Daily Tech Digest by Kannan Subbiah: SRE

Showing posts with label SRE. Show all posts

Daily Tech Digest - April 22, 2026

Quote for the day:

"Any code of your own that you haven't looked at for six or more months might as well have been written by someone else." -- Eagleson's law

🎧 Listen to this digest on YouTube Music

▶ Play Audio Digest

Duration: 18 mins • Perfect for listening on the go.

From pilots to platforms: Industrial IoT comes of age

The article "From Pilots to Platforms: Industrial IoT Comes of Age" explores the transformative shift in India’s manufacturing sector as Industrial IoT (IIoT) matures from isolated experimental pilots into robust, enterprise-wide operational platforms. Historically, IIoT deployments were limited to simple sensor installations for monitoring single machines; however, the current landscape focuses on building a production-grade digital infrastructure that integrates data from across the entire shop floor. This evolution enables a transition from reactive maintenance to proactive operational intelligence, allowing leaders to prioritize measurable outcomes such as increased throughput, energy efficiency, and overall revenue. Experts emphasize that the conversation has moved beyond questioning the technology's viability to addressing the complexities of scaling across multiple facilities and managing "" realities where decades-old equipment must be retrofitted for connectivity. The modern IIoT stack now balances edge and cloud workloads while leveraging to sustain continuous operations. Despite these advancements, robust network design and cybersecurity remain critical challenges that must be addressed to ensure resilience. Ultimately, the success of IIoT in India now hinges on converting vast operational data into repeatable, high-speed decisions that deliver tangible business value across the industrial ecosystem.

Beyond the ‘25 reasons projects fail’: Why algorithmic, continuous scenario planning addresses the root causes

The article "Beyond the '25 reasons projects fail'" argues that high failure rates in enterprise initiatives—highlighted by BCG and Gartner data—are not merely delivery misses but symptoms of a systemic failure in portfolio design and decision logic. While visible symptoms like scope creep and poor communication are real, they represent a deeper "pattern under the pattern" where organizations lack the capacity to calculate the ripple effects of change. The author, John Reuben, posits that modern governance requires "" and "continuous scenario planning" to translate strategic ambition into modeled consequences. Without this discipline, leadership cannot effectively navigate trade-offs or manage dependencies. Furthermore, the piece emphasizes that while AI offers transformative potential, it must be anchored in mathematically sound planning data to avoid magnifying weak assumptions. To address these root causes, CIOs are urged to implement a modern control system for change featuring six essential capabilities: a unified planning model across priorities and budgets, side-by-side scenario comparison, interdependency mapping, early visibility into bottlenecks, continuous recalculation as conditions shift, and executive-facing summaries that turn data into decisions. Ultimately, the solution lies in evolving planning from a static, narrative process into a dynamic, algorithmic discipline capable of seeing and governing complex interactions in real time.

Is AI creating value or just increasing your IT bill?

The Spiceworks article, grounded in the "State of IT 2026" research by Spiceworks Ziff Davis, examines the economic tension between AI’s promise of value and its actual impact on corporate budgets. While AI software expenditures currently appear manageable—with a median spend of only 2.7% of total IT computing infrastructure—the report warns that this represents just the visible portion of a much larger financial commitment. The "hidden" bill for enterprise AI includes critical investments in high-performance servers, specialized storage, and robust networking, which experts estimate can increase the total cost by four to five times the software license fees. This disparity highlights a significant risk: organizations may underestimate the capital required to move from experimentation to full-scale deployment. The article argues that "putting your money where your mouth is" requires a strategic alignment of talent, time, and treasure rather than just following market hype. To achieve a positive return on investment, IT leaders must look beyond software-as-a-service costs and account for the substantial infrastructure upgrades necessary to power modern AI workloads. Ultimately, the path to value depends on a holistic understanding of the total cost of ownership in an increasingly AI-driven landscape.

Cryptographic debt is becoming the next enterprise risk layer

"Cryptographic debt" is emerging as a critical enterprise risk layer, especially within the financial sector, as organizations face the consequences of outdated algorithms, fragmented key management, and encryption deeply embedded in legacy systems. According to Ruchin Kumar of Futurex, this "debt" has long remained invisible to boardrooms because cryptography was historically treated as a technical silo rather than a strategic risk domain. However, the rise of and the impending transition to post-quantum cryptography (PQC) are exposing these structural vulnerabilities. Major hurdles to modernization include a lack of centralized cryptographic visibility, the tight coupling of security logic with application code, and manual, error-prone key management processes. To address these challenges, enterprises must shift toward a "crypto-agile" architecture. This transformation requires centralizing governance through Hardware Security Modules (HSMs), abstracting cryptographic functions via standardized APIs, and automating the entire key lifecycle. Such a horizontal transformation will likely trigger a massive wave of IT spending, comparable to cloud migration. As ecosystems become increasingly interconnected through APIs and fintech partnerships, weak cryptographic governance in any single segment now poses a systemic threat, making unified, architecture-first security essential for long-term business resilience and regulatory compliance.

Practical SRE Habits That Keep Teams Sane

The article "Practical SRE Habits That Keep Teams Sane" outlines essential strategies for Site Reliability Engineering teams to maintain high system availability while safeguarding engineer well-being. Central to these habits is the clear definition of Service Level Objectives (SLOs), which provide a data-driven framework for balancing feature velocity with operational stability. To combat burnout, the piece emphasizes reducing "toil"—repetitive, manual tasks—through targeted automation and the creation of actionable runbooks that lower the cognitive burden during high-pressure incidents. A significant portion of the advice focuses on human-centric operations, advocating for blameless post-mortems that prioritize systemic learning over individual finger-pointing, effectively removing the drama from failure analysis. Furthermore, the article suggests optimizing on-call health by implementing "interrupt buffers" and rotating "shield" roles to protect the rest of the team from productivity-killing context switching. By adopting safer deployment patterns and rigorous backlog hygiene, teams can shift from a chaotic, reactive firefighting mode to a controlled and predictable "boring" operational state. Ultimately, these practical habits aim to create a sustainable culture where reliability is a shared responsibility, ensuring that both the technical infrastructure and the humans who support it remain resilient and efficient in the long term.

From the engine room to the bridge: What the modern leadership shift means for architects like me

The article explores how the evolving role of modern technology leadership, specifically CIOs, necessitates a fundamental shift in the approach of system architects. Traditionally, CIOs focused on uptime and cost efficiency, but today’s leaders prioritize competitive differentiation, workforce transformation, and organizational alignment. Many modernization projects fail not due to technical flaws, but because of "upstream" issues like unresolved stakeholder conflicts or a lack of strategic clarity. Consequently, architects must look beyond sound code and clean implementation to build the "social infrastructure" and trust required for adoption. Modern leadership acts as both navigator and engineer, demanding infrastructure that supports both technical needs—like automated policy enforcement—and business outcomes. Managing technical debt proactively is crucial, as legacy systems often stifle innovation like AI adoption. For architects, this means evolving from purely technical resources into strategic partners who understand the cultural and decision-making constraints of the business. The best architectural designs are ultimately useless unless they resonate with the organizational reality and strategic pressures facing the customer. Bridging the gap between the engine room and the bridge is now the essential mandate for those designing the systems that drive modern business forward.

Are We Actually There? Assessing RPKI Maturity

The article "Are We Actually There? Assessing RPKI Maturity" provides a critical evaluation of the Resource Public Key Infrastructure (RPKI) and its current state of global deployment for securing internet routing. The authors argue that while RPKI adoption is steadily growing, the system is still far from reaching true maturity. Through comprehensive measurements, the research reveals that the effectiveness of RPKI enforcement varies significantly across the internet ecosystem; while large transit networks provide broad protection, the impact of enforcement at Internet Exchange Points remains localized. Furthermore, the paper highlights severe vulnerabilities within the RPKI software ecosystem, identifying over 40 security flaws that could compromise deployments. These issues are often rooted in the immense complexity and vague requirements of the RPKI specifications, which make correct implementation difficult and error-prone. The research also notes dependencies on other protocols like DNSSEC, which itself faces design-flaw vulnerabilities like KeyTrap. Ultimately, the authors conclude that although RPKI is currently the most effective defense against Border Gateway Protocol (BGP) hijacks, achieving a robust and mature architecture requires a fundamental redesign to simplify its structure, clarify specifications, and improve overall efficiency. Until these systemic flaws are addressed, the internet's routing security remains precarious.

Study finds AI fraud losses decline, but the risks are growing

The Javelin Strategy & Research 2026 identity fraud study, "The Illusion of Progress," highlights a deceptive shift in the digital landscape where total monetary losses have decreased while systemic risks continue to escalate. In 2025, combined fraud and scam losses fell to $38 billion, a $9 billion reduction from the previous year, accompanied by a drop in victim numbers to 36 million. This decline was primarily fueled by a 45 percent drop in scam-related losses. However, these improvements are overshadowed by a 31 percent surge in new-account fraud victims, signaling that criminals are pivoting their tactics. Artificial intelligence is at the core of this evolution, as fraudsters adopt advanced tools more rapidly than financial institutions can update their defenses. Lead analyst Suzanne Sando warns that lower loss figures are misleading because scammers are increasingly focused on stealing personal data to seed future, more sophisticated attacks rather than seeking immediate cash. To address this "inflection point," the report stresses that organizations must move beyond one-time security decisions. Instead, they must implement continuous fraud controls and foster deep industry collaboration to stay ahead of AI-powered criminals who operate without the regulatory constraints that often slow down legitimate financial services.

Why identity is the driving force behind digital transformation

In the modern digital landscape, identity has evolved from a simple login mechanism into the fundamental "invisible engine" driving successful digital transformation. As traditional network perimeters dissolve due to cloud adoption and remote work, identity has emerged as the critical new security boundary, utilizing a "never trust, always verify" approach to protect sensitive data. This shift empowers businesses to implement fine-grained access controls that enhance security while streamlining operations. Beyond security, identity systems act as a catalyst for business agility, allowing software teams to navigate complex environments more efficiently. Crucially, centralized identity management enhances the customer experience by unifying disparate data points to provide highly personalized interactions and build brand trust. In high-stakes sectors like finance, identity-centric frameworks are essential for real-time fraud detection and comprehensive risk assessment by linking multiple accounts to a single verified user. To truly leverage identity as a strategic asset, organizations must ensure their systems are real-time, easily integrable, and governed by strict access rules. Ultimately, establishing identity as a core infrastructure is no longer optional; it is the essential foundation for innovation, security, and competitive growth in an increasingly interconnected and complex global digital economy.

From Panic to Playbook: Modernizing Zero‑Day Response in AppSec

In "From Panic to Playbook: Modernizing Zero-Day Response in AppSec," Shannon Davis explores how the increasing frequency and rapid exploitation of zero-day vulnerabilities, such as , necessitate a shift from reactive improvisation to structured, rehearsed workflows. Traditional AppSec cadences—where vulnerabilities are typically addressed through scheduled scans and predictable sprint fixes—fail to meet the urgent demands of zero-day events due to collapsed time-to-exploit windows, high data volatility, and complex transitive dependencies. To bridge this gap, Davis highlights the Mend AppSec Platform’s modernized approach, which emphasizes four critical components: a live, authoritative data feed independent of scan schedules, instant correlation with existing inventory to identify exposure without manual rescanning, a defined 30-day lifecycle for active threats, and a centralized audit trail for cross-team alignment. This framework enables organizations to respond effectively within the vital first 72 hours after disclosure by providing a single source of truth for both human teams and automated tooling. Ultimately, the article argues that organizational resilience during a security crisis depends less on the total size of a security budget and more on the implementation of a proactive, data-driven playbook that transforms chaotic incident response into a sustainable, repeatable, and efficient operational reality.

Daily Tech Digest - January 09, 2026

Quote for the day:

"Always remember, your focus determines your reality." -- George Lucas

The AI plateau: What smart CIOs will do when the hype cools

During the early stages of GenAI adoption, organizations were captivated by its potential -- often driven by the hype surrounding tools like ChatGPT. However, as the technology matures, enterprises are now grappling with the complexities of scaling AI tools, integrating them into existing workflows and using them to meet measurable business outcomes. ... History has shown that transformative technologies often go through similar cycles of hype, disillusionment and eventual stabilization. ... Early on, many organizations told every department to use AI to boost productivity. That approach created energy, but it also produced long lists of ideas that competed for attention and resources. At the plateau stage, CIOs are becoming more selective. Instead of experimenting with every possible use case, they are selecting a smaller number of use cases that clearly support business goals and can be scaled. The question is no longer whether a team can use AI, but whether it should. ... CIOs should take a two-speed approach that separates fast, short-term AI projects from larger, long-term efforts, Locandro said. Smaller initiatives help teams learn and deliver quick results. Bigger projects require more planning and investment, especially when they span multiple systems. ... A key challenge CIOs face with GenAI is avoiding long, drawn-out planning cycles that try to solve everything at once. As AI technology evolves rapidly, lengthy projects risk producing outdated tools.

Middle East Tech 2026: 5 Non-AI Trends Shaping Regional Business

The Middle Eastern biotechnology market is rapidly maturing into a multi-billion-dollar industrial powerhouse, driven by national healthcare and climate agendas. In 2026, the industry is marking the shift toward manufacturing-scale deployment, as genomics, biofuels, and diagnostics projects move into operational phases. ... Quantum computing has moved past the stage of academic curiosity. In 2026, the Middle East is seeing the first wave of applied industrial pilots, particularly within the energy and material science sectors. ... While commercialization timelines remain long, the strategic value of early entry is high. Foreign suppliers who offer algorithm development or hardware-software integration for these early-stage pilots will find a highly receptive market among national energy champions. ... Geopatriation refers to the relocation of digital workloads and data onto sovereign-controlled clouds and local hardware and stands out as a major structural shift in 2026. Driven by national security concerns and the massive data requirements of AI, Middle Eastern states are reducing their reliance on cross-border digital architectures. This trend has extended beyond data residency to include the localization of critical hardware capabilities. ... the region is moving away from perimeter-based security models toward zero-trust architectures, under which no user, device, or system receives implicit trust. Security priorities now extend beyond office IT systems to cover operational technology

Scaling AI value demands industrial governance

"Capturing AI's value while minimizing risk starts with discipline," Puig said. "CIOs and their organizations need a clear strategy that ties AI initiatives to business outcomes, not just technology experiments. This means defining success criteria upfront, setting guardrails for ethics and compliance, and avoiding the trap of endless pilots with no plan for scale." ... Puig adds that trust is just as important as technology. "Transparency, governance, and training help people understand how AI decisions are made and where human judgment still matters. The goal isn't to chase every shiny use case; it's to create a framework where AI delivers value safely and sustainably." ... Data security and privacy emerge as critical issues, cited by 42% of respondents in the research. While other concerns -- such as response quality and accuracy, implementation costs, talent shortages, and regulatory compliance -- rank lower individually, they collectively represent substantial barriers. When aggregated, issues related to data security, privacy, legal and regulatory compliance, ethics, and bias form a formidable cluster of risk factors -- clearly indicating that trust and governance are top priorities for scaling AI adoption. ... At its core, governance ensures that data is safe for decision-making and autonomous agents. In "Competing in the Age of AI," authors Marco Iansiti and Karim Lakhani explain that AI allows organizations to rethink the traditional firm by powering up an "AI factory" -- a scalable decision-making engine that replaces manual processes with data-driven algorithms.

Information Management Trends in the Year Ahead

The digital workforce will make its presence felt. “Fleets of AI agents trained on proprietary data, governed by corporate policy, and audited like employees will appear in org charts, collaborate on projects, and request access through policy engines,” said Sergio Gago, CTO for Cloudera. “They will be contributing insights alongside their human colleagues.” A potential oversight framework may effectively be called an “HR department for AI.” AI agents are graduating from “copilots that suggest to accountable coworkers inside their digital environments,” agreed Arturo Buzzalino ... “Instead of pulling data into different environments, we’re bringing compute to the data,” said Scott Gnau, head of data platforms at InterSystems. “For a long time, the common approach was to move data to wherever the applications or models were running. AI depends on fast, reliable access to governed data. When teams make this change, they see faster results, better control, and fewer surprises in performance and cost.” ... The year ahead will see efforts to reign in the huge volume of AI projects now proliferating outside the scope of IT departments. “IT leaders are being called in to fix or unify fragmented, business-led AI projects, signaling a clear shift toward CIOs—like myself,” said Shelley Seewald, CIO at Tungsten Automation. The impetus is on IT leaders and managers to be “more involved much earlier in shaping AI strategy and governance.

What is outcome as agentic solution (OaAS)?

The analyst firm, Gartner predicts that a new paradigm it’s named outcome as agentic solution (OaAS) will make some of the biggest waves, by replacing software as a service (SaaS). The new model will see enterprises contract for outcomes, instead of simply buying access to software tools. Instead of SaaS, where the customer is responsible for purchasing a tool and using it to achieve results, with OaAS providers embed AI agents and orchestration so the work is performed for you. This leaves the vendor responsible for automating decisions and delivering outcomes, says Vuk Janosevic, senior director analyst at Gartner. ... The ‘outcome scenario’ has been developing in the market for several years, first through managed services then value-based delivery models. “OaAS simply formalizes it with modern IT buyers, who want results over tools,” notes Thomas Kraus, global head of AI at Onix. OaAS providers are effectively transforming systems of record (SoR) into systems of action (SoA) by introducing orchestration control planes that bind execution directly to outcomes, says Janosevic. ... Goransson, however, advises enterprises carefully evaluate several areas of risk before adopting an agentic service model, Accountability is paramount, he notes, as without clear ownership structures and performance metrics, organizations may struggle to assess whether outcomes are being delivered as intended.

Bridging the Gap Between SRE and Security: A Unified Framework for Modern Reliability

SRE teams optimize for uptime, performance, scalability, automation and operational efficiency. Security teams focus on risk reduction, threat mitigation, compliance, access control and data protection. Both mandates are valid, but without shared KPIs, each team views the other as an obstacle to progress. Security controls — patch cycles, vulnerability scans, IAM restrictions and network changes — can slow deployments and reduce SRE flexibility. In SRE terms, these controls often increase toil, create unpredictable work and disrupt service-level objectives (SLOs). The SRE culture emphasizes continuous improvement and rapid rollback, whereas security relies on strict change approval and minimizing risk surfaces. ... This disconnect impacts organizations in measurable ways. Security incidents often trigger slow, manual escalations because security and operations lack common playbooks, increasing mean time to recovery (MTTR). Risk gets mis-prioritized when SRE sees a vulnerability as non-disruptive while security considers it critical. Fragmented tooling means that SRE leverages observability and automation while security uses scanning and SIEM tools with no shared telemetry, creating incomplete incident context. The result? Regulatory penalties, breaches from failures in patch automation or access governance and a culture of blame where security faults SRE for speed and SRE faults security for friction.

The 2 faces of AI: How emerging models empower and endanger cybersecurity

More recently, the researchers at Google Threat Intelligence Group (GTIG) identified a disturbing new trend: malware that uses LLMs during execution to dynamically alter its own behavior and evade detection. This is not pre-generated code, this is code that adapts mid-execution. ... Anthropic recently disclosed a highly sophisticated cyber espionage operation, attributed to a state-sponsored threat actor, that leveraged its own Claude Codemodel to target roughly 30 organizations globally, including major financial institutions and government agencies. ... If adversaries are operating at AI speed, our defenses must too. The silver lining of this dual-use dynamic is that the most powerful LLMs are also being harnessed by defenders to create fundamentally new security capabilities. ... LLMs have shown extraordinary potential in identifying unknown, unpatched flaws (zero-days). These models significantly outperform conventional static analyzers, particularly in uncovering subtle logic flaws and buffer overflows in novel software. ... LLMs are transforming threat hunting from a manual, keyword-based search to an intelligent, contextual query process that focuses on behavioral anomalies. ... Ultimately, the challenge isn’t to halt AI progress but to guide it responsibly. That means building guardrails into models, improving transparency and developing governance frameworks that keep pace with emerging capabilities. It also requires organizations to rethink security strategies, recognizing that AI is both an opportunity and a risk multiplier.

Hacker Conversations: Katie Paxton-Fear Talks Autism, Morality and Hacking

“Life with autism is like living life without the instruction manual that everyone else has.” It’s confusing and difficult. “Computing provides that manual and makes it easier to make online friends. It provides accessibility without the overpowering emotions and ambiguities that exist in face-to-face real life relationships – so it’s almost helping you with your disability by providing that safe context you wouldn’t normally have.” Paxton-Fear became obsessed with computing at an early age. ... During the second year into her PhD study, a friend from her earlier university days invited her to a bug bounty event held by HackerOne. She went – not to take part in the event (she still didn’t think she was a hacker nor understood anything about hacking), she went to meet up with other friends from the university days. She thought to herself, ‘I’m not going to find anything. I don’t know anything about hacking.’ “But then, while there, I found my first two vulnerabilities.” ... he was driven by curiosity from an early age – but her skill was in disassembly without reassembly: she just needed to know how things work. And while many hackers are driven to computers as a shelter from social difficulties, she exhibits no serious or long lasting social difficulties. For her, the attraction of computers primarily comes from her dislike of ambiguity. She readily acknowledges that she sees life as unambiguously black or white with no shades of gray.

‘A wild future’: How economists are handling AI uncertainty in forecasts

Economists have time-tested models for projecting economic growth. But they’ve seen nothing like AI, which is a wild card complicating traditional economic playbooks. Some facts are clear: AI will make humans more productive and increase economic activity, with spillover effects on spending and employment. But there are many unknowns about AI. Economists can’t isolate AI’s impact on human labor as automation kicks in. Nailing down long-term factory job losses to AI is not possible. ... “We’re seeing an increase in terms of productivity enhancements over the next decade and a half. While it doesn’t capture AI directly… there is all kinds of upside potential to the productivity numbers because of AI. ... “There are basically two ways this can go. You can get more output for the same input. If you used to put in 100 and get 120, maybe now you get 140. That’s an expansion in total factor productivity. Or you can get the same output with fewer inputs. “It’s unclear how much of either will happen across industries or in the labor market. Will companies lean into AI, cut their workforce, and maintain revenue? Or will they keep their workforce, use AI to supplement them, and increase total output per worker? ... If AI and automation remove the human element from labor-intensive manufacturing, that cost advantage erodes. It makes it harder for developing countries to use cheap labor as a stepping stone toward industrialization.

Understanding transformers: What every leader should know about the architecture powering GenAI

Inside a transformer, attention is the mechanism that lets tokens talk to each other. The model compares every token’s query with every other token’s key to calculate a weight which is a measure of how relevant one token is to another. These weights are then used to blend information from all tokens into a new, context-aware representation called a value. In simple terms: attention allows the model to focus dynamically. If the model reads “The cat sat on the mat because it was tired,” attention helps it learn that “it” refers to “the cat,” not “the mat.” ... Transformers are powerful, but they’re also expensive. Training a model like GPT-4 requires thousands of GPUs and trillions of data tokens. Leaders don’t need to know tensor math, but they do need to understand scaling trade-offs. Techniques like quantization (reducing numerical precision), model sharding and caching can cut serving costs by 30–50% with minimal accuracy loss. The key insight: Architecture determines economics. Design choices in model serving directly impact latency, reliability and total cost of ownership. ... The transformer’s most profound breakthrough isn’t just technical — it’s architectural. It proved that intelligence could emerge from design — from systems that are distributed, parallel and context-aware. For engineering leaders, understanding transformers isn’t about learning equations; it’s about recognizing a new principle of system design.

Daily Tech Digest - December 22, 2025

Quote for the day:

"Life isn’t about getting and having, it’s about giving and being." -- Kevin Kruse

Browser agents don’t always respect your privacy choices

A key issue is the location of the language model. Seven out of eight agents use off device models. This means detailed information about the user’s browser state and each visited webpage is sent to servers controlled by the service provider. When the model runs on remote servers, users lose control over how search queries and sensitive webpage content are processed and stored. While some providers describe limits on data use, users must rely on service provider policies. Browser version age is another factor. Browsers release frequent updates to patch security flaws. One agent was found running a browser that was 16 major versions out of date at the time of testing. ... Agents also showed weaknesses in TLS certificate handling. Two agents did not show warnings for revoked certificates. One agent also failed to warn users about expired and self signed certificates. Trusting connections with invalid certificates leaves agents open to machine-in-the-middle attacks that allow attackers to read or alter submitted information. ... Agent decision logic sometimes favored task completion over protecting user information, leading to personal data disclosure. This resulted in six vulnerabilities. Researchers supplied agents with a fictitious identity and observed whether that information was shared with websites under different conditions. Three agents disclosed personal information during passive tests, where the requested data was not required to complete the task.

What CISOs should know about the SolarWinds lawsuit dismissal

For many CISOs, the dismissal landed not as an abstract legal development, but as something deeply personal. ... Even though the SolarWinds case sparked a deeper recognition that cybersecurity responsibility should be a shared responsibility across enterprises, shifting policy priorities and future administrations could once again put CISOs in the SEC’s crosshairs, they warn. ... The judge’s reasoning reassured many security leaders, but it also exposed a more profound discomfort about how accountability is assigned inside modern organizations. “The area that a lot of us were really uncomfortable about was the idea that an operational head of security could be personally responsible for what the company says about its cybersecurity investments,” Sullivan says. He adds, “Tim didn’t have the CISO title before the incident. And so there was just a lot there that made security people very concerned. Why is this operational person on the hook for representations?” But even if he had had the CISO role before the incident, the argument still holds, according to Sullivan. “Historically, the person who had that title wasn’t a quote-unquote ‘chief’ in the sense that they’re not in the little room of people who run the company,” Sullivan says. ... If the SolarWinds case clarified anything, it’s that relief is temporary and preparation is essential. CISOs have a window of opportunity to shore up their organizational and personal defenses in the event the political pendulum swings and makes CISOs litigation targets again.

Global uncertainty is reshaping cloud strategies in Europe

Europe has been debating digital sovereignty for years, but the issue has gained new urgency amid rising geopolitical tensions. “The political environment is changing very fast,” said Ollrom. A combination of trade disputes, sanctions that affect access to technology, and the possibility of tariffs on digital services has prompted many European organizations to reconsider their reliance on US hyperscaler clouds. ... What was once largely a public-sector concern now attracts growing interest across a wide range of private organizations as well. Accenture is currently working with around 50 large European organizations on digital-sovereignty-related projects, said Capo. This includes banks, telcos, and logistics companies alongside clients in government and defense. ... Another worry is the possibility that cloud services will be swept up in future trade disputes. If the EU imposes retaliatory tariffs on digital services, the cost of using hyperscaler cloud platforms could hike overnight, and organizations heavily dependent on them may find it hard to switch to a cheaper option. There’s also the prospect that organizations could lose access to cloud services if sanctions or export restrictions are imposed, leaving them temporarily or permanently locked out of systems they rely on. It’s a remote risk, said Dario Maisto, a senior analyst at Forrester, but a material one. “We are talking of a worst-case scenario where IT gets leveraged as a weapon,” he said.

What the AWS outage taught CIOs about preparedness

For many organizations, the event felt like a cyber incident even though it wasn’t, but it raised a difficult question for CIOs about how to prepare for a disruption that lives outside your infrastructure, yet carries the same operational and reputational consequences as a security breach. ... Beyond strong cloud architecture, “Preparedness is the real differentiator,” he says. “Even the best technology teams can’t compensate for gaps in scenario planning, coordination, and governance.” ... Within Deluxe, disaster recovery tests historically focused on applications the company controlled, while cyber tabletops focused on simulated intrusions. The AWS outage exposed the gap between those exercises and real-world conditions. Shifting its applications from AWS East to AWS West was swift, and the technology team considered the recovery a success. Yet it was far from business as usual, as developers still couldn’t access critical tools like GitHub or Jira. “We thought we’d recovered, but the day-to-day work couldn’t continue because the tools we depend on were down,” he says. ... In a well-architected hybrid cloud setup, he says resilience is more often a coordination problem than a spending problem, and distributing workloads across two cloud providers doesn’t guarantee better outcomes if the clouds rely on the same power grid, or experience the same regional failure event. ... Jayaprakasam is candid about the cultural challenge that comes with resilience work.

Winning the density war: The shift from RPPs to scalable busway infrastructure in next-gen facilities

“Four or five years ago, we were seeing sub-ten-kilowatt racks, and today we're being asked for between 100 and 150 kilowatts, which makes a whole magnitude of difference,” says Osian. “And this trend is going to continue to rise, meaning we have to mobilize for tomorrow’s power challenges, today.” Rising power demands also require higher available fault currents to safely handle larger, more dynamic surges in the circuit. Supporting equipment must be more resilient and reliable to maintain safe and efficient distribution. With change happening so quickly, adopting a long-term strategy is essential. This requires building critical infrastructure with adaptability and flexibility at its core. ... A modular approach offers another tactical advantage: speed. With a traditional RPP setup, getting power physically hooked up from A to B on a per-rack basis is time and resource-consuming, especially at first installation. By reducing complexity with a plug-and-play modular design slotted in directly over the racks, the busway delivers the swift reinforcements modern facilities need to stay ahead. ... “One of the advancements we've made in the last year is creating a way for users to add a circuit from outside the arc flash boundary. While the Starline busway is already rated for live insertion – meaning it’s safe out of the box – we’ve taken safety to the next level with a device called the Remote Plugin Actuator. It allows a user to add a circuit to the busway without engaging any of the electrical contacts directly.”

Building a data-driven, secure and future-ready manufacturing enterprise: Technology as a strategic backbone

A central pillar of Prince Pipes and Fittings’ digital strategy is data democratisation. The organisation has moved decisively away from static reports towards dynamic, self-service analytics. A centralised data platform for sales and supply chain allows business users to create their own dashboards without dependence on IT teams. Desai further states, “Sales teams, for instance, can access granular data on their smartphones while interacting with customers, instantly showcasing performance metrics and trends. This empowerment has not only improved responsiveness but has also enhanced user confidence and satisfaction. Across functions, data is now guiding actions rather than merely describing outcomes.” ... Technology transformation at Prince Pipes and Fittings has been accompanied by a conscious effort to drive cultural change. Leadership recognised early that democratising data would require a mindset shift across the organisation. Initial resistance was addressed through structured training programs conducted zone-wise and state-wise, helping users build familiarity and confidence with new platforms. ... Cyber security is treated as a business-critical priority at Prince Pipes and Fittings. The organisation has implemented a phase-wise, multi-layered cyber security framework spanning both IT and OT environments. A simple yet effective risk-classification approach i.e. green, yellow, and red, was used to identify gaps and prioritise actions. ... Equally important has been the focus on human awareness.

The Next Fraud Problem Isn’t in Finance. It’s in Hiring: The New Attack Surface

The uncomfortable truth is that the interview has become a transaction. And the “asset” being transferred is not a paycheck. It’s access: to systems, data, colleagues, customers, and internal credibility. ... Payment fraud works because the system is trying to be fast. The same is true in hiring. Speed is rewarded. Friction is avoided. And that creates a predictable failure mode: an attacker’s job is to make the process feel normal long enough to get to “approved.” In payments, fraudsters use stolen cards and compromised accounts. In hiring, they can use stolen faces, voices, credentials, and employment histories. The mechanics differ, but the objective is identical: get the system to say yes. That’s why the right question for leaders is not, “Can we spot a deepfake?” It’s, “What controls do we have before we grant access?” ... Many companies verify identity late, during onboarding, after decisions are emotionally and operationally “locked.” That’s the equivalent of shipping a product and hoping the card wasn’t stolen. Instead, introduce light identity proofing before final rounds or before any access-related steps. ... In payments, the critical moment is authorization. In hiring, it’s when you provision accounts, ship hardware, grant repository permissions, or provide access to customer or financial systems. That moment deserves a deliberate gate: confirm identity through a known-good channel, verify references without relying on contact info provided by the candidate, and run a final live verification step before credentials are issued.

Agent autonomy without guardrails is an SRE nightmare

Four-in-10 tech leaders regret not establishing a stronger governance foundation from the start, which suggests they adopted AI rapidly, but with margin to improve on policies, rules and best practices designed to ensure the responsible, ethical and legal development and use of AI. ... When considering tasks for AI agents, organizations should understand that, while traditional automation is good at handling repetitive, rule-based processes with structured data inputs, AI agents can handle much more complex tasks and adapt to new information in a more autonomous way. This makes them an appealing solution for all sorts of tasks. But as AI agents are deployed, organizations should control what actions the agents can take, particularly in the early stages of a project. Thus, teams working with AI agents should have approval paths in place for high-impact actions to ensure agent scope does not extend beyond expected use cases, minimizing risk to the wider system. ... Further, AI agents should not be allowed free rein across an organization’s systems. At a minimum, the permissions and security scope of an AI agent must be aligned with the scope of the owner, and any tools added to the agent should not allow for extended permissions. Limiting AI agent access to a system based on their role will also ensure deployment runs smoothly. Keeping complete logs of every action taken by an AI agent can also help engineers understand what happened in the event of an incident and trace back the problem.

Where Architects Sit in the Era of AI

In the emerging AI-augmented ecosystem, we can think of three modes of architect involvement: Architect in the loop, Architect on the loop, and Architect out of the loop. Each reflects a different level of engagement, oversight, and trust between an Architect and intelligent systems. ... What does it mean to be in the loop? In the Architect in the Loop (AITL) model, the architect and the AI system work side by side. AI provides options, generates designs, or analyzes trade-offs, but humans remain the decision-makers. Every output is reviewed, contextualized, and approved by an architect who understands both the technical and organizational context. This is where the Architect is sat in the middle of AI interactions ... What does it mean to be on the loop? As AI matures, parts of architectural decision-making can be safely delegated. In the Architect on the Loop (AOTL) model, the AI operates autonomously within predefined boundaries, while the architect supervises, reviews, and intervenes when necessary. This is where the architect is firmly embedded into the development workflow using AI to augment and enhance their own natural abilities. ... What does it mean to be out of the loop? In the AOOTL model, we see a world where the architect is no longer required in the traditional fashion. The architectural work of domain understanding, context providing, and design thinking is simply all done by AI, with the outputs of AI being used by managers, developers, and others to build the right systems at the right time.

Cloud Migration of Microservices: Strategy, Risks, and Best Practices

The migration of microservices to the cloud is a crucial step in the digital transformation process, requiring a strategic approach to ensure success. The success of the migration depends on carefully selecting the appropriate strategy based on the current architecture's maturity, technical debt, business objectives, and cloud infrastructure capabilities. ... The simplest strategy for migrating to the cloud is Rehost. This involves moving applications as is to virtual machines in the cloud. According to research, around 40% of organizations begin their migration with Rehost, as it allows for a quick transition to the cloud with minimal costs. However, this approach often does not provide significant performance or cost benefits, as it does not fully utilize cloud capabilities. Replatform is the next level of complexity, where applications are partially adapted. For example, databases may be migrated to cloud services like Amazon RDS or Azure SQL, file storage may be replaced, and containerization may be introduced. Replatform is used in around 22% of cases where there is a need to strike a balance between speed and the depth of changes. A more time-consuming but strategically beneficial approach is Refactoring (or Rearchitecting), in which the application undergoes a significant redesign: microservices are introduced, Kubernetes, Kafka, and cloud functions (such as Lambda and Azure Functions) are utilized, as well as a service bus.

Daily Tech Digest - January 16, 2025

How DPUs Make Collaboration Between AppDev and NetOps Essential

While GPUs have gotten much of the limelight due to AI, DPUs in the cloud are having an equally profound impact on how applications are delivered and network functions are designed. The rise of DPU-as-a-Service is breaking down traditional silos between AppDev and NetOps teams, making collaboration essential to fully unlock DPU capabilities. DPUs offload network, security, and data processing tasks, transforming how applications interact with network infrastructure. AppDev teams must now design applications with these offloading capabilities in mind, identifying which tasks can benefit most from DPUs—such as real-time data encryption or intensive packet processing. ... AppDev teams must explicitly design applications to leverage DPU-accelerated encryption, while NetOps teams need to configure DPUs to handle these workloads efficiently. This intersection of concerns creates a natural collaboration point. The benefits of this collaboration extend beyond security. DPUs excel at packet processing, data compression, and storage operations. When AppDev and NetOps teams work together, they can identify opportunities to offload compute-intensive tasks to DPUs, dramatically improving application performance.

The CFO may be the CISO’s most important business ally

“Cybersecurity is an existential threat to every company. Gone are the days where CFOs could only be fired if they ran out of money, cooked the books, or had a major controls outage,” he said. “Lack of adequate resourcing of cybersecurity is an emerging threat to their very existence.” This sentiment reflects the reality that for most organizations cyber threat is the No. 1 business risk today, and this has significant implications for the strategic survival of the enterprise. It’s time for CISOs and CFOs to address the natural barriers to their relationship and develop a strategic partnership for the good of the company. ... CISOs should be aware of a few key strategies for improving collaboration with their CFO counterparts. The first is reverse mentoring. Because CFOs and CISOs come from differing perspectives and lead domains rife with terminology and details that can be quite foreign to the other, reverse mentoring can be important for building a bridge between the two. In such a relationship, the CISO can offer insights into cybersecurity, while simultaneously learning to communicate in the CFO’s financial language. This mutual learning creates a more aligned approach to organizational risk. Second, CISOs must also develop their commercial perspective.

Establishing a Software-Based, High-Availability Failover Strategy for Disaster Mitigation and Recovery

No one should be surprised that cloud services occasionally go offline. If you think of the cloud as “someone else’s computer,” then you recognize there are servers and software behind it all. Someone else is doing their best to keep the lights on in the face of events like human error, natural disasters, and DDoS and other types of cyberattacks. Someone else is executing their disaster response and recovery plan. While the cloud may well be someone else’s computer, when there is a cloud outage that affects your operations, it is your problem. You are at the mercy of someone else to restore services so you can get back online. It doesn’t have to be that way. Cloud-dependent organizations can adopt strategies that allow them to minimize the risk someone else’s outage will knock them offline. One such strategy is to take advantage of hybrid or multi-cloud architecture to achieve operational resiliency and high availability through service redundancy through SANless clustering. Normally a storage area network (SAN) uses local storage to configure clustered nodes on-premises, in the cloud, and to a disaster recovery site. It’s a proven approach, but because it is hardware dependent, it is costly in terms of dollars and computing resources, and comes with additional management demands.

Trusted Apps Sneak a Bug Into the UEFI Boot Process

UEFI is a kind of sacred space — a bridge between firmware and operating system, allowing a machine to boot up in the first place. Any malware that invades this space will earn a dogged persistence through reboots, by reserving its own spot in the startup process. Security programs have a harder time detecting malware at such a low level of the system. Even more importantly, by loading first, UEFI malware will simply have a head start over those security checks that it aims to avoid. Malware authors take advantage of this order of operations by designing UEFI bootkits that can hook into security protocols, and undermine critical security mechanisms like UEFI Secure Boot or HVCI, Windows' technology for blocking unsigned code in the kernel. To ensure that none of this can happen, the UEFI Boot Manager verifies every boot application binary against two lists: "db," which includes all signed and trusted programs, and "dbx," including all forbidden programs. But when a vulnerable binary is signed by Microsoft, the matter is moot. Microsoft maintains a list of requirements for signing UEFI binaries, but the process is a bit obscure, Smolár says. "I don't know if it involves only running through this list of requirements, or if there are some other activities involved, like manual binary reviews where they look for not necessarily malicious, but insecure behavior," he says.

How CISOs Can Build a Disaster Recovery Skillset

In a world of third-party risk, human error, and motivated threat actors, even the best prepared CISOs cannot always shield their enterprises from all cybersecurity incidents. When disaster strikes, how can they put their skills to work? “It is an opportunity for the CISO to step in and lead,” says Erwin. “That's the most critical thing a CISO is going to do in those incidents, and if the CISO isn't capable doing that or doesn't show up and shape the response, well, that's an indication of a problem.” CISOs, naturally, want to guide their enterprises through a cybersecurity incident. But disaster recovery skills also apply to their own careers. “I don't see a world where CISOs don't get some blame when an incident happens,” says Young. There is plenty of concern over personal liability in this role. CISOs must consider the possibility of being replaced in the wake of an incident and potentially being held personally responsible. “Do you have parachute packages like CEOs do in their corporate agreements for employability when they're hired?” Young asks. “I also see this big push of not only … CISOs on the D&O insurance, but they're also starting to acquire private liability insurance for themselves directly.”

Site Reliability Engineering Teams Face Rising Challenges

While AI adoption continues to grow, it hasn't reduced operational burdens as expected. Performance issues are now considered as critical as complete outages. Organizations are also grappling with balancing release velocity against reliability requirements. ... Daoudi suspects that there are a series of contributing factors that have led to the unexpected rise in toil levels. The first is AI systems maintenance: AI systems themselves require significant maintenance, including updating models and managing GPU clusters. AI systems also often need manual supervision due to subtle and hard-to-predict errors, which can increase the operational load. Additionally, the free time created by expediting valuable activities through AI may end up being filled with toilsome tasks, he said. "This trend could impact the future of SRE practices by necessitating a more nuanced approach to AI integration, focusing on balancing automation with the need for human oversight and continuous improvement," Daoudi said. Beyond AI, Daoudi also suspects that organizations are incorrectly evaluating toolchain investments. In his view, despite all the investments in inward-focused application performance management (APM) tools, there are still too many incidents, and the report shows a sentiment for insufficient observability instrumentation.

The Hidden Cost of Open Source Waste

Open source inefficiencies impact organizations in ways that go well beyond technical concerns. First, they drain productivity. Developers spend as much as 35% of their time untangling dependency issues or managing vulnerabilities — time that could be far better spent building new products, paying down technical debt, or introducing automation to drive cost efficiencies. ... Outdated dependencies compound the challenge. According to the report, 80% of application dependencies remain un-upgraded for over a year. While not all of these components introduce critical vulnerabilities, failing to address them increases the risk of undetected security gaps and adds unnecessary complexity to the software supply chain. This lack of timely updates leaves development teams with mounting technical debt and a higher likelihood of encountering issues that could have been avoided. The rapid pace of software evolution adds another layer of difficulty. Dependencies can become outdated in weeks, creating a moving target that’s hard to manage without automation and actionable insights. Teams often play catch-up, deepening inefficiencies and increasing the time spent on reactive maintenance. Automation helps bridge this gap by scanning for risks and prioritizing high-impact fixes, ensuring teams focus on the areas that matter most.

The Virtualization Era: Opportunities, Challenges, and the Role of Hypervisors

Choosing the most appropriate hypervisor requires thoughtful consideration of an organization’s immediate needs and long-term goals. Scalability is a crucial factor, as the selected solution must address current workloads and seamlessly adapt to future demands. A hypervisor that integrates smoothly with an organization’s existing IT infrastructure reduces the risks of operational disruptions and ensures a cost-effective transition. Equally important is the financial aspect, where businesses must look beyond the initial licensing fees to account for potential hidden costs, such as staff training, ongoing support, and any necessary adjustments to workflows. The quality of support the vendor provides, coupled with the strength of the user community, can significantly influence the overall experience, offering critical assistance during implementation and beyond. For many businesses, partnering with Managed Service Providers (MSPs) brings an added layer of expertise, ensuring that the chosen solution delivers maximum value while minimizing risk. The ongoing evolution and transformation of the virtualization market presents both challenges and opportunities. As the foundation for IT efficiency and flexibility, hypervisors remain central to these changes.

DORA’s Deadline Looms: Navigating the EU’s Mandate for Threat Led Penetration Testing

It’s hard to defend yourself, if you have no idea what you’re up against, and history and countless news stories are evidence that trying to defend against all manner of digital threat is a fool’s errand. As such, the first step to approaching DORA compliance is profiling not only the threat actors that target the financial services sector, but specifically which actors, and by what Tactics Techniques and Procedures (TTPs), you are likely to be attacked. However, first before you can determine how an actor may view and approach you, you need to know who you are. So, the first profile that must be built is of your own business. Not just financial services, but what sector/aspect, what region, and finally what is the specific risk profile based on the critical assets in organizational, and even partner, infrastructures. The second profile begins with the current population of known actors that target the financial services industry. It then moves to narrowing to the actors known to be aligned with the specific targeting profile. From there, leveraging industry standard models such as the MITRE ATT&CK framework, a graph is created of each actor/group’s understood goals and TTPs, including their traditional and preferred methods of access and exploitation, as well as their capabilities for evasion, persistence and command and control.

With AGI looming, CIOs stay the course on AI partnerships

“The immediate path for CIOs is to leverage gen AI for augmentation rather than replacement — creating tools that help human teams make smarter, faster decisions,” Nardecchia says. “There are very promising results with causal AI and AI agents that give an autonomous-like capability and most solutions still have a human in the loop.” Matthew Gunkel, CIO of IT Solutions at the University of California at Riverside, agrees that IT organizations should keep moving forward regardless of the growing delta between AI technology milestones and actual AI implementations. ... “The rapid advancements in AI technology, including projections for AGI and ACI, present a paradox: While the technology races ahead, enterprise adoption remains in its infancy. This divergence creates both challenges and opportunities for CIOs, employees, and AI vendors,” Priest says. “Rather than speculating on when AGI/ACI will materialize, CIOs would be best served to focus on what preparation is required to be ready for it and to maximize the value from it.” Sid Nag, vice president at Gartner, agrees that CIOs should train their attention on laying the foundation for AI and addressing important matters such as privacy, ethics, legal issues, and copyright issues, rather than focus on AGI advances.

Quote for the day:

"When you practice leadership,The evidence of quality of your leadership, is known from the type of leaders that emerge out of your leadership" -- Sujit Lalwani

Daily Tech Digest - July 10, 2024

How platform teams lead to better, faster, stronger enterprises

Platform teams are uniquely equipped to optimize resource allocation because they sit in between developers and the cloud infrastructure and compute that developers need, and are able to maximize the efficiency and effectiveness of software development processes. With their unique set of skills and expertise, they effectively collaborate with other teams, including developers, data scientists, and operations teams, to accurately understand their needs and pain points. Using a product approach, platform teams remove barriers for developers and operations teams by offering shared services for developer self-service, enabling faster modernization within organizational boundaries and automation to simplify the management of applications and Kubernetes clusters in the cloud. Fostering a culture of innovation, platform teams play a crucial role in keeping the organization at the forefront of emerging trends and technologies. This enables enterprises to provide innovative solutions that set them apart in the market.

Developing An AI Uuse Policy

An AI Use Policy is designed to ensure that any AI technology used by your business is done so in a safe, reliable and appropriate manner that minimises risks. It should be developed to inform and guide your employees on how AI can be used within your business. ... Perhaps the most important part for the majority of your employees, set specific do’s and don’ts for inputs and outputs. This is to ensure compliance with data security, privacy and ethical standards. For example, “Don’t input any company confidential, commercially sensitive or proprietary information”, “Don’t use AI tools in a way that could inadvertently perpetuate or reinforce bias” and “Don’t input any customer or co-worker’s personal data”. For outputs, guidance can reiterate to staff the potential for misinformation or ‘hallucinations’ generated by AI. Consider rules such as “Clearly label any AI generated content”, “Don’t share any output without careful fact-checking” or “Make sure that a human has the final decision when using AI to help make a decision which could impact any living person

Synergy between IoT and blockchain transforming operational efficiency

The synergy between the two technologies is integral to achieving Industry 4.0 goals, including digital transformation, decentralised connectivity, and smart industry advancements. Via this integration, organisations can achieve real-time visibility into production operations, optimise supply chain processes, and enhance overall efficiency. ... In regulated industries like pharmaceutical manufacturing, where compliance is crucial, integrating IoT and Blockchain lets companies onboard suppliers to upload raw material info, batch numbers, and quality checks to a blockchain ledger. IoT devices automate data acquisition during manufacturing and storage, ensuring data integrity and transparency. In smart city ecosystems, local authorities share data with service providers for waste management, traffic updates, and more. Traffic data from sensors can be securely uploaded to a blockchain, where third-party services like food delivery and ridesharing can access it to optimise operations. Logistics companies use IoT systems to gather data on location and handling, which is uploaded to a blockchain ledger to track goods, estimate delivery time, and provide real-time updates.

Ignore Li-ion fire risks at your peril

Li-ion batteries are prone to destructive and hard-to-control fires. There have been several reported incidents in data centers, some of which have led to serious outages, but they are not well-documented or systematically studied. ... A commonly held view is that Li-ion’s fire risk in the data center is overstated, partly as a result of marketing by vendors of alternative chemistries such as salt and nickel-zinc. If these products are promoted as a “safe” alternative, then it will (it is speculated) create a perception that Li-ion is “unsafe.” After assessing the evidence, examining the science, and hearing from data center operators at recent member meetings, Uptime Institute is taking a cautious and practicable stance at this point. While it is true that Li-ion batteries have a higher risk of fire compared with other chemistries, and these fires are particularly problematic, Uptime Institute engineers do not think Li-ion batteries should be rejected out of hand. ... Data center builders and operators should carefully consider the benefits of Li-ion batteries alongside the risks. As well as the obvious risk of serious fires, there are financial and reputational risks in preparing for, avoiding, and responding to such incidents.

More than a CISO: the rise of the dual-titled IT leader

Dual-title roles give CISOs new levers to work with and more scope to drive strategic integration and alignment of cybersecurity within the organization. ... Belknap finds having his own team of engineers puts him in a stronger position when working with partners. When looking for support or assistance with a project, his team will have already built something, reducing the amount of work needed from the partner team. “This means we can lean on them to be responsible for the things that only they can do. I don’t have to pull them into the work that only I can do or the work that’s not aligned to their expertise,” he says. These dual-title roles also recognize how CISOs are increasingly operating as technology leaders and operators of the organization, according to Adam Ely, head of digital products at Fidelity Investments who was formerly the firm’s CISO and has a long history in security. Ely says that as CISOs typically work across an organization, know how the business lines work, and are day-to-day leaders of people and technology as well as crisis managers, it stands them in good stead for dual-title or more senior positions.

You Can’t Wish Away Technology Complexity

Every business succeeds because of technology. Every person gets paid by technology. The value of our currency itself is about technology. Of course, it is not only about technology. But tell that to the CFO or CLO. When it is about finance, there is very little pushback in saying it is all about money. When it is about legal, there is no push-back about it being about law. I’ve noticed only technologists pull back and say, “You’re right, it’s not about technology.” ... See what people often forget that technology complexity is cool on multiple levels. It gives us the ability to make different choices for stakeholders and customers (I mean real customers not stakeholders that think they are customers – note to business stakeholders, you and I get our paychecks from the same place, you are not my customer. Our customer is my customer). But while this complexity allows for choice, it also creates a dependency on understanding those choices. Or a dependency on a professional who does. I don’t pretend to understand medicine. That is why I ask doctors what to do.

Electronic Health Record Errors Are a Serious Problem

The exposure of healthcare records, in even minor ways, leaves patients highly vulnerable. “I never reached out to this woman [whose records were entered into my father’s], but I had all her contact information. I could have gone to her house and handed her the copy of the results I had found in my dad’s records,” Hollingsworth says. ... Data aggregators pose a further risk. These organizations may collect deidentified data to perform analyses on population-level health issues for both healthcare organizations and insurance companies. “Are they following the same security standards that we follow in the health care transaction world?” Ghanayem asks. “I don’t know.” ... Clear distinctions between important information fields must be made to cut down on adjacency errors. Concise patient summaries at the beginning of each record and usable search features may increase usability and decrease frustration that leads to the introduction of errors. And refining when alerts are issued can decrease alert fatigue, which may lead providers to simply ignore alerts even when they are valid.

Diversifying cyber teams to tackle complex threats

To make a significant change and deliver a more diverse cyber workforce, we need to focus on leadership and change our language and processes for recruitment. This takes courage and is the biggest challenge organizations face. Having a diverse team helps others see it is a place for them. It isn’t just about attracting talent; it’s also about openness and retaining talent. Organizations need to help individuals from diverse backgrounds to see themselves as role models who need to be out shouting about the opportunities within the sector. Diversity fosters a sense of belonging and inclusivity making the cybersecurity field more attractive to a wider range of individuals. When potential recruits see relatable role models within a team, it breaks down the traditional and somewhat homogenous perception of cybersecurity. This inclusivity is crucial for attracting talent from underrepresented groups, particularly women and minority groups, who may not have traditionally seen themselves in cybersecurity roles. A diverse team with strong role models creates a positive feedback loop.

Nanotechnology and SRE: Pioneering Precision in Performance

Nanotechnology offers the opportunity to transform SRE at the atomic level — addressing individual tasks, subtasks, and tickets. For example, extra-sensitive nanosensors can continuously monitor system performance metrics, including temperature, voltage, and processing load. When placed in data centers, these sensors enable real-time data collection and analysis, detecting electrical and mechanical issues before they escalate and extending the lifespan of technological components. Nanobots can be programmed to address hardware issues and routine maintenance tasks. Together, these technologies can integrate into a self-healing and continuously improving system in line with SRE principles. ... Nanotechnology can potentially transform SRE, leading to enhanced system reliability and performance. Nanotechnology-enabled solutions can allow more precise monitoring, optimization, and real-time improvements, supporting the key pillars of SRE. At the same time, the foundational principles of SRE can be applied to ensure the reliability of advanced nanotechnology systems.

Three Areas Where AI Can Make a Huge Difference Without Significant Job Risk

Doing a QC job can be annoying because even though the job is critical to the outcome, your non-QC peers and management treat you like a potentially avoidable annoyance. You stand in the way of shipping on time and at volume, potentially delaying or even eliminating performance-based bonuses. We are already discovering that to assure the quality of an AI-driven coding effort, a second AI is needed to assure the quality of the result because people just don’t like doing QC on code, particularly those who create it. ... In short, properly applied AI could highlight and help address problems that are critically reducing a company’s ability to perform to its full potential and preventing it from becoming a great place to work. ... Calculating an employee’s contribution and then using it to set compensation transparently should significantly reduce the number of employees who feel they are being treated unfairly by eliminating that unfairness or by showing them a path to improve their value and thus positively impact their pay.

Quote for the day:

"When you stop chasing the wrong things you give the right things a chance to catch you." -- Lolly Daskal