Showing posts with label password strength. Show all posts
Showing posts with label password strength. Show all posts

Daily Tech Digest - February 23, 2020

Robots are not the job killers we all feared


Not only can digital workers contribute to a more effective workforce overall, they can also make for happier employees. More often than not, automation relieves employees of the tedious parts of their jobs that take considerable time and effort to accomplish. In return, they have more opportunities to pursue projects they truly enjoy and are passionate about. One example of this is at S&P, where financial journalists produce reports on the businesses they are assigned to cover. Their work to develop insightful analyses was hindered by the need to first write lengthy stock reports, until they leveraged Blue Prism’s connected-RPA to automate stock report production. This has given the journalists more time to produce thoughtful analysis, which is not only a more rewarding part of their roles but is also a more valuable offer to S&P’s clients. In some cases, digital workers are even introduced as part of a broader effort to improve employee happiness and engagement. According to our research, 87% of knowledge workers are comfortable with re-skilling in order to work alongside a digital workforce.



FBI recommends passphrases over password complexity

login screen
For more than a decade now, security experts have had discussions about what's the best way of choosing passwords for online accounts. There's one camp that argues for password complexity by adding numbers, uppercase letters, and special characters, and then there's the other camp, arguing for password length by making passwords longer. This week, in its weekly tech advice column known as Tech Tuesday, the FBI Portland office positioned itself on the side of longer passwords. "Instead of using a short, complex password that is hard to remember, consider using a longer passphrase," the FBI said. "This involves combining multiple words into a long string of at least 15 characters," it added. "The extra length of a passphrase makes it harder to crack while also making it easier for you to remember." The idea behind the FBI's advice is that a longer password, even if relying on simpler words and no special characters, will take longer to crack and require more computational resources. Even if hackers steal your encrypted password from a hacked company, they won't have the computing power and time needed to crack the password.



How the IRS Audits Cryptocurrency Tax Returns

How the IRS Audits Cryptocurrency Tax Returns - Filing Expert Shares Example, Insights on AML Focus
The presence of a new crypto question on 2019’s Schedule 1 form has individuals concerned about reporting their crypto assets correctly more than ever, and according to experts, this is for good reason. “That is massive” says Enrolled Agent Clinton Donnelly of Donnelly Tax Law. “This question in the 2019 return … it forces every taxpayer in the United States to make a decision whether or not they’re going to be honest or not on this question, because its a yes or no and when you sign the tax return … it’s in small print, it says ‘under penalty of perjury I have reviewed this return and it’s true, complete and correct,’ so failing to check the box is incomplete.” Donnelly went on to explain that by reporting crypto gains in light of the new question, many crypto holders will inadvertently reveal that they first acquired their digital assets years back, which calls their previous years’ returns into suspicion and makes an IRS investigation more likely. Donnelly’s service has so far seen two cryptocurrency audits with its clients, and the tax professional is interested in learning more about what triggers an IRS investigation.


Why AI companies don’t always scale like traditional software startups

Businessman trying to fit through a very small door.
For AI companies, knowing when you’ve found product-market fit is just a little bit harder than with traditional software. It’s deceptively easy to think you’ve gotten there – especially after closing 5-10 great customers – only to see the backlog for your ML team start to balloon and customer deployment schedules start to stretch out ominously, drawing resources away from new sales. The culprit, in many situations, is edge cases. Many AI apps have open-ended interfaces and operate on noisy, unstructured data (like images or natural language). Users often lack intuition around the product or, worse, assume it has human/superhuman capabilities. This means edge cases are everywhere: as much as 40-50% of intended functionality for AI products we’ve looked at can reside in the long tail of user intent. Put another way, users can – and will – enter just about anything into an AI app. Handling this huge state space tends to be an ongoing chore. Since the range of possible input values is so large, each new customer deployment is likely to generate data that has never been seen before. Even customers that appear similar – two auto manufacturers doing defect detection, for example – may require substantially different training data, due to something as simple as the placement of video cameras on their assembly lines.


Cloud misconfigurations cost companies nearly $5 trillion

Cloud computing concept on futuristic technology background
"Data breaches caused by cloud misconfigurations have been dominating news headlines in recent years, and the vast majority of these incidents are avoidable," said Brian Johnson, chief executive officer and co-founder of DivvyCloud. Using data from a 2019 Ponemon Institute report that said the average cost per lost record globally is $150, DivvyCloud researchers estimated that cloud misconfiguration breaches cost companies upwards of $5 trillion over those two years. "Breaches caused by cloud misconfigurations have been dominating news headlines in recent years. DivvyCloud researchers compiled this report to substantiate the growing trend of breaches caused by cloud misconfigurations, quantify their impact to companies and consumers around the world and identify factors that may increase the likelihood a company will suffer such a breach," the report said. "Year over year from 2018 to 2019, the number of records exposed by cloud misconfigurations rose by 80%, as did the total cost to companies associated with those lost records," according to the report Unfortunately, the report added, experts expect this upward trend to persist, as companies continue to adopt cloud services rapidly but fail to implement proper cloud security measures.


When Money Becomes Programmable – Part 1

Digital scarcity, when applied to a token such as bitcoin or some other digitally tokenized medium of exchange, allows a new approach to managing our increasingly digitized economy and its micro-economies within. With scarce digital tokens, communities with a common interest in value generation can embed their shared values into the software’s governance and use these meta-assets as instruments of those values. Once they associate scarce tokens with rights to scarce resources, they can develop controls over token usage that help manage that public good. Here’s one hypothetical example: A local government that wants to reduce pollution, traffic congestion, and the town’s carbon footprint might reward households that invest in local solar generation with negotiable digital tokens that grant access to electric mass-transit vehicles but not to toll roads or parking lots. The tokens would be negotiable, with their value tied to measures of the town’s carbon footprint, creating an incentive for residents to use them.


How Fintech Startups Are Disrupting the Payments Industry

How Fintech Startups Are Disrupting the Payments Industry
Banks have invested huge sums to build legacy payment systems. However, financial institutions must now not only design processes and systems that incorporate cutting-edge innovations but also meet higher customer expectations. Legacy infrastructure is incompatible with those of other banks or payment processors. That leads to high fees, long delays and frustration for customers when sending and receiving payments. Tokenization solves the issue of interoperability by leveraging a standard token that participants use to transfer value (or data) quickly and efficiently. In the case of Soramitsu’s Project Bakong, its platform allows participants (i.e. banks) to transact directly using token transfers. This method drastically speeds up settlements by eliminating traditional business processes such as transfer instructions, liquidation and payment confirmations at a later date. Cambodia, Malaysia and Thailand are also experimenting with QR scan codes to improve remittances between these countries. The QR codes are EMVCo compatible and may be used to send and receive payments that are denominated in local currencies.


Banking for Humanity: Technology to Increase the Human Touch

As the Gen Z generation are more concerned with being authentic and persistent, banks will need to understand that there is no difference between offline and online words when it comes to building their omnichannel strategies. Banks can also consider creating educational channels to promote discourse with Gen Z. By digitalising their services, banks can bridge the gap between financial institutions and the older generations as well. Staff can help to assist older customers with self-service devices so that they have greater control over their money. Branch designs also take into consideration the personal consultation aspect that caters to their needs. Likewise, video banking can be used within branches to increase access to financial services and assistance for customers who need help with self-service products and technology whenever they want. A bank’s physical services can be carefully merged with the latest digital technologies.


Understanding the Impact of the Cybersecurity Skills Shortage on Business

womans hands working on laptop reflection of data protection symbol picture id1135823003
The impact of the skills shortage is too powerful to ignore and requires intervention. This is where an effective strategy driven by the CISO comes in. The evolution of the CISO has expanded the role from being a technologist solely focused on managing an organization’s security risks, to also being a business strategist able to reach across organizational boundaries to shape and mobilize resources to enable things like secure digital transformation. In today’s threat landscape, security solutions alone are no longer enough to withstand modern cyber threats. The expanding responsibilities of the CISO and the organizational impact of today’s cybersecurity skills shortage both play a critical role in the success of an organization’s digital transformation efforts and security strategies. While an effective CISO can provide essential guidance, a skills shortage can present uncertainties that can still adversely affect the productivity and morale of the security team – which can directly impact the overall security of the organization. By investing time and efforts into existing team members, security leaders can actively provide more value to their organizations without having to rely solely on seeking new talent.


AI for CRE: Is Cybersecurity A friend or foe?

AI cybersecurity
While AI could help lower cybersecurity spending in terms of money and manpower, it could also cost companies money, too. Last year, Juniper Research predicted that data breaches’ costs would increase from $3 trillion in 2019 to $5 trillion in 2024. A number of factors will play into those costs like lost business, recovery costs and fines, but so will AI. “Cybercrime is increasingly sophisticated; the report anticipates that cybercriminals will use AI, which will learn the behavior of security systems in a similar way to how cybersecurity firms currently employ the technology to detect abnormal behavior,” Juniper’s report said. “The research also highlights that the evolution of deep fakes and other AI-based techniques is also likely to play a part in social media cybercrime in the future.” Security experts have also pointed to this year as to when hackers will start their attacks that leverage AI and machine learning. “The bad [actors] are really, really smart,” Burg of EY Americas told VentureBeat. “And there are a lot of powerful AI algorithms that happen to be open source. And they can be used for good, and they can also be used for bad.



Quote for the day:


"Leadership is, among other things, the ability to inflict pain and get away with it - short-term pain for long-term gain." -- George Will


October 24, 2015

Why Self-Driving Cars Must Be Programmed to Kill

In general, people are comfortable with the idea that self-driving vehicles should be programmed to minimize the death toll. This utilitarian approach is certainly laudable but the participants were willing to go only so far. “[Participants] were not as confident that autonomous vehicles would be programmed that way in reality—and for a good reason: they actually wished others to cruise in utilitarian autonomous vehicles, more than they wanted to buy utilitarian autonomous vehicles themselves,” conclude Bonnefon and co. And therein lies the paradox. People are in favor of cars that sacrifice the occupant to save other lives—as long they don’t have to drive one themselves.


Prepping for Data Driven Innovation

It is important for businesses to understand that data validates theory and give it a perspective. Acting on a hypothesis without validation is close to flying blind. So, it is important to understand what role data plays. For example – In innovation, we have a tendency of going top-down, but more often than not, innovation fails because it is not backed by detailed data points to validate the assumptions. So, businesses should convince themselves to align in a way that facilitates data in decision making processes. For innovation process, it does a couple of things: it validates the assumption; it helps ideas germinate fast and find their product market fit as well as it helps ideas fail quick. So, businesses end up spending less money and time on failed products and more resources on the ones that are closer to their customer’s need.


Deriving Value from Data Before It Goes Dark

It’s much more efficient to derive value from data before it goes dark by implementing a fast data solution in a data pipeline to ingest and analyze data in real time. This allows the enterprise to take action, automatically implement transactions, and make decisions based on information available in live data streams. Rather than losing time waiting for data at rest to be classified and made available for Big Data analysis, the enterprise can immediately analyze and act on real-time information, based on defined business policies. The enterprise can gain instant insight into sales, production and distribution trends, and capitalize on opportunities to create value by leveraging instant insights to shape products and services and steer marketing and sales campaigns.


As sites move to SHA2 encryption, millions face HTTPS lock-out

"Given that many sites are 75 percent through to SHA2 migration, it's likely that those users with old browsers will start to experience problems with increased frequency throughout 2016," said Ristic. Mozilla found out the hard way last year. Last year, the browser maker updated its website with a new SHA2-hashed SSL certificate. But those who were running a browser or operating system that didn't support SHA2 couldn't get onto the website. The upgrade "killed one million downloads," said Mozilla's Chris More in a bug listing at the time. "A lot of the world is still running old browsers and come to our website to get Firefox," he said. And it won't be the last time it happens.


20 hybrid cloud insights from top industry experts

One cloud does not fit all organizations. That’s true whether it is a public or private cloud. A hybrid cloud option allows your business to create a custom solution that fits your organizational needs. However, there are always questions with new solutions. We reached out to industry thought leaders to answer some of the marketplace’s most pressing questions on hybrid cloud. In this eBook, you’ll learn why thought leaders like Kevin Jackson, founder and CEO GovCloud Network, look at hybrid cloud from the viewpoint of hybrid IT. You’ll also hear from Shelly Kramer, co-CEO, V3+Broadsuite, on what CIOs need to consider when adopting hybrid cloud.


Malvertising – the new silent killer?

For sites that use these ad networks, limiting who can advertise on your site can cut back on the chance you're going to serve up malvertising. "Most of these ad networks allow you a wide array of which type of ads you'll accept," says Wilson. "I'll accept ads from IBM, Dell and Oracle, but I'm not going to accept ads from just any random unknown person."  Websites that use ad networks should also make sure their security is up to date, says Kowsik Guruswamy, CTO of Menlo Security. In a March report, Menlo Security found that of the top million ranked domains on Alexa, one third are running software with security gaps. "There are domains out there running software that hasn't been updated in years," he says. "We're seeing sites that are running software from 2010 that have known vulnerabilities."


You’ve Been Misled About What Makes a Good Password

The results show that making a password longer or adding symbols is a better way to strengthen it than by adding uppercase characters or numbers. That’s because people tend to add uppercase characters at the start of passwords and numbers at the end, and password attacking methods can take advantage of that, says Dell’Amico. “Basically you need to make your passwords less predictable,” he says. The new method could be used to create more accurate ways to give people a sense of the strength of a password, says Dell’Amico. A good way of doing that is important but has long proven elusive, says Mark Burnett, a security researcher who published one of the password research databases used in the study.


The Business Value of (Effective) Architecture – Part 2

So here’s how I went about to measure the value of EA. I started with the premise that if we had perfect information and did perfect planning, each project would cost exactly what we projected, it would finish on time, and it would deliver the expected business results. If we take a simple scenario of a $100M annual budget for capital projects and assume that on average the projects take 12 months, have a 12 month payback (business benefits in the first 12 months of operation equal the initial project cost), and have a maintenance cost of 20% of the original project cost, and the cost of capital or the internal rate of return is 10%, then the net present value (NPV) of the $100M investment is $143M which represents a 43% ROI over a 5 year period.


Developing Test Automation Scripts and Automation Frameworks

Framework is so nice word that when you say it – it makes an impression. For instance, the Zachman Framework is not related to any developed components – it’s a methodology to define enterprise architectures. The same goes for in-house automation built frameworks – they can contain both components for test automation along with approaches, describing how to automate something in the best possible way. This is what test automation experts (including me) show to their customers willing to start test automation for the first time or to understand what is going on their current automation project. One more important framework family to mention. Those are tool specific or project specific frameworks and target less coding experienced staff – to enable them write and support automation scripts.


The New Old: High-Tech and Design for Aging

We are entering an age of “invisibility” — automated solutions are disappearing into the fabric of users’ daily lives and allowing someone to live without thinking twice about using them (think Samantha, the OS in the movie “Her”). More and more innovators are coming to us to create health care products that integrate with mobile technology, the cloud and artificial intelligence. As boomers increasingly demand to age in place, however, we’ve found that creating advanced technology isn’t enough anymore — we must spend time talking to aging users and their caregivers and studying the ecosystems of their lives to understand how the new technologies we develop can best service them.



Quote for the day:

“You never win unless you win the hearts of people.” -- Syed Bokhari

July 24, 2012

ASP.NET - Password Strength Indicator using jQuery and XML
ASP.NET Password Strength Indicator somewhat similar to AJAX PasswordStrength extender control behavior and implemented by using jQuery and XML.

Flexibility: A Foundation for Responsive Design
If you haven’t been living under a rock for the past year or so, you know that responsive Web design is one of the biggest trends these days. Introduced by Ethan Marcotte, the concept is simple: develop a site using methods that enable it to adapt and respond to different devices and resolutions.

Why does the IT industry continue to listen to Gartner?
Another day, another provocative research report from Gartner, which has a long track record of spectacularly wrong predictions. I've collected some of their greatest hits. Er, misses.

After Infy, TCS, Cognizant in fray to buy Lodestone
TCS and Cognizant have joined Infosys in the race to take over Swiss firm Lodestone Management Consultants, a management and technology consulting firm.

Samsung adopts Windows Azure for Smart TV cloud structures
Samsung announced on Monday its decision to use Windows Azure technology to manage the Smart TV system through cloud-based technology. The company cited a reduction in costs, increased productivity and a flexible, scalable model which can be expanded to meet its growing customer base.

Harley-Davidson deal win spurs Infosys to open new US delivery centre
Outsourcer Infosys has decided to open a delivery centre in Milwaukee, after it won a five-year deal with motorbike maker Harley-Davidson to supply tech services such as applications management

Facebook's Zuckerberg wins privacy patent, 6 years on
The patent, number 8,225,376, was first applied for on July 25, 2006. Zuckerberg and Facebook's former chief privacy officer Chris Kelly are credited as inventors for the patent, which is titled "Dynamically generating a privacy summary."

Microsoft's Lync: Unified Communications Made Easy
Microsoft Lync offers Instant, Messaging Audio/Video Conferencing and Telephony Services, making it the complete unified communications tool SMEs need, says Microsoft's Sukhvinder Ahuja

How to Handle Relational Data in a Distributed Cache
Although distributed caching is great, one challenge it presents is how to cache relational data that has various relationships between data elements. This is because a distributed cache provides you a simple, Hashtable-like (key, value) interface ...

Robert's Rules: The Four Commitments
Here are Robert Thompson's four leadership traits rather commitments.


Quote for the day:

"Out of clutter, find simplicity. From discord find harmony. In the middle of difficulty lies opportunity."  -- Albert Einstein