(ISC)² Blog

The Delicate Balance of Security Versus Usability

Why Does This Have to Be So Hard? As a security practitioner, how often have you heard the refrain from your colleagues that one of the security protocols that were so carefully thought-out and expertly implemented are just too difficult to deal with? Perhaps you have sighed when you had to adhere to your own security protocol? As a security evangelist, you understand the necessity of adhering to a set of security requirements, but as a normal staff member, you can understand the frustration of your non-security coworkers. Is there ever such a thing as being a “normal” staff member... Read more →

THE HEALTHCARE INTERNET OF THINGS – FOR BETTER OR WORSE

By Rema Deo, HCISPP By now, everyone is familiar with the Internet of Things (IoT), an expanding network of physical devices, appliances, and equipment that are embedded with sensors, software, and other technologies in order to connect and exchange data with other devices and systems over the Internet. It’s an exciting digital world in which your smartphone can control the tiny computers in your air conditioning system and your house lights. Where the small computer in your refrigerator monitors water quality and automatically orders a new filter from the manufacturer. Where your computerized oven can be turned on remotely to... Read more →

Cybersecurity Predictions for 2021 from the (ISC)² Community of Security Professionals (Part 2)

By Diana-Lynn Contesti, CISSP-ISSAP, ISSMP, CSSLP, SSCP John Martin, CISSP-ISSAP, CISM Richard Nealon, CISSP-ISSMP, SSCP, SCF In part one of this blog series, we discussed privacy, remote access (aka Work from Home), insider threats, data leakage, Zero Trust Architecture (ZTA) and security architecture. To continue this discussion, we believe that 2021 will still see folks working from home; thus, the risks due to insider threats and data leakage will continue to grow. However, we believe that there are other concerns for information security professionals, including edge computing, 5G, IoMT/IoT, AI and ransomware. Edge Computing Edge Computing is a distributed computing... Read more →

Remote Work During the Pandemic: What We Got Wrong

By Stephen Fried, CISSP As COVID-19 began to spread rapidly across the globe in 2020, many organizations moved their employees off company premises and enabled large "work from home" efforts. Nobody knew how long this would last, but we assumed we could work remotely for a few months until this thing worked itself out, then return to the office and get back to "normal." We were very wrong. We weren’t just wrong about the length of the crisis; we were wrong about how our employees defined “home.” What we didn’t anticipate is that the pandemic would force companies to rethink... Read more →

Looking for Resources on Privacy? You’ve Come to the Right Place

Happy Data Privacy Day! The National Cyber Security Alliance (NCSA) designates January 28 as a day to empower individuals and encourage businesses around the world to respect privacy, safeguard data and enable trust. In honor of the effort to inspire dialogue and empower learning about how personal information is used, collected and shared in our digital society, following is a list of helpful (ISC)2 resources and activities focused on privacy best practices. Professional Development Institute courses The PDI is a portfolio of more than 40 continuing cybersecurity education courses that is free to (ISC)2 members. Among the wide array of... Read more →

Security Predictions for 2021 from the (ISC)² Community of Security Professionals (PART 1)

By Diana-Lynn Contesti, CISSP-ISSAP, ISSMP, CSSLP, SSCP, John Martin, CISSP-ISSAP, and Richard Nealon, CISSP-ISSMP, CISSP, SSCP, SCF, CISM, CISA 2020 was a year of change. It changed the way that folks work and how they interact with each other. Wondering what 2021 might look like for information security professionals? This is the first in a series of posts where we will discuss what we believe 2021 may have in store for information security professionals. Some of the issues faced by security professionals in 2021/2022 will include (but are not limited to) the evolving landscape of privacy, and the ongoing necessity... Read more →

Absolute Zero

By Allan Caton, CISSP, CISM, CCSP, CISMP Most companies are migrating from an environment of legacy, on-premise systems to the cloud which will result in a hybrid environment. Market forces are driving the push toward usable, mobile technology and the always-on, always-available, ubiquity of web-based applications. This shift will include both customers and all types of enterprise users – including employees, contractors, vendors, partners, etc. This shift to a decentralized, identity-centric operating model brings with it the absolute requirement to consider the security of the user identities, devices and data which comprise the enterprise estate. The future of identity management,... Read more →

Getting Ready for the New Zealand Privacy Act 2020

by John Martin, CISSP, Senior Security Architect, IBM New Zealand Are you ready for the New Zealand Privacy Act 2020 to come into effect on 1st December 2020? There’s a lot to consider as the clock ticks down and your organisation’s ability to comply is critical if you want to avoid some of the hefty fines involved. As you align your security strategy with your business, here are some key areas to consider as you prepare: Reporting privacy breaches immediately It will be mandatory for businesses to immediately report serious privacy breaches, particularly where a data breach poses a risk... Read more →

Not All Life Savers Wear White Coats

by Anastasios Arampatzis During the COVID-19 public health crisis, cyber criminals took advantage of people’s growing need for information about the pandemic to launch an increased number of attacks against healthcare providers. The exponential growth of these cyberattacks is posing a considerable threat to civil society, government institutions, and most particularly, the healthcare sector. Despite a wake-up call following the WannaCry crisis, healthcare cybersecurity still lags. As a result, in this time of emergency, cyberattacks may not only have an economic and reputational cost, they may also have an impact on human life. To help healthcare organizations focus on the... Read more →

NY Department of Financial Services Brings First Enforcement Action under its Cybersecurity Regulation

By Paul Lanois, SSCP, CIPP, CIPT, CIPM On Tuesday, July 21, 2020, the New York Department of Financial Services (NYDFS) announced that it has brought its first enforcement action pursuant to the NYDFS Cybersecurity Regulation against a large title insurer, First American Title Insurance Company (“the Company”), alleging multiple failures to protect their consumers' sensitive personal information. According to the Statement of Charges and Notice of Hearing issued by the NYDFS, the Company maintained a database with millions of documents containing sensitive personal information, including bank account numbers and statements, mortgage and tax records, Social Security numbers, wire transaction receipts,... Read more →

RETHINKING SECURITY PREDICTIONS FOR 2020 FROM THE (ISC)² COMMUNITY OF SECURITY PROFESSIONALS

By Diana-Lynn Contesti, CISSP-ISSAP, ISSMP, CSSLP, SSCP and John Martin, CISSP-ISSAP In February 2020, we put together our thoughts on Security Predictions for the upcoming year in a two-part series (Part 1, Part 2). Little did we know that COVID-19 would happen and change the way that folks work in our organizations, nor we as security practitioners work. In our original blog, we suggested that the following issues would be of concern to the industry: Data Privacy changes Lack of secure coding practices 5G and WiFi-6 Phasing out passwords Lack of perimeters Backups and their role with ransomware We believe... Read more →

Beware of TMI: Cyber Crooks Are Watching

Research conducted since the start of the COVID-19 pandemic shows an increase in cyber threats as cybercriminals try to take advantage of users working remotely. What most users may not realize is that they could be making it easier for threat actors to target them. Here’s how: Every time a user posts a picture of his or her remote office setup on social media or participates in a videoconference, the user unwittingly may be revealing personal or company information that threat actors can exploit. In an opinion piece published by the Wall Street Journal, a cybersecurity expert warned about the... Read more →

Cyber Threats Are Spiking as Remote Worker Ranks Soar

The number of people working from home is skyrocketing as the COVID-19 pandemic forces companies to close offices and practice social distancing. The sudden explosion of makeshift home office environments is adding to the burden of already overtaxed cybersecurity workers, who now face the massive task of trying to protect a remote workforce against cyber threats. While cybersecurity professionals put in extra hours to handle the situation, the increasing ranks of remote workers are catching the attention of another group – cyber attackers. Cyber criminals are betting that many of these hastily outfitted work-from-home environments will not have the same... Read more →

Healthcare is the Preferred Target of Cyber Attackers

U.S. healthcare institutions are under constant attack from cybercriminals, and unless hospitals take concrete steps to protect themselves, the situation won’t get any better. In 2019, the healthcare industry was the number one target for cyber attackers, with the cost of breaches totaling $4 billion, according to a new report. 2020 Vision: A Review of Major IT & Cybersecurity Issues Affecting Healthcare, published by security intelligence firm CyberMDX, provides an in-depth look at the causes and types of cybersecurity threats affecting the industry, as well as recommendations for healthcare institutions to fortify their cyber defenses. Attacks on healthcare are prevalent,... Read more →

UNDER ATT&CK: How MITRE’s methodology to find threats and embed counter-measures might work in your organization

As published in the November/December 2019 edition of InfoSecurity Professional Magazine By Naresh Kurada, CISSP Threat modeling is gaining even more attention with today’s dynamic threat environment. The sophistication of threat actors and development of advanced tactics, techniques and procedures (TTPs) has put a brighter spotlight on the process of finding vulnerabilities by incorporating the attacker’s point of view. There are several threat modeling approaches and techniques to consider. Often, these can be classified as asset-centric, system-centric, people-centric or risk-centric. For instance, Microsoft’s STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service and Elevation of Privilege) is system-centric, while PASTA... Read more →

Breaches Increased in 2019, but the Number of Exposed Records Declined

The number of U.S. data breaches bumped up 17% in 2019 but despite the increase, the volume of sensitive consumer records that were exposed declined substantially by 65%, according to a newly published report. These statistics are a complete reversal of what happened in 2018, when the number of exposed consumer records soared by 126% and breaches declined by 23%, according to the Identity Theft Resource Center’s (ITRC) End-of-Year Data Breach Report for 2019 Data breaches tracked in 2019 in the United States jumped to 1,473, from 1,257 in the previous year, the report revealed. Meanwhile, 164,683,455 sensitive records were... Read more →

Security Predictions for 2020 from the (ISC)² Community of Security Professionals (Part 2)

By Diana-Lynn Contesti, CISSP-ISSAP, ISSMP, CSSLP, SSCP and John Martin, CISSP-ISSAP Continued discussion from Security Predictions for 2020 from the (ISC)² Community of Security Professionals (Part 1) Internet of Things (IoT), Industrial Internet of Things (IIoT) and Operating Technology (OT) related to the state of digital certificates The issue is not just self-signed digital certificates or expired certificates. Many of these devices have digital certificates, which need to be managed via a Key Management System and maintained. The fallout, of course, is that without proper controls, these devices can and will be compromised. Currently, the onus is on the consumer... Read more →

New York’s New Data Breach Security Laws Increase Data Privacy and Provide Security Controls Guidance

By Paul Lanois, SSCP, CIPP, CIPT, CIPM and Eric Tierling, CISSP, CIPP/E The landscape of privacy and related legislation in the United States continues to get more interesting. Despite the California Consumer Privacy Act (CCPA) being the talk of the town for privacy and security professionals, New York also put something noteworthy in place, called the “Stop Hacks and Improve Electronic Data Security Act,” or SHIELD Act, in short. Not only is it relatively prescriptive, but it also encompasses cybersecurity obligations that are particularly relevant for security professionals. The SHIELD Act of New York was signed into law in July... Read more →

A Lifeline: Patient Safety and Cybersecurity

By Lee Kim, JD, CISSP, CIPP/US, Director, Privacy and Security, HIMSS The most valuable part of the healthcare system is the patient. Patient safety is paramount in the healthcare sector. With the digitization of healthcare information, the free flow of information comes at a price. We need to be responsible stewards of healthcare information. Patients entrust us with their healthcare information and their lives. Those of us in the healthcare cybersecurity field have the unique task of protecting and securing patient information yet ensuring that the information is available on demand—especially when critical, life threatening situations arise. The Vulnerabilities of... Read more →

Cyber Threats to Healthcare on the Rise

Hospitals are set up to fight infections, but not necessarily the kind that has been plaguing healthcare institutions lately – malware. A new report estimates that cyber threats against healthcare targets increased 60% since January, surpassing the total number of threats identified in all of 2018. The most common threat targeting the healthcare industry is Trojan malware, which increased 82% in the third quarter from Q2, according to the report by Malwarebytes, Cybercrime Tactics and Techniques: The 2019 State of Healthcare. Most of the Trojan attacks involved Emotet and TrickBot, which are the two most dangerous Trojans around since 2018.... Read more →