No local (ISC)² chapter, but interested in creating a security roundtable

[ericgeater]

In an earlier, separate post, the discussion led to possibly creating my own IT security round-table group.  I'm only six months into my CISSP, so I'm too new to start an (ISC)² chapter, but a cursory view at LinkedIn suggests there's several local (ISC)² and ISSA members.

Does (ISC)² membership permit access to a local members directory?  If anyone knows about ISSA membership, I'm paid up there as well.

[Caute_cautim]

@ericgeaterHave you looked at https://www.isc2.org/Chapters, and looked for advice on setting up a chapter.   We set up a chapter in Auckland, New Zealand some years ago now, the first few years was very slow and we only started with bi-monhtly meetings.   Getting a Linkedlin, Facebook on social media helps, but also have a very good person, who likes to market and arrange meetings helps as well.   We swap around our respective organisations, and normally have found lunch time sessions, with some food thrown helps a great deal, rather than evening sessions.   But we have only learnt this over time and experimenting.   Getting some speakers from industry helps a great deal and giving people a Charter House environment helps as well, to develop local talent, by giving them 10 minutes slots to try their new presentation before giving it at their organisations has helped.   We have even helped a PhD student to test his presentation skills, prior to presenting his thesis helped him, but also prepared for questioning as well.   Study groups either online and locally is a good driver, but many people tend to do this themselves, but being able to listen to people who have done the hard yards helps as well.  

Keeping the motivation going, is key, and finding the right people willing to assist as a team to promote and keep it running as well.  If you can obtain local business sponsorship whilst staying objective really assists as well.

Hope this helps?

Regards

Caute_cautim

[ericgeater]

Thanks for the reply.  I can't start an (ISC)² chapter on my own, because I only passed CISSP in March.  According to https://www.isc2.org/chapters/start-chapter, I must "Be an (ISC)² member in good standing for a minimum of 3 years" to be eligible to start a chapter.

If I could access a local members' directory, I could at minimum solicit people to create a security roundtable, which at minimum could be used to bounce ideas off of one another.

[Caute_cautim]

@ericgeaterGood Idea, Have you checked whether or not there is a local chapter in your area?   Or reached out to the ISC2 Officer responsible to see if they can assist you.   Another way is to see what other Security organisations are running in your area too, ISACA?  ASIS?  Audit Groups?  Reaching out often helps to see who is interested, even if it starts out as a casual coffee once a month or something similar.

Regards

Caute_cautim

[ericgeater]

Did that first.  The closest (ISC)² near me is in Huntsville, which is 65 miles away.  It's an incipient group itself.  I am definitely welcome to participate in the meetings there, but the culture of HSV is highly populated with people working in DoD or are government contractors.  I work for a company that doesn't require any clearance, and the culture of the industries in my neck of the woods are less restrictive than DoD levels of sensitivity, anyway.

My original post mentioned that I'm a member of ISSA (and naturally, (ISC)²), but at this point I would be happy to commiserate with anyone in IS/IT, for the sake of discussing good IT security management practices.

[Caute_cautim]

@ericgeaterI think you have to think laterally here; Think of a common set of subjects or issues, which might interest people and see if people are interested about talking about it.   It could be a pending issue such as CCPA or a new legislation or subjects such as IoT, 5G, and the ramifications or something similar?  Or find a great speaker, who may be of interest and obtain permission to host an event in your organisation with support of your marketing department?   Or even host a Webex online session? 

Other methods are a local group via LinkedIn, I am sure something will come about, thinking about it in the background.  Think of it as an opportunity rather than a barrier.  

Those who are cleared, know what they can and what they cannot talk about - but if you keep it fairly highly level in terms of principles, issues or common factors.

Or do you have a local University, or college and commence a dialogue with them?

You have come a long way, don;'t given up - I am sure something will resonate.

Regards

Caute_cautim

[CraginS]

---

@ericgeater wrote:

In an earlier, separate post, the discussion led to possibly creating my own IT security round-table group.  I'm only six months into my CISSP, so I'm too new to start an (ISC)² chapter, but a cursory view at LinkedIn suggests there's several local (ISC)² and ISSA members.

Does (ISC)² membership permit access to a local members directory?  If anyone knows about ISSA membership, I'm paid up there as well.

---

Eric,

As a recently certified member, you cannot be the top line organizer to sign the chapter application paperwork, but you most certainly CAN be the spark plug that makes it happen, and become a plank owner member of the new chapter's board of directors.

Your best bet in the community here is to post a new thread starter over in

https://community.isc2.org/t5/Chapters/bd-p/Chapters

and also over on the alternate forum

https://groups.io/g/cisspforum

Subject: Help Start a Podunk City (ISC)2 Chapter

Body:

We are looking for a starter set of members to stand up a new (ISC)2 Chapter in Podunk City. If you are interested in being a member of this new chapter, please send me a note at myname@mymail.tv indicating your interest. Remember, you do not have to be in Podunk, just be interested in participating in chapter events there. As we get going, we may not be able to support online chapter meetings initially, but we will see what resources we can leverage.

I. If you helped start a new chapter and can advise on do's and don't's from your own lessons learned, please send me that information.(The very successful DC chapter comes to mind.)

II. If you are interested in being a member of the new group, send me a  note to indicate interest,  including the following information:

1. Your name as registered with (ISC)2.

2. Your preferred name for correspondence.

3. Your e-mail (essential), and phone number (optional).

4. Your (ISC)2 member number and all (ISC) certifications you hold.

(A minimum proportion of the chapter must be (ISC)2 members with one or more certifications, but the chapter membership can include non-certified cyber professionals.)

5. Whether you are interested in taking on a leadership role on the chapter board or as a committee chair. What roles could you help with?

6. Any experience or skills you have in volunteer organizational leadership that you may be able to use to help get the chapter going.

Once we have sufficient number of replies to indicate this might actually happen, we will announce an initial get-together to everyone who replied, as well as here on this forum.

=========

Go for it, Eric! Leadership is seeing a need and working to fulfill that need, not waiting in line for your turn to do something.

Be prepared to set up a database of interested folks, send a lot of e-mails to keep everyone informed, and choose a free or low cost virtual meeting provider for your initial meetings with prospective members. Follow-up face to face meetings with those who offer to take key roles will be essential, too, but can easily be over coffee or a meal at a local establishment.

Good luck!

Craig

[ericgeater]

My most principal task is to baseline my company's current architecture.  What're we doing right?  What could we improve on?  What tools are similar companies using to protect or reduce their attack surface?  Who informs their decisions on how to attain their protection?  What decisions did a company use to evaluate RMFs?

Ultimately, yes, all of this depends on buy-in and alignment... but I'm just a person on the IT staff, and less charismatic than an end-of-month sales report.  If and when my stakeholders decide to react positively to the latest inbox cybersecurity horror story which raises the hair on the back of their necks, I would like to have a calm, thoughtful, measured response to their worrisome questions.