As organizations transition to a remote workforce due to the immediate impacts of the COVID-19 pandemic, cybersecurity teams face new security challenges. We read about cyberattacks daily and the increase in phishing and malware attacks.
Many companies were not prepared to go fully remote and have been forced to modify their IT security stature and risk management practices. In fact, 59% of risk managers responding to a recent survey by the Risk Management Institute reported their organization had not given any consideration to a pandemic risk, and 94% of respondents feel that the post-COVID-19 world will strengthen the case for risk management. Now more than ever, it is imperative that cybersecurity professionals stay up to date with their skills and knowledge.
The CompTIA Advanced Security Practitioner (CASP+) certification addresses the competencies required for resilient risk management practices. It also validates advanced-level enterprise security operations and architecture, research and collaboration, and integration of enterprise security.
How Does CompTIA Advanced Security Practitioner (CASP+) Address Enterprise Risk Management?
Risk management represents nearly 20% of the questions on the CASP+ certification exam. IT pros who have CASP+ can prepare their organizations for evolving vulnerabilities and threats through risk assessment and management techniques. The risks and vulnerabilities coming out of COVID-19 have demonstrated the importance of these skills. Here are four CASP+ risk management objectives and why they are important to enterprises:
1. Identifying and Understanding the Enterprise Impact of Cybersecurity Risks
CASP+ Exam Objective 1.1: Summarize business and industry influences and associated security risks
To sufficiently protect an organization, IT pros must know the internal and external influences for IT risk, including the impact of new products, technologies, mergers, partnerships, de-perimeterization and government regulations on an organization’s security posture.
A cybersecurity professional who has CASP+ understands the concepts of changing business models and strategies based on enterprise risk. COVID-19 put pressure on organizations to quickly change their business models to survive. IT pros who have CASP+ can adapt an enterprise’s security posture to new business models and ensure the organization continues operations.
2. Addressing Organizational Risks with Policy
CASP+ Exam Objective 1.2: Compare and contrast security, privacy policies and procedures based on organizational requirements
IT pros must support the following to properly protect an organization:
- Policy and process life cycle management
- Legal compliance
- Business impact analysis (BIA)
- Security requirements for requests for proposals (RFPs)
- Support of policy development
- Standard cybersecurity practices
CASP+ certification holders understand best practices in emerging risks, such as COVID-19, and know how to help support the development of policies containing standard security practices that incorporate a pandemic.
3. Mitigating Risk with Trend Analysis and Security Controls
CASP+ Exam Objective 1.3: Given a scenario, execute risk mitigation strategies and controls
IT pros require specific skills to implement risk assessment and management, including the following:
- Trend analysis
- How to determine the likelihood of a threat
- Translating technical risks into business terms
- Selecting security controls based on confidentiality, integrity and availability (CIA) to continuously improve an organization’s security posture
A mastery-level cybersecurity pro who has CASP+ knows to conduct risk mitigation strategies and implemented security controls to protect the organization against a pandemic before it arrives and disrupts the organization.
4. Analyzing Risk Metrics to Secure the Enterprise
CASP+ Exam Objective 1.4: Analyze risk metric scenarios to secure the enterprise
IT pros must review the effectiveness of existing security controls, such as analyzing KPI metrics to perform gap analysis, interpret trend data and provide recommendations to help secure an organization. They often fix the gaps they find, which requires judgement to prototype and test solutions, and create benchmarks to ensure security solution metrics meet business needs.
CASP+ certification holders know to audit their security posture to ensure that identified risk metrics would perform well during a disaster, such as a pandemic. They would identify disruptions that force vulnerabilities as a risk and establish risk metric scenarios to help ensure performance, latency and availability of the organization.
Who Should Get a CompTIA Advanced Security Practitioner (CASP+) Certification?
CASP+ is the final certification in the CompTIA Cybersecurity Pathway and represents the hands-on mastery of advanced-level cybersecurity skills, including risk management. It’s recommended for cybersecurity professionals with 10 or more years of experience in IT administration, including 5 years of hands-on technical cybersecurity experience.
This advanced-level cybersecurity certification is based on the following job roles:
- Security architect
- Security engineer
- Technical lead analyst
- Application security engineer
CASP+ certified professionals are unique not only because they create cybersecurity policy and procedures, but they also implement cybersecurity policies and framework solutions. For example, many chief information security officers (CISOs) do not have hands-on cybersecurity skills, but preparing for and earning CASP+ would prove their hands-on and risk management mastery of enterprise IT networks.
A CISO with hands-on cybersecurity skills would be among the most effective CISOs because they would know how to create and implement risk-related policy. Implementation is tricky in enterprise networks because one change can affect dozens of systems. A CISO who knows how enterprise systems operate can analyze them to better secure the organization.
CASP+ is compliant with ISO 17024 standards. Regulators and government rely on this accreditation because it provides confidence and trust in the outputs of an accredited program. CASP+ is also approved by the U.S. Department of Defense (DoD) to meet directive 8140/8570.01-M requirements.
For more information on CompTIA Advanced Security Practitioner (CASP+) and to receive updates, check out the CASP+ home page and download the exam objectives for free.
Patrick Lane is a director of product management for CompTIA. He manages IT workforce skills certifications, including CompTIA Security+, CompTIA Cybersecurity Analyst (CySA+),CompTIA PenTest+ and CompTIA Advanced Security Professional (CASP+).
Jen Blackwell also contributed to this article. She is a senior products marketing manager at CompTIA and oversees the certifications along the CompTIA Cybersecurity Career Pathway.
