Archive
Scotiabank does it again
Beginning Jan. 1, 2020, the bank’s Canadian workforce will have a
total of five personal days and the flexibility to take them as needed,
in addition to existing sick and vacation days.
“Our people are our most important asset and their well-being is a
top priority for Scotiabank,” said Barbara Mason, chief human resources
officer, in a press release. “We strongly believe that by offering
employees greater flexibility to take time off to achieve greater
work-life balance, our employee population will be healthier and
happier, and therefore enabled to perform at their very best.”
Picard is back!
… and he is teaming up with 7 of 9!
Go borg GO! This is going to be so exciting… https://twitter.com/WIRED/status/1180899318024163328?s=09
Debit cards and TD are in trouble (again)
Toronto business owner loses $14K to technical glitch at mobile payment company.
https://www.cbc.ca/news/canada/toronto/mobile-payment-glitch-1.5300313
You may remember the post a few months ago that may be related…
Multi-stage, fileless Nodersok campaign delivers rare Node.js-based malware – Microsoft Security
If you are a security operations analyst, your job just got a whole lot harder.
Lock all your doors and keep your children inside; this one is hard to find…
Over 1 million Google Chrome users affected by Cookie Stuffing from two popular adblockers | Cyware Hacker News
If you have ever visited a webpage that took a really long time to load or was filled with ads all over the site, you may have already heard that you need an ad blocker. If you were not sure of which one to use, you might be a victim of a knock off; a piece of software that is created with a similar name to the original but one that can monetize you use of it and put you at risk.
Learn about how many Google Chrome users were tricked into installing fake extensions and why you need to be sure of the names which extensions you trust.
CWE – 2019 CWE Top 25 Most Dangerous Software Errors
If you are a software developer (and not living in a cave) you may already know about vulnerabilities but did you know that there is a list of the 25 most dangerous put out by Mitre?
Well they have released the new 2019 list and some of these might surprise you…
https://cwe.mitre.org/top25/archive/2019/2019_cwe_top25.html
Quality Of Code Doesn’t Matter Much In Open Source Contributions: Study
For those of you in the software industry, you may be shocked to learn that contributor reputation trumps good old fashioned peer review when it comes to committing code in your project in a study on open source projects. I suspect this might mirror the real world where tight deadlines and outsourced labor are regular parts of the workload.
https://fossbytes.com/quality-of-code-doesnt-matter-open-source-contributions/#
Warning! Proceed with caution ⚠
Culture is more important than money (but I do need to pay my bills).
If you are not lucky enough to work for a company that you value or one that values you, learn about a bold approach to employment where they only want the best and try to tell yourself that you wouldn’t want to work there…
Kubernetes – steady as she goes
Looks like the fine folks running the Kubernetes core have the results from an audit they did. As many of the infrastructure teams look to use this code to help manage clusters of computing resources, we would all benefit from learning what could possibly go wrong 😊.
Many of the recommendations in the report involve code clean-up, adding further testing and documentation, and making defaults more security conscious.
These basic recommendations would make it easier to patch and resolve problems when they are found.
It is important to note that there were five “high severity” findings that included problems with access control, authentication, timing, and data validation.
Here is a look at the big ones…
- An access control bypass of PodSecurityPolicy
- K8s does not facilitate certificate revocation
- HTTPS connections are not authenticated
- Time of check, time of use problem with moving PID
- Improperly patched directory traversal in kubectl cp
Keep in mind that some of these have already been resolved if you are already using 1.15 branches.
The report is definitely worth a read and can be found here.
Black Hat USA 2019: IBM X-Force Red Reveals New ‘Warshipping’ Hack To Infiltrate Corporate Networks
Imagine, shipping a disposable package to someone at the office in order to gain access to a phone, test lab or even the corporate wifi network?
It is now a reality and can be done for less than $100 bucks (shipping charges may apply)
Security Analyst - Jeff Soehner CISSP, GXPN,GPYC,GMOB,GCIH 