Showing posts with label controls. Show all posts
Showing posts with label controls. Show all posts

August 02, 2015

New Guide From ISACA Helps Organizations Improve SAP Security Controls

“ERP systems automate and integrate much of a company’s business processes to create consistency. ISACA released this important update to bring together information related to SAP ERP-specific risks, controls and testing procedures,” said Ben Fitts of Deloitte Advisory, who worked with ISACA on the fourth edition of the book. “This will be a go-to reference for auditors, not just as a one-time read, but as a book they can dog-ear with sticky notes and return to year after year.” ERP software integrates all facets of an operation, including product planning, development, manufacturing, sales and marketing.


Facebook's Aquila Aircraft, Which Can Beam Data At 10Gb/s Is Complete

Facebook undertook this project as part of its Internet.org efforts. If you’re unfamiliar with Internet.org, it is an initiative led by Facebook, with the goal of bringing together leaders in technology, nonprofits, and local communities to help connect the two thirds of the world that doesn’t have internet access. Zuckerberg explains in his post announcing the completion of Aquila, “This effort is important because 10% of the world’s population lives in areas without existing internet infrastructure. To affordably connect everyone, we need to build completely new technologies.”


Big Data Makes a Better Blockbuster

This is also the moment where Big Data entrepreneurs will be able to turn a vision into reality and change the world, by bringing the benefits of Big Data to the masses. Big Data, analytics, and tools are changing the world, but just because they can read scripts and correlate data sets doesn't mean that human intelligence no longer has a role. In fact, I would argue that these algorithms will free human data scientists from the activities they (objectively) aren't so good at, giving them better information with which to make the creative decisions the computers can't. The examples above show that Big Data isn't only becoming available to smaller businesses, but that it's affecting industries that were considered very difficult to disrupt.



Financial Institutions need to jump on the big data bandwagon

With cashless transactions becoming the norm, fraud is another big issue. Banks needs to continuously monitor client behaviour for anything anomalous. This is done by monitoring the time, geolocation, transaction amount, transaction frequency, items purchased and then mapping the behaviour against a template of what ‘normal’ looks like for that customer. Bear in mind that ‘normal’ for December may be very different from ‘normal’ in July. Spatiotemporal problems like this are non-trivial, and solving them requires highly efficient processing at scale. With data streaming in thick and fast and potentially large financial transactions at stake we ideally want to detect anomalies accurately and within a small time window. Accuracy here means not stopping valid transactions


Machine learning, IoT and big data: Retailers need to embrace latest tech or fall behind

It is here that retailers need to consider technologies that can harness and analyse data automatically and carry out actions without needing much or any human intervention. Luca Bonacina, a retail research analyst at IDC, explained that the retail world has the opportunity to adopt machine learning to improve big data use. "The retail industry is well positioned to take advantage of machine learning developments as very large volumes of data (structured or unstructured) are being created every second. There is a need to understand the hidden patterns in that data to make the most use of it," he said. Machine learning systems can analyse data automatically and in real time to present recommendations to retail workers, or take action based on the results of such analysis.


Black Vine: Anthem hackers share zero-days with rival cyberattackers

It is believed a group dubbed Black Vine is to blame for the data breach, and Anthem is only one of multiple campaigns this resourceful group has shouldered the blame for. On Tuesday, cybersecurity firm Symantec released a whitepaper (.PDF) documenting the evolution of Black Vine over the last three years. According to the company, Black Vine has been in operation since 2012, and the group has compromised companies within the aerospace industry, healthcare, energy, military and defense, finance, agriculture and technology realms. The group not only has access to a variety of zero-day exploits but also uses customized malware. Symantec explains:


How to read a digital footprint

Measuring psychological traits has long been difficult for researchers and boring for participants, usually involving laborious questionnaires. This will sound familiar to anyone who has used an employment agency or job centre. The team are now building on their previous work with algorithms to take psychometric testing even further into uncharted territory – video games. Job centres might be the first to benefit. “A job centre gets about seven minutes with each job seeker every two weeks, so providing personalised support in that time is challenging,” explains Stillwell. “We are working with a company to build a game that measures a person’s strengths in a ‘gamified’ way that’s engaging but still accurate.”


Being Quantitative in Spite of Ambiguity

First, even the simplest of problem statements like “quantify our market growth” has several different ways that this problem could be solved. You could use internal data assets like sales figures, you could use third party data assets like social media activity, and you could even use publicly available data assets like census data to start to quantify these things. You could analyze the data with a litany of techniques with tools like time series analysis, supervised learning, unsupervised learning, regression or network analysis at your disposal. ... There are thousands and thousands of permutations, each of which might be appropriate for solving the problem at hand, making it difficult to navigate the landscape of approaches at your disposal.


Researchers improve de-anonymization attacks for websites hiding on Tor

The Tor anonymity network was built to hide from network snoopers which websites or other Internet resources that user is accessing. It does this by wrapping the user’s requests in several layers of encryption and routing them through multiple computers that run the Tor software. Each of those computers, known as nodes or relays, peel off one layer of encryption, before passing on the request to the next node. In this way the final node, called the exit relay, knows the request’s destination, but not its original source, while the first node, known as the entry guard, knows the original source, but not the final destination. It has long been known that if an attacker controls both the entry guard and the exit relay used for a Tor connection, or circuit, he could use traffic correlation techniques to deanonymize the user.


The best Wi-Fi extender (for most people)

We spent a total of 110 hours researching 25 different Wi-Fi extenders (and testing 10 of them), and the $100 Netgear EX6200 is the one we recommend for most people right now. It costs as much as a great router—but it has the best combination of range, speed, flexibility, and physical connections of any extender we tested. In our tests, the EX6200 could stream 1080p YouTube videos to three laptops at the same time (one up to 63 feet away), and it was the only extender we tested that could stream a 4K YouTube video to a single laptop at the same distance. The Netgear EX6200 also had the best long-range performance, even through exterior walls. It was the easiest to configure and it can give your devices the fastest connection they're likely to support.


Paxata: Adaptive Data Preparation

Paxata developed the first Adaptive Data Preparation™ platform built for the business analyst. The company’s technology dramatically reduces the most painful and manual steps of any analytic exercise, turning raw data into ready data for analytics, and empowering analysts to drive greater value for the business. With seamless connections to BI tools like Tableau, QlikView, and Excel, users can combine data on their own or work with peers in a shared, transparent environment as they shape data for analytics. Data prep has needed re-invention for 30+ years. Paxata leads the convo on self-service data integration, quality, enrichment, collaboration and governance.



Quote for the day:

"The simple act of paying positive attention to people has a great deal to do with productivity" -- Tom Peters

November 26, 2014

Google Glass Is Dead; Long Live Smart Glasses
Despite Google’s missteps, the technology isn’t going away. The idea that Glass represents—allowing you to ingest digital information at a glance—has appealed for decades to die-hards like Thad Starner, a Glass technical lead who has been making and wearing these kinds of gadgets since 1993. Researchers are going to keep plugging away until we get to a point where the technology blends into the glasses themselves, rather than sitting so obviously atop them. So imagine that in a few years someone comes out with smart glasses that are pretty much unnoticeable. They have a tiny display in the lenses; the electronics and battery are neatly concealed in the frame.


Don't forget charisma when hiring an IT leader
Charisma often gets a bad rap in technical circles. It's perceived as the sizzle without the steak, or the "empty suit" who shakes the hands and kisses the babies, but underneath it all has no idea what he or she is talking about. In IT we often evaluate our peers and managers by their technical acumen, and anyone who doesn't make the cut is dismissed as incapable. However, these "soft skills" can be critically important, although they're rarely bundled with deep technical competence, requiring IT leaders to evaluate where to deploy their charismatic leaders vs. their strongest technicians.


What’s the Value of IT Security Investments for Security Intelligence?
Given the maniacal focus of senior executives on stock values, an alternative approach to expressing the value of IT security might be to use an event study approach. Eugene Fama, an American economist and Nobel laureate in economics, established the event study methodology based on his efficient market theory. This theory assumes stock market prices always immediately reflect all available information. Simply stated, event studies reflect the stock market reaction to a public announcement.


An Unconventional Solution to a Big IT Problem
No matter how you slice it, the user community believes that we will somehow divine the perfect system for them. And as much as we wish this unrealistic expectation would go away—or that we could just go ahead and write the systems without our users’ involvement—we all know that’s not possible. (At least, not if we want to have a hope of actually delivering on their real needs.) So what’s an IT professional to do when faced with the ever-present burden of unavailable stakeholders? Here’s a real-life story that may cause you to not only think a little differently, but to act a little differently in the coming year.


7 Leadership Tips for Women Tech Executives
"Female executives face the challenge of presenting themselves accurately in their first 90 days on the job. They need to balance proving both their competence and skill set with showing their true work persona. Male executives are judged first and foremost on how they do a job, and perhaps secondarily on their office demeanor and appearance. Women are immediately judged on both, and therefore need to set goals around performance in both areas," says Danielle Tate, founder and CEO of MissNowMrs.com, an online name change service.


The Gap Between Big Data and Big Insights: Turning data into engaging stories
It’s not that big data isn’t important. Believe me, it’s the foundation for the future of business. It’s just that every time I hear about big data, it’s either in the context of social media, The Internet of Things, data technology, Nate Silver, or a combination of all of the above. What I don’t hear enough is the human side of data, the questions asked, the insights that are drawn, and the ways that insights are then executed against at every level that matters (internally and externally). The problem with big data is we think that by saying “big,” we automatically convey importance and urgency up, down, and across our organization.


Hybrid cloud growth leaves enterprises scrambling for control
Cairns explained that the reason why there has been such a quick uptake in such a short period of time is because enterprises have realised the advantages a cloud environment can provide, such as the increased freedom to be agile and innovative. "It's almost the freedom to fail quietly. So you can go out and be innovative, and if it does work, you can expand madly on public and on private. It's just so much more accessible," she said. But because the uptake has been so rapid, Cairns said many enterprises are now wrangling with multiple cloud accounts, while learning how to balance shifting workloads from legacy and into the cloud.


Review: Lenovo Yoga Tablet 2 Pro
Using the pico projector is a mixed bag. It's more of a gimmick than a useful feature. It projects the image out of the left side of the cylinder, and tablet placement is critical to get a level projection on a wall or screen. The stand must be in a low angle position, and tilted just right to get a good projected image. There is a slider next to the lens for focusing the projected display, which can be as big as 50 inches. This slider is stiff to move, making fine adjustments very difficult. This turns using the projector into an exercise in frustration. A button on the left side of the tablet toggles the pico projector on and off.


Making the Case for an API Roadmap
Access is often a significant API adoption barrier, so provide a self-service, resource-rich environment. Use API management infrastructure (e.g. WSO2 API Manager, Apigee, 3Scale) to expose an “API store.” The API Store application will establish your own API marketplace and promote APIs. Application developers easily find, explore, subscribe, and evaluate APIs within a marketplace experience similar to the Apple AppStore or Google Marketplace. The venue lets developers register as a potential API consumer, obtain API access credentials, and match project requirements to API capabilities.


Target Wants Data Breach Bank Claims Dismissed
"Target's gross security deficiencies enabled the breach, and Target's inaction and omissions worsened the breach's effect on plaintiffs," the lenders said in a court filing. The banks are relying in part on a Minnesota law — the Plastic Card Security Act — to support their claim that Target had a duty to shield them. The retailer contends the lenders aren't covered by the measure. The law prohibits the company from retaining certain card data after a sale is completed. Target's lawyers say the data theft happened at the point of sale and that the statute doesn't apply. Bank attorneys counter the company has said it retained card data and that the retailer voluntarily disabled data system security functions that would have detected the breach.



Quote for the day:

“If your actions inspire others to dream more, learn more, do more and become more, you are a leader.” -- John Quincy Adams

October 12, 2014

Effective IT governance enhances risk management and statutory and internal compliance
The Indian Companies Act has always provided for controls in information systems as a mandatory internal control requirement as a significant corporate governance requirement. The importance of IT governance is now further accentuated by the new Companies Act 2013, which provides for robust and structured risk management and internal controls, with specific requirements as regards internal controls that are relevant to financial reporting and electronic records. Effective IT governance enhances risk management and statutory and internal compliance.


Living Systems and the Information First Company
Put another way, NewCos are “information first” companies. They map the flows of information in a market, and organize themselves so as to exploit or leverage those information flows, even if the flows are “potential information” - information used in a new way, a manner which may be more efficient, productive, or valuable. Put information first, and let that determine how best to organize energy and matter. Industrial era-companies, on the other hand, value their hard assets first (energy, matter), and only view information as a way to organize or protect those assets.


NIST Cybersecurity Framework: Don’t Underestimate It
The framework also highlights why it is important for senior management to establish and supervise a cybersecurity program. The framework places senior management at the top of the decision-making process and holds senior managers responsible for compliance with the framework. Although senior managers without a technical background might be tempted to defer responsibility to their IT departments, complying with the framework requires them to be educated about the choices their company faces and to take responsibility for allocating appropriate resources to address risks.


Conquer the Top 20 critical security controls
The CSC emphasis on integration and automation makes it align very well with the Security Connected approach from McAfee (part of Intel Security). The Security Connected framework enables you to establish a robust risk management process with integrated solutions and management that protect your infrastructure—including IT and incident command systems (ICS) without impairing system availability. Because our and partner solutions share a unified, policybased management platform and real-time threat intelligence, organizations can move easily to adopt incremental controls as part of a consistent, efficient process.


New iRobot App Lets You Control a ‘Bot Army With an Android Tablet
The new control hub is called the uPoint Multi-Robot Control system, and it’s an Android app. It supports hopping between individual robots, so if you have several in your setup and simply tab over to control a different machine. With it, controlling the robots is even easier than driving a remote-control car. In the simplest setup, the app’s live-view screen shows you a feed from a robot’s front-mounted camera, and tapping on locations simply drives to that point. You can also drag your finger from the robot to different parts of the scene to lead it there. Doing so shows the drive path the machine will take, curves included. It makes it incredibly easy to navigate the robots around obstacles and corners.


FDA Follows NIST Framework in Cybersecurity Guidance for Medical Devices
While not yet mandatory, the FDA strongly recommends that manufacturers follow the guidance in explicitly addressing cybersecurity risks in premarket submissions for medical devices, particularly those that rely heavily on software, access patient data, and connect with electronic networks. So what, exactly, are the highlights of the FDA’s guidance for medical device manufacturers? And what are the take-away lessons for companies in the industry, whether or not they’re in the process of seeking premarket approval for new devices? Following the NIST Framework, the FDA recommends that companies focus on five core functions in addressing and managing cybersecurity risks: Identify, Protect, Detect, Respond, and Recover:


The Protection Revolution - A Needed Counter to Attacks
As security professionals, we need to follow a similar trajectory to hackers and apply lessons learned from the Industrial Revolution to become faster, more efficient, and more effective in our sector: a “Protection Revolution,” if you will. Just as technologies and capabilities for attackers have improved, so have technologies and capabilities for defenders. This gives us a unique opportunity to move toward security systems built on a foundation of broad-based visibility, depth of data collection, the ability to learn through correlation and context, and then dynamically apply controls.


Strategies for Security Governance
When dealing with contested security issues, or when escalating security risk issues to senior management, assume that your audience does not understand information security. Your narrative messages should be short—preferably one page and no longer than two pages. Talk in business risk terms and terminology. Be factual: issues must be dealt with in a straightforward manner. Do not sugar coat or exaggerate issues. Fear, uncertainty or doubt should not be used. Jargon should be explained or not used at all. Senior management should be updated at least three times a year on the general risk posture of the organization and outstanding high risk security issues that are being monitored.


Leading Enterprise Organizations Have Established a Dedicated Network Security Group
This “us-and-them” mentality appears to be legacy behavior. According to ESG research, 47% of enterprise organizations now claim that they have a dedicated group in charge of all aspects of network security (note: I am an ESG employee). Additionally, network security is done cooperatively by networking and security teams at 26% of organizations today, but these firms insist that they are in the process of creating a dedicated network security group to supplant their current division of labor.


How CIOs can plug critical gaps in IT governance
Cyber security is a fast-changing and complex field whose professionals will benefit from access to a foundational body of knowledge, education, and thought leadership from chief information security officers (CISOs) and other security experts working in the industry. By using industry frameworks such as COBIT to gain access to key tools, specific guidance they require, and access to the latest tips and insights from the industry, these professionals can ensure they are keeping up to date with ever-changing industry challenges and increasingly sophisticated attacks.



Quote for the day:

"You cannot be a leader, and ask other people to follow you, unless you know how to follow, too." -- Sam Rayburn

October 04, 2014

Driving IT Business Alignment: One CIOs Journey
To fix things, Dale and his team partnered with the business. Doing it together rather than separately enabled the IT organization and the business to collaborate and to build a better and more permanent partnership. Dale says, “We have really enjoyed implementing the solution, because the business units are now working very closely with IT”. Dale claims as well the relationship with their business units has gotten to be a very solid, trusting relationship with them, and very collaborative. They have learned to trust IT’s input, and IT has learned a lot from the business units about how they operate and like to operate.”


EA in practice: The Case Container
A central part to any typical Enterprise Application is the Case or Dossier, and the process handling this. The information going in to a Case, the business logic applied to it, and the subsequent business decision(s). It all has to be filed with accuracy. Case handling get complex because information changes over time, business decisions are made, and the business logic and the information going into it are also complex. Just look at financial institutions and insurance systems, as well as government systems. These have a load of legislation and business rules - that change over time – and every business decision must comply to the rules and information that was valid at that point in time. Otherwise that decision does not have integrity.


Examine API integration trends in the enterprise
As customers are looking to API integration tools more and more for mobile enablement, [representational state transfer (REST)/Javascript Object Notation] has become an accepted standard for exposing enterprise applications as APIs. Tools should facilitate the creation of these REST APIs, and on the back end [they should] support service discovery, shaping, cataloging and publishing APIs, and [monitor] the health and performance of these APIs at runtime.


Your Roadmap to Successful Adoption of Agile
Lean software development presents the traditional Lean principles in terms that relate to software development. Often when Lean is discussed, there tends to be a strong focus on eliminating waste and rightly so. However the real focus of Lean is the identification of value to the customer: delivering what they want, when they want it, and with the minimum amount of effort. To be sure, what is considered “valuable” also becomes a driver for what is considered wasteful. As folks think about Agile principles, I suggest that they also consider the Lean software development principles to help them in their Agile journey.


Information Security Controls Relating to Personnel
While the risk of threats are increasing, study says that the threat is more from the inside than from the outside. This has mandated the need for framing polices, procedures and controls around the employees of the organization, so that such risks arising from within can be mitigated or managed well. Whilst personnel security controls cannot provide guarantees, they are sensible precautions that provide for the identity of individuals to be properly established.


An immature security program is an exciting challenge
There are similarities between where my new company is right now with regards to security and where my old company was when I started there. But I don’t expect this new job to be a repeat of the last four years. For one thing, I am starting with all the knowledge and experience that I gained over the past four years. In the course of that time, I have learned a lot about things like cloud computing, mobile devices, advanced malware, data handling and security awareness. And I expect to keep on learning, since new things that I can’t even anticipate are sure to crop up.


Inside the Secret Clash of CIOs and CMOs
There's a fundamental problem in the way CMOs and CIOs look at technology projects. CIOs don't like loose ends. That is, they want to see projects that have a clear beginning and end -- a clear-cut return on investment. CMOs, however, can't afford to wait for this kind of clarity before embarking on projects. ... CMOs call this open-ended approach as being "agile," which is very different from what CIOs hear. For CIOs, "agile" means a software development methodology, according to The CIO-CMO Omnichannel study


When Good Federation Goes Bad
Given a choice of identity providers to leverage when logging in to a service provider, I generally choose the IdP that has the least data about me. In loose order of preference, this translates to Twitter, Microsoft, Google, and finally, Facebook. The first three generally require only my email address and a few other attributes, such as profile information I share publicly. Facebook, however is a whole other matter. I've written before on how Facebook throws a plethora of user identity attributes at a service provider when you use it as identity provider for a federated login.


Identity and Access Management Through the Enterprise Service Bus is a Pipe Dream
The first is the bi-directional nature of the ESB’s interface with the rest of your systems. This simply means the ESB can send and receive data and commands to any system it is connected to. Identity and Access Management processes don’t work the same way, however, as the type of data is “very different.” The changes involved, such as “a change in job or surname, or a promotion or departure of employees,” often can’t be read by the applications in their default modes, requiring significant development work on the part of the application supplier to make the system function. A result is that only very basic messages can be sent, such as the creation of a new identity.


The Problem with “Always On” Deduplication
The bigger problem is the way in which database systems store data. Relational databases use tables to improve performance and manage operations. A relational database such as Oracle has no duplicate data blocks, because each block in a tablespace (the logical container in which tables and indexes are stored) contains a unique key at the start and a checksum containing part of that key at the end. As a result, most shops are going to see little space saving, while paying the price of increased latency as the hardware pointlessly attempts to find matching blocks.



Quote for the day:

"A leader takes people where they would never go on their own." -- Hans Finzel

July 08, 2012


So what's the difference between a Custom Control and User Control?
Someone asked why should one use a Custom Control instead of a User Control? Hence, let's extend the series and discuss about that. I apologize for the delay of this post. I should have explained this at the start of the series, but actually my goal was to explain to you how to create and use a Custom Control in Silverlight. ...


Australia builds 100 petabyte storage cloud
These are the first of eight to ten nodes intended to underpin the national storage network, which by 2014 will offer Australian researchers access to around 100 petabytes of data collections.

Intel/McAfee: What's the Future of Security?
A lot of the advanced persistent threats [APTs] test the ability to detect them. When you sit above the operating system, the visibility is limited. But in Intel's chipset, you can detect malware and APTs in a different way. The first product we'll be coming out with is rootkit detection, at the end of the calendar year.

Nine Things Cloud ISVs Should Do Next
Different ISVs are in different business situations with respect to fully exploiting the cloud benefits. Based on observations so far, here are nine things ISVs can look at doing next.

Overhauling a UI Without Upsetting Current Users
The risks associated with not updating a UI outweigh those associated with an update. But a successful redesign absolutely requires the right product management and UX techniques to evolve the product carefully and avoid a user revolt.


The 5 traits of radically successful people
Success can come in different fields, but the principles behind it are one. From Sugar Ray Leonard chasing the school bus to Peter Guber’s corkboard, these stories show the unique personality traits that tipped the scales in favor of the world’s most successful people.


Twitter is a Corporate API
A lot has been written in the last week about Twitter's API and developer concerns that it would soon be closed to apps that are platform-specific clients. The discussion was started by a post by a Twitter manager, Michael Sippey, who was also one of the earliest bloggers.


Docomo, Omron Healthcare launch connected health venture in Japan
The venture also promises an unspecified “wide range of services to meet the needs of all lifestyles and the various stages of life by cooperating with various content providers, including companies in health-related fields,” according to a press release.



Quote for the day:
Delegation requires the willingness to pay for short term failures in order to gain long term competency. ~Dave Ramsey