(ISC)² Blog

Introducing (ISC)² EMEA ISLA 2017 Finalist: Bridget Kenyon

This year marks the first ever (ISC)² EMEA Information Security Leadership Awards (ISLA), a chance for our community to recognise fellow information security and management professionals going the extra mile to enhance security across Europe, the Middle East and Africa. Overall, we received a staggering number of impressive submissions, over 200, and these were shortlisted down to our finalists by our judges, members of the Europe, Middle East and Africa Advisory Council (EAC). Winners will be announced at our Secure Summit UK on 12 December 2017. In the meantime, we will be sharing their stories on the blog. Here is... Read more →

Why Non-EU based Businesses may be affected by the EU General Data Protection Regulation (GDPR)?

By Yves Le Roux, (ISC)² EMEA Advisory Council Co-Chair & Privacy Workgroup Lead Yves will be hosting the half-day workshop GDPR: Charting Experience on the March to May 2018 at (ISC)² Secure Summit MENA, in Dubai on the 21st and 22nd November 2017. The General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) is a regulation by which the European Parliament, the Council of the European Union and the European Commission intend to strengthen and unify data protection for all individuals within the European Union (EU). The regulation was adopted in April last year. It becomes enforceable from 25th May 2018... Read more →

SSCP Spotlight: Jasmin Landry

Name: Jasmin Landry Title: IT Security Analyst Employer: SecureOps Location: Montreal, Canada Years in IT: 4 Years in information security: 3 Cybersecurity certifications: SSCP, OSCP, CEH, eJPT, CCNA: Security, MCSA How did you decide upon a career in cybersecurity? It all started when I was a teenager. I enjoyed video games and I was curious about how they were created, so I decided to pursue education in programming. I quickly switched path though, after my first networking class. The teacher introduced us to Wireshark and I was just so amazed at what it could do, and what I was able... Read more →

Open Source — and Associated Risks — are the New Normal

By Tunde Ogunkoya, Consulting Partner, Africa, at DeltaGRiC Consulting (Pty) ltd. Tunde will be hosting the session Open Source; Pathway to Being or Not Being the VulN Victim at (ISC)² SecureJohannesburg 2017 on 5th October, 2017. The use of Open Source Software (OSS) has come a long way from when developers and organisations tried to avoid it. Today Open Source has become a go-to saving grace within most DevOps teams under pressure to roll out new functionality and features ahead of competition. Unfortunately, levels of vulnerability have grown with the trend as DevOps remain largely unaware of the risks or... Read more →

Top 10 (ISC)² Webcasts of 2017

(ISC)² webcasts are a great source for insight into all areas of security. From the Internet of Things to malware and compliance, the topics vary. Here are the top 10 (ISC)² webcasts for 2017 so far as ranked by cybersecurity professionals: Part 1: Future of SIEM - Why Static Correlation Fails Insider Threat Detection Hackers stealing credentials and operating in your corporate network…disgruntled employees collecting customer lists and design materials for a competitor...malware sending identity information back to random domains…these common threats have been with us for years and are only getting worse. Most organizations have invested large amounts in... Read more →

CCSP Spotlight: Adam Boulton

Name: Adam Boulton Title: Senior Vice President, Security Technology Employer: BlackBerry Location: United Kingdom Degree: Bachelor of Science (Honors) in Software Engineering Years in IT: 12 Years in cybersecurity: 12 Cybersecurity certifications: CCSP, CISSP, CSSLP, CSTM, QSTM, OCJA How did you decide upon a career in cybersecurity? I’ve been really interested in technology for as long as I can remember. I was fortunate enough to know that since my early teens I wanted my career to be in software engineering. I am sure my story is very similar to many others, technology really captured my imagination from early on. I... Read more →

CISSP Spotlight: Mark A. Singer

Name: Mark A. Singer Title: Principal Software Engineer Employer: DoD Sub-Contractor Location: Indianapolis, IN Education: Business Management Years in IT: 19 Years in cybersecurity: 12 Cybersecurity certifications: CISSP How did you decide upon a career in cybersecurity? Evolution. I stumbled into computers when I served in the U.S. Navy from 1985 to 1989 when PCs with 8086 processors were common. When I got out of the service, I was able to get a job working for Naval Avionics in Indianapolis and was placed in a role where I was doing local computer support on tempest computers (386, 486, & 486DX... Read more →

Security Headlines: Payouts and Panic

WannaCry and NotPetya aftermath means payouts and panic. Here are the top security headlines for the week of August 7, 2017: Big money, no whammies! It seems like the hackers behind WannaCry have cashed out their bitcoin into Monero, a harder to track cryptocurrency. Mo money means mo malware. The success – can we call it that? – of WannaCry and NotPetya means ransomware is not going away any time soon, because… well, people and businesses pay the ransom. What’s that definition of insanity? Oh yeah, doing the same thing and expecting a different result… Tripwire research indicates that two-thirds... Read more →

SIEM: Understanding, Parsing and Correlating Logs

Building an effective SIEM requires ingesting log messages and parsing them into useful information. While it might be easy to stream, push and pull logs from every system, device and application in your environment, that doesn’t necessarily improve your security detection capabilities. What you do with your logs – correlation, alerting and automated response – are the strength of a SIEM. Real-time security starts with understanding, parsing and developing actionable information and events from your log messages. With the launch of a new site, (ISC)² was presented an opportunity to refine our security monitoring services. Linked below is an example... Read more →

CISSP Spotlight: Rob Turner

Name: Rob Turner Title: Senior Cyber Network Defense Analyst Employer: DXC Technology (formerly Hewlett-Packard Enterprise) Title: Computer Technology Program Coordinator Employer: Ball State University Location: Indiana, U.S.A. Education: BS in Computer Technology, Graduate Certificate in Information System Security Management, MS in Information and Communication Sciences Years in IT: 10 Years in Cybersecurity: 7 Cybersecurity certifications: CISSP-ISSAP, CISSP, CCNA-Security, CEH, CHFI, ECSA How did you decide upon a career in cybersecurity? Cybersecurity had always been an aspect of my career as a systems analyst/administrator. The more proactive I became at securing systems and networks, the more research and interest I developed... Read more →

SSCP Spotlight: Ronald Ricohermoso

Name: Ronald Ricohermoso Title: IS Security Operations Analyst Employer: Ingram Micro Location: Philippines Degree: BS in Computer Science Years in IT: 6 Years in information security: 4 Cybersecurity certifications: SSCP, Security+, CEH, ITIL Foundation How did you decide upon a career in cybersecurity? I started working as a service desk, but decided to leave and specialize in other fields of IT (ex. networking or infrastructure). It started when I got a job at Ingram Micro as a security administrator and learned about the importance of information security and the challenges it offers due to the changing threat landscape. I learned... Read more →

Being the Fly on the Wall: The latest observations from the (ISC)² Member’s GDPR Task Force

By Yves Le Roux, CISSP, CISM, Co-Chair, Europe, Middle East and Africa Advisory Council (EAC) Recently our GDPR Task Force has found that despite efforts to prepare for the incoming regulation, many practitioners are finding that there is actually a lot more to do than originally anticipated, and are still in “discovery mode” about what data they hold. Data being fragmented and contained within individual business units means that knowing where data sets reside and mapping their flow is proving challenging. Businesses have just realised the mammoth task ahead of them Many businesses are still stuck in the initial stages... Read more →

SSCP Spotlight: Jae H. Moon

Name: Jae H. Moon Title: Sr. Systems (Linux/IA) Engineer Employer: Cray, Inc. Location: Salt Lake City, Utah, U.S.A. Degree: Master’s degree in Information Systems (emphasis on information security) Years in IT: 16+ Years in information security: 10+ Cybersecurity certifications: CompTIA Security +, SSCP How did you decide upon a career in cybersecurity? I had the opportunity to work as a summer intern at Scott Air Force Base in Illinois for the Department of Defense. I also worked as a Unix System Administrator for AT&T (after graduating from college) which focused heavily on implementing various information security principles and practices to... Read more →

CCSP Spotlight: Haruhiko Kurita

Name: Haruhiko Kurita Title: Senior Security Consultant Employer: NetOne Systems Location: Tokyo, Japan Degree: Master of Science, Physics Years in IT: 24 Years in cybersecurity: 21 Cybersecurity certifications: CISSP, CCSP, CISA, PCI DSS QSA How did you decide upon a career in cybersecurity? My career in cybersecurity started around 1995, when the internet was becoming popular here in Japan. My first product was HSM (Hardware Security Module) and I was interested in cryptography, as technology was very attractive to me. After three mergers, the company (Tandem) became bigger and I covered various parts of security, like F/W, antivirus, identity management,... Read more →

What we learned from this month’s European GISWS report

What is the GISWS? Since its first release in 2004, the biennial (ISC)²® Global Information Security Workforce Study (GISWS) has been gauging the opinions of information security professionals; and in turn, providing detailed insights into the important trends and opportunities within this increasingly crucial profession. This year, the study conducted its largest-ever global survey of cybersecurity professionals, with over 19,000 individuals taking part (3,694 of which hailing from Europe), further allowing it to ascertain an even clearer and progressively more complete profile of the information security workforce; with stronger understandings of areas and issues such as pay scales, skills gaps,... Read more →

CISSP Spotlight: Samana Haider

Name: Samana Haider Title: Manager, Forcepoint Security Labs Employer: Forcepoint Location: Dublin, Ireland Education: MSc Computer Science Years in IT: 15 Years in cybersecurity: 7 Cybersecurity certifications: CISSP How did you decide upon a career in cybersecurity? I started my career in IT in the education sector where I was a lecturer at a university back home in Pakistan. I started working in HP managing SAP administration. I got the opportunity to work with one of the leading Irish banks where I was responsible for implementing security controls for SAP administration and ensuring SOX compliance. The security aspect of that... Read more →

Weekly Security Headlines: WannaCry Spillover, Mickey Mouse Hacked, DocuSign Phishing and 560 Million Passwords

Not surprisingly, WannaCry remained top of mind last week. We’re sure you’re doing everything you can to patch your environment and prevent similar ransomware attacks in the future. Here are some WannaCry headlines (and other security news) that caught our eye last week. WannaCry Rolls On According to the Dark Reading article WannaCry's 'Kill Switch' May Have Been a Sandbox-Evasion Tool, researchers early last week were looking into the “kill switch” and consensus seemed to be building that it was a poorly constructed VM analysis/sandbox evasion technique. WIRED went a bit deeper with their assessment The WannaCry Ransomware Hackers Made... Read more →

SSCP Spotlight: George McPherson

Name: George McPherson Title: Information Security Analyst Employer: Duke Energy Location: Charlotte, North Carolina Degree: Currently working towards Associates Degree in "Cyber Security" Years in IT: 4 Years Years in information security: 3 Years Cybersecurity certifications: SSCP, Security+, MTA Security How did you decide upon a career in cybersecurity? When I first entered IT and started sitting for IT certifications I noticed that when I received my score report, I would always score the highest on security-related questions. When reflecting on this revelation, I realized that I also got excited about security and investigating security-related issues. Why did you get... Read more →

2017 Americas ISLA – nominations are open!

(ISC)² has had the honor of celebrating leaders in cyber, information, software and infrastructure security since 2004. The 2017 Americas Information Security Leadership Awards (AM-ISLA®) are now open for nominations. We can’t wait to hear about your latest achievements, so please tell us about a cybersecurity leader whose work deserves recognition by the industry and by their peers. The categories for nomination are: Information Security Practitioner Senior Information Security Professional Up-and-Coming Information Security Professional Community Awareness The deadline to submit is June 7, 2017 at 11:59pm EST. Nominations and awards are open to (ISC)² members and non-members alike. Winners will... Read more →

CISSP Spotlight: George Romas

Name: George Romas Title: Chief Engineer Employer: DXC Technology Location: Washington, D.C., U.S.A. Education: Bachelor of Science, Computer Science and Economics, Union College, Schenectady, NY Years in IT: 34 Years in cybersecurity: 34 Cybersecurity certifications: CISSP How did you decide upon a career in cybersecurity? Cybersecurity came as part of the job. I’ve spent most of my career supporting the intelligence community, where every system or solution that you develop has a cybersecurity component. As I gained more knowledge and expertise, that security frame of mind becomes a way of life. Why did you get your CISSP®? The main reason... Read more →