Security certification body (ISC)Â — the International Information System Security Certification Consortium — "is a non-profit organization providing training and certification for cybersecurity professionals," writes PortSwigger "Daily Swig" blog for cybersecurity news. "Over the last two years, it has been carrying out a review of its practices around committees, nominations, and governance."

But some of the proposed bylaw amendments (announced earlier this month) drew criticism: According to Wim Remes, a former board member who spent three years as (ISC)Â chair, the organization currently has a poor record on member engagement, with election turnout averaging only around 4%. As things stand, 500 endorsements are required for members to raise a petition. However, the new proposals would see this figure raised to 1% of the 170,000-odd members. "This effectively shuts down an important relief valve in corporate governance, in my opinion, and is not in the interest of the membership," Remes told The Daily Swig. "It's already impossible to get up to 500. It's unthinkable anybody would make it to 1,600, [or] to 2,000."

Also in the pipeline is a significant change to the process for electing the board of directors. If approved, this would remove the option for a write-in candidate and witness the board submitting a slate of qualified candidates to the membership that would be equal to the number of open seats. "Combined with making the petition process harder — if not impossible — this is as close to a coup by governance as one could get," Remes argued. "They still call it an election, but it is officially a coronation."

Meanwhile, the Ethics Committee is to be eliminated as a standing committee of the board.
Clar Rosso, CEO of (ISC)2, tells the site that the bylaw changes will be voted on by members, and will move the ethics process "from one that is majority board-run to a process that is adjudicated by a broader cross-section of members."

"Additionally, many of these bylaw changes are reflective of best practices of other similarly-sized associations, and some simply provide clarity and ensure legal compliance with applicable state and federal laws. The (ISC)Â board of directors, comprised entirely of member volunteers, supports the proposed changes."

Long-time Slashdot reader mencik shares a page offering nine alternate proposals to increase transparency — along with a petition for including them on the agenda of the group's next annual meeting. (Reminder: only ISC2 members can vote.)

Slashdot reader storagedude writes: Ransomware groups have been busy improving their data exfiltration tools, and with good reason: As ransomware decryption fails to work most of the time, victims are more likely to pay a ransom to keep their stolen data from being publicly leaked.

But some security researchers think the trend suggests that ransomware groups may change their tactics entirely and abandon ransomware in favor of a combined approach of data destruction and exfiltration, stealing the data before destroying it and any backups, thus leaving the stolen copy of the data as the only hope for victims to recover their data. After all, if ransomware just destroys data anyway, why waste resources developing it?

"With data exfiltration now the norm among threat actors, developing stable, secure, and fast ransomware to encrypt files is a redundant and costly endeavor compared to corrupting files and using the exfiltrated copies as the means of data recovery," Cyderes researchers wrote after analyzing an attack last month.

"Eliminating the step of encrypting the data makes the process faster and eliminates the risk of not getting the full payout, or that the victim will find other ways to decrypt the data," they added. "Data destruction is rumored to be where ransomware is going to go, but we haven't actually seen it in the wild. During a recent incident response, however, Cyderes and Stairwell discovered signs that threat actors are actively in the process of staging and developing this capability."

That incident – involving BlackCat/ALPHV ransomware – turned up an exfiltration tool with hardcoded sftp credentials that was analyzed by Stairwell's Threat Research Team, which found partially-implemented data destruction functionality.

"The use of data destruction by affiliate-level actors in lieu of RaaS deployment would mark a large shift in the data extortion landscape and would signal the balkanization of financially-motivated intrusion actors currently working under the banners of RaaS affiliate programs," the Stairwell researchers wrote.

An anonymous reader quotes a report from Phys.Org: Bumble bees play, according to new research led by Queen Mary University of London published in Animal Behavior. It is the first time that object play behavior has been shown in an insect, adding to mounting evidence that bees may experience positive "feelings." The team of researchers set up numerous experiments to test their hypothesis, which showed that bumble bees went out of their way to roll wooden balls repeatedly despite there being no apparent incentive for doing so. The study also found that younger bees rolled more balls than older bees, mirroring human behavior of young children and other juvenile mammals and birds being the most playful, and that male bees rolled them for longer than their female counterparts.

The study followed 45 bumble bees in an arena and gave them the options of walking through an unobstructed path to reach a feeding area or deviating from this path into the areas with wooden balls. Individual bees rolled balls between 1 and, impressively, 117 times over the experiment. The repeated behavior suggested that ball-rolling was rewarding. This was supported by a further experiment where another 42 bees were given access to two colored chambers, one always containing movable balls and one without any objects. When tested and given a choice between the two chambers, neither containing balls, bees showed a preference for the color of the chamber previously associated with the wooden balls. The set-up of the experiments removed any notion that the bees were moving the balls for any greater purpose other than play. Rolling balls did not contribute to survival strategies, such as gaining food, clearing clutter, or mating and was done under stress-free conditions. [...] The new research showed the bees rolling balls repeatedly without being trained and without receiving any food for doing so -- it was voluntary and spontaneous -- therefore akin to play behavior as seen in other animals. Study first-author, Samadi Galpayage, Ph.D. student at Queen Mary University of London says that "it is certainly mind-blowing, at times amusing, to watch bumble bees show something like play. They approach and manipulate these 'toys' again and again. It goes to show, once more, that despite their little size and tiny brains, they are more than small robotic beings."

"They may actually experience some kind of positive emotional states, even if rudimentary, like other larger fluffy, or not so fluffy, animals do. This sort of finding has implications to our understanding of sentience and welfare of insects and will, hopefully, encourage us to respect and protect life on Earth ever more."

A Redditor says they've managed to get a hold of an old Netflix server for free, and has posted a detailed online look at the once mysterious hardware. The devices were part of Netflix's Open Connect Content Delivery Network (CDN), and can often be found embedded within major ISP networks to ensure your Netflix streams don't suck. From a report: Reddit user PoisonWaffle3 said the ISP he currently works for has been offloading old Netflix servers as they upgrade to more modern equipment. In a Reddit thread titled "So I got a Netflix cache server..." he posted a photo of the server, which is bright Netflix red, and explained how he was curious about what's inside the boxes given how little public information was available.

"All I could find online was overviews, installation/config guides for their proprietary software, etc.," he said. "No specs, no clue what was inside the red box." Dave Temkin, Netflix's former Vice President of Network Systems Infrastructure told Motherboard there's nothing too mysterious about what the servers can do, though they significantly help improve video streaming by shortening overall content transit time. "They're just an Intel FreeBSD box," he said. "We got Linux running on some of the generations of that box as well."

Netflix's Open Connect Content Delivery Network hardware caches popular Netflix content to reduce overall strain across broadband networks. Netflix lets major broadband ISPs embed a CDN server on the ISP network for free; the shorter transit time then helps improve video delivery, of benefit to broadband providers and Netflix alike. It took all of three screws for PoisonWaffle3 to get inside the mysterious red unit, at which point users discovered a "fairly standard" Supermicro board, a single Xeon E5 2650L v2 processor, 64GB of DDR3 memory, and a 10 gigabit ethernet card. They also found 36 7.2TB 7200RPM drives and six 500GB Micron solid state drives, for a grand total of 262 terabytes of storage.

An anonymous reader quotes a report from ZDNet: Everyone depends on OpenSSL. You may not know it, but OpenSSL is what makes it possible to use secure Transport Layer Security (TLS) on Linux, Unix, Windows, and many other operating systems. It's also what is used to lock down pretty much every secure communications and networking application and device out there. So we should all be concerned that Mark Cox, a Red Hat Distinguished Software Engineer and the Apache Software Foundation (ASF)'s VP of Security, this week tweeted, "OpenSSL 3.0.7 update to fix Critical CVE out next Tuesday 1300-1700UTC." How bad is "Critical"? According to OpenSSL, an issue of critical severity affects common configurations and is also likely exploitable. It's likely to be abused to disclose server memory contents, and potentially reveal user details, and could be easily exploited remotely to compromise server private keys or execute code execute remotely. In other words, pretty much everything you don't want happening on your production systems.

The last time OpenSSL had a kick in its security teeth like this one was in 2016. That vulnerability could be used to crash and take over systems. Even years after it arrived, security company Check Point estimated it affected over 42% of organizations. This one could be worse. We can only hope it's not as bad as that all-time champion of OpenSSL's security holes, 2014's HeartBleed. [...] There is another little silver lining in this dark cloud. This new hole only affects OpenSSL versions 3.0.0 through 3.0.6. So, older operating systems and devices are likely to avoid these problems. For example, Red Hat Enterprise Linux (RHEL) 8.x and earlier and Ubuntu 20.04 won't be smacked by it. RHEL 9.x and Ubuntu 22.04, however, are a different story. They do use OpenSSL 3.x. [...] But, if you're using anything with OpenSSL 3.x in -- anything -- get ready to patch on Tuesday. This is likely to be a bad security hole, and exploits will soon follow. You'll want to make your systems safe as soon as possible.

From Tokyo to San Francisco, mobile game studios have sparred for years to captivate a fickle audience, fostering an overlooked problem -- the average title has become so huge that players can no longer fit more than a few on their phones. From a report: Japanese games publisher Gree expects an impending reckoning over escalating costs and ballooning file sizes, as developers pack their games with increasingly intricate graphics, voice acting and larger storylines, all to get players spending. That's creating a winner-takes-all situation that could winnow out smaller studios in coming years, Gree Senior Vice President Yuta Maeda said in an interview. The situation will only get worse as console veteran Sony -- no stranger to space-hogging hits -- prepares to invade the mobile arena. "Production of mobile games can't avoid becoming more complex, time-consuming and larger-scale, which will inevitably result in bigger app sizes," Maeda said. "Companies that survive in the market will only be the ones that can keep up with that trend."

The spending poured into today's A-list mobile titles -- MiHoYo's Genshin Impact, for instance, started with a $100 million budget -- rivals Hollywood blockbusters and is yielding better production values than ever, but also an outsized footprint. That game can occupy upwards of 20 gigabytes of storage, which is a huge chunk of what most people have available on their phones. With memory upgrades not keeping pace, the result is fewer games can vie for attention. Sony, one of the giants of console gaming, has laid out plans to bring its high-profile PlayStation franchises to mobile platforms. Rival Microsoft is also building an Xbox mobile gaming store. All of that piles pressure on the entrenched free-to-play business model followed by Gree and others. These publishers rely on monetizing in-game items and upgrades, regularly adding more content players can buy and play with. The most common workaround from game studios is to put only a basic installer in app stores, which then downloads further game assets once the player starts. Gree uses it with Heaven Burns Red, which is an initial 1GB and grows beyond 10GB for players who want the full experience.

Do you have a laptop that's either "pretty old" or "weird in some other way"? Did it ship without Windows from the factory, or did you flash its firmware with coreboot? You could help the Linux kernel move its backlight code forward without abandoning quirky gear like yours. ArsTechnica: Hans de Goede, a longtime Linux developer and principal engineer at Red Hat, writes on his Livejournal about the need to test "a special group of laptops" to prevent their backlight controls from disappearing in Linux kernel 6.1. Old laptop tests are needed because de Goede is initiating some major changes to user-space backlight controls, something he has been working on since 2014. As detailed at Linux blog Phoronix, there are multiple issues with how Linux tries to address the wide variety of backlight schemes in displays, which de Goede laid out at the recent Linux Plumbers Conference. There can be multiple backlight devices operating a single display, leaving high-level controls to "guess which one will work." Brightness control requires root permissions at the moment. And "0" passed along as a backlight value remains a conundrum, as the engineer pointed out in 2014: Is that entirely off, or as low as the display can be lit?

Thomson Reuters, a multinational media conglomerate, left an open database with sensitive customer and corporate data, including third-party server passwords in plaintext format. Attackers could use the details for a supply-chain attack. Cybernews: The Cybernews research team found that Thomson Reuters left at least three of its databases accessible for anyone to look at. One of the open instances, the 3TB public-facing ElasticSearch database, contains a trove of sensitive, up-to-date information from across the company's platforms. The company recognized the issue and fixed it immediately. Thomson Reuters provides customers with products such as the business-to-business media tool Reuters Connect, legal research service and database Westlaw, the tax automation system ONESOURCE, online research suite of editorial and source materials Checkpoint, and other tools. The size of the open database the team discovered corresponds with the company using ElasticSearch, a data storage favored by enterprises dealing with extensive, constantly updated volumes of data.

An anonymous reader quotes a report from ZDNet: Low-code and no-code development is often seen as the realm of citizen developers, but the segment of the enterprise where low-code and no-code has gained significant traction is among professional developers themselves. And, importantly, it's making their jobs better in two ways: providing tools for faster software development and deployment, as well as elevating their roles in enterprises to that of teachers and facilitators for potential citizen developers.

A recent survey of 860 developers by OutSystems finds a majority of low-code users -- most of whom also use traditional coding languages alongside low-code -- report that they are "very satisfied" with their team productivity (59%), compared to 41% of traditional developers. Most low-coders, 57%, are also very satisfied with the quality of tools at their disposal to complete their work, compared to 36% of their traditional coding counterparts. In addition, 71% of low-code users said they were able to stick to the typical 40-hour work week, compared to only 44% of traditional developers. Additionally, 63% of low-code developers indicate they are happy with their salary and benefits compared to 40% of traditional developers.

Not only is low-code and no-code making things easier, it is also elevating the roles of technology professionals within their enterprises, to facilitator, educators, and consultants. Industry observers agree. "The professional's role is now to customize and connect the low-code solution to the organization's resources," relates Moses Guttmann, CEO and co-founder of ClearML. Their roles "shift towards mainly automation and orchestration, taking a low-code process and helping the low-code infrastructure gain access to different resources within the organization. Think of it as abstracting the databases and providing access to the orchestration -- such as cloud infrastructure to execute the low-code application." This can only mean more Agile development for the next generation of applications, with business-savvy developers and tech-savvy business users working side by side. "Citizen developers are typically growth-minded, innovative problem solvers with an active understanding of the business' overarching goals," says Aaron White, CTO and co-founder of Vendr. "In tandem with overseeing the work completed in a low-code or no-code environment, professional developers -- especially those leading teams -- should strive to recognize these employees' talents, actively enabling them to contribute to the development process." "It takes away a lot of the day-to-day implementation-related tasks and allows developers to focus on more architectural and strategic concerns," says Om Vyas, co-founder and chief product officer for oak9. "It puts them in a position to have a greater business impact. But also, with low-code and no-code approaches, when the one-size-fits-all pattern does not work for you, it will create work for these professionals to amend or customize to add their own implementations."

In many cases, "a low-code/no-code approach may operate as a complete solution. That said, IT and engineering may need to step in from time to time, to fine-tune the details," White adds.

Lennart Poettering's latest blog post proposes moving the Linux boot process into a "Brave New Trusted Boot World" of cryptographically signed Unified Kernel Images. From a report: Agent Poettering offers a mechanism for tightening up the security of the system startup process on Linux machines, using TPM 2.0 hardware. In brief, what he sees as the problem is that on hardware with Secure Boot enabled, while the boot process up to and including the kernel is signed, the next step, loading the initrd, is not. That's what he wants to fix.

Apple has given its most direct confirmation yet that a USB-C-equipped iPhone will happen, now that the European Union is mandating that all phones sold in its member countries use the connector if they have a physical charger. From a report: When asked by The Wall Street Journal if the company would replace Lightning, Apple's senior vp of worldwide marketing, Greg Joswiak, answered by saying: "Obviously, we'll have to comply; we have no choice."

WSJ brought the law up during a talk with Joswiak and software VP Craig Federighi at the WSJ's Tech Live conference and followed up by asking when we can expect to see USB-C on an iPhone. Joswiak replied, "the Europeans are the ones dictating timing for European customers." Currently, the law dictates that "all mobile phones and tablets" will have to use USB-C by "autumn 2024." Joswiak refused to answer whether the company would include the connector on phones sold outside the EU. But he made it abundantly clear that Apple isn't happy about being legally coerced into making the switch. Before acknowledging that the company must comply with the law, Joswiak went into a long explanation about how Apple has historically preferred to go its own way and trust its engineers rather than be forced into adopting hardware standards by lawmakers.

An anonymous reader quotes a report from Reuters: Australia's biggest health insurer, said on Wednesday a cyber hack had compromised the data of all of its of its nearly 4 million customers, as it warned of a $16 million to $22.3 million hit to first-half earnings. It said on Wednesday that all personal and significant amounts of health claims data of all its customers were compromised in the breach reported this month, a day after it warned the number of customers affected would grow.

Medibank, which covers one-sixth of Australians, said the estimated cost did not include further potential remediation or regulatory expenses. The company reiterated that its IT systems had not been encrypted by ransomware to date and that it would continue to monitor for any further suspicious activity. "Everywhere we have identified a breach, it is now closed," John Goodall, Medibank's top technology executive, told an analyst call on Wednesday. "Our investigation has now established that this criminal has accessed all our private health insurance customers' personal data and significant amounts of their health claims data," chief executive David Koczkar said in a statement. "I apologize unreservedly to our customers. This is a terrible crime -- this is a crime designed to cause maximum harm to the most vulnerable members of our community."

An anonymous reader shares a report: Nvidia's $1,599 GeForce RTX 4090 is an incredibly powerful graphics card, but its performance comes at the cost of high power draw. Like a few of the RTX 3000-series cards, Nvidia uses a new kind of 16-pin 12VHPWR power connector to supply all that power to the card -- you can plug up to four 8-pin GPU power cables into the 12VHPWR adapter, which then plugs into the connector on the GPU, saving some board space.

But at least two RT 4090 users are now reporting that their 12VHPWR connectors have overheated and melted during use. These complaints are sourced from Reddit (via Tom's Hardware), so take them with a grain of salt -- we don't know the exact configuration of either user's PC setup. The specific model of graphics card (a Gigabyte RTX 4090 Gaming OC for one user, an Asus RTX 4090 TUF Gaming OC Edition for the other), the power supply, and any number of other factors could have contributed to the connectors overheating.

An anonymous reader quotes a report from Ars Technica: Generically, passkeys refer to various schemes for storing authenticating information in hardware, a concept that has existed for more than a decade. What's different now is that Microsoft, Apple, Google, and a consortium of other companies have unified around a single passkey standard shepherded by the FIDO Alliance. Not only are passkeys easier for most people to use than passwords; they are also completely resistant to credential phishing, credential stuffing, and similar account takeover attacks.

On Monday, PayPal said US-based users would soon have the option of logging in using FIDO-based passkeys, joining Kayak, eBay, Best Buy, CardPointers, and WordPress as online services that will offer the password alternative. In recent months, Microsoft, Apple, and Google have all updated their operating systems and apps to enable passkeys. Passkey support is still spotty. Passkeys stored on iOS or macOS will work on Windows, for instance, but the reverse isn't yet available. In the coming months, all of that should be ironed out, though.

Passkeys work almost identically to the FIDO authenticators that allow us to use our phones, laptops, computers, and Yubico or Feitian security keys for multi-factor authentication. Just like the FIDO authenticators stored on these MFA devices, passkeys are invisible and integrate with Face ID, Windows Hello, or other biometric readers offered by device makers. There's no way to retrieve the cryptographic secrets stored in the authenticators short of physically dismantling the device or subjecting it to a jailbreak or rooting attack. Even if an adversary was able to extract the cryptographic secret, they still would have to supply the fingerprint, facial scan, or -- in the absence of biometric capabilities -- the PIN that's associated with the token. What's more, hardware tokens use FIDO's Cross-Device Authentication flow, or CTAP, which relies on Bluetooth Low Energy to verify the authenticating device is in close physical proximity to the device trying to log in. "Users no longer need to enroll each device for each service, which has long been the case for FIDO (and for any public key cryptography)," said Andrew Shikiar, FIDO's executive director and chief marketing officer. "By enabling the private key to be securely synced across an OS cloud, the user needs to only enroll once for a service, and then is essentially pre-enrolled for that service on all of their other devices. This brings better usability for the end-user and -- very significantly -- allows the service provider to start retiring passwords as a means of account recovery and re-enrollment."

In other words: "Passkeys just trade WebAuthn cryptographic keys with the website directly," says Ars Review Editor Ron Amadeo. "There's no need for a human to tell a password manager to generate, store, and recall a secret -- that will all happen automatically, with way better secrets than what the old text box supported, and with uniqueness enforced."

If you're eager to give passkeys a try, you can use this demo site created by security company Hanko.

An anonymous reader quotes a report from Reuters: The Republican National Committee (RNC) filed a lawsuit against Alphabet's Google on Friday for allegedly sending its emails to users' spam folders. The U.S. political committee accuses the tech giant of "discriminating" against it by "throttling its email messages because of the RNC's political affiliation and views," according to a lawsuit filed in U.S. District Court in California. "Google has relegated millions of RNC emails en masse to potential donors' and supporters' spam folders during pivotal points in election fundraising and community building," the RNC said in the lawsuit. Google rejected the claims.

Spam filters on email services typically weed out unsolicited "spam" messages and divert them to a separate folder. The RNC said that for most of the month, nearly all of its emails end up in users' inboxes but at the end of the month, which is an important time for fund-raising, nearly all of their emails end up in spam folders. "Critically, and suspiciously, this end of the month period is historically when the RNC's fundraising is most successful," the lawsuit said, adding that it does not matter whether the email is about donating, voting or community outreach. The committee said the "discrimination" had been going on for about 10 months despite its best efforts to work with Google. It said the alleged routing of its emails to spam folders had eaten up revenue and that more money would be lost in coming weeks as midterm elections loom. "As we have repeatedly said, we simply don't filter emails based on political affiliation. Gmail's spam filters reflect users' actions," Google spokesperson Jose Castaneda said in a statement. "We provide training and guidelines to campaigns, we recently launched an FEC-approved pilot for political senders, and we continue to work to maximize email deliverability while minimizing unwanted spam," he said, referring to the Federal Election Commission.

Further reading: US Approves Google Plan To Let Political Emails Bypass Gmail Spam Filter

PayPal has announced today that passkeys are being added as a new, password-less login method to secure PayPal accounts for iPhone, iPad, and Mac users on PayPal.com, with plans to expand passkeys to other platforms as they add support. From a report: PayPal passkeys are rolling out to US customers today and will be available to "additional countries" in early 2023. Passkeys are a new type of login credential that replaces passwords with cryptographic key pairs. They are resistant to phishing attempts and are designed to avoid sharing passkey data between platforms, addressing the weakness of current password-based authentication.

Passkeys are supported by Apple, Google, and Microsoft, who have pledged to bring the FIDO Alliance standard to their respective OSes. Reusing passwords across online accounts leaves users open to hacking and other vulnerabilities, but remembering individual login details is no easy task without a secure password manager. A study from Verizon shows that over 2.6 billion records were hacked in 2017, with 81 percent estimated to have been caused by password stealing and guessing.

The Federal Trade Commission plans to take the rare step of bringing individual sanctions against the CEO of alcohol delivery company Drizly for data privacy abuses, following allegations that the company's security failures under his watch exposed the personal information of about 2.5 million customers. From a report: The proposed order will follow Drizly CEO James Cory Rellas to future businesses, requiring him to implement a security program at any companies he runs that collect information from more than 25,000 people. The order will also apply to the company itself, which is now a subsidiary of the ride-hailing service Uber. Under the terms of the FTC action, Rellas and Drizly will have to destroy unnecessary data, implement new data controls and train employees about cybersecurity.

In singling out Rellas, the FTC signaled it could use a wider range of tools to address data privacy abuses under the leadership of chair Lina Khan, who was widely expected to bring tougher oversight of the tech industry. The inclusion of Rellas follows a push from Democrats to more aggressively penalize individual executives involved in major data privacy breaches. Democrats on the commission previously criticized the agency's record-setting settlement with Facebook over the Cambridge Analytica data scandal because it did not name Facebook CEO Mark Zuckerberg.

Earlier this year, Microsoft announced that it would be releasing new hardware to encourage more developers to start using and supporting the Arm version of Windows. Dubbed "Project Volterra," all we knew about it at the time was that it would use an unnamed Qualcomm Snapdragon processor and NVMe-based storage, that it would support at least two monitors, and that it would have a decent number of ports. Today, Microsoft is putting Volterra out into the world, complete with a snappy new name: the Windows Dev Kit 2023. From a report: The Dev Kit 2023 will use a Snapdragon 8cx Gen 3 -- essentially the same chip as the Microsoft SQ3 in the new 5G version of the Surface Pro 9 -- plus 512GB of storage and a whopping 32GB of RAM for the surprisingly low price of $599.

We don't know exactly how fast the 8cx Gen 3 will be (Qualcomm says "up to 85 percent faster" CPU performance than the 8cx Gen 2, which would put it somewhere below but within spitting distance of modern Core i5 laptop CPU). But 512GB of storage and 32GB of memory should make the Dev Kit 2023 useful as a development and testing environment. Microsoft says the box can connect to up to three monitors simultaneously using its two USB-C ports and mini DisplayPort and that up to two of those displays can be 4K screens running at 60 Hz. Three USB-A ports, gigabit Ethernet, Wi-Fi 6, and Bluetooth 5.1 round out the connectivity options.

Bruce66423 writes: Britain's data watchdog has fined the construction group Interserve $4.9m after a cyber-attack that enabled hackers to steal the personal and financial information of up to 113,000 employees. The attack occurred when Interserve ran an outsourcing business and was designated a "strategic supplier to the government with clients including the Ministry of Defence." Bank account details, national insurance numbers, ethnic origin, sexual orientation and religion were among the personal information compromised. The Information Commissioner's Office (ICO) said Interserve Group broke data protection law because the company failed to put appropriate measures in place to prevent the cyber-attack, which happened two years ago. Interserve's system failed to stop a phishing email that an employee downloaded, while a subsequent anti-virus alert was not properly investigated.

The attack led to 283 systems and 16 accounts being compromised, uninstalled Interserve's anti-virus system and encrypted all current and former employees' information. The ICO said Interserve used outdated software systems and protocols, had a lack of adequate staff training and insufficient risk assessments. "This data breach had the potential to cause real harm to Interserve's staff, as it left them vulnerable to the possibility of identity theft and financial fraud," said John Edwards, the UK information commissioner. "Leaving the door open to cyber-attackers is never acceptable, especially when dealing with people's most sensitive information. The biggest cyber-risk businesses face is not from hackers outside of their company but from complacency within their company."

Gartner, the prestigious tech research and consulting firm, has released its annual predictions for "strategic tech trends" in the coming year.

Forbes offers a summary. Some highlights: Digital Immune Systems. [A]ntiquated development and testing approaches are no longer sufficient for delivering robust and resilient business-critical solutions that also provide a superior user experience. A Digital Immune System combines several software engineering strategies such as observability, automation, and extreme testing to enhance the customer experience by protecting against operational and security risks. By 2025, Gartner predicts that organizations that invest in building digital immunity will increase end-user satisfaction through applications that achieve greater uptime and deliver a stronger user experience.

Applied Observability. The path to data-driven decision making includes a shift from monitoring and reacting to data to proactively applying that data in an orchestrated and integrated way across the enterprise. Doing so can shorten the time it takes to reach critical decisions while also facilitating faster, more accurate planning. Gartner notes observable data as an organization's "most precious monetizable asset" and encourages leaders to seek use cases and business capabilities in which this data can deliver competitive advantage.
"By 2025, Gartner predicts that 50% of CIOs will have performance metrics tied to the sustainability of the IT organization," Forbes writes. But they also note that Gartner is predicting platform engineering — "a curated set of reusable self-service tools, capabilities, and processes" to speed up and optimize development. "Gartner predicts that by 2026, 80% of software engineering organizations will establish platform teams."

They're also predicting "adaptive" AI that can change after being deployed. But Forbes summarizes Gartner's related prediction, that AI leaders "increasingly must bake governance, trustworthiness, fairness, reliability, efficacy and privacy into AI operations" to improve adoption and user acceptance. This will include tools that "make AI models easier to interpret and explain while improving overall privacy and security."

PC Magazine offers this summary of a related prediction from Gartner: "By 2025, without sustainable AI practices, AI will consume more energy than the average European country, offsetting any environmental gains that AI creates by 25%."

Gartner also predicts a phasing out of marketing that uses social media sites' data about individuals — and that fully virtual workspaces "will account for 30% of the investment growth in metaverse technologies and will 'reimagine' the office experience through 2027," writes PC Magazine: [Gartner Fellow Daryl Plummer] said people need to reimagine how work will be done. He said that few people want to go back to the office full-time, but that virtual participants in calls often feel like second-class citizens. A fully immersive world is an answer to this, he said, with the interactive experience more important than information exchange. He believes metaverse experiences will be where people collaborate in ways they couldn't do in the office, blurring the line between home and work.

By 2025, "labor volatility" will cause 40% of organizations to report a material business loss, forcing a shift in talent strategy from acquisition to resilience. Plummer talked about revamping the way talent is valued. He said people don't want to do just one thing, but want to be "versatilists," which makes them more valuable to the company and less likely to leave.