Monthly Archives: April 2022

Major technology companies are becoming faster at fixing security vulnerabilities, incentivized to close gaps for customers.

Vendors took an average of 52 days to fix security vulnerabilities in 2021, down from 80 days three years ago, data from Google's Project Zero show.

Between 2019 and 2021, Apple fixed 87% of its bugs in 90 days; Microsoft fixed 76% in the same period.

"The tech community is getting faster at fixing discovered security issues for a variety of reasons, including advancing DevOps and CI/CD technological advancements, adopting bug bounty programs into the mainstream, embracing open source platforms' security issue tracking, and Project Zero making an impact," said Eylam Milner, director, Argon Technology with Aqua Security.

There is a caveat to this progress. The largest tech companies handle their bug bounty programs differently than smaller or lesser-known companies.

"Companies such as Microsoft, Facebook, Oracle, Mozilla, and Linux are very different in the way they operate, let alone handle security issues, than most software vendors and open source projects," Milner said.

While the average time to fix a vulnerability has gone down, that could be a bit misleading based on the companies involved. On the other hand, trends like this often have a trickle-down effect that is making a positive impact across the tech industry at large.

"When a large tech company (e.g., Facebook) is forced to fix a security issue in 90 days, this puts the company in a position to innovate with in-house organizational structure, engineering culture, and even new technology solutions," said Milner.

The engineering community at large often mimics big tech innovators, moving forward the way the entire community handles security issue fixing.

While the tech industry is getting better at remediating vulnerabilities in a more timely manner, the need to fix problems is not trickling down to the organizations using the software. If a customer lacks urgency in deploying a patch, a flaw can linger.

Even though members of the security community evangelize the importance of defined security patching processes and procedures as part of an overall security policy, there is still a knowledge gap, according to Matt Carpenter, senior principal security researcher with GRIMM.

"One of the core components of a good security policy is knowing what technologies/assets your organization maintains, and having regular patching intervals, processes and written procedures," Carpenter said.

Although companies realize the value of automated updates and regular automated checks and reports for out-of-date machines, less-security mature companies fall behind.

No matter how good tech companies have become at assessing vulnerabilities, there is always room for improvement. Adding automated application security solutions is key for diving deeper into vulnerability assessment and remediation.

"It's impossible for software consumers and vendors to handle a large amount of security risk in large codebases without an automated process for detection, remediation and prevention," said Milner.

The next step is to teach organizations to partner with trusted security companies in a long-term strategy, which helps reduce both risk and cost in the long term.

"For example, each organization should have a Security Architecture Review or similarly Threat And Risk Assessment (TARA) from a trusted and knowledgeable external security company," said Carpenter.

While informative, for assessments to add the most value, organizations should put together an internal security team with a top executive onboard, such as a CSO, CIO or CTO, to act as a liaison with the external assessment group.

This ensures assessment findings are communicated throughout the company and the necessary remediation steps can happen.

It's important to have clear strategies for both addressing general asset management, according to Daniel Trauner, senior director of security with Axonius.

"Without an asset management strategy, you might not even be aware that there's a patch to apply," Trauner said.

And if patches aren't applied in a timely manner, the quick remediation time of vulnerability remediation by tech companies won't do much good to prevent attacks

More:

Big tech is fixing bugs faster. Will that influence trickle down? - CIO Dive

OPINION:

The last few weeks have not been good for the corporate media or anyone who values the principle of free speech on social media. From Hunter Bidens laptop to the bogus Russian dossier, to COVID-19 vaccines and transgender issues, glaring errors of journalism and stringent thought control have been proven, once again, to always flow in one direction.

The Washington Post became the latest media outlet to belatedly confirm the authenticity of Hunters laptop, nearly a year and a half after his emails and texts surfaced late in the 2020 presidential election. These materials had been derided by most media as Russian disinformation for 17 months.

The Post story followed The New York Times, which two weeks earlier inserted its own confirmation of the laptop into the 24th paragraph of a report about the ongoing federal investigation into Hunters lucrative, habitual selling of access to his powerful father, now-President Joe Biden.

But still unexamined by the media are the emails that link Mr. Biden to Hunters international business schemes.

Even so, the burst of reporting birthed a segment on CNN, previously unthinkable there, in which senior legal analyst Elie Honig intoned that the case building against Hunter represents a very real, very substantial investigation of potentially serious federal crimes, creating a realistic chance this could result in federal charges.

In the wake of this grudging journalism came news from the Federal Election Commission that Hillary Clintons 2016 campaign and the Democratic National Committee were fined a total of $113,000 for improperly disclosing how they paid for the infamous Steele Dossier. The fabricated opposition research document was central to the now-discredited Russian collusion hoax that most media and Democrats in Congress used to undermine the first two years of former President Donald Trumps administration.

Silicon Valley also got in on the action, and as a consultant to GETTR, a new free speech platform, I pay close attention to what happens on social media.

Twitter reminded us that it still wields unchecked power to stifle free speech by suspending journalist John Solomons account for linking to his own story about a peer-reviewed COVID-19 vaccine study.

Mr. Solomon reported on research from Swedens Lund University, which has worked closely with the National Institutes of Health and the World Health Organization, examining how the Pfizer vaccine interacts with liver cells.

Despite the studys appearance in Current Issues in Molecular Biology, a respected medical journal, Twitter ruled that Mr. Solomon had violated its policy on spreading misleading and potentially harmful information related to COVID-19.

Apparently, Twitter is now staffed by expert molecular scientists who feel empowered to invalidate complex medical research.

To this point, defenders of the social media oligarchs have claimed that they run private companies, and so can enforce whatever rules they want. But what about when the government is the entity which instigates the censorship?

White House press secretary Jen Psaki has already admitted that the Biden administration flags selected social media posts and certain accounts for Facebook, identifying them as spreaders of COVID-19 misinformation. Its unknown if Mr. Solomons tweet was singled out by the White House, but at the very least, the executive branchs engagement in censorial activity emboldens tech companies and is precisely the sort of overreach the First Amendment is intended to prohibit.

And Twitter has been on a suspension rampage of late, targeting conservative accounts over the alleged misgendering of transgender people.

The satirical website Babylon Bee, commentator Charlie Kirk and Fox News host Tucker Carlson were all locked out of their Twitter accounts for various offenses involving tweets about Rachel Levine, an official in the Biden administration who is transgender.

Rep. Vicky Hartzler, a congresswoman from Missouri who is running for the U.S. Senate in that state, was suspended for tweeting her television ad about University of Pennsylvania swimmer Lia Thomas, a biological male who has been dominating womens collegiate swimming.

At the end of this troubling period of overdue reporting and crackdowns on free expression all of which displayed bias against conservatives there was at least the chance for reporters to ask the White House about the revelations contained in the presidents sons computer.

Biden communications director Kate Bedingfield handled the White House press briefing on Tuesday and Wednesday this week, which was good timing since she had dismissed the laptop as Russian misinformation during the closing days of the 2020 presidential race.

Only, not a single reporter asked her about it.

But why would they? Most of them agreed with her back then and dont want to admit their error now.

But is a tiny bit of objectivity really too much to ask?

Tim Murtaugh is a Washington Times columnist and the founder and principal of Line Drive Public Affairs, a communication consulting firm.

See the original post:

Media and Big Tech censorship is alive and well - Washington Times

Power Movesis a column where we chart the comings and goings of talent across the region. Got a new hire, gig or promotion? Email us: pittsburgh@technical.ly.

This week, serial founder and entrepreneur Lynsie Campbell announced that she would leave her role as startup czar for the Pittsburgh Regional Alliance after starting six months ago to fully commit to growing her new startup studio, Better Work Ventures (formerly named Hooman).

While Ive met a lot of great people during my time with PRA, Ive found (to no surprise) that I cant just talk about making things better for founders in the region. I have to do something about it, she wrote on Twitter. Im an executor and a builder. I need results.

Outside of building Better Work Ventures, Campbell is also the general partner of seed stage investment firm The Fund Midwest, as well as the founder of past startups LaneSpotter and ShowClix and the author of a book on entrepreneurship, This Better Work. Shes also an active voice on social media detailing her own entrepreneurial journeys as well as pointing out challenges that exist for several founders looking to grow their companies in Pittsburgh.

Carnegie Mellon University announced the list of honorary degree recipients for its 2022 commencement ceremony, which will take place this spring on May 13 to 15. The names encompass leaders in creative, entrepreneurial, public, scholarly and technology-minded pursuits, notably including hometown hero and CMU alumnus Billy Porter, who will receive a doctor of fine arts degree and deliver the commencement address for bachelors degree graduates.

In the realm of technology, honorary degree recipients includes chemistry Nobel Laureate Frances Arnold, who will receive a doctor of science and technology degree, and Portugal Minister for Science, Technology and High Education Manuel Heitor, who will receive the same degree. Both of these recipients will also present keynote addresses to graduate students at commencement.

Additional honorary degree recipients in the realm of tech and include university professor of computer science and robotics and Moza Bint Nasser chair in CMUs School of Computer Science, Raj Reddy, who will receive a doctor of science and technology, as well as US Army Reserve Command Chief of Army Reserve and Commanding General Lt. Gen. Jody Daniels, who is a CMU alumna herself and will receive the same doctorate degree as Reddy. And in the realm of business and entrepreneurship, Jim Rohr, the retired executive chairman and former CEO of PNC Financial Services Group, will receive a doctor of business practice.

This years honorary degree recipients and keynote speakers are among todays most accomplished changemakers, artists and innovators, CMU President Farnam Jahaniansaid in a statement.As we prepare to celebrate the achievements of three classes of CMU graduates, showcasing the impact and leadership of these honorees will help to make Commencement 2022 a truly exciting and historic occasion.

Ganeshan Venkateshwaran. (Photo via LinkedIn)

Pittsburgh-headquartered digital transformation IT service provider Mastech Digitalannounced that Ganeshan Venkateshwaran would be appointed as the CEO of Mastech InfoTrellis, a subsidiary of Mastech Digital that leverages enterprise data for business intelligence. A press release noted that Venkateshwarans role will focus on growing the data and analytics services segment of the company by providing new services and expanding its global footprint. Previously, Venkateshwaran worked as an executive at both Trianz and Wipro Technologies.

I am excited to join Mastech, with its rich history as a technology services innovator, dating back to the iGate Corporation years, he said in a statement. Today, the company is squarely in the middle of the digital transformation space, which is ripe with innovative solution opportunities. Im thrilled to have the opportunity to lead Mastech InfoTrellis in its journey to capture the next wave of growth by creating value for our customers and providing our employees with positive career experiences and personal advancement.

The Women in Manufacturing Education Foundation announced 22 new members that had been elected to its board of directors for 2022, with terms beginning on April 1. The North American nonprofit is a part of the Women in Manufacturing Association, and serves as the larger organizations arm for providing educational opportunities to women interested in manufacturing careers.

The foundation named four new first-term members to the board, including representatives from Amazon Web Services, Novelis and PLZ Corp. Among a number of board members listed as continuing their service for the foundation was Michel Conklin, who is the executive director of Pittsburghs BotsIQ, a manufacturing workforce development program for high school students.

On behalf of the entire WiM organization, I am excited to welcome this new group of leaders to the WiMEF Board of Directors, said the foundations president, Allison Grealis, in a statement. I look forward to working with them to continue developing and delivering effective and affordable programming that helps women advance in their industry careers.

Founded in 2015, Pittsburgh startup Knotzland aims to make use of the millions of tons of textiles wasted every year by turning them into bowties and other accessories. And this weekend, founder and CEO Nisha Blackwell shared that one of the companys bowties made its Oscars debut on the neck of Danny Glover.

Ive learned many times over my 30+ years on this planet that, while you can not choose the cards you were dealt at birth, your upbringing, or predetermined socioeconomic opportunities; you can choose to show up, work hard, be consistent, study your craft and the greats that come before you, Blackwell wrote in a post on LinkedIn. The movement may be slower and the road will not be straight, narrow, or easy, but the fruits will be so much sweeter!!

A number of staff members at CMUs College of Engineering will begin a professional development program hosted by the university called CIT Leads. Now in its fifth consecutive year, CIT Leads brings together managers, leaders and other contributors to go through seven experiential learning models in a way that minimizes additional work for participants outside of the classroom. By assessing emotional intelligence and DISC (dominance, influence, steadiness and conscientiousness) profiles of each participant, the program enables staff members to better understand their leadership styles and how that might fit or conflict with others.

This will help them create better work productivity, transform conflict into collaboration, and become more effective people leaders, said Samuel Boyer, founder and leader of CIT Leads, in a press release on the news. The release did not specifically mention the timeline of the program or the names of this years participants.

Originally posted here:

Power Moves: A new focus for Lynsie Campbell and big tech names on CMU's list of honorary degree recipients - Technical.ly