(ISC)² Blog

HCISPP Spotlight: Ana Ferreira

Name: Ana Ferreira Title: Doctor Employer: Center for Health Technology and Services Research (CINTESIS), Faculty of Medicine, University of Porto Location: Porto, Portugal Education: BSc in Computer Science, MSc in Information Security, PhD in Computer Science Years in IT: 20 Years in cybersecurity and/or privacy: 16 Cybersecurity certifications: CISSP, HCISPP How did you decide upon a career in healthcare security and/or privacy? After I graduated in 1998, I went to work for a healthcare education institution as a researcher and IT specialist. After a few years, I realized that security and privacy, especially in the domain of healthcare, were crucial... Read more →

Making Cyber Threats Big Data Manageable

By Adrian Winckles Director of Cyber Security, Networking and Big Data Research Group, Anglia Ruskin University Whilst figures differ depending on which report you read, Gartner estimates the average time between a breach and detection to be about 285 days. By this time, an attacker has long gone. With all the security products in an enterprise network today, why is this still so long? One reason maybe because threat detection is a big data problem. Particularly for network traffic based solutions. A handful of probes, or mirror ports, across a high-speed enterprise network and you could be capturing Terabytes of... Read more →

HCISPP Spotlight: Rema Deo

Name: Rema Deo Title: Managing Director Employer: 24By7Security, Inc. Location: Coral Springs, Florida Education: MBA Years in IT: 25+ Years in Cybersecurity: 5+ Cybersecurity Certifications: HCISPP How did you decide upon a career in healthcare security and/or privacy? I have been in risk management technology and compliance technology career for banking for several years, so when it was time for a change, Cybersecurity and Compliance related work was a logical next choice. 24By7Security has a client portfolio consisting of healthcare organizations as well as several other industries. Healthcare security and privacy work is still more nascent compared to financial technology,... Read more →

Data Privacy Laws in Europe and California a Boon to Jobseekers

The sweeping new privacy law that went into effect in the European Union in May has significantly boosted demand for data protection expertise, according to job postings site Indeed. A report from the popular recruitment site found that job openings for data protection officers (DPO) have skyrocketed 829 percent since 2016 as organizations took steps to comply with the General Data Protection Regulation (GDPR). The need for the expertise is about to get even greater, thanks to a newly approved data privacy law in California, the world’s fifth largest economy. The new law was rushed through the state’s legislation to... Read more →

Associate of (ISC)²: Thien Phan

Name: Thien Phan (ISC)² Exams Passed: CISSP and CCSP Title: Cybersecurity, Privacy and IT Risk Associate Employer: PricewaterhouseCoopers (PwC) Location: New York City, NY, U.S.A. Education: MBA degree and Bachelor’s Degree in Management Information Systems (MIS) from Binghamton University Years in IT: 1 year Years in cybersecurity: 1 year Cybersecurity certifications: Security+, CCNA Cyber Ops How did you decide upon a career in cybersecurity? It was back in my third year of college when I interned for a multimedia company as a database administrator. I did not know much about how different technologies worked together. I was introduced to the... Read more →

HCISPP Spotlight: Debi Carr

Name: Debi Carr Title: CEO and Consultant Employer: D. K. Carr and Associates, LLC Location: Christmas, FL, U.S.A. Years in IT: 28 years Years in cybersecurity and/or privacy: 20 years Cybersecurity certifications: HCISPP, CAHIMS How did you decide upon a career in healthcare security and/or privacy? As a practice manager of a healthcare practice, I was appointed the “Privacy and Security” Officer when HIPAA went into effect. I was also responsible for overseeing the technology in the practice through the years. As a result, I began educating myself on security and privacy protocols. Why did you decide to pursue your... Read more →

GDPR With a Smile

Bruce Beam, CISSP recently joined the (ISC)² family as our director of infrastructure and security. Bruce has more than 20 years of experience leading IT/ICT and security teams for large enterprises and the U.S. Navy. He is leading all aspects of (ISC)²’s global IT/ICT and cybersecurity operations. He is not only managing the (ISC)² “DETE” (digital-end-to-end) initiative, but also oversees our Global Data Protection Regulation preparations. Bruce has words of advice for surviving – and thriving – through GDPR: The GDPR sweat is now in full swing with the May 25 deadline looming. I have seen a lot of gloom... Read more →

Weekly Security Headlines: Hearings, guidelines and news

New guidelines, increased government oversight, and mounting stress in cybersecurity With the 4th quarter underway, we are starting to see lots of predictions about what the cybersecurity industry can expect to see come 2018. Thinking about the future makes it easy to forget about what is happening right now, though. Let’s take a look back at the news that happened this week to remind us of where we are, before we focus too much on where we’re going. Arguably the biggest industry-wide news of the week was the Senate Commerce Committee hearing, “Protecting Consumers in the Era of Major Breaches.... Read more →

Security Headlines: Do you know where your data records are?

It’s 2:00 pm. Do you know where your data records are? Here are the security headlines from the week of September 18, 2017. Say it ain’t so, SEC. Say it ain’t so! It looks like the U.S. Securities and Exchange Commission (SEC) suffered a cyber attack in 2016. Hackers have been trading using non-public information. In more cybercrime news, Help Net Security has a list of most wanted malware and mobile malware. We’re all hoping the risk of wearable devices is worth the health benefit – or is that just what I tell myself about my FitBit? But what if... Read more →

Security Headlines: World Cup, IT and everything in between

Pardon our absence on the blog this past week. Hurricane Irma had plans of her own, but we’re back in business and ready to break down the top security headlines for the week of September 11, 2017: The fear of foreign hacking is not just related to elections or national security. England is worried about World Cup information. The silver lining of Equifax is that cybersecurity stocks are up. So I guess that’s a win? Password123 is still not a good idea, but could relaxing password policy increase security? The Hill has questions about the Equifax hack. Still waiting on... Read more →

Tracking Members’ Progress with GDPR: Europe’s New Data Protection Regulation

By Yves Le Roux, Co-Chair (ISC)² EMEA Advisory Council (EAC) and Chair of its GDPR Task Force. Download the 12 Areas of Activity and their key supporting tasks The (ISC)² EMEA Advisory Council is turning to its professional membership to measure the readiness of organizations and security departments for the General Data Protection Regulation (GDPR) and highlight the challenges they are facing in the effort to become compliant by May 2018. We are doing this by bringing people who are actively working on implementation projects together either on monthly international calls and, as of this month, in face-to-face workshops hosted... Read more →

Moving to a Culture of Trust in Digital Transformation - Perspectives from the Healthcare Industry

The move to a paperless system to improve health and social care is an ambition central to many governments around the world. (ISC)² recently held a roundtable event in London, United Kingdom (UK) inviting several people who work within the sector and the country’s National Public Health Service (NHS) to explore a range of current issues, including the reasons why patients were showing a reluctance to trust efforts to protect their personal data. The aim was to bring together perspectives from many areas of the healthcare industry and give them the opportunity to talk freely and anonymously about the opportunities... Read more →

Calling All Cybersecurity Experts!

This year’s (ISC)² Security Congress – with the theme “Leaders of Tomorrow” – will take place September 25-27 in Austin, Texas at the JW Marriott. For the first time, Security Congress will be a stand-alone event, without former partner ASIS International. “We value the partnership we had with ASIS International for the past six years, but it was time for Security Congress to stand on its own to address the programming needs expressed by our members,” says (ISC)² CEO David Shearer. The cybersecurity conference will host more than 90 educational sessions, as well as a town hall meeting, career center... Read more →

EMEA Advisory Council Marks International Data Protection Day with GDPR Warning

Yves Le Roux, co-chair and public policy workgroup lead, (ISC)2 EMEA Advisory Council This Saturday marks the 10th anniversary for Data Protection Day, celebrated each year on 28 January – which is the date the Council of Europe’s data protection convention, known as “Convention 108”, was established. Data Protection Day, known as Privacy Day outside of Europe, is now celebrated globally, raising awareness of people’s rights as they relate to the automatic processing of their data. Each year, events are held around the world to both arm citizens with the information they need to understand and protect their rights, while... Read more →

A Gliimpse into the Future: Giving patients control of their healthcare records?

Last month, after playing host to a roundtable discussion on encouraging patient trust in sharing healthcare data in London, we blogged about transparency and the road to digital health. Today I’m going to revisit that topic in light of Apple’s recent acquisition of a US healthcare start-up called Gliimpse. Gliimpse described itself as “healthcare’s platform for patient data. By unlocking patient data silos, we aggregate fragmented data into a patient-owned, longitudinal health profile. Gliimpse is your personal health history, in the palm of your hands.” Why is this announcement relevant? I think this move could shake up the way we... Read more →

Securing Tomorrow: Society Must Wake Up and Take Ownership of Identity

There are trends that have been on the industry’s radar for a while now; social, mobile, applications and cloud. However, within the next year, we’ll see more of an emphasis on one of the key underpinnings of these trends – identity. The issues with data management and security are often told and understood from an industry, business or sector perspective; but society as a whole is still arguably not at a point where it is fully awake to these issues and how they directly affect individuals. Next year, I believe we will begin to see people recognising the need to... Read more →

Moving Beyond the Dangerous Denial Phase as Individuals and Organizations

I spent 25 years in the Washington, DC area, and during that time I became a National Public Radio junkie. I guess I still am. I recently listened to a report on a comprehensive study about how people in the workplace react to the news about a coworker that’s been diagnosed with breast cancer.[i] The results of the study shocked me. The worse the diagnoses and the closer employees physically worked to the diagnosed coworker, the less likely those working in close proximity were to seek cancer screening. Similarly, as the conversation about the complexities, costs, and potential breaches is... Read more →

JP Morgan Chase Security Breach Comments from (ISC)² Leadership

Continuous monitoring is the key to thwarting these types of breaches. With cyberattacks becoming commonplace in every sector, companies must continuously protect their most valuable information. Cyber guns fire at us all the time, but the notion of catching and stopping every cybercriminal simply isn’t realistic in today’s burgeoning threat environment. I liken it to aspiring to completely eliminate common street crime. It’s just not realistic. Flaws will always exist, even within the most ideal protective structures. Every company should assume they’ll be breached, and focus efforts on minimizing damage once cybercriminals get in. The need for qualified cybersecurity professionals... Read more →

The Luxury of Privacy

I was asked – as happens from time to time – for commentary for an upcoming security article. (As also happens from time to time, I have no idea whether the journalist has used it or not. Since the request came via an agency, I don’t actually know the who or where, either, so I feel quite comfortable about expanding on that commentary here…) In this case, the topic was a report from Silent Circle. I’d be happy to provide a link to it, but I haven’t been able to find one. Apparently, though, the report summarizes the opinions of... Read more →

HealthCare Security & Privacy Professionals Defined

When I entered the workforce after college, my first job was with the Department of Defense working in IT for a military hospital. I was quickly inundated with compliance requirements that spanned multiple industries and had varying levels of importance. I quickly learned about NIST special publications, how they related to FISMA compliance, and how JACHO and HIPAA both had regulatory standards but were not the same. I was thrown into an environment that involved quite a learning curve, but it turned out to be a great starting point for my career in healthcare compliance. Throughout my career, I have... Read more →