Daily Tech Digest - January 14, 2025

Why Your Business May Want to Shift to an Industry Cloud Platform

Industry cloud services typically embed the data model, processes, templates, accelerators, security constructs, and governance controls required by the adopter's industry, says Shriram Natarajan, a director at technology research and advisory firm ISG, in an online interview. "This [approach] allows faster development of new functionality, better security and governance, and an enhanced and user/stakeholder experience." ... Enterprises spanning many industries can benefit significantly by moving to an industry cloud platform, Campbell says. "Businesses that are faced with many regulations and operational requirements can especially benefit from the specialized services industry cloud platforms," he notes, adding that many industry cloud platforms are preconfigured to meet specific needs, which can help accelerate the time to value realized. Many enterprises have a blinkered view on verticalized solutions, Natarajan says. "They tend to see the platforms they already have in-house and look for solutions that these platforms provide." He believes that enterprise IT and business teams can both benefit from looking at the landscape of verticalized industry cloud platforms.


FRAML Reality Check: Is Full Integration Really Practical?

While integration between AML and fraud teams is a desirable goal, experts say it should not be viewed as the best solution. Paul Dunlop, insider risk consultant at a financial services firm, stressed the importance of collaboration over integration. "I am against the oversimplification of fraud and AML integration. Banking risks are multifaceted, involving not just fraud and AML but also cybersecurity, privacy and other domains," Dunlop said. "Integration decision should be assessed based on the bank's maturity level, regulatory environment and unique operational needs." "Cost should not be the sole factor behind this decision. One must assess operational and risk management trade-offs," he said. Meng Liu, senior analyst at Forrester, said that despite AML and fraud being two distinct functions at present, the trend toward more consolidated and integrated financial crime management is real. ... Despite the differences in fraud and AML teams, some use cases, such as scams, human trafficking and child exploitation, cry out for better collaboration, Mitchell said. "These require shared data and aligned strategies." But high-volume fraud detection such as check and card fraud is less suited for joint efforts due to operational complexity.


Ransomware abuses Amazon AWS feature to encrypt S3 buckets

In the attacks by Codefinger, the threat actors used compromised AWS credentials to locate victim's keys with 's3:GetObject' and 's3:PutObject' privileges, which allow these accounts to encrypt objects in S3 buckets through SSE-C. The attacker then generates an encryption key locally to encrypt the target's data. Since AWS doesn't store these encryption keys, data recovery without the attacker's key is impossible, even if the victim reports unauthorized activity to Amazon. "By utilizing AWS native services, they achieve encryption in a way that is both secure and unrecoverable without their cooperation," explains Halcyon. Next, the attacker sets a seven-day file deletion policy using the S3 Object Lifecycle Management API and drops ransom notes on all affected directories that instruct the victim to pay ransom on a given Bitcoin address in exchange for the custom AES-256 key. ... Halcyon also suggests that AWS customers set restrictive policies that prevent the use of SSE-C on their S3 buckets. Concerning AWS keys, unused keys should be disabled, active ones should be rotated frequently, and account permissions should be kept at the minimum level required.


How AI and ML are transforming digital banking security

By continuously learning from new data, ML improves over time, adapting to the organization’s needs and the ever-evolving fraud tactics. This supports reducing false positives, ensuring legitimate transactions proceed smoothly while maintaining security. Predictive analytics also help identify potential threats before they materialize, and fraud scoring prioritizes high-risk activities for action. AI/ML-powered systems are scalable and effective against sophisticated threats, such as synthetic identity fraud and account takeovers, and can monitor multiple banking channels simultaneously. They automate detection, lowering operational costs, and providing seamless customer experiences, thereby enhancing trust. However, nothing is a silver bullet and considerations must be made to things such as algorithm bias, data privacy concerns, and the need for explainable models persist. Still, despite these potential hurdles, AI and ML are reshaping digital banking security, equipping financial institutions with proactive tools to counter fraud while safeguarding customer trust and regulatory compliance. ... Advanced technologies like AI and ML are helping institutions monitor transactions in real time, detecting anomalies and preventing fraud without directly involving users. Meanwhile, encryption and tokenization protect sensitive data, ensuring transactions remain secure in the background.


The Evolution of Business Systems in the Digital Era

Systems of Record (SORs) serve as the foundation of organizational infrastructure, storing essential data such as customer information, financial transactions, and operational processes. These systems are designed to maintain structured and reliable records, ensuring data integrity, compliance, and security. They play a critical role in regulatory reporting, audits, and operational consistency. ... Systems of Engagement (SOEs) are the digital front doors of modern businesses, facilitating seamless and interactive communication with customers and employees. They go beyond simple data storage and retrieval, focusing on creating dynamic and personalized experiences across various channels. SOEs prioritize customer-centric approaches, ensuring businesses can deliver dynamic and interactive communication. ... Systems of Intelligence (SOIs) represent the pinnacle of data-driven decision making. Built upon the foundation of Systems of Record (SORs) and Systems of Engagement (SOEs), SOIs leverage the power of artificial intelligence (AI) and machine learning (ML) to transform raw data into actionable insights. Unlike their predecessors, SOIs go beyond simply identifying patterns and trends. They possess the ability to predict future outcomes and even prescribe optimal courses of action.


Gen AI strategies put CISOs in a stressful bind

One of the most problematic gen AI issues CISOs face is how casual many gen AI vendors are being when selecting the data used to train their models, Townsend said. “That creates a security risk for the organization.” ... generative AI’s penetration into SaaS solutions makes this more problematic. “The attack surface for gen AI has changed. It used to be enterprise users using foundation models provided by the biggest providers. Today, hundreds of SaaS applications have embedded LLMs that are in use across the enterprise,” said Routh, who today serves as chief trust officer at security vendor Saviynt. “Software engineers have more than 1 million open source LLMs at their disposal on HuggingFace.com.” ... All this can take a psychological toll on CISOs, Townsend surmised. “When they feel overwhelmed, they shut down,” he said. “They do what they feel they can, and they will ignore what they feel that they can’t control.” ... “The bad actors are feverishly working to exploit these new technologies in malicious ways, so the CISOs are right to be concerned about how these new gen AI solutions and systems can be exploited,” Taylor said. 


How Enterprises and Startups Can Master AI With Smarter Data Practices

For enterprises, however, supplying AI systems with the data they need to thrive is more complicated by several orders of magnitude. There are two main reasons for this: First, enterprises don’t have the same information aggregation ability in the consumer AI world. Consumer AI companies can use any public data on the web to train their AI models; think of it as an entire continent of information to which they have unfettered access. On the other hand, enterprise data exists within minor, disparate, and oftentimes disconnected information archipelagos. Additionally, enterprises are working with many types of data, including relational data from operational systems, decades of poorly organized folders of documents, and audio and numeric data from payroll and financial systems. Further, enterprises must contend with additional layers of regulatory complexity regarding handling personal and private data. To build impactful AI tools, an enterprise’s algorithms must be fed or trained on specific data sets that span multiple sources, including the company’s human resources, finance, customer relationship management, supply chain management, and other systems.


Yes, you should use AI coding assistants—but not like that

AI is a must for software developers, but not because it removes work. Rather, it changes how developers should work. For those who just entrust their coding to a machine, well, the results are dire. ... Use AI wrong and things get worse, not better. Stanford researcher Yegor Denisov-Blanch notes that his team has found that AI increases both the amount of code delivered and the amount of code that needs reworking, which means that “actual ‘useful delivered code’ doesn’t always increase” with AI. In short, “some people manage to be less productive with AI.” So how do you ensure you get more done with coding assistants, not less? ... Here’s the solution: If you want to use AI coding assistants, don’t use them as an excuse not to learn to code. The robots aren’t going to do it for you. The engineers who will get the most out of AI assistants are those who know software best. They’ll know when to give control to the coding assistant and how to constrain that assistance (perhaps to narrow the scope of the problem they allow it to work on). Less-experienced engineers run the risk of moving fast but then getting stuck or not recognizing the bugs that the AI has created. ... AI can’t replace good programming, because it really doesn’t do good programming.


AI Tools Amplify API Security Threats Worldwide

The financial implications of API breaches prove substantial. According to Kong's report, 55% of organizations experienced an API security incident in the past year. Among those affected, 47% reported remediation costs exceeding $100,000, while 20% faced expenses surpassing $500,000. Gartner's research underscores this urgency, highlighting that API breaches typically result in ten times more leaked data than other types of security incidents. ... While AI technologies, particularly LLMs, drive unprecedented innovation, they introduce new vulnerabilities. These advanced tools enable attackers to exploit shadow APIs, bypass traditional defenses and manipulate API traffic in unexpected ways. The survey indicates that 84% of leaders predict AI and LLMs will increase the complexity of securing APIs over the next two to three years, emphasizing the need for immediate action. Despite 92% of organizations implementing measures to secure their APIs, 40% of leaders remain skeptical about whether their investments will adequately counter AI-driven risks. The regional disparity in preparedness stands out: 13% of U.S. organizations acknowledge taking no specific measures against AI threats, compared to 4% in the U.K.


From AI Assistants to Swarms of Thousands of Collaborating AI Agents: Is Your Architecture Ready?

Agentic AI is likely to create most issues in some areas more than others. The Agentic Architecture Framework identifies seven areas that will require more support in the forms of new or updated frameworks, tools and techniques to support Agentic AI capability-building and architecture development. ... Agentic AI Strategy begins with defining a clear target state across the Agentic AI maturity dimensions and levels. This step establishes the organization’s AI aspirations and provides a benchmark for future transformation. Once the target state is identified, the next step involves conducting a GAP analysis to determine the differences between current capabilities in the previous step, and the organization’s ambition. With these gaps clarified, organizations can then focus on identifying and quantifying high-impact AI use cases that align with business objectives and support progression toward the target state. ... The Agentic AI Operating Model defines how AI systems, people, and processes work together to deliver value. It focuses on integrating AI into the organization’s core operations, ensuring that AI agents operate seamlessly within new and existing workflows and alongside human teams.



Quote for the day:

"No person can be a great leader unless he takes genuine joy in the successes of those under him." -- W. A. Nance

No comments:

Post a Comment