(ISC)² Blog

Being the Fly on the Wall: The latest observations from the (ISC)² Member’s GDPR Task Force

By Yves Le Roux, CISSP, CISM, Co-Chair, Europe, Middle East and Africa Advisory Council (EAC) Recently our GDPR Task Force has found that despite efforts to prepare for the incoming regulation, many practitioners are finding that there is actually a lot more to do than originally anticipated, and are still in “discovery mode” about what data they hold. Data being fragmented and contained within individual business units means that knowing where data sets reside and mapping their flow is proving challenging. Businesses have just realised the mammoth task ahead of them Many businesses are still stuck in the initial stages... Read more →

Looking for cybersecurity job? Healthcare is hiring!

While the projected 1.8 million cybersecurity workforce gap is a staggering number, the Global Information Security Workforce Study did reveal which sectors are most aggressively looking to address this talent shortfall. Healthcare, retail and manufacturing top the list of industries looking to increase their cybersecurity workforce by more than 20% over the next year. Healthcare, in particular, is aiming for a 39% increase. It’s not surprising that they’re leading the charge to staff up, as Privacy Rights Clearninghouse reports that there were 223 known breaches to healthcare organizations in the United States in 2016 - and another 46 disclosed so... Read more →

Continuing the Conversation: Spearphishing

If you’ve attended any of our (ISC)² ThinkTank Webinars (and we hope you have!) you know that moderator Brandon Dunlap shares your questions with panelists to answer during the session. While we can’t get to all questions, we’d like to address a few more here on our blog. Last week’s webinar was “The Human Target – The Tip of the Spear is Aimed at You”, with panelists Ira Winkler, president of Secret Mentem, Sylvester Gray, security product specialist at Sophos and Johnny Deutsch, senior manager, advanced security center at Ernst & Young, LLP. Thank you to our panelists for sharing... Read more →

What we learned from this month’s European GISWS report

What is the GISWS? Since its first release in 2004, the biennial (ISC)²® Global Information Security Workforce Study (GISWS) has been gauging the opinions of information security professionals; and in turn, providing detailed insights into the important trends and opportunities within this increasingly crucial profession. This year, the study conducted its largest-ever global survey of cybersecurity professionals, with over 19,000 individuals taking part (3,694 of which hailing from Europe), further allowing it to ascertain an even clearer and progressively more complete profile of the information security workforce; with stronger understandings of areas and issues such as pay scales, skills gaps,... Read more →

Viewing Cybersecurity as a Business Enabler Versus a Money Pit

A data breach can cause a loss of revenue, destroy shareholder value, erode consumer trust and even open you up to legal consequences, whereas better security can add value to a company by preventing attacks, detecting breaches faster and mitigating the damage caused by cyber threats. The Ponemon Institute's 2016 Cost of Data Breach Study estimates that the average consolidated total cost of a data breach is $4 million; so why do we still view cybersecurity simply as an operating cost? Unfortunately, cybersecurity is often viewed as the organization that always says no versus the organization that makes the business... Read more →

Calling All Cybersecurity Experts!

This year’s (ISC)² Security Congress – with the theme “Leaders of Tomorrow” – will take place September 25-27 in Austin, Texas at the JW Marriott. For the first time, Security Congress will be a stand-alone event, without former partner ASIS International. “We value the partnership we had with ASIS International for the past six years, but it was time for Security Congress to stand on its own to address the programming needs expressed by our members,” says (ISC)² CEO David Shearer. The cybersecurity conference will host more than 90 educational sessions, as well as a town hall meeting, career center... Read more →

EMEA Advisory Council Marks International Data Protection Day with GDPR Warning

Yves Le Roux, co-chair and public policy workgroup lead, (ISC)2 EMEA Advisory Council This Saturday marks the 10th anniversary for Data Protection Day, celebrated each year on 28 January – which is the date the Council of Europe’s data protection convention, known as “Convention 108”, was established. Data Protection Day, known as Privacy Day outside of Europe, is now celebrated globally, raising awareness of people’s rights as they relate to the automatic processing of their data. Each year, events are held around the world to both arm citizens with the information they need to understand and protect their rights, while... Read more →

CISSP Spotlight: Miriam Celi

Name: Miriam Celi Title: Technical Leader – Secure Coding IT Quality Assurance Employer: Humana, Inc. Years in IT: 20 Years in cybersecurity: 7 Cybersecurity certifications: CISSP, GISP How did you decide upon a career in cybersecurity? I got into a career in cybersecurity by chance. In early 2009, I joined a small startup that specialized in personal identity verification (PIV) solutions for the government. I was very fortunate that since the company was small, I was able to perform various roles, such as integrating products with various physical access control systems and biometric devices, representing the company in security conferences... Read more →

Why cars are increasingly vulnerable to cyber attack

Adrian Davis, Managing Director, EMEA at (ISC)² explains how we can stop the ongoing proliferation of vulnerabilities in connected cars It’s clear that we are rapidly moving towards turning cars into rolling internet browsers, connecting to everything from traffic lights to household appliances. Future vehicles will get remote updates on traffic jams or weather, automatically alert emergency services to accidents as they happen, allow drivers to get over-the-air ‘upgrades’ without visiting a dealership and even warm up their kettles from their cars. Software updates can now give cars self-driving features, turn them into rolling Wi-Fi hotspots or even allow them... Read more →

CISSP Spotlight: Collin Chung

Name: Collin Chung Title: Risk and Compliance Analyst II Employer: CareerBuilder Education: B.A. Years in IT: 6 Years in cybersecurity: 5 Cybersecurity certifications: CISA, CISSP, CRISC, ITIL How did you decide upon a career in cybersecurity? It honestly just happened upon me. I loved video games growing up and decided to pursue an education in information technology and business - MIS. I later discovered that my love of computers pervaded enterprises in ways I couldn't have imagined and dove head first into the world of IT and eventually cybersecurity. Why did you get your CISSP®? Before I obtained my CISSP... Read more →

Moving Beyond the Dangerous Denial Phase as Individuals and Organizations

I spent 25 years in the Washington, DC area, and during that time I became a National Public Radio junkie. I guess I still am. I recently listened to a report on a comprehensive study about how people in the workplace react to the news about a coworker that’s been diagnosed with breast cancer.[i] The results of the study shocked me. The worse the diagnoses and the closer employees physically worked to the diagnosed coworker, the less likely those working in close proximity were to seek cancer screening. Similarly, as the conversation about the complexities, costs, and potential breaches is... Read more →

JP Morgan Chase Security Breach Comments from (ISC)² Leadership

Continuous monitoring is the key to thwarting these types of breaches. With cyberattacks becoming commonplace in every sector, companies must continuously protect their most valuable information. Cyber guns fire at us all the time, but the notion of catching and stopping every cybercriminal simply isn’t realistic in today’s burgeoning threat environment. I liken it to aspiring to completely eliminate common street crime. It’s just not realistic. Flaws will always exist, even within the most ideal protective structures. Every company should assume they’ll be breached, and focus efforts on minimizing damage once cybercriminals get in. The need for qualified cybersecurity professionals... Read more →

Secure Software Development – Closing the Gap between Risk Awareness and Response

by Mano Paul, CISSP, CSSLP, MCSD, MCAD, CompTIA Network+, ECSA As highlighted in the recently released 2013 Global Information Security Workforce Study (GISWS) – the largest vendor-neutral study of its kind conducted by (ISC)2 and analyst firm Frost & Sullivan – the largest gap between information security risk awareness and response exists in the secure software development discipline. In fact, respondents ranked application vulnerabilities as their top concern, making application security and secure software development the highest ranking security concern for the information security profession today. As the first software security certification, the groundbreaking Certified Secure Software Lifecycle Professionals (CSSLP®s)... Read more →

Flight risk

An amateur pilot has reportedly assembled and hacked real aircraft cockpit systems, demonstrating their vulnerabilities. "Security researcher Hugo Teso was able to "hijack" the systems to feed false navigation information to a simulated jet that made it change course." BBC It's not hard to think of scenarios where a well-resourced, competent and overtly malicious yet non-suicidal adversary could wreak havoc by redirecting aircraft, missiles, anti-missile-missiles, drones etc. using similar techniques, or simply interfere with them, hence one would have thought that information security was an obvious safety-critical requirement for their navigation and comms systems ... like for example the 30... Read more →

Federal Cloud Computing: The Definitive Guide for Cloud Service Providers

Federal Cloud Computing: The Definitive Guide for Cloud Service Providers offers an in-depth look at topics surrounding federal cloud computing within the federal government, including the Federal Cloud Computing Strategy, Cloud Computing Standards, Security and Privacy, and Security Automation. You will learn the basics of the NIST risk management framework (RMF) with a specific focus on cloud computing environments, all aspects of the Federal Risk and Authorization Management Program (FedRAMP) process, and steps for cost-effectively implementing the Assessment and Authorization process, as well as strategies for implementing Continuous Monitoring, enabling the Cloud Service Provider to address the FedRAMP requirement on... Read more →

Making the users accountable

We all know that information security relays on a layered approach. It´s about people, process/programs and technology. And we all know about Advanced Persistent Threats. How they work, attack vectors, etc. And even so, more and more companies are attacked by each day. I just want to highlight two incidents that are critical on my opinion and will act as the basis of my argumentation. One of the incidents happened to Coca-Cola. They were attacked by hackers on 2009 and the effect of this was the collapse of one giant company acquisition that Coca-Cola was negotiating in China. What is... Read more →

FedRAMP: A progress report from a 3PAO

The Federal government’s cloud first policy is in full swing. It has been 6 months since the Federal Risk and Authorization and Management Program (FedRAMP) was granted initial operating capability to streamline cloud security management and vendor approvals in an effort to strengthen our national IT infrastructure. In short, FedRAMP requires a few things. One, that government agencies identify 3 low- and moderate-impact federal systems that must be moved to commercial cloud environments by 2015 (reduced cost, operating efficiency is the MO here). Two, accredit independent third party assessment organizations (3PAO) to assess cloud environments to a known set of... Read more →

Social engineering trumps Wal-Mart customer service

This year's social engineering 'capture the flag' competition at the DefCon hackers' conference was won by a contestant who does social engineering for a living. In the course of a 20 minute phone call, he successfully fooled a Wal Mart employee into revealing all the pieces of information he was after, even getting him to visit a website to 'complete a survey'. Read about the con here. Aside from the Wal Mart story itself, the comments on the CNN article are just as telling. Even allowing for the fact that only certain people were inspired enough to want to read... Read more →

EU organizations below par on infosec

A study into the information security practices of 600 mid-sized European businesses by PwC and Iron Mountain paints a disappointing picture of their state of maturity. Their overall score comes out at 40.6 on a scale ranging from 0 (dreadful) to 100 (excellent). 40.6 is somewhat below the pass-mark of 50. In my experience performing IT audits against ISO/IEC 27002, average scores have been up around 60 to 70%, although these are for large organizations in industries that take information security seriously (financial services, defence, aerospace, pharmaceuticals and hi tech/engineering). For starters, they employed me to do their IT audits!... Read more →

Selecting a 3PAO with assessors that have the Certificate of Cloud Security Knowledge (CCSK)

The CCSK is NOT meant to be a substitute for other certifications in information security, audit and governance. The CCSK augments other credentialing programs like the CISSP, CAP, CSSLP, etc. However, the CCSK does provide a valuable selector for organizations such as federal agencies, cloud service providers (CSPs), and even cloud customers seeking to evaluate the qualifications of potential assessors such as those included in the U.S. Government’s Federal Risk and Authorization Management Program (FedRAMP) Third Party Assessment Organization (3PAO) program when conducting their own due diligence. Per FedRAMP Program Management Office (PMO) - FedRAMP.gov FAQ: What is a 3PAO?... Read more →