Daily Tech Digest - January 06, 2024

FTC offers $25,000 prize for detecting AI-enabled voice cloning

Through the Voice Cloning Challenge, the FTC aims to find a solution that can identify cases of voice cloning with the help of generative AI. The agency calls it “an exploratory challenge” that could potentially provide a direction for the risk mitigation effort. The winning proposal will receive $25,000 and the runner-up will get $4,000. There are up to three honorable mentions, each awarded with $2,000. On January 2nd, the agency started accepting submissions via this portal and will receive ideas for 10 days, until January 12, 08:00 PM EST. Submissions must include a one-page overview of the proposal and a detailed description of up to 10 pages. Participants may also include a video to show how their idea works. All submissions will be judged based on their practical feasibility, impact on corporate accountability and burden on the consumer, and resilience to rapid technological advancements in the field. Should the challenge fail to yield any effective defense ideas, FTC notes that the effort will serve as an early warning for policymakers and would highlight the need for more stringent regulations on the use of AI technology.

Building a Great Security Operations Center

Without a defined SOC strategy, security leaders may struggle to prioritize resources. A strategy provides direction based on various inputs such as the threat landscape, regulatory requirements and threat assessments specific to the organization. In the context of an SOC, the primary objective of the SOC strategy should be to avoid a situation where the cost and effort is high and the value and return on investment (ROI) is low. The aim of the SOC strategy is to ensure that the SOC effectively fulfils its function and, in doing so, helps the organization to fulfil its overall business objectives. A well-architected SOC provides a positive ROI by minimizing potential financial losses due to cyberincidents. At the same time, an SOC enhances an organization’s ability to detect and respond to cyberthreats in real time, safeguarding sensitive data and protecting the organization’s reputation. Therefore, compliance, ROI and risk reduction are interconnected. Although it is easy to get carried away with generic cybersecurity use cases, the development of business-aligned use cases is what separates average SOCs from great SOCs.

Is the vCISO Model Right for Your Organization?

It's getting harder to justify not having a CISO, so many businesses that have never had one are filling the gap with a virtual CISO (vCISO). A vCISO, sometimes referred to as a fractional CISO or CISO-as-a-service, is typically a part-time, outsourced security expert who helps businesses protect their infrastructure, data, personnel and customers. Depending on the needs of the company, vCISOs can work on-site or remotely, for the long term or short term. There are plenty of reasons why companies are going the vCISO route. Sometimes it's an internal crisis where a company's CISO has unexpectedly resigned and the board needs time to find a permanent new one. Other times it revolves around new regulatory or business requirements or a cybersecurity framework the company needs to adhere to, like NIST's Cybersecurity Framework 2.0. Sometimes a board member used to being briefed by the CISO may request a vCISO. "A smaller company might need a CISO but just a few days a week, and that type of delivery model is perfect for a vCISO," says Russell Eubanks, a vCISO who is also on the faculty of IANS Research and an instructor with SANS Institute.

Generative AI and Data Management: Transforming B2B Practices

Generative AI’s future in data management and analytics shines with promising trends to redefine data analysis methodologies. These trends encompass enhanced augmentation, deeper understanding and explanation, and the democratization of data analysis, presenting a transformative shift in how organizations harness data for insights and decision-making. Generative AI is poised to transcend traditional data visualization, evolving to augment the entire data analysis workflow. This evolution encompasses automated data exploration, hypothesis generation, data storytelling, and predictive analytics. AI’s capability to suggest patterns, relationships, and anomalies and generate comprehensive reports promises to revolutionize data-driven decision-making. The future of Generative AI goes beyond reporting events, delving into causality and explanations. The upcoming trends include causal inference, counterfactual analysis, and the integration of Explainable AI (XAI). These advancements ensure a profound understanding of underlying causes behind observed trends and transparent insights for users.

4 Strategies for Migrating Monolithic Apps to Microservices

For many organizations, taking a lift-and-shift approach is the first step for migrating monolithic applications to Kubernetes and microservices. This involves directly lifting the monolith onto hardware hosted in the cloud, and then gradually breaking down the app into microservices. However, the lift-and-shift philosophy has its challenges, as organizations must refactor monoliths to optimize them for the cloud. Therefore, it’s often more cost-effective to refactor an application service by service into a containerized architecture. ... Dependencies within monolithic apps are deeply intertwined. These close relationships among components are one of the driving forces behind the move to Kubernetes and microservices, as they hinder flexible changes and deployment. When migrating an application to a microservices architecture, it’s important for teams to understand all dependencies among services and to reduce and streamline them as much as possible. Asynchronous messaging is key, allowing services to communicate by sending and receiving messages using queues. 

Network Tokenization and Digital Identities Are Quietly Transforming Payment Security

y 

Digital identities, through biometric data and multi-factor authentication, fortify the security of transactions. This not only protects users from identity theft but also strengthens the overall trustworthiness of digital payment systems. “We never really thought about, what does it mean to identify a person on the internet in a way that is portable and doesn’t require you to rely on a single private platform,” Mike Brock, CEO of TBD, a business from Block focused on open-source decentralized technologies, told PYMNTS. Digital identities play a crucial role in meeting regulatory requirements. By providing a secure and traceable means of verifying user identities, businesses can navigate compliance challenges more efficiently, reducing the complexities associated with anti-money laundering (AML) and know your customer (KYC) processes. “Combating Online Fraud With Digital Identification,” a PYMNTS Intelligence and Prove collaboration, finds that security is highly important for 83% of consumers, while 53% say consistent experiences across different platforms have a very or extremely big impact on their trust in financial institutions.

AI governance outlook: A Global South perspective

An under-regulated path for AI and emerging technologies may bring diverse negative outcomes. These outcomes may lead to a rise in inequality, loss of privacy, and ethical transgressions. By contextualising this through understanding the history of the industrial revolutions that brought drastic changes in people's social and economic lives and prioritising moral concerns, the G20 and GPAI member states can reduce negative results that will arise without the right steering and regulation. Despite the G20's significant influence and GPAI’s members’ technical expertise, many member states face issues with the digital divide, especially the unequal distribution of advanced technologies and their benefits. The divide deepens as AI development, mainly in developed markets, widens the gap between these countries and their developing counterparts in AI research and development (R&D). As per the AI Index Fund 2023, private investments in AI from 2013-22 in the United States (US) (US$250 billion) outpaces that of other economies including India, Japan, the United Kingdom (UK) and most of the other G20 nations.

At What Point Is Digital Transformation A Success?

“Digital transformation” sounds like an expensive, laborious slog. The good news is that most companies are likely closer to succeeding at it than they think. Getting in shape and digital transformation have a lot in common: planning, persistence and patience—with a lot of pragmatism—are the keys to achieving your goals. ... When you are in a new fitness regimen, have you “failed” because you’ve only lost 10 pounds of your 20-pound goal? Of course not. You celebrate your progress, and you keep working at it. In a digital transformation, each company’s goals and starting points are unique to their particular circumstances. As a result, based on the clients I work with daily, there are many ways to measure progress. ... In building a great company or social sector enterprise, there is no single defining action, no grand program, no one killer innovation, no solitary lucky break, no miracle moment. Rather, the process resembles relentlessly pushing a giant, heavy flywheel, turn upon turn, building momentum until a point of breakthrough, and beyond.

How to prepare for increased oversight of cybersecurity

DORA, NIST 2.0 frameworks and the new SEC rules can help speed up this process. However, companies can also develop best practices to better implement board oversight of cybersecurity risk. First, covered entities must start planning now for the structural and cultural changes these rules and regulations will require—they will take time to implement. When done right, a risk management program will educate and empower company leaders to understand and confidently accept, mitigate or transfer risk. Second, to promote this strong governance at the C-Suite and board level, companies must educate their leadership on how to take a front seat around cyber strategy and governance. Rather than an insulated organizational function, cyber risk management should be informed by a company’s business strategies, compliance landscape, and risk culture. Finally, it will be critical for organizations to understand specific roles and responsibilities and to maintain regular lines of communications. In addition to the Board and other company leaders, security, communications, and legal teams should be involved in ongoing conversations around achieving a whole-of-business cyber governance strategy.

Optimizing PCI compliance in financial institutions

In practice, IT architectural patterns give architects the building blocks to design any IT solution. The architect chooses and orders the patterns available in the portfolio to meet the end goal. Having segmentation between infrastructure providing data processing and data storage is an example of a broad IT security architectural pattern. If the solution’s goal involves processing and storing data, the architect is constrained to place the pieces that will fulfill those tasks in the proper segments. Furthermore, if the operating system pattern is Linux Oracle Enterprise, the architect would use that pattern first in its design unless technical constraints made the consumption of this pattern suboptimal to accomplish the solution’s goal. All other needs, for example, authentication, encryption, log management, system configuration, would be treated the same—by using the architectural patterns available. The notion of pattern exists beyond IT in areas that a PCI security assessment touches, such as employee pre-employment practices, awareness security training, risk assessment methodology, or third-party service provider management.

---

Quote for the day:

"Give whatever you are doing and whoever you are with the gift of your attention." -- Jim Rohn

---

August 25, 2014

Payment cards with chips aren't perfect, so encrypt everything, experts say
The EMV specification as it exists today is vastly complex, and vendors have made additions on top of it, which means that it's easy to make mistakes when implementing it, Anderson said. Depending on how much attention you pay, you can design a secure system using EMV or an awful one, he said. Lucas Zaichkowsky, an enterprise defense architect at AccessData whose previous jobs involved investigating credit card breaches and assessing compliance with payment card security standards, agreed with Anderson. "People think that if we switch to EMV, these breaches will go away, but that's not true," said Zaichkowsky, who also held a presentation about POS system architecture and security at Black Hat.


A gift that keeps giving, software-defined storage now showing IT architecture-wide benefits
Software-defined storage advocates a new model, where applications and VMs are provisioned at the time that the user needs them. The storage resources that they need are provisioned on-demand, exactly for what the application and the user needs -- nothing more or less.  The idea is that you do this in a way that is really intuitive to the end-user, in a way that reflects the abstractions that user understands -- applications, the data containers that the applications need, and the characteristics of the application workloads.


Is the private cloud really a viable option for most enterprises?
Of course, private and public cloud architectures are not that pure. There are hybrid clouds, or, mixtures of private and public clouds, typically without direct portability between the private and public cloud server instances. Also, there are virtual private clouds (VPCs), which are private clouds hosted by public cloud providers, such as AWS. Moreover, there are hosted private clouds that are physical servers that may exist within a managed services provider or co-lo. The models get more cloudy as cloud technology providers come up with new ways to approach private clouds.


At Multiverse Impasse, a New Theory of Scale
The scale symmetry approach traces back to 1995, when William Bardeen, a theoretical physicist at Fermi National Accelerator Laboratory in Batavia, Ill., showed that the mass of the Higgs boson and the other Standard Model particles could be calculated as consequences of spontaneous scale-symmetry breaking. But at the time, Bardeen’s approach failed to catch on. The delicate balance of his calculations seemed easy to spoil when researchers attempted to incorporate new, undiscovered particles, like those that have been posited to explain the mysteries of dark matter and gravity.


8 Tips to Be a Better Career Negotiator
There are many places you can go to learn about a company's culture, and what past employees think of them, at places like Glassdoor.com and Salary.com. But don't neglect sources like press and product releases, Google News and trade sites and magazines. "Business savvy IT pros tend to conduct more research on market trends and utilize that information to negotiate offers more actively. These hires are likely to have a deeper understanding of the value of their skillsets and use that to initiate a negotiation conversation," says John Reed, Senior Executive Director with Robert Half Technology.


5 Tips to Consider When Designing Supply Chain Key Performance Indicators
You can’t predict anything with 100% certainty, and your predictive power wanes the farther out you gaze. The study of KPIs over time is all about finding patterns and signals, then applying intelligence in order to make better decisions and gain wisdom. In a previous post I focused on the pitfalls associated with supply chain KPI and metrics development. In this post, I’ll cover how businesses can improve their supply chain measurement processes by avoiding the common pitfalls by keeping in mind a few simple hints.


US warns 'significant number' of major businesses hit by Backoff malware
"Over the past year, the Secret Service has responded to network intrusions at numerous businesses throughout the United States that have been impacted by the "Backoff" malware," the alert said. "Seven PoS system providers/vendors have confirmed that they have had multiple clients affected." The malware is thought to be responsible for the recent data breaches at Target, SuperValu supermarkets and UPS stores, and the Secret Service is still learning of new infections. DHS first warned of Backoff in late July, when it noted the malware was not detectable my most antivirus software. That made it particularly difficult to stop, because much of the fight against computer viruses and malware rests on antivirus applications.


Cybersecurity's hiring crisis: A troubling trajectory
Solving this crisis turns out to be as complex as defining what constitutes a "qualified hacker" -- in a business where having a pedigree can actually have you considered to be less qualified, and being unhirable by traditional standards is… almost desirable. Chris Hoff is the Vice President, Strategy and Technical Marketing Engineering – Security, Switching, and Solutions BU at Juniper Networks. Hoff told ZDNet that vendors are experiencing difficulty finding suitable candidates "in a highly competitive job market that have the required experience in a number of emerging disciplines such as advanced malware detection/mitigation, reverse engineering, forensics, crypto, virtualization and cloud."


Improve collaboration with enterprise video
In this webinar, Irwin Lazar, vice president and service director at Nemertes Research, explains how enterprise video can alleviate these issues to improve collaboration and engagement among employees. According to Lazar, the past two years have seen a push for enterprise video adoption, largely due to lower video costs, tight travel budgets and wider availability of HD video conferencing systems. Enterprises that adopt video to improve collaboration see benefits that range from better non-verbal communication to increased productivity.


Henri Eliot: Where cybersecurity and the boardroom intersect
A comprehensive cyber security plan requires the appropriate culture and tone at the top, which includes an awareness of the importance of security that extends from the C-suite to the professionals in each function, since breaches can occur at any level and in any department. The CEO should make it clear that cyber security is a major corporate priority, and should communicate that he or she is fully on board with enforcing compliance with policies and supports efforts to strengthen infrastructure and combat threats.

---

Quote for the day:

"Humility is a great quality of leadership which derives respect and not just fear or hatred." -- Yousef Munayyer

---

March 28, 2014

Amazon hints at new German datacenter, but probably not for the reasons you might think
What's significantly more likely, as Jassy hinted, is that it's more to do with "data sovereignty requirements" - specifically knowing where your data is stored, and under which legal jurisdiction. That's a major proponent of the new European data protection and privacy legislation that's currently going through the European Parliament, which sped up in the wake of the Edward Snowden leaks. There's no doubt there's a push-pull effect going on here, but it's not the be-all and end-all by a long shot.


Payment card security revamp becoming chip vs. PIN tussle
EMV chip cards are used widely around the world and are considered much safer than magnetic stripe cards, especially when used in conjunction with a Personal Identification Number (PIN). However, retailers, which have to bear the bulk of the migration costs to EMV, say it's possible to improve U.S. payment card security quickly by simply implementing a mandatory PIN requirement for all credit and debit card transactions. Just as PINs are required to withdraw money from ATMs, PINs should be required for all payment card transactions, they say.


Migrating to Office 365 requires planning, pilot-testing
With Microsoft Office 365, Microsoft has entered the hosted/cloud email hosting market, and it's now among the company's fastest-growing products. As with any such changes, though, it's important to do the Office 365 migration right; email communication is too critical to put at risk. Companies need to plan their migrations carefully and pilot-test and verify at every step.


A Cyber History Of The Ukraine Conflict
Over the last few months Ukrainian websites (within the TLD .ua) have seen their fair share of defacements. Evidence indicates that Muslim hacking groups with pro-Syrian or anti-Israeli agendas conducted the majority of the defacements. A recent round by a group named Cyber Berkut is particularly troubling. Based on the targets attacked and symbolism used it’s very clear that the Cyber Berkut is pro-Russian. Some of the group’s tactics, techniques, and procedures (TTPs) are similar to those used in cyber operations in 2007 and 2008 by the Kremlin against Estonia and Georgia.


Seagate Business Storage Windows Server review: No-nonsense NAS for business
You don’t set up this box as you would a NAS box that runs on Linux, by connecting the device to your network, typing a predefined IP address into your web browser, and having at it. You must first attach a keyboard and VGA display, and then define a password using its local interface. Once that’s completed, you can remove the keyboard and display, connect it to your network, and administer the box via Remote Desktop from another Windows PC on your LAN.


The Value of Being Approachable: Priceless
If you want to be approachable, the opportunities that come your way will dramatically increase. All you have to do is act as if you are wearing a name tag. When you wear a name tag, people know that you want them to be free to engage you in conversation. It’s an invitation that tells people, “Approach me, introduce yourself. It’s OK!” If you’re a manager, that’s the way you want people to see you and that’s the way you want your people to be seen. When people see you as approachable, all sorts of opportunities open up.


Pair Painting
We’ve established that there’s much to be gained from working as a pair - high standards, joint ownership, even fun! You need to be prepared to work at it, however. Simply sitting two people in front of a screen won’t automatically produce these results - but with a bit of effort and some careful inspect-and-adapt the magic will start to happen. If you and your team decide to give pair programming a go, there are many great resources available to help you get off the starting block


Conscious uncoupling in the enterprise: Time for the next phase of services
The API economy is well understood, as we've been working to put SOA practices in place for more than a decade now. However, what McNee calls the Internet of Everything is a vast, little-understood frontier. "Everything is a source of data, and everything is connected or connectable," he observes. "This emergent inter-connected business and IT reality brings with it unprecedented challenges, mainly due to its almost completely unpredictable scale and complexities.... its effects are likely to be outside of previous experience and its requirements will be beyond most existing skills and resources."


Cisco fixes denial-of-service flaws in IOS software for networking devices
The newly released IOS versions contain patches for two vulnerabilities identified in the software's Network Address Translation (NAT) feature that's commonly used in routing scenarios. One vulnerability could be exploited by sending malformed DNS packets to be processed and translated by an affected device and the other by sending certain sequences of TCP packets. "To determine whether NAT has been enabled in the Cisco IOS Software configuration, log in to the device and issue the 'show ip nat statistics' command," Cisco said in a security advisory published Wednesday


Software test management: Know which rules to follow, which to break
When you stop to think about the idea of 100% utilization as a measure of success, its absurdity is obvious. What if you kept all of your people busy all the time, but they were focusing on the wrong things? "When test managers hear me talk about this myth, they say, 'Oh my gosh,' and they look at me with their mouths open," Rothman said. To ensure success, test managers should focus on getting software projects – and features that are part of those projects -- out the door. The way to accomplish that is to optimize the team's workflow at a steady rate, according to Rothman.

---

Quote for the day:

"No man can think clearly when his fists are clenched." -- George Jean Nathan

---

February 25, 2013

Here is how cloud computing, big data, and some innovation can reinvent healthcare
The rise of big data as a set of new technologies provides new options for both the storage and analysis of information. This leads to better patient care and cost reductions. The use of cloud computing provides the elastic capacity requirements at costs that almost all healthcare provider organizations can afford. When combined, you have something that is clearly a game changer.


The One Question to Ask in an Exit Interview
Generally, HR pros open an exit interview by asking “Why are you leaving?” While useful to a point, HR could be asking a far more revealing question: “What made you start looking for another job in the first place?” says Sharlyn Lauby, who blogs at www.hrbartender.com and is president of HR consulting firm ITM Group, Inc.


Driving Innovation with Total Rewards

You don't have to resort to providing wacky toys or jeopardizing the bottom line with monster R&D labs. Believe it or not, your compensation mix, recognition and rewards programs, and development opportunities can go a long way in creating that next great idea. Here are three ways you can drive innovation with your total rewards strategy:


BYOD Boosts Macs vs. PCs
"When we were having BYOD discussions employees said they wanted a choice. At the time, we wanted to be a single-platform shop so we could get scale pricing. But with the Mac, we could buy a whole bunch or just a few, so that didn't matter. We had two PC vendors and Apple ticked up in part because the form factor was attractive even to PC users," he says.


Setting Up A Sound Risk Management Framework
The main driver of a positive risk culture lies in individual accountability. If a risk or set of risks is assigned to a group, its management will be hazily diluted amongst its members without a clear understanding and accountability. Individual accountability maintains individual awareness at every level of an organisation. A risk or set of risks should fall into one's duties, and individuals' performance should be assessed according to their effectiveness in managing them.


Serve stored data on the cloud to mobile apps using visual search engines
Visual search engines have created a new paradigm of mobile applications. However, to use this technology effectively, a large, publicly accessible data set must be established and maintained. Cloud-based storage is a great solution to use when deploying an app with a visual search engine. Learn how an organization can use a visual search engine and cloud-based storage to automate business processes.


WebOS lives! LG to resurrect it for smart TVs
LG said today it was acquiring WebOS from Hewlett-Packard, with the intention to use the operating system not for its mobile phones, but in its smart televisions. With the deal, LG obtains the source code for WebOS, related documtreentation, engineering talent, and related WebOS Web sites. LG also gets HP licenses for use with its WebOS products, and patents HP obtained from Palm. The financial terms of the deal weren't disclosed.


MasterCard launches MasterPass: Will this digital wallet fly?
MasterPass will launch at the end of March in Australia and Canada followed by the U.S. and U.K. MasterCard also said that MasterPass will roll out in Belgium, Brazil, China, France, Italy, Netherlands, Singapore, Spain and Sweden in 2013. ... The big question remains whether MasterPass will manage to gain traction among shoppers, who know of digital wallets but aren't exactly clamoring for them.

Microsoft's own code should prevent an Azure SSL fail: So what went wrong?
That leaves me with two remaining possibilities. The first: Microsoft isn't using its own rather excellent technology to handle these certs. I'm not fully sure of the underpinnings of Azure; does it run on Server 2012? Bing.com does. Even if Azure isn't using off-the-shelf Windows Server, there would be a delicious irony to Microsoft – enthusiastic player of the constant, cacophonous drumbeat of "upgrade for your own good" – had failed to take advantage of technology they themselves invented to solve this exact problem.

Are SIs Meeting CIO Expectations?
Increasing business complexities and adaption of newer technologies along with forever-rising employee demands, the CIO's challenges are only increasing day by day. Hence they have started looking beyond IT when engaging systems integrators (SIs) with the objective of driving business results through innovative business solutions. But, are these SIs delivering on their promise? A Forrester survey of over 30 CIOs yielded some grim findings

---

Quote for the day:

"It is amazing what you can accomplish if you do not care who gets the credit." -- Harry S Truman

---