IT leaders are losing sleep over improving overall IT performance (60%), data security (50%), process risk and compliance (46%), and the need to improve agility (41%), according to Rocket Software.

To overcome these challenges, IT organizations are turning to hybrid solutions to leverage the benefits of the cloud and the mainframe. An astounding 93% of respondents strongly agree with the sentence, “I believe my organization needs to embrace a hybrid infrastructure model that spans from mainframe to cloud.”

The benefits of hybrid approach for critical systems integration

Many businesses, in some form or another, have been migrating their operations to the cloud for years now. But critical systems like the mainframe remain as critical as ever.

Organizations can save money and resources—and drive efficiency—by connecting mission-critical content across mainframe, distributed, and cloud technologies with a hybrid approach.

This enables organizations to modernize in place, leveraging their existing IT investments, rather than ripping and replacing. IT leaders clearly recognize this opportunity, with 65% of technology professionals working in organizations of more than 1,000 people cited implementing hybrid cloud strategy as a top priority.

In addition to hybrid cloud, businesses are turning to automation to remain competitive in today’s digital-first world. Many IT professionals are still spending much of their time manually managing and analyzing data, with 63% of respondents spending anywhere from 6-15 hours on manual data entry and analysis each week.

Organizations are turning to automation to reduce the number of hours employees are spending on data entry and leveraging advanced technology to increase efficiency and agility and mitigate potential risk.

The benefits of hybrid cloud solutions

Respondents noted that they measure success within their IT organization by increased efficiency (71%), optimized resources (67%), and reduced risk (63%). Only 32% are extremely confident that they have the right technology, processes, and people in place to execute an effective approach to IT management.

62% noted they have a much greater focus on efficiency due to the economic landscape. Respondents ranked faster DevOps processes, automated processes, and increasing overall output as the top three measures that would be most impactful for increasing efficiency.

Respondents cited software development as both the most and least efficient aspect of their IT organization. This signals that while some organizations have optimized their software development practice, it’s still a hurdle for others.

“IT leaders are under enormous pressure to do more with less resources and build an IT department that can optimize an organization’s resources and reduce exposure to risk,” said Milan Shetti, CEO of Rocket Software. “Leaders understand that hybrid cloud solutions are the most effective way to leverage the benefits of both the mainframe and the cloud. By pairing the right technologies, processes, and vendors together, IT leaders can modernize their operations without disrupting day-to-day operations.”

from Help Net Security https://ift.tt/9ZiqdWL

Modern refrigerators do more than keep food chilled: They also come with ice makers, water dispensers and filters, and features that help you keep contents organized.

But the more bells and whistles there are, the more of a chance there is that at least one of the components will break. Homeowners are then faced with the decision of whether to repair their current fridge, or replace it with a new one.

So how do you know when it makes more sense to fix your refrigerator? The experts at Consumer Reports (CR) have created a guide and interactive tool to help you figure it out. Here’s what to know.

How to use CR’s interactive tool

You can access the interactive online tool on this page of the CR website. Start by selecting your fridge’s freezer type (top freezers, bottom freezers, French doors, side-by-sides, or built-ins) from the drop-down menu on the top left. Then, use the sliders on the bottom of the tool to enter the age of your refrigerator, the original cost, and any estimate you have for a repair.

The color bar will then let you know whether you should definitely repair, consider a repair, or replace your refrigerator. If it indicates that you should replace your fridge, the tool provides recommendations for new models to consider.

When it makes more sense to repair your refrigerator instead of replacing it

Rather than simply getting rid of a new-ish refrigerator—and contributing to a landfill—there are many situations when repairing the one you currently own makes more financial sense.

According to CR research, it’s typically more economical to fix refrigerators less than 10 years old. This is good news, considering there’s a 31% likelihood that a fridge will need repairs between the second and fifth years of ownership, with a median out-of-pocket cost of $197.

Not all repairs are the same

Just because there’s a problem with your fridge, it doesn’t necessarily mean you’ll need to shell out for expensive professional repairs. Here are three factors to consider, per CR:

• Recalls: Check the manufacturer’s website to see if the faulty part of your fridge is covered by a product recall.
• Your warranty: Is your fridge covered by any type of standard or extended warranty? If so, is your problem one it covers?
• DIY repairs: If you’ve identified the problem, look in the owner’s manual and/or do an online search to find out whether it’s a quick and simple fix you can do yourself, or a situation that requires a professional.

If you aren’t able to pinpoint the problem on your own, and are on the fence about whether to bring in a professional, the experts at CR recommend calling your manufacturer’s customer service department:

Many refrigerators now feature technology that allows them to run remote diagnostics that can identify your problem. This will either take the form of connecting your refrigerator to your home’s WiFi so that customer service can access it, or transmitting a series of diagnostic codes over the phone that customer service can translate into data on the issue.

Keep in mind that if you do end up hiring a professional to determine what’s wrong with your fridge, most charge a fee for the visit—though it’s typically applied towards the cost of any repairs, according to CR.

from Lifehacker https://ift.tt/IMasoE6

If you run a WordPress site with the Ultimate Members plugin installed, make sure you’ve updated it to the latest version.

Over the weekend, the plugin’s creator published version 2.6.7, which is supposed to patch a serious security hole, described by user @softwaregeek on the WordPress support site as follows:

A critical vulnerability in the plugin (CVE-2023-3460) allows an unauthenticated attacker to register as an administrator and take full control of the website. The problem occurs with the plugin registration form. In this form it appears possible to change certain values for the account to be registered. This includes the wp_capabilities value, which determines the user’s role on the website.

The plugin doesn’t allow users to enter this value, but this filter turns out to be easy to bypass, making it possible to edit wp_capabilities and become an admin.

In other words, when creating or managing their accounts online, the client-side web form presented to users doesn’t officially allow them to set themselves up with superpowers.

But the back-end software doesn’t reliably detect and block rogue users who deliberately submit improper requests.

Plugin promises “absolute ease”

The Ultimate Member software is meant to help WordPress sites to offer various levels of user access, listing itself as the “best user profile and membership plugin for WordPress”, and talking itself up in its advertising blurb as:

The #1 user profile & membership plugin for WordPress. The plugin makes it a breeze for users to sign-up and become members of your website. The plugin allows you to add beautiful user profiles to your site and is perfect for creating advanced online communities and membership sites. Lightweight and highly extendible, Ultimate Member will enable you to create almost any type of site where users can join and become members with absolute ease.

Unfortunately, the programmers don’t seem terribly confident in their own ability to match the “absolute ease” of the plugin’s use with strong security.

In an official response to the above security report from @softwaregeek, the company described its bug-fixing process like this [quoted text sic]:

We are working on the fixes related to this vulnerability since 2.6.3 version when we get a report from one of our customer. Versions 2.6.4, 2.6.5, 2.6.6 partially close this vulnerability but we are still working together with WPScan team for getting the best result. We also get their report with all necessary details.

All previous versions are vulnerable so we highly recommend to upgrade your websites to 2.6.6 and keep updates in the future for getting the recent security and feature enhancements.

We are currently working on fixing a remaining issue and will release a further update as soon as possible.

Bugs in many places

If you were on cybersecurity duty during the infamous Log4Shell vulnerability over the Christmas vacation season at the end of 2021, you’ll know that some types of programming bug end up needing patches that need patches, and so on.

---

---

For example, if you have a buffer overflow at a single point in your code where you inadvertently reserved 28 bytes of memory but meant to type in 128 all along, fixing that erroneous number would be enough to patch the bug in one go.

Now, however, imagine that the bug wasn’t down to a typing mistake at just one point in the code, but that it was caused by an assumption that 28 bytes was the right buffer size at all times and in all places.

You and your coding team might have repeated the bug at other places in your software, so that you need to settle in for an extended session of bug-hunting.

That way, you can promptly and proactively push out further patches if you find other bugs caused by the same, or a similar, mistake. (Bugs are generally easier to find once you know what to look for in the first place.)

In the Log4J case, attackers also set about scouring the code, hoping to find related coding mistakes elswhere in the code before the Log4J programmers did.

Fortunately, the Log4J programming team not only reviewed their own code to fix related bugs proactively, but also kept their eyes out for new proof-of-concept exploits.

Some new vulnerabilities were publicly revelealed by excitable bug-hunters who apparently preferred instant internet fame to the more sober form of delayed recognition they would get from disclosing the bug responsibly to the Log4J coders.

We saw a similar situation in the recent MOVEit command injection vulnerability, where associates of the Clop ransomware gang found and exploited a zero-day bug in MOVEit’s web-based front end, allowing the crooks to steal sensitive company data and then try to blackmail the victims into paying “hush money”.

Progress Software, makers of MOVEit, quickly patched the zero-day, then published a second patch after finding related bugs in a bug-hunting session of their own, only to publish a third patch shortly afterwards, when a self-styled threat hunter found yet another hole that Progress had missed.

Sadly, that “researcher” decided to claim credit for finding the vulnerability by publishing it for anyone and everyone to see, rather than giving Progress a day or two to deal with it first.

This forced Progress to declare it to be yet another zero-day, and forced Progress customers to turn the buggy part of the software off entirely for about 24 hours while a patch was created and tested.

---

---

In this Ultimate Members bug situation, the makers of the plugin weren’t as thoughtful as the makers of MOVEit, who explicitly advised their customers to stop using the software while that new and exploitable hole was patched.

Ultimate Members merely advised their users to keep their eyes out for ongoing updates, of which the recently published 2.6.7 is the fourth in a chain of bug fixes for a problem first noticed in the middle of June 2023, when 2.6.3 was the current version number.

What to do?

• If you are an UltimateMember user, patch urgently. Given the piecemeal way that the plugin’s coding team seem to be addressing this issue, make sure you look out for future updates and apply them as soon as you can, too.
• If you’re a server-side programmer, always assume the worst. Never rely on client-side code that you can’t control, such as HTML or JavaScript that runs in the user’s browser, to ensure that submitted input data is safe. Validate thine inputs, as we like to say on Naked Security. Always measure, never assume.
• If you’re a programmer, search broadly for related issues when any bug is reported. Coding errors made in one place by one programmer may have been duplicated elsewhere, either by the same coder working on other parts of the project, or by other coders “learning” bad habits or trustingly following incorrect design assumptions.

---

from Naked Security https://ift.tt/DvNVKd2

No one wants to get into their car on a really hot day and turn on their air conditioning for some relief, only to wait for a refreshing, cool breeze that never comes. Or, maybe some semi-cool air manages to get through the vents a few minutes into your drive, but is too warm and too weak to make much of a difference. Either way, here are three ways to get more out of your car’s air conditioner.

How to get the most out of your car’s air conditioner

Some strategies for dealing with inadequate AC in your car—like parking in the shade, or using a windshield cover—focus on trying to keep it as cool as possible when it’s not in use. And while they do help keep the temperatures inside the car down a bit, it’ll still likely be uncomfortably hot when you get in.

Here are some other options that might work a bit better:

Change the air filter

When was the last time you changed your cabin air filter? If you can’t remember, or know it was a while ago, you may want to check it. Over time, the dirt, dust, pollen, and other particles that your air filter prevents from blowing out through your vents accumulate, potentially clogging it and stopping the cool air from flowing through.

Let the hot air out

It typically takes around 10 to 20 seconds for your car’s AC to get going, so switch it on as soon as you get in the car, and open your windows for roughly the same length of time. That way, you’re clearing the hot air out while the AC cools down.

Set it to the lowest temperature

It may seem like you’re doing your car a favor by setting the temp somewhere in the middle of the dial, but according to the automotive experts at Consumer Reports, that’s not the case.

“In a typical AC system, the air is cooled to 38 degrees,” CR editors explain. “If you set the temp higher, you’re actually forcing the system to reheat the cooled air, which takes more effort and more fuel.”

from Lifehacker https://ift.tt/6eMkPmf

Over the past few weeks, gardeners on the east coast and other parts of the country have been experiencing their first wildfire season. This means that even people who have been gardening for years may not be familiar with how to help their outdoor plants recover from the exposure to the smoke, and possibly even ash, coming from Canada. Here’s what to know.

How to help your garden recover from wildfire smoke

The extent of your garden’s smoke and ash damage depends on your proximity to the wildfire, along with the recent weather—especially the wind direction and speed, as well as whether there has been any precipitation. But, generally speaking, there are a few initial steps to take to promote your plants’ healthy growth through the rest of the season:

Your safety is most important

Even if the smoke has cleared at this point, check the air quality index in your area, and wear an N95 face mask. And, of course, don’t go outside if it’s not yet safe to do so.

Carefully assess the situation

Before taking any action, take a look around your garden, doing your best not to disturb any ash or other particles that may have settled on or around your plants.

“Avoid creating clouds of ash that you might accidentally breathe in,” says Brooke Edmunds, a master gardener at Oregon State University Extension with an expertise in community horticulture.

Rinse off your plants

Whether there’s a thick layer of ash, or a thin film of soot coating your plants—or even if they look completely normal—never use a leaf blower to clean them off, Edmunds says.

Instead, she recommends gently sprinkling them with water from your garden hose. “Wear a face covering at a minimum while doing this, wash your hands afterwards, and avoid tracking ash into your house on your shoes or clothes,” she adds.

Keep rinsing regularly

After your initial garden rescue mission, continue rinsing your plants with a hose—both from the top, and underneath the leaves—at least once a week.

from Lifehacker https://ift.tt/AMxZzIQ

Police are already using self-driving car footage as video evidence:

While security cameras are commonplace in American cities, self-driving cars represent a new level of access for law enforcement ­ and a new method for encroachment on privacy, advocates say. Crisscrossing the city on their routes, self-driving cars capture a wider swath of footage. And it’s easier for law enforcement to turn to one company with a large repository of videos and a dedicated response team than to reach out to all the businesses in a neighborhood with security systems.

“We’ve known for a long time that they are essentially surveillance cameras on wheels,” said Chris Gilliard, a fellow at the Social Science Research Council. “We’re supposed to be able to go about our business in our day-to-day lives without being surveilled unless we are suspected of a crime, and each little bit of this technology strips away that ability.”

[…]

While self-driving services like Waymo and Cruise have yet to achieve the same level of market penetration as Ring, the wide range of video they capture while completing their routes presents other opportunities. In addition to the San Francisco homicide, Bloomberg’s review of court documents shows police have sought footage from Waymo and Cruise to help solve hit-and-runs, burglaries, aggravated assaults, a fatal collision and an attempted kidnapping.

In all cases reviewed by Bloomberg, court records show that police collected footage from Cruise and Waymo shortly after obtaining a warrant. In several cases, Bloomberg could not determine whether the recordings had been used in the resulting prosecutions; in a few of the cases, law enforcement and attorneys said the footage had not played a part, or was only a formality. However, video evidence has become a lynchpin of criminal cases, meaning it’s likely only a matter of time.

from Schneier on Security https://ift.tt/bpzoakO

While surface-level confidence around hybrid cloud security is high, with 94% of global respondents stating their security tools and processes provide them with complete visibility and insights into their IT infrastructure, the reality is nearly one third of security breaches aren’t spotted by IT and security professionals, according to Gigamon.

Hybrid cloud security breaches expected to surge

According to Flexera, 74% of organizations now exist in the hybrid cloud and this infrastructure is considered the ‘norm’ by Forrester analysts. Yet it comes with a number of security concerns, clearly recognized by respondents to the Gigamon’s survey; 93% predict cloud security attacks are only going to increase, and 90% had experienced a breach in the last 18 months.

The issue is that 31% of breaches are being identified later down the line, rather than preemptively using security and observability tools – either by data appearing on the dark web, files becoming inaccessible, or users experiencing slow application performance (likely due to DoS or inflight exfiltration). This number rises to 48% in the US, and 52% in Australia.

The good news is that collaboration across IT is on the rise. 96% of IT and Security leaders around the world believe cloud security is everyone’s responsibility, and almost all (99%) see CloudOps and SecOps working towards a common goal.

Yet there is still more to be done, while CloudOps seems to be leading on strategy, 99% of respondents claim a lack of a security-first culture means vulnerability detection is often siloed to the SecOps team.

Legislation and attack complexity keep CISOs awake at night

The Gigamon report also identified that the key stressors for IT and security leaders in 2023 aren’t what many may have anticipated. It is unexpected blind spots (56%), legislation (34%) and attack complexity (32%) that keep CISOs and other IT leaders up at night, while a lack of cyber investment is only worrying 14 percent of global respondents, along with just 20% who were concerned about the ongoing skills gap.

In fact, only 19% claim effective security education for staff is a crucial factor for gaining confidence on IT infrastructure security. Respondents from France and Germany are slightly more concerned about skills, with 23% and 25% respectively stating they need access to skilled people in the cloud.

Instead, legislation is a growing worry on a global scale, and is a particular issue for the UK and Australia: 41% in the UK and 59% in Australia see change in cyber laws and compliance as a key concern.

Blind spots across hybrid cloud infrastructure

Survey respondents generally acknowledged blind spots across their hybrid cloud infrastructure:

• 70% lack visibility into encrypted data, a number that rises to 79% in Germany.
• 35% had limited insights into containers, which increases to 38% in France and 43 percent in Singapore.
• 48% had insights into laterally moving data, although the US leads the market here with 64% achieving East-West visibility.

Yet despite flagging blind spots as their leading stressor, one third of CISOs and 50% of other IT and security leaders admit they lack confidence in knowing where their most sensitive data is stored and how it is secured.

“These findings highlight a trend of critical gaps in visibility from on-premises to cloud, the danger of which is seemingly misunderstood by IT and Security leaders around the world,” comments Ian Farquhar, security CTO at Gigamon.

“Many don’t recognize these blind spots as a threat, yet East-West traffic – laterally moving data – and encrypted traffic can be incredibly dangerous in the hybrid cloud world. We’ve seen previous reports that highlight the vast quantity of malware that hides behind encryption. Considering over 50% of global CISOs are kept up at night by the thought of unexpected blind spots being exploited, there’s seemingly not enough action being taken to remediate critical visibility gaps,” added Farquhar.

Zero trust rises as top priority for IT and security leaders

The Gigamon report on hybrid cloud security trends points to zero trust as another IT and security leader priority. In fact, there’s an upward trend of how often this security framework is discussed at a board level; 87% of global respondents say zero trust is spoken about openly by the Board, a 29% increase compared to findings from 2022.

Yet while half of all respondents to this year’s survey stated that zero trust is crucial to boosting confidence levels that their organization is secure, the reality is that many teams simply do not have the visibility to enable it.

The UK (39%), the US (42%) and Australia (41%) are leading the market when it comes to achieving visibility to enable this framework, while France (26%), Germany (29%) and Singapore (25%) all fall behind.

Uncertainty about the reality of zero trust is high in France and Singapore in particular and all global respondents are recognizing the value of deep observability – the addition of real-time, network-derived intelligence to amplify the power of metric, event, log, and trace-based (MELT) security and observability tools – for building a foundation for zero trust.

97% also believe deep observability is an important element of cloud security – a rise of 8 percent from last year.

Mark Jow, EMEA CTO at Gigamon concludes, “Zero trust is still very much a ‘work in progress’ for organizations around the globe, but it’s positive to see that at least half of the IT and security leaders we surveyed view it as crucial to boosting security posture and even more positive to see them recognize the value of visibility. Deep observability and going beyond traditional MELT approaches is crucial if organizations are to advance successfully on their zero trust journeys, securing their hybrid cloud infrastructure and eradicating the critical visibility gaps that are clearly causing headaches and restless nights.”

from Help Net Security https://ift.tt/KGfEP1I