Careers and certifications

OURSA takes on RSA Conference to highlight diversity

News roundup: Our Security Advocates emerges amid criticism of RSA Conference's lack of female keynote speakers. Plus, a kill switch is discovered for the Memcrashed DDoS exploit, and more. Continue Reading

By

• Rob Wright and Peter Loshin

CISSP Domain 8: Software development security explained

If you're studying for the CISSP exam, don't miss this special Security School on Domain 8. Review important concepts in software development security and sharpen your skills. Continue Reading

Domain 8: Security in software development lifecycle quiz

Understanding the ins and outs of the software development lifecycle is pivotal to passing Domain 8 of the CISSP exam. Are you ready? Find out with this practice quiz. Continue Reading

By

• (ISC) 2

Use software forensics to uncover the identity of attackers

By analyzing the proverbial fingerprints of malicious software -- its program code -- infosec pros can gain meaningful insights into an attacker's intent and identity. Continue Reading

By

• (ISC) 2

CISSP Domain 7: Security operations

Learn about important cybersecurity techniques and technologies that serve as the foundation of both day-to-day security operations and incident response. Continue Reading

Get ready for CISSP Domain 7: Cyberattack prevention quiz

Do you know what it takes to stop bad guys in their tracks? Find out with this practice quiz on cybersecurity methods and tools used to thwart or recover from an attack. Continue Reading

By

• (ISC) 2

What are the root causes of the cybersecurity skills shortage?

SearchSecurity talks with David Shearer, CEO of (ISC)2, about what is -- and isn't -- contributing to the cybersecurity skills shortage in the U.S., as well as how to fix the problem. Continue Reading

By

• Rob Wright, Senior News Director, Dark Reading

Information security certification guide: Specialized certifications

This information security certification guide looks at vendor-neutral certifications in specialized areas such as risk management, security auditing and secure programming. Continue Reading

By

• Ed Tittel

Fight a targeted cyberattack with network segmentation, monitoring

It takes a variety of tactics, including network segmenting and monitoring, to safeguard the network. Learn the latest defenses to keep your network safe. Continue Reading

By

• Michael Cobb

Fred Cohen on strategic security: 'Start with the assumptions'

Cohen is a globally recognized expert in information protection and cybersecurity. Since coining the term 'computer virus,' he has remained a pioneer in information assurance. Continue Reading

By

• Marcus J. Ranum

David Neuman: The CISO position and keeping the cloud safe

The Rackspace CISO joined the enlisted ranks in the Air Force, eventually becoming an officer with global responsibilities before moving to the private sector. Continue Reading

By

• Alan R. Earls

Information security certification guide: Forensics

This information security certificate guide looks at vendor-neutral computer forensics certifications for IT professionals interested in cyber attribution and investigations. Continue Reading

By

• Ed Tittel

Information security certification guide: Advanced level

Part three of this information security certification guide looks at vendor-neutral advanced security certifications for more experienced IT professionals. Continue Reading

By

• Ed Tittel

Information security certification guide: Intermediate level

Part two of this information security certificate guide looks at vendor-neutral intermediate certifications for IT professionals interested in midlevel positions. Continue Reading

By

• Ed Tittel

CISSP Domain 6: The importance of security assessments and testing

Security assessment and testing should be baked into your regular IT workflows so that you’re able to spot software vulnerabilities before they turn into full-blown attacks. Continue Reading

CISSP Domain 6 quiz: Vulnerabilities in software

Domain 6 of the CISSP exam tests how well you understand the security assessment and testing strategies needed to recognize, prevent and remedy vulnerabilities in software. Continue Reading

By

• (ISC) 2

CISSP Domain 5: Cloud identity management and access control

From cloud identity and access management to physical access control, this study guide will help you review key concepts from Domain 5 of the CISSP exam. Continue Reading

CISSP Domain 5 quiz: Types of access control systems

Get ready for the CISSP exam with this 10-question practice quiz covering key concepts in Domain 5, including access control, identity, authentication and more. Continue Reading

By

• (ISC) 2

John Germain lands the new CISO position at Duck Creek

Serving the technology needs of the property and casualty insurance industry means keeping a weathered eye on risk profiles, enterprise software and emerging threats. Continue Reading

By

• Alan R. Earls

How to prevent password attacks and other exploits

Prevention is essential to protection against various types of password attacks, unauthorized access and related threats. Expert Adam Gordon outlines how to proactively bolster your defenses. Continue Reading

By

• (ISC) 2

CISSP Domain 4 quiz: Network security basics

Think you know network security basics inside and out? Take this 10-question quiz to find out how well you’ve prepared for Domain 4 of the CISSP exam. Continue Reading

By

• (ISC) 2

CISSP Domain 4: Communications and network security

Brush up on network security fundamentals like segmentation and secure routing in this CISSP exam study guide for Domain 4, Communication and Network Security. Continue Reading

What does a CISO do now? It's a changing, increasingly vital role

What does a CISO do in this day and age? The responsibilities of a chief information security officer, the senior executive responsible for an organization's information security program, are growing dramatically. Once relegated to the IT department -- if there was a designated corporate role at all -- the CISO is now often a member of the C-suite team, working alongside the CIO and others, formulating information security strategy and policy with an eye on both security and the business bottom line.

As the volume and sophistication of cyberattacks expand and corporate liability grows -- threatening profits and displeasing shareholders -- CISOs are now tasked with making tough decisions on how tools, systems and training are best used to manage risk. This quarterly supplement to Information Security magazine looks at the state of the CISO role -- how it's changed, where it's heading and what it takes to become an effective CISO in terms of cybersecurity skills, staff support and education.

 Continue Reading

CISSP Domain 3 quiz: Security engineering

In preparing for Domain 3, Security Engineering, CISSP candidates should review a wide range of concepts, from security models to cryptography systems. Continue Reading

By

• (ISC) 2

CISSP Domain 3: Security systems engineering

Planning to take the CISSP exam? Brush up on essential concepts and vocabulary in security systems engineering, covered in Domain 3, in this Security School. Continue Reading

Cryptography attacks: The ABCs of ciphertext exploits

Encryption is used to protect data from peeping eyes, making cryptographic systems an attractive target for attackers. Here are 18 types of cryptography attacks to watch out for. Continue Reading

By

• (ISC) 2

CISSP Domain 2 quiz: Data security control, asset protection

Domain 2 of the CISSP exam, known as asset security, covers data security control, classification, ownership and more. Test your knowledge with this 10-question practice quiz. Continue Reading

By

• (ISC) 2

Interfacing with an information technology entrepreneur

E. Kelly Fitzsimmons started with coconuts and then sold four companies. A serial entrepreneur discusses security and technology startups and why embracing failure works. Continue Reading

By

• Marcus J. Ranum

CISSP Domain 1: Cybersecurity and risk management

Partner with business leaders and apply information security management principles to best address enterprise governance, risk management and compliance needs. Continue Reading

CISSP Domain 1 quiz: Security and risk management

Test your knowledge of the CISSP exam’s Domain 1: Security and Risk Management -- one of the heaviest-weighted portions of the test -- with this practice quiz. Continue Reading

By

• (ISC) 2

As privacy requirements evolve, CISSPs must stay informed

Just as technology constantly changes, so too do the laws and regulations that govern data privacy. CISSPs must remain aware of their organization's individual requirements. Continue Reading

By

• (ISC) 2

IT diversity and the cyberskills gap Q&A with Jules Okafor

Jules Okafor discusses the skills gap in the cybersecurity industry, how better IT diversity could help, and what is needed to bring in more women and minorities. Continue Reading

By

• Michael Heller, TechTarget

Cybersecurity skills gap fixes must support minorities

A new survey shows a majority of organizations are facing a cybersecurity skills gap and experts say more focus on women and minorities could be key to finding talent. Continue Reading

By

• Michael Heller, TechTarget

Guide to vendor-specific IT security certifications

The abundance of vendor-specific information technology security certifications can overwhelm any infosec professional. Expert Ed Tittel helps navigate the crowded field. Continue Reading

By

• Ed Tittel

Wendy Nather: 'We're on a trajectory for profound change'

This former CISO talks about her uncharted path from international banking to industry analysis. What's next for infosec? We ask the security strategist those questions and more. Continue Reading

By

• Marcus J. Ranum

Report: Threat hunting is more SOC than intel

Threat hunting is driven by alerts with less emphasis on cyberthreat intelligence, according to researchers. Yet 60% of those surveyed cited measurable security improvements. Continue Reading

By

• Kathleen Richards

Cybersecurity careers soar with security leadership skills

Security leadership abilities are hard to quantify. Certifications and degrees may ease the way into a career in cybersecurity, but hard-won experience is usually the surer path into a role that can influence meaningful change in today's complex environments. Whether they report into the CIO or outside of the IT organization, CISOs handle growing levels of responsibilities as evolving threats and infrastructures mean higher risk and no room for staff shortages. In this Information Security issue on cybersecurity careers, we look at the path to CISO. What are the measures of success or failure in this positon? Is it worth it?

As more Fortune 5000 companies seek CISOs to handle cybersecurity concerns, larger organizations in financial services and defense industries have piqued everyone's interest with their continued investment in the human factor -- the je ne sais quoi that results in successful threat hunting. While many definitions of hunting can be found, threat hunters essentially search for the traces attackers leave behind in an IT environment, usually before any alerts of their activities are generated by security devices.

"I used to think that only the best security operations center people could be threat hunters, but that's not always true," said Anton Chuvakin, a Gartner research vice president. "The best SOC analyst may be good at responding to alerts, but they don't always have the creativity that's needed."

As automation and machine learning gain hold, technology is still no substitute for security leadership abilities and cybersecurity talent. In this issue of Information Security magazine, we look at cybersecurity careers and the best ways to build top-notch security organizations.

 Continue Reading

CISO job requires proven track record in business and security

In the security field, certifications and degrees are never a substitute for on-the-job experience. For women in security, the challenges may be even greater. Continue Reading

By

• Kathleen Richards

CISSP Practice Exam and Study Guides

Studying for, obtaining and maintaining your CISSP® certification has now become more convenient with SearchSecurity.com. Continue Reading

Chenxi Wang discusses DEF CON hacking conference, 'Equal Respect'

Grassroots efforts to shift cultural thinking in information security have had a positive effect, the former professor of computer engineering says. Continue Reading

By

• Marcus J. Ranum

Role of CISO: FICO enlists CISO in security product management

As head of FICO's information security program, Vickie Miller's role is wide-ranging. Continue Reading

By

• Alan R. Earls

Uncharted path to IT and compliance with Digital River's Dyann Bradbury

Bradbury chats with Marcus J. Ranum about her early interest in computers and her unexpected career path to head of global compliance for an e-commerce provider. Continue Reading

By

• Marcus J. Ranum

How infosec professionals can improve their careers through writing

Writing can be one of the best ways to establish your reputation as an infosec professional. Expert Joshua Wright of the SANS Institute explains the best ways to do it. Continue Reading

By

• Joshua Wright, SANS Institute

CISSP online training: Software Development Security domain

Spotlight article: Shon Harris explains the core concepts in the CISSP domain on software development security, including models, methods, database systems and security threats. Continue Reading

By

• Shon Harris , Logical Security

How should we hire for specialized information security roles?

A rise in specialized roles puts extra pressure on security hiring. Expert Mike O. Villegas explains how to meet this demand and find talented security professionals. Continue Reading

By

• Mike O. Villegas, K3DES LLC

Getting to know the new GIAC certification: GCCC

The new GIAC certification, GCCC, is not a very specific certification, but it could prove useful in organizations. Expert Joseph Granneman explains why. Continue Reading

By

• Joseph Granneman, Illumination.io

CISSP quiz: System architecture, security models, system evaluation

Test your knowledge of the CISSP exam's Security Architecture and Design domain by taking this practice quiz that covers topics including system architecture, security models and more. Continue Reading

By

• Shon Harris , Logical Security

CISSP cryptography training: Components, protocols and authentication

Spotlight article: Shon Harris outlines the main topics in the CISSP domain on cryptography -- background information, cryptography components, digital authentication, protocols and more. Continue Reading

By

• Shon Harris , Logical Security

CISSP online training: Inside the access control domain

Spotlight article: Shon Harris discusses the main topics covered in the CISSP domain on access control, including authorization, authentication, identity management and more. Continue Reading

By

• Shon Harris , Logical Security

Spotlight article: Domain 8, Laws, Investigations and Ethics

Get a detailed introduction to the concepts of CISSP exam Domain 8, Laws, Investigations and Ethics. Continue Reading