Long-time Slashdot reader chicksdaddy shares news of a recent report from cybersecurity company Forcepoint's X-Lab, examining how cybersecurity decision-making is affected by six common biases: For instance, Forcepoint found that older generations are typically characterized by information security professionals as "riskier users based on their supposed lack of familiarity with new technologies." However, studies have found the opposite to be true: younger people are far more likely to engage in risky behavior like sharing their passwords to streaming services. The presumption that older workers pose more of a risk than younger workers is an example of so-called "aggregate bias," in which subjects make inferences about an individual based on a population trend. Biases like this misinform security professionals by directing their focus to individual users based on their supposed group membership. In turn, analysts wrongly direct their focus to the wrong individuals as sources of security issues.

Availability bias may influence cybersecurity analysts' decision-making in favor of hot topics in the news, which ultimately cloud other information they may know but are not so frequently exposed to; leading them to make less well-rounded decisions. People encounter "confirmation bias" most frequently during research. By neglecting the bigger picture, assumptions are made and research is specifically tailored to confirm those assumptions. When looking for issues, analysts can often find themselves looking for confirmation of what they already believe to be the cause as opposed to searching for all possible causes.

The fundamental attribution error also plays a significant role in misleading security analysts, Forcepoint found. This is manifested when information security analysts or software developers place blame on users being inept instead of considering that their technology may be faulty or that internal factors contributed to a security lapse.
The report also cites what it calls the framing effect. "Security problems are often aggressively worded, and use negative framing strategies to emphasize the potential for loss."

This year America's National Security Agency (NSA) is once again "developing a cyber challenge and daring more than 330 schools and 2,600 students to solve it," writes Federal News Network.

Slashdot reader eatvegetables shares their report: Kathy Hutson, the senior strategist for industry and academic engagement at the NSA, said the Codebreaker Challenge has become one of the best ways to attract the next generation of talent to the federal government... NSA launched the Codebreaker Challenge in 2013 as a way to further connect with students and professors, who are focused on technology and cyber issues. Over the last six years, the annual initiative has become a much-anticipated challenge with professors making it a part of their classes and students testing their mettle against NSA's cyber experts...

The initiative provides students, professors and anyone else who is interested "with a hands-on opportunity to develop their reverse-engineering /low-level code analysis skills while working on a realistic problem set centered around the NSA's mission," said Eric Bryant, a technical director in the crypto analysis organization at the NSA. The 2018 challenge focused on ransomware and blockchain, requiring participants to solve eight separate, but related challenges... Bryant said a group of NSA cyber experts develop the challenge each year on top of their regular duties. He said they try to focus on areas that are either up-and-coming or current cyber threats and attack vectors. For the 2019 Codebreaker Challenge, Bryant said it likely will focus on mobile security threats, probably using an Android operating system...

Bryant said he reaches out to all of the students who solve the challenge and NSA sends them letters of recognition and a memento for participating. "We reach out to these students to figure out what year they are in, how could they come here to do internships or hire them full-time, so we are definitely on that from a hiring and recruitment perspective," Hutson said. The NSA keeps a leaderboard ranking the participating colleges. (Last year Oregon State had over 100 students participating.)

The 2018 challenge is still online, Bryant says, "and there are people who are working and submitting solutions."

PolygamousRanchKid shares a report: GeekWire obtained an internal Microsoft list of prohibited and discouraged technology -- software and online services that the company doesn't want its employees using as part of their day-to-day work. We first picked up on rumblings of the prohibition from Microsoft employees who were surprised that they couldn't use Slack at work, before tracking down the list and verifying its authenticity. While the list references the competitive nature of these services in some situations, the primary criteria for landing in the "prohibited" category are related to IT security and safeguarding company secrets.

Slack is on the "prohibited" category of the internal Microsoft list, along with tools such as the Grammarly grammar checker and Kaspersky security software. Services in the "discouraged" category include Amazon Web Services, Google Docs, PagerDuty and even the cloud version of GitHub, the popular software development hub and community acquired by Microsoft last year for $7.5 billion...

"It's not just the risk that Google will try to find trade secrets from data stored on their servers," said Christopher Budd, who has worked in security technology for 20 years, including past roles in Microsoft security and privacy communications. "When you're at Microsoft, you're at risk of state sponsored industrial espionage."
The article notes that in the past Microsoft adopted an even harsher stance to employees using competing products. "At a company meeting during his tenure as CEO, Steve Ballmer once famously snatched an iPhone from an employee and pretended to stomp on it..."

But GeekWire also argues that Microsoft's prohibiting of a popular chat tool "can have implications in a competitive recruiting environment."

An anonymous reader quotes MarketWatch: Iran has increased its offensive cyberattacks against the U.S. government and critical infrastructure as tensions have grown between the two nations, cybersecurity firms say.

In recent weeks, hackers believed to be working for the Iranian government have targeted U.S. government agencies, as well as sectors of the economy, including oil and gas, sending waves of spear-phishing emails, according to representatives of cybersecurity companies CrowdStrike and FireEye, which regularly track such activity. It was not known if any of the hackers managed to gain access to the targeted networks...

"Both sides are desperate to know what the other side is thinking," said John Hultquist, director of intelligence analysis at FireEye. "You can absolutely expect the regime to be leveraging every tool they have available to reduce the uncertainty about what's going to happen next, about what the U.S.'s next move will be...."
According to the article, one of the phishing emails "appeared to come from the Executive Office of the President and seemed to be trying to recruit people for an economic adviser position.

"Another email was more generic and appeared to include details on updating Microsoft Outlook's global address book."

"If you hate your company, its employees and the shareholders then go ahead and introduce the latest management fad: Hot-desking," writes Forbes contributor Simon Constable. "It's a better way to destroy the firm than inviting Russian hackers to rob you blind.

"The bigger the company, the faster the damage will occur with hot-desking."

Hot-desking is a working arrangement where employees have no assigned desk. Each morning you get a workstation based on that old standby, first-come-first-served. If you show up at 5:30 a.m. then you'll likely have your pick. Later than 9 a.m., then probably you'll get what's left even if that means working apart from your colleagues. The theory behind this idea is that it provides companies with increased flexibility in managing office space. With some exceptions, the drawbacks vastly outweigh any benefits.

I know this having witnessed decades in corporate jobs, including a role at one employer that implemented such idiocy. It sends the message that employees don't matter. Employers frequently say their employees are their biggest asset. But when the company can't even be bothered to let you have a permanent desk, then the opposite message is sent.
He cites other more specific problems -- like the fact that no one can easily find anyone, making it harder to hold quick impromptu discussions or ask for help. And it also becomes harder to explain to employees why they can't just work from home.

The article concedes hot-desking "probably works just fine" for small companies with just a handful of employees. But "the bigger the firm the larger the inefficiency that is caused. A company of 50 people might see only minor problems from hot-desking, while one of 50,000 will likely see massive dysfunction throughout the institution..."

"If you see a public company introducing hot desks as a way to add flexibility or save money across the board, then be afraid for investors. Why? Because the profits quickly suffer in a dysfunctional company."

This week the New York Times' Style section asked an interesting question. "Slack wants to replace email. Is that what we want?" The company says it has 88,000 paying customers -- a sliver of a sliver of the world's desk-and-phone-bound office workers, and fewer than work full time at, for example, Google's parent company, Alphabet. Speaking of Google, the company has a Slack alternative of its own, called Hangouts Chat, as does Facebook, in Workplace. Microsoft has Teams, which is bundled with its Office software and which the company says is being used by more than 500,000 organizations. This multifront attack on email is just beginning, but a wartime narrative already dominates: The universally despised office culture of replies and forwards and mass CCs and "looping in" and "circling back" is on its way out, and it's going to be replaced by chat apps. So what happens if they actually win...?

For the right office, it's a huge relief to chat. "I know for the engineering team it's a game-changer," said Shannon Todesca, an employee at CarGurus, an automotive shopping site. "It's used to keep track of code pushes," she said, as well as system errors. Workers also report dentist appointments and sick days to the #ooo (out of office) channel, preventing inboxes from getting clogged, or an early heads-up from getting lost. At Automattic, which runs Wordpress.com and a handful of smaller internet services, Slack is the glue that binds a fully remote "virtual office" of nearly 1,000 employees living in dozens of countries and working on vastly different products...

Rank-and-file employees were more likely to share concerns about the new era of office chat... Most common were mixed feelings, often related to privacy and productivity. "We've had to consciously discuss using Slack less often," said Lacey Berrien, who works at marketing startup Drift. "I had our IT team check a few weeks ago, and we were up to over 950 Slack channels," she said, "and that doesn't count the private ones...." I have also spent the last 10 years at companies where work chat was the norm and observed the arrival of Slack with both relief and suspicion. Finally, a better work chat app. Then: Oh god, this is really how people are going to work, now?
I remember using chat logs to trace back the discussions that led to buggy programs. (Though obviously you can do the same thing with archived emails.) So I'd be interested to hear how Slashdot's readers would answer the question.

Should Slack-like chat clients replace email?

An anonymous reader quotes a report from ZDNet: A report published this week by the NASA Office of Inspector General reveals that in April 2018 hackers breached the agency's network and stole approximately 500 MB of data related to Mars missions. The point of entry was a Raspberry Pi device that was connected to the IT network of the NASA Jet Propulsion Laboratory (JPL) without authorization or going through the proper security review. NASA described the hackers as an "advanced persistent threat," a term generally used for nation-state hacking groups.

Fake presidential alerts could be sent to tens of thousands of phones, according to a report out of the University of Colorado Boulder. From a report: Researchers say they found a backdoor that let them mimic alerts and blast fake messages to people confined to a small area, such as a city block or a sports stadium. The researchers developed software mimicking the presidential alert format and then used commercially available wireless transmitters to send the messages to phones within their radius. The team had a success rate of hitting 90% of all phones in the area it tested.

secwatcher shares a report from Threatpost: Millions of PCs made by Dell and other OEMs are vulnerable to a flaw stemming from a component in pre-installed SupportAssist software. The flaw could enable a remote attacker to completely takeover affected devices. The high-severity vulnerability (CVE-2019-12280) stems from a component in SupportAssist, a proactive monitoring software pre-installed on PCs with automatic failure detection and notifications for Dell devices. That component is made by a company called PC-Doctor, which develops hardware-diagnostic software for various PC and laptop original equipment manufacturers (OEMs). A patch has been issued by PC-Doctor that fixes impacted devices. Impacted customers can find the latest version of SupportAssist here (for single PC users) or here (for IT managers).

Freshly Exhumed shares a report from The Georgia Straight: The Quebec-based Desjardins Group has admitted to being victimized by one of the largest data breaches in Canadian history. Laval police informed the financial-services giant that personal information of more than 2.9 million members has been shared with people outside of the organization. This includes 2.7 million people and 173,000 businesses. "This situation is the outcome of unauthorized and illegal use of our internal data by an employee who has since been fired," Desjardins said in a statement. "In light of these events, and given the circumstances, additional security measures were put in place on all accounts." Desjardins, which is the largest federation of credit unions in North America, will be informing people by letters if they've been affected. The leaked data included first and last names, birthdates, social insurance numbers, addresses, phone numbers, email addresses, and details about banking habits. However, passwords, security questions, and PINs were not disclosed.

An anonymous reader quotes a report from Motherboard: The Oregon Department of Corrections has banned prisoners from reading a number of books related to technology and programming, citing concerns about security. According to public records obtained by the Salem Reporter, the Oregon Department of Corrections has banned dozens of books related to programming and technology as they come through the mail room, ensuring that they don't get to the hands of prisoners. At least in official department code, there is no blanket ban on technology-related books. Instead, each book is individually evaluated to assess potential threats. Many programming-related books are cited as "material that threatens," often including the subject matter ("computer programming") as justification. The Oregon Department of Corrections (DOC) worries that prisoners could use the tools mentioned in some of the programming-related books to compromise their systems. But what's odd is the scope of the ban. Justin Seitz's Black Hat Python book failed the prison's security test since it's geared towards hacking, but so did the book Windows 10 for Dummies, Microsoft Excel 16 for Dummies which simply teaches proficiency in Excel and Windows 10.

Officials at the DOC argue that knowledge of even these basic programs can pose a threat to prisons. "Not only do we have to think about classic prison escape and riot efforts like digging holes, jumping fences and starting fires, modernity requires that we also protect our prisons and the public against data system breaches and malware," DOC spokesperson Jennifer Black said in an emailed statement. "It is a balancing act we are actively trying to achieve."

WeTransfer, a popular online service to transfer and share files, has informed some of its customers of a security incident that resulted in it sharing emails with download links to wrong recipients. BetaNews reports: In the email to customers, WeTransfer said: "We are writing to let you know about a security incident in which a number of WeTransfer service emails were sent to the wrong people. This happened on June 16th and 17th. Our team has been working tirelessly to correct and contain this situation and find out how it happened. We have learned that a transfer you sent or received was also delivered to some people it was not meant to go to. Our records show those files have been accessed, but almost certainly by the intended recipient. Nevertheless, as a precaution we blocked the link to prevent further downloads.

Even though Google launched confidential mode over a year ago, people are still confused about what it does. Is it actually secure or private? Is it encrypted? From a report: When you turn it on, does it prevent Google from reading your messages? The answer to these questions is 'no.' In fact, the decision to call it "confidential" suggests a level of security and privacy that doesn't exist in Gmail confidential mode. Gmail's confidential mode does not mean your messages are end-to-end encrypted. Google can still read them. Expiring messages aren't erased for good, and the recipient can always take a screenshot of your message.

Gmail's confidential mode does not make emails private because Google can always read them. When you send an email with confidential mode turned on, Google keeps the email contents on its servers. Other Gmail users can read the email in their inbox, but outside users only receive an email notifying them that a sender "has sent you an email via Gmail confidential mode" along with a link to a page on google.com.

PolygamousRanchKid shares a report from Reuters: The United States has told India it is considering caps on H-1B work visas for nations that force foreign companies to store data locally, three sources with knowledge of the matter told Reuters, widening the two countries' row over tariffs and trade. India, which has upset companies such as Mastercard and irked the U.S. government with stringent new rules on data storage, is the largest recipient of these temporary visas, most of them to workers at big Indian technology firms.

A Washington-based industry source aware of India-U.S. negotiations also said the United States was deliberating capping the number of H-1B visas in response to global data storage rules. The move, however, was not solely targeted at India, the source said. Most affected by any such caps would be India's more than $150 billion IT sector, including Tata Consultancy Services (TCS) and Infosys Ltd, which uses H-1B visas to fly engineers and developers to service clients in the United States, its biggest market. Major Silicon Valley tech companies also hire workers using the visas. Since last year, the Trump administration has been upset that U.S. companies such as Mastercard and Visa suffer due to regulations in several countries that it says are protectionist and increasingly require companies to store more data locally. India last year mandated foreign firms to store their payments data 'only in India' for supervision, and New Delhi is working on a broad data protection law that would impose strict rules for local processing of data it considers sensitive. Senior Indian government officials were briefed last week on a U.S. plan to cap H-1B visas issued each year to Indians at between 10% and 15% of the annual quota. Currently, there is no country-specific limit on the 85,000 H-1B work visas granted each year, and an estimated 70% go to Indians.

Google on Thursday confirmed that a bug in its Nest security cameras could have allowed users to be spied on. The Daily Dot reports: The issue was first raised by a user on Facebook who recently sold his Nest Cam Indoor yet was still able to access its feed. The problem involves Wink, an app that lets people manage multiple smart devices regardless of their developer. The Facebook user noted that despite carrying out a factory reset on his Nest camera before selling it, his Wink account remained connected to the device, allowing him to view snapshots of the buyer's live feed.

Wirecutter tested the vulnerability on its own Nest Cam by linking it to a Wink account and then performing a factory reset. The publication also found it was receiving "a series of still images snapped every several seconds" via its Wink account. "In simpler terms: If you buy and set up a used Nest indoor camera that has been paired with a Wink hub, the previous owner may have unfettered access to images from that camera," Wirecutter says. "And we currently don't know of any cure for this problem." Google responded to the report and said it has fixed the problem. "We were recently made aware of an issue affecting some Nest cameras connected to third-party partner services via Works with Nest," a spokesperson told Wirecutter. "We've since rolled out a fix for this issue that will update automatically, so if you own a Nest camera, there's no need to take any action."

An anonymous reader quotes a report from ZDNet: A MongoDB database was left open on the internet without a password, and by doing so, exposed the personal details and prescription information for more than 78,000 U.S. patients. The database contained information on 391,649 prescriptions for a drug named Vascepa; used for lowering triglycerides (fats) in adults that are on a low-fat and low-cholesterol diet. Additionally, the database also contained the collective information of over 78,000 patients who were prescribed Vascepa in the past. Leaked information included patient data such as full names, addresses, cell phone numbers, and email addresses, but also prescription info such as prescribing doctor, pharmacy information, NPI number (National Provider Identifier), NABP E-Profile Number (National Association of Boards of Pharmacy), and more. According to vpnMentor, the company that left the database open may have violated HIPAA, and may be in line for a hefty fine for failing to encrypt the patient data it had stored on the database server, a HIPAA golden rule," the report adds. "However, Dissent, the administrator of DataBreaches.net, a website dedicated to tracking data breaches and HIPAA violations, told ZDNet that just because a system stores medical information, it doesn't mean it's necessarily covered by HIPAA. Until the database owner is found, no other conclusions can be drawn."

Apple on Thursday launched a voluntary recall and replacement program on Thursday for the 15-inch 2015 MacBook Pro with Retina Display, saying that batteries on some of these devices could overheat and "may pose a fire safety risk." From a report: The current generation is not impacted thankfully; if you have a 2016-2018 MacBook Pro you can breathe a sigh of relief. Actually, the only model covered by the recall is the "Retina, 15-inch, Mid 2015." If you own that model, don't panic -- it is not all of them. To see if your computer has the faulty battery, you need to enter your serial number on Apple's website.

An anonymous reader writes: A recent Firefox zero-day that has made headlines across the tech news world this week was actually used in attacks against Coinbase employees, and not the company's users. Furthermore, the attacks used not one, but two Firefox zero-days, according to Philip Martin, a member of the Coinbase security team, which reported the attacks to Mozilla. One was an RCE reported by a Google Project Zero security researcher to Mozilla in April, and the second was a sandbox escape that was spotted in the wild by the Coinbase team together with the RCE, on Monday.

The question here is how an attacker managed to get hold of the details for the RCE vulnerability and use it for his attacks after the vulnerability was privately reported to Mozilla by Google. The attacker could have found the Firefox RCE on his own, he could have bribed a Mozilla/Google insider, hacked a Mozilla/Google employee and viewed details about the RCE, or hacked Mozilla's bug tracker, like another attacker did in 2015.

The city council for Riviera Beach, Florida, voted this week to pay more than $600,000 to a ransomware gang so city officials could recover data that has been locked and encrypted more than three weeks ago. From a report: The city's decision, as reported by CBS News, came after officials came to the conclusion that there was no other way to recover the city's files. Access to Riviera City data has been locked since May 29, this year, when a Riviera Beach police department employee opened an email and unleashed ransomware on the city's network. The ransomware locked files and shut down all the city's services. Operations have been down ever since, with the exception of 911 services, which were able to continue to operate, although limited. The city's website, email server, billing system, and everything else has been down ever since, with all city communications being done in person, over the telephone, or via posters. The city has been having a hard time recovering from the incident ever since.

An anonymous reader quotes a report from Bloomberg: Just one day of work per week is the most "effective dose" to give the mental health benefits of paid employment, research suggests. A study indicated that the risk of mental health problems reduces by 30% when people move from unemployment or stay-at-home parenting into paid work of eight hours or less per week. But researchers at the Universities of Cambridge and Salford found no evidence that working any more than eight hours provided further boosts to well-being. The researchers used data from a panel survey to examine how changes in working hours were linked to mental health and life satisfaction in more than 70,000 UK residents between 2009 and 2018. They controlled for characteristics including age, children, longstanding illness and household income. The study suggests that to get the mental well-being benefits of paid work, the most "effective dose" is only around one day a week -- as anything more makes little difference. The research has been published in the journal Social Science & Medicine.