(ISC)² Blog

Latest Cyberthreats and Advisories - November 18, 2022

Beware the BatLoader, the NSA calls for more memory-safe programming language use and ransomware causes more trouble in Australia….Here are the latest threats and advisories for the week of November 18, 2022. Threat Advisories and Alerts Researchers Sound Alarm on Dangerous BatLoader Malware Dropper A dangerous new malware loader with features for determining whether it's running on business or home computers has begun rapidly infecting systems worldwide over the past few months. Researchers at VMware Carbon Black claim the threat, dubbed BatLoader, is being used to distribute a variety of malware tools including a banking Trojan, an information stealer, and... Read more →

LATEST CYBERTHREATS AND ADVISORIES - OCTOBER 21, 2022

Ransomware derails big businesses as the Australian cyberattack spree and student loan forgiveness scam highlight a disturbing week in the cybersecurity world. Here are the latest threats and advisories for the week of October 21, 2022. Threat Advisories and Alerts FBI Warns That Fraudsters May Target Beneficiaries of Student Loan Forgiveness Individuals seeking US federal student loan forgiveness should be cautious of potential scams related to the Student Loan Debt Relief Plan introduced in August of this year. Scammers are using a variety of digital tools – including websites, email, mobile phones and more – to trick victims into giving... Read more →

What Do You Mean My Email Isn’t Free?

By Greg Anderson, (ISC)² Associate is an emerging cybersecurity professional with an interest in digital privacy. The U.S. Postal Service is in trouble. It’s $63 billion dollars in debt, and is expected to lose another $160 billion over the coming decade. Lawmakers are scratching their heads about how to pull it out of its deepening hole. Ideas to expand USPS revenue streams include offering check-cashing services, utility bill payments and selling bonds. What about something more innovative? To offer a more contemporary service, USPS can borrow an idea from the big tech playbook. Here’s how it would work: the postal... Read more →

Security Through Obscurity. It Doesn’t Work.

By Keith Bruce, CISSP and IT Security Compliance Analyst. Keith’s primary focus is on ISO 27001 compliance and team analytics, but also manages vulnerability, policy, penetration testing and client audit review programs, just to name a few. Introduction The internet offers a plethora of information about you and everyone else, whether we like it or not. Our personal information is out there if you know where and how to look for it. Everything is tracked. Everything. All we need to do is dig a little deeper to find more information that may be public, or private for that matter. Default... Read more →

What do cybersecurity experts predict in 2022?

2022 Predictions for the Cybersecurity Industry and Advice for Newcomers or Those Working for Small to Medium-Sized Businesses By Diana-Lynn Contesti, CISSP-ISSAP, ISSMP, CSSLP, SSCP, John Martin, CISSP-ISSAP, CISM, BCS CITP, and Richard Nealon, CISSP-ISSMP, SSCP, SCF, CISM, CISA As long-time information security professionals and (ISC)² Community Champions, we have experienced the way cybersecurity employees engage and work with one another continue to adapt in response to changes in the workplace and world at large. In 2021, we experienced a rapid evolution to these interactions. Like us, you may be wondering, what will 2022 look like for information security professionals?... Read more →

The Delicate Balance of Security Versus Usability

Why Does This Have to Be So Hard? As a security practitioner, how often have you heard the refrain from your colleagues that one of the security protocols that were so carefully thought-out and expertly implemented are just too difficult to deal with? Perhaps you have sighed when you had to adhere to your own security protocol? As a security evangelist, you understand the necessity of adhering to a set of security requirements, but as a normal staff member, you can understand the frustration of your non-security coworkers. Is there ever such a thing as being a “normal” staff member... Read more →

THE HEALTHCARE INTERNET OF THINGS – FOR BETTER OR WORSE

By Rema Deo, HCISPP By now, everyone is familiar with the Internet of Things (IoT), an expanding network of physical devices, appliances, and equipment that are embedded with sensors, software, and other technologies in order to connect and exchange data with other devices and systems over the Internet. It’s an exciting digital world in which your smartphone can control the tiny computers in your air conditioning system and your house lights. Where the small computer in your refrigerator monitors water quality and automatically orders a new filter from the manufacturer. Where your computerized oven can be turned on remotely to... Read more →

Cybersecurity Predictions for 2021 from the (ISC)² Community of Security Professionals (Part 2)

By Diana-Lynn Contesti, CISSP-ISSAP, ISSMP, CSSLP, SSCP John Martin, CISSP-ISSAP, CISM Richard Nealon, CISSP-ISSMP, SSCP, SCF In part one of this blog series, we discussed privacy, remote access (aka Work from Home), insider threats, data leakage, Zero Trust Architecture (ZTA) and security architecture. To continue this discussion, we believe that 2021 will still see folks working from home; thus, the risks due to insider threats and data leakage will continue to grow. However, we believe that there are other concerns for information security professionals, including edge computing, 5G, IoMT/IoT, AI and ransomware. Edge Computing Edge Computing is a distributed computing... Read more →

Remote Work During the Pandemic: What We Got Wrong

By Stephen Fried, CISSP As COVID-19 began to spread rapidly across the globe in 2020, many organizations moved their employees off company premises and enabled large "work from home" efforts. Nobody knew how long this would last, but we assumed we could work remotely for a few months until this thing worked itself out, then return to the office and get back to "normal." We were very wrong. We weren’t just wrong about the length of the crisis; we were wrong about how our employees defined “home.” What we didn’t anticipate is that the pandemic would force companies to rethink... Read more →

Looking for Resources on Privacy? You’ve Come to the Right Place

Happy Data Privacy Day! The National Cyber Security Alliance (NCSA) designates January 28 as a day to empower individuals and encourage businesses around the world to respect privacy, safeguard data and enable trust. In honor of the effort to inspire dialogue and empower learning about how personal information is used, collected and shared in our digital society, following is a list of helpful (ISC)2 resources and activities focused on privacy best practices. Professional Development Institute courses The PDI is a portfolio of more than 40 continuing cybersecurity education courses that is free to (ISC)2 members. Among the wide array of... Read more →

Security Predictions for 2021 from the (ISC)² Community of Security Professionals (PART 1)

By Diana-Lynn Contesti, CISSP-ISSAP, ISSMP, CSSLP, SSCP, John Martin, CISSP-ISSAP, and Richard Nealon, CISSP-ISSMP, CISSP, SSCP, SCF, CISM, CISA 2020 was a year of change. It changed the way that folks work and how they interact with each other. Wondering what 2021 might look like for information security professionals? This is the first in a series of posts where we will discuss what we believe 2021 may have in store for information security professionals. Some of the issues faced by security professionals in 2021/2022 will include (but are not limited to) the evolving landscape of privacy, and the ongoing necessity... Read more →

Absolute Zero

By Allan Caton, CISSP, CISM, CCSP, CISMP Most companies are migrating from an environment of legacy, on-premise systems to the cloud which will result in a hybrid environment. Market forces are driving the push toward usable, mobile technology and the always-on, always-available, ubiquity of web-based applications. This shift will include both customers and all types of enterprise users – including employees, contractors, vendors, partners, etc. This shift to a decentralized, identity-centric operating model brings with it the absolute requirement to consider the security of the user identities, devices and data which comprise the enterprise estate. The future of identity management,... Read more →

Getting Ready for the New Zealand Privacy Act 2020

by John Martin, CISSP, Senior Security Architect, IBM New Zealand Are you ready for the New Zealand Privacy Act 2020 to come into effect on 1st December 2020? There’s a lot to consider as the clock ticks down and your organisation’s ability to comply is critical if you want to avoid some of the hefty fines involved. As you align your security strategy with your business, here are some key areas to consider as you prepare: Reporting privacy breaches immediately It will be mandatory for businesses to immediately report serious privacy breaches, particularly where a data breach poses a risk... Read more →

Not All Life Savers Wear White Coats

by Anastasios Arampatzis During the COVID-19 public health crisis, cyber criminals took advantage of people’s growing need for information about the pandemic to launch an increased number of attacks against healthcare providers. The exponential growth of these cyberattacks is posing a considerable threat to civil society, government institutions, and most particularly, the healthcare sector. Despite a wake-up call following the WannaCry crisis, healthcare cybersecurity still lags. As a result, in this time of emergency, cyberattacks may not only have an economic and reputational cost, they may also have an impact on human life. To help healthcare organizations focus on the... Read more →

NY Department of Financial Services Brings First Enforcement Action under its Cybersecurity Regulation

By Paul Lanois, SSCP, CIPP, CIPT, CIPM On Tuesday, July 21, 2020, the New York Department of Financial Services (NYDFS) announced that it has brought its first enforcement action pursuant to the NYDFS Cybersecurity Regulation against a large title insurer, First American Title Insurance Company (“the Company”), alleging multiple failures to protect their consumers' sensitive personal information. According to the Statement of Charges and Notice of Hearing issued by the NYDFS, the Company maintained a database with millions of documents containing sensitive personal information, including bank account numbers and statements, mortgage and tax records, Social Security numbers, wire transaction receipts,... Read more →

RETHINKING SECURITY PREDICTIONS FOR 2020 FROM THE (ISC)² COMMUNITY OF SECURITY PROFESSIONALS

By Diana-Lynn Contesti, CISSP-ISSAP, ISSMP, CSSLP, SSCP and John Martin, CISSP-ISSAP In February 2020, we put together our thoughts on Security Predictions for the upcoming year in a two-part series (Part 1, Part 2). Little did we know that COVID-19 would happen and change the way that folks work in our organizations, nor we as security practitioners work. In our original blog, we suggested that the following issues would be of concern to the industry: Data Privacy changes Lack of secure coding practices 5G and WiFi-6 Phasing out passwords Lack of perimeters Backups and their role with ransomware We believe... Read more →

Beware of TMI: Cyber Crooks Are Watching

Research conducted since the start of the COVID-19 pandemic shows an increase in cyber threats as cybercriminals try to take advantage of users working remotely. What most users may not realize is that they could be making it easier for threat actors to target them. Here’s how: Every time a user posts a picture of his or her remote office setup on social media or participates in a videoconference, the user unwittingly may be revealing personal or company information that threat actors can exploit. In an opinion piece published by the Wall Street Journal, a cybersecurity expert warned about the... Read more →

Cyber Threats Are Spiking as Remote Worker Ranks Soar

The number of people working from home is skyrocketing as the COVID-19 pandemic forces companies to close offices and practice social distancing. The sudden explosion of makeshift home office environments is adding to the burden of already overtaxed cybersecurity workers, who now face the massive task of trying to protect a remote workforce against cyber threats. While cybersecurity professionals put in extra hours to handle the situation, the increasing ranks of remote workers are catching the attention of another group – cyber attackers. Cyber criminals are betting that many of these hastily outfitted work-from-home environments will not have the same... Read more →

Healthcare is the Preferred Target of Cyber Attackers

U.S. healthcare institutions are under constant attack from cybercriminals, and unless hospitals take concrete steps to protect themselves, the situation won’t get any better. In 2019, the healthcare industry was the number one target for cyber attackers, with the cost of breaches totaling $4 billion, according to a new report. 2020 Vision: A Review of Major IT & Cybersecurity Issues Affecting Healthcare, published by security intelligence firm CyberMDX, provides an in-depth look at the causes and types of cybersecurity threats affecting the industry, as well as recommendations for healthcare institutions to fortify their cyber defenses. Attacks on healthcare are prevalent,... Read more →

UNDER ATT&CK: How MITRE’s methodology to find threats and embed counter-measures might work in your organization

As published in the November/December 2019 edition of InfoSecurity Professional Magazine By Naresh Kurada, CISSP Threat modeling is gaining even more attention with today’s dynamic threat environment. The sophistication of threat actors and development of advanced tactics, techniques and procedures (TTPs) has put a brighter spotlight on the process of finding vulnerabilities by incorporating the attacker’s point of view. There are several threat modeling approaches and techniques to consider. Often, these can be classified as asset-centric, system-centric, people-centric or risk-centric. For instance, Microsoft’s STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service and Elevation of Privilege) is system-centric, while PASTA... Read more →