ISC2 Blog

Will Banks Adopting Open-Source Leave Them More Open to Supply Chain Cyber Attacks?

One of the biggest vindications of open-source software in recent years has been its widespread adoption by the finance sector. By Joe Fay In its 2022 State of Open Source in Financial Services report, the Fintech Open Source Foundation (FINOS) found that 87% of respondents agreed that open source is “valuable to the future” of the industry, with open-source consumption and the use of open standards seen as top factors in increasing productivity. Banks and other institutions have clearly decided it makes no sense to constantly develop their own software from the ground up when open-source alternatives exist. This not... Read more →

Cybersecurity’s Shift from IT to OT

As malware spreads from IT to OT, the focus is shifting from business interruptions to physical harm, with the final responsibility resting with the CEO. Amid this fundamental change in threat and attack strategy, organizations need to focus on asset-centric cyber-physical systems and ensure teams are in place to handle monitoring and management of these key systems. By Dave Cartwright, CISSP Cybersecurity professionals are used to defending IT systems against malware and other cyber attacks. In recent years, though, attackers have increasingly targeted Operational Technology (OT) systems. What is OT? According to the UK’s National Cyber Security Centre (NCSC) it... Read more →

New cybersecurity express-learning opportunities with (ISC)² Skill-Builders

Cybersecurity never stands still. It’s a constantly evolving field that requires constant learning to stay in front of cyberthreats. (ISC)² Skill-Builders are a new way to stay current and demonstrate your knowledge of emerging cybersecurity topics. The quick, on-demand learning from cybersecurity’s leading professional organization features content created by industry experts. Learning activities focused on real-world activities ensure the content is accessible and relevant. Anyone can access the courses anytime, anywhere. (ISC)² Skill-Builders dive into the following focus areas: Entry-Level Cybersecurity Skill-Builders - Learn valuable fundamental skills as you pursue a career in cybersecurity. Cloud Security - Get up to... Read more →

Cybersecurity Industry News Review - June 6, 2023

$400 million fund for AI and robotics start-ups, OpenAI to fund cybersecurity efforts while research shows that cybercriminals are targeting the friends and families of high-value organization executives. By Chris Green IQ Capital Gears Up For ‘Deep Tech’ Investment London-based venture investor IQ Capital has successfully raised $400 million (£320 million) across two funds, which it plans to invest in an array of so-called ‘deep tech’ start-ups focused on tech areas including artificial intelligence (AI), robotics, quantum computing and others. The venture capital firm primarily invests in seed to Series A stage startups in the UK and Europe. Its previous... Read more →

Infosecurity Europe 2023 Preview – Our Pick of the Keynote Sessions

In the first of two previews of Infosecurity Europe 2023, we look at our top picks for unmissable keynote sessions across the three days of the conference, held at ExCel in London from June 20-22. By John E. Dunn As the pivotal cybersecurity conference in the region, every Infosecurity Europe conference is oriented to topical themes. This year is no exception, with the speaker lineup covering everything from the on-going anxiety of cyberwar, how zero trust can be made to work once it leaves the drawing board, and the never-ending puzzle of assessing supply chain risk. The following is our... Read more →

Practitioners Point to Zero Trust As Key To User Access Security

By Chris Green Nearly 4,000 cybersecurity professionals weighed in and 55% feel Zero Trust is the most impactful to keep organizations secure. The debate over the most effective form of access control has been waging for as long as computers have had individual logins. Whether its passwords, two-factor authentication, location-based authentication, password-less login – the debate is split. Or is it? In a survey conducted by (ISC)² on LinkedIn ahead of World Password Day revealed the extent to which zero trust policies are being embraced as part of stricter authentication practices. The poll of nearly 4,000 cybersecurity professionals revealed that... Read more →

SEC Cybersecurity Proposals Survey Exposes Need for Board-Level Cyber Skills

Respondents highlight the need for appointing and developing more board-level cybersecurity expertise, while some are concerned that disclosure regulations unintentionally risk helping criminals alongside improving investor transparency. By Joe Fay U.S. Securities and Exchange Commission (SEC) proposals to boost cybersecurity reporting requirements for publicly traded firms have not resonated with (ISC)² members in a survey, with over half unaware of the proposals and a fifth suggesting they could benefit threat actors inadvertently through providing investors with enhanced disclosure. In 2022, the SEC proposed new rules on cybersecurity that impact publicly traded companies, with standards for disclosures around cyber security risk... Read more →

#IdentityManagementDay - Best Practices to Help Keep Your Organization Secure

By Chinatu Uzuegbu, CISSP, CEO/Managing Cyber Security Consultant at RoseTech CyberCrime Solutions Ltd. We kicked off the Identity and Access Management Processes from the Top-Level Management approach. The Identity and Access Management Security Steering Committee is a group of C-Suites leaders, also referred to as the respective Data and Asset Owners from the various Business Units of my organization. The group met and established the governing policy around the Identity and Access Management Processes. The governance covers the Mandatory Access Control Policy and Trust Policy of the organization which are automatically enforced as the baselines on default. The governance of... Read more →

Push Notification Is More Secure Than SMS 2FA, So Why the Reluctance to Enable It?

Forget SMS 2FA authentication – Twitter and others are making it less attractive by either charging for it or phasing it out altogether. But there’s a better alternative if only tech companies were willing to invest. By John E. Dunn Mention Twitter and two factor authentication (2FA) in the same breath right now and security watchers will immediately think about a puzzling announcement the company made less than two months ago. The gist was that anyone using or adding SMS 2FA to their account would have to buy a subscription to Twitter Blue for $8 per month to continue to... Read more →

LATEST CYBERTHREATS AND ADVISORIES - APRIL 7, 2023

The U.S. government takes down another dark web forum, Western Digital suffers a cyberattack and the fastest acting ransomware to date. Here are the latest threats and advisories for the week of April 7, 2023. By John Weiler Threat Advisories and Alerts Websites Built with Elementor Pro and WooCommerce under Attack Millions of WordPress websites using the popular Elementor Pro website builder and the WooCommerce plugin have been exposed to a serious security vulnerability. The flaw, which affects Elementor Pro versions 3.11.6 and earlier, allows malicious actors to change the default user privileges to include administrator access. The vulnerability was... Read more →

CYBERSECURITY INDUSTRY NEWS REVIEW - APRIL 4, 2023

UK government potentially skimps on senior cyber role salary as the NCSC calls for more investment in people, Microsoft talks up the potential for ChatGPT and the US moves to ban spyware. By Joe Fay U.K. Treasury Tries to Drive Down Inflation with Paltry Cybersecurity Salary The U.K.’s Treasury department is looking for an “experienced” Head of Cyber Security willing to work for £55,500. The successful candidate will be “working at the heart of Government in a time of momentous change and offering a level of exposure and challenge that is hard to find anywhere else”. Amongst other things, they... Read more →

SSCP Members – We Need Your Input

The SSCP certification is held by more than 7,000 professionals around the world. Known for its technical rigor, the members who hold this qualification are typically working in areas like IT administration, networks security, security operations or incident response. The exam was last refreshed in November 2021 which that means it is time for us to begin the process again. We announced last week that the CISSP will be starting the revision process in January and so will the SSCP. We need to hear from you, the certification holders. As we prepare for a Job Task Analysis (JTA) Study Workshop... Read more →

Latest Cyberthreats and Advisories - November 18, 2022

Beware the BatLoader, the NSA calls for more memory-safe programming language use and ransomware causes more trouble in Australia….Here are the latest threats and advisories for the week of November 18, 2022. Threat Advisories and Alerts Researchers Sound Alarm on Dangerous BatLoader Malware Dropper A dangerous new malware loader with features for determining whether it's running on business or home computers has begun rapidly infecting systems worldwide over the past few months. Researchers at VMware Carbon Black claim the threat, dubbed BatLoader, is being used to distribute a variety of malware tools including a banking Trojan, an information stealer, and... Read more →

OT: The New Gold Mine for Hackers and How CDS Can Secure It

By Dr. Fulvio Arreghini, CSSLP, Head of International Sales at INFODAS GmbH. Fulvio is a CDR of the Italian Navy (reserve). He has an Master Degree in communication engineering and a PhD in Information engineering. During his active service in the Navy he’s been working mainly in the areas of Secure Tactical Communication and Command and Control systems, acting often also as security officer and risk manager. Since 2020 in the private sector, he joined Infodas at first as solution architect to later become head of international sales. Cyberattacks to operational technology (OT) are on the rise and the providers... Read more →

LATEST CYBERTHREATS AND ADVISORIES - SEPTEMBER 23, 2022

Cyberattacks on the video game industry, big-name brand data breaches and the Tea Pot gangster make headlines this week. Here are the latest threats and advisories for the week of September 23, 2022. Threat Advisories and Alerts Iranian Cybercriminals Target Western Nations Bad actors associated with the Iranian Government’s Islamic Revolutionary Guard Corps (IRGC) have been exploiting Microsoft Exchange, Fortinet and VMware Horizon Log4j vulnerabilities. The attacks have hit critical US infrastructure sectors as well as Canadian, Australian and U.K. organizations. Rather than targeting specific sectors or entities, the cybercriminals are exploiting known vulnerabilities on unprotected networks to extort data... Read more →

(ISC)² and Venafi Explore The Strange New World of Machine Identity Management

Earlier this year, (ISC)² hosted a webinar about a new kind of challenge facing cybersecurity: machine identity management. Although this security component has only received sizable attention over the last couple of years, Gartner ranked it among the top eight security trends for 2021. In the webinar, Kevin Bocek, Vice-President of Security Strategy & Threat Intelligence for Venafi, discussed the problems that arise when machine identities fail, infamous machine identity attacks and the protective measures organizations can take. Machine identities – TLS, SSH, and code signing keys and certificates – control encryption, authentication, and code execution for software-based machines such... Read more →

The ‘Hottest’ IT Security Technologies in 2022

Did you catch The ‘Hottest’ IT Security Technologies in 2022 webinar? If not, we are here to share the key takeaways. Steve Piper, CISSP, CEO and Founder of CyberEdge Group joined moderator Brandon Dunlap in this initial kickoff of a five-part webinar series discussing key insights from the 2022 Cyberthreat Defense Report. This webinar focused on which security technologies are most widely deployed and most planned for acquisition in 2022. The 2022 Cyberthreat Defense Report is now in its 9th year and surveys 1,200 IT security and decision-makers and practitioners in organizations of 500+ employees. The survey is designed to... Read more →

Effective Security Using Zero Trust Architecture

By Jagadish Paranthaman, CISSP, Global Cybersecurity Solutions Architect at Avanade Zero Trust is a cybersecurity model centered around an end-to-end approach for resource and data protection with a principle not to trust completely but conduct continual verification. Zero Trust assumes the non-existence of a perimeter. It is not a product but a collection of architectural premises and security patterns encompassing identity, endpoints, networks and hosting infrastructure, applications, and data. Zero Trust Architecture is achieved through solutions that sit between requesting subject (identity) and a fulfilling resource (service or application). Solutions can be a combination of agent-based, cloud-based or enterprise deployment... Read more →

(ISC)² and F5 Examine OWASP’S “Top 10” Report on New Web Application Security Risks

In late 2021, the Open Web Application Security Project® (OWASP®) Foundation released a revised list of the 10 most critical security risks to web applications. The OWASP Top 10 list is the foundation’s flagship project for guidance on securing web applications. (ISC)² hosted a webinar in which Byron McNaught from the application security company F5 discussed key changes in the Top 10 and how to use the list as a foundation for protecting applications. The webinar highlighted the fact that while the OWASP Top 10 had remained largely unchanged for nearly 20 years, the 2021 version included significant updates. For... Read more →

Summary of March Inside (ISC)2 Webinar: Stay Vigilant

As the war in Ukraine rages on, (ISC)² leaders took the opportunity to remind cybersecurity practitioners in the most recent Inside (ISC)² webinar of a simple but essential message: Be vigilant. As the hostilities continue, it is possible the war will spill over into the cyber realm, said Jon France, who joined (ISC)² in January as the organization’s first CISO. Cyber is the “fourth plain after land, sea and air” in the Ukraine war, he said. France joined CEO Clar Rosso and Board of Directors Chairperson Zachary Tudor for the quarterly webinar, during which they provided updates on the organization’s... Read more →