Daniel Bavaro

This article lists off some popular security models that companies can pull from when building software for a certain market sector. Also in the article, it describes the importance of having a multidisciplinary software development team. If everybody thinks the same and has similar goals, then the software will have security holes. The article suggests having people on the team that are focused on: data privacy, user design, quality assurance, software security and testing. All of these people can have useful input that can direct the path of the project.

https://www.business.com/articles/how-to-maintain-data-privacy-during-software-development/

https://www.darkreading.com/attacks-breaches/baltimore-reportedly-had-no-data-backup-process-for-many-systems/d/d-id/1335953

This was an interesting read about a recent ransomware attack to hit the Baltimore government. Apparently, the attack resulted in large losses of key/critical data, that was only stored on user’s local computers. There are a few issues here and the article dives into each of them. First, why were users storing critical/key data locally on their computers? This data should have been stored in a centralized location. Second, this obviously was not a one-off situation. For the government to lose a lot of this data, it was not just a few people not following policies. This was a systemic method for storing and manipulating data. Is the IT department to blame for not implementing a workstation backup solution, to address this systemic problem? The data stored centrally was able to recover from the ransomware attack, but the workstation data was not.

I had never heard the term: DevSecOps, so this article seemed interesting to me. This concept is a fairly new initiate that bring security personnel into the DevOps software development process, much earlier than they normally would be. This allows for security needs to be respected, all throughout the software development life cycle. In some software development circles, security is an afterthought. This new technique will hopefully prove to be the best overall solution.

https://www.darkreading.com/risk/devsecops-recreating-cybersecurity-culture–/a/d-id/1335783

https://thehackernews.com/2019/04/xiaomi-antivirus-app.html

I have always been a fan of Android over iOS, but I found this headline to be too awesome to pass up. Certain Xiaomi phones come pre-loaded with an Antivirus app suite called Guard Provider. The main feature of Guard Provider is that it helps to facilitate you choosing an antivirus app, from a list of 3: Avast, AVL or Tencent. I supposed they did this, so that they didn’t have to develop an antivirus app themselves, but also didn’t want to prevent the customers from being able to have some flexibility in which AV app they wanted to use. Not sure why they would do this, since Android let’s you add and remove apps as you please, for the most part. The problem with Guard Provider is that it used an unsecure HTTP connection for downloading AV signature updates and it also allowed the 3 SDKs from the 3 AV apps to co-exist and talk to each other. This combination could allow an attacker to perform and man in the middle attacker over that HTTP connection and slip malware into the download. They also apparently found a way to exploit that connection, so that they could access the user’s pictures, videos and other data. The software has since been patched.

https://www.forbes.com/sites/forbestechcouncil/2019/09/05/cybersecurity-regulations-10-ways-to-encourage-employee-compliance/#81189acead3d

I found this to be interesting, because one of the major hurdles that organizations face is that the employees pose a large risk to information security. If staff are not trained well, they can be the gateway to either initiating a threat or being duped into allowing an attacker inside. The struggle is often not about coming up with good policies, but is about getting employees to adopt them. This article introduces some nice ideas for how to fix that.