Daily Tech Digest - February 27, 2020

Unpatched Security Flaws Open Connected Vacuum to Takeover

Researchers have discovered several high-severity vulnerabilities in a connected vacuum cleaner. The security holes could give remote attackers the capability to launch an array of attacks — from a denial of service (DoS) attack that renders the vacuum unusable, to viewing private home footage through the vacuum’s embedded camera. The Ironpie M6, which is available for $230 on Amazon, comes equipped with a corresponding mobile app and a security camera. The vacuum cleaner is built by artificial intelligence home robot company Trifo, and was first launched IronPie at CES 2019. Researchers on Wednesday said that they uncovered six flaws, stemming from the vacuum’s mobile app and its connectivity protocol, at RSA Conference 2020, this week in San Francisco. “The most severe vulnerability allows attackers to access any video stream from any Trifo device across the world,” Erez Yalon, director of security research with Checkmarx, told Threatpost. “Through this vulnerability, every single user – whether in a home or office setting as shown in our PoC video – is at risk of a hacker obtaining a live video feed. Needless to say, this represents a total loss of privacy.”

The Amazing Ways Goodyear Uses Artificial Intelligence And IoT For Digital Transformation

Regardless if it's an autonomous, electric, or a traditional vehicle, they all need a solid foundation of the right tire for the specific demands of the vehicle. Goodyear uses internet of things technology in its Eagle 360 Urban tire. The tire is 3D printed with super-elastic polymer and embedded with sensors. These sensors send road and tire data back to the artificial intelligence-enhanced control panel that can then change the tread design to respond to current road conditions on the fly and share info about conditions with the broader network. If the tire tread is damaged, the tire moves the material and begins self-repair. Goodyear’s intelligent tires are in use on a new pilot program with Redspher, a European transportation and logistics company operating in 19 countries. The fleet benefits from the tire's ability to monitor and track tire pressure, vehicle data, and road conditions. This data is then analyzed by Goodyear’s algorithms to gain insights about maintenance needs and ways to improve the safety and performance of the fleet.

Google Teaches AI To Play The Game Of Chip Design

One of the promising frontiers of research right now in chip design is using machine learning techniques to actually help with some of the tasks in the design process. We will be discussing this at our upcoming The Next AI Platform event in San Jose on March 10 with Elias Fallon, engineering director at Cadence Design Systems. The use of machine learning in chip design was also one of the topics that Jeff Dean, a senior fellow in the Research Group at Google who has helped invent many of the hyperscaler’s key technologies, talked about in his keynote address at this week’s 2020 International Solid State Circuits Conference in San Francisco. Google, as it turns out, has more than a passing interest in compute engines, being one of the large consumers of CPUs and GPUs in the world and also the designer of TPUs spanning from the edge to the datacenter for doing both machine learning inference and training. So this is not just an academic exercise for the search engine giant and public cloud contender – particularly if it intends to keep advancing its TPU roadmap and if it decides, like rival Amazon Web Services, to start designing its own custom Arm server chips or decides to do custom Arm chips for its phones and other consumer devices.

JFrog touts DevSecOps edge in CI/CD tools

Most CI/CD tools integrate with package managers for similar purposes. But JFrog could differentiate its Pipelines product based on its experience developing the Artifactory artifact repository manager, as well as its messaging. "Everyone is really doing the same thing -- transforming code into software packages and then shipping those packages to production," said Tom Petrocelli, an analyst at Amalgam Insights. "But there are security advantages as a side effect of the way [JFrog thinks]." This relates to the fact that enterprise DevOps shops in the Linux world increasingly use package managers to centralize corporate governance, explained Charles Betz, an analyst at Forrester Research. "There's a heck of a lot of digital management that revolves around artifacts when you don't own the source code, when that code is written by open source communities and vendors," Betz said.

Hidden cost of cloud puts brakes on migration projects

More than half (58%) of the IT decision-makers surveyed believe the cloud over-promised and under-delivered, while 43% admit that the cloud is more costly than they thought. Only 27% of IT decision-makers surveyed claim they have been able to reduce labour and logistical costs by moving to the cloud. Mark Cook, divisional executive officer at Capita, said: “Every migration journey is unique in both its destination and starting point. While some organisations are either ‘born’ digital or can gather the resources to transform in a relatively short space of time, the majority will have a much slower, more complex path. “Many larger organisations will have heritage technology and processes that can’t simply be lifted and converted, but will need some degree of ‘hybrid by design’,” he added. When asked what unforeseen factors had delayed cloud migration projects, 39% had cost as the main factor, followed by workload and application rearchitecting issues (38%) and security concerns (37%).

IoT Can Put Your Data at Risk, Here’s How

The data processed by IoT devices is potentially extremely sensitive. With office and home security systems increasingly mediated by IoT (doorbells and surveillance cameras being just a couple of examples), criminal attacks can pose a serious problem. The huge volume of data habitually collected by IoT devices was exposed this year when a database owned by the Chinese firm Orvibo, who offer a smart home appliance platform, was found to have no password protection despite containing logs relating to 2 million worldwide users, including individuals and hotel chains. The data included insufficiently-protected user passwords, reset codes, precise locations, and even a recorded conversation. Botnets are another way for cybercriminals to wreak havoc using IoT devices. Botnets consist of, as their name suggests, networks of bots running on Internet-connected devices. They are primarily known for their role in DDoS (Distributed Denial of Service) attacks, in which a stream of network requests is sent to a network that a malicious entity wishes to bring down.

DesignOps — scaling design to create a productive internal environment for IBMers

DesignOps is a collective term for creating a productive workforce, by addressing challenges such as: growing and evolving design teams, finding and hiring people with the right skills, creating efficient workflows and improving the quality and impact of design outputs. It’s a method of optimising people, processes and workflow, and at IBM, the practice has been deployed to increase efficiency, productivity and general well-being among the the whole organisation, including the thousands-strong IT team. Satisfying this level of individuals and teams is no easy feat, which is why IBM has a specific department dedicated to creating great experiences for IBMers. Kristin Wisnewski — who is on the advisory board for Information Age’s Women in IT Summit in New York on March 25th 2020 at the Grand Hyatt Hotel — leads the CIO Design team at IBM as vice president, whose purpose is to create a productive internal environment at IBM. “We’re here to create, design and improve the experience of employees in their daily jobs. Our team is made up of 140 people, and so it is a big mission to help the hundreds of thousands of employees here at IBM,” she said.

Cloud misconfigurations are a new risk for the enterprise

Cloud misconfigurations are becoming another risk for corporations. At RSA 2020, Steve Grobman, senior vice president and chief technology officer at McAfee, explained how easy it is to take advantage of cloud misconfigurations, an expensive security problem for corporations. He compared cyber security to infectious disease control: an imperfect science. ... In addition to making sure cloud configurations are secure, security teams have to address tomorrow's security risks today, Grobman said. Advances in quantum computing will be a double-edged sword with the downside being the threat to existing encryption systems. "Nation-states will use quantum computing to break our public key encryption systems," he said. "Our adversaries are getting the data today and counting on quantum to unlock in tomorrow." Grubman said that companies need to think about how long data will need to be protected. "Even in 2020, there are documents in the National Archives in relation to the Kennedy assignation that still have redacted information due to national security concerns of today," he said.

Data Science Is A Team Sport: Oracle’s New Cloud Platform Provides The Playing Field

Unlike other data science products that focus on helping individual data scientists, Oracle Cloud Infrastructure Data Science helps improve the effectiveness of data science teams with capabilities like shared projects, model catalogs, team security policies, and reproducibility and auditability features. “Data scientists are experimenters. They want to try stuff and see how it works,” says Pavlik. “They grab sample datasets, they pull in all kinds of open source tools, and they're doing great stuff. What we want to do is let them keep doing that, but improve their productivity by automating their entire workflow and adding strong team support for collaboration to help ensure that data science projects deliver real value to businesses.” The starting point for data science to deliver value is doing more with machine learning, and being more efficient with the data and algorithms involved.  “Effective machine learning models are the foundation of successful data science projects,” Pavlik says, but the volume and variety of data facing data science teams “can stall these initiatives before they ever get off the ground.”

Getting closer to no-battery devices

The technique being exploited takes advantage of backscattering. That's a way of parasitically using radio signals inherent in everyday environments. In this case, the chip piggybacks on existing Wi-Fi transmissions to send its data. This method of sending data is power-light, because the carrier needed for the radio transmission is already created—it doesn’t need new energy for the message to be sent. Interestingly, two principal scientists involved in this backscattering project, which was announced by UC San Diego's Jacobs School of Engineering, have also been heavily involved in the development of "wake-up" radios. Wake-up is when a Wi-Fi or other radio comes alive to communicate only when it has something to transmit or receive. The technology uses two radios. One radio is for the wake-up signaling; that radio's only purpose is to listen for a signature. The second is a more heavy-duty radio for the data send. Power is saved because the main radio isn't on all the time. Dinesh Bharadia, now a professor of electrical and computer engineering at UC San Diego, was at Stanford University working on a wake-up radio that I’ve written about.

---

Quote for the day:

"The greatest good you can do for another is not just share your riches, but reveal to them their own." -- Benjamin Disraeli

---

Daily Tech Digest - September 04, 2019

Vision 2020: Reimagining India over the next decade through AI

Government bodies and private players are already collaborating to pilot AI-led applications, even in domains which had hitherto been relatively untouched by cutting-edge innovations; these include areas such as agriculture, education and healthcare. The results generated thus far are extremely encouraging and indicative of the critical role that the technology can play in driving large-scale transformations across industries and sectors. Talking about specific use-cases, we have the Ministry of Home Affairs is working towards deploying India’s first Intelligent Traffic Management System (ITMS) in New Delhi. Aimed at addressing the city’s perennial traffic woes, the deployment will leverage AI-based smart traffic signals to monitor, automate and streamline the flow of traffic flow. Similarly, the Ministry of Defence has its own AI Task Force, which is advising the government about the possible offensive and defensive applications to optimize its military strategy and further enhance India’s position as an emerging superpower.

USB4 is ready: Twice as fast, smaller, and hitting devices in 2020

USB4 is the next major version of the USB, which gains a major speed boost thanks to Intel licensing its Thunderbolt 3 protocol to the USB Promoter Group on a royalty-free basis. This group includes Apple, HP, Intel, Microsoft, and Texas Instruments.  USB4 will enable 40Gbps speeds equivalent to Thunderbolt 3, which is currently found in high-end computers like the MacBook Pro and peripherals. That's twice as fast as the current USB 3.2. However, as noted by CNET's Stephen Shankland, many consumers are still using computers with earlier versions of USB that offer 5Gbps or 10Gbps. Thunderbolt 3's incorporation into USB4 should bring higher speeds to lower-end devices and peripherals. And those higher speeds will be useful for connecting multiple displays and getting data from external hard drives. The longer-term promise of the speedier USB4 is that device makers will stop using old rectangular USB-A ports and USB Micro B ports in favor of the newer USB-C connectors, which USB4 requires to work. The USB Implementers Forum told CNET that consumers could expect to see devices, including laptops, external hard drives, and dongles with USB4 support in the "second half of 2020".

Developer code reviews: 4 mistakes to avoid

Code reviews typically fall into one of two poor patterns. The first involves the reviewer not making any changes: "When there are no comments, that should terrify you," Presley said. "It leads to apathy—if you're rubber stamping, why do it at all?" The second is when a simple set of changes turns into a long, drawn-out process, when quick changes turn into inefficient meetings with too many people involved to actually solve problems, Presley said. "It's exhausting, and a waste of time for you and lots of other people," he added.  The simple goal of code reviews is to find bugs early on in the process, since bugs cost more the later they are discovered, Presley said. Several case studies back this up, he explained: For example, IBM found that each hour of code inspection prevents about 100 hours of related work, including support at QA. And after introducing code reviews, Raytheon reduced its cost of rework from 40% of the project cost to 20% of the cost, and the amount of money spent on fixing bugs dropped by 50%, Presley said.

Capabilities Of Attackers Outpacing Security Leaders' Ability To Defend Their Organization: Study

This issue is compounded with limited resources, including lack of sufficient budget and skilled professionals as well as a threat attack surface that is quickly expanding and becoming more sophisticated. Because of this, security leaders understand it is critical to have the right strategies in place as they face an arms race between the capabilities of attackers and their own defense postures.The global survey polled CISOs across various industries about the biggest challenges they’re facing and strategies they’re putting in place to address these obstacles. “The Forbes Insights survey echoes the primary challenges we hear directly from Fortinet customers and prospects. Today's CISOs are tasked with the challenge of allocating limited funds and resources to the highest-return cybersecurity projects which can range from breach detection to response. These C-level security leaders must maximize security with finite resources, all while balancing strategic leadership responsibilities and tactical issues. Through the Fortinet Security Fabric, Fortinet is providing end-to-end security so that CISOs can navigate a rapidly changing cyber threat landscape day in and day out,” said John Maddison, EVP of Products at Fortinet.

CISOs think cloud safer, but security fears remain

Those adopting a multi-cloud approach were far more likely to have suffered a data breach over the past 12 months, the study shows, with 52% reporting breaches compared with 24% of hybrid-cloud users and 24% of single-cloud users. Companies with a multi-cloud approach are also more likely to have suffered a larger number of breaches, with 69% reporting 11-30 breaches compared with 19% of those from single-cloud and 13% from hybrid-cloud businesses. “When it comes to ensuring resilience and being able to source ‘best-in-class’ services, using multiple vendors makes sense,” said Reed. “However, from a security perspective, the multi-cloud approach also increases exposure to risk as there are a greater number of parties handling an organisation’s sensitive data. This is exactly why an eye must be kept on integration and a concerted effort be made to gain the visibility needed to counter threats across all different types of environments.” 

Using predictive analytics to troubleshoot network issues: Fact or fiction?

When properly designed and deployed, predictive analytics can deliver deep insights into an array of commonplace and unique network issues, helping operators handle everything from policy setting and network control to security, says Rahim Rasool, an associate data scientist with Data Science Dojo, a data science training organization. To tackle security issues, for instance, predictive analytics can use anomaly detection algorithms to sniff out suspicious activities and identify possible data breaches. "These algorithms scan the behavior of networks working in the transfer of data and distinguish legitimate activity from others," Rasool explains. "With predictive analytics systems, the vulnerabilities in a network can be detected before a hacker group does and, subsequently, a defense mechanism can be drawn out." Another way predictive analytics can help organizations is by comparing trends to infrastructure capabilities and alert thresholds. "Almost all signals have an upper bound and a lower bound that are a result of the infrastructure's capabilities," says Gadi Oren, vice president of technology evangelism at LogicMonitor, which operates a cloud-based performance monitoring platform. 

IT budgets 2020: How the money will be spent, and who will spend it

Enterprise software will see the highest growth in 2019 and 2020 (9% and 10.9% respectively), while devices, communications services and data center systems will all recover somewhat in 2020 from declines in 2019, according to Gartner. The analyst firm sees the cloud spreading its tentacles further into the enterprise, encompassing areas like office suites, content services and collaboration services. "Spending in old technology segments, like data center, will only continue to be dropped," Lovelock said. ... IDC sees a 'natural cohesion' between traditional and new technologies: "Cloud and mobile enable rapid deployment and connectivity, while also cutting costs and complexity in legacy operations which allows businesses to focus on new digital innovation," says the analyst firm. Such synergies, along with the continuing need for professional services associated with the roll-out of digital transformation solutions, will mean that the impact of new technologies is "much bigger than revenues associated with discrete categories such as IoT sensors, 3D printers or drones," IDC says.

How to avoid CIO and CFO clashes over cloud spend

Much of the cloud budgeting issues can be traced back to a disconnect between IT and finance, according to the report, which ultimately hurts the business. The IT department is often unaware of the burden cloud budgeting has on finance, the report found: 51% of finance respondents said they occasional overspend on cloud resources, compared to 37% of IT respondents, who are less aware. Some 68% of finance respondents said they are alerted to overspend only after it's too late, whereas 80% of IT respondents said they are alerted before the overspend takes place, the report found. Collaboration between IT and finance in a formal reporting capacity remains rare, as only 28% of professionals surveyed said this happens in their organization, the report found. The CIO and CFO play key roles in any organization, but the two have historically faced challenges working together over budgets and technology investments. Budgets tend to be the largest point of friction, as those are not typically a strength of the CIO, Khalid Kark, US CIO program research leader at Deloitte, told TechRepublic. On top of that, many times CIOs are investing in assets that may not have direct ROI.

Settling the edge computing vs. cloud computing debate

The edge computing side that’s in the vehicle needs to respond immediately to changing data in and around the vehicle, such as an impeding crash or weather-related hazards. It does not make sense to send that data all the way to a central cloud server, where the decision is made to apply the brakes, and then back to the vehicle. By then you’ll have hit the semi. However, edge devices are typically much lower powered, with limited storage and compute capabilities. Deep learning processing and predictive analytics to determine the best approach to vehicle maintenance based on petabytes of historic data is best done on back-end cloud-hosted servers. See how that works? The edge computing market will continue to grow. A report on the topic, sponsored by software provider AlefEdge, pegs the size of the edge-computing market at more than $4 trillion by 2030. At the same time the cloud computing market will be 10 times that, and you’ll find the growth of both markets more or less proportional. Edge computing needs cloud computing, and the other way around. Indeed, public cloud computing providers will take advantage of the use of edge-based systems, providing small cloud service replicants, or smaller edge-based version of cloud services.

IoT security essentials: Physical, network, software

Where IoT is concerned, however, best security practices aren’t as fleshed out. Some types of IoT implementation could be relatively simple to secure – a bad actor could find it comparatively difficult to tinker with a piece of complex diagnostic equipment in a well-secured hospital, or a big piece of sophisticated robotic manufacturing equipment on an access-controlled factory floor. Compromises can happen, certainly, but a bad actor trying to get into a secure area is still a well-understood security threat. By contrast, smart city equipment scattered across a metropolis – traffic cameras, smart parking meters, noise sensors and the like – is readily accessible by the general public, to say nothing of anybody able to look convincing in a hard hat and hazard vest. The same issue applies to soil sensors in rural areas and any other technology deployed to a sufficiently remote location. The solutions to this problem vary. Cases and enclosures could deter some attackers, but they might not be practical in some instances. The same goes for video surveillance of the devices, which could become a target itself. The IoT Security Foundation recommends disabling all ports on a device that aren’t strictly necessary for it perform its function, implementing tamper-proofing on circuit boards, and even embedding those circuits entirely in resin.

---

Quote for the day:

Ineffective leaders don't react to problems, they respond to problems and learn. - Danny Cox

---

Daily Tech Digest - January 21, 2017

New details emerge about Intel's super-small Euclid computer for robots

Intel announced and demonstrated the Euclid computer in a robot moving on stage during CEO Brian Krzanich's keynote at the Intel Developer Forum in August. The Euclid Developer Kit launch page is up on the website of Mouser Electronics. Intel didn't provide a specific launch date or pricing. Once the Euclid is placed in a robot, it can be operated remotely through a mobile device or PC. The Euclid has Wi-Fi and Bluetooth connectivity to communicate with the PC. The Euclid can also "serve as a full, autonomous brain with sensing capabilities, or as a smart sensor controlled by a more powerful computer," Mouser states on its website. The computer has GPS capabilities for navigation. ... The Atom CPU provides the horsepower to process and analyze the images collected by the 3D camera. The CPU will drive a robot's movement and help it complete tasks.

How banking apps and digital cash solutions are all the rage in India

The National Payments Corporation of India, the nodal agency for all retail payment systems in the country, is working with Visa and MasterCard to develop a common QR code to facilitate cashless transactions in shops. “It is a huge market. There are hundreds of mobile banking apps and hundreds of e-wallets. All of them serve the same purpose using different means,” said Sony Joy, chief executive officer of Chillr. “If there is any direct competitor of ours, it is cash.” Not surprisingly, at this juncture, uninitiated consumers are lost. Credit and debit cards have been the most used cashless payment systems in India for over a decade. Internet banking solutions such as NEFT (national electronic funds transfer) and RTGS (real time gross settlement) for corporate customers are in place. There are offline payment methods, eliminating internet security and malware threats.

How Android One could complete Google's grand Android plan

From the get-go, the whole point of Android One was to make inexpensive Android phones that didn't suck -- phones that were affordable but still decent to use, without all the asterisks that often accompany budget-level devices. Part of that means Google maintains tight control over the software and also guarantees the devices will get reliable and timely ongoing updates -- both security patches and full-fledged OS releases. Thus far, Android One has been limited to a small number of so-called "emerging markets" -- places like Pakistan and India, where it can be "hard for people" to "get their hands on a high-quality smartphone," as Google explains it. Bringing the program to America, though, would give it a whole new meaning. In short, it'd help Google move closer to its goal of "fixing" Android -- a goal that started in earnest with the Pixel but remains only half-complete.

How -And Why-You Should Use A VPN Any Time You Hop On The Internet

The good news is VPNs aren’t expensive. You can usually pay as little as $5 a month (billed annually or in blocks of several months) for VPN coverage. We won’t get into specific VPN service recommendations in this article; instead, here are some issues to consider when shopping around for a VPN provider. First, what kind of logging does your VPN provider do? In other words, what information do they keep about your VPN sessions and how long is it kept? Are they recording the IP addresses you use, the websites you visit, the amount of bandwidth used, or any other key details? All VPNs have to do some kind of logging, but there are VPNs that collect as little data as possible and others that aren’t so minimalist. On top of that, some services discard their logs in a matter of hours or days while other companies hold onto them for months at a time.

China Unveils Memory Plans

Although China’s domestic IC sector is moving at a fast pace, the Chinese government has been grappling with the same problem for years. It is behind in semiconductor technology. This is a complex subject, but one of the causes is export controls. Multinational companies sell products into China, but they must follow various export control policies. Originally hatched during the Cold War period in the 1950s, export controls were established to limit technologies that could have potential military use. As part of those controls, multinational fab equipment makers for years were prevented from shipping advanced tools into China (and other nations) that were capable of processing chips at 0.25 microns and below. On top of that, China also lacked IC know-how, so it fell behind in semiconductor technology.

Google Sets Out to Disrupt Curating With “Machine Learning”

A few other Experiments involve organizing the Google trove of art images into 3-D landscapes. “t-SNE Map,” for instance, gives you a view of a landscape of rolling hills, composed of points. Zoom in on the terrain, and you discover that the points are actually images of artworks. The topography is formed by how the computer has decided to sort and cluster artworks in relation to one another, based on its understanding of aesthetic similarities. “The algorithms only ‘looked’ at the artworks,” the description explains. “No meta data was used, the visual similarity was calculated with a computer image algorithm used in Google Search purely based on the images.”

Why Cyber-Security Strategies Are Falling Short

While organizations around the world are more confident than ever that they can predict and detect cyber-attacks, they're still falling short on investments and plans geared toward recovering from a breach. Such is the double-edged finding of EY's 19th annual Global Information Security Survey, "Path to Cyber-Resilience: Sense, Resist, React." EY surveyed 1,735 IT and IT security executives from organizations around the world to uncover the most compelling cyber-security issues facing business today, and what it discovered was a marketplace still struggling to keep up with a fast-evolving threat landscape. "Organizations have come a long way in preparing for a cyber-breach, but as fast as they improve, cyber-attackers come up with new tricks. Organizations therefore need to sharpen their senses and upgrade their resistance to attacks," said Paul van Kessel, EY's global advisory cyber-security leader.

Automated Traders Take Over Bitcoin as Easy Money Beckons

The nation’s central bank conducted on-site inspections at some of the biggest bitcoin exchanges this month, looking for evidence of violations including market manipulation and money laundering. Similar scrutiny of stock-index futures in 2015 led to trading restrictions that cut volumes by 99 percent. ... Rather than moving money out of the country, most automated traders in China are focused on cross-exchange arbitrage, said Arthur Hayes, a former market maker at Citigroup Inc. who now runs BitMEX, a bitcoin derivatives venue in Hong Kong. They can transact multiple times per second, reacting to price changes caused by individual investors and other speculators who often use technical patterns to guide their buying and selling decisions, Hayes said.

Half of work activities could be automated by 2055

Advances in natural language processing and machine learning produce a Cambrian crush of light AI technologies emerged in 2016. Chatbots have extended from messaging platforms to corporate IT departments while ecosystems are springing up around virtual assistants such as Amazon.com's Alexa. Roboadvisers, in which software assists with delivering financial advice, are increasingly becoming a standard offering in financial services. As a result, Chui says that it is tough to estimate AI’s potential as machines learn to process natural language more effectively. "It will unlock a lot of potential," Chui says. But most corporate IT departments are just beginning to figure out how to incorporate AI to better serve customers, according to Forrester Research. Despite strong interest in investing in AI technologies, many enterprises don’t understand how to apply AI to meet specific business objectives.

Do you have a cyber A-team?

Retained executive search firms are busy matching executive cyber A-players to support their forward-thinking clients. The largest companies and biggest brands can offer the seven-figure comp packages to the very best talent.... Smaller private companies find it difficult to compete for top talent in this elite pool. What these companies can’t offer in cash comp, they can make up in pre-IPO equity. ... Rapid technological advances are changing the game and your company’s crown jewels are too often accessible to the bad guys. Cybersecurity has fast become a top priority management challenge and finding best-in-class leaders to be part of your A-team to assess, manage and mitigate threats must be a key element of your company strategy. Previously siloed risk-management functions today must be reinvented, strengthened, and funded more aggressively.

---

Quote for the day:

"Life passes most people by while they're making grand plans for it." -- George Jung, Blow

---

Daily Tech Digest - January 06, 2017

2017: The year of cybersecurity scale

Forget about centralizing all cybersecurity data because it is no longer feasible to do so. Enterprise cybersecurity professionals must learn all they can about distributed data management architecture and include cloud-based elements to all their planning. Enterprise customers have already placed SIEM vendors such as AlienVault, IBM, LogRhythm and Splunk on a data management treadmill to keep up with scale, but these vendors will be forced to innovate rapidly, tier their storage backends and provide cloud-based services for non-critical and archival data. Cybersecurity professionals will need to understand an array of data management technologies – relational databases, NoSQL, Hadoop/HDFS, etc. – and figure out what goes where and how to keep track of it all. Finally, companies like Amazon, Facebook, Google and Microsoft familiar with cloud-scale data challenges may play a role in new types of cybersecurity data management architectures.

Seven bold predictions about Android for 2017

The first reason is Google (more on that in a bit). Another reason for this landmark will be a lack of innovation from Apple; the big "A" will continue to play it safe (as they did in 2016), and more users will migrate to Android because of this. Couple this with the increased performance and battery life found in Android 7, and the Linux-driven mobile platform will easily climb the next rung in the global dominance market's ladder. ... Another reason Android will dominate 2017 is the device designed by Google: the Pixel. Not only is this device the most powerful smartphone on the market, it also brings to light features that people will want. One feature in particular is Assistant. Google is the first company to bring an AI-centric digital assistant to life and do it right. With the power of the Pixel driving that feature, this device will continue to be one of the hottest on the market.

Why People and Processes Are Critical to Cybersecurity

“There is so much to consider in cybersecurity, and traditionally, IT in higher education is understaffed,” says Jill Albin-Hill, vice president for information technology and CIO at Dominican University. “It’s tough to find the time and to get the right resources on campus to be able to address it all.” To address that gap, Dominican teamed up with four other small institutions in the western Chicago suburbs — Elmhurst College, North Central College, Wheaton College and Judson University — to create a cybersecurity consortium. The group banded together to contract with an external IT service firm that helps all of the institutions manage cyber risks. ... “Already, it’s helped me gain some visibility across the institution about how this is an important university consideration, and not just an IT issue,” Albin-Hill says.

Top Cybersecurity Lesson from 2016: Unchecked Insiders

It might surprise you, but most organizations struggle to implement and maintain access controls—a basic security building block for file and e-mail systems. Employees and contractors typically have access to far more sensitive data than they need to do their jobs. This makes it much easier for intruders and insiders to do a lot of damage. In the study, 88 percent of end users said their jobs require them to access and use proprietary information such as customer data, contact lists, employee records, financial reports, confidential business documents, or other private or confidential information assets. Sixty-two percent believe they have access to company data they probably shouldn’t see. This, combined with a lack of monitoring and auditing for the files and documents employees do access, sets organizations up for disaster.

Will the cloud be a safe haven for data in 2017?

Delivering enterprise security via the cloud will ultimately start to lower the cost and complexity of the security infrastructure, as those legacy appliance systems are replaced in favor of agile, distributed models, he said.  “There’s a growing call for security to be treated as a fundamentally basic utility where safety can be assumed. The cloud is the key to enabling this, with benefits like storage options, scalability and ease of deployment,” Chasin said. Bluelock CTO Pat O'Day predicts that when faced with a hardware refresh, more companies will turn to the cloud than to new hardware. “There’s a lot of churn in the hardware space because of virtualization. Companies are growing tired of having to refresh their IT systems with new hardware every five years. People want to be more mobile, and the cloud is a way to get there.

Intel's Compute Card mini-computer is so small that you may lose it

At first glance, it's easy to mistake the modular computer for a credit card or smart card. It's so thin, it could be easy to lose. But it's a full blown computer, crammed with a 7th Generation Intel Kaby Lake processor, memory, storage and wireless connectivity. It's so small, it can't accommodate USB-C or other ports to power up or connect to displays. The Compute Card will work only after being plugged into a slot of a larger device, much like smart cards. Here's the bad news: It's not targeted toward PCs. However, we hope Intel will eventually make them for PCs, and there are hints the chipmaker could. The idea of a super-small computer is exciting, and it could solve some problems. For example, computer upgrades could become easier.

The future for APIs - how management and security will have to come of age

The gaps that exist between internal IT teams can lead to issues not being fixed. Research by Ovum pointed to problems here, with 53 percent of respondents stating that the security team should lead on this topic while 47 percent believing that the software development team handling APIs would be responsible. Alongside nailing down the responsibility for these potential problems, this includes managing the response that IT teams should take when there are attacks on their APIs. For internal APIs, the response includes looking at what the attacks are targeting and how to stop the problem. Simply turning an API “off” is one approach; the issue with this is that it stops legitimate traffic from accessing the API as well. Categorising attacker traffic and blocking this from interacting with the API is a more fine-grained approach, but relies on a more intelligent approach to rating requests.

Are we all at risk? Implications of the Oracle-Dyn Merger News

We no longer live in an age when we can outsource our issues, especially when it comes to security. Inspect what you expect. Think about all the moving parts of your ecosystems and inspect those parts. Build layers of redundancy, consider and think about front layers. Do not narrow your thinking to just DDoS attacks, but also DDoS mitigation. Reddit had a good strategy in place when it partnered with Dyn. Without Dyn, it may have been down for days, but Dyn was able to get them back up within hours. Ten years ago, as the CTO of a cloud service provider, prospects used to run us through the security gambit to ensure we had the proper security measures in place to protect their infrastructure they put in our cloud… at the same time AWS, MS and Google were being hit by security incidents and downtime one after the other.

Yahoo breach: a breakdown of the biggest data breach ever

Amichai Shulman, CTO Imperva, explained that, “This Yahoo breach and others before it teach us a couple of things: Attackers are still ahead of enterprises, even the larger companies when it comes to covering their tracks. The alleged breaches were only detected once the leaked information surfaced on the web; and time is still a factor. While the passwords were not leaked in clear text, the time between leakage and detection allowed the attackers, using modern computing power, to crack most of the passwords. If the enterprises had promptly detected the breaches a lot of the potential damage could have been avoided.” “We all can learn from Yahoo!’s misfortune, teaching us how to pre-empt and react to [potential] breaches, because the tools are out there on the market to help. With Yahoo being such a behemoth organisation, the question here is – did they invest in security and, if so, how did it go so wrong?” questioned Alez Cruz-Farmer, VP at NSFOCUS.

Interview with Wesley Coelho on Challenges in DevOps

Once you get there, or not necessarily in sequence, the other interesting thing that people are doing with Agile is you don’t want it just within your organization. You want it across organizations. So if you’re implementing Agile but you are outsourcing a component of your software, for example, to a different organization, you want to eliminate the waterfall communication that’s happening across those organizations. Example of what we’re seeing is a luxury auto manufacturer, who’s developing cars that they sell that run 100 million lines of code. They don’t write any of that code internally. It’s all outsourced to dozens of suppliers. So when they take that car out on the track and they find a defect in the car, they file that defect in their own central repository and they take a technology, an automation technology such as Tasktop, and that gets transformed and automatically transmitted to the right supplier who produced the component where the defect was.

---

Quote for the day:

"The cure for boredom is curiosity. There is no cure for curiosity." -- Dorothy Parker

---

Daily Tech Digest - December 21, 2016

Why every CIO needs to be a hands-on leader to succeed

If you looked at the job descriptions and expectations for CIOs of the past, almost all of them required the incumbent to be a master builder. A person had to know how build and manage data centers, buy hardware – large and small, and be a virtuoso of disaster and business continuity plans. Today, the cost savings, let alone the flexibility, of utilizing cloud resources for almost everything is just too hard to ignore. While vexing to consider for veteran CIOs, the epic of building physical empires within IT has passed. But this change represents a tremendous opportunity for even the most strategic IT leader to get into the trenches in a meaningful way. By going through data centers, CIOs can be on the frontlines of shutting them down.

10 Cybersecurity challenges from IoT, DDoS, autos and more

We recently saw some of the largest DDoS attacks on record, in some instances topping 1 terabit per second. That’s absolutely massive and it shows no sign of slowing. Through 2015, the largest attacks on record were in the 65 gigabit per second range. Going into 2017, we can expect to see DDoS attacks grow in size, further fueling the need for solutions tailored to protect against and mitigate these colossal attacks. Math, machine learning and artificial intelligence will be baked more into security solutions. Security solutions will learn from the past, and essentially predict attack vectors and behavior based on that historical data. This means security solutions will be able to more accurately and intelligently identify and predict attacks by using event data and marrying it to real-world attacks.

NICE Robotic Automation Improves Interaction Experience

NICE, a longtime contact center systems vendor, has offered real-time process automation since 2001, and it recently launched a new product in this market. It now has three products in this space – desktop analytics, desktop automation and its latest, robotic process automation. NICE Desktop Analytics captures information about what agents, or other designated users, do on their desktop, including systems they access, information they look up, data they enter, information they give callers, and systems they update after finishing calls. The analytics enables organizations to track the four basic components of a call – identifying the caller, identifying the caller’s issue, providing a response and completing any required after call work. The analytics component thus can identify best practices for interaction handling and agent performance, and recommend changes to processes or coaching and training.

Tech companies like Privacy Shield but worry about legal challenges

While U.S. companies are embracing Privacy Shield, many European businesses are "still concerned that Privacy Shield will not hold up under court scrutiny, and they will find themselves in the same scenario as they were in October 2015, when the Safe Harbor agreement was struck down," said Deema Frei, ... Some European companies see Privacy Shield certification as a "tick box" compliance exercise, she added. With some doubts about its long-term viability, companies should also consider other data transfer agreements, such as EU model clauses or binding corporate rules, she recommended. However, if companies can get certainty about Privacy Shield's future, and if it won't be "attacked in the long term by data privacy activists trying to discredit it and challenge its validity, I believe it will work in the long run," Frei added.

Never Fear, Vulnerability Disclosure is Here

There is no excuse for organizations letting fear of working with hackers prevent them from doing so for defense. There is no excuse for lacking a vulnerability disclosure policy, in any organization, private or public sector. The only barrier is building capabilities to handle what can be daunting in terms of facing the world of hackers. Big companies like Google, Apple, and Microsoft have had to deal with this issue for a very long time, and have worked out systems that work for them. But what about smaller organizations? What about other industries outside of the tech sector? What about IoT? And what about governments, who must walk the line between getting the help they need from the hacker community without accidentally giving free license to nation-states to hack them with an overly permissive policy?

Contactless Payments: Addressing the Security Issues

In a contactless environment, on mobile devices in particular, biometrics authentication can replace the need to use PIN entry as an additional authentication layer, King says in this interview conducted at Information Security Media Group's recent Fraud & Breach Prevention Summit in London. "The challenge there is, 'How do you ensure the security and the authenticity of the biometrics?'" he says. "Biometrics have been around for a while, in terms of authentication. ... They are static information. My fingerprints don't change. Now, if I lose my PIN, I can go into the bank and say, 'Can I have a new PIN?' If I lose my fingerprint, if that is compromised, then there's not much I can do." As contactless mobile payments become more commonplace in Europe and elsewhere, card networks and issuers are rethinking how they secure payments, turning to biometrics and, in some cases, transaction and behavioral analytics, he adds.

Google releases Project Wycheproof: Security tests to check cryptographic libraries for known attacks

Project Wycheproof includes over 80 test cases, and Google says they have already uncovered more than 40 security bugs. The list of bugs is available here, though Google notes not all are currently listed as some are still being fixed by vendors. The same goes for some of the tests — they will be released once the affected cryptographic libraries have been patched. The tests encompass the most popular crypto algorithms, including AES-EAX, AES-GCM, DH DHIES, DSA, ECDH, ECDSA, ECIES, and RSA. The tests detect whether a library is vulnerable to many attacks, including invalid curve attacks, biased nonces in digital signature schemes, and all of Bleichenbacher’s attacks. In short, Project Wycheproof allows developers and users to check libraries against a large number of known attacks without having to “sift through hundreds of academic papers or become cryptographers themselves.”

Mobile banking trojans adopt ransomware features

Cybercriminals are adding file-encrypting features to traditional mobile banking trojans, creating hybrid threats that can steal sensitive information and lock user files at the same time. One such trojan is called Faketoken and its primary functionality is to generate fake login screens for more than 2,000 financial applications in order to steal login credentials. The malicious app also displays phishing pages to steal credit card information, and it can read and send text messages. ... File encryption is not as popular as screen blocking techniques in mobile ransomware because many of the files stored on mobile devices are backed up to cloud services and can be easily restored, according to Unuchek. That doesn't seem to stop developers from experimenting with such techniques, though. Researchers from security company Comodo have recently analyzed another mobile banking trojan called Tordow 2.0 that has the ability to encrypt files.

Raspberry Pi in 2017: New boards, new OSes and more

Expect to see the Raspberry Pi powering far more appliances in 2017, following the release of the Compute Module 3 (CM3). Due to be launched "very early next year", the CM3 will pack the same quad-core Broadcom BCM2837 processor and 1GB memory used on the Pi 3 onto a slimmer and smaller board. The compact design of the Compute Module, which comes with 4GB eMMC Flash storage, makes it better suited to being built into electronic products. The CM3 marks a significant leap forward in processing power, since the previous Compute Module was based on the first-generation, single-core Raspberry Pi, which is up to ten times slower than the third-generation board. When released, it will also be the first Compute Module to run Windows 10 IoT Core, a cut-down version of Windows 10 designed to support Internet of Things appliances.

Automating the Database: A Win-Win for DBAs and DevOps

In most cases, the DBA invests a lot of time and effort in manually reviewing code from the developers and preparing the deployment script. At times, this goes beyond fine-tuning and actually involves rewriting entire code segments, simply because the DBA has a better understanding and overview of the database. Similarly, when database problems arise during deployment or production, DBAs may be called upon to resolve them by fixing unfamiliar code without access to the original developers. No matter the number of development teams and their potentially overlapping needs, the DBA is tasked with protecting the integrity of the data and ensuring availability. In order to perform this behind-the-scenes “traffic duty”, the DBA must balance the requirements of the various development teams with daily database maintenance routines and administrative responsibilities.

---

Quote for the day:

"Don't judge me by my past. I don't live there anymore." -- Petteri Tarkkonen

---

Daily Tech Digest - December 14, 2016

Public vs. Private vs. Hybrid Cloud - Exploring the use Cases

Despite some of the challenges and associated costs of the private cloud model, many bigger firms are compelled to choose private due to the security risks of public. The potential damage to a company’s brand and the loss of customer trust after a public cloud breach can exponentially surpass the costs of the private cloud. ... Implementing a private cloud securely can prove difficult unless you utilize the help of a third-party service. This is where a qualified IT consultancy such as TechBlocks can provide critical guidance on the best practices for implementation, and perhaps discuss the case for a hybrid public-private approach. ... The hybrid cloud is increasingly the path for organizations that desire a customizable approach with reduced maintenance costs and time. Pursuing a hybrid approach is often the path IT will take to convince upper management that the cloud is safe and a good option for critical data.

The mainframe is hindering application delivery

“Organisations face both business and technical challenges on the mainframe, preventing them from innovating and transforming into a digital business. To avoid issues with the mainframe, organisations are working around it, re-platforming, or modernising. However, each of these tactics creates new issues. The good news is that those companies embracing DevOps deliver faster and at a higher quality, all while fostering collaboration,” said Compuware CEO Chris O’Malley Compuware, which commissioned the study, has been aggressively leading the transformation of the mainframe into a fully Agile and DevOps-enabled platform where development, testing and operations processes can occur at the same rapid pace as they do on distributed and cloud platforms.

10 Clear Principles for the 96% that Need Culture Change

“Although it’s important to engage employees at every level early on, all successful change management initiatives start at the top, with a committed and well-aligned group of executives strongly supported by the CEO.” It is imperative for the top team to be on the same page regarding both why the change is necessary and “the particulars for implementing it.” The top leader or any member of the top team will dramatically undermine change efforts if they are directly or indirectly sending messages that are in conflict with the change effort. They must act in a different way that’s consistent with the change effort and visible to all. ... “Mid-level and frontline people can make or break a change initiative. The path of rolling out change is immeasurably smoother if these people are tapped early for input on issues that will affect their jobs.”

Advocate Congress establish a permanent joint committee on information technology

This joint committee was formed in response to both a dramatic threat and an incredible opportunity. The threat was the potential of nuclear war. The opportunity was the potential to use nuclear science to generate electricity to power cities as well as naval vessels, as well as opportunities to use nuclear science in medicine and industry. It was clear to congress at the time that success in response to the threat and success in gaining national benefit from nuclear energy would require a different way of doing things. So, the response was the United States Atomic Energy Act of 1946. For over 30 years the Joint Committee this act set up provided bi-partisan solutions broadly supported and widely credited with bringing unity of effort to many multiple complex activities.

DevOps capabilities vary widely by industry vertical

DevOps maturity varies according to the business sphere that companies occupy, and some are constrained by the characteristics of their markets -- from heavy regulation in the financial services and life sciences industries to stifling technical debt in the retail and media and entertainment sectors. Other markets, such as healthcare and transportation, face unique cultural challenges to bringing a DevOps mindset to the software development process. ... The philosophy of increased IT automation and collaboration between development and operations -- which, in some industries, are no longer separate groups at all -- is here to stay. "Consumers, empowered by rich software interactions with access to internet resources, have never had more power or choices," wrote Forrester Research analysts in their report "The State of DevOps Industry Adoption for 2016 -- Where's the Heat?"

Nine Questions to Ask to Determine IoT Device Safety

While IoT brings forth many benefits to consumers—from convenience to energy efficiency, to monitoring babies and locating lost pets—it also brings risk. ... These IoT devices were used them to take out the Dyn DNS Server this September. As a consumer, you might think… “why should I care if my device is involved in a DDoS attack? As long as it works, I don’t mind.” Well, some 20,000 residents in Finland found out the hard way why it matters, when their building’s IoT connected thermostats stopped functioning because the devices were enslaved to a botnet conducting a DDoS attack (By the way, it’s cold in Finland in November). Whether you are a consumer considering a connected device as a gift for the holidays, or a reporter about to review the next wave of IoT devices launching at CES, we have put together a list of questions you should ask before diving in:

Why soft skills outweigh hard skills for IT-business collaboration

The skills needed in IT change so frequently that businesses are more interested in finding qualified candidates with strong soft skills -- workers who can grow and adapt in a quickly changing landscape, says Palm. Qualified workers can always take a course or complete training in areas where they need more knowledge, but it's not as easy to teach someone how to be collaborative or to communicate effectively. Palm says she's seen an increase in applicants that fit this "t-shaped personality," which means "an individual has a broad set of skills, but only a few areas where the skillset goes deep." T-shaped workers are the type of employees who are "agile and able to rapidly adapt to new changes," she says. They constantly adjust to new and uncharted territory, learn new skills as needed and stay up to date on emerging trends.

Don't Like Russian Cyberspies? Tips To Stop State-Sponsored Hackers

“Customers are looking for a magical button to stop all these threats,” he said. Businesses will then buy the tools and assume they’re safe, when in reality they aren’t properly being used. For example, many businesses often fail to install security patches with their IT products -- including the antivirus software -- exposing them to hacks that otherwise could have been prevented. They may also ignore the warnings that pop up from security software, believing them to be a false positive. Or they’ll even forget to turn the software on.  However, in other cases, the businesses had limited expertise on staff to deal with the cyberthreats the security tools encountered. “If you buy the tools without hiring the right people, you are not going to solve your nation-state hacking problem,” Firstbrook said.

Blockchain – The Next Big Thing for Middleware

Fascinating new technologies are emerging these days. Everybody talks about cloud, containers, big data and machine learning. Another disrupting technology is blockchain. You might have heard about blockchain as the underlying infrastructure of Bitcoin. But Bitcoin is just the tip of the iceberg. This article explains the use cases and technical concepts behind blockchain, gives an overview about available services, and points out why middleware is a key success factor in this space. ... Welcome to the world of blockchain where smart contracts process such a scenario automatically and in a secure way. Governments in conjunction with global non-profit airline associations like International Air Transport Association (IATA), which “support aviation with global standards for airline safety, security, efficiency and sustainability,” could enforce airlines to compensate customers automatically as it is defined by law.

Google Tries To Advance IoT Security With Android Things

Android Things comes after the world got some more glimpses into how insecure many products can be. IoT devices were used to take down popular websites on the East Coast (and elsewhere) in October. Then in November, critical vulnerabilities were discovered in popular IoT cameras--a problem that repeated itself when backdoors were found in Sony's internet-connected cameras in early December. The IoT market had a bad couple of months. These issues have led to calls to improve the security of IoT devices. The problem is that many companies drag their feet in responding to problems, lack the infrastructure to push updates to devices that have already been sold, or simply don't care about the security of their products. Making sure these devices are safe for their owners and for the internet at large just isn't a priority for the manufacturers churning them out.

---

Quote for the day:

"Most people who sneer at technology would starve to death if the engineering infrastructure were removed." -- Robert A. Heinlein

---

Daily Tech Digest - December 07, 2016

Macbook Pro vs Surface Book i7

The Surface Book is essentially a business user's dream. You get just enough ports to keep you connected to a desktop station without needing any dongles, adapters or converters. ... It's lightweight enough to tote around, at 1.21 pounds, but it's meant to just sit on your desk, keeping cords tucked away and waiting for you to connect. The Macbook Pro isn't as limited in ports as the Macbook, which made a statement at its release by only including one USB-Type C port on the entire device, but the Pro still doesn't offer the same flexibility as the Surface Book for business users. On the 2016 Macbook Pro, you'll find four Thunderbolt 3 ports that also act as a USB-Type C port -- they use different connection standards but the port is the same shape and size.

Data Virtualization and Sandboxes: Filling the DevOps Data Gap

The Data Gap is the fact that provisioning production-like data effectively for developers and testers is one of the most challenging aspects of standing up the environments that are so critical to enabling DevOps. Let's back up a bit to understand the context of this. DevOps is all about building, testing, and releasing software at speeds that are orders of magnitude faster than traditional methods. Enterprises used to release software (or products) on yearly or quarterly basis. Today's application based economy is forcing them to move to monthly, weekly, or daily releases. DevOps aims to transform companies' cultures, processes, and tools to enable high velocity, continuous deployments of software. In speaking about this goal, DevOps guru and Phoenix Project author Gene Kim says,

Skills to look for in a threat hunter

Security analysts need a solid understanding of networking devices and computer operating systems. Hunt analysts constantly review raw system & network logs as well as packet captures. Analysts should have a deep understanding of the technology and software producing the logs to provide context to abnormalities. ... Endpoint analysis provides greater context in security threats and activity. This type of analysis can include memory dumps, I/O activity, user activity, etc. This stage of the hunt can provide more conclusive evidence on what is happening at the host and user level. Hunt analysts should be able to navigate OS logs and explore local endpoints with relative ease.

Companies Are in Short Supply of Cybersecurity Talent

“The deficit of cyber security talent is a challenge for every industry sector. The lack of trained personnel exacerbates the already difficult task of managing cyber security risks,” according to the CSIS report. The current shortage of cyber security skills is concerning for companies in all industries. One in four of the IT professionals surveyed said their organizations had been victims of cyber theft because of their lack of qualified workers. It is estimated that by 2019, between one to two million cyber security positions will be left unfilled. In the United States alone, 209,000 cyber security positions in 2015 sat vacant because of the shortage of cyber security skills. Hackers are taking notice of this gap. Worryingly, 33% of respondents to the Intel Security-CSIS survey said their organization was a target for hackers who knew their cyber security was not strong enough.

FCC Looks To Increase Security Regulations On Internet Of Things

FCC Chairman Tom Wheeler acknowledged the governing body’s interest in beefing up the security protocols for connected devices in a letter to Virginia Senator Mark Warner. “We cannot rely solely on the market incentives of ISP to fully address the risk of malevolent cyber activities," Wheeler wrote, arguing that a combination of market-based incentives and regulatory oversight are necessary to establish basic cybersecurity protections for internet-connected consumer devices. The message from Wheeler, published on Monday, was prompted by a letter from Senator Warner dated Oct. 25 of this year. Warner’s initial correspondence was prompted by the Mirai botnet attack that managed to take down a number of major websites. The attackers primarily utilized unsecured IoT devices to perform massive distributed denial of service (DDoS) attack.

Automated phishing campaigns increase profits for hackers

This is alarming given that phishing is the starting point for most network and data breaches. With this in mind, Imperva researchers deconstructed a phishing campaign initiated in mid-June, 2016. Among the most surprising findings was the low cost of launching a phishing campaign and the high projected return on investment for cyber-criminals. Imperva researchers browsed the darknet marketplace to estimate the cost of phishing campaigns and to get a clear picture of the business model. They observed the ease of purchase and low cost of Phishing-as-a-Service (PhaaS) campaigns. In addition, they saw that hackers were easily able to hijack compromised web servers for their campaign, which further lowered the investment needed.

Navigating the Five Stages of Threat Hunting

Hunting for the unknown requires patience, persistence and more effort. This is because unknown threats often tend to be more sophisticated, well-hidden and harder to detect. However, these adversaries leave indicators of their movement around your network. They will try to mimic the normal activity of authorized users to stay under the radar. If you are vigilant, eventually they will reveal themselves as an outlier – primarily by taking actions that reveal their precise targeting and IT savvy ... There’s a wealth of information in your logs! You’d be surprised what can be revealed simply by correlating information. By baselining a particular activity within your environment, and noting how often it occurs, you will start to see things pop up that are worthy of closer scrutiny. Patterns of suspicious behavior will emerge over the course of 30 days or even a couple of weeks.

Building a Secure, Fast Microservices Architecture From NGINX

With the transition from having all of the functional components of your application running in memory and being managed by the VM, to working over a network and talking to each other, you’ve essentially introduced a series of problems that you need to address in order for the application to work efficiently. One, you need to do service discovery. Two, you need to do load balancing between all the different instances in your architecture. And three, you need to worry about performance and security. For better or worse, these issues go hand in hand and you have to balance them together. Hopefully, we’ll have a solution that addresses all of them.

Microsoft Office, Google Docs beware: This open-source startup is after your users

Bannov contrasts those points with OnlyOffice having cloud and server versions and desktop and mobile apps on the same code base. "Our editors also show the highest compatibility with Microsoft Office formats," he says. As of now, OnlyOffice has more than two million users worldwide, with most of them using the free products. However, it is being used by one Oracle department in UK, and also by Unisys. The office suite also has a foot in the door of many educational institutions. Clients include the University of Brunswick, Karlsruhe Institute of Technology, University of Paris-Sud, and the Luxembourg Institute of Science and Technology. Public organizations use OnlyOffice as well. For example, the French Red Cross and Germany's Social Democratic Party.

How to merge IT and product development into one department

Why bring product and technology together? "Take our device protection product: when your device is stolen or lost, we can replace it typically in less than 24 hours," Vandevier says. "That product involves consumer websites, agent tools, mobile apps, supply chain, and repair operations — a whole host of systems, applications and products. The product has to roll up to one team that supports device protection end-to-end rather than to a bunch of people in different departments.” If Vandevier and his colleagues hadn't pulled those teams together, the device protection product would have suffered from a lack of clarity and unhappy customers. "When you have product and technology in separate groups, you wind up leaving out critical requirements and scrambling to squeeze in features late in the delivery cycle," he says.

---

Quote for the day:

"You always believe in other people. But that's easy. Sooner or later you have to believe in yourself." -- Gary, The Muppets

---