Showing posts with label BISO. Show all posts
Showing posts with label BISO. Show all posts

Daily Tech Digest - June 09, 2025


Quote for the day:

"Motivation gets you going and habit gets you there." -- Zig Ziglar


Architecting Human-AI Relationships: Governance Frameworks for Emotional AI Integration

The talent retention implications prove equally compelling, particularly as organizations compete for digitally native workforce demographics who view AI collaboration as a natural extension of professional relationships. ... Perhaps most significantly, healthy human-AI collaboration frameworks unleash innovation potential that traditional technology deployment approaches consistently fail to achieve. When teams feel psychologically safe in their AI partnerships—confident that transitions will be managed thoughtfully and that their emotional investment in digital collaborators is acknowledged and supported—they demonstrate a remarkable willingness to explore advanced AI capabilities, experiment with novel applications, and push the boundaries of what artificial intelligence can accomplish within organizational contexts. ... The ultimate result is organizational resilience that extends far beyond technical robustness. Comprehensive governance approaches that address technical performance and psychological factors create AI ecosystems that adapt gracefully to technological change, maintain continuity through system transitions, and sustain collaborative effectiveness across the inevitable evolution of artificial intelligence capabilities.


CISOs reposition their roles for business leadership

“The CISOs of the present and the future need to get out of being just technologists and build their influence muscle as well as their communication muscle,” Kapil says. They need to be able to “relay the technology and cyber messaging in words and meanings where a non-technologist actually understands why we’re doing what we’re doing.” ... “CISOs who are enablers can have the greatest impact on the business because they understand the business objectives,” LeMaire explains. “I like to say we don’t do cybersecurity for cybersecurity’s sake. … Ultimately, we do cybersecurity to contribute to the goals, missions, and objectives of the greater organization. When you’re an enabler that’s what you’re doing.” ... The BISO role emerged to bridge the gap between business objectives and cybersecurity oversight that has existed in many companies, Petrik says. “By acting as a liaison between business, technology, and cybersecurity teams, the BISO ensures that security measures are aligned with business strategies and integrated effectively,” he says. Digital transformation, emerging technologies, and rapid innovation are business mandates, and security teams add value and manage risk better when they are involved before a platform is selected or implemented, he says.


Balancing Safety and Security in Software-Defined Vehicles

Features such as Bluetooth, Wi-Fi, and cellular networks improve user convenience but create multiple attack vectors. For example, infotainment systems, because of their connectivity, are prime targets on software-defined vehicles. The recent Nissan LEAF hack revealed exactly this vulnerability, with researchers using the vehicle’s infotainment system as an entry point to access critical vehicle controls, including the steering. Not only can attackers gain access to data and location information, they can use vulnerable infotainment systems as an on-ramp to access other critical vehicle systems, like Advanced Driver Assistance Systems (ADAS), CAN-Bus, or key engine control units. ... Real-Time Operating Systems play a key role in the functionality of software-defined vehicles, as they enable precise, time-critical operations for systems like Electronic Control Units (ECUs). ECUs are primarily programmed in C and C++ due to the need for efficiency and performance in resource-constrained environments. ... Memory-based vulnerabilities, inherent to C/C++ programming, can be exploited to enable remote code execution, potentially compromising critical safety and performance systems. This creates serious cybersecurity and reliability concerns for vehicles. As RTOS suppliers manage numerous processes, any vulnerability in their codebase can be a gateway for attackers, increasing the likelihood of malicious exploits across the interconnected vehicle ecosystem.


The agile blueprint for simplifying performance management: Rethinking reviews for real impact

Understanding performance has a psychological side to it. Recognising this effect on performance frameworks, Rashmi suggested that imposter syndrome can be mitigated by making progress visible. “When you see your results in real time, you can’t keep criticising yourself.” The panellists encouraged managers to have personal discussions with their team members, which would help them build bonds. Rashmi highlighted this aspect, which can be leveraged through AI. “If AI says that there has been no potential feedback for the employee in the last month, then let the technology help the manager remind.” She also added, “Scaling up makes the quarterly reviews an exercise; hence, spontaneous quarterly check-ins are important.” Rashmi also advocated for weekly, human-centred check-ins, features that are integrated in HRStop, where it won’t be just about tracking project status, but to understand employees as people. “Treat it like a family discussion,” Rashmi recommended. “A touch of personal conversation builds deeper rapport.” Another aspect that came up in the discussion was coaching. Vimal emphasised that coaching must happen at all levels—from CXOs to interns. “It’s this cultural consistency that builds trust, retention, and performance”, he added.


Is this the perfect use case for police facial recognition?

First, as the judge noted, “fortunately the technology available prevented physical contact going further”. Availability is important here, not just in terms of the equipment being accessible; it has a specific legal element too. Where the technological means to prevent inhumane or degrading treatment are reasonably available to the police, the law in England and Wales may not just permit the use of remote biometric technology, it may even require it. I’m unaware of anyone relying on this human rights argument yet and we won’t know if these conditions would have met that threshold. ... Second, the person was on the watchlist because he was subject to a court order. This was not the public under ‘general surveillance’: a court had been satisfied on the evidence presented that an order was necessary to protect the public from sexual harm from him. He breached that order by insinuating himself into the life of a 6-year-old girl and was found alone with her. He was accurately matched with the watchlist image. The third feature is that the technology did its job. It would be easy to celebrate this as a case of ‘thank goodness nothing happened’ but that would underestimate its significance and miss the legal areas where FRT will be challenged. 


IT leaders’ top 5 barriers to AI success

Data quality issues are a real concern and an actual barrier to AI adoption, but the problem is much larger than the traditional and typical discussion about data quality in transactional or analytical environments, says John Thompson, senior vice president and principal at AI consulting firm The Hackett Group. “With gen AI, literally 100% of an organization’s data, documents, videos, policies, procedures, and more are available for active use,” Thompson says. This is a much larger issue than data quality in systems such as enterprise resource planning (ERP) or customer relationship management (CRM), he says. ... Organizations need the infrastructure in place to educate and train its employees to understand the capabilities and limitations of AI, Ally’s Muthukrishnan says. “Without the right training, adoption and utilization will not achieve the outcome you’re hoping for,” he adds. “While I believe AI is one of the largest tech transformations of our lifetime, integrating it into day-to-day processes is a huge change management undertaking.” ... “The skills gap is only going to grow,” Hackett Group’s Thompson says. “Now is the time to start. You can start with your team. Have them work on test cases. Have them work on personal projects. Have them work on passion projects. [Taking] time for everyone to take a class is just elongating the process to close the skills gap. ...”


Google’s Cloud IDP Could Replace Platform Engineering

Much of the work behind the Google Cloud IDP comes from Anna Berenberg, an engineering fellow with Google Cloud who has been with the company for 19 years. “She is the originator of a lot of these concepts overall … many of these ideas which I did not really understand the impact of until I saw it manifest itself,” said Seroter. “She had this vision that I did not even buy into three years ago. She saw a little further ahead from there, and she has built and published things. It is impressive to have such interesting engineering thought leadership, not just applied to how Google does platforms, but now turning that into how we can change … infrastructure to make it simpler. She is a pioneer of that.” In an interview with The New Stack, Berenberg said that her ideas on the IDP came to her when she looked at how this could all work using Google’s vast compute and services resources to reimagine how platform engineering could be improved. “The way it works is you have a cloud platform, and then on top of it is this thick layer of platform engineering stuff, right?” said Berenberg. “So, platform engineering teams are building a layer on top of infrastructure cloud to do an abstraction and workflows and whatever they need” to improve processes for developers. “It shrinks down because everything shifts down to the platform and now we are providing platform engineering. “


FakeCaptcha Infrastructure HelloTDS Infects Millions of Devices With Malware

The campaign’s cunning blend of social engineering and technical subterfuge has enabled threat actors to compromise systems across a vast array of regions, targeting unsuspecting users as they consume streaming media, download shared files, or even browse legitimate-appearing websites. Gendigital researchers first identified HelloTDS as an intricate Traffic Direction System (TDS) — a malicious decision engine that leverages device and network fingerprinting to select which visitors receive harmful payloads, ranging from infostealers like LummaC2 to fraudulent browser updates and tech support scams. Entry points for the menace include compromised or attacker-operated file-sharing portals, streaming sites, pornographic platforms, and even malvertising embedded in seemingly innocuous ad spots. The system’s filtering and redirection logic allows it to avoid obvious honeytraps such as virtual machines, VPNs, or known analyst environments, significantly complicating detection and takedown efforts. The scale of the campaign is staggering. Gen’s telemetry reported over 4.3 million attempted infections within just two months, with the highest impact in the United States, Brazil, India, Western Europe, and, proportionally, several Balkan and African countries.


Cutting-Edge ClickFix Tactics Snowball, Pushing Phishing Forward

ClickFix first came to light as an attack method last year when Proofpoint researchers observed compromised websites serving overlay error messages to visitors. The message claimed that a faulty browser update was causing problems, and asked the victim to open "Windows PowerShell (Admin)" (which will open a User Account Control (UAC) prompt) and then right-click to paste code that supposedly "fixed" the problem — hence the attack name. Instead of a fix, though, users were unwittingly installing malware — in that case, it was the Vidar stealer. ... "The goals of ClickFix campaigns vary depending on the attacker," says Nathaniel Jones, vice president of security and AI strategy at Darktrace. "The aim might be to infect as many systems as possible to build out a network of proxies to use later. Some attackers are trying to exfiltrate credentials or domain controller files and then sell to other threat actors for initial access. So there isn't one type of victim or one objective — the tactic is flexible and being used in different ways." ... The approach, and ClickFix in general, represents a significant innovation in the world of phishing, according to Jones, because unlike an email asking someone to click on a typosquatted link that can be easily checked, the entire attack takes place inside the browser.


Like humans, AI is forcing institutions to rethink their purpose

The institutions in place now were not designed for this moment. Most were forged in the Industrial Age and refined during the Digital Revolution. Their operating models reflect the logic of earlier cognitive regimes: stable processes, centralized expertise and the tacit assumption that human intelligence would remain preeminent. ... But the assumptions beneath these structures are under strain. AI systems now perform tasks once reserved for knowledge workers, including summarizing documents, analyzing data, writing legal briefs, performing research, creating lesson plans and teaching, coding applications and building and executing marketing campaigns. Beyond automation, a deeper disruption is underway: The people running these institutions are expected to defend their continued relevance in a world where knowledge itself is no longer as highly valued or even a uniquely human asset. ... This does not mean institutional collapse is inevitable. But it does suggest that the current paradigm of stable, slow-moving and authority-based structures may not endure. At a minimum, institutions are under intense pressure to change. If institutions are to remain relevant and play a vital role in the age of AI, they must become more adaptive, transparent and attuned to the values that cannot readily be encoded in algorithms: human dignity, ethical deliberation and long-term stewardship.

Daily Tech Digest - November 17, 2023

Here is how far we are to achieving AGI, according to DeepMindDeep

Mind presents a matrix that measures “performance” and “generality” across five levels, ranging from no AI to superhuman AGI, a general AI system that outperforms all humans on all tasks. Performance refers to how an AI system’s capabilities compare to humans, while generality denotes the breadth of the AI system’s capabilities or the range of tasks for which it reaches the specified performance level in the matrix. ... DeepMind suggests that an AGI benchmark would encompass a broad suite of cognitive and metacognitive tasks, measuring diverse properties, including linguistic intelligence, mathematical and logical reasoning, spatial reasoning, interpersonal and intrapersonal social intelligence, the ability to learn new skills, and creativity. However, they also acknowledge that it is impossible to enumerate all tasks achievable by a sufficiently general intelligence. “As such, an AGI benchmark should be a living benchmark. Such a benchmark should therefore include a framework for generating and agreeing upon new tasks,” they write.


Utilizing A Business Information Security Officer

Unfortunately, a majority of CISOs are spending their limited time firefighting issues rather than contributing to business strategy or forging relationships. This is where a business information security officer (BISO) can come in. According to Forrester, the BISO operates on behalf of the CISO, serving as an advisor and bridge to functional leaders. In other words, it’s a security role that puts business first. ... Security culture can be defined as the values, attitudes, customs, beliefs, and social behaviors that influence the security posture of an organization. It’s the stuff that drives secure behavior in employees (even when no one’s watching); it’s the security instinct that kicks in when someone sees something unusual or suspicious. Traditionally, most CISOs are not in close contact or communication with employees, and therefore, it is difficult for them to influence and promote a positive security culture. With the BISO role, it's different; since the BISO enjoys closer ties with various business groups and has a better understanding of employee requirements and sentiments, they are better positioned to influence culture change.


Russian Hackers Linked to 'Largest Ever Cyber Attack' on Danish Critical Infrastructure

On the 11 companies that were successfully infiltrated, the threat actors executed malicious code to conduct reconnaissance of the firewall configurations and determine the next course of action. "This kind of coordination requires planning and resources," SektorCERT said in a detailed timeline of events. "The advantage of attacking simultaneously is that the information about one attack cannot spread to the other targets before it is too late." "This puts the power of information sharing out of play because no one can be warned in advance about the ongoing attack since everyone is attacked at the same time. It is unusual – and extremely effective." A second wave of attacks targeting more organizations was subsequently recorded from May 22 to 25 by an attack group with previously unseen cyber weapons, raising the possibility that two different threat actors were involved in the campaign. That said, it's currently unclear if the groups collaborated with each other, worked for the same employer, or were acting independently.


Demystifying Event Storming: A Comprehensive Guide to Understanding Complex Systems

Event Storming is a powerful and collaborative workshop-based technique used to gain a deep understanding of complex systems, processes, and domains. It was introduced by Alberto Brandolini, an expert in domain-driven design and Agile software development. Event Storming stands out as a versatile and practical approach that brings together stakeholders, domain experts, software developers, and business analysts to unravel the intricacies of a system. At its core, Event Storming is a visual modeling method that uses sticky notes and a large workspace, such as a wall or whiteboard, to represent various events and interactions within a system. These events can range from user actions, system processes, and domain events to business rules and policies. The workshop participants collaboratively contribute to this visual representation, creating a shared understanding of the system’s behavior and business processes. Event Storming starts with a domain description, then Big Picture. Big Picture Event Storming is the first step in understanding complex systems. 


Integration of Cybersecurity into Physical Security Realm

In this era of evolving cyber threats, integrating cybersecurity into physical security is not a choice but an organizational necessity. In most cases, physical security and cybersecurity work as two sides of the same backbone in the spectrum of security. Physical security protects tangible assets, such as buildings, equipment, and people, from physical threats. On the other hand, cybersecurity focuses on safeguarding digital assets, information, and systems from virtual threats, including hacking, malware, and data breaches. In this context, just as a backbone provides structural support to the body, the integration of cybersecurity into the realm of physical security offers a robust defense for an organization. This fusion of digital and physical security measures creates a comprehensive defense strategy which safeguards firm-specific assets, personnel, and data from various threats. This integrated approach ensures not only the protection of the physical infrastructure but also the prevention of unauthorized access, tampering, and disruptions caused by cyberattacks. It is paramount to understand how cybersecurity enhances physical security systems’ resilience.


Bridging the expectation-reality gap in machine learning

The engineers who wrangle company data to build ML models know it’s far more complex than that. Data may be unstructured or poor quality, and there are compliance, regulatory, and security parameters to meet. There is no quick-fix to closing this expectation-reality gap, but the first step is to foster honest dialogue between teams. Then, business leaders can begin to democratize ML across the organization. Democratization means both technical and non-technical teams have access to powerful ML tools and are supported with continuous learning and training. Non-technical teams get user-friendly data visualization tools to improve their business decision-making, while data scientists get access to the robust development platforms and cloud infrastructure they need to efficiently build ML applications. At Capital One, we’ve used these democratization strategies to scale ML across our entire company of more than 50,000 associates. When everyone has a stake in using ML to help the company succeed, the disconnect between business and technical teams fades. So what can companies do to begin democratizing ML? 


Generative AI Solution Architecture for Complex Enterprises

Generative AI tends to be non-deterministic (running it multiple times even with the same input may result in different behaviour each time it is run). Therefore, how we design, manage and test it needs different thinking from more traditional deterministic technologies. As with machine learning in general, maths and algorithms that are inaccessible to the average person (without knowledge of statistics and data science) create issues in understanding and transparency. Add to this the complexity of enterprise architecture (business, data, applications and applications) in modern organisations, and explainability becomes even more difficult. This non-deterministic behaviour also creates consistency, reliability and repeatability challenges. ... Scaling systems powered by machine learning is challenging. Creating an algorithm in a lab environment that comes up with an answer in several hours is OK for a one-off exercise, but simply won’t cut it for real-time customer interaction at scale. It won’t simply be the performance of the ML models; how you integrate these models with enterprise data stores and systems of record will also impact performance. 


Why cyber war readiness is critical for democracies

We can’t talk about the war in Ukraine and not mention cyber attacks aimed at disrupting operational technology (OT) used by companies that are part of the country’s critical infrastructure (CI). In his talk, Ferguson briefly passed through the known attacks that hit CI entities with OT-specific malware, starting with Stuxnet in 2010 and ending with CosmicEnergy in 2023. Some of the attacks are believed to be the work of the US and Israel (Stuxnet), cybercriminals or are still unattributed (the destructive 2014 attack against a steel plant in Germany). But the rest, he noted, are all believed to have been mounted by Russian state-backed attackers. And, he says, they are getting better at it. Mirroring the development of attacks against IT systems, they have recently begun exploiting legitimate tools found in OT environments, so they don’t need to develop customized malware. Many attackers are scanning for OT-specific protocols and probing OT devices, Ferguson noted. While their actual exploitation hinges on the skills of the attackers, some modes of attack are available to those who are less skilled, but eager. 


Unpatched Critical Vulnerabilities Open AI Models to Takeover

The risk is not theoretical: Large companies have already embarked on aggressive campaigns to find useful AI models and apply them to their markets and operations. Banks already use machine learning and AI for mortgage processing and anti-money laundering, for example. While finding vulnerabilities in these AI systems can lead to compromise of the infrastructure, stealing the intellectual property is a big goal as well, says Daryan Dehghanpisheh, president and co-founder of Protect AI. "Industrial espionage is a big component, and in the battle for AI and ML, models are a very valuable intellectual property asset," he says. "Think about how much money is spent on training a model on the daily basis, and when you're talking about a billion parameters, and more, so a lot of investment, just pure capital that is easily compromised or stolen." Battling novel exploits against the infrastructure underpinning natural-language interactions that people have with AI systems like ChatGPT will be even more impacting, says Dane Sherrets, senior solutions architect at HackerOne.


How to prepare for anything

In Latin, Audi means listen (translated from German horch, which is also the name of Audi’s founder, August Horch). And that is exactly what Mohr decided to do: listen to the questions he and his team were asking themselves. Mohr chose a human approach to understanding how change comes about. It revolves around understanding and embracing the five levels or shades of uncertainty on the journey toward transformation: wonder, skepticism, curiosity, doubt, and creativity. ... “We needed to understand what really matters to our people in order to initiate meaningful change,” Stine Thomssen, who is part of Mohr’s leadership team, recalls. Understanding what really matters to your employees requires insight into their ways of thinking and talking about their everyday practice. This calls for a systematic approach of tapping into the questions people are asking one another in your organization. In the case of the paint shop, it involved setting up several workshops and using a digital platform to engage employees in peer-to-peer conversations about the future. 



Quote for the day:

''The manager asks how and when, the leader aks what and why.'' -- Warren Bennis

Daily Tech Digest - January 05, 2023

Singh calls herself a business information security partner, but the title most commonly employed for this role is business information security officer (BISO). People in these roles are responsible for one or more areas of the business and they usually report to the CISO or CTO, based on job descriptions found online and those laid out by multiple sources interviewed for this article. The people holding these roles also come from diverse educational and experiential backgrounds, at the core of which are strong familiarity with compliance regulations, solid cybersecurity foundations, and business acumen. ... Renee Guttmann, who’s been CISO to several Fortune 50 companies, says that the most important thing she looks for in a BISO is a thorough understanding of the business unit they support, which includes identifying the company’s “crown jewels”: what the most important assets are, where they are, and the targeted attacks to which they are potentially vulnerable. The BISO should be able to identify the risks and work with others, such as architecture and infrastructure managers, to prioritize risks.


DevOps: 3 steps to plan and execute a successful project

The preliminary stages of a DevOps project are crucial. Without clear direction and a shared understanding across the team, the initiative is doomed to failure. The team and the client must therefore be willing to dedicate the time necessary to understand each other’s goals and ensure their visions align. This can be done through meetings and workshops, where participants identify objectives and team members establish a clear goal for how the final product should look. When executed correctly, the DevOps team will exit the project’s first phase with a well-defined brief and a clear understanding of the client’s goals. If this step is rushed, engineers will be hindered by a lack of direction, increasing the likelihood that the finished product will not meet the client’s requirements. ... Phase two is when the development of the app begins. This is usually facilitated by using a cloud-based solution, where the team begins preparing the environment’s aesthetic, working out the components it should contain, and understanding how they should be configured to maximize efficiency.


5 Key Kubernetes Trends to Follow in 2023

Multi-cluster Kubernetes is important because it makes it feasible to separate workloads using not just namespaces, but entirely distinct clusters. Doing so provides more security and performance protections than you can get using namespaces, which offer only virtualized segmentation between workloads. As a result, multi-cluster Kubernetes makes Kubernetes more valuable for use cases that involve very stringent security requirements, or where it's critical to avoid the "noisy neighbor" problems that can happen when multiple workloads share the same hosting infrastructure. ... No one has ever accused Kubernetes of being an easy platform to use. On the contrary, you'll find plenty of warnings on the internet that Kubernetes is "hard," or even "damn complicated." But you could have said the same thing about Linux in the 1990s, or the Amazon cloud in the mid-2000s, when those platforms were new. Like other major technologies that preceded it, Kubernetes is still growing up, and there remains plenty of room to improve it by improving the platform's usability.


Moving Beyond Security Awareness to Security Education

“Unlike awareness, application security education is based on central principles or ‘big ideas’. If key security concepts are part of a continuous and programmatic education initiative, development teams can learn to apply knowledge, skills, and experience to novel situations and better secure applications,” said Baker. When application security principles are understood, developers can then not only identify when code isn’t quite right or spot something that creates risk, but also effectively design against it. “Awareness doesn’t go far enough for security-critical roles such as software developers, product and UX managers, quality assurance and scrum masters who are all responsible for delivering safe applications,” said Baker. “What’s needed is deeper education, and there are several ways that this can be incorporated into the awareness training mix.” First and foremost, Baker stated, the concept of continuous and programmatic security education—and why it matters for security-critical roles—requires buy-in from everyone within the organization. 


Blow for Meta: must stop serving personalised ads until it's GDPR compliant

According to nyob, ten confidential meetings took place between Meta and the DPC during the course of the proceedings, over which time the DPC came down on the side of the company and its bypassing of the standard GDPR rules for consent. Schrems has launched multiple successful legal campaigns against technology companies and their misuse of personal data. He said: "This case is about a simple legal question. Meta claims that the 'bypass' happened with the blessing of the DPC. For years the DPC has dragged out the procedure and insisted that Meta may bypass the GDPR, but was now overruled by the other EU authorities. It is overall the fourth time in a row the Irish DPC got overruled." Schrems claimed the DPC had refused to release the details of the decision to nyob and accused the regulator of playing "a very diabolic public relations game". He added: "By not allowing noyb or the public to read the decision, it tries to shape the narrative of the decision jointly with Meta. It seems the cooperation between Meta and the Irish regulator is well and alive - despite being overruled by the EDPB"


What is data ingestion?

At its simplest, data ingestion is the process of shifting or replicating data from a source and moving it to a new destination. Some of the sources from which data is moved or replicated are databases, files or even IoT data streams. The data moved and/or replicated during data ingestion is then stored at a destination that can be on-premises. ... Data ingestion uses software automation to move large amounts of data efficiently, as the operation requires little manual effort from IT. Data ingestion is a mass means of data capture from virtually any source. It can deal with the extremely large volumes of data that are entering corporate networks on a daily basis. Data ingestion is a “mover” technology that can be combined with data editing and formatting technologies such as ETL. By itself, data ingestion only ingests data; it does not transform it. For many organizations, data ingestion is a critical tool that helps them manage the front end of their data and data just entering their enterprise. A data ingestion tool enables companies to immediately move their data into a central data repository without the risk of leaving any valuable data “out there” in sources that may later no longer be accessible.


The Most Futuristic Tech at CES 2023

TCL's RayNeo X2 AR glasses are available for demo at CES 2023, and CNET's Scott Stein was able to use them to translate a conversation with a Chinese speaker in real time. The frames on the RayNeo X2 AR glasses are slightly bulkier than regular eyeglass frames, but prescription inserts eliminate the need to wear other glasses underneath, and the expected introduction of Qualcomm's AR1 chipset should reduce the size further. The RayNeo X2 AR glasses will be released to the developer community at the end of the first quarter of 2023, with a commercial launch set for later in the year. ... One of the more unusual prototypes shown at CES 2023 is a wearable neckband from a Japanese startup company called Loovic. The device hangs around your neck, sort of like studio headphones when not in use, and provides audio and tactile directions to help you navigate without looking at your phone. The device was inspired by Loovic CEO Toru Tamanka's son, who suffers from a cognitive impairment that makes following directions difficult. It will work for anyone who wants to receive navigation while keeping their head up. 


Kubernetes must stay pure, upstream open-source

Vendors may modify code for their custom distributions or the supporting applications you need to make Kubernetes run in production. While a modified version of Kubernetes will work with a particular vendor’s application stack and management tools, these proprietary modifications lock you into customized component builds preventing you from integrating with other upstream open-source projects without lock-in. And if their stack comprises multiple products, it’s very hard to achieve interoperability, which can cause lots of downstream issues as you scale. ... It’s incredibly difficult to merge back a fork that has diverged drastically over the years from the upstream. This is called technical debt – the cost of maintaining source code caused by deviation from the main branch where joint development happens. The more changes to forked code, the more money and time it costs to rebase the fork to the upstream project.


Managing Remote Workforces: IT Leaders Look to Expanded Suite of Tools

Ramin Ettehad, co-founder of Oomnitza, says organizations must connect their key systems and orchestrate rules, policies, and workflows across the technology and employee lifecycle, not with tickets and manual workloads, but rather with conditional rule-based automation of all tasks across teams and systems. He notes an example of a key business process that is challenged in a remote working world is employee onboarding and offboarding. “Companies want to make a positive first impression by offering new employees a consumer-esque onboarding experience,” he says. “This effort will maximize employee experience and time to productivity.” From the perspective of Dan Wilson, vice president analyst in the Gartner IT practice, some key tech tools for remote workforce management include remote Control for IT support to remotely see and interact with computers, as well as Unified Endpoint Management (UEM). “UEM lets IT departments discover, manage, configure devices, and deploy software and operating system updates without having to connect to the corporate network or VPN,” he explains.


Social Engineering Attacks: Preparing for What’s Coming in 2023

Impersonation and comment spam have exploded over the past year and will likely be some of the most prominent forms of phishing in 2023. This type of social engineering attack exploits the trust and recognition associated with influencers. Attackers create an account on a social media site that looks nearly identical to an influencer’s. The posts are often giveaway announcements, declaring that fans just need to “click this link” or “DM this account on Telegram” to collect their winnings. Instead, people are tricked into giving away money and are ghosted by the fake account. Impersonation and comment spam have become so serious on YouTube that prominent creators have asked the platform to address the issue. The scam results in monetary theft and hurts the reputation of the creators being impersonated. ... One peculiar new form of social engineering on the rise is reputation ransomware. This scare tactic exploits the headline nature of data breach announcements. The cybercriminal will demand ransom from the victim organization, threatening to “leak” news of a fictional data breach if they do not pay.



Quote for the day:

"Without continual growth and progress, such words as improvement, achievement, and success have no meaning.” -- Benjamin Franklin