Daily Tech Digest - March 12, 2022

The Similarities and Differences between ITIL 4 and VeriSM

Even though ITIL has been around for many years and is considered the de facto best practice framework for IT service management (ITSM), VeriSM emerged in 2018 to find its place in the market. And this came before the launch of ITIL 4 from AXELOS in February 2019. VeriSM’s publication introduced some modern approaches in service management such as Agile and shift-left among others. ITIL 4, once released, also incorporated these modern concepts that have conquered the IT world during the last few years. VeriSM claims not to be a body of service management best practice but is instead an approach where the key facet of the model (it’s not a process flow, nor a set of procedures) is the Management Mesh where all the popular management practices (ITIL, COBIT, ISO/IEC 20000, CMMI-SVC, DevOps, Agile, Lean, SIAM, etc.) and emerging technologies and trends (artificial intelligence (AI), containerization, the Internet of Things (IoT), big data, cloud, shift-left, continuous delivery, CX/UX, etc.) are included. Maybe there’s some truth in this statement. 

Solo.io Intros Gloo Mesh Enterprise 2.0

Introduced last year, Gloo Mesh Enterprise is an Istio-based Kubernetes-native solution for multicluster and multimesh service mesh management. New features in 2.0 such as multitenant workspaces enable users to set fine-grained access control and editing permissions based on roles for shared infrastructure, enabling teams to collaborate in large environments. Users can manage traffic, establish workspace dependencies, define cluster namespaces, and control destinations directly in the UI. And the policies can be re-used and adapted using labels. Gloo Mesh Enterprise 2.0 also features a new Gloo Mesh API for Istio management enables developers to configure rules and policies for both north-south traffic and east-west traffic from a single, unified API. The new API also simplifies the process of expanding from a single cluster to dozens or hundreds of clusters. And the new Gloo Mesh UI for observability provides service topology graphs that highlight network traffic, latency, and speeds while automatically saving the new state when you move clusters or nodes. 

Introducing Community Security Analytics

You can use CSA to further investigate high-fidelity security findings from Security Command Center (SCC) and correlate them with logs for decision-making. For example, you may use a CSA query to get the list of admin activity performed by a newly created service account key flagged by Security Command Center in order to validate any malicious activity. It’s important to note that the detection queries provided by CSA will be self-managed and you may need to tune to minimize alert noise. If you’re looking for managed and advanced detections, take a look at SCC Premium’s growing threat detection suite which provides a list of regularly-updated managed detectors designed to identify threats within your systems in near real-time. CSA is not meant to be a comprehensive, managed set of threat detections, but a collection of community-contributed sample analytics to give examples of essential detective controls, based on cloud techniques. Use CSA in conjunction with our threat detection and response capabilities in conjunction with our threat prevention capabilities.

µTransfer: A technique for hyperparameter tuning of enormous neural networks

Our theory of scaling enables a procedure to transfer training hyperparameters across model sizes. If, as discussed above, µP networks of different widths share similar training dynamics, they likely also share similar optimal hyperparameters. Consequently, we can simply apply the optimal hyperparameters of a small model directly onto a scaled-up version. We call this practical procedure µTransfer. If our hypothesis is correct, the training loss-hyperparameter curves for µP models of different widths would share a similar minimum. Conversely, our reasoning suggests that no scaling rule of initialization and learning rate other than µP can achieve the same result. This is supported by the animation below. Here, we vary the parameterization by interpolating the initialization scaling and the learning rate scaling between PyTorch default and µP. As shown, µP is the only parameterization that preserves the optimal learning rate across width, achieves the best performance for the model with width 213 = 8192, and where wider models always do better for a given learning rate—that is, graphically, the curves don’t intersect.

Will Transformers Take Over Artificial Intelligence?

Transformers quickly became the front-runner for applications like word recognition that focus on analyzing and predicting text. It led to a wave of tools, like OpenAI’s Generative Pre-trained Transformer 3 (GPT-3), which trains on hundreds of billions of words and generates consistent new text to an unsettling degree. The success of transformers prompted the AI crowd to ask what else they could do. The answer is unfolding now, as researchers report that transformers are proving surprisingly versatile. In some vision tasks, like image classification, neural nets that use transformers have become faster and more accurate than those that don’t. Emerging work in other AI areas — like processing multiple kinds of input at once, or planning tasks — suggests transformers can handle even more. “Transformers seem to really be quite transformational across many problems in machine learning, including computer vision,” said Vladimir Haltakov, who works on computer vision related to self-driving cars at BMW in Munich. Just 10 years ago, disparate subfields of AI had little to say to each other. But the arrival of transformers suggests the possibility of a convergence.

The Questionable Ethics Of Bitcoin ESG Junk Science

In February 2022, an op-ed, titled “Revisiting Bitcoin’s Carbon Footprint,” was published in the scientific journal “Joule,” authored by four researchers: Alex de Vries, Ulrich Gallersdörfer, Lena Klaaßen and Christian Stoll. Their written commentary, which admits limitations in their estimates, states that as bitcoin miners migrated from China to Kazakhstan and the United States in 2021, the network’s carbon footprint increased to 0.19% of global emissions. What went unnoticed by the media was that the researchers have professional motives to overstate Bitcoin’s relatively tiny environmental impact. The op-ed’s lead author, Alex de Vries, failed to disclose that he is employed by De Nederlandsche Bank (DNB), the Dutch central bank. Central banks are no fans of open, global payment rails, which bypass monopolistic government settlement layers. De Vries first released his “Bitcoin Energy Consumption Index” in November 2016, which coincides with his first round of employment with DNB, giving the appearance that DNB encouraged his critique of Bitcoin’s energy consumption. 

DBaaS and the Enterprise

From a DBA perspective (and being a former DBA myself), I always enjoyed working on more challenging issues. Mundane operations like launching servers and setting up backups make for a less-than-exciting daily work experience. When managing large fleets, these operations make up the majority of the work. As applications grow more complex and data sets grow rapidly, it is much more interesting to work with the application teams to design and optimize the data tier. Query tuning, schema design, and workflow analysis are much more interesting (and often beneficial) when compared to the basic setup. DBAs are often skilled at quickly identifying issues and understanding design issues before they become problems. When an enterprise adopts a DBaaS model, this can free up the DBAs to work on more complex problems. They are also able to better engage and understand the applications they are supporting. A common comment I get when discussing complex tickets with clients is: “well, I have no idea what the application is doing, but we have an issue with XYZ”.

How to Develop Strategies that Close the Leadership Gap with the Generation Gap

The leadership gap that has been forecasted for the past several years is upon us. And, it could not have come at a worse time with the Covid-19 pandemic still underway, impacting each of the multiple generations in the workforce differently. Many companies are unable to keep pace with their need to fill leadership openings created by Baby Boomers taking retirement and by companies expanding, in some cases at rapid rates. Their pipelines are not sufficient to fill the increasing number of leadership openings promptly. Companies that lack a focused strategy and drive to close this gap might very well find themselves struggling to stay in business and maintain their market share. The significant numbers of Baby Boomers taking retirement for the past ten years have only exacerbated the leadership gap. Many of them are leaving their leadership roles for their well-earned leisure lifestyle. In the third quarter of 2020, the number of Boomers who retired increased by over three million from the same quarter in 2019. 

How Digital Transformation is Rebuilding the Construction Industry

As construction companies continue to comply with pandemic restrictions, technology has been essential to the implementation of health and safety measures. For instance, firms can use wearables and AI sensors to detect when workers are not maintaining proper physical distance. Some construction projects are even using contact tracing devices that alert employees when there are too many personnel at a worksite; these can identify potentially infected individuals in the event of a confirmed COVID-19 case. These measures not only prioritize employee safety, but also help companies avoid entire site shutdowns. Even remotely, technology is a vital asset to construction firms. With fewer personnel allowed on-site, companies can rely on new cloud-based video platforms to assist with site monitoring. In the city of Miami, virtual inspections of construction sites through either a Zoom or a Microsoft Teams video call are now routine between engineers on site and building control officials. With usage tripling in 2020 alone, drones are also being used more frequently to improve mapping and surveying processes.

It’s not a Great Resignation–it’s a Great Rethink

Leaders often regard purpose in a limited way as either a marketing or human resources exercise. Companies that go deepest with purpose take a much more comprehensive approach, treating purpose as an operating system and embedding it in processes, organizational structures, and culture. Global professional services firm EY adopted a system of metrics to spur behaviors associated with its purpose. “Companies really have to be able to show what they’re doing,” EY’s CEO Carmine Di Sibio told me. “They get into trouble when they talk a lot about purpose and it’s just talk.” Imagine what it feels like when everything about your work ties back in clear, even obvious ways to your purpose. That’s what employees at deep-purpose companies experience on the job. It’s encouraging that some CEOs—68% of those queried in one survey—are placing “more emphasis” on purpose, but that’s not enough. For purpose to feel genuine and meaningful, they must live it in their daily work, hold others accountable for acting in ways congruent with that purpose, and bring it alive for their workforce.

---

Quote for the day:

"The essence of leadership is the willingness to make the tough decisions. Prepared to be lonely." -- Colin Powell

---

Daily Tech Digest - June 23, 2020

Four Steps Public-Sector CIOs Should Take To Break Down Silos Impeding Innovation

Government agencies, almost by design, are large and slow-moving. When something goes wrong, the response is often to add another policy and another layer of approvals and reviews. This slows things down even more and frustrates efforts by CIOs and other decision-makers to make informed and timely choices. Further inhibiting—and complicating—operations, individual mission centers facing bureaucratic barriers often create their own duplicative capabilities, delivered quickly and effectively, but just for their own use. These silos are especially common when it comes to information technology and are given the pejorative label of “Shadow IT” by CIOs and others at the enterprise level who want to assert control over all agency technology. ... Don’t reinvent solutions just because that’s the way it’s been done. Resist the urge to customize. Change your policies and practices, if you can, so you can set and use standards that break down application, data and user silos. Push back internally on those policies that exist for the lowest common denominator. Challenge your technologists to leverage these standards and build tools that can solve enterprise problems at speed and scale. 

Italian Banking Association ready to trial Central Bank Digital Currency

In the announcement it read, " Italian banks are available to participate in projects and experiments of a digital currency of the European Central Bank, contributing, thanks to the skills acquired in the creation of infrastructure and distributed governance, to speed up the implementation of a European-level initiative in a first nation." A year ago the Association of Italian Banks set up a working group dedicated to deepening the understanding related to digital coins and crypto assets. From this group 10 recommenations were announced that include: Monetary stability and full respect for the European regulatory framework must be preserved as a matter of priority; Italian banks are already operating on a Distributed ledger technology Dlt infrastructure with the Spunta project. They intend to be part of the change brought about by an important innovation such as digital coins; A programmable digital currency represents an innovation in the financial field capable of profoundly revolutionizing money and exchange. This is a transformation capable of bringing significant potential added value, in particular in terms of the efficiency of the operating and management processes. ...

The next software disruption: How vendors must adapt to a new era

The rise of PaaS has changed what it takes to be a successful enterprise-software vendor. As PaaS services become more sophisticated, software application vendors have a tougher time justifying a price premium for products that could be delivered with a thin user interface on top of generic PaaS services. With PaaS tools giving attackers and customers themselves the means to develop new applications quickly, software vendors that do not innovate in kind will face increased risk. Software vendors need to defend their share of the profit pool by taking a clear look at where they have the best and most defendable opportunities to differentiate themselves. Rather than going head-to-head with the Big Three, one strategy is to specialize and tailor solutions to the needs of targeted verticals and use cases. This strategy proved successful in the early 2010s, when SaaS disruptors first entered the market. The legacy-software vendors that were closest to the customer and had a high degree of industry and domain expertise protected their market share and maintained their enterprise value-to-revenue multiples while customers that stressed differentiation on the basis of their technology were more vulnerable

How Manufacturers Can Address Cybercrime in the Ongoing Pandemic

Security has never been a top priority for manufacturers. Security features and best practices are often not taken into account when new products are purchased. With COVID-19 requiring companies across all industries to explore remote workforce options, manufacturing companies prioritized, and invested in, automation systems that make it easier for their employees to do their jobs from the safety of their homes. Although it is encouraging to see companies making investments to support their employees, many automation tools are being purchased without considering their security features. Standard security best practices such as checking for previous reported vulnerabilities, changing factory settings and passwords, and training employees in the secure ways to use the new solutions are not happening. With fewer guards and controls in place, it's easy for industrial control systems to be hacked simply through accident or user error. Despite the challenges plaguing the industry -- outdated technology, a disconnect between safety and security, and vulnerabilities associated with remote work operations -- there are small steps that manufacturers can take to significantly improve their security posture.

IoT Security Is a Mess. Privacy 'Nutrition' Labels Could Help

At the IEEE Symposium on Security & Privacy last month, researchers from Carnegie Mellon University presented a prototype security and privacy label they created based on interviews and surveys of people who own IoT devices, as well as privacy and security experts. They also published a tool for generating their labels. The idea is to shed light on a device's security posture but also explain how it manages user data and what privacy controls it has. For example, the labels highlight whether a device can get security updates and how long a company has pledged to support it, as well as the types of sensors present, the data they collect, and whether the company shares that data with third parties. “In an IoT setting, the amount of sensors and information you have about users is potentially invasive and ubiquitous," says Yuvraj Agarwal, a networking and embedded systems researcher who worked on the project. "It’s like trying to fix a leaky bucket. So transparency is the most important part. This work shows and enumerates all the choices and factors for consumers." Nutrition labels on packaged foods have a certain amount of standardization around the world, but they're still more opaque than they could be. And security and privacy issues are even less intuitive to most people than soluble and insoluble fiber.

Smart Devices: How Long Will Security Updates Be Issued?

Europe's automobile industry is bound by regulations for supporting vehicle components to ensure consumers have access to critical parts, says Brad Ree, CTO of ioXt and board member with the ioXt Alliance, which is a trade group dedicated to securing IoT devices. But Ree says with connected devices, no regulator has yet made the leap to ensure that the software is supported for an extended period. "Right now, consumers really don't know how long the product is going to be supported," Ree says. That's critical because smart devices cost more than devices without software control features. The U.S. is trying to nudge manufacturers in the right direction. Two years ago, the National Telecommunications and Information Administration created a document about what type of information companies should clearly communicate to consumers before they buy a smart device. The voluntary recommendations include describing whether and how a device receives security updates and the anticipated timeline for the end of security support. 

Why the open source DBaaS market is hot

"The good news is that there's a lot of open source database choice for organizations," said James Curtis, senior research analyst at S&P Global. "The bad news is that there's a lot open source choice and that can cause some confusion." While a growing number of vendors support open source database products, the public cloud vendors also offer versions of many popular open source databases, Curtis noted. For example, AWS boasts a managed Cassandra service, as well as support for MySQL and PostgreSQL with its Relational Database Service (RDS). When they get ready to decide on which route to take, Curtis said that organizations need to choose a vendor that provides the support they are looking for. For open source database vendors, DBaaS might also represent a threat as it has the potential to replace or cannibalize existing on-premises deployments. Among DBaaS benefits, one of the most important is reducing the time organizations need to spend managing the infrastructure. "What will happen in the future is that database workloads will gravitate to the right environment in which it makes sense to run that workload," Curtis said. "Some workloads are best suited to run on premises and perhaps always will."

Organizations Must Reset Expectations to Spring Back from Pandemic

The first step is identifying an organization’s critical assets and the missions they support. The SEI's foundational process improvement approach to operational resilience management, the CERT Resilience Management Model (CERT-RMM), defines four asset types: people, facilities, technology, and information. "The COVID-19 crisis has impaired our people and our facilities, so it’s akin to a natural disaster," said Butkovic. However, most disaster plans did not anticipate that the event would affect everyone, everywhere. "Typically, you don’t have fires at all of your facilities at the same time, with little notion of when they’ll be put out. In that way, there are lessons to be learned from cyber events, which can affect all locations simultaneously." During a cyber attack, an organization might keep its technology assets out of harm's way by modifying firewall rules. During the COVID-19 pandemic, most human assets are keeping out of harm’s way by staying away from the workplace. But not all safeguards can remain in place forever. 

The Future of Work: Best Managed with Agility, Diversity, Resilience

While the future is uncertain, one clear trend is that remote work will play a larger role during and after the pandemic. After experiencing several weeks of office closures, organizational leaders are questioning the wisdom of maintaining the same amount of office space because in most cases, employees have proved they can be productive and collaborate effectively while working remotely. On the flip side, some employees have discovered they prefer working at home, at least part-time. To affect social distancing in the short-term, employers must rethink space utilization. Interestingly, they may find they've stumbled upon their longer-term strategy, which is some version of a partly remote, partly on-site workforce. With digital transformation, more tasks and processes are aided or facilitated by software. Meanwhile, the organizations' tech stacks are becoming increasingly virtual (cloud-based), intelligent (machine learning and AI), and diverse (including IoT). However, digital transformation isn't just about technology implementation, it's also about cultural transformation which reflects greater diversity and cross-departmental collaboration.

Building Resiliency in the Age of Disruption and Uncertainty

Attendees discussed how risk needs to be managed holistically. James Fong, Regional Business Director at RSA, highlighted the need to view risk in the context of four pillars namely, operations, workforce, supply chain and cybersecurity. Fong said that “Operational risk management, IT and security risk management, regulatory and corporate compliance, business resiliency, third party governance and audit management, need to be part of an integrated risk management plan.” Fong continued “Risk data needs to be shared on customised dashboards for executives, CISOs and others. The data needs to give a clear understanding of the monetary cost associated with the risk. For example, how much is a risk worth? What is the cost of the threat?” Importantly, organisations need to understand the risk associated with third party suppliers. A more common view expressed is that no matter how much you prepare yourself, there will always be instances when organisations need to react to situational change. For example, incoming threats that can choke or change content in the media industry.

---

Quote for the day:

"Challenges in life always seek leaders and leaders seek challenges." -- Wayde Goodall

---