Microsoft updates program to encourage diversity in partner law firms

Microsoft has overhauled a program for promoting diversity at the law firms it works with, to promote higher representation for lawyers of different minority groups in the firms’ leadership ranks.The company’s Law Firm Diversity Program has been changed to offer bonuses to 15 law firms it works with, based on how many attorneys in positions of power are female, from racial and ethnic minorities, openly LGBT, people with disabilities or military veterans.Microsoft started the program 7 years ago and originally offered firms a 2 percent bonus on their billings if a set percentage of the hours they billed to the company were worked by diverse attorneys.To read this article in full or to leave a comment, please click here

DHS warns about privacy implications of cybersecurity bill

The U.S. Department of Homeland Security has warned about the privacy implications of a cybersecurity bill that is intended to encourage businesses to share information about cyberthreats with the government.The DHS has also warned that the information sharing system proposed by the new bill could slow down responses in the face of a cyberthreat, if companies are allowed to share information directly with various government agencies, instead of routing it through the department.The Cybersecurity Information Sharing Act (CISA), which would give businesses immunity from customer lawsuits when they share cyberthreat data with the government, is under consideration of the Senate.To read this article in full or to leave a comment, please click here

Apple computers vulnerable to ‘Thunderstrike 2’ firmware worm

An improved attack on the firmware in Apple computers makes them vulnerable to hard-to-detect malware without even being connected to a network, according to a Black Hat conference presentation due to be given later this week.The new research highlights ongoing weaknesses in the low-level software that runs on every computer before an operating system is loaded.It comes from researchers Xeno Kovah and Corey Kallenberg of LegbaCore and Trammell Hudson of Two Sigma Investments. They showed earlier this year how they could infect a Mac’s firmware with malware by connecting malicious devices to them using Thunderbolt, Apple’s high-speed data transfer interface. The attack was dubbed Thunderstrike.To read this article in full or to leave a comment, please click here

Cisco’s SDN controller has a security hole

Cisco has issued software to fix a vulnerability in its SDN controller than allows infiltrators to access the system as root users, with access to root commands.Access to root commands would enable an attacker to access all commands and files on the controller. With that access, the attacker can then modify the system in any way desired, including granting and revoking access permissions for other users, including root users.A vulnerability in the cluster management configuration of Cisco’s Application Policy Infrastructure Controller (APIC) and Nexus 9000 switch in Application Centric Infrastructure (ACI) mode could allow an authenticated, remote attacker to access the APIC as the root user, according to a recently issued Cisco security advisory. The vulnerability is due to improper implementation of access controls in the APIC filesystem, the advisory states.To read this article in full or to leave a comment, please click here

Condé Nast parent company jumps into big data market with 1010data purchase

Advance, a global media group that owns the Condé Nast group of consumer publications, has ventured into the realm of data analysis, purchasing New York-based analytics firm 1010data for $500 million.Advance plans to infuse 1010data with capital to expand its operations, so it can take on more of the growing market for big data-styled analysis services.Sandy Steier, 1010data co-founder and CEO, in a statement issued Monday that there will be no disruption to its customers, employees nor to its business as a result of the acquisition, which will instead allow 1010data to grow more quickly.The purchase is a bit of an unusual one for Advance, which has filled its portfolio with traditional media properties.To read this article in full or to leave a comment, please click here

Social Engineering: 6 commonly targeted data points that are poorly protected

It's the little things that cause the biggest problemsImage by ThinkstockThis week, thousands of hackers have traveled to Las Vegas to learn about the latest in security research and techniques during BSides Las Vegas and Black Hat. This weekend, during DEF CON, the education continues as hackers roam the halls moving from talk to talk or head over to one of the villages.To read this article in full or to leave a comment, please click here

Counterterrorism expert says it’s time to give companies offensive cybercapabilities

The U.S. government should deputize private companies to strike back against cyberattackers as a way to discourage widespread threats against the nation’s businesses, a former government official says.Many U.S. businesses have limited options for defending their IP networks, and the nation needs to develop more “aggressive” capabilities to discourage cyberattacks, said Juan Zarate, the former deputy national security advisor for counterterrorism during President George W. Bush’s administration.The U.S. government should consider allowing businesses to develop “tailored hack-back capabilities,” Zarate said Monday at a forum on economic and cyberespionage hosted by think tank the Hudson Institute. The U.S. government could issue cyberwarrants, giving a private company license “to protect its system, to go and destroy data that’s been stolen or maybe even something more aggressive,” he added.To read this article in full or to leave a comment, please click here

Newest RIG exploit kit driven by malicious advertising

LAS VEGAS - Earlier this year, a disgruntled reseller leaked the source code for version 2.0 of the RIG exploit kit.Since then, the RIG's author has released version 3.0, which was recently discovered by researchers from Trustwave. The latest version uses malvertising in order to deliver a majority of its traffic, infecting some 1.25 million systems to date.There have been a few notable changes made to RIG between versions, including a cleaner control panel that's easier to navigate, changes to the URL structure used by the kit that helps it avoid detection, and a security structure that prevents unauthenticated users from accessing internal files – clearly implemented to avoid leaks such as the one that exposed the source code for the previous version.To read this article in full or to leave a comment, please click here

Harvard CISO shares 5 pearls of IT security wisdom

Chief Information Security Officer Christian Hamer, who is responsible for policy and awareness across Harvard University and whose team handles security operations and incident response, took part on a panel last week at the Campus Technology conference in Boston (Campus Technology’s Rhea Kelly moderated; ESET researcher Lysa Myers was also an expert panelist). Here’s a selection of Hamer’s more notable observations:  Most important steps for protecting your network: We think all too often about IT security or information security [as being] about the bits and bytes, and what kind of widget we put on the network or somebody’s computer to protect it… But in general we have populations that want to do the right thing. They’re a lot more aware of the threats now because a lot of them have been in the media quite a bit recently. But they’re just not sure what to do or how to do it. And that’s probably the No. 1 thing that people could double down on. Does your community know what to do? Do they know how to do it? And do they know who to ask if they have trouble understanding that? Mobile security: “There’s a great industry around mobile Continue reading

Patch halt looms for half of all IE users

With just over four months left before Microsoft stops serving security updates to most versions of Internet Explorer (IE) other than IE11, nearly half of all IE users are still running a soon-to-be-retired edition, new data released Saturday showed.In August 2014, Microsoft abruptly told virtually all IE users that they needed to be running IE11 by Jan. 12, 2016, or face a shut-off of security updates. After that date, Microsoft will support IE9 only on Windows Vista and Windows Server 2008; IE10 only on Windows Server 2012; and only IE11 on Windows 7, Windows 8, Windows 8.1, Windows 10, Windows Server 2008 R2 and Windows Server 2012 R2.To read this article in full or to leave a comment, please click here

Hello Windows 10. Hello Criminals.

It’s not really surprising that scammers are taking advantage of Microsoft’s consumer release of Windows 10. According to security firm KnowBe4:  Major Operating System upgrades are usually causing confusion among end-users and the current Windows 10 upgrade is no exception. The bad guys exploit these confusions in several ways, mostly through massive phishing campaigns and with criminal call-center operations which claim to be Microsoft tech support. Some campaigns will try to worry the user that their PC has changed somehow, causing access issues. Other phishing emails will try to lure the user with links where they can get their new no-charge version of Windows 10, or have it "attached" in a zipped file, which makes it our Scam Of The Week, because the attachment is the CBT-Locker ransomware!To read this article in full or to leave a comment, please click here

It’s About Time

I guess I’m semi-famous. Or maybe I’m a moderately sized fish in a rather small bowl. Whatever the reason, a lot of people reach out to me for career advice. Which is okay, of course — I make it a personal policy to answer every email that’s addressed to me, individually, that I receive. It only takes a minute or two, after all, and it drives me nuts when I send an email to someone that seems to go into a black hole. I try not to be the person that drives me nuts. :-)

So a couple of times a week, I open my inbox to find either an email or a message through some social network (the only social networks I actively use, by the way, are Twitter and LinkedIn, so if you friend me on Facebook, or send me an invite to something else, I’m not likely to accept) asking some variation of a couple of questions. The one I want to address in this post is probably the hardest to answer.

How can I become an architect/really good engineer/really good writer/really successful/etc.?

The snark inside me just wants to answer, “just change your title on LinkedIn, that’s Continue reading

1 … 3,323 3,324 3,325 3,326 3,327 … 3,791