(ISC)² Blog

Absolute Zero

By Allan Caton, CISSP, CISM, CCSP, CISMP Most companies are migrating from an environment of legacy, on-premise systems to the cloud which will result in a hybrid environment. Market forces are driving the push toward usable, mobile technology and the always-on, always-available, ubiquity of web-based applications. This shift will include both customers and all types of enterprise users – including employees, contractors, vendors, partners, etc. This shift to a decentralized, identity-centric operating model brings with it the absolute requirement to consider the security of the user identities, devices and data which comprise the enterprise estate. The future of identity management,... Read more →

From Y2K to NYC Parking Meters: Have We Learned Anything About Complacency in Cybersecurity?

Software glitches like the Y2K bug and its recent echoes, such as the New York City parking meter failure serve to remind us of the complacency that often settles into organizational culture, and which allows security threats to turn into full-on failures. The New York City parking meter failure was soon eclipsed by the enormity of the COVID-19 pandemic, which has occupied the world’s attention ever since. But this story should not be forgotten, because it has roots that extend far back into the past and – more importantly – has serious implications for computing and threat management far into... Read more →

RETHINKING SECURITY PREDICTIONS FOR 2020 FROM THE (ISC)² COMMUNITY OF SECURITY PROFESSIONALS

By Diana-Lynn Contesti, CISSP-ISSAP, ISSMP, CSSLP, SSCP and John Martin, CISSP-ISSAP In February 2020, we put together our thoughts on Security Predictions for the upcoming year in a two-part series (Part 1, Part 2). Little did we know that COVID-19 would happen and change the way that folks work in our organizations, nor we as security practitioners work. In our original blog, we suggested that the following issues would be of concern to the industry: Data Privacy changes Lack of secure coding practices 5G and WiFi-6 Phasing out passwords Lack of perimeters Backups and their role with ransomware We believe... Read more →

10 Critical Skills for the Cybersecurity Workforce

With breach rates growing and cyberattacks becoming a daily occurrence for business, IT leaders are looking to beef up their security teams. This is good news for anyone who is considering a career in information security. But as new talent begins to navigate breaking into the field, many may wonder: What skills should I focus on developing for a security career? Most security hiring managers are looking for a blend of skills and backgrounds. Here are 10 things you need to enter the cybersecurity workforce today. Technical prowess While some career paths in security may not require technical skills, many... Read more →

Study: Pandemic Boosts Cybersecurity Demand

Demand is up for cybersecurity solutions and services as businesses try to cope with the effects of the COVID-19 pandemic. In a survey of technology firms, industry association CompTIA found that customer inquiries regarding cybersecurity were up by 36% in April -- second only to inquiries about communications, collaboration and A/V technologies. The increased demand for cybersecurity and collaboration technologies makes sense in light of the sudden increase in work-from-home (WFH) numbers. The ranks of remote workers shot up as a result of stay-at-home and lockdown directives issued by governments in efforts to manage the spread of COVID-19. Recent (ISC)2... Read more →

Study: Small Businesses Are More Focused on IoT Investments Than Cybersecurity

More than twice as many small businesses are investing in Internet of Things (IoT) technologies than in cybersecurity, according to recent research. And while this may raise some red flags, it is possible that small businesses are spending less on cybersecurity for justifiable reasons. A poll conducted by Survey Monkey for business network CNBC says 44% of small businesses are planning to invest in IoT while only 20% plan to invest in cybersecurity. Naturally, this raises the very real concern that companies may purchase technology without properly securing it. Doing so, of course, would be a mistake. As a whole,... Read more →

Cyber Threats Are Spiking as Remote Worker Ranks Soar

The number of people working from home is skyrocketing as the COVID-19 pandemic forces companies to close offices and practice social distancing. The sudden explosion of makeshift home office environments is adding to the burden of already overtaxed cybersecurity workers, who now face the massive task of trying to protect a remote workforce against cyber threats. While cybersecurity professionals put in extra hours to handle the situation, the increasing ranks of remote workers are catching the attention of another group – cyber attackers. Cyber criminals are betting that many of these hastily outfitted work-from-home environments will not have the same... Read more →

What is Cryptography?

By Javvad Malik, CISSP Can You Explain Encryption to Me? From: Thomas, Kevin Sent: 24 August 2019 10:43 To: Malik, Javvad Subject: Encryption Jav I’m updating the presentation pack for this months management meeting. Can you send me a short description of encryption so the SLT can better understand the solution. Kev From: Malik, Javvad Sent: 24 August 2019 11:03 To: Thomas, Kevin Subject: Encryption Hi Kevin, Encryption is the process of transforming information using an algorithm to make it unreadable to anyone except those possessing special knowledge, usually referred to as a key. The result of the process is... Read more →

Let’s Work Together

As published in the November/December 2019 edition of InfoSecurity Professional Magazine By Michael Bergman, CISSP An (ISC)2 member details a software security integration system that eliminates that ’50-page security policy’ for developers. Unless your organization is gifted with resources, your software development teams do not have a dedicated first-line-of-defense function that integrates controls and makes it easier for developers to secure the products they build. Instead developers, particularly those using Agile for project management, typically are handed a 50-page security policy document and told to “implement that along with your functional requirements, all within your two-week sprint cycle.” The result... Read more →

Healthcare is the Preferred Target of Cyber Attackers

U.S. healthcare institutions are under constant attack from cybercriminals, and unless hospitals take concrete steps to protect themselves, the situation won’t get any better. In 2019, the healthcare industry was the number one target for cyber attackers, with the cost of breaches totaling $4 billion, according to a new report. 2020 Vision: A Review of Major IT & Cybersecurity Issues Affecting Healthcare, published by security intelligence firm CyberMDX, provides an in-depth look at the causes and types of cybersecurity threats affecting the industry, as well as recommendations for healthcare institutions to fortify their cyber defenses. Attacks on healthcare are prevalent,... Read more →

Threat Hunting: Is Your Security Operation Ready to Launch Such a Program?

As published in the November/December edition of InfoSecurity Professional Magazine. It could be a blended attack as slick as a multichannel marketing campaign. Or a spontaneous crime of opportunity by a single dis-gruntled employee. It could even be an innocent configuration error. When a threat exists, there will be indicators. The perennial challenge is to hunt for signs in the right places and to isolate the signal from the noise. How best to find—and remove, where possible—such threats remains up for debate. Lance Cottrell, chief scientist at Ntrepid, approaches threat hunting less as a specific set of techniques than as... Read more →

UNDER ATT&CK: How MITRE’s methodology to find threats and embed counter-measures might work in your organization

As published in the November/December 2019 edition of InfoSecurity Professional Magazine By Naresh Kurada, CISSP Threat modeling is gaining even more attention with today’s dynamic threat environment. The sophistication of threat actors and development of advanced tactics, techniques and procedures (TTPs) has put a brighter spotlight on the process of finding vulnerabilities by incorporating the attacker’s point of view. There are several threat modeling approaches and techniques to consider. Often, these can be classified as asset-centric, system-centric, people-centric or risk-centric. For instance, Microsoft’s STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service and Elevation of Privilege) is system-centric, while PASTA... Read more →

Breaches Increased in 2019, but the Number of Exposed Records Declined

The number of U.S. data breaches bumped up 17% in 2019 but despite the increase, the volume of sensitive consumer records that were exposed declined substantially by 65%, according to a newly published report. These statistics are a complete reversal of what happened in 2018, when the number of exposed consumer records soared by 126% and breaches declined by 23%, according to the Identity Theft Resource Center’s (ITRC) End-of-Year Data Breach Report for 2019 Data breaches tracked in 2019 in the United States jumped to 1,473, from 1,257 in the previous year, the report revealed. Meanwhile, 164,683,455 sensitive records were... Read more →

Security Predictions for 2020 from the (ISC)² Community of Security Professionals (Part 2)

By Diana-Lynn Contesti, CISSP-ISSAP, ISSMP, CSSLP, SSCP and John Martin, CISSP-ISSAP Continued discussion from Security Predictions for 2020 from the (ISC)² Community of Security Professionals (Part 1) Internet of Things (IoT), Industrial Internet of Things (IIoT) and Operating Technology (OT) related to the state of digital certificates The issue is not just self-signed digital certificates or expired certificates. Many of these devices have digital certificates, which need to be managed via a Key Management System and maintained. The fallout, of course, is that without proper controls, these devices can and will be compromised. Currently, the onus is on the consumer... Read more →

Cyber Threats to Healthcare on the Rise

Hospitals are set up to fight infections, but not necessarily the kind that has been plaguing healthcare institutions lately – malware. A new report estimates that cyber threats against healthcare targets increased 60% since January, surpassing the total number of threats identified in all of 2018. The most common threat targeting the healthcare industry is Trojan malware, which increased 82% in the third quarter from Q2, according to the report by Malwarebytes, Cybercrime Tactics and Techniques: The 2019 State of Healthcare. Most of the Trojan attacks involved Emotet and TrickBot, which are the two most dangerous Trojans around since 2018.... Read more →

Cybersecurity Is the Top Concern for Midmarket Executives

Nearly half of midmarket executives (47%) in a newly released quarterly report cited cybersecurity as their top concern for the coming year. The Middle Market Indicator report, by Chubb and the National Center for the Middle Market (NCMM), shows that cybersecurity topped the list of concerns for the second quarter in row. The concern isn’t surprising. Any executive who pays attention to the cyber threat landscape is bound to feel trepidation about the potential for cyber attacks against their organization. A study published by The Conference Board earlier this year found that cybersecurity is the top business concern for U.S.... Read more →

SSCP vs. CISSP Exams: How are they different?

You’re considering a cybersecurity certification and the SSCP and CISSP are both on your list. After comparing the material, you’re thinking there’s a good bit of overlap between the two. But is there, really? And if you sit for one exam would you be able to sit for the other without additional study or preparation? These are excellent questions. In fact, we hear them a lot. And the reality is, there ARE commonalities, which is true for most things in the field. However, these two certifications are wholly different and were developed from two distinct perspectives. In many ways, the... Read more →

Making Cyber Threats Big Data Manageable

By Adrian Winckles Director of Cyber Security, Networking and Big Data Research Group, Anglia Ruskin University Whilst figures differ depending on which report you read, Gartner estimates the average time between a breach and detection to be about 285 days. By this time, an attacker has long gone. With all the security products in an enterprise network today, why is this still so long? One reason maybe because threat detection is a big data problem. Particularly for network traffic based solutions. A handful of probes, or mirror ports, across a high-speed enterprise network and you could be capturing Terabytes of... Read more →

HCISPP Spotlight: Rema Deo

Name: Rema Deo Title: Managing Director Employer: 24By7Security, Inc. Location: Coral Springs, Florida Education: MBA Years in IT: 25+ Years in Cybersecurity: 5+ Cybersecurity Certifications: HCISPP How did you decide upon a career in healthcare security and/or privacy? I have been in risk management technology and compliance technology career for banking for several years, so when it was time for a change, Cybersecurity and Compliance related work was a logical next choice. 24By7Security has a client portfolio consisting of healthcare organizations as well as several other industries. Healthcare security and privacy work is still more nascent compared to financial technology,... Read more →

A First-Hand Experience with CISSP CAT

Patrick Strijkers is a 43-year-old information risk security officer at a pension funds firm in the Netherlands. He works in the IT security department in security incident management. Patrick’s employer runs a job rotation program, allowing him to gain experience in a variety of roles, with his next position coming invulnerability management this September. He holds the following security certifications: CompTIA Security+ CompTIA Network+ EC-Council Certified Ethical Hacker v8 EC-Council Certified Security Analyst v8 EC-Council Computer Hacking Forensics Investigator v8 Rapid7 Nexpose Rapid7 Metasploit Pro Patrick’s goal last year was to earn his CISSP certification. He attended a five-day boot... Read more →