(ISC)² Blog

Reaching More Cybersecurity Professionals in a Growing Market

Though more attention has come to the security industry, cyber crime continues to challenge defense. Cybersecurity can no longer be ignored. In case you missed the press release last week, we’re letting you know that (ISC)² announced an open call for expert cybersecurity speakers for our 2018 Security Congress. In fact, there was lots of news coming out of (ISC)² last week. We are also welcoming nominations for the 2018 Information Security Leadership Award – Government. It’s the end of the year, which means the start of a new one. With the new year comes the promise of growth and... Read more →

ISO 27001 – Between the Reality and the Myth

By Tony Chebli, Senior Manager, Information Security Department/Risk Management Division, Credit Libanais S.A.L Tony will be hosting the session ISO 27001 Between the Reality and the Myth at (ISC)² Secure Summit MENA in Dubai on the 21st and 22nd November 2017. It seems like yesterday, but actually it has been over 13 years, since I obtained my ISO 27001 Lead Auditor certification and started travelling from country to country around the Middle East, preaching the benefits of ISO 27001 certification and its importance to companies that are looking to secure their information assets. I admit it was (and still is)... Read more →

CISSP Spotlight: Tony Harris

Name: Tony Harris Title: Consultant, Cyber Security Employer: KPMG LLP Location: Vancouver, Canada Education: MSc, Cyber Security (in progress) from the University of Liverpool, and Bachelor of Arts in American Studies & International Relations from the University of British Columbia Years in IT: 8 Years in cybersecurity: 7 Cybersecurity certifications: CISSP, CISM How did you decide upon a career in cybersecurity? I began my career in general IT processes eight years ago as your typical jack-of-all-trades IT. I wanted to narrow my focus into a specialty that I'd be interested in and cybersecurity ultimately was that choice. The reason was... Read more →

CISSP Spotlight: Mark A. Singer

Name: Mark A. Singer Title: Principal Software Engineer Employer: DoD Sub-Contractor Location: Indianapolis, IN Education: Business Management Years in IT: 19 Years in cybersecurity: 12 Cybersecurity certifications: CISSP How did you decide upon a career in cybersecurity? Evolution. I stumbled into computers when I served in the U.S. Navy from 1985 to 1989 when PCs with 8086 processors were common. When I got out of the service, I was able to get a job working for Naval Avionics in Indianapolis and was placed in a role where I was doing local computer support on tempest computers (386, 486, & 486DX... Read more →

Security Headlines: Payouts and Panic

WannaCry and NotPetya aftermath means payouts and panic. Here are the top security headlines for the week of August 7, 2017: Big money, no whammies! It seems like the hackers behind WannaCry have cashed out their bitcoin into Monero, a harder to track cryptocurrency. Mo money means mo malware. The success – can we call it that? – of WannaCry and NotPetya means ransomware is not going away any time soon, because… well, people and businesses pay the ransom. What’s that definition of insanity? Oh yeah, doing the same thing and expecting a different result… Tripwire research indicates that two-thirds... Read more →

SIEM: Understanding, Parsing and Correlating Logs

Building an effective SIEM requires ingesting log messages and parsing them into useful information. While it might be easy to stream, push and pull logs from every system, device and application in your environment, that doesn’t necessarily improve your security detection capabilities. What you do with your logs – correlation, alerting and automated response – are the strength of a SIEM. Real-time security starts with understanding, parsing and developing actionable information and events from your log messages. With the launch of a new site, (ISC)² was presented an opportunity to refine our security monitoring services. Linked below is an example... Read more →

SSCP Spotlight: Ronald Ricohermoso

Name: Ronald Ricohermoso Title: IS Security Operations Analyst Employer: Ingram Micro Location: Philippines Degree: BS in Computer Science Years in IT: 6 Years in information security: 4 Cybersecurity certifications: SSCP, Security+, CEH, ITIL Foundation How did you decide upon a career in cybersecurity? I started working as a service desk, but decided to leave and specialize in other fields of IT (ex. networking or infrastructure). It started when I got a job at Ingram Micro as a security administrator and learned about the importance of information security and the challenges it offers due to the changing threat landscape. I learned... Read more →

2017 Americas ISLA – nominations are open!

(ISC)² has had the honor of celebrating leaders in cyber, information, software and infrastructure security since 2004. The 2017 Americas Information Security Leadership Awards (AM-ISLA®) are now open for nominations. We can’t wait to hear about your latest achievements, so please tell us about a cybersecurity leader whose work deserves recognition by the industry and by their peers. The categories for nomination are: Information Security Practitioner Senior Information Security Professional Up-and-Coming Information Security Professional Community Awareness The deadline to submit is June 7, 2017 at 11:59pm EST. Nominations and awards are open to (ISC)² members and non-members alike. Winners will... Read more →

CISSP Spotlight: Uzoma Nwankwo

Name: Uzoma Nwankwo Title: Information Systems Security Officer Employer: Booz Allen Hamilton Location: National Business Park, Maryland, U.S.A. Education: MBA, BS in Computer Information Systems Years in IT: 12 Years in cybersecurity: 7 Cybersecurity certifications: CISSP, Certified Ethical Hacker (CEH), Comptia Security +, Project Management Professional (PMP) How did you decide upon a career in cybersecurity? I began my career as a systems administrator, supporting a project for a large government agency. When that project ended, I was presented with an opportunity to help another government agency with cybersecurity services in locations throughout the country. I travelled, met new people... Read more →

CISSP Spotlight: Robert Kato

Name: Robert Kato Title: IT Specialist Employer: African Development Bank Education: Bachelor’s Degree in Information Technology and Master’s Degree in Information Systems Years in IT: 10 Years in cybersecurity: 5 Cybersecurity certifications: CISSP, CCNA Security How did you decide upon a career in cybersecurity? I started my career mostly doing systems administration and networking roles. At that time, especially in Africa, connectivity and system performance were the most important aspects. We had servers that had 128GB of memory and a 64 Kpbs DSL link and would cost $500 monthly. However, with the increase in computing power and high speed internet... Read more →

CCSP Spotlight: Nanditha Rao

Name: Nanditha Rao Title: Information Systems Security Principal Employer: CSRA, LLC Degree: Master of Science in Computer Science Years in IT: 14 Years in cybersecurity: 11 Cybersecurity certifications: CCSP, CISSP How did you decide upon a career in cybersecurity? I found myself in the field due to the encouragement from my supervisors who believed that I had the analytical skills to move from IT risk management to IT security and cybersecurity. It was a natural transition for me, and I really enjoyed working in the domain. Since my start in the security field, I have actively worked to learn new... Read more →

So What’s New with the New UK Cybersecurity Strategy?

The intent to enforce… something quite significant actually. A first read and review of the news coverage around the United Kingdom’s (U.K.) new Cybersecurity Strategy earlier this month left many believing that there is little to report on cybersecurity from their new government. The initiatives articulated and the funding levels had already been publically discussed throughout the year, while any new intentions expressed in the strategy lacked detail. My initial reaction was disappointment that Teresa May’s government did not see fit to add new funds to the £1.9 billion committed by the previous Chancellor in November last year. Given that... Read more →

ISLA Winner: Mack Bhatia

The 2016 Americas Information Security Leadership Awards (ISLA®) were held in conjunction with (ISC)²’s Security Congress in Orlando, Florida in September. Mack Bhatia, fractional chief information security officer and information security practice director, at Enterprise Integration was named the winner of the Information Security Practitioner Award. Bhatia, who has his bachelor’s degree in organic chemistry and master’s degree in business administration, began his career in cybersecurity while working as an executive consultant. During a multi-year assignment, his client information security requirements evolved to encompass nearly every domain in the security field – from physical, to application, to network, and beyond.... Read more →

Flight risk

An amateur pilot has reportedly assembled and hacked real aircraft cockpit systems, demonstrating their vulnerabilities. "Security researcher Hugo Teso was able to "hijack" the systems to feed false navigation information to a simulated jet that made it change course." BBC It's not hard to think of scenarios where a well-resourced, competent and overtly malicious yet non-suicidal adversary could wreak havoc by redirecting aircraft, missiles, anti-missile-missiles, drones etc. using similar techniques, or simply interfere with them, hence one would have thought that information security was an obvious safety-critical requirement for their navigation and comms systems ... like for example the 30... Read more →

A Career in Science and Technology – from Nuclear Engineering to Cyber Security

By: Hord Tipton One chooses their career path for different reasons – whether it be following in a parent’s footsteps or an innate desire to help others. I was inspired by a chemistry teacher to pursue a career in chemical engineering and found success in engineering nuclear weapons for Atomic Energy Commission, securing SCADA systems that controlled vital resources such as the Hoover Dam, and enhancing information and software security standards through credentials and education. Throughout my vast career, I’ve seen computers shrink from room-sized to pocket-sized with more power in one device today than throughout an entire operating system... Read more →

Federal Cloud Computing: The Definitive Guide for Cloud Service Providers

Federal Cloud Computing: The Definitive Guide for Cloud Service Providers offers an in-depth look at topics surrounding federal cloud computing within the federal government, including the Federal Cloud Computing Strategy, Cloud Computing Standards, Security and Privacy, and Security Automation. You will learn the basics of the NIST risk management framework (RMF) with a specific focus on cloud computing environments, all aspects of the Federal Risk and Authorization Management Program (FedRAMP) process, and steps for cost-effectively implementing the Assessment and Authorization process, as well as strategies for implementing Continuous Monitoring, enabling the Cloud Service Provider to address the FedRAMP requirement on... Read more →

2012: Redefining United States Cyber Security: Taking a Holistic View and Machiavellian Approach, part 1

By: Larry P. Bunch CISSP, CEH http://mysite.verizon.net/vze18ez5m/id3.html Twitter: https://twitter.com/#!/bunchlarryp Preface This article was originally intended to be a light reading OP/ED piece. However, it has slowly evolved into a hybrid OP/ED – Whitepaper dealing with Cyber Intelligence and Network Security. The opinions in this article do not represent the United States government or my employer (VortechX LLC.). This article is intended to generate discussion, collaboration, and interaction within the Intelligence and Network Defense communities of both the Public and Private sectors of the United States. The ideas and recommendations presented here reflect only my own opinions and may NOT be... Read more →

Security Not Often a Top Priority for Small Business

I recently found an article that outlined a study about cyber security and small businesses. In the study, by Newtek Business Services’ Small Business Authority, it was discovered that “just 27 percent of small business owners have had an outside party test their computer systems to ensure that they are hacker-proof…” I found this to be a relatively shocking number, but one that is believable in today’s tough economy. It would seem that most small organizations would be watching every penny and often during that type of number crunching, Information Technology and I.T. Security budgets are often the first to... Read more →

Recovering a dead hard drive in the freezer

I've heard about this technique a few times and, having never tried it myself, I've always been cynical ... but by all accounts it looks like I'm wrong. The basic idea is to put a failed hard drive in the freezer for at least an hour, preferably overnight, before trying to read the drive. Responses to another blog piece on this include plenty of success stories, and a few clues about why it might work. The reason seems to be not the cooling per se but avoiding the heat generated in the drive when it is working normally. Presumably those... Read more →

We are living on strange "Cyberwar times"

In the after-crisis of the Stuxnet worm, Governments around the world are mobilizing to be better prepared against CyberThreats and CyberWar. It's becoming clear, more and more that groups pf individuals with a lot of knowledge, time and motivation can do harm against economies, healthcare, utilities and other systems, being responsible (who knows?) for the collapse of a country. We already had, in the past, cases of well succeeded CyberAttacks that collapsed a country information structure and paralyzed it for a while. We can remember of: 2007 CyberAttakcs on Estonia 2007 CyberAttacks against Syria Radar Infrastructure 2008 CyberAttacks on Georgia... Read more →