Solidarity and resistance: How renters are fighting against unjust evictions – DiEM25

The fight for housing security, a basic human right of which many in our country have been robbed, has rapidly become a fight over the shape of civil society more generally, with fault lines appearing across the political spectrum.

As the right seeks to wage a culture war over anything from the Last Night of the Proms, to the ethics of snitching on your neighbours, the left are at the vanguard of the tenants rights movement, directly resisting evictions and shifting the tenor of public debate around housing more generally.

The ban on evictions which was introduced in March, at the height of the first wave of COVID-19 was a vital piece of legislation that not only protected thousands of people from homelessness, but made the concept of a lockdown actually workable, alongside the tragically temporary end of rough sleeping. As remarked by The Guardian, it was a cruelly poetic twist of fate that the end of the eviction ban should fall on the day in which the grim double act of Prof Chris Whitty and Sir Patrick Vallance addressed the UK warning of 50,000 new cases per day by mid-October.

This means that the already overworked courts face an enormous backlog of eviction cases to deal with. Many tenants are unaware of their legal rights in the face of eviction, which calls the already shoddy ethics behind the entire eviction process into question and robs many judges of the chance to grant discretion in housing cases.

It seems absolutely perverse and reckless for the government to once again urge everyone to work from home if they can, but simultaneously work to undermine housing security for thousands of people. A Conservative election pledge last year was the abolition of no fault evictions, but the government has instead decided that those falling into arrears due to the pandemic should stop carping on and get a higher income or a more secure job. Meanwhile, Conservative generosity towards private renters has extended as far as a Christmas truce, banning evictions in the run up to Christmas taking a leaf out of the Ebenezer Scrooge school of housing policy. Ultimately, the Christmas truce is an admission that the Tories and their landlord friends have been waging a class war against private renters for years.

Labour MP Zara Sultana has called for urgent measures to protect renters, highlighting the fact that 300,000 private renters have fallen into arrears during the pandemic, a figure that is highly likely to rise when the furlough scheme ends, currently propping up at least 5 million jobs. Sultana urged the government to extend the evictions ban for another year, cancel rent arrears and scrap no fault evictions. A coalition of organisations including Shelter, Crisis and Generation Rent have also urged the government to extend the eviction ban and offer a short-term package of emergency grants and loans to help renters who have lost income due to the pandemic.

The rights of tenants and renters facing eviction have been picked up by Momentum as part of a widespread resistance campaign against residential evictions and a shift towards community-based action. Calls from John McDonnell MP for a Marshall Plan-style social housing recovery plan to build 100,000 council homes would go a long way towards elevating many out of precarious, expensive private rented accommodation, and would also create hundreds of thousands of jobs in construction and other industries.

Meanwhile, facing stiff competition for the title of Worst Landlord in the Country is John Christodoulou, the billionaire owner of Somerford Grove in Hackney. After campaigning for a rent reduction during the pandemic, residents were subjected to surveillance, harassment and threatened with legal action. The tenants, with the support of Generation Rent, the London Renters Union and Momentum now face immediate eviction, but to put it more accurately, they are now directly resisting their own eviction.

While the billionaire Christodoulou outright refuses to even meet with the tenants, the government and even the shadow cabinet have also neglected their duty of care and protection for renters. Shadow Secretary of State for Housing, Thangam Debbonaire MP was incredibly dismissive when asked why she opposed forgiving private rent debt, bizarrely claiming that it would benefit the rich.

There have been a number of victories in the UK for tenant activists to celebrate this year, such as the Peoples Empowerment Alliance for Custom House (Peach) winning a 60% rent reduction and the right to live in council-managed properties. After four years of grassroots struggle, hundreds of families won the right to live in safe, secure and affordable accommodation. The London Renters Union have also been incredibly active in the capital, mobilising hundreds of members from disparate communities to resist evictions, preventing dozens of unlawful evictions over the summer. Acorn, a community-based union of tenants, workers and residents are also providing eviction resistance training for members as well as supporting direct action by members to resist evictions and win compensation from negligent landlords.

As we move into an uncertain future in which tenants are no longer protected by the eviction ban, it is likely that these unions and organisations will serve as a vanguard for many on the left who no longer see their views represented by the Labour leadership, but feel empowered to take matters into their own hands.

In the US, the situation of private renters is fraught, with up to 40 million facing eviction without a further stimulus package. Ominously, an Uber for evictions has been launched in the States, Civvl, who are anything but civil, call evictions the FASTEST GROWING MONEY MAKING GIG DUE TO COVID-19. However, in a demonstration of how tenant activism can have incredible outcomes, protestors across the US were able to secure an additional 4 month moratorium against evictions, buying time for an election and stimulus plan to be pushed through what will hopefully be a Democratic majority Congress. In Spain, the left wing Podemos coalition have frozen evictions until six months after the end of the current state of emergency. Other countries with more authoritarian governments have not seen this kind of support, for instance, thousands in Brazil have been evicted by force, and slums in Kenya were brutally demolished leaving their residents homeless during the pandemic.

If their complete rejection of a building safety bill based on the recommendations of the Grenfell fire public enquiry is anything to go on, the Conservatives simply do not care about private renters. In the face of this neglect, community-led organisations and unions are fighting in the streets to secure safe, affordable and secure housing, demonstrating solidarity with their neighbours and standing up to heartless landlords. The fight will be long and difficult, but in the words of Vijay Prashad, as long as you are resisting, you are not defeated.

Photo Source: London Renters Union on Twitter.

Read Benjamin James Davies article Britains COVID-19 Housing Crisis.

Do you want to be informed of DiEM25's actions? Sign up here

Read more from the original source:

Solidarity and resistance: How renters are fighting against unjust evictions - DiEM25

ASSANGE EXTRADITION: Craig Murray: Your Man in the Public Gallery: Assange HearingDay 12 – Consortium News

Former British diplomat Craig Murray was in the public gallery at Old Bailey for Julian Assanges hearing and here is his report on Wednesdays events.

By Craig MurrayCraigMurray.org.uk

On Wednesday the trap sprang shut, as Judge Vanessa Baraitser insisted the witnesses must finish next week, and that no time would be permitted for preparation of closing arguments, which must be heard the immediate following Monday.

This brought the closest the defence have come to a protest, with the defence pointing out they have still not addressed the new superseding indictment, and that the judge refused their request for an adjournment before witness hearings started, to give them time to do so.

Edward Fitzgerald QC for the defence also pointed out that there had been numerous witnesses whose evidence had to be taken into account, and the written closing submissions had to be physically prepared with reference to the transcripts and other supporting evidence from the trial.

Baraitser countered that the defence had given her 200 pages of opening argument and she did not see that much more could be needed.

Edward Fitzgerald QC in dated photo. (YouTube)

Fitzgerald, who is an old-fashioned gentleman in the very nicest sense of those words, struggled to express his puzzlement that all of the evidence since opening arguments could be dismissed as unnecessary and of no effect.

I fear that all over London a very hard rain is now falling on those who for a lifetime have worked within institutions of liberal democracy that at least broadly and usually used to operate within the governance of their own professed principles. It has been clear to me from Day No. 1 that I am watching a charade unfold.

It is not in the least a shock to me that Baraitser does not think anything beyond the written opening arguments has any effect. I have again and again reported to you that, where rulings have to be made, she has brought them into court pre-written, before hearing the arguments before her.

I strongly expect the final decision was made in this case even before opening arguments were received.

(CC0 1.0)

The plan of the U.S. government throughout has been to limit the information available to the public and limit the effective access to a wider public of what information is available. Thus, we have seen the extreme restrictions on both physical and video access. A complicit mainstream media has ensured those of us who know what is happening are very few in the wider population.

Even my blog has never been so systematically subject to shadow banning from Twitter and Facebook as now.

Normally about 50 percent of my blog readers arrive from Twitter and 40 percent from Facebook. During the trial it has been 3 percent from Twitter and 9 percent from Facebook. That is a fall from 90 percent to 12 percent.

In the February hearings Facebook and Twitter were between them sending me over 200,000 readers a day. Now they are between them sending me 3,000 readers a day. To be plain that is very much less than my normal daily traffic from them just in ordinary times. It is the insidious nature of this censorship that is especially sinister people believe they have successfully shared my articles on Twitter and Facebook, while those corporations hide from them that in fact it went into nobodys timeline. My own family have not been getting their notifications of my posts on either platform.

The U.S. government responded to Baraitsers pronouncement enthusiastically with the suggestion that closing arguments did not ought to be heard AT ALL. They ought merely to be submitted in writing, perhaps a week after final witnesses.

Baraitser appeared eager to agree with this.

Noam Chomsky. (Duncan Rawlinson)

Let me add that two days ago I noticed that the defence really had missed an important moment to stand up to her, when the direction of her railroading became evident. It appears that because of the ground the defence already conceded at that stage, Noam Chomsky is one of the witnesses from whom we now will not hear.

I am afraid I am not going to give you a substantive account of Wednesdays witnesses. I have decided that the intimate details of Julians medical history and condition ought not to be subject to further public curiosity. I know I cannot call back what others have published and the court is going to consider press requests for the entire medical records before it. But I have to do what I believe is right.

I will say that for the defence, Dr. Quinton Deeley appeared.

Dr. Quinton Deeley

Deeley is senior lecturer in social behaviour and neurodevelopment at the Institute of Psychiatry, Psychology, and Neuroscience (IOPPN), Kings College London and consultant neuropsychiatrist in the National Autism Unit. He is co-author of the Royal College Report on the Management of Autism.

Deeley, after overseeing the standard test and extensive consultation with Julian Assange and tracing of history, had made a clear diagnosis which encompassed Aspergers. He described Julian as high-functioning autistic. There followed the usual disgraceful display by James Lewis QC, attempting to pick apart the diagnosis trait by trait, and employing such tactics as well, you are not looking me in the eye, so does that make you autistic? He really did. I am not making this up.

I should say more about Lewis, who is a strange character. Privately very affable, he adopts a tasteless and impolite aggression in cross-examination that looks very unusual indeed. He adopts peculiar postures. After asking aggressive questions, he strikes poses of theatrical pugilism. For example, he puts arms akimbo, thrusts out his chin, and bounces himself up on his feet to the extent that his heels actually leave the floor, while looking round at the courtroom in apparent triumph, his gaze pausing to fix that of the judge occasionally. These gestures almost always involve throwing back one or both front panels of his jacket.

I think this is some kind of unconscious alpha male signaling in progress, and all these psychiatrists around might link it to his lack of height. It is display behaviour but not really very successful. Lewis has grown a full set during lockdown and he appears strikingly like a chorus matelot in a small-town production of HMS Pinafore.

Dr. QuintonDeeley. (Kings College)

There is a large part of me that wants to give details of the cross-examination because Deeley handled Lewis superbly, giving calm and reasoned replies and not conceding anything to Lewis clumsy attempts to dismantle his diagnosis.

Lewis effectively argued Julians achievements would be impossible with autism while Deeley differed. But there is no way to do retell it without going into the discussion of medical detail I do not wish to give. I will however tell you that Julians father John Shipton told me that Julian has long known he has Aspergers and will cheerfully say so.

The second psychiatrist on Wednesday, Dr. Seena Fazel, professor of forensic psychiatry at the University of Oxford, was the first prosecution witness we have heard from. He struck me as an honest and conscientious man and made reasonable points, well. There was a great deal of common ground between Fazel and the defence psychiatrists, and I think it is fair to say that his major point was that Julians future medical state would depend greatly on the conditions he was held in with regard to isolation, and on hope or despair dependent on his future prospects.

Here Lewis was keen to paint an Elysian picture. As ever, he fell back on the affidavit of U.S. Assistant Attorney Gordon Kromberg, who described the holiday camp that is the ADX maximum security prison in Florence, Colorado, where the prosecution say Julian will probably be incarcerated on conviction.

You will recall this is the jail that was described as a living hell and a fate worse than death by its own warden.

Lewis invited Fazel to agree this regime would not cause medical problems for Julian, and to his credit Fazel, despite being a prosecution witness, declined to be used in this way, saying that it would be necessary to find out how many of Krombergs claims were true in practice, and what was the quality of this provision. Fazel was unwilling to buy in to lies about this notorious facility.

Lewis was disingenuous because he knows, and the prosecution have conceded, that if convicted Julian would most likely be kept in H block at the ADX ( administrative maximum) under Special Administrative Measures. If he had read on a few paragraphs in Krombergs affidavit he would have come to the regime Julian would actually be held under:

So, let us be clear about this. U.S. Attorney General William Barr decides who is subjected to this regime and when it may be ameliorated.

For at least the first 12 months you are in solitary confinement locked in your cell, and allowed out only three times a week just to shower. You are permitted no visits and two phone calls a month.

After 12 months this can be ameliorated and we will hear evidence this is rare to allow three phone calls a month, and brief release from the cell five times a week to exercise, still in absolute isolation. We have heard evidence this exercise period is usually around 3 a.m. After an indeterminate number of years, you may, or may not, be allowed to meet another human being.

Behind Baraitsers chilly disdain, behind Lewis theatrical postures, this hell on Earth is what these people are planning to do to Julian. They are calmly discussing how definitely it will kill him, in full knowledge that it is death in life in any event.

I sit in the public gallery, perched 8 feet above them all, watching the interaction of the characters in this masque, as the lawyers pile up their bundles of papers or stare into their laptops, as Lewis and Fitzgerald exchange pleasantries, as the friendly clerks try to make the IT systems work, and my mind swims in horrified disbelief. They are discussing a fate for my friend as horrible as that of the thousands who over 500 years were dragged from this very spot and strung up outside. They are all chatting and working away as though we were a normal part of civilized society.

Then I go back to my hotel room, type it all up and post it. The governments who are destroying Julian have, through their agencies, pushed the huge corporations who now control the major internet traffic gateways, to ensure my pained and grieving account is seen by very few. My screams of pain and horror are deadened by thick padded walls. We are all locked in.

Craig Murray is an author, broadcaster and human rights activist. He was British ambassador to Uzbekistan from August 2002 to October 2004 and rector of the University of Dundee from 2007 to 2010.

Theauthorscoverage of the Assange trial is entirely dependent on reader support. Subscriptions to keep this blog going aregratefully received.

This article is from CraigMurray.org.uk.

The views expressed are solely those of the author and may or may not reflect those ofConsortium News.

Please Contributeto Consortium News25th Anniversary Fall Fund Drive

Donate securely with

Click on Return to PayPal here.

Or securely by credit card or check by clicking the red button:

View post:

ASSANGE EXTRADITION: Craig Murray: Your Man in the Public Gallery: Assange HearingDay 12 - Consortium News

Assange case: former security firm staff allowed to give anonymous evidence – The Guardian

Former employees of a security firm accused of spying on Julian Assange at Ecuadors embassy in the UK will be allowed to give evidence to his extradition case anonymously after claiming they would be at risk of kidnapping or poisoning.

Anonymity was granted to two former employees of UC Global after a hearing at the Old Bailey in London was told they feared that its director and owner, David Morales, or others connected to him in the US, could seek to harm them.

Judge Vanessa Baraitser said she would permit their identities to remain anonymous out of respect for a Spanish court that had done the same as part of a case in which they are involved.

Hearing a submission for anonymity from the WikiLeaks founders legal team on Tuesday, she asked if the witnesses required protection from the director of UC Global, or from the American state, or from whom do you think?

Mark Summers QC responded that they required protection mainly from Morales, but also from those associated with him. He said that Morales, who had been detained in Spain and subsequently bailed, had military training and that a firearm with the serial numbers removed had been found at one of his addresses.

James Lewis QC, acting for the US government, did not contest the submission for anonymity but said that checks would be carried out on the witnesses, whose evidence would be read into the record. He added that the US case was likely to be that their evidence was wholly irrelevant.

In allegations first reported by El Pais, the Spanish defence and private security company provided security for the Ecuadorian embassy, where Assange lived for seven years until April 2019. According to a complaint lodged by Assange in Spain, the company handed over audio and video of meetings he held with his lawyers and supporters inside the embassy to the CIA, breaching privacy laws and legal privilege.

Earlier in Tuesdays hearing, a lawyer for Abu Hamza, the radical Muslim cleric serving a life sentence in the US for terrorism offences, told the court that Assange would almost certainly end up in the extreme conditions of a notorious supermax jail if sent to the US.

The lawyer, Lindsay Lewis, accused US authorities of going back on assurances that she said had been given to courts in the UK and Europe before Hamza was extradited from Britain in 2012.

Assange is fighting extradition to the US on charges relating to leaks of classified documents allegedly exposing US war crimes and abuse. He could face a prison sentence of up to 175 years if convicted on all charges and be moved to the supermax administrative maximum facility near Florence, Colorado.

It is currently holding Abu Hamza, an Egyptian-born former imam at the Finsbury Park mosque in north London, who was born Mustafa Kamel Mustafa.

The 62-year-old had suffered serious psychological consequences from enforced isolation in the US, Lewis told the Old Bailey. The US lawyer represented Hamza during his New York terrorism trial and has been called by Assanges defence team.

I would note he was almost never out of his cell except for legal visits, she said, adding that calls and communications to his family were also sporadic.

There was no reason to believe that the conditions US authorities could impose on Assange would be any less arbitrary, oppressive or difficult to challenge, Lewis said.

Her evidence follows a week of testimony by medical experts who referred to Assanges history of depression and what was said to be a high risk of him taking his life if extradited.

I think he would be unlikely to get anywhere near the care or accommodation he has had in the UK, said Lewis, giving evidence via videolink.

Another witness called by the Assange legal team, a former warden at the Metropolitan Correctional Centre in New York, said there would have to be a severe change in Assanges medical status for him to get out of the prison in Florence.

Cross-examining, Clair Dobbin, for the US government, said it was only a possibility that Assange would be subject to what are known as Sams (special administrative measures).

Read more here:

Assange case: former security firm staff allowed to give anonymous evidence - The Guardian

Oversee apps with these 3 application security testing tools – TechTarget

Automated application security testing tools are critical as software applications come with a broad attack surface for cybercriminals to potentially exploit. With over a quarter of them having one or more serious vulnerabilities, applications are easy targets. The consequences of an attack can be devasting for both the application owner and its users, exposing both to financial loss and reputational damage. Even when security is built into the design and development stages of an application, vulnerabilities can still creep in. However, in modern continuous integration and continuous delivery (CI/CD) environments, where time is critical and manual code reviews and traditional test plans are time-consuming, IT admins often struggle to comprehensively oversee large, complex applications.

Automated application security testing tools can help developers identify software defects early in the CI/CD pipeline -- when they are easiest to detect, cheaper to resolve and overall less likely to disrupt the next development cycle.

Various laws and standards, such as PCI DSS, HIPAA and NIST 800-53, mandate or require the use of application security testing tools to address risk management requirements. The recent GDPR and California Consumer Privacy Act have also dramatically increased the amount of potential fines for organizations that don't take the appropriate steps to safeguard data.

The latest crop of application security testing tools enables software development teams to regularly check their code base to catch and fix bugs and vulnerabilities throughout the development, deployment, upgrade and maintenance of an application, greatly reducing the risk of a security incident. Commercial and open source application security testing tools and services are widely available, and although they will incur some initial costs, companies will ultimately spend fewer resources to remediate vulnerabilities and possible security incidents.

Application security testing tools can also free developers from tedious work, improving overall productivity. Modern tools incorporated into a developer's integrated development environment (IDE) enable the option to scan smaller sections of code more frequently, providing immediate feedback on potential issues. Application security testing tools not only find vulnerabilities, but also potential weaknesses in the code and its execution, halting the build process, if necessary, until admins remediate the problem and verify resolution. These tools offer repeatable tests that scale well and generate metrics to show how many issues admins detect and fix; track improvements in each developer's code; and track security issues so they don't get overlooked or ignored.

There are three main types of app security testing tools:

Mobile application security testing tools for mobile apps and application security testing as a service (ASTaaS) are two other options teams should consider depending on the nature of their environment. Also, as every project will include some third-party and open source components, a software composition analysis (SCA) tool is important in order to meet compliance regulations as it identifies components and libraries used in an application and checks for vulnerabilities.

No single application security testing tool will uncover every type of security issue. So, admins must plan for a combination of tools in the long run but should attempt to integrate tools as early as possible into the software development process. By automating the search for coding flaws, fixing security defects can become a routine, everyday task similar to fixing functional defects. SAST, along with an SCA tool, is the most common starting point for initial code analysis and will help fix the most common weaknesses and ensure code adheres to coding standards, particularly when the application is written in-house or the team has access to the source code.

Not all security issues are detectable during the software development phase, however, particularly if the source code is unavailable. Many issues only come to light when the application is in use, hence the need for DAST scanners, which crawl a running application before scanning it. This lets the scanner find all exposed input and access points within the application, which are then subsequently tested for a range of vulnerabilities by the scanner. Assessing how the interaction of different components affects security is an important part of reducing an application's attack surface.

The drawback with DAST is that admins must run the tests at a later stage in the software development lifecycle (SDLC), making it more costly to fix the vulnerabilities they discover. IAST tools generally run on the application server, functioning as an agent providing real-time detection of security issues by analyzing traffic and execution flow from within the application. The results can usually feed directly into an issue tracking tool.

The big advantages IAST has over SAST is that its false positive rate is normally a lot lower and it can handle third-party vulnerability detection to identify problems caused by external or open source components. IAST tools can operate during development, quality assurance and even in production as there is little effect on overall performance.

A team's development philosophy will also influence the choice of tools. SAST tools fit well into a Waterfall SDLC, as do DAST tools, whereas an Agile or CI/CD environment is better suited to IAST tools as they have a smaller time effect on the development cycle. One important, but often overlooked, feature is reporting. Tools that produce reports that all stakeholders can sufficiently comprehend will help project managers communicate risk and overall security posture. If resources and skill limitations make on-premises options a challenge, buyers should consider ASTaaS to hand off testing to a cloud service.

Any application security testing tool obviously needs to support whatever coding languages an application uses and integrate into the development pipeline, into the target platform -- such as mobile or web -- and with existing IDEs. If the development team doesn't include a security specialist or have the support of a dedicated security team, then they must pay extra attention to a potential tool's ease of setup and configuration as developers won't want to lose time in the setup process.

The size and geographic distribution of the development team, along with budget, will determine which features are necessary in an application security testing tool. Large teams located in different offices or countries will need a tool that can coordinate the management and reporting of all the different application security testing tools running in each location. If the team has less-experienced developers or if past projects contained a high number of bugs and weak coding practices, then e-learning functionality can improve the quality of code going forward.

Buyers should always ask to see a demo and take advantage of free trials to compare them against open source products and to ensure the features and capabilities are worth the investment. It's always possible to complement commercial tools with open source tools if the budget is limited.

Checkmarx provides a full range of tools from SAST, IAST, SCA and just-in-time training to educate developers on specific challenges. It comes with a range of implementation options, from private cloud to on-premises systems, all on a centralized platform to manage each tool. According to company case studies, customers have found setup to be straightforward, particularly combining automated scans with code collaboration tools, such as GitHub, GitLab, Bitbucket and Azure DevOps. Its mobile application security testing platform supports more than 22 coding and scripting languages and their frameworks, with zero configuration necessary to scan any language.

Companies choose Checkmarx over other options because of its ease of integration and ability to run automated scans on more than 100 different applications. One particular banking client also utilized its integration with Jira to assign vulnerability remediation to the relevant developer. Another client reduced development cycle times by scanning only new or altered code instead of running a full scan of the entire database, no longer requiring a dedicated engineer to write rules to automate the false positive elimination process.

Synopsys offers a full range of tools from SAST to IAST, including a plugin that integrates security analysis into IDEs, such as IntelliJ, Eclipse or Visual Studio. This plugin enables developers to correct security flaws in their code as they write without having to switch back and forth between tools. It also provides remediation guidance with context-sensitive e-learning lessons specific to any common weakness enumerations identified in a developer's code, helping avoid similar mistakes in the future. This is a great way to improve security awareness and coding skills of a development team.

The Synopsys Black Duck SCA tool maps open source and third-party components to known vulnerabilities, monitors for new vulnerabilities, and enforces component use and security policies. Its IAST tool, Seeker, monitors web application interactions in the background during normal testing, reporting any vulnerabilities, as well as the relevant code. According to Gartner Peer Insights, users say it requires little configuration, making it easy for developers and testers to run checks on a regular basis. One company, according to a Flowbird case study, required to meet PCI DSS Section 6 regulations turned to Seeker to understand how data flows through its payment systems and identify vulnerabilities in relation to their impact on sensitive data, resulting in improved security, less time spent on security testing, and improved communication between security and R&D.

Veracode provides a scalable, cloud-based service for application security and software testing. Its platforms enable end-to-end automated web testing and mobile app testing. As an on-demand SaaS system, it enables teams to more easily control costs, with users only paying for services needed. Veracode also offers penetration testing to manually test web, mobile, desktop, back-end and IoT applications to identify vulnerabilities automated testing can't find.

Veracode also offers Security Labs, which teaches secure coding practices through interactive web apps based on modern threats that developers often exploit and patch. The labs-based approach to developer enablement can speed up flaw resolution and help developers avoid flaws altogether, improving skills and overall awareness of secure coding practices. A free version, Security Labs Community Edition, is also available to any developer worldwide.

Other notable vendors include the following:

The right application security testing tools can decrease time to market, while cutting the costs of development, maintenance and remediation. While monitoring and protecting the production environment are still essential, by preventing vulnerabilities from making it through to the end product, application security testing tools greatly reduce the chances of a security breach -- and the often dire consequences that follow.

Go here to see the original:

Oversee apps with these 3 application security testing tools - TechTarget

Managing competing demands of development velocity and application security – Intelligent CIO ME

Software tools are constantly offering new ways of working which enable organisations to compete. Patrick Carey, Director of Product Marketing at Synopsys, says that as the shape of software development continues to evolve, so too must the mechanisms to secure it.

The first software development team I worked on operated on the follow mantra:

Meaning, dont worry about performance optimisations until your code actually does what its supposed to do, and dont worry about code maintainability until after you know it both works and performs well. Users generally have no idea how maintainable the code is, but theydoknow if the application is broken or slow. So more often than not, wed never get around to refactoring the code at least not until the code debt started to impact application reliability and performance.

Today, that developer mantra has two additional lines:

As with application performance and reliability, delivering an application on time is easily quantified and observed. Everybody knows when you miss a deadline something thats easy to do when your release cycles are measured in weeks, days, or even hours the security of an application isnt so easily observed or quantified, at least not until theres a security breach.

It should come as no surprise, then, that nearly half of the respondents to themodern application development security survey, conducted by Enterprise Strategy Group (ESG), state that their organisations regularly push vulnerable code to production. Its also not surprising that for over half of those teams, tight delivery schedules and critical deadlines are the main contributing factor. In the presence of a deadline, what can be measured is whats going to get done, and what cant be (or at least isnt) measured often doesnt get done.

However, we dont have time to do it doesnt really cut it when it comes to application security. This is demonstrated by the 60% of respondents who reported that their applications have sufferedOWASP Top 10exploits during the past 12 months. The competing demands of short release cycles and improved application security are a real challenge for development and security teams.

It doesnt have to be this way, and other findings in the survey point to opportunities that teams have to both maintain development velocityandimprove application security. Here are just a few:

Reject silver bullets

Gone are the days of security teams simply running DAST andpenetration testsat the end of development. A consistent trend shown in the report is that teams are leveraging multiple types of security testing tools across theSDLCto address different forms of risk in both proprietary and open source code.

Integrate and automate

Software development is increasingly automated andapplication security testingneeds to be too. Over half the respondents indicated that their security controls are highly integrated into their DevOps processes, with another 38% saying they are heading down that same path.

Train the team

Most developers lack sufficient application security knowledge to ensure their code isnt vulnerable. Survey respondents indicated that developer knowledge is a challenge, as is consistent training. Without sufficient software security training, developers struggle to address the findings of application security tests. An effective way to remedy this is to provide just-in-time security training delivered through the integrated development environment (IDE).

Keep score

If what gets measured gets done, then its important to measure the progress of both your AppSec testing and security training programmes. This includes tracking the introduction and mitigation of security bugs as well as improvements to both of these metrics over time, i.e. who is writing secure code and who isnt and are they improving?

We must also recognise that there can be too much of a good thing in terms of security tooling. ESG reported over a year ago that organisations, on average run 25 to 49 security tools from up to 10 different vendors. Some of these are monitoring tools for IT infrastructure, such as network, endpoint, wireless, identities and so on. But it applies to software development as well.

Analysts likeForresterand451 Researchhave reported on security tool sprawl in the past year, noting that as many as 40% of organisations admit that their development teams are so overwhelmed by security alerts that they cant respond to at least 25% of them. Indeed, when security alerts are so constant, they become background noise and are ignored the exact opposite of the intent.

It shouldnt be this way. The right combination of tools that run the right tests at the right time can help security keep pace with development, which has moved into hyperdrive over the past few years. And still, there is a persistent perception that if some tools improve your security, more will improve it even more. Unfortunately, it could be just the opposite. If you pile too many tools on your development team, especially if you cant coordinate them on a single platform, your developers are more likely to ignore critical alerts.

Too many tools can even expand your attack surface if they dont communicate securely or arent updated regularly. So what can you do?

Take an inventory of your security tools

Eliminate tool sprawl by taking a rigorous inventory and evaluating it. Know what you have and what its intended to do. Its of great importance also to make sure your tools are properly configured, deployed and are up to date.And then evaluate: are they doing what theyre supposed to? Is any tool doing the same thing that another tool might be doing better? If a security tool is inferior or redundant, get rid of it. Security clutter is the last thing you want.

Make sure tools complement one another

Be sure your tools can work together. It doesnt matter that a single tool is considered best in class if it cant play nice with all the others. Your tools need to integrate with one other and into your workflow, which makes it easier to embed security into the SDLC from start to finish. As the experts say, the best way to encourage developers to add Sec to DevOps is to make the secure way the easier way.

Integrate tools into your workflow

The way to make security easier, and combat security tool overload in the process, is to integrate your security tools into a single platform with a dashboard that flags bugs and other potential defects as you go. Its far better than forcing developers to return to code they wrote weeks ago to deal with problems you discovered today.

High velocity development is the future, theres no denying it. And while security must keep up with methodologies such as DevOps, it must be carried out in a way that enables development teams to build security into their existing processes. As the shape of software development continues to evolve, so too must the mechanisms to secure it and that doesnt simply mean an overabundance of security tooling.

Facebook Twitter LinkedInEmailWhatsApp

Read the original here:

Managing competing demands of development velocity and application security - Intelligent CIO ME

Delaware releases new contact tracing app to help control virus’s spread The Review – University of Delaware Review

Eric Munson/THE REVIEWOn Sept. 15, the Delaware Division of Public Health (DPH) released a new coronavirus contact tracing app called COVID Alert DE.

BY ERIC MUNSONAssociate News Editor

On Sept. 15, the Delaware Division of Public Health (DPH) released a new coronavirus contact tracing app called COVID Alert DE.

In an email statement to The Review, Jennifer Brestel, the chair of community relations for DPH, said that COVID Alert DE is a free anonymous exposure notification mobile app.

The app is available to everyone 18 and older with an apple [sic] or android [sic] phone, who lives, works or goes to college in Delaware, Brestel said in the statement.

According to a press release from the Office of the Governor, the app does not collect personal information or GPS location data to track its users. However, COVID Alert DE uses Bluetooth Low Energy technology, which allows phones with the app to recognize when it is near other phones also running the application.

Users of COVID Alert DE may receive an exposure notification if they were in close proximity of someone who tested positive for COVID-19, and also has the app downloaded on their phone, the press release reads. Close proximity is defined as within six feet for 15 minutes or more.

The app was created by NearForm, an Irish software developer headquartered in the small seaside town of Tramore, located in County Waterford, Ireland.

In an email statement to The Review, Colm Harte, the technical director of NearForm, said the company specializes in globally accelerated solution delivery for the likes of Cond Nast, IBM and EY [Ernst & Young].

Harte said that NearForm was approached by the Irish government to create a contact tracing app for the Health Service Executive, Irelands public health authority. The prototype of the app was completed within 10 days of the request.

According to Harte, the Irish version of the app was launched on July 7 and 25% of the population downloaded it within the first 36 hours. The download rate continues to climb.

The success of the app led NearForm to create similar apps for Northern Ireland, Scotland, the Island of Jersey and Gibraltar. 22% of Scottish people downloaded the app within the first week, Harte said.

In the US we have engaged with a number of states, including Delaware and Pennsylvania, who have seen the success of the app in Ireland and parts of the UK, Harte said in the statement.

Harte said COVID Alert DE is interoperable between Delaware and Pennsylvania, meaning the app still works when crossing state borders. Harte also said that 70,000 Pennsylvanians have already downloaded it. The Irish version is also interoperable with Northern Ireland, as people frequently travel between the two, Harte went on to say.

Making these apps interoperable with as many other states as possible will provide people with an additional layer of protection as they travel to work and to visit family, Harte said in the statement. We are also working on a wider European interoperability project.

Harte said that what makes the app unique is its privacy technology in that all the code is open-source and eligible for peer review. The source code is currently catalogued by the Linux Foundation Public Health, under the code name COVID Green. Harte said that this allows others to see how the code works and to demonstrate its privacy first approach.

According to Harte, when two phones with the app are in a close proximity for 15 minutes or more they exchange a digital handshake or anonymous keys.

If the user of one of those phones later tests positive for COVID-19 the public health authority will ask them if they have the app, and if they are willing to upload a random six-digit code to anonymously notify those apps they have exchanged anonymous keys with, Harte said in the statement. The important thing to note is that it is all completely private and voluntary. The app doesnt know who you are, and doesnt use GPS or track your location.

According to Harte, the app stores this data for 14 days, after which it is automatically deleted. He said this can help to notify those that are unable to remember being in contact with someone, especially someone they do not know.

Harte also said that the app is fully customizable end-to-end so that different states and countries are able to tailor language, information, look and feel to be consistent with the needs of their citizens. The app can also be easily integrated into manual contact tracing systems thanks to its one-time verification code.

The app puts the power in peoples hands to join the fight against the spread of COVID-19, and to protect themselves and their loved ones, Harte said in the statement. Once the app is deployed it starts working to break transmission chains immediately. The more people who download the app the better.

Harte cited a recent report from the University of Oxford showing that a 15% uptake of contact tracing apps can help reduce Covid-19 infections.

Dr. Karyl Rattay, the director of the DPH, said that the app complements [the DPHs] contact tracing efforts.

This is a crisis, Rattay said. None of us have ever seen over 200,000 individuals in our country die from [an] infection.

According to Rattay, Delaware has seen an increase in COVID-19 cases. As of the publication of this article there are almost 20,000 cases.

Over the last couple of weeks we have seen more significant increases that we had previously, Rattay said. A number of those cases are related to University of Delaware students, but were also seeing increased cases in other areas of Delaware as well.

According to the State of Delawares Coronavirus (COVID-19) Data Dashboard, of the 19,625 total named contacts, 11,478 have been reached by contact tracers at a rate of 58%. Of the 11,478 contacted, 2,697 are cases with known exposure to another case, a rate of 26%. This works out to an average of 3.0 contacts per case. This data goes all the way back to June 27.

Rattay said that some major issues with contact tracing are remembering names, the length of contact, exact timeframes and whether the people are strangers or not. This makes contact tracers jobs harder as they are unable to use the typical contact tracing methods.

Rattay reiterated Hartes statement about giving citizens responsibility to help prevent the spread of coronavirus.

So this [app] really puts the power in the hands of the citizens to know if they have possibly been exposed from an infected individual and then take the necessary steps to protect themselves from the spread of infection, Rattay said.

According to Rattay, the DPHs contact tracing program began in May and became permanent in late June. She said that when somebody tests positive, the contact tracers call each and every individual who may have been exposed from them.

Its an incredibly important tool, not just for us to know who they may have spread it to, but also to better understand how its spreading in the community, Rattay said.

Rattay affirmed that the primary focus of the app is information and communication, especially since there is not a vaccine available at the moment.

Rattay said that since the app is completely anonymous, the DPH has no way of knowing who you are, where you are, [or] what your behaviors are, but it gives people knowledge of what they need to do such as quarantining, social distancing and getting tested.

Rattay believes that the app will be helpful in the long-run especially when dealing with future respiratory illnesses and pandemics.

We may very well begin to use this more for other infections to better understand if youve been exposed in the future, Rattay said. I think its an exciting breakthrough for public health to be able to use technology like this.

Rattay said that whether we want to or not everybody has a role to play in preventing the spread of the coronavirus. She implored people to answer the phone when they get a call from a contact tracer.

When all it takes is just answering the phone so that youre informed about whether or not you might be infectious, and how best to address the situation, its really all of our responsibility, Rattay said.

See original here:

Delaware releases new contact tracing app to help control virus's spread The Review - University of Delaware Review

Coiled Announces $5M Seed Funding to Meet the Needs of Modern Data Teams – PRNewswire

SAN FRANCISCO, Sept. 29, 2020 /PRNewswire/ --Coiled, the modern solution for seamlessly scaling data science, machine learning, and AI in Python, today announced it has raised a $5 million Seed round co-led by Costanoa Ventures and IA Ventures, with other backers including Kaggle co-founders, Anthony Goldbloom and Ben Hamner, and Techammer, spearheaded by Cloudera co-founder, Jeff Hammerbacher.

Coiled boasts an impressive and reputable leadership team including CEO and Founder Matthew Rocklin, who is best known for creating Dask, as well as Hugo Bowne-Anderson and Rami Chowdhury, both of whom are long-time leaders in the open-source community.

Dask has become the leading Python way to natively scale out open-source technology, including:

But up to now, the open-source software ecosystem did not provide the tools for enterprises to do Dask work in a secure, collaborative way. That is why Rocklin started Coiled--to enable existing Python workflows for data science and machine learning to scale in a way that works better for enterprises. Coiled's initial product will:

"As data science goes from prototyping to production, it's crucial to be able to scale workloads. Dask (and Coiled) allow data scientists to scale using workloads using the libraries they know and love. That's why I'm excited to be an investor in Coiled."

-Anthony Goldbloom, CEO and Cofounder of Kaggle

**************************************************

"I'm excited to see the Dask community growing with Coiled building products around this essential scaling technology. I was so proud to be associated with the creation of Dask at Anaconda that arose from our broad efforts to scale the PyData community. At Quansight and OpenTeams, we look forward to partnering with Coiled to ensure Dask continues to grow as a trusted backbone for scaling data science and machine learning workflows."

-Travis Oliphant, Creator of SciPy, NumPy, and Numba

**************************************************

"The Coiled team are world experts in scaling Python and are deeply aware of the pain points data scientists face everyday. It has been a pleasure

collaborating with Matt and Dask developers in recent years in our work on Apache Arrow, and we're excited for what's up next for this open source ecosystem."

-Wes McKinney, creator of Pandas and Apache Arrow

**************************************************

"There is a huge gap between tools that data scientists love and those that are fit for the enterprise. Coiled brings these two together and will be the crucial connective tissue that enables organizations to do productive data science at scale."

-Tony Liu, Senior Associate at Costanoa Ventures

**************************************************

"It's rare to get the caliber team that founded the original open source project to lead it's commercialization for enterprises. Matt Rocklin knows exactly what needs to be done and has the credibility with the PyData community to make Coiled a great company."

-Greg Sands, Managing Partner at Costanoa Ventures

**************************************************

"When Matt originally developed Dask as an open-source project, his vision was to enable every data scientist to scale their python code. Today, it is relied on by tens of thousands of users globally. Coiled builds on this framework to provide a complete solution for individuals and enterprises alike to simply and seamlessly scale their machine learning code and data from local workstations to data centers, traditional clouds, and even GPU clusters. Coiled's rapid ascent is impressive and we at IA are thrilled to be partnering with the team on this journey."

-Brad Gillespie, General Partner , IA Ventures

About Coiled

Founded by the creator of Dask, Coiled products ensure that data infrastructure scales at maximum speed, minimum cost, and with the Python tools data scientists already use. Coiled makes it easy for teams and organizations to collaborate and ensures reproducibility with data of any size and simplifies working in the cloud. Coiled's team has helped scale data work from workstations and laptops to compute clusters and GPUs using Dask. These Dask projects range from machine learning and ETL pipelines to demand forecasting and statistical modelingfor Barclays, Capital One, Harvard Medical School, Los Alamos National Labs, Novartis, USGS, Walmart, Grubhub, and more. To learn more, please visit https://coiled.io/.

SOURCE Costanoa Ventures

http://www.costanoavc.com

Read more:

Coiled Announces $5M Seed Funding to Meet the Needs of Modern Data Teams - PRNewswire

Ring plans to offer end-to-end encryption by the end of the year – The Verge

Ring has announced that it will soon offer the option to enable end-to-end encryption for the video feeds from its smart doorbells and connected home security cameras. This new higher level of security will be an optional feature and builds upon Rings existing encryption features. The company says it will be available for free to all Ring customers and plans to offer the feature by the end of this year.

With end-to-end encryption enabled, the video footage will be encrypted on the camera and can only be decrypted with a key stored on the mobile device used to view the recording. The setting is optional because once end-to-end encryption is enabled, certain features such as accessing the video feed through Alexa on an Echo Show or Fire TV device or sharing footage from the camera with others will no longer work. It essentially limits the Ring cameras feed to the app itself.

In addition to the stronger encryption, Ring is also updating its mobile app with more information on how videos are encrypted or stored. But more significantly, the company is finally allowing Ring owners to completely disable the controversial Neighbors feed from the app. The Neighbors feed is where Ring owners can share clips captured by their cameras and is ostensibly designed to alert others to possible crime or emergencies in their areas. But its long been criticized for being both fearmongering and an abuse vector for those in marginalized communities and hasnt been proven effective in reducing crime.

The other big criticism against Ring has been its close partnerships with police departments, which have been able to use Ring cameras as surveillance devices in hundreds of communities across the country. Todays announcements dont change any of this Ring will still partner with police departments and owners will have to manually opt out of being contacted by police for their camera footage if they dont want to participate in the program.

More:
Ring plans to offer end-to-end encryption by the end of the year - The Verge

Ring to offer opt-in end-to-end encryption for videos beginning later this year – TechCrunch

Ring will be stepping up its efforts to make its security products secure for users by enabling end-to-end video encryption later this year. The company will be providing this toggle in a new page in tits apps Control Center, which will provide more information about Rings current encryption practices, and measures to keep user video secure, until the end-to-end encryption feature goes live. Ring is also taking the covers off a range of new devices today including its first drone but Ring CEO and founder Jamie Siminoff says that this new security measure could actually make the biggest difference to its customers.

[End-to-end encryption] could be our most important product that were sort of putting out there, because security and privacy, and user control are foundational to Ring, and continuing to push those further than even the industry, and really even pushing the res of the industry, is something I think that we have a responsibility to do.

Siminoff also points to Rings introduction of mandatory two-factor authentication earlier this year as something thats above and beyond the standard across the industry. I asked him them why not make end-to-end encryption for video on by default, with an opt-out option instead if users feel strongly that they dont want to take part.

Privacy, as you know, is really individualized we see people have different needs, he said. Just one example for end-to-end, is thatwhen you enable it, you cannot use your Alexa to say Show me whos at the front door, because of the physics of locking down to an end-to-end key. As soon as you do something like that, it would actually break what youre trying to achieve. So it really is something that is optional, because it doesnt fit every user in terms of the way in which they want to use the product. But there are some users that really do want this type of security so I think what youre going to see from us in the future, and I hope the industry as well, is just really allowing people to dial in the security that they want, and having transparency, which is also with the Video Control Center that weve launched today to provide you with the knowledge of whats happening with your data, in this case with Ring videos.

Overall, Siminoff said that the company hopes through all of its products, to be able to provide its users to build the system that they want to use, its the way that they want to use it. The Alway Home Cam drone, he points out, is another expression of that, since it provides the potential to monitor every room in your home but also the ability to be selective about when and where.

I think its just about building the options to allow people to use technology but use it comfortably, understand it, and control it, he said.

More:
Ring to offer opt-in end-to-end encryption for videos beginning later this year - TechCrunch

WhatsApp Encryption Is Not Foolproof; Chats Can Be Accessed In These Ways – Yahoo India News

The mysterious death of Sushant Singh Rajput has kicked off debates on drugs, nepotism, and whatnot. The recent drug probe, which has summoned many celebrities like Deepika Padukone, Sara Ali Khan, and others, based on extracted WhatsApp chats, has raised concerns among the people.

The leaked WhatsApp chats have made people question WhatsApps security and its claim of end-to-end encryption. If WhatsApp chats are encrypted, then how are government agencies like NCB and CBI able to extract these chats?

WhatsApp is used by over two million users from more than 180 countries around the world. Being one of the widely used apps that connect people, doubts about privacy have raised fear among people.

WhatsApp says that only you and the receiver can read the messages you send. No one in between can access them, not even WhatsApp itself.

Each message you send has its unique lock and key, only you and the receiver have that unique key to open the messages and read them. As per WhatsApp, this encryption is automatic and can not be turned off manually.

For added protection, every message you send has a unique lock and key. All of this happens automatically. No need to turn on settings or set up special secret chats to secure your messages- WhatsApp.

Although even after encrypting the messages, WhatsApp indeed stores information in the form of metadata. Metadata is very little data stored in the apps server that can be your device configuration, mobile number, logins, profile photo, etc.

The messages you send are only stored on the apps server until they are delivered. So, all the chat data is stored in the form of chat backup in your Google Drive or iCloud. This data stored in cloud services is not properly encrypted and can be used by anyone who can access them.

Agencies such as the Central Bureau of Investigation (CBI) and the Narcotics Control Bureau (NCB) use complex software mechanisms to clone mobile data onto a different phone. Cloning is used to transfer data from a suspects phone to a different phone without using the phone that is being cloned.

This can be done using an app. Although mobile cloning or imaging is illegal for the general public, government agencies can freely use these services.

So, in a nutshell, anyone who has access to your Google Drive or iCloud can access your chats. One way to protect your chats is to turn off cloud backups. Use two-factor authentication on as many platforms as possible to add a layer of security to your personal information.

Image Sources:Google Images

Sources:ABP Live, Indian Express, Wired + More

Find Blogger:@mitalipatekar

This post is tagged under: Whatsapp encryption, WhatsApp Accounts, WhatsApp, WhatsApp cybercrime, NCB drug probe, NCB, SSR, End-to-end encryption, Deleted WhatsApp Messages, WhatsApp conversation, WhatsApp google drive, WhatsApp google drive backup, WhatsApp google drive chat backup, whatsapp chat backup, how to read whatsapp chats, how to access whatsapp chats, hacking whatsapp, hacking whatsapp chats

Conmen Are Hijacking WhatsApp Accounts & Blackmailing Users With Intimate Pictures, Texts And More

View original post here:
WhatsApp Encryption Is Not Foolproof; Chats Can Be Accessed In These Ways - Yahoo India News