anc

ETSI Releases New Guidelines to Enhance Cyber-security for Consumer IoT Devices

Sophia Antipolis, 31 October 2024

Protect Confidentiality, Integrity and Availability of Data as Smart Devices Proliferate.

Read More...




anc

MAA France: Fall All-Canadian Bowling Night for McGillians

Starts: Thu, 14 Nov 2024 22:00:00 -0500
11/14/2024 07:30:00PM
Location: PARIS, Canada




anc

San Francisco Bay Area Holiday Party - Don't Miss the Fun!

Starts: Sun, 08 Dec 2024 18:30:00 -0500
12/08/2024 04:30:00PM
Location: San Mateo, U. S. A.




anc

Vancouver Alumni Holiday Party

Starts: Tue, 10 Dec 2024 19:00:00 -0500
12/10/2024 05:00:00PM
Location: Vancouver, Canada




anc

WLP Vancouver Holiday Social & Networking Event with Martha Piper!

Starts: Wed, 11 Dec 2024 19:00:00 -0500
12/11/2024 05:00:00PM
Location: Vancouver, Canada




anc

Vancouver: Professional Networking

Starts: Thu, 12 Dec 2024 09:30:00 -0500
12/12/2024 08:00:00AM
Location: Vancouver, Canada




anc

The Image of Africa in the Literature of the Harlem Renaissance

New essay by Trudier Harris, "The Image of Africa in the Literature of the Harlem Renaissance," added to Freedom's Story: Teaching African American Literature and History, TeacherServe from the National Humanities Center.




anc

OSC Staff Notice 11-737 (Revised) – Securities Advisory Committee – Vacancies

The Securities Advisory Committee (“SAC”) is a committee of industry experts established by the Commission to advise it and its staff on a variety of matters including policy initiatives and capital markets trends.




anc

Detailed Data on Balance of Issuers in ninth Staff Review of Disclosure regarding Women on Boards and in Executive Officer Positions




anc

Director of Finance and Administration

Job Summary: The International Food Policy Research Institute (IFPRI), an international non-profit, research organization with over 600+ employees worldwide, seeks a Director of Finance and Administration to oversee the institute’s annual budget of USD 100+ million and lead the finance and administration services across the institute including Finance, IT Services, Travel and Facilities. The Director of Finance and Administration is a member of the Senior Management Team and reports to the Director General. The ideal candidate should be an excellent leader, people person, strategic communicator and relationship builder who can thrive in a complex, fast-changing environment. This is a three-year, full-time, exempt, renewable appointment and involves international travel, particularly to developing countries. This position could be based at IFPRI’s headquarters located in Washington, DC (preferred), Nairobi, Kenya or New Delhi, India. Essential Duties: Specific duties include but are not limited to: Provides information and advice to the IFPRI’s Board and senior management to ensure that the financial and physical resources of the institute are managed optimally and sustainably. Ensures that an effective framework is in place for informed decision making including the appropriate financial and risk management strategies, internal and external audits, compliance policies, corporate financial planning and reporting. Oversees the preparation and timely distribution of the Institute’s annual budget, long-term forecasts, including base case and downside scenario planning, and regular financial and management reports in accordance with internal, external and statutory obligations Directly supervises the senior corporate services managers (Finance, IT Services, Facilities, and Travel). Leads, manages and supports all managers in carrying out their duties by providing them with information, advice, general support and capacity building as needed. Monitors budget and expense trends; recommends and implements corrective actions as required. Reviews financial policies, procedure and practices; recommends improvements to financial processes and controls. Develops and implements systems that ensure the smooth operations of central administration. Work closely with the CGIAR Corporate Service Heads and at the One CGIAR System Office. Oversees all space and lease functions. Primarily responsible for IFPRI’s risk management system including oversight of IFPRI’s operations in Africa and Asia. Ensures that Finance and Corporate Service units in all IFPRI locations are appropriately staffed, well led and managed for performance. Ensure continuous improvement in the service delivery from these units. Required Qualifications: CPA/MBA or equivalent; minimum of fifteen years of relevant experience at the senior management level. Demonstrated leadership, management, and supervisory skills including the ability to recommend or make decisions, including difficult ones, in a complex, changing environment. Excellent planning and organizational skills, as well as attention to detail. Broad knowledge of finance and corporate service functions. Senior level experience in contract administration. Managerial experience in a non-profit, research, and/or international organization. Excellent written and verbal English communication skills.  Demonstrated ability to work in multi-cultural settings and to build productive relationships with diverse internal and external stakeholders. Willingness and ability to travel internationally, particularly to developing countries (15-20%). Essential personal qualities: integrity, responsiveness and decisiveness. Preferred Qualifications: Knowledge of or experience with the CGIAR Understanding of US GAAP AND IFRS Experience in donor relations Proficiency in a second language of the U.N. system Physical Demand and Work Environment: Employee will sit in an upright position for a long period of time.  Employee will lift between 0-10 pounds.  Employee is required to have close visual acuity to perform activities such as: preparing and analyzing data and figures; transcribing; viewing computer terminal; extensive reading. Salary Range: The expected salary ranges for this job requisition are between $ 188,900 - $231,400.  In determining your salary, we will consider your experience and other job-related factors. Benefits: IFPRI is committed to providing our staff members with valuable and competitive benefits, as it is a core part of providing a strong overall employee experience. This position is eligible for health insurance coverage and a summary of our benefits can be found on our website. Please note that the listed benefits are generally available to active, non-temporary, full-time and part-time US based employees who work at least 25 hours per week. The International Food Policy Research Institute (IFPRI) is an equal employment opportunity employer - F/M/Disability/Vet/Sexual Orientation/Gender Identity.




anc

Finance and Administrative Coordinator

Job Summary: The International Food Policy Research Institute (IFPRI) seeks a Finance & Administrative Coordinator for its Development Strategies and Governance Unit (DSG). This is a one-year, renewable appointment and is located at IFPRI’s South Asia Office in India. This position will work within the DSG department in providing support with travel organization, contract drafting & monitoring, revision of deliverables, financial reports, and invoices; workshops, edit narratives; close contracts and projects. Interested applicants must have work authorization to work in India. Essential Duties and Responsibilities Project Logistical Coordination : Provide logistical coordination for project activities, to include drafting and monitoring of project subcontracts, for complex Divisional projects. Monitor deadlines and coordinate the receipt of collaborator deliverables and submission of donor deliverables as requested. Accounting Support : Prepare travel and field expense reports.  File & monitor project budgets, collaborator and donor-approved budget expenditures, and sub-contracts. Submit and monitor collaborator invoices upon submission/approval of deliverables. Monitor weekly unit payments and submit updates to vendors and/or PM/PL/ project coordinators. Follow-up and process invoices from centers that host Group staff.   Assist, as needed, on provision of monthly General Ledgers (GLs)/Project Summary Report (PSRs) to PM/PLs.  Submit/correct project-related expense adjustments (as needed) Contact Data Base Support:   Maintain various administrative/unit database including Collaborator & Project main list, staff contact/emergency file, and other master files. Monitor SAC calendar to identify: Project end-dates and eventual closeout. Provide project budget burn rates to projects leaders upon request. Electronic filing of documents. Closeout collaborator and sub-contractor contracts after detailed verification that all deliverables have been received and all funds have been disbursed, filling in the checklist, obtaining the Project Leader signature, and importing the Close Out Form onto D4D. Timely preparation of periodic financial reports and invoices for a range of donors. Monitor billed and unbilled receivables for delinquent payments and billable cost. Data Entry in Tally and Finalization of accounts books as per Indian Accounting standards. Review monthly project status reports. Address internal and external inquiries regarding project financial matters. Assist with annual statutory audit. Other duties as assigned. Required Qualifications: Bachelor’s degree in accounting/finance plus two years of relevant experience or associate’s degree plus five years of relevant experience. Preference would be given to Intermediate/pursuing CA/CS/CWA. Knowledge of Tally is preferable. Demonstrated proficiency with computers: experience with MS Office, especially Microsoft Word, Outlook, Excel, and PowerPoint required. Strong analytical skills. Demonstrated ability to work productively within a multi-cultural team environment. Excellent oral and written communications skills. Demonstrated ability to pay diligence and follow-through to closure. Demonstrated experience working in a fast-paced work environment. Physical Demand & Work environment: Employee will sit in an upright position for a long period of time. Employee will lift between 0-10 pounds. Employee is required to have close visual acuity to perform activity such as: preparing and analyzing data and figures; viewing computer terminal; extensive reading. 




anc

Measures for Advancing Gender Equality (MAGNET) Website




anc

FY 2024 State and Local Cybersecurity Grant Program Adds CISA KEV as a Performance Measure

The CISA Known Exploited Vulnerabilities (KEV) catalog and enhanced logging guidelines are among the new measurement tools added for the 2024 State and Local Cybersecurity Grant Program.

Last month, the Department of Homeland Security announced the availability of $279.9 million in grant funding for the Fiscal Year (FY) 2024 State and Local Cybersecurity Grant Program (SLCGP). Now in its third year, the four-year, $1 billion program provides funding for State, Local and Territorial (SLT) governments to implement cybersecurity solutions that address the growing threats and risks to their information systems. Applications must be submitted by December 3, 2024.

While there are no significant modifications to the program for FY 2024, the Federal Emergency Management Agency (FEMA), which administers SLCGP in coordination with the Cybersecurity and Infrastructure Security Agency (CISA), identified key changes, some of which we highlight below:

The FY 2024 NOFO adds CISA’s KEV catalog as a new performance measure and recommended resource

The FY 2024 notice of funding opportunity (NOFO) adds the CISA Known Exploited Vulnerabilities (KEV) catalog as a recommended resource to encourage governments to regularly view information related to cybersecurity vulnerabilities confirmed by CISA, prioritizing those exploited in the wild. In addition, CISA has added “Addressing CISA-identified cybersecurity vulnerabilities” to the list of performance measures it will collect through the duration of the program.

Tenable offers fastest, broadest coverage of CISA’s KEV catalog

At Tenable, our goal is to help organizations identify their cyber exposure gaps as accurately and quickly as possible. To achieve this goal, we have research teams around the globe working to provide precise and prompt coverage for new threats as they are discovered. Tenable monitors and tracks additions to the CISA KEV catalog on a daily basis and prioritizes developing new detections where they do not already exist.

Tenable updates the KEV coverage of its vulnerability management products — Tenable Nessus, Tenable Security Center and Tenable Vulnerability Management — allowing organizations to use KEV catalog data as an additional prioritization metric when figuring out what to fix first. The ready availability of this data in Tenable products can help agencies meet the SLCGP performance measures. This blog offers additional information on Tenable’s coverage of CISA’s KEV catalog.

FY 2024 NOFO adds “Adopting Enhanced Logging” as a new performance measure

The FY 2024 NOFO also adds “Adopting Enhanced Logging” to the list of performance measures CISA will collect throughout the program duration.

How Tenable’s library of compliance audits can help with Enhanced Logging

Tenable's library of Compliance Audits, including Center for Internet Security (CIS) and Defense Information Systems Agency (DISA), allows organizations to assess systems for compliance, including ensuring Enhanced Logging is enabled. Tenable's vulnerability management tools enable customers to easily schedule compliance scans. Users can choose from a continuously updated library of built-in audits or upload custom audits. By conducting these scans regularly, organizations can ensure their systems are secure and maintain compliance with required frameworks.

FY 2024 NOFO continues to require applicants to address program objectives in their applications

As with previous years, the FY 2024 NOFO sets four program objectives. Applicants must address at least one of the following in their applications:

  • Objective 1: Develop and establish appropriate governance structures, including by developing, implementing, or revising Cybersecurity Plans, to improve capabilities to respond to cybersecurity incidents, and ensure operations.
  • Objective 2: Understand their current cybersecurity posture and areas for improvement based on continuous testing, evaluation, and structured assessments.
  • Objective 3: Implement security protections commensurate with risk.
  • Objective 4: Ensure organization personnel are appropriately trained in cybersecurity, commensurate with responsibility.

How Tenable can help agencies meet Objective 2 of the program

Tenable is uniquely positioned to help SLTs meet Objective 2 through the Tenable One Exposure Management Platform. In addition to analyzing traditional IT environments, Tenable One analyzes cloud instances, web applications, critical infrastructure environments, identity access and privilege solutions such as Active Directory and more — including highly dynamic assets like mobile devices, virtual machines and containers. Once the complete attack surface is understood, the Tenable One platform applies a proactive risk-based approach to managing exposure, allowing SLT agencies to successfully meet each of the sub-objectives outlined in Objective 2 (see table below).

Sub-objectiveHow Tenable helps
2.1.1: Establish and regularly update asset inventoryTenable One deploys purpose-built sensors across on-premises and cloud environments to update inventories of human and machine assets, including cloud, IT, OT, IoT, mobile, applications, virtual machines, containers and identities
2.3.2. Effectively manage vulnerabilities by prioritizing mitigation of high-impact vulnerabilities and those most likely to be exploited.

Tenable One provides an accurate picture of both internal and external exposure by detecting and prioritizing a broad range of vulnerabilities, misconfiguration and excessive permissions across the attack surface.

Threat intelligence and data science from Tenable Research are then applied to give agencies easy-to-understand risk scores. For example, Tenable One provides advanced prioritization metrics and capabilities, asset exposure scores which combine total asset risk and asset criticality, cyber exposure scoring which calculates overall exposure for the organization, peer benchmarking for comparable organizations, as well as the ability to track SLAs and risk patterns over time.

Further, Tenable One provides rich critical technical context in the form of attack path analysis that maps asset, identity and risk relationships which can be exploited by attackers. It also provides business context by giving users an understanding of the potential impact on the things that matter most to an agency, such as business critical apps, services, processes and functions. These contextual views greatly improve the ability of security teams to prioritize and focus action where they can best reduce the potential for material impact. These advanced prioritization capabilities, along with mitigation guidance, ensure high-risk vulnerabilities can be addressed quickly.

2.4.1 SLT agencies are able to analyze network traffic and activity transiting or traveling to or from information systems, applications, and user accounts to understand baseline activity and identify potential threats.

Tenable provides purpose-built sensors, including a passive sensor, which can determine risk based on network traffic. After being placed on a Switched Port Analyzer (SPAN) port or network tap, the passive sensor will be able to discover new devices on a network as soon as they begin to send traffic, as well as discover vulnerabilities based on, but not limited to:

  • Services
  • User-agents
  • Application traffic
2.5.1 SLT agencies are able to respond to identified events and incidents, document root cause, and share information with partners.

Tenable One can help SLT agencies respond to identified events and incidents and document root cause more quickly. SOC analysts managing events and incidents and vulnerability analysts focused on remediation of vulnerabilities have access to deep technical content in the form of attack paths, with risk and and configuration details to verify viability, as well as business context to understand the potential impact to their agency.

This information is valuable not only to validate why IT teams should prioritize mitigation of issues before breach, but to prove that a successful attack has occurred. Further, agencies can deliver dashboards, reports and scorecards to help share important security data in meaningful ways across teams and with partners. Agencies are able to customize these to show the data that matters most and add details specific to their requirements. 

Source: Tenable, October 2024

Tenable One deployment options offer flexibility for SLT agencies

Tenable offers SLT agencies flexibility in their implementation models to help them best meet the requirements and objectives outlined as part of the SLCGP. Deployment models include:

  • Centralized risk-based vulnerability program managed by a state Department of Information Technology (DoIT)
  • Multi-entity projects
  • Decentralized deployments of Tenable One managed by individual municipalities,
  • Managed Security Service Provider (MSSP) models that allow agencies to rapidly adopt solutions by utilizing Tenable’s Technology Partner network.

Whole-of-state approach enables state-wide collaboration and cooperation

A “whole-of-state” approach — which enables state-wide collaboration to improve the cybersecurity posture of all stakeholders — allows state governments to share resources to support cybersecurity programs for local government entities, educational institutions and other organizations. Shared resources increase the level of defense for SLTs both individually and as a community and reduce duplication of work and effort. States get real-time visibility into all threats and deploy a standard strategy and toolset to improve cyber hygiene, accelerate incident response and reduce statewide risk. For more information, read Protecting Local Government Agencies with a Whole-of-State Cybersecurity Approach.

FY 2024 NOFO advises SLT agencies to adopt key cybersecurity best practices

As in previous years, the FY 2024 NOFO again recommends SLT agencies adopt key cybersecurity best practices. To do this, they are required to consult the CISA Cross-Sector Cybersecurity Performance Goals (CPGs) throughout their development of plans and projects within the program. This is also a statutory requirement for receiving grant funding.

How Tenable One can help agencies meet the CISA CPGs

The CISA CPGs are a prioritized subset of cybersecurity practices aimed at meaningfully reducing risk to critical infrastructure operations and the American people. They provide a common set of IT and operational technology (OT) fundamental cybersecurity best practices to help SLT agencies address some of the most common and impactful cyber risks. Learn more about how Tenable One can help agencies meet the CISA CPGs here.

Learn more




anc

Securing Financial Data in the Cloud: How Tenable Can Help

Preventing data loss, complying with regulations, automating workflows and managing access are four key challenges facing financial institutions. Learn how Tenable can help.

Imagine a bustling bank, made not of bricks and mortar, but of a swirling mass of data in the cloud. Account numbers, transaction histories and personally identifiable information (PII) zip across servers, powering the financial world. Holding all this sensitive data requires tremendous care. Therefore, securing this sensitive information is paramount.

This is where Tenable Cloud Security steps in, offering a data security shield specifically designed for the unique needs of financial institutions.

The challenge: A data deluge demands vigilance

Financial institutions generate massive volumes of data daily. While the public cloud offers unparalleled capacity to store such data, along with agility and scalability, the cloud also expands the attack surface. Legacy cybersecurity solutions are often unable to manage — let alone secure — the sheer volume of data and the variety of ways it is accessed, leaving organizations exposed to malicious actors. At the same time, financial institutions must keep up with new and evolving compliance standards and regulations set forth by governing bodies. Financial institutions need a security platform that helps them protect their data and maintain compliance.

Tenable Cloud Security’s advantage: Seeing beyond the walls

Tenable Cloud Security actively scrutinizes every corner of the cloud data vault, continuously and automatically.

"Without [Tenable Cloud Security], we would've been virtually blind to risks and threats impacting our sensitive data. [Tenable Cloud Security] allows us to preempt any issues and meet the requirements we're receiving from our business partners, with minimal effort.

— VP Security at a leading Fintech platform

Here's how Tenable empowers financial institutions:

  • Protecting sensitive data: Tenable doesn't just guard the door; it knows what's inside and how to best protect it. It identifies and labels all data, like financial records and social security numbers, understanding its sensitivity and prioritizing its protection.
  • Continuous monitoring: Imagine guards constantly scanning every inch of the vault. Tenable does the same digitally, using advanced technology to constantly search for suspicious activity and potential breaches. Any unusual movement of the data, either exfiltration or copying to a different and inaccessible location, triggers an alarm, allowing for immediate intervention.
  • Policy enforcement: Just like a vault needs clear access protocols, so does your data. Tenable automates setting and enforcing cybersecurity policies across the entire cloud, ensuring everyone plays by the book and no unauthorized hands touch the valuables.
  • Following mandated regulations: Financial institutions juggle a complex set of regulations and industry standards like the Payment Card Industry Data Security Standard (PCI-DSS). Tenable simplifies compliance with a host of international regulations by providing timely reports and audit trails.

Beyond traditional security: More than just a lock

Modern technology stacks for data storage require a modern cybersecurity stack. Traditional security solutions are unable to address the unique risks associated with storing data in cloud technologies. Financial organizations that leverage Tenable’s data security platform are able to meet existing and future challenges, including:

  • Preventing data loss: Early detection and prevention of unauthorized data access can help organizations minimize financial losses and reputational damage, keeping valuable assets safe from even the most cunning thieves.
  • Complying with regulations: Automated reports and adherence to the most stringent regulations and industry standards ensure compliance, saving time and resources.
  • Automating workflows: Tenable automates tasks and provides deeper insights into how data behaves, enabling organizations to free up their valuable resources for other endeavors and make their security teams more efficient.
  • Managing access: Just like knowing who has access to the vault is crucial. Tenable tracks who and what has access to data, ensuring only authorized parties can handle the data.

The future of financial security is data-centric

Tenable Cloud Security's data-centric approach positions it as a valuable partner, not just for guarding the perimeter but for understanding the inner workings of the vault and the most sensitive data within it. By leveraging Tenable’s capabilities, financial institutions can confidently embrace the cloud while ensuring the highest level of security for their most valuable assets — their data.

To learn more about how you can secure your data




anc

CSA encourages Canadians to have the “money talk” to prevent financial abuse

SAINT JOHN, NB - In recognition of Financial Literacy Month’s theme “Money on your Mind?




anc

Innovations of targeted poverty reduction governance and policy in Zhejiang Province: Insights from China’s post-2020 anti-poverty strategy [in Chinese]




anc

CSA Investor Alert: Investment scams imitating well-known financial brands

Toronto – The Canadian Securities Administrators (CSA) is warning the public about scammers claiming to represent large, well-known financial companies.  Recently, the CSA has noted an increase in the number of scams involving the use of professional looking electronic broch




anc

Irrigation schemes in Ethiopia’s Awash River Basin: An examination of physical, knowledge, and governance infrastructures

Using a representative sample of irrigation schemes, the study documents the physical, knowledge, and governance infrastructures of irrigation schemes in Ethiopia’s most intensively used river basin, the Awash. The findings show that about 20 percent of the equipped area of irrigation schemes in the basin is not being irrigated, while the number of actual beneficiaries […] Source: IFPRI Ethiopia: Ethiopia Strategy Support Program




anc

Targeting social assistance in fragile settings: An experiment on community-based targeting

Targeting is an important but challenging process in the design and delivery of social and humanitarian assistance programs. Community-based targeting (CBT) approaches are often preferred for their local information advantages, especially when data-driven methods are not feasible. However, how different variants of CBT approaches fare under various constraints and environments remains unclear. For example, it […] Source: IFPRI Ethiopia: Ethiopia Strategy Support Program




anc

Integrated and enhanced datasets on food security and household coping strategies in the G5 Sahel Countries (2018-2023)

The objective of this analysis is to gain more insight into the coping behavior of households in Mali when facing covariate shocks and stressors of different kinds Source: IFPRI Africa Regional Office (AFR)




anc

Integrated and enhanced datasets on food security and household coping strategies in the G5 Sahel Countries (2018-2023) Copy

The objective of this analysis is to gain more insight into the coping behavior of households in Mali when facing covariate shocks and stressors of different kinds Source: IFPRI Africa Regional Office (AFR)




anc

Tenable Research Uncovers Thousands of Vulnerable Cyber Assets Amongst Southeast Asia’s Financial Sector

 New research conducted by Tenable®, Inc., the exposure management company, has uncovered more than 26,500 potential internet-facing assets among Southeast Asia’s top banking, financial services and insurance (BFSI) companies by market capitalisation across Indonesia, Malaysia, the Philippines, Singapore, Thailand and Vietnam.

On July 15, 2024, Tenable examined the external attack surface of over 90 BFSI organisations with the largest market capitalisations across the region. The findings revealed that the average organisation possesses nearly 300 internet-facing assets susceptible to potential exploitation, resulting in a total of more than 26,500 assets across the study group.

Singapore ranked the highest among the six countries assessed, with over 11,000 internet-facing assets identified across its top 16 BFSI companies. Over 6,000 of those assets are hosted in the United States. Next on the list is Thailand with over 5000 assets. The distribution of internet-accessible assets underscores the need for cybersecurity strategies that adapt to the rapidly evolving digital landscape.

CountryNumber of internet-facing assets amongst top 90 BFSI companies by market capitalisation
  1. Singapore
11,000
  1. Thailand
5,000
  1. Indonesia
4,600
  1. Malaysia
4,200
  1. Vietnam
3,600
  1. Philippines
2,600

“The results of our study reveal that many financial institutions are struggling to close the priority security gaps that put them at risk. Effective exposure management is key to closing these gaps,” said Nigel Ng, Senior Vice President, Tenable APJ. “By identifying and securing vulnerable assets before they can be exploited, organisations can better protect themselves against the growing tide of cyberattacks.” 


Cyber Hygiene Gaps 
The Tenable study revealed many potential vulnerabilities and exposed several cyber hygiene issues among the study group, including outdated software, weak encryption, and misconfigurations. These vulnerabilities provide cybercriminals with easily exploitable potential entry points, posing potential risk to the integrity and security of financial data. 

Weak SSL/TLS encryption 

A notable finding is that among the total assets, organisations had nearly 2,500 still supporting TLS 1.0—a 25-year old security protocol introduced in 1999 and disabled by Microsoft in September 2022. This highlights the significant challenge organisations with extensive internet footprints face in identifying and updating outdated technologies.

Misconfiguration increases external exposure

Another concerning discovery was that over 4,000 assets, originally intended for internal use, were inadvertently exposed and are now accessible externally. Failing to secure these internal assets poses a significant risk to organisations, as it creates an opportunity for malicious actors to target sensitive information and critical systems.

Lack of encryption 

There were over 900 assets with unencrypted final URLs, which can present a security weakness. When URLs are unencrypted, the data transmitted between the user's browser and the server is not protected by encryption, making it vulnerable to interception, eavesdropping, and manipulation by malicious actors. This lack of encryption can lead to the exposure of sensitive information, such as login credentials, personal data, or payment details, and can compromise the integrity of the communication.


API vulnerabilities amplify risk

The identification of over 2,000 API v3 out of the total number of assets among organisations' digital infrastructure poses a substantial risk to their security and operational integrity.

APIs serve as crucial connectors between software applications, facilitating seamless data exchange. However, inadequate authentication, insufficient input validation, weak access controls, and vulnerabilities in dependencies within API v3 implementations create a vulnerable attack surface.

Malicious actors can exploit such weaknesses to gain unauthorised access, compromise data integrity, and launch devastating cyber attacks.

“The cybersecurity landscape is evolving faster than ever, and financial institutions must evolve with it, so they can know where they are exposed and take action to close critical risk” Ng added. “By prioritising exposure management, these organisations can better protect their digital assets, safeguard customer trust, and ensure the resilience of their operations in an increasingly hostile digital environment.”

About Tenable
Tenable® is the exposure management company, exposing and closing the cybersecurity gaps that erode business value, reputation and trust. The company’s AI-powered exposure management platform radically unifies security visibility, insight and action across the attack surface, equipping modern organizations to protect against attacks from IT infrastructure to cloud environments to critical infrastructure and everywhere in between. By protecting enterprises from security exposure, Tenable reduces business risk for more than 44,000 customers around the globe. Learn more at tenable.com

Notes to Editors:

  1. Tenable examined the top 12-16 BFSI companies discoverable based on market cap. 
  2. In the context of this alert:
  • An asset is a domain name, subdomain, or IP addresses and/or combination thereof of a device connected to the Internet or internal network. An asset may include, but not limited to web servers, name servers, IoT devices, network printers, etc. Example: foo.tld, bar.foo.tld, x.x.x.xs.
  • The Attack Surface is from the network perspective of an adversary, the complete asset inventory of an organisation including all actively listening services (open ports) on each asset.




anc

Tenable Enhances Nessus Risk Prioritization to Help Customers Expose and Close Exposures

Tenable®, the exposure management company, today announced new risk prioritization and compliance features for Tenable Nessus, the #1 vulnerability assessment solution in accuracy, coverage and adoption. Nessus supports new and updated vulnerability scoring systems – Exploit Prediction Scoring System (EPSS) and Common Vulnerability Scoring System (CVSS) v4 – to help customers implement more effective prioritization for risk reduction and maintain compliance.

Due to evolving threats and expanding attack surfaces, organizations rely on multiple risk scoring systems, which are not effective risk qualifiers on their own to determine criticality. With Tenable Nessus, customers can take advantage of the latest industry-adopted vulnerability scoring systems – EPSS and CVSS v4 – and Tenable Vulnerability Priority Rating (VPR) to identify and take action on the vulnerabilities that pose the greatest risk specific to their environment. Leveraging an advanced data science algorithm developed by Tenable Research, Tenable VPR combines and analyzes Tenable proprietary vulnerability data, third-party vulnerability data and threat data to effectively and efficiently measure risk.

“EPSS and CVSS are single variables in the risk equation – context around exposures delivers a deeper level of understanding around true risk,” said Shai Morag, chief product officer, Tenable. “Recent Tenable Research found that only 3% of vulnerabilities most frequently result in impactful exposure. We’ve optimized Nessus to meet the evolving needs of our customers, empowering informed vulnerability prioritization strategies to address these critical few.”

Key features in this release include:

  • EPSS and CVSS v4 Support enables users to see and filter plugins by EPSS and CVSS v4 score, further informing prioritization strategy. This feature enables security teams to remain compliant with organizational policies that require the use of EPSS or CVSS as the primary scoring system.
  • Nessus Offline Mode addresses challenges with conducting vulnerability scans offline in air-gapped environments. Building upon existing offline scanning capabilities, Nessus runs critical services only, removing unwanted traffic generated by functions that rely on an active internet connection, thereby ensuring the security of sensitive data within a secure environment.
  • Declarative Agent Versioning On-Prem enables users to create and manage agent profiles in Nessus Manager for Tenable Security Center. Users can specify a product version for an agent deployed in an environment, thereby reducing disruptions in day-to-day operations and enabling users to adhere to enterprise change control policies.

Learn more about vulnerability and risk scoring by checking out the Inaugural Study of EPSS Data and Performance developed by Cyentia Institute and the Forum of Incident Response and Security Teams (FIRST).

Join the upcoming Tenable webinar titled, From Data to Defense: Harnessing Predictive Scoring to Strengthen Your Cybersecurityon September 12, 2024 at 2:00 pm ET, by registering here.

Tenable Nessus is available as a standalone product and is included in Tenable Security Center and Tenable Vulnerability Management. More information on Tenable Nessus is available at: https://www.tenable.com/products/nessus

 

About Tenable

Tenable® is the exposure management company, exposing and closing the cybersecurity gaps that erode business value, reputation and trust. The company’s AI-powered exposure management platform radically unifies security visibility, insight and action across the attack surface, equipping modern organizations to protect against attacks from IT infrastructure to cloud environments to critical infrastructure and everywhere in between. By protecting enterprises from security exposure, Tenable reduces business risk for more than 44,000 customers around the globe. Learn more at tenable.com.

 

###

Media Contact:

Tenable

tenablepr@tenable.com




anc

Mozart's sister / Nancy Moser.

Christy Award winner Nancy Moser is the best-selling author of more than 16 popular books of faith and inspiration. In this compelling historical novel, Wolfgang Mozart's little-known sister Nannerl tells the tale of her own bittersweet life. Eleven-year-old Nannerl is arguably the best keyboard player in all of Europe. Yet because her six-year-old brother Wolfie can play almost as well as she, he receives virtually all the praise and adulation. Traveling far and wide with her family, she and her brother perform before the crowned heads of Europe. Social convention and public clamor relegate her to living life in the shadow of a prodigy. But when will Nannerl ever realize her own dreams and aspirations? "Moser's writing is smooth" and replete with "fascinating historical details" Publishers Weekly "Mozart's Sister is a masterpiece of lyrical prose; a deeply moving story that embodies a love for music and a fascination with history. Bravisima, Ms. Moser!"-Tamera Alexander, best-selling author of Rekindled.




anc

Mr. Putter & Tabby dance the dance / Cynthia Rylant.

Newbery Medalist Cynthia Rylant weaves tales with tremendous appeal to young readers, and her popular Mr. Putter and Tabby series stars two of Rylant's most memorable characters. It's no secret that Mr. Putter does not like to dance. But when his neighbor Mrs. Teaberry develops a fondness for ballroom dancing, she is able to convince the reluctant Mr. Putter to join her for a night at the Crystal Ballroom- with beloved pets Tabby and Zeke in tow, of course!




anc

Los Museos de Bellas Artes de San Francisco presentan «Mary Cassatt at Work»

Los Museos de Bellas Artes de San Francisco presentan «Mary Cassatt at Work» Del 5...




anc

El Museo Guggenheim presenta “Armonía y disonancia: orfismo en París, 1910-1930”

El Museo Guggenheim presenta “Armonía y disonancia: orfismo en París, 1910-1930” Del 8 de noviembre...




anc

Analyse des flux physiques, performances économiques et relations au sein des filières de manioc, de riz, de lait et de poisson au Sud-Kivu et Tanganyika (RDC 2021)

Ce document présente une analyse des chaînes de valeur agroalimentaires de manioc, de riz, de lait et de poisson le long du corridor économique entre les capitales provinciales de Bukavu (Sud-Kivu) et Kalemie (Tanganyika) situées dans la partie orientale de la République démocratique du Congo (RDC). Les principales données utilisées pour cette étude proviennent d’enquêtes menées en 2021 auprès d’environ 3000 acteurs conomiques familiaux, y compris des agriculteurs, des transformateurs et des intermédiaires, actifs dans une ou plusieurs des quatre filières ciblées.




anc

Mary Cassatt at Work at the Fine Arts Museums of San Francisco

Mary Cassatt at Work at the Fine Arts Museums of San Francisco From October 5,...




anc

Guggenheim Museum presents “Harmony and Dissonance: Orphism in Paris, 1910–1930”

Guggenheim Museum presents “Harmony and Dissonance: Orphism in Paris, 1910–1930” From 8 November 2024 to...





anc

Global Food Policy Report 2024: Improving governance to create supportive environments for diet and nutrition policies

Global Food Policy Report 2024: Improving governance to create supportive environments for diet and nutrition policies

Key steps to strengthen institutions and relationships

The post Global Food Policy Report 2024: Improving governance to create supportive environments for diet and nutrition policies appeared first on IFPRI.




anc

From risk to resilience: How strategic government partnerships can enhance access to insurance-linked credit for smallholders in Zambia

From risk to resilience: How strategic government partnerships can enhance access to insurance-linked credit for smallholders in Zambia

The power of bundled solutions

The post From risk to resilience: How strategic government partnerships can enhance access to insurance-linked credit for smallholders in Zambia appeared first on IFPRI.




anc

Rules for resistance : advice from around the globe for the age of Trump / edited and with an introduction by David Cole ; co-edited by Melanie Wachtell Stinnett.




anc

Swing Ann Arbor: Weekly Beginner Lesson + Social Dance (November 13, 2024 6:30pm)

Event Begins: Wednesday, November 13, 2024 6:30pm
Location: Vandenberg Room (2nd floor)
Organized By: Maize Pages Student Organizations


Swing Ann Arbor hosts a beginner drop-in lesson and social dance every Wednesday! No partner or experience needed. You do not need to be student of the University of Michigan to attend. Just bring yourself and some comfy shoes! WHEN:
Join us Wednesdays from 6:30-7:30pm for a free beginner drop-in lesson, followed by a social dance from 7:30-9:30pm!  COST:
Admission to beginner drop-in lesson: FREE!
Admission to social dance: $5 or FREE if you take the beginner drop-in lesson/are an SAA member Photo Credit: Samantha Kunz Photography




anc

Amawele’s Cuisine Brings South African Flavors to San Francisco

Pam and Wendy Drew are South African identical twins who do everything together; from travel to entering the same career paths and now owning and operating Amawele’s Cuisine in San Francisco. The name of their restaurant came easy—it simply means “The Twins” in Zulu.   Amawele’s Cuisine serves what Wendy and Pam consider to be … Continue reading Amawele’s Cuisine Brings South African Flavors to San Francisco




anc

EAT Action Dialogues on “Mobilizing Finance for the Food System Transformation”

EAT Action Dialogues on “Mobilizing Finance for the Food System Transformation”

This dialogue series is by invitation only. In preparation for the 2025 launch of the EAT-Lancet Commission 2.0, EAT is hosting a series of ‘EAT Action Dialogues’ to engage with stakeholders and co-create solutions for transforming food systems in line with the new targets and recommendations of the EAT-Lancet Commission 2.0.  The first two Dialogues will […]

The post EAT Action Dialogues on “Mobilizing Finance for the Food System Transformation” appeared first on IFPRI.




anc

Advancing Sustainable Agri-food Systems for Climate Resilience, Food Security, and Global Collaboration

Advancing Sustainable Agri-food Systems for Climate Resilience, Food Security, and Global Collaboration

The livestream will be available on Tuesday November 12, 2024 at 5:00 – 6:30 pm (America/Sao_Paulo) / 3:00 – 4:30 pm (US/Eastern). Join us for an in-depth discussion on Avanzar2030, an evidence-based initiative that identifies promising innovations in agri-food systems and estimates the costs of implementing them. Launched in response to the 2021 UN Food […]

The post Advancing Sustainable Agri-food Systems for Climate Resilience, Food Security, and Global Collaboration appeared first on IFPRI.




anc

Agricultural growth key to accelerated poverty reduction in Bangladesh (Financial Express)

Agricultural growth key to accelerated poverty reduction in Bangladesh (Financial Express)

Senior research fellow and country representative, Akhter Ahmed writes in an op-ed for the Financial Express (Bangladesh) that the country “has witnessed substantial economic growth over the past decade, with an average annual gross domestic product (GDP) growth of 6.6 per cent between 2016 and 2022. Notably, the country experienced a 3.4 per cent increase in GDP in 2020, making Bangladesh one […]

The post Agricultural growth key to accelerated poverty reduction in Bangladesh (Financial Express) appeared first on IFPRI.




anc

Steven Were Omamo joins IFPRI as the new Director of the Development Strategies and Governance Unit

Steven Were Omamo joins IFPRI as the new Director of the Development Strategies and Governance Unit

IFPRI is pleased to announce that Steven Were Omamo joins IFPRI as the new Director of the DSG Unit.

The post Steven Were Omamo joins IFPRI as the new Director of the Development Strategies and Governance Unit appeared first on IFPRI.