(ISC)² Blog

With new leadership at the helm, DHS may recruit more talent

If leadership truly does come from the top, having Kirstjen Neilsen as the newest Homeland Security secretary may prove promising when it comes to filling the jobs gap. After all, she’s the first person to bring industry experience to the role. Few things have the ability to obliterate people’s passion for their work like a terrible boss, especially when that boss lacks the knowledge and skills needed to guide an organization’s growth. But Kirstjen Neilsen certainly has the potential to really reform and improve the Department of Homeland Security. It’s exciting times, but that is not all the notable news... Read more →

Exploring Industrial Cyber Physical Security Enhancement

By Cevn Vibert, ICS Industrial Cyber Physical Security Advisor Cevn will be hosting the session Grass Roots Industrial Control Security at (ISC)² Secure Summit UK, between 12th and 13th December 2017. The industrial cybersecurity market is facing rapid changes as more threats are discovered, more impact is felt by end-users and cybersecurity vendors vie for leadership. My session will highlight both alerts and advice for end-users of automation and control systems (ICS/OT), as well as selected advisory notes for practitioners of Industrial Cyber Physical Security. Strategic methodologies and programmes of activities for mitigation of impacts on IIOT, IOT and how... Read more →

SSCP Spotlight: Mario Bardowell

Name: Mario Damar Bardowell Title: Security Analyst Employer: Leidos Location: Orlando, Florida, U.S.A. Degree: B.S. in Network Systems Communications Years in IT: 8 Years in information security: 2 Cybersecurity certifications: SSCP, CISSP, CompTIA’s CASP and Security +, CEH How did you decide upon a career in cybersecurity? The decision to pursue a career in cybersecurity was made due to the impression I received when I got a chance to work with an information security professional in my very first role as a help desk analyst. The man was sharp and always did things by the book. He didn't cut corners... Read more →

As cyber grows more popular, so do techniques for developing security skills

It’s not only the tech sector that’s talking about cybersecurity. The cybersecurity industry has been advocating for awareness training for the better part of the last decade, and since the Equifax breach, security has gone mainstream. With its new popularity, cybersecurity has evolved into a hot political issue as well. One result of the attention is increased regulations, which has many defense contractors scrambling to meet the December 31, 2017 deadline for Defense Federal Acquisition Regulation Supplement (DFARS) compliance. In a year of many major breaches, legislators are eager to move forward on the Consolidated Audit Trail (CAT) project to... Read more →

ISO 27001 – Between the Reality and the Myth

By Tony Chebli, Senior Manager, Information Security Department/Risk Management Division, Credit Libanais S.A.L Tony will be hosting the session ISO 27001 Between the Reality and the Myth at (ISC)² Secure Summit MENA in Dubai on the 21st and 22nd November 2017. It seems like yesterday, but actually it has been over 13 years, since I obtained my ISO 27001 Lead Auditor certification and started travelling from country to country around the Middle East, preaching the benefits of ISO 27001 certification and its importance to companies that are looking to secure their information assets. I admit it was (and still is)... Read more →

CCSP Spotlight: Greg Harris

Name: Greg Harris Title: Senior Security Consultant and Adjunct Professor Employer: Big 4 Firm and Kennesaw State University Location: Alpharetta, Georgia, U.S.A. Degree: MBA, MS in Information Systems, BS in Computer Science & Mathematics Years in IT: 15+ Years in cybersecurity: 13+ Cybersecurity certifications: CISSP, CCSP, CRISC, CISM, CISA, GCFA How did you decide upon a career in cybersecurity? McKesson Corporation hired me as a Security Infrastructure Engineer through a campus-recruiting program at Kennesaw State University in 2003. My undergraduate degree was a Bachelor of Science with a double major in Computer Science and Mathematics. With my Navy Electronic Warfare... Read more →

Has Science Fiction Become Reality?

By Lorna Trayan, Associate Partner Security at IBM Security Services Lorna will be hosting the session Security Threats and Trends - Middle East Region at (ISC)² Secure Summit MENA in Dubai on the 21st and 22nd November 2017. I’m one of those speakers that every year presents a topic that has the same title. I wonder if people at some point ask themselves ‘Is she presenting this topic again?!’. I started this in 2010 and have been repeating it every year since then. What’s this miraculous topic that never gets old you wonder? The topic is Security Trends and Threats... Read more →

Security Headlines: Hopping Around

This week’s National Cybersecurity Awareness campaign focused on feeding the pipeline to narrow the skills gap in the cybersecurity workforce. While StaySafeOnline declared “The Internet Wants You: Consider a Career in Cybersecurity,” Ransomware hopped to the headlines. Rabbit on the run ‘Bad Rabbit’, the third global outbreak of the year with similarities to NotPetya, struck companies throughout Russia and Eastern Europe with file-encrypting malware. This strand of ransomware metaphorically knocks on the user’s door by way of a malicious pop-up offering a Flash update. Though the outbreak was first reported, it’s suspected that the group behind the attack has been... Read more →

SSCP Spotlight: Tiffany Temple

Name: Tiffany Temple Title: Cyber Security Analyst Employer: City of Greensboro Location: Greensboro, North Carolina, U.S.A. Education: Bachelor of Science in Management Information Systems - East Carolina University, Master of Science in Information Technology Management - University of North Carolina at Greensboro Years in IT: 5 Years in information security: 4 Cybersecurity certifications: SSCP How did you decide upon a career in cybersecurity? I was encouraged by my current boss to transition from Help Desk duties to an Information Security role after she saw in me the analytical skills necessary to succeed. It was a seamless transition for me and... Read more →

Introducing (ISC)² EMEA ISLA 2017 Finalist: Peter O’Boyle

This year marks the first ever (ISC)² EMEA Information Security Leadership Awards (ISLA), a chance for our community to recognise fellow information security and management professionals going the extra mile to enhance security across Europe, the Middle East and Africa. Overall, we received a staggering number of impressive submissions, over 200, and these were shortlisted down to our finalists by our judges, members of the Europe, Middle East and Africa Advisory Council (EAC). Winners will be announced at our Secure Summit UK on 12 December 2017. In the meantime, we will be sharing their stories on the blog. Here is... Read more →

Introducing (ISC)² EMEA ISLA 2017 Finalist: Bridget Kenyon

This year marks the first ever (ISC)² EMEA Information Security Leadership Awards (ISLA), a chance for our community to recognise fellow information security and management professionals going the extra mile to enhance security across Europe, the Middle East and Africa. Overall, we received a staggering number of impressive submissions, over 200, and these were shortlisted down to our finalists by our judges, members of the Europe, Middle East and Africa Advisory Council (EAC). Winners will be announced at our Secure Summit UK on 12 December 2017. In the meantime, we will be sharing their stories on the blog. Here is... Read more →

Why Non-EU based Businesses may be affected by the EU General Data Protection Regulation (GDPR)?

By Yves Le Roux, (ISC)² EMEA Advisory Council Co-Chair & Privacy Workgroup Lead Yves will be hosting the half-day workshop GDPR: Charting Experience on the March to May 2018 at (ISC)² Secure Summit MENA, in Dubai on the 21st and 22nd November 2017. The General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) is a regulation by which the European Parliament, the Council of the European Union and the European Commission intend to strengthen and unify data protection for all individuals within the European Union (EU). The regulation was adopted in April last year. It becomes enforceable from 25th May 2018... Read more →

SSCP Spotlight: Jasmin Landry

Name: Jasmin Landry Title: IT Security Analyst Employer: SecureOps Location: Montreal, Canada Years in IT: 4 Years in information security: 3 Cybersecurity certifications: SSCP, OSCP, CEH, eJPT, CCNA: Security, MCSA How did you decide upon a career in cybersecurity? It all started when I was a teenager. I enjoyed video games and I was curious about how they were created, so I decided to pursue education in programming. I quickly switched path though, after my first networking class. The teacher introduced us to Wireshark and I was just so amazed at what it could do, and what I was able... Read more →

Open Source — and Associated Risks — are the New Normal

By Tunde Ogunkoya, Consulting Partner, Africa, at DeltaGRiC Consulting (Pty) ltd. Tunde will be hosting the session Open Source; Pathway to Being or Not Being the VulN Victim at (ISC)² SecureJohannesburg 2017 on 5th October, 2017. The use of Open Source Software (OSS) has come a long way from when developers and organisations tried to avoid it. Today Open Source has become a go-to saving grace within most DevOps teams under pressure to roll out new functionality and features ahead of competition. Unfortunately, levels of vulnerability have grown with the trend as DevOps remain largely unaware of the risks or... Read more →

Top 10 (ISC)² Webcasts of 2017

(ISC)² webcasts are a great source for insight into all areas of security. From the Internet of Things to malware and compliance, the topics vary. Here are the top 10 (ISC)² webcasts for 2017 so far as ranked by cybersecurity professionals: Part 1: Future of SIEM - Why Static Correlation Fails Insider Threat Detection Hackers stealing credentials and operating in your corporate network…disgruntled employees collecting customer lists and design materials for a competitor...malware sending identity information back to random domains…these common threats have been with us for years and are only getting worse. Most organizations have invested large amounts in... Read more →

CCSP Spotlight: Adam Boulton

Name: Adam Boulton Title: Senior Vice President, Security Technology Employer: BlackBerry Location: United Kingdom Degree: Bachelor of Science (Honors) in Software Engineering Years in IT: 12 Years in cybersecurity: 12 Cybersecurity certifications: CCSP, CISSP, CSSLP, CSTM, QSTM, OCJA How did you decide upon a career in cybersecurity? I’ve been really interested in technology for as long as I can remember. I was fortunate enough to know that since my early teens I wanted my career to be in software engineering. I am sure my story is very similar to many others, technology really captured my imagination from early on. I... Read more →

CISSP Spotlight: Mark A. Singer

Name: Mark A. Singer Title: Principal Software Engineer Employer: DoD Sub-Contractor Location: Indianapolis, IN Education: Business Management Years in IT: 19 Years in cybersecurity: 12 Cybersecurity certifications: CISSP How did you decide upon a career in cybersecurity? Evolution. I stumbled into computers when I served in the U.S. Navy from 1985 to 1989 when PCs with 8086 processors were common. When I got out of the service, I was able to get a job working for Naval Avionics in Indianapolis and was placed in a role where I was doing local computer support on tempest computers (386, 486, & 486DX... Read more →

Security Headlines: Payouts and Panic

WannaCry and NotPetya aftermath means payouts and panic. Here are the top security headlines for the week of August 7, 2017: Big money, no whammies! It seems like the hackers behind WannaCry have cashed out their bitcoin into Monero, a harder to track cryptocurrency. Mo money means mo malware. The success – can we call it that? – of WannaCry and NotPetya means ransomware is not going away any time soon, because… well, people and businesses pay the ransom. What’s that definition of insanity? Oh yeah, doing the same thing and expecting a different result… Tripwire research indicates that two-thirds... Read more →

SIEM: Understanding, Parsing and Correlating Logs

Building an effective SIEM requires ingesting log messages and parsing them into useful information. While it might be easy to stream, push and pull logs from every system, device and application in your environment, that doesn’t necessarily improve your security detection capabilities. What you do with your logs – correlation, alerting and automated response – are the strength of a SIEM. Real-time security starts with understanding, parsing and developing actionable information and events from your log messages. With the launch of a new site, (ISC)² was presented an opportunity to refine our security monitoring services. Linked below is an example... Read more →

CISSP Spotlight: Rob Turner

Name: Rob Turner Title: Senior Cyber Network Defense Analyst Employer: DXC Technology (formerly Hewlett-Packard Enterprise) Title: Computer Technology Program Coordinator Employer: Ball State University Location: Indiana, U.S.A. Education: BS in Computer Technology, Graduate Certificate in Information System Security Management, MS in Information and Communication Sciences Years in IT: 10 Years in Cybersecurity: 7 Cybersecurity certifications: CISSP-ISSAP, CISSP, CCNA-Security, CEH, CHFI, ECSA How did you decide upon a career in cybersecurity? Cybersecurity had always been an aspect of my career as a systems analyst/administrator. The more proactive I became at securing systems and networks, the more research and interest I developed... Read more →