(ISC)² Blog

Has Science Fiction Become Reality?

By Lorna Trayan, Associate Partner Security at IBM Security Services Lorna will be hosting the session Security Threats and Trends - Middle East Region at (ISC)² Secure Summit MENA in Dubai on the 21st and 22nd November 2017. I’m one of those speakers that every year presents a topic that has the same title. I wonder if people at some point ask themselves ‘Is she presenting this topic again?!’. I started this in 2010 and have been repeating it every year since then. What’s this miraculous topic that never gets old you wonder? The topic is Security Trends and Threats... Read more →

Security Headlines: Hopping Around

This week’s National Cybersecurity Awareness campaign focused on feeding the pipeline to narrow the skills gap in the cybersecurity workforce. While StaySafeOnline declared “The Internet Wants You: Consider a Career in Cybersecurity,” Ransomware hopped to the headlines. Rabbit on the run ‘Bad Rabbit’, the third global outbreak of the year with similarities to NotPetya, struck companies throughout Russia and Eastern Europe with file-encrypting malware. This strand of ransomware metaphorically knocks on the user’s door by way of a malicious pop-up offering a Flash update. Though the outbreak was first reported, it’s suspected that the group behind the attack has been... Read more →

SSCP Spotlight: Tiffany Temple

Name: Tiffany Temple Title: Cyber Security Analyst Employer: City of Greensboro Location: Greensboro, North Carolina, U.S.A. Education: Bachelor of Science in Management Information Systems - East Carolina University, Master of Science in Information Technology Management - University of North Carolina at Greensboro Years in IT: 5 Years in information security: 4 Cybersecurity certifications: SSCP How did you decide upon a career in cybersecurity? I was encouraged by my current boss to transition from Help Desk duties to an Information Security role after she saw in me the analytical skills necessary to succeed. It was a seamless transition for me and... Read more →

Introducing (ISC)² EMEA ISLA 2017 Finalist: Peter O’Boyle

This year marks the first ever (ISC)² EMEA Information Security Leadership Awards (ISLA), a chance for our community to recognise fellow information security and management professionals going the extra mile to enhance security across Europe, the Middle East and Africa. Overall, we received a staggering number of impressive submissions, over 200, and these were shortlisted down to our finalists by our judges, members of the Europe, Middle East and Africa Advisory Council (EAC). Winners will be announced at our Secure Summit UK on 12 December 2017. In the meantime, we will be sharing their stories on the blog. Here is... Read more →

Introducing (ISC)² EMEA ISLA 2017 Finalist: Bridget Kenyon

This year marks the first ever (ISC)² EMEA Information Security Leadership Awards (ISLA), a chance for our community to recognise fellow information security and management professionals going the extra mile to enhance security across Europe, the Middle East and Africa. Overall, we received a staggering number of impressive submissions, over 200, and these were shortlisted down to our finalists by our judges, members of the Europe, Middle East and Africa Advisory Council (EAC). Winners will be announced at our Secure Summit UK on 12 December 2017. In the meantime, we will be sharing their stories on the blog. Here is... Read more →

Why Non-EU based Businesses may be affected by the EU General Data Protection Regulation (GDPR)?

By Yves Le Roux, (ISC)² EMEA Advisory Council Co-Chair & Privacy Workgroup Lead Yves will be hosting the half-day workshop GDPR: Charting Experience on the March to May 2018 at (ISC)² Secure Summit MENA, in Dubai on the 21st and 22nd November 2017. The General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) is a regulation by which the European Parliament, the Council of the European Union and the European Commission intend to strengthen and unify data protection for all individuals within the European Union (EU). The regulation was adopted in April last year. It becomes enforceable from 25th May 2018... Read more →

SSCP Spotlight: Jasmin Landry

Name: Jasmin Landry Title: IT Security Analyst Employer: SecureOps Location: Montreal, Canada Years in IT: 4 Years in information security: 3 Cybersecurity certifications: SSCP, OSCP, CEH, eJPT, CCNA: Security, MCSA How did you decide upon a career in cybersecurity? It all started when I was a teenager. I enjoyed video games and I was curious about how they were created, so I decided to pursue education in programming. I quickly switched path though, after my first networking class. The teacher introduced us to Wireshark and I was just so amazed at what it could do, and what I was able... Read more →

Open Source — and Associated Risks — are the New Normal

By Tunde Ogunkoya, Consulting Partner, Africa, at DeltaGRiC Consulting (Pty) ltd. Tunde will be hosting the session Open Source; Pathway to Being or Not Being the VulN Victim at (ISC)² SecureJohannesburg 2017 on 5th October, 2017. The use of Open Source Software (OSS) has come a long way from when developers and organisations tried to avoid it. Today Open Source has become a go-to saving grace within most DevOps teams under pressure to roll out new functionality and features ahead of competition. Unfortunately, levels of vulnerability have grown with the trend as DevOps remain largely unaware of the risks or... Read more →

Top 10 (ISC)² Webcasts of 2017

(ISC)² webcasts are a great source for insight into all areas of security. From the Internet of Things to malware and compliance, the topics vary. Here are the top 10 (ISC)² webcasts for 2017 so far as ranked by cybersecurity professionals: Part 1: Future of SIEM - Why Static Correlation Fails Insider Threat Detection Hackers stealing credentials and operating in your corporate network…disgruntled employees collecting customer lists and design materials for a competitor...malware sending identity information back to random domains…these common threats have been with us for years and are only getting worse. Most organizations have invested large amounts in... Read more →

CCSP Spotlight: Adam Boulton

Name: Adam Boulton Title: Senior Vice President, Security Technology Employer: BlackBerry Location: United Kingdom Degree: Bachelor of Science (Honors) in Software Engineering Years in IT: 12 Years in cybersecurity: 12 Cybersecurity certifications: CCSP, CISSP, CSSLP, CSTM, QSTM, OCJA How did you decide upon a career in cybersecurity? I’ve been really interested in technology for as long as I can remember. I was fortunate enough to know that since my early teens I wanted my career to be in software engineering. I am sure my story is very similar to many others, technology really captured my imagination from early on. I... Read more →

CISSP Spotlight: Mark A. Singer

Name: Mark A. Singer Title: Principal Software Engineer Employer: DoD Sub-Contractor Location: Indianapolis, IN Education: Business Management Years in IT: 19 Years in cybersecurity: 12 Cybersecurity certifications: CISSP How did you decide upon a career in cybersecurity? Evolution. I stumbled into computers when I served in the U.S. Navy from 1985 to 1989 when PCs with 8086 processors were common. When I got out of the service, I was able to get a job working for Naval Avionics in Indianapolis and was placed in a role where I was doing local computer support on tempest computers (386, 486, & 486DX... Read more →

Security Headlines: Payouts and Panic

WannaCry and NotPetya aftermath means payouts and panic. Here are the top security headlines for the week of August 7, 2017: Big money, no whammies! It seems like the hackers behind WannaCry have cashed out their bitcoin into Monero, a harder to track cryptocurrency. Mo money means mo malware. The success – can we call it that? – of WannaCry and NotPetya means ransomware is not going away any time soon, because… well, people and businesses pay the ransom. What’s that definition of insanity? Oh yeah, doing the same thing and expecting a different result… Tripwire research indicates that two-thirds... Read more →

SIEM: Understanding, Parsing and Correlating Logs

Building an effective SIEM requires ingesting log messages and parsing them into useful information. While it might be easy to stream, push and pull logs from every system, device and application in your environment, that doesn’t necessarily improve your security detection capabilities. What you do with your logs – correlation, alerting and automated response – are the strength of a SIEM. Real-time security starts with understanding, parsing and developing actionable information and events from your log messages. With the launch of a new site, (ISC)² was presented an opportunity to refine our security monitoring services. Linked below is an example... Read more →

CISSP Spotlight: Rob Turner

Name: Rob Turner Title: Senior Cyber Network Defense Analyst Employer: DXC Technology (formerly Hewlett-Packard Enterprise) Title: Computer Technology Program Coordinator Employer: Ball State University Location: Indiana, U.S.A. Education: BS in Computer Technology, Graduate Certificate in Information System Security Management, MS in Information and Communication Sciences Years in IT: 10 Years in Cybersecurity: 7 Cybersecurity certifications: CISSP-ISSAP, CISSP, CCNA-Security, CEH, CHFI, ECSA How did you decide upon a career in cybersecurity? Cybersecurity had always been an aspect of my career as a systems analyst/administrator. The more proactive I became at securing systems and networks, the more research and interest I developed... Read more →

SSCP Spotlight: Ronald Ricohermoso

Name: Ronald Ricohermoso Title: IS Security Operations Analyst Employer: Ingram Micro Location: Philippines Degree: BS in Computer Science Years in IT: 6 Years in information security: 4 Cybersecurity certifications: SSCP, Security+, CEH, ITIL Foundation How did you decide upon a career in cybersecurity? I started working as a service desk, but decided to leave and specialize in other fields of IT (ex. networking or infrastructure). It started when I got a job at Ingram Micro as a security administrator and learned about the importance of information security and the challenges it offers due to the changing threat landscape. I learned... Read more →

Being the Fly on the Wall: The latest observations from the (ISC)² Member’s GDPR Task Force

By Yves Le Roux, CISSP, CISM, Co-Chair, Europe, Middle East and Africa Advisory Council (EAC) Recently our GDPR Task Force has found that despite efforts to prepare for the incoming regulation, many practitioners are finding that there is actually a lot more to do than originally anticipated, and are still in “discovery mode” about what data they hold. Data being fragmented and contained within individual business units means that knowing where data sets reside and mapping their flow is proving challenging. Businesses have just realised the mammoth task ahead of them Many businesses are still stuck in the initial stages... Read more →

SSCP Spotlight: Jae H. Moon

Name: Jae H. Moon Title: Sr. Systems (Linux/IA) Engineer Employer: Cray, Inc. Location: Salt Lake City, Utah, U.S.A. Degree: Master’s degree in Information Systems (emphasis on information security) Years in IT: 16+ Years in information security: 10+ Cybersecurity certifications: CompTIA Security +, SSCP How did you decide upon a career in cybersecurity? I had the opportunity to work as a summer intern at Scott Air Force Base in Illinois for the Department of Defense. I also worked as a Unix System Administrator for AT&T (after graduating from college) which focused heavily on implementing various information security principles and practices to... Read more →

CCSP Spotlight: Haruhiko Kurita

Name: Haruhiko Kurita Title: Senior Security Consultant Employer: NetOne Systems Location: Tokyo, Japan Degree: Master of Science, Physics Years in IT: 24 Years in cybersecurity: 21 Cybersecurity certifications: CISSP, CCSP, CISA, PCI DSS QSA How did you decide upon a career in cybersecurity? My career in cybersecurity started around 1995, when the internet was becoming popular here in Japan. My first product was HSM (Hardware Security Module) and I was interested in cryptography, as technology was very attractive to me. After three mergers, the company (Tandem) became bigger and I covered various parts of security, like F/W, antivirus, identity management,... Read more →

What we learned from this month’s European GISWS report

What is the GISWS? Since its first release in 2004, the biennial (ISC)²® Global Information Security Workforce Study (GISWS) has been gauging the opinions of information security professionals; and in turn, providing detailed insights into the important trends and opportunities within this increasingly crucial profession. This year, the study conducted its largest-ever global survey of cybersecurity professionals, with over 19,000 individuals taking part (3,694 of which hailing from Europe), further allowing it to ascertain an even clearer and progressively more complete profile of the information security workforce; with stronger understandings of areas and issues such as pay scales, skills gaps,... Read more →

CISSP Spotlight: Samana Haider

Name: Samana Haider Title: Manager, Forcepoint Security Labs Employer: Forcepoint Location: Dublin, Ireland Education: MSc Computer Science Years in IT: 15 Years in cybersecurity: 7 Cybersecurity certifications: CISSP How did you decide upon a career in cybersecurity? I started my career in IT in the education sector where I was a lecturer at a university back home in Pakistan. I started working in HP managing SAP administration. I got the opportunity to work with one of the leading Irish banks where I was responsible for implementing security controls for SAP administration and ensuring SOX compliance. The security aspect of that... Read more →