Daily Tech Digest - July 15, 2020

The Microsoft-Android transformation is about to affect us all

Unlike a traditional Android app, though, a progressive web app can run on a computer, too — any computer — in that same single form. And that means it's way easier and more economical for developers to maintain a single progressive web app and have that one version of their program run everywhere. And if the end result is just as good as what you'd get with a native app — or close enough to seem practically the same, for most real-world purposes — then there's no real downside. It's a win-win-win, for developers, for gatekeepers like Microsoft and Google, and for us feline-impersonating land-people who rely on Android phones. For Microsoft, the move means more and more apps could run in identical forms on both Windows and Android — and thus despite the fact that it's venturing into uncharted territory by fully embracing Android and steering folks into its own mini-ecosystem within Google's universe, it can begin to offer a surprisingly consistent experience for anyone embracing a mix of Android and Windows. For Google, it means the amount of exceptional Android apps will only continue to grow and become more diverse. And remember, it isn't just about Android for Google, either; the company is equally interested in pushing Chrome OS forward

Detecting and Resolving Database Connection Leaks with Java Applications

Here removeAbandoned when set to true to try to remove abandoned connections and return them to pool again in configured removeAbandonedTimeout in seconds. Setting this to true can recover database connections from poorly written applications that fail to close a connection. The logAbandoned property is also very important as it can log the complete stack-trace which might be leaking the connection, thus can be very useful to identify connection leak in application. Stack-Trace is logged in terminal itself. In Red Hat Fuse we can see these stack-traces logged by logAbandoned in karaf terminal and not in application log or fuse.log file. All these properties are mentioned commons-dbcp doc. The timeBetweenEvictionRunsMillis property can also be helpful, it is set in milliseconds. When set than a separate thread will run to remove idle object evictor thread in every configured millisecond. Its default value is -1 which means this idle object evictor thread wouldn't be active and running and only when set to a positive integer then it would be effective.

Hack Brief: Microsoft Warns of a 17-Year-Old ‘Wormable’ Bug

While those organizations rarely expose their Windows DNS servers to the internet, both Check Point and Williams warn that many administrators have made architectural changes to networks—often questionable ones—to better allow employees to work from home since the beginning of the Covid-19 pandemic. That could mean more exposed Windows DNS servers that are open to full remote exploitation. "The threat landscape of internet-exposed things has risen dramatically" in recent months, Williams says. The good news, Check Point says, is that detecting SigRed exploitation of a Windows DNS server is relatively easy, given the noisy communications necessary to trigger the vulnerability. The firm says that despite the 17 years that SigRed has lingered in Windows DNS, it has yet to find any indication of an attack on its clients' networks so far. "We're not aware of anyone using this, but if they did, hopefully now it will stop," Herscovici says. But in the short term at least, Microsoft's patch could also lead to more exploitation of the bug as hackers reverse engineer the patch to discover exactly how the vulnerability can be triggered.

CIA behind APT34 and FSB hacks and data dumps

In an exclusive today, Yahoo News reported that the agency used its newly acquired powers to orchestrate "at least a dozen operations" across the world. The CIA was already authorized to conduct silent surveillance and data collection, but the new powers allow it to go even further. "This has been a combination of destructive things - stuff is on fire and exploding - and also public dissemination of data: leaking or things that look like leaking," a former US government official told Yahoo News. ... Citing former US officials, Yahoo News claims that such operations would have never been approved in the previous administrations, who have always been very cautious when attacking foreign adversaries, fearing blowback. However, in 2018, President Trump departed from the White House's classic stance on the matter and signed a document called a presidential finding, granting the CIA the ability to plan and execute covert offensive cyber operations under its judgment, rather than under the oversight of the National Security Council. The document effectively took the decision making and approval process from the White House and the National Security Council and placed it with CIA leadership in an attempt to expedite foreign hacking operations.

Why You Should Consider Blockchain As A Technology To Learn

The blockchain provides an ideal infrastructure for the universal application of cryptography, which can effectively promote the universal application of cryptography protocols. Their application can effectively protect personal privacy and business secrets, ensure the standard implementation of contracts and processes, strengthen trust and prevent fraud, and then the basic values of modern society: freedom, fairness and trust. ... The second-generation blockchain represented by Ethereum is equivalent to a computer where all nodes share state. On top of this infrastructure, smart contracts can code and automate complex business actions in a clear way. If the asset is digitized, the smart contract can automatically manage the digital asset according to a predetermined contract. Smart contracts promote the “code as law”. The biggest advantage of Ethereum is that it is a distributed consensus system without centralized control. In addition, because of the emergence of digital currency, we can use microeconomics to create a new system that subverts the tradition in a new way. The emergence of smart contracts provides an effective way for the blockchain to process data in a programmable and automated manner.

Juniper targets security portfolio at SASE race

Juniper uses AI-driven automation, insight and actions across the LAN, WLAN and WAN to optimize the end-to-end user experience, Madrid stated. This includes customized Service Level Expectations, event correlation across the LAN and WAN for rapid fault isolation and resolution, AI-driven support with proactive notifications and an interactive Virtual Network Assistant (VNA) called Marvis to provide recommended actions and/or keep the network humming autonomously, Madrid stated Juniper’s SASE plans come on the heels of recent announcements by other key players in what is expected to be a hot market. For example, VMware in June said it was advancing secure access for remote and mobile workers by mixing its Workspace ONE offering with its SD-WAN package. The resulting VMware SD-WAN Zero Trust Service promises to help enterprises handle growing distributed workloads for remote workers. The service also represents a big step toward SASE, the company said. “Speed and data are two of the most valuable business currencies in today’s rapid growth environment, both of which have rendered traditional security deployments insufficient and ineffective,” VMware stated.

How DigitalOps links together business models and digital platforms

“Step one is creating a shared and living ‘map’ of your business,” said Shearer. “We would recommend using Domain Driven Design, as it gives the DigitalOps team a good way to communicate with teams on important business elements, how they relate to one another, to users and to revenue. It also provides a pattern to follow when implementing new digital services. “Next you’ll need to determine the areas that are both mission critical and market differentiating. Everything else should be brought in or delivered with a partner. Focus on your core strengths and specialisms as this is where you stand the best chance of success. “Last but not least, this must be underpinned with a commitment to a culture of rapid innovation, with your users integrated into your product process. Without this, you simply can’t hope to succeed and good intentions can quickly turn into missed opportunities and lost competitive advantage.” Staying on the topic of culture within the workplace, White commented: “DigitalOps follows the same approach to other XOps approaches, such as DevOps, by focussing on the removal of barriers, silos and increasing collaboration between cross-functional teams.

Ensure remote users meet data protection standards

As measures to relax lockdowns are being delivered in phases, IT staff should recognize that the initial phase of business continuity has passed. The next phase requires a more measured approach. There was no time to train users and implement standard applications, but now administrators should audit all systems accessing corporate data and standardize on secure collaborative apps. This thorough approach is essential for remote data protection. IT administrators should contact users directly to ensure they are familiar with the standard work applications and processes. If administrators need to remove some consumer apps, they should explain why upending their established workflows is necessary. In many cases, these workers adopted new applications without much guidance. However, users will have to understand that the new best practices are the only way for IT to ensure data security going forward. Under no circumstances, however, should IT allow unsafe apps such as WhatsApp and Facebook Messenger to access business data; this is a direct threat to remote data security. Where users relied on personal devices for work, offer alternatives such as a unified endpoint management (UEM) policy with low restrictions.

Why the Merging of the DevOps Driven Cloud and Cybersecurity Will Create Dozens of New Category Leaders

The massive paradigm shift to cloud requires a very different skill set than on premises. Whereas once IT and DevOps were considered the foundation and cybersecurity was "a final 'check the box' for compliance", this model simply can’t exist in a dynamic cloud-based world. The acceleration with which remote and distributed activity is happening requires these two disciplines to mesh even faster. Everything that was once done on premise must now be done in the cloud and must be done using tools built and optimized for the cloud environment. That puts cloud-based cybersecurity innovators in a unique and valuable position of being revenue-generating quickly relative to other new categories, while simultaneously creating and defining a new space (cloud-first security products). ... Important to note the picks and axes of the cloud will continue to be dominated by a handful of the biggest tech companies in the world. Over the last decade, AWS, Microsoft Azure and Google Cloud Platform have grown to over $80B in annual cumulative revenue. The fast followers trying to take share in this area are not start-ups, but rather IBM, Oracle and Alibaba.

A Modern Data Storage Paradigm; Reducing the High Cost of Data Management

The new paradigm combines a file-based Primary Tier and an object-based Perpetual Tier. The Primary Tier (or Project Tier) holds all in-progress data and active projects. It is made up of flash, DRAM, and high-performance disk drives to meet the requirements of critical data workflows dependent on response time. The Perpetual Tier can accommodate multiple storage media types – including any combination of cloud storage, object storage, network-attached storage (NAS) and tape – to address data protection, multi-site replication (sharing), cloud and data management workflows. Data moves seamlessly between tiers as it is manipulated, analyzed, shared and protected. Implementing a proper storage management strategy within a two-tier paradigm allows organizations to address today’s most relevant data storage problems, while creating an environment open to future growth, development and change. Modern storage management software (SMS) maximizes efficiency by ‘smartly’ migrating data to the appropriate level of storage.

Quote for the day:

"Leaders need to strike a balance between action and patience." -- Doug Smith

No comments:

Post a Comment