safer to confront the crowds? Let’s be honest, consumers are not waiting until off hours to fill their digital carts. Hackers prey on the knowledge that it’s ever more difficult for end users to distinguish the difference between fraudulent and valid emails, which presents security issues to the enterprise as well. For the cybersecurity of end users (and the companies where they work) many headlines this week, have shared tips on how to avoid falling... Read more →

SSCP Spotlight: Todd Painter

Name: Todd A. Painter Title: Network Engineer Employer: UNG, Inc. Location: Boiling Springs, SC (USA) Years in IT: 7 Years in information security: 3 Cybersecurity certifications: SSCP, Security+, working on CISSP How did you decide upon a career in cybersecurity? Looking at the current scope of IT, it was apparent to me that the IT security field would have the largest growth in the coming years. With that in mind, I knew that I had a good chance at becoming a valuable asset to any company that needed a security expert, or someone with more of a security mindset rather... Read more →

Reaching More Cybersecurity Professionals in a Growing Market

Though more attention has come to the security industry, cyber crime continues to challenge defense. Cybersecurity can no longer be ignored. In case you missed the press release last week, we’re letting you know that (ISC)² announced an open call for expert cybersecurity speakers for our 2018 Security Congress. In fact, there was lots of news coming out of (ISC)² last week. We are also welcoming nominations for the 2018 Information Security Leadership Award – Government. It’s the end of the year, which means the start of a new one. With the new year comes the promise of growth and... Read more →