Creepy Way Facebook Advertisers Use You!

How Facebook Is Using Your Photos in Ads?

Gmail isn't the only online platform guilty of repurposing your photos. Facebook and its advertisers, too, have become really good at using your image to inspire your friends' confidence in the products they are pushing.

A friend who recently experienced this said, "I did not realize that 'friending' [a company on Facebook] to get coupons probably means I've agreed to be used in their ads. Seeing a friend's picture [used this way] makes me suspicious my picture is doing the same thing on other people's Facebook pages."

What I find particularly interesting is the way Facebook explains away its practices with this statement, (which you can see for yourself if you follow the prevention steps below): "Everyone wants to know what their friends like. That's why we pair ads and friends."

Fortunately, there is a way to stop Facebook from using your profile picture in advertisements.

1) Go to "Privacy Settings"

2) Click on the "Ads" tab on the left hand side.

3) In the Third Party Sites section click on "Edit"

4) In the drop down menu, click "No one" and then "Save Changes"

5) In the Ads & Friends section click "Edit"

6) In the drop down menu, click "No one" and then "Save Changes"

NOTE: You cannot opt out of receiving Sponsored Stories, which are essentially another type of ad. If you like a story on a brand page or share that you engaged with a brand, that brand can pay Facebook to ensure that it shows up in yours and your friends' timeline feeds.

How Developers Can Secure their Code?

5 Application Security Tips

Over the last 30 years, many organizations have done an amazing job of automating their business, resulting in productivity gains, efficiencies and innovations.

Unfortunately, the threat landscape has changed dramatically during this time. A lot of that application code, written without security in mind decades ago, is still the heart-and-soul of many enterprises. That code was designed for a world where computers could not be accessed remotely.

Since then, it has been wrapped, integrated, connected, ported, and most importantly, exposed. That application code is not strong enough to withstand today's threat.

OWASP has a number of free and open-source resources that developers can use right now to help secure their code.

5 Tips for Developers

Start with the OWASP Top Ten - This awareness document will help you understand, identify, and fix the most critical application security risks quickly.

Get hands-on with WebGoat - WebGoat is a deliberately flawed application that is riddled with holes to give people the opportunity for hands-on learning. It is open-sourced to help developers and security testers get experience with real vulnerabilities.

Leverage the OWASP Cheat Sheets - This is a fantastic series from leading experts globally. Let me know what you think of the Cross-Site Scripting Prevention Cheat Sheet, one of OWASP's most popular pages.

Verify Your Applications - There is no substitute for getting real facts about the security of your application portfolio. OWASP Application Security Verification Standard helps developers get started scanning, testing and code reviewing with tools like OWASP Zap and CSRFTester.

Get Training - Perhaps the hardest thing about application security is that there are so many different ways that software can fail, particularly when it's targeted by a motivated attacker. The key is training to get started with securing applications quickly.

If instructor-led training isn't possible, eLearning solutions are available to allow developers to learn on-demand and get hands-on, practical experience with vulnerabilities, security controls and real code. Training is a remarkably effective way to reduce vulnerabilities.

Before you trust your business to application software, make certain that the people who are writing your code know how to defend your business and its assets. It's time to learn.

“Typing Arabic has never been this easy!”

Microsoft Maren

Roger's recent post pointed me to an interesting software recently released by Microsoft. I quote from the website:

Lack of access to an Arabic keyboard or lack of familiarity with one are two of the most common problems preventing Arabic users from communicating in their own language.

Microsoft Maren is a Windows extension that comes to the rescue, allowing you to type Arabic in Roman characters (Romanized Arabic, Arabizi, Arabish or Franco-Arabic) and have it converted on the fly to Arabic script.

Maren integrates seamlessly with Windows and works in most Windows applications and websites.

It is very interesting and handy application if you type or use arabic all the time. Don't forget to watch a very good video on the page.

Protecting Web Applications

Four strategic best practices for protecting Web Applications

To address security-related issues as they pertain to Web Applications, organizations can employ four broad, strategic best practices.

1. Increase Security Awareness

This encompasses training, communication and monitoring activities, preferably in cooperation with a consultant.

* Training:

Provide annual security training for all application team members: Developers, Quality Assurance Professionals, Analysts and Managers. Describe current attacks and a recommended remediation process. Discuss the organization's current security practices. Require developers to attend training to master the framework's prebuilt security functions. use vendor-supplied material to train users on commercial off-the-shelf (COTS) security tools, and include security training in the project plan.

* Communication:

Collect security best practices from across all teams and lines of business in your organization. Distribute them in a brief document and make them easily accessible on an intranet. Get your IT security experts involved early and develop processes that include peer mentoring. Assign a liaison from the security team to every application team to help with application requirements and design.

* Monitoring:

Ensure that managers stay aware of the security status of every application in production. Track security errors through your normal defect tracking and reporting infrastructures to give all parties visibility.

2. Categorize application risk and liability

Every organization has limited resources and must manage priorities. To help set security priorities, you can:

* Define risk thresholds and specify when the security team will terminate application services.

* Categorize applications by risk factors (e.g. Internet or Intranet vs. Extranet).

*Generate periodic risk reports based on security scans that match issues to defined risk thresholds.

* Maintain a database that can analyze and rank applications by risk, so you can inform teams of how their applications stack up against deployed systems.

3. Set a zero-tolerance enforcement policy

An essential part of governing the development and delivery process, a well-defined security policy can reduce your risk of deploying vulnerable or non compliant applications. During inception, determine which tests the application must pass before deployment, and inform all team members. Formally review requirements and design specifications for security issues during inception and elaboration - before coding begins. Allow security exceptions only during design and only with appropriate executive - level approval.

4. Integrate security testing throughout the development and delivery process

By integrating security testing throughout the delivery lifecycle, you can have significant positive effects on the design, development and testing of applications. You should base functional requirements on security tests your application must pass, making sure that your test framework:

* Use automated tools and can run at any point during the development and delivery process.

* Includes unit and system test as well application-level tests.

* Allow for audit testing in production.

* Uses an agile development methodology for security procedures.

* Can be run during coding, testing, integration and production activities.