(ISC)² Blog

SSCP Members – We Need Your Input

The SSCP certification is held by more than 7,000 professionals around the world. Known for its technical rigor, the members who hold this qualification are typically working in areas like IT administration, networks security, security operations or incident response. The exam was last refreshed in November 2021 which that means it is time for us to begin the process again. We announced last week that the CISSP will be starting the revision process in January and so will the SSCP. We need to hear from you, the certification holders. As we prepare for a Job Task Analysis (JTA) Study Workshop... Read more →

Latest Cyberthreats and Advisories - November 18, 2022

Beware the BatLoader, the NSA calls for more memory-safe programming language use and ransomware causes more trouble in Australia….Here are the latest threats and advisories for the week of November 18, 2022. Threat Advisories and Alerts Researchers Sound Alarm on Dangerous BatLoader Malware Dropper A dangerous new malware loader with features for determining whether it's running on business or home computers has begun rapidly infecting systems worldwide over the past few months. Researchers at VMware Carbon Black claim the threat, dubbed BatLoader, is being used to distribute a variety of malware tools including a banking Trojan, an information stealer, and... Read more →

OT: The New Gold Mine for Hackers and How CDS Can Secure It

By Dr. Fulvio Arreghini, CSSLP, Head of International Sales at INFODAS GmbH. Fulvio is a CDR of the Italian Navy (reserve). He has an Master Degree in communication engineering and a PhD in Information engineering. During his active service in the Navy he’s been working mainly in the areas of Secure Tactical Communication and Command and Control systems, acting often also as security officer and risk manager. Since 2020 in the private sector, he joined Infodas at first as solution architect to later become head of international sales. Cyberattacks to operational technology (OT) are on the rise and the providers... Read more →

LATEST CYBERTHREATS AND ADVISORIES - SEPTEMBER 23, 2022

Cyberattacks on the video game industry, big-name brand data breaches and the Tea Pot gangster make headlines this week. Here are the latest threats and advisories for the week of September 23, 2022. Threat Advisories and Alerts Iranian Cybercriminals Target Western Nations Bad actors associated with the Iranian Government’s Islamic Revolutionary Guard Corps (IRGC) have been exploiting Microsoft Exchange, Fortinet and VMware Horizon Log4j vulnerabilities. The attacks have hit critical US infrastructure sectors as well as Canadian, Australian and U.K. organizations. Rather than targeting specific sectors or entities, the cybercriminals are exploiting known vulnerabilities on unprotected networks to extort data... Read more →

(ISC)² and Venafi Explore The Strange New World of Machine Identity Management

Earlier this year, (ISC)² hosted a webinar about a new kind of challenge facing cybersecurity: machine identity management. Although this security component has only received sizable attention over the last couple of years, Gartner ranked it among the top eight security trends for 2021. In the webinar, Kevin Bocek, Vice-President of Security Strategy & Threat Intelligence for Venafi, discussed the problems that arise when machine identities fail, infamous machine identity attacks and the protective measures organizations can take. Machine identities – TLS, SSH, and code signing keys and certificates – control encryption, authentication, and code execution for software-based machines such... Read more →

The ‘Hottest’ IT Security Technologies in 2022

Did you catch The ‘Hottest’ IT Security Technologies in 2022 webinar? If not, we are here to share the key takeaways. Steve Piper, CISSP, CEO and Founder of CyberEdge Group joined moderator Brandon Dunlap in this initial kickoff of a five-part webinar series discussing key insights from the 2022 Cyberthreat Defense Report. This webinar focused on which security technologies are most widely deployed and most planned for acquisition in 2022. The 2022 Cyberthreat Defense Report is now in its 9th year and surveys 1,200 IT security and decision-makers and practitioners in organizations of 500+ employees. The survey is designed to... Read more →

Effective Security Using Zero Trust Architecture

By Jagadish Paranthaman, CISSP, Global Cybersecurity Solutions Architect at Avanade Zero Trust is a cybersecurity model centered around an end-to-end approach for resource and data protection with a principle not to trust completely but conduct continual verification. Zero Trust assumes the non-existence of a perimeter. It is not a product but a collection of architectural premises and security patterns encompassing identity, endpoints, networks and hosting infrastructure, applications, and data. Zero Trust Architecture is achieved through solutions that sit between requesting subject (identity) and a fulfilling resource (service or application). Solutions can be a combination of agent-based, cloud-based or enterprise deployment... Read more →

(ISC)² and F5 Examine OWASP’S “Top 10” Report on New Web Application Security Risks

In late 2021, the Open Web Application Security Project® (OWASP®) Foundation released a revised list of the 10 most critical security risks to web applications. The OWASP Top 10 list is the foundation’s flagship project for guidance on securing web applications. (ISC)² hosted a webinar in which Byron McNaught from the application security company F5 discussed key changes in the Top 10 and how to use the list as a foundation for protecting applications. The webinar highlighted the fact that while the OWASP Top 10 had remained largely unchanged for nearly 20 years, the 2021 version included significant updates. For... Read more →

Summary of March Inside (ISC)2 Webinar: Stay Vigilant

As the war in Ukraine rages on, (ISC)² leaders took the opportunity to remind cybersecurity practitioners in the most recent Inside (ISC)² webinar of a simple but essential message: Be vigilant. As the hostilities continue, it is possible the war will spill over into the cyber realm, said Jon France, who joined (ISC)² in January as the organization’s first CISO. Cyber is the “fourth plain after land, sea and air” in the Ukraine war, he said. France joined CEO Clar Rosso and Board of Directors Chairperson Zachary Tudor for the quarterly webinar, during which they provided updates on the organization’s... Read more →

The Dilemma of Defense in Depth

By Ala' F. Wrikat, MSc, CISSP, CISM. Ala' is currently a specialist in policies and strategic studies at the Financial-sector's CERT of Jordan. Defense in depth strategy has proven its effectiveness in preventing cyber threats over the years. At the abstract level, most technical security controls are designed with two main components; 1) a knowledge base, and 2) a matching engine. Each security product has its own version of a growing knowledge base of feeds (whatever these feeds are). The content and how frequent these knowledge bases get updated are often the basis of competition between vendors. In this context,... Read more →

Elevating the Risk Discussion – Quantitative Analytics

By Charlene Deaver-Vazquez, CISSP, CISA. Charlene is the developer of Probabilistic Risk Modeling for Cyber (P-RMOD4Cyber) a framework of mathematical models for quantifying risk. There is a tendency to view the effectiveness of our cybersecurity practice through a single lens – compliance. We apply controls and best practices hardening our systems and continually monitoring our security posture. We implement defense in depth relying on strong perimeter defense and real-time analytics. At this point, we discuss risk in terms of defensive actions, what we’ve done and what we see based on our logs and alerts. What does a typical conversation around... Read more →

U.S. Cyber Command Operation Targets ‘Real-life Cyber Threats’

A U.S. Cyber Command (USCYBERCOM) task force has conducted “its first offensive cyber effect operation against real-life cyber threats.” Details of the operation have not been published, but the military says offensive cyberspace operations are “intended to project power by the application of force in or through cyberspace.” News of the operation, conducted by USCYBERCOM’s Cyber National Mission Force (CNMF) from February to August 2021, came in a news release from the Maryland Air National Guard’s 175th Cyber Operations Group, which took part in the mission. “USCYBERCOM’s CNMF plans, directs and synchronizes full-spectrum cyberspace operations to deter, disrupt and, if... Read more →

FTC: Fix Log4j Vulnerability, Or Else

A warning to companies from the Federal Trade Commission (FTC) to fix a “serious vulnerability” in the Java logging package Log4j comes as a reminder that cybersecurity teams must remain diligent in keeping up with cyber threats. Otherwise, they could end up costing their organizations millions in remediation and punitive fines. “The FTC intends to use its full legal authority to pursue companies that fail to take reasonable steps to protect consumer data from exposure as a result of Log4j, or similar known vulnerabilities in the future,” the commission said. It’s the first time the FTC has issued such a warning, indicating the commission... Read more →

Decisions, Decisions and the Role of Authorization

Technology and cybersecurity cannot be thought of as the responsibility of a siloed IT department – it is the lifeblood of the organization. In day-to-day operations, as well as during moments of crisis, a company’s different functional areas must be able to collaborate and must know who to turn to for leadership. System authorization has been employed in government for over 20 years, and it is becoming recognized outside government for the promise it holds as a practical approach for identifying and documenting business requirements for security, for ensuring that cost-effective controls are functioning appropriately, and for ensuring that weaknesses... Read more →

Poll Data: What CEOs Need to Know About Cybersecurity Going into 2022

The end of the year is a good time to reflect on the past 12 months and create a plan to improve in 2022. Like years past, 2021 revealed more of the same for the cybersecurity industry—more breaches, bigger ransomware attacks, higher stakes. Some of the most disruptive cyberattacks occurred this year, such as JBS Foods, Kaseya and Colonial Pipeline. These attacks received global attention and spotlighted the need for even more attention on cybersecurity best practices. To help CEOs around the globe better understand cyber risks and how to make their businesses more secure, (ISC)² conducted an online poll... Read more →

(ISC)² Celebrates Cybersecurity Awareness Month With Treasure Trove of Knowledge Building Resources

It’s October! And that can mean only one thing. It’s time to kick off the annual Cybersecurity Awareness Month, hosted by the National Cyber Security Alliance (NCSA) and the Cybersecurity & Infrastructure Security Agency (CISA). With remote work the new normal for most and ransomware attacks at peak fever pitch, there’s no time like now to learn about cybersecurity, or for those in the know, for a refresher on some of the common pitfalls to avoid in order to keep your data safe. In celebration of this month of best practices discovery, (ISC)² created a one-stop-shop to find helpful cybersecurity... Read more →

National Small Business Week: 10 Best Practices for Small Business Cybersecurity

A recent survey conducted by CNBC and Momentive found that 56% of small business owners are not concerned about being the victim of a cyberattack in the next year and that only 28% of them have a response plan in place in case of a cyberattack. This does not bode well for their longevity, as other industry data shows that 60% of small businesses that suffer a data breach will be out of business within six months. The high cost of remediation and the potential for reputational damage can be more than most small businesses can withstand. Many times, the... Read more →

Cybersecurity Leaders: Think in Business Terms

The vast majority of cybersecurity chiefs (93%) do not report to the CEO, according to a recently published report. As a result, a lack of communication between the C-suite and cybersecurity leaders keeps top executives largely in the dark about their organizations' cybersecurity risks and overall security posture. The report, published by LogRhythm and based on research by the Ponemon Institute, polled 1,426 security and technology leaders. “On average, respondents are three levels away from the CEO, which makes it very difficult to ensure that leadership has an accurate and complete understanding of security risks facing the organization,” the report... Read more →

These Roles Require Cybersecurity Training

With data breach rates rising and criminal attack methods becoming more sophisticated each day, it is essential for every organization to take security seriously. That means cybersecurity training and education so that key stakeholders understand the risks that businesses are facing, and which strategies are most effective for protection. Who should receive cybersecurity training in your organization? While your immediate reaction might be to think training should stay with the cybersecurity team, there are actually many roles that would benefit from security knowledge and education. Cybersecurity is a shared responsibility and since many companies do not have a formal security... Read more →

Survey: Cybersecurity Community Increasingly Concerned About SolarWinds Breach

Few cybersecurity breaches have caused more consternation among industry experts than the far-reaching 2020 attack against SolarWinds. In fact, concern has built up throughout the cybersecurity community as new details come to light. In an (ISC)2 survey of 303 cybersecurity professionals fielded from February 10-28, 2021, a solid majority of respondents (86%) said they would have rated the breach “very” or “extremely severe” when they first learned about it. However, roughly six weeks after the incident was reported, as more details emerged, the number of respondents who indicated that the breach was “severe” increased from 51% to 55%. On a... Read more →