Author

IT Blogr

Browsing

The software development landscape changes constantly. New areas of specialization, technologies, and methodologies pop into existence every few months, forged by the relentless innovation of the software industry. With it, terms to describe specialized types of developers become part of the unofficial industry lingo and show up in job ads and corporate titles.

Before the existence of the internet, many of these specializations didn’t exist. The worldwide web has shifted most aspects of our lives, including revolutionizing the career paths of software engineers.

There isn’t an official industry glossary of terms. Understanding the skills that each type of developer needs to have is confusing to newcomers, and can be intimidating to non-technical people.

The cheat sheet below highlights the 3 major It Developer categories

Other tiers similar to frontend, backend and full-stack developer include Middle-Tier Developer,   which is a developer who writes non-UI code that runs in a browser and often talking to non-core code running on a server. In general, middle tier is the “plumbing” of a system. The term middle-tier developer is used to describe someone who is not specialized in the front-end or the back-end but can do a bit of both, without being a full stack developer. Only rarely engineers have this as a title, as it is more of a description of a skill set than a career path.

 

With the coronavirus constantly in the news, more businesses than ever are considering the viable option of  telework as opposed to traditional onsite work for their company and employees. The new cyber threats and data breaches constantly reported indicates that business owners have to ask themselves the question: How do I maintain my cybersecurity when my employees work remotely?

Whether you have one employee working on a mobile device while on a business trip or your entire staff telecommuting from home, your cybersecurity shouldn’t be sacrificed for convenience. By understanding your options and working with quality IT services providers, you can safely navigate the cyber world and keep your business protected.

Cyber Security and Telework

Maintaining your cybersecurity while allowing your employees to work remotely can be a challenge, but it can be accomplished with minimal risk if you plan ahead and choose the right options for your business. If you don’t expect someone to infiltrate your network, you won’t be protected when someone tries. Always prepare for the worst-case scenario.

The report below states the constants that incorporate and facilitate the ability to work from home for security professionals

Following the responses of nations to the Coronavirus pandemic and in line with precautionary measures instituted by world health bodies, the solution to mitigate the spread of the Covid-19 viruses at offices gets tense by the day.

Important alterations to take note of specifically in the cybersecurity space include:

  • All the interview sessions will be conducted via Skype, video call or tele-conversation.
  • Most employees will work from home
  • Generally, projects that can be completed virtually are prioritized that projects requiring physical presence

As of today, 93% of interviews have to be adjusted to suit virtual environments, including Skye. Preparing for a Skype interview due to Covid-19? remember these steps:

1. Test your audio and camera prior to the interview session.

2. Elevate your laptop to avoid staring down into the camera and creating an “angle of depression”.

3. Dress professionally like you would on a face-to-face interview

4. Position yourself at a table, against a plain, neutral non-busy background.

5. Check the lighting in the room and avoid flares or distractive reflections.

6. Close all other applications on your laptop.

7. Silence your cell phone, and disable vibration.

8. Have a copy of your resume at hand.

9. Attach post-its around the laptop screen with prompts + questions you wish to ask the interviewer.

10. Exclude kids, pets, etc from the room for the duration of the interview.

11. Have a pen and paper at hand. 12. Have a glass of water next to you.

13. Have the phone number of the interviewer in case the video connection is lost.

14. Smile and always have at least one question

In 2015, the United States Congress passed the cybersecurity Act of 2015 (CSA), and within this
legislation is Section 405(d): Aligning Health Care Industry Security Approaches. As an approach to this
requirement, in 2017 HHS convened the 405(d) Task Group leveraging the Healthcare and Public Health
(HPH) Sector Critical Infrastructure Security and Resilience Public-Private Partnership. The Task Group is
comprised of a diverse set of over 150 members representing many areas and roles, including
cybersecurity, privacy, healthcare practitioners, Health IT organizations, and other subject matter
experts.
The Task Group’s charge was to develop a document that is available to everyone at no cost and
includes a common set of voluntary, consensus-based, and industry-led guidelines, practices,
methodologies, procedures, and processes that serve as a resource to meet three core goals to:
1. Cost-effectively reduce cybersecurity risks for a range of health care organizations;
2. Support voluntary adoption and implementation; and
3. Ensure on an ongoing basis that content is actionable, practical, and relevant to healthcare
stakeholders of every size and resource level.
Progress || The Task Group assembled in May 2017 and since then, many achievements have been
made with this effort. The table highlights current accomplishments made by those involved.

The report below elaborates the current health industry cybersecurity best practices.

 

Until recently, end-to-end encryption (E2EE) was the sole domain of the tech savvy because of the complicated operations required to use it. However, recent technological advances have made end-to-end encryption much easier to use and more accessible. In this article, we will explain what is end-to-end encryption and what advantages it offers over regular encryption.

What is end-to-end encryption (E2EE)?

When you use E2EE to send an email or a message to someone, no one monitoring the network can see the content of your message — not hackers, not the government, and not even the company (e.g., ProtonMail) that facilitates your communication.

This differs from the encryption that most companies already use, which only protects the data in transit between your device and the company’s servers. For example, when you send and receive an email using a service that does not provide E2EE, such as Gmail or Hotmail, the company can access the content of your messages because they also hold the encryption keys. E2EE eliminates this possibility because the service provider does not actually possess the decryption key. Because of this, E2EE is much stronger than standard encryption.

How does end-to-end encryption work?

To understand how E2EE works, it helps to look at a diagram. In the example below, Bob wants to say hello to Alice in private. Alice has a public key and a private key, which are two mathematically related encryption keys. The public key can be shared with anyone, but only Alice has the private key.

First, Bob uses Alice’s public key to encrypt the message, turning “Hello Alice” into something called ciphertext — scrambled, seemingly random characters.

Bob sends this encrypted message over the public internet. Along the way, it may pass through multiple servers, including those belonging to the email service they’re using and to their internet service providers. Although those companies may try to read the message (or even share them with third parties), it is impossible for them to convert the ciphertext back into readable plaintext. Only Alice can do that with her private key when it lands in her inbox, as Alice is the only person that has access to her private key. When Alice wants to reply, she simply repeats the process, encrypting her message to Bob using Bob’s public key.

Advantages of end-to-end encryption services

There are several advantages of E2EE over the standard encryption that most services utilize:

  • It keeps your data safe from hacks. E2EE means fewer parties have access to your unencrypted data. Even if hackers compromise the servers where your data is stored (e.g., the Yahoo mail hack), they cannot decrypt your data because they do not possess the decryption keys.
  • It keeps your data private. If you use Gmail, Google can know every intimate detail you put in your emails, and it can save your emails even if you delete them. E2EE gives you control over who reads your messages.
  • It’s good for democracy. Everyone has the right to privacy. E2EE protects free speech and shields persecuted activists, dissidents, and journalists from intimidation.

end-to-end encryption

End-to-end encryption is the most secure way to communicate privately and securely online. By encrypting messages at both ends of a conversation, end-to-end encryption prevents anyone in the middle from reading private communications.

Source: Proton mail

At first glance, February appears to be a big improvement cyber security-wise compared to the start of the year. The 632,595,960 breached records accounts for about a third of January’s total, and is considerably lower than the figures for this time last year.

Unfortunately, the number of breached records doesn’t tell the full story, as there were a whopping 105 incidents – making February 2020 the second leakiest month we’ve ever recorded.

You can find detailed breakdowns of some of the more notable incidents by subscribing to our Round-ups or by visiting our cheatsheet page where we have a dedicated variety of handy cybersecurity cheatsheets.

Cyber attacks

Ransomware

Data breaches

Financial information

Malicious insiders and miscellaneous incidents

In other news…

Source: IT Governance

The new decade has begun relatively well, with a six-month low of only 61 disclosed cybersecurity incidents.

By comparison, 2019 saw an average of almost 80 data breaches and cyber attacks per month.

It’s not all good news, though. Several major incidents occurred in January, boosting the total number of breached records to a substantial 1,505,372,820.

That includes several worrying incidents involving UK organizations – which are highlighted in bold.

You can find detailed breakdowns of some of the more notable incidents by subscribing to our Round-ups or by visiting our cheatsheet page where we have a dedicated variety of handy cybersecurity cheatsheets.

In the meantime, you can check out the full list here:

Cyber attacks

Ransomware

Data breaches

 

Financial information

Malicious insiders and miscellaneous incidents

In other news…

Source: IT Governance

Throughout the year 2019, we kept an eye on cyber attack and data breach reported in mainstream publications, releasing our findings in our monthly blog series. 

This allowed us to see how many security incidents were occurring, how many records were involved and which industries were worst affected. 

Did you know, for example, that July was the worst month of the year in terms of breached records? Or that the leading cause of data breaches was internal error? 

With 2019 in the books, we’ve summarised these and other facts in infographics below

Source: IT Governance

 

November 2019 was a big month for data breaches, with a confirmed 1,341,147,383 records being exposed in 87 incidents.

However, almost all of those came from one leaked database, the origin of which is unclear as at the time of this writing.

Here is a full list of data breaches in November, showing the 1.34 billion records breached

Cyber Attacks

Ransomware

Data Breaches

Financial Information

Malicious insiders and miscellaneous incidents

Source: IT Governance

Popular social media app TikTok has been banned from United States Navy devices due to security fears.

A Navy bulletin sent to personnel declared that the video sharing app, owned by Chinese firm ByteDance, would be banned from government-issued mobile devices as it posed a “cybersecurity threat.”

Anyone found to be using government-issued mobile devices who did not uninstall TikTok would be blocked from the Navy Marine Corps Intranet, the note said.

Threats

In a statement sent to Reuters, Pentagon spokesman Lieutenant Colonel Uriah Orland said the order was part of an effort to “address existing and emerging threats”.

The “Cyber Awareness Message”, which was sent out to personnel on December 16, “identifies the potential risk associated with using the TikTok app and directs appropriate action for employees to take in order to safeguard their personal information.”

TikTok, which has over a billion users worldwide, has come in for increased scrutiny over the past months from US lawmakers as they look to clamp down on possible security threats.

Although popular mainly with teenagers, US army cadets were last month instructed not to use TikTok following concerns raised by Senator Chuck Schumer.

A Navy spokesman said Naval and Marine personnel who use government-issued smart devices are generally allowed to use popular commercial apps, including common social media apps, but from time to time specific programs that present security threats are banned. He would not give examples of apps that are allowed or those considered unsafe.

TikTok has not commented on the story, but its parent company is currently facing a national security review in the US following the $1 billion acquisition of American social media app Musical.ly last month.

Source: Tech Radar