Daily Tech Digest by Kannan Subbiah: smart factory

Showing posts with label smart factory. Show all posts

Daily Tech Digest - June 14, 2026

Quote for the day:

“If you think compliance is expensive, try non‑compliance.” -- Paul McNulty

🎧 Listen to this digest on YouTube Music

Duration: 24 mins • Perfect for listening on the go.

Segmentation Works for OT If Operators Are Paying Attention

Network segmentation remains a foundational strategy for securing operational technology, but its ultimate effectiveness relies heavily on active and continuous human oversight. Many organizations mistakenly view network segmentation as a static, one-time project designed during a workshop, rather than as an ongoing operational practice that evolves over time. This fixed mindset creates dangerous security gaps, as real-world industrial environments change quickly while network diagrams remain completely outdated. Furthermore, the practical execution of traditional segmentation and newer microsegmentation models faces severe real-world hurdles. Traditional firewalls are frequently undermined by user convenience workarounds, such as technicians introducing unmanaged, internet-connected personal laptops onto the factory floor, or by unpatched vulnerabilities within the firewalls themselves. Meanwhile, microsegmentation is regularly impossible to implement because older legacy infrastructure cannot accommodate security software agents or survive the disruptive downtime required for vital updates. Compounding the issue, companies often overuse segmentation by dumping too many diverse industrial systems into a single isolated zone, meaning one compromised machine can expose the entire segment. To fix these systemic flaws, security experts recommend adopting enforceable policies that continuously verify user access. Operators must look past static blueprints, regularly auditing endpoint logs and identifying unrecognizable addresses to catch unauthorized connections before clever attackers can exploit them.

In Conversation with Simon Stone and Simon Barrows: Adventures in Architecture as Code

As organizations grow in scale and speed, traditional architecture diagrams often become outdated, subjective, and disconnected from actual operations. A recent interview with Simon Stone and Simon Barrows explores the transition from relying on these static diagrams to adopting Architecture as Code, a method that treats architectural knowledge as living, version-controlled data. This shift is increasingly practical today because modern artificial intelligence can efficiently gather and organize data from various scattered sources. By keeping architecture as structured data, teams can automatically generate up-to-date diagrams on demand, test for consistency, and cleanly link business strategies directly to technology investments. This approach changes the architect's role from drawing static pictures to managing data quality, working more like a software engineer. Instead of constantly updating documents, architects can rely on automated tests for routine checks and focus their time on complex decisions. However, converting old, fragmented documents into a single, reliable dataset remains a significant challenge. To succeed, the speakers advise starting small. Rather than attempting a massive overhaul all at once, organizations should identify a specific, high-value problem to solve first. By focusing on a clear initial use case, companies can build a solid foundation and gradually expand their structured architecture, ultimately creating a more transparent, efficient, and well-aligned technical environment.

10 Indispensable Prompts Our Team Refuses to Build Without

The recent Google Cloud blog post highlights a collection of practical prompts that their engineering teams rely on to build better software. Rather than using AI just to write code faster, these developers use specific prompts to challenge their own assumptions and catch mistakes early. The shared prompts cover a wide range of everyday programming tasks. For example, some developers ask the AI to act as a strict architect to help refine product requirements without making the design too complex. Others use it to run thorough code reviews, instructing the tool to grade their work on a harsh scale to ensure systems are truly reliable. There are also prompts designed to build testing plans, clean up unused code and forgotten comments, check software permissions for compliance, and weigh the pros and cons of different technical choices. Additionally, the team uses prompts to automatically review code changes and identify potential flaws in code that was generated by AI itself. Ultimately, the article suggests that treating AI as a critical partner rather than a simple code generator helps developers release software with greater confidence. By routinely asking hard questions and checking for hidden weaknesses, engineering teams can improve the overall quality of their work and avoid unexpected failures.

AI Governance in Enterprise Adoption: Why Trust Will Define the Next Wave of Innovation

Artificial intelligence is steadily moving from isolated experiments into the daily operations of the financial services sector. As companies integrate these systems into everything from fraud detection to customer service, the primary challenge is no longer about the technology itself, but rather about building institutional trust. With the arrival of more autonomous systems, financial organizations must handle complex new risks that go beyond simple technical errors. These risks involve broad operational dependencies, data security, and the complications of unapproved tool usage by employees. Because of this, companies are shifting away from unrestricted public tools and moving toward carefully governed internal environments. Setting clear rules and maintaining structured oversight should not be viewed as an obstacle to progress. Instead, sensible governance provides the necessary foundation for organizations to innovate safely and reliably. By establishing clear boundaries and maintaining accountability, businesses give their teams the confidence to adopt new capabilities while assuring regulators and customers that their data remains secure. Ultimately, the companies that succeed in this new landscape will not necessarily be the fastest to implement the latest tools. They will be the ones that recognize safe, transparent, and continuous oversight as a strategic advantage, proving that responsible management is a fundamental requirement for sustainable growth in modern finance.

Rethinking MDR as Attackers and Defenders Embrace AI

Traditional managed detection and response models are struggling to keep pace with modern cybersecurity threats. Historically, these services relied on human analysts to monitor networks and investigate potential issues. However, as attackers increasingly use advanced automation to launch faster and more complex campaigns, human-led teams simply cannot process the massive volume of alerts generated daily. Because of this, analysts are forced to prioritize severe warnings, leaving roughly sixty percent of alerts unreviewed. Unfortunately, attackers know this and deliberately hide their activity within these overlooked, low-severity notifications. Furthermore, the quality of human investigation can vary depending on shift times and workload, leading to inconsistent security outcomes. To address these vulnerabilities, organizations are moving toward automated systems. In this new approach, computers automatically investigate every single alert, regardless of its initial severity rating or the time of day. Instead of acting as a simple filter, the system conducts a deep, technical analysis of all warnings in seconds, providing a consistent and thorough review. This allows human security teams to shift their focus from manual discovery to making informed decisions based on the system's verified findings. Ultimately, adopting this automated approach ensures complete alert coverage, eliminates blind spots, and provides organizations with full ownership of their own network data.

The Intelligent Factory: Navin Nathani on How Manufacturing’s Next Competitive Edge Is Being Built on Data, Resilience, and Industrial AI

In modern manufacturing, competitive advantage no longer relies solely on scale and cost, but on the speed and quality of broad company decisions. Navin Nathani emphasizes that navigating current disruptions requires connected operations rather than delayed reporting. To achieve this, technology is shifting from a supportive background function to the core operating system of the business. Organizations are focusing on practical technology updates, such as modernizing resource planning software and moving information storage to the internet. These practical upgrades establish stability and build trust among employees, making them more open to further changes. As office networks and factory machinery converge, manufacturing plants become more connected, which necessitates a stronger focus on security to protect production from emerging online threats. Furthermore, the industry is gradually adopting artificial intelligence for specific applications like anticipating equipment repairs and better supply planning. Rather than serving as a replacement for human workers, this technology acts as a useful assistant that helps identify patterns and prevent equipment failures before they occur. However, successful implementation relies heavily on maintaining disciplined processes and accurate data. Ultimately, the future of manufacturing lies in using connected information to shift from reacting to problems to preventing them, ensuring that daily operations remain stable in an unpredictable environment.

Knowing When To Let Go Is A Leadership Skill

In her article, Kendra MacDonald explains that true leadership requires knowing when to persevere and when to simply let go. Drawing from her personal experiences with family planning, she notes that while society often celebrates grit and determination, effective leaders must also exercise clear judgment. They need to recognize whether their ongoing efforts are actually helpful or just delaying an inevitable outcome. MacDonald highlights that some situations and relationships cannot be repaired, and forcing people to agree is not always the answer. Instead, she advises leaders to accept differences as realities rather than problems to solve. When setbacks occur, it is essential to learn from them without taking the failure personally or letting emotions cloud objective facts. Furthermore, she stresses the importance of facing difficult conversations directly, as avoiding them only prolongs frustration for everyone involved. Honest communication, even when disappointing, is far more useful than giving false hope. Most importantly, MacDonald points out that holding onto the wrong opportunity or strategy drains team energy. By walking away from poorly fitting client relationships or unworkable strategies, leaders create space for fresh ideas and better matches. Ultimately, stepping back from a failing path is not a lack of resilience; rather, it is often the clearest demonstration of confident leadership.

The Real Cost of Unclear Technology Ownership

Unclear technology ownership is a direct threat to a company's operational stability and financial health. When no single person is accountable for a specific technology, organizations suffer from chronic delays, wasted spending, and repeated audit failures. Teams might look busy with meetings and project updates, but without a clear decision maker, this activity often hides a lack of actual progress. The costs show up as hidden labor, duplicated efforts, and lingering security vulnerabilities. This lack of ownership usually breaks down in critical areas like access management, data reporting, and vendor relationships. When systems fail or security incidents occur, fragmented responsibility means no one knows who should act first. As a result, small problems quickly escalate into costly crises. Furthermore, when executives and board members receive vague answers or see the same issues repeatedly, they quickly lose trust in the team's ability to manage risk. To fix this, companies do not need massive new programs. Instead, they must assign one accountable executive to each major risk area and give them the real authority to make decisions and control budgets. Organizations should establish a clear path for reporting bad news and ensure that board updates focus on actionable decisions rather than just listing activities. Clear ownership replaces confusion with stable, reliable progress.

AI Is Here to Stay. The Real Challenge Is Operating It Securely

Artificial intelligence is now a standard tool for writing software, with AI-generated code already running in major projects like OpenStack. However, its rapid adoption introduces significant operational and security challenges. Because AI produces code so quickly, human reviewers struggle to keep up, making it harder to ensure software remains secure and maintainable. Even more concerning is the rise of autonomous AI agents. Organizations often grant these agents broad permissions to access production environments, ignoring decades of security practices like the principle of least privilege. While AI capabilities advance rapidly, security features like containment and auditing lag behind. To operate AI securely, teams must apply proven engineering practices. First, organizations should use automated gating systems like Zuul. By testing how new code interacts with dependencies before it merges, gating prevents errors from reaching production. This acts as a vital check against the high volume of AI-written code. Second, teams should use strong hardware isolation, such as Kata Containers, to protect sensitive information. Standard containers share a core operating system, posing security risks in shared environments. Kata provides lightweight virtual machine isolation, ensuring data processed by an agent remains secure. Ultimately, enforcing strict access limits, adopting automated quality checks, and maintaining reliable backups are essential steps for operating AI safely.

Security in the Post-Mythos Era

The emergence of advanced artificial intelligence capable of instantly discovering and exploiting software vulnerabilities has fundamentally shifted the timeline of cybersecurity. While the core principles of network defense remain unchanged, the sheer speed at which new threats materialize means organizations can no longer rely on software patching as their primary shield. Because AI systems can weaponize flaws in minutes, human-driven patching cycles simply cannot keep pace. To survive, organizations must adopt a layered strategy that holds strong when patching inevitably falls behind. The first critical step is returning to basic system hardening. This means strictly enforcing multi-factor authentication, removing unnecessary network services, and dividing networks into isolated segments to prevent attackers from moving freely. When preventive measures fail, robust detection and response systems serve as the vital safety net. Security teams must assume some attacks will break through and focus on identifying the behavioral signs of an intruder, rather than relying solely on known threat lists. Finally, organizations must actively test these defenses. Regularly checking network boundaries and practicing response plans ensures that controls work in reality, not just on paper. AI has accelerated the speed of risk, making foundational preparation and rigorous testing the most reliable path to security.

Daily Tech Digest - July 09, 2025

Quote for the day:

"Whenever you see a successful person you only see the public glories, never the private sacrifices to reach them." -- Vaibhav Shah

Why CIOs see APIs as vital for agentic AI success

API access also goes beyond RAG. It allows agents and their underlying language models not just to retrieve information, but perform database mutations and trigger external actions. This shift allows agents to carry out complex, multi-step workflows that once required multiple human touchpoints. “AI-ready APIs paired with multi-agentic capabilities can unlock a broad range of use cases, which have enterprise workflows at their heart,” says Milind Naphade, SVP of technology and head of AI foundations at Capital One. In addition, APIs are an important bridge out of previously isolated AI systems. ... AI agents can make unprecedented optimizations on the fly using APIs. Gartner reports that PC manufacturer Lenovo uses a suite of autonomous agents to optimize marketing and boost conversions. With the oversight of a planning agent, these agents call APIs to access purchase history, product data, and customer profiles, and trigger downstream applications in the server configuration process. ... But the bigger wins will likely be increased operational efficiency and cost reduction. As Fox describes, this stems from a newfound best-of-breed business agility. “When agentic AI can dynamically reconfigure business processes, using just what’s needed from the best-value providers, you’ll see streamlined operations, reduced complexity, and better overall resource allocation,” she says.

What we can learn about AI from the ‘dead internet theory’

The ‘dead internet theory,’ or the idea that much of the web is now dominated by bots and AI-generated content, is largely speculative. However, the concern behind it is worth taking seriously. The internet is changing, and the content that once made it a valuable source of knowledge is increasingly diluted by duplication, misinformation, and synthetic material. For the development of artificial intelligence, especially large language models (LLMs), this shift presents an existential problem. ... One emerging model for collecting and maintaining this kind of data is Knowledge as a Service (KaaS). Rather than scraping static sources, KaaS creates a living, structured ecosystem of contributions from real users (often experts in their fields) who continuously validate and update content. This approach takes inspiration from open-source communities but remains focused on knowledge creation and maintenance rather than code. KaaS supports AI development with a sustainable, high-quality stream of data that reflects current thinking. It’s designed to scale with human input, rather than in spite of it. ... KaaS helps AI stay relevant by providing fresh, domain-specific input from real users. Unlike static datasets, KaaS adapts as conditions change. It also brings greater transparency, illustrating directly how contributors’ inputs are utilised. This level of attribution represents a step toward more ethical and accountable AI.

The Value of Threat Intelligence in Ensuring DORA Compliance

One of the biggest challenges for security teams today is securing visibility into third-party providers within their ecosystem due to their volume, diversity, and the constant monitoring required. Utilising a Threat Intelligence Platform (TIP) with advanced capabilities can enable a security team to address this gap by monitoring and triaging threats within third-party systems through automation. It can flag potential signs of compromise, vulnerabilities, and risky behaviour, enabling organisations to take pre-emptive action before risks escalate and impact their systems. ... A major aspect of DORA is implementing a robust risk management framework. However, to keep pace with global expansion and new threats and technologies, this framework must be responsive, flexible, and up-to-date. Sourcing, aggregating, and collating threat intelligence data to facilitate this is a time-exhaustive task, and unfeasible for many resource-stretched and siloed security teams. ... From tabletop scenarios to full-scale simulations, these exercises evaluate how well systems, processes, and people can withstand and respond to real-world cyber threats. With an advanced TIP, security teams can leverage customisable workflows to recreate specific operational stress scenarios. These scenarios can be further enhanced by feeding real-world data on attacker behaviours, tactics, and trends, ensuring that simulations reflect actual threats rather than outdated risks.

Why your security team feels stuck

The problem starts with complexity. Security stacks have grown dense, and tools like EDR, SIEM, SOAR, CASB, and DSPM don’t always integrate well. Analysts often need to jump between multiple dashboards just to confirm whether an alert matters. Tuning systems properly takes time and resources, which many teams don’t have. So alerts pile up, and analysts waste energy chasing ghosts. Then there’s process friction. In many organizations, security actions, especially the ones that affect production systems, require multiple levels of approval. On paper, that’s to reduce risk. But these delays can mean missing the window to contain an incident. When attackers move in minutes, security teams shouldn’t be stuck waiting for a sign-off. ... “Security culture is having a bit of a renaissance. Each member of the security team may be in a different place as we undertake this transformation, which can cause internal friction. In the past, security was often tasked with setting and enforcing rules in order to secure the perimeter and ensure folks weren’t doing risky things on their machines. While that’s still part of the job, security and privacy teams today also need to support business growth while protecting customer data and company assets. If business growth is the top priority, then security professionals need new tools and processes to secure those assets.”

Your data privacy is slipping away. Here's why, and what you can do about it

In 2024, the Identity Theft Resource Center reported that companies sent out 1.3 billion notifications to the victims of data breaches. That's more than triple the notices sent out the year before. It's clear that despite growing efforts, personal data breaches are not only continuing, but accelerating. What can you do about this situation? Many people think of the cybersecurity issue as a technical problem. They're right: Technical controls are an important part of protecting personal information, but they are not enough. ... Even the best technology falls short when people make mistakes. Human error played a role in 68% of 2024 data breaches, according to a Verizon report. Organizations can mitigate this risk through employee training, data minimization—meaning collecting only the information necessary for a task, then deleting it when it's no longer needed—and strict access controls. Policies, audits and incident response plans can help organizations prepare for a possible data breach so they can stem the damage, see who is responsible and learn from the experience. It's also important to guard against insider threats and physical intrusion using physical safeguards such as locking down server rooms. ... Despite years of discussion, the U.S. still has no comprehensive federal privacy law. Several proposals have been introduced in Congress, but none have made it across the finish line.

How To Build Smarter Factories With Edge Computing

According to edge computing experts, these are essentially rugged versions of computers, of any size, purpose-built for their harsh environments. Forget standard form factors; industrial edge devices come in varied configurations specific to the application. This means a device shaped to fit precisely where it’s needed, whether tucked inside a machine or mounted on a factory wall. ... What makes these tough machines intelligent? It’s the software revolution happening on factory floors right now. Historically, industrial computing relied on software specially built to run on bare metal; custom code directly installed on specific machines. While this approach offered reliability and consistent, deterministic performance, it came with significant limitations: slow development cycles, difficult updates and vendor lock-in. ... Communication between smart devices presents unique challenges in industrial environments. Traditional networking approaches often fall short when dealing with thousands of sensors, robots and automated systems. Standard Wi-Fi faces significant constraints in factories where heavy machinery creates electromagnetic interference, and critical operations can’t tolerate wireless dropouts.

Fighting in a cloudy arena

“There are a few primary problems. Number one is that the hyperscalers leverage free credits to get digital startups to build their entire stack on their cloud services,” Cochrane says, adding that as the startups grow, the technical requirements from hyperscalers leave them tied to that provider. “The second thing is also in the relationship they have with enterprises. They say, ‘Hey, we project you will have a $250 million cloud bill, we are going to give you a discount.’ Then, because the enterprise has a contractual vehicle, there’s a mad rush to use as much of the hyperscalers compute as possible because you either lose it or use it. “At the end of the day, it’s like the roach motel. You can check in, but you can’t check out,” he sums up. ... "We are exploring our options to continue to fight against Microsoft’s anti competitive licensing in order to promote choice, innovation, and the growth of the digital economy in Europe." Mark Boost, CEO of UK cloud company Civo, said: ”However they position it, we cannot shy away from what this deal appears to be: a global powerful company paying for the silence of a trade body, and avoiding having to make fundamental changes to their software licensing practices on a global basis.” In the months that followed this decision, things got interesting.

How passkeys work: The complete guide to your inevitable passwordless future

Passkeys are often described as a passwordless technology. In order for passwords to work as a part of the authentication process, the website, app, or other service -- collectively referred to as the "relying party" -- must keep a record of that password in its end-user identity management system. This way, when you submit your password at login time, the relying party can check to see if the password you provided matches the one it has on record for you. The process is the same, whether or not the password on record is encrypted. In other words, with passwords, before you can establish a login, you must first share your secret with the relying party. From that point forward, every time you go to login, you must send your secret to the relying party again. In the world of cybersecurity, passwords are considered shared secrets, and no matter who you share your secret with, shared secrets are considered risky. ... Many of the largest and most damaging data breaches in history might not have happened had a malicious actor not discovered a shared password. In contrast, passkeys also involve a secret, but that secret is never shared with a relying party. Passkeys are a form of Zero Knowledge Authentication (ZKA). The relying party has zero knowledge of your secret, and in order to sign in to a relying party, all you have to do is prove to the relying party that you have the secret in your possession.

Crafting a compelling and realistic product roadmap

The most challenging aspect of roadmap creation is often prioritization. Given finite resources, not everything can be built at once. Effective prioritization requires a clear framework. Common methods include scoring features based on business value versus effort, using frameworks like RICE, or focusing on initiatives that directly address key strategic objectives. Be prepared to say “no” to good ideas that don’t align with current priorities. Transparency in this process is vital. Communicate why certain items are prioritized over others to stakeholders, fostering understanding and buy-in, even when their preferred feature isn’t immediately on the roadmap. ... A product roadmap is a living document, not a static contract. The B2B software landscape is constantly evolving, with new technologies emerging, customer needs shifting, and competitive pressures mounting. A realistic roadmap acknowledges this dynamism. While it provides a clear direction, it should also be adaptable. Plan for regular reviews and updates – quarterly or even monthly – to adjust based on new insights, validated learnings, and changes in the market or business environment. Embrace iterative development and be prepared to pivot or adjust priorities as new information comes to light.

Are software professionals ready for the AI tsunami?

Modern AI assistants can translate plain-English prompts into runnable project skeletons or even multi-file apps aligned with existing style guides (e.g., Replit). This capability accelerates experimentation and learning, especially when teams are exploring unfamiliar technology stacks. A notable example is MagicSchool.com, a real-world educational platform created using AI-assisted coding workflows, showcasing how AI can powerfully convert conceptual prompts into usable products. These tools enable rapid MVP development that can be tested directly with customers. Once validated, the MVP can then be scaled into a full-fledged product. Rapid code generation can lead to fragile or opaque implementations if teams skip proper reviews, testing, and documentation. Without guardrails, it risks technical debt and poor maintainability. To stay reliable, agile teams must pair AI-generated code with sprint reviews, CI pipelines, automated testing, and strategies to handle evolving features and business needs. Recognising the importance of this shift, tech giants like Amazon (CodeWhisperer) and Google (AlphaCode) are making significant investments in AI development tools, signaling just how central this approach is becoming to the future of software engineering.

Daily Tech Digest - February 06, 2025

Quote for the day:

"Success is liking yourself, liking what you do, and liking how you do it." -- Maya Angelou

Here’s How Standardization Can Fix the Identity Security Problem

Fragmentation in identity security doesn’t only waste resources, it also leaves businesses exposed to threat actors, leading to potential reputational and financial damage if systems are compromised. Misconfigurations often arise when teams are pressured to deliver quickly without adequate frameworks. Fragmentation also forces teams to juggle mismatched tools, creating gaps in oversight. These gaps become weak points for attackers, leading to cascading failures. ... Standardization transforms the complexity of identity management into a straightforward, structured process. Instead of piecing together bespoke solutions, leveraging established frameworks can deliver robust, scalable and future-proof security. ... Developers often need to weigh short-term challenges against long-term gains. Adopting standardized identity frameworks is one decision where the long-term benefits are clear. Increased efficiency, security and scalability contribute to a more sustainable development process. Standardization equips us with ready-to-use solutions for essential features, freeing us to focus on innovation. It also enables applications to meet compliance requirements without added strain on teams. By investing in frameworks like IPSIE, we can future-proof our systems while reducing the burden on individual developers.

How Data Contracts Support Collaboration between Data Teams

Data contracts are what APIs are for software systems, Christ said. They are an interface specification between a data provider and their data consumers. Data contracts specify the provided data model with the syntax, format, and semantics, but also contain data quality guarantees, service-level objectives, and terms and conditions for using the data, Christ mentioned. They also define the owner of the provided data product that is responsible if there are any questions or issues, he added. Data mesh is an important driver for data contracts, as data mesh introduces distributed ownership of data products, Christ said. Before that, we usually had just one central team that was responsible for all data and BI activities, with no need to specify interfaces with other teams. ... Data providers benefit by gaining visibility into which consumers are accessing their data. Permissions can be automated accordingly, and when changes need to be implemented in a data product, a new version of the data contract can be introduced and communicated with the consumers, Christ said. With data contracts, we have very high-quality metadata, Christ said. This metadata can be further leveraged to optimize governance processes or build an enterprise data marketplace, enabling better discoverability, transparency, and automated access management across the organization to make data available for more teams.

How Agentic AI will be Weaponized for Social Engineering Attacks

To combat advanced social engineering attacks, consider building or acquiring an AI agent that can assess changes to the attack surface, detect irregular activities indicating malicious actions, analyze global feeds to detect threats early, monitor deviations in user behavior to spot insider threats, and prioritize patching based on vulnerability trends. ... Security awareness training is a non-negotiable component to bolstering human defenses. Organizations must go beyond traditional security training and leverage tools that can do things like assign engaging content to users based on risk scores and failure rates, dynamically generate quizzes and social engineering scenarios based on the latest threats, trigger bite-sized refreshers, etc. ... Human intuition and vigilance are critical in combating social engineering threats. Organizations must double down on fostering a culture of cybersecurity, educating employees on the risks of social engineering and the impact on the organization, training to identify and report such threats, and empowering them with tools that can improve security behavior. Gartner predicts that by 2028, a third of our interactions with AI will shift from simply typing commands to fully engaging with autonomous agents that can act on their own goals and intentions. Obviously, cybercriminals won’t be far behind in exploiting these advancements for their misdeeds.

Strengthening cloud security strategies in India: Addressing evolving cyber threats and leveraging AI for protection

As businesses expand their cloud services and integrate AI, IoT, and other digital tools, the attack surface grows exponentially. Cybercriminals are exploiting this vast surface with increasingly sophisticated tactics, including AI-driven attacks that can bypass traditional security measures. Lack of visibility across multicloud environments: Many businesses rely on a combination of private, public, and hybrid cloud solutions, which can create visibility gaps. Security teams struggle to manage and monitor resources across various platforms, making it difficult to detect vulnerabilities or respond to threats in real time. Misconfigurations and human error: Cloud misconfigurations remain one of the leading causes of data breaches. ... Ongoing risk assessments are essential for identifying vulnerabilities and understanding the potential attack vectors in cloud environments. Regular penetration testing can help organisations identify and patch security gaps proactively. These assessments, combined with continuous monitoring, ensure the security posture evolves alongside emerging threats. Centralised threat detection and response: Implementing a centralised security platform that aggregates data from multiple cloud environments can streamline threat detection and response. By correlating network events with cloud activities, security teams can gain deeper insights into potential risks and reduce the mean time to resolution (MTTR) for incidents.

Is 2025 the year of quantum computing?

As quantum computing research gradually inches toward real-world usability, you might wonder where we’ll see the impacts of this technology, both short- and long-term. One of the most immediately important areas is cryptography. Since a quantum computer can take on many states simultaneously, something like factoring large numbers can proceed in parallel, relying on the superposition of particle states to explore many possible outcomes at once. There is also a tantalizing potential for cross-over between machine learning and quantum computing. Here, the probabilistic nature of neural networks and AI in general seems to lend itself to being modeled at a more fundamental level, and with far greater efficiency, using the hardware capabilities of quantum computers. How powerful would an AI system be if it rested on quantum hardware? Another area is the development of alternative energy sources, including fusion. Using matter itself to model reality opens up possibilities we can’t yet fully predict. Drug discovery and material design are also areas of interest for quantum calculations. At the hardware level, quantum systems allow us to use matter itself to model the complexity of designing useful matter. These and other exciting developments, especially in error correction, seem to indicate quantum computing’s time is finally coming.

The overlooked risks of poor data hygiene in AI-driven organizations

A significant risk posed by AI-enabled apps is called ‘AI oversharing,’ where enterprise applications expose sensitive information through poorly defined access controls. This is especially prevalent in retrieval-augmented generation (RAG) applications when original source permissions aren’t honoured throughout the system. Imagine for a minute if you were an enterprise with millions of documents that contain decades of enterprise knowledge and you wanted to leverage AI through a RAG-based architecture. A typical approach is to load all of those documents into a vector database. If you exposed that data through an AI chatbot without honouring the original permissions on those documents, then anyone issuing a prompt could access any of that data. ... Organizations need to implement a methodical process for assessing and preparing data for AI applications, as sophisticated attacks like prompt injection and unauthorized data access become more prevalent. Begin with a thorough inventory of your data stores, including file and documents stores, support and ticketing system, and any other data sources that you’ll source your enterprise data from. Then work to understand its potential use in AI applications and identify critical gaps or inconsistencies.

Who Is Attacking Smart Factories? Understanding the Evolving Threat Landscape

Cybercriminals no longer rely on broad, generalized attacks but have begun to tailor their malware specifically for OT systems. For example, they know which files on engineering workstations or MES systems are most important for production and will specifically target them for encryption. This shift has also seen an increase in multi-vector attacks. Attackers might gain initial access through phishing emails but, once inside, use tools that enable them to move seamlessly between IT and OT networks. The goal is no longer just to hold data hostage but to encrypt or destroy files that are crucial to the manufacturing process. With this targeted approach, attackers increase the likelihood that companies will pay the ransom, especially when systems critical to production are held hostage. ... The increasing sophistication of these attacks highlights the need for manufacturers to adopt a holistic approach to cybersecurity. While technical countermeasures like firewalls, endpoint security, and intrusion detection systems are important, they are not enough on their own. A comprehensive security strategy must address both IT and OT environments and recognize the interdependence between these systems. Manufacturers should focus on risk assessment across their entire value chain, from the factory floor to the supply chain and customer-facing systems.

Legislators demand truth about OPM email server

Erik Avakian, security counselor at Info-Tech Research Group said the “recent development regarding OPM and the alleged issues regarding an email server being deployed on the agency network and emails being distributed by the agency to federal employees raise potential security and privacy concerns that, if substantiated, could be out of sync with well-defined cybersecurity best practices and privacy regulations.” Most important, he said, would be the way in which the system had been deployed onto the federal network, “particularly in light of the many existing US federal government-required processes, procedures, and checks a system would need to undergo before receiving green light approval for such a fast-tracked deployment. There could be fast-track processes in place for such instances.” However, even in such cases, said Avakian, “any deployment of systems or tools would certainly, as best practice, need to be reviewed for security vulnerabilities, and its architecture checked and hardened, at a minimum, to be aligned with the federal security requirements for systems deployed on the network prior to going live.” The question would be whether the processes were followed, he said. “In any case, there could be quite a checklist of issues regarding Compliance with Cybersecurity Frameworks, Best Practices, and the Federal Government’s Memo regarding the Implementation of Zero Trust, to name a few, as well as numerous privacy laws.”

Open-Source AI: Power Shift or Pandora's Box?

"This is no longer just a technological race, it’s a geopolitical one. While open-source models offer accessibility, their full training pipeline and datasets often remain undisclosed. Nations are using AI to influence global markets, trade policies and digital sovereignty," said Amitkumar Shrivastava, global distinguished engineer and head of AI at Fujitsu Consulting India. "The real winners will be those who balance innovation with regulatory foresight and ethical AI practices." While open-source AI fosters innovation, it also raises concerns about security, compliance and ethical risks. Increased accessibility introduces challenges such as misinformation, deepfake generation and unauthorized automation. "DeepSeek is open-source, which is very important, as it allows users to download the models and run them on their own hardware if they have the capacity. We are already seeing others create local installations of DeepSeek models even without GPUs," Professor Balaraman Ravindran, IIT Madras, wrote in his blog. "Assuming that DeepSeek's claims on infrastructure reductions are true, some researchers are still not fully convinced and are in the process of verifying the claims. There will be an immediate breakdown of the monopolistic hold of a few technology giants with deep pockets to control the AI market - much like India developing cheap Corona vaccine," said Dr. Sanjeev Kumar.

The Cost of AI Security

The cost of AI and its security needs is going to be an ongoing conversation for enterprise leaders. “It’s still so early in the cycle that most security organizations are trying to get their arms around what they need to protect, what’s actually different. What do [they] already have in place that can be leveraged?” says Saeedi. Who is a part of these evolving conversations? CISOs, naturally, have a leading role in defining the security controls applied to an enterprise’s AI tools, but given the growing ubiquity of AI a multistakeholder approach is necessary. Other C-suite leaders, the legal team, and the compliance team often have a voice. Saeedi is seeing cross-functional committees forming to assess AI risks, implementation, governance, and budgeting. As these teams within enterprises begin to wrap their heads around various AI security costs, the conversation needs to include AI vendors. “The really key part for any security or IT organization, when [we’re] talking with the vendor is to understand, ‘We’re going to use your AI platform but what are you going to do with our data?’” Is that vendor going to use an enterprise’s data for model training? How is that enterprise’s data secured? How does an AI vendor address the potential security risks associated with the implementation of its tool?

Daily Tech Digest - July 06, 2022

10 Things You Are Not Told About Data Science

Many data scientists become disillusioned when they are hired for statistics and machine learning, but instead find themselves being the resident “IT expert” instead. This phenomena is not new and actually predates data science. Shadow information technology (shadow IT) describes office workers who create systems outside their IT department. This includes databases, dashboards, scripts, and code. This used to be frowned on in organizations, as it is unregulated and operating outside the IT department’s scope of control. However, one benefit of the data science movement is it has made shadow IT more accepted as a necessity for innovation. Rather than be disillusioned, a data scientist can gain proficiency in SQL, programming, cloud platforms, web development, and other useful technologies. After all, a data scientist works with data and that implicitly can lead to IT-work. It can also make their work streamlined and more accessible to others, and open up possibilities for statistical and machine learning models.

The connected nature of smart factories is exponentially increasing the risk of cyber attacks

The research found that, for many organizations, cybersecurity is not a major design factor; only 51% build cybersecurity practices in their smart factories by default. Unlike IT platforms, all organizations may not be able to scan machines at a smart factory during operational uptime. System-level visibility of IIoT and OT devices is essential to detect when they have been compromised; 77% are concerned about the regular use of non-standard smart factory processes to repair or update OT/IIOT systems. This challenge partly originates from the low availability of the correct tools and processes, however 51% of organizations, said that smart factory cyberthreats primarily originate from their partner and vendor networks. Since 2019, 28% noted a 20% increase in employees or vendors bringing in infected devices, such as laptops and handheld devices, to install/patch smart-factory machinery. ... When it comes to incidents, only a few of the organizations surveyed claimed that their cybersecurity teams have the required knowledge and skills to carry out urgent security patching without external support.

Google’s Powerful Artificial Intelligence Spotlights a Human Cognitive Glitch

The human brain is hardwired to infer intentions behind words. Every time you engage in conversation, your mind automatically constructs a mental model of your conversation partner. You then use the words they say to fill in the model with that person’s goals, feelings and beliefs. The process of jumping from words to the mental model is seamless, getting triggered every time you receive a fully fledged sentence. This cognitive process saves you a lot of time and effort in everyday life, greatly facilitating your social interactions. However, in the case of AI systems, it misfires – building a mental model out of thin air. A little more probing can reveal the severity of this misfire. Consider the following prompt: “Peanut butter and feathers taste great together because___”. GPT-3 continued: “Peanut butter and feathers taste great together because they both have a nutty flavor. Peanut butter is also smooth and creamy, which helps to offset the feather’s texture.” The text in this case is as fluent as our example with pineapples, but this time the model is saying something decidedly less sensible.

VMware report finds org modernization cannot succeed without observability

Enterprises have evolved their cloud strategies to multicloud environments and are adopting more containers, microservices and cloud-native technologies. This is creating increasingly distributed systems, making it harder to gain a comprehensive view into how they’re performing, Weiss said. As a result, legacy monitoring tools are obsolete for modern applications. “The reason for that is the change to cloud computing multi-services. Together with the amount of data that is being generated in these applications, you can’t cope with it anymore,” Weiss said. Monitoring merely collects data from the system and alerts admins to something being wrong. Observability goes beyond monitoring to interpret the data, providing answers on why something is wrong and how to fix it, allowing teams to pinpoint the root cause, minimize downtime and increase operational efficiency. “Previously, the solution was to put an agent on the server that can do everything, collect everything – but there is no place to put the agent anymore,” Weiss told VentureBeat. “Services are becoming very volatile. They’re disappearing. They’re here now, they’re not here tomorrow. I’m not even talking about serverless. So, that’s a change that is trending.”

A breakthrough algorithm developed in the US can predict crimes a week ahead

The concept might sound interesting, but the actual application was dodgy. As investigations later showed, almost half of the alleged perpetrators on the list had never been charged for illegal possession of arms, while others had not been charged with serious offenses before. A Technology Review report in 2019 detailed how risk assessment algorithms that determined whether an individual should be sent to jail or not were trained on historically biased data. So, when researchers at the University of Chicago, led by assistant professor Ishanu Chattopadhyay, tried to build their algorithm, they wanted to avoid past mistakes. The algorithm divides a city into 1,000 square feet tiles and uses the historical data on violent and property crimes to predict future events. The researchers told Bloomberg that their model is different from other such algorithmic predictions since the other look at crime as emerging from hotspots and spreading to other areas. However, such approaches, the researchers argue, miss the complex social environment of cities and are also biased by the surveillance used by the state for law enforcement.

7 key new features in SingleStoreDB

SingleStore has also enhanced SingleStoreDB with the addition of Code Engine with Wasm. Now users can bring external data and compute algorithms to power new real-time use cases within the database engine, drawing on WebAssembly. With Code Engine with Wasm, developers can securely, natively, and efficiently execute rich computation in the database using their programming language of choice. For computations and algorithms that are not easily expressed in SQL, Wasm support in SingleStoreDB brings algorithms to the data without having to move that data outside of the database. With SingleStoreDB Universal Language support, enterprises can now quickly integrate machine learning into real-time applications and dashboards. ... The latest release of SingleStoreDB also includes Data API, enabling seamless integrations with applications. Developers can use Data API to build serverless applications including web and mobile apps. Data API uses HTTP to run SQL operations against the database rather than maintaining a persistent TCP connection. The connection is dynamically reconfigured, and each request-response is its own connection.

Researchers Infuse ‘Human Guesses’ In Robots To Navigate Blind Spots

A novel methodology developed by MIT and Microsoft researchers identifies instances in which autonomous systems have “learned” from training samples that don’t reflect what happens in the real world. Engineers may employ this idea to improve the security of robots and autonomous vehicles that use artificial intelligence. For instance, to prepare them for nearly every eventuality on the road, the artificial intelligence (AI) systems that drive autonomous cars go through extensive training in virtual simulations. But occasionally the car makes an unforeseen error as a result of a situation that ought to alter the way it acts but doesn’t. Consider an autonomous car without the necessary sensors, which would be unable to discern between drastically different conditions like large, white cars and ambulances with red, flashing lights on the road. A driver may not know to slow down and pull over when an ambulance starts its sirens as it is traveling down the highway because it cannot tell the ambulance from a huge white sedan. Like with conventional methods, the researchers trained an AI system using simulations.

Integrating blockchain-based digital IDs into daily life

While blockchain’s elevator pitch is heavily inclined toward immutability, the technology boasts multiple advantages over traditional software and paper-based systems. The opinions regarding the benefits of blockchain boil down to the control over personal information. Self-sovereignty stands as one of the biggest benefits of blockchain-based digital IDs, according to Martis. This means that blockchain empowers users to share partial or selective information with their service providers instead of handing over their complete identity. With blockchain-based IDs eradicating the misuse of information, experts envision the birth of a truly trustless system without the involvement of third parties. Gentry, too, reiterated verifiability, traceability and uniqueness as some of the major benefits brought about by blockchain, as she highlighted that blockchain IDs cannot be duplicated because it's on the distributed ledger. “All the Digital ID can be verified on the blockchain and can be traced back to the owners' account which can also be used for Know Your Customer,” she added.

Neurodiversity in Cybersecurity: Broadening Perspectives, Offering Inclusivity

“There are not enough skilled people in this field, but neurodivergent individuals bring an essential skillset to cybersecurity -- hyper focus on analyzing data and identifying trends,” explains Rex Johnson, executive director of cybersecurity at CAI. “Not everyone has this ability, or at least do it well, except for neurodiverse talent.” To reach out to neurodiverse professionals, Johnson says organizations must look beyond traditional recruiting methods. “Depending on the need, consider a team of neurodivergent individuals who work under a supervisor who understands how to manage this dynamic and be the liaison to other management teams,” he advises. They can look for organizations that implement an end-to-end neurodiversity employment program that not only bring the right neurodivergent teammate in the door, but also work with the employer to create workplace accommodations that increase retention, morale, and productivity. “Not everyone is the same. People are inspired and motivated by many different visions and missions,” Johnson adds.

Staying protected amidst the cyber weapons arms race

Most would not like to admit it, but vulnerabilities are inevitable. Although a ransomware event is likely to affect an organisation at some point, ransomware itself is not completely out of the control of a business. Vendors have an ethical imperative to be transparent with the customer community when they become aware of a vulnerability in their product, providing clear assessment of impact and steps to remediate. As soon as any vulnerability in its software is known, speed and effectiveness in sharing relevant information and patches with customers and stakeholders are crucial. Once alerted, the impacted customer community then has a shared responsibility to action this information, in the context of the impact on their business and what that means for their resilience and continuity of operations. Here the vendor’s responsibility clearly becomes double-edged. Vendors must be transparent so their customers can apply the fix, yet this sets off a ticking time bomb as threat actors continuously scour the internet for this type of information, hoping to exploit the vulnerability before organisations have had time to apply the patch.

Quote for the day:

"People seldom improve when they have no other model but themselves." -- Oliver Goldsmith

Daily Tech Digest - February 15, 2020

How Can Companies Minimize Risk Against Emerging Threats?

It's estimated that there is a ransomware attack every 14 seconds somewhere in the world. By far, the single greatest vulnerability that companies continue to face is the infiltration of malware from phishing campaigns. Other vulnerabilities stem from the proliferation of IoT components, cloud storage and computing, and new data and financial apps that external vendors provide and install on the organization's system. To battle the threat, I believe a dedicated effort must go all the way up to the C-level to ensure that everyone is put to the task because when an intrusion attempt succeeds, it's already too late. It can take hackers as little as 19 minutes to get into a system and up to eight hours for many companies to respond due to their obligation to internal processes. Many larger companies install a variety of specialized solutions to protect themselves in different areas, and it seems that endless products answer very specific threats. Too often, though, that buildup of solutions from a multitude of vendors exacerbates the risk that each patch is intended to guard against.

Emotion AI researchers say overblown claims give their work a bad name

Emotion recognition, also known as affective computing, is still a nascent technology. As AI researchers have tested the boundaries of what we can and can’t quantify about human behavior, the underlying science of emotions has continued to develop. There are still multiple theories, for example, about whether emotions can be distinguished discretely or fall on a continuum. Meanwhile, the same expressions can mean different things in different cultures. In July, a meta-study concluded that it isn’t possible to judge emotion by just looking at a person’s face. The study was widely covered, often with headlines suggesting that “emotion recognition can’t be trusted.” Emotion recognition researchers are already aware of this limitation. The ones we spoke to were careful about making claims of what their work can and cannot do. Many emphasized that emotion recognition cannot actually assess an individual’s internal emotions and experience. It can only estimate how that individual’s emotions might be perceived by others, or suggest broad, population-based trends.

AIoT – Convergence of Artificial Intelligence with the Internet of Things

Large volumes of confidential company information and user data are tempting targets for dark web hackers as well as the global government entities. The high level of risk has also brought in newer and more responsibilities that accompany the increased capability. Sensors are now applied to almost everything. This indicates that infinitely more data can be collected from every transaction or process in real-time. IoT devices are the front line of the data collection process in manufacturing environments and also in the customer service departments. Any device with a chipset can potentially be connected to a network and begin streaming data 24/7. Complex algorithms allow performing predictive analytics from all conceivable angles. Machine learning (ML), a subset of AI, continues to upgrade workflows and simplify problem-solving. Companies now capture all the meaningful data surrounding their processes and problems to develop specific solutions for real challenges within the organization, improving efficiency, reliability, and sustainability.

8 steps to being (almost) completely anonymous online

9 steps to make you completely anonymous online

The universe believes in encryption, a wise man once opined, because it is astronomically easier to encrypt than it is to brute force decrypt. The universe does not appear to believe in anonymity, however, as it requires significant work to remain anonymous. We are using privacy and anonymity interchangeably, and this is incorrect. An encrypted message may protect your privacy — because (hopefully) no one else can read it besides you and your recipient — but encryption does not protect the metadata, and thus your anonymity. Who you're talking to, when, for how long, how many messages, size of attachments, type of communication (text message? email? voice call? voice memo? video call?), all this information is not encrypted and is easily discoverable by sophisticated hackers with a mass surveillance apparatus, which is most these days. A final thought before we dig into specific technical tools: "Online" is now a meaningless word. Meatspace and cyberspace have merged. We used to live in the "real world" and "go online."

MIT finds massive security flaws with blockchain voting app

MIT researchers released a lengthy paper on Thursday that said hackers could change votes through the app, which has already been used in Oregon, West Virginia, Washington and Utah since 2018. "Their security analysis of the application, called Voatz, pinpoints a number of weaknesses, including the opportunity for hackers to alter, stop, or expose how an individual user has voted," MIT said in a news release. Additionally, the researchers found that Voatz' use of a third-party vendor for voter identification and verification poses potential privacy issues for users," the MIT press release said. In a blog post and call with reporters, Voatz defended its security practices and disputed the claims made by the MIT researchers. The company said the research paper was based on an "old version" of the app and that because of this, many of their claims were invalid. "Voatz has worked for nearly five years to develop a resilient ballot marking system, a system built to respond to unanticipated threats and to distribute updates worldwide with short notice.

The time is now: How to manufacture your smart factory with Industrial IoT

Although the value of digital innovation is apparent, widespread adoption has been slow. This is due to a myriad of challenges. For many organisations, the biggest challenge is available talent — they simply don’t have the internal expertise to plan and execute digital innovation initiatives. With continued strain on IT budgets, organisations struggle to both manage the priorities of today and invest in the talent needed to help them transform their business. A new report by PwC identified hiring more Internet of Things (IoT) engineers and data scientists – while training the wider workforce in digital skills – as a key change CEOs must implement if they want to maximise the benefits from digitisation of manufacturing. Legacy technology is another factor holding manufacturers back. The average factory today is 25 years old, according to McKinsey, with machinery that’s approaching nine years old. Before any plans of integrating the IoT can begin at these plants, they must first upgrade equipment to enable digital readiness. Driven by immediate goals of reducing costs and returns, some manufacturing companies have deferred technology investment.

Microsoft's Windows Terminal: This is the final preview of its new command-line tool

This update brings new command-line arguments, such as the 'wt' execution alias. Users can now launch Terminal with new tabs and split panes, which open with preferred profiles and directories. Terminal developers point out that the 'wt' design was "heavily inspired by that of the venerable and beloved GNU screen competitor" called tmux, a terminal for Unix-like systems. "You can wt new-tab, wt split-pane, wt new-tab -p Debian ; split-pane -p PowerShell until your heart's content," says Dustin Howett, an engineer lead at Microsoft. .. This release also has some goodies for PowerShell Core fans, with Terminal now automatically finding PowerShells on a system. "The Windows Terminal will now detect any version of PowerShell and automatically create a profile for you," explains Kayla Cinnamon, Windows Terminal program manager. "The PowerShell version we think looks best (starting from highest version number, to the most GA version, to the best-packaged version) will be named as 'PowerShell' and will take the original PowerShell Core slot in the dropdown."

Machine learning could lead cybersecurity into uncharted territory

Security threats are evolving to include adversarial attacks against AI systems; more expensive ransomware targeting cities, hospitals, and public-facing institutions; misinformation and spear phishing attacks that can be spread by bots in social media; and deepfakes and synthetic media have the potential to become security vulnerabilities. In the cover story, European correspondent Chris O’Brien dove into how the spread of AI in security can lead to less human agency in the decision-making process, with malware evolving to adapt and adjust to security firm defense tactics in real time. Should costs and consequences of security vulnerabilities increase, ceding autonomy to intelligent machines could begin to seem like the only right choice. We also heard from security experts like McAfee CTO Steve Grobman, F-Secure’s Mikko Hypponen, and Malwarebytes Lab director Adam Kujawa, who talked about the difference between phishing and spear phishing, addressed an anticipated rise in personalized spear phishing attacks ahead, and spoke generally to the fears — unfounded and not — around AI in cybersecurity.

Cloud Threat Report Shows Need for Consistent DevSecOps

Despite efforts to educate developers on the importance of security, he says most developers believe their top priority is getting new features and functionality out as quickly as possible. “Yes, they’re supposed to engineer-in security but that doesn’t happen in many cases,” Chiodi says. “Many organizations have not yet embraced the concept of DevSecOps.” Unit 42’s research shows that forward leaning organizations such as consumer companies want to operate with cloud-scale, serving a multitude of users, while maintaining security. Chiodi cites Netflix as a company that does so because it fully integrated development, security, and operations. He suggests that security teams should also embrace infrastructure as code to automatically put written security policies into code. “That way when a developer creates a new cloud environment, if it has security standards coded right in, every time they create from that template it will be the same every time,” he says. Conversely, Chiodi says a template with vulnerabilities will repeat those vulnerabilities each time it is applied.

Election hacking: is it the end of democracy as we know it?

According to David Emm, senior security researcher at Kaspersky Lab, “the term ‘hacking’ often gets used loosely to refer to different attempts to interfere in elections. These include using social media to try and shape opinions or stealing data held on compromised computers to try and shame political figures, as well as tampering directly with machines used to manage the voting process.” Mateo Meier, the founder and CEO of Artmotion, a cloud security company, agrees that “threat actors will use all available tools at their disposal to hack the outcome [of an election]. So it’s always likely to be a multi-pronged approach rather than a single data breach during election season.” In recent years, governments have made some serious accusations, and researchers have demonstrated how vulnerabilities in voting machines can be targeted. “Such vulnerabilities have also been seen in the real-world, with NSW election results being challenged over [the] iVote security flaw. Yet, it’s difficult to gauge the impact a successful real world attack would have.

Quote for the day:

"Leaders need to be optimists._ Their vision is beyond the present." -- Rudy Giuliani