• Search for:
    31Oct, 2022
    NASA Continues Psyche Asteroid Mission

    NASA announced Friday the agency decided its Psyche mission will go forward, targeting a launch period opening on Oct. 10, 2023.

    Earlier this year, Psyche missed its planned 2022 launch period as a result of mission development problems, leading to an internal review of whether the mission would be able to overcome these issues to successfully launch in 2023.

    This continuation/termination review was informed by a project-proposed mission replan and a separate independent review, commissioned in June by NASA and the agency’s Jet Propulsion Laboratory in Southern California, that investigated causes for the delay.

    “I appreciate the hard work of the independent review board and the JPL-led team toward mission success,” said Thomas Zurbuchen, associate administrator of NASA’s Science Mission Directorate in Washington. “The lessons learned from Psyche will be implemented across our entire mission portfolio. I am excited about the science insights Psyche will provide during its lifetime and its promise to contribute to our understanding of our own planet’s core.”

    The independent review board is still finalizing its report, which, along with NASA’s response, will be shared publicly once complete.

    The mission team continues to complete testing of the spacecraft’s flight software in preparation for the 2023 launch date. The new flight profile is similar to the one originally planned for August 2022, using a Mars gravity assist in 2026 to send the spacecraft on its way to the asteroid Psyche. With an October 2023 launch date, the Psyche spacecraft will arrive at the asteroid in August 2029.

    “I’m extremely proud of the Psyche team,” said JPL Director Laurie Leshin. “During this review, they have demonstrated significant progress already made toward the future launch date. I am confident in the plan moving forward and excited by the unique and important science this mission will return.”

    NASA selected Psyche in 2017 to investigate a previously unexplored metal-rich asteroid of the same name. It is part of the agency’s Discovery Program, a line of low-cost, competitive missions led by a single principal investigator. 

    NASA continues to assess options for its Janus mission exploring twin binary asteroid systems, which was originally scheduled to launch on the same SpaceX Falcon Heavy rocket as Psyche. NASA’s Deep Space Optical Communications technology demonstration, testing high-data-rate laser communications, is integrated into the Psyche spacecraft and will continue as planned on the new launch date.

    Arizona State University leads the Psyche mission. JPL, which is managed for NASA by Caltech in Pasadena, California, is responsible for the mission’s overall management, system engineering, integration and test, and mission operations. Maxar Technologies in Palo Alto, California, is providing the high-power solar electric propulsion spacecraft chassis. NASA’s Launch Services Program, based at the agency’s Kennedy Space Center in Florida, is managing the launch. Psyche is part of NASA’s Discovery Program, managed by the agency’s Marshall Space Flight Center in Huntsville, Alabama.

    For more information about the Psyche mission, visit:

    https://www.nasa.gov/psyche

    Resource : https://www.nasa.gov/feature/nasa-continues-psyche-asteroid-mission

    28Oct, 2022
    Magnetic sensors track muscle length

    Using a simple set of magnets, MIT researchers have come up with a sophisticated way to monitor muscle movements, which they hope will make it easier for people with amputations to control their prosthetic limbs.

    In a new pair of papers, the researchers demonstrated the accuracy and safety of their magnet-based system, which can track the length of muscles during movement. The studies, performed in animals, offer hope that this strategy could be used to help people with prosthetic devices control them in a way that more closely mimics natural limb movement.

    “These recent results demonstrate that this tool can be used outside the lab to track muscle movement during natural activity, and they also suggest that the magnetic implants are stable and biocompatible and that they don’t cause discomfort,” says Cameron Taylor, an MIT research scientist and co-lead author of both papers.

    In one of the studies, the researchers showed that they could accurately measure the lengths of turkeys’ calf muscles as the birds ran, jumped, and performed other natural movements. In the other study, they showed that the small magnetic beads used for the measurements do not cause inflammation or other adverse effects when implanted in muscle.

    “I am very excited for the clinical potential of this new technology to improve the control and efficacy of bionic limbs for persons with limb-loss,” says Hugh Herr, a professor of media arts and sciences, co-director of the K. Lisa Yang Center for Bionics at MIT, and an associate member of MIT’s McGovern Institute for Brain Research.

    Herr is a senior author of both papers, which appear today in the journal Frontiers in Bioengineering and Biotechnology. Thomas Roberts, a professor of ecology, evolution, and organismal biology at Brown University, is a senior author of the measurement study.

    Tracking movement

    Currently, powered prosthetic limbs are usually controlled using an approach known as surface electromyography (EMG). Electrodes attached to the surface of the skin or surgically implanted in the residual muscle of the amputated limb measure electrical signals from a person’s muscles, which are fed into the prosthesis to help it move the way the person wearing the limb intends.

    However, that approach does not take into account any information about the muscle length or velocity, which could help to make the prosthetic movements more accurate.

    Several years ago, the MIT team began working on a novel way to perform those kinds of muscle measurements, using an approach that they call magnetomicrometry. This strategy takes advantage of the permanent magnetic fields surrounding small beads implanted in a muscle. Using a credit-card-sized, compass-like sensor attached to the outside of the body, their system can track the distances between the two magnets. When a muscle contracts, the magnets move closer together, and when it flexes, they move further apart.

    In a study published last year, the researchers showed that this system could be used to accurately measure small ankle movements when the beads were implanted in the calf muscles of turkeys. In one of the new studies, the researchers set out to see if the system could make accurate measurements during more natural movements in a nonlaboratory setting.

    To do that, they created an obstacle course of ramps for the turkeys to climb and boxes for them to jump on and off of. The researchers used their magnetic sensor to track muscle movements during these activities, and found that the system could calculate muscle lengths in less than a millisecond.

    They also compared their data to measurements taken using a more traditional approach known as fluoromicrometry, a type of X-ray technology that requires much larger equipment than magnetomicrometry. The magnetomicrometry measurements varied from those generated by fluoromicrometry by less than a millimeter, on average.

    “We’re able to provide the muscle-length tracking functionality of the room-sized X-ray equipment using a much smaller, portable package, and we’re able to collect the data continuously instead of being limited to the 10-second bursts that fluoromicrometry is limited to,” Taylor says.

    Seong Ho Yeon, an MIT graduate student, is also a co-lead author of the measurement study. Other authors include MIT Research Support Associate Ellen Clarrissimeaux and former Brown University postdoc Mary Kate O’Donnell.

    Biocompatibility

    In the second paper, the researchers focused on the biocompatibility of the implants. They found that the magnets did not generate tissue scarring, inflammation, or other harmful effects. They also showed that the implanted magnets did not alter the turkeys’ gaits, suggesting they did not produce discomfort. William Clark, a postdoc at Brown, is the co-lead author of the biocompatibility study.

    The researchers also showed that the implants remained stable for eight months, the length of the study, and did not migrate toward each other, as long as they were implanted at least 3 centimeters apart. The researchers envision that the beads, which consist of a magnetic core coated with gold and a polymer called Parylene, could remain in tissue indefinitely once implanted.

    “Magnets don’t require an external power source, and after implanting them into the muscle, they can maintain the full strength of their magnetic field throughout the lifetime of the patient,” Taylor says.

    The researchers are now planning to seek FDA approval to test the system in people with prosthetic limbs. They hope to use the sensor to control prostheses similar to the way surface EMG is used now: Measurements regarding the length of muscles will be fed into the control system of a prosthesis to help guide it to the position that the wearer intends.

    “The place where this technology fills a need is in communicating those muscle lengths and velocities to a wearable robot, so that the robot can perform in a way that works in tandem with the human,” Taylor says. “We hope that magnetomicrometry will enable a person to control a wearable robot with the same comfort level and the same ease as someone would control their own limb.”

    In addition to prosthetic limbs, those wearable robots could include robotic exoskeletons, which are worn outside the body to help people move their legs or arms more easily.

    The research was funded by the Salah Foundation, the K. Lisa Yang Center for Bionics at MIT, the MIT Media Lab Consortia, the National Institutes of Health, and the National Science Foundation.

    Resource : https://www.sciencedaily.com/releases/2022/10/221025150229.htm

    28Oct, 2022
    Comprehensive lithium battery solutions for smart security

    Under the rapid development trend of the IoT and artificial intelligence industry, smart security has gradually replaced traditional security and become the main development mode of the industry. EVE is committed to creating a safer and more reliable lithium battery solution.

    Relying on long-term research on application modes such as Bluetooth, LoRa, Wi-Fi, NB-IoT, and ZigBee, EVE’s products are widely used for smart motion sensors, smart door sensors, flammable gas detectors, smart smoke detectors, smart fire extinguishers, smart door locks, and so on.

    Power supply requirements for different applications:

    Advantages of lithium manganese dioxide batteries

    Lithium manganese dioxide batteries have the advantages of high energy density, no voltage delay, high power output capacity, low self-discharge rate, ultra-wide working temperature range and good environmental adaptability.

    • Low self-discharge rate

    The annual self-discharge rate of a CR2/3AL cell, measured by microcalorimeter, was less than 1% at 25℃. The ultra-low annual self-discharge rate can effectively ensure long battery life.

    • Excellent installed performance of smart smoke detector (CR2/3AL)

    EVE-CR2/3AL battery is installed in a smart smoke detector and perform weekly press tests to confirm that the detector is functioning properly.

    Load voltage variation trend of battery following installation of the smart smoke detector.

    After 10 years of installation, the load voltage of the battery is higher than 2.60V, which is typically used to determine low battery.

    • High capacity and current pulse discharge capability (CR123AH)

    The discharge capacity of the EVE-CR123AH battery is 1800mAh, which is a leading level of the industry.

    The EVE-CR123AH battery has the capability of continuous discharge more than 2000 times of 900mA pulse at 20℃.

    • Cylindrical lithium manganese battery series

    A fully automatic production line together with various inspection equipment (SEM, GC-MS, BET, ICP, and UL1642 and IEC60086 testing equipment etc.) can guarantee the quality of product. For the application of IoT devices, EVE has developed a series of industrial Li/MnO₂ batteries.

    Industrial Li/MnO₂ battery products:

    Conclusion

    Based on reliable design, advanced manufacturing technology, comprehensive testing, and standardized control, EVE gives full play to its technical advantages to produce lithium batteries for Smart Security. The CR battery solution has more than 11 years of industry application experience, can satisfy the standard of UL217 in smart Smoke Detectors Industry and IEC62368, with characteristics of high reliability and safety, long lifespan, low self-discharge rate, high pulse capability throughout the cycle life.

    Resource : https://www.iottechnews.com/news/2022/oct/10/comprehensive-lithium-battery-solutions-for-smart-security/

    27Oct, 2022
    Cybersecurity Skills for Beginners: How to Crack into the Industry

    What is cybersecurity, and why is it important?

    Cybersecurity is all about managing the confidentiality, integrity, and availability of information (known as the “CIA Triangle”) by protecting digital assets such as networks, applications, and databases against attackers. 

    Corporations regularly handle all sorts of sensitive data, such as personally identifiable information (PII), financial data, and trade secrets. Cybersecurity professionals are essential for protecting this data from increasingly sophisticated cyber threats. The means used to defend and attack assets are continually evolving. It’s up to cybersecurity talent to adapt to new technologies and potential attack vectors as the threat landscape evolves.

    Is cybersecurity a viable career?

    There is an incredible demand for cyber security skills, and that demand is not going away anytime soon. According to a 2019 report from Burning Glass, there was a 94% growth in the number of cybersecurity job postings since 2013. 

    To top it off, the US Bureau of Labor Statistics estimates a remarkable 32 percent growth from 2018-2028 for information security analysts – 27 percent greater than the average growth rate for all occupations combined. 

    Why is cybersecurity so high in demand? 

    Everyone has sensitive data

    Every company interacts with some form of sensitive data in their day-to-day operations. Even non-tech companies need to collect basic human resources information on their employees. This personally identifiable information (PII) carries significant monetary value for identity theft and other harmful acts, making it a hot commodity in the “dark web” of the internet.

    Meeting compliance

    Companies are required to take proactive cybersecurity measures to meet data privacy compliance requirements. The two major players, Europe’s General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), require that those with personal data in their custody take reasonable measures to keep that data safe. 

    Avoiding data breaches

    According to research from IBM and the Ponemon Institute, the average total cost of a data breach is $3.92M. These costs include damage to the company’s reputation, support for the victims of the data breach, legal fines, and the resources required to investigate the cause of the breach.

    There’s not only a high demand for cybersecurity professionals, but there’s also a significant shortage. 

    Aside from the zero percent unemployment rate mentioned in the Cybersecurity Ventures report, the 2019 Cybersecurity Workforce Study by (ISC)2 shows that the global cybersecurity workforce needs to grow by 145 percent demand for these skills.

    This disproportion in availability and demand has caused cybersecurity salaries to skyrocket; according to The State of Cybersecurity Hiring report from Burning Glass, the average advertised salary for a cybersecurity job is now $93,540.

    Now is an excellent time for upcoming talent to get the experience, training, and certification they need to fill the cyber security skills gap.

    What cybersecurity skills do you need to get a job? 

    An essential trait for anyone seeking cybersecurity roles is a profound thirst for knowledge and a strong sense of curiosity. The cyber threat landscape is continuously evolving, so if you are transitioning into this field, you need to be prepared to continually learn, unlearn, and relearn.

    Hard skills that’ll help you get a job

    Coding

    Understanding the basic principles of coding/scripting in languages such as HTML and Javascript will help you understand how applications and websites are made, providing you with valuable insights into how they are exploited by cyber attackers. You can also learn how to develop scripts in Bash, Shell, and Python that will be used to automate core processes in potential roles. We cover which programming languages you should learn in more depth later in the article.

    Networking

    Businesses use all different kinds of networks in their day-to-day operations. Learning the intricacies behind how to set up and maintain local area networks (LAN), wide area networks (WAN), virtual private networks (VPN) will go a long way, even if you’re not pursuing a dedicated sysadmin position.

    Applications

    Computer software and other applications are integral tools for businesses, so you’ll definitely come across them. By learning how to run, configure, and maintain common applications such as databases and web servers, you will be better prepared to improve the security of applications by testing vulnerabilities during development and deployment.

    Systems

    Systems are the bread-and-butter of cybersecurity. Learn everything you can about desktop and mobile systems by studying the unique characteristics of common operating systems and becoming comfortable navigating with command-line interfaces such as Linux’s Terminal or Windows’ Powershell.

    Other skills and experiences to help you get a job

    A diverse IT background

    It takes more than dedicated cybersecurity training courses to excel in this field. You need to learn as much as you can about IT to get a sense of the systems and processes that form the foundation of the technology you will be securing. 

    Diverse outside experience

    That said, there is incredible value in diverse knowledge outside of technology. Potential cybersecurity roles are so broad that the field benefits from non-tech backgrounds such as psychology, project management, marketing, and public relations. Soft skills are incredibly crucial for advocating for the security needs of the company and understanding the motives of cyber attackers.

    Critical thinking

    Cybersecurity will require you to analyze and prioritize complex situations. You’ll need to be skilled at identifying what could go wrong and determining the company’s best course of action based on its available capabilities and resources.

    Attention to detail

    Security pros are tasked with diving deep into technical issues and examining them. If you take on a security role, you’ll need to pay careful attention to minute details to diagnose and assess security vulnerabilities accurately.

    Communication

    In this field, you will not just be working with your security team, you’ll also need to advocate for the security needs of the company by clearly explaining your findings to those that are less tech-savvy. The ability to communicate highly technical concepts to a broad audience is critical for any successful cybersecurity professional. Other soft skills like leadership and public speaking are also essential, so take some online courses to brush up on those skills before your next interview. 

    Cybersecurity is not strictly technical. Roles that focus on the “human side,” such as privacy, security training, and ethics, are equally important for preventing data breaches and fighting cyber threats as their heavily technical counterparts.

    Does cybersecurity require programming?

    While coding is not essential for many entry-level cybersecurity jobs, programming skills and computer science knowledge will help expand your career options to mid and upper-level roles. Even for entry-level positions, the more knowledge you have of how things work, the better you’ll perform. 

    Becoming familiar with the concepts, languages, and tools of web and application development will help you understand how things are built, which will significantly improve your ability to find vulnerabilities and construct protections.

    What are the best programming and scripting languages to learn for cybersecurity?

    Python

    Learning how to write scripts and applications in Python will be incredibly useful for automating tasks and creating tools that can be used to solve problems in the workplace. Python is also incredibly helpful in creating digital forensics tools that you can use to troubleshoot and investigate security vulnerabilities. Here are some other cool things Python can do.

    Javascript

    Javascript is widely used in web development to add dynamic and interactive elements to websites. By learning this programming language for cybersecurity, you can effectively study the malicious executables used by hackers to exploit web security vulnerabilities.

    PHP

    Anyone venturing into web security needs to understand PHP. This server-side programming language is used to extract data from a database to create dynamic web pages.

    C and C++

    You should learn these languages if you will be pursuing application security. Understanding lower-level languages will provide you with more significant insights into the underlying processes that hackers use to exploit applications and programs.

    HTML

    While HTML is technically a markup language and not a programming language, it pays to know this fundamental building block of the web. 

    What education do you need to work in cybersecurity?

    You do not need a degree to work in cybersecurity. This field highly emphasizes applicable skills, real-life experiences, and genuine interest more than formal education. That said, there are highly valued and recognized.certifications that may be worth pursuing. 

    These certifications will improve how attractive your resume is to larger companies, and they’ll also provide you with the fundamental knowledge you’ll need to work in this field.

    Core certifications for cybersecurity jobs:

    While formal education can help develop core knowledge and build a resume, non-traditional career pathways are incredibly common in the cybersecurity space. Potential candidates need to emphasize developing relevant skills and hobbies that they can demonstrate to experienced IT recruiters.

    Non-traditional cybersecurity learning resources:

    • Networking: Attend meetings for local cybersecurity groups and participate in events from industry leaders such as The Information Systems Security Association (ISSA). 
    • Experience: Gain hands-on cybersecurity experience through Vulnhub projects, participating in the National Collegiate Cyber Defense Competition, and contributing code to open source projects through communities such as the Open Web Application Security Project (OWASP).
    • Hobbies: Having hobbies relevant to cybersecurity demonstrates a genuine interest to recruiters and helps you get the hands-on experience you need to shine through as a strong candidate. Try building a “lab” at home by configuring multiple virtual operating systems on your computer. Use your lab to practice setting up networks, testing security vulnerabilities, and researching new security tools.
    • Training courses: Regular skills development through courses and certifications will be a normal part of pursuing a career in this field. Online resources provide opportunities to build both foundational and specialist cybersecurity knowledge.

    Even once you’re established in cybersecurity, you’ll need to continuously adapt to new technologies and cyber threats as they emerge. This career is best suited for those that have a genuine passion for learning and challenging their skills.

    What cybersecurity careers are available?

    The cybersecurity field is incredibly diverse, with positions available for a wide variety of skills. Cybersecurity jobs can include identifying the security needs of business networks, analyzing software for security vulnerabilities, balancing the security and accessibility requirements of a database, or helping businesses become aware of their cybersecurity weaknesses. 

    Note: There is a great deal of overlap between general information technology (IT) roles and cybersecurity roles, but there are distinctions between them. For the most part, cybersecurity roles are focused on protecting electronic data and systems from being compromised. In contrast, general IT roles are more likely to be focused on making sure hardware, software, and network technologies are appropriately configured. 

    Here are just a few examples of potential roles in this field

    • Information Security Analyst: People in this role are responsible for protecting sensitive and critical data against cyber attackers. They analyze software, hardware, and networks for weaknesses and make recommendations for addressing them.
    • Automotive Cybersecurity Engineer: Anywhere there’s new tech, there’s a need for a cybersecurity specialist to help make it secure. The evolution of self-driving cars, cloud-based applications, and other technological advancements in automobiles means that cyber attackers have a potential entry point that will need to be secured by cybersecurity professionals.
    • Network and Computer Systems Administrators: Most commonly called sysadmins (“system administrators”), this role is critical for nearly every organization. Sysadmins set up and maintain the networks that are used to access data in day-to-day business operations securely.

    Can cybersecurity be a side-gig?

    Cybersecurity can be pursued as side-gig. Up-and-coming talent can gain much-needed experience and potentially earn some cash by participating in bounty hunting programs through platforms such as HackerOne. 

    In a bounty-hunting program, you can attempt to earn small cash payouts by discovering security vulnerabilities in applications, websites, and hardware. Companies voluntarily open bounty hunting programs to test their products and services for potential vulnerabilities, allowing them to improve the security of their offering in exchange for a modest payout.

    More experienced cybersecurity professionals will pursue freelance consulting roles where they can offer their expertise to businesses with specific and timely security needs. Freelance cybersecurity workers can perform targeted bounty hunting campaigns (known as penetration testing), or they can advise companies on the best practices they can take to implement new technology and systems in their organization securely.

    What’s next?

    The demand for cybersecurity is incredibly high right now, and there are ample resources to get the experience and skills you need to get started. Even without a formal college or university education, you can pursue a career in cybersecurity through practical projects, networking, and skills development through online training courses.

    If you’d like to break into cybersecurity, consider pursuing general IT roles to gain the core skills you’ll need to understand how systems, applications, and networks operate. With intimate knowledge of how core IT infrastructure interlinks and transmits data, you will have valuable insights that you can take with you as you learn how to manage security vulnerabilities.

    Want to further your skills and advance your career? Sign up for a GoSkills 7 day free trial today to get unlimited access to the full award-winning course library, including coding and soft skills courses to kick off your cybersecurity career.

    Resource : https://www.goskills.com/Development/Resources/Cyber-security-skills

    27Oct, 2022
    Better developer platforms are the key to better digital products

    The move to thinking about “products” instead of “projects” is to be welcomed when it comes to developer tooling. At a time when hiring and retaining talent — technical or otherwise — is one of the biggest concerns for organizations, paying attention to the needs of internal customers can only be a good thing. 

    However, for all the benefits of this turn to product-thinking, too often it can lack substance. This is particularly problematic when it comes to developer platforms; while the notion of “developer experience” — how development teams interact with their tools and platforms — is one that every organization needs to take seriously, it’s not enough to simply implement cross-functional teams (as important as that is) or go and purchase a platform on the back of positive noises from the wider software industry. These approaches might bring short-term benefits but their value is limited and potentially damaging over a long-term period. Done incorrectly, what was intended as empowering can become inflexible. 

    Developer platforms do indeed require a product approach. But this should mean a commitment to grasping the context of development work and a recognition of how that context (technical and organizational) will change and evolve over time. At a broader scale, this necessitates sensitivity to the work developers do and the role they play inside an organization: it’s ultimately impossible to develop an effective developer platform while retaining the view that technical teams are little more than a resource that builds and runs code on demand. 

    Aligning developer context with commercial goals

    But what does being sensitive to the work developers do actually look like? What does it involve?

    At one level it requires you to throw out any assumptions about what developers might need or how they might like to work. We need to start from the ground up and understand collaboration, tooling, processes, skills and culture.

    At Thoughtworks we advocate for a technique we call path-to-production mapping. Although this is a simple idea, in which teams will literally get together and draw all the steps required to make a change and then to push it to production —  we rarely see clients do it, which leaves developer pain points and inefficiencies uncovered and unaddressed. For teams too, it helps ensure there’s a shared understanding of how things are done. Ultimately, itt forces everyone, at multiple levels, to commit to finding out what developers actually do and what they need to accelerate the speed to value. This is a valuable foundation for any future platform development.

    At another level, we also need to articulate and acknowledge the wider goals and drivers of the organization. In other words, where do development teams add value? And how can they add value faster? 

    This will vary widely according to the type of organization. It’s for this reason that a preconceived idea of what a platform should be (ie., what features it should have) can be risky. It would be great to be able to just list examples of exemplary developer platforms — Spotify’s Backstage is, rightly, often held up here — but the issue is that there is no exemplary: a perfect developer platform in one context is an inflexible antipattern in another. Fundamentally, a good platform implements guardrails that allow developers to focus on what they do best: writing and shipping code. It should reduce team cognitive load, minimizing the risk of error and maximizing the time developers can spend on value-adding work.  

    The needs of software developers and the commercial demands of an organization are best managed or mediated by a product owner. This is a role that’s often overlooked. Not quite a Business Analyst, nor a strict development role, the Product Owner is an essential person in ensuring that developers are empowered and that they are also delivering value for the wider organization.

    Internal marketing

    It’s important, however, that capturing feature requirements isn’t viewed as the full extent of platform-as-product work. Attention to detail matters, but we need to be attentive to more than just the nuts and bolts of the platform — we need to make sure that the value of those nuts and bolts can be realized. That can only be done with a coherent and sustained internal marketing and communication strategy. 

    Again, what this looks like is contextual, driven by things like how an organization is composed, ways of working and modes of collaboration. There’s no single model of how different types or sizes of organization should go about this and it would be wrong to think about things in terms of an “enterprise way of doing things” or a “startup way of doing things.” However, some activities and artifacts that could be implemented — at the appropriate level of scale — include documentation (perhaps even a lightweight wiki), training sessions and clear communication channels to showcase updates and changes.

    Ultimately, good (internal) marketing is about ensuring customers are aware of the value the platform is meant to deliver, and how they can realize that value. Sometimes it’s tempting to think that if we’re approaching a platform as a product, its path to value should be seamless, as if any friction is indicative of a problem with the product. This is rarely the case — even the most well-considered platform products need to be marketed to their users. Intuitiveness is a good guiding principle when it comes to building a platform product, but it’s a principle that should come with a dose of humility — an awareness that it will never be perfectly intuitive.

    There is an important caveat: internal marketing shouldn’t be delivered as a top-down edict. Instead, it needs to be something that facilitates and enables dialogue between those driving a platform and those using it. Marketing should initiate dialogue, encouraging users to ask questions, request new features and raise issues.

    Evolution and change

    One of the challenges of developer platforms is that they shouldn’t be viewed as things that can just be built, launched and then forgotten about; they require constant evolution and maintenance. The feedback loops initiated by a considered communication strategy will help here, but it’s also important to consider the ways the platform evolves alongside the organization and emerging technologies.  

    A technique included for the first time on Volume 27 of our Technology Radar — incremental developer platforms — can be particularly useful as a way of responding to these multifaceted demands. Such an approach not only ensures alignment with the specific needs of users, it also prevents the platform from being derailed by over-ambition — something that typically stems from a preconceived vision of what the platform should look like. The virtues of an incremental approach to software is widely accepted by the industry — so why don’t we bring this thinking to the way we think about platforms and internal tooling?

    It’s time to acknowledge the experience of building software

    Developer platforms are far from the most visible or eye-catching part of the technology industry. Yet the way they are approached often reflects the extent to which software development is respected and valued within an organization. If building software really is key to delivering value then we also need to value the experience of doing it.

    Resource : https://www.thoughtworks.com/en-in/insights/blog/devops/better-developer-platforms-key-better-digital-products

    26Oct, 2022
    Security experts targeted with malicious CVE PoC exploits on GitHub

    Researchers discovered thousands of GitHub repositories that offer fake proof-of-concept (PoC) exploits for various flaws used to distribute malware.

    A team of researchers at the Leiden Institute of Advanced Computer Science (Soufian El Yadmani, Robin The, Olga Gadyatskaya) discovered thousands of repositories on GitHub that offer fake proof-of-concept (PoC) exploits for multiple vulnerabilities.

    The experts analyzed PoCs shared on GitHub for known vulnerabilities discovered in 2017-2021, some of these repositories were used by threat actors to spread malware.

    The experts pointed out that public code repositories do not provide any guarantees that any given PoC comes from a trustworthy source.

    “We discovered that not all PoCs are trustworthy. Some proof-of-concepts are fake (i.e., they do not actually offer PoC functionality), or even malicious: e.g., they attempt to exfiltrate data from the system they are being run on, or they try to install malware on this system.” reads the research paper published by the experts.

    The team focused on a set of symptoms observed in the collected dataset, such as calls to malicious IP addresses, encoded malicious code, or included Trojanized binaries. The boffins analyzed 47313 repositories and 4893 of them were malicious repositories (i.e. 10.3% of the studied repositories have symptoms of malicious intent).

    “This figure shows a worrying prevalence of dangerous malicious PoCs among the exploit code distributed on GitHub.” continues the paper.

    GitHub malicious repositories PoC exploits

    The researchers analyzed a total of 358277 IP addresses, 150734 of them were unique IPs and 2864 were blacklisted. 1,522 IP addressed were labeled as malicious by Virus Total, and 1,069 of them were listed in the AbuseIPDB database.

    Of the 150,734 unique IPs extracted, 2,864 matched blacklist entries. 1522 were detected as malicious in AV scans on Virus Total, and 1069 were present in the AbuseIPDB database.

    Most of the malicious detections are related to vulnerabilities from 2020.

    During their research the experts found multiple examples of malicious PoC developed for CVEs and shared some case studies.

    One of the examples is related to a PoC developed for the CVE-2019-0708, also known as BlueKeep.

    “This repository was created by a user under the name Elkhazrajy. The source code contains a base64 line that once decoded will be running. It contains another Python script with a link to Pastebin28 that will be saved as a VBScript, then run by the first exec command. After investigating the VBScript we discovered that it contains the Houdini malware.” continues the paper.

    Another example detailed by the experts is related to a malicious PoC designed to gather info about the target. In this case the URL to the server used for data exfiltration was base64-encoded.

    The boffins explained that their study has several limitations. For example the GitHub API proved unreliable and not all repositories corresponding to the used CVE IDs were collected.

    Another limitation is related to the use of heuristics for detecting malicious PoCs. Experts explained that the approach can miss some malicious PoCs in their dataset.

    “However, this approach cannot detect every malicious PoC based on source code, since it is always possible to find more creative ways to obfuscate it. We have investigated code similarity as a feature to help identifying new malicious repositories. Our results show that indeed malicious repositories are on average more similar to each other than non-malicious one.” conclude the experts. “This result is the first step to develop more robust detection techniques.”

    The researchers have shared their findings with GitHub and some of the malicious repositories have yet to be removed.

    Resource : https://securityaffairs.co/wordpress/137527/hacking/malicious-github-repositories.html

    26Oct, 2022
    Cybersecurity Awareness Month: 5 Actionable Tips

    Best practices for defeating against most attacks, hopefully making the need for future Cybersecurity Awareness Months obsolete

    Cybersecurity Awareness Month, which was previously known as National Cybersecurity Awareness Month, is in its 19th year. Launched under the guidance of the U.S. Department of Homeland Security and the National Cyber Security Alliance (NCSA), it aims to help Americans stay safe and secure online. This year’s campaign theme – See Yourself in Cyber – is focused on the “people” equation of cybersecurity, while promoting how to recognize and report phishing, the use of strong passwords, password managers and multi-factor authentication, and applying software updates. While these tactics are certainly a great place to start, organizations need to go beyond these fundamental steps to strengthen their cyber resilience.

    The last year has proven to be a game-changing year for cybersecurity: Cyber breaches are bigger and worse than ever. Hardly a week goes by without headlines about some new devastating cyberattack. In fact, the Federal Bureau of Investigation’s Internet Crime Report (PDF), saw a 7 percent increase in complaints, resulting in losses of nearly $6.9 billion. The surge in cyberattacks directly correlates to the broadened attack surface – specifically, the sudden shift to hybrid working. Cyber adversaries capitalized on the rapidly changing environment by intensifying their attacks and targeting the weakest link in the attack chain – the remote worker. Furthermore, professional hackers, cybercriminal syndicates, and nation-states are exploiting the supply chain, increasing their blast radius and overall damages.

    Implementing an effective enterprise security strategy requires an understanding of hackers’ tactics, techniques, and procedures (so-called TTPs). In this context, it is vital for security practitioners to review the entire cyberattack lifecycle to gain a full grasp of the areas that need to be addressed as part of an in-depth cyber defense approach.

    Here are five best practices for defeating against most attacks, hopefully making the need for future Cybersecurity Awareness Months obsolete. 

    Put your Trust in Zero Trust

    Zero Trust means trusting no one – not even known users, applications, or devices – until they have been verified and validated. Zero Trust principles help enterprises enforce dynamic, contextual network access policies to grant access for people, devices, or applications. This entails analyzing device postures, application health, network connection security, as well as user activity to subsequently enforce pre-defined policies at the endpoint rather than via a centralized proxy. 

    For most organizations, the path to Zero Trust should start with identity paired with endpoint resilience to create a more secure work-from-anywhere user population. Applying Zero Trust principles can help companies avoid becoming the next breach headline, including the brand damage, customer loss, and value degradation that typically comes with it.

    Focus on What Matters Most

    Gartner estimates that global spending on cybersecurity will hit almost $173 billion annually in 2022, yet the breaches keep on coming. That’s probably because a large chunk of that money is being funneled toward solutions that don’t address modern security problems and cover the ever-growing attack surface of modern enterprises. Hackers, for their part, are taking advantage of the fact that organizations and their workforce are relying on mobile devices, home computers, and laptops to connect to company networks to conduct business. In turn, these endpoint devices become the natural point of entry for many attacks. In fact, a recent Ponemon Institute survey revealed that 68 percent of organizations suffered a successful endpoint attack within the last 12 months.

    Understanding not just the tail end of the cyberattack kill chain, but also focusing on initial attack vectors like endpoints provides a roadmap for aligning preventive measures with today’s threats. It is vital to maintain granular visibility and control over access points to prevent and remediate vulnerabilities that can and often will surface on them. In today’s work-from-anywhere era, assuring endpoint resilience is a vital element of a successful in-depth cyber defense strategy.

    Secure your Network Access

    In today’s perimeter-less environment, security practitioners can no longer assume implicit trust among applications, users, devices, services, and networks. In fact, 51 percent of organizations have seen evidence of compromised endpoints being used to access company data via the corporate network. That’s why many organizations have started to embrace a Zero Trust approach and are considering augmenting their conventional network access security concepts such as virtual private networks (VPNs) and demilitarized zones (DMZs) with Zero Trust Network Access (ZTNA) solutions. 

    ZTNA solutions create an identity- and context-based, logical access boundary around an application or a set of applications. Access is granted to users based on a broad set of factors, for instance, the device being used, as well as other attributes such as the device posture (e.g., if anti-malware is present and functioning), time/date of the access request, and geolocation. Upon assessing the contextual attributes, ZTNA then dynamically offers the appropriate level of access at that specific time. Since risk levels of users, devices, and applications are constantly changing, access decisions are made for each individual access request.

    Balance your Security Investments

    It’s a fact that we can never eliminate cyber risk entirely, but we can manage it more effectively with “Left and Right of Boom” processes and procedures, creating a winning strategy by splitting an organization’s cybersecurity investments between strategic preparedness, prevention, and incident response. Finding the right balance has become essential in determining an organization’s ability to anticipate, withstand, recover from, and adapt to attacks, or compromises on cyber resources. Gartner, in its “Maverick Research: You Will be Hacked, So Embrace the Breach” report is emphasizing that “to make a real difference to the impact of cybersecurity incidents, cybersecurity priorities must shift from defensive strategies to the management of disruption through resilience.”

    Become Cyber Resilient

    More and more security professionals acknowledge that modern enterprise infrastructures are made up of large and complex entities, and therefore will always have flaws and weaknesses that adversaries will be able to exploit. In this context, they propagate the concept of cyber resilience to ensure that an adverse cyber event (intentional or unintentional, i.e., due to failed software updates) does not negatively impact the confidentiality, integrity, and availability of an organization’s business operations.

    Like Zero Trust, cyber resilience offers a blueprint to strengthen an organization’s security posture in today’s dynamic threatscape, establish security controls that require cyber adversaries to spend more time figuring out how to bypass them (which they often are unwilling to do, because time is money), and the means to recover from cyberattacks quickly and efficiently.

    Conclusion

    Organizations have to assume that bad actors are in their networks already. Before the next Cybersecurity Awareness Month comes along, companies across all industries should consider moving to a resilient Zero Trust approach, powered by additional security measures such as Zero Trust Network Access and endpoint resilience. Furthermore, they should balance their focus between preventive and responsive measures to a potential breach. This will help them stay ahead of the security curve and ultimately remove the need for an awareness month after all.

    Resource : https://www.securityweek.com/cybersecurity-awareness-month-5-actionable-tips

    25Oct, 2022
    GitLab patches RCE bug in GitHub import function

    A vulnerability in GitLab allowed attackers to stage various attacks against GitLab servers, including the cloud-hosted GitLab.com platform.

    The bug, reported by security researcher ‘yvvdwf’, was caused by the way GitLab imports data from GitHub, which could be exploited to run commands on the host server.

    Unsafe imports

    GitLab uses Octokit, a library that provides an interface to import data from the GitHub API. To retrieve and present its results, Octokit uses the HTTP client library Sawyer.

    However, GitLab directly used the Sawyer results returned by Octokit without sanitizing them, which provided opportunities to insert malicious commands.

    Yvvdwf found that one of the parameters used in the import function was prone to command injections against GitLab’s Redis database.

    RCE, information theft, and more

    On standalone GitLab installations, an attacker could exploit the command injection bug to escalate from Redis to Bash and send commands to the operating system. Any potential attacker would have remote code execution (RCE) access to the host with the privileges of the host process.

    While the RCE exploit did not work on GitLab.com, yvvdwf was able to use other Redis commands to replicate data from GitLab.com to a standalone server with a public IP. They were also able to poison GitLab projects through the same mechanism and make them inaccessible.

    An attacker with a standalone GitLab installation and an API access token could use the exploit to steal information, inject malicious code, and perform other malicious actions against GitLab.com.

    Protecting GitLab servers

    The vulnerability was assigned CVE-2022-2884 with a critical base score of 9.9 in the Common Vulnerability Scoring System.

    GitLab has already patched the issue in GitLab.com and published a critical security release for GitLab Community Edition and Enterprise Edition.

    All users are advised to upgrade their GitLab installation. For organizations that can’t upgrade right away, GitLab advises them to secure their installation by disabling imports until they can patch their system.

    While GitLab users will be safe by using the cloud or updated self-hosted version of the platform, other services that use Octakit to interact with GitHub should be wary and make sure that they perform the right checks around the data they pass on and receive through the library.

    Resource : https://portswigger.net/daily-swig/gitlab-patches-rce-bug-in-github-import-function

    25Oct, 2022
    Remote Control Tools Popular Among Cybercriminals

    Remote access tools have become a versatile support to organizations. However, these tools come with a risk; the risk of being used by cybercriminals against organizations. Here are some of the remote access tools they use, as delineated by AhnLab. 

    Remote shell

    • This is the most common remote access tool, which can be classified into reverse shell and blind shell. 
    • Once remote shell is deployed on a compromised system, the attacker can take over the victim system and execute commands. 
    • The latest version of the Ursnif banking trojan, dubbed LDR4, functions as a backdoor trojan and attempts to get VNC or remote shell into the infected machine.

    RATs

    • The most popular RATs sold on the dark web include RedLine Stealer, NanoCore, BitRAT, and Remcos RAT.
    • Apart from the above, another RAT is Gh0stCringe, a variant of Gh0st RAT. In March, Gh0st was found targeting Microsoft SQL and MySQL database servers.
    • Even attackers make their own backdoors, such as AppleSeed, NukeSped, and PebbleDash by Kimsuky and NukeSped groups. The North Korea-backed Lazarus APT was found abusing the Log4j vulnerability to ultimately drop the NukeSped backdoor for cyberespionage. 

    Cobalt Strike

    • Cobalt Strike is an offensive security tool used by red teams. However, attackers have been increasingly using it for their malicious activities. 
    • Recently, the HHS had warned against increased Cobalt Strike infections in the healthcare sector. The pentesting tool is exploited mostly by nation state-sponsored threat actors, including Mustang Panda, APT10, APT41, and Winnti. 
    • The Black Basta ransomware group has been using QAKBOT, Cobalt Strike, and Brute Ratel (another Red Teaming tool), for network intrusion. 

    AveMaria or Warzone RAT

    • Warzone RAT is usually delivered via spam emails. It can perform a multitude of tasks, including remote shell execution and  keylogging. 
    • In September, the Russian Sandworm APT group was spotted targeting Ukraine with commodity malware by pretending to be telecom providers. The end goal was to deploy Warzone RAT and Colibri Loader on critical systems.

    The bottom line

    Remote access tools are increasingly exploited as they can grant attackers to harm victims’ networks and systems in several ways. Therefore, security teams need to check normal authorized activities and enforce them. The adoption of a proactive cybersecurity strategy and implementing basic cybersecurity hygiene are critical to protecting an organization from security threats.

    Resource : https://cyware.com/news/remote-control-tools-popular-among-cybercriminals-96417414

    22Oct, 2022
    Network and IoT security in a zero trust security model

    You can never be too careful when it comes to network and IoT security. With a rapidly growing number of disparate devices being connected to corporate and industrial infrastructures, it’s better to be safe than sorry.

    For network administrators it is no longer only about protecting laptops and PCs, but rather about managing a network comprised of a colorful palette of connected hardware including mobile and low-cost IoT devices. But how can you possibly keep your network secure when every device plays by its own rules? The answer is (relatively) simple: TRUST NO ONE!

    This is where the concept of a “zero trust architecture” comes in, which is a security concept based on not trusting a device by default simply because it is part of your network. Instead, every device needs to authenticate itself for every connection it wants to establish. Given that any possible connection involves at least two parties, the authentication that is required here is called mutual authentication.

    There are different communication protocols that make use of mutual authentication, such as SSH and TLS. But what these protocols have in common is that the authentication is based on unique device certificates. Without such a certificate, a device cannot authenticate itself.

    How does a device get a certificate?

    It all starts with the device having its own unique public-private keypair. To generate a certificate, the first step is sharing the public key from this pair with a Certificate Authority (CA). The CA will verify that the public key belongs to this device, by sending it a challenge. Only the device that possesses the corresponding private key will be able to successfully respond to this challenge. Now the CA knows that the public key belongs to the device, and it will create a certificate for it.

    Once created, the certificate can be sent to the device, which is now able to use it in future authentication protocols on networks that consider the specific CA that has created the certificate a trusted source. This is something that makes the term “zero trust” a bit misleading. Even when you don’t trust the devices, there is something that you need to trust. In this case, the trust is based on the certificates and on the authority that provides them.

    But there is another aspect that is important to consider: the private key. The private key is the foundation on which all the security is built. It’s what ties the certificate to the device because anyone who wants to check the authenticity of the certificate can do this by challenging the private key. And because this private key is so important, it should always be stored securely inside the device.

    An attacker should never be able to read, alter or copy this private key, as that compromises the security of the entire network that the device is connected to. Keeping the private key private should be any device’s highest priority. And the network needs to trust (there’s that word again…) the device to be able to do so.

    How is the private key stored securely on the device?

    There are a few ways to do this, starting with the traditional use of secure hardware, like a Secure Element or a Trusted Platform Module. These are both secure chips that need to be added to the device and that take care of creating and securely storing keys. This is an acceptable solution for expensive devices such as phones and laptops but does not usually solve all security issues since limited parties have access to it. However, for low-cost IoT devices adding a secure chip to the bill of materials adds too much cost.

    A more affordable solution is storing the key pair in the memory of one of the chips the device already needs anyway, like a microcontroller. In this case the key pair can be externally provisioned during manufacturing, or it can be internally generated (if the chip has an internal random number generator). The major downside of this option is that chips for IoT devices are not designed for securely storing keys. This means that there is a serious risk of the private key being compromised by a determined attacker with access to the device. On top of this, when keys are injected from the outside, the party that injects those keys is another entity that needs to be trusted to keep the secrets secret.

    There is yet another an alternative to these traditional methods for generating and storing secret keys, and it’s based on physical unclonable functions (PUFs).

    PUFs use deep submicron variations in the manufacturing process of chips to create device unique identifiers. This means that PUFs can generate cryptographic keys (like the key pair we require) from the silicon of chips. These keys are unique for every chip, and they never have to be stored in memory – they are simply (re-)generated every time they are needed. This eliminates the need for externally provisioning keys as well as for using dedicated hardware for protecting stored keys.

    This is why the deployment of PUFs is gaining traction rapidly, especially for low-cost IoT devices. Using PUFs to create and protect the keys needed to generate device certificates provides the kind of trust that a zero-trust architecture requires.

    Conclusion

    Now that we have seen all different building blocks that are required to securely connect devices in a network, we can take a step back and see what we have learned.

    It all starts on the device level, where the foundation of a zero-trust architecture is established by selecting the right way to provision the device with the keys that are the basis for its unique certificate. The method of choice will vary depending on the hardware of individual devices.

    Different approaches provide different levels of security, but one thing that they all have in common is that they need to instill the appropriate level of trust that they will keep the private key private. When a device is equipped with a public-private key pair, a CA can provide the next piece of the puzzle by generating a certificate for the device. Once a device has this unique certificate, it is ready for the mutual authentication that is required to be allowed entrance in a secure way to a network built on a zero-trust architecture.

    Combining the assurance that is provided by the way cryptographic keys are stored with the trust that needs to be placed in the CA, it is safe to state that, at least in this case, there is no “zero trust” without trust.

    Resource : https://www.helpnetsecurity.com/2021/10/25/network-iot-security/?web_view=true