Category: Cyber Security

The Center for Cyber Safety and Education^TM has announced the 2016 recipients of its Women’s Cybersecurity Scholarships. The scholarships, totaling US$40,000 in awards, will be provided to seven women from around the world in various levels of study to help them advance their cybersecurity careers. The Center is the nonprofit charitable foundation formed by (ISC)² in 2011 to empower students, parents, teachers and the general public, across all age groups and demographics, to secure their online lives with cybersecurity education and awareness programs.

According to the 2015 (ISC)² Global Information Security Workforce Study, women represent only 10 percent of the cybersecurity workforce. There is a talent gap facing the industry in general, with a shortage estimated at 1.5 million professionals by the year 2020. Increasing the number of women in the field by supporting those who are enrolled in formal education programs is one way that (ISC)² and the Center can help to fill that gap.

The Center teamed up with Raytheon, a technology company specializing in defense, civil government and cybersecurity solutions, to award two of the scholarships to Nicole Krantz and Catherine McLean. Each recipient will receive US$10,000 to support their cybersecurity education. Krantz is beginning the cybersecurity engineering program at George Mason University later this year. McLean is a junior at Northeastern University and is pursuing a bachelor’s degree in computer science cyber operations. She participates in the university’s co-op program and is currently working as an intern at Raytheon.

“I am so honored to accept the 2016 Raytheon’s Women in Cybersecurity Scholarship,” said Krantz. “It is such a wonderful opportunity that will open doors for me in the future. I could not attend George Mason University without it.”

“I’m incredibly honored to be awarded Raytheon’s Women in Cybersecurity Scholarship,” said McLean. “This scholarship will enable me to continue pursuing my passion for security, through both classes and my internship at Raytheon COI, and I am excited to fully explore a career in this field.”

Scholarships were also awarded to graduate students Anna Truss of Excelsior College, Saleema Adejumo of the University of Leicester, Keirsten Williams of the University of Maryland, Shivani Singhal of Carnegie Mellon Univeristy and Jingxuan Wang, who is pursuing her Ph.D. at the University of Hong Kong.”With this partnership, the Center for Cyber Safety and Education and Raytheon are actively supporting women who are focused on information security and giving them the opportunity to gain valuable hands-on experience,” said Patrick Craven, director, Center for Cyber Safety and Education.

For more information on the Center’s scholarships, please visit https://www.isc2cares.org/Scholarships/.

(ISC)² Management

[(ISC)² Blog]

The cybersecurity field contains a professional charge like few others. Exploding into the commercial landscape over the last decade, the discipline finds itself in a perpetual state of flux. Subject to a myriad of definitions, many hopeful professionals and students know two things about cybersecurity:  first, it is important; second, it is growing.

This trend is evident in the highest levels of corporate consciousness. A recent Forrester poll cited a 48 percent increase in executive awareness of information security. As a result, students and professionals worldwide are pursuing the vocation, while companies try hard to hire these professionals.

However, somewhere a disconnect has occurred in the training process because the people who have studied, prepped, certified and sacrificed for these skills and jobs are often deemed unqualified, unproven or unknown by hiring organizations. As a result, both the aspirational professional and the hopeful hiring organization are left wanting. This is underlined by the fact that one of the biggest hiring hurdles organizations face is finding people with the “right stuff.”

The same Forrester poll noted that 59 percent of cybersecurity organizations said finding employees with the right skills was either a challenge or a major challenge. Of those respondents, 59 percent felt keeping their cybersecurity team staffed appropriately was either a challenge or a major challenge. Thus, reinforcing findings of an ISACA/RSA survey State of Cybersecurity: Implications for 2016 that found 27 percent of respondents needed at least three to six months to fill vacancies.

This disruptive cycle of cybersecurity employment disappointment is a direct result of the current education and certification systems, churning out graduates and certificate holders who, while displaying gumption and interest, are rarely evaluated on the level that matters:  hands-on performance. True capability in the field of cybersecurity does not rest in the traditional certification or education process, but requires performance-based testing and evaluation in live environments. Only through directly assessing an individual under pressure and time constraints are organizations able to truly place their faith in new hires.

The Problem
It is easy to see why a lot of cybersecurity job hopefuls are struggling. Traditional academic institutions offer advanced degrees in cybersecurity without ever dissecting a packet, instead providing curriculum heavy in policy and guidance. While no cyber education is complete without a thorough understanding of the laws that govern the realm, it is equally important that students learn the practical side of the craft. Meanwhile, many certification programs that vaunt their technical aspects suffer from rampant test and evaluation corruption, wherein students purchase copies of the antiquated knowledge-based exams online, memorizing the answers and cheating the certification process. So it comes as no surprise when most organizations feel that only half of their cybersecurity applicants are qualified upon hire.

The Solution
A cure is at hand:  the Cybersecurity Nexus (CSX). CSX is a holistic, grassroots program—developed from the ground up—with real time evaluation of technical skills at its core. With three levels:  Practitioner, Specialist and Expert, the program meets hiring organizations’ needs for new, proven talent. Understanding that the greatest skills needs in cybersecurity organizations are skills in security operations, such as device configuration, policy maintenance and intelligence analysis, CSX provides students with consistent, live lab environments, which are accessible anywhere with an Internet connection. Additionally, CSX integrates all of the important governance and policy details of the cybersecurity field, both internationally with ISO and ISA compliance, as well as Cybersecurity Framework elements.

While this is helpful for students, the true value lies in the certification exam that requires them to identify and protect assets, detect and respond to threats, and recover from network incidents in a live environment. They are evaluated in real time, based upon their performance and effectiveness. The end result is competent, proven cybersecurity professionals who provide results on their first day.

Hope for Competence
While the cybersecurity field matures and expands, it is important to remember that accurate evaluation of hands-on skills is the most effective way to assure that potential hires and aspirational professionals are able to prove their abilities. Through applying performance-based instructional and certification mechanisms, like those seen in the CSX program, organizations can feel confident that their new hires are applicable on day one and new employees can take solace in the knowledge that they have effectively proven their worth.

Editor’s note: The CSX Practitioner (CSXP) certification was recently honored by SC Magazine as the Best Professional Certification Program at the SC Awards Gala on Tuesday, March 1, during the RSA Conference. CSXP is the first vendor-neutral, performance-based certification on the market. ISACA’s CISA and CISM certifications were also among the five nominees from industry groups offering certifications to IT security professionals wishing to receive educational experience and credentials.

Frank Downs, Sr. Manager, Cyber/Information Security, ISACA

[ISACA Now Blog]

Incidents involving ransomware are becoming more prevalent and can devastate an underprepared organization. What is most alarming is that ransomware variants are increasingly easier to obtain and deploy by not only criminal syndicates, but anyone with the means and desire to purchase.

In the community we have seen rapid development of ransomware with many of the more robust variants becoming more and more difficult to circumvent. Thankfully, many practitioners and researchers have come together to assist ransomware victims in recovering their data. While it is good to see open-sourced solutions available to mitigate ransomware and help victims recover their data, criminals that develop ransomware can easily sidestep identified recovery techniques and deploy a more advanced version.

Not too long ago, ransomware attacks primarily targeted individuals (the Steam ransomware attacks come to mind). Many individual victims did not have the means or desire to pay the ransom, which directly impacted criminal profit. Within the past year we have seen not only an uptick of those exposed to ransomware, but honed targeting more directed at businesses (those with the means and desire to pay).

Two fairly publicized attacks involve Hollywood Presbyterian Hospital and a school system in South Carolina. In both cases, these organizations were underprepared to perform data recovery in-house and business leaders decided their only option was to pay the ransom; this is not the position an organization wants to be in when an incident occurs.

Each time ransom is paid, the attacker wins, the criminals become better funded and the ransomware attack model becomes more lucrative; thus attracting more criminals to conduct such attacks on larger scales. “Funding the cybercriminal” should not be the best option in a disaster recovery plan, although for many organizations it is both the best and only option. While moving at the speed of business, basic industry standards for backup and recovery planning are not being met. This can either be due to ignorance of the threat, lack of funding, too few resources, or misaligned priorities.

Our consultants respond to all types of incidents, including ransomware events. We also help organizations visualize how ransomware spreads by conducting live simulations using custom tools to simulate a ransomware attack and recommend our business-tailored phishing assessments as well. In all cases, our simulations show that clients without a disaster recovery plan (and those underprepared for an information security incident) experience a severe business impact and can easily be crippled by ransomware. A recent incident we responded to involved one click on a phishing email by an over-privileged user, resulting in a near complete loss of company data (even the nightly backup!). While we were able to assist in complete restoration of the encrypted data, I am positive the business leaders will not soon forget this incident.

Practical approaches to defend against ransomware (at a minimum) include:

• Robust disaster recovery plans and policy development
• End-user awareness of the business threat (easier to conceptualize a threat to business rather than IT screaming “Cyber scary things!”)
• Backup and storage solutions that are well-maintained and scalable as the business grows
• Segmented network space and restricted user account permissions (Sorry, having admin privileges does not make you cool, it makes you a target and business risk)
• Full network packet capture (even small amounts of packet capture can tell a story if there is an incident)
• Continuous monitoring and vulnerability assessment

Incidents involving ransomware are likely to continue. Industry involvement and development of mitigating techniques through reverse engineering of ransomware are extremely helpful in assisting an organization overcome by ransomware get back on their feet; this alone is just not enough to protect the business. The only way we can truly stop ransomware and those that distribute and profit from it, is to defund it. When ransomware is no longer lucrative for a criminal organization, ransomware development and improvements will vastly decrease (this goes against the criminal business model). As long as underprepared organizations are willing to pay the ransom, profitability remains.  Employing practical approaches to defend against ransomware attacks within your organization will help dry up the ransomware well.

Note: ISACA Now is running a series of blogs on the 10 threats covered in ISACA’s Cybersecurity Nexus (CSX) Threats & Controls tool. The threats include APT, cybercrime, DDoS, insider threats, malware, mobile malware, ransomware, social engineering, unpatched systems and watering hole. To learn more about the controls for cybercrime, as well as recent examples and references, typical patterns of cybercrime and more, visit the tool here.

Brandon McCrillis, Sr., Information Security Consultant, Rendition Infosec, @13M4C

[ISACA Now Blog]

The Cloud Security Alliance has opened the call for papers for the 2016 CSA EMEA Congress, to be held November 15 at the Circulo de Bellas Artes in Madrid, Spain. CSA EMEA Congress is Europe’s premier cloud security event and is designed around the CSA’s core mission of promoting the use of best practices for providing security assurance within Cloud Computing and to provide education on the uses of Cloud Computing to help secure all other forms of computing.

The one-day conference will include two parallel tracks. Papers can be submitted online at:https://easychair.org/conferences/?conf=csaemea2016

The call for papers closes on August 1, and speakers will be notified by September 1.

The following topics are of key interest:
Current and emerging trends

• Containerization and micro service security
• Software Defined Perimeter (SDP)
• Blockchain
• Cloud-enabled vs Cloud-centric application
• Multi-actor authentication
• Cloud-based solutions for Small and Medium Enterprises (SMEs)
• Threat landscape for cloud computing
• IoT and Cloud, e.g Cloud and smart cities, smart transport.
• Big Data security

Privacy in the Cloud

• The impact of the European General Data Protection Regulations
• How to manage legal and security compliance in a multi national environment
• Cyber Security Laws and Regulation in Europe
• The impact of the right to be forgotten in the cloud
• Privacy and Security by design
• Encryption solutions and trends

Risk Management, Certification and standards for the cloud

• The role of standards within organisations
• Case studies on the adoption of cloud certification
• How manage Governance Risk and Compliance in the Cloud
• Risk Profiling
• Security and Privacy Service Level Agreements
• Cloud Security Automation: how to develop and implement framework for automated risk calculation and response.
• SaaS Governance

Incident Management in the Cloud

• Incident Information Sharing
• Leveraging Big Data for Threat intelligence in the Cloud
• Cloud Forensics
• SIEM in the Cloud
• Cloud Security Gateways vs SIEM
• Privacy Breaches Reporting
• Reporting Security Breaches: the state of art in Europe
• Cloud Disaster Recovery

Cloud Computing in critical sectors

• Finance sector
• ehealth
• eGovernement
• Energy
• Transport

General guidelines

• Proposals cutting across the above topics are also encouraged.
• Proposals, presentations, panels, or sessions must be in English and should provide a learning opportunity for the conference attendees.
• In case a proposal is accepted, the author (or one of the authors) must attend
• Proposals that focus on marketing or promoting a product or service will not be considered.
• Proposals from marketing or PR professionals (external or internal) will not be considered.

For general inquiries and speaking opportunities, please contact pr@cloudsecurityalliance.org.
For sponsorship enquiries, please contact marketing@cloudsecurityalliance.org.
For media credentials, please contact kari@zagcommunications.com.

[Cloud Security Alliance Blog]