Connect with us

Infosecurity

Why Tenacity and Problem-Solving Matter More Than a CISSP in Cybersecurity

Published

on

Why Tenacity and Problem-Solving Matter More Than a CISSP in Cybersecurity

At the CLOUDSEC conference in London back in September 2016, Trend Micro’s vice president of security research, Rik Ferguson, delivered a talk that challenged conventional wisdom about the cybersecurity industry. His central thesis? The so-called cyber skills gap is a myth—the real problem is that employers are looking for the wrong things.

Instead of chasing paper certifications like the CISSP, Ferguson argues that tenacity and problem-solving are far more valuable traits. This perspective, shared during his session titled ‘Take Control: Empower the People,’ sparked a lively debate about what truly makes a great security professional.

The Myth of the Cyber Skills Gap

Ferguson didn’t mince words when addressing the industry’s hiring practices. “There’s not a cyber skills gap,” he stated. “The industry is just looking for the wrong things: It’s looking for paperwork and certifications rather than people and skills.” According to him, employers are hiring certificates, not individuals. This misalignment, he says, leads to teams that lack the creative and analytical thinking needed to tackle modern threats.

Building on this idea, he emphasized that tenacity and problem-solving abilities are critical. In a field where attackers constantly evolve, the ability to think on your feet and persist through complex challenges is more valuable than any piece of paper.

Why Certifications Like CISSP Fall Short

The CISSP (Certified Information Systems Security Professional) is one of the most recognized credentials in cybersecurity. However, Ferguson argues that it shouldn’t be the primary filter for hiring. “They should be looking for tenacity, problem-solving, analytical thinking,” he explained. “These skills are far more useful than a CISSP.”

This doesn’t mean certifications are worthless, but they should not overshadow practical abilities. As Ferguson put it, self-certification is “for losers,” and compliance should be seen as a starting point, not a shield. The goal is to build a team that can adapt and respond to threats, not just check boxes.

Key Takeaways from Rik Ferguson’s Talk

Beyond the hiring debate, Ferguson shared several other insights that resonate today:

  • Machine learning is a technique, not a solution: “What is most valuable is the output and what we can learn from it,” he said, warning against buzzword-driven security.
  • Ransomware is exploding: In 2015, 29 new families of crypto-ransomware were discovered. In just the first six months of 2016, that number jumped to 79. He criticized companies that offer to pay ransoms, calling it financing crime.
  • Past breaches still haunt us: “Data breaches of the past are suddenly haunting us,” he noted, citing the LinkedIn and Dropbox breaches as examples.
  • Take control of your systems: “Build a reliable perimeter around everything you can control, and build out from there to the network.”
  • Security is an aspiration, not an obligation: “View compliance as an obligation and security as an aspiration.”
  • Education is key: “Make sure your employees are educated, aware and engaged.”
  • Speed matters: “The fast will beat the slow in security.”

How to Apply These Lessons Today

For hiring managers, the message is clear: prioritize tenacity and problem-solving over credentials. Look for candidates who demonstrate curiosity, persistence, and the ability to think critically under pressure. For professionals, focus on building these traits through hands-on experience, continuous learning, and real-world problem solving.

As Ferguson’s talk reminds us, the cybersecurity landscape is constantly shifting. The people who thrive are those who can adapt, learn, and persist—not just those who hold a certification. For more insights on building a strong security team, check out our guide on hiring for cybersecurity traits and effective security training strategies.

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Infosecurity

Mobile devices and robots: Why companies must act now to prevent future cybercrime

Published

on

Mobile devices and robots: Why companies must act now to prevent future cybercrime

The digital landscape is shifting rapidly, and with it, the threats that businesses face. Data protection and security concerns around mobile devices and robots are no longer distant possibilities—they are active battlegrounds for cybercriminals. While many organizations have focused on securing traditional desktop environments, the explosion of mobile usage and the rise of connected robotics are opening new doors for hackers. Companies that fail to adapt now risk not only financial ruin but also lasting reputational damage.

The growing threat of data breaches under GDPR

One of the most pressing issues for businesses today is compliance with the EU General Data Protection Regulation (GDPR). Even after Brexit, the UK will remain subject to GDPR requirements. From May 2018, organizations must notify national data protection authorities of any breach within 72 hours. This is no small task—data breaches are becoming more frequent and more severe.

Large corporations that handle millions of customer records are prime targets for blackmail. Hackers steal data and demand hefty ransoms for its return. This tactic is already common in the United States and is gaining traction across Europe. The cost of non-compliance or a successful attack can be catastrophic. Therefore, companies need to put the legwork in now to reduce the risk of this happening as the cost – both financial and reputational – is far too great.

Building a robust data protection strategy is not optional; it is a legal and ethical imperative. Businesses should invest in encryption, access controls, and employee training to minimize exposure. For more on building a security culture, check out our guide on cybersecurity culture best practices.

Mobile devices: A new playground for hackers

Mobile devices are inherently less secure than desktop environments. This is a common theme when speaking to clients and security providers. Unlike corporate laptops, smartphones and tablets often lack the same level of control and monitoring. This presents a fresh opportunity for malicious actors.

There are apps that can take control of a mobile device in seconds, often without the user noticing. A stark example was the launch of Pokémon Go. When the game wasn’t officially available in the UK, users flocked to unofficial app stores—including risky “grey app” markets—to download it. As a result, different versions of the game were installed on some phone models, exposing users to a world of risks. Hackers could easily take control of the phone, access personal data, listen in on conversations, or even activate the camera to spy on the user. It is a scary new world.

This means that businesses must treat mobile devices as critical endpoints. Implementing mobile device management (MDM) solutions and enforcing strict app policies are essential steps. For additional insights, see our article on mobile security strategies for 2024.

The rise of robots and the cyberwar frontier

Finally, the infiltration of robots into everyday life will become more evident. These machines will be connected to the internet at home, at work, and everywhere in between. While there are many benefits—from automation in manufacturing to assistance in healthcare—businesses cannot hide from the fact they will be a new frontier for hackers.

Connected robots could be hijacked to cause physical damage, steal sensitive data, or disrupt critical infrastructure. This could result in a form of ‘cyberwar’ where robotic systems become weapons. The potential consequences are severe, ranging from production downtime to public safety risks.

To prepare, companies should integrate security into the design of robotic systems from the outset. Regular patching, network segmentation, and rigorous testing are non-negotiable. As robots become more common, the line between cybersecurity and physical safety will blur.

Conclusion: Act now to build trust

Ultimately, businesses need to work hard to combat cybercrime by putting the right preventative measures in place now to reduce the risk of breaches in the future. The threats from mobile devices and robots are real and growing. By taking a proactive stance—investing in technology, training, and compliance—organizations can build a culture of trust in these new technology solutions. The time to act is today, not after the next major breach.

Continue Reading

Infosecurity

Gotta Hack ‘Em All: What Pokémon Go Taught Us About Security and Privacy Awareness

Published

on

Gotta Hack ‘Em All: What Pokémon Go Taught Us About Security and Privacy Awareness

When Pokémon Go burst onto iPhone and Android devices in July 2016, it became an instant cultural phenomenon. The game, developed by Niantic, tapped into decades of nostalgia while introducing millions to augmented reality (AR). Yet within days of launch, a serious Pokémon Go security flaw emerged, threatening users’ Google accounts. This incident became a real-world test of how everyday people handle digital privacy risks.

The Google Authentication Flaw That Shook Players

Shortly after release, security researchers discovered that the app’s sign-in process granted full access to a user’s Google account—including emails, photos, and documents. The flaw meant that Niantic—or a hacker—could potentially read private data without additional permission. This mobile app privacy breach made global headlines, sparking urgent questions about augmented reality risks and data safety.

Despite the severity, most players did not delete the game. Instead, they weighed the threat against the joy of catching virtual creatures. This reaction reveals a surprising truth: the average user already understands basic risk management, even if they don’t realize it.

How Users Applied Risk Management Without Knowing It

Identifying and Assessing the Threat

The first step in any security process is recognizing the danger. Researchers identified the flaw quickly, and media coverage ensured that millions of players knew the risks. Users learned that their email, photos, and documents could be exposed. This transparency allowed people to assess the impact on their own lives.

Four Ways Players Treated the Risk

Once aware, players chose different responses. Some removed the app entirely—a classic avoidance strategy. Others created throwaway email accounts to reduce exposure. A third group shared the risk by using separate devices or accounts. The largest segment simply accepted the risk, continuing to play without changes. This mirrors professional infosec decision-making.

In fact, this incident serves as a practical lesson in user data protection. It shows that even non-experts can grasp threat, likelihood, and consequence—the core of risk management.

Privacy Awareness: A Litmus Test for the Digital Age

The Pokémon Go episode became an accidental benchmark for privacy awareness. It demonstrated that people are not oblivious; they simply have a higher tolerance for risk when the reward is compelling. For Gen X and Millennial players, the nostalgic pull of catching Pikachu outweighed the theoretical danger of data theft.

However, this does not mean we should ignore the risks. The flaw highlighted how quickly Google account permissions can be abused. It also reminded us that no app is immune to vulnerabilities. As AR and mobile gaming grow, developers must prioritize security from day one.

Lessons for Developers and Users Alike

For app creators, the takeaway is clear: integrate security testing early. For users, the lesson is to stay informed and adjust settings. Check app permissions regularly. Use unique passwords. Consider secondary accounts for high-risk services.

Ultimately, the Pokémon Go security scare was a wake-up call. It proved that the public can handle complex security concepts—if given clear, timely information. The challenge lies in making that information accessible without causing panic.

Want to dive deeper? Read our guide on mobile app security tips and learn how to protect your data. Also check out augmented reality privacy concerns for future AR apps. And don’t miss our analysis of social engineering awareness in popular games.

In the end, the question isn’t whether we can catch ‘em all—it’s whether we can keep our data safe while trying.

Continue Reading

Infosecurity

Proven Cybersecurity Tips to Keep Hackers at Bay and Protect Your Data

Published

on

Proven Cybersecurity Tips to Keep Hackers at Bay and Protect Your Data

In today’s hyper-connected world, the threats to your personal and professional data are more sophisticated than ever. What once required a physical key to your office now demands constant vigilance against a barrage of virtual attacks. Hackers are no longer just targeting large corporations; they are increasingly focusing on individuals. To truly keep hackers at bay, you need a comprehensive strategy that blends awareness, technology, and good habits. This guide offers actionable cybersecurity tips to fortify your digital life.

Why Hackers Target Individuals and How to Prevent Spear Phishing

Imagine receiving an email that looks perfectly legitimate, addressing you by name and referencing a recent project. This is a classic spear phishing attack. Unlike generic spam, these messages are tailored to you. Hackers often conduct thorough research, scouring social media and public records to craft convincing lures. They might aim to steal money, sensitive information, or even settle a personal grudge.

To prevent spear phishing, start by scrutinizing every unexpected request for data or money. Never click on links or download attachments from unknown senders. Implement a cybersecurity policy within your organization that mandates verification protocols for financial transactions. Additionally, regular training sessions can help staff recognize the subtle signs of a targeted attack, such as unusual urgency or slight spelling errors in the sender’s email address.

Essential Cybersecurity Tips for Securing Your Home and Work Networks

Secure Public Wi-Fi and Use a VPN

Public Wi-Fi networks are a hacker’s playground. It is alarmingly easy for cybercriminals to set up a fake hotspot that mimics a legitimate one, such as “Starbucks_Free_WiFi.” When you connect, they can intercept all your traffic. To keep hackers at bay on public networks, always verify the network name with an employee before connecting. Once you finish browsing, log out of all services and instruct your device to “forget” the network to prevent automatic reconnection. Furthermore, disable Wi-Fi when it is not in use to avoid accidental connections.

One of the most effective cybersecurity tips is to use a Virtual Private Network (VPN). A VPN encrypts your internet traffic, routing it through a secure tunnel. This makes it virtually impossible for hackers to decipher your data, whether you are on a mobile phone, tablet, or laptop. For business environments, consider using a corporate VPN for all remote work.

Strengthen Passwords and Enable Two-Factor Authentication

Weak or reused passwords are a primary entry point for hackers. It is crucial to change your passwords regularly and avoid using the same credentials across multiple platforms. Password managers can generate and store complex passwords securely. However, even the strongest password can be compromised. Therefore, enable two-factor authentication (2FA) on all major accounts, including Gmail, Twitter, and Facebook. This adds an extra layer of protection, requiring a second verification step, such as a code sent to your phone.

Another simple yet powerful practice is to check for the green lock icon in your browser’s address bar. This indicates that the website uses HTTPS, which encrypts data between your device and the server. Never enter sensitive information on a site that lacks this security feature.

How to Keep Hackers at Bay with Device and App Management

Hackers can exploit vulnerabilities in your devices and apps without you ever knowing. For instance, they can remotely activate your webcam to spy on boardroom discussions. Always cover your webcam when not in use, and review the security settings on your devices. Similarly, when installing apps, carefully examine the permissions they request. A simple drawing app should never need access to your contacts list or network information. If an app asks for unnecessary permissions, do not install it.

Building on this, implement a strict policy for personal devices used for work. Ensure that all devices have up-to-date antivirus software and operating system patches. On average, it takes 229 days to detect a security breach, giving hackers ample time to alter or steal data. Regular audits and monitoring can help reduce this detection gap.

Build a Cybersecurity Culture in Your Organization

To truly keep hackers at bay, cybersecurity must become a shared responsibility. Appoint a dedicated cybersecurity officer and review staff permissions regularly. Most breaches occur due to human error, so ongoing training is essential. This does not have to be expensive; even short, monthly updates can significantly raise awareness. Additionally, stay informed about evolving data protection laws, as compliance often includes mandatory cybersecurity measures. Finally, remember that good habits at home—like using a VPN and strong passwords—will naturally translate to better practices at work.

For more detailed guidance, check out our Cybersecurity Awareness Training Guide and learn about Phishing Simulation Tools to test your team’s readiness. By adopting these strategies, you can significantly reduce your risk and build a resilient defense against modern cyber threats.

Continue Reading

Trending