Dec 07 2019

NIST CyberSecurity Framework and ISO 27001

Category: Information Security,ISO 27k,NIST CSFDISC @ 6:54 pm

NIST CyberSecurity Framework and ISO 27001

[pdf-embedder url=”https://blog.deurainfosec.com/wp-content/uploads/2019/12/NIST_ISO_Green_Paper_NEW_V3___Final_Edits.pdf”]

How to get started with the NIST Cybersecurity Framework (CSF) – Includes Preso

Written Information Security Program (WISP) – ISO 27002, NIST Cybersecurity Framework & NIST 800-53
httpv://www.youtube.com/watch?v=B8QjwD6f4rc

What is ISO 27001?
httpv://www.youtube.com/watch?v=AzSJyfjIFMw

Virtual Session: NIST Cybersecurity Framework Explained
httpv://www.youtube.com/watch?v=nFUyCrSnR68





Enter your email address:

Delivered by FeedBurner

Tags: iso 27001, NIST CSF, NIST RMF


Nov 21 2019

Five Keys for Building a Security program

Category: Information SecurityDISC @ 11:00 pm


https://www.sans.org/media/critical-security-controls/Poster_CIS-Security-Controls_2018.pdf
The best practice guide for an effective infoSec function

Five Keys for Building a Security program

Open a PDF file Five Keys for Building a Security Program.

 


Enter your email address:

Delivered by FeedBurner


Oct 21 2019

6 Essential Pillars for InfoSec Prioritization

Category: Information SecurityDISC @ 11:22 am

It may be time to Think Differently in security.

Do you know which of your vulnerabilities are critical, those which can wait a day, vs ones that are just noise? Read this handy guide to get the 6 essential pillars for comprehensive InfoSec prioritization:



The Five Laws of Cybersecurity | Nick Espinosa | TEDxFondduLac
httpv://www.youtube.com/watch?v=_nVq7f26-Uo

Your 5 Year Path: Success in Infosec
httpv://www.youtube.com/watch?v=Uv-AfK7PkxU

Top 20 Security Controls for a More Secure Infrastructure


Subscribe to DISC InfoSec blog by Email

Tags: isms, Secure Infrastructure


Oct 14 2019

The best practice guide for an effective infoSec function

Building ISMS

The best practice guide for an effective infoSec function: iTnews has put together a bit of advice from various controls including ISO 27k and NIST CSF to guide you through what’s needed to build an effective information security management system (ISMS) within your organization.

This comprehensive report is a must-have reference for executives, senior managers and folks interested in the information security management area.

 

Practice Guide

Open a PDF file The best practice guide for an effective infoSec function.

How to Build a Cybersecurity Program based on the NIST Cybersecurity Framework
httpv://www.youtube.com/watch?v=pDra0cy5WZI

Beginners ultimate guide to ISO 27001 Information Security Management Systems
httpv://www.youtube.com/watch?v=LytISQyhQVE

Conducting a cybersecurity risk assessment


Subscribe to DISC InfoSec blog by Email

Tags: isms


Sep 26 2019

Live and let live InfoSec

User vs Security

secret password
Live and let live InfoSec

The average person’s take on security control: they have real jobs to do, and security isn’t one of them. so remember ‘usability vs bypass security control’ when designing a new control. Please feel free to share your opinion on this.



Funny business meeting illustrating how hard it is for an (infosec) engineer to fit into the corporate world!
httpv://www.youtube.com/watch?v=BKorP55Aqvg

parkour vs security chase
httpv://www.youtube.com/watch?v=Hnv5OOpr4ug


Subscribe to DISC InfoSec blog by Email


May 03 2019

Creating A Cyber Secure Home

Category: Information Security,IoT SecurityDISC @ 9:23 am

Creating A Cyber Secure Home – Infographic via SANS Institute

 Subscribe in a reader

Tags: cyber secure home, home security


Apr 03 2019

Hospital viruses: Fake cancerous nodes in CT scans, created by malware, trick radiologists

Category: Antivirus,Information SecurityDISC @ 3:50 pm

Researchers in Israel created malware to draw attention to serious security weaknesses in medical imaging equipment and networks.

Source: Hospital viruses: Fake cancerous nodes in CT scans, created by malware, trick radiologists

  • Malware Analysis


  • Apr 01 2019

    Just Having A Security Product Doesn’t Make You Secure

    Category: Information Security,ISO 27kDISC @ 5:31 pm

    Every day, big companies are still getting breached despite their security products. F-Secure’s Mikko Hypponen warns that companies that say ‘use our technology and you will not have a breach’ actually make it much harder for clients to think about and be ready for a breach.

    Source: Just Having A Security Product Doesn’t Make You Secure



    Mar 09 2019

    Google Says Upgrade To Windows 10 After Critical Flaws Found In Chrome And Windows 7

    Category: Information Security,Security patchingDISC @ 11:54 am

    Hot on the heels of disclosing a critical zero-day vulnerability in Chrome that was being exploited in the wild by attackers, Google has now uncovered another critical zero-day that is being used alongside it to take over Windows machines.

    Source: Google Says Upgrade To Windows 10 After Critical Flaws Found In Chrome And Windows 7



    Mar 05 2019

    Comcast security nightmare: default ‘0000’ PIN on everybody’s account

    Category: Information SecurityDISC @ 10:29 am

    It didn’t require an account PIN to switch carriers. Everybody uses 0000, it said, making it easier for customers… and phone hijackers.

    Source: Comcast security nightmare: default ‘0000’ PIN on everybody’s account

  • Best Practice Information Security
  • Enter your email address:

    Delivered by FeedBurner


    Feb 28 2019

    Microsoft: Do these things now to protect your network | ZDNet

    Category: Information SecurityDISC @ 10:08 am


    In its annual security intelligence report, Microsoft offers up its top tips for blocking out hackers.

    Source: Microsoft: Do these things now to protect your network | ZDNet


    Enter your email address:

    Delivered by FeedBurner


    Jan 29 2019

    Scanner CLI : A Project Security/Vulnerability/Risk Scanning Tool

    Category: Information SecurityDISC @ 8:38 am

  • #InfoSecTools
  • The Hawkeye Scanner CLI is a project security, vulnerability and general risk highlighting tool. It is meant to be integrated into your pre-commit hooks

    Source: Scanner CLI : A Project Security/Vulnerability/Risk Scanning Tool



    Jan 25 2019

    Windows 7 migration warning: Plan now to avoid security worries later | ZDNet

    Category: Information SecurityDISC @ 9:56 am

    Malware can spread much more easily on obsolete platforms, warns security body. With less than a year until the end of Windows 7 support, don’t get caught out.

    Source: Windows 7 migration warning: Plan now to avoid security worries later | ZDNet

    Subscribe to DISC InfoSec blog by Email


    Tags: Windows 7, windows security


    Jan 23 2019

    Center for Internet Security releases Microsoft 365 benchmarks

    Category: App Security,Information SecurityDISC @ 11:01 am

    Follow the guidance in this CIS document to configure Microsoft 365 security settings to the level that suits your organization.

    Source: Center for Internet Security releases Microsoft 365 benchmarks



    Jan 22 2019

    Businesses can safely delay patching most vulnerabilities

    Category: Information Security,Security patchingDISC @ 8:38 am

    Patching vulnerabilities is often seen as a key element of keeping systems secure. But a new report suggests businesses could be ‘smarter’ in their patching regimes and prioritize the i…

    Source: Businesses can safely delay patching most vulnerabilities

    🔒 securing the business 🔒

    DISC InfoSec

     



    Sep 19 2018

    US lawmakers introduce bill to fight cybersecurity workforce shortage

    Category: cyber security,Information SecurityDISC @ 10:04 am

    Report claims US public and private sectors had over 300,000 cybersecurity-related job openings between April 2017 and March 2018.

    By Catalin Cimpanu for Zero Day

    softwarearchitect.jpg

    US lawmakers have introduced a bipartisan bill in the House of Representatives meant to address the cybersecurity workforce shortage crisis.

    The bill, named the Cyber Ready Workforce Act (H.R.6791), would establish a grant program within the Department of Labor.

    According to the bill’s proposed text, the Secretary of Labor will be able to award grants to workforce intermediaries to support the creation, implementation, and expansion of apprenticeship programs in cybersecurity.

    These apprenticeship programs may include career counseling, mentorship, and assistance with transportation, housing, and child care costs.

    The Cyber Ready Workforce Act is meant to address a growing problem in the US workforce landscape where companies, across all sectors, are having a hard time filling cybersecurity jobs with trained personnel.

    According to a CompTIA report based on data from CyberSeek, a free cybersecurity career and workforce resource, there were 301,873 cybersecurity-related job openings in the private and public sectors between April 2017 and March 2018.

    Also: Bill that would have the White House create a database of APT groups passes House vote

    Congresswoman Jacky Rosen (Dem., NV-03) introduced the bill last week. The bill is based on the state of Nevada’s recently introduced cybersecurity apprenticeship program.

    The bill was also co-sponsored by Congressman Seth Moulton (Dem., MA-06), Congresswoman Elise Stefanik (Rep., NY-21), and Congressman Dan Donovan (Rep., NY-11).

    The bill, which doesn’t yet have mirroring legislation in the Senate, has also gained the support of trade and workforce organizations such as CompTIA and The Learning Center.

    Cybersecurity threats will continue to present national security challenges for America in the 21st century,” said Congressman Dan Donovan. “With these threats and the changing economic and technological landscape, America needs a workforce that can adequately advance our cybersecurity defense priorities.”

    “Investing in and expanding our cybersecurity workforce doesn’t only fuel our economy, it keeps us safe,” said Congressman Seth Moulton. “While I was fighting on the ground in Iraq, Al-Qaeda was fighting us on the internet — and they were beating us online! And while we focused on Russia’s military in 2016, they attacked us through the internet. This bill is an important first step towards making sure we don’t get ourselves into such a vulnerable position again.”


    Tags: cybersecurity workforce shortage


    Nov 19 2017

    4 reasons you should get a cyber security qualification

    Category: CISSP,cyber security,Information SecurityDISC @ 7:10 pm

    The dramatic rise in cyber attacks over the past few years has caught most businesses off guard. Their cyber security departments are severely understaffed, causing them to look desperately for qualified professionals to help tackle the threat.

    There has never been a better time to get into cyber security, so if you’re looking to enter the field, or further your career in it, you could benefit massively from gaining a relevant qualification. Here are four reasons why:

    1. Cyber security professionals are well paid

    Money isn’t everything when it comes to choosing your career, but it’s obviously a big factor for many people. We mentioned recently that people with a CISM®PCIor GDPR qualification could earn £60,000 or more a year.

    Of these, the CISM (Certified Information Security Manager) qualification is the most versatile. It’s the globally accepted standard of achievement among information security, information systems audit and IT governance professionals.

    According to ITJobsWatch, people with a CISM qualification earn £64,000 a year on average. This figure has grown by more than 9% in the past two years.

    1. There’s a high level of job security

    The shortage of qualified cyber security professionals means that those in the field are less likely to be replaced or made redundant. Their skills are hard to find elsewhere, and the more someone gets to know the company, the more valuable they will become.

    Additionally, because almost every organisation currently needs cyber security professionals, those with the relevant qualifications are more likely to find a position in a location or company that suits them.

    1. There’s room for career growth

    For the same reason that cyber security is a safe career, it’s also one that offers plenty of room for growth. Qualifications plus experience is a powerful combination that can help you move into more senior positions.

    As you gain experience, you’ll also get the opportunity to earn more advanced qualifications. For example, you must have at least three years’ experience in IT governance to be eligible for a Certified in Risk and Information Systems Control (CRISC) qualification, and five years’ experience to be eligible for a Certified in the Governance of Enterprise IT (CGEIT®) qualification.

    1. The work is rewarding

    Cyber security is still a relatively young field, making it an exciting and prosperous place. The threats that organisations face are constantly evolving, so you’ll always have new challenges. Plus, you know that your hard work is for a good cause: to stop cyber criminals and keep your organisation safe.

    What qualifications do I need?

    The qualifications you need will depend on the career path you choose. If you’re interested in governance, risk management, and compliance, for instance, a CGEIT qualification is essential. If you’re interested in information security, you’ll need a CRISC qualification.

    We’re currently running promotions on our CRISC, CGEIT, CISA and CISM training courses. If you book before 22 December, you’ll receive a 10% discount on the courses and a 5% discount on all reading materials.

    Find out more about our:




    Nov 12 2017

    Security in the Digital World

    Category: Information SecurityDISC @ 10:39 am

    Cyberspace, the Internet, the digital world – call it what you will – is always developing. But so are the threats and risks that come with it.

    It doesn’t matter if you are working in the most mature enterprise environment, unemployed, retired, or still at school, whether you often have a smartphone in your hand or only use an e-reader: You are still at risk and the threats will try to target you.

    Protect yourself from increasing cyber threats and risks with our latest title, Security in the Digital World, now available to pre-order.

    Security in the Digital World

    This must-have guide features simple explanations, examples, and advice to help you be security aware online in the digital age. Learn how to:

    • Keep your information secure
    • Put the necessary controls on your home network, protecting your family from cyber crime
    • Prevent identity theft when shopping online or using contactless debit cards
    • Keep your children safe when using the Internet

    Look inside this book >>



    Sep 04 2017

    Information Security Certifications and Salaries

    Category: CISSP,Information Security,Security ProfessionalDISC @ 2:54 pm

    Is this a good time to be in the field of InfoSec, (ISC)2 report shows the skills shortage is getting worse.

     

    Over the next five years, the number of unfilled cybersecurity jobs will rise to a whopping 1.8 million, a 20% increase from 2015 estimates, according to a new (ISC)2 survey released. Cybersecurity Faces 1.8 Million Worker Shortfall By 2022

     

    Start learning InfoSec basic:

    When planning to take on this career, at early stage of this career you may get as much practical experience as possible and achieve industry-standard qualifications offered by such as Microsoft, CISCO, Checkpoint, Symantec and HP. Also vendor-independent learning path A+, Network+, and Security+ qualifications are recommended.

    When evaluating prospective InfoSec candidates, employers frequently look to certification as one of the measure of excellence in continuing education and commitment to learning. Below are the 7 most sought out InfoSec certifications.

     

    InfoSec Salaries review:

    Security Analyst Salaries in the United States
    Information Security Analyst Salary Range
    IT Security Certifications Salary Guide
    Top Cyber Security Salaries In U.S. Metros Hit $380,000

     



    Aug 10 2017

    Security Management and Governance

    Category: GRC,Information Security,ISO 27kDISC @ 9:38 am
    • The textbook for the Open University’s postgraduate information security course.
    • The recommended textbook for all IBITGQ ISO 27001 courses.
    • Available in softcover or eBook format.



    Description

    Fully updated expert information security management and governance guidance based on the international standard for information security management, ISO 27001.

    As global threats to information security increase in frequency and severity, and organisations of all sizes, types and sectors face increased exposure to fast-evolving cyber threats, there has never been a greater need for robust information security management systems.

    Now in its sixth edition, the bestselling IT Governance: An International Guide to Data Security and ISO27001/ISO27002 provides best-practice guidance for technical and non-technical managers looking to enhance their information security management systems and protect themselves against information security threats.

    This new edition of IT Governance: An International Guide to Data Security and ISO27001/ISO27002 has been fully updated to take account of current cyber security trends and advanced persistent threats, and reflects the latest regulatory and technological developments, including the 2013 updates to ISO 27001 and ISO 27002.

    Product overview

    Including coverage of key international markets, such as the UK, North America, the EU and the Asia-Pacific region, IT Governance: An International Guide to Data Security and ISO27001/ISO27002 is the definitive guide to implementing an effective information security management system (ISMS), as set out in the international standard ISO 27001.

    It covers all aspects of data protection/information security, including viruses, hackers, online fraud, privacy regulations, computer misuse and investigatory powers.

    Changes introduced in this edition include:

    • Full updates in line with the 2013 revisions to the ISO 27001 standard and ISO 27002 code of practice.
    • Full coverage of changes to data protection regulations in different jurisdictions and advice on compliance.
    • Guidance on the new continual improvement model that replaces the plan-do-check-act cycle that was mandated in the 2005 iteration of ISO 27001.
    • New developments in cyber risk and mitigation practices.
    • The latest technological developments that affect IT governance and security.
    • Guidance on the new information security risk assessment process.

    IT Governance: An International Guide to Data Security and ISO27001/ISO27002 is the recommended textbook for the Open University’s postgraduate information security course and the recommended text for all IBITGQ ISO 27001 courses.



    « Previous PageNext Page »