Day: October 16, 2015

Earning a security credential can help you open the door to a great job. But you need to know which certification is the right one for you.

GIAC Security Essentials (GSEC)

Global Information Assurance Certification (GIAC) is the leading provider and developer of Cyber Security Certifications, globally recognized by government, military and industry leaders. GIAC tests and validates the ability of practitioners in areas including security administration, forensics, management, audits, software security, and legal.

Description
This certification is designed for candidates who want to demonstrate skills in IT systems roles with respect to security tasks. Ideal candidates for this certification possess an understanding of information security beyond simple terminology and concepts.

Prerequisites: None

Exam: GIAC Security Essentials (GSEC)
(180 questions, 5 hours, 73% passing score)

Approx. Cost for Exam
$1,099 USD, administered by Pearson VUE (Affiliate Pricing for GIAC Certification in conjunction with SANS training is $629 USD)

Available Courses
Recommended course SEC401: Security Essentials Bootcamp Style,

Self-Study Material
Training events ($5,950 USD), Self-study books and DVDs ($5,350 USD), Videos from Dr. Cole

Online Practice Test
SANS Security Essentials Assessment Test, (Login credentials required)

(Image source: GIAC)

When a company suffers a data breach—or fears that it has suffered a breach—teams often go into panic mode. When the dust settles, work divides into two camps: those focused on business continuity and containment, and those focused on determining if the organization has any breach notice obligations under relevant laws.

Often, these goals can be in conflict—or at least resources to achieve these goals can conflict. Different teams work on different sides of the issue. Internal resources are stretched. Outside resources overlap. What can a company do? First, recognize that both goals are important and deserve resources. Second, account for both goals throughout the breach “process.” The following are some concrete steps companies—and their breach crisis teams—can take:

• Before the incident: Everyone knows about creating an incident plan, and giving it a test run. But what about taking steps to understand your business realities and needs? Being prepared and ready to address a breach, if it arises, hinges on a good understanding of the types of information you have, where you have it, and with whom that information is shared. It is never too soon to start on this work, and keeping that information up-to-date can be a life saver if a breach arises.
• Digging in—investigating an incident : This is where the work of the two goals, containment and determining notification obligations, can come into the most conflict. Obviously you will need to contain and control the incident. You will want to take steps like investigating the nature of the incident and getting the right team–with the right background—on hand. But you will also want to know some very specific facts for the lawyers who are determining whether notification is necessary. This includes understanding if there was a compromise to the information and if the information itself triggered breach notice laws (social security numbers, medical information, usernames and passwords, etc.).
• Notification : If you determine that notification is necessary, containment should not leave the scene. Will your notice impact any ongoing investigations? Will you tip off a bad actor? These are things that should be taken into account as you draft your notifications, and as you potentially work with law enforcement pursuing said bad actors.
• Post -notification: Once your notice goes out, you are not finished. The containment team will want to look at what lessons can be learned for next time—if there is a next time. The legal side of the house will be thinking about potential post-notice inquiries, whether they come from regulators, the press, or impacted individuals.

Regardless of whether your incident involves an aggressive bad actor bent on destroying your company or gives rise to a duty to notify, your team should ensure that it is taking appropriate steps to both contain and assess legal risks. The tips above are aimed at helping you get there.

Liisa Thomas, Esq.
Partner at Winston& Strawn LLP

Liisa will speak more on data breaches at the ISACA’s CSX 2015 cyber security conference in Washington, DC, 19-21 October 2015.

Note: This post is the third in a series of Cybersecurity Awareness Month blog posts. To learn more on the cyber security resources ISACA is offering this month, click here.

[ISACA Now Blog]

“We tend to focus on the shiny technology when, in fact, actually, humans are the weak link in cybersecurity.”
— Michael Daniel, cybersecurity coordinator, Executive Office of the President

As a nation, the US will be recognizing cybersecurity awareness throughout the month of October. The Department of Homeland Security and likely every vendor that sells cybersecurity products or services will be sounding the ‘awareness alarm’, offering tips and tricks for users in an effort to promote safer online practices and better cyber hygiene.

But for those of us in the cybersecurity profession, awareness should not stop at educating users. As leaders in our field, the term must invoke a determination to address a workforce in crisis.

No one can truly understand what we are facing as a profession unless they are actually in the profession. Security managers are struggling to find qualified staff to run the security operations center; system administrators are bustling to keep pace with patching demands; incident responders are trying to catch a breath in between back-to-back breach timelines.

In recent years, it has been said that we are suffering from a ‘human capital crisis,’ a term recognized by both lawmakers and leaders in the public and private sectors. The very core of this crisis is characterized by a widening gap between supply and demand for workers. The(ISC)² 2015 Global Information Security Workforce Study (GISWS) forecasts that this workforce gap will only continue to widen and will reach 1.5 million professionals worldwide by 2020 due to the insufficient pool of qualified candidates.

Among U.S. federal government GISWS survey respondents, 60% said that they do not have enough personnel to meet the demands of their mission, and that this is one of the key factors working against them. While both public and private sectors have dedicated significant resources to programs in an effort to fix this problem, we have found no silver bullets. As it goes, practitioners in this field are working in an environment with the odds stacked against them – and with very little relief in sight.

During the month of October, I would like to challenge those in our field to promote a different type of awareness. My challenge is for us to pull together and inspire whomever we come in contact with to consider a career in cybersecurity.

The impact of growing the cybersecurity workforce with trained and skilled personnel will be far reaching, and will ultimately benefit the users at the central focus of this month’sNational Cyber Security Awareness Month activities.

How can we promote such awareness? I, for one, intend to promote careers in cybersecurity whenever I get the chance to address students and their parents such as later this month when speaking to MITRE employees as part of (ISC)² Foundation’s Safe and Secure Online program. Here are some suggestions for my cybersecurity colleagues and others as you go about your day-to-day activities during the month of October:

• Look for opportunities to speak with children about cybersecurity. Check out your neighborhood school’s calendar of events to identify career days and rally your colleagues to get involved.
• Educate yourself on the many scholarship opportunities for those seeking careers in this field and encourage students entering college to apply.
• Know a veteran who is transitioning to civilian life? Provide him/her with information about the many programs that assist with cybersecurity career training and support.
• Your friends who are either unhappy in their current role or temporarily out of a job might see cybersecurity as a chance to transition onto a rewarding career path. Not sure how to get them started? Find an (ISC)² member or contact us directly.
• Are you a member of (ISC)²? If so, you can volunteer to teach parents, children, teachers and seniors about online safety through the (ISC)² Foundation’s Safe and Secure Online program, which also offers an opportunity to pique student interest in a cybersecurity career at a young age.
• Feed a student’s interest in cybersecurity by guiding them to one of the many cyber camps, challenges and competitions within our community.

Certainly, the goal of cybersecurity awareness is to inspire users to maintain a daily regimen of sound cyber practices. Let’s not stop at ‘shiny technology’. Instead, let’s get the message out that fortifying the workforce is essential in establishing and maintaining a safe and secure cyber world.

Dan Waddell, CISSP, CAP, PMP, (ISC)² managing director, North America Region and director of U.S. Government Affairs, was lead author of this peer-reviewed post.

[InfoSecurity Magazine]