codesanitize

java – How can I retailer a worth as world variable from an API response and go it to a different API as parameter in Cucumber function file utilizing REST assured

Software Testing

codesanitize

-

25 August 2024

I’m designing automation scripts utilizing the Cucumber BDD framework for REST APIs utilizing RestAssured. I’ve one API which generates the “Token” after which there may be one other API for order creation which requires this “Token” within the authorization parameter. Right here is my function file:

Function: Create Order API

  @Background:
  State of affairs Define: Generate Entry token With Legitimate Particulars
    Given Question param for request
      | grant_type         |
      | client_credentials |
    Given Primary Auth keys for request "" and ""
    When Construct request for baseurl "PAYPAL_BASE_URI" and endpoint "ENDPOINT_GET_AUTH_KEY"
#    And Set world "access_token" in "token"
    And Carry out "POST" request utilizing
    Then standing code is 200
    And  response incorporates "scope"
    Examples:
      | userName    | key |                                                                  
   | AWnCbuv9Bee0_6 | EMWowD696LqfznidhQ2RT_jZL2ys |

Now the response of the above API is as follows:

{
    "scope": "https://uri.pppaypal.com/providers/invoicing https://uri.pppaypal.com/providers/functions/webhooks",
    "access_token": "ALs1szFnv2TJ19Zf3vq",
    "token_type": "Bearer",
    "app_id": "APP-284543T",
    "expires_in": 311286,
    "nonce": "2022-05-31T03:41:41ZWs9dpOQ"
}

Now I want this “access_token” as within the “Create Order API” Authorization parameter with Bearer. The “Create Order API” function file is beneath:

 State of affairs: Confirm create order api utilizing legitimate auth
    Given Generate request
    And Construct request for baseurl "PAYPAL_BASE_URI" and endpoint "ENDPOINT_CREATE_ORDER_API"
    And Set header values as
      | Content material-Sort     | Authorization                                                                                            |
      | software/json | Bearer  |
    When Carry out "POST" request utilizing "FILE_PATH_ORDER_JSON"
    Then standing code is 201

How can I set “access_token” in “token” as a worldwide variable from the function file in order that I can use it anyplace on this function file utilizing the next step?

And Set world "access_token" in "token"

Dell Energy Supervisor Privilege Escalation Vulnerability

Hacking

codesanitize

-

25 August 2024

0

Dell Energy Supervisor Privilege Escalation Vulnerability

Dell Applied sciences has issued a essential safety replace for its Dell Energy Supervisor software program following the invention of a major vulnerability that would permit attackers to execute code and escalate privileges on affected programs.

The vulnerability, recognized as CVE-2024-39576, has been assigned a excessive severity score with a CVSS rating of 8.8, highlighting the pressing want for customers to replace their software program.

CVE-2024-39576: Privilege Escalation Vulnerability

The vulnerability resides in Dell Energy Supervisor (DPM) variations 3.15.0 and earlier. It’s categorized as an “Incorrect Privilege Project” flaw, which will be exploited by a low-privileged attacker with native entry to the system.

This vulnerability might allow an attacker to execute arbitrary code and achieve elevated privileges, doubtlessly compromising your complete system.

Are You From SOC/DFIR Groups? - Attempt Superior Malware and Phishing Evaluation With ANY.RUN -14-day free trial

The Widespread Vulnerability Scoring System (CVSS) particulars for CVE-2024-39576 are as follows:

Assault Vector (AV): Native
Assault Complexity (AC): Low
Privileges Required (PR): Low
Person Interplay (UI): None
Scope (S): Modified
Confidentiality (C): Excessive
Integrity (I): Excessive
Availability (A): Excessive

These metrics point out that the vulnerability is comparatively straightforward to take advantage of and may considerably impression system confidentiality, integrity, and availability.

Dell Energy Supervisor is a broadly used software for managing energy settings and monitoring battery well being on Dell gadgets.

The affected variations embody all releases earlier than model 3.16.0. Dell has promptly addressed the problem by releasing an up to date model, 3.16.0, on August 20, 2024.

Customers are strongly suggested to improve to this model or later to mitigate the danger related to this vulnerability.

Remediation Steps:

Replace Software program: Customers ought to obtain and set up Dell Energy Supervisor model 3.16.0 or later from Dell’s official web site.
Confirm Replace: Make sure the set up is profitable and the software program model is up to date to three.16.0 or past.

Dell has acknowledged that no workarounds or mitigations can be found for this vulnerability, making it crucial for customers to use the replace as quickly as doable to guard their programs from potential exploitation.

The invention of CVE-2024-39576 underscores the significance of standard software program updates and vigilance in cybersecurity practices.

Dell’s swift response in releasing a safety replace is commendable, however customers should take quick motion to safe their programs.

As cyber threats evolve, staying knowledgeable and proactive stays the perfect protection in opposition to potential vulnerabilities.

Shield Your Enterprise with Cynet Managed All-in-One Cybersecurity Platform – Attempt Free Trial

Audit finds notable safety gaps in FBI’s storage media administration

Technology

codesanitize

-

25 August 2024

0

Audit finds notable safety gaps in FBI’s storage media administration

An audit from the Division of Justice’s Workplace of the Inspector Basic (OIG) recognized “vital weaknesses” in FBI’s stock administration and disposal of digital storage media containing delicate and categorised info.

The report highlights a number of points with insurance policies and procedures or controls for monitoring storage media extracted from units, and vital bodily safety gaps within the media destruction course of.

The FBI has acknowledged these points and is within the technique of implementing corrective actions based mostly on the suggestions from OIG.

OIG’s findings

OIG’s audit highlights a number of weaknesses in FBI’s stock administration and disposal procedures for digital storage media containing delicate however unclassified (SBU) in addition to categorised nationwide safety info (NSI).

The three key findings are summarized as follows:

The FBI doesn’t adequately monitor or account for digital storage media, equivalent to inside exhausting drives and thumb drives, as soon as they’re extracted from bigger units, which will increase the chance of those media being misplaced or stolen.
The FBI fails to constantly label digital storage media with the suitable classification ranges (e.g., Secret, High Secret), which may result in mishandling or unauthorized entry to delicate info.
The OIG additionally noticed inadequate bodily safety on the FBI facility the place media destruction happens. This contains insufficient inside entry controls, unsecured storage of media awaiting destruction, and non-functioning surveillance cameras, all of which heighten the chance of categorised info being compromised.

Compromised pallet on FBI's storage warehouse aisle — **Pallet with storage units uncovered in FBI’s facility**
*Supply: OIG*

Suggestions and FBI’s response

The OIG has made three particular suggestions to the FBI to deal with the recognized issues.

Revise procedures to make sure all digital storage media containing delicate or categorised info, together with exhausting drives which can be extracted from computer systems slated for destruction, are appropriately accounted for, tracked, well timed sanitized, and destroyed.
Implement controls to make sure its digital storage media are marked with the suitable NSI classification stage markings, in accordance with relevant insurance policies and tips.
Strengthen the management and practices for the bodily safety of its digital storage media on the facility to forestall loss or theft.

FBI acknowledged the audit’s findings and said it’s within the technique of growing a brand new directive titled “Bodily Management and Destruction of Labeled and Delicate Digital Units and Materials Coverage Directive.”

This new coverage is predicted to deal with the issues recognized within the storage media monitoring and classification markings.

Protective cages to be used in FBI storage facilities — **Protecting cages for use in FBI storage amenities**
*Supply: OIG*

Moreover, the FBI stated it’s within the technique of putting in protecting “cages” to make use of as storage factors for the media, which will probably be coated by video surveillance.

OIG expects the FBI to replace it on the standing of implementing the corrective actions inside 90 days.

5 explanation why Python is widespread amongst cybersecurity professionals

Cyber Security

codesanitize

-

25 August 2024

0

5 explanation why Python is widespread amongst cybersecurity professionals

Safe Coding

Python’s versatility and quick studying curve are simply two elements that specify the language’s ‘grip’ on cybersecurity

25 Apr 2024
•
,
3 min. learn

Gripped by Python: 5 reasons why Python is popular among cybersecurity professionals

The Python programming language, born from the artistic genius of Guido van Rossum way back to some 35 years in the past, has developed into a vital instrument for professionals working in varied areas, together with software program growth, knowledge science, synthetic intelligence and, notably, cybersecurity.

Certainly, Python’s popularity precedes it, and this high-level, general-purpose programming language has turn into famend, amongst different issues, for its user-friendliness and a developer neighborhood of no fewer than 8.2 million folks, in addition to an in depth array of instruments and libraries. It’s little surprise that its strengths have been harnessed for purposes as numerous as area exploration, Netflix suggestions, and the event of autonomous vehicles.

Let’s look a little bit extra carefully at these and another advantages which have finally made Python the go-to language for a lot of professionals, together with in cybersecurity.

1. Ease of use and conciseness

Python’s accessibility is because of its simplicity and light-weight nature. Given its quick studying curve, even newbies discover Python intuitive and simple to know. Python’s clear syntax and concise code construction streamline growth processes, permitting programmers to give attention to problem-solving somewhat than wrestling with language intricacies. As well as, its straightforward readability facilitates collaboration amongst crew members and finally enhances their productiveness.

2. Versatility

Python’s versatility is aware of no bounds. By providing a complete toolkit for a variety of duties, it may be a common language for cybersecurity professionals. Whether or not conducting vulnerability assessments and different safety testing, forensic evaluation, analyzing malware, or automating community and port scanning and different repetitive duties because of scripts, Python proves its mettle throughout numerous safety domains. Its adaptability extends past security-specific duties, and it seamlessly integrates with different programming languages and applied sciences.

3. Adaptability and integration

Flexibility and integration capabilities are one more supply of Python’s energy. It seamlessly interfaces with programs and applied sciences resembling databases, internet companies and APIs, which finally enhances interoperability and collaboration. By harnessing Python’s in depth libraries and frameworks, builders can leverage pre-built modules to speed up growth cycles and improve performance. Furthermore, because it’s platform-independent, Python can run on all frequent working programs (Home windows, Mac and Linux) and is suitable with different widespread languages like Java and C, which allows its integration into present infrastructure and helps keep away from disruptions to enterprise operatioons.

4. Activity automation

Automation is the cornerstone of environment friendly cybersecurity practices, and Python excels on this enviornment. Its strong automation capabilities empower safety groups to streamline repetitive duties, resembling vulnerability scanning, risk detection, and incident response. By automating routine processes, organizations can improve operational effectivity, reduce human error, and bolster their total safety posture. Python’s versatility extends past security-specific automation, nonetheless, because it allows organizations to automate additionally administrative duties, resembling person provisioning and system configuration administration, with ease.

5. Intensive libraries and energetic neighborhood

Python’s vibrant open-source ecosystem supplies a treasure trove of sources, with its in depth modules, packages, libraries and frameworks catering to numerous safety wants and offering ready-made options for varied frequent challenges. From risk intelligence evaluation to safety orchestration and automation, Python’s libraries assist empower groups and organizations to sort out complicated safety points successfully. Additionally, Python’s energetic neighborhood ensures ongoing growth and help, with builders worldwide contributing to its evolution and enhancement.

READ NEXT: Introducing IPyIDA: A Python plugin on your reverse-engineering toolkit

One the flip aspect, the truth that anybody can contribute to the official Python repository referred to as PyPI comes with some downsides. Whereas not frequent, malware masquerading as legit initiatives there isn’t extraordinary, as demonstrated by current ESET analysis and two different instances from 2017 and 2023.

Conclusion

So there you may have it – we’ve tried to cowl Python’s strengths as concisely as attainable and so do justice to it. In closing, because of its unparalleled versatility, flexibility, and effectivity, Python stands as a linchpin within the realm of many domains, together with cybersecurity, the place it is a useful asset for safety professionals looking for to safeguard digital belongings and mitigate threats.

Elevating Information Intelligence: Key Insights from Trade Leaders on Information and AI

Big Data

codesanitize

-

25 August 2024

0

Elevating Information Intelligence: Key Insights from Trade Leaders on Information and AI

In right now’s quickly evolving technological panorama, the intersection of knowledge and synthetic intelligence (AI) has grow to be a vital focus for organizations throughout industries. In response to Foundry’s current CIO Tech Ballot, IT leaders have overwhelmingly positioned AI-enabled options on the prime of their funding listing for 2024, with solely 8% expressing little interest in generative AI. This surge in AI prioritization underscores the necessity for a deeper understanding of how information and AI can work collectively to drive innovation and enterprise worth.

To discover this significant matter, we lately hosted a panel dialogue that includes trade specialists from Informatica, Immuta, and Dataiku. The panel introduced their distinctive views from real-life buyer situations on the necessity for high-quality information, new rules, and laying the best information foundations for everybody. The dialog centered round two key aspects:

How know-how suppliers are making certain intelligence is constructed into platforms to deal with safety, privateness, governance, and coverage management.
allow prospects to guide AI initiatives successfully by leveraging the facility of their very own information.

Panel:
Robin Sutara – Discipline CTO, Databricks
Conor Jensen – Dataiku, Discipline CTO
Rik Tamm-Daniels – Informatica, GVP Ecosystem and Expertise, Informatica
Chris Brown – Immuta, Public Sector CTO

Let’s delve into the important thing insights shared by our esteemed panelists.

Leveraging AI for Information Administration and Vice Versa

Rik Tamm-Daniels from Informatica highlighted the corporate’s strategy to integrating AI into information administration processes:

Incorporating generative AI to speed up information administration
Simplifying consumer interactions with information utilizing pure language interfaces inside an clever information warehouse
Creating enterprise-grade AI functions that combine not solely public information and AI fashions but additionally first-party information

This strategy emphasizes the significance of a robust information basis in unlocking the complete potential of AI applied sciences.

Guaranteeing Information Safety and Entry Management

Chris Brown from Immuta targeted on the vital side of knowledge safety:

Figuring out and understanding the situation of delicate information throughout varied storage techniques
Creating guidelines to make sure solely approved personnel have entry to particular information units
Implementing automated insurance policies for information engineering and report creation

A buyer success story shared by Chris illustrated how organizations are leveraging options from Dataiku, Immuta, and Databricks to reinforce their information engineering capabilities whereas sustaining strict governance.

Democratizing Information Entry and Utilization

Conor Jensen from Dataiku emphasised the significance of constructing information accessible to everybody in a corporation:

Enabling all workers to leverage information throughout varied use instances
Addressing the problem of restricted entry to worthwhile information inside platforms
Hanging a steadiness between ease of use and danger administration in information entry

The Function of Metadata in AI Purposes

The panelists agreed on the vital position of metadata in integrating totally different information property with Giant Language Fashions (LLMs). Guaranteeing the best information is enter into AI techniques is essential for producing dependable and reliable outputs, reinforcing the “rubbish in, rubbish out” precept.

Balancing Innovation and Threat

Robin Sutara from Databricks touched on the impression of generative AI on individuals, processes, and alter administration:

The necessity for alignment with enterprise outcomes
The excellence between information governance and AI governance
The significance of bringing in the best instruments for information and AI governance

She concluded with a robust message: “Construct for the longer term, however do not watch for the longer term.” The mixed options from Databricks, Immuta, Informatica, and Dataiku empower organizations to adapt to evolving applied sciences with out fixed rebuilding, making certain steady empowerment of knowledge shoppers.

Conclusion

As organizations proceed to navigate the advanced panorama of knowledge and AI, insights from trade leaders grow to be invaluable. By specializing in sturdy information foundations, breaking down information silos, sturdy safety measures, and accessible but ruled information practices, companies can harness the complete potential of AI whereas mitigating related dangers.

To achieve deeper insights into this fascinating dialogue, we encourage you to watch the complete panel dialogue.