Quote for the day:
"I've learned that people will forget what you said, people will forget what you did, but people will never forget how you made them feel." -- Maya Angelou
The True Value Of Open-Source Software Isn’t Cost Savings
Cost savings is an undeniable advantage of open-source software, but I believe
that enterprise leaders often overlook other benefits that are even more
valuable to the organization. When developers use open-source tools, they join a
collaborative global community that is constantly learning from and improving on
the technology. They share knowledge, resources and experiences to identify and
fix problems and move updates forward more rapidly than they could individually.
Adopting open-source software can also be a win-win talent recruitment and
retention strategy for your enterprise. Many individual contributors see
participating in open-source software communities as a tangible way to build
their own profiles as experts in their field—and in the process, they also
enhance your company’s reputation as a cool place where tech leaders want to
work. However, there’s no such thing as a free meal. Open-source software isn't
immune to vendor lock-in, when your company becomes so dependent on a partner’s
product that it is prohibitively costly or difficult to switch to an
alternative. You may not be paying licensing fees, but you still need to invest
in support contracts for open-source tools. The bigger challenge from my
perspective is that it’s still rare for enterprises to contribute regularly to
open-source software communities.
The Growing Cost of Non-Compliance and the Need for Security-First Solutions
Regulatory bodies across the globe are increasing their scrutiny and
enforcement actions. Failing to comply with well-established regulations like
HIPAA or GDPR, or newer ones like the European Union’s Digital Operational
Resilience Act (DORA) and NY DFS Cybersecurity requirements, can result in
penalties that can reach millions of dollars. But the costs do not stop there.
Once a company has been found to be non-compliant, it often faces reputational
damage that extends far beyond the immediate legal repercussions. ... A
security-first approach goes beyond just checking off boxes to meet regulatory
requirements. It involves implementing robust, proactive security measures
that safeguard sensitive data and systems from potential breaches. This
approach protects the organization from fines and builds a strong foundation
of trust and resilience in the face of evolving cyber threats. ... Many
businesses still rely on outdated, insecure methods of connecting to critical
systems through terminal emulators or “green screen” interfaces. These
systems, often running legacy applications, can become prime targets for
cybercriminals if they are not properly secured. With credential-based attacks
rising, organizations must rethink how they secure access to their most vital
resources.
Researchers unveil nearly invisible brain-computer interface
Today's BCI systems consist of bulky electronics and rigid sensors that prevent
the interfaces from being useful while the user is in motion during regular
activities. Yeo and colleagues constructed a micro-scale sensor for neural
signal capture that can be easily worn during daily activities, unlocking new
potential for BCI devices. His technology uses conductive polymer microneedles
to capture electrical signals and conveys those signals along flexible
polyimide/copper wires—all of which are packaged in a space of less than 1
millimeter. A study of six people using the device to control an augmented
reality (AR) video call found that high-fidelity neural signal capture persisted
for up to 12 hours with very low electrical resistance at the contact between
skin and sensor. Participants could stand, walk, and run for most of the daytime
hours while the brain-computer interface successfully recorded and classified
neural signals indicating which visual stimulus the user focused on with 96.4%
accuracy. During the testing, participants could look up phone contacts and
initiate and accept AR video calls hands-free as this new micro-sized brain
sensor was picking up visual stimuli—all the while giving the user complete
freedom of movement.
Creating SBOMs without the F-Bombs: A Simplified Approach to Creating Software Bills of Material
It's important to note that software engineers are not security professionals,
but in some important ways, they are now being asked to be. Software engineers
pick and choose from various third-party and open source components and
libraries. They do so — for the most part — with little analysis of the security
of those components. Those components can be — or become — vulnerable in a whole
variety of ways: Once-reliable code repositories can become outdated or
vulnerable, zero days can emerge in trusted libraries, and malicious actors can
— and often do — infect the supply chain. On top of that, risk profiles can
change overnight, making what was a well considered design choice into a
vulnerable one almost overnight. Software engineers never before had to consider
these things, and yet the arrival of the SBOM is making them do so like never
before. Customers can now scrutinize their releases, and then potentially reject
or send them back for fixing — resulting in even more work on short notice and
piling on pressure. Even if the risk profile of a particular component changes
between the creation of an SBOM and a customer reviewing it, then the release
might be rejected. This is understandably the cause of much frustration for
software engineers who are often already under great pressure.
Risk & Quality: The Hidden Engines of Business Excellence
/dq/media/media_files/2025/04/08/6WDshzRE4ixEeRPByn45.jpg)
In the world of consultancy, firms navigate a minefield of challenges—tight
deadlines, budget constraints, and demanding clients. Then, out of nowhere,
disruptions such as regulatory shifts or resource shortages strike, threatening
project delivery. Without a robust risk management framework, these disruptions
can snowball into major financial and reputational losses. ... Some leaders see
quality assurance as an added expense, but in reality, it’s a profit multiplier.
According to the American Society for Quality (ASQ), organizations that
emphasize quality see an average of 4-6% revenue growth compared to those that
don’t. Why? Because poor quality leads to rework, client dissatisfaction, and
reputational damage. ... The cost of poor quality is substantial. Firms that
don’t embed quality into their culture ultimately face consequences like
customer churn, regulatory fines, and declining market share. Additionally,
fixing mistakes after the fact is far more expensive than ensuring quality from
the outset. Organizations that invest in quality from the start avoid
unnecessary costs, improve efficiency, and strengthen their bottom line. As
Philip Crosby, a pioneer in quality management, stated, “Quality is free. It’s
not a gift, but it’s free. What costs money are the unquality things—all the
actions that involve not doing jobs right the first time.”
Enabling a Thriving Middleware Market
A more unified regulatory approach could reduce uncertainty, streamline
compliance, and foster an ecosystem that better supports middleware development.
However, given the unlikelihood of creating a new agency, a more feasible
approach would be to enhance coordination among existing regulators. The FTC
could address antitrust concerns, the FCC could promote interoperability, and
the Department of Commerce could support innovation through trade policies and
the development of technical standards. Even here, slow rulemaking and legal
challenges could hinder progress. Ensuring agencies have the necessary
authority, resources, and expertise will be critical. A soft-law approach,
modeled after the National Institute for Standards and Technology (NIST) AI Risk
Management Framework, might be the most feasible option. A Middleware Standards
Consortium could help establish best practices and compliance frameworks.
Standards development organizations (SDOs), such as the Internet Engineering
Task Force or the World Wide Web Consortium (W3C), are well-positioned to lead
this effort, given their experience crafting internet protocols that balance
innovation with stability. For example, a consortium of SDOs with buy-in from
NIST could establish standards for API access, data portability, and
interoperability of several key social media functionalities.
How to Supercharge Application Modernization with AI
The refactoring of code – which means restructuring and, often, partly rewriting
existing code to make applications fit a new design or architecture – is the
most crucial part of the application modernization process. It has also tended
in the past to be the most laborious because it required developers to pore over
often very large codebases, painstakingly tweaking code function-by-function or
even line-by-line. AI, however, can do much of this dirty work for you. Instead
of having to find places where code should be rewritten or modified in order to
optimize it, developers can leverage AI tools to look for code that requires
attention. ... When you move applications to the cloud, the infrastructure that
hosts them is effectively a software resource – which means you can configure
and manage it using code. By extension, you can use AI tools like Cursor and
Copilot to write and test your code-based infrastructure configurations.
Specifically, AI is capable of tasks such as writing and maintaining the code
that manages CI/CD pipelines or cloud servers. It can also suggest opportunities
to optimize existing infrastructure code to improve reliability or security. And
it can generate the ancillary configurations, such as Identity and Access
Management (IAM) policies, that govern and help to secure cloud infrastructure.
Balancing Generative AI Risk with Reward
As businesses start evolving in their use of this technology and exposing it to
a broader base inside and outside their companies, risks can increase. “I’ve
always loved to say AI likes to please,” said Danielle Derby, director of
enterprise data management at TriNet, who joined Rodarte at the presentation.
Risk manifests “because AI doesn’t know when to stop,” said Derby, and you, for
example, may not have thought about including a human or technology guardrail to
keep it from answering a question you hadn’t prepared it to be able to
accurately manage. “There are a lot of areas where you’re just not sure how
someone who’s not you is going to handle this new technology,” she said. ...
Improper data splitting can lead to data leakage, resulting in overly optimistic
model performance, which you can mitigate by using techniques like stratified
sampling to ensure representative splits and by always splitting the data before
performing any feature engineering or preprocessing. Inadequate training data
can lead to overfitting and too little test data can yield unreliable
performance metrics, and you can mitigate these by ensuring there is enough data
for both training and testing based on problem size, and using a validation set
in addition to training and test sets.
Why Cybersecurity-as-a-Service is the Future for MSPs and SaaS Providers
For MSPs and SaaS providers, adopting a proactive, scalable approach to
cybersecurity—one that provides continuous monitoring, threat intelligence, and
real-time response—is crucial. By leveraging Cybersecurity-as-a-Service (CSaaS),
businesses can access enterprise-grade security without the need for extensive
in-house expertise. This model not only enhances threat detection and mitigation
but also ensures compliance with evolving cybersecurity regulations. ... The
increasing complexity and frequency of cyber threats necessitate a proactive and
scalable approach to security. CSaaS offers a flexible solution by outsourcing
critical security functions to specialized providers. This ensures continuous
monitoring, threat intelligence, and incident response without the need for
extensive in-house resources. As cyber threats evolve, CSaaS providers
continuously update their tools and techniques, ensuring we stay ahead of
emerging vulnerabilities. CSaaS enhances our ability to protect sensitive data
and allows us to confidently focus on core business operations. As threats
evolve, CSaaS providers continually update their tools and techniques, ensuring
companies stay ahead of emerging vulnerabilities. ... Embracing CSaaS is
essential for maintaining a robust security posture in an increasingly complex
digital landscape.
Meta: WhatsApp Vulnerability Requires Immediate Patch
Meta has voluntarily disclosed the new WhatsApp vulnerability, now published as
CVE-2025-30401, after investigating it internally as a submission to its bug
bounty program. The company says there is not yet evidence that it has been
exploited in the wild. The issue likely impacts all Windows versions prior to
2.2450.6. The WhatsApp vulnerability hinges on an attacker sending a malicious
attachment, and would require the target to attempt to manually view the
attachment within the software. A spoofing issue makes it possible for the file
opening handler to execute code that has been hidden as a seemingly valid MIME
type such as an image or document. That could pave the way for remote code
execution, though a CVE score has yet to be assigned as of this writing. ... The
WhatsApp vulnerability exploited by Paragon was a much more devastating
zero-click (and one that targeted phones and mobile devices), similar to one
exploited by NSO Group on the platform to compromise over a thousand devices.
That landed the spyware vendor in trouble in US courts, where it was found to
have violated national hacking laws. The court found that NSO Group had obtained
WhatsApp’s underlying code and reverse-engineered it to create at least several
zero-click vulnerabilities that it put to use in its spyware.
No comments:
Post a Comment