Demand for security analysts and security operations centre experts is high – so high that Frost and Sullivan found only two percent unemployment in the sector and that demand continues outstrip the supply of newly skilled professionals. (ISC)² suggests that the number of skilled professionals will have to grow from 2.8 million worldwide to 4.07 million to close the skills gap.
All these roles will require the right skills and the right data. Alongside filling those positions effectively, supplying the right insight on what is taking place will be essential. Without the right level of insight, these roles can easily be overwhelmed by the sheer volume of alerts and false positives.
Filling the security information
The main problem is that there is so much information coming into the SOC continuously that keeping up is a near-impossible task. Without the right approach in place, it becomes easy for analysts to be overwhelmed by the wrong kinds of signals.
Filling the information gap therefore involves looking at how to make the most of the data that is coming in, without paralyzing the process or relying on manual intervention. While artificial intelligence and machine learning have been suggested as routes to achieving this, in reality they will only be part of the approach. Achieving the right security posture will instead involve looking at the data, the analysis and the real-time requirements together.
Typically, security teams use alerting and information from their tools to flag suspicious activity that is taking place. This data tends to flow into a Security Incident and Event Management (SIEM) product for analysis. However, SIEMs were developed as an approach to work with traditional networks and on-premise applications, rather than the world of cloud and containerised applications that we are moving to today. These new systems put out so much more data that traditional SIEM approaches – and the SOC processes that rely on SIEM – are no longer fully fit for purpose.
To fill the gaps that exist here, making use of cloud for scalability is one approach. Cloud environments tend to be elastic, unpredictable, and highly dynamic, so taking the same approach to handling data is desirable. As the types, quantities, and sources of data continue to increase, SOC teams may go from handling data being created at a rate of 1TB/day, then scaling up to 70TB/day and back down again, all in a matter of hours. Without the flexibility of capacity planning that cloud provides, SOC teams risk losing or missing data due to unpredictable spikes.
Building continuous intelligence
For many SOC teams, the ability to analyze data in real-time is currently enough. However, the lack of skills and the increasing quantity of data means that this won’t be the case forever. Instead, the ability to analyze will have to be linked into more recommendations and automation for decision support.
It’s important to make the distinction clear between real-time analytics and what Gartner calls continuous intelligence. Real-time analytics is the ability to take in data and process it for people to use; continuous intelligence builds on this by providing more context, analysis and recommendations as part of that process. For SOC teams, this is similar to the “observe – orient – decide – act” (OODA) loop developed by military strategist and US Air Force Colonel John Boyd, where data is used to provide better decision options and lead to better outcomes as actions are taken.
OODA can help security teams work in the moment by processing context information more quickly. For continuous intelligence purposes, the loop uses automation to pull in all the necessary data across IT assets and services, analyze the relevant information and then provide recommendations to the SOC team on what issues are worth investigating further, what may warrant watching over time, and what is effectively “business as normal.”
These recommendations for actions to take can help SOC staff concentrate on where their efforts are most required, rather than facing a barrage of alerts with no guidance on where to prioritize. As actions are taken, the data coming in can be analyzed again to ensure that actions have had the right impact and priorities are re-assessed continuously. This helps the SOC team understand that their actions always have the most potential good impact.
Looking ahead, the number of skilled IT security professionals needed will continue to grow. As security technologies and automation approaches develop, existing and new security staff will be able to handle more data and in more intelligent ways. The SOC of the future will need to keep up with all the new data sets, applications and infrastructure that businesses require. By taking an approach based on continuous intelligence, those teams will be more efficient and more productive.
As organizations work to ensure remote workforce productivity, the issue of cached credentials will inevitably appear, causing a problem for the impacted user, and the IT service desk.
It’s no secret that some material portion of nearly every workforce is functioning remotely. You’ve spent the last few months scurrying to establish remote connectivity, cloud-based productivity, and some form of encompassing security – all to allow your remote employees to get their job done while meeting corporate governance requirements around security and compliance to as best a degree as possible. But with approximately 40% of remote workforces using corporate devices while working from home, there’s an issue that may be just around the corner that is likely on the cusp of becoming an issue that will involve that subset of your entire remote workforce – expiring locally cached credentials.
For those of you new to IT who aren’t familiar with locally cached credentials, here’s the very brief primer: Because the user is remote, they can’t easily (if at all) connect to a domain controller (DC) on the corporate network. So, Windows keeps a copy of the user’s credentials cached on the local device and the user can freely log in locally while remote without needing to connect to the corporate network. Despite Microsoft killing the requirement to require users to change passwords frequently, there are still scenarios where passwords need to be reset:
Old policy remains in place and a password does expire
The user’s credential is suspected to have been compromised by insider threat or cyberattack and needs to be administratively reset
The currently established password is found to be using a compromised/leaked password and is administratively reset
The user forgets their password (as in, it’s been cached for so long, they don’t even know what it is)
The issue at hand is when the password needs to be reestablished on the Active Directory side of the equation, how do you update the locally cached credentials? The affected user needs to be connected to the corporate network (specifically, to a Domain Controller (DC)) to have a newly established set of credentials cache locally. Now, some of you are already ahead of me thinking, “my users use a VPN and are, therefore, logically on the network, so we’re fine.” But according to a recent study by Proofpoint, only 39% of users have a VPN installed and only 47% of those folks use it consistently. Additionally, many VPN connections to the DC are established post login so not all potential scenarios that may arise will be resolved without IT support.
In short, eventually, the problem of locally cached credentials is going to catch up with you.
So, what are your options to update expired credentials, and what are the security ramifications for each?
First off, because the problem we’re solving for is that the remote endpoint device needs to update the cached credentials, the underlying process is largely the same: The device needs to be logically connected to the corporate network (again, specifically with access to a DC) via VPN, and will need to (assuming you’re running Windows 10) press Ctrl-Alt-Del and choose Change a Password.
When seeing this process in practical application, there are a few scenarios to consider around the updating of locally cached credentials and how each impacts corporate security and IT.
1. Known, Non-Expired Password, Able to Connect – this is the gold standard of possible scenarios. The tech-savvy user simply connects to the VPN, and changes their password, and goes about their day. Pure IT nirvana.
2. Known, Expired Password, Unable to Connect – without third-party password reset solutions, the VPN is a requirement here. The service desk is going to be involved to help facilitate at least the “connecting to the corporate network”, by manually resetting their password to the existing one as a potential solution and having them change it immediately, which can involve helping with finding the keys needed to get to Change a Password.
3. Unknown Password – Putting the connectivity issue aside, this is where true security risk begins. When users don’t know what their password is to begin with, it obviously requires an initial reset by the service desk, and then a password change upon first logon, just like the scenario above. The security risk comes in the form of identifying the user as the credential owner before handing over the reset password. In the first scenario at least, they knew the old password although not a very secure verification method it’s a start. So, in this case, without some form of a second authentication factor that goes beyond, “who’s this?” or “what’s your employee ID?” is really risky.
4. Forced Reset – in cases where IT forces a reset of a user’s credential (again, due to issues like suspecting it has been compromised by cyberattack), the act of working with the user to communicate a newly reset password needs to involve some very specific and secure form of validating the credential owner before handing over the reset password.
Getting cached credential updating correct
The issue here is two-pronged, cached credentials will ultimately lead to an increase in IT support calls and loss in productivity however there is a security issue at hand here. The handoff between the user claiming to be the credential owner and the service desk agent that needs to hand off a temporary password to facilitate the credential update can leave an organization exposed to attacks.
Users within your organization have varying levels of access and, therefore, inherent risk. So, add to the mix here that those with elevated levels of access to sensitive, proprietary, and otherwise valuable information need much more validation than any of the simplistic methods often times utilized at the IT service desk.
Updating the locally cached credentials is a security issue. And the best security is the one the user doesn’t know about. Add to that, the best solution is the one IT doesn’t need to get involved with. It’s obvious, from the scenarios above, the scenario involving a proactive, tech-savvy user meets the criteria. But that just isn’t the reality most of the time. So, there may be a need to look to third-party password self-service solution that integrate with the Windows logon process to help simplify the three unknowns I’ve mentioned in this article: the user’s technical prowess, their ability to connect to the corporate network, and IT’s ability to validate the person requesting a password reset is in fact the credential owner.
Without any third-party solution, the answer is simple: VPN, change the password. When that’s not generally feasible, I recommend you look for a solution that meets your remote workforce where they are while helping to maintain productivity and corporate security.
Agile adoption improves key capabilities needed to respond to current business challenges, especially those resulting from the pandemic, according to Digital.ai.
With 60 percent of survey respondents saying Agile has helped increase speed to market, 41 percent agreeing they are better able to manage distributed teams, and 58 percent saying they have improved team productivity it is clear these practices are invaluable during these challenging times.
“Our all-in move to the cloud in recent years allowed us to go to fully virtualized in one day,” said Kim Gokce, Sr. Director IT Capabilities at The Coca-Cola Company. “Our people showcased their agility in immediately reorganizing the work. For me, it was a ‘burn the ships’ moment on our journey to agility.”
How the COVID-19 pandemic has affected Agile adoption
In mid-May 2020, a brief supplemental survey of respondents was conducted to learn more about how the COVID-19 pandemic has affected their Agile adoption. Supplemental findings reveal:
55 percent say their company plans to increase the use of Agile in the next 12-14 months. This is an increase of 13 percent over the original survey completed just five months ago.
43 percent of organizations say their momentum for Agile adoption has increased over the past 90 days, with 15 percent saying it has increased significantly.
33 percent say they increased or expanded Agile adoption in the last 90 days to help manage distributed teams.
Other notable findings from the report, completed in December 2019, include:
Risk and compliance continue to trend upward, as the value of identifying and measuring technical risk prior to deployment increased by 54 percent and the importance of automated audit compliance and governance across control points increased by 10 percent over last year.
A significant shift in Agile techniques occurred, as product road-mapping increased nine percent while release planning decreased 11 percent. Drivers for this change may include a general increase in continuous integration/continuous deployment and better-defined program increment planning.
The Scaled Agile Framework (SAFe) continues to be the most popular scaling method cited by respondents, increasing 5 percent over last year and outpacing the number two choice, Scrum@Scale, by 19 percent.
Larger companies more likely to practice Agile
For the first time, the survey results were filtered along demographic lines to reveal insights beyond the general results. The analysis indicated a correlation between length of time practicing Agile, improved time to market, and the ability to manage changing priorities.
The survey indicated that companies with more than 20,000 people were more likely to be practicing Agile for at least five years. While companies with less than 1,000 people continue to mature quickly and are increasingly embracing a broader view of business agility by applying Agile principles to areas of the business outside development, IT, and operations.
This is third in a series of articles that introduces and explains application programming interfaces (API) security threats, challenges, and solutions for participants in software development, operations, and protection.
Explosion of APIs
The API explosion is also driven by several business-oriented factors. First, enterprises are moving away from large monolithic applications that are updated annually at best. Instead, legacy and new applications are being broken into small, independently functional components, often rolled out as container-based microservices. The resulting application components and microservices work together to deliver the same functionality as the monolithic applications.
Holding all of this together, of course, are the APIs that allow for communication between processes, bi-directional sharing of data, and real-time provision of services. By serving as the bridge between applications, components, microservices, and other containerized workloads, APIs can be viewed as integrating large portions of the Internet, including eCommerce, supply chain processing, enterprise business interactions, and other components of the modern digital economy.
At a more technical level, the factors that have helped to make APIs so pervasive in the design and implementation of Internet services include the following:
Support for DevOps – Iterative development methodologies such as DevOps, DevSecOps, and Agile enable teams to push incremental changes directly to customers instead of using long development and assurance cycles.
On-Demand flexibility – Modern application hosting requires the ability to scale services up or down, on-demand, and in a cost-effective and efficient manner, to handle changes in usage patterns, such as seasonally-based demand.
Development frameworks – Technology adoption trends such as increased use of cloud, containers and orchestration (such as Kubernetes), and management frameworks (such as Istio) make it easier to develop and deploy API-based microservices at scale.
Diverse ecosystem – Partner ecosystem expansion, enabled by API-based microservices enable aggregators, suppliers, and external developers use to grow their business without replicating functionality. These APIs are well-documented and publicly-available, as evidenced by the massive directory of more than 23,000 APIs that one can find on the Internet.
The increased adoption of APIs is thus great news for businesses, but introduces corresponding challenges for security professionals. Enterprise teams who might have been tasked previously, for example, with protecting a handful of applications, might now be suddenly responsible for protecting hundreds if not thousands of public-facing APIs with a range of cyber security risks. As a result, API security has become a top-of-mind issue for most CISOs.
OWASP Top Ten risks
The Open Web Application Security Project (OWASP) Foundation was created to improve the security of software through community-led software initiatives, local chapter work led by members, and many different conferences. Its most famous product is the so-called OWASP top ten risks, which are published to help software developers avoid the most common risks in the creation and use of web applications. A description of the top ten OWASP risks is listed below, and taken directly from the OWASP Website.
1. Injection. Injection flaws, such as SQL, NoSQL, OS, and LDAP injection, occur when untrusted data is sent to an interpreter as part of a command or query. The attacker’s hostile data can trick the interpreter into executing unintended commands or accessing data without proper authorization.
2. Broken authentication. Application functions related to authentication and session management are often implemented incorrectly, allowing attackers to compromise passwords, keys, or session tokens, or to exploit other implementation flaws to assume other users’ identities temporarily or permanently.
3. Sensitive data exposure. Many web applications and APIs do not properly protect sensitive data, such as financial, healthcare, and PII. Attackers may steal or modify such weakly protected data to conduct credit card fraud, identity theft, or other crimes. Sensitive data may be compromised without extra protection, such as encryption at rest or in transit, and requires special precautions when exchanged with the browser.
4. XML External Entities (XXE). Many older or poorly configured XML processors evaluate external entity references within XML documents. External entities can be used to disclose internal files using the file URI handler, internal file shares, internal port scanning, remote code execution, and denial of service attacks.
5. Broken access control. Restrictions on what authenticated users are allowed to do are often not properly enforced. Attackers can exploit these flaws to access unauthorized functionality and/or data, such as access other users’ accounts, view sensitive files, modify other users’ data, change access rights, etc.
6. Security misconfiguration. Security misconfiguration is the most commonly seen issue. This is commonly a result of insecure default configurations, incomplete or ad hoc configurations, open cloud storage, misconfigured HTTP headers, and verbose error messages containing sensitive information. Not only must all operating systems, frameworks, libraries, and applications be securely configured, but they must be patched/upgraded in a timely fashion.
7. Cross-Site Scripting (XSS). XSS flaws occur whenever an application includes untrusted data in a new web page without proper validation or escaping, or updates an existing web page with user-supplied data using a browser API that can create HTML or JavaScript. XSS allows attackers to execute scripts in the victim’s browser which can hijack user sessions, deface web sites, or redirect the user to malicious sites.
8. Insecure deserialization. Insecure deserialization often leads to remote code execution. Even if deserialization flaws do not result in remote code execution, they can be used to perform attacks, including replay attacks, injection attacks, and privilege escalation attacks.
9. Using components with known vulnerabilities. Components, such as libraries, frameworks, and other software modules, run with the same privileges as the application. If a vulnerable component is exploited, such an attack can facilitate serious data loss or server takeover. Applications and APIs using components with known vulnerabilities may undermine application defenses and enable various attacks and impacts.
10. Insufficient logging & monitoring. Insufficient logging and monitoring, coupled with missing or ineffective integration with incident response, allows attackers to further attack systems, maintain persistence, pivot to more systems, and tamper, extract, or destroy data. Most breach studies show time to detect a breach is over 200 days, typically detected by external parties rather than internal processes or monitoring.
Security in DevOps
The waterfall model of software development has become a victim of time. That is, the duration between when software requirements are defined and the time functional code is delivered has become too lengthy for most practical environments. In fact, by the time a waterfall project gets around to coding, the requirements have often changed so much as to render the activity irrelevant. Because requirements changes usually originate with end-users, the situation is unlikely to change.
To address this accelerated lifecycle, so-called DevOps processes have emerged in the software community. Designed to address the increasing pace of requirements change, DevOps involves rapidly-organized and quickly-executed tasks designed to produce and deploy new requirements quickly. Integration between coders (the Dev part) and production users (the Ops part) creates a never-ending spiral cycle of software development that is best performed with a maximum of automated support.
Introducing security into DevOps became an obvious concern once DevOps processes were applied to critical system development efforts. Experts saw this as an immediate challenge, because many security tasks have the inherent result of slowing down deployments due to a traditional reliance on change control processes. This produced an immediate collision between security and the obvious DevOps objective of moving as quickly as possible.
The solution to the DevOps security challenge is automation. Only through the introduction of automated controls for tasks such as security testing, code scanning, control monitoring, and activity logging – can the speed of DevOps be maintained, while also ensuring that vulnerabilities are not being introduced as a result of the process. Obviously, buggy code with exploitable breaches will continue to emerge from DevOps, but these should not be introduced as a result of the process.
One interesting and curious note worth mentioning is that the community has not agreed on a standard nomenclature for secure DevOps processes. One might find references to DevSecOps, SecDevOps, and DevOpsSec – and this author has no good advice for identifying the differences. Readers are advised to engage with the security team early in the application development process to foster a tight working relationship.
Contributing author: Matthew Keil, Director of Product Marketing, Cequence.
Currently, organizations are struggling to adjust to the new normal amidst the COVID-19 pandemic, a Bitglass survey reveals. 41% have not taken any steps to expand secure access for the remote workforce, and 50% are citing proper equipment as the biggest impediment to doing so. Consequently, 65% of organizations now enable personal devices to access managed applications.
Remote work and secure access concerns
When asked what their organizations are primarily concerned with securing while employees work remotely, 65% of respondents said securing network access. This was followed by securing access to SaaS apps like Slack (55%) and bring your own device/personal devices (55%).
When it comes to the most concerning threat vectors for remote work, respondents cited malware (72%) and unauthorized user access (59%).
“This research indicates that many organizations are not implementing the security measures necessary to protect their data in the current business environment,” said Anurag Kahol, CTO of Bitglass.
“For example, while respondents said that the pandemic has accelerated the migration of user workflows and applications to the cloud, most are not employing cloud security solutions like single sign-on (SSO), data loss prevention, zero trust network access, or cloud access security brokers.
“On top of that, 84% of organizations reported that they are likely to continue to support remote work capabilities even after stay at home orders are lifted. To do this safely, they must prioritize securing data in any app, any device, anywhere in the world.”
Key findings
Malware is the most concerning threat vector, with 72% of respondents citing it as their top concern.
From a remote work perspective, the application types that organizations are most concerned about securing include file sharing (68%), web applications (47%), and video conferencing (45%).
At 77%, anti-malware is the most-used tool to secure remote work. However, this and other tools like single sign-on (45%), data loss prevention (18%), and user and entity behavior analytics (11%) are still not deployed widely enough.
63% of respondents said that remote work was likely to impact their compliance with regulatory mandates; 50% named GDPR, specifically.
Researchers at the National Institute of Standards and Technology (NIST) have developed a mathematical formula that, computer simulations suggest, could help 5G and other wireless networks select and share communications frequencies about 5,000 times more efficiently than trial-and-error methods.
NIST engineer Jason Coder makes mathematical calculations for a machine learning formula that may help 5G and other wireless networks select and share communications frequencies efficiently
The novel formula is a form of machine learning that selects a wireless frequency range, known as a channel, based on prior experience in a specific network environment. The formula could be programmed into software on transmitters in many types of real-world networks.
The formula is a way to help meet growing demand for wireless systems, including 5G, through the sharing of frequency ranges, also known as bands, that are unlicensed. Wi-Fi, for example, uses unlicensed bands – those not assigned by the Federal Communications Commission (FCC) to specific users.
Rapidly selecting the best subchannels
The study focuses on a scenario in which Wi-Fi competes with cellular systems for specific frequencies, or subchannels. What makes this scenario challenging is that these cellular systems are raising their data-transmission rates by using a method called License Assisted Access (LAA), which combines both unlicensed and licensed bands.
“This work explores the use of machine learning in making decisions about which frequency channel to transmit on,” NIST engineer Jason Coder said. “This could potentially make communications in the unlicensed bands much more efficient.”
The formula enables transmitters to rapidly select the best subchannels for successful and simultaneous operation of Wi-Fi and LAA networks in unlicensed bands. The transmitters each learn to maximize the total network data rate without communicating with each other. The scheme rapidly achieves overall performance that is close to the result based on exhaustive trial-and-error channel searches.
The research differs from previous studies of machine learning in communications by taking into account multiple network “layers,” the physical equipment and the channel access rules between base stations and receivers.
The formula is a Q-learning technique, meaning it maps environmental conditions – such as the types of networks and numbers of transmitters and channels present – onto actions that maximize a value, known as Q, that returns the best reward.
By interacting with the environment and trying different actions, the algorithm learns which channel provides the best outcome. Each transmitter learns to select the channel that yields the best data rate under specific environmental conditions.
Boosting data rates
If both networks select channels appropriately, the efficiency of the combined overall network environment improves. The method boosts data rates in two ways. Specifically, if a transmitter selects a channel that is not occupied, then the probability of a successful transmission rises, leading to a higher data rate. And if a transmitter selects a channel such that interference is minimized, then the signal is stronger, leading to a higher received data rate.
In the computer simulations, the optimum allocation method assigns channels to transmitters by searching all possible combinations to find a way to maximize the total network data rate. The formula produces results that are close to the optimum one but in a much simpler process.
The study found that an exhaustive effort to identify the best solution would require about 45,600 trials, whereas the formula could select a similar solution by trying only 10 channels, just 0.02 percent of the effort.
The study addressed indoor scenarios, such as a building with multiple Wi-Fi access points and cellphone operations in unlicensed bands. Researchers now plan to model the method in larger-scale outdoor scenarios and conduct physical experiments to demonstrate the effect.
Blackpoint Cyber released 365 Defense – a Microsoft 365 security add-on for its true Managed Detection and Response (MDR) service. With 365 Defense, Blackpoint adds 24/7 monitoring, threat detection, and security policy enforcement for Microsoft 365 environments.
The add-on is available to existing and new clients and provides an additional offering for Blackpoint partners, including Managed Service Providers (MSPs).
There’s been an alarming increase in Microsoft 365 account takeover (ATO) attacks according to a report published last year, with 29% of organizations having their Microsoft 365 accounts compromised in March 2019 alone.
Methods of committing ATO attacks include phishing campaigns, social engineering, and using stolen credentials found across the web. Once the hackers successfully took over these accounts, they sent over 1.5 million malicious spam emails.
Blackpoint Cyber’s 365 Defense add-on is a comprehensive offering that provides both security monitoring and security policy enforcement as monitoring is critical to detect initial suspicious activity. 365 Defense monitors account activity such as new and deleted users, permission changes, and unusual logins (including from unauthorized countries).
Policy enforcement is a pro-active service that hardens Microsoft 365 environments to reduce the likelihood of compromise; 365 Defense ensures Microsoft audit logs are always on, applies policies to block dangerous content or behavior, and notifies end users of possible phishing attacks.
By enforcing good Microsoft 365 security practices and detecting suspicious or unusual behavior early, 365 Defense augments Blackpoint’s 24/7 MDR service in protecting organizations from modern cyberattacks.
“We built our security platform and MDR service from the ground up to catch breaches in their earliest stages, and this strategy includes monitoring common attack vectors like Microsoft 365,” said Jon Murchison, CEO and founder of Blackpoint Cyber.
“As we work to continually improve our threat detection and service offerings, I’m excited to announce this new add-on, which is the first in several very exciting enhancements coming to our MDR service this year.”
Wipro announced the appointment of Thierry Delaporte as the Chief Executive Officer and Managing Director of the company, effective July 6, 2020.
Until recently, Thierry Delaporte was the Chief Operating Officer of Capgemini Group and a member of its Group Executive Board. During his twenty-five year career with Capgemini, he held several leadership roles including that of Chief Executive Officer of the Global Financial Services Strategic Business Unit, and head of all global service lines.
He also oversaw Capgemini’s India operations, and led the group’s transformation agenda, conceptualizing and driving several strategic programs across various business units.
“I am delighted to welcome Thierry as CEO and Managing Director of the company. Thierry has an exceptional leadership track record, strong international exposure, deep strategic expertise, a unique ability to forge long-standing client relationships, and proven experience of driving transformation and managing technological disruption. We believe that Thierry is the right person to lead Wipro in its next phase of growth,” said Rishad Premji, Chairman, Wipro Limited.
“I want to thank Abid for all that he has done for Wipro and for making this transition as smooth and seamless as possible despite his personal commitments.”
Abidali Neemuchwala will relinquish his position as CEO and MD on June 1. Rishad Premji will oversee the day to day operations of the company until July 5.
Commenting on his appointment, Thierry Delaporte said, “I am deeply honored to be invited to lead Wipro, an extraordinary company and an exemplary corporate citizen with a deep technology heritage built on a strong foundation of values.
“I look forward to working closely with Rishad, the Board, senior leadership and the hugely talented employees of Wipro to turn a new chapter of growth and build a better tomorrow for all our stakeholders.”
He will be based in Paris and report to Chairman Rishad Premji.
Thierry has a Bachelor’s degree in Economy and Finance from Sciences Po Paris and a Masters in Law from Sorbonne University. He is also the co-Founder and President of the not-for-profit organization Life Project 4 Youth.
If you’re an iPhone user with some cash to blow, skip the fakes and go for some real AirPods. The AirPods Pro stepped the game up with rubber tips, noise cancellation, and better overall audio quality, and you can save $20 on a pair of your own at Amazon, complete with a wireless charging case.
This story was originally published by Quentyn Kennemer on 5/1/2020 and updated by Quentyn Kennemer with new information on 5/29/2020
TaoTronics is making it super cheap to get an entry-level pair of ANC headphones. The SoundSurge 60 are just $34 when you clip the coupon at Amazon and use promo code KINJALE6.
These feature dual 40mm drivers, Bluetooth 5.0 connectivity, improved voice calls with CVC 6.0 microphones, and TaoTronics is advertising 30-hour battery life with quick charging, where just five minutes on the juice gets you a two-hour session.
This article was originally published by Quentyn Kennemer on 5/9/2020 and updated by Quentyn Kennemer with new information on 5/29/2020.
Take it from someone who loses his buds on a daily basis: Don’t jump into the true wireless game until you know what kind of beast it is. These Acellories earbuds are perfect, as they only cost $20 at MorningSave and could be mistaken for AirPods to the untrained eye. You can grab one in White, Mint, Black, Blue, Rose Gold, or Red with a matching charging case.
Losing your things frequently? With a Tile Pro, down to $40 at Amazon, you’ll have a layer of protection and reprieve that’ll save you some panic. Just press the button twice to find your phone, or use the phone to find whatever the Tile is attached to, like your keys, your wallet, or maybe even that leftover lasagna that keeps disappearing from your fridge (but we can’t guarantee your perp won’t be smart enough to take it off before they stuff their face).
Compared to the original, the Tile Pro has better battery life (with user-removable cells) and increased Bluetooth range of 300 feet.
Looking for faster, more reliable portable storage? ADATA has something you’ll like. For $100, you’re getting 1TB of flash-based storage that transfers over any USB connection up to USB 3.1. ADATA’s name doesn’t carry the same weight as someone like Western Digital or Samsung, but it’s no noob to the storage wars, and it’s pretty hard to mess up SSD tech. You can buy one at Amazon right here.
The way 2020 has gone so far, it’s only a matter of time before we’re living in a real world Walking Dead scenario. Prepare now with a set of five two-way dual band walkie talkie radios, plus the earpieces and a programming cable, for $95. Use code 5PCSUV5R for the discount, and you can thank me later (preferably with an I.O.U. to not eat my brains if you end up turning).
LOOK AT THIS. THIS IS SO CUTE. IT’S A PINK GAME BOY COLOR LUNCH BOX. And with code E75HZ37W, you can get this SUPER ADORABLE LUNCH BOX for just $8! It’s a bit more than just a cute novelty too, as reviews suggest that it’s actually a good lunch box for keeping your food cool. AND IT’S JUST SO CUTE.
There are a couple caveats, though. First, the code only works for the pink lunchbox. I’m a bit sad I can’t get the iconic purple color lunchbox for $8, but the pink one is plenty cute. Also, these lunch boxes are made with leather, so those that live the complete vegetarian or vegan lifestyle will not be able to grab one.
But if those don’t bother you, you have until June 7th (or until it sells out) to grab one!
Gaming chairs tend to get a bad rap. But, it’s important that if you’re sitting in something for a long period time, even to play video games, you need to make sure you have proper posture and not ruining your back when you’re older. Of course, gaming chairs aren’t made equal in this regard either, but this Fortnite chair looks pretty solid.
First and foremost, it’s not in those garish colors that most gaming chairs are made in for god knows what reason. So that’s nice! It also has a footrest, if you’re feeling that too. And honestly, I don’t really know HOW this chair is related to Fortnite, so you don’t really need to be a megafan to buy it.
From there, it’s pretty standard for a ergonomic computer chair—just without the huge price tag. This chair is only $130, but the sale only lasts until Monday!
It is my contention that Funko Pops are tacky. I also have at least three of them displayed in the shelving unit next to my bed. We contain multitudes. Right now you can do the same—at a steep discount in Amazon’s Gold Box sale. Want to show off your love of Star Wars? One 7" tall Luke Skywalker riding a Taun Taun is marked down 25%. Reveal your T W I S T E D side to friends and family with $9 off the 10" Joker vinyl. Remember Game of Thrones? Daenerys is $19, a 38% reduction in price.
Peruse the wider catalog of discounted Funko Pops over on the Amazon sale page. Whether you like it or not, I’m certain you’ll find a character that pulls at your heartstrings. How could Baby Yoda not? He’s a freakin’ Muppet Baby. You’ll never unsee this horrific Goose from Captain Marvel replica. For better or for worse, there’s plenty more where those came from.
After some obfuscated messaging around COVID-19 delays back in March, the TurboGrafx-16 mini is now up for grabs on Amazon, assuming you have $100 to spend. Complete with 50 full-fledged seminal classics, the retro gaming console follows the NES and SNES Classic as well as the more evergreen Sega Genesis Mini and PlayStation Classic as yet another throwback system that’ll let you relive the good ol’ days in quarantine (or live through them the first time if you’re under a certain age).
Included in the package, you’ll find the console, a single controller, and an assorted mix of big ticket American TurboGrafx-16 and Japanese PC Engine games like Ys: Book I and II, Dracula X (Castlevania: Rondo Of Blood) Military Madness, Bonk’s Revenge, and more. Although you won’t find a power adapter in the box unless you shell out for the currently sold-out $120 bundle, you can swap in just about any old USB AC plug in its stead. Alternatively, you can upgrade your existing TurboGrafx-16 using this HDMI accessory.
The TurboGrafx-16 Mini was announced last June as the PC Engine Mini in Japan and PC Engine Core Grafx in Europe. The US version has two USB ports and supports a five-way multiplayer adapter. A second controller was available from Hori, but like the power adapter it too is sold out on Amazon. It was originally slated to release over two months ago, on March 19, before its manufacturing and shipping facilities in China were faced with an “unavoidable suspension” due to the widespread outbreak of the novel coronavirus.
Big Tony Stark fan? Now you can add the Iron Man Hall of Armor to your LEGO Avengers setup for $12 off of the list price.
It comes with four different Iron Man suits, including a swappable Stark head, plus two enemy Outriders and a big robotic Igor Suit that you can put Tony Stark into. This 524-piece set is 20% off.
Wake the fuck up, samurai. Todd McFarlane’s Keanu Reeves (AKA Johnny Silverhhand) figurine is here and it’s already 20% off on Amazon. Pick it up while supplies last, and don’t forget to pre-order Cyberpunk 2077, now discounted to $45 on CDKeys. Revealed at E3 2019, Reeves is making his motion-captured video game debut in the upcoming dystopian sci-fi RPG from The Witcher series developer CD Projekt.
Loosely based on the character of the same name in the tabletop role-playing game Cyberpunk 2020, the Johnny Silverhand character Reeves will be playing belongs to the Rockerboy class, described in the game’s canon as “the street poets, social consciences and rebels of the 2000s.” If this sounds dumb to you, that’s because it is, and you should be excited for that reason. Cyberpunk 2077 will release later this year on September 17.
15% off order | Dylan’s Candy Bar | Use code SWEET15Photo: Dylan’s Candy Bar
I’m stressed, and I really, really, REALLY want to eat some candy. But... I’m on keto, so alas, I cannot. But, what can do is torture myself by looking at wonderful looking candies. And what YOU can do is actually buy and eat some candy semi-guilt-free with 15% off at Dylan’s Candy Bar.
Where should you start on your sugar-filled adventure? Well, the Best-Sellers list has a bunch of amazing looking products to try out. The tackle boxes really catch my eye, with a nice assortment of candies that come in a box that you probably can actually use for tackle, or other things. With the code SWEET15, you can get one for $22.
There’s so much to choose from, too, so take a look at their full selection. Eat enough candy for me too, okay?
Are you working on a creative project? Perhaps you need to write something on some poster board that will be big and bold and easy to see? Sharpie’s chisel tip markers are your best bet, as the broad tip makes it much easier to make your words visible without too much effort. Right now, an eight pack of the markers is about half off at Amazon for $7, which is less than a dollar a marker! Use these babies to create signs for your events, or events you may be attending. They’re very versatile.
This sale lasts all week, but some items are already selling out, so act fast if there’s something that catches your eye.
$137 for a three piece tool set? Compared to a lot of other options, these might seem pretty expensive. However, these KNIPEX tools are way more versatile than meets the eye. These babies are adjustable, meaning that just these three wrenches can replace an entire bulky wrench set—perfect for those tired of lugging around a ton of tools. These can also be used as pliers, knocking out a whole other set of things to carry around.
While this set normally goes for $247, this wrench set is over $100 off. Grab a set before the price goes back up!
Who doesn’t love a good smoothie? Packed with fresh fruits and vitamins, it’s a healthy drink you can sip on all day, especially when it’s hot and humid. The Ninja Professional Blender is a decent $90, and can hold about 72 oz of liquid. If you’re not into smoothies, the blades can puree and blend any kind of gravies or whatever else you might need to be the best chef, because it’s YOUR kitchen and it is what you make it. I’d hop on this deal before it’s gone.
So, summer is basically here, but if you’re one of the people who depend on get-togethers to procure a perfectly toasted hot dog with a crunchy bun you might be missing out. Well, I have the solution to your problem—a retro Coca Cola toaster that cooks hot dog and toasts buns! It’s only $20 and it can toast any kind of franks or sausages you can think of to varying degrees. It comes with tongs to grab the hot dogs when they’re done, and a drip tray to catch the oil while they are toasting. Listen, grab this before it’s gone—you deserve it!
All Pants | $28 | Haggar | Use code DAD27 All Shorts | $18 | Haggar | Use code DAD27Graphic: Elizabeth Henges
Haggar believes dads should treat themselves, and this week, the clothing company will have daily deals for dads to give themselves a wardrobe refresh. For today only, you can use code DAD27 at checkout to get shorts for $18, and pants for $28. There’s only one catch—the pants don’t include suit pants, but the pants that do count look great enough for business casual anyway. Maybe don’t wear the shorts in the office, though.
This sale will only last until the end of the day, and then Haggar will offer something new for dads. So act fast!
It’s hot. This is no shocker, this is what happens in the Northern hemisphere from late May through early September. Well, if you live in an area that experiences all four seasons—I mean, I don’t. Kinda sucks. Regardless of where you live, though, it’s time to stock up on some shorts, and JACHS NY has just the deal for you with these twill chino shorts.
Gym shorts are for the gym and only the gym, so dress up a bit with these really cheap chinos instead. JACHS NY has a bunch of different colors, so you can definitely mix and match to make some nice outfits. If you use code SCH at checkout, you can get these pairs starting at $29 a piece (some are up to $36). Grab some of these before they sell out!
Next month is Pride Month! And, well, people that identify under the LGBTQIA+ label (except some of that As, hey what’s up y’all love you) deserve some extra self-love in June. Ella Paradis is starting the Pride Party early with the Show Your Pride Bundle, which is sure to please a lot of people.
This lovely set, which is only $40, includes the Better Love Queen of Hearts couples vibrator, which I think is best described on Ella Paradis’ website:
Has your bedroom routine with your partner become a little too routine? Spice things up with this Queen of Hearts remote controlled couples’ vibe featuring 10 vibrations modes in a 100% waterproof design. The remote makes this a convenient hands-free toy, or have your partner control it while you become their victim. Whatever the case, you’ll be screaming “off with their heads” once you’re done with the Queen of Hearts.
Off with their heads, indeed. The bundle also comes with some sexy tarot cards (are there portents of sexual cataclysms within?) and a satin bag to store your new toy in. These items usually go for $100, so if you want a new toy to spice up the bedroom there’s no better time than now to expand your collection.
You may have seen our neck gaiter accessory around each of our sister sites’ dedicated store pages, but for a limited time only, we’re discounting each one by 10% and donating a percentage of the sales to charities like Feeding America, The Trevor Project, and Planned Parenthood. Support your favorite sites—and keep your face covered—while giving back to a benevolent cause.
Whether you want to show off your appreciation for Kotaku’s excellent games coverage or Jezebel’s meticulous (and sometimes hilarious) reporting on issues important to women, now is the chance to do so for just $19. A portion of the proceeds will be donated to Meals on Wheels and Planned Parenthood, respectively. Each gaiter is washable and reusable and can also be used as a headband, bandana, wristband, neck warmer, and more.
Here’s a full rundown of our branded face shields, along with the names of the charities involved.
We’ve teamed up with Bellesa Boutique to give away a ton of free vibrators in honor of Masturbation May. All you have to do is visit this link and share your email. The cool twist on this is the more people that sign up the more we can give away, there’s no set number.
We hope you’ve been celebrating all month long but if you’d like to give yourself a little something extra double click your mouse and head to Bellesa. I personally would like to direct you to the Satisfyer Line because yes, it does.
Research has shown masturbation can prevent depression, reduce the risk of cervical cancer, raise your self-esteem, and help you sleep better. No matter how you celebrate you’re doing your mind, body, and soul so much good when you do.
God, it’s Sunday again already. Can time just stop for a bit? No? Well, I guess I can spend more money on some Kindle eBooks instead. Today’s deal is a selection of best-selling novels for just $3. Simple and easy! No need to take a guess at what price they’ll end up being this time.
Some recommendations? Well, if you like non-fiction, Conversations with RBG will certainly be up your alley. If you’re a sci-fi fan, Annihilation is a good book, and the start of the Southern Reach series. As usual, there are some good grabs here, so don’t sleep on this deal! It’s only available until the end of the day.
If you’ve had enough of scrolling through Netflix’s seemingly infinite library of stuff you don’t wanna watch right now, it might be time to grab a couple Blu-ray’s for your next binge session. For anime aficionados, there’s lots to grab on sale at Amazon right now. Dragon Ball fans can pick up Dragon Ball Super: Brolyfor 52% off, Dragon Ball Z: Battle of the Godsfor 54% off, as well as a couple seasons of Dragon Ball Z andDragon Ball Z Kaifor about 15% off each.
TECH
GAMING
HOME
LIFESTYLE
DEALS YOU MAY HAVE MISSED
If you’re missing a good ol’ fashioned pedicure and need to catch up on some me-time, you should try this vibrating foot spa. It’s only $73, and can quickly heat up to a nice, warm temperature to make you say “ah.” The spa also has a jacuzzi function with bubbles, so if you have some foot salts and bubbles, you’ll have a great time! If you’re always on your feet, the spa has removable massage rollers to soothe your tired dogs to keep them from barking. What are you waiting for? Jump on this deal before it’s gone!
Need a battery that can jump start your car as easily as it can your phone? Pick up Gooloo’s 4000A Peak SuperSafe Car Jump Starter for $84 at Amazon using the promo code 4JFKBZHD.
While most people need a portable charger you can stuff in a bag or jacket pocket, this battery packs enough power to jump start your car in a pinch, too. With two USB-A charging ports, and one USB-C charging port, you’ll be able to keep all your gear charged up on your road trips without worrying about killing your car’s battery.
This article was originally published by Jordan McMahon on 4/28/2020 and updated by Quentyn Kennemer with new information on 5/28/2020.
Believe it or not, lately I’ve been having trouble focusing at work, in part due to the excessive cat hair pervading my apartment. It’s why I asked our readers last week for your input on the best pet hair removers, and it’s also why I spend much of my time vacuuming obsessively. But without the right vacuum for the job, clunks of hair can get lodged in the brushes.
The Dyson V8 Animal cordless vacuum, now discounted $60 on Amazon, pumps up the volume (brush bar power) 150% over the Dyson V6, making it the perfect match for pet lovers and messy roommates alike. It’s cord-free, so while you do have to charge it, anything beats plugging and unplugging it as you vacuum throughout the house. However, bear in mind that because this is a renewed, or refurbished by Amazon, product it is subject to minimal wear and tear—including a reduced battery capacity as low as 80%.
Back in March, I asked our readers at The Inventory for your picks of the best juicers to kick my unhealthy ass into shape. Two months later, I need it now more than ever, and if you feel the same, the Omega CNC80S compact juicer is on sale, from one of your favorite brands, over on Amazon right now, down 12% from sticker price. That may not sound like a lot, but think about it this way: You’re saving $28 on a highly coveted juicer from a reader-trusted brand.
While the TWN30S listed in our Co-op roundup is a twin masticating juicer, it’s also unavailable for purchase as of this writing. The CNC80S, on the other hand, boasts the same 15-year warranty and voltage, albeit with a much slower motor. Whereas the TWN30S spins at 160 revolutions per minute (RPM), the CNC80S demolishes fruits and veggies at 80 RPM which, according to Omega, “results in minimal heat buildup and oxidation promoting healthy enzymes.” In reference to the comparable Omega TWN30S, Kinja commenter PhilipLegendsaid:
OK I am gonna assume you are asking here cause you want the real shit. This will get you started. Don’t even mess with that cheaper shit, you will waste more on low yield foamy nasty juice than you’ll save.
This is how you juice.
Rachel Parcell is a women’s brand specializing in feminine and timeless pieces that can be worn for any occasion. This new collection echoes that with so many of the pieces being inspired by eras of silhouettes that complimented the female form. It’s dainty, it’s pretty, it’s on sale for 30%.
These yesteryear details are easy to spot. I can see the influences of 1940s tea dresses and Victorian ruffles, which are prominently on display. There’s a very 70s callback of a denim jumpsuit. Tops, skirts, pants, and dresses with fit and flare that cost a little less is the dream for any fashionista.
Shipping is free on all orders.
Now that it’s abruptly scalding outside, it feels like the right time to make that Summer Switch. The switch to shorts that is. After an unruly winter that somehow bled into May (it snowed this month on the East Coast), I am sitting down typing this on the 8th floor of an apartment building, windows wide open, and beginning to sweat profusely. It’s shorts season, boys, time to stock up on Faherty all days from Huckberry, now $68.
Shop today for up to 30% off Huckberry’s entire men’s shorts catalog including Relwen flyweight flex shorts, Flint and Tinder 365s, Proof Nomads, and more. Keep scrolling and you’ll even find Tranquillo “Chillshorts,” which appear to be some kind of sweatpant/boardshort hybrid. Sweatshorts you might say. Made from a cotton-poly fabric, these little guys are the perfect companion for those of us working from home this summer. Don’t miss out, grab a pair today.
Up to 50% off | Ella Paradis | Use Code HOTPhoto: Ella Paradis
Ella Paradis loves giving out discounts like this, seek and ye shall find. Drop the code HOT in at checkout and see which savings you get. I got 50% and 40% off on different products just to test the code out.
But there are some restrictions like the discount doesn’t work on holy grail items like the Hitachi Magic Wand. Bummer. But it does work on the top-selling Womanizer Premium Stimulator. This code is good for a variety of products (lube, bondage, candles, condoms, etc.) across the site but you do have to play around with it. At the moment it seems arbitrary, which might be the point. Ella Paradis is also giving you a $5 coupon when you spend $100 if you’re feeling wily on spending.
Free shipping on all orders and deal runs until June 10.
Today at MorningSave, a large room air purifier by Holmes is down to $129. Usually $200, this dual-position model can be effective from any wall or corner in the room. Its True HEPA filter should be able to catch nearly 100% of any airborne particle up to 0.3 microns large, which covers just about all the most common allergens that have destroyed countless mornings.
You’ll get a digital display and three different speeds to make operation easy, and its size and power allow it to stay effective in rooms up to 430 square feet.
Not everyone has the luxury of moisture in the air during the Bad Times. Some of us live in dry apartments or houses in which we can hardly breathe through our nostrils. The solution, I’m told, is a humidifier. I have a cheap one right now but it sucks! This one from TaoTronics, according to reviewers, is much better.
At MSRP, its $100 price tag is a little steep if I’m honest, but at $70 with our exclusive code KINJIA66 (plus the clippable coupon on the site), it’s actually quite tempting. The 5.5-liter unit, designed for large rooms, is capable of clearing out dry air for 45 hours straight on one fill. It covers rooms up to 200-450 sq. foot which, seeing as my apartment is 550 sq. foot in its entirety, means you might only need one.
But if you have a larger apartment or house, it’s not a bad idea to shell out for one in each room. In the winter, you can even set the temperature to dispense warm mist up to 140°F, for a sauna-like experience. That said, warm mist mode is automatically disabled at night to keep you safe and sound from overheating and disruptive noise.
This post was originally published by Gabe Carey on 3/27/2020 and updated by Quentyn Kennemer with new information on 5/26/2020.
Xbox gift cards are usable across Xbox One and Windows 10, and they can be used on anything available in the digital store, including games, movies, TV shows, music, and apps.
You’ll get miniaturized versions of pool, foosball, skeeball, and air hockey. All that’s left to buy are shot glasses for the inevitable drinking games you’ll come up with. Add better health insurance while you’re at it. You know ... just in case you’re bad at those, too.
It’s gonna be a while before we start going to any concerts again, and even when we do, they’re probably gonna look a little different. Even so, there’s a particular delight in being in a space filled with music, and humming along to your favorite tunes. This isn’t a concert replacement, but the Marshall Stanmore II offers impressive sound quality for a Bluetooth speaker, and it’s down to $280 on Amazon right now, saving you $70, so tuck that extra cash away for a rainy day.
I love Marshall. Every product I’ve had from them becomes my favorite and these Minor II in-ear headphones are at the top. Amazon is currently discounting these by 46% which is an amazing deal on a quality product. These are usually $129 but worth every penny.
I run with these almost every day and can vouch that they not only stay in place but have a great sound and block out a lot of excess noise. I love how compact these are. They’re easy to toss in your bag or even pocket. I’ve even fallen asleep with these, that’s how comfortable they are. They charge quickly, pair with anything, and the mic is clear for phone calls or even recording a podcast (which I do weekly). I can’t recommend these enough.
Free shipping if you are a Prime member and ready to be sent out now.
There’s a good chance a lot of us will have to work from home for a while. That comes with the typical woes of shoddy video calls and slow speeds whenever you’re doing something important, but it also makes things like watching Netflix tough when everyone’s at home trying to stream something. You’ll wanna dodge those issues where you can, and a good router can help.
TP-Link’s AX1500 Wi-Fi 6 router, currently down to $70 on Amazon, can help give you a bit of extra bandwidth to make working from home less prone to buffering. It provides 300 Mbps on 2. 4 GHz and 1201 Mbps on 5 GHz (802. 11ax), plus parental controls if you’ve gotta lock things down a bit more for the little ones.
Health tracking isn’t a necessity, but if it’s something you’re interested in, having a smart scale can make tracking your weight a bit less of a chore. The Eufy Smart Scale is available today in a bundle with the Eufy Smart Plug Mini, for just $50, giving you a cheap entry into the world of health tracking gizmos. This one’s not just good for weight tracking, though; it can also track body fat percentage (But honestly you shouldn’t worry about this too much), or body water, though accuracy may vary. Whatever you choose to track, it’ll sync all your data to Google Health or Apple HealthKit, depending on your chosen platform, and you can start getting a more comprehensive look at your routine.
HP is slashing $260 off the starting list price of its modest 15t model laptop right now. This Windows 10 PC comes with a 10th-gen Intel Core i5 in the base config, along with a 256GB SSD and 12GB RAM. The one big downside is a sub-1080p 15.6” screen, although you can pay a bit extra to bump that up to Full HD.
Humble Suds is a small business with a lot of happy customers. They’ve become a popular Etsy shop by keeping cleaning safe and simple. These two Earth Mommas invested in the power of the plant along with mineral-derived familiar ingredients topped off with pure essential oils. Their current bundle is the Humble Hero Set that lets you sample a little of it all for $43.
The Humble Hero set features some of their best products. The all-purpose cleaner (choose the scent), hand sanitizers (lavender/mint scent), one laundry soap for ten loads, and a double-lined mask. Comment after comment mentions how lovely all the scents are. These products are handmade in Evergreen, Colorado by two moms who wanted top-notch ingredients, that are locally sourced when possible and of the highest quality. They certainly seemed to have delivered.
Ships free from Colorado. And 15% of this purchase will go to support The United Way.
Nearing the end of your PlayStation Plus subscription? It would normally cost you $60, but thanks to CDKeys, you can add a whole year to your account for just $32. PlayStation Plus is required for online play and cloud saves, but there are other premium benefits like free games, exclusive discounts, and Share Play. It doesn’t look like these shut-ins will go away quickly and quietly, so if you’re planning on filling your newfound time with a spot of gaming, PS+ is an absolute necessity.
This story was originally published by Quentyn Kennemer on 4/08/2020 and updated by Gabe Carey with new information on 5/19/2020.