ant New Opinion Allowing Plaintiff to Present His Class Action Willful FCRA Claims to a Jury Reinforces Need to Remain Vigilant About FCRA Compliance By www.littler.com Published On :: Thu, 21 Apr 2022 15:11:48 +0000 The Fair Credit Reporting Act (FCRA) is a federal law that governs employment-related background checks. Most lawsuits asserting federal claims proceed in federal court.1 The FCRA is atypical in that FCRA claims can proceed in either federal or state court. A new opinion from a California court of appeal in Hebert v. Full Article
ant Atlanta Amends Anti-Discrimination Ordinance to Include Protections for Gender Expression and Criminal Histories By www.littler.com Published On :: Thu, 10 Nov 2022 15:20:07 +0000 The City Council of Atlanta, Georgia recently passed an ordinance that amends its existing anti-discrimination law to include protection on the basis of “criminal history status” as well as “gender expression.” The ordinance is effective immediately. With regard to gender expression, the law simply amends existing law to include “gender expression” as an additional protected characteristic. Full Article
ant Atlanta Amends Anti-Discrimination Ordinance to Include Protections for Gender Expression and Criminal Histories By www.littler.com Published On :: Wed, 16 Nov 2022 15:41:49 +0000 Rachel P. Kaercher, Wendy Buckingham and William J. Simmons examine a new ordinance passed by the Atlanta City Council that amends its existing anti-discrimination law to include protections on the basis of criminal history status and gender expression. SHRM Online View (Subscription required.) Full Article
ant Employers Face June 1, 2024 Deadline to Comply with Lehigh County, Pennsylvania’s New Expansive Anti-Discrimination Ordinance By www.littler.com Published On :: Thu, 02 May 2024 16:48:51 +0000 The Lehigh County Human Relations Ordinance was enacted February 26, 2024, establishing county-specific non-discrimination requirements for employment, housing, education, health care and public accommodations. The ordinance also creates a Lehigh County Human Relations Commission charged with investigating and enforcing claims of discrimination. The ordinance becomes effective June 1, 2024. Expanded Protected Characteristics and Employer Coverage Full Article
ant California Court of Appeal Thwarts Efforts to Conceal Important Driving History Information from Employers By www.littler.com Published On :: Mon, 08 Jul 2024 15:05:17 +0000 Employers with operations in California are all too familiar with how state and local officials continue to restrict the access employers have to public records, including criminal history information.1 For example, lengthy delays in completing standard criminal background checks are now routine in California.2 Apart from criminal background checks, many employers rely on motor vehicle record checks (MVRs) to vet candidates for positions that require driving as part of the job. In Doe v. California Dept. Full Article
ant Top 5 Changes in the SECURE 2.0 Act for Plan Sponsors and Participants By www.littler.com Published On :: Thu, 29 Dec 2022 18:21:13 +0000 The Securing a Strong Retirement Act of 2022 included in the omnibus spending bill includes five significant changes for employers and plan sponsors: Full Article
ant Watch Out New York – New Jersey Wants Its Taxes Too! By www.littler.com Published On :: Fri, 22 Sep 2023 19:14:07 +0000 On July 21, 2023, New Jersey Governor Phil Murphy signed Assembly Bill No. S3128/A4694 into law,1 which implements an aggressive tax treatment of nonresidents who work for New Jersey employers. Full Article
ant Shift Work and Tax Relief in Belgium: The New Law Introducing the ‘Variant Bis’ Has Been Published By www.littler.com Published On :: Fri, 31 May 2024 15:45:07 +0000 We recently reported on the saga that followed the Constitutional Court's ruling of February 8, 2024 on the conditions for applying the partial exemption from payment of withholding tax for employers organizing shift work (CIR/92, art. 275/5). The ruling of February 8, 2024, had given rise to fears among many employers whose successive shifts fluctuate in size that they would simply lose the tax advantage, which can represent a reduction of 10 to 15% in the wage costs associated with shift workers. Full Article
ant Congressional Democrats Want to Weaponize Federal Labor Law By www.littler.com Published On :: Tue, 21 Sep 2021 21:37:05 +0000 Michael Lotito writes about unions and their allies’ attempts to sneak parts of the Protecting the Right to Organize (PRO) Act into the budget bill. The Wall Street Journal View (Subscription required.) Full Article
ant Arbitrator upholds reasonableness of hospital vaccination policy for termination of non-compliant By www.littler.com Published On :: Thu, 22 Jun 2023 19:08:17 +0000 Rhonda B. Levy and Barry Kuretzky discuss a case in which an arbitrator issued the first award in Ontario to address and uphold the reasonableness of a hospital vaccination policy that allows employers to terminate employees for non-compliance. Human Resources Director Canada View (Subscription required.) Full Article
ant Pencils, Paper, and Now NLRA Legal Protections – New General Counsel Memorandum Provides College Student Athletes with a Very Significant New “School Supply” By www.littler.com Published On :: Fri, 01 Oct 2021 18:32:52 +0000 On September 29, 2021, National Labor Relations Board (NLRB) General Counsel (GC) Jennifer A. Abruzzo released a nine-page memorandum taking the unequivocal position that “certain Players at Academic Institutions” are employees under Section 2(3) of the National Labor Relations Act (NLRA). Refusing to call such players “student athletes,” Abruzzo asserts in the memorandum (GC 21-08) that: Full Article
ant Legal Landmines for Restaurant Owners By www.littler.com Published On :: Tue, 26 Jul 2016 14:20:51 +0000 Libby Henninger authored this article outlining focus areas for employers reviewing compensation policies and practices. Food & Beverage Magazine View Article Full Article
ant The Labor Dept. Wants to Revise a Trump-Era Policy on Handling of Discrimination Claims Against Contractors By www.littler.com Published On :: Wed, 30 Mar 2022 19:23:41 +0000 David Goldstein talks about some differences as the Labor Department proposes changes to a Trump-era rule that it says “undermined” how it handles and resolves discrimination claims by federal contractors. Government Executive View Full Article
ant New Haven Office Kicks Off 2024 with a New Leader – Littler Selects Paula Anthony as Office Managing Shareholder By www.littler.com Published On :: Wed, 03 Jan 2024 21:05:16 +0000 NEW HAVEN, Conn. (January 4, 2024) – Littler, the world’s largest employment and labor law practice representing management, has appointed Paula Anthony as office managing shareholder (OMS) of the firm’s New Haven, Connecticut office, effective January 1, 2024. Anthony succeeds Lori Alexander who will be stepping down to continue to focus on her full-time litigation and advice practice. Full Article
ant Littler Adds Unfair Competition and Trade Secrets Litigator Phillip Antablin in Los Angeles By www.littler.com Published On :: Mon, 19 Aug 2024 16:24:52 +0000 LOS ANGELES (August 19, 2024) – Littler, the world’s largest employment and labor law practice representing management, has added Phillip Antablin as a shareholder in its Century City office in Los Angeles. Antablin previously served as Senior Counsel at Epstein Becker Green. Full Article
ant New amendments to California bill clarify scope of prohibition on junk fees for restaurant industry By www.littler.com Published On :: Mon, 11 Nov 2024 23:43:48 +0000 Stacey James and Jamie L. Santos discuss a California amendment that seeks to allow restaurants to support higher wages and benefits while clearly disclosing service fees to consumers upfront. Wolters Kluwer View (Subscription required) Full Article
ant China’s New Cross-Border Data Transfer Rules Substantially Reduce Compliance Burdens for Multinational Employers By www.littler.com Published On :: Wed, 27 Mar 2024 20:33:12 +0000 Multinational employers operating in China have been waiting since September 2023 for the Cyberspace Administration of China (CAC) to finalize proposed revisions to its complex and burdensome rules for cross-border data transfers. Relief arrived on March 22, 2024, when the CAC published the “Provisions on Promoting and Regulating Cross-border Data Flows” (the “Approved Provisions”), which went into effect on the same day. Full Article
ant Colorado’s Landmark AI Legislation Would Create Significant Compliance Burden for Employers Using AI Tools By www.littler.com Published On :: Thu, 16 May 2024 21:09:22 +0000 UPDATE: On May 17, 2024, Colorado Governor Jared Polis signed Senate Bill 24-205 into law, although not without reservations. Governor Polis sent a letter to the members of the Colorado General Assembly encouraging them to reconsider and amend aspects of Senate Bill 24-205 before it takes effect on February 1, 2026. Full Article
ant Legal-Ease: Your Lawyer as Your Business Consultant – A Labor & Employment Perspective By www.littler.com Published On :: Wed, 05 Jun 2024 16:21:45 +0000 Kristy Peters discusses how employment law attorneys can be critical partners for employers to help them identify challenges and opportunities for their business. InBusiness Phoenix View Full Article
ant Important Changes for Businesses in Australia – What Employers Should Know By www.littler.com Published On :: Thu, 17 Oct 2024 17:43:21 +0000 Several new employment law changes in Australia have or will soon become enforceable. Employers may need to review and revise their policies and procedures governing wage theft, the right to disconnect, shut-down notices, privacy, sexual harassment, and independent contractors. Full Article
ant AIOTI, ISO/IEC JTC1, ETSI, oneM2M and W3C Collaborate on Two Joint White Papers on Semantic Interoperability Targeting Developers and Standardization Engineers By www.etsi.org Published On :: Thu, 28 Apr 2022 06:12:23 GMT AIOTI, ISO/IEC JTC1, ETSI, oneM2M and W3C Collaborate on Two Joint White Papers on Semantic Interoperability Targeting Developers and Standardization Engineers Cross-organization expert group works together on accelerating adoption of semantic technologies in IoT. AIOTI today announced its collaborative role in the publication of two joint white papers on semantic interoperability entitled Semantic IoT Solutions - A Developer Perspective and Towards semantic interoperability standards based on ontologies in conjunction with organizations closely tied to the advancement of the IoT ecosystem. Read More... Full Article
ant ETSI IoT Week: semantics, experiences and security By www.etsi.org Published On :: Thu, 28 Apr 2022 06:12:48 GMT ETSI IoT Week: semantics, experiences and security Sophia Antipolis, 28 October 2019 ETSI IoT Week 2019 (21-25 October) drew more than 200 attendees to ETSI’s headquarters for what has become a must attend event for anyone who wants to understand the importance of standard-enabled technologies for IoT service deployments, in many different sectors. Read More... Full Article
ant ETSI OSM organizes its first fully remote Hackfest with a record number of participants By www.etsi.org Published On :: Thu, 28 Apr 2022 14:03:29 GMT ETSI OSM organizes its first fully remote Hackfest with a record number of participants Sophia Antipolis, 16 March 2020 These are special times where many face-to-face meetings are being postponed or canceled. But when the going gets tough, the tough gets going and ETSI OSM opted for reorganizing its Hackfest, originally planned as a physical event in Madrid from 9 to 12 March 2020, as a fully remote event. What originally seemed a huge challenge due to the hands-on approach and the high level of interaction required in a Hackfest, proved possible in a record time thanks to the outstanding engagement of the OSM community and the means provided by ETSI, making this Hackfest one of the best attended ever. The 4 days of Hackfest were run in parallel with the OSM Mid-Release EIGHT meeting and the OSM Ecosystem Day, also held remotely. Read More... Full Article
ant ETSI releases migration strategies and recommendations for Quantum-Safe schemes By www.etsi.org Published On :: Thu, 28 Apr 2022 14:21:53 GMT ETSI releases migration strategies and recommendations for Quantum-Safe schemes Sophia Antipolis, 11 August 2020 The ETSI Quantum-Safe Cryptography (QSC) working group is pleased to announce the release of Technical Report TR 103 619 defining migration strategies and recommendations for Quantum-Safe schemes, and enhancing cryptography awareness across all business sectors. Read More... Full Article
ant ETSI’s CTO granted the prestigious award of Wireless World Research Forum By www.etsi.org Published On :: Thu, 18 Feb 2021 17:15:55 GMT ETSI’s CTO granted the prestigious award of Wireless World Research Forum Sophia Antipolis, 18 February 2021 During WWRF 45th meeting ETSI’s Chief Technical Officer (CTO), Adrian Scrase, has been granted the prestigious award of the Wireless World Research Forum in recognition of his significant contribution to the development of mobile communications standards, and for his longstanding support of the work of WWRF. Read More... Full Article
ant Homage to Pierre Laffitte, founder of Sophia-Antipolis and former Senator By www.etsi.org Published On :: Thu, 08 Jul 2021 19:03:38 GMT Homage to Pierre Laffitte, founder of Sophia-Antipolis and former Senator Sophia Antipolis, 8 July 2021 We were very sad to hear that Pierre Laffitte passed away on 7 July, at the age of 96. President and founder of the Sophia-Antipolis technopole, a scientist and politician, he has spent countless hours contributing to making Sophia-Antipolis the largest technopole in Europe. Read More... Full Article
ant ETSI releases two Technical Reports to support US NIST standards for post-quantum cryptography By www.etsi.org Published On :: Wed, 06 Oct 2021 13:28:24 GMT ETSI releases two Technical Reports to support US NIST standards for post-quantum cryptography Sophia Antipolis, 6 October 2021 In 2016 the US National Institute of Standards and Technology (NIST) announced their intention to develop new standards for post-quantum cryptography. They subsequently initiated a competition-like standardization process with a call for proposals for quantum-safe digital signatures, public-key encryption schemes, and key encapsulation mechanisms. NIST have stated that they intend to select quantum-safe schemes for standardization at the end of the current, third round of evaluation. Read More... Full Article
ant ETSI Secures Critical Infrastructures against Cyber Quantum Attacks with new TETRA Algorithms By www.etsi.org Published On :: Mon, 07 Nov 2022 17:51:09 GMT ETSI Secures Critical Infrastructures against Cyber Quantum Attacks with new TETRA Algorithms Sophia Antipolis, 8 November 2022 With the world facing growing challenges including the war in Europe and a global energy crisis, it is essential that the mission- and business-critical communications networks used by the public safety, critical infrastructure and utilities sectors (including transportation, electricity, natural gas and water plants) are secured against third-party attacks, to protect communications and sensitive data. With more than 120 countries using dedicated TETRA (Terrestrial Trunked Radio) networks for these critical services, work has been undertaken to ensure the ETSI TETRA technology standard remains robust in the face of evolving threats. Read More... Full Article
ant ETSI Quantum-Safe Cryptography event: a success 10 years later! By www.etsi.org Published On :: Thu, 16 Feb 2023 09:56:38 GMT Sophia Antipolis, 16 February 2023 The 9th face-to-face ETSI-IQC Quantum-Safe Cryptography event this week attracted a large audience of nearly 200 people from Europe, North America and Asia, bringing together industry, academia and government. The event was kicked off by ETSI Director-General Luis Jorge Romero, who gave an overview of the quantum-safe standardization journey since the first workshop in 2013 and reiterated ETSI’s continued support for this important global effort. Read More... Full Article
ant ETSI releases World First Protection Profile for Quantum Key Distribution By www.etsi.org Published On :: Thu, 27 Apr 2023 07:58:49 GMT Sophia Antipolis, 27 April 2023 ETSI has just released a Protection Profile (PP) for the security evaluation of quantum key distribution (QKD) modules, ETSI GS QKD 016. This Protection Profile is a first and anticipates the need for quantum safe cryptography. The ETSI specification will help manufacturers to submit pairs of QKD modules for evaluation under a security certification process. Read More... Full Article
ant Preparing for a secure future: industry and business share plans for quantum era at 10th ETSI/IQC Quantum-Safe Cryptography Conference By www.etsi.org Published On :: Mon, 08 Jul 2024 08:56:55 GMT Sophia Antipolis, 24 May 2024 Speakers at the 10th ETSI/IQC Quantum Safe Cryptography Conference have called on organizations to prepare their cybersecurity infrastructures to address the challenges of a post-quantum world. Organized by ETSI and the Institute for Quantum Computing, this year’s conference was hosted from 14-16 May by the Centre for Quantum Technologies (CQT), National University of Singapore (NUS), in partnership with the Infocomm Media Development Authority (IMDA) and the Cyber Security Agency (CSA) of Singapore. The event attracted an impressive 235 onsite delegates from 27 countries, reflecting fast-growing interest worldwide in the critical importance of quantum-safe cryptography in today’s cybersecurity strategies. Read More... Full Article
ant Research Assistant/ Research Analyst I By phf.tbe.taleo.net Published On :: Wed, 24 Jul 2024 13:45:28 GMT Job Summary: The International Food Policy Research Institute (IFPRI) seeks a qualified candidate to serve as a Research Assistants/ Research Analyst I in its Development Strategies and Governance Unit for the Sudan Strategy Support Program. This is a one-year, renewable appointment. The successful candidates will work with senior research staff in the analysis of agriculture, rural development, food and nutrition security and related policies and other research activities including research work related to the ensuing conflict in Sudan. The incumbent will work under the overall guidance of the IFPRI Sudan Program Leader but will be employed directly by IFPRl's organizational host, the Arab Organization for Agricultural Development (AOAD) - employment policies, compensation, and benefits of AOAD will apply to this position. Interested applicants must have authorization to work in Sudan. The final grade level will be determined by level of education and years of relevant work experience. Essential Duties: Specific Duties include but are not limited to: Assist the collection of primary and secondary data, Asist build large dataset from multiple sources, Assist to analyze data using advance analytical methods, Assist in conducting literature reviews and synthesis, Assist in drafting and translating reports, research papers, and blog posts between English and Arabic languages, Assist in capacity building and support outreach activities, Assist to coordinate projects and conduct other duties as assigned. Required Qualifications: Research Assistant: Bachelor's or its equivalent in Economics, Agricultural Economics, Statistics, or closely related fields, Research Analyst: Bachelor’s degree plus two years of relevant professional experience or Master’s degree in a relevant discipline, Excellent knowledge of macroeconomic and/or microeconomic theory, Excellent knowledge of and quantitative econometric methods and/or economic modeling, Excellent knowledge of Stata and/or GAMS, Excellent analytical mind and drafting skills, Demonstrated fluency in written and spoken English and Arabic , Excellent interpersonal skills and to work in a team-oriented multi-cultural environment, Demonstrated ability to multi-task, meet deadlines, and manage time, Demonstrated professional level of attention to detail and accuracy of work, Ability to work independently and take initiative, Willingness to travel. Preferred Qualifications: Previous experience conducting research on and collecting data in Sudan. Familiarity with the literature on economic and agriculture development, food security, poverty reduction and related fields. Previous experience related to policy analysis and impact evaluation. Experience with spatial analysis and ARC-GIS. Experience with policy communication activities and events organization. Experience with managing websites and updating their contents. Experience in academia, the private sector, a development-oriented organization, or comparable institution, Physical Demand & Work environment Employee will sit in an upright position for a long period of time. Employee will lift between 0-10 pounds. Employee is required to have close visual acuity to perform activities such as: preparing and analyzing data and figures; transcribing; viewing computer terminal; extensive reading. Full Article
ant Research Unit Contracts & Grants Manager I By phf.tbe.taleo.net Published On :: Thu, 22 Aug 2024 19:00:50 GMT The Development Strategies and Governance (DSG) Unit within the Transformation Strategies Department of the International Food Policy Research Institute (IFPRI) seeks a Research Unit Contracts & Grants Manager I, who will be responsible for financial management which includes budgetary responsibilities, cost monitoring and control, and financial analysis and reporting, contracts administration which includes proposal preparation and submission and the administration of the Unit’s special projects. Other responsibilities include supervising Unit Admin Support staff, serving as liaison with finance and administration as well as the Director General’s office; drafting correspondence for the Unit director and communication with external contacts (donors, clients, collaborators, sub-contractors and auditors); and service as active member on various standing and ad-hoc committees, as well as work with Project Managers in management of budgets, contracts, deliverables, invoices and other payment documents. This position is a 2-year, renewable appointment based in Washington, DC. Essential Duties: Specific duties and responsibilities include but are not limited to: Providing technical support in proposal preparation, reviewing contracts to ensure they reflect the provisions negotiated, and monitoring performance of contracts and submission of specified deliverables. Drafting, negotiating and monitoring consultant collaborative agreements, serve as liaison between program collaborators and finance/administrative issues, review monthly financial reports, and provide financial analysis reports on projects. Preparing the divisional budgets and monitoring expense budgets Coordinating the drafting of project/program budgets; review of accounting transactions. Developing spreadsheets & maintaining financial information for planning & reference. Drafting routine correspondence regarding contracts or project/program finances. Assisting in financial audits Coordinating financial and operational activities for field offices Ensuring the smooth operation of the program’s day-to-day activities; coordinate seminars and workshops, manage logistical arrangements on seminars/workshops. Liaising with IFPRI HR Services, Facilities and IT department for related issues and needs. Preparing administrative and operational procedures for the division and approves timesheets Maintaining division files Supervising administrative support staff Other tasks as assigned. Required Qualifications: Bachelor’s degree plus ten years of relevant experience, or associate’s degree plus twelve years of relevant experience. Two year of management experience Experience in developing, monitoring and managing budgets and contracts. Experience in coordinating budget processes, reviewing accounting transactions, developing financial projections and reports. Solid composition, grammar and proof-reading skills, with the ability to compose correspondence and reports; excellent written and oral English communications skills. Proficient in Microsoft Office; word processing & spreadsheet programs required. Ability to handle multiple tasks & prioritize tasks with minimal supervision in a fast-paced environment. Demonstrated experience and comfort working with multiple program managers simultaneously. Ability to prioritize and coordinate tasks in such an environment. Demonstrated flexibility to adjust to multiple individual work styles. Attention to detail and ability to work within a team in a multicultural environment. Preferred Qualifications: Familiarity with IFPRI’s operational systems (finance, accounting, etc.) and the CGIAR system is highly desirable. Proficiency in a second language of the U.N. system Demonstrated proficiency with MS Office, especially Microsoft Word, Outlook, Excel, and PowerPoint required, and demonstrated proficiency with financial management and administrative software applications such as Costpoint, OnBase, Deltek, and/or other applications. Physical Demand & Work environment: Employee will sit in an upright position for a long period of time Employee will lift between 0-10 pounds. Employee is required to have close visual acuity to perform activities such as: preparing and analyzing data and figures; transcribing; viewing computer terminal; extensive reading. Salary Range: The expected salary range for this job requisition is between $85,600- $104,900. In determining your salary, we will consider your experience and other job-related factors. Benefits: IFPRI is committed to providing our staff members with valuable and competitive benefits, as it is a core part of providing a strong overall employee experience. This position is eligible for health insurance coverage and a summary of our benefits can be found on our website. Please note that the listed benefits are generally available to active, non-temporary, full-time and part-time US-based employees who work at least 25 hours per week. The International Food Policy Research Institute (IFPRI) is an equal employment opportunity employer - F/M/Disability/Vet/Sexual Orientation/Gender Identity. Full Article
ant Staff Accountant II By phf.tbe.taleo.net Published On :: Thu, 26 Sep 2024 16:30:41 GMT Job Summary: The International Food Policy Research Institute (IFPRI) seeks a Staff Accountant II for a two-year, renewable appointment to provide general accounting support in the Finance Department. This position will report to the Accounting Manager and is based at IFPRI Headquarters located in Washington, DC. Essential Duties: Specific duties and responsibilities include but are not limited to: Assist in monthly and year end closing process. Prepare monthly journal entries and provide relevant supporting documentation. Prepare monthly account reconciliations as assigned and research and clear any transactional discrepancies. Ensure field office expenditures are processed timely. Review for compliance field office expenditure reports and documentation. Handle weekly cash deposit and process monthly deposit entry. Provide audit assistance in retrieving documents for auditors to review. Provide back up support when needed in processing accounts payable transactions, wire transfers, and payroll functions. Qualifications: Bachelor’s degree in accounting, Finance or closely related field plus two years of relevant experience; or associate's degree plus five years of relevant experience. Strong attention to detail. Proficiency with Microsoft Excel. Strong analytical skills. Good oral and written communications skills. Demonstrated Ability to consistently process high volume of transactions. Preferred Qualification Deltek Costpoint Experience Physical Demand & Work environment: Employee will sit in an upright position for a long period of time. Employee will lift between 0-10 pounds. Employee is required to have close visual acuity to perform activities such as: preparing and analyzing data and figures; transcribing; viewing computer terminal; extensive reading. Salary Range: The expected salary range for this job requisition is between $55,600 - $68,100. In determining your salary, we will consider your experience and other job-related factors. Benefits: IFPRI is committed to providing our staff members with valuable and competitive benefits, as it is a core part of providing a strong overall employee experience. This position is eligible for health insurance coverage and a summary of our benefits can be found on our website. Please note that the listed benefits are generally available to active, non-temporary, full-time and part-time US-based employees who work at least 25 hours per week. The International Food Policy Research Institute (IFPRI) is an equal employment opportunity employer - F/M/Disability/Vet/Sexual Orientation/Gender Identity. Full Article
ant From Bugs to Breaches: 25 Significant CVEs As MITRE CVE Turns 25 By www.tenable.com Published On :: Tue, 22 Oct 2024 11:11:11 -0400 Twenty five years after the launch of CVE, the Tenable Security Response Team has handpicked 25 vulnerabilities that stand out for their significance.BackgroundIn January 1999, David E. Mann and Steven M. Christey published the paper “Towards a Common Enumeration of Vulnerabilities” describing an effort to create interoperability between multiple vulnerability databases. To achieve a common taxonomy for vulnerabilities and exposures, they proposed Common Vulnerabilities and Exposures (CVE). In September 1999, the MITRE Corporation finalized the first CVE list, which included 321 records. CVE was revealed to the world the following month.As of October 2024, there are over 240,000 CVEs. including many that have significantly impacted consumers, businesses and governments. The Tenable Security Response Team has chosen to highlight the following 25 significant vulnerabilities, followed by links to product coverage for Tenable customers to utilize.25 Significant CVEsCVE-1999-0211: SunOS Arbitrary Read/Write VulnerabilityArbitrary ReadArbitrary WriteLocalCritical1999Why it’s significant: To our knowledge, there is no formally recognized “first CVE.” However, the GitHub repository for CVE.org shows that the first CVE submitted was CVE-1999-0211 on September 29, 1999 at 12:00AM. Because it was the first one, we’ve chosen to highlight it. The vulnerability was first identified in 1991 and a revised patch was issued in 1994.CVE-2010-2568: Windows Shell Remote Code Execution VulnerabilityRemote Code ExecutionExploitedZero-DayLocalStuxnetHigh2010Why it’s significant: Regarded as one of the most sophisticated cyberespionage tools ever created, Stuxnet was designed to target SCADA systems in industrial environments to reportedly sabotage Iran's nuclear program. Stuxnet exploited CVE-2010-2568 as one of its initial infection vectors, spreading via removable drives. Once a compromised USB drive was inserted into a system, Stuxnet was executed automatically via the vulnerability, infecting the host machine, propagating to other systems through network shares and additional USB drives.CVE-2014-0160: OpenSSL Information Disclosure VulnerabilityHeartbleedInformation DisclosureExploitedZero-DayNetworkCybercriminalsHigh2014Why it’s significant: Dubbed “Heartbleed” because it was found in the Heartbeat extension of OpenSSL, this vulnerability allows an attacker, without prior authentication, to send a malicious heartbeat request with a false length field, claiming the packet contains more data than it does. The receiving system would then return data from its memory extending beyond the legitimate request, which may include sensitive private data, such as server keys and user credentials. OpenSSL is used by millions of websites, cloud services, and even VPN software, for encryption, making Heartbleed one of the most widespread vulnerabilities at the time.CVE-2014-6271: GNU Bash Shellshock Remote Code Execution VulnerabilityShellshock Bash Bug Remote Code ExecutionExploitedZero-DayNetworkCybercriminalsCritical2014Why it’s significant: An attacker could craft an environment variable that contained both a function definition and additional malicious code. When Bash, a command interpreter used by Unix-based systems including Linux and macOS, processed this variable, it would execute the function, but also run the arbitrary commands appended after the function definition. “Shellshock” quickly became one of the most severe vulnerabilities discovered, comparable to Heartbleed’s potential impact. Attackers could exploit Shellshock to gain full control of vulnerable systems, leading to data breaches, service interruptions and malware deployment. The impact extended far beyond local systems. Bash is used by numerous services, particularly web servers, via CGI scripts to handle HTTP requests.CVE-2015-5119: Adobe Flash Player Use After FreeRemote Code Execution Denial-of-ServiceExploitedZero-DayCybercriminalsAPT GroupsCritical2015Why it’s significant: Discovered during the Hacking Team data breach, it was quickly weaponized, appearing in multiple exploit kits. CVE-2015-5119 is a use-after-free flaw in Flash’s ActionScript ByteArray class, allowing attackers to execute arbitrary code by tricking users into visiting a compromised website. It was quickly integrated into attack frameworks used by Advanced Persistent Threat (APT) groups like APT3, APT18, and Fancy Bear (APT28). These groups, with ties to China and Russia, used the vulnerability to spy on and steal data from governments and corporations. Fancy Bear has been associated with nation-state cyber warfare, exploiting Flash vulnerabilities for political and military intelligence information gathering. This flaw, along with several other Flash vulnerabilities, highlighted Flash’s risks, accelerating its eventual phase-out.CVE-2017-11882: Microsoft Office Equation Editor Remote Code Execution VulnerabilityRemote Code ExecutionExploitedNetworkCybercriminalsAPT GroupsHigh2017Why it’s significant: The vulnerability existed for 17 years in Equation Editor (EQNEDT32.EXE), a Microsoft Office legacy component used to insert and edit complex mathematical equations within documents. Once CVE-2017-11882 became public, cybercriminals and APT groups included it in maliciously crafted Office files. It became one of 2018’s most exploited vulnerabilities and continues to be utilized by various threat actors including SideWinder.CVE-2017-0144: Windows SMB Remote Code Execution VulnerabilityEternalBlueRemote Code ExecutionExploitedNetworkWannaCry NotPetyaHigh2017Why it’s significant: CVE-2017-0144 was discovered by the National Security Agency (NSA) and leaked by a hacker group known as Shadow Brokers, making it widely accessible. Dubbed “EternalBlue,” its capacity to propagate laterally through networks, often infecting unpatched machines without human interaction, made it highly dangerous. It was weaponized in the WannaCry ransomware attack in May 2017 and spread globally. It was reused by NotPetya, a data-destroying wiper originally disguised as ransomware. NotPetya targeted companies in Ukraine before spreading worldwide. This made it one of history’s costliest cyberattacks.CVE-2017-5638: Apache Struts 2 Jakarta Multipart Parser Remote Code Execution VulnerabilityRemote Code ExecutionExploitedNetworkEquifax BreachCritical2017Why it’s significant: This vulnerability affects the Jakarta Multipart Parser in Apache Struts 2, a popular framework for building Java web applications. An attacker can exploit it by injecting malicious code into HTTP headers during file uploads, resulting in remote code execution (RCE), giving attackers control of the web server. CVE-2017-5638 was used in the Equifax breach, where personal and financial data of 147 million people was stolen, emphasizing the importance of patching widely-used frameworks, particularly in enterprise environments, to prevent catastrophic data breaches.CVE-2019-0708: Remote Desktop Services Remote Code Execution VulnerabilityBlueKeep DejaBlue Remote Code ExecutionExploitedNetworkRansomware GroupsCybercriminalsCritical2019Why it’s significant: Dubbed "BlueKeep," this vulnerability in Windows Remote Desktop Services (RDS) was significant for its potential for widespread, self-propagating attacks, similar to the infamous WannaCry ransomware. An attacker could exploit this flaw to execute arbitrary code and take full control of a machine through Remote Desktop Protocol (RDP), a common method for remote administration. BlueKeep was featured in the Top Routinely Exploited Vulnerabilities list in 2022 and was exploited by affiliates of the LockBit ransomware group.CVE-2020-0796: Windows SMBv3 Client/Server Remote Code Execution VulnerabilitySMBGhost EternalDarknessRemote Code ExecutionExploited NetworkCybercriminalsRansomware GroupsCritical2020Why it’s significant: Its discovery evoked memories of EternalBlue because of the potential for it to be wormable, which is what led to it becoming a named vulnerability. Researchers found it trivial to identify the flaw and develop proof-of-concept (PoC) exploits for it. It was exploited in the wild by cybercriminals, including the Conti ransomware group and its affiliates.CVE-2019-19781: Citrix ADC and Gateway Remote Code Execution VulnerabilityPath TraversalExploitedNetworkAPT GroupsRansomware GroupsCybercriminalsCritical2019Why it’s significant: This vulnerability in Citrix Application Delivery Controller (ADC) and Citrix Gateway is significant due to its rapid exploitation by multiple threat actors, including state-sponsored groups and ransomware affiliates. By sending crafted HTTP requests, attackers could gain RCE and take full control of affected devices to install malware or steal data. The vulnerability remained unpatched for a month after its disclosure, leading to widespread exploitation. Unpatched systems are still being targeted today, highlighting the risk of ignoring known vulnerabilities.CVE-2019-10149: Exim Remote Command Execution VulnerabilityRemote Command ExecutionExploitedNetworkAPT GroupsCybercriminalsCritical2019Why it’s significant: This vulnerability in Exim, a popular Mail Transfer Agent, allows attackers to execute arbitrary commands with root privileges simply by sending a specially crafted email. The availability of public exploits led to widespread scanning and exploitation of vulnerable Exim servers, with attackers using compromised systems to install cryptocurrency miners (cryptominers), launch internal attacks or establish persistent backdoors. The NSA warned that state-sponsored actors were actively exploiting this flaw to compromise email servers and gather sensitive information.CVE-2020-1472: Netlogon Elevation of Privilege VulnerabilityZerologonElevation of PrivilegeExploitedLocalRansomware GroupsAPT GroupsCybercriminalsCritical2020Why it’s significant: This vulnerability in the Netlogon Remote Protocol (MS-NRPC) allows attackers with network access to a Windows domain controller to reset its password, enabling them to impersonate the domain controller and potentially take over the entire domain. Its severity was underscored when Microsoft reported active exploitation less than two months after disclosure and the Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency directive to patch the flaw. Despite available patches, it continues to be exploited by ransomware groups, APT groups, and others, highlighting its broad and ongoing impact on network security.CVE-2017-5753: CPU Speculative Execution Bounds Check Bypass VulnerabilitySpectreSpeculative Execution Bounds Check BypassLocalMedium2018Why it’s significant: In a speculative execution process, an idle microprocessor waiting to receive data speculates what the next instruction might be. Although meant to enhance performance, this process became a fundamental design flaw affecting the security of numerous modern processors. In Spectre’s case, an attacker-controlled process could read arbitrary memory belonging to another process. Since its discovery in January 2018, Spectre has affected nearly all modern processors from Intel, AMD and ARM. While it’s difficult to execute a successful Spectre attack, fully remediating the root cause is hard and requires microcode as well as operating system updates to mitigate the risk.CVE-2017-5754: CPU Speculative Execution Rogue Data Cache Load VulnerabilityMeltdownSpeculative Execution Rogue Data Cache LoadLocalHigh2018Why it’s significant: Meltdown, another speculative execution vulnerability released alongside Spectre, can allow a userspace program to read privileged kernel memory. It exploits a race condition between the memory access and privilege checking while speculatively executing instructions. Meltdown impacts desktop, laptop and cloud systems and, according to researchers, may affect nearly every Intel processor released since 1995. With a wide reaching impact, both Spectre and Meltdown sparked major interest in a largely unexplored security area. The result: a slew of research and vulnerability discoveries, many of which were also given names and logos. While there’s no evidence of a successful Meltdown exploit, the discovery showcased the risk of security boundaries enforced by hardware.CVE-2021-36942: Windows LSA Spoofing VulnerabilityPetitPotamSpoofingExploitedZero-DayNetworkRansomware GroupsHigh2021Why it’s significant: This vulnerability can force domain controllers to authenticate to an attacker-controlled destination. Shortly after a PoC was disclosed, it was adopted by ransomware groups like LockFile, which have chained Microsoft Exchange vulnerabilities with PetitPotam to take over domain controllers. Patched in the August 2021 Patch Tuesday release, the initial patch for CVE-2021-36942 only partially mitigated the issue, with Microsoft pushing general mitigation guidance for defending against NTLM Relay Attacks.CVE-2022-30190: Microsoft Windows Support Diagnostic Tool Remote Code ExecutionFollinaRemote Code ExecutionExploitedZero-DayLocalQakbot RemcosHigh2022Why it’s significant: Follina, a zero-day RCE vulnerability in MSDT impacting several versions of Microsoft Office, was later designated CVE-2022-30190. After public disclosure in May 2022, Microsoft patched Follina in the June 2022 Patch Tuesday. After disclosure, reports suggested that Microsoft dismissed the flaw’s initial disclosure as early as April 2022. Follina has been widely adopted by threat actors and was associated with some of 2021’s top malware strains in a joint cybersecurity advisory from CISA and the Australian Cyber Security Centre (ACSC), operating under the Australian Signals Directorate (ASD).CVE-2021-44228: Apache Log4j Remote Code Execution VulnerabilityLog4ShellRemote Code ExecutionExploitedNetworkCybercriminalsAPT GroupsCritical2021Why it’s significant: Log4j, a Java logging library widely used across many products and services, created a large attack surface. The discovery of CVE-2021-44228, dubbed “Log4Shell,” caused great concern, as exploitation simply requires sending a specially crafted request to a server running a vulnerable version of Log4j. After its disclosure, Log4Shell was exploited in attacks by cryptominers, DDoS botnets, ransomware groups and APT groups including those affiliated with the Iranian Islamic Revolutionary Guard Corps (IRGC).CVE-2021-26855: Microsoft Exchange Server Server-Side Request Forgery VulnerabilityProxyLogonServer-Side Request Forgery (SSRF)ExploitedZero-DayNetworkAPT Groups Ransomware GroupsCybercriminalsCritical2021Why it’s significant: CVE-2021-26855 was discovered as a zero-day along with four other vulnerabilities in Microsoft Exchange Server. It was exploited by a nation-state threat actor dubbed HAFNIUM. By sending a specially crafted HTTP request to a vulnerable Exchange Server, an attacker could steal the contents of user mailboxes using ProxyLogon. Outside of HAFNIUM, ProxyLogon has been used by ransomware groups and other cybercriminals. Its discovery created a domino effect, as other Exchange Server flaws, including ProxyShell and ProxyNotShell, were discovered, disclosed and subsequently exploited by attackers.CVE-2021-34527: Microsoft Windows Print Spooler Remote Code Execution VulnerabilityPrintNightmareRemote Code ExecutionExploitedLocalAPT GroupsRansomware GroupsCybercriminalsHigh2021Why it’s significant: This RCE in the ubiquitous Windows Print Spooler could grant authenticated attackers arbitrary code execution privileges as SYSTEM. There was confusion surrounding the disclosure of this flaw, identified as CVE-2021-34527 and dubbed “PrintNightmare.” Originally, CVE-2021-1675, disclosed in June 2021, was believed to be the real PrintNightmare. However, Microsoft noted CVE-2021-1675 is “similar but distinct” from PrintNightmare. Since its disclosure, several Print Spooler vulnerabilities were disclosed, while a variety of attackers, including the Magniber and Vice Society ransomware groups exploited PrintNightmare.CVE-2021-27101: Accellion File Transfer Appliance (FTA) SQL Injection VulnerabilitySQL InjectionExploitedZero-DayNetworkRansomware GroupCritical2021Why it’s significant: The file transfer appliance from Accellion (now known as Kiteworks) was exploited as a zero-day by the CLOP ransomware group between December 2020 and early 2021. Mandiant, hired by Kiteworks to investigate, determined that CLOP (aka UNC2546) exploited several flaws in FTA including CVE-2021-27101. This was CLOP’s first foray into targeting file transfer solutions, as they provide an easy avenue for the exfiltration of sensitive data that can be used to facilitate extortion.CVE-2023-34362: Progress Software MOVEit Transfer SQL Injection VulnerabilitySQL InjectionExploitedZero-DayNetworkRansomware GroupCritical2023Why it’s significant: CLOP’s targeting of file transfer solutions culminated in the discovery of CVE-2023-34362, a zero-day in Progress Software’s MOVEit Transfer, a secure managed file transfer software. CLOP targeted MOVEit in May 2023 and the ramifications are still felt today. According to research conducted by Emsisoft, 2,773 organizations have been impacted and information on over 95 million individuals has been exposed as of October 2024. This attack underscored the value in targeting file transfer solutions.CVE-2023-4966: Citrix NetScaler and ADC Gateway Sensitive Information Disclosure VulnerabilityCitrixBleedInformation DisclosureExploitedZero-DayNetworkRansomware GroupsAPT GroupsCritical2023Why it’s significant: CVE-2023-4966, also known as “CitrixBleed,” is very simple to exploit. An unauthenticated attacker could send a specially crafted request to a vulnerable NetScaler ADC or Gateway endpoint and obtain valid session tokens from the device’s memory. These session tokens could be replayed back to bypass authentication, and would persist even after the available patches had been applied. CitrixBleed saw mass exploitation after its disclosure, and ransomware groups like LockBit 3.0 and Medusa adopted it.CVE-2023-2868: Barracuda Email Security Gateway (ESG) Remote Command Injection VulnerabilityRemote Command InjectionExploitedZero-DayNetworkAPT GroupsCritical2023Why it’s significant: Researchers found evidence of zero-day exploitation of CVE-2023-2868 in October 2022 by the APT group UNC4841. While Barracuda released patches in May 2023, the FBI issued a flash alert in August 2023 declaring them “ineffective,” stating that “active intrusions” were being observed on patched systems. This led to Barracuda making an unprecedented recommendation for the “immediate replacement of compromised ESG appliances, regardless of patch level.”CVE-2024-3094: XZ Utils Embedded Malicious Code VulnerabilityEmbedded Malicious CodeZero-DayUnknown Threat Actor (Jia Tan)Critical2024Why it’s significant: CVE-2024-3094 is not a traditional vulnerability. It is a CVE assigned for a supply-chain backdoor discovered in XZ Utils, a compression library found in various Linux distributions. Developer Andres Freund discovered the backdoor while investigating SSH performance issues. CVE-2024-3094 highlighted a coordinated supply chain attack by an unknown individual that contributed to the XZ GitHub project for two and a half years, gaining the trust of the developer before introducing the backdoor. The outcome of this supply chain attack could have been worse were it not for Freund’s discovery.Identifying affected systemsA list of Tenable plugins for these vulnerabilities can be found on the individual CVE pages:CVE-1999-0211CVE-2010-2568CVE-2014-0160CVE-2014-6271CVE-2015-5119CVE-2017-11882CVE-2017-0144CVE-2017-5638CVE-2019-0708CVE-2020-0796CVE-2019-19781CVE-2019-10149CVE-2020-1472CVE-2017-5753CVE-2017-5754CVE-2021-36942CVE-2022-30190CVE-2021-44228CVE-2021-26855CVE-2021-34527CVE-2021-27101CVE-2023-34362CVE-2023-4966CVE-2023-2868CVE-2024-3094 Full Article
ant FY 2024 State and Local Cybersecurity Grant Program Adds CISA KEV as a Performance Measure By www.tenable.com Published On :: Thu, 31 Oct 2024 09:00:00 -0400 The CISA Known Exploited Vulnerabilities (KEV) catalog and enhanced logging guidelines are among the new measurement tools added for the 2024 State and Local Cybersecurity Grant Program.Last month, the Department of Homeland Security announced the availability of $279.9 million in grant funding for the Fiscal Year (FY) 2024 State and Local Cybersecurity Grant Program (SLCGP). Now in its third year, the four-year, $1 billion program provides funding for State, Local and Territorial (SLT) governments to implement cybersecurity solutions that address the growing threats and risks to their information systems. Applications must be submitted by December 3, 2024.While there are no significant modifications to the program for FY 2024, the Federal Emergency Management Agency (FEMA), which administers SLCGP in coordination with the Cybersecurity and Infrastructure Security Agency (CISA), identified key changes, some of which we highlight below:The FY 2024 NOFO adds CISA’s KEV catalog as a new performance measure and recommended resourceThe FY 2024 notice of funding opportunity (NOFO) adds the CISA Known Exploited Vulnerabilities (KEV) catalog as a recommended resource to encourage governments to regularly view information related to cybersecurity vulnerabilities confirmed by CISA, prioritizing those exploited in the wild. In addition, CISA has added “Addressing CISA-identified cybersecurity vulnerabilities” to the list of performance measures it will collect through the duration of the program.Tenable offers fastest, broadest coverage of CISA’s KEV catalogAt Tenable, our goal is to help organizations identify their cyber exposure gaps as accurately and quickly as possible. To achieve this goal, we have research teams around the globe working to provide precise and prompt coverage for new threats as they are discovered. Tenable monitors and tracks additions to the CISA KEV catalog on a daily basis and prioritizes developing new detections where they do not already exist.Tenable updates the KEV coverage of its vulnerability management products — Tenable Nessus, Tenable Security Center and Tenable Vulnerability Management — allowing organizations to use KEV catalog data as an additional prioritization metric when figuring out what to fix first. The ready availability of this data in Tenable products can help agencies meet the SLCGP performance measures. This blog offers additional information on Tenable’s coverage of CISA’s KEV catalog.FY 2024 NOFO adds “Adopting Enhanced Logging” as a new performance measureThe FY 2024 NOFO also adds “Adopting Enhanced Logging” to the list of performance measures CISA will collect throughout the program duration.How Tenable’s library of compliance audits can help with Enhanced LoggingTenable's library of Compliance Audits, including Center for Internet Security (CIS) and Defense Information Systems Agency (DISA), allows organizations to assess systems for compliance, including ensuring Enhanced Logging is enabled. Tenable's vulnerability management tools enable customers to easily schedule compliance scans. Users can choose from a continuously updated library of built-in audits or upload custom audits. By conducting these scans regularly, organizations can ensure their systems are secure and maintain compliance with required frameworks.FY 2024 NOFO continues to require applicants to address program objectives in their applicationsAs with previous years, the FY 2024 NOFO sets four program objectives. Applicants must address at least one of the following in their applications:Objective 1: Develop and establish appropriate governance structures, including by developing, implementing, or revising Cybersecurity Plans, to improve capabilities to respond to cybersecurity incidents, and ensure operations.Objective 2: Understand their current cybersecurity posture and areas for improvement based on continuous testing, evaluation, and structured assessments.Objective 3: Implement security protections commensurate with risk.Objective 4: Ensure organization personnel are appropriately trained in cybersecurity, commensurate with responsibility.How Tenable can help agencies meet Objective 2 of the programTenable is uniquely positioned to help SLTs meet Objective 2 through the Tenable One Exposure Management Platform. In addition to analyzing traditional IT environments, Tenable One analyzes cloud instances, web applications, critical infrastructure environments, identity access and privilege solutions such as Active Directory and more — including highly dynamic assets like mobile devices, virtual machines and containers. Once the complete attack surface is understood, the Tenable One platform applies a proactive risk-based approach to managing exposure, allowing SLT agencies to successfully meet each of the sub-objectives outlined in Objective 2 (see table below).Sub-objectiveHow Tenable helps2.1.1: Establish and regularly update asset inventoryTenable One deploys purpose-built sensors across on-premises and cloud environments to update inventories of human and machine assets, including cloud, IT, OT, IoT, mobile, applications, virtual machines, containers and identities2.3.2. Effectively manage vulnerabilities by prioritizing mitigation of high-impact vulnerabilities and those most likely to be exploited.Tenable One provides an accurate picture of both internal and external exposure by detecting and prioritizing a broad range of vulnerabilities, misconfiguration and excessive permissions across the attack surface.Threat intelligence and data science from Tenable Research are then applied to give agencies easy-to-understand risk scores. For example, Tenable One provides advanced prioritization metrics and capabilities, asset exposure scores which combine total asset risk and asset criticality, cyber exposure scoring which calculates overall exposure for the organization, peer benchmarking for comparable organizations, as well as the ability to track SLAs and risk patterns over time.Further, Tenable One provides rich critical technical context in the form of attack path analysis that maps asset, identity and risk relationships which can be exploited by attackers. It also provides business context by giving users an understanding of the potential impact on the things that matter most to an agency, such as business critical apps, services, processes and functions. These contextual views greatly improve the ability of security teams to prioritize and focus action where they can best reduce the potential for material impact. These advanced prioritization capabilities, along with mitigation guidance, ensure high-risk vulnerabilities can be addressed quickly.2.4.1 SLT agencies are able to analyze network traffic and activity transiting or traveling to or from information systems, applications, and user accounts to understand baseline activity and identify potential threats.Tenable provides purpose-built sensors, including a passive sensor, which can determine risk based on network traffic. After being placed on a Switched Port Analyzer (SPAN) port or network tap, the passive sensor will be able to discover new devices on a network as soon as they begin to send traffic, as well as discover vulnerabilities based on, but not limited to:ServicesUser-agentsApplication traffic2.5.1 SLT agencies are able to respond to identified events and incidents, document root cause, and share information with partners.Tenable One can help SLT agencies respond to identified events and incidents and document root cause more quickly. SOC analysts managing events and incidents and vulnerability analysts focused on remediation of vulnerabilities have access to deep technical content in the form of attack paths, with risk and and configuration details to verify viability, as well as business context to understand the potential impact to their agency.This information is valuable not only to validate why IT teams should prioritize mitigation of issues before breach, but to prove that a successful attack has occurred. Further, agencies can deliver dashboards, reports and scorecards to help share important security data in meaningful ways across teams and with partners. Agencies are able to customize these to show the data that matters most and add details specific to their requirements. Source: Tenable, October 2024Tenable One deployment options offer flexibility for SLT agenciesTenable offers SLT agencies flexibility in their implementation models to help them best meet the requirements and objectives outlined as part of the SLCGP. Deployment models include:Centralized risk-based vulnerability program managed by a state Department of Information Technology (DoIT)Multi-entity projectsDecentralized deployments of Tenable One managed by individual municipalities,Managed Security Service Provider (MSSP) models that allow agencies to rapidly adopt solutions by utilizing Tenable’s Technology Partner network.Whole-of-state approach enables state-wide collaboration and cooperationA “whole-of-state” approach — which enables state-wide collaboration to improve the cybersecurity posture of all stakeholders — allows state governments to share resources to support cybersecurity programs for local government entities, educational institutions and other organizations. Shared resources increase the level of defense for SLTs both individually and as a community and reduce duplication of work and effort. States get real-time visibility into all threats and deploy a standard strategy and toolset to improve cyber hygiene, accelerate incident response and reduce statewide risk. For more information, read Protecting Local Government Agencies with a Whole-of-State Cybersecurity Approach.FY 2024 NOFO advises SLT agencies to adopt key cybersecurity best practicesAs in previous years, the FY 2024 NOFO again recommends SLT agencies adopt key cybersecurity best practices. To do this, they are required to consult the CISA Cross-Sector Cybersecurity Performance Goals (CPGs) throughout their development of plans and projects within the program. This is also a statutory requirement for receiving grant funding.How Tenable One can help agencies meet the CISA CPGsThe CISA CPGs are a prioritized subset of cybersecurity practices aimed at meaningfully reducing risk to critical infrastructure operations and the American people. They provide a common set of IT and operational technology (OT) fundamental cybersecurity best practices to help SLT agencies address some of the most common and impactful cyber risks. Learn more about how Tenable One can help agencies meet the CISA CPGs here.Learn more$1 Billion State and Local Cybersecurity Grant Program Now Open for ApplicantsProtecting Local Government Agencies with a Whole-of-State Cybersecurity ApproachHow to Meet FY 2023 U.S. State and Local Cybersecurity Grant Program ObjectivesNew U.S. SLCGP Cybersecurity Plan Requirement: Adopt Cybersecurity Best Practices Using CISA's CPGsStudy: Tenable Offers Fastest, Broadest Coverage of CISA's KEV Catalog Full Article
ant Social Media for Science Outreach – A Case Study: AntarcticGlaciers.org By www.nature.com Published On :: Wed, 22 May 2013 09:00:38 +0000 To tie in with this month’s SoNYC birthday celebrations, we are hosting a collection of case Full Article Featured Guest Posts Outreach SpotOn NYC (#SoNYC) #reachingoutsci #SoNYC Social Media Case Study
ant OSC seeks applications for the Registrant Advisory Committee By www.osc.ca Published On :: Thu, 10 Oct 2024 15:29:30 GMT TORONTO – The Ontario Securities Commission (OSC) is inviting applications for membership on its Registrant Advisory Committee (RAC or the Committee). Full Article
ant SpotOn London 2013 Storify: The Dark Art of Dark Social: Email, the antisocial medium which will not die By www.nature.com Published On :: Mon, 11 Nov 2013 15:43:19 +0000 Here is a Storify collecting the online conversations from the, “The Dark Art of Dark Full Article Featured Outreach SpotOn London (#SoLo) Storifys #solo13dark
ant The Black Panther Party : a graphic novel history / David F. Walker ; art, colors, and letters by Marcus Kwame Anderson. By library.gcpl.lib.oh.us Published On :: "Founded in Oakland, California, in 1966, the Black Panther Party for Self-Defense was a radical political organization that stood in defiant contrast to the mainstream civil rights movement. This gripping illustrated history explores the impact and significance of the Panthers, from their social, educational, and healthcare programs that were designed to uplift the Black community to their battle against police brutality through citizen patrols and frequent clashes with the FBI, which targeted the Party from its outset. Using dramatic comic book-style retellings and illustrated profiles of key figures, The Black Panther Party captures the major events, people, and actions of the Party, as well as their cultural and political influence and enduring legacy." -- Page [2] of cover. Full Article
ant Innovations of targeted poverty reduction governance and policy in Zhejiang Province: Insights from China’s post-2020 anti-poverty strategy [in Chinese] By www.ifpri.org Published On :: Tue, 03 Nov 2020 5:05:01 EST Full Article
ant Return to Santa Flores A Classic Love Story Iris Johansen. By library.gcpl.lib.oh.us Published On :: #1 New York Times bestselling author Iris Johansen offers readers a classic tale of a love that seems impossible-and a hunger that is undeniable. Jenny Cashman longs to escape the refined, rarified air of her exclusive Swiss education. At nineteen, she's desperate for independence-and to once again see the man she loves. So she sells her belongings, leaves Europe, and heads to Las Vegas. The sight of Steve Jason's newest palatial hotel and casino thrills Jenny-but not as much as the sight of the man himself. Steve came to her rescue after her father died, paying for her years of expensive schooling. Now, she must convince him that she's old enough to make her own decisions . . . including about her passion for him. Steve Jason is a powerful mogul, a man who came from nothing and made a name for himself in the industry before he was thirty years old. He takes great care to keep all emotional involvement with others to a bare minimum-with only one exception. Jenny has always been incredibly important to him. But how can he keep her safe when she seems oblivious to her own stunning beauty and the reactions she gets from other men? It will take all of Steve's resolve to protect her-especially from his own desires. Full Article
ant Investor Alert: Fraudulent social media “investment groups” take advantage of unsuspecting investors By www.osc.ca Published On :: Tue, 09 Jul 2024 13:23:57 GMT TORONTO – The Canadian Securities Administrators (CSA) warns Canadians about fraudulent “investment groups” promoted on social media like Facebook and Instagram. These groups could be running a scam called a “pump and dump.”How the scam works: Full Article
ant Batman, the Dark Knight detective. Volume 5 / Alan Grant, Archie Goodwin, writers ; pencilers, Norm Breyfogle, Dan Jurgens ; Steve Mitchell, Dick Giordano, inkers ; Adrienne Roy, colorist ; Todd Klein, letterer. By library.gcpl.lib.oh.us Published On :: "Bruce Wayne's latest ward, Tim Drake, has all the makings of becoming the greatest Robin yet. He's intelligent, athletic, and levelheaded, and his detective skills rival those of his mentor. However, every Boy Wonder who has come before has endured tragedy, and Tim may be no exception when his parents are marked for death by the sinister Obeah Man. Will the Dark Knight stop the Obeah Man in time, or must Tim face a deadly rite of passage in order to be worthy of inheriting the mantle of Robin?"--Provided by publisher. Full Article
ant Catwoman. Soulstealer : the graphic novel / based on the novel written by Sarah J. Maas ; adapted by Louise Simonson ; illustrated by Samantha Dodge with Carl Potts and Brett Ryans ; colors by Shari Chankhamma ; letters by Saida Temofonte. By library.gcpl.lib.oh.us Published On :: Selina Kyle returns to Gotham City as new socialite Holly Vanderhees, but she needs to outsmart rival Batwing to rise to the top of the city's criminal underbelly. Full Article
ant Future state. The next Batman / writers, John Ridley, Vita Ayala, Andrew Constant [and 4 others] ; pencillers, Laura Braga, Aneke, Nick Derington [and 5 others] ; inkers, Laura Braga, Aneke, Nick Derington [and 6 others] ; colorists, Arif Prianto, Jordie By library.gcpl.lib.oh.us Published On :: "Giant, sprawling future Gotham City is under martial law, protected and regulated by a private security force led by the infamous Peacekeepers. Their mandate is to maintain the safety of the citizens of Gotham, regardless of any Constitutional rights, and to hunt down, incarcerate, or kill all masked vigilantes, villains, and criminals in the city limits. It's a dangerous and violent look at a possible future Gotham City and the heroes and villains who live there!" -- Provided by publisher. Full Article
ant Batman, White Knight presents : Harley Quinn / Katana Collins, writer, story ; Sean Murphy, story, covers ; Matteo Scalera, art, variants ; Dave Stewart, colorist ; Matt Hollingsworth, cover colors ; AndWorld Design, lettering. By library.gcpl.lib.oh.us Published On :: "Batman: White Knight Presents: Harley Quinn takes place two years after Batman: Curse of the White Knight. Azrael has wiped out criminals in Gotham, Jack Napier (formerly The Joker) is dead, Bruce Wayne (Batman) is in prison, and Harley Quinn is adjusting to life as a single mother, raising the twins she had with Jack. But as new villains arise, Harley is forced to dance with madness once again and confront her own past with The Joker and Batman while helping the Gotham City police and an eager young FBI agent uncover the truth behind a series of gruesome murders. This collection also features a chapter from Harley Quinn's newest digital first series, Harley Quinn Black + White + Red, told in a traditional black-and-white format with the color red uniquely shaping Harley Quinn's story." -- Provided by publisher. Full Article
ant Future state. Batman, dark detective / Mariko Tamaki, Joshua Williamson, Gene Luen Yang [and others], writers ; Dan Mora, Giannis Milonogiannis, Ben Oliver [and others], art ; Jordie Bellaire, Arif Prianto, Otto Schmidt [and others], color ; Aditya Bidika By library.gcpl.lib.oh.us Published On :: "Welcome to the possible future state of Gotham. The Magistrate, a freelance military and surveillance corporation, has been hired by Gotham's leadership to turn the old city into a futuristic surveillance state free of vigilante-based crime/heroics. Batman, horrified to see what his city was becoming, fought tooth and nail against Magistrate— and they killed him for it. Or did they? Bruce Wayne survived this assassination attempt, and has been laying low for years now trying to sort out how to beat Magistrate. The only problem? He doesn't think he can anymore. They're too big, they're too powerful. And the latest horrific revelation? They have eyes everywhere. It's left to Batman for one last mission. Destroy their command center, expose the drones, and free the city. Whatever the cost." -- Provided by publisher. Full Article
ant Pokémon. Sun & Moon. Volume 10 / story, Hidenori Kusaka ; art, Satoshi Yamamoto ; translation, Tetsuichiro Miyaki ; English adaptation, Bryant Turnage ; touch-up & lettering, Susan Daigle-Leach. By library.gcpl.lib.oh.us Published On :: "Sun dreams of money. Moon dreams of scientific discoveries. When their paths cross with Team Skull, both their plans go awry … Lost in an alternate dimension, Sun and Moon battle to help their new friends defend the eternally dark city of Ultra Megalopolis. But then a betrayal deprives them of their transportation home! Meanwhile, what surprising news does Lillie receive?" -- Provided by publisher Full Article
ant How can African agriculture adapt to climate change: Analysis of the determinants of farmers' choice of adaptation methods and perceptions of climate change in the Nile Basin of Ethiopia [in Amharic] By www.ifpri.org Published On :: Sat, 07 Feb 2015 2:14:37 EST "Ethiopia's agricultural sector, which is dominated by smallscale, mixed-crop, and livestock farming, is the mainstay of the country's economy. It constitutes more than half of the country's gross domestic product, generates more than 85 percent of foreign exchange earnings, and employs about 80 percent of the population. Unfortunately, Ethiopia's dependence on agriculture makes the country particularly vulnerable to the adverse impactsof climate change on crop and livestock production. Full Article