Daily Tech Digest - July 25, 2023

The real risk of AI in network operations

One who tried generative AI technology on their own historical network data said that it suggested a configuration change that, had it been made, would have broken the entire network. “The results were wrong a quarter of the time, and very wrong maybe an eighth of the time,” the operations manager said. “I can’t act on that kind of accuracy.” ... That raises my second point about a lack of detail on how AI reached a conclusion. I’ve had generative AI give me wrong answers that I recognized because they were illogical, but suppose you didn’t have a benchmark result to test against? If you understood how the conclusion was reached, you’d have a chance of picking out a problem. Users told me that this would be essential if they were to consider generative AI a useful tool. They don’t think, nor do I, that the current generative AI state of the art is there yet. What about the other, non-generative, AI models? There are well over two dozen operations toolkits out there that claim AI or AI/ML capability. Users are more positive on these, largely because they have a limited scope of action and leave a trail of decision-making steps that can be checked quickly.

Exploring an Agilist's Story of Perseverance

“There are a few things in technology that help people with MS because they have the same problem with speech, but they’re not really effective for me,” because you still have to go back and edit everything. If you are living with ataxia, “there is a group called the National Ataxia Foundation. It is a great support group; you don’t feel like you are going through this alone. They post things about technology and tools you can use,” Apuroopa said. She also recommends utilizing your HR resources if you have any need for accommodation. An accommodation request form may be the right way to access technology or request an adjustment or change in your work environment or duties based on a medical condition. Apuroopa’s employer offers a work-from-home option. “The remote environment adds complexity,” she said, because not everyone is willing to turn their cameras on for various reasons, and you end up missing that facial connection and body language, but she’s also thankful for the option to stay home.

A critical cybersecurity backup plan that too many companies are ignoring

With a departure of a CISO, there is a loss of valuable institutional knowledge, which can impede an organization’s ability to adapt to rapidly evolving cyber threats, said Daniel Soo, risk and financial advisory principal in cyber and strategic risk at consulting firm Deloitte. “The lack of a successor could disrupt business-as-usual cybersecurity operations, resulting in delays, gaps in critical cyber risk management activities, and hindered cyber incident response and decision-making,” Soo said. In addition, CISO succession planning is key to ensuring that an organization has the right person at the right time to help drive the organization’s cyber objectives, Soo said. ... CISO succession planning should also involve anticipating future security requirements by considering the evolving nature of the business and technology landscape. “CISOs should analyze the security implications of these trends and develop policies, technologies, and skills to address future needs,” he said. “Implementing a training program can help ensure that employees are equipped with the necessary skills to tackle upcoming security challenges.”

Bridging the cybersecurity skills gap through cyber range training

Cyber ranges take traditional cyber training and turn it into real-life, experiential learning so learners can actually apply their knowledge and skills and gain real experience using a simulation method. SOC analysts, who are the last line of defense, need to continually engage in these simulations to strengthen their capabilities and create “muscle memory.” An ongoing cyber range training program with real-life attacks enhances their preparedness as individuals and as a cohesive team through immersive experiences. One thing to note is that not all cyber ranges are equal to each other. They can vary in terms of their purpose, complexity, and available features, tools, and technology. To ensure your team is getting the most effective training, it’s critical to use a dynamic range with live-fire attacks that the whole team can participate in together, versus more of a directed lab environment or individual exercises that team members do in parallel. 

Why cyber security should be part of your ESG strategy

In fact, the investment community has been singling out cyber security as one of the major risks that ESG programmes will need to address due to the potential financial losses, reputational damage and business continuity risks posed by a growing number of cyber attacks and data breaches. Investment firm Nomura already takes into account an investee firm’s cyber security performance in its credit ESG scoring model, while KPMG noted in its report that cyber security is not only applicable to the governance aspects of ESG, but also has social and environmental implications. ... “That trust you want to build from a social standpoint comes from sound cyber security practices, so you can tell customers you’re taking the right steps to protect their identity and financial information,” he added. But even after organisations have identified aspects of their businesses that are at risk, building up their risk profile remains challenging as they are often unaware of what technology assets they have, coupled with the lack of efforts to assess technical risks, Wenzler said.

Boost your tech ROI with Engineering Effectiveness

Learnings from numerous agile, DevOps, and platform transformation projects have shown that the productivity of engineering teams in most organizations is around 30 percent of their total potential. Therefore, a whopping 70 percent improvement is possible, even necessary if you want to keep up with digital-native competitors. You can achieve this by investing in both technology and the development teams themselves. Create an environment equipped with the right platforms, methodologies, and workplace culture that makes teams more productive and helps them collaborate more efficiently. It's also vital to give developers the opportunity and resources to keep their skills up to date. ... The path to modernization is not only about allocating more resources, but fundamentally about transforming business processes and culture. Talent is better utilized when outdated and inefficient workflows are revised. A critical look at the organization, involving senior management, is essential to uncover all bottlenecks. Changing traditional work and thought patterns can be challenging. In such cases, external assistance coupled with tried-and-tested frameworks and tools can be of help. 

Social Intelligence Is the Next Big Step for AI

When it comes to being able to decipher nonverbal cues like body language or facial expressions, AI still lacks many of the social skills that many of us humans take for granted. To help AI develop those social skills, new work from Chinese researchers suggests that a multidisciplinary approach will be needed — such as adapting what we know about cognitive science, and using computational modeling would help us better identify the disparities between the social intelligence of machine learning models and their human counterparts. “[Artificial social intelligence or ASI] is distinct and challenging compared to our physical understanding of the work; it is highly context-dependent,” said first author Lifeng Fan of the Beijing Institute for General Artificial Intelligence (BIGAI) in a statement. “Here, context could be as large as culture and common sense, or as little as two friends’ shared experience. This unique challenge prohibits standard algorithms from tackling ASI problems in real-world environments, which are frequently complex, ambiguous, dynamic, stochastic, partially observable and multi-agent.”

Why Ambient Computing May Be the Next Big Trend

Ambient computing will become an everyday reality through the widespread adoption of connected devices, the Internet of Things (IoT), and advancements in artificial intelligence, Bilay predicts. “As these technologies become more sophisticated, affordable, and seamlessly integrated into our environments, ambient computing will permeate our homes, workplaces, and public spaces.” ... Bilay says users will need to remain vigilant about data protection. He cautions that ambient computing’s reliance on interconnected systems creates dependencies that could make users susceptible to service disruptions caused by technical failures or compatibility issues. Security is another major concern. “We’ve already seen cases in which an estranged spouse uses the smart thermostat or smart lighting to harass their ex,” Loukides says. When devices are networked, attacks could occur at a larger and more devastating scale. “We’re already familiar with ransomware,” he notes. “Could somebody extort a vendor like Honeywell or Nest because they’ve taken control over all the thermostats?”

Has generative AI quietly ushered in a new era of shadow IT on steroids?

There are dozens of great studies showing the dangers that come with shadow IT. A few of the concerns include decreased control over sensitive data, an increased attack surface, risk of data loss, compliance issues, and inefficient data analysis. Yes, there are many other security, privacy, and legal issues that can surface with shadow IT. But what concerns me the most is the astonishing growth in generative AI apps -- along with how fast these apps are being adopted for a myriad of reasons. Indeed, if the internet can best be described as an accelerator for both good and evil -- which I believe is true -- generative AI is supercharging that acceleration in both directions. Many are saying that the adoption of generative AI apps is best compared to the early days of the internet, with the potential for unparalleled global growth. ... If you're questioning whether generative AI apps qualify as shadow IT, as always it depends on your situation. If the application is appropriately licensed and all the data stays within the confines of your organization's secure control, generative AI can fit neatly into your enterprise portfolio of authorized apps.

What Is a Modern Developer?

The desire to simplify one's life, automate everything, and solve problems is the key thing that drives many modern developers. If this desire sounds familiar, then you are a developer. In the near future, you may only need to think of what the code should be and then you can write it out in sentences — aka a prompt engineer. This is coming so quickly that this future could be Tuesday. The heterogeneous nature of data, data producers, applications, and services that drives everyone to be a developer also highlights the importance of developers. We need to build applications and other things since there are so many diverse applications and systems that need to be joined together to solve an entire real-world requirement. ... The number of activities a developer has to do in modern development today goes beyond just designing, creating, building, testing, and deploying applications. Often in today’s resource-constrained environments, a common additional role is to gather and translate user requirements into buildable assets. Responsibilities also include internationalization, monitoring, managing, extracting data, and more.

---

Quote for the day:

“When people are financially invested, they wanta return. When people are emotionally invested, they want to contribute.” -- Simon Sinek

---

Daily Tech Digest - January 21, 2021

15 SLA mistakes IT leaders still make

SLAs have often been a point of contention ­— not only between providers and customers, but within organizations themselves. “It often boils down to IT leaders hating to read legal agreements while procurement and legal teams can be focused on business and financial risk rather than IT dependencies or the impact of system outages to delivering services,” says Joel Martin, cloud strategies research vice president at HFS Research. And as companies move more solutions to the cloud, understanding the service levels agreed to is important to developing trusted and dependable relationships. Moreover, SLA development and management has evolved significantly in recent years, with an eye toward driving business value. “Service recipients have become far more sophisticated in how they manage SLAs,” says Marc Tanowitz, managing director with West Monroe, adding that they “are looking for end-to-end outcomes that drive business success and recognize that the true value of SLAs is to drive business insights and performance — rather than to reduce the cost of service by capturing performance credits.” Nonetheless, there remain some common — and potentially costly — SLA mistakes IT leaders can make. Following are some of the most detrimental to the IT organization and the business at large.

Ransomware provides the perfect cover

Attackers are constantly creating new variants that evade detection by traditional signature-based approaches. To counteract these attacks, firms need to have defence in depth. This starts with preventing threat actors from infiltrating the network by defending against tactics such as phishing and malware campaigns through staff training, the use of strong passwords, 2FA, and patch management. If a threat actor makes it onto the system, their potential for lateral movement is limited when organizations have deployed a least-privilege approach, where access to files and folders is limited based on job role or seniority. Behavioral anomalies are a prime indicator that a threat actor could be on the network. This includes encrypting or downloading large amounts of data or user accounts trying to access restricted data. Successfully spotting such behaviour requires correlating data from many sources, including endpoint and network detection and response solutions. Finally, to ensure they can recover quickly in the event of a ransomware attack, organizations must also have robust backups that they can rely on if their network does go down.

Cisco tags critical security holes in SD-WAN software

The first critical problem–with a Common Vulnerability Scoring System rating of 9.9 out of 10–is vulnerability in the web-based management interface of Cisco SD-WAN vManage Software.  “This vulnerability is due to improper input validation of user-supplied input to the device template configuration,” Cisco stated. “An attacker could exploit this vulnerability by submitting crafted input to the device template configuration. A successful exploit could allow the attacker to gain root-level access to the affected system.” This vulnerability affects only the Cisco SD-WAN vManage product, the company stated. The second critical Cisco SD-WAN Software issue–with a CVSS rating of 9.8—could let an unauthenticated, remote attacker to cause a buffer overflow. “The vulnerability is due to incorrect handling of IP traffic,” Cisco stated. “An attacker could exploit this vulnerability by sending crafted IP traffic through an affected device, which may cause a buffer overflow when the traffic is processed. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating system with root privileges.”

Microsoft Releases New Info on SolarWinds Attack Chain

According to Microsoft, the attackers achieved this by using a known MITRE attack method called event triggered execution, where malicious code is executed on a host system when a specific process is launched. In this case, the threat actors used the SolarWinds process to create a so-called Image File Execution Options (IEFO) registry value for running the malicious VBScript file when the dllhost dot exe process is executed on the infected system. The dllhost dot exe process is a legitimate Windows process for launching other applications and systems. When triggered, the VBScript then runs another executable that activates the Cobalt Strike DLL in a process that is completely disconnected and separate from the SolarWinds process. The VBScript then also deletes the IEFO registry value and other traces of the sequence of events that happened, according to Microsoft. The full motives behind the operation and its victims remain unclear — or at least publicly undisclosed — though some believe it may have been for corporate espionage or spying. FireEye, Microsoft, the US Cybersecurity and Infrastructure Security Agency (CISA), and numerous others have described the operation as being the work of a highly sophisticated state-backed actor. 

Accessible 5G: Making it a reality

To make 5G truly accessible to businesses, customers and consumers, we need to improve connectivity for all by eventually converging cellular and satellite networks to provide coverage both on land and via geo-satellite. While 3G and 4G were primarily created to improve mobile services for mobile device users, 5G is expected to support a much wider scope of IoT applications. With more intelligence being packed into smart, connected devices – we’ll need seamless connectivity and coverage. The hybrid network will enable all types of industries, from education and healthcare to construction and manufacturing, to not only use IoT technology to improve services and efficiencies but remove operational complexities, such as in-building coverage for more remote locations and black spots in connectivity when laying foundations – think basement renovations and housing developments in remote landscapes. As 5G-enabled smart devices and IoT applications increase, so too will the volume of data transactions between devices in the home: Smartphones, tablets, TVs, voice-assistance, and white goods like refrigerators and smart ovens. The sheer volume of applications transferring data to communicate with each other, for example, using voice assistance to dim the lights and select a film to watch for a night in, will require robust and seamless connectivity for the perfect experience.

Fueled by Record Profits, Ransomware Persists in New Year

In 2020, exfiltrating data from victims before crypto-locking their systems and naming and shaming victims via leaks sites became common. Pioneered by the now-defunct Maze group in late 2019, many other groups followed suit. Those include Clop, DoppelPaymer, Nefilim, Sekhmet and, more recently, Avaddon. DoppelPaymer was also tied to an attack against a hospital in Germany, which led to a seriously ill patient having to be rerouted to another hospital. "This individual later died, though German authorities ultimately did not hold the ransomware actors responsible because the German authorities felt the individual's health was poor and the patient likely would have died even if they had not been re-routed," the FBI notes in a private industry alert issued last month. For exfiltrating data, "size doesn't matter" for attackers, Sophos says. "They don't seem to care about the amount of data targeted for exfiltration. Directory structures are unique to each business, and some file types can be compressed better than others. We have seen as little as 5GB, and as much as 400GB, of compressed data being stolen from a victim prior to deployment of the ransomware." 

The state of the dark web: Insights from the underground

According to Raveed Laeb, product manager at KELA, the dark web of today represents a wide variety of goods and services. Although traditionally concentrated in forums, dark web communications and transactions have moved to different mediums including IM platforms, automated shops, and closed communities. Threat actors are sharing covert intelligence on compromised networks, stolen data, leaked databases and other monetizable cybercrime products through these mediums. “The market shifts are focused on automation and servitization [subscription models], aimed at aiding the cybercrime business to grow at scale,” says Laeb. “As can be witnessed by the exponential rise of ransomware attacks leveraging the underground financial ecosystem, the cybercriminal-to-cybercriminal markets allow actors to seamlessly create a supply chain that supports decentralized and effective cybercrime intrusions—giving attackers an inherent edge.” ... “Defenders can exploit these robust and dynamic ecosystems by gaining visibility into the inner workings of the underground ecosystem—allowing them to trace the same vulnerabilities, exposures, and compromises that would be leveraged by threat actors and remediate them before they get exploited,” says Laeb.

New MIT Social Intelligence Algorithm Helps Build Machines That Better Understand Human Goals

While there’s been considerable work on inferring the goals and desires of agents, much of this work has assumed that agents act optimally to achieve their goals. However, the team was particularly inspired by a common way of human planning that’s largely sub-optimal: not to plan everything out in advance, but rather to form only partial plans, execute them, and then plan again from there. While this can lead to mistakes from not thinking enough “ahead of time,” it also reduces the cognitive load.  For example, imagine you’re watching your friend prepare food, and you would like to help by figuring out what they’re cooking. You guess the next few steps your friend might take: maybe preheating the oven, then making dough for an apple pie. You then “keep” only the partial plans that remain consistent with what your friend actually does, and then you repeat the process by planning ahead just a few steps from there.  Once you’ve seen your friend make the dough, you can restrict the possibilities only to baked goods, and guess that they might slice apples next, or get some pecans for a pie mix. Eventually, you’ll have eliminated all the plans for dishes that your friend couldn’t possibly be making, keeping only the possible plans (i.e., pie recipes). Once you’re sure enough which dish it is, you can offer to help.

5G: Opportunities and Challenges for Electric Distribution Companies

While the primary focus for this new technology from a common carrier’s perspective seems to center around broadband services, the most likely areas that will be important to electric utilities will be the increased capacity to support field area network needs for connected grid devices. The "Grid of Things" will greatly benefit from the connectedness afforded by the larger IoT. "We plan to leverage our AMI network for connectivity needs, but that may change as we deploy more 'grid-edge' devices," said an executive of a mid-sized mid-Atlantic utility. Low-latency services potentially offer the opportunity to leverage this technology to support mission critical applications, such as protective relay management, SCADA, and substation communications. "Use of 5G can potentially provide SCADA and other system data over a cellular network versus a hard-wired solution through fiber or copper," said a general manager of a Connecticut public utility. The high data rate mmWave wireless broadband services may be applied to augmented/virtual reality (AR/VR), an area where some utilities like Duke Energy and EPRI are actively leveraging, and unmanned aerial vehicles (UAVs) that will improve asset management and visualization.

Financial institutions can strengthen cybersecurity with SWIFT’s CSCF v2021

SWIFT created the CSP to support financial institutions in protecting their own environments against cybercrime. The CSP established a common set of security controls, the Customer Security Controls Framework (CSCF), designed to help users secure their systems with a list of mandatory controls, community-wide information sharing initiatives, and security features on their payment infrastructure. The CSCF is designed to evolve based on threats observed across the transaction landscape. The CSCF’s controls are centered around three overarching objectives: Secure your environment; Know and limit access; and Detect and respond. The updated CSCF v2021 includes changes to existing controls and additional guidance and clarification on implementation guidelines. The newest version includes 31 security controls, 22 mandatory controls, and 9 advisory controls. Mandatory controls must be implemented by all users on the user’s local SWIFT infrastructure. Advisory controls are based on recommended best practices advised by SWIFT.

---

Quote for the day:

"Education is what survives when what has been learned has been forgotten." -- B. F. Skinner

---