ea

ETSI announces TeraFlowSDN Release 4

Sophia Antipolis, 6 November 2024

End-to-end Network Automation and Security Framework

Read More...




ea

MAA Toronto Presents - Intro To Wealth Management

Starts: Wed, 20 Nov 2024 19:30:00 -0500
11/20/2024 06:00:00PM
Location: Toronto, Canada




ea

MAA South Korea: Annual Networking Event

Starts: Sat, 23 Nov 2024 18:30:00 -0500
11/23/2024 06:30:00PM
Location: Seoul, Korea (south)




ea

McGill Women Leading in Sports

Starts: Mon, 25 Nov 2024 19:00:00 -0500
11/25/2024 05:30:00PM
Location: Montréal, Canada




ea

McGill Society of Montreal Holiday Social

Starts: Mon, 25 Nov 2024 20:00:00 -0500
11/25/2024 05:30:00PM
Location: Montreal, Canada




ea

MAA of Brome-Missisquoi Holiday Season Gathering

Starts: Sat, 30 Nov 2024 20:00:00 -0500
11/30/2024 05:00:00PM
Location: Lac-Brome (Knowlton), Canada




ea

McGill Society of Hong Kong Year End Holiday Dinner

Starts: Tue, 03 Dec 2024 19:30:00 -0500
12/03/2024 07:30:00PM
Location: Happy Valley, Hong Kong (china)




ea

Los Angeles Holiday Party - Smoked Meat & Poutine Brunch

Starts: Sat, 07 Dec 2024 13:30:00 -0500
12/07/2024 11:30:00AM
Location: Los Angeles, U. S. A.




ea

San Francisco Bay Area Holiday Party - Don't Miss the Fun!

Starts: Sun, 08 Dec 2024 18:30:00 -0500
12/08/2024 04:30:00PM
Location: San Mateo, U. S. A.




ea

Native American Religion in Early America

Teaching about Native American religion is a challenging task to tackle with students at any level.




ea

How to Read a Slave Narrative

New essay by William L. Andrews just added to Freedom's Story: Teaching African American Literature and History, TeacherServe from the National Humanities Center.




ea

CSA Multilateral Staff Notice 58-317 - Review of Disclosure Regarding Women on Boards and in Executive Officer Positions - Year 10 Report

This document is only available in PDF format.




ea

CSA Staff Notice 51-365 Continuous Disclosure Review Program Activities for the Fiscal Years Ended March 31, 2024 and March 31, 2023

This document is only available in PDF format.




ea

Research Analyst I/II

Job Summary The International Food Policy Research Institute (IFPRI) seeks a qualified candidate to serve as a Research Analyst I/II in its Development Strategies and Governance Unit. This position is a one-year, renewable appointment, based at IFPRI’s office in New Delhi, India. The Successful candidate will have experience in using mixed methods for research and excellent writing skills. Interested applicants must have work authorization to work in India. The final grade level will be determined by level of education and years of relevant work experience. Essential Duties:  Specific duties and responsibilities include but are not limited to: Assist with the analysis of climate-smart agricultural (CSA) technologies and interventions and their increasing significance as part of agricultural adaptation in the wake of climate change, particularly in the developing countries. Assist in conducting cost-benefit analysis, constraint analysis, and policy analysis to estimate the extent to of CSA adoption in the South Asia region.  Conduct data analysis (using primary and secondary), statistical and econometric analysis. Familiarity with trade-related data and data sources to assist with the analysis of trade barriers (tariff and non-tariff) associated with various CSA technologies. Preparation of analytical reports and peer-reviewed publishable papers using information from primary surveys and secondary data. Assist in the preparation of project reports, policy briefs and journal articles. Conduct literature reviews & synthesis. Verify or triangulate key data to ensure the robustness and relevance of it in developing indices. Regular travel and meetings with various stakeholders including government officials, extension agents, local service providers, and farmers to gather inputs for drafting reports. Assist in organizing high level policy forum, workshops and seminars. Required Qualifications:  At the Research Analyst I level, Bachelors’ degree plus two years of relevant experience, or Master’s degree in Economics, Rural Development, Public Policy, or a closely related field. At the Research Analyst II level, Master's degree in the above-mentioned fields plus three years of relevant post Master’s work experience. Demonstrated experience working with large quantitative data sets (data cleaning, management, analysis, etc.) Knowledge of standard econometric tools Excellent Stata, data visualization (Tableau/Power BI), MS Excel and ArcGIS skills (knowledge of ArcGIS and Tableau/Power BI is not compulsory)  Demonstrated strong writing skills. Fluency in written and spoken English and Hindi Ability to work independently, with initiative and minimal supervision. Preferred Qualifications:  Experience in fieldwork, using mixed methods for research. Experience in designing and conducting focused group discussions, semi-structured interviews, and analysis of policy documents.   Experience working in rural South Asia Experience in liaison and coordination with ministries and departments.  Physical Demands and Work Environment Employee will sit in an upright position for a long period of time. Employee will lift between 0-10 pounds. Employee is required to have close visual acuity to perform activities such as: preparing and analyzing data and figures; transcribing; viewing computer terminal; extensive reading.  




ea

Research Analyst I/II

Job Summary   The International Food Policy Research Institute (IFPRI) seeks a qualified candidate to serve as a Research Analyst I/II in its Development Strategies and Governance Unit. This position is a one-year, renewable appointment, based at IFPRI’s office in New Delhi, India. Successful candidate will engage in quantitative research to generate empirical evidence on efficiency in agricultural research & development, impact of agricultural technologies, farm credits & insurance, innovations in input delivery systems, linkages between agriculture and nutrition etc. Job duties will include support to quantitative data analysis, literature reviews including policy and program reviews and assistance in the preparation of reports and journal manuscripts. The RA is expected to support policy and stakeholder communications activities also. Interested applicants must have work authorization to work in India. The final grade level will be determined by level of education and years of relevant work experience. Essential Duties:  Specific duties and responsibilities include but are not limited to: Assist in various tasks involving Data collection, compilation, cleaning, and analysis of primary and secondary data from various sources.          Coordinate and manage large field surveys. C onduct literature reviews and synthesize findings. Perform economic modeling and statistical analysis. Facilitate coordination between collaborators and stakeholders.                                             Assist in the drafting and editing of research papers, blogs, policy briefs, technical guidance, presentations, etc. Perform other duties as assigned. Required Qualifications:  Research Analyst I: Bachelor’s degree in Economics, Agricultural Economics, Statistics, Agricultural Statistics plus two years of professional experience or Master’s degree in closely related field. Research Analyst II: Master’s degree in one of the above fields plus minimum three years of post-master’s relevant experience. Skills in quantitative research methods and data analysis. Experience of using Stata software for data analysis. Fluency in written and spoken English. Excellent interpersonal skills along with the ability to work independently and with colleagues from diverse cultures. Ability to manage multiple tasks and produce completed products in time. Ability to work independently, with initiative and minimal supervision. Preferred Qualifications:  Experience in handling large agricultural and household survey data from developing countries. Demonstrated strong writing skills. Physical Demand & Work environment: Employee will sit in an upright position for a long period of time.  Employee will lift between 0-10 pounds.    Employee is required to have close visual acuity to perform activities such as: data preparation, web-scraping, preparing, and analyzing data and figures; dashboard; viewing computer terminal; extensive coding.  




ea

Research Assistant/ Research Analyst I

Job Summary: The International Food Policy Research Institute (IFPRI) seeks a qualified candidate to serve as a Research Assistants/ Research Analyst I in its Development Strategies and Governance Unit for the Sudan Strategy Support Program. This is a one-year, renewable appointment. The successful candidates will work with senior research staff in the analysis of agriculture, rural development, food and nutrition security and related policies and other research activities including research work related to the ensuing conflict in Sudan. The incumbent will work under the overall guidance of the IFPRI Sudan Program Leader but will be employed directly by IFPRl's organizational host, the Arab Organization for Agricultural Development (AOAD) - employment policies, compensation, and benefits of AOAD will apply to this position. Interested applicants must have authorization to work in Sudan. The final grade level will be determined by level of education and years of relevant work experience. Essential Duties: Specific Duties include but are not limited to: Assist the collection of primary and secondary data, Asist build large dataset from multiple sources, Assist to analyze data using advance analytical methods, Assist in conducting literature reviews and synthesis, Assist in drafting and translating reports, research papers, and blog posts between English and Arabic languages, Assist in capacity building and support outreach activities, Assist to coordinate projects and conduct other duties as assigned. Required Qualifications:  Research Assistant: Bachelor's or its equivalent in Economics, Agricultural Economics, Statistics, or closely related fields, Research Analyst: Bachelor’s degree plus two years of relevant professional experience or Master’s degree in a relevant discipline, Excellent knowledge of macroeconomic and/or microeconomic theory, Excellent knowledge of and quantitative econometric methods and/or economic modeling, Excellent knowledge of Stata and/or GAMS, Excellent analytical mind and drafting skills, Demonstrated fluency in written and spoken English and Arabic , Excellent interpersonal skills and to work in a team-oriented multi-cultural environment, Demonstrated ability to multi-task, meet deadlines, and manage time, Demonstrated professional level of attention to detail and accuracy of work, Ability to work independently and take initiative, Willingness to travel. Preferred Qualifications: Previous experience conducting research on and collecting data in Sudan. Familiarity with the literature on economic and agriculture development, food security, poverty reduction and related fields. Previous experience related to policy analysis and impact evaluation. Experience with spatial analysis and ARC-GIS. Experience with policy communication activities and events organization. Experience with managing websites and updating their contents. Experience in academia, the private sector, a development-oriented organization, or comparable institution,   Physical Demand & Work environment Employee will sit in an upright position for a long period of time. Employee will lift between 0-10 pounds. Employee is required to have close visual acuity to perform activities such as: preparing and analyzing data and figures; transcribing; viewing computer terminal; extensive reading.  




ea

Research Unit Contracts & Grants Manager I

The Development Strategies and Governance (DSG) Unit within the Transformation Strategies Department of the International Food Policy Research Institute (IFPRI) seeks a Research Unit Contracts & Grants Manager I, who will be responsible for financial management which includes budgetary responsibilities, cost monitoring and control, and financial analysis and reporting, contracts administration which includes proposal preparation and submission and the administration of the Unit’s special projects. Other responsibilities include supervising Unit Admin Support staff, serving as liaison with finance and administration as well as the Director General’s office; drafting correspondence for the Unit director and communication with external contacts (donors, clients, collaborators, sub-contractors and auditors); and service as active member on various standing and ad-hoc committees, as well as work with Project Managers in management of budgets, contracts, deliverables, invoices and other payment documents. This position is a 2-year, renewable appointment based in Washington, DC.   Essential Duties: Specific duties and responsibilities include but are not limited to: Providing technical support in proposal preparation, reviewing contracts to ensure they reflect the provisions negotiated, and monitoring performance of contracts and submission of specified deliverables.  Drafting, negotiating and monitoring consultant collaborative agreements, serve as liaison between program collaborators and finance/administrative issues, review monthly financial reports, and provide financial analysis reports on projects.  Preparing the divisional budgets and monitoring expense budgets Coordinating the drafting of project/program budgets; review of accounting transactions.  Developing spreadsheets & maintaining financial information for planning & reference. Drafting routine correspondence regarding contracts or project/program finances. Assisting in financial audits Coordinating financial and operational activities for field offices Ensuring the smooth operation of the program’s day-to-day activities; coordinate seminars and workshops, manage logistical arrangements on seminars/workshops. Liaising with IFPRI HR Services, Facilities and IT department for related issues and needs. Preparing administrative and operational procedures for the division and approves timesheets Maintaining division files Supervising administrative support staff Other tasks as assigned. Required Qualifications:  Bachelor’s degree plus ten years of relevant experience, or associate’s degree plus twelve years of relevant experience.   Two year of management experience Experience in developing, monitoring and managing budgets and contracts. Experience in coordinating budget processes, reviewing accounting transactions, developing financial projections and reports. Solid composition, grammar and proof-reading skills, with the ability to compose correspondence and reports; excellent written and oral English communications skills. Proficient in Microsoft Office; word processing & spreadsheet programs required. Ability to handle multiple tasks & prioritize tasks with minimal supervision in a fast-paced environment. Demonstrated experience and comfort working with multiple program managers simultaneously.  Ability to prioritize and coordinate tasks in such an environment. Demonstrated flexibility to adjust to multiple individual work styles.  Attention to detail and ability to work within a team in a multicultural environment.   Preferred Qualifications: Familiarity with IFPRI’s operational systems (finance, accounting, etc.) and the CGIAR system is highly desirable.  Proficiency in a second language of the U.N. system Demonstrated proficiency with MS Office, especially Microsoft Word, Outlook, Excel, and PowerPoint required, and demonstrated proficiency with financial management and administrative software applications such as Costpoint, OnBase, Deltek, and/or other applications. Physical Demand & Work environment: Employee will sit in an upright position for a long period of time  Employee will lift between 0-10 pounds.  Employee is required to have close visual acuity to perform activities such as: preparing and analyzing data and figures; transcribing; viewing computer terminal; extensive reading. Salary Range: The expected salary range for this job requisition is between $85,600- $104,900. In determining your salary, we will consider your experience and other job-related factors.  Benefits: IFPRI is committed to providing our staff members with valuable and competitive benefits, as it is a core part of providing a strong overall employee experience. This position is eligible for health insurance coverage and a summary of our benefits can be found on our website. Please note that the listed benefits are generally available to active, non-temporary, full-time and part-time US-based employees who work at least 25 hours per week. The International Food Policy Research Institute (IFPRI) is an equal employment opportunity employer - F/M/Disability/Vet/Sexual Orientation/Gender Identity.




ea

Senior Research Fellow I/II

Job Summary: The International Food Policy Research Institute (IFPRI) seeks a qualified candidate to serve as a Senior Research Fellow (SRF I or SRF II) for a two-year, renewable appointment for its Nutrition, Diets and Health Unit. This position is based at IFPRI headquarters located in Washington, D.C but would involve travel to any of the countries in which IFPRI carries out its research. The SRF I/II would manage complex, multi-partner surveys and evaluations, mentor junior research staff, lead the development of new research activities, including developing proposals for the evaluation of multisectoral programs and food systems approaches to improving diet, nutrition and health outcomes in low- and middle-income countries. In addition, the SRF I/II would lead research activities related to the CGIAR Research Initiative on Fruit and Vegetables for Sustainable Healthy Diets (FRESH) which would include leading the co-development of programmatic activities (with program implementation partners) to increase intake of fruit and vegetables. Essential Duties:   Specific duties include but are not limited to: Conducting research related to diets, nutrition, health, and well-being in low-and middle-income countries and the impact of multisectoral programs and/or food systems approaches on these types of outcomes.  Developing and managing large/complex research projects and/or programs including developing workplans, coordinating research activities, monitoring and reporting on progress and sharing research findings with diverse audiences.  Design and supervise large-scale data collection activities such as household surveys, food environment surveys, dietary assessment surveys and nutritional status assessments.   Supervising the work of various research support staff and providing professional mentoring to others.  As part of multisectoral program and/or food systems evaluation activities, work closely with program implementation partners and other key stakeholders, to identify and oversee the design of programmatic activities to address constraints to sustainable, healthy diets. Recruiting and managing national collaborators. Developing and monitoring of the project or program budget. Publishing research in peer-reviewed publications. Providing strong research leadership in developing new ideas into proposals. Preparing donor and other project/program reports. Liaising with donor & senior government and other types of stakeholders on projects Communicating research to a broad spectrum of stakeholders (researchers, academicians, policy makers, local partners. Required Qualifications: At the Senior Research Fellow I level:  PhD in Nutrition, Public Health, Epidemiology, International Development, or closely related field and a minimum of 7 years of post-PhD experience. At the Senior Research Fellow II level:  PhD in Nutrition, Public Health, Epidemiology, International Development, or closely related field and a minimum of 10 years of post-PhD experience Major external recognition within peer professional network due to publications and other leaderships activities. Extensive publication record in peer-reviewed journals. Strong skills in quantitative data analysis Demonstrated ability to perform critical analyses of own & others’ research.  Sustained and consistent excellent publications record in peer-reviewed journals.  Demonstrated leadership skills and strong experience building and managing teams. Demonstrated leadership in developing global research programs with policy recommendations. Demonstrated experience in effective interactions in a multicultural setting with other researchers and with policymakers, donors, and civil society, facilitating impact of research & capacity strengthening. The ability to effectively contribute to IFPRI’s overall institutional value through demonstrated participation and support for organization-wide programs and activities. Willingness to travel extensively as required. Excellent written and spoken English communication skills with demonstrated excellence in written and oral presentations. Demonstrated computer literacy (PC and Microsoft Applications).  Proven record of fundraising success for broad and complex programs and projects. Preferred Qualifications: Proficiency in a second language of the U.N. system Dietary assessment and analysis expertise Experience with qualitative assessment methods and associated analytic techniques and software. Physical Demand and Work Environment: Employee will sit in an upright position for a long period of time.  Employee will lift between 0-10 pounds.  Employee is required to have close visual acuity to perform activities such as: preparing and analyzing data and figures; transcribing; viewing computer terminal; extensive reading. Salary Range : The expected salary ranges for this job requisition are between 24 R : $135,400 -  $169,300 ; 25 R: $159,800 -  $199,700 .  In determining your salary, we will consider your experience and other job-related factors. Benefits IFPRI is committed to providing our staff members with valuable and competitive benefits, as it is a core part of providing a strong overall employee experience. This position is eligible for health insurance coverage and a  summary of our benefits can be found on our website . Please note that the listed benefits are generally available to active, non-temporary, full-time and part-time US based employees who work at least 25 hours per week. The International Food Policy Research Institute (IFPRI) is an equal employment opportunity employer - F/M/Disability/Vet/Sexual Orientation/Gender Identity.




ea

Associate Research Fellow / Research Fellow

Job Summary The International Food Policy Research Institute (IFPRI) seeks a qualified candidate to serve as an Associate Research Fellow or Research Fellow. This is a two-year, renewable, exempt appointment based at IFPRI’s Washington, DC Office.  The ideal candidate will have demonstrated aptitude with modeling water resources and hydrologic systems at multiple scales, experience in developing and operating modeling suites that link biophysical and economic models, and interest/experience in the analysis of risk and uncertainty. The successful candidate will work on interdisciplinary teams to conduct research, produce high-impact publications and disseminate knowledge that (for example): assists national level policy-making units confront the challenges posed by climate change and water constraints; fosters regional strategies for resilient growth and development in a context of climate change; works with CGIAR partners on research and/or model development, particularly in IWMI; and assists key agri-food system actors in low- and middle-income countries (LMICs) and other constituencies in the formation of investment plans in water resources, including in relation to food and energy. Specific areas of research are expected to be developed in accordance with the intersection of the interests and skills of the successful candidate and the objectives of the Foresight and Policy Modeling Unit. It is anticipated that about 80 percent of the job will be dedicated to applied research, and the remaining 20 percent will be allocated to capacity-building, policy engagement, and outreach activities supporting evidence-based decision-making. Essential Duties  Specific duties include but are not limited to:  ·          Lead development, maintenance, and improvement of IFPRI’s water data and modeling systems compatible with global (IMPACT) and national levels (RIAPA). ·          Contribute to scenario development, modeling and analytics supporting a variety of foresight-related research projects. ·          Lead focused studies on water-related issues relevant for food system transformation globally and in LMICs. ·          Work with other modelers in the Foresight and Policy Modeling unit to maintain and improve water modeling components of established modeling frameworks. ·          Conduct research in the service of the CGIAR’s mission to advance positive transformation of food, land, and water systems. ·          Support efforts to strengthen the capacity of partner organizations and networks to conduct scholarly research and communicate evidence-based policy recommendations. ·          Prepare project reports, research papers, presentations, and peer-reviewed journal articles in collaboration with CGIAR researchers, other collaborators, and partners. ·          Regularly communicate research outputs via policy seminars, policy briefs, and peer-reviewed publications to a broad spectrum of stakeholders, including researchers, academics, policymakers, and government officials. ·          The successful candidate will work with a multi-disciplinary and multi-cultural team of researchers and is expected to engage in a broad range of research projects and activities consistent with the research program of the Foresight and Policy Modeling Unit. Required Qualifications ·          PhD in Water Resources Engineering, Hydrology, or closely related field ·          Significant expertise in using water resources systems and hydrologic models and experience or interest to link these to economic and other simulation models at global, regional and national levels to evaluate policies related to food, land, and water systems. ·          Demonstrated capabilities in quantitative analysis and ability to use spatial data and methods in innovative and policy-relevant ways to examine water resource management issues in the context of climate change and other major drivers. ·          Ability or willingness to work in the GAMS modeling environment and code, other math/statistical programming languages, and GIS. ·          Experience using river basin modeling tools, (e.g. Mike Hydro Basin, WEAP, and Riverware). ·          Strong interpersonal skills and ability to work well both with a team and independently. ·          Ability to work in a dynamic environment, take initiatives to resolve issues and effectively work with minimal supervision. ·          Excellent written and verbal communication skills in English. ·          Willingness to travel extensively (including internationally) as required. Preferred Qualifications ·          Ability to work in Python. ·          Relevant research experience as applied to LMIC country contexts in Africa, Asia, and/or Latin America. ·          Demonstrated ability to produce high-quality written reports, oral presentations, blog posts, and/or other forms of written and oral communications associated with scholarly research outputs. Additional requirements at the Research Fellow level ·          At least 3 years of post-PhD experience relevant to the job and demonstrated fundraising experience. ·          Strong publication record in peer-reviewed journals. ·          Major external recognition within professional peer network based on publications and other leadership activities. ·          Demonstrated leadership skills and successful experience building and managing teams. Physical Demand & Work environment ·          Employee will sit in an upright position for a long period of time ·          Employee will lift between 0-10 pounds. ·          Employee is required to have close visual acuity to perform activities such as: preparing and analyzing data and figures; transcribing; viewing computer terminal; extensive reading. Salary Range :  The expected salary range for this job requisition is between $85,600 - $107,000. In determining your salary, we will consider your experience and other job-related factors. Benefits : IFPRI is committed to providing our staff members with valuable and competitive benefits, as it is a core part of providing strong overall employee experience. This position is eligible for health insurance coverage and a summary of our benefits  can be found on our website . Please note that the listed benefits are generally available to active, non-temporary, full-time and part-time US-based employees who work at least 25 hours per week. The International Food Policy Research Institute (IFPRI) is an equal employment opportunity employer - F/M/Disability/Vet/Sexual Orientation/Gender Identity.    




ea

Research Analyst I

Job Summary The International Food Policy Research Institute (IFPRI) seeks a qualified candidate to serve as a Research Analyst in its Development Strategies and Governance Unit (DSG). This is one-year, non-renewable appointment based in Yangon, Myanmar, and may include travel and extended stays in different parts of rural Myanmar. The successful candidate will work on several research projects, involving household survey data collection and analysis. Interested applicants must be authorized to work in Myanmar. Essential Duties: Specific Duties include but are not limited to: Collection, cleaning, and analysis of primary and secondary data Assist in handling household survey data (including survey design, sampling & questionnaire) Assist with development of research instruments and analytical tools Conduct data analysis, statistical analysis, econometric analysis Conduct literature reviews & synthesis Contribute to the writing of discussion papers, donor reports, and other scholarly publications. Coordinate field implementation of survey activities (scoping, pretesting, training survey enumerators, etc.) Prepare large datasets for public access Develop data documentation manuals or other learning materials, as needed Help develop & coordinate technical workshops Interact with collaborators and project partners. Other duties as assigned Required Qualifications: Bachelors degree in Economics, Agricultural Economics, International Development or related field plus two years of professional experience or a Master’s degree in a relevant discipline. Experienced in conducting literature reviews of academic publications, research reports, etc. Demonstrated experience in coordinating activities in the field. Demonstrated experience in effective interaction and coordination with collaborators and project partners. Demonstrated experience working with large quantitative data sets (data cleaning, management, analysis, etc.) Demonstrated ability to perform in-depth statistical analysis and report the results. Demonstrated fluency in written and spoken English and Myanmar language. Proficiency with Microsoft Office (Word, Excel, PowerPoint, Outlook) Excellent interpersonal skills and to work in a team-oriented multi-cultural environment. Demonstrated ability to multi-task as needed, consistently meet deadlines and manage time well Demonstrated professional level of attention to detail and accuracy of work. Ability to work independently, with initiative and minimal supervision. Ability to travel. Preferred Qualifications: Skilled in programming in Stata and in managing household databases. Excellent econometric skills on cross-section and panel data analysis. Experience with data entry and CAPI software packages. Proficiency in Shan, Karen, Kachin, Chin, and/or Mon language. Physical Demand & Work environment: Employee will seat in an upright position for a long period of time. Employee will lift between 0-10 pounds. Employee is required to have close visual acuity to perform activity such as: preparing and analyzing data and figures; transcribing; viewing computer terminal; extensive reading.




ea

Senior Research Coordinator I

Job Summary: The International Food Policy Research Institute (IFPRI) seeks a qualified candidate to fill the position of Senior Research Coordinator for a 2-year, exempt appointment. This position will be based at IFPRI’s office in Lilongwe, Malawi. The Senior Research Coordinator will play a leading role in developing and implementing policy research and engagement strategies, as well as capacity strengthening. Essential Duties: Specific duties and responsibilities include but are not limited to: Policy engagement/influence and capacity strengthening ·          Lead efforts of IFPRI to promote evidence-based policy planning and implementation in Malawi, including the promotion of policy dialogue and mutual learning. ·          Engage with other relevant continental and regional processes to seek opportunities for influencing and strengthening policy processes in Malawi. ·          Strengthen leadership and develop policymaking capacity in Malawi. ·          Develop and strengthen links between IFPRI and Malawi’s relevant Ministries, Departments and Agencies (MDAs). ·          Represent IFPRI in regional meetings and interactions. ·          Develop new partnerships with strategic partners, as and when appropriate. ·          Engage at international level with relevant platforms and processes.   Research development, facilitation and management ·          Develop, implement and manage programs of research at IFPRI in Malawi. ·          Liaise with IFPRI partner organizations to ensure the policy workstream is responsive and complementary to other work streams. ·          Identify funding opportunities for proposals for policy-relevant research. ·          Develop new policy-relevant research to address knowledge gaps/research needs that exist, or emerge. ·          Link with platforms and initiatives to harmonize and strengthen research plans and outputs. ·          Link to and collaborate with (as appropriate) other external partners and stakeholders. ·          Support the dissemination and publication of research results in policy briefs and other targeted publications. ·          Support the Malawi Country Program Leader in internal and external (including donor) reporting and proposal development.   Required Qualifications: ·          PhD plus 5 years’ experience in public policy, economics, political science or quantitative social science. Strong track record of policy research and engagement, and a strong understanding of development policies and practice. Specific experience in Malawi is an advantage. ·          Experience in cross-sectoral policy engagement on agricultural commercialization, urbanization and rural transformation.   ·          Demonstrated leadership and experience in effective interactions in a multicultural and international development setting with other researchers and with policymakers, donors, and civil society in Africa, and preferably in Malawi, facilitating impact of research and capacity strengthening. Experience with CGIAR institutions is desirable. ·          Experience with development of capacity strengthening strategies and programs in Africa, and preferably in Malawi. ·          Major external recognition within peer professional network ·          Willingness to travel extensively as required ·          Excellent written and spoken English communication skills with demonstrated excellence in written and oral presentations. Knowledge of Chichewa is an advantage. ·          Demonstrated leadership skills and strong experience in working in and influencing development institutions. ·          Demonstrated ability to critically assess own and others’ research Physical Demand & Work environment: ·          Employee will sit in an upright position for a long period of time with little opportunity to move/stretch ·          Employee will lift between 0-10pounds ·          Employee is required to have close visual acuity to perform activities such as: preparing and analyzing data and figures; transcribing; viewing computer terminal; extensive reading   Salary Range : The expected salary range for this job requisition is between $115,800 - $144,800. In determining your salary, we will consider your experience and other job-related factors. Benefits : IFPRI is committed to providing our staff members with valuable and competitive benefits, as it is a core part of providing a strong overall employee experience. This position is eligible for health insurance coverage and a summary of our benefits  can be found on our website . Please note that the listed benefits are generally available to active, non-temporary, full-time and part-time US-based employees who work at least 25 hours per week. The International Food Policy Research Institute (IFPRI) is an equal employment opportunity employer - F/M/Disability/Vet/Sexual Orientation/Gender Identity.




ea

Share your experiences to create some SpotOn social media tips for scientists!

It ain’t a party if you can’t join us Towards the end of April, SpotOn




ea

Measures for Advancing Gender Equality (MAGNET) Website




ea

Against the grain: Could farmers feed the world and heal the planet?




ea

Agronomy & Policy Solutions for Implementation of the African Fertilizer and Soil Health Action Plan




ea

Supporting and shaping the global nutrition agenda with evidence: A three-decade journey of resea…




ea

From Bugs to Breaches: 25 Significant CVEs As MITRE CVE Turns 25

Twenty five years after the launch of CVE, the Tenable Security Response Team has handpicked 25 vulnerabilities that stand out for their significance.

Background

In January 1999, David E. Mann and Steven M. Christey published the paper “Towards a Common Enumeration of Vulnerabilities” describing an effort to create interoperability between multiple vulnerability databases. To achieve a common taxonomy for vulnerabilities and exposures, they proposed Common Vulnerabilities and Exposures (CVE). In September 1999, the MITRE Corporation finalized the first CVE list, which included 321 records. CVE was revealed to the world the following month.

As of October 2024, there are over 240,000 CVEs. including many that have significantly impacted consumers, businesses and governments. The Tenable Security Response Team has chosen to highlight the following 25 significant vulnerabilities, followed by links to product coverage for Tenable customers to utilize.

25 Significant CVEs

CVE-1999-0211: SunOS Arbitrary Read/Write Vulnerability

Arbitrary ReadArbitrary WriteLocalCritical1999Why it’s significant: To our knowledge, there is no formally recognized “first CVE.” However, the GitHub repository for CVE.org shows that the first CVE submitted was CVE-1999-0211 on September 29, 1999 at 12:00AM. Because it was the first one, we’ve chosen to highlight it. The vulnerability was first identified in 1991 and a revised patch was issued in 1994.

CVE-2010-2568: Windows Shell Remote Code Execution Vulnerability

Remote Code ExecutionExploitedZero-DayLocalStuxnetHigh2010Why it’s significant: Regarded as one of the most sophisticated cyberespionage tools ever created, Stuxnet was designed to target SCADA systems in industrial environments to reportedly sabotage Iran's nuclear program. Stuxnet exploited CVE-2010-2568 as one of its initial infection vectors, spreading via removable drives. Once a compromised USB drive was inserted into a system, Stuxnet was executed automatically via the vulnerability, infecting the host machine, propagating to other systems through network shares and additional USB drives.

CVE-2014-0160: OpenSSL Information Disclosure Vulnerability

HeartbleedInformation DisclosureExploitedZero-DayNetworkCybercriminalsHigh2014Why it’s significant: Dubbed “Heartbleed” because it was found in the Heartbeat extension of OpenSSL, this vulnerability allows an attacker, without prior authentication, to send a malicious heartbeat request with a false length field, claiming the packet contains more data than it does. The receiving system would then return data from its memory extending beyond the legitimate request, which may include sensitive private data, such as server keys and user credentials. OpenSSL is used by millions of websites, cloud services, and even VPN software, for encryption, making Heartbleed one of the most widespread vulnerabilities at the time.

CVE-2014-6271: GNU Bash Shellshock Remote Code Execution Vulnerability

Shellshock Bash Bug Remote Code ExecutionExploitedZero-DayNetworkCybercriminalsCritical2014Why it’s significant: An attacker could craft an environment variable that contained both a function definition and additional malicious code. When Bash, a command interpreter used by Unix-based systems including Linux and macOS, processed this variable, it would execute the function, but also run the arbitrary commands appended after the function definition. “Shellshock” quickly became one of the most severe vulnerabilities discovered, comparable to Heartbleed’s potential impact. Attackers could exploit Shellshock to gain full control of vulnerable systems, leading to data breaches, service interruptions and malware deployment. The impact extended far beyond local systems. Bash is used by numerous services, particularly web servers, via CGI scripts to handle HTTP requests.

CVE-2015-5119: Adobe Flash Player Use After Free

Remote Code Execution Denial-of-ServiceExploitedZero-DayCybercriminalsAPT GroupsCritical2015Why it’s significant: Discovered during the Hacking Team data breach, it was quickly weaponized, appearing in multiple exploit kits. CVE-2015-5119 is a use-after-free flaw in Flash’s ActionScript ByteArray class, allowing attackers to execute arbitrary code by tricking users into visiting a compromised website. It was quickly integrated into attack frameworks used by Advanced Persistent Threat (APT) groups like APT3, APT18, and Fancy Bear (APT28). These groups, with ties to China and Russia, used the vulnerability to spy on and steal data from governments and corporations. Fancy Bear has been associated with nation-state cyber warfare, exploiting Flash vulnerabilities for political and military intelligence information gathering​. This flaw, along with several other Flash vulnerabilities, highlighted Flash’s risks, accelerating its eventual phase-out.

CVE-2017-11882: Microsoft Office Equation Editor Remote Code Execution Vulnerability

Remote Code ExecutionExploitedNetworkCybercriminalsAPT GroupsHigh2017Why it’s significant: The vulnerability existed for 17 years in Equation Editor (EQNEDT32.EXE), a Microsoft Office legacy component used to insert and edit complex mathematical equations within documents. Once CVE-2017-11882 became public, cybercriminals and APT groups included it in maliciously crafted Office files. It became one of 2018’s most exploited vulnerabilities and continues to be utilized by various threat actors including SideWinder.

CVE-2017-0144: Windows SMB Remote Code Execution Vulnerability

EternalBlueRemote Code ExecutionExploitedNetworkWannaCry NotPetyaHigh2017Why it’s significant: CVE-2017-0144 was discovered by the National Security Agency (NSA) and leaked by a hacker group known as Shadow Brokers, making it widely accessible. Dubbed “EternalBlue,” its capacity to propagate laterally through networks, often infecting unpatched machines without human interaction, made it highly dangerous. It was weaponized in the WannaCry ransomware attack in May 2017 and spread globally. It was reused by NotPetya, a data-destroying wiper originally disguised as ransomware. NotPetya targeted companies in Ukraine before spreading worldwide. This made it one of history’s costliest cyberattacks.

CVE-2017-5638: Apache Struts 2 Jakarta Multipart Parser Remote Code Execution Vulnerability

Remote Code ExecutionExploitedNetworkEquifax BreachCritical2017Why it’s significant: This vulnerability affects the Jakarta Multipart Parser in Apache Struts 2, a popular framework for building Java web applications. An attacker can exploit it by injecting malicious code into HTTP headers during file uploads, resulting in remote code execution (RCE), giving attackers control of the web server. CVE-2017-5638 was used in the Equifax breach, where personal and financial data of 147 million people was stolen, emphasizing the importance of patching widely-used frameworks, particularly in enterprise environments, to prevent catastrophic data breaches.

CVE-2019-0708: Remote Desktop Services Remote Code Execution Vulnerability

BlueKeep DejaBlue Remote Code ExecutionExploitedNetworkRansomware GroupsCybercriminalsCritical2019Why it’s significant: Dubbed "BlueKeep," this vulnerability in Windows Remote Desktop Services (RDS) was significant for its potential for widespread, self-propagating attacks, similar to the infamous WannaCry ransomware. An attacker could exploit this flaw to execute arbitrary code and take full control of a machine through Remote Desktop Protocol (RDP), a common method for remote administration. BlueKeep was featured in the Top Routinely Exploited Vulnerabilities list in 2022 and was exploited by affiliates of the LockBit ransomware group.

CVE-2020-0796: Windows SMBv3 Client/Server Remote Code Execution Vulnerability

SMBGhost EternalDarknessRemote Code ExecutionExploited NetworkCybercriminalsRansomware GroupsCritical2020Why it’s significant: Its discovery evoked memories of EternalBlue because of the potential for it to be wormable, which is what led to it becoming a named vulnerability. Researchers found it trivial to identify the flaw and develop proof-of-concept (PoC) exploits for it. It was exploited in the wild by cybercriminals, including the Conti ransomware group and its affiliates.

CVE-2019-19781: Citrix ADC and Gateway Remote Code Execution Vulnerability

Path TraversalExploitedNetworkAPT GroupsRansomware GroupsCybercriminalsCritical2019Why it’s significant: This vulnerability in Citrix Application Delivery Controller (ADC) and Citrix Gateway is significant due to its rapid exploitation by multiple threat actors, including state-sponsored groups and ransomware affiliates. By sending crafted HTTP requests, attackers could gain RCE and take full control of affected devices to install malware or steal data. The vulnerability remained unpatched for a month after its disclosure, leading to widespread exploitation. Unpatched systems are still being targeted today, highlighting the risk of ignoring known vulnerabilities.

CVE-2019-10149: Exim Remote Command Execution Vulnerability

Remote Command ExecutionExploitedNetworkAPT GroupsCybercriminalsCritical2019Why it’s significant: This vulnerability in Exim, a popular Mail Transfer Agent, allows attackers to execute arbitrary commands with root privileges simply by sending a specially crafted email. The availability of public exploits led to widespread scanning and exploitation of vulnerable Exim servers, with attackers using compromised systems to install cryptocurrency miners (cryptominers), launch internal attacks or establish persistent backdoors. The NSA warned that state-sponsored actors were actively exploiting this flaw to compromise email servers and gather sensitive information.

CVE-2020-1472: Netlogon Elevation of Privilege Vulnerability

ZerologonElevation of PrivilegeExploitedLocalRansomware GroupsAPT GroupsCybercriminalsCritical2020Why it’s significant: This vulnerability in the Netlogon Remote Protocol (MS-NRPC) allows attackers with network access to a Windows domain controller to reset its password, enabling them to impersonate the domain controller and potentially take over the entire domain. Its severity was underscored when Microsoft reported active exploitation less than two months after disclosure and the Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency directive to patch the flaw. Despite available patches, it continues to be exploited by ransomware groups, APT groups, and others, highlighting its broad and ongoing impact on network security.

CVE-2017-5753: CPU Speculative Execution Bounds Check Bypass Vulnerability

SpectreSpeculative Execution Bounds Check BypassLocalMedium2018Why it’s significant: In a speculative execution process, an idle microprocessor waiting to receive data speculates what the next instruction might be. Although meant to enhance performance, this process became a fundamental design flaw affecting the security of numerous modern processors. In Spectre’s case, an attacker-controlled process could read arbitrary memory belonging to another process. Since its discovery in January 2018, Spectre has affected nearly all modern processors from Intel, AMD and ARM. While it’s difficult to execute a successful Spectre attack, fully remediating the root cause is hard and requires microcode as well as operating system updates to mitigate the risk.

CVE-2017-5754: CPU Speculative Execution Rogue Data Cache Load Vulnerability

MeltdownSpeculative Execution Rogue Data Cache LoadLocalHigh2018Why it’s significant: Meltdown, another speculative execution vulnerability released alongside Spectre, can allow a userspace program to read privileged kernel memory. It exploits a race condition between the memory access and privilege checking while speculatively executing instructions. Meltdown impacts desktop, laptop and cloud systems and, according to researchers, may affect nearly every Intel processor released since 1995. With a wide reaching impact, both Spectre and Meltdown sparked major interest in a largely unexplored security area. The result: a slew of research and vulnerability discoveries, many of which were also given names and logos. While there’s no evidence of a successful Meltdown exploit, the discovery showcased the risk of security boundaries enforced by hardware.

CVE-2021-36942: Windows LSA Spoofing Vulnerability

PetitPotamSpoofingExploitedZero-DayNetworkRansomware GroupsHigh2021Why it’s significant: This vulnerability can force domain controllers to authenticate to an attacker-controlled destination. Shortly after a PoC was disclosed, it was adopted by ransomware groups like LockFile, which have chained Microsoft Exchange vulnerabilities with PetitPotam to take over domain controllers. Patched in the August 2021 Patch Tuesday release, the initial patch for CVE-2021-36942 only partially mitigated the issue, with Microsoft pushing general mitigation guidance for defending against NTLM Relay Attacks.

CVE-2022-30190: Microsoft Windows Support Diagnostic Tool Remote Code Execution

FollinaRemote Code ExecutionExploitedZero-DayLocalQakbot RemcosHigh2022Why it’s significant: Follina, a zero-day RCE vulnerability in MSDT impacting several versions of Microsoft Office, was later designated CVE-2022-30190. After public disclosure in May 2022, Microsoft patched Follina in the June 2022 Patch Tuesday. After disclosure, reports suggested that Microsoft dismissed the flaw’s initial disclosure as early as April 2022. Follina has been widely adopted by threat actors and was associated with some of 2021’s top malware strains in a joint cybersecurity advisory from CISA and the Australian Cyber Security Centre (ACSC), operating under the Australian Signals Directorate (ASD).

CVE-2021-44228: Apache Log4j Remote Code Execution Vulnerability

Log4ShellRemote Code ExecutionExploitedNetworkCybercriminalsAPT GroupsCritical2021Why it’s significant: Log4j, a Java logging library widely used across many products and services, created a large attack surface. The discovery of CVE-2021-44228, dubbed “Log4Shell,” caused great concern, as exploitation simply requires sending a specially crafted request to a server running a vulnerable version of Log4j. After its disclosure, Log4Shell was exploited in attacks by cryptominers, DDoS botnets, ransomware groups and APT groups including those affiliated with the Iranian Islamic Revolutionary Guard Corps (IRGC).

CVE-2021-26855: Microsoft Exchange Server Server-Side Request Forgery Vulnerability

ProxyLogonServer-Side Request Forgery (SSRF)ExploitedZero-DayNetworkAPT Groups Ransomware GroupsCybercriminalsCritical2021Why it’s significant: CVE-2021-26855 was discovered as a zero-day along with four other vulnerabilities in Microsoft Exchange Server. It was exploited by a nation-state threat actor dubbed HAFNIUM. By sending a specially crafted HTTP request to a vulnerable Exchange Server, an attacker could steal the contents of user mailboxes using ProxyLogon. Outside of HAFNIUM, ProxyLogon has been used by ransomware groups and other cybercriminals. Its discovery created a domino effect, as other Exchange Server flaws, including ProxyShell and ProxyNotShell, were discovered, disclosed and subsequently exploited by attackers.

CVE-2021-34527: Microsoft Windows Print Spooler Remote Code Execution Vulnerability

PrintNightmareRemote Code ExecutionExploitedLocalAPT GroupsRansomware GroupsCybercriminalsHigh2021Why it’s significant: This RCE in the ubiquitous Windows Print Spooler could grant authenticated attackers arbitrary code execution privileges as SYSTEM. There was confusion surrounding the disclosure of this flaw, identified as CVE-2021-34527 and dubbed “PrintNightmare.” Originally, CVE-2021-1675, disclosed in June 2021, was believed to be the real PrintNightmare. However, Microsoft noted CVE-2021-1675 is “similar but distinct” from PrintNightmare. Since its disclosure, several Print Spooler vulnerabilities were disclosed, while a variety of attackers, including the Magniber and Vice Society ransomware groups exploited PrintNightmare.

CVE-2021-27101: Accellion File Transfer Appliance (FTA) SQL Injection Vulnerability

SQL InjectionExploitedZero-DayNetworkRansomware GroupCritical2021Why it’s significant: The file transfer appliance from Accellion (now known as Kiteworks) was exploited as a zero-day by the CLOP ransomware group between December 2020 and early 2021. Mandiant, hired by Kiteworks to investigate, determined that CLOP (aka UNC2546) exploited several flaws in FTA including CVE-2021-27101. This was CLOP’s first foray into targeting file transfer solutions, as they provide an easy avenue for the exfiltration of sensitive data that can be used to facilitate extortion.

CVE-2023-34362: Progress Software MOVEit Transfer SQL Injection Vulnerability

SQL InjectionExploitedZero-DayNetworkRansomware GroupCritical2023Why it’s significant: CLOP’s targeting of file transfer solutions culminated in the discovery of CVE-2023-34362, a zero-day in Progress Software’s MOVEit Transfer, a secure managed file transfer software. CLOP targeted MOVEit in May 2023 and the ramifications are still felt today. According to research conducted by Emsisoft, 2,773 organizations have been impacted and information on over 95 million individuals has been exposed as of October 2024. This attack underscored the value in targeting file transfer solutions.

CVE-2023-4966: Citrix NetScaler and ADC Gateway Sensitive Information Disclosure Vulnerability

CitrixBleedInformation DisclosureExploitedZero-DayNetworkRansomware GroupsAPT GroupsCritical2023Why it’s significant: CVE-2023-4966, also known as “CitrixBleed,” is very simple to exploit. An unauthenticated attacker could send a specially crafted request to a vulnerable NetScaler ADC or Gateway endpoint and obtain valid session tokens from the device’s memory. These session tokens could be replayed back to bypass authentication, and would persist even after the available patches had been applied. CitrixBleed saw mass exploitation after its disclosure, and ransomware groups like LockBit 3.0 and Medusa adopted it.

CVE-2023-2868: Barracuda Email Security Gateway (ESG) Remote Command Injection Vulnerability

Remote Command InjectionExploitedZero-DayNetworkAPT GroupsCritical2023Why it’s significant: Researchers found evidence of zero-day exploitation of CVE-2023-2868 in October 2022 by the APT group UNC4841. While Barracuda released patches in May 2023, the FBI issued a flash alert in August 2023 declaring them “ineffective,” stating that “active intrusions” were being observed on patched systems. This led to Barracuda making an unprecedented recommendation for the “immediate replacement of compromised ESG appliances, regardless of patch level.”

CVE-2024-3094: XZ Utils Embedded Malicious Code Vulnerability

Embedded Malicious CodeZero-DayUnknown Threat Actor (Jia Tan)Critical2024Why it’s significant: CVE-2024-3094 is not a traditional vulnerability. It is a CVE assigned for a supply-chain backdoor discovered in XZ Utils, a compression library found in various Linux distributions. Developer Andres Freund discovered the backdoor while investigating SSH performance issues. CVE-2024-3094 highlighted a coordinated supply chain attack by an unknown individual that contributed to the XZ GitHub project for two and a half years, gaining the trust of the developer before introducing the backdoor. The outcome of this supply chain attack could have been worse were it not for Freund’s discovery.

Identifying affected systems

A list of Tenable plugins for these vulnerabilities can be found on the individual CVE pages:




ea

How To Protect Your Cloud Environments and Prevent Data Breaches

As organizations create and store more data in the cloud, security teams must ensure the data is protected from cyberthreats. Learn more about what causes data breaches and about the best practices you can adopt to secure data stored in the cloud.

With the explosion of data being generated and stored in the cloud, hackers are creating new and innovative attack techniques to gain access to cloud environments and steal data. A review of recent major data breaches shows us that data thieves are using social engineering, hunting for exposed credentials, looking for unpatched vulnerabilities and misconfigurations and employing other sophisticated techniques to breach cloud environments.

A look at recent cloud data-breach trends

Here are some takeaways from major data breaches that have occurred this year:

  • Managing the risk from your third-parties – partners, service providers, vendors – has always been critical. It’s even more so when these trusted organizations have access to your cloud environment and cloud data. You must make sure that your third-parties are using proper cloud-security protections to safeguard their access to your cloud data and to your cloud environment.
  • Secure your identities. We’ve seen major data breaches this year tracked down to simple missteps like failing to protect highly-privileged admin accounts and services with multi-factor authentication (MFA). 
  • Adopt best practices to prevent ransomware attacks, and to mitigate them if you get hit by one. Ransomware gangs know that a surefire way to pressure victims into paying ransoms is to hijack their systems and threaten to expose their sensitive data. 

So, how can you strengthen your data security posture against these types of attacks?

  1. Implement a "zero trust" security framework that requires all users, whether inside or outside the organization, to be authenticated, authorized and continuously validated before being granted or maintaining access to data. This framework should allow only time-limited access and be based on the principle of least privilege, which limits access and usage to the minimum amount of data required to perform the job.
  2. Use a cloud data security posture management (DSPM) solution to enforce the security framework through continuous monitoring, automation, prioritization and visibility. DSPM solutions can help organizations identify and prioritize data security risks based on their severity, allowing them to focus their resources on the most critical issues.
  3. Regularly conduct risk assessments to detect and remediate security risks before they can be exploited by hackers. This can help prevent data breaches and minimize the impact of any security incidents that do occur.
  4. Train employees on security best practices, including how to create strong passwords, how to identify risks and how to report suspicious activity.

By following these recommendations, organizations can significantly reduce their risk of a data breach and improve handling sensitive data belonging to their organization. As more and more data moves to the cloud and hackers become more sophisticated, it's essential to prioritize security and take proactive measures to protect against data risks. 

Learn more




ea

FY 2024 State and Local Cybersecurity Grant Program Adds CISA KEV as a Performance Measure

The CISA Known Exploited Vulnerabilities (KEV) catalog and enhanced logging guidelines are among the new measurement tools added for the 2024 State and Local Cybersecurity Grant Program.

Last month, the Department of Homeland Security announced the availability of $279.9 million in grant funding for the Fiscal Year (FY) 2024 State and Local Cybersecurity Grant Program (SLCGP). Now in its third year, the four-year, $1 billion program provides funding for State, Local and Territorial (SLT) governments to implement cybersecurity solutions that address the growing threats and risks to their information systems. Applications must be submitted by December 3, 2024.

While there are no significant modifications to the program for FY 2024, the Federal Emergency Management Agency (FEMA), which administers SLCGP in coordination with the Cybersecurity and Infrastructure Security Agency (CISA), identified key changes, some of which we highlight below:

The FY 2024 NOFO adds CISA’s KEV catalog as a new performance measure and recommended resource

The FY 2024 notice of funding opportunity (NOFO) adds the CISA Known Exploited Vulnerabilities (KEV) catalog as a recommended resource to encourage governments to regularly view information related to cybersecurity vulnerabilities confirmed by CISA, prioritizing those exploited in the wild. In addition, CISA has added “Addressing CISA-identified cybersecurity vulnerabilities” to the list of performance measures it will collect through the duration of the program.

Tenable offers fastest, broadest coverage of CISA’s KEV catalog

At Tenable, our goal is to help organizations identify their cyber exposure gaps as accurately and quickly as possible. To achieve this goal, we have research teams around the globe working to provide precise and prompt coverage for new threats as they are discovered. Tenable monitors and tracks additions to the CISA KEV catalog on a daily basis and prioritizes developing new detections where they do not already exist.

Tenable updates the KEV coverage of its vulnerability management products — Tenable Nessus, Tenable Security Center and Tenable Vulnerability Management — allowing organizations to use KEV catalog data as an additional prioritization metric when figuring out what to fix first. The ready availability of this data in Tenable products can help agencies meet the SLCGP performance measures. This blog offers additional information on Tenable’s coverage of CISA’s KEV catalog.

FY 2024 NOFO adds “Adopting Enhanced Logging” as a new performance measure

The FY 2024 NOFO also adds “Adopting Enhanced Logging” to the list of performance measures CISA will collect throughout the program duration.

How Tenable’s library of compliance audits can help with Enhanced Logging

Tenable's library of Compliance Audits, including Center for Internet Security (CIS) and Defense Information Systems Agency (DISA), allows organizations to assess systems for compliance, including ensuring Enhanced Logging is enabled. Tenable's vulnerability management tools enable customers to easily schedule compliance scans. Users can choose from a continuously updated library of built-in audits or upload custom audits. By conducting these scans regularly, organizations can ensure their systems are secure and maintain compliance with required frameworks.

FY 2024 NOFO continues to require applicants to address program objectives in their applications

As with previous years, the FY 2024 NOFO sets four program objectives. Applicants must address at least one of the following in their applications:

  • Objective 1: Develop and establish appropriate governance structures, including by developing, implementing, or revising Cybersecurity Plans, to improve capabilities to respond to cybersecurity incidents, and ensure operations.
  • Objective 2: Understand their current cybersecurity posture and areas for improvement based on continuous testing, evaluation, and structured assessments.
  • Objective 3: Implement security protections commensurate with risk.
  • Objective 4: Ensure organization personnel are appropriately trained in cybersecurity, commensurate with responsibility.

How Tenable can help agencies meet Objective 2 of the program

Tenable is uniquely positioned to help SLTs meet Objective 2 through the Tenable One Exposure Management Platform. In addition to analyzing traditional IT environments, Tenable One analyzes cloud instances, web applications, critical infrastructure environments, identity access and privilege solutions such as Active Directory and more — including highly dynamic assets like mobile devices, virtual machines and containers. Once the complete attack surface is understood, the Tenable One platform applies a proactive risk-based approach to managing exposure, allowing SLT agencies to successfully meet each of the sub-objectives outlined in Objective 2 (see table below).

Sub-objectiveHow Tenable helps
2.1.1: Establish and regularly update asset inventoryTenable One deploys purpose-built sensors across on-premises and cloud environments to update inventories of human and machine assets, including cloud, IT, OT, IoT, mobile, applications, virtual machines, containers and identities
2.3.2. Effectively manage vulnerabilities by prioritizing mitigation of high-impact vulnerabilities and those most likely to be exploited.

Tenable One provides an accurate picture of both internal and external exposure by detecting and prioritizing a broad range of vulnerabilities, misconfiguration and excessive permissions across the attack surface.

Threat intelligence and data science from Tenable Research are then applied to give agencies easy-to-understand risk scores. For example, Tenable One provides advanced prioritization metrics and capabilities, asset exposure scores which combine total asset risk and asset criticality, cyber exposure scoring which calculates overall exposure for the organization, peer benchmarking for comparable organizations, as well as the ability to track SLAs and risk patterns over time.

Further, Tenable One provides rich critical technical context in the form of attack path analysis that maps asset, identity and risk relationships which can be exploited by attackers. It also provides business context by giving users an understanding of the potential impact on the things that matter most to an agency, such as business critical apps, services, processes and functions. These contextual views greatly improve the ability of security teams to prioritize and focus action where they can best reduce the potential for material impact. These advanced prioritization capabilities, along with mitigation guidance, ensure high-risk vulnerabilities can be addressed quickly.

2.4.1 SLT agencies are able to analyze network traffic and activity transiting or traveling to or from information systems, applications, and user accounts to understand baseline activity and identify potential threats.

Tenable provides purpose-built sensors, including a passive sensor, which can determine risk based on network traffic. After being placed on a Switched Port Analyzer (SPAN) port or network tap, the passive sensor will be able to discover new devices on a network as soon as they begin to send traffic, as well as discover vulnerabilities based on, but not limited to:

  • Services
  • User-agents
  • Application traffic
2.5.1 SLT agencies are able to respond to identified events and incidents, document root cause, and share information with partners.

Tenable One can help SLT agencies respond to identified events and incidents and document root cause more quickly. SOC analysts managing events and incidents and vulnerability analysts focused on remediation of vulnerabilities have access to deep technical content in the form of attack paths, with risk and and configuration details to verify viability, as well as business context to understand the potential impact to their agency.

This information is valuable not only to validate why IT teams should prioritize mitigation of issues before breach, but to prove that a successful attack has occurred. Further, agencies can deliver dashboards, reports and scorecards to help share important security data in meaningful ways across teams and with partners. Agencies are able to customize these to show the data that matters most and add details specific to their requirements. 

Source: Tenable, October 2024

Tenable One deployment options offer flexibility for SLT agencies

Tenable offers SLT agencies flexibility in their implementation models to help them best meet the requirements and objectives outlined as part of the SLCGP. Deployment models include:

  • Centralized risk-based vulnerability program managed by a state Department of Information Technology (DoIT)
  • Multi-entity projects
  • Decentralized deployments of Tenable One managed by individual municipalities,
  • Managed Security Service Provider (MSSP) models that allow agencies to rapidly adopt solutions by utilizing Tenable’s Technology Partner network.

Whole-of-state approach enables state-wide collaboration and cooperation

A “whole-of-state” approach — which enables state-wide collaboration to improve the cybersecurity posture of all stakeholders — allows state governments to share resources to support cybersecurity programs for local government entities, educational institutions and other organizations. Shared resources increase the level of defense for SLTs both individually and as a community and reduce duplication of work and effort. States get real-time visibility into all threats and deploy a standard strategy and toolset to improve cyber hygiene, accelerate incident response and reduce statewide risk. For more information, read Protecting Local Government Agencies with a Whole-of-State Cybersecurity Approach.

FY 2024 NOFO advises SLT agencies to adopt key cybersecurity best practices

As in previous years, the FY 2024 NOFO again recommends SLT agencies adopt key cybersecurity best practices. To do this, they are required to consult the CISA Cross-Sector Cybersecurity Performance Goals (CPGs) throughout their development of plans and projects within the program. This is also a statutory requirement for receiving grant funding.

How Tenable One can help agencies meet the CISA CPGs

The CISA CPGs are a prioritized subset of cybersecurity practices aimed at meaningfully reducing risk to critical infrastructure operations and the American people. They provide a common set of IT and operational technology (OT) fundamental cybersecurity best practices to help SLT agencies address some of the most common and impactful cyber risks. Learn more about how Tenable One can help agencies meet the CISA CPGs here.

Learn more




ea

Cybersecurity Snapshot: CISA Warns of Global Spear-Phishing Threat, While OWASP Releases AI Security Resources

CISA is warning about a spear-phishing campaign that spreads malicious RDP files. Plus, OWASP is offering guidance about deepfakes and AI security. Meanwhile, cybercriminals have amplified their use of malware for fake software-update attacks. And get the latest on CISA’s international plan, Interpol’s cyber crackdown and ransomware trends.

Dive into six things that are top of mind for the week ending Nov. 8.

1 - CISA: Beware of nasty spear-phishing campaign

Proactively restrict outbound remote-desktop protocol (RDP) connections. Block transmission of RDP files via email. Prevent RDP file execution.

Those are three security measures cyber teams should proactively take in response to an ongoing and “large scale” email spear-phishing campaign targeting victims with malicious RDP files, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA).

A foreign threat actor is carrying out the campaign. Several vertical sectors, including government and IT, are being targeted.

“Once access has been gained, the threat actor may pursue additional activity, such as deploying malicious code to achieve persistent access to the target’s network,” CISA’s alert reads.
 


Other CISA recommendations include:

  • Adopt phishing-resistant multi-factor authentication (MFA), such as FIDO tokens, and try to avoid SMS-based MFA
  • Educate users on how to spot suspicious emails
  • Hunt for malicious activity in your network looking for indicators of compromise (IoCs) and tactics, techniques and procedures

Although CISA didn’t name the hacker group responsible for this campaign, its alert includes links to related articles from Microsoft and AWS that identify it as Midnight Blizzard. Also known as APT29, this group is affiliated with Russia’s government.

To get more details, check out the CISA alert “Foreign Threat Actor Conducting Large-Scale Spear-Phishing Campaign with RDP Attachments.

For more information about securing RDP tools:

2 - OWASP issues AI security resources

How should your organization respond to deepfakes? What’s the right way of establishing a center of excellence for AI security in your organization? Where can you find a comprehensive guide of tools to secure generative AI applications?

These questions are addressed in a new set of resources for AI security from the Open Worldwide Application Security Project’s OWASP Top 10 for LLM Application Security Project

The new resources are meant to help organizations securely adopt, develop and deploy LLM and generative AI systems and applications “with a comprehensive strategy encompassing governance, collaboration and practical tools,” OWASP said in a statement.



These are the new resources:

  • The Guide for Preparing and Responding to Deepfake Events,” which unpacks four types of deepfake schemes – financial fraud, job interview fraud, social engineering and misinformation – and offers guidance about each one in these areas:
    • preparation
    • detection and analysis
    • containment eradication and recovery
    • post-incident activity
  • The LLM and GenAI Center of Excellence Guide,” which aims to help CISOs and fellow organization leaders create a center of excellence for generative AI security that facilitates collaboration among various teams, including security, legal, data science and operations, so they can develop:
    • Generative AI security policies
    • Risk assessment and management processes
    • Training and awareness
    • Research and development
  • The AI Security Solution Landscape Guide,” which offers security teams a comprehensive catalog of open source and commercial tools for securing LLMs and generative AI applications.

To get more details, read OWASP’s announcement “OWASP Dramatically Expands GenAI Security Guidance.”

For more information about protecting your organization against deepfakes:

3 - Fake update variants dominate list of top malware in Q3

Hackers are doubling down on fake software-update attacks.

That’s the main takeaway from the Center for Internet Security’s list of the 10 most prevalent malware used during the third quarter.

Malware variants used to carry out fake browser-update attacks took the top four spots on the list: SocGholish, LandUpdate808, ClearFake and ZPHP. Collectively, they accounted for 77% of the quarter’s malware infections. It's the first time LandUpdate808 and ClearFake appear on this quarterly list.


(Source: “Top 10 Malware Q3 2024”, Center for Internet Security, October 2024)

In a fake software-update attack, a victim gets duped into installing a legitimate-looking update for, say, their preferred browser, that instead infects their computers with malware.

Here’s the full list, in descending order:

  • SocGholish, a downloader distributed through malicious websites that tricks users into downloading it by offering fake software updates 
  • LandUpdate808, a JavaScript downloader distributed through malicious websites via fake browser updates
  • ClearFake, another JavaScript downloader used for fake browser-update attacks
  • ZPHP, another JavaScript downloader used for fake software-update attacks
  • Agent Tesla, a remote access trojan (RAT) that captures credentials, keystrokes and screenshots
  • CoinMiner, a cryptocurrency miner that spreads using Windows Management Instrumentation (WMI)
  • Arechclient2, also known as SectopRAT, is a .NET RAT whose capabilities include multiple stealth functions
  • Mirai, a malware botnet that compromises IoT devices to launch DDoS attacks
  • NanoCore, a RAT that spreads via malspam as a malicious Excel spreadsheet
  • Lumma Stealer, an infostealer used to swipe personally identifiable information (PII), credentials, cookies and banking information

To get more information, the CIS blog “Top 10 Malware Q3 2024” offers details, context and indicators of compromise for each malware strain.

For details on fake update attacks:


VIDEO

Fake Chrome Update Malware (The PC Security Channel)

4 - CISA’s first international plan unveiled

CISA has released its first-ever international plan, which outlines a strategy for boosting the agency’s collaboration with cybersecurity agencies from other countries.

Aligning cybersecurity efforts and goals with international partners is critical for tackling cyberthreats in the U.S. and abroad, according to the agency.

The three core pillars of CISA’s “2025 - 2026 International Strategic Plan” are:

  • Help make more resilient other countries’ assets, systems and networks that impact U.S. critical infrastructure
  • Boost the integrated cyber defenses of the U.S. and its international partners against their shared global cyberthreats
  • Unify the coordination of international activities to strengthen cyberdefenses collectively

The plan will allow CISA to “reduce risk to the globally interconnected and interdependent cyber and physical infrastructure that Americans rely on every day,” CISA Director Jen Easterly said in a statement.

5 - Interpol hits phishers, ransomware gangs, info stealers

Interpol and its partners took down 22,000 malicious IP addresses and seized thousands of servers, laptops, and mobile phones used by cybercriminals to conduct phishing scams, deploy ransomware and steal information.

The four-month global operation, titled Synergia II and announced this week, involved law enforcement agencies and private-sector partners from 95 countries and netted 41 arrests.


“Together, we’ve not only dismantled malicious infrastructure but also prevented hundreds of thousands of potential victims from falling prey to cybercrime,” Neal Jetton, Director of Interpol’s Cybercrime Directorate, said in a statement.

In Hong Kong, more than 1,000 servers were taken offline, while authorities in Macau, China took another 291 servers offline. Meanwhile, in Estonia, authorities seized 80GB of server data, which is now being analyzed for links to phishing and banking malware.

For more information about global cybercrime trends:

6 - IST: Ransomware attacks surged in 2023

Ransomware gangs went into hyperdrive last year, increasing their attacks by 73% compared with 2022, according to the non-profit think tank Institute for Security and Technology (IST).

The IST attributes the sharp increase in attacks to a shift by ransomware groups to “big game hunting” – going after prominent, large organizations with deep pockets. 

“Available evidence suggests that government and industry actions taken in 2023 were not enough to significantly reduce the profitability of the ransomware model,” reads an IST blog.

Global Ransomware Incidents in 2023

Another takeaway: The ransomware-as-a-service (RaaS) model continued to prove extremely profitable in 2023, and it injected dynamism into the ransomware ecosystem. 

The RaaS model prompted ransomware groups “to shift allegiances, form new groups, or iterate existing variants,” the IST blog reads.

The industry sector that ransomware groups hit the hardest was construction, followed by hospitals and healthcare, and by IT services and consulting. Financial services and law offices rounded out the top five.

To learn more about ransomware trends:




ea

Social Media for Science Outreach – A Case Study: Career changing and pseudonyms

To tie in with this month’s SoNYC birthday celebrations, we are hosting a collection of case




ea

Social Media for Science Outreach – A Case Study: Marine Science & Conservation Outreach

A twitter TeachIn about marine protected areas, hosted by @RJ_Dunlap on 4/8/2013




ea

Social Media for Science Outreach – A Case Study: The Beagle Project, Galapagos Live & ISS Wave

Selected responses categorized into 'helped', 'helped and harmed' and 'harmed'.




ea

Social Media for Science Outreach – A Case Study: AntarcticGlaciers.org

To tie in with this month’s SoNYC birthday celebrations, we are hosting a collection of case




ea

Social Media for Science Outreach – A Case Study: Chemicals Are Your Friends

To tie in with this month’s SoNYC birthday celebrations, we are hosting a collection of case




ea

Social Media for Science Outreach – A Case Study: National Science Foundation-funded IGERT project team

To tie in with this month’s SoNYC birthday celebrations, we are hosting a collection of case




ea

Social Media for Science Outreach – A Case Study: TEDMED Great Challenges

To tie in with this month’s SoNYC birthday celebrations, we are hosting a collection of case




ea

Social Media for Science Outreach – A Case Study: Lessons From a Campaign Twitter Account

James King is a geomorphologist interested in exploring the processes that govern sediment transport and




ea

OSC publishes gamification research and launches new trading simulation tool for Investor Education Month

TORONTO – The Ontario Securities Commission (OSC) today released a new report that studied the impact of gamification on investors.




ea

OSC releases 2024 Investment Fund Survey Data Dashboard

TORONTO - The Ontario Securities Commission (OSC) is pleased to announce the release of the 2024 Investment Fund Survey (IFS) data dashboard.




ea

OSC study finds ESG ratings greatly influence investor decisions but are difficult to understand

TORONTO – The Ontario Securities Commission (OSC) today released the results of a study examining the influence of environmental, social and governance (ESG) factors on retail investor decision making.




ea

SpotOn London 2012: My not-so-secret-anymore double life: Juggling research and science communication

Dr Anne Osterrieder is a Research and Science Communication Fellow in Plant Cell Biology at the Department of




ea

SpotOn London 2012 Storify: ORCID – why do we need a unique researcher ID?

Here is a Storify round up of the SpotOn London session: ORCID – why do we




ea

SpotOn London 2012 Storify: Tackling the terabyte: how should research adapt to the era of big data?

Here is a Storify round up of the SpotOn London session: Tackling the terabyte: how should




ea

SpotOn London 2013 – draft programme: Outreach track

As we’re getting ready to make tickets available for this year’s SpotOn London conference, we’re




ea

SpotOn London 2013: Public Health Links, Lost in Translation

Damian Pattinson (@damianpattinson) is a co-organiser of the session on Public Health Links, Lost in Translation at




ea

Outcast. Volume 1, A darkness surrounds him / Robert Kirkman, creator, writer ; Paul Azaceta, artist ; Elizabeth Breitweiser, colorist ; Rus Wooton, letterer.

Kyle Barnes has been plagued by demonic possession all his life and now he needs answers. Unfortunately, what he uncovers along the way could bring about the end of life on Earth as we know it.




ea

Outcast. Volume 3, This little light / Robert Kirkman, creator, writer ; Paul Azaceta, artist ; Elizabeth Breitweiser, colorist ; Rus Wooton, Letterer ; Sean Mackiewicz, editor.

"Kyle is faced with the most emotional exorcism he's performed yet … as he begins to learn more about his abilities and what's really happening around him. The pieces are starting to fall into place as secrets are revealed that will change everything." -- Description provided by publisher.




ea

Outcast. Volume 2, A vast and unending ruin / Robert Kirkman, creator, writer ; Paul Azaceta, artist ; Elizabeth Breitweiser, colorist ; Rus Wooton, letterer.

Kyle Barnes has been plagued by demonic possession all his life. In light of recent revelations, he finally feels like he's starting to piece together the answers he's looking for. But while he feels a new sense of purpose is Reverend Anderson's life falling apart?




ea

Outcast. Volume 4, Under Devil's wing / Robert Kirkman, creator, writer ; Paul Azaceta, artist ; Elizabeth Breitweiser, colorist ; Rus Wooton, letterer.

"Answers are given, secrets are revealed, and the Barnes family has never been in more danger. Allison learns that there's something very special about her daughter, bu where's Kyle? Will Anderson risk everything to save him?' -- Page 4 of cover.