
It doesn't contain data on every child in scouting, it hasn't work well enough to enter most of the details...
The Scout Association has further delayed the date for restoring its troubled Compass database, which contains the details of 450,000 young people and volunteer adults. The new live date has been tentatively set for January 2016, a year since it was originally taken down following revelations by The Register of serious …
As others have said the alternative to a central database is Scout leaders having stuff on bits of paper and local machines. Which do you think is going to be more secure?
Bad guys who are looking to exploit Scouts are going to be largely targeting local kids. Much easier to nick Skip's laptop than hack a properly implemented central database.
Assuming the central database is properly implemented.
Everybody's details are publically accessible anyway, I don't see how this database would actually be remotely useful to anyone. It seems like a bunch of paranoia over no real danger.
Why not use existing tried and tested security for accounts from google, etc. Then it is simply a matter of the right levels of compartmentalised access to known members of the organisation. This shouldn't take years to do, it is not rocket surgery.
Agreed - I think the need for the database is given away by info on their data protection/usage policy (I found it while searching for info on how to use it). Policy points out that all data is (or is meant to be) collected on the official scout info request form which includes a "I agree to my deatils being used for marketing purposes" tick box. Then the policy goes on to say that they'll clean the database by checking for duplicates, cross checking vs electoral roll, register of deaths (!) etc etc on a quartely basis (n.b. no doubt to aid this I gather the system is/was extremely picky about the address formats etc). Sounded to me like they were building up a "clean" database of address of families that they could tout to all and sundry to raise funds.
Firstly, it has to be said that the Scout Association should be commended for taking the difficult decision of pulling the plug on this, until they were sure it was secure.
However, it should never have got to this point...................
The Adult information that we required access to to ensure that adults are properly cleared and trained to take kids away and run a section night, is accessible, unfortunately we as volunteers have to go through a lengthy process to get information to which as a Group Scout Leader, I require.
So we have a long winded process of doing what we need done, the reality in a voluntary organisation is that stuff doesnt get done, unless it really has to, because of The Scout Association's incompetance on this matter.
Data wasnt stolen, but they have set our record keeping back 10+ years, well done The Scout Association, if you are going to take on a huge project, ensure that you can do it properly.
Will leasons be learnt, unfortunatley with IT and the Scouts I dont have much faith with that... But the kids will still enjoy camping. The real questions is how many leaders will leave because all they ever hear is that COMPASS is the excuse..................
Every Scout pack in my area uses OSM because it's reliable, it's secure and it does excatly what they want. Unfortunately the Scouting Association has apparently tried to ban it's use, something that smacks of a serious case of "not invented here" syndrome.
Half the problem is that everyone involved in Scouting is a volunteer....and managing all the paperwork takes far too much time.....so something online *ought* to help. Eg: tracking nights away or hikes away should run throughout a young persons life, from their first hut sleepover as a beaver to their Gold/Queens Scout Expedition within Scouting...but on paper this rarely happens.
Sadly my experience helping run an Explorer Unit of over 30 & using eDofE (online electronic DofE) tells me that the online systems simply add to the overhead of time used up.
The idea that the scoutmaster can manage subs etc easily with paper shows someone who doesn't do any of this. Try arranging a few things for a large group, with some parents who regularly forget to send little Johnny/Jessy without money for an activity, or who NEVER respond to any requests - it is laughable if it weren't so sad....
I am frankly planning my exit just due to the sheer number of hours of my time the whole thing eats up - the planning for activities, the evenings themselves, the weekend things, the management of finances and badge lists etc etc. Parents make all sorts of excuses to not help out, and don't realise WE are parents giving time up as well - it is almost as though they think we are paid resources!
So I wish good luck to the online Compass system, & I hope it doesn't contribute to others giving up their efforts!
My wife recently ran a Beaver group, which did take quite a bit of her time. She routinely mentioned that some parents just see it as cheap babysitting.
A bit more on subject, she also said that COMPASS was pretty unusable. Apparently entering the data was a bit of a struggle, but that was nothing compared to having to make any changes.
Cisco has alerted customers to another four vulnerabilities in its products, including a high-severity flaw in its email and web security appliances.
The networking giant has issued a patch for that bug, tracked as CVE-2022-20664. The flaw is present in the web management interface of Cisco's Secure Email and Web Manager and Email Security Appliance in both the virtual and hardware appliances. Some earlier versions of both products, we note, have reached end of life, and so the manufacturer won't release fixes; it instead told customers to migrate to a newer version and dump the old.
This bug received a 7.7 out of 10 CVSS severity score, and Cisco noted that its security team is not aware of any in-the-wild exploitation, so far. That said, given the speed of reverse engineering, that day is likely to come.
Analysis Under Nevada's baking summer sunshine, Snowflake last week promised it would bring together two ways of working with data that mix about as well as oil and water.
The data warehouse vendor – well known for its stratospheric $120 billion post-IPO valuation – said it would support both analytics and transactional workloads in the same system.
Launched at the Snowflake Summit 2022 in Vegas, Unistore would be the "foundation for another wave of innovation in the Snowflake Data Cloud," said Christian Kleinerman, senior vice president of product. "Similar to how we redefined data lakes and data warehouses for our customers, Unistore is ushering in a renaissance of building and deploying a new generation of applications in the Data Cloud," he said.
The UK government is upping the ante in attempts to have Arm listed on the London stock exchange, with reports suggesting it is considering the threat of national security laws to force the issue with owner SoftBank.
According to the Financial Times, the British administration is considering whether to apply the National Security and Investment Act (NSIA), which came into force at the start of the year, in a bid to have SoftBank change its mind over listing Arm exclusively on the Nasdaq in New York, as it has previously indicated.
The FT cites the usual "people familiar with the matter", who indicated there had not yet been a formal debate over using national security legislation, and the idea was opposed by some government officials.
Updated Two security vendors – Orca Security and Tenable – have accused Microsoft of unnecessarily putting customers' data and cloud environments at risk by taking far too long to fix critical vulnerabilities in Azure.
In a blog published today, Orca Security researcher Tzah Pahima claimed it took Microsoft several months to fully resolve a security flaw in Azure's Synapse Analytics that he discovered in January.
And in a separate blog published on Monday, Tenable CEO Amit Yoran called out Redmond for its lack of response to – and transparency around – two other vulnerabilities that could be exploited by anyone using Azure Synapse.
Patch Tuesday Microsoft claims to have finally fixed the Follina zero-day flaw in Windows as part of its June Patch Tuesday batch, which included security updates to address 55 vulnerabilities.
Follina, eventually acknowledged by Redmond in a security advisory last month, is the most significant of the bunch as it has already been exploited in the wild.
Criminals and snoops can abuse the remote code execution (RCE) bug, tracked as CVE-2022-30190, by crafting a file, such as a Word document, so that when opened it calls out to the Microsoft Windows Support Diagnostic Tool, which is then exploited to run malicious code, such spyware and ransomware. Disabling macros in, say, Word won't stop this from happening.
RSA Conference Your humble vulture never liked conference expos – even before finding myself on the show floor during a global pandemic. Expo halls are a necessary evil that are predominatly visited to find gifts to bring home to the kids.
Do organizations really choose security vendors based on a booth? The whole expo hall idea seems like an outdated business model – for the vendors, anyway. Although the same argument could be made for conferences in general.
For the most part, all of the executives and security researchers set up shop offsite – either in swanky hotels and shared office space (for the big-wigs) or at charming outdoor chess tables in Yerba Buena Gardens. Many of them said they avoided the expo altogether.
Updated Fifty-six vulnerabilities – some deemed critical – have been found in industrial operational technology (OT) systems from ten global manufacturers including Honeywell, Ericsson, Motorola, and Siemens, putting more than 30,000 devices worldwide at risk, according to private security researchers.
Some of these vulnerabilities received CVSS severity scores as high as 9.8 out of 10. That is particularly bad, considering these devices are used in critical infrastructure across the oil and gas, chemical, nuclear, power generation and distribution, manufacturing, water treatment and distribution, mining and building and automation industries.
The most serious security flaws include remote code execution (RCE) and firmware vulnerabilities. If exploited, these holes could potentially allow miscreants to shut down electrical and water systems, disrupt the food supply, change the ratio of ingredients to result in toxic mixtures, and … OK, you get the idea.
Analysis At MongoDB's recent conference in New York, the company demonstrated its ambition in taking on workloads from other databases.
The company has made significant inroads into the database market with a developer-friendly distributed document database to help devs build modern, web-based, transactional systems.
Time series and search have become targets, with the promise of support for secondary indexes in the former, and Search Facets to help developers build search experiences more rapidly in the latter.
1Password, the Toronto-based maker of the identically named password manager, is adding a security analysis and advice tool called Insights from 1Password to its business-oriented product.
Available to 1Password Business customers, Insights takes the form of a menu addition to the right-hand column of the application window. Clicking on the "Insights" option presents a dashboard for checking on data breaches, password health, and team usage of 1Password throughout an organization.
"We designed Insights from 1Password to give IT and security admins broader visibility into potential security risks so businesses improve their understanding of the threats posed by employee behavior, and have clear steps to mitigate those issues," said Jeff Shiner, CEO of 1Password, in a statement.
RSA Conference Exclusive Establishing some level of cybersecurity measures across all organizations will soon reach human-rights issue status, according to Jeetu Patel, Cisco EVP for security and collaboration.
"It's our civic duty to ensure that everyone below the security poverty line has a level of safety, because it's gonna eventually get to be a human-rights issue," Patel told The Register, in an exclusive interview ahead of his RSA Conference keynote.
"This is critical infrastructure — financial services, health care, transportation — services like your water supply, your power grid, all of those things can stop in an instant if there's a breach," he said.
Biting the hand that feeds IT © 1998–2022