Daily Tech Digest by Kannan Subbiah: service mesh

Showing posts with label service mesh. Show all posts

Daily Tech Digest - February 23, 2025

Quote for the day:

“Success does not consist in never making mistakes but in never making the same one a second time.” --George Bernard Shaw

Google Adds Quantum-Resistant Digital Signatures to Cloud KMS

After a process that kicked off nearly a decade ago, NIST officially published the first three PQC standards last August. The standards, based on advanced encryption algorithms, are now known as FIPS 203, FIPS 204, and FIPS 205, although additional specifications are still under review by NIST. Google's strategy calls for support for the current and future NIST standards. While Cloud KMS will eventually support all three NIST standards, Google's initial release implements the two digital signature algorithms: FIPS 204, which enables lattice-based digital signatures, and FIPS 205, which is for stateless hash-based digital signatures. Porter says support for FIPS 203, which is for asymmetric cryptography, will come later in the year. ... "Making the open source libraries and Cloud KMS to support those specific signatures with those keys will give the opportunity for our customers to validate those performance implications to their environments when they use those keys for the signing of longer linked environments," Porter explains. Google is not the only major player adding open source libraries that support the NIST standards. In September, Microsoft started releasing support for the NIST standards in SymCrypt, its open source core cryptographic library main cryptographic library used in Azure, Microsoft 365, Windows 11, Windows 10, Windows Server, Azure Stack HCI, and Azure Linux.

The most critical job skill you need to thrive in the AI revolution

A few weeks ago, The World Economic Forum dropped its predictions for the future of jobs and the seismic shift in the workforce over the next five years (2030). ... Half of the employers plan to reorient business strategies in response to the rise of AI. In fact, 2 in 3 plan to hire for AI-specific skills (this is where the new jobs will come from). 40% of those same businesses also think their workforce will shrink due to AI automating tasks. On the surface, this might seem like doom and gloom, but remember, we are talking about 78 million new jobs by 2030. It is safe to assume some of that workforce will find employment in companies that don't exist yet. Another insight that stood out to me but deserves its own article is that an aging population will drive the demand for more healthcare jobs. This could be a huge opportunity. Let me know in the comments if you want me to discuss the possibilities. ... As for your big opportunity, I feel like everyone is so focused on the shiny objects, like what are the best prompts or the best tool? Those are fine, but not enough focus is placed on the soft skills. It's as if we're forgetting that even though we use AI to create, our creations are still intended for humans. If I had to say it another way, it is almost like some businesses are using AI and becoming sloppy. Not caring about the customer, and so on.

MDR, EDR Markets See Wave of M&A as Competition Intensifies

Organizations traditionally relied on managed security services for log monitoring and basic alerting. MDR took this a step further by offering real-time threat detection, investigation and response. At the same time, vendors came to realize that endpoint visibility alone through EDR was insufficient, leading to XDR, which integrates signals from multiple layers, including cloud, network and identity systems. "It's complicated to learn the skills to be able to operate these kinds of platforms really efficiently, and it's even more challenging to be able to do it 24/7/365," Levy said. "Most organizations simply aren't equipped to be able to run a global SOC with multiple shifts." While XDR expanded detection capabilities, Levy said it also introduced operational complexities, with most companies lacking the expertise and resources to manage a sophisticated security platform 24/7, leading to the rise of MDR as a fully managed security service. True MDR should go beyond the endpoint and include threat detection across cloud environments, networks and identity systems, Schneider said. "Once partners get engaged and really see the value in managed EDR, the conversation immediately goes to, 'Can you do the same thing for my firewalls? Can you do the same thing for my NDR solution? Can you do the same thing for my identity solution?'"

We need to talk about the F word (‘friction’ in enterprise, that is)

By striking the right balance, companies can use friction to their advantage. Friction, after all, is another word for feedback — so products that become completely frictionless stop responding to users’ needs. The pursuit of frictionlessness can launch you skywards, but over time you’ll struggle to course-correct. Eventually, gravity will drag you back to earth. This isn’t hypothetical: Research shows that friction makes many systems — including businesses — smarter and more resilient. A bit of strategic inconvenience can improve market performance, with investors making smarter decisions when they’re forced to slow down and think about trades. ... For technologists, that means asking: What problems are you solving by eliminating friction — and what problems might you create, now or in future, by doing so? Every design choice brings tradeoffs, but balancing risks and rewards to design for the right level of friction enables both rapid growth and long-term sustainability. Such an approach could also make it easier to have grown-up conversations about the need to regulate AI and other emerging technologies. Regulations always add friction — but once we accept that some friction can be valuable, we can work collaboratively with policymakers to find the right level of friction to support innovation while protecting and respecting consumers.

Struggling to Become Truly Data-Driven? Focus on Access and Culture, Not Tech

Success in data strategy requires strong leadership commitment and cultural transformation. The playbook emphasizes the role of leaders in advancing data literacy and encouraging data-driven decision-making. This includes identifying and empowering "data champions" across the organization and creating communities of practice to share knowledge and best practices. Training and development play crucial roles in building data capabilities. The report recommends targeted training programs for employees central to data usage, utilizing both online and in-person resources. Investment in training yields significant returns through improved efficiency, better decision-making, and enhanced customer service. However, training should not be a one-size-fits-all approach; it should be tailored to different roles and skill levels within the organization. The report emphasizes that becoming a data-driven organization is an ongoing journey rather than a destination. Financial institutions must continuously evolve their data strategies to keep pace with changing technology and customer expectations. This includes exploring emerging technologies like artificial intelligence and machine learning, while ensuring they maintain a strong foundation in data quality and governance.

Introduction to Service Mesh

A service mesh acts as a layer encompassing services running within a distributed application that facilitates dependable and visible communication among microservices. It oversees how services interact with one another, handling tasks such as discovering services, distributing workloads evenly, recovering from failures, collecting metrics and monitoring performance. ... By separating network management duties from the application code, a service mesh makes it easier for developers and operations teams to handle tasks efficiently. Developers can concentrate on creating business logic without the need to deal with integrating service discovery, load balancing or security protocols into their applications. Operations teams can take advantage of the management of policies and configurations provided by the service mesh’s control plane. ... When selecting a service mesh, it’s important to consider scalability. Make sure that the service mesh is capable of accommodating the size of your microservices setup and can adapt as your application grows. Assess how the service mesh affects your system’s performance and the load added by sidecar proxies. A scalable service mesh should deliver performance and minimal delays when adding more services and incurring higher traffic levels.

Why enterprises fail at finops

One of the most significant challenges is the lack of integration between the finops and engineering teams responsible for building and deploying cloud applications. McKinsey’s report showed that many organizations struggle to capture savings beyond the immediate finops team’s mandate because these teams often lack the incentives or access to cloud cost data. Consequently, many well-meaning optimization efforts fall by the wayside as engineers juggle multiple priorities or lack the resources to focus on cost-related improvements. Another issue is the lack of systematic implementation of finops best practices. This is where FaC becomes essential by incorporating finops processes directly into application configurations to make them foolproof. FaC can dramatically reduce costs by integrating financial management principles directly into the infrastructure management life cycle. Organizations can enforce budget constraints by automatically identifying opportunities for cost reduction, supporting more efficient resource scheduling, and employing cloud-native services to decrease operational cloud resource expenses. Many organizations struggle with basic cloud hygiene practices. They’re not effectively identifying and eliminating obvious sources of waste, such as underutilized resources, oversized virtual machines, and redundant storage volumes.

Building the next-gen creator economy with AI agents

Autonomous agents simplify content distribution and monetization by automating tasks such as pricing, licensing, and revenue sharing, freeing creators to focus on their craft. For instance, these agents can optimize pricing strategies based on market demand or manage revenue splits transparently. Unlike traditional AI tools, decentralized agents can operate trustlessly onchain, ensuring transparency, reducing costs, and eliminating third-party intermediaries. By leveraging programmable rules and onchain verification, autonomous agents also allow creators to explore new revenue streams—such as micro-licensing or fractional ownership of digital assets—giving them control over their intellectual property while tapping into innovative monetization models. Ethical concerns, such as licensing and copyright issues, can be addressed through programmable licensing rights embedded in content metadata. ... The use of trustless, onchain computation means that creators are not reliant on centralized APIs or platforms, which could compromise their data or artistic vision. Unlike many current AI agents that depend on centralized APIs like OpenAI, these decentralized agents operate sustainably and transparently, avoiding vulnerabilities tied to centralized control.

The Future of Cybersecurity: AI-Driven Threat Detection and Prevention

Artificial intelligence has revolutionized the way organizations respond to threat detection. Contemporary AI systems are capable of examining huge volumes of network traffic, log data, and user activity in real-time, detecting subtle patterns that could represent a security compromise. AI-powered Security Information and Event Management (SIEM) solutions can examine billions of security events per day, correlating seemingly unrelated activity to reveal advanced attack campaigns. ... Machine learning algorithms are now shifting from reactive security to predictive threat prevention. By examining past patterns of attacks and present system activity, AI can detect potential security threats before they become real threats. This is especially effective in insider threat detection, where AI algorithms can detect slight variations in employee behavior that could be a sign of compromise or malicious activity. ... When an incident is detected, AI-based security orchestration platforms can respond automatically, cutting in half the lag time between detection and mitigation. They can isolate infected systems, withdraw misused credentials, and apply countermeasures in seconds – operations that it would take human teams hours or even days to do manually.

Generative AI is already being used in journalism – here’s how people feel about it

What if the AI identifies something or someone incorrectly, and these keywords lead to mis-identifications in the photo captions? What if the criteria humans think make “good” images are different to what a computer might think? These criteria may also change over time or in different contexts. Even something as simple as lightening or darkening an image can cause a furore when politics are involved. AI can also make things up completely. Images can appear photorealistic but show things that never happened. Videos can be entirely generated with AI, or edited with AI to change their context. Generative AI is also frequently used for writing headlines or summarising articles. These sound like helpful applications for time-poor individuals, but some news outlets are using AI to rip off others’ content. AI-generated news alerts have also gotten the facts wrong. ... Overall, our participants felt most comfortable with journalists using AI for brainstorming or for enriching already created media. This was followed by using AI for editing and creating. But comfort depends heavily on the specific use. Most of our participants were comfortable with turning to AI to create icons for an infographic.

Daily Tech Digest - April 02, 2024

A double-edged sword: GenAI vs GenAI

Every technology indeed presents new avenues for vulnerabilities, and the key lies in maintaining strict discipline in identifying and addressing these vulnerabilities. This calls for the strict application of IT ethos in organisational setups to ensure no misuse of technologies, especially intelligent ones. “It is crucial to continuously test your APIs and applications, relentlessly seeking out any potential vulnerabilities and ensuring they are addressed promptly. This proactive approach is vital in safeguarding your platform against potential threats,” says Sunil Sapra, Co-founder & Chief Growth Officer, Eventus Security. The Government of India has proactively addressed the grave importance of cybersecurity and recently rolled out the much-awaited Digital Personal Data Protection Act 2023. The Act though takes into consideration data protection and data privacy laying emphasis on the ‘consent of the owner’, but it does not draw the spotlight on GenAI that can make or break the existing cyber fortifications. Hence, there is a dire need for strong regulations and control measures guarding the application of GenAI models.

There's more to cloud architecture than GPUs

GPUs require a host chip to orchestrate operations. Although this simplifies the complexity and capability of modern GPU architectures, it’s also less efficient than it could be. GPUs operate in conjunction with CPUs (the host chip), which offload specific tasks to GPUs. Also, these host chips manage the overall operation of software programs. Adding to this question of efficiency is the necessity for inter-process communications; challenges with disassembling models, processing them in parts, and then reassembling the outputs for comprehensive analysis or inference; and the complexities inherent in using GPUs for deep learning and AI. This segmentation and reintegration process is part of distributing computing tasks to optimize performance, but it comes with its own efficiency questions. Software libraries and frameworks designed to abstract and manage these operations are required. Technologies like Nvidia’s CUDA (Compute Unified Device Architecture) provide the programming model and toolkit needed to develop software that can harness GPU acceleration capabilities.

How to Evaluate the Best Data Observability Tools

Some key areas to evaluate for enterprise readiness include:Security– Do they have SOC II certification? Robust role based access controls? Architecture– Do they have multiple deployment options for the level of control over the connection? How does it impact data warehouse/lakehouse performance? Usability– This can be subjective and superficial during a committee POC so it’s important to balance this with the perspective from actual users. Otherwise you might over-prioritize how pretty an alert appears versus aspects that will save you time such as ability to bulk update incidents or being able to deploy monitors-as-code. Scalability– This is important for small organizations and essential for larger ones. We all know the nature of data and data-driven organizations lends itself to fast, and at times unexpected growth. What are the largest deployments? Has this organization proven its ability to grow alongside its customer base? Other key features here include things like ability to support domains, reporting, change logging, and more. These typically aren’t flashy features so many vendors don’t prioritize them.

CISA releases draft rule for cyber incident reporting

According to the proposed rules, CISA plans to use the data it receives to carry out trend and threat analysis, incident response and mitigation, and to inform future strategies to improve resilience. While the rule is not expected to be finalized until 18 months from now or potentially later next year, comments are due 60 days after the proposal is officially published on April 4. One can be sure that the 16 different critical infrastructure sectors and their armies of lawyers will have much to say. The 447-page NOPR details a dizzying array of nuances for specific sectors and cyber incidents. ... The list of exceptions to the cyber incidents that critical infrastructure operators will need to report is around twice as long as the conditions that require reporting an incident, and the final shape of the rule may change as CISA considers comments from industry. The companies affected by the proposed rules include all critical infrastructure entities that exceed the federal government’s threshold for what is a small business. The rules provide a series of different criteria for whether other critical infrastructure sectors will be required to report incidents.

Digital transformation’s fundamental change management mistake

the bigger challenge is often downstream and occurs when digital trailblazers, the people assigned to lead digital transformation initiatives, must work with end-users on process changes and technology adoption. When devops teams release changes to applications, dashboards, and other technology capabilities, end-users experience a productivity dip before people effectively leverage new capabilities. This dip delays when the business can start realizing the value delivered. While there are a number of change management frameworks and certifications, many treat change as separate disciplines from the product management, agile, and devops methodologies CIOs use to plan and deliver digital transformation initiatives. ... Reducing productivity dips and easing end-user adoption then are practices that must fit the digital and transformation operating model. Let’s consider three areas where CIOs and digital trailblazers can inject change management into their digital transformation initiatives in a way that brings greater effectiveness than if change management were addressed as a separate add-on.

6 keys to navigating security and app development team tensions

Unfortunately, many organizations don’t take the proper steps, leading to the development team viewing security teams as a “roadblock” — a hurdle to overcome. Likewise, the security team’s animosity toward development teams grows as they view developers as not “taking security seriously enough.” ... When you have an AppSec team built just by security people who have never worked in development, that situation will likely cause friction between the two groups because they will probably always speak two languages. And neither group understands the problems and challenges the other team faces. When you have an AppSec team that includes prior developers, you will see a much different relationship between the teams. ... Sometimes, there are unreasonable requests because the security team asks for things that aren’t actual issues to be fixed. This happens when they run an application vulnerability scanner, and the scanner reports a vulnerability that doesn’t exist or expose an actual risk. The security team blindly passed that on to developers to remedy.

Enhancing Business Security and Compliance with Service Mesh

When implementing a service mesh, there are several important factors you should consider for secure and compliant deployment.You should carefully evaluate the security features and capabilities of the chosen service mesh framework. Look for strong authentication methods like mutual TLS and support for role-based access control (RBAC) to ensure secure communication between services. Establish clear policies and configurations for traffic management, such as circuit breaking and request timeouts, to mitigate the risk of cascading failures and improve overall system resilience. Thirdly, consider the observability aspects of the service mesh. Ensure that metrics, logging, and distributed tracing are properly configured to gain insights into service mesh behavior and detect potential security incidents. For example, leverage tools like Prometheus for metrics collection and Grafana for visualization to monitor key security metrics such as error rates and latency. Maintaining regular updates and patches for the service mesh framework is important to address any security vulnerabilities promptly. You should stay informed about the latest security advisories and best practices provided by the service mesh community.

Who should be the head of generative AI — and what they should do

Some generative AI leaders might have a creative background; others could come from tech. Gratton said background matters less than a willingness to experiment. “You want somebody who’s got an experimental mindset, who sees this as a learning opportunity and sees it as an organizational structuring issue,” she said. “The innovation part is what’s really crucial.” ... The head of AI could encourage use of the technology to help with managing employees, Gratton said. This encompasses three key areas: Talent development - Companies can use chatbots and other tools to recruit people and help them manage their careers. Productivity - AI can be used to create assessments, give feedback, manage collaboration, and provide skills training. Change management - This includes both internal and external knowledge management. “We have so much knowledge in our organizations … but we don’t know how to find it,” Gratton said. “And it seems to me that this is an area that we’re really focusing on in terms of generative AI.” ... Leaders should remember that buy-in across all career stages and skill levels is essential. Generative AI isn’t just the domain of youth.

Knowledge-Centered Design for Generative AI in Enterprise Solutions

The need for a new design pattern, specifically the Knowledge Centered Design (KCD), arises from the evolution and complexity of AI and machine learning technologies. As these technologies advance, they generate an increasing volume of knowledge and insights. The traditional Human-Centered Design (HCD) focuses on understanding users, their tasks, and environments. However, it may not be fully equipped to handle the intricate dynamics of both human-generated and AI-generated knowledge effectively. The proposed KCD extends HCD by emphasizing the life cycle of knowledge – identifying, acquiring, categorizing, extracting insights – and incorporating feedback loops for continuous improvement. It ensures that both human-based and AI-generated knowledge are effectively integrated into the design process to enhance user experience and productivity. ... The knowledge life cycle process, feedback loop process, and integral components of the KCD pattern, serve as starting baselines that each enterprise can adapt and adjust according to their specific business needs and institutional culture.

Creating a Data Monetization Strategy

Monetizing customer data involves implementing effective strategies and adhering to best practices to maximize its value. One key approach is to ensure data privacy and security, as customers are increasingly concerned about the usage of their personal information. Companies must establish robust data protection measures, comply with regulations such as GDPR or CCPA, and obtain explicit consent for data collection and utilization. Another strategy is to leverage advanced analytics techniques to derive valuable insights from customer data. By employing ML algorithms, predictive modeling, and artificial intelligence, businesses can uncover patterns, preferences, and trends. ... Blockchain technology is revolutionizing how data is monetized by enhancing security and trust in the digital ecosystem. Blockchain, a decentralized and immutable ledger, provides a robust infrastructure for securely storing and transferring data, making it an ideal solution for data monetization. Additionally, every transaction recorded on the blockchain is encrypted and linked to previous transactions through cryptographic hash functions, further safeguarding the integrity of the data.

Quote for the day:

"It is during our darkest moments that we must focus to see the light." -- Aristotle Onassis

Daily Tech Digest - June 25, 2023

Traffic Routing in Ambient Mesh

The ambient mesh deployment model is much leaner than the sidecar data plane deployment model, allowing for incremental adoption of service mesh features and making it less risky. As ambient mesh includes fewer components, this leads to reduced infrastructure costs and performance improvements, as captured in this blog post. Ambient mesh does all this while retaining all the service mesh critical features, including zero trust security. ... The new Rust-based ztunnel proxy is responsible for mTLS, authentication, L4 authorization and telemetry in the ambient mesh. Its job is to proxy the traffic between ambient mesh pods. Optionally, the ztunnel proxies to L7 waypoint proxies, ingress and, in the future, egress proxies. Ztunnels on different nodes establish a tunnel using HBONE (HTTP-Based Overlay Network Environment). Similarly, the tunnel gets established between the ztunnel and the waypoint proxy, if one exists. The tunnel that’s established between the ztunnels allows the source ztunnel to connect to the destination workload on behalf of the source workload.

Unleashing Business Growth: The Power of Adopting Enterprise Architecture

Enterprise architecture plays a vital role in the success and growth of modern businesses. By aligning business and IT strategies, enhancing agility, optimizing resources, mitigating risks, and fostering innovation, EA provides a solid foundation for sustained growth and competitive advantage. As businesses continue to navigate an increasingly complex landscape, leveraging the business-critical values of Enterprise Architecture becomes imperative to welcome new opportunities and drive long-term success. So, whether you are a business leader, IT professional, or decision-maker, embracing EA as a strategic imperative will position your organization for growth, resilience, and innovation in the ever-changing business landscape. Remember, an ingenious Enterprise Architecture Development is not a one-time effort but an ongoing journey of adaptation and improvement. It requires collaboration, commitment, and continuous refinement to realize its full potential in driving business growth.

IT firms expect to increase hiring next quarter, ManpowerGroup says

Among the skills most in demand in IT are project managers, business analysts, and software developers. "I wish we could clone full stack developers. We can't find enough of them," Doyle said. In past years, ManpowerGroup’s survey has been conducted by telephone. This year, it was done online. Regionally, the strongest hiring intentions for next quarter are in the west, with 43% of employers planning to add to workers, according to ManpowerGroup. In the northeast, 40% of employers plan to increase staff; the midwest is expected to see a 32% increase; and companies in the south are expected to boost hiring by 29%. Large organizations with more than 250 employees are more than three times as optimistic as small firms (with fewer than 10 employees) to hire in the next quarter, with employment outlooks of +47% and +14%, respectively. Earlier this month, the US Bureau of Labor Statistics (BLS) released its hiring data for the month of May; it showed a 0.3% increase in overall unemployment — from 3.4% to 3.7%.

Building Effective Defenses Against Social Engineering

In addition to awareness training and education, quite a number of technologies are available to augment and fortify efforts to limit the impact of social engineering attacks. Cloud-based email security gateways are just one example. Depending on budget, staffing, age of existing infrastructure, the value of the assets to be protected and other aspects, a layered defense strategy may range from relatively low-cost and simple to more elaborate (and expensive) endeavors. Enforcement of strong passwords is an example of a relatively cheap, easy and fast tactic that can be highly effective in averting data breaches and other cyberattacks. Other strategies and techniques can be rolled out in parallel with existing technologies to minimize disruption while preparing for a new, stronger security infrastructure. A zero-trust network architecture (ZTNA) is one such example; it can be deployed alongside a secure sockets layer (SSL) virtual private network (VPN), working as an overlay at first to boost security and eventually replacing it.

Data Breach Lawsuit Alleges Mismanagement of 3rd-Party Risk

The latest GoAnywhere-related lawsuit alleges that ITx could have prevented the theft of sensitive data "had it limited the patient information it shared with its business associates and employed reasonable supervisory measures to ensure that adequate data security practices, procedures and protocols were being implemented and maintained by business associates." ITx's "collective inadequate safeguarding and supervision of class members' private information that they collected and maintained, and its failure to adequately supervise its business associates, vendors and/or suppliers" has put the plaintiffs and class members at risk for ID fraud and theft crimes, the complaint also alleges. The lawsuit says victims will be at higher risk for phishing, data intrusion and other illegal schemes through the misuse of their private information. It also points out that their data is still held by ITx and could be exposed to future breaches without the court's corrective action. The lawsuit seeks monetary damages, lifetime credit and identity monitoring for the plaintiff and class members, as well as a court order for ITx to take measures to prevent any future similar data security incidents.

Who owns the code? If ChatGPT's AI helps write your app, does it still belong to you?

Attorney Richard Santalesa, a founding member of the SmartEdgeLaw Group based in Westport, Conn., focuses on technology transactions, data security, and intellectual property matters. He points out that there are issues of contract law as well as copyright law -- and they're treated differently. From a contractual point of view, Santalesa contends that most companies producing AI-generated code will, "as with all of their other IP, deem their provided materials -- including AI-generated code -- as their property." OpenAI (the company behind ChatGPT) does not claim ownership of generated content. According to their terms of service, "OpenAI hereby assigns to you all its right, title and interest in and to Output." Clearly, though, if you're creating an application that uses code written by an AI, you'll need to carefully investigate who owns (or who claims to own) what. For a view of code ownership outside the US, ZDNET turned to Robert Piasentin, a Vancouver-based partner in the Technology Group at McMillan LLP, a Canadian business law firm.

Shadow SaaS, changing contracts and ChatGPT adoption: SaaS trends to watch

As more companies move to remote work, many find that shorter (one-year) contracts are preferable because they allow for more flexibility. Reducing contract lifetime is also a way for organizations to reduce overhead costs. One-year contracts accounted for 79% of all contracts in 2020 and 85% of all contracts in 2022. Three-year and longer contracts declined the most year-over-year. In 2023, SaaS spend per employee averaged $9,643. Large businesses spent an average of $7,492 per employee in 2022, while medium-sized businesses spent $10,045 and small and medium-sized businesses spent $11,196. The large businesses spent less because they received volume discounts and enterprise-wide licensing agreements, as well as better efficiency of scale with consumption-based apps, Productiv said. “To avoid shadow IT, organizations need to develop appropriate SaaS governance policies that help teams take their free and purchased apps out of the shadows and ensure the right level of corporate policies for procurement, security and compliance,” Chandarana said.

How AI is reshaping demand for IT skills and talent

AI opens new doors for security threats and compliance issues as well that organizations must be prepared to address. “On the technical side, I see security as hugely important,” says Hendrickson. “A lot of companies say, ‘We’re not letting people touch ChatGPT yet, we’re just not allowing it—it’s blocked.’” But end-users’ propensity for finding ways to improve their work processes will no doubt lead to greater levels of shadow IT around such emerging technologies, and thus, security implications will eventually need to be tackled beyond simply trying to hold back the tide. Moreover, Hendrickson points to the fact that just a few years ago, discussions around machine learning centered around its ability to break encryption, and with quantum machine learning on the horizon, that concern has only increased. As companies navigate AI in the workplace, they’re going to need skilled professionals who can identify potential risks and pinpoint possible solutions. There are also increased complexities around “managing the infrastructure and platforms that provide resources to power applications, and to store and access data,” says Kim.

Decision Rights Rule the World – Architecture Design Part 3

Think of the number of decisions made related to technology daily in your organization. Try to imagine, every library, product, SaaS tool, vendor agreement, pattern, style, and reference model that is being chosen by one or more people. From huge (ERP, standardizing a single cloud vendor, information management structures) to small (library dependency, pattern application to code, GitHub structure). The real question is, how many of those are architecturally relevant (Note: it is NOT all of them)? And how many of them come with a decision record of any kind? I have asked this question of countless audiences and teams over time. The answer is… almost none. And that is scary. We end up with WHAT we decided, not WHY we decided. Traceability, understanding, decision excellence are all thrown out the window because we think it might take too, long. Just FYI, whenever I have implemented decision management in teams, important decisions (structural, value-based, etc) go FASTER not slower. The decision record allows us to focus on apples to apples instead of long-winded, emotionally charged, opinion-heavy, biased arguments.

Structured for Success: 4 Architectural Pillars of Cyber Resilience

Having centralized visibility is fundamental to not only taking control of cloud environments but also bridging silos. In a recent survey conducted by Forrester, 83% of IT decision-makers said a single consolidated view for managing their organizations’ cloud and IT services would help achieve their business outcomes — including improving their cybersecurity posture. ... Immutable data storage enables the storing of data after it is written, such that it's impossible to change, erase or otherwise interfere with it. This functionality guards against malware, ransomware, and both unintentional and malicious human behavior. Since it effectively protects data against any change or erasure, as would be typical in a ransomware attack that tries to encrypt data, immutability is commonly regarded as a prerequisite in the battle against ransomware. ... Beyond this 3-2-1 rule, organizations need a scalable backup and recovery infrastructure — one that makes management fast and simple – to sustain business continuity and operations in the current cybersecurity landscape.

Quote for the day:

"Leadership without mutual trust is a contradiction in terms." -- Warren Bennis

Daily Tech Digest - January 30, 2023

How to survive below the cybersecurity poverty line

All types of businesses and sectors can fall below the cybersecurity poverty line for different reasons, but generally, healthcare, start-ups, small- and medium-size enterprises (SMEs), education, local governments, and industrial companies all tend to struggle the most with cybersecurity poverty, says Alex Applegate ... These include wide, cumbersome, and outdated networks in healthcare, small IT departments and immature IT processes in smaller companies/start-ups, vast network requirements in educational institutions, statutory obligations and limitations on budget use in local governments, and custom software built around specific functionality and configurations in industrial businesses, he adds. Critical National Infrastructure (CNI) firms and charities also commonly find themselves below the cybersecurity poverty line, for similar reasons. The University of Portsmouth Cybercrime Awareness Clinic’s work with SMEs for the UK National Cyber Security Centre (NCSC) revealed that cybersecurity was a secondary issue for most micro and small businesses it engaged with, evidence that it is often the smallest companies that find themselves below the poverty line, Karagiannopoulos says.

The Importance of Testing in Continuous Deployment

Test engineers are usually perfectionists (I speak from my experience), that’s why it’s difficult for them to take a risk of issues possibly reaching end users. This approach has a hefty price tag and impacts the speed of delivery, but it’s acceptable if you deliver only once or twice per month. The correct approach would be automating critical paths in application both from a business perspective and application reliability. Everything else can go to production without thorough testing because with continuous deployment, you can fix issues within hours or minutes. For example, if item sorting and filtering stops working in production, users might complain, but the development team could fix this issue quickly. Would it impact business? Probably not. Would you lose a customer? Probably not. These are the risks that should be OK to take if you can quickly fix issues in production. Of course, it all depends on the context – if you’re providing document storing services for legal investigations, it would be a good idea to have an automated test for sorting and filtering.

Why Trust and Autonomy Matter for Cloud Optimization

With organizations beginning to ask teams to do more with less, optimization — of all kinds — is going to become a vital part of what technology teams (development and operations alike) have to do. But for that to be really effective, team autonomy also needs to be founded on confidence — you need to know that what you’re investing time, energy and money on makes sense from the perspective of the organization’s wider goals. Fortunately, Spot can help here too. It gives teams the data they need to make decisions about automation, so they can prioritize according to what matters most from a strategic perspective. “People aren’t really sure what’s going to be happening six, nine, 10 months down the road.” Harris says. “Making it easier for people to get that actionable data no matter what part of the business you’re in, so that you can go in and you can say, ‘Here’s what we’re doing right, here’s where we can optimize’ — that’s a big focus for us.” One of the ways that Spot enables greater autonomy is with automation features.

Keys to successful M&A technology integration

For large organisations merging together, unifying networks and technologies may take years. But for SMBs (small and medium-sized businesses) utilising more traditional technologies uch as VPNs, integrations may be accomplished more quickly and with less friction. In scenarios where both the acquiring company and the company being acquired utilise more sophisticated SD-WAN networks, these technologies tend to be closed and proprietary in nature. Therefore, if both companies utilise the same vendor, integration can be managed more easily. On the other hand, if the vendors differ, it is not going to interlink with other networks as easily and needs a more careful step-by-step network transformation plan. ... Another key to a successful technology merger is to truly understand where your applications are going. For example, if two New York companies are joining forces, with most of the data and applications residing in the US East Coast, it wouldn’t make sense to interconnect networks in San Francisco. Along with this, it is important to make sure your regional networks are strong, even within your global network. In terms of where you are sending your traffic and data, it’s important to be as efficient as possible.

Understanding service mesh?

Service meshes don’t give an application’s runtime environment any additional features. Service meshes are unique in that they abstract the logic governing service-to-service communication to an infrastructure layer. This is accomplished by integrating a service mesh as a collection of network proxies into an application. proxies are frequently used to access websites. Typically, a company’s web proxy receives requests for a web page and evaluates them for security flaws before sending them on to the host server. Prior to returning to the user, responses from the page are also forwarded to the proxy for security checks. ... But service mesh is an essential management system that helps all the different containers to work in harmony. Here are several reasons why you will want to implement service mesh in an orchestration framework environment. In a typical orchestration framework environment, user requests are fulfilled through a series of steps, where each of the steps is performed by a container Each one runs a service that plays a different but vital role in fulfilling that request. Let us call this role played by each container a business logic.

Chaos Engineering: Benefits of Building a Test Strategy

Many organizations struggle to get visibility into where their most sensitive data is stored. Improper handling of that data can have disastrous consequences, such as compliance violations or trade secrets falling into the wrong hands. “Using chaos engineering could help identify vulnerabilities that, unless remediated, could be exploited by bad actors within minutes,” Benjamin says. Kelly Shortridge, senior principal of product technology at Fastly, says organizations can use chaos engineering to generate evidence of their systems’ resilience against adverse scenarios, like attacks. “By conducting experiments, you can proactively understand how failure unfolds, rather than waiting for a real incident to occur,” she says. The very nature of experiments requires curiosity -- the willingness to learn from evidence -- and flexibility so changes can be implemented based on that evidence. “Adopting security chaos engineering helps us move from a reactive posture, where security tries to prevent all attacks from ever happening, to a proactive one in which we try to minimize incident impact and continuously adapt to attacks,” she notes.

How to get buy-in on new technology: 3 tips

When making a case for new technology, keep your audience in mind. Tailoring your arguments to their role and goals will put you in a much better position to capture their attention and generate enthusiasm. Sometimes this will require you to shift away from strict business goals. If you need to speak with the chief revenue officer and are trying to justify an additional $100,000 for your tech stack, for example, you will need to focus on the bottom line and the financial benefit your proposal could provide. On the other hand, the head of engineering might not be interested in the finances and would rather discuss how engineers can better avoid burnout or otherwise become easier to manage. When advocating for stack improvements, working with a partner helps substantially. It’s good to have a boss or teammate help, but even better to find a leader on a different team or even in another department. If multiple departments have team members who champion a specific improvement, it makes a strong case that there’s a pervasive need for stack enhancements across the entire company.

How organizations can keep themselves secure whilst cutting IT spending

The zero trust network access model has been a major talking point for CIOs, CISOs and IT professionals for some time. While most organizations do not fully understand what zero trust is, they recognize the importance of the initiative. Enforcing principles of least privilege minimizes the impact of an attack. In a zero trust model, an organization can authorize access in real-time based on information about the account they have collected over time. To make such informed decisions, security teams need accurate and up-to-date user profiles. Without it, security teams can’t be 100% confident that the user gaining access to a critical resource isn’t a threat. However, with the sprawl of identity data – stored in the cloud and legacy systems – of which are unable to communicate with each other, such decisions cannot be made accurately. Ultimately, the issue of identity management isn’t only getting more challenging with the digitalization of IT and migration to the cloud – it’s now also halting essential security projects such as zero trust implementation.

Economic headwinds could deepen the cybersecurity skills shortage

Look at anyone’s research and you’ll see that more organizations are turning to managed services to augment overburdened and under-skilled internal security staff. For example, recent ESG research on security operations indicates that 85% of organizations use some type of managed detection and response (MDR) service, and 88% plan to increase their use of managed services in the future. As this pattern continues, managed security service providers (MSSPs) will need to add headcount to handle increasing demand. Since service provider business models are based on scaling operations through automation, they will calculate a higher return on employee productivity and be willing to offer more generous compensation than typical organizations. One aggressive security services firm in a small city could easily gain a near monopoly on local talent. At the executive level, we will also see increasing demand for the services of virtual CISOs (vCISOs) to create and manage security programs in the near term.

2023 Will Be the Year FinOps Shifts Left Toward Engineering

By enabling developers to adopt using dynamic logs for troubleshooting issues in production without the need to redeploy and add more costly logs and telemetry, developers can own the FinOps cost optimization responsibility earlier in the development cycle and shorten the cost feedback loop. Dynamic logs and developer native observability that are triggered from the developer development environment (IDE) can be an actionable method to cut overall costs and better facilitate cross-team collaboration, which is one of the core principles of FinOps. “FinOps will become more of an engineering problem than it was in the past, where engineering teams had fairly free reign on cloud consumption. You will see FinOps information shift closer to the developer and end up part of pull-request infrastructure down the line,” says Chris Aniszczyk, CTO at the Cloud Native Computing Foundation. Keep in mind that it’s not always easy to prioritize and decide when to pull the cost optimization trigger.

Quote for the day:

"Inspired leaders move a business beyond problems into opportunities." -- Dr. Abraham Zaleznik

Daily Tech Digest - August 24, 2022

3 reasons cloud computing doesn’t save money

Without cloud spending visibility and insights, you’re basically driving a car without a dashboard. You don’t how fast you’re going or when you’re about to run out of gas. A guessing game turns into a big surprise when cloud spending is way above what everyone initially thought. That sucking sound you hear is the value that you thought cloud computing would bring now leaving the business. Second, there is no discipline or accountability. A lack of cloud cost monitoring means we can’t see what we’re spending. The other side of this coin is a lack of accountability. Even when a business monitors cloud spending, that data is useless if everyone knows there are no penalties. Why should people change their behavior? They need known incentives to conserve cloud computing resources as well as known consequences. Accountability problems can usually be corrected by leadership making some unpopular decisions. Trust me, you’ll either deal with accountability now or wait until later when it becomes much harder to fix.

How attackers use and abuse Microsoft MFA

The legitimate owner of a thusly compromised account is unlikely to spot that the second MFA app has been added. “It is only obvious if one specifically looks for it. If one goes to the M365 security portal, they will see it; but most users never go to that place. It is where you can change your password without being prompted for it, or change an authenticator app. In day-to-day use, people only change passwords when mandated through the prompt, or when they change their phone and want to move their authenticator app,” Mitiga CTO Ofer Maor told Help Net Security. Also, an isolated, random prompt for the second authentication factor triggered by the attacker can easily not be seen or ignored by the legitimate account owner. “They get prompted, but once the attacker authenticates on the other authenticator, that prompt disappears. There is no popup or anything that says ‘this request has been approved by another device’ (or something of that sort) to alert the user of the risk. ... ” Maor noted.

The emergence of the chief automation officer

AI and automation can transform IT and business processes to help improve efficiencies, save costs and enable people — employees — to focus on higher-value work. Two of the most important areas of IT operations in the enterprise are issue avoidance and issue resolution because of the massive impact they have on cost, productivity, and brand reputation. The rapid digital expansion among enterprises has led to an immediate uptick in demand from IT leaders to embrace AIops tools to increase workflow productivity and ensure proactive, continuous application performance. With AIops, IT systems and applications are more reliable, and complex work environments can be managed more proactively, potentially saving hundreds of thousands of dollars. This can enable IT staff to focus on high-value work instead of laborious, time-consuming tasks, and identify potential issues before they become major problems.

How a Service Mesh Simplifies Microservice Observability

According to Jay Livens, observability is the practice to capture the system’s current state based on the metrics and logs it generates. It’s a system that helps us with monitoring the health of our application, generating alerts on failure conditions, and capturing enough information to debug issues whenever they happen. ... A major aspect of observability is capturing network telemetry, and having good network insights can help us solve a lot of the problems we spoke about initially. Normally, the task of generating this telemetry data is up to the developers to implement. This is an extremely tedious and error-prone process that doesn’t really end at telemetry. Developers are also tasked with implementing security features and making communication resilient to failures. Ideally, we want our developers to write application code and nothing else. The complications of microservices networking need to be pushed down to the underlying platform. A better way to achieve this decoupling would be to use a service mesh like Istio, Linkerd, or Consul Connect.

IT talent: 4 interview questions to prep for

Whether managers have a more hands-on approach or allow their direct reports more autonomy, identifying this during the interview process is in the best interest of both parties. Additionally, some candidates thrive in an office, while others are hoping for a completely remote position or even a hybrid option. Discussing and defining preferences and working environments helps clarify candidates’ expectations for their roles. It also benefits hiring managers, prospective employees, and the companies, which can avoid high turnover rates by being transparent in their recruiting phase. ... people generally love to talk about things that make them proud. By asking this question, hiring managers allow candidates to talk about who they are as individuals rather than just what they bring to the larger business. Obviously, pride can encompass past work projects, but some candidates might also cite volunteer contributions, family achievements, or other accomplishments. Overall, candidates should always be prepared to discuss experiences that have contributed to their growth.

Beyond purpose statements

Many CEOs are starting to sound like politicians, throwing around lofty language that is vague and hard to pin down. And therein lies the problem, or certainly the challenge: to remain credible and trustworthy, leaders need to shift the conversation from fuzzy purpose bromides to more tangible and concrete statements about the impact their companies are having on society. That is not simply a matter of semantics, as there is a world of difference between purpose and impact. It is difficult to challenge a purpose. If a company says its reason for existing in some form or fashion is to try to make the world a better place, how can you pressure-test that claim? If that company is providing goods or services that customers are willing to pay for, and it employs people and pays vendors, then, ipso facto, it is doing something that has a perceived value. As long as it’s not doing anything criminal or unethical, it’s working “to promote the good of the people,” to borrow the language from one organization’s mission statement. But if you are claiming that you are making an impact, then you need proof. And that’s what makes a statement powerful.

Managing Expectations: Explainable A.I. and its Military Implications

AI systems can be purposefully programmed to cause death or destruction, either by the users themselves or through an attack on the system by an adversary. Unintended harm can also result from inevitable margins of error which can exist or occur even after rigorous testing and proofing of the AI system according to applicable guidelines. Indeed, even ‘regular’ operations of deployed AI systems are mired with faults that are only discoverable at the output stage. ... A primary cause for such faults is flawed training datasets and commands, which can result in misrepresentation of critical information as well as unintended biases. Another, and perhaps far more challenging, reason is issues with algorithms within the system which are undetectable and inexplicable to the user. As a result, AI has been known to produce outputs based on spurious correlations and information processing that does not follow the expected rules, similar to what is referred to in psychology as the ‘Clever Hans effect’.

POCs, Scrum, and the Poor Quality of Software Solutions

It is generally accepted that quality is the ‘reliability of a product’. ‘Reliability’ though, as we are used to think of in classical science, is the attribute of consistently getting the same results under the same conditions. In this classical view, building a Quality solution means that we should build a product that never fails. Ironically, understanding reliability this way harms Quality instead of achieving it. Aiming to build a product that never fails can only result in extremely complex systems that are hard to maintain causing Quality to degrade over time. The issue with reliability in this classical sense is the false assumption that we control all conditions, while in fact we don’t (hardware failure, network latency, external service throttling…etc.). We need to extend the meaning of reliability to also accommodate for cases when the conditions are not aligned: Quality is not only a measure of how reliable a software product is when it is up & running, but also a measure of how reliable it is when it fails.

Critical infrastructure is under attack from hackers. Securing it needs to be a priority - before it's too late

In order to protect networks – and people – from the consequences of attacks, which could be significant, many of the required security measures are among the most commonly recommended and often simplest practices. ... Cybersecurity can become more complex for critical infrastructure, particularly when dealing with older systems, which is why it's vital that those running them know their own network, what's connected to it and who has access. Taking all of this into account, providing access only when necessary can keep networks locked down. In some cases, that might mean ensuring older systems aren't connected to the outside internet at all, but rather on a separate, air-gapped network, preferably offline. It might make some processes more inconvenient to manage, but it's better than the alternative should a network be breached. Incidents like the South Staffordshire Water attack and the Florida water incident show that cyber criminals are targeting critical infrastructure more and more. Action needs to be taken sooner rather than later to prevent potentially disastrous consequences not just for organizations, but for people too.

How to Nurture Talent and Protect Your IT Stars

Anderson adds building out growth and learning opportunities starts with the CTO. “That means ensuring we have learning and training goals identified, which is used as a critical element for annual performance expectations of our IT leaders and managers, not only for themselves, but for their staff,” he says. As Court notes, the company invests internally through the LIFT University with a cadre of continuing education and augmenting with external training. “For career growth, I recommend IT teams have a close reporting or partnership to the engineering and product teams,” Anderson adds. He says the rationale for this is simple -- as employees want to perfect their craft, they need to work for and with people that understand their craft, and push them to continually learn through team, project, and program collaboration. “As we all know, the one constant is that technology is constantly evolving, so continuous learning for employees, especially our IT team, is a must,” he says. SoftServe’s Semenyshyn says that closely monitoring employee burnout is a priority across the IT industry, pointing out the advantage of the IT business in a large global company is the possibility of rotations.

Quote for the day:

"Teamwork is the secret that make common people achieve uncommon result." -- Ifeanyi Enoch Onuoha

Daily Tech Digest - July 24, 2022

AI can see things we can’t – but does that include the future?

“What we focus on is augmented intelligence for humans to take action [on],” says Radtke when I raise this concern. “We are not prescribing the action to be taken based on the insights that we get – we're trying to make sure that the human has all the necessary intelligence to drive the behavior that they need to drive. We're reporting facts back – this actually happened here, this is what has happened in the past – and you can take action based on that. It's all about driving improved safety for everyone in that area.” When I press him on the possible human rights concern and the inevitable pushback that will arise if AI is routinely used to pre-emptively police areas deemed as problematic, he answers: “I think that with every technology that's ever been out there in history there is always a way to use it for non-good. I think you have to focus on the good that it can provide and make sure that you police the non-good behavior that could happen from it.” This will entail some sort of oversight. “There are consortiums out there to help drive the ethical adoption of AI throughout the industry – we definitely keep aware of those.

RPA vs. BPA: Which approach to automation should you use?

Where BPA and RPA overlap, according to Mullakara, is the goal of eliminating human intervention in order to process multiple automation. “The whole idea of BPA was to remove people from the process and that's kind of what RPA is also aiming for. In the sense of the simple workflow automation, both can do it. RPA does it through a UI integration whereas BPA does it mostly with APIs. And you know, automating the workflow with the systems by invoking the systems,” he tells us. However, Taulli explains that automation really won’t get rid of people at this point and it will be the usual suspects that will, such as recessions. Mullakara agrees that this messaging for BPA and RPA is a common misconception and has earned both technologies quite a bad rap. “So, what you actually automate with RPA for example is tasks – it's not jobs. It's not an entire job even if it's a process. It’s not jobs, so we still need people,” he says.

All the Things a Service Mesh Can Do

Many organizations have different teams and services dispersed across different networks and regions of a given cloud. Many also have services deployed across multiple cloud environments. Securely connecting these services across different cloud networks is a highly desirable function that typically requires significant effort by network teams. In addition, limitations that require non-overlapping Classless Inter-Domain Routing (CIDR) ranges between subnets can prevent network connectivity between virtual private clouds (VPCs) and virtual networks (VNETs). Service mesh products can securely connect services running on different cloud networks without requiring the same level of effort. HashiCorp Consul, for example, supports a multidata center topology that uses mesh gateways to establish secure connections between multiple Consul deployments running in different networks across clouds. Team A can deploy a Consul cluster on EKS. Team B can deploy a separate Consul cluster on AKS. Team C can deploy a Consul cluster on virtual machines in a private on-premises data center.

Snowballing Ransomware Variants Highlight Growing Threat to VMware ESXi Environments

The proliferation of ransomware targeting ESXi systems poses a major threat to organizations using the technology, security experts have noted. An attacker that gains access to an EXSi host system can infect all virtual machines running on it and the host itself. If the host is part of a larger cluster with shared storage volumes, an attacker can infect all VMs in the cluster as well, causing widespread damage. "If a VMware guest server is encrypted at the operating system level, recovery from VMware backups or snapshots can be fairly easy," McGuffin says. '[But] if the VMware server itself is used to encrypt the guests, those backups and snapshots are likely encrypted as well." Recovering from such an attack would require first recovering the infrastructure and then the virtual machines. "Organizations should consider truly offline storage for backups where they will be unavailable for attackers to encrypt," McGuffin adds. Vulnerabilities are another factor that is likely fueling attacker interest in ESXi. VMware has disclosed multiple vulnerabilities in recent months.

5 typical beginner mistakes in Machine Learning

Tree-based models don’t need data normalization as feature raw values are not used as multipliers and outliers don’t impact them. Neural Networks might not need the explicit normalization as well — for example, if the network already contains the layer handling normalization inside (e.g. BatchNormalization of Keras library). And in some cases, even Linear Regression might not need data normalization. This is when all the features are already in similar value ranges and have the same meaning. For example, if the model is applied for the time-series data and all the features are the historical values of the same parameter. In practice, applying unneeded data normalization won’t necessarily hurt the model. Mostly, the results in these cases will be very similar to skipped normalization. However, having additional unnecessary data transformation will complicate the solution and will increase the risk of introducing some bugs.

Git for Network Engineers Series – The Basics

Version control systems, primarily Git, are becoming more and more prevalent outside of the realm of software development. The increase in DevOps, network automation, and infrastructure as code practices over the last decade has made it even more important to not only be familiar with Git, but proficient with it. As teams move into the realm of infrastructure as code, understanding and using Git is a key skill. ... Unlike other Version Control Systems, Git uses a snapshot method to track changes instead of a delta-based method. Every time you commit in Git, it basically takes a snapshot of those files that have been changed while simply linking unchanged files to a previous snapshot, efficiently storing the history of the files. Think of it as a series of snapshots where only the changed files are referenced in the snapshot, and unchanged files are referenced in previous snapshots. Git operations are local, for the most part, meaning it does not need to interact with a remote or central repository.

Deep learning delivers proactive cyber defense

The timing couldn’t be better. The increasing availability of ransomware-as-a-service offerings, such as ransomware kits and target lists, are making it easier than ever for bad actors—even those with limited experience—to launch a ransomware attack, causing crippling damage in the very first moments of infection. Other sophisticated attackers use targeted strikes, in which the ransomware is placed inside the network to trigger on command. Another cause for concern is the increasing disappearance of an IT environment’s perimeter as cloud compute storage and resources move to the edge. Today’s organizations must secure endpoints or entry points of end-user devices, such as desktops, laptops, and mobile devices, from being exploited by malicious hackers—a challenging feat, according to Michael Suby, research vice president, security and trust, at IDC. “Attacks continue to evolve, as do the endpoints themselves and the end users who utilize their devices,” he says. “These dynamic circumstances create a trifecta for bad actors to enter and establish a presence on any endpoint and use that endpoint to stage an attack sequence.”

Towards Geometric Deep Learning III: First Geometric Architectures

The neocognitron consisted of interleaved S- and C-layers of neurons (a naming convention reflecting its inspiration in the biological visual cortex); the neurons in each layer were arranged in 2D arrays following the structure of the input image (‘retinotopic’), with multiple ‘cell-planes’ (feature maps in modern terminology) per layer. The S-layers were designed to be translationally symmetric: they aggregated inputs from a local receptive field using shared learnable weights, resulting in cells in a single cell-plane have receptive fields of the same function, but at different positions. The rationale was to pick up patterns that could appear anywhere in the input. The C-layers were fixed and performed local pooling (a weighted average), affording insensitivity to the specific location of the pattern: a C-neuron would be activated if any of the neurons in its input are activated. Since the main application of the neocognitron was character recognition, translation invariance was crucial.

Don’t Just Climb the Ladder. Explore the Jungle Gym

Most of us do not approach work (or life) with a master plan in mind, and many of the steps we take are beautiful accidents that help us become who we are. “I’m 67 years old,” Guy said, “and I think I finally found my true calling.” He was referring to his podcast, Remarkable People, where he interviews exceptional leaders and innovators (think Jane Goodall, Neil deGrasse Tyson, Steve Wozniak, and Kristi Yamaguchi) about how they got to be remarkable. “In a sense, my whole career has prepared me for this moment. I’ve had decades of experience in startups and large companies. So that gives me the data to ask great questions that my listeners really want the answers to,” Guy said. Guy is undeniably brilliant, and his success is no accident. But still, he believes that luck has played a part in his success. In his words, “Basically, I’ve come to the conclusion that it’s better to be lucky than smart.” Maybe Guy is right. Or perhaps, the smartest people know when to take advantage of luck and act on the opportunities that present themselves. Whatever the case, it’s important to take calculated risks.

Should You Invest in a Digital Transformation Office?

With the digital transformation office comes a transformation team, who initiates organizational change. Laute says that it’s crucial that everyone inside the organization stand behind the transformation team if they truly want to see changes happening. “You need to have an environment where these people, the transformation lead and the transformation team, are allowed and are not afraid to speak up. These people shouldn't be biased, not just following what the executive board says, but really [being] able to challenge and to speak up. And they should have the freedom to call out if something is going in the wrong direction, may it be content or behavioral-wise,” she explains. And while clearly there can be technology-related challenges, Laute tells us that digital transformation is also a people problem, and calls for a change in culture and mindset in order to find success. The cultural shift, she explains, is truly where everything starts to come together in order to get the transformation going. “Digital [transformation] is not only technology. You need to change behaviors and you need to change processes. And most of the time, you change your target operating model, right?”

Quote for the day:

"Uncertainty is a permanent part of the leadership landscape. It never goes away." -- Andy Stanley