as Frederick Douglass and Harriet Jacobs: American Slave Narrators By nationalhumanitiescenter.org Published On :: Wed, 17 Mar 2010 15:11:23 -0400 New essay by Lucinda MacKethan just added to Freedom's Story: Teaching African American Literature and History, TeacherServe from the National Humanities Center. Full Article
as The New Negro and the Black Image: From Booker T. Washington to Alain Locke By nationalhumanitiescenter.org Published On :: Tue, 02 Nov 2010 16:22:54 -0400 New essay, "The New Negro and the Black Image: From Booker T. Washington to Alain Locke," by Henry Louis Gates, Jr., the Alphonse Fletcher University Professor and the Director of the W. E. B. Du Bois Institute for African and African American Research at Harvard University, added to Freedom's Story: Teaching African American Literature and History, TeacherServe from the National Humanities Center. Full Article
as Research Assistant/ Research Analyst I By phf.tbe.taleo.net Published On :: Wed, 24 Jul 2024 13:45:28 GMT Job Summary: The International Food Policy Research Institute (IFPRI) seeks a qualified candidate to serve as a Research Assistants/ Research Analyst I in its Development Strategies and Governance Unit for the Sudan Strategy Support Program. This is a one-year, renewable appointment. The successful candidates will work with senior research staff in the analysis of agriculture, rural development, food and nutrition security and related policies and other research activities including research work related to the ensuing conflict in Sudan. The incumbent will work under the overall guidance of the IFPRI Sudan Program Leader but will be employed directly by IFPRl's organizational host, the Arab Organization for Agricultural Development (AOAD) - employment policies, compensation, and benefits of AOAD will apply to this position. Interested applicants must have authorization to work in Sudan. The final grade level will be determined by level of education and years of relevant work experience. Essential Duties: Specific Duties include but are not limited to: Assist the collection of primary and secondary data, Asist build large dataset from multiple sources, Assist to analyze data using advance analytical methods, Assist in conducting literature reviews and synthesis, Assist in drafting and translating reports, research papers, and blog posts between English and Arabic languages, Assist in capacity building and support outreach activities, Assist to coordinate projects and conduct other duties as assigned. Required Qualifications: Research Assistant: Bachelor's or its equivalent in Economics, Agricultural Economics, Statistics, or closely related fields, Research Analyst: Bachelor’s degree plus two years of relevant professional experience or Master’s degree in a relevant discipline, Excellent knowledge of macroeconomic and/or microeconomic theory, Excellent knowledge of and quantitative econometric methods and/or economic modeling, Excellent knowledge of Stata and/or GAMS, Excellent analytical mind and drafting skills, Demonstrated fluency in written and spoken English and Arabic , Excellent interpersonal skills and to work in a team-oriented multi-cultural environment, Demonstrated ability to multi-task, meet deadlines, and manage time, Demonstrated professional level of attention to detail and accuracy of work, Ability to work independently and take initiative, Willingness to travel. Preferred Qualifications: Previous experience conducting research on and collecting data in Sudan. Familiarity with the literature on economic and agriculture development, food security, poverty reduction and related fields. Previous experience related to policy analysis and impact evaluation. Experience with spatial analysis and ARC-GIS. Experience with policy communication activities and events organization. Experience with managing websites and updating their contents. Experience in academia, the private sector, a development-oriented organization, or comparable institution, Physical Demand & Work environment Employee will sit in an upright position for a long period of time. Employee will lift between 0-10 pounds. Employee is required to have close visual acuity to perform activities such as: preparing and analyzing data and figures; transcribing; viewing computer terminal; extensive reading. Full Article
as Associate Research Fellow / Research Fellow By phf.tbe.taleo.net Published On :: Thu, 17 Oct 2024 14:57:57 GMT Job Summary The International Food Policy Research Institute (IFPRI) seeks a qualified candidate to serve as an Associate Research Fellow or Research Fellow. This is a two-year, renewable, exempt appointment based at IFPRI’s Washington, DC Office. The ideal candidate will have demonstrated aptitude with modeling water resources and hydrologic systems at multiple scales, experience in developing and operating modeling suites that link biophysical and economic models, and interest/experience in the analysis of risk and uncertainty. The successful candidate will work on interdisciplinary teams to conduct research, produce high-impact publications and disseminate knowledge that (for example): assists national level policy-making units confront the challenges posed by climate change and water constraints; fosters regional strategies for resilient growth and development in a context of climate change; works with CGIAR partners on research and/or model development, particularly in IWMI; and assists key agri-food system actors in low- and middle-income countries (LMICs) and other constituencies in the formation of investment plans in water resources, including in relation to food and energy. Specific areas of research are expected to be developed in accordance with the intersection of the interests and skills of the successful candidate and the objectives of the Foresight and Policy Modeling Unit. It is anticipated that about 80 percent of the job will be dedicated to applied research, and the remaining 20 percent will be allocated to capacity-building, policy engagement, and outreach activities supporting evidence-based decision-making. Essential Duties Specific duties include but are not limited to: · Lead development, maintenance, and improvement of IFPRI’s water data and modeling systems compatible with global (IMPACT) and national levels (RIAPA). · Contribute to scenario development, modeling and analytics supporting a variety of foresight-related research projects. · Lead focused studies on water-related issues relevant for food system transformation globally and in LMICs. · Work with other modelers in the Foresight and Policy Modeling unit to maintain and improve water modeling components of established modeling frameworks. · Conduct research in the service of the CGIAR’s mission to advance positive transformation of food, land, and water systems. · Support efforts to strengthen the capacity of partner organizations and networks to conduct scholarly research and communicate evidence-based policy recommendations. · Prepare project reports, research papers, presentations, and peer-reviewed journal articles in collaboration with CGIAR researchers, other collaborators, and partners. · Regularly communicate research outputs via policy seminars, policy briefs, and peer-reviewed publications to a broad spectrum of stakeholders, including researchers, academics, policymakers, and government officials. · The successful candidate will work with a multi-disciplinary and multi-cultural team of researchers and is expected to engage in a broad range of research projects and activities consistent with the research program of the Foresight and Policy Modeling Unit. Required Qualifications · PhD in Water Resources Engineering, Hydrology, or closely related field · Significant expertise in using water resources systems and hydrologic models and experience or interest to link these to economic and other simulation models at global, regional and national levels to evaluate policies related to food, land, and water systems. · Demonstrated capabilities in quantitative analysis and ability to use spatial data and methods in innovative and policy-relevant ways to examine water resource management issues in the context of climate change and other major drivers. · Ability or willingness to work in the GAMS modeling environment and code, other math/statistical programming languages, and GIS. · Experience using river basin modeling tools, (e.g. Mike Hydro Basin, WEAP, and Riverware). · Strong interpersonal skills and ability to work well both with a team and independently. · Ability to work in a dynamic environment, take initiatives to resolve issues and effectively work with minimal supervision. · Excellent written and verbal communication skills in English. · Willingness to travel extensively (including internationally) as required. Preferred Qualifications · Ability to work in Python. · Relevant research experience as applied to LMIC country contexts in Africa, Asia, and/or Latin America. · Demonstrated ability to produce high-quality written reports, oral presentations, blog posts, and/or other forms of written and oral communications associated with scholarly research outputs. Additional requirements at the Research Fellow level · At least 3 years of post-PhD experience relevant to the job and demonstrated fundraising experience. · Strong publication record in peer-reviewed journals. · Major external recognition within professional peer network based on publications and other leadership activities. · Demonstrated leadership skills and successful experience building and managing teams. Physical Demand & Work environment · Employee will sit in an upright position for a long period of time · Employee will lift between 0-10 pounds. · Employee is required to have close visual acuity to perform activities such as: preparing and analyzing data and figures; transcribing; viewing computer terminal; extensive reading. Salary Range : The expected salary range for this job requisition is between $85,600 - $107,000. In determining your salary, we will consider your experience and other job-related factors. Benefits : IFPRI is committed to providing our staff members with valuable and competitive benefits, as it is a core part of providing strong overall employee experience. This position is eligible for health insurance coverage and a summary of our benefits can be found on our website . Please note that the listed benefits are generally available to active, non-temporary, full-time and part-time US-based employees who work at least 25 hours per week. The International Food Policy Research Institute (IFPRI) is an equal employment opportunity employer - F/M/Disability/Vet/Sexual Orientation/Gender Identity. Full Article
as Assessing social media impact – a workshop at ScienceOnline #scioimpact By www.nature.com Published On :: Mon, 28 Jan 2013 15:00:33 +0000 Assessing social media impact was one of the workshop sessions at November’s SpotOn London conference, Full Article Featured Outreach Tools #scio13 #scioimpact
as Measures for Advancing Gender Equality (MAGNET) Website By www.youtube.com Published On :: Wed, 26 Jun 2024 14:10:42 GMT Full Article
as TV Interview | Purnima Menon at the UN General Assembly By www.youtube.com Published On :: Wed, 2 Oct 2024 16:44:08 GMT Full Article
as From Bugs to Breaches: 25 Significant CVEs As MITRE CVE Turns 25 By www.tenable.com Published On :: Tue, 22 Oct 2024 11:11:11 -0400 Twenty five years after the launch of CVE, the Tenable Security Response Team has handpicked 25 vulnerabilities that stand out for their significance.BackgroundIn January 1999, David E. Mann and Steven M. Christey published the paper “Towards a Common Enumeration of Vulnerabilities” describing an effort to create interoperability between multiple vulnerability databases. To achieve a common taxonomy for vulnerabilities and exposures, they proposed Common Vulnerabilities and Exposures (CVE). In September 1999, the MITRE Corporation finalized the first CVE list, which included 321 records. CVE was revealed to the world the following month.As of October 2024, there are over 240,000 CVEs. including many that have significantly impacted consumers, businesses and governments. The Tenable Security Response Team has chosen to highlight the following 25 significant vulnerabilities, followed by links to product coverage for Tenable customers to utilize.25 Significant CVEsCVE-1999-0211: SunOS Arbitrary Read/Write VulnerabilityArbitrary ReadArbitrary WriteLocalCritical1999Why it’s significant: To our knowledge, there is no formally recognized “first CVE.” However, the GitHub repository for CVE.org shows that the first CVE submitted was CVE-1999-0211 on September 29, 1999 at 12:00AM. Because it was the first one, we’ve chosen to highlight it. The vulnerability was first identified in 1991 and a revised patch was issued in 1994.CVE-2010-2568: Windows Shell Remote Code Execution VulnerabilityRemote Code ExecutionExploitedZero-DayLocalStuxnetHigh2010Why it’s significant: Regarded as one of the most sophisticated cyberespionage tools ever created, Stuxnet was designed to target SCADA systems in industrial environments to reportedly sabotage Iran's nuclear program. Stuxnet exploited CVE-2010-2568 as one of its initial infection vectors, spreading via removable drives. Once a compromised USB drive was inserted into a system, Stuxnet was executed automatically via the vulnerability, infecting the host machine, propagating to other systems through network shares and additional USB drives.CVE-2014-0160: OpenSSL Information Disclosure VulnerabilityHeartbleedInformation DisclosureExploitedZero-DayNetworkCybercriminalsHigh2014Why it’s significant: Dubbed “Heartbleed” because it was found in the Heartbeat extension of OpenSSL, this vulnerability allows an attacker, without prior authentication, to send a malicious heartbeat request with a false length field, claiming the packet contains more data than it does. The receiving system would then return data from its memory extending beyond the legitimate request, which may include sensitive private data, such as server keys and user credentials. OpenSSL is used by millions of websites, cloud services, and even VPN software, for encryption, making Heartbleed one of the most widespread vulnerabilities at the time.CVE-2014-6271: GNU Bash Shellshock Remote Code Execution VulnerabilityShellshock Bash Bug Remote Code ExecutionExploitedZero-DayNetworkCybercriminalsCritical2014Why it’s significant: An attacker could craft an environment variable that contained both a function definition and additional malicious code. When Bash, a command interpreter used by Unix-based systems including Linux and macOS, processed this variable, it would execute the function, but also run the arbitrary commands appended after the function definition. “Shellshock” quickly became one of the most severe vulnerabilities discovered, comparable to Heartbleed’s potential impact. Attackers could exploit Shellshock to gain full control of vulnerable systems, leading to data breaches, service interruptions and malware deployment. The impact extended far beyond local systems. Bash is used by numerous services, particularly web servers, via CGI scripts to handle HTTP requests.CVE-2015-5119: Adobe Flash Player Use After FreeRemote Code Execution Denial-of-ServiceExploitedZero-DayCybercriminalsAPT GroupsCritical2015Why it’s significant: Discovered during the Hacking Team data breach, it was quickly weaponized, appearing in multiple exploit kits. CVE-2015-5119 is a use-after-free flaw in Flash’s ActionScript ByteArray class, allowing attackers to execute arbitrary code by tricking users into visiting a compromised website. It was quickly integrated into attack frameworks used by Advanced Persistent Threat (APT) groups like APT3, APT18, and Fancy Bear (APT28). These groups, with ties to China and Russia, used the vulnerability to spy on and steal data from governments and corporations. Fancy Bear has been associated with nation-state cyber warfare, exploiting Flash vulnerabilities for political and military intelligence information gathering. This flaw, along with several other Flash vulnerabilities, highlighted Flash’s risks, accelerating its eventual phase-out.CVE-2017-11882: Microsoft Office Equation Editor Remote Code Execution VulnerabilityRemote Code ExecutionExploitedNetworkCybercriminalsAPT GroupsHigh2017Why it’s significant: The vulnerability existed for 17 years in Equation Editor (EQNEDT32.EXE), a Microsoft Office legacy component used to insert and edit complex mathematical equations within documents. Once CVE-2017-11882 became public, cybercriminals and APT groups included it in maliciously crafted Office files. It became one of 2018’s most exploited vulnerabilities and continues to be utilized by various threat actors including SideWinder.CVE-2017-0144: Windows SMB Remote Code Execution VulnerabilityEternalBlueRemote Code ExecutionExploitedNetworkWannaCry NotPetyaHigh2017Why it’s significant: CVE-2017-0144 was discovered by the National Security Agency (NSA) and leaked by a hacker group known as Shadow Brokers, making it widely accessible. Dubbed “EternalBlue,” its capacity to propagate laterally through networks, often infecting unpatched machines without human interaction, made it highly dangerous. It was weaponized in the WannaCry ransomware attack in May 2017 and spread globally. It was reused by NotPetya, a data-destroying wiper originally disguised as ransomware. NotPetya targeted companies in Ukraine before spreading worldwide. This made it one of history’s costliest cyberattacks.CVE-2017-5638: Apache Struts 2 Jakarta Multipart Parser Remote Code Execution VulnerabilityRemote Code ExecutionExploitedNetworkEquifax BreachCritical2017Why it’s significant: This vulnerability affects the Jakarta Multipart Parser in Apache Struts 2, a popular framework for building Java web applications. An attacker can exploit it by injecting malicious code into HTTP headers during file uploads, resulting in remote code execution (RCE), giving attackers control of the web server. CVE-2017-5638 was used in the Equifax breach, where personal and financial data of 147 million people was stolen, emphasizing the importance of patching widely-used frameworks, particularly in enterprise environments, to prevent catastrophic data breaches.CVE-2019-0708: Remote Desktop Services Remote Code Execution VulnerabilityBlueKeep DejaBlue Remote Code ExecutionExploitedNetworkRansomware GroupsCybercriminalsCritical2019Why it’s significant: Dubbed "BlueKeep," this vulnerability in Windows Remote Desktop Services (RDS) was significant for its potential for widespread, self-propagating attacks, similar to the infamous WannaCry ransomware. An attacker could exploit this flaw to execute arbitrary code and take full control of a machine through Remote Desktop Protocol (RDP), a common method for remote administration. BlueKeep was featured in the Top Routinely Exploited Vulnerabilities list in 2022 and was exploited by affiliates of the LockBit ransomware group.CVE-2020-0796: Windows SMBv3 Client/Server Remote Code Execution VulnerabilitySMBGhost EternalDarknessRemote Code ExecutionExploited NetworkCybercriminalsRansomware GroupsCritical2020Why it’s significant: Its discovery evoked memories of EternalBlue because of the potential for it to be wormable, which is what led to it becoming a named vulnerability. Researchers found it trivial to identify the flaw and develop proof-of-concept (PoC) exploits for it. It was exploited in the wild by cybercriminals, including the Conti ransomware group and its affiliates.CVE-2019-19781: Citrix ADC and Gateway Remote Code Execution VulnerabilityPath TraversalExploitedNetworkAPT GroupsRansomware GroupsCybercriminalsCritical2019Why it’s significant: This vulnerability in Citrix Application Delivery Controller (ADC) and Citrix Gateway is significant due to its rapid exploitation by multiple threat actors, including state-sponsored groups and ransomware affiliates. By sending crafted HTTP requests, attackers could gain RCE and take full control of affected devices to install malware or steal data. The vulnerability remained unpatched for a month after its disclosure, leading to widespread exploitation. Unpatched systems are still being targeted today, highlighting the risk of ignoring known vulnerabilities.CVE-2019-10149: Exim Remote Command Execution VulnerabilityRemote Command ExecutionExploitedNetworkAPT GroupsCybercriminalsCritical2019Why it’s significant: This vulnerability in Exim, a popular Mail Transfer Agent, allows attackers to execute arbitrary commands with root privileges simply by sending a specially crafted email. The availability of public exploits led to widespread scanning and exploitation of vulnerable Exim servers, with attackers using compromised systems to install cryptocurrency miners (cryptominers), launch internal attacks or establish persistent backdoors. The NSA warned that state-sponsored actors were actively exploiting this flaw to compromise email servers and gather sensitive information.CVE-2020-1472: Netlogon Elevation of Privilege VulnerabilityZerologonElevation of PrivilegeExploitedLocalRansomware GroupsAPT GroupsCybercriminalsCritical2020Why it’s significant: This vulnerability in the Netlogon Remote Protocol (MS-NRPC) allows attackers with network access to a Windows domain controller to reset its password, enabling them to impersonate the domain controller and potentially take over the entire domain. Its severity was underscored when Microsoft reported active exploitation less than two months after disclosure and the Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency directive to patch the flaw. Despite available patches, it continues to be exploited by ransomware groups, APT groups, and others, highlighting its broad and ongoing impact on network security.CVE-2017-5753: CPU Speculative Execution Bounds Check Bypass VulnerabilitySpectreSpeculative Execution Bounds Check BypassLocalMedium2018Why it’s significant: In a speculative execution process, an idle microprocessor waiting to receive data speculates what the next instruction might be. Although meant to enhance performance, this process became a fundamental design flaw affecting the security of numerous modern processors. In Spectre’s case, an attacker-controlled process could read arbitrary memory belonging to another process. Since its discovery in January 2018, Spectre has affected nearly all modern processors from Intel, AMD and ARM. While it’s difficult to execute a successful Spectre attack, fully remediating the root cause is hard and requires microcode as well as operating system updates to mitigate the risk.CVE-2017-5754: CPU Speculative Execution Rogue Data Cache Load VulnerabilityMeltdownSpeculative Execution Rogue Data Cache LoadLocalHigh2018Why it’s significant: Meltdown, another speculative execution vulnerability released alongside Spectre, can allow a userspace program to read privileged kernel memory. It exploits a race condition between the memory access and privilege checking while speculatively executing instructions. Meltdown impacts desktop, laptop and cloud systems and, according to researchers, may affect nearly every Intel processor released since 1995. With a wide reaching impact, both Spectre and Meltdown sparked major interest in a largely unexplored security area. The result: a slew of research and vulnerability discoveries, many of which were also given names and logos. While there’s no evidence of a successful Meltdown exploit, the discovery showcased the risk of security boundaries enforced by hardware.CVE-2021-36942: Windows LSA Spoofing VulnerabilityPetitPotamSpoofingExploitedZero-DayNetworkRansomware GroupsHigh2021Why it’s significant: This vulnerability can force domain controllers to authenticate to an attacker-controlled destination. Shortly after a PoC was disclosed, it was adopted by ransomware groups like LockFile, which have chained Microsoft Exchange vulnerabilities with PetitPotam to take over domain controllers. Patched in the August 2021 Patch Tuesday release, the initial patch for CVE-2021-36942 only partially mitigated the issue, with Microsoft pushing general mitigation guidance for defending against NTLM Relay Attacks.CVE-2022-30190: Microsoft Windows Support Diagnostic Tool Remote Code ExecutionFollinaRemote Code ExecutionExploitedZero-DayLocalQakbot RemcosHigh2022Why it’s significant: Follina, a zero-day RCE vulnerability in MSDT impacting several versions of Microsoft Office, was later designated CVE-2022-30190. After public disclosure in May 2022, Microsoft patched Follina in the June 2022 Patch Tuesday. After disclosure, reports suggested that Microsoft dismissed the flaw’s initial disclosure as early as April 2022. Follina has been widely adopted by threat actors and was associated with some of 2021’s top malware strains in a joint cybersecurity advisory from CISA and the Australian Cyber Security Centre (ACSC), operating under the Australian Signals Directorate (ASD).CVE-2021-44228: Apache Log4j Remote Code Execution VulnerabilityLog4ShellRemote Code ExecutionExploitedNetworkCybercriminalsAPT GroupsCritical2021Why it’s significant: Log4j, a Java logging library widely used across many products and services, created a large attack surface. The discovery of CVE-2021-44228, dubbed “Log4Shell,” caused great concern, as exploitation simply requires sending a specially crafted request to a server running a vulnerable version of Log4j. After its disclosure, Log4Shell was exploited in attacks by cryptominers, DDoS botnets, ransomware groups and APT groups including those affiliated with the Iranian Islamic Revolutionary Guard Corps (IRGC).CVE-2021-26855: Microsoft Exchange Server Server-Side Request Forgery VulnerabilityProxyLogonServer-Side Request Forgery (SSRF)ExploitedZero-DayNetworkAPT Groups Ransomware GroupsCybercriminalsCritical2021Why it’s significant: CVE-2021-26855 was discovered as a zero-day along with four other vulnerabilities in Microsoft Exchange Server. It was exploited by a nation-state threat actor dubbed HAFNIUM. By sending a specially crafted HTTP request to a vulnerable Exchange Server, an attacker could steal the contents of user mailboxes using ProxyLogon. Outside of HAFNIUM, ProxyLogon has been used by ransomware groups and other cybercriminals. Its discovery created a domino effect, as other Exchange Server flaws, including ProxyShell and ProxyNotShell, were discovered, disclosed and subsequently exploited by attackers.CVE-2021-34527: Microsoft Windows Print Spooler Remote Code Execution VulnerabilityPrintNightmareRemote Code ExecutionExploitedLocalAPT GroupsRansomware GroupsCybercriminalsHigh2021Why it’s significant: This RCE in the ubiquitous Windows Print Spooler could grant authenticated attackers arbitrary code execution privileges as SYSTEM. There was confusion surrounding the disclosure of this flaw, identified as CVE-2021-34527 and dubbed “PrintNightmare.” Originally, CVE-2021-1675, disclosed in June 2021, was believed to be the real PrintNightmare. However, Microsoft noted CVE-2021-1675 is “similar but distinct” from PrintNightmare. Since its disclosure, several Print Spooler vulnerabilities were disclosed, while a variety of attackers, including the Magniber and Vice Society ransomware groups exploited PrintNightmare.CVE-2021-27101: Accellion File Transfer Appliance (FTA) SQL Injection VulnerabilitySQL InjectionExploitedZero-DayNetworkRansomware GroupCritical2021Why it’s significant: The file transfer appliance from Accellion (now known as Kiteworks) was exploited as a zero-day by the CLOP ransomware group between December 2020 and early 2021. Mandiant, hired by Kiteworks to investigate, determined that CLOP (aka UNC2546) exploited several flaws in FTA including CVE-2021-27101. This was CLOP’s first foray into targeting file transfer solutions, as they provide an easy avenue for the exfiltration of sensitive data that can be used to facilitate extortion.CVE-2023-34362: Progress Software MOVEit Transfer SQL Injection VulnerabilitySQL InjectionExploitedZero-DayNetworkRansomware GroupCritical2023Why it’s significant: CLOP’s targeting of file transfer solutions culminated in the discovery of CVE-2023-34362, a zero-day in Progress Software’s MOVEit Transfer, a secure managed file transfer software. CLOP targeted MOVEit in May 2023 and the ramifications are still felt today. According to research conducted by Emsisoft, 2,773 organizations have been impacted and information on over 95 million individuals has been exposed as of October 2024. This attack underscored the value in targeting file transfer solutions.CVE-2023-4966: Citrix NetScaler and ADC Gateway Sensitive Information Disclosure VulnerabilityCitrixBleedInformation DisclosureExploitedZero-DayNetworkRansomware GroupsAPT GroupsCritical2023Why it’s significant: CVE-2023-4966, also known as “CitrixBleed,” is very simple to exploit. An unauthenticated attacker could send a specially crafted request to a vulnerable NetScaler ADC or Gateway endpoint and obtain valid session tokens from the device’s memory. These session tokens could be replayed back to bypass authentication, and would persist even after the available patches had been applied. CitrixBleed saw mass exploitation after its disclosure, and ransomware groups like LockBit 3.0 and Medusa adopted it.CVE-2023-2868: Barracuda Email Security Gateway (ESG) Remote Command Injection VulnerabilityRemote Command InjectionExploitedZero-DayNetworkAPT GroupsCritical2023Why it’s significant: Researchers found evidence of zero-day exploitation of CVE-2023-2868 in October 2022 by the APT group UNC4841. While Barracuda released patches in May 2023, the FBI issued a flash alert in August 2023 declaring them “ineffective,” stating that “active intrusions” were being observed on patched systems. This led to Barracuda making an unprecedented recommendation for the “immediate replacement of compromised ESG appliances, regardless of patch level.”CVE-2024-3094: XZ Utils Embedded Malicious Code VulnerabilityEmbedded Malicious CodeZero-DayUnknown Threat Actor (Jia Tan)Critical2024Why it’s significant: CVE-2024-3094 is not a traditional vulnerability. It is a CVE assigned for a supply-chain backdoor discovered in XZ Utils, a compression library found in various Linux distributions. Developer Andres Freund discovered the backdoor while investigating SSH performance issues. CVE-2024-3094 highlighted a coordinated supply chain attack by an unknown individual that contributed to the XZ GitHub project for two and a half years, gaining the trust of the developer before introducing the backdoor. The outcome of this supply chain attack could have been worse were it not for Freund’s discovery.Identifying affected systemsA list of Tenable plugins for these vulnerabilities can be found on the individual CVE pages:CVE-1999-0211CVE-2010-2568CVE-2014-0160CVE-2014-6271CVE-2015-5119CVE-2017-11882CVE-2017-0144CVE-2017-5638CVE-2019-0708CVE-2020-0796CVE-2019-19781CVE-2019-10149CVE-2020-1472CVE-2017-5753CVE-2017-5754CVE-2021-36942CVE-2022-30190CVE-2021-44228CVE-2021-26855CVE-2021-34527CVE-2021-27101CVE-2023-34362CVE-2023-4966CVE-2023-2868CVE-2024-3094 Full Article
as CVE-2024-47575: Frequently Asked Questions About FortiJump Zero-Day in FortiManager and FortiManager Cloud By www.tenable.com Published On :: Wed, 23 Oct 2024 16:37:56 -0400 Frequently asked questions about a zero-day vulnerability in Fortinet’s FortiManager that has reportedly been exploited in the wild.BackgroundThe Tenable Security Response Team (SRT) has compiled this blog to answer Frequently Asked Questions (FAQ) regarding a zero-day vulnerability in Fortinet’s FortiManager.Update October 23: The blog has been updated with new information about in-the-wild exploitation and threat actor activity associated with this vulnerability.View Change LogFAQWhat is FortiJump?FortiJump is a name given to a zero-day vulnerability in the FortiGate-FortiManager (FGFM) protocol in Fortinet’s FortiManager and FortiManager Cloud. It was named by security researcher Kevin Beaumont in a blog post on October 22. Beaumont also created a logo for FortiJump.What are the vulnerabilities associated with FortiJump?On October 23, Fortinet published an advisory (FG-IR-24-423) for FortiJump, assigning a CVE identifier for the flaw.CVEDescriptionCVSSv3CVE-2024-47575FortiManager Missing authentication in fgfmsd Vulnerability9.8What is CVE-2024-47575?CVE-2024-47575 is a missing authentication vulnerability in the FortiGate to FortiManager (FGFM) daemon (fgfmsd) in FortiManager and FortiManager Cloud.How severe is CVE-2024-47575?Exploitation of FortiJump could allow an unauthenticated, remote attacker using a valid FortiGate certificate to register unauthorized devices in FortiManager. Successful exploitation would grant the attacker the ability to view and modify files, such as configuration files, to obtain sensitive information, as well as the ability to manage other devices.Obtaining a certificate from a FortiGate device is relatively easy:Commentby from discussioninfortinet According to results from Shodan, there are nearly 60,000 FortiManager devices that are internet-facing, including over 13,000 in the United States, over 5,800 in China, nearly 3,000 in Brazil and 2,300 in India:When was FortiJump first disclosed?There were reports on Reddit that Fortinet proactively notified customers using FortiManager about the flaw ahead of the release of patches, though some customers say they never received any notifications. Beaumont posted a warning to Mastodon on October 13:Post by @GossiTheDog@cyberplace.socialView on Mastodon Was this exploited as a zero-day?Yes, according to both Beaumont and Fortinet, FortiJump has been exploited in the wild as a zero-day. Additionally, Google Mandiant published a blog post on October 23 highlighting its collaborative investigation with Fortinet into the “mass exploitation” of this zero-day vulnerability. According to Google Mandiant, they’ve discovered over 50 plus “potentially compromised FortiManager devices in various industries.”Which threat actors are exploiting FortiJump?Google Mandiant attributed exploitation activity to a new threat cluster called UNC5820, adding that the cluster has been observed exploiting the flaw since “as early as June 27, 2024.”Is there a proof-of-concept (PoC) available for this vulnerability/these vulnerabilities?As of October 23, there are no public proof-of-concept exploits available for FortiJump.Are patches or mitigations available for FortiJump?The following table contains a list of affected products, versions and fixed versions.Affected ProductAffected VersionsFixed VersionFortiManager 6.26.2.0 through 6.2.12Upgrade to 6.2.13 or aboveFortiManager 6.46.4.0 through 6.4.14Upgrade to 6.4.15 or aboveFortiManager 7.07.0.0 through 7.0.12Upgrade to 7.0.13 or aboveFortiManager 7.27.2.0 through 7.2.7Upgrade to 7.2.8 or aboveFortiManager 7.47.4.0 through 7.4.4Upgrade to 7.4.5 or aboveFortiManager 7.67.6.0Upgrade to 7.6.1 or aboveFortiManager Cloud 6.46.4 all versionsMigrate to a fixed releaseFortiManager Cloud 7.07.0.1 through 7.0.12Upgrade to 7.0.13 or aboveFortiManager Cloud 7.27.2.1 through 7.2.7Upgrade to 7.2.8 or aboveFortiManager Cloud 7.47.4.1 through 7.4.4Upgrade to 7.4.5 or aboveFortiManager Cloud 7.6Not affectedNot ApplicableFortinet’s advisory provides workarounds for specific impacted versions if patching is not feasible. These include blocking unknown devices from attempting to register to FortiManager, creating IP allow lists of approved FortiGate devices that can connect to FortiManager and the creation of custom certificates. Generally speaking, it is advised to ensure FGFM is not internet-facing.Has Tenable released any product coverage for these vulnerabilities?A list of Tenable plugins for this vulnerability can be found on the individual CVE page for CVE-2024-47575 as they’re released. This link will display all available plugins for this vulnerability, including upcoming plugins in our Plugins Pipeline.Get more informationBurning Zero Days: FortiJump FortiManager vulnerability used by nation state in espionage via MSPsFortiGuard Labs PSIRT FG-IR-24-423 AdvisoryChange LogUpdate October 23: The blog has been updated with new information about in-the-wild exploitation and threat actor activity associated with this vulnerability.Join Tenable's Security Response Team on the Tenable Community.Learn more about Tenable One, the Exposure Management Platform for the modern attack surface. Full Article
as FY 2024 State and Local Cybersecurity Grant Program Adds CISA KEV as a Performance Measure By www.tenable.com Published On :: Thu, 31 Oct 2024 09:00:00 -0400 The CISA Known Exploited Vulnerabilities (KEV) catalog and enhanced logging guidelines are among the new measurement tools added for the 2024 State and Local Cybersecurity Grant Program.Last month, the Department of Homeland Security announced the availability of $279.9 million in grant funding for the Fiscal Year (FY) 2024 State and Local Cybersecurity Grant Program (SLCGP). Now in its third year, the four-year, $1 billion program provides funding for State, Local and Territorial (SLT) governments to implement cybersecurity solutions that address the growing threats and risks to their information systems. Applications must be submitted by December 3, 2024.While there are no significant modifications to the program for FY 2024, the Federal Emergency Management Agency (FEMA), which administers SLCGP in coordination with the Cybersecurity and Infrastructure Security Agency (CISA), identified key changes, some of which we highlight below:The FY 2024 NOFO adds CISA’s KEV catalog as a new performance measure and recommended resourceThe FY 2024 notice of funding opportunity (NOFO) adds the CISA Known Exploited Vulnerabilities (KEV) catalog as a recommended resource to encourage governments to regularly view information related to cybersecurity vulnerabilities confirmed by CISA, prioritizing those exploited in the wild. In addition, CISA has added “Addressing CISA-identified cybersecurity vulnerabilities” to the list of performance measures it will collect through the duration of the program.Tenable offers fastest, broadest coverage of CISA’s KEV catalogAt Tenable, our goal is to help organizations identify their cyber exposure gaps as accurately and quickly as possible. To achieve this goal, we have research teams around the globe working to provide precise and prompt coverage for new threats as they are discovered. Tenable monitors and tracks additions to the CISA KEV catalog on a daily basis and prioritizes developing new detections where they do not already exist.Tenable updates the KEV coverage of its vulnerability management products — Tenable Nessus, Tenable Security Center and Tenable Vulnerability Management — allowing organizations to use KEV catalog data as an additional prioritization metric when figuring out what to fix first. The ready availability of this data in Tenable products can help agencies meet the SLCGP performance measures. This blog offers additional information on Tenable’s coverage of CISA’s KEV catalog.FY 2024 NOFO adds “Adopting Enhanced Logging” as a new performance measureThe FY 2024 NOFO also adds “Adopting Enhanced Logging” to the list of performance measures CISA will collect throughout the program duration.How Tenable’s library of compliance audits can help with Enhanced LoggingTenable's library of Compliance Audits, including Center for Internet Security (CIS) and Defense Information Systems Agency (DISA), allows organizations to assess systems for compliance, including ensuring Enhanced Logging is enabled. Tenable's vulnerability management tools enable customers to easily schedule compliance scans. Users can choose from a continuously updated library of built-in audits or upload custom audits. By conducting these scans regularly, organizations can ensure their systems are secure and maintain compliance with required frameworks.FY 2024 NOFO continues to require applicants to address program objectives in their applicationsAs with previous years, the FY 2024 NOFO sets four program objectives. Applicants must address at least one of the following in their applications:Objective 1: Develop and establish appropriate governance structures, including by developing, implementing, or revising Cybersecurity Plans, to improve capabilities to respond to cybersecurity incidents, and ensure operations.Objective 2: Understand their current cybersecurity posture and areas for improvement based on continuous testing, evaluation, and structured assessments.Objective 3: Implement security protections commensurate with risk.Objective 4: Ensure organization personnel are appropriately trained in cybersecurity, commensurate with responsibility.How Tenable can help agencies meet Objective 2 of the programTenable is uniquely positioned to help SLTs meet Objective 2 through the Tenable One Exposure Management Platform. In addition to analyzing traditional IT environments, Tenable One analyzes cloud instances, web applications, critical infrastructure environments, identity access and privilege solutions such as Active Directory and more — including highly dynamic assets like mobile devices, virtual machines and containers. Once the complete attack surface is understood, the Tenable One platform applies a proactive risk-based approach to managing exposure, allowing SLT agencies to successfully meet each of the sub-objectives outlined in Objective 2 (see table below).Sub-objectiveHow Tenable helps2.1.1: Establish and regularly update asset inventoryTenable One deploys purpose-built sensors across on-premises and cloud environments to update inventories of human and machine assets, including cloud, IT, OT, IoT, mobile, applications, virtual machines, containers and identities2.3.2. Effectively manage vulnerabilities by prioritizing mitigation of high-impact vulnerabilities and those most likely to be exploited.Tenable One provides an accurate picture of both internal and external exposure by detecting and prioritizing a broad range of vulnerabilities, misconfiguration and excessive permissions across the attack surface.Threat intelligence and data science from Tenable Research are then applied to give agencies easy-to-understand risk scores. For example, Tenable One provides advanced prioritization metrics and capabilities, asset exposure scores which combine total asset risk and asset criticality, cyber exposure scoring which calculates overall exposure for the organization, peer benchmarking for comparable organizations, as well as the ability to track SLAs and risk patterns over time.Further, Tenable One provides rich critical technical context in the form of attack path analysis that maps asset, identity and risk relationships which can be exploited by attackers. It also provides business context by giving users an understanding of the potential impact on the things that matter most to an agency, such as business critical apps, services, processes and functions. These contextual views greatly improve the ability of security teams to prioritize and focus action where they can best reduce the potential for material impact. These advanced prioritization capabilities, along with mitigation guidance, ensure high-risk vulnerabilities can be addressed quickly.2.4.1 SLT agencies are able to analyze network traffic and activity transiting or traveling to or from information systems, applications, and user accounts to understand baseline activity and identify potential threats.Tenable provides purpose-built sensors, including a passive sensor, which can determine risk based on network traffic. After being placed on a Switched Port Analyzer (SPAN) port or network tap, the passive sensor will be able to discover new devices on a network as soon as they begin to send traffic, as well as discover vulnerabilities based on, but not limited to:ServicesUser-agentsApplication traffic2.5.1 SLT agencies are able to respond to identified events and incidents, document root cause, and share information with partners.Tenable One can help SLT agencies respond to identified events and incidents and document root cause more quickly. SOC analysts managing events and incidents and vulnerability analysts focused on remediation of vulnerabilities have access to deep technical content in the form of attack paths, with risk and and configuration details to verify viability, as well as business context to understand the potential impact to their agency.This information is valuable not only to validate why IT teams should prioritize mitigation of issues before breach, but to prove that a successful attack has occurred. Further, agencies can deliver dashboards, reports and scorecards to help share important security data in meaningful ways across teams and with partners. Agencies are able to customize these to show the data that matters most and add details specific to their requirements. Source: Tenable, October 2024Tenable One deployment options offer flexibility for SLT agenciesTenable offers SLT agencies flexibility in their implementation models to help them best meet the requirements and objectives outlined as part of the SLCGP. Deployment models include:Centralized risk-based vulnerability program managed by a state Department of Information Technology (DoIT)Multi-entity projectsDecentralized deployments of Tenable One managed by individual municipalities,Managed Security Service Provider (MSSP) models that allow agencies to rapidly adopt solutions by utilizing Tenable’s Technology Partner network.Whole-of-state approach enables state-wide collaboration and cooperationA “whole-of-state” approach — which enables state-wide collaboration to improve the cybersecurity posture of all stakeholders — allows state governments to share resources to support cybersecurity programs for local government entities, educational institutions and other organizations. Shared resources increase the level of defense for SLTs both individually and as a community and reduce duplication of work and effort. States get real-time visibility into all threats and deploy a standard strategy and toolset to improve cyber hygiene, accelerate incident response and reduce statewide risk. For more information, read Protecting Local Government Agencies with a Whole-of-State Cybersecurity Approach.FY 2024 NOFO advises SLT agencies to adopt key cybersecurity best practicesAs in previous years, the FY 2024 NOFO again recommends SLT agencies adopt key cybersecurity best practices. To do this, they are required to consult the CISA Cross-Sector Cybersecurity Performance Goals (CPGs) throughout their development of plans and projects within the program. This is also a statutory requirement for receiving grant funding.How Tenable One can help agencies meet the CISA CPGsThe CISA CPGs are a prioritized subset of cybersecurity practices aimed at meaningfully reducing risk to critical infrastructure operations and the American people. They provide a common set of IT and operational technology (OT) fundamental cybersecurity best practices to help SLT agencies address some of the most common and impactful cyber risks. Learn more about how Tenable One can help agencies meet the CISA CPGs here.Learn more$1 Billion State and Local Cybersecurity Grant Program Now Open for ApplicantsProtecting Local Government Agencies with a Whole-of-State Cybersecurity ApproachHow to Meet FY 2023 U.S. State and Local Cybersecurity Grant Program ObjectivesNew U.S. SLCGP Cybersecurity Plan Requirement: Adopt Cybersecurity Best Practices Using CISA's CPGsStudy: Tenable Offers Fastest, Broadest Coverage of CISA's KEV Catalog Full Article
as Cybersecurity Snapshot: Apply Zero Trust to Critical Infrastructure’s OT/ICS, CSA Advises, as Five Eyes Spotlight Tech Startups’ Security By www.tenable.com Published On :: Fri, 01 Nov 2024 09:00:00 -0400 Should critical infrastructure orgs boost OT/ICS systems’ security with zero trust? Absolutely, the CSA says. Meanwhile, the Five Eyes countries offer cyber advice to tech startups. Plus, a survey finds “shadow AI” weakening data governance. And get the latest on MFA methods, CISO trends and Uncle Sam’s AI strategy.Dive into six things that are top of mind for the week ending Nov. 1.1 - Securing OT/ICS in critical infrastructure with zero trustAs their operational technology (OT) computing environments become more digitized, converged with IT systems and cloud-based, critical infrastructure organizations should beef up their cybersecurity by adopting zero trust principles.That’s the key message of the Cloud Security Alliance’s “Zero Trust Guidance for Critical Infrastructure,” which focuses on applying zero trust methods to OT and industrial control system (ICS) systems.While OT/ICS environments were historically air gapped, that’s rarely the case anymore. “Modern systems are often interconnected via embedded wireless access, cloud and other internet-connected services, and software-as-a-service (SaaS) applications,” reads the 64-page white paper, which was published this week.The CSA hopes the document will help cybersecurity teams and OT/ICS operators enhance the way they communicate and collaborate. Among the topics covered are:Critical infrastructure’s unique threat vectorsThe convergence of IT/OT with digital transformationArchitecture and technology differences between OT and ITThe guide also outlines this five-step process for implementing zero trust in OT/ICS environments:Define the surface to be protectedMap operational flowsBuild a zero trust architectureDraft a zero trust policyMonitor and maintain the environmentA zero trust strategy boosts the security of critical OT/ICS systems by helping teams “keep pace with rapid technological advancements and the evolving threat landscape,” Jennifer Minella, the paper’s lead author, said in a statement.To get more details, read:The report’s announcement “New Paper from Cloud Security Alliance Examines Considerations and Application of Zero Trust Principles for Critical Infrastructure”The full report “Zero Trust Guidance for Critical Infrastructure”A complementary slide presentationFor more information about OT systems cybersecurity, check out these Tenable resources: “What is operational technology (OT)?” (guide)“Discover, Measure, and Minimize the Risk Posed by Your Interconnected IT/OT/IoT Environments” (on-demand webinar)“How To Secure All of Your Assets - IT, OT and IoT - With an Exposure Management Platform” (blog)“Blackbox to blueprint: The security leader’s guidebook to managing OT and IT risk” (white paper)“Tenable Cloud Risk Report 2024” (white paper)2 - Five Eyes publish cyber guidance for tech startupsStartup tech companies can be attractive targets for hackers, especially if they have weak cybersecurity and valuable intellectual property (IP).To help startups prevent cyberattacks, the Five Eyes countries this week published cybersecurity guides tailored for these companies and their investors.“This guidance is designed to help tech startups protect their innovation, reputation, and growth, while also helping tech investors fortify their portfolio companies against security risks," Mike Casey, U.S. National Counterintelligence and Security Center Director, said in a statement.These are the top five cybersecurity recommendations from Australia, Canada, New Zealand, the U.S. and the U.K. for tech startups:Be aware of threat vectors, including malicious insiders, insecure IT and supply chain risk.Identify your most critical assets and conduct a risk assessment to pinpoint vulnerabilities.Build security into your products by managing intellectual assets and IP; monitoring who has access to sensitive information; and ensuring this information’s protection.Conduct due diligence when choosing partners and make sure they’re equipped to protect the data you share with them.Before you expand abroad, prepare and become informed about these new markets by, for example, understanding local laws in areas such as IP protection and data protection. “Sophisticated nation-state adversaries, like China, are working hard to steal the intellectual property held by some of our countries’ most innovative and exciting startups,” Ken McCallum, Director General of the U.K.’s MI5, said in a statement.To get more details, check out these Five Eyes’ cybersecurity resources for tech startups:The announcement “Five Eyes Launch Shared Security Advice Campaign for Tech Startups”The main guides: “Secure Innovation: Security Advice for Emerging Technology Companies”“Secure Innovation: Security Advice for Emerging Technology Investors”These complementary documents:“Secure Innovation: Scenarios and Mitigations”“Secure Innovation: Travel Security Guidance”“Secure Innovation: Due Diligence Guidance”“Secure Innovation: Companies Summary”3 - Survey: Unapproved AI use impacting data governanceEmployees’ use of unauthorized AI tools is creating compliance issues in a majority of organizations. Specifically, it makes it harder to control data governance and compliance, according to almost 60% of organizations surveyed by market researcher Vanson Bourne.“Amid all the investment and adoption enthusiasm, many organisations are struggling for control and visibility over its use,” reads the firm’s “AI Barometer: October 2024” publication. Vanson Bourne polls 100 IT and business executives each month about their AI investment plans.To what extent do you think the unsanctioned use of AI tools is impacting your organisation's ability to maintain control over data governance and compliance?(Source: Vanson Bourne’s “AI Barometer: October 2024”)Close to half of organizations surveyed (44%) believe that at least 10% of their employees are using unapproved AI tools.On a related front, organizations are also grappling with the issue of software vendors that unilaterally and silently add AI features to their products, especially to their SaaS applications.While surveyed organizations say they’re reaping advantages from their AI usage, “such benefits are dependent on IT teams having the tools to address the control and visibility challenges they face,” the publication reads.For more information about the use of unapproved AI tools, an issue also known as “shadow AI,” check out:“Do You Think You Have No AI Exposures? Think Again” (Tenable)“Shadow AI poses new generation of threats to enterprise IT” (TechTarget)“10 ways to prevent shadow AI disaster” (CIO)“Never Trust User Inputs -- And AI Isn't an Exception: A Security-First Approach” (Tenable)“Shadow AI in the ‘dark corners’ of work is becoming a big problem for companies” (CNBC)VIDEOShadow AI Risks in Your Company 4 - NCSC explains nuances of multi-factor authenticationMulti-factor authentication (MFA) comes in a variety of flavors, and understanding the differences is critical for choosing the right option for each use case in your organization.To help cybersecurity teams better understand the different MFA types and their pluses and minuses, the U.K. National Cyber Security Centre (NCSC) has updated its MFA guidance.“The new guidance explains the benefits that come with strong authentication, while also minimising the friction that some users associate with MFA,” reads an NCSC blog. In other words, what type of MFA method to use depends on people’s roles, how they work, the devices they use, the applications or services they’re accessing and so on.Topics covered include:Recommended types of MFA, such as FIDO2 credentials, app-based and hardware-based code generators and message-based methodsThe importance of using strong MFA to secure users’ access to sensitive dataThe role of trusted devices in boosting and simplifying MFABad practices that weaken MFA’s effectiveness, such as:Retaining weaker, password-only authentication protocols for legacy servicesExcluding certain accounts from MFA requirements because their users, usually high-ranking officials, find MFA inconvenientTo get more details, read:The NCSC blog “Not all types of MFA are created equal”The NCSC guide “Multi-factor authentication for your corporate online services”For more information about MFA:“Multifactor Authentication Cheat Sheet” (OWASP)“Deploying Multi Factor Authentication – The What, How, and Why” (SANS Institute)“How MFA gets hacked — and strategies to prevent it” (CSO)“How Multifactor Authentication Supports Growth for Businesses Focused on Zero Trust” (BizTech)“What is multi-factor authentication?” (TechTarget)5 - U.S. gov’t outlines AI strategy, ties it to national security The White House has laid out its expectations for how the federal government ought to promote the development of AI in order to safeguard U.S. national security.In the country’s first-ever National Security Memorandum (NSM) on AI, the Biden administration said the federal government must accomplish the following:Ensure the U.S. is the leader in the development of safe, secure and trustworthy AILeverage advanced AI technologies to boost national securityAdvance global AI consensus and governance“The NSM’s fundamental premise is that advances at the frontier of AI will have significant implications for national security and foreign policy in the near future,” reads a White House statement. The NSM’s directives to federal agencies include:Help improve the security of chips and support the development of powerful supercomputers to be used by AI systems.Help AI developers protect their work against foreign spies by providing them with cybersecurity and counterintelligence information.Collaborate with international partners to create a governance framework for using AI in a way that is ethical, responsible and respects human rights. The White House also published a complementary document titled “Framework To Advance AI Governance and Risk Management in National Security,” which adds implementation details and guidance for the NSM.6 - State CISOs on the frontlines of AI securityAs the cybersecurity risks and benefits of AI multiply, most U.S. state CISOs find themselves at the center of their governments' efforts to craft AI security strategies and policies.That’s according to the “2024 Deloitte-NASCIO Cybersecurity Study,” which surveyed CISOs from all 50 states and the District of Columbia.Specifically, 88% of state CISOs reported being involved in the development of a generative AI strategy, while 96% are involved with creating a generative AI security policy.However, their involvement in AI cybersecurity matters isn’t necessarily making them optimistic about their states’ ability to fend off AI-boosted attacks.None said they feel “extremely confident” that their state can prevent AI-boosted attacks, while only 10% reported feeling “very confident.” The majority (43%) said they feel “somewhat confident” while the rest said they are either “not very confident” or “not confident at all.” Naturally, most state CISOs see AI-enabled cyberthreats as significant, with 71% categorizing them as either “very high threat” (18%) or “somewhat high threat” (53%).At the same time, state CISOs see the potential for AI to help their cybersecurity efforts, as 41% are already using generative AI for cybersecurity, and another 43% have plans to do so by mid-2025.Other findings from the "2024 Deloitte-NASCIO Cybersecurity Study" include:4 in 10 state CISOs feel their budget is insufficient.Almost half of respondents rank cybersecurity staffing as one of the top challenges.In the past two years, 23 states have hired new CISOs, as the median tenure of a state CISO has dropped to 23 months, down from 30 months in 2022.More state CISOs are taking on privacy protection duties — 86% are responsible for privacy protection, up from 60% two years ago.For more information about CISO trends:“What’s important to CISOs in 2024” (PwC)“The CISO’s Tightrope: Balancing Security, Business, and Legal Risks in 2024” (The National CIO Review)“State of CISO Leadership: 2024” (SC World)“4 Trends That Will Define the CISO's Role in 2024” (SANS Institute) Full Article
as Cybersecurity Snapshot: CISA Warns of Global Spear-Phishing Threat, While OWASP Releases AI Security Resources By www.tenable.com Published On :: Fri, 08 Nov 2024 09:00:00 -0500 CISA is warning about a spear-phishing campaign that spreads malicious RDP files. Plus, OWASP is offering guidance about deepfakes and AI security. Meanwhile, cybercriminals have amplified their use of malware for fake software-update attacks. And get the latest on CISA’s international plan, Interpol’s cyber crackdown and ransomware trends.Dive into six things that are top of mind for the week ending Nov. 8.1 - CISA: Beware of nasty spear-phishing campaignProactively restrict outbound remote-desktop protocol (RDP) connections. Block transmission of RDP files via email. Prevent RDP file execution.Those are three security measures cyber teams should proactively take in response to an ongoing and “large scale” email spear-phishing campaign targeting victims with malicious RDP files, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA).A foreign threat actor is carrying out the campaign. Several vertical sectors, including government and IT, are being targeted.“Once access has been gained, the threat actor may pursue additional activity, such as deploying malicious code to achieve persistent access to the target’s network,” CISA’s alert reads. Other CISA recommendations include:Adopt phishing-resistant multi-factor authentication (MFA), such as FIDO tokens, and try to avoid SMS-based MFAEducate users on how to spot suspicious emailsHunt for malicious activity in your network looking for indicators of compromise (IoCs) and tactics, techniques and proceduresAlthough CISA didn’t name the hacker group responsible for this campaign, its alert includes links to related articles from Microsoft and AWS that identify it as Midnight Blizzard. Also known as APT29, this group is affiliated with Russia’s government.To get more details, check out the CISA alert “Foreign Threat Actor Conducting Large-Scale Spear-Phishing Campaign with RDP Attachments.”For more information about securing RDP tools:“Commonly Exploited Protocols: Remote Desktop Protocol (RDP)” (Center for Internet Security)“What is remote desktop protocol (RDP)?” (TechTarget)“Wondering Whether RDP IS Secure? Here's a Guide to Remote Desktop Protocol” (AllBusiness)“Why remote desktop tools are facing an onslaught of cyber threats” (ITPro)“'Midnight Blizzard' Targets Networks With Signed RDP Files” (Dark Reading)2 - OWASP issues AI security resourcesHow should your organization respond to deepfakes? What’s the right way of establishing a center of excellence for AI security in your organization? Where can you find a comprehensive guide of tools to secure generative AI applications?These questions are addressed in a new set of resources for AI security from the Open Worldwide Application Security Project’s OWASP Top 10 for LLM Application Security Project. The new resources are meant to help organizations securely adopt, develop and deploy LLM and generative AI systems and applications “with a comprehensive strategy encompassing governance, collaboration and practical tools,” OWASP said in a statement.These are the new resources:“The Guide for Preparing and Responding to Deepfake Events,” which unpacks four types of deepfake schemes – financial fraud, job interview fraud, social engineering and misinformation – and offers guidance about each one in these areas:preparationdetection and analysiscontainment eradication and recoverypost-incident activity“The LLM and GenAI Center of Excellence Guide,” which aims to help CISOs and fellow organization leaders create a center of excellence for generative AI security that facilitates collaboration among various teams, including security, legal, data science and operations, so they can develop:Generative AI security policiesRisk assessment and management processesTraining and awarenessResearch and development“The AI Security Solution Landscape Guide,” which offers security teams a comprehensive catalog of open source and commercial tools for securing LLMs and generative AI applications.To get more details, read OWASP’s announcement “OWASP Dramatically Expands GenAI Security Guidance.”For more information about protecting your organization against deepfakes:“How to prevent deepfakes in the era of generative AI” (TechTarget)“Deepfake scams escalate, hitting more than half of businesses” (Cybersecurity Dive)“The AI Threat: Deepfake or Deep Fake? Unraveling the True Security Risks” (SecurityWeek)“How deepfakes threaten biometric security controls” (TechTarget)“Deepfakes break through as business threat” (CSO)3 - Fake update variants dominate list of top malware in Q3Hackers are doubling down on fake software-update attacks.That’s the main takeaway from the Center for Internet Security’s list of the 10 most prevalent malware used during the third quarter.Malware variants used to carry out fake browser-update attacks took the top four spots on the list: SocGholish, LandUpdate808, ClearFake and ZPHP. Collectively, they accounted for 77% of the quarter’s malware infections. It's the first time LandUpdate808 and ClearFake appear on this quarterly list.(Source: “Top 10 Malware Q3 2024”, Center for Internet Security, October 2024)In a fake software-update attack, a victim gets duped into installing a legitimate-looking update for, say, their preferred browser, that instead infects their computers with malware.Here’s the full list, in descending order:SocGholish, a downloader distributed through malicious websites that tricks users into downloading it by offering fake software updates LandUpdate808, a JavaScript downloader distributed through malicious websites via fake browser updatesClearFake, another JavaScript downloader used for fake browser-update attacksZPHP, another JavaScript downloader used for fake software-update attacksAgent Tesla, a remote access trojan (RAT) that captures credentials, keystrokes and screenshotsCoinMiner, a cryptocurrency miner that spreads using Windows Management Instrumentation (WMI)Arechclient2, also known as SectopRAT, is a .NET RAT whose capabilities include multiple stealth functionsMirai, a malware botnet that compromises IoT devices to launch DDoS attacksNanoCore, a RAT that spreads via malspam as a malicious Excel spreadsheetLumma Stealer, an infostealer used to swipe personally identifiable information (PII), credentials, cookies and banking informationTo get more information, the CIS blog “Top 10 Malware Q3 2024” offers details, context and indicators of compromise for each malware strain.For details on fake update attacks:“Fake browser updates spread updated WarmCookie malware” (BleepingComputer)“Beware: Fake Browser Updates Deliver BitRAT and Lumma Stealer Malware” (The Hacker News)“Hackers Use Fake Browser Updates for AMOS Malware Attacks Targeting Mac Users” (MSSP Alert)“Malware crooks find an in with fake browser updates, in case real ones weren't bad enough” (The Register)“Fake Google Chrome errors trick you into running malicious PowerShell scripts” (BleepingComputer)VIDEOFake Chrome Update Malware (The PC Security Channel)4 - CISA’s first international plan unveiledCISA has released its first-ever international plan, which outlines a strategy for boosting the agency’s collaboration with cybersecurity agencies from other countries.Aligning cybersecurity efforts and goals with international partners is critical for tackling cyberthreats in the U.S. and abroad, according to the agency.The three core pillars of CISA’s “2025 - 2026 International Strategic Plan” are:Help make more resilient other countries’ assets, systems and networks that impact U.S. critical infrastructureBoost the integrated cyber defenses of the U.S. and its international partners against their shared global cyberthreatsUnify the coordination of international activities to strengthen cyberdefenses collectivelyThe plan will allow CISA to “reduce risk to the globally interconnected and interdependent cyber and physical infrastructure that Americans rely on every day,” CISA Director Jen Easterly said in a statement.5 - Interpol hits phishers, ransomware gangs, info stealersInterpol and its partners took down 22,000 malicious IP addresses and seized thousands of servers, laptops, and mobile phones used by cybercriminals to conduct phishing scams, deploy ransomware and steal information.The four-month global operation, titled Synergia II and announced this week, involved law enforcement agencies and private-sector partners from 95 countries and netted 41 arrests.“Together, we’ve not only dismantled malicious infrastructure but also prevented hundreds of thousands of potential victims from falling prey to cybercrime,” Neal Jetton, Director of Interpol’s Cybercrime Directorate, said in a statement.In Hong Kong, more than 1,000 servers were taken offline, while authorities in Macau, China took another 291 servers offline. Meanwhile, in Estonia, authorities seized 80GB of server data, which is now being analyzed for links to phishing and banking malware.For more information about global cybercrime trends:“AI-Powered Cybercrime Cartels on the Rise in Asia” (Dark Reading)“AI Now a Staple in Phishing Kits Sold to Hackers” (MSSP Alert)“The Business of Cybercrime Explodes” (BankDirector)“Nation state actors increasingly hide behind cybercriminal tactics and malware” (CSO)6 - IST: Ransomware attacks surged in 2023Ransomware gangs went into hyperdrive last year, increasing their attacks by 73% compared with 2022, according to the non-profit think tank Institute for Security and Technology (IST).The IST attributes the sharp increase in attacks to a shift by ransomware groups to “big game hunting” – going after prominent, large organizations with deep pockets. “Available evidence suggests that government and industry actions taken in 2023 were not enough to significantly reduce the profitability of the ransomware model,” reads an IST blog.Global Ransomware Incidents in 2023Another takeaway: The ransomware-as-a-service (RaaS) model continued to prove extremely profitable in 2023, and it injected dynamism into the ransomware ecosystem. The RaaS model prompted ransomware groups “to shift allegiances, form new groups, or iterate existing variants,” the IST blog reads.The industry sector that ransomware groups hit the hardest was construction, followed by hospitals and healthcare, and by IT services and consulting. Financial services and law offices rounded out the top five.To learn more about ransomware trends:“Ransomware Is ‘More Brutal’ Than Ever in 2024” (Wired)“Ransomware on track for record profits, even as fewer victims pay” (SC Magazine)“How Can I Protect Against Ransomware?” (CISA)“How to prevent ransomware in 6 steps” (TechTarget)“Steps to Help Prevent & Limit the Impact of Ransomware” (Center for Internet Security) Full Article
as Social Media for Science Outreach – A Case Study: Career changing and pseudonyms By www.nature.com Published On :: Tue, 30 Apr 2013 15:53:34 +0000 To tie in with this month’s SoNYC birthday celebrations, we are hosting a collection of case Full Article Featured Guest Posts Outreach SpotOn NYC (#SoNYC) #reachingoutsci #SoNYC Social Media Case Study
as Social Media for Science Outreach – A Case Study: Marine Science & Conservation Outreach By www.nature.com Published On :: Tue, 30 Apr 2013 17:00:52 +0000 A twitter TeachIn about marine protected areas, hosted by @RJ_Dunlap on 4/8/2013 Full Article Featured Outreach SpotOn NYC (#SoNYC) #reachingoutsci #SoNYC Social Media Case Study
as Social Media for Science Outreach – A Case Study: The Beagle Project, Galapagos Live & ISS Wave By www.nature.com Published On :: Tue, 30 Apr 2013 19:00:04 +0000 Selected responses categorized into 'helped', 'helped and harmed' and 'harmed'. Full Article Featured Guest Posts Outreach SpotOn NYC (#SoNYC) #reachingoutsci #SoNYC Social Media Case Study
as Social Media for Science Outreach – A Case Study: AntarcticGlaciers.org By www.nature.com Published On :: Wed, 22 May 2013 09:00:38 +0000 To tie in with this month’s SoNYC birthday celebrations, we are hosting a collection of case Full Article Featured Guest Posts Outreach SpotOn NYC (#SoNYC) #reachingoutsci #SoNYC Social Media Case Study
as Social Media for Science Outreach – A Case Study: Chemicals Are Your Friends By www.nature.com Published On :: Wed, 22 May 2013 11:00:40 +0000 To tie in with this month’s SoNYC birthday celebrations, we are hosting a collection of case Full Article Featured Guest Posts Outreach SpotOn NYC (#SoNYC) Uncategorized #reachingoutsci Social Media Case Study
as Social Media for Science Outreach – A Case Study: National Science Foundation-funded IGERT project team By www.nature.com Published On :: Wed, 22 May 2013 15:00:23 +0000 To tie in with this month’s SoNYC birthday celebrations, we are hosting a collection of case Full Article Featured Guest Posts Outreach SpotOn NYC (#SoNYC) Uncategorized #reachingoutsci Social Media Case Study
as Social Media for Science Outreach – A Case Study: TEDMED Great Challenges By www.nature.com Published On :: Thu, 23 May 2013 13:55:01 +0000 To tie in with this month’s SoNYC birthday celebrations, we are hosting a collection of case Full Article Featured Guest Posts Outreach SpotOn NYC (#SoNYC) Uncategorized #reachingoutsci Social Media Case Study
as Social Media for Science Outreach – A Case Study: Lessons From a Campaign Twitter Account By www.nature.com Published On :: Fri, 24 May 2013 10:07:42 +0000 James King is a geomorphologist interested in exploring the processes that govern sediment transport and Full Article Featured Guest Posts Outreach SpotOn NYC (#SoNYC) #reachingoutsci Social Media Case Study
as OSC consults on improving retail investor access to long-term asset investments By www.osc.ca Published On :: Thu, 10 Oct 2024 13:06:56 GMT TORONTO – The Ontario Securities Commission (OSC) today Full Article
as OSC releases 2024 Investment Fund Survey Data Dashboard By www.osc.ca Published On :: Tue, 15 Oct 2024 13:59:16 GMT TORONTO - The Ontario Securities Commission (OSC) is pleased to announce the release of the 2024 Investment Fund Survey (IFS) data dashboard. Full Article
as Outcast. Volume 1, A darkness surrounds him / Robert Kirkman, creator, writer ; Paul Azaceta, artist ; Elizabeth Breitweiser, colorist ; Rus Wooton, letterer. By library.gcpl.lib.oh.us Published On :: Kyle Barnes has been plagued by demonic possession all his life and now he needs answers. Unfortunately, what he uncovers along the way could bring about the end of life on Earth as we know it. Full Article
as Outcast. Volume 3, This little light / Robert Kirkman, creator, writer ; Paul Azaceta, artist ; Elizabeth Breitweiser, colorist ; Rus Wooton, Letterer ; Sean Mackiewicz, editor. By library.gcpl.lib.oh.us Published On :: "Kyle is faced with the most emotional exorcism he's performed yet … as he begins to learn more about his abilities and what's really happening around him. The pieces are starting to fall into place as secrets are revealed that will change everything." -- Description provided by publisher. Full Article
as Outcast. Volume 2, A vast and unending ruin / Robert Kirkman, creator, writer ; Paul Azaceta, artist ; Elizabeth Breitweiser, colorist ; Rus Wooton, letterer. By library.gcpl.lib.oh.us Published On :: Kyle Barnes has been plagued by demonic possession all his life. In light of recent revelations, he finally feels like he's starting to piece together the answers he's looking for. But while he feels a new sense of purpose is Reverend Anderson's life falling apart? Full Article
as Outcast. Volume 4, Under Devil's wing / Robert Kirkman, creator, writer ; Paul Azaceta, artist ; Elizabeth Breitweiser, colorist ; Rus Wooton, letterer. By library.gcpl.lib.oh.us Published On :: "Answers are given, secrets are revealed, and the Barnes family has never been in more danger. Allison learns that there's something very special about her daughter, bu where's Kyle? Will Anderson risk everything to save him?' -- Page 4 of cover. Full Article
as The Adventure zone : the crystal kingdom / based on the podcast by Griffin McElroy, Clint McElroy, Travis McElroy, Justin McElroy ; adaptation by Clint McElroy, Carey Pietsch ; art by Carey Pietsch. By library.gcpl.lib.oh.us Published On :: "A desperate call for help interrupts holiday celebrations at the Bureau of Balance, and sends Taako, Magnus and Merle on a high-stakes mission to find and reclaim a fourth deadly relic: a powerful transmutation stone, hidden somewhere in the depths of a floating arcane laboratory that's home to the Doctors Maureen and Lucas Miller. An unknown menace has seized control of the stone, and is using it to transform the lab into a virulent pink crystal that spreads to everything it touches. It's only a matter of time before this sparkling disaster crash-lands, but in order to find the stone and save the whole planet from being King Midased, our heroes will have to fight their way through a gauntlet of rowdy robots and crystal golems, decide whether they can trust the evasive Lucas Miller, and solve the mystery of what— or who— has put them all in peril, before there's no world left to save." -- Provided by publisher Full Article
as Asadora! Volume 1 / Naoki Urasawa ; translation & adaptation, John Werry ; touch-up art & lettering, Steve Dutro. By library.gcpl.lib.oh.us Published On :: "A deadly typhoon, a mysterious creature and a girl who won't quit. In 2020, a large creature rampages through Tokyo, destroying everything in its path. In 1959, Asa Asada, a spunky young girl from a huge family in Nagoya, is kidnapped for ransom— and not a soul notices. When a typhoon hits Nagoya, Asa and her kidnapper must work together to survive. But there's more to her kidnapper and this storm than meets the eye. When Asa's mother goes into labor yet again, Asa runs off to find a doctor. But no one bats an eye when she doesn't return— not even as a storm approaches Nagoya. Forgotten yet again, Asa runs into a burglar and tries to stop him on her own, a decision that leads to an unlikely alliance." -- Provided by publisher. Full Article
as Asadora! Volume 2 / by Naoki Urasawa / N Wood Studio ; translation & adaptation, John Werry ; touch-up art & lettering, Steve Dutro. By library.gcpl.lib.oh.us Published On :: "Asa and Kasuga see the tail of a giant creature rise from the water. In a jungle, explorers discover massive claw marks in a tree trunk. And years later in 1964, a mysterious military man appears asking all the wrong questions." -- Provided by publisher. Full Article
as Study on countermeasures of Agriculture against Economic and Trade Frictions between China and USA [in Chinese] By www.ifpri.org Published On :: Sat, 12 Dec 2020 5:05:01 EST Full Article
as 1225 Christmas Tree Lane Debbie Macomber. By library.gcpl.lib.oh.us Published On :: Welcome to Christmas Town! The people of Cedar Cove know how to celebrate Christmas. Like Grace and Olivia and everyone else, Beth Morehouse expects this Christmas to be one of her best. Her small Christmas tree farm is prospering, her daughters and her dogs are happy and well, and her new relationship with local vet Ted Reynolds is showing plenty of romantic promise. But...someone recently left a basket filled with puppies on her doorstep, puppies she's determined to place in good homes. That's complication number one. And number two is that her daughters, Bailey and Sophie, have invited their dad, Beth's long-divorced husband, Kent, to Cedar Cove for Christmas. The girls have visions of a mom-and-dad reunion dancing in their heads. As always in life-and in Cedar Cove-there are surprises, too. More than one family's going to have a puppy under the tree. More than one scheme will go awry. And more than one romance will have a happy ending! Full Article
as Bad Monkey Carl Hiaasen. By library.gcpl.lib.oh.us Published On :: Andrew Yancy-late of the Miami Police and soon-to-be-late of the Monroe County sheriff's office-has a human arm in his freezer. There's a logical (Hiaasenian) explanation for that, but not for how and why it parted from its shadowy owner. Yancy thinks the boating-accident/shark-luncheon explanation is full of holes, and if he can prove murder, the sheriff might rescue him from his grisly Health Inspector gig (it's not called the roach patrol for nothing). But first-this being Hiaasen country-Yancy must negotiate an obstacle course of wildly unpredictable events with a crew of even more wildly unpredictable characters, including his just-ex lover, a hot-blooded fugitive from Kansas; the twitchy widow of the frozen arm; two avariciously optimistic real-estate speculators; the Bahamian voodoo witch known as the Dragon Queen, whose suitors are blinded unto death by her peculiar charms; Yancy's new true love, a kinky coroner; and the eponymous bad monkey, who with hilarious aplomb earns his place among Carl Hiaasen's greatest characters. Here is Hiaasen doing what he does better than anyone else: spinning a tale at once fiercely pointed and wickedly funny in which the greedy, the corrupt, and the degraders of what's left of pristine Florida-now, of the Bahamas as well-get their comeuppance in mordantly ingenious, diabolically entertaining fashion. Full Article
as Return to Santa Flores A Classic Love Story Iris Johansen. By library.gcpl.lib.oh.us Published On :: #1 New York Times bestselling author Iris Johansen offers readers a classic tale of a love that seems impossible-and a hunger that is undeniable. Jenny Cashman longs to escape the refined, rarified air of her exclusive Swiss education. At nineteen, she's desperate for independence-and to once again see the man she loves. So she sells her belongings, leaves Europe, and heads to Las Vegas. The sight of Steve Jason's newest palatial hotel and casino thrills Jenny-but not as much as the sight of the man himself. Steve came to her rescue after her father died, paying for her years of expensive schooling. Now, she must convince him that she's old enough to make her own decisions . . . including about her passion for him. Steve Jason is a powerful mogul, a man who came from nothing and made a name for himself in the industry before he was thirty years old. He takes great care to keep all emotional involvement with others to a bare minimum-with only one exception. Jenny has always been incredibly important to him. But how can he keep her safe when she seems oblivious to her own stunning beauty and the reactions she gets from other men? It will take all of Steve's resolve to protect her-especially from his own desires. Full Article
as Canadian securities regulators issue warning about fraudulent investment solicitations involving crypto assets By www.osc.ca Published On :: Mon, 17 Jan 2022 14:34:45 GMT Montréal –The Canadian Securities Administrators (CSA) warns the public about investment schemes involving fraudulent websites that solicit investments in foreign exchange (often referred to as “forex”), binary options and/or crypto assets. Full Article
as How did households in Mali cope with covariate shocks between 2018 and 2023? Exploration of a unique dataset By africa.ifpri.info Published On :: Mon, 04 Nov 2024 16:36:30 +0000 Citation Marivoet, Wim; and Hema, Aboubacar. 2024. How did households in Mali cope with covariate shocks between 2018 and 2023? Source: IFPRI Africa Regional Office (AFR) Full Article Africa conflicts; extreme weather events; farming systems; households New Publication News Publications shock; food prices food security livestock violence
as Irrigation schemes in Ethiopia’s Awash River Basin: An examination of physical, knowledge, and governance infrastructures By essp.ifpri.info Published On :: Wed, 06 Nov 2024 09:06:37 +0000 Using a representative sample of irrigation schemes, the study documents the physical, knowledge, and governance infrastructures of irrigation schemes in Ethiopia’s most intensively used river basin, the Awash. The findings show that about 20 percent of the equipped area of irrigation schemes in the basin is not being irrigated, while the number of actual beneficiaries […] Source: IFPRI Ethiopia: Ethiopia Strategy Support Program Full Article News Publications
as Unleashing the potential of Generation Z for food system transformation in Africa By massp.ifpri.info Published On :: Thu, 07 Nov 2024 06:23:47 +0000 Africa’s population is the youngest of any region, with more than 400 million young people aged 15 to 35 out of a total of 1.5 billion. But even though rising numbers of this cohort—a “youth bulge”—enter the labor market every year, African economies a... Source: IFPRI Malawi: Malawi Strategy Support Program Full Article Blogs Featured Post Food systems News Strengthening Governance
as Register: Delivering for Nutrition in South Asia Conference By bangladesh.ifpri.info Published On :: Thu, 07 Nov 2024 08:02:49 +0000 South Asia grapples with escalating levels of malnutrition in various forms, including undernutrition, overweight and obesity, and micronutrient deficiencies, alongside the increasing incidence of diet-related non-communicable diseases. Malnutrition re... Source: IFPRI Bangladesh Country Office Full Article D4N2024 Delivering for Nutrition Events News Conference implementation research
as Targeting social assistance in fragile settings: An experiment on community-based targeting By essp.ifpri.info Published On :: Tue, 12 Nov 2024 05:39:42 +0000 Targeting is an important but challenging process in the design and delivery of social and humanitarian assistance programs. Community-based targeting (CBT) approaches are often preferred for their local information advantages, especially when data-driven methods are not feasible. However, how different variants of CBT approaches fare under various constraints and environments remains unclear. For example, it […] Source: IFPRI Ethiopia: Ethiopia Strategy Support Program Full Article News Publications
as Integrated and enhanced datasets on food security and household coping strategies in the G5 Sahel Countries (2018-2023) By africa.ifpri.info Published On :: Tue, 12 Nov 2024 11:15:47 +0000 The objective of this analysis is to gain more insight into the coping behavior of households in Mali when facing covariate shocks and stressors of different kinds Source: IFPRI Africa Regional Office (AFR) Full Article Africa Burkina Faso Chad households Mauritania; New Publication News Publications Sahel climate food security Mali Niger violence
as Integrated and enhanced datasets on food security and household coping strategies in the G5 Sahel Countries (2018-2023) Copy By africa.ifpri.info Published On :: Tue, 12 Nov 2024 12:54:39 +0000 The objective of this analysis is to gain more insight into the coping behavior of households in Mali when facing covariate shocks and stressors of different kinds Source: IFPRI Africa Regional Office (AFR) Full Article Africa Burkina Faso Chad households Mauritania; New Publication News Publications Sahel climate food security Mali Niger violence
as Agricultura, seguridad alimentaria, desarrollo y proteccion ambiental: Un futuro para Honduraas basado en la ciencia, tecnologia e innovacion By www.ifpri.org Published On :: Thu, 14 Jul 2022 5:05:01 EDT Full Article
as Informe de políticas alimentarias mundiales 2023: Repensar las respuestas a las crisis alimentarias: Sinopsis By www.ifpri.org Published On :: Fri, 21 Apr 2023 5:05:02 EDT En 2022, el mundo se enfrentó a múltiples crisis. Continuaron las perturbaciones de los sistemas alimentarios debidas a la prolongada pandemia de COVID-19, las grandes catástrofes naturales, los disturbios civiles y la inestabilidad política, así como los crecientes efectos del cambio climático, mientras la guerra entre Rusia y Ucrania y la inflación agravaban una crisis mundial de alimentos y fertilizantes. Full Article
as Empoderamiento de la mujer rural en Guatemala, necesidades y oportunidades de medición: Posibles aplicaciones de una Métrica de Empoderamiento de las Mujeres para los Sistemas Estadísticos Nacionales (WEMNS) By www.ifpri.org Published On :: Tue, 12 Sep 2023 5:05:01 EDT La igualdad de género y el empoderamiento de las mujeres y niñas se ve reflejado en distintas prioridades de políticas a nivel global y local. El Objetivo de Desarrollo Sostenible 5 busca lograr la igualdad de género y empoderar a todas las mujeres y niñas. Full Article
as Avatar : the last airbender. Smoke and shadow. Part 1 / script, Gene Luen Yang ; art and cover, Gurihiru ; lettering, Michael Heisler. By library.gcpl.lib.oh.us Published On :: When the Fire Nation begins to believe that the country will perish if Zuko stays in power, Avatar Aang and his friends must protect the ruler. Full Article
as Avatar, the last airbender. Smoke and shadow. Part 3 / script, Gene Luen Yang ; art and cover, Gurihiru ; lettering, Michael Heisler. By library.gcpl.lib.oh.us Published On :: "Children are disappearing in the Fire Nation capitol! Avatar Aang and his friends are doing everything in their power to save them--but will it be enough?! What's worse, when Azula--the mad sister of Fire Lord Zuko--appears on the scene, Zuko locks down the capitol to catch her, igniting fear and riots in the streets! Will Zuko follow in his evil father's footsteps in order to save those he holds dear?!"--Amazon.com. Full Article
as Five nights at Freddy's. [2], The twisted ones : the graphic novel / by Scott Cawthon and Kira Breed-Wrisley ; adapted by Christopher Hastings ; illustrated by Claudia Aguirre ; colors by Laurie Smith and Eva de la Cruz. By library.gcpl.lib.oh.us Published On :: "It's been a year since the horrific events at Freddy Fazbear's Pizza, and Charlie is just trying to move on. Even with the excitement of a new school and a fresh start, she's still haunted by nightmares of a masked murderer and four gruesome animatronic puppets. Charlie thinks her ordeal is over, but when a series of bodies are discovered near her school bearing wounds that are disturbingly familiar she finds herself drawn back into the world of her father's frightening creations. Something twisted is hunting Charlie, and this time if it finds her, it's not letting her go." -- Publisher's description. Full Article
as Demon slayer = kimetsu no yaiba. Volume 20, The path of opening a steadfast heart / story and art by Koyoharu Gotouge ; translation, John Werry ; English adaptation, Stan! ; touch-up art & lettering, John Hunt. By library.gcpl.lib.oh.us Published On :: "In Taisho-era Japan, kindhearted Tanjiro Kamado makes a living selling charcoal. But his peaceful life is shattered when a demon slaughters his entire family. His little sister Nezuko is the only survivor, but she has been transformed into a demon herself! Tanjiro sets out on a dangerous journey to find a way to return his sister to normal and destroy the demon who ruined his life … After their initial confrontation with Kokushibo, the most powerful of Muzan's demons, Tokito is severely wounded and Genya has been cut in half— but is still alive! Can his regenerative power heal even this fatal wound? Then the Hashira Himejima and Sanemi square off against Kokushibo and unleash all the skill they have against him. Himejima is blind, but if he can see into the Transparent World, he might have a chance. Who will survive this whirlwind of flashing blades?"-- Provided by publisher. Full Article
as The Count of Monte Cristo / Alexandre Dumas ; art by: Nokman Poon ; story adaptation by: Crystal S. Chan ; lettering by Morpheus Studios ; lettering assist: Jeannie Lee. By library.gcpl.lib.oh.us Published On :: On the very day of his wedding to the beautiful Mercedes, a young merchant sailor named Edmond Dantès is falsely imprisoned for life, laying to waste his plans of marriage and hard-earned fortune. Following several long years in prison he has managed to escape and reinvent himself as the mysterious Count of Monte Cristo. It is the reign of Napoleon Bonaparte and the Count has been plotting his revenge on the three men who had him falsely imprisoned. With a new identity, an incredible education abroad and a vast fortune, he has returned completely unrecognizable to those who had committed their crimes against him. Full Article
as Catwoman. Soulstealer : the graphic novel / based on the novel written by Sarah J. Maas ; adapted by Louise Simonson ; illustrated by Samantha Dodge with Carl Potts and Brett Ryans ; colors by Shari Chankhamma ; letters by Saida Temofonte. By library.gcpl.lib.oh.us Published On :: Selina Kyle returns to Gotham City as new socialite Holly Vanderhees, but she needs to outsmart rival Batwing to rise to the top of the city's criminal underbelly. Full Article
