WEIGHING IN ON NEW EXAMS

InfoSecurity
PROFESSIONAL
A Publication for the (ISC)2 Membership
NOVEMBER/DECEMBER 2016

WHAT LIES
BENEATHThe Shadowy Side of IT

+ CREATING YOUR PERSONAL LEARNING NETWORK

WRITING A BOOK IS FAR FROM CHILDS PLAY
also
AMERICAS ISLA WINNERS
LETTING GO OF LEGACY NIPS

isc2.org facebook.com/isc2fb twitter.com/ISC2

5 MINUTES WITH TUSHAR GOKHALE
GET EMPLOYERS ATTENTION
CREDENTIALS THAT SET YOU APART

EARN UP TO THREE NSA DIGITAL BADGES on your way to a degree at

a nationally recognized university. Badges are offered for these information
assurance and security (IAS) programs:

PURSUE A DEGREE IN: EARN AN NSA DIGITAL BADGE IN:

Bachelors in IT IAS Information Assurance and Security

Masters in IAS Digital Forensics Digital Forensics

Security Incident Analysis and Response

Masters in IAS Network Defense Network Security Administration

Network Security Engineering
System Security Engineering

Capella University has been designated by the National Security Agency

(NSA) and the Department of Homeland Security as a National Center
of Academic Excellence in Information Assurance/Cyber Defense for
academic years 2014-2021.

GET RECOGNIZED FOR WHAT YOU KNOW. START TODAY.

CAPELLA.EDU/ISC2 OR 1.866.933.5836

See graduation rates, median student debt, and other information at www.capellaresults.com/outcomes.asp.

ACCREDITATION: Capella University is accredited by the Higher Learning Commission.

HIGHER LEARNING COMMISSION: https://www.hlcommission.org, 800.621.7440
CAPELLA UNIVERSITY: Capella Tower, 225 South Sixth Street, Ninth Floor, Minneapolis MN
55402, 1.888.CAPELLA (227.3552)

Copyright 2016. Capella University. 16-8831

Contents VOLUME 9 ISSUE 6

DEPARTMENTS
4 EDITORS NOTE
What Kind of
Information Security
Professional Are You?
BY ANNE SAITA

6 EXECUTIVE LETTER
(ISC)2 Examinations to
Carry More Weight
BY DR. CASEY MARKS

8 FIELD NOTES
Americas ISLA winners
announced; top-paying IT
There are numerous ways
jobs in 2016; cheers for

to learn without breaking your Santiagos SecureChile;

and much more.

budget. PAGE 21

FEATURES
14 MEMBERS CORNER
Why Your Legacy
Network IDS/IPS
Needs to Be
TECHNOLOGY Replaced NOW

15 What Lies Beneath

Its time to cast a stronger light on the shadowy side of IT.
BY JAMES HAYES

27
BY RODRIGO CALVO

CENTER POINTS
Raising Awareness,
Scholarships and
PROFESSIONAL DEVELOPMENT Opportunities for

21
Future Cybersecurity
Its Not Just Who You Know Professionals
or maybe it is. Expand your professional potential by building a BY PAT CRAVEN
Personal Learning Network. BY KERRY ANDERSON
28 5 MINUTES WITH
Tushar Gokhale
PROFESSIONAL DEVELOPMENT
The Mumbai, India,

24 Playing by the Book

How an (ISC)2 member creates childrens books also meant
for their elders. BY CHRIS GRECO
native came to the U.S.
for a formal education
in information security.
And, boy, has he gotten it.

Cover image: JOHN KUCZALA. Image (above): ROBERT PIZZO. 4 AD INDEX

InfoSecurity Professional is produced by Twirling Tiger Media, 7 Jeffrey Road, Franklin, MA 02038. Contact by email: [email protected]. The information contained
in this publication represents the views and opinions of the respective authors and may not represent the views and opinions of (ISC)2 on the issues discussed
as of the date of publication. No part of this document print or digital may be reproduced, stored in, or introduced into a retrieval system, or transmitted in any
form by any means (electronic, mechanical, photocopying, recording or otherwise), or for any purpose, without the express written permission of (ISC)2. (ISC)2,
the (ISC)2 digital logo and all other product, service or certification names are registered marks or trademarks of the International Information Systems Secu-
rity Certification Consortium, Incorporated, in the United States and/or other countries. The names of actual products and companies mentioned herein may
be the trademarks of their respective owners. For subscription information, please visit www.isc2.org. To obtain permission to reprint materials, please email
[email protected]. To request advertising information, please email [email protected]. 2016 (ISC)2 Incorporated. All rights reserved.

RE TURN TO
InfoSecurity Professional 3 November/December 2016 CONTENTS
 Editors Note
WHAT KIND OF INFORMATION (ISC)2 MANAGEMENT TEAM
SENIOR MANAGER,
SECURITY PROFESSIONAL ARE YOU?

O
MEMBERSHIP MARKETING
AND MEDIA SERVICES
Jessica Hardy
727-785-0189 x4063
[email protected]
F ALL THE EXCELLENT advice delivered during a Security EXECUTIVE PUBLISHER
Congress session on building and retaining security teams, Timothy Garon
the piece that stood out most to me came from Deidre 508-529-6103
[email protected]
Diamond, founder and CEO of Cyber Security Network.
Her secret tool to hold on to good employees: kindness. SENIOR MANAGER,
CORPORATE COMMUNICATIONS
Its the number one thing that everyone wants from an employer, Diamond
Maria Forrest
says in an abbreviated transcript of the session published online. 727-201-5759
If kindness is all it took to keep top talent, youd think no one would leave. [email protected]
But, it turns out, compassion and consideration become more scarce as people MEDIA SERVICES COORDINATOR
rise in rank. UC Berkeley psychology professor Dacher Keltner discovered that Michelle Schweitz
as people gain power or privilege, they are less likely to demonstrate empathy, 727-785-0189 x4055
[email protected]
collaboration and openness toward othersnot just in politics and professional
sports, but in the workplace too. SALES TEAM
How can you tell if you practice empathy, gratitude and generositythree
EVENTS SALES MANAGER
cornerstones of kindness? Consider your own behavior toward your colleagues Jennifer Hunt
and direct reports. Studies show that people in position of corporate power are 781-685-4667
three times as likely as other employees to interrupt [email protected]
coworkers, raise their voices, and say insulting things REGIONAL SALES MANAGER
at the office, Keltner writes in the October issue of Lisa OConnell
781-460-2105
Harvard Business Review.
[email protected]
And the result? In a recent poll of 800 managers
and employees in 17 industries, about half the respon- EDITORIAL ADVISORY BOARD
dents who reported being treated rudely at work said Carlos Canoto South America
they deliberately decreased their effort or lowered the Tushar Gokhale U.S.A.
quality of their work in response, Keltner reports. Javvad Malik EMEA
This gives credence to Diamonds recommendation J.J. Thompson U.S.A.
and should serve as a warning to anyone in, or seeking, Elise Yacobellis (ISC)2
a senior-level position, today or 10 years from now. If you
arent already, learn how to listen earnestly to others. TWIRLING TIGER MEDIA
Deliver thoughtful thank yous. Acknowledge good EDITORIAL TEAM
Anne Saita, editor-in- EDITOR-IN-CHIEF
work and those who did it. Give praise generously
chief, lives and works Anne Saita
in Southern California. (and genuinely).
[email protected]
She can be reached at Do this for both your present you and your future
[email protected]. you. After all, as the famous saying goes, Be nice to ART DIRECTOR & PRODUCTION
Maureen Joyce
those you meet on the way up, for they are the same [email protected]
people youll meet on the way down.
MANAGING EDITOR
ANNE SAITA Deborah Johnson
PROOFREADER
Ken Krause
Rob Andrew Photography

ADVERTISER INDEX
For information about advertising in this publication, please contact Tim Garon at [email protected].
Twirling Tiger Media is
Capella.................................................................... 2 (ISC)2. ....................................................................12 certified as a womens
business enterprise by the
RSA.......................................................................... 5 Center for Cyber Safety & Education............13 Womens Business Enterprise
National Council (WBENC).
(ISC) . ..................................................................... 7
2
(ISC)2. .................................................................. 20 This partnership reflects (ISC)2s commitment
to supplier diversity.
Pearson...................................................................9 Twirling Tiger Media........................................ 29 www.twirlingtigermedia.com

RE TURN TO
InfoSecurity Professional 4 November/December 2016 CONTENTS
ATTEND RSA
CONFERENCE 2017
FOR LESS!

Save $200 with

your (ISC)2 member
discount code.

From February 1317, the (ISC)2 community will

come together in San Francisco at RSA Conference 2017,
the worlds largest infosecurity event.

Join your peers and discover:

Over 555 sessions covering a range of topics to
help you stay on top of threats and solutions.
(ISC)2 CCSP Two-Day Crash Course covering the six domains
in the Certified Cloud Security Professional CBK.
(ISC)2 CISSP Two-Day Crash Course covering the eight domains
in the Certified Information Systems Security Professional CBK.
More than 550 exhibitors in two Expo halls.
Four days of enlightening and inspiring keynotes, led by speakers
such as Dr. Neil DeGrasse Tyson, Amit Yoran and many more!

Visit www.rsaconference.com/isc2 to register today!

Use code 1U7ISC2FD when you register to save $200 off
a Full Conference Pass.

Follow us on: #RSAC

 THE LATEST
FROM (ISC)2S
LEADERSHIP

EXECUTIVE LETTER DR. CASEY MARKS

(ISC)2 EXAMINATIONS
TO CARRY MORE WEIGHT

T HE TIME THAT a candidate spends preparing to take

a rigorous examination can be described any number
of ways: nerve-racking, mind-numbing, paranoia-
inducing or painful. Rarely is it uneventful.
Certification examinations seek to illuminate the knowledge, skills
and abilities an individual possesses under the shroud of absolute
secrecy. Examination forms are secured. Test items may only be seen
by vetted candidates and validated professionals. Exam administration
occurs in locked-down facilities. Threat detection and risk mitigation
the highest industry standards in examination
development, administration and security. We
subject our programs to continuous third-party
audits to demonstrate that our exams are valid,
that they actually measure what they intend to
measure, and that they are reliable. Indeed, the
examination development at (ISC)2 has always
been world-class on these these important psy-
chometric principles. Now, we hope to improve
countermeasures are deployed, continuously, post-exam administration. on how we talk about these concepts.
Furthermore, we seek to assess test takers by
asking questions to measure a latent psycholog-
ical trait: in our case, the vast knowledge and
practice of securing information. Now candidates will
Dr. Casey Marks, a
20-year psychome-
While examinations and their development
need to be secure, they dont need to be a
know not only the
trician, is the director
of examinations and
mystery. To this end, (ISC)2 for the first time content areas to be
recently approved publishing examination
customer experience
at (ISC)2. He can be domain weights. Now candidates will know not assessed, but also what
reached at cmarks@
isc2.org.
only the content areas to be assessed, but also
what proportion of an exam will be dedicated proportion of an exam
to these sections.
Publishing the percentages of items dedi-
will be dedicated to
cated to each exam domain is not only good these sections.
testing practice, it is a giant leap forward in
providing necessary clarity to ensure that our
standards of validity and reliability continue Publishing domain weights at this time
to stand up to public scrutiny. provides necessary guidance and focus for
(ISC)2 cares a great deal about its certifica- candidates in their educational preparation.
tion programs. We have sought ANSI 17024 Additionally, it provides a convenient remedia-
accreditation for nine of our 10 professional tion heuristic for candidates who do not pass
certifications. How difficult is it to earn this an exam on their first attempt.
mark of excellence? Of the more than 3,000 Rest assured, the exam is certainly not any
certification programs in the United States easier than when you passed it. As what is test-
alone, fewer than 200 reportedly are ANSI- able in information security continues to grow,
accredited. so will our focus on certifying professionals who
In obtaining this prestigious recognition, are best able to help us inspire, and create, a
we must demonstrate that (ISC)2 adheres to safer and more secure cyber world.

RE TURN TO
InfoSecurity Professional 6 November/December 2016 CONTENTS
 Member Benefits
Are you getting the most out of your (ISC)2 membership? Whether you are looking for CPEs to
maintain your certification, avenues to network with your peers, or resources to help you stay on
the cutting edge of information security, your membership provides these benefits and more.

Free Digital Member Magazine

Digital Badges and Certificates
Free Online Events
Access to Exclusive Information Security Reports
Vulnerability Central and many more

VIEW BENEFITS
www.isc2.org/member-benefits.aspx

Member Discounts
(ISC)2 continues to strive to partner with industry leading organizations to deliver discounts to
provide more value to your membership. These help you stay relevant in your career, introduce
you to the top resources, and help you save money and time.

Discounts on Industry Conferences,

such as BlackHat and RSA EVENTyoSu!
r
1-Day SecureEvents to a city nea
Coming
Service and Subscription Discounts
50% Off on (ISC) Official Books,
Study Guides,and Other Resources

VIEW DISCOUNTS

www.isc2.org/member-discounts.aspx
 FIELD EDITED BY DEBORAH JOHNSON

NOTES A ROUNDUP OF WHATS HAPPENING IN (ISC)2 COMMUNITIES

(ISC)2 SALUTES THE 2016 IN REMEMBRANCE

(ISC)2 BANGALORE CHAPTER
AMERICAS ISLA WINNERS PRESIDENT SHEKHAR BOSE

T
Shekhar Bose,
president of the
HE SIXTH ANNUAL Americas Information Security Leadership (ISC)2 Bangalore
Awards (Americas ISLA) were presented at the 2016 (ISC)2 Security Chapter in India,
Congress in Orlando. Americas ISLA, part of (ISC)2s Global Awards died unexpect-
Program, recognizes the achievements of outstanding cybersecurity edly on Sept. 3,
professionals who have led a workforce improvement initiative, program or proj- 2016.
ect in Central, North or South America. An (ISC)2
Jim Davis, the creator of Garfield, provided the keynote address during a ban-
member since
quet ceremony. Garfield, the iconic cartoon cat featured in the Garfield & Friends
June 2007, Bose
series, is the spokescat for the Center for Cyber Safety and Educations Safe and
was the founding
Secure Online program.
president of the
We are excited to honor the Americas ISLA recipients once again this year,
says (ISC)2 CEO David Shearer. These professionals are advancing our industry Bangalore Chapter. With his and
and truly making a difference in the cyber world. the chapter officers efforts, the
The 2016 Americas ISLA winners are: Bangalore Chapter grew from 43
members in 2014, to 63 mem-
Senior Information Security Up-and-Coming Information bers in 2015. In an interview for
Professional Security Professional the March Chapter Connections
Diego Andres Zuluaga Urrea, Jennifer Chermoshnyuk, Paralegal, online newsletter, Bose spoke of
Information Security Officer, Davis Wright Tremaine LLP (U.S.A.) wanting to increase the chapter ac-
ISAGEN S.A. (Colombia) PROJECT: Continuing Legal tivities by providing more member
PROJECT: Colombian Energy Education Program benefits to the local community.
Sector Cyber Security Improvement His energy and enthusiasm will be
Community Awareness greatly missed.
Information Security Practitioner Sandra Toner, Senior Technical He is survived by his wife and
Mack Bhatia, Senior Practice Specialist, ICF International (U.S.A.) daughter.
Director, Enterprise Integration PROJECT: Online Cybersecurity
(U.S.A.) Awareness Tools
PROJECT: Enterprise Integration

CPEs
SOC 2 and SOC 3 Compliance For more information on the Americas ISLA
program, please visit www.isc2.org/aisla.

Top 10 Wearable Technologies and Please note that (ISC)2 submits

Capabilities for 2017 and 2018 CPEs for (ISC)2s InfoSecurity
Professional magazine on your
1. Biometric authentication 6. Embedded security behalf within five business
Photograph: Thinkstock

2. Mobile health monitoring 7. Conformal electronics days. This will automatically

3. Energy boosting using harvesting 8. Wearable processors assign you two Group A CPEs.
4. Virtual personal assistants 9. Virtual and augmented reality https://live.blueskybroadcast.
com/bsb/client/CL_DEFAULT.
(VPAs) 10. Accurate motion recognition asp?Client=411114&PCAT=7777&-
CAT=10476
5. Smart coaching Source: Gartner, August 2016 Report

RE TURN TO
InfoSecurity Professional 8 November/December 2016 CONTENTS
 100% Online Master of Science in Cyber Security

The front lines of digital defense are looking thin.

Become an in-demand expert.
CNBC estimates a need for 30,000 top-level security experts worldwide.
Those experts are consistently earning more than six figures annually,
according to payscale.com. The numbers dont lie there has never been a
better time to specialize your skills. Elevate your technical abilities in booming
areas like cloud security, wireless network security, and mobile device
hacking. Housed within the John E. Simon School of Business, Maryville
Universitys Online Master of Science in Cyber Security program helps you
develop the business literacy to influence, and even enter, the C-suite.

Earn your advanced degree. START TODAY

Graduate in Complete your Use our Maryville Learn from

as few as coursework Virtual Lab as a faculty
18 months. 100% online, a professional dedicated to
on any device. training ground. the profession.

ONLINESECURITY.MARYVILLE.EDU/STARTTODAY
 FIELD NOTES

CHAPTER SPOTLIGHT: (ISC)2 CHILE CHAPTER

CYBERSECURITY: CRUCIAL IN EVERY LANGUAGE

S ANTIAGO, CHILE HOSTED the first Spanish-

language secure event, (ISC)2 SecureChile,
organized by (ISC)2 Chile Chapter in partner-
ship with the (ISC)2 Latin America Office. Information
Security: A Task of All was attended by 100 information
security professionals, from management to C-level.
The keynote speaker, James Harris, a former senior
management official from the U.S. Federal Bureau of
Investigations Cyber Division, briefed the audience on
a project studying why users make bad choices when it
comes to cybersecurity and how training and education can
improve their decision-making.
Other presenters included representatives from major
businesses, including Telefnica, Neosecure, Deloitte Chile, (ISC)2 Chile Chapter at SecureChile meeting. From left to right:
Assertiva and Grupo SURA as well as (ISC)2 Chile Chapter Gabriel Bergel (vice president), Eric Donders (secretary) and
officers, who emphasized the importance of (ISC)2 certi- Wilson Espaa (president).
fications and the initiatives in Latin America to increase
awareness of (ISC)2. The day wrapped up with a panel encourage the professional community to join the activities
featuring three female CISOs representing their companies, of our chapter, and also demonstrate the high quality of the
CODELCO, NEXUS and SINACOFI, who discussed secu- professionals that are part of the (ISC)2 membership. There
rity management challenges in BYOD, big data and IoT. is no doubt that (ISC)2 SecureChile met the needs of non
It was an honor and privilege to have been part of this commercial events at the international level, said Wilson
first Secure event in Chile. The experience was enriching, Espaa, president of (ISC)2 Chile Chapter.
both for the content of the presentations and for the great
opportunity of networking with other professionals. This is
an initiative that must be repeated every year, said Javier
Toro Rodrguez, head of regulation and security compliance (ISC)2 CHILE CHAPTER CONTACT INFORMATION
and risk and security management for RedBanc. Chapter President: Wilson Espaa
Carrying out the first Secure event in the Spanish Email: [email protected]
language in Latin America was a major achievement for the Website: http://www.isc2chile.cl/
(ISC)2 Chile Chapter. Definitely, the success achieved will

27 percent 210 percent

of corporate data traffic will increase in the adoption
bypass perimeter security by 2021, of bug bounty programs
up from 10 percent today. since 2013.
Source: Gartner, August 2016 Report Source: Bugcrowds 2016 State of Bug Bounty Report
released in September

RE TURN TO
InfoSecurity Professional 10 November/December 2016 CONTENTS
 FIELD NOTES

9
PITTSBURGH HIGH SCHOOL
STUDENTS TACKLE THE
DARK SIDE OF CYBER
Highest
Paying
IT Jobs
(2016)
Pittsburgh-area high school students participate
in a kinetic exercise assisting a U.S. Navy Seal
team in a hostage rescue operation.

R EAL-WORLD SITUATIONS provided the material for high school

students to test their cybersecurity know-how in a series of exer-
cises, including a hostage rescue operation presented by experts
at Carnegie Mellon Universitys Software Engineering Institute. Seventy-five
Pittsburgh students, from freshmen to seniors, got a firsthand look at the
dangers lurking in cyberspace, including identity theft, social engineering
Functional
Area

Cloud computing
Average Annual
Salary (USD)

$115,826
attacks, malware, and its cousin, ransomware. They learned how to protect
IT architecture $113,499
computer systems using the latest Windows and Linux security tools and
techniques and state-of-the-art network simulators. IT security $104,949
(ISC) board member Dave Kennedy from the security firm TrustedSec spoke
to the teens about his early days of hacking. Business
For the hostage rescue exercise, students, assisting a Navy SEAL team, hacked technology $101,663
into the power grid and disabled the building lights where hostages were, and Java developers $99,763
at the same time defended their drone infrastructure from attacks, all the while
providing cyber support for the SEALs. Project/program
The competition event, co-hosted for the second year by SEIs CERT Division, management $98,607
featured US$1,500 in prizes provided by TrustedSec.
Data warehousing/
This competition reflects the commitment of the SEI, (ISC)2 and TrustedSec
business
to providing opportunities for STEM education and experiences to young people,
intelligence $93,522
said Chris May, technical director of the workforce development team in the SEIs
CERT Division. Events like these help address a gap in teen education and inspire Business
the next generation of cybersecurity professionals. application
Jonathan Frederick, cybersecurity exercise developer for the SEIs CERT development $92,037
Division and vice president of the Pittsburgh Chapter of (ISC), added, Since
its inception, our chapters primary focus has been to provide outreach to the Voice engineering $91,489
Pittsburgh region. IT security professionals from businesses throughout the area
Source: 2016 IT Skills and Salary Survey
collectively realize the importance of educating our successors. Global Knowledge, http://images.globalk-
For more information on this event visit http://isc2chapterpittsburgh.com/, nowledge.com/wwwimages/pdfs/2016_
https://www.trustedsec.com/, http://www.cert.org/. SalaryReport.pdf

RE TURN TO
InfoSecurity Professional 11 November/December 2016 CONTENTS
 FIELD NOTES

RECOMMENDED READING The authors highlight the means of performing foren-

sics in the cloud and reviewing the location of the data in
Cloud Computing: Assessing the Risks regard to international requirements such as EU Privacy
By Jared Carstensen, Bernard Golden Directive 2002/58/EC. They make a point of indicating that
and JP Morgenthal the information security professional has to collaborate
with the business or process owner to help these stakehold-
Suggested by Larry Marks, CISSP
ers better understand their risks related to cloud, and better
AS THE CLOUD becomes a partner in more grasp the concepts.
and more enterprises, the need for in-depth Real-life scenarios are presented, such as: When I am
information on the benefits and risks grows done, how do I de-provision and transition assets out of the
as well. This book, though a few years old, is a good invest- cloud vendor to another location of another context? Also
ment, especially for those professionals working to bring included is an overview of cloud deployment models and
cloud computing to their companies. The authors provide other cloud concepts so the reader has the proper founda-
step-by-step guidance to the various components, gover- tion. I found this book to be a practical guide that can apply
nance and liabilities that may impact performance. The to a variety of cloud possibilities that any employer will
authors identify the top security risks related to the cloud, consider. It is a good supplement to any understanding of
the impact of DevOps, and the risks of auditing application the risks that professionals should concern themselves with
security. when reviewing security for the cloud.

MEMBERS
Download Your
Certificate DIGITALLY

Based on member feedback, you can

now download a digital PDF certificate!

Your digital certificate is available under

My Profile.

Download my certificate

RE TURN TO
InfoSecurity Professional 12 November/December 2016 CONTENTS
 www.isc2cares.org

Its easy to see that teachers, librarians, and media specialists need more quality
information and resources to address cyber safety in the classroom and at school!

We believe everyone has the right to access the internet without fear of compromising
their safety or identity. However, in the Centers 2016 study of children grades 4-8 we
found a few alarming results:

62%
Went to adult

40%
websites after Have connected with
a search or chatted online with
strangers

21% Watch adult

11%
programming online Met a stranger
in person after
meeting online

49%
Are online at 11pm
or later on school
nights

You can choose to support any of the following:

Child 1 Individual Packet
Classroom 1 Educators Kit
Grade 3 Educators Kit
School 15 Educators Kit
Girl Scout Troop Patches for
a Troop of 10 Scouts
(*Quantities are not limited) Paws. All rights reserved

Please click here to

make a donation.
Donate Today!
safeandsecureonline.org
MEMBERS CORNER Rodrigo Calvo, CISSP,
is a senior security
A SOUNDING BOARD engineer at infoLock
Technologies. He can
FOR THOSE WITH be reached at rcalvo@
SOMETHING TO SAY infolocktech.com.

Why Your Legacy Network IDS/IPS

Needs to Be Replaced NOW
BY RODRIGO CALVO
FIGURE 1: Comparative between
Legacy NIPS and Modern ATP approaches
GHOSTNET, STUXNET AND DUQU prioritize and provide intelligence
are just a few examples of advanced from email, endpoint and network
Modern advanced
persistent threats (APT) that demon- events. Even better if the solution can Legacy NIPS threat protection
strate the complexity used by hackers integrate actions for a quick incident approaches
to exfiltrate information from inter- response.
nal networks. Weve all heard about A use case of such multilevel
these attacks, but are we prepared to integration on a single solution could Classic malware
prevent them? include: detection
Lets assume that our perimeter is Correlated information from
full of firewalls and network intru- multiple sources. But in contrast to
Behavioral monitoring Advanced
sion prevention systems (NIPS) based a SIEM solution, the technologies or heuristics persistent threats-
on stand-alone legacy and not OSI being used could block malicious based detection
Layer 7 technologies. Is that enough? traffic, suspicious files, or send a
I asked a lot of colleagues about command to the endpoint protection Protocol anomalies Advanced evasion
the best defense for APTs and con- solution in order to isolate it and let detection techniques
firmed with the Gartner MQ for IPS the security team analyze the evi- detection
from 2015 this common perception: dence for further actions.
NIPS, with the technologies that we Use of reputation services from Cloud-based
Signature database sandboxing and/or
recognized five to 10 years ago, can- the cloud to compare against network payload detonation
not provide comprehensive protec- events. ser vices
tion. Its necessary to have additional Alerts of events from the host
support that can handle analysis of IDS/IPS in order to bypass SSL traffic
advanced threats and interact with (or any potential attacks across that
other security tools. That kind of channel).
protection has many names: UTMs, Network events in which host
NGFWs, NGIPSs and ATPs. IDS/IPS information will feed back to Source of the attack
Yet legacy tools exist because the solutions infrastructure to deter- The logic of malicious code
many of us work for organizations mine if there is some sort of advanced attacking the company (files, registry
that lack the resources to fully attack going on. creation, network connections, etc.)
replace them. In those instances, Actionable recommendations
we must find better solutions that The time has long passed when
complement our current corporate the IT department just waited for the No doubt APT protection solutions
security model. Figure 1 graphically antivirus provider to get a virus defi- add crucial benefits for customers.
demonstrates the idea of protecting nition (or vaccine like many people So, as budget seasons are underway,
the environment and minimizing the called it a few years ago) for a virus. it may be time to evaluate the market
risk with a solution that can collect Now its necessary to have more and find the best option for our com-
security data at multiple levels, information to understand at least: panies.

RE TURN TO
InfoSecurity Professional 14 November/December 2016 CONTENTS
 TECHNOLOGY

WHAT LIES
BENEATH BY JAMES HAYES

Its time to cast a stronger

light on the shadowy side of IT.
The cloud has a dark lining.
Shadow IT, or stealth ITthose enterprise computing solutions cre-
ated and deployed by end users without approval of IT managementhas
made its way into the cloud, uncontrolled and unchecked. The 2015 Global
CIO Survey, conducted by New York-based Logicalis, has suggested that
shadow IT is now a fact of life for the majority of CIOs, with 90 percent of
IT chiefs polled admitting that they are now bypassed by line-of-business
colleagues at least occasionally.
So whats a cybersecurity professional to do about it?

PHOTO ILLUSTRATION BY JOHN KUCZALA

RE TURN TO
InfoSecurity Professional 15 November/December 2016 CONTENTS
We are seeing that shadow IT concerns are now growing, due
in part to the realization that the enterprise IT function cannot
evade having to take on some ownership of the problem.
NIGEL HAWTHORN, EMEA marketing director, Skyhigh Networks

TWO SIDES TO A SHADOW of shadow IT applications in use, says Gartner principal

As its proponents seek to re-label shadow IT less threat- research analyst Brian Lowans. Many cloud services
eningly as flexible IT or devolved IT, caught-in-the- have good security, Lowans adds, but left unchecked, the
middle CIOs are being advised to stop trying to quash the adoption of SaaS (software as a service) or BPaaS (business
trend, and instead enfold it into their management plans. process as a service) applications by business units and
More fatalistic IT chiefs have thought hard about bringing their employees inevitably heightens the risks of erroneous
shadow IT into the sphere of progressive enterprise IT or malicious posting of sensitive dataand of resource
strategies, but may retain an anti-shadow stance toward wastage.
C-suite executives susceptible to sharing shadows perceived
business benefits.
Corporate information security specialists and their SAVING MONEYOR RISKY BUSINESS?
security teams are less likely to be beguiled by claims from It is tempting to see shadow IT as a way of cutting costs,
pro-shadow lobbyists; rather, as an expectation arises says Owen Wright, assurance director at London-based
thateven though they have no innate influence over, Context Information Security. But in my experience, a
or knowledge of, shadow IT adoptionthey should bear short-term saving can be undone several times over if there
responsibility for defusing security-related incidents where is a security breach, or if a shadow system [that becomes
shadow is the known source. As shadow IT proliferates, so business-critical] later needs significant refactoring to be
too will the system security-related issues that it is likely to integrated with the rest of a companys IT systems.
cause. Addressing the shadow IT issues on a variety of fronts
We are seeing that shadow IT concerns are now grow- will also entail additional costs across the business, pre-
ing, due in part to the realization that the enterprise IT dicts Andy Buchanan, area VP at RES Software, based in
function cannot evade having to take on some ownership Radnor, Pa. Infosecurity professionals understand that
of the problem, says Nigel Hawthorn, EMEA marketing IT environments are more vulnerable to attacks than ever,
director at Skyhigh Networks, based in Campbell, Calif. and are therefore focusing heavily on internal and external
This is because other enterprise departmentssuch as risk auditswhich are extremely time-consuming and costly,
and compliance, as well as external auditorsare increas- he says.
ingly demanding information on shadow IT usage. With new government regulationsnotably, the
forthcoming EU General Data Protection Regulationthe
cost and burden of compliance is going to rise, especially
THE LENGTHENING SHADOW if shadow IT increase continues. Ultimately, organizations
Shadow IT usage has continued to grow over the last 12 that fail to rein in IT shadows will face stringent fines and
months. punishment.
A May 2016 study of 355 IT professionals by Such turns of events may not, however, necessarily
CloudstandingMicrosofts tool that matches up potential bring forth concessionary quid pro quos from unrepentant
partners for cloud operationsreported that 70 percent of business unit managers who are signing off on shadow IT
employees are using cloud-based technologies that are not activity, points out Jonathan Sander, VP of product strategy
officially provided or managed by their company. The at Los Angeles Lieberman Software.
media sector, with 83 percent of employees using unautho- Although many CIOs are now keenly aware of security
rized services, led the ranking, with manufacturing at the issues around shadow IT, he says, it does not mean that they
bottom of the list, still with 49 percent of their workforce can find it when it exists.
using uncontrolled cloud technology. CIOs are now actively engaging the businessthe
Most organizations grossly underestimate the number source of shadow ITto find things out. They are discover-

RE TURN TO
InfoSecurity Professional 16 November/December 2016 CONTENTS
 Shadow IT Security
Management To-Do List
ing that they can only get answers when they ask the right
questions, [so] they are now asking their business leaders
[directly] about IT that is happening outside of normal
channels.
These communication shortfalls do not, of course, nec-
essarily mean that certain shadow services buyers are also
procuring their own security solutions: 52 percent of 1,200
business surveyed in an April 2016 report on cloud security
by Santa Clara, Calif.-based Intel Security still expect IT
to secure their unauthorized department-sourced cloud
services.

CONFLICT OF INTERESTS?
A further complication is the possibility that a cloud Ascertain the degree of understanding of
service provider is working at the same time both over shadow IT risk at C-suite level, and ensure
the counter with a clients IT department and under the that senior executives have access to guid-
radar with separate business unit contacts. ance that informs both sides of the pro/anti
The scope for confusion is obvious, says Skyhigh arguments.
Networks Hawthorn. Some cloud providers business
models include promoting a free service to users, after Ensure that any recommendations or proofs
provided in favor of shadow IT are balanced
which they approach the users IT departments to show
against reliable and quantifiable informa-
them how many users they have, in an effort to justify it
tion about verified security risks, and are
becoming a paid service.
set forth in the broad context of possible
Having two or more routes to market can muddle outcomes in the event of a problem.
matters, potentially leaving the company to pay for more
licenses than it requires, Hawthorn warns. Review enterprise IT procurement policies
Some of the more dangerous shadow IT scenarios to identify any causes of delay that could
we have seen have involved business leads creating their be eliminated, providing end users with
own internal application development teams, and launch- a valid excuse for localized IT purchase
ing apps in cloud-hosting environments with little or no decision-making.
involvement by the IT department, says Ben Desjardins, Ensure that standard IT procurement pro-
a Washington, D.C.-based security solutions director at cedures are communicated throughout the
Radware. Some will even argue that SaaS providers may enterprise, eliminating any possibility that
be better at securing data than their organizations own IT shadow IT consumers can claim that they
team. had not been made aware of official proce-
Desjardins point underscores the fact that enterprise dure toward new product acquisition.
shadow IT is not confined to business workgroups; indeed, Develop enterprise IT procurement policies
according to a 2013 report from Frost & Sullivans strate- and guidelines that contain provision for
gic forecasting practice, Stratecast, IT staffs use a higher end-user requests for non-standard tech-
number of non-approved SaaS applications than their col- nology to be speedily brought under full
leagues. It appears that, in acting as the guardian of corpo- consideration by the information security
rate technology, the IT department considers itself exempt, function.
writes report author Lynda Stadtmueller at Stratecast.
Communicate information about potential
security risks of unauthorized IT procure-
KNOW THE RISKS ment, supported by examples and by com-
mentary from directorate heads in the legal,
It is important when seeking insight into degrees of shadow
financial and governance departments.
IT risk to distinguish between the liabilities of shadow IT
per se, and those liabilities arising as a direct consequence James Hayes
of shadow IT deployments, says Contexts Wright. The real
challenges that shadow IT raises, such as lack of control

RE TURN TO
InfoSecurity Professional 17 November/December 2016 CONTENTS
over system configurations and failures in asset manage- example, an organization might have fully aligned to the
ment, are common information security manager worries. Microsoft stack, including .NET web applications, based on
Michael Hack, SVP EMEA operations at Ipswitch, Internet Information Services and SQL server hosted in the
based in Lexington, Mass., has no doubt that shadow IT is Azure cloud infrastructure, Wright explains. If a [busi-
a significant and persistent risk for information security ness] team were to deploy an application based on PHP,
management, but is one that is often underplayed because MYSQL and Linux into an Amazon AWS environment, they
it is seen as a creeping problem [that] does not impact on would then need to manage an entirely different stack of
the business in the same dramatic, headline-grabbing way technologyand all of the complexity involved.
that a debilitating virus or major data breach does.
Theres an element of reverse polarity at play here,
Hack suspects, because market studies have indicated that
internal threats arising from human error or misjudgment If a [business] team were
(and many would regard shadow IT activity as such) remain
at the top of the list of cybersecurity headaches for orga-
to deploy an application
nizations of all types and sizesand indeed pose a more
acute threat than external menaces such as viruses and
based on PHP, MYSQL and
intrusive attacks. Linux into an Amazon AWS
Shadow IT apps are [usually] installed with the best
of intentions, and a desire to improve business efficiency, environment, they would
Hack says. This means they are not ranked as highly on
the information security risk scale as Trojans, for instance,
then need to manage an
or other kinds of malware. But their risks are potentially
as devastating, particularly when it comes to a companys
entirely different stack of
ability to comply with constantly changing data privacy and technologyand all of the
protection laws or to thoroughly encrypt its data.
complexity involved.
MICHAEL HACK, SVP EMEA operations, Ipswitch
THE DANGERS LURKING IN THE SHADOW
The adverse impacts of a security incident arising from a
shadow IT deployment can be generally assigned to three Should the respective business team move on, respon-
groups. The possibility that shadow IT could provide an sibility for this can fall back to the core IT department,
entre to external cybersecurity threats is, of course, a crit- resulting in systems where no one within the organization
ical concern, but ways in which proliferating, unsanctioned has the technical capability to manage them, Wright says,
technology might introduce additional security-related and where existing data security standards, processes and
problems also need to be factored into any risk assessment. policies cannot be applied, (because) they are tailored for
a different platform: Thus, an upfront saving in time and
1. Endangering the System money to deploy quickly can lead to significant ongoing
Best IT management practice is about ensuring that opti- expenses further down the line.
mal performance value is derived from IT assets in order
to maximize returns on investments (ROI). Any factors 2. Challenging Security Regulations
that put technological well-being at risk and hamper IT Shadow IT can negatively impact regulatory compliance
management should necessarily be regarded as threats to and legislative requirements that all businesses are now
infrastructural stability and performance, some systems subject to. In Europe, the impending European Commission
experts believe. General Data Protection Regulation (GDPR) intends to
Use of non-approved software can have a number strengthen and unify data protection for people within the
of adverse effects on the network [it runs over], says European Union. It also addresses export of personal data
Ipswitchs Hack. [Such software] can consume a large outside the EU, so it will affect companies and other orga-
amount of bandwidth, for example, which in turn slows nizations around the world.
down the network, and can cause compliance and data
sharing issues. 3. Creating Breach Opportunities
Shadow IT at its most unrestrained can result in The possibilities of breaches of IT systems, resulting in
unmanageable systems, warns Contexts Wright: For infiltration of an enterprise computing resource, data theft,

RE TURN TO
InfoSecurity Professional 18 November/December 2016 CONTENTS
denial or impairment of service, and the installation of that might have no direct touch on the main enterprise IT
malware (such as ransomware) are well known. A high systems.
proportion of cloud apps have been found to be not enter- Cloud services make it harder to discover unofficial
prise-ready, lacking the baseline security, audit and certi- systems associated with a company as they often do not
fication capabilities required for workplace use. Unsecured reside within the companys own network space, says
applications could be used for months without the employ- Wright, making it harder to discover using common
ees who set them up being aware that their cost-effective inventory management or network scanning processes
self-sourced application has been compromised from day and tools.
oneeven the details of the credit card they used to make RES Softwares Buchanan agrees. Based on conversa-
the purchase online have likely been filched. tions we have with customers, it is becoming increasingly
A data breach resulting from a shadow IT instance will difficult for security professionals to discover and keep
result in financial liabilities affecting the organizations track of the shadow IT usage in an organization. This is
bottom line, warns Gartners Brian Lowans: Liabilities can largely due to the [the closer coupling of] cloud and mobile,
be very large due to a mix of costs that include notification as individuals, and indeed department leads, can now easily
penalties, auditing processes, loss of customer revenue, go to a cloud service and leverage their tools and services.
brand damage, security remediation and investment, and Adds Ipswitchs Michael Hack: Monitoring shadow IT
cyber-insurance. deployment and use on corporate networks is [now] one
of the main reasons that infosecurity professionals need a
fully integrated and multifunctional network management
WHO IS RESPONSIBLE FOR tool.
THE SHADOWS RISKS? Network monitoring tools that can help safeguard the
The question remains: Who takes the flak when shadow networks performance, monitor the availability of appli-
is at fault? If a business team has ignored company cations and prevent misuse, continue to evolveand even
processes in order to deploy systems in contravention of advance into the realms of bots, artificial intelligence and
company policy, then its likely they will bear the brunt of machine learning. But right now, network-monitoring solu-
any immediate fallout, suggests Contexts Wright, but tions that make use of advanced visualization technology
any resulting data breach is a problem for staff across an are already coming onto the market. The best of these solu-
organization. Information security will likely end up tions can intuitively map the user experience directly to the
having to find time to deal with the outcome in either case, environment that the IT team originally created, allowing
distracting them from scheduled work that might be of team members to easily understand irregularitiessuch as
greater importance. shadow IT deployments.
The risks of shadow IT are quantifiable: the risk of Corralling shadow IT into a more managed context
breach, of noncompliance, of IT failure, of lack of control, calls for revised terms of engagement between the business
says Nathan Dornbrook, CTO at Glasgow, U.K.-based ECS. and the IT team, suggests David Emm, principal security
The risks of not using shadow IT are also quantifiable researcher at Kaspersky Lab based in Woburn, Mass. One
cost and time[the difference being that] these risks can of these could include new reciprocal ground rules designed
be managed. Ultimately, business risk is owned by the to get the message across that security policies have a
business, not by IT, so violators of these policies need to be critical purpose, and exist to protect all staff from threats
handled by the business. of which they probably have limited comprehension.
In todays business world we have always-on staff
conducting business with an assortment of devices and
ITS OUT THERE SOMEWHERE solutions, Emm says, so businesses must be able to apply a
How big of a problem is shadow IT? How widespread is security wrapper around each employeewhatever device
its use? How can it best be managed? These questions they use and wherever they work. To do this, the informa-
and more pose a challenge to information security profes- tion security team must be able to see what is being done,
sionals seeking to introduce better security management manage staff and devices throughout the organization, and
over shadow IT. Up until now, IT managers could detect protect corporate datawherever its held.
evidence of use of unauthorized cloud apps and service
through usage pattern alerts, email monitoring and traffic
logs. But it is getting harder for IT to detect the use of rogue JAMES HAYES is a freelance writer based in the United Kingdom.
SaaS, as shadow-minded users have become more covert His first feature on car hacking appeared in the January/February
especially given the increase in mobile enterprise platforms 2016 issue.

RE TURN TO
InfoSecurity Professional 19 November/December 2016 CONTENTS
 Have confidence
in your cloud security knowledge.
Become a CCSP and lead your organization to the cloud.

Be a leader in the field.

CCSPs report that in addition to employer confidence, they have gained
respect, credibility, and trust across all levels within their organization.
CCSP certification on your resume will demonstrate your cloud security
expertise and show employers that you can fill a void in the rapidly
growing aspect of information technology that is cloud security.

TION MA
I CA GA
IF
RT

ZI

2016
NE
CE

TOP CERT
CCSP tops The Next Big Thing list as
CCSP the #1 certification survey respondents
plan to earn in 2016

H
G
T

E
NE H IN
XT BIG T

Download the CCSP

Exam Outline

brought
Copyright 2016 (ISC) Inc. All Rights Reserved.
 PROFESSIONAL DEVELOPMENT

WHO
ITS NOT JUST

YOU
KNOW

OR MAYBE IT IS. EXPAND YOUR PROFESSIONAL

POTENTIAL BY BUILDING A PERSONAL LEARNING NETWORK.
BY KERRY ANDERSON

CYBERSECURITY is a discipline that

requires continuous professional
development to stay ahead of the new
risks in the threat landscape, as well
as an expanded expertise. Many of
the technologies that cybersecurity
practitioners must manage securely
continually evolve, much as futurists
like Ray Kurzweil, who in his 2001
essay The Law of Accelerating Returns
predicted when he wrote that the 21st
century will experience a rate of tech-
nological change that is a thousand
times greater than in the prior one.
Cybersecurity teams will need
to respond to new challenges while
managing existing risks, such as
social engineering. It may no longer
be sufficient to obtain expertise after
the fact; practitioners need to be able
to anticipate the security repercus-
sions of technological and societal
trends, and acquire the necessary
proficiencies to manage them for
their organizations. Otherwise,
practitioners will find themselves

RE TURN TO
ILLUSTRATION BY ROBERT PIZZO InfoSecurity Professional 21 November/December 2016 CONTENTS
constantly attempting to control the proliferation of poten- in your field. For some, this might mean expanding beyond
tial insecure technology implementations, such as cloud their normal comfort zone and putting more of themselves
storage or BYOD, without appropriate controls or policies out thereby commenting on blog posts or articles, and
in place. attending more networking events. It all begins with estab-
Most of us already have a means of finding expert advice, lishing your professional presence, both in the physical and
whether through publications, social media or conferences. virtual worlds.
But how many of us have actually established bona fide
plans to build and nurture a professional network that incor- Participate in local professional organizations. Attend
porates the most popular ways of connecting with peers? local chapter meetings or events of professional associations
several times annually at least. Monthly meetings are often
free or low cost. Events frequently offer member discounts.
WHOS IN YOUR PERSONAL NETWORK? Get there early to network with peers, and stay for optional
Many cybersecurity practitioners face challenges to their post-event activities when possible.
professional development, most commonly the cost of Make it a point to carry an ample supply of business
materials and outside training and the time away from the cardsone from your current employer, and one with a
office or home. A Professional Learning Network (PLN), more personal touch that includes your personal mobile
also referred to as Personal Learning Network, can provide phone number and email address, as well as any relevant
development opportunities close to home and at minimal social media profile links. Building a PLN is a lifetime
(if any) cost. investment in your career, so consider what you want to
Practitioners design their PLN to achieve a goal: become do well beyond your current position and use the personal
better at what they do, or what they want to do. Social business cards if your employer has strict rules for email
media tools, such as Facebook, Twitter and LinkedIn, let and internet use done on company time. The bonus to these
(ISC)2 members connect with other professionals who inexpensive personal business cards: the contact informa-
share a common interest or passion in cybersecurity, and tion typically stays current even if you change jobs.
exchange ideas and possible collaborations. Additionally,
we have former classmates, current and past coworkers, Develop your social media profile. First, make sure
and members of professional organizations that we can con- your chosen social media profile is easy to find via an
tact on a somewhat regular basis. And thats importantto internet search using just your name. Dont skimp on the
nurture a network, you need to keep in touch, though descriptions sections. Your social media profile can be the
frequency rates may vary. equivalent of the elevator speech, essentially a 30-second
This brings up an important pointand distinction for promotion about you. People form an instant impression
those formally creating a PLN versus just becoming more based on what, and how much, information you provide. It
social. We learn from exchanging new ideas, knowledge is a good idea to invest in a professional photo and a fully
and different attitudes that stimulate learning and profes- developed profile by listing relevant experience, certifi-
sional growth. It is not a one-way relationship. An enduring cations, education and other accomplishments, such as
PLN requires communication and assistance flow in both publications where youve contributed. LinkedIn features a
directions. If a practitioner fails to return support to others profile strength-rating system that can be used as a model
within their PLN, members of the PLN may become reluc- when assessing your profiles on other social media sites.
tant to engage in the relationship in the future.
Blog. If you are a proficient writer, consider creating a
blog. Blog posts can be short pieces on a timely topic that
LOADING THE PLN interests you, and are an excellent way to both develop and
Designing a PLN requires a customized approach. It is display your expertise. Great blog posts can grab others
essential to diversify the composition of a PLN. The prac- attentions and be shared via Twitter, Facebook, LinkedIn,
titioners might seek out potential contacts across many and other popular social network platforms.
specializations, including relationships with individuals in
cybersecurity-related disciplines and other fields, such as Contribute articles to publications. If writing is your
education and human resources. Sometimes the best way to passion, consider submitting an article to a professional
learn from others is to engage others whose industries are associations magazine, newsletter or peer journal. In
not in competition. addition to publishing your piece, these publications also
There are a variety of tactics to build a core PLN under typically allow you to include your blog or personal website.
the overarching strategy of better connecting with experts Every publication has its own writer guidelines, so be sure

RE TURN TO
InfoSecurity Professional 22 November/December 2016 CONTENTS
 LEARN MORE
Personal Learning Networks are not new, but they
are an emerging concept among technologists after
years of development by formal educators. Here
are some online resources to get you started on
to review those before you submit a work. building a robust roster of e-learning opportunities:

Speak at events. Many cybersecurity conferences and (ISC)2 Secure Webcasts

events put out a call for papers (presentations), including These sessions are free to members and may
those hosted by (ISC)2. Again, there typically are guide- include CPEs for attending. Visit www.isc2.org
lines to follow, so be sure to apply properly to speak on a and click the Events tab.
topic based on that conferences criteria for presenters. Not Stephen Downes
ready for the national stage? No problem. Many chapters The Canadian researcher has posted a number of
of cybersecurity associations look for speakers for monthly presentations on SlideShare outlining the benefits
meetings and annual events. Speaking at events gives oth- and online resources for developing a PLN. One
ers an opportunity to get to know you and add to your PLN. particularly relevant slide deck is at http://www.
In addition to speaking, some events task speakers to write slideshare.net/Downes/we-learn-66731688.
a blog on their sessions topic, and this offers an additional
mechanism for building a PLN. How to Create a Robust and Meaningful
Personal Learning Network
This 2013 blog post by Debbie Morrison spells out
Join online discussion forums. Virtual discussion groups
a lot of opportunitiessome mentioned in this
exist all over the internet. Its not tough to find them, but it
articleincluding MOOCs.
may take some work to find one that you want to join and
to which you will contribute. Be sure to read threads to How Important is Twitter to
make sure theres valid information being exchanged, and Your Personal Learning Network?
that trolling or other disparaging comments are discour- eLearn magazine dives into the value of this social
aged. There are literally hundreds of these groups related media platform. The 2012 article is dated but still a
to information assurance and compliance areas. Some are good primer for those who havent added their own
open forums, while others require a request for member- 140-character thoughts to the Twitterverse.
ship to join.

media sites, primarily LinkedIn. As an adjunct professor, I

BUILDING A COMMUNITY along with my co-instructor encourage our students to par-
The creation of a PLN does not replace the traditional ticipate in communities of practice by creating a class blog.
development options of formal classroom training or
conferences, but rather offers opportunities to expand
knowledge and perspectives in a one-on-one manner. It is PUT YOURSELF OUT THERE
the foundational step for initiation into communities of A significant component of adult learning is social. We
practice. A community of practice is a collection of individ- learn from our interactions with others. By designing a
uals who share a specific profession or area of interest. Jean PLN, we can proactively engage others with knowledge we
Lave, a cognitive anthropologist, and educational theorist need to advance in our careers, and in our lives. In turn, we
Etienne Wenger introduced this concept in their 1991 book can do the same for someone else by becoming part of his
Situated Learning: Legitimate Personal Participation. Wenger or her PLN.
expounded on the topic in his 1998 book Communities of Sound simple? It is, at least in theory. Throughout our
Practice: Learning, Meaning, and Identity. Communities of careers, many of us unconsciously build professional learn-
practice are pivotal in a profession like cybersecurity, where ing networks and, as a result, become a member of one or
it is impossible to develop expertise in all areas. more communities of practice. With PLNsand those ded-
A cybersecurity professional who does not participate in icated to sustaining them as they evolveso too does the
either informal or formal communities of practice, such as cybersecurity industry through stronger professional rela-
local chapters of professional associations, is at a distinct tionships and greater information sharing. So, as you plan
disadvantage in such a broad field with many sub-special- for 2017, consider raising your personal profileonline and
izations. in real lifeto help make our cyber world a little safer.
Cybersecurity professionals build their own communities
of practice using many of the same tools to build a PLN
developing a strong social media presence, writing and blog- Massachusetts-based (ISC)2 member KERRY ANDERSON has earned
ging, and participating in conferences. In addition to these, the following education and career credentials: CISSP, ISSAP, ISSMP,
there are a number of virtual discussion groups on social CISM, CISA, CGEIT, CSSLP, CRISC, CFE, CCSK, MBA, MSIA.

RE TURN TO
InfoSecurity Professional 23 November/December 2016 CONTENTS
 PROFESSIONAL DEVELOPMENT

Playing by the

BOOK
HOW AN (ISC)2 MEMBER CREATES CHILDRENS
BOOKS ALSO MEANT FOR THEIR ELDERS. BY CHRIS GRECO
CYBERSECURITY CAN SEEM relatively complex to children. But this convenience comes with risks, from privacy
I know from experience that our youngest members of intrusions to identity theft, cyberbullying and even extor-
Photograph: Thinkstock

society view technology from a convenience standpoint tion. That is the reason childrens books on cybersecurity
being able to connect with others, or collect information are both wanted and warranted in this age of cyber first,
at the touch of a button. This is a generation of texters, not consequences second.
talkers, who rarely use a smartphone to actually make a As an author of a series of childrens books on cybersecu-
call. Instead, they are adept at using more modern methods rity, I can attest that these publications are neither simple
to communicate using social networking tools. nor straightforward to produce, but they also are one of the

RE TURN TO
InfoSecurity Professional 24 November/December 2016 CONTENTS
 most satisfying and reward- first one, on passwords,
ing ventures that I have ever was something that we all
accomplished, besides helping encounter. For most of us, its
my wife raise our two children, a simple task to generate a
of course. password, which is why there
are tons of easy passwords out
there to break.
GETTING READY I wanted to ensure I got
TO LAUNCH the point across that pass-
When I first started writing words are the keys to your
and illustrating cybersecurity padlock of information you
books for children, I wanted want to keep secret. Keep in
to ensure that the character mind, we are dealing with
would be someone who chil- an age in which schoolyard
dren would enjoy listening to, friendships are frequently
as well as learning from. cemented over sharing
Granpappy Turtle fulfills secrets.
both needs. This is one illustration that, with a narrative, helps In some cases, I have
He understands how to explain how a computer user downloads information heard of children giving away
from the web.
speak to the generations that their passwords to their best
followed him, by asking good, friends. Although I can
focused questions. The character is the right blend of understand how you want to trust people, the best friends
inquisitive and knowledgeable to work for these types of in a childs life change, sometimes daily, and that can lead
books. to someone who is not a friend getting the password. From
While the character was important, the content was key. there they can wreak havoc on the childs social networking
I wanted to present a book that parents could read to their site, posting comments or pictures that seem like they are
children, or that children could (eventually) read them- coming from the child. In todays world, the lines between
selves to provoke thought. As a parent, I can tell you that real life and online personas is blurring, so what is said
my children might listen to what I say, but they listen to online can easily spill into the real world and cause need-
another adult with much more attention. The same is true less friction and fractures.
with Granpappy Turtle and the characters that surround My book, therefore, had to address both the password
him. structure and content in easily understood terms, and
As for the content of the books, I am still exploring the underscore why it is essential to keep passwords secret
tone and volume of the written language that grabs chil- all this with colorful pictures.
drens attention. I try to share my books with friends and
their children to get feedback on the content and then use
that feedback to refine the message. WHY CHILDRENS BOOKS
The books that I write are not for early elementary Someone once asked me why I write childrens books rather
school age, but more for 8- to 10-year-old children. I have than books for adults. I had to smile since I actually write
found that 9-year-old children thoroughly enjoy the books childrens books for adults. I know that, as an adult, I used
and do not feel challenged by the language. At a recent to read books to my children at bedtime, as well as review-
book festival, I had a 9-year-old pick up one of my books ing them before I read them.
and read it so well that I was sure that my age range was I often found the books were as educational for me as for
appropriate. them, and I hope my books may also spread education by
In addition to the content of the book, the venue is the parents reviewing the book prior to reading it to their
also important. I tried narrating some of my Granpappy children. I also expanded my offering to e-books, which
Illustration: Chris Greco

Turtle books on shared video websites like YouTube, but helps the parent (or any adult) download the book and then
the results have been mixed. I am still experimenting with use their mobile device to share it. I feel that this is the
all of these aspects of childrens book writing to see which epitome of informing people about cybersecurity: using
ones work and which ones dont, but the journey is well technology to teach it!
worth the work. I have learned a lot by creating Granpappy Turtle books.
The topics for the books were no easy task either. The In exploring the subject for my first book, I learned that

RE TURN TO
InfoSecurity Professional 25 November/December 2016 CONTENTS
Becoming an author also has led me to present cybersecurity
concepts at senior centers, where elder citizens, which I have
named Silver Hats, can also learn from Granpappy Turtle
about how to not fall for online scams and fraud.

some of the password techniques I have used in the past to Turtle books including a two-part series on cybersecurity
reduce my risk did not actually reduce my risk at all, and I (the first part is out now and the second part is coming).
am a computer security professional! Becoming an author also has led me to present cybersecu-
The research that I have done to make these books as rity concepts at senior centers, where elder citizens, which
factual as possible, while surrounding them with turtle I have named Silver Hats, can also learn from Granpappy
characters, mixes the real and the imagined so that chil- Turtle about how to not fall for online scams and fraud.
dren can adopt the character as someone that gives them This, along with the writing and illustrating of other
information to keep them safe. non-cybersecurity related Granpappy Turtle books, helps
I hope that through my make-believe characters and me to give back to the computer security community.
handy delivery formats, both reading and concepts of cyber-
security are a little more enjoyableand prompt the actions
we want children to take to become safer online. CHRIS GRECO, CISSP, is a senior consultant/trainer with Greco
I am continuing the storytelling with more Granpappy Techknowledgee (GRECTECH) (www.grectech.com).

A Marketing Tip When

Youre Self-Published

W RITING AND ILLUSTRATING

childrens books is hard work.
Marketing finished works can be just as hard,
maybe even harder. It takes time and a strategy
to spread the word and gain readers, especially
they felt their password was strong. Most would
be pretty humble and say no, to which I would ask
them to put a password (not the one that they use
for any of their applications) into the password
meter to check the strength.
if you are self-published and do not have a If their password was not strong, I would then
publishing company to help with marketing. show them that adding just three characters would
I recently participated in the Baltimore Book make the password that much stronger. Their
Festival to sell my Granpappy Turtle childrens reaction was one of surprise and delight. In one
books and found one way to attract potential instance, a young lady put in four numbers, all
customers was to have a game or contest. the same. It was the lowest score of the day. She
During the festival many people had games was shocked, saying that she thought placing
of chance (usually a spinner) where every spin four of the same number would be the hardest
rewarded a prize. Since my main book is on pass- to guess.
words, I downloaded a cell phone app that would With that lesson, people expressed a little more
score a persons password. When someone interest in the book. In a sense, they all won the
came to my booth and showed interest, usually prize that day.
by smiling at my book cover, I would ask them if Chris Greco

RE TURN TO
InfoSecurity Professional 26 November/December 2016 CONTENTS
CENTER POINTS Pat Craven is the director
of the Center for Cyber
Safety and Education
FOCUSING ON EDUCATION and can be reached at
AND RESEARCH INITIATIVES [email protected].

Raising Awareness, Scholarships

and Opportunities for Future
Cybersecurity Professionals BY PAT CRAVEN

I KNOW YOU THINK I am

going to talk about Garfield
this month, given our big
launch at Septembers
Security Congress in Orlando. Yes,
weve worked hard over the past year
to make the worlds most recog-
nizable feline our Safe and Secure
scholarships open in January 2017.
Information on all scholarships may
be found at www.isc2cares.org/schol-
arships.

CHAPTER CHALLENGE
WINNERS
This year also saw the introduction
Richmond-Metro Chapter
USD$1,500

Congratulations to these chap-

ters for collectively raising nearly
USD$8,000 toward information
security scholarships.

Online spokescat. But that isnt all of a new three-year partnership FUTURE CHALLENGES?
weve been working hard on this year. with Raytheon. The technology Does your U.S.-based chapter want
In addition to achieving record- organization is now providing two to provide local high school students
shattering participation in this USD$10,000 scholarships along with with scholarships? A new fundrais-
years Global Information Security a paid summer internship for two ing period opens on November 1
Workforce Study, we have revitalized aspiring female cybersecurity profes- and runs until July 31, 2017. Thats
our scholarship programalso to sionals. We are so excited Raytheon nine months of fundraising, and
great success. is providing a model program that we have all the tools you need to
This year, with your support, we we hope inspires other companies help. Chapters will have their own
are providing some USD$150,000 committed to diversity within infor- personalized donation pages, where
in educational scholarships to help mation security. the chapters scholarship can be
prepare the next generation of But the achievements dont stop promoted on social media sites and
cybersecurity professionals. Last year there. This year we challenged three funds can be collected online. (ISC)2
66 students applied for financial aid; (ISC)2 chapters to pilot a new effort will also help you get the word out
this year we received 511 applica- to provide scholarships to high school by emailing (ISC)2 members in your
tions for our womens, graduate and students in their communities. The local community. Its easy, and a great
undergraduate scholarships. Of those results are in! The following chapters way to help impact future cybersecu-
seeking aid, 61 percent of applicants met the (ISC)2 Chapter Scholarship rity professionals.
were female and 56 percent were Challenge by raising at least Join in the fun and make a dif-
born outside the United States. Of USD$1,500 in funds and expanding ference! Email us at scholarships@
the 42 scholarships award, 22 (52 opportunities for high school students isc2.org for more information on how
percent) went to females and 20 in their communities. Here are their you, your chapter, or your company
(48 percent) to males. fundraising totals as of October 1: can play a part in preparing the next
Applications for next years Austin Chapter USD$3,409 generation of information security
women, graduate and undergraduate Tampa Bay Chapter USD$3,000 professionals.

RE TURN TO
InfoSecurity Professional 27 November/December 2016 CONTENTS
 5
MINUTES WITH

TUSHAR GOKHALE
Tushar Gokhale lives in Dallas, Texas, but grew up in
Mumbai, India. The cybersecurity specialist has been
part of (ISC)2 for more than two years and is the newest
member of our Editorial Advisory Board.
EDITED BY ANNE SAITA
That includes doing my small part to
When did you know you wanted a to an information security specialist help nurture others in the informa-
career in information security? was the biggest hurdle. It was more tion security profession. Im proud
After I completed my bachelor difficult than I thought it would be. to have earned a masters degree in
studies in electronics and telecom- Further, elevating my career path by information security, continue to
munication engineering, I started focusing on being a technology secu- advance in my professional career,
working as a network and communi- rity professional to business security and volunteer as a peer reviewer for
cation engineer. I worked on several professional was another challenge. academic and professional secu-
network design and technology rity journals and magazines. Ive
projects, such as implementation of Youre originally from India. What also been an instructor for secu-
routers, firewalls, intrusion detection part of the nation are you from,
rity courses, judged cybersecurity
and prevention systems, etc. At that and how has living in India, and still
contests, and held other roles that
visiting, impacted your career?
juncture, I decided to start learning I believe contribute to making our
more about information technology I am from Mumbai (often termed community and industry better.
security and eventually pursued a the financial capital of India), which
career in information security. is located in western Indias state of What do you believe are some mis-
Maharashtra. There is always huge conceptions about the cybersecurity
After realizing that was your chosen demand for great talent across all workforce in India?
path, how easy or difficult was it to sectors and industries in Mumbai. Not only India, but a majority of
gain entry? I started my professional career in developing nations still consider
I must say, it was a little difficult. Mumbai and later moved to the cybersecurity as only a technology
Specifically in India, I remember United States to pursue a formal challenge. Also, another misconcep-
information security was considered education in the field of information tion is that only those with a tech-
a branch of IT and a potential can- security. My information security nology background and significant
didate for information security was professional contributions to the amount of technical experience can
expected to be best at information financial and insurance sector in advance to a career in cybersecurity.
technology most times. An entry-level Mumbai provided the groundwork for This may not be always true. While
career as an information security my current work in the United States cybersecurity could still be technical
professional was a little difficult, as in and internationally. I believe the at its core, in wider context it is a
most industries and sectors, security more diverse and international your business challenge and overlaps with
concepts and security implementa- experience is, the more rewarded you governance, risk, compliance and
tions were considered child projects are. business in addition to technology.
of IT implementations.
What are you most proud of accom-
What have been your biggest hurdles plishing with the group to date? An expanded version of this interview
in your current career? Every achievement and contribution will appear in the December issue of
I make to the information security Insights, a companion e-newsletter
Transitioning my career from a net-
for the (ISC)2 membership.
work and communication engineer community makes me feel satisfied.

RE TURN TO
InfoSecurity Professional 28 November/December 2016 CONTENTS
Why blow your budget on piecemeal, ad hoc content generation?

Use our full-service

creative agency dedicated to
delivering your unique message
Unleashing strong ideas and creating effective content marketing that
is on brand and on time is our specialty. Twirling Tiger Media, a creative
agency with its roots in journalism, is a team of expert storytellers and
designers who will connect your customers business issues to your
companys solutions through original and honest contentthe type
that will attract, acquire and engage your target audience.

Drive profitable audience action with our services, which will be on brand with your
companys marketing goals.
Articles Infographics Publications
Blogs Inspirational Quotes Social and Digital Media
Case Studies Leadership Guides Sponsored Content
Content Marketing Magazines Success Stories
Custom Content Newsletters Web Content
eBooks Press Releases White Papers and more!

TWIRLING
For how our team of experts can serve you, please contact
Bob Ostrow at [email protected].
TIGER media
creators of content you
can sink your teeth into
Twirling Tiger Media is certified as a womens business enterprise by the Womens Business
Enterprise National Council (WBENC) and federally designated as a Women-Owned Small
Business (WOSB). twirlingtigermedia.com