Dozens of tech firms have volunteered to sign a secure-by-design pledge endorsed by the Cybersecurity and Infrastructure Security Agency (CISA), according to CIO Dive.

Companies that have signed on to the CISA initiative include Amazon Web Services, Google, and Microsoft, as well as a large number of cybersecurity firms. The Register reported the signatories announced their commitment at the RSA Conference 2024, with the expectation being that the 68 companies will share their progress on the pledge at the 2025 edition of the conference.

The pledge is entirely voluntary, isn’t legally binding, and CISA has no enforcement mechanism if the firms don’t follow through. Still, it includes a wide range of best practices signatories agree to adopt. Those include expanding multi-factor authentication across their products, reducing the use of default passwords, and demonstrating “actions taken toward enabling a significant measurable reduction of one or more vulnerability classes,” according to the text of the pledge.

Read more here.—TM

Do you work in IT or have information about your IT department you want to share? Email [email protected]. Want to go encrypted? Ask Tom for his Signal.

Ready to put your IT skills to the test? Enter the Server Room of Doom to experience secret traps, pits of despair, and haphazard tablet storage—and the chance to discover lost treasure.

Eaton's new, exciting text-based game comes with a gauntlet of IT-inspired challenges, such as:

• server racks that need to be cooled before the walls close in
• out-of-date UPS firmware that threatens to seal you in a chamber forever

Ya know, everyday IT issues. Successful adventurers will find hidden treasure—and learn more about Eaton’s next-gen solutions. You’ll learn about its comprehensive, cross-industry ecosystem of products and solutions designed to conquer every issue in your path.

Enter here.

The Achilles’ heel of security upgrades? User resistance.

After all, security features like two-factor authentication (2FA) can introduce friction for users, who often feel the added steps interfere with their ability to do their jobs. But Microsoft-owned GitHub, the world’s largest code repository, said it was able to implement a 2FA mandate for millions of users with relatively few setbacks.

GitHub recently reported that since 2FA became required for code contributors in March 2023, around 95% of them have opted in—and 2FA opt-in has risen by 54% among all other active contributors, such as commenters.

Besides user complaints, transitions to multi-factor authentication often run into obstacles like increased workloads for IT support teams. Yet GitHub says the number of support tickets for 2FA account recovery that required “significant human intervention” have decreased since May 2023 and is now 54% lower.

Mike Hanley, GitHub’s chief security officer and SVP of engineering, explained to IT Brew the company was wary of simply imposing 2FA requirements on users and planned its rollout strategy around user engagement.

“We felt very strongly this was an opportunity to help basically raise the bar for everyone,” Hanley said.

Read more here.—TM

Do you work in IT or have information about your IT department you want to share? Email [email protected]. Want to go encrypted? Ask Tom for his Signal.

Yeah, you know Java, but do you know…Descartes?

As AI tools speed up code development (or aim to), IT bosses and directors who spoke with IT Brew are increasingly searching for more abstract skills in their coders, like a way with philosophy and anticipating user behavior.

“Building things is easy, because of the technologies that we have today. Deciding on what to build is going to become more and more important,” Sharan Gurunathan, VP of engineering for the cloud solutions group at the IT services and consulting firm Presidio, told IT Brew.

The what requires some understanding of human need, or user need, according to Gurunathan.

The code ahead. Programmers have plenty of AI options for code assistance. Amazon’s CodeWhisperer or Microsoft’s Copilot, for example, offers suggestions based on comments and existing code. The Presidio team has been experimenting with how large language models like OpenAI GPT-4, Llama, Amazon Titan, and Claude can support software development needs, like code review, Gurunathan said.

Keep reading here.—BH

Do you work in IT or have information about your IT department you want to share? Email [email protected].

Step back, get ahead. Selling intricate products and services doesn’t have to be a headache. Conga’s CPQ gives you the tools you need to automate your entire sales process—which can help you increase sales and improve your margins. Don’t settle for isolated tech and fragmented data; get connected with Conga. Start here.