Windows has a zero-day that won’t be patched for weeks
For now, there are no CVE identifiers and the only confirmed details are in Microsoft’s warning: Microsoft is aware of limited targeted attacks that could leverage un-patched vulnerabilities in the Adobe Type Manager Library and is providing the following guidance to help reduce customer risk until the security update is released. Attackers could exploit the flaw by persuading users to open a malicious document. Importantly, however, the same danger would arise even if users viewed that document using the Windows Explorer file manager preview pane. The latter is significant because, for now, there’s no software fix, which could be as far away as the next Patch Tuesday update, scheduled for 14 April 2020: Microsoft is aware of this vulnerability and working on a fix. Updates that address security vulnerabilities in Microsoft software are typically released on Update Tuesday, the second Tuesday of each month. Until then, the only countermeasure is to use one of the recommended workarounds, which involves disabling Explorer’s preview and details pane.
The fintech sector encompasses banking, investments, trading, payments and other related areas. It involves applying technology for improved decision-making, better transparency, enhanced security and more. Companies that deal with matters like stock trading and investments should strongly consider hiring data protection officers to help maintain best practices for security. Doing so is particularly important considering the amount of evaluation that a person or company typically goes through before making such investments. For example, some databases contain complete historical records of end-of-day data for exchange-traded and equity options in the United States. Clients need continual and reliable access to such data so that they can decide when to invest and which companies on the stock exchange deserve their attention. The fintech sector assists everyday people who are not investors, too. Many banks and financial apps track a consumer’s spending habits.
Historically, security systems often simply used a low-resolution camera to passively capture video. This trend held whether at private residences, commercial properties, or on-board public transportation. Now, smart security systems are being purpose-built to capture, store, and analyze continuous video streams. On top of the 4K video captured by high-resolution cameras, these systems can use an analytics layer with machine learning software to carry out pattern recognition and motion detection. ... Today’s factories are using IoT-enabled machines to work smarter, not harder. By equipping machines with sensors, factory managers can more accurately map machine workloads, inputs, and outputs. They can also more closely track machine wear-and-tear, which leads to maintenance that is predictive rather than reactive and improves lifespan. With these features, factories are increasingly becoming automated, thanks to the wave of Industry 4.0. Machine-to-machine (M2M) devices typically use embedded and removable flash solutions to aggregate data into a single stream at the edge.
Amazon Web Services has included pandemic response in its resiliency planning and regularly scales to handle spikes in demand, such as on Black Friday. Pandemic response policies and procedures have been incorporated into disaster recovery planning. Measures have been taken to ensure ample capacity and service continuity. Google Cloud has formed an internal working group to plan for and mitigate against business impacts resulting from COVID-19. The company expressed confidence its systems can continue to support customers during this time. Microsoft Azure has seen a 500 percent increase in meetings, calling, and conferences on its Teams remote collaboration platform since January 31. In the same time frame, it has seen a 200 percent increase in Teams usage on mobile devices. The company maintains cloud service availability by running multiple instances in geographically dispersed locations. Forrester advises cloud users not to panic about cloud capacity, given the past decade of massive cloud buildouts. While the long-term impact of how people will work in the future is unclear, the pandemic offers a powerful case study and a first look at the promise of cloud computing.
How Microsoft is building new tech to bring precision agriculture to the world’s poorest farmers
While the team could innovate their way to recreate a drone’s functionality, there was no replacement for sensors that provide critical soil-level data for insights. To capture data, one needs multiple sensors spread across the field, which costs hundreds of dollars. The technology is too expensive for small farmers. “That technology does not exist. It has to be built,” Chandra says. So they built it. The FarmBeats team has come up with a solution that can provide soil level data without requiring expensive sensors on the ground. “While it might not be possible for these farmers to buy multiple sensors, we realized they already have a sensor that they use—their Android smartphones,” Chandra says as his eyes light up. Instead of using a network of sensors, the solution uses a smartphone’s Wi-Fi chipset to beam signals to the ground. By analyzing the “time of flight” of the Wi-Fi signal, they can detect the soil moisture and conductivity, which provides insights about watering the field and fertilizer input.
Boost security defenses against Kwampirs RAT malware with new list of IOCs
ReversingLabs collected data samples from Kwampirs attacks to write a reliable malware configuration parser that extracts network configurations from the samples. Each of the Kwampirs samples collected by ReversingLabs came with a set of 200 control server URLs. Malicious operations are usually carried out in campaigns that share the same control server infrastructure. ReversingLabs was particularly looking for command-and-control (C2) URLs. These URLs are interesting because of how the malware finds active C2 servers. Every sample comes with a hardcoded list of 200 URLs that Kwampirs tries to access in sequential order. The C2 locations are either in the form of domain names or IP addresses. The malware uses the first active URL it finds as the C2 server. Because the malware configuration is hidden in the installer that drops the DLL onto the system, an unpacker needs to be created to use with the parser. This unpacker decomposes the installation component and extracts the DLL, allowing the parser to collect the necessary C2 information. Using these two methods, ReversingLabs identified 1,586 URLs. Analyzing these URLs revealed that some of the droppers used the same payload, even though their hashes were different.
Digital Transformation Efforts Hindered by Lack of Upskilling
According to the Upskilling 2020: Enterprise DevOps Skills Report from the DevOps Institute, based on 1,300 respondents, more than 50% of enterprises find challenges with all aspects associated with managing the people, processes and technologies that make DevOps possible. The report found 58% of enterprises have a tough time actually finding those with the right DevOps skills and 48% said it’s difficult to retain skilled DevOps professionals. With that in mind, it’s no surprise the report found DevOps salaries on the rise. According to the Robert Half Technology 2020 Salary Guide, salaries for experienced DevOps engineers can reach beyond $179,250. Survey respondents said that the skillsets necessary for DevOps practitioners skillsets should be multifaceted, including process skills and knowledge (69% of respondents), automation skills (67%) and interpersonal skills (61%). The 2019 survey found automation skills to be the top skill, followed by process skills and knowledge.
Improving Cyber-Risk Management with ISO 27001 and the 10 Steps to Cybersecurity
According to the 2020 Global Risk Report developed by the World Economic Forum, cyber-attacks and data breaches now feature in the top 10 most likely risks to businesses, while also featuring prominently in relation to potential impact. As the frequency and disruptive potential of cyber-attacks increases each year, so does the cost. According to the 2019 Cost of Cybercrime study carried out by Accenture, the total cost of cybercrime in 2018 increased by 12% over the prior year and 72% over the previous five years. Recognizing the threat posed by cyber-attacks, the National Cyber Security Centre (NCSC) – the information assurance arm of the UK Government – released ‘10 steps to cybersecurity.’ These guiding principles offer business leaders advice on how to improve cybersecurity and how to protect their information assets. They can be applied to almost all organizations regardless of their size, location or sector. The central message of the guidance is the need for businesses to establish an effective information risk management regime or culture, supported by top management.
Fintech taskforce established to help SMEs cope with COVID-19 pandemic
The taskforce, which includes Trade Ledger, Wiserfunding, Nimbla and NorthRow, is working to provide a new turn-key loan origination and underwriting platform to allow banks and lenders to provide funds to businesses. This platform would include risk assessment, ‘know your customer’ (KYC), and insurance capabilities, and could be used by individual lenders or as part of a consortium. The funds that are made available would be deployed virtually and digitally, and would aim to lessen the impact of the COVID-19 outbreak on SMEs. Options would include loans of over £500,000, deployed within days rather than weeks. Martin McCann, CEO at Trade Ledger, said: “With the COVID-19 outbreak putting immense financial pressure on global supply chains, now more than ever, SMEs need reliable cash flow if they are to stay in business. “On average, it takes around 90 days for lenders in this sector to onboard new customers and establish new credit lines.
How much do you know about the Russian Dark Web?
We're seeing unique information come out of there because they're technically way more advanced than other users of the Dark Web around the world. Russians are far advanced and ahead of the game. So for example, earlier this year before the BlueKeep vulnerability was disclosed, there were Russian threat actors on cybercrime forums talking about this vulnerability, creating exploits for it and testing it before anybody else had been talking about it. So they're ahead of the rest of the world. And I think there's many environmental factors that contribute to that culture of criminality in the Russian Dark Web. And one is that the government just turns a blind eye to most of it. If it's not specifically negatively affecting the Russian government or Russian entities, they turn a blind eye to the crime. It's almost like they're giving permission to criminals to use this Dark Web forum for crime and business. Basically, in Russia, it's free game. The Russian government has no accountability. They don't hold these people accountable for their actions.
Quote for the day:
"Let him who would be moved to convince others, be first moved to convince himself." -- Thomas Carlyle
No comments:
Post a Comment