Want to hear some mind-blowing stats? Get this. 65% of Canadian office workers have expressed a preference for a hybrid work model where they split time between home and office. And here’s the most important nugget. Over 40% of these individuals say that they would begin hunting for a new job if their current employer mandated the return to the office full-time. Translation. If you are not actively finding ways to embrace and optimize your hybrid workspace, you’re in for a world of hurt. It’s not a question of if, but when. And in this episode of All Hands on Tech, we’ll discuss a few things you may not have considered.

The hybrid workspace is a reality and the vast majority of businesses are not going back to work as it was. The issue you face now as a business outside of how to transition staff to a hybrid world is how to make the new workspace as safe as the old one was, whether in your home, at your office, or wherever you may be. Security was much easier when everything was under one roof. However, in today’s world, we’re not always in the same location. That translates to a dire need for a 360 degree review of your company’s best practices when it comes to internet safety and security. Put it this way, the evil that’s out there absolutely loves the vulnerability of this new hybrid workspace.

Let’s start with email. Look, I know you’re thinking it’s not that difficult. Let the fake duct cleaning rep prey on someone more gullible than you. The thing is, anyone can be fooled. Okay, look, literally the fourth day at my IT World Canada career, I got an email from a kindhearted soul about a litter of puppies who needed a new home. Attached to the email was a contact form that you had to print out, fill in, and fax back to them. Yep, it was an email to send a fax. Like a responsible person, I emailed it to the entire company distribution list.

Speaker 2:
Houston, we have a problem.

Someone even more responsible than me Googled, identified it as a scam, and let the company know. The point is it can happen to anyone.

So how do you guard against that? By setting up a strong email security policy and culture. Here are five guidelines we feel are important. One, keep your work and your home emails separate. We’re all guilty of signing up for coupons with our work email address, but you can just make a special address for that. Gmail. Yahoo. Outlook. They give them away like their candy at Halloween. Two, using multi-factor authentication. Why use multi-factor? Because when they get more sophisticated, we need to get more sophisticated. Three, double check links and attachments. Hover over them and see if they make sense considering who sent them and exercise common sense. Why would the company’s bank be contacting you through an email, especially since you’re not accountant? Four, use strong and unique passwords. Let’s face it, passwords get stolen, so you need to keep strong, unique passwords. If you can’t remember them, there are so many password management tools out there. Consider rolling out one to your staff. And remember, password is not a password, Kevin.

Oh crap.

Mat Pancha:

Five and most importantly, embrace cybersecurity training. There is no question too stupid to ask. And in the online world, no mistake is too small. Get your staff trained.

Next up, backups. By now, we all likely have a great horror story that keeps us up every night. But in case you don’t, here’s a unique one that some of you may have heard before. During production of Pixar’s Toy Story 2, 90% of the movie was deleted during production. Luckily, the film supervising technical director was on maternity leave and didn’t want to lose out on doing her work. So she had a machine at home with the entire movie on it. The bottom line, have a backup. Have a backup plan, and have a backup plan to your plan.

A few guidelines on building your backup strategy. First, ransomware protection built in. It’s a must, because you don’t want your backup to have the ransomware in it that you’re trying to recover from. It’s human to forget to backup. So number two is automate. With your team working from home, consider having your backups go to the cloud as well. And finally, not everyone has the fastest internet at home, so deduplication and compression are very important, to shrink the size of your backups, thus keeping your recovery very fast.

Lastly, comes the company security audit. Basically, how secure are you, your team and the whole company. Even the biggest and best of us out there have some serious head-shaking moments. For example, just in July 2022, a single employee’s computer getting breached, caused theft of 20 gigabytes of data from Marriott Hotels. Also, in July 2022, a Twitter data breach exposed the contact info of some 5.4 million accounts. #oops.

Let’s be real. You’re faced with two dilemmas when it comes to security auditing. First off, it’s extremely difficult to do internally since no one ever seems to have the time to dive into. And secondly, doing so will likely give you a skewed and inaccurate scope of your actual security posture. Your perception and reality are rarely the same thing. Not convinced? Try asking people this question. Do you work out? See what I mean? Nothing is as telling and as honest as the input from outside of your circle. And it’s even more honest when the people doing the telling are experts in the field. It’s what they do.

Having said that, we have a white paper from the people at Ricoh who can tell you everything you need to know about baseline security audits. It’s well worth the read, but I will let you in on a couple of the tasty nuggets. A few things that we dive into. Who has access to what information? What are your software and equipment standards? What are your company cybersecurity policies? Do you even have cybersecurity policies? What are your biggest threats? And of course the proverbial much, much more. It even ends with this really cool car chase.

Look, we all love the new hybrid workspace. And when I say all, I mean all those creepy crawly threats out there as well. Do yourself a favor and beat them to the punch, or scam or bot or virus or Trojan. You get the picture. Anyway, thank you for watching. Be sure to like, subscribe, and check out that Ricoh white paper I mentioned and tell me what you thought of the car chase. Mat out.

The post All Hands on Tech – Security in the Hybrid Office first appeared on IT World Canada.

A Canadian mortgage broker’s database containing personal information on thousands of people was left open on the internet, according to security researchers.

Access to the database belonging to Toronto-based 8Twelve Financial Technologies was quickly restricted after the company was notified by researcher Jeremy Folwer and the staff of Website Planet, which offers resources for website builders.

According to a report issued today, the database has 717,814 records on thousands of Canadian residents, with home mortgage loan-related information including names, phone numbers, email addresses, physical addresses, and more. Many of the records appeared to be mortgage leads of people who want to buy a house, refinance, obtain an equity line of credit, or purchase an investment property, the report says.

“We immediately sent a responsible disclosure notice and 8Twelve acted fast and professionally by restricting public access within hours of our discovery,” the researchers say.

In an interview 8Twelve Financial president and CIO Akber Abbas said a staffer made a mistake in December when shifting data to an AWS bucket. “This incident happened when one of our report analysts was working on a migration and accidentally left one of the ports open. It was quickly identified through our penetration testing. No data was removed from our server. That person was subsequently let go from the organization. We have solutions now in place to protect us moving forward.”

As for the researchers who found the blunder, Abbas said “we realized it ourselves before they notified us.”

Abbas said the company’s responses included working with security consultants to close any gaps.

Asked if the incident is embarrassing, he replied, “Yeah. You never want to be in this type of position. The reality of the security landscape is things are changing very quickly. We have since [the incident] put in a number of additional controls in the last four weeks above what we do … to be as proactive as we can.”

Abbas didn’t know if his company has notified a regulatory body about the breach of security controls.

The company has two lines of business: 8Twelve Mortgage for mortgage lending, which, the company’s site says, negotiates with 65 lenders to find the best mortgage rates in the North York region of Toronto; and 8T Capital, which offers short-term loans.

This apparent breach of security controls is just the latest in a string of corporate databases found unprotected on the internet. Often these wrongly-configured files are uploaded to cloud storage sites like Amazon AWS, where the creators put them temporarily or intend to do data analysis, and then forget to either password-protect the files or to ensure they aren’t connected to the public internet.

A blog by vendor SecurityTrails notes that some of the most common database blunders involve the use of Elasticsearch, a database for storing and analyzing large amounts of data. Elasticsearch by default binds to localhost only, the article notes, which is secure enough. But, it adds, to make Elasticsearch usable in an organization, database administrators often make the mistake of binding Elasticsearch to the public network interface without firewalling it.

A great tool for finding exposed databases is the Shodan search engine, which finds anything connected to the internet. As a 2017 article on exposed databases in Wired noted, if you want to find all the MongoDB databases connected to the public internet, just type “MongoDB” into Shodan. Not all of the databases found will have sensitive personal information, but some might.

According to Website Planet, the database contained:

717,814 records. The database contained one folder named “applicant” and five folders named “application”;
applicant names, emails, phone number for work, home, and cell. Some records contained physical addresses, state or province. As most of the data could relate to a specific individual, data found in the records could be considered Personally Identifiable Information (PII);
in a random sampling of 10,000 records, the term “email” returned 18,382 results. Each record displayed contained two email addresses; one belonging to the applicant accompanied by a corresponding one from the 8Twelve agent who was assigned the lead. Nearly all common email services appeared in the data, notably Gmail (13,695 results), and Yahoo (3,406), along with Outlook, iCloud, AOL, and smaller numbers of multiple other email providers.
mortgage leads from multiple Canadian provinces were collected in multiple folders marked as “Prod” (which we assume stands for “production”). The records appeared to indicate where the leads came from: Facebook ads, referral, website, etc. Campaign ID numbers were also listed in the applicant files, which we may infer were for the purposes of internal tracking of sales and marketing effectiveness.
applicants’ self-submitted information about their own financial standing, in the form of their credit scores, bankruptcy, savings, finances, and other data to start the loan application process. For credit evaluation purposes, mortgage agents may need to determine an applicant’s creditworthiness by disclosing the aforementioned financial information to an independent credit reporting agency or another source.
records also included 8 Twelve employee names, email addresses, and internal notes about the prospective loan or customer, indicating whether an applicant was credit-worthy or not.
The post Customer database of Canadian mortgage broker left open on internet first appeared on IT World Canada.

On Tuesday, the emergency 911 service was down for two and a half hours in the early morning across the province of Nova Scotia and in some areas of New Brunswick and Prince Edward Island. The disruption affected landlines and some cellphones.

Bell, which operates the affected 911 network, restored the service at 9.30 am AT, saying in a statement to CBC News that the cause of the outage was a 6 am software update to prepare for 10-digit dialing for New Brunswick, “which triggered an unexpected call processing failure to 911.”

Bell stressed that 911 outages are rare, and receive the full attention of their engineering teams, adding that the issue was an “isolated incident.”

 But it is important to remember that the problem is not with the 911 systems, which are “essentially bullet-proof,” said Mark Tauschek, vice president, distinguished analyst and research fellow at Info-Tech Research Group, but rather with Bell’s public switched telephone network (PSTN). More importantly, Tauschek added, it was not likely a software issue, rather a configuration issue.

“We’ve started conflating software updates and configuration updates, which are not the same thing,” Tauschek explained. “Recall the recent 16-hours plus Rogers internet outage in July of 2022 – that was not a “software bug”; it was a configuration change to BGP (Border Gateway Protocol) routing that took the whole network down until they could rectify the issue and route internet traffic back through Rogers’ network.”

The same thing potentially happened with the configuration update to allow for 10-digit calling, whereby the call routing tables probably did not know how to handle a 3-digit call because it had not been routed to a new 10-digit local number, suggested Tauschek.

Bell updating call routing to 10-digit dialing in Eastern Canada is a once in a lifetime configuration update, hence, not something the company will find fruitful to plan for again, said Tauschek. But a post mortem is necessary, and the lessons should be applied to change management processes going forward. He added, “Bell will likely have to do that either way, because the government will be on them like they were on Rogers.”

Bell is seemingly of the same mind, stating that it “adjusted its processes and safeguards to ensure this type of issue will not happen again.” 

That statement, however, did not stop industry minister François-Philippe Champagne from expressing his discontent with the matter in a tweet: “The telecoms outage that affected 911 services in Nova Scotia early this morning is unacceptable. As I have said before, Canadians expect and deserve reliable telecoms connection to access emergency services at all times.”

The minister responsible for the Nova Scotia Emergency Management Office, John Lohr, also called the outage ‘extremely concerning’, adding, “I think it’s clear that could cost somebody their life if they didn’t receive the services they need.” 

Public trust in Canada’s national telcos is also seemingly at a low, as many users took to Twitter to convey their indignation. Some expressed their dissatisfaction with their service and the exorbitant rates, while others pointed out the fact that a similar outage happened for six hours, 15 years ago in the 613 area code when Ontario shifted to 10-digit dialing, yet Bell managed to repeat the same errors.

The post Maritime-wide 911 outage likely a configuration issue similar to the “software bug” that disrupted Rogers internet last summer, says analyst first appeared on IT World Canada.

Samsung yesterday unveiled the latest in its Galaxy flagship phones, a trio known as the Galaxy S23 series, all available for pre-order now, and for purchase in stores on Feb. 17.

Let’s get the painful bit over with first. These are flagship phones, and they are not cheap! The base phone, the Samsung Galaxy S23, starts at C$1,099.99 on the Samsung site. It offers 8 GB of RAM, and 128 GB of storage. The next model up, the S23+, starts at C$1,399.99 with 8GB RAM and 256 GB storage, and the top of the line, the S23 Ultra, starts at C$1,649.99 with 8 GB RAM and 256 GB storage. To sweeten the deal, Samsung is offering double the storage at the same price on pre-orders.

While you still have your smelling salts handy, I must add that the price of the S23 Ultra’s top configuration, 12 GB RAM and 1 TB storage, is shown as C$2,209.99 – but you get Samsung Care+, worth C$229, at no charge.

And speaking of charging – none of the devices comes with a wall charger, just a data cable. The fast charger, should you need one, will set you back around C$25.

Now let’s look at what you get for all that money.

Samsung S23 Series specs

S23
S23+
S23 Ultra

RAM
8GB
8GB
8GB
12GB

Storage options

128GB
256GB
512GB
256GB
512GB
256GB
512GB
1TB

Cameras
12 MP ultra-wide
50 MP wide
10 MP telephoto
12 MP Front
12 MP ultra-wide
50 MP wide
10 MP telephoto
12 MP Front
12 MP ultra-wide
200 MP wide
10 MP telephoto F2.4
10 MP telephoto F4.9
12 MP Front

Display
6.1 inch FHD+
6.6 inch FHD+
6.8 inch QHD+

Dimensions
70.9 x 146.3 x 7.6 mm
76.2 x 157.8 x 7.6 mm
78.1 x 163.4 x 8.9 mm

Weight
168 g
196 g
234 g

Battery
3900mAh
4700mAh
5000mAh

Price starting at

C$1099.99
C$1399.99
C$1649.99

Samsung separated its announcement into discussions of the S23/S23+ and the S23 Ultra. And, as in most recent launches, the focus was on the cameras, particularly those in the Ultra. In this release, the company featured a film shot on the S23 Ultra by Ridley Scott. It also showed off the 200 MP wide angle camera, which blows the socks off previous models. The phone’s night mode (the “Nightography camera”) and Astro Hyperlapse (for astronomy buffs), plus Expert RAW mode, are designed to make photography-centric users happy.

The Ultra also includes a built-in S Pen, continuing the Ultra’s legacy replacing the discontinued Galaxy Note. The company says the writing experience is now virtually latency-free, providing a pen and paper-like experience.

All three S23 models include dynamic AMOLED displays with a 120Hz refresh rate, and include wireless charging. Samsung touts improved gaming performance as well, especially on the S23 Ultra.

Laptops

Credit: Samsung

The final segment of the event was devoted to some new Samsung laptops: The Galaxy Book3 Ultra, Book3 Pro 360, and Book3 360. The Ultra and Pro feature 16 inch screens, and the 360’s display is 13.3 inches.

The 360 and Pro 360 are available for pre-order now and the Ultra can be ordered on Feb. 14. The 360 will be in stores in March, the Pro 360 on Feb. 17, and the Ultra on Feb. 22. Pricing will begin at C$1,499 for the 360, C$2,199 for the Pro 360, and C$2,999 for the Ultra. Each comes in two versions with different amounts of storage.

Graphics, connectivity, and light weight (1.49 kg – 1.79 kg, depending on model) were the featured points during the launch event. Samsung emphasized the power of its ecosystem, in which all of its devices can seamlessly commune to extend displays and processing across devices. Phones, tablets, and laptops connect to allow a phone app to display on a PC, or the PC display be extended to a tablet to provide extra video real estate.

This part isn’t new – Samsung devices have always been able to interoperate – but Samsung has enhanced the laptop’s innards with NVIDIA GeForce RTX graphics processing units (GPUs), as well as with the current generation of Intel processors. The displays have been enhanced as well – the Galaxy Book3 Ultra provides 3K resolution (2880 x 1800) – and, like the phones, a 120Hz refresh rate.

As with the phones, Samsung is offering double storage on most pre-ordered systems, as well as free or discounted Samsung Care+ on most models.

We will be reviewing devices soon and will report on how they live up to their promises. Stay tuned.

The post Samsung unpacks new devices first appeared on IT World Canada.

Following an announcement that Intel Corp.’s executive team will slash their salaries by up to 25 per cent and cut employees’ pay by five per cent as a result of a dire economic slump, the dismal news continued yesterday, with S&P Global Ratings lowering the company’s rating to A from A+.

A statement from the ratings company about the move said the Santa Clara, Calif.-based semiconductor manufacturer reported fourth-quarter earnings last week “well short of our expectations due to continued weak PC demand, inventory corrections across client and server end markets, and company-specific execution issues.

“We expect weak operating results in 2023 across its client computing, data centre and AI, and network and edge business segments, resulting in about US$7 billion to US$8 billion negative free operating cash flow (FOCF) before dividends.”

The company added that it took the rating action for several reasons including:

Continued market share loss to competitor Advanced Micro Devices (AMD), especially in the server end market, which could persist through 2024.
An expectation that the company’s revenue will decline by a percentage in the mid-teens this year, to an estimated US$53 billion.

“The company recently launched its fourth-generation Intel Xeon processor, Sapphire Rapids, in January 2023, which was originally scheduled for a fall 2021 release,” S&P noted. “Product launch delays have allowed AMD to gain significant market share over the past two years, threatening Intel’s long-established dominant market position in the x86 client and server CPU markets.”

In contrast to Intel’s woes, Bloomberg reported yesterday that AMD “gave a better-than-feared sales forecast for the first quarter as gains in the lucrative server market help make up for a collapse in demand for PC chips.

Revenue will be as much as US$5.6 billion in the period, AMD said in a statement Tuesday, in line with an average analyst prediction of US$5.56 billion – with estimates coming in as low as US$5 billion.

In a release, the company said that for full year 2022, it reported revenue of US$23.6 billion, gross margin of 45 per cent, operating income of US$1.3 billion, net income of US$1.3 billion and diluted earnings per share of US$0.84.

“2022 was a strong year for AMD as we delivered best-in-class growth and record revenue despite the weak PC environment in the second half of the year,” said AMD chair and chief executive officer Dr. Lisa Su.

“We accelerated our data centre momentum and closed our strategic acquisition of Xilinx, significantly diversifying our business and strengthening our financial model. Although the demand environment is mixed, we are confident in our ability to gain market share in 2023 and deliver long-term growth based on our differentiated product portfolio.”

Meanwhile, S&P stated that it continues to view Intel’s product roadmap as “aggressive given its track record of technology missteps. Intel remains committed to delivering five process nodes in four years, achieving process performance parity in 2024 and regaining its leadership position.

“Intel’s heavy capital spending, which we estimate will be about US$15 billion to US$17 billion in 2023 and US$19 billion to US$20 billion in 2024, net of government support and various subsidies, will weigh heavily on its profitability over the next several years.”

David T. Tsui, an analyst with S&P, said the company’s strategy involving new nodes “is very important to them. But if there are any delays in node transition then their products will be less competitive compared to their competitors, AMD specifically.

“There’s investment required for them to move along that aggressive node transition curve. And it’s our expectation that free cash flow is going to be negative in 2023 and 2024.”

He noted the company is taking actions, including an announced pledge to cut upwards of US$10 billion in costs annually by 2025, but said “it’s not just about cost cuts – it’s about looking at the whole company, the fixed costs, the CAPEX and hopefully to  a lesser extent R&D to see what is reasonable to optimize, and make sure they have enough funding to execute on their (node) strategy.”

The post A bad day for Intel as rating lowered … but a great day for AMD first appeared on IT World Canada.

Laid off workers flock to Blind app, PagerDuty CEO quotes Martin Luther King when announcing layoffs and OpenAI charges $20 a month for ChatGPT.

That’s all the tech news that’s trending right now. Welcome to Hashtag Trending. It’s Thursday, February 2nd and I am your host, Ashee Pamma

As layoffs continue to blight the tech industry, laid off employees are taking it to social media platforms to share their stories while remaining wary workers look for information to prepare for looming cuts. Blind, an anonymous network has been a cushion for many of those employees. Not Microsoft-owned Linkedin unsurprisingly, although the employment-focused social media network also saw its fair share of ex-employees chronicling their professional journeys and displeasure after being laid off. According to internal data revealed to news company CNN, some 6000 Microsoft employees signed up for accounts on Blind between Jan 13 and January 18, the day the 10,000 layoffs by the tech giants were announced. Employees used the service to speculate about when the layoffs would come, which departments might get hit and comfort those who were concerned. Employees on the platform are verified through their work email address but they remain anonymous, leading to candid conversations about America’s biggest employers. Now, Blind is filled with posts from workers comforting each other about how to get through periods of unemployment.

Source: CNN

In an email to employees announcing layoffs, PagerDuty’s CEO Jennifer Tejada turned to a quote from Martin Luther King Jr.”I am reminded in moments like this, of something Martin Luther King said, that “the ultimate measure of a [leader] is not where [they] stand in the moments of comfort and convenience, but where [they] stand in times of challenge and controversy”. After facing heavy backlash for being “tone deaf” and self-aggrandizing, she has now apologized for using the quote in the layoffs announcement. She admitted that the quote was inappropriate and insensitive and she should have been more upfront and thoughtful. Seven per cent of the company’s headcount was slashed in this announcement.

Source: Business Insider

OpenAI announced that it is starting to sell subscriptions to ChatGPT for $20 a month. ChatGPT will still be available for free to users who don’t subscribe, but paying customers will get priority access, faster response times, and early use of new features. According to experts, ChatGPT is looking to monetize as the AI service is taking a lot of computing power, costing OpenAI $100,000 a day or more to run it, Axios wrote. Monetization of its technology is especially important for the AI firm right now, following its 10 billion investment from Microsoft. OpenAI said in a blog post that the company is actively exploring options for lower-cost plans, business plans, and data packs for more availability.

Source: Axios

In February, the Supreme Court will hear a landmark case on Section 230 of Communications Decency Act. This legal provision protects social platforms from lawsuits over harmful user-generated content while giving them the authority to remove posts at their own discretion. This provision has been key to BigTech’s massive growth and if repealed, social media companies will have to transform their content moderation strategy. However, smaller sites like Reddit and Wikipedia that rely on community moderation will also be hit as moderators simply doing their jobs will also be taking a legal risk every time they moderate a content. Reddit’s lawyers filed an amicus brief claiming that their features like “upvotes” and “downvotes” are protected by Section 230, which Congress crafted to immunize Internet ‘users,’ not just platforms. Wikimedia, the foundation that manages Wikipedia, is also worried that a new interpretation of Section 230 might force volunteer editors to court for how they deal with user-generated content.

Source: MIT Technology Review

Samsung unveiled its sustainability efforts at the 2023 Samsung Unpacked event, saying that their Samsung Galaxy S23 series, were the company’s most sustainable phones yet. The company said the new Samsung Galaxy S23 phones are UL ECOLOGO certified. This certification indicates that a product has a reduced environmental impact based on environmental performance criteria throughout its life cycle, including energy reduction, materials, health, environment, manufacturing, and operations. The Samsung Galaxy S23 Ultra is made up of 12 internal and external components of recycled material, compared to the Galaxy S22 Ultra, which was made of six. These recycled materials include pre-consumer recycled aluminum and glass and post-consumer recycled plastics sourced from discarded fishing nets, PET bottles, and water barrels. The phones also come in 100% recycled packaging certified as sustainably sourced.

Source: ZDNet

That’s all the tech news that’s trending right now. Hashtag Trending is a part of the ITWC Podcast network. Add us to your Alexa Flash briefings or your Google Home daily briefing. Make sure to sign up for our Daily IT Wire newsletter to get all the news that matters directly in your inbox every day. Also, catch the next episode of Hashtag Tendances, our weekly Hashtag Trending episode in French, which drops every Thursday morning. If you have a suggestion or a tip, drop us a line in the comments or via email. Thank you for listening, I’m Ashee Pamma.

The post Hashtag Trending Feb.2- Blind app provides info and support to laid off workers; tech CEO quotes Martin Luther King; ChatGPT for $20 first appeared on IT World Canada.

Yesterday, the Federal Economic Development Agency for Southern Ontario (FedDev Ontario) announced an investment of nearly C$5.4 million in non-profit Invest Ottawa’s Area X.O, a research and development complex responsible for developing and commercializing connected and autonomous vehicles (CAVs), aerial systems, communications infrastructures, defence and cybersecurity technologies and more. 

Invest Ottawa, which celebrated its 10th anniversary yesterday, has been key to providing businesses and innovators in the Ottawa region with the tools and space required to develop their products and services. 

Delivered through the Job and Growth Fund, the investment seeks to expand the capabilities of Area X.O, support 140 companies, create and maintain 745 jobs and accelerate the commercialization of 40 new products and services at the research hub.

Seventy per cent of participating businesses need to be founded, owned or co-led by members of underrepresented groups, including women, racialized Canadians, Black entrepreneurs, Indigenous entrepreneurs, and members of the 2SLGBTQI+ community, Invest Ottawa said yesterday, to advance DEI (Diversity, Equity and Inclusion).

“The work being done at Area X.O will be felt across Ottawa and Canada, as innovators and entrepreneurs aim to bring their solutions to Canadians, create jobs and contribute to our thriving tech industry,” said the Honourable Filomena Tassi, Minister responsible for FedDev Ontario.

Invest Ottawa will add the following capabilities at Area X.O through this investment:

Remote simulation to allow entrepreneurs to remotely conduct tests and demonstrations.
New programming to support companies developing services for essential sectors like defence, emergency management, public safety, security, and disaster preparedness.
Support the creation of the first advanced robotic and unmanned aerial systems testbed of its kind in Canada.
Enable increased access to foreign direct investment, particularly in the development of smart mobility, autonomy, and connectivity technologies.
Improve market access by creating collaboration opportunities across Ontario and internationally.

The announcement builds on a previous C$7 million investment from FedDev Ontario that was instrumental in the creation of Area X.O and support of 35 small-to medium enterprises (SMEs) and creation of 350 jobs in 2020.

FedDev Ontario said in its release that, since 2015, the government of Canada, through FedDev Ontario, has invested over C$210 million in more than 200 projects in the Ottawa region, estimated to create nearly 8,000 jobs and maintain over 7,000 jobs.

The post Government of Canada invests $5.4 million in Ottawa R&D complex first appeared on IT World Canada.

Infosec leaders are still behind in cybersecurity basics, leaving their organizations unnecessarily open to attacks, says the vice-president of Microsoft Security.

Cyber attacks aren’t successful because they are getting more sophisticated, Kelly Bissell told the siberX CISO Forum Canada on Tuesday.

“Ninety-eight per cent of attacks are elementary,” he said, and take advantage of unpatched devices, a lack of multifactor authentication to protect logins, no privileged access controls, no identity management, and password vulnerabilities.

“Those things are happening every day. I think why we’re getting more [successful] attacks is because this is one of the industries where crime actually pays.”

Seventy-eight per cent of computing devices have an unpatched vulnerability that’s at least nine months old, he added. “We’re not patching our systems. We’re taking the approach, ‘I’ll patch these systems if I can.’ But what you’d better do is patch now, even at the risk of breaking an application.

“We have to re-think our DevSecOps function to be far more resilient in the patching of our environments.”

The good news is law enforcement agencies around the world are having some success against attackers, he added. He urged CISOs to work with police agencies if their IT environments are compromised.

There are a number of things CISOs should do to stiffen their security, he said, including

— move away from best-of-breed solutions to a platform;

— get intelligence feeds;

— move workloads to the cloud;

— invest in artificial intelligence solutions to speed analysis and response;

— make sure data is well protected;

— “be brilliant at the basics,” particularly having a well-designed Active Directory protection structure;

— get privileged access under control to prevent lateral movement;

— and optimize and simplify your IT architecture.

On this last point, Bissell offered proof:

“I was part of an organization a while back that had a ransomware attack on our AD domain. By the way, we had 90 domains. Thank goodness we had the right architecture. The ransomware was contained to one domain structure. If we didn’t have the right design, it would have spread to all domains. It would have been devastating. So the architecture of your security environment matters.”

The post Cyber attacks work because CISOs don’t do basic security: Microsoft first appeared on IT World Canada.

A significant number of employees are still falling for phishing scams, according to the results of a global test by a Canadian-based firm.

Seven percent of all end users who participated in the 2022 Gone Phishing Tournament run by Quebec’s Terranova Security clicked on the link in the phishing email. Three per cent of them — 44 per cent of clickers — failed to recognize the warning signs on the simulation’s webpage and proceeded to enter their credentials on the malicious site.

“To put these numbers into perspective,” said company chief information security officer (CISO) Theo Zafirakos, “if an enterprise-level organization of 10,000 employees had been targeted with a phishing scam like the one depicted in the simulation, 700 employees would have clicked on the phishing link and over 300 of those clickers would have entered their password, which can be used to compromise systems and sensitive information. Given our reliance on online systems and data to conduct many business transactions and services, this reality is concerning.”

Terranova Security is part of Fortra LLC of Minneapolis. The simulation, which was done in October, was co-sponsored by Microsoft. The annual test, which has a different format every year, saw over 250 organizations in several countries agree to have their employees sent phishing emails. A total of 1.2 million messages were sent in 21 languages.

The report, with full results of the test, is available here. Registration is required.

Though the 2022 Gone Phishing Tournament simulation was deemed easier than in previous years, Terranova said in a news release, the click rate and web form submission rate should still be considered high as a result.

The three per cent failure rate was a significant improvement when compared against results from 2021 and 2020, where 14.4 per cent and 13.4 per cent of end users, respectively, would’ve completed an action that compromised sensitive information in the simulation.

“These findings underscore why building an engaging security awareness training program
that leverages hands-on, practical exercises like phishing simulations is essential,” says the report. “Technical infrastructure like firewalls, endpoint security, and even phishing report buttons in a corporate email client can’t guarantee information security.”

Microsoft supplied this year’s email and webpage templates, designed to imitate a real-world scenario that many employees experience: a gift card scam. The scenario, selected by the Terranova Security leadership team, measured several end-user behaviors, such as clicking on a link in the body of a phishing email and entering credentials into a form on a phishing webpage.

If users clicked on the link in the phishing simulation’s email, they were redirected to a landing page, which prompted them to enter credentials that, had the simulation been an actual attack, would have been compromised. If users completed this second step, they were brought to a phishing simulation feedback page highlighting the warning signs they missed and the best practices they should follow.

The post Gift card lure was alluring to many in phishing test first appeared on IT World Canada.

Microsoft tracks 100 gangs using ransomware, Google Fi customer data is copied and more.

Welcome to Cyber Security Today. It’s Wednesday, February 1st, 2023. I’m Howard Solomon, contributing reporter on cybersecurity for ITWorldCanada.com and TechNewsDay.com in the U.S.

There are more than 100 threat actors deploying over 50 families of ransomware, according to Microsoft. In a series of tweets this week it said attackers continue to use phishing and unpatched applications for initial access. However, the use of malvertising as well as fake application and browser updates for initial compromise is increasing.

Google Fi, which is Google’s cellular network provider, has confirmed it has suffered a data breach. According to TechCrunch, Google said the unnamed primary network provider for the service acknowledged customer data — including phone numbers and SIM card serial numbers — were copied. No payment card data or passwords were taken. However, the news story said at least one Google Fi customer claimed in a Reddit post that their phone number was hijacked for two hours. That was enough time for the attacker to use the phone to send and receive text messages.

Cyber crooks continue trying to leverage the document-signing service called DocuSign to steal employees’ login credentials. According to researchers at Armorblox, one of the latest phishing campaigns has a subject line saying, “Please DocuSign: Approve document 2023-01-11.” One tip this is a scam: While the message appears to come from DocuSign, the full email address of the sender shows it didn’t. It’s another example of why IT has to show employees how to turn on the ability to display the full sender’s email address for all messages. The targets of this particular campaign are companies that use the Proofpoint email protection service. Victims who click on the attached document are asked to sign in using their Proofpoint credentials to read the supposed document. Organizations that use Proofpoint have to warn employees to beware of this scam.

YouTube content creators need to toughen their security to avoid their sites being taken over by cryptocurrency scammers. That’s the word from researchers at Guardio Labs. Hacking YouTube channels in what’s called StreamJacking isn’t new. What’s going on now is that it’s being used to spread cryptocurrency scams once the YouTube channel is taken over. Often these messages pretend to be from entrepreneur Elon Musk offering giveaways: Victims are promised a two-for-one swap of any cryptocurrency they send in. What really happens is the crook just takes the digital coins. Meanwhile, the owner of the hijacked YouTube channel can’t get control back. This happens because the owner is tricked into giving away their login credentials, often by falling for email messages promising hacked software or modifications to video games. If you fall for an offer to cheat, don’t complain when you get hacked.

Maintainers of open-source repositories like PyPI, GitHub and others are reminded that some threat actors are determined to drop poisoned packages of code on their platforms. Researchers at Checkmarx this week detailed how one group used several tactics over four months to deposit code that steals credentials, bitcoin wallets and more from victims. These are developers who downloaded the packages and put them in their applications. Open code repositories have to beef up their security, while developers need to be more cautious in downloading packages.

There’s no shortage of reports about hospitals being hit with cyber attacks. Here’s more evidence: Kroll, a cyber risk evaluation provider, says that of its customers healthcare firms were the most breached sector last year. They overtook financial institutions as the most hacked industry. Also during 2022, breaches at industrial services doubled.

Finally, with Super Bowl Sunday less than two weeks away a reminder that crooks will push email and text scams. Officials at BullWall remind sports teams and companies to use email authentication procedures to make sure their brand and domains aren’t spoofed. Fans should be careful with pitches for tickets, T-shirts and other trinkets that appear too good to be true.

Follow Cyber Security Today on Apple Podcasts, Google Podcasts or add us to your Flash Briefing on your smart speaker.

The post Cyber Security Today, Feb. 1, 2023 – Microsoft tracks 100 gangs using ransomware, Google Fi customer data is copied and more first appeared on IT World Canada.