Why secret detection tools are not enough: It's not just about false positives - An industrial case study.

Checked-in secrets in version-controlled software projects pose security risks to software and services. Secret detection tools can identify the presence of secrets in the code, commit changesets, and project version control history. As these tools can generate false positives, developers are provided with mechanisms to bypass the warnings generated from these tools. Providing this override mechanism can result in developers sometimes exposing secrets in software repositories. The goal of this article is to aid software security practitioners in understanding why' secrets are checked into repositories, despite being warned by tools, through an industrial case study of analysis of usage data of a secret detection tool and a survey of developers who bypassed the tool alert. In this case study, we analyzed the usage data of a checked-in secret detection tool used widely by a software company and we surveyed developers who bypassed the warnings generated by the tool. From the case study, we found that, despite developers classified 50% of the warning as false positive, developers also bypassed the warning due to time constraints, working with non-shipping projects, technical challenges of eliminating secrets completely from the version control history, technical debts, and perceptions that check-ins are low risk. We advocate practitioners and researchers to investigate the findings of our study further to improve secret detection tools and related development practices. We also advocate that organizations should insert secondary checks, as is done by the company we studied, to capture occasions where developers incorrectly bypass secret detection tools.

Evaluation of the Impact of Compliance with Mitigation Strategies and Frequency of Restaurant Surface Cleaning and Sanitizing on Control of Norovirus Transmission from Ill Food Employees Using an Existing Quantitative Risk Assessment Model.

ABSTRACT: Reduction of foodborne illness caused by norovirus (NoV) continues to be a focus for the food safety community. Using a previously published quantitative risk assessment model, we evaluated more than 60 scenarios examining the impact of implementation of and compliance with risk management strategies identified in the U.S. Food and Drug Administration Food Code for (a) surface cleaning and sanitizing, (b) hand hygiene, (c) exclusion, or (d) restriction of ill employees. Implementation of and compliance with hand hygiene and ill food employee exclusion strategies had the largest impact on the predicted number of highly contaminated food servings and associated consumer illnesses. In scenarios in which gloves were always worn and hand washing compliance was 90%, the model estimated reductions in the number of highly contaminated food servings and ill consumers to 39 and 43% of baseline estimates (i.e., typical practice), respectively. Reductions were smaller when gloves were never worn. Hand washing compliance after using the restroom strongly impacted predicted numbers of highly contaminated servings and consumer illnesses. Ten percent compliance with removing or excluding ill food employees was predicted to increase the number of highly contaminated food servings and ill consumers to 221 and 213% of baseline estimates, respectively. Ninety-four percent compliance with exclusion of ill food employees was predicted to decrease these numbers to 69 and 71% of baseline estimates, respectively. Surface cleaning in food establishments had a relatively small impact on these measures. Restriction of food employees (removed from contact with food and food contact equipment and utensils) was not effective for reducing NoV illness unless this restriction included additional provisions. The results from this study can help risk managers prioritize mitigation strategies and their implementation for controlling the transmission of NoV and subsequent consumer foodborne illness.

Restaurant Date-Marking Practices Concerning Ready-to-Eat Food Requiring Time and Temperature Control for Safety.

Certain foods are more vulnerable to foodborne pathogen growth and formation of toxins than others. Lack of time and temperature control for these foods can result in the growth of pathogens, such as Listeria monocytogenes, and lead to foodborne outbreaks. The Food and Drug Administration's (FDA) Food Code classifies these foods as time/temperature control for safety (TCS) foods and details safe cooking, holding, and storing temperatures for these foods. The FDA Food Code also includes a date-marking provision for ready-to-eat TCS foods that are held for >24 h. The provision states that these foods should not be held in refrigeration for >7 days and should be marked with the date or day by which the food should be "consumed on the premises, sold, or discarded." To learn more about restaurants' date-marking practices, the Centers for Disease Control and Prevention's Environmental Health Specialists Network (EHS-Net) conducted observations and manager interviews in 359 restaurants in 8 EHS-Net jurisdictions. Managers reported that they date marked ready-to-eat TCS foods more often than data collectors observed this practice (91% vs. 77%). Observation data showed almost a quarter of study restaurants did not date-mark ready-to-eat TCS foods. In addition, restaurants with an internal date-marking policy date marked 1.25 times more often than restaurants without such a policy and chain restaurants date marked 5.02 times more often than independently owned restaurants. These findings suggest that regulators and the retail food industry may improve food safety and lower the burden of foodborne illness in the United States if they target interventions to independent restaurants and encourage strong date-marking policies.

Methane Exhaust Measurements at Gathering Compressor Stations in the United States.

Unburned methane entrained in exhaust from natural gas-fired compressor engines ("combustion slip") can account for a substantial portion of station-level methane emissions. A novel in-stack, tracer gas method was coupled with Fourier transform infrared (FTIR) species measurements to quantify combustion slip from natural gas compressor engines at 67 gathering and boosting stations owned or managed by nine "study partner" operators in 11 U.S. states. The mean methane emission rate from 63 four-stroke, lean-burn (4SLB) compressor engines was 5.62 kg/h (95% CI = 5.15-6.17 kg/h) and ranged from 0.3 to 12.6 kg/h. The mean methane emission rate from 39 four-stroke, rich-burn (4SRB) compressor engines was 0.40 kg/h (95% CI = 0.37-0.42 kg/h) and ranged from 0.01 to 4.5 kg/h. Study results for 4SLB engines were lower than both the U.S. EPA compilation of air pollutant emission factors (AP-42) and Inventory of U.S. Greenhouse Gas Emissions and Sinks (GHGI) by 8 and 9%, respectively. Study results for 4SRB engines were 43% of the AP-42 emission factor and 8% of the GHGI emission factor, the latter of which does not distinguish between engine types. Total annual combustion slip from the U.S. natural gas gathering and boosting sector was modeled using measured emission rates and compressor unit counts from the U.S. EPA Greenhouse Gas Reporting Program. Modeled results [328 Gg/y (95% CI = 235-436 Gg/y) of unburned methane] would account for 24% (95% CI = 17-31%) of the 1391 Gg of methane emissions for "Gathering and Boosting Stations", or 6% of the net emissions for "Natural Gas Systems" (5598 Gg) as reported in the 2020 U.S. EPA GHGI. Gathering and boosting combustion slip emissions reported in the 2020 GHGI (374 Gg) fall within the uncertainty of this model.

Assessing Employee Health Policies for Reporting and Excluding Ill Food Employees in Restaurants within the United States.

ABSTRACT: Preventing ill food employees from spreading pathogens to food and food contact surfaces remains an important objective of retail food safety policy in the United States. Since 2005, the U.S. Food and Drug Administration (FDA) has recommended food establishments implement employee health policies that include requirements for the exclusion or restriction of ill food employees and reporting, to the person in charge, symptoms or diagnosis of certain diseases transmitted by food. However, the incorporation of this recommendation has not been widely studied. The purpose of this exploratory study was to assess the presence and prevalence of employee health policies at fast-food and full-service restaurants in the United States. More than 50% of fast-food and full-service restaurants were found to have nonexistent employee health policies for each of the five recommended components specified in the FDA Food Code. Results showed 17.41% of fast-food restaurants and 12.88% of full-service restaurants had all five recommended components. Moreover, most restaurants with all five recommended employee health policy components were part of a multiple-unit operation and were found to have more developed food safety management systems than restaurants with none of the recommended components. Further attention and research into the impediments associated with developing and implementing employee health policies in restaurants is warranted.

Evaluation of a Mobile Health Intervention to Improve Wellness Outcomes for Breast Cancer Survivors.

PURPOSE: Breast cancer survivors are at increased risk of cancer recurrence, second malignancies, and other comorbid conditions. This study examined if use of a convenient, commercially available, $65 per month app that gives breast cancer survivors access to a health and wellness coach is more effective than a self-guided toolkit and one-time health education session at achieving the following goals: 1) improving adherence to a plant-based diet, 2) increasing physical activity, 3) assisting with weight loss and reduction in body mass index, 4) reducing elevated depression and fatigue scores, and 5) leading to sustained adherence to lifestyle and wellness plan at and beyond 6 months. METHODS: A nonrandomized 2-group control study design with pre-post repeated measures (N=127 subjects) was utilized. Women 18 years of age or older, with curative-intent breast cancer, were included in the study. App users received a survivorship care plan and enrolled in a 6-month subscription to the health app. A control group received the same information but, instead of access to the app, were given a self-guided toolkit. RESULTS: At 6 months, more patients in the app group experienced weight loss and had a significantly greater reduction in overall body mass index (P<0.01). The app group also demonstrated statistically significant improvements in "strenuous" physical activity (P=0.04) and had significant improvement in their dietary patterns (P<0.001), as compared to the self-guided group. The app group had greater reduction in fatigue and improvement in depression, but these changes were not statistically significant. At 12 months, none of the app users were still using the app, but many were still following their wellness plan and had maintained their weight loss. Outliers in both groups and low rate of response made evaluation of results difficult. CONCLUSIONS: The results of this advanced practice provider-led study demonstrated that a live health coaching app that provides wellness coaching can offer motivated breast cancer survivors and cancer programs a modality that offers convenient, effective support at a reasonable cost.

Methane Emissions from Gathering Compressor Stations in the U.S.

Using results from a nationally representative measurement campaign at 180 gathering compressor stations conducted with nine industry partners, this study estimated emissions for the U.S. gathering sector, where sector-specific emission factors have not been previously available. The study drew from a partner station population of 1705 stations-a significantly larger pool than was available for prior studies. Data indicated that whole gas emission rates from components on gathering stations were comparable to or higher than emission factors utilized by the EPA's greenhouse gas reporting program (GHGRP) but less than emission factors used for similar components on transmission compressor stations. Field data also indicated that the national population of stations likely has a higher fraction of smaller stations, operating at lower throughput per station, than the data used to develop the per-station emission factor used in EPA's greenhouse gas inventory (GHGI). This was the first national study to incorporate extensive activity data reported to the GHGRP, including 319 basin-level reports, covering 15,895 reported compressors. Combining study emission data with 2017 GHGRP activity data, the study indicated statistically lower national emissions of 1290 [1246-1342] Gg methane per year or 66% [64-69%] of current GHGI estimates, despite estimating 17% [12-22%] more stations than the 2017 GHGI (95% confidence interval). Finally, we propose a replicable method that uses GHGRP activity data to annually update GHGI gathering and boost sector emissions.

Allergen Removal and Transfer with Wiping and Cleaning Methods Used in Retail and Food Service Establishments.

ABSTRACT: Preventing the transfer of allergens from one food to another via food contact surfaces in retail food environments is an important aspect of retail food safety. Existing recommendations for wiping and cleaning food contact surfaces is mainly focused on preventing microorganisms, such as bacteria and viruses, from contaminating foods. The effectiveness of these wiping and cleaning recommendations for preventing the transfer of food allergens in retail and food service establishments remains unclear. This project investigated (i) allergen removal from surfaces by wiping with paper wipes, terry cloth, and alcohol quaternary ammonium chloride (quat) sanitizing wipes; (ii) cleaning of allergen-contaminated surfaces by using a wash-rinse-sanitize-air dry procedure; and (iii) allergen transfer from contaminated wipes to multiple surfaces. Food contact surfaces (stainless steel, textured plastic, and maple wood) were contaminated with peanut-, milk- and egg-containing foods and subjected to various wiping and cleaning procedures. For transfer experiments, dry paper wipes or wet cloths contaminated with allergenic foods were wiped on four surfaces of the same composition. Allergen-specific lateral flow devices were used to detect the presence of allergen residues on wiped or cleaned surfaces. Although dry wipes and cloths were not effective for removing allergenic foods, terry cloth presoaked in water or sanitizer solution, use of multiple quat wipes, and the wash-rinse-sanitize-air dry procedure were effective in allergen removal from surfaces. Allergens present on dry wipes were transferred to wiped surfaces. In contrast, minimal or no allergen transfer to surfaces was found when allergen-contaminated terry cloth was submerged in sanitizer solution prior to wiping surfaces. The full cleaning method (wash-rinse-sanitize-air dry) and soaking the terry cloth in sanitizer solution prior to wiping were effective at allergen removal and minimizing allergen transfer.

Food Safety Management Systems, Certified Food Protection Managers, and Compliance with Food Safety Practices Associated with the Control of Listeria monocytogenes in Foods at Restaurants.

HIGHLIGHTS: Proper cold holding and date marking practices help control Lm growth in foods. Most restaurants had ≥1 instance of improper cold holding. Less than 50% of all cold holding observations were found to be out of compliance. Restaurants in areas requiring date marking of food were more likely to date mark. CFPM did not predict out-of-compliance observations when FSMS effects were considered.