(ISC)² Blog

Calling All Cybersecurity Experts!

This year’s (ISC)² Security Congress – with the theme “Leaders of Tomorrow” – will take place September 25-27 in Austin, Texas at the JW Marriott. For the first time, Security Congress will be a stand-alone event, without former partner ASIS International. “We value the partnership we had with ASIS International for the past six years, but it was time for Security Congress to stand on its own to address the programming needs expressed by our members,” says (ISC)² CEO David Shearer. The cybersecurity conference will host more than 90 educational sessions, as well as a town hall meeting, career center... Read more →

EMEA Advisory Council Marks International Data Protection Day with GDPR Warning

Yves Le Roux, co-chair and public policy workgroup lead, (ISC)2 EMEA Advisory Council This Saturday marks the 10th anniversary for Data Protection Day, celebrated each year on 28 January – which is the date the Council of Europe’s data protection convention, known as “Convention 108”, was established. Data Protection Day, known as Privacy Day outside of Europe, is now celebrated globally, raising awareness of people’s rights as they relate to the automatic processing of their data. Each year, events are held around the world to both arm citizens with the information they need to understand and protect their rights, while... Read more →

CISSP Spotlight: Miriam Celi

Name: Miriam Celi Title: Technical Leader – Secure Coding IT Quality Assurance Employer: Humana, Inc. Years in IT: 20 Years in cybersecurity: 7 Cybersecurity certifications: CISSP, GISP How did you decide upon a career in cybersecurity? I got into a career in cybersecurity by chance. In early 2009, I joined a small startup that specialized in personal identity verification (PIV) solutions for the government. I was very fortunate that since the company was small, I was able to perform various roles, such as integrating products with various physical access control systems and biometric devices, representing the company in security conferences... Read more →

Why cars are increasingly vulnerable to cyber attack

Adrian Davis, Managing Director, EMEA at (ISC)² explains how we can stop the ongoing proliferation of vulnerabilities in connected cars It’s clear that we are rapidly moving towards turning cars into rolling internet browsers, connecting to everything from traffic lights to household appliances. Future vehicles will get remote updates on traffic jams or weather, automatically alert emergency services to accidents as they happen, allow drivers to get over-the-air ‘upgrades’ without visiting a dealership and even warm up their kettles from their cars. Software updates can now give cars self-driving features, turn them into rolling Wi-Fi hotspots or even allow them... Read more →

CISSP Spotlight: Collin Chung

Name: Collin Chung Title: Risk and Compliance Analyst II Employer: CareerBuilder Education: B.A. Years in IT: 6 Years in cybersecurity: 5 Cybersecurity certifications: CISA, CISSP, CRISC, ITIL How did you decide upon a career in cybersecurity? It honestly just happened upon me. I loved video games growing up and decided to pursue an education in information technology and business - MIS. I later discovered that my love of computers pervaded enterprises in ways I couldn't have imagined and dove head first into the world of IT and eventually cybersecurity. Why did you get your CISSP®? Before I obtained my CISSP... Read more →

Moving Beyond the Dangerous Denial Phase as Individuals and Organizations

I spent 25 years in the Washington, DC area, and during that time I became a National Public Radio junkie. I guess I still am. I recently listened to a report on a comprehensive study about how people in the workplace react to the news about a coworker that’s been diagnosed with breast cancer.[i] The results of the study shocked me. The worse the diagnoses and the closer employees physically worked to the diagnosed coworker, the less likely those working in close proximity were to seek cancer screening. Similarly, as the conversation about the complexities, costs, and potential breaches is... Read more →

JP Morgan Chase Security Breach Comments from (ISC)² Leadership

Continuous monitoring is the key to thwarting these types of breaches. With cyberattacks becoming commonplace in every sector, companies must continuously protect their most valuable information. Cyber guns fire at us all the time, but the notion of catching and stopping every cybercriminal simply isn’t realistic in today’s burgeoning threat environment. I liken it to aspiring to completely eliminate common street crime. It’s just not realistic. Flaws will always exist, even within the most ideal protective structures. Every company should assume they’ll be breached, and focus efforts on minimizing damage once cybercriminals get in. The need for qualified cybersecurity professionals... Read more →

Secure Software Development – Closing the Gap between Risk Awareness and Response

by Mano Paul, CISSP, CSSLP, MCSD, MCAD, CompTIA Network+, ECSA As highlighted in the recently released 2013 Global Information Security Workforce Study (GISWS) – the largest vendor-neutral study of its kind conducted by (ISC)2 and analyst firm Frost & Sullivan – the largest gap between information security risk awareness and response exists in the secure software development discipline. In fact, respondents ranked application vulnerabilities as their top concern, making application security and secure software development the highest ranking security concern for the information security profession today. As the first software security certification, the groundbreaking Certified Secure Software Lifecycle Professionals (CSSLP®s)... Read more →

Flight risk

An amateur pilot has reportedly assembled and hacked real aircraft cockpit systems, demonstrating their vulnerabilities. "Security researcher Hugo Teso was able to "hijack" the systems to feed false navigation information to a simulated jet that made it change course." BBC It's not hard to think of scenarios where a well-resourced, competent and overtly malicious yet non-suicidal adversary could wreak havoc by redirecting aircraft, missiles, anti-missile-missiles, drones etc. using similar techniques, or simply interfere with them, hence one would have thought that information security was an obvious safety-critical requirement for their navigation and comms systems ... like for example the 30... Read more →

Federal Cloud Computing: The Definitive Guide for Cloud Service Providers

Federal Cloud Computing: The Definitive Guide for Cloud Service Providers offers an in-depth look at topics surrounding federal cloud computing within the federal government, including the Federal Cloud Computing Strategy, Cloud Computing Standards, Security and Privacy, and Security Automation. You will learn the basics of the NIST risk management framework (RMF) with a specific focus on cloud computing environments, all aspects of the Federal Risk and Authorization Management Program (FedRAMP) process, and steps for cost-effectively implementing the Assessment and Authorization process, as well as strategies for implementing Continuous Monitoring, enabling the Cloud Service Provider to address the FedRAMP requirement on... Read more →

Making the users accountable

We all know that information security relays on a layered approach. It´s about people, process/programs and technology. And we all know about Advanced Persistent Threats. How they work, attack vectors, etc. And even so, more and more companies are attacked by each day. I just want to highlight two incidents that are critical on my opinion and will act as the basis of my argumentation. One of the incidents happened to Coca-Cola. They were attacked by hackers on 2009 and the effect of this was the collapse of one giant company acquisition that Coca-Cola was negotiating in China. What is... Read more →

FedRAMP: A progress report from a 3PAO

The Federal government’s cloud first policy is in full swing. It has been 6 months since the Federal Risk and Authorization and Management Program (FedRAMP) was granted initial operating capability to streamline cloud security management and vendor approvals in an effort to strengthen our national IT infrastructure. In short, FedRAMP requires a few things. One, that government agencies identify 3 low- and moderate-impact federal systems that must be moved to commercial cloud environments by 2015 (reduced cost, operating efficiency is the MO here). Two, accredit independent third party assessment organizations (3PAO) to assess cloud environments to a known set of... Read more →

Social engineering trumps Wal-Mart customer service

This year's social engineering 'capture the flag' competition at the DefCon hackers' conference was won by a contestant who does social engineering for a living. In the course of a 20 minute phone call, he successfully fooled a Wal Mart employee into revealing all the pieces of information he was after, even getting him to visit a website to 'complete a survey'. Read about the con here. Aside from the Wal Mart story itself, the comments on the CNN article are just as telling. Even allowing for the fact that only certain people were inspired enough to want to read... Read more →

EU organizations below par on infosec

A study into the information security practices of 600 mid-sized European businesses by PwC and Iron Mountain paints a disappointing picture of their state of maturity. Their overall score comes out at 40.6 on a scale ranging from 0 (dreadful) to 100 (excellent). 40.6 is somewhat below the pass-mark of 50. In my experience performing IT audits against ISO/IEC 27002, average scores have been up around 60 to 70%, although these are for large organizations in industries that take information security seriously (financial services, defence, aerospace, pharmaceuticals and hi tech/engineering). For starters, they employed me to do their IT audits!... Read more →

Selecting a 3PAO with assessors that have the Certificate of Cloud Security Knowledge (CCSK)

The CCSK is NOT meant to be a substitute for other certifications in information security, audit and governance. The CCSK augments other credentialing programs like the CISSP, CAP, CSSLP, etc. However, the CCSK does provide a valuable selector for organizations such as federal agencies, cloud service providers (CSPs), and even cloud customers seeking to evaluate the qualifications of potential assessors such as those included in the U.S. Government’s Federal Risk and Authorization Management Program (FedRAMP) Third Party Assessment Organization (3PAO) program when conducting their own due diligence. Per FedRAMP Program Management Office (PMO) - FedRAMP.gov FAQ: What is a 3PAO?... Read more →

Android, Malware and Rehabilitation

With news breaking of a further wave of "fake malware-laden apps", let's hope that Google has seen ENISA's analysis of appstore security, and will not assume that Bouncer app review is enough... Read more →

Applying Newton's third law to information security

Simply banning stuff (such as using social media at work) through management edict or policy can be counterproductive for security if employees react by circumventing the ban. I argue that effective security awareness using motivation and persuasion is a far more effective technique. Read more →

40 hard-won business continuity lessons from the NZ and Japan quakes

Article draws 40 business continuity lessons from earthquakes in NZ and Japan Read more →

RSA Breach - Is authentication at risk?

Most of you have heard about the breach at RSA, in which SecurID token authentication implementation data was stolen. In case you did not heard about it, click in the following link, prior to continue reading. http://news.cnet.com/8301-27080_3-20044775-245.html As we, as Security Professionals must design and implement identity management and authentication policies as part of our job, I believe that now, many of us need to rethink our proposed solutions. Our main objective should be: How to create a more resilient authentication framework? First of all... We need to realize and accept three facts 1) Any authentication system that is 100%... Read more →

Recovering a dead hard drive in the freezer

I've heard about this technique a few times and, having never tried it myself, I've always been cynical ... but by all accounts it looks like I'm wrong. The basic idea is to put a failed hard drive in the freezer for at least an hour, preferably overnight, before trying to read the drive. Responses to another blog piece on this include plenty of success stories, and a few clues about why it might work. The reason seems to be not the cooling per se but avoiding the heat generated in the drive when it is working normally. Presumably those... Read more →