Daily Tech Digest - April 07, 2020

Hybrid Instead of All-Flash

All-flash Array vendors claim that because of the continuing decline in flash pricing and because of deduplication, there is no longer a financial reason to choose hybrid instead of all-flash. They claim that the unpredictable performance concerns of hybrid arrays outweigh any remaining cost advantage. AFA vendors, though, ignore the fact that the price of hard disk drives is reducing in terms of cost per terabyte. They also ignore the new reality that hard disk isn’t the only option for the second tier of storage. Deduplication, while bringing down the cost per terabyte of flash, brings a set of “taxes” that make it less cost-efficient than customers are led to believe. First, in primary storage, deduplication is far less efficient than when IT uses the technology for backup storage. Second, there is a performance overhead associated with its use, and all-flash arrays that use deduplication have an inferior cost per IOPS rating. Finally, most all-flash vendors don’t pass the full savings of deduplication on to the customer. The customer receives some of the cost savings value, but not all of it.

How to stay motivated when you work from home

Those conversations you have with friends and family in restaurants, bars, on the street don’t need to stop when you’re self-isolating, just contact your people on FaceTime. With these suggestions in mind I’ve identified a selection of iOS tools that may help you take control of working from home while also helping you make the best of the motivation you still have available to you. Don’t be too frustrated if you’re not as motivated as normal – it really isn’t your fault. Things are happening. They are quite frightening. You are already doing what you can to challenge them by staying at home. Cut yourself some slack first and then see if these (mostly free) tools help you feel a little more in control. Assuming you can find the ingredients, then FoodPlanner lets you find healthy recipes you like the sound of online, add them into the app and then generates nutritional data, create a shopping list (including inventory management features to help you track ingredients you already have) and create meal plans for the next week or more. Foodplanner doesn’t aim to pester you into exercise, it lets you choose the food you want and then gives you the information you need in order to make it.

Two-factor authentication is broken: What comes next?

Compromising a 2FA system is lot easier than it seems. One of the easiest methods, especially in America, is a sim-swap, where a malicious actor switches a target’s mobile phone number to a new phone. Any subsequent text messages, such as those for 2FA, are sent to this new phone, thereby giving the malicious actor access. Certain malware has also been found to compromise 2FA systems. Cerberus, a type of Android-based malware, was found to have stolen 2FA codes for Google Authenticator in February 2020. There is also the TrickBot malware, which bypasses 2FA solutions by intercepting the one-time codes used by banking apps, sent by SMS and push notifications. Social engineering is also used to bypass 2FA security. Malicious actors may pose as a target’s bank, calling the target to “confirm their identity” by quoting the secure code that has just been sent to them, in response to an attempt to access their banking profile. “A lot of this stuff doesn’t require any real technical skill, and that’s the really scary part,” says Harding.

Microsoft Teams: How to master remote work beyond the basics

It might not be immediately obvious, but the Search box at the top of the Teams desktop app doubles as a command line. Click in that box and then tap the slash key (/) to display a list of all available commands. ... Pressing Ctrl+E takes you to the Search box, for example, just as it does in File Explorer and your web browser. You can use Ctrl+number to go to the corresponding node in the navigation pane on the left. In the default arrangement, Ctrl+1 goes to the Activity pane, Ctrl+2 takes you to Chat, and so on. Press Ctrl+Shift+X to toggle between the bare compose box and the full editor with all its formatting options. And just as in your web browser, you can hold down Ctrl as you tap the plus or minus keys to zoom in or out, then press Ctrl+0 to go back to normal (100%) magnification. ... When posting a new conversation/thread, it's a good idea to add a subject, as I've done in the opening post here. That makes it easier to spot a specific conversation by scrolling through a channel, and also makes it easier to use the search tools to find that conversation.

What is power over Ethernet (PoE)?

Using PoE in wireless rollouts may be the technology’s primary application but many think it will find a home in the internet of things where wired IoT devices can receive power from their network connection. Versa technology wrote a blog about the use of PoE and IoT by the city of San Diego, Calif., which is using Ethernet cabling to deliver power to thousands of interconnected LED streetlights, which are integrated into the city’s IoT network. Power to the smart lamps can be turned up and down to optimize illumination for each space. Such lighting systems have low power requirements, making them cheaper to use. The PoE streetlights are integrated with the city’s IoT network, which makes it possible to monitor and control them remotely. The smart lamps are fitted with motion sensors to conserve energy by optimizing lighting based on the needs of each space. The system saves the city $250,000 or more per year, Versa stated. IP security cameras, which are often placed in difficult-to-access locations, are another key PoE application target.

IBM CEO Throws Down Hybrid-Cloud Challenge

In a LinkedIn message to IBM’s employees, Krishna said he wants the company to add a greater presence in the hybrid-cloud space to its already established positions in the mainframe, services, and middleware ecosystem. “The fundamentals are already in place,” Krishna wrote. “Our approach to hybrid cloud is the most flexible and the most cost effective for our clients in the long term. Coupled with our deep expertise, IBM has unique capabilities to help our clients realize the potential of a hybrid cloud business model.” Krishna stated that IBM would take advantage of its already established presence in cloud, artificial intelligence (AI), blockchain, and quantum computing. He noted that two “strategic battles” were taking place in the journeys to hybrid cloud and AI. “We all need to understand and leverage IBM’s sources of competitive advantage,” Krishna explained. “Namely, our open source and security leadership, our deep expertise and trust, and the fact that we enable clients to build mission-critical applications once and run them anywhere.”

Cybercriminals increasingly using SSL certificates to spread malware

Recent studies have shown that cybercriminals building phishing sites now use SSL as well, complicating efforts by enterprises to keep their employees safe. The Menlo Security research revealed that while 96.7% of all user-initiated web visits are being served over https, only 57.7% of the URL links in emails turn out to be https, which means that web proxies or firewall will be oblivious to the threats unless enterprises turn on SSL inspection. "If you think the little green lock of https equals security, think again," the report said. "The bad news is that the bad guys use encryption, too. Many people mistakenly assume that as long as an SSL certificate is present, they're safe from attack, but that couldn't be further from the truth. From Reductor to Godlua and numerous other variants, it has become all too clear that new types of malware are being secreted behind a symbol that was once seen as secure." According to the report, enterprises have long relied on on-premises proxies and next-generation firewalls for visibility and control of web access. But when it comes to decrypting and inspecting SSL sessions, the report said, "many enterprises have held back partly driven out of privacy issues and partly around performance of these proxies with SSL decryption turned on.

What are the five main barriers to digital transformation and their solutions? 

One of the biggest barriers to digital transformation initiatives is when there is no clear direct return on investment. To overcome this barrier, White explains that “businesses should rectify this by defining a clear set of digital success criteria at the start, defined based on what you are trying to achieve — are you creating additional revenue streams or enhancing internal operations? Measures can be based on anything from metrics to softer statements such as ‘we will be able to provide customers with a way to engage 24/7 around the world’.” ... The most common barrier to digital transformation, according to Steve White, head of transformation accounts at Yotta, is data and department silos. He explains: “One common example is that the software applications being used by departments are very specific to those service areas, often require specialist knowledge to use effectively and are locked down via account profiles and permissions. They also incorporate different user interface designs (UI) and user experience designs (UX) which all make access by other departments or users within the organisation extremely difficult.

Data scientists: White House issues a call to arms

It's an opportunity for service for data scientists, a way to help healthcare workers and policymakers understand a growing dataset that holds the key to making informed decisions. At the moment, we lack the most basic knowledge about COVID-19, including an answer to the most fundamental question: how many people have been infected? Health experts agree that reliable data answering this question and other fundamental questions are needed to guide difficult decisions ahead. ... "The good news is we have lots of data," says McDonald. "The bad news is the organization and accessibility of that data is very spread out or difficult to access." Given the difficulties with the dataset, McDonald points to AI deep learning as a necessary tool. "Deep Learning is not a typical algorithm. A user literally "teaches" the platform with hundreds of examples of the various classifications or predictions. Once taught, then future classifications and predictions are in the hands of the deep learning platform." This can be applied to health data in general, which is a growing trend in data-driven medicine.

Cisco goes after wireless IoT with Fluidmesh acquisition

In January Cisco rolled out an overarching security architecture for industrial IoT (IIoT) environments that includes existing products but also new software called Cisco Cyber Vision, for the automated discovery of industrial assets attached to Cisco’s extensive IIoT networking portfolio. The new security rollout also included Cisco Edge Intelligence software to simplify the extraction of IoT data at the network edge. Together with the new software, IT and operational technology groups will be able to work together to provide advanced anomaly detection in IIoT environments, Cisco stated. Also in 2019, Cisco expanded its IoT security and management offerings by acquiring Sentryo, a company that offers anomaly detection and real-time threat detection for IIoT networks. Founded in 2014 Sentryo products include ICS CyberVision – an asset-inventory, network-monitoring and threat-intelligence platform – and CyberVision network-edge sensors, which analyze network flows. Last year Cisco rolled out a family of switches, including the Catalyst IE3x00 ruggedized edge switches, software, developer tools and blueprints to incorporate IoT and industrial networking into intent-based networking and classic IT security, monitoring and application-development support.

---

Quote for the day:

"When you expect the best from people, you will often see more in them than they see in themselves." -- Mark Miller

---

Daily Tech Digest - March 24, 2020

What is Kotlin? The Java alternative explained

Kotlin is a general purpose, free, open source, statically typed “pragmatic” programming language initially designed for the JVM (Java Virtual Machine) and Android that combines object-oriented and functional programming features. It is focused on interoperability, safety, clarity, and tooling support. Versions of Kotlin targeting JavaScript ES5.1 and native code (using LLVM) for a number of processors are in production as well. Kotlin originated at JetBrains, the company behind IntelliJ IDEA, in 2010, and has been open source since 2012. The Kotlin team currently has more than 90 full-time members from JetBrains, and the Kotlin project on GitHub has more than 300 contributors. JetBrains uses Kotlin in many of its products including its flagship IntelliJ IDEA. ... In Kotlin, functions may be declared at top level in a file, locally inside other functions, as a member function inside a class or object, and as an extension function. Extension functions provide the C#-like ability to extend a class with new functionality without having to inherit from the class or use any type of design pattern such as Decorator.

Coronavirus: Can the networks take the strain?

Operators’ measurements found that, in general terms up to 12 March, traffic through IP networks had seen increases of nearly 40% while mobile use has increased by about 50% in voice and 25% in data. Traffic from instant messaging tools such as WhatsApp had increased fivefold in recent days. In a tell-tale sign of the increased use of teleworking, network traffic related to remote work tools such as Skype and Webex has increased fourfold. There is nothing to suggest that the same scenario will be played out in all the European countries that enter lockdown, if they do. And therein lies an issue: who knows what is actually going on and when and what are networking firms doing to ensure that the lights stay lit? The UK’s second-largest broadband provider, Virgin Media, said it realises how important its network is to everyone right now. The company said it wants to reassure users that it is working as hard as it can to keep it in “great shape”. In particular, Virgin stressed that as more people work from home, it is important for users to know that its network can withstand any increased usage, including peaks throughout the day, in the evenings and at weekends.

Report: Most IoT transactions are not secure

“What this tells us is that employees inside the office might be checking their nanny cam over the corporate network. Or using their Apple Watch to look at email. Or working from home, connected to the enterprise network, and periodically checking the home security system or accessing media devices,” the company said in its report. Which is typical, to be honest, and let (s)he who is without sin cast the first stone in that regard. What’s troubling is that roughly 83% of IoT-based transactions are happening over plaintext channels, while only 17% are using SSL. The use of plaintext is risky, opening traffic to packet sniffing, eavesdropping, man-in-the-middle attacks and other exploits. And there are a lot of exploits. Zscaler said it detects about 14,000 IoT-based malware exploits per month, a seven-fold increase over the previous year. “Folks can keep their smart watches, smart closets, and whatever else they think is making them smart. Banning devices is not going to be the answer here. The answer is changing up the narrative on how we think about IoT devices from a security and risk standpoint, and what expectations we put on manufacturers to increase the security posture of these devices,” wrote Deepen Desai, Zscaler’s vice president of security research in a blog post.

Creating SQL containers on Azure Data Studio Notebooks with Python

The SQL Server tools team at Microsoft introduced Notebooks to Azure Data Studio (ADS) around March 2019. Since then, data professionals from the SQL Server community have been posting and sharing knowledge on how to make the most of this awesome new feature. It was probably May of 2019 when I decided to give ADS Notebooks a try. I started simply just creating some simplified versions of T-SQL notebooks. Then, I decided to move a step forward experimenting with the code cells that support markdown. I felt this step very natural for me, because of my familiarity with the markup language. However, I was looking for something else. Then, I discovered that ADS notebooks also support Python as one of the built-in kernels. That's when notebooks got my attention! I'm a big fan of Python, therefore I started to experiment around immediately. Python is a very modular language with many libraries and SDK's at our disposal, being the Docker SDK one of the most popular and personal favorites.

New York asks domain registrars to crack down on sites used for coronavirus scams

In an email, Kirkendall said his company has already been working with authorities to "proactively prevent, and take down any fraudulent or abusive domains or websites related to COVID19 or the Coronavirus." "These actions also include banning such terms from our available domain name search tool to prevent them from being registered going forward," Kirkendall told us. But only Namecheap appears to have taken proactive steps to block customers from registering coronavirus scammy-looking domains. On the other hand, GoDaddy and Endurance said they'd continue to rely on their abuse reporting mechanisms that are currently in place. "We have processes and procedures currently in place to investigate and respond promptly to notices of illicit customer activity, including alleged illegal activity or other violations of our terms of service," a spokesperson for the Endurance International Group told ZDNet in an email. GoDaddy provided a similar reply via email, but also in a tweet addressed to Attorney General James.

TrickBot and Emotet strains make process injection most prevalent attack technique

According to Red Canary detection engineer Jason Killam, process injection is a technique used by cyberattackers to mix malicious activity with operating system processes that are fairly routine. "Its most useful function may be that arbitrary code, once injected into a legitimate process, can inherit the privileges of that process or, similarly, access parts of the operating system that shouldn't be otherwise available," Killam wrote. Scheduled tasks are similarly designed to take advantage of normal functions by allowing cybercriminals to take certain actions at prespecified times, enabling execution, persistence, and privilege escalation. Red Canary director of advanced threat detection and research Michael Haag said that Scheduled Tasks are a functionally necessary component of the Windows operating system, adding that they execute routinely, and malicious tasks readily blend in with benign ones. "Scheduled Tasks represent a versatile tool for adversaries. With the requisite privileges, an attacker can schedule tasks remotely. The technique is also useful for execution and persistence in conjunction with a variety of widely used scripting languages, such as PowerShell," Haag said.

WHO, coronavirus testing lab hit by hackers as opportunistic attacks ramp up

According to Reuters, WHO has seen a marked increase in attempted cyberattacks – with one of the most recent reportedly perpetrated by a hacker group called DarkHotel. The unsuccessful attack spoofed a webpage to look like a login portal for agency employees in an attempt to steal passwords. As healthcare organizations battle the COVID-19 pandemic, they’re also facing heightened cybersecurity threats from malicious actors looking to take advantage of the crisis caused by the outbreak. The U.S. Department of Health and Human Services also fended off an attack recently as it was simultaneously focused on coronavirus response. Now, a UK-based medical facility that has plans to test coronavirus vaccines, Hammersmith Medicines Research, has been hit by an attack from one of the ransomware groups that recently pledged not to target medical organizations during the COVID-19 pandemic. The criminals behind the Maze ransomware attacks apparently managed to exfiltrate a slew of patient records, and have subsequently published some of the files on the dark web, demanding ransom payment.

CV19: Meet The Volunteer COVID-19 Cyber Heroes Helping Healthcare Fight The Hackers

Radoslaw Gnat, a veteran information security professional, has a very personal motivation for being involved: two of his children were recently diagnosed with virus unrelated pneumonia, and healthcare practitioners are helping them. Radoslaw sees this as an opportunity to contribute back. "We are just a group of people that is using our skills and contacts to help people that are the first line of defense against COVID-19," Gnat says. Those skills cover incident response, research, risk management and training services, among other things. Daniel Card, a self-proclaimed "Cyber Ninja Warrior" and founder of the PwnDefend capture the flag games, has issued a call for more people to help CV19 with its work. Alongside the enormous amount of work that is going into enabling technology solution providers and infosec professional volunteers, Card says that CV19 "must ensure that the work we do is conducted in line with our mission to help, not hinder." To facilitate this, CV19 has published a code of conduct that provides a shared understanding of how everyone should work together during this time of crisis.

IT’s Sudden Challenge: Connecting a Distributed Workforce

For IT departments this shift is creating an entirely new set of challenges. The primary challenge is connecting a distributed, remote workforce to business-enabling applications and services residing in the data center and the cloud. Some users require access to VoIP systems, virtual desktops, and video conferencing that require fast and highly reliable network connections. A company that had 50 branch offices yesterday must now grapple with the idea that every user, and their home network, is a new branch they have to support, representing an exponential increase in the number of sites overnight. Over the past few weeks, as this shift has moved from possibility to reality, we’ve had a series of discussions with customers about how to best meet these changing organizational goals. We’ve taken these requirements into account and have compiled a reference architecture that allows for non-SD-WAN and SD-WAN users alike to connect to applications and services remotely. In this blog we’ll dig into this architecture in more depth.

Fintech Firm Finastra Recovering From Ransomware Attack

CEO Tom Kilroy, who has posted a series of notices on the company's website, on Monday noted that Finastra was still working to "restore full IT operations. As mentioned previously, our solutions each have their own nuanced processes to move from being available to operationally live, and we are working closely with impacted customers to move through these essential steps securely." The ransomware attack. which started on Friday, forced Finastra to take its servers offline to prevent the malware from spreading further within its network, according to the online update. Kilroy did not offer details about the type of ransomware used in the attack on the company's infrastructure, but he noted that no customer or employee data apparently was inappropriately accessed or exfiltrated. Kilroy also noted that any clients running their own software on Finastra's network were not affected. The company is working with U.K. law enforcement officials as well as security firms to investigate the incident.

---

Quote for the day:

"Leaders begin with a different question than others. Replacing who can I blame with how am I responsible?" -- Orrin Woodward

---

Daily Tech Digest - May 31, 2019

How To Identify What Technologies To Invest In For Digital Transformation

There are many aspects of the experience, but if you look at the central pillars of a great experience, it comes down to the acronym “ACT.” The “A” pillar of ACT is anticipation. The platform must anticipate what the customer or employee needs when using the platform. A second pillar, C, reminds that their experience must be complete. The platform should not put the burden of tasks on the customer or employee; it should run the activity to its completion and deliver a satisfying, complete result back to the customer or employee. The third pillar, T, represents the timeliness factor. The experience needs to be performed in a time frame that is relevant and consistent with customer or employee expectations. An example is in sales where the company has 45 minutes (or perhaps two days) to complete the stakeholder’s need. The time is not about response time; it’s about the appropriate amount of time that the individual gives the company to get to a complete answer. It could be seconds, hours or days.

When the Internet of Things meets the digital supply network

The digital twin is an evolving digital profile of the historical and current behavior of products, assets, or processes and can be used to optimize business performance. Based on cumulative, real- time, real-world data measurements across an array of dimensions, the digital twin depends on connectivity—and the IIoT—to drive functionality. Amid heightened competition, demand pressures, inaccurate capacity assumptions, and a suboptimal production mix, one manufacturing company sought ways to drive operational improvements, accelerate production throughput, and promote speed to market. At the same time, however, the manufacturer was hampered by limited visibility into its machine life cycles, and knew relatively little about resource allocation throughout the facility. To gain deeper insight into its processes—and to be able to simulate how shifts in resources or demand might affect the facility—the manufacturer used sensors to connect its finished goods and implement a digital twin.

How iRobot used data science, cloud, and DevOps

The core item in the new design language is the circle in the middle of the robots. The circle represents the history of iRobot, which featured a bevy of round Roomba robots. "The circle is a nod back to the round robots and gives us the ability to be more expansive with geometries," he explains. But iRobot 2.0 also represents the maturation of iRobot. "Innovation at iRobot started back in the early days with a toolkit of robot technology. Innovation was really about market exploration and finding different ways for the toolkit to create value," Angle says. Through that lens, iRobot explored everything from robots for space exploration to toys to industrial cleaning and medical uses. "Our first 10 to 15 years of history is fraught with market exploration," Angle says. Ultimately, iRobot, founded in 1990, narrowed its focus to defense, commercial and consumer markets before focusing solely on home robots. iRobot divested its commercial and its military robot division, which was ultimately acquired by FLIR for $385 million.

The Defining Role of Open Source Software for Managing Digital Data

Open source use is accelerating and driving some of the most exciting ventures of modern IT for data management. It is a catalyst for infusing innovation. For example, Apache Hadoop, Apache Spark, and MongoDB in big data; Android in mobile; OpenStack and Docker in Cloud; AngularJS, Node.js, Eclipse Che, React, among others in web development; Talend and Pimcore in data management; and TensorFlow in Machine learning. Plus, the presence of Linux is now everywhere—in the cloud, the IoT, AI, machine learning, big data, and blockchain. This ongoing adoption trend of open source software, especially in data management, will intensify in the coming time. The capability of open source has a certain edge as it does not restrain IT specialists and data engineers to innovate and make the use of data more pervasive. In my experience, successful data management depends upon on breaking down data silos in the enterprise with a consolidated platform in place for rationalizing old data as well as deploying new data sources across the enterprise.

DevOps security best practices span code creation to compliance

Software security often starts with the codebase. Developers grapple with countless oversights and vulnerabilities, including buffer overflows; authorization bypasses, such as not requiring passwords for critical functions; overlooked hardware vulnerabilities, such as Spectre and Meltdown; and ignored network vulnerabilities, such as OS command or SQL injection. The emergence of APIs for software integration and extensibility opens the door to security vulnerabilities, such as lax authentication and data loss from unencrypted data sniffing. Developers' responsibilities increasingly include security awareness: They must use security best practices to write hardened code from the start and spot potential security weaknesses in others' code.Security is an important part of build testing within the DevOps workflow, so developers should deploy additional tools and services to analyze and evaluate the security posture of each new build.

The Role Of The Chief Artificial Intelligence Officer

The CAIO might not be at the Executive Committee level, but beware the various other departments reaching out to own the role. AI often gets its initial traction through innovation teams – but is then stymied in the transition to broader business ownership. The IT function has many of the requisite technological skills but often struggles to make broader business cases or to deliver on change management. The data team would be a good home for the CAIO, but only if they are operating at the ExCom level: a strong management information (MI) function is a world away from a full AI strategy. Key functions may be strong users of AI  –  digital marketing teams or customer service teams with chatbots, for example  – but they will always be optimising on specific things.  So, who will make a good CAIO? This is a hard role to fill — balancing data science and technology skills with broader business change management experience is a fine line. Ultimately it will be circumstances that dictate where the balance should be struck. Factors include the broader team mix and the budget available, but above all the nature of the key questions that the business faces.

Researcher Describes Docker Vulnerability

Containers, which have grown in popularity with developers over the last several years, are a standardized way to package application code, configurations and dependencies into what's known as an object, according to Amazon Web Services. The flaw that Sarai describes is part of Docker's FollowSymlinkInScope function, which is typically used to resolve file paths within containers. Instead, Sarai found that this particular symlink function is subject to a time-to-check-time-to-use, or TOCTOU, bug. ... But a bug can occur that allows an attacker to modify these resource paths after resolution but before the assigned program starts operating on the resource. This allows the attack to change the path after the verifications process, thus bypassing the security checks, security researchers say. "If attackers can modify a resource between when the program accesses it for its check and when it finally uses it, then they can do things like read or modify data, escalate privileges, or change program behavior," Kelly Shortridge, vice president of product strategy at Capsule8, a security company that focuses on containers, writes in a blog about the this Docker vulnerability.

JDBC vs. ODBC: What's the difference between these APIs?

Many people associate ODBC with Microsoft because Microsoft integrates ODBC connectors right into its operating system. Furthermore, Microsoft has always promoted Microsoft Access as an ODBC-compliant database. In reality, the ODBC specification is based upon the Open Group's Call Level Interface specification, and is supported by a variety of vendors. The JDBC specification is owned by Oracle and is part of the Java API. Evolution of the JDBC API, however, is driven by the open and collaborative JCP and Java Specification Requests. So while Oracle oversees the API development, progress is largely driven by the user community. Despite the separate development paths of ODBC and JDBC, both allow support of various, agreed-upon specifications by RDBMS vendors. These standards are set by the International Standards Organization's data management and interchange committee, and both JDBC and ODBC vendors work to maintain compliance with the latest ISO specification. 

LinkedIn Talent Solutions: 10 tips for hiring your perfect match

The product uses AI to recommend relevant candidates that could be a good fit for an available role, and it leverages analytics to make recommendations in real time as you’re crafting your job description. LinkedIn Recruiter and Jobs also allows companies to target open roles using LinkedIn Ads to reach relevant candidates. In the new Recruiter and Jobs, talent professionals no longer have to jump back and forth between Recruiter and Jobs; the update puts search leads and job applicants for an open role within the same project, viewable on a single dashboard. Candidates can then be saved to your Pipeline, where they’ll move through the later stages of the hiring process. ... Finally, LinkedIn Pages allows organizations of any size to showcase their unique culture and employee experience by posting employee-created content, videos and photos. Candidates can visit and organization’s page to see what your organization has to offer, as well as get personalized job recommendations and connect with employees like them, according to LinkedIn. Real-time page analytics can identify who’s engaging with your organization’s page and which content is making the greatest impact.

Sidecar Design Pattern in Your Microservices Ecosystem

Segregating the functionalities of an application into a separate process can be viewed as a Sidecar pattern. The sidecar design pattern allows you to add a number of capabilities to your application without additional configuration code for third-party components. As a sidecar is attached to a motorcycle, similarly in software architecture a sidecar is attached to a parent application and extends/enhances its functionalities. A sidecar is loosely coupled with the main application. Let me explain this with an example. Imagine that you have six microservices talking with each other in order to determine the cost of a package. Each microservice needs to have functionalities like observability, monitoring, logging, configuration, circuit breakers, and more. All these functionalities are implemented inside each of these microservices using some industry standard third-party libraries. But, is this not redundant? Does it not increase the overall complexity of your application?

---

Quote for the day:

"The essential question is not, "How busy are you?" but "What are you busy at?" -- Oprah Winfrey

---

Daily Tech Digest - April 01, 2019

APT group Elfin switches from data destruction to data stealing via WinRAR vulnerability

Instead of using wipers, Symantec reports that the group’s recent attacks are aimed at data exfiltration using vulnerabilities in a common piece of software. “The main point of entry in recent attacks has been spear-phishing emails capable of delivering malware to the recipient’s computer,” says Dick O’Brien, researcher at Symantec's Security Response. “The group has also attempted to exploit the recently patched WinRAR vulnerability attacks.” After sending phishing emails to targeted companies, the victim is encouraged to download a file, JobDetails.rar, which then tries to exploit vulnerability CVE-2018-20250 in WinRAR. A successful infection on an unpatched system allows an attacker to install any file on the computer. ... “Based on its tactics and targets, our assessment is that Elfin is a state-sponsored espionage group,” says O’Brien. “Given the nature of the group and its targets, we can only speculate that the information in question is likely to be of a strategic or economic interest to Elfin’s sponsors.”

A Regular Expression Engine in C#

Lexing is the process of breaking an input stream of characters into "tokens" - strings of characters that have a "symbol" associated with them. The symbol indicates what type of string it is. For example, the string "124.35" might be reported as the symbol "NUMBER" whereas the string "foo" might be reported as the symbol "IDENTIFIER". Parsers typically use lexers underneath, and then compose the incoming symbols into a syntax tree. Because lexers are called in core parsing code, the lexing operations must be reasonably efficient. The .NET regular expression isn't really suitable here, and while it can work, it actually increases code complexity while diminishing performance. Included in this project is a file called "FA.cs" that contains the core code for a regular expression engine using finite automata which resolves to the humble yet ubiquitous state machine. Finite state machines are composed of graphs of states. Each state can reference another state using either an "input transition" or an "epsilon transition".

AI and data security: a help or a hindrance?

Having the right technology in place is vital but companies need the right people to ensure it runs effectively. In a great deal of cases we’re seeing a shift in companies bringing senior security talent in-house rather than relying on external partners to bolster their security infrastructure. But organisations still have a long way to go when it comes to building security expertise from within. More than half, 52%, of respondents in a recent poll by Infosecurity Europe cited that they have a skill shortage in their organisation when it comes to preventing cyber attacks. Without the right team and technology, cyber attacks will only grow in severity. Neither can work effectively in isolation and those organisations that don’t invest in both will find out that the impact of a data breach goes far beyond fines. Businesses know that there is a high risk of cyber attacks and the majority are trying to build the right team and implement technology to tackle cyber security. But very few leaders truly understand where all data leak vulnerabilities exist and how to prevent them.

Creating HTML Layouts That Meet Web Accessibility Standards

Use ARIA landmarks across the web pages where appropriate. ARIA(Accessible Rich Internet Applications) is a comprehensive technical specification for adding accessibility information to elements that are not natively accessible (in particular, the ones developed with JavaScript, AJAX, and DHTML). With ARIA landmarks, a developer can extend HTML capabilities and apply proper semantics, i.e. properties, to UI and content elements for assistive technologies to understand these. Here is an example of how HTML semantic elements (<header>, <nav>, <main>, <footer>) are combined with ARIA role attributes (“banner”, “navigation”, “main”, “contentinfo”) to make website navigation using a screen reader easier for people with disabilities. Though most ARIA functions were recently implemented in HTML5 (and you should definitely favor these!), not all screen readers and browsers (e.g. IE) are sophisticated enough to depend on HTML semantics only.

Undertake software dependency management to reduce conflicts 

Since dependencies can take numerous forms, it's easy to end up with too many. When software depends on many packages or components, the application might have significant compatibility problems and can be plagued by long downloads, plus require lots of storage space. Similar problems occur with long dependency chains, where components depend on other components, and so on. Dependencies can conflict when multiple applications rely on different, incompatible versions of the same dependency. For example, if an application depends on component A.1 and another application depends on component A.2 but apps cannot install A.1 and A.2 together, a conflict occurs, and many conflicts are more convoluted than this example. In such circumstances, both apps cannot run on the same system at the same time, or the application with the older dependency might need an update to use the current dependency. Circular dependencies can affect software applications or constituent components.

Advancing OpenCL™ for FPGAs

Intel has created Intel® FPGA SDK for OpenCL™ technology, which provides an alternative to HDL programming. The technology and related tools belong to a class of techniques called high-level synthesis (HLS) that enable designs to be expressed with higher levels of abstraction. Intel FPGA SDK for OpenCL technology is now in widespread use. Amazingly for longtime FPGA application developers, the performance achieved is often close to―or even better than― HDL code. But it also seems apparent that achieving this performance is often limited to developers who already know how the C-to-hardware translation works, and who have an in-house toolkit of optimization methods. At Boston University, we’ve worked on enumerating, characterizing, and systematizing one such optimization toolkit. There are already a number of best practices for FPGA OpenCL documents. This work augments them, largely by applying additional methods well known to the high-performance computing (HPC) community2. In this methodology, we believe we’re on the right track.

Nancy Harris of Sage Talks Financial Data and the Cloud

We are spending a lot of R&D time and effort figuring out what does that look like in our world. In our human resources products, we call it augmented intelligence. You can look at the data; you can discern certain things that are going on with your workforce such as diversity. Where you can get into augmented intelligence in a human capital management environment, you can literally train the product to tell you things about the workforce doing ongoing analytics. “With Intacct, we’ve talked a lot about artificial intelligence. When dealing with the close [for bookkeeping] especially for publicly traded companies, what if you could—over time through artificial intelligence—just always have an ongoing close? So it was never a monolithic event? Transactions were always updated. You had triggers that showed you potentially fraudulent transactions. You’re cleaning up your books as you go along. There is no notion of a period end close. You’re always closing. You could teach an AI engine how to do a continuous financial close. Those are the kinds of things we are trying to bring to bear within our products.

Artificial Intelligence is Really the Future? Let's Explore

The fresh recognition given to the pioneers of artificial intelligence, computer scientists Yoshua Bengio, Geoffrey Hinton and Yann LeCun with the Turing Award, an honour that is better known as technology industry’s version of the Nobel Prize has established that the world is acknowledging the relevance of emerging tech. AI has become a part of DNA for tech giants like Google. To maintain the sanctity of this technology and address the concerns around the ethics revolving around the growth of artificial intelligence, the company has created an Advanced Technology External Advisory Council to keep AI in check and shape the "responsible development and use" of AI in its products. Apart from being the fastest growing technologies in science, AI has taken the crown for being the front-runner for digital transformation, which has become a major part of every company’s agenda; 40 per cent of which is expected to be met by employing artificial intelligence. Smart assistants are fostering decision making procedure in diverse fields, from medicine, IT and education too.

Critical Magento SQL injection flaw could be targeted by hackers soon

Due to its popularity and the sensitive customer data it processes, the Magento platform is an attractive target for hackers and has been targeted in widespread attacks many times in the past. The number of attacks against online shops in general has increased over the past year, with some groups of hackers specializing in web skimming -- injecting rogue scripts on computers to capture credit card details. SQL injection vulnerabilities allow injecting data into or reading information from databases. Even if this particular flaw can't be used to infect a website directly, it can potentially give attackers access to accounts on a site. That access can then be used to exploit one of the other privilege escalation or code execution flaws that were patched in this release and which require authentication. "Unauthenticated attacks, like the one seen in this particular SQL Injection vulnerability, are very serious because they can be automated — making it easy for hackers to mount successful, widespread attacks against vulnerable websites," the Sucuri researchers warned. 

C# Futures: Deferred Error Handling

In order to use deferred error handling, a new compiler directive called “exception mode” is used. This switches the current function between structured exception handling and the new deferred mode. When using the deferred mode, the Exception.LastException property can be used to determine if an error has occurred. This stores only the most recent error, so if multiple errors occurred, all but the last will be lost. This has caused some concern, as it would mean one should check LastException after each line, which would be contrary to the goal of reducing the amount of code needed. To address this, an amendment to the proposal is to replace LastException with a stack is under consideration. ... The use of both structured and deferred error handling in the same function can be problematic from a compiler standpoint. Deferred mode fundamentally changes the way the code is compiled, much like how C# implements closures and async/await without CLR support.

---

Quote for the day"

"Real leadership is being the person others will gladly and confidently follow." -- John C. Maxwell

---

Daily Tech Digest - March 21, 2019

Industry 4.0 shifting from buzzword to reality, says Hampleton Partners' M&A report

Hampleton’s Industry 4.0 M&A Market Report records more than 600 deals in 2018, up from 513 in 2017. The analysis reveals that the highest level of interest lies in AI technologies with context information, digital threads and digital twin solutions. Dr.-Ing. Peter Baumgartner, sector principal at Hampleton Partners, said: “A mere buzzword a few years ago, Industry 4.0 has become today’s reality and is one of the hottest M&A sectors in the DACH region. Liquidity is at a high level, meaning that buyers have the funds to support start-ups or established Industry 4.0 players, and the cutting-edge technology coming out of the region has generated many M&A deals.” Industry 4.0 has become integral to the region’s technology giants such as Bosch Rexroth, Festo and Siemens, whilst a recent strategic partnership between Rockwell Automation and PTC, accompanied by a $1 billion equity investment from the former, further demonstrates the importance of integrating innovations such as IoT and augmented reality with more traditional industrial automation.

CISOs, Know Your Enemy: An Industry-Wise Look At Major Bot Threats

According to a study by the Ponemon Institute in December 2018, bots comprised over 52% of all Internet traffic. While ‘good’ bots discreetly index websites, fetch information and content, and perform useful tasks for consumers and businesses, ‘bad’ bots have become a primary and growing concern to CISOs, webmasters, and security professionals today. They carry out a range of malicious activities, such as account takeover, content scraping, carding, form spam, and much more. The negative impacts resulting from these activities include loss of revenue and harm to brand reputation, theft of content and personal information, lowered search engine rankings, and distorted web analytics, to mention a few. For these reasons, researchers at Forrester recommend that, “The first step in protecting your company from bad bots is to understand what kinds of bots are attacking your firm.” So let us briefly look at the main bad bot threats CISOs have to face, and then delve into their industry-wise prevalence.

A Comparison Between Flutter And React Native

As the need for mobile apps increase, developers are looking at ways to build better apps in a faster way. New frameworks are emerging to make work easier for app developers. Developers can create the most attractive native-like apps with Cross-platform app development. These apps provide a better user experience while making the developing process easy and fast. As more and more frameworks emerge, there is a compulsion to compare these and find out which is more suitable. Flutter is a reasonably new framework while React Native has been here for quite some time now. Both these are cross-platform frameworks helping to develop native apps easily. A comparison of these frameworks will help many app developers to decide which will be better for their apps. While Flutter is a product from Google, Facebook had launched React Native. Cross-platform frameworks are a great help for developers because it avoids the need for maintaining two teams for the two mobile platforms.

Resumable Online Index Create and Rebuild Operations

When you cancel an index rebuild or a create index operation in SQL Server prior to SQL Server 2017, the database engine must roll back all the work it had done on the index. Because of this, when you restart the index rebuild or create index process, SQL Server has to start all over again at rebuilding or creating the index. This causes lots of processing and requires resources just to redo what was done prior to cancelling the indexing rebuild or create index process. But if you migrate your older versions of your databases to SQL Server 2017, you can restart your online index rebuild operations. Plus, with the rollout of the previews of Azure SQL Database or SQL Server 2019, you can pause and restart both your online rebuilds and creation processes. Being able to pause these online index operations allows SQL Server to pick up the rebuild or create index operations where they left off.

Success with the IoT starts with understanding 'Thing Management'

A typical cell phone has nearly 14 sensors, including an accelerometer, GPS, and even a radiation detector. Industrial Things such as wind turbines, gene sequencers, and high-speed inserters can easily have 100 sensors. People enter data at a snail’s pace when compared with the barrage of data coming from the IoT. A utility grid power sensor, for instance, can send data 60 times per second, a construction forklift once per minute, and a high-speed inserter once every two seconds. Technologists and businesspeople both need to learn how to collect and put all of the data coming from the industrial IoT to use and manage every connected Thing. They will have to learn how to build enterprise software for Things versus people. The industrial IoT is all about value creation: increased profitability, revenue, efficiency, and reliability. It starts with the target of safe, stable operations and meeting environmental regulations, translating to greater financial results and profitability.

jOOPL: Object-Oriented Programming for JavaScript

Web development has increased its complexity during the last decade. Think about how the Web was and in what it turned into now: the Web of applications. Also known as Web 2.0 and the coming 3.0. JavaScript has been the language that accompanied the Web since its early stages. Someday was the way to add some fancy effects to our pages, but as the language has evolved into an actual application programming language, the need to reuse and scale have become an important point in Web development. Definitively, object-oriented approach on graphical user interface, domain and others, has demonstrated that is a good way of creating well-structured, reusable and maintainable software. The worst part is JavaScript is not an object-oriented programming language: it is prototype-oriented, which is a weak approach to leverage few features of a full-fledged object-oriented platform. That is why jOOPL exists. "jOOPL" stands for "JavaScript Object-Oriented Programming Library".

Cash review suggests fintech “is not a panacea” yet

“Fintech is fantastic as it is, but it is not a panacea,” said banking specialist Mark Aldred by email, of ATM software firm, Auriga, the banking and cash management firm. Access to Cash, an independent body established to gauge the effects of going cashless, reported in its final review in early March that 2.2m people rely solely on cash while 8m would struggle in a completely cash-free society. “There are technological developments which could address many of the needs of those who depend on cash,” reads the executive summary, citing the UK’s reputation as a source of financial technology innovation. The word ‘fintech’ appears 19 times, each time exploring how the fledgling sector could better serve the 2.2m. However, the report also acknowledges that fintechs tend to target early adopting consumers as opposed to the majority of late adopters who populate the 8m underserved. “Fintech is seeking to move from its digitally-savvy demographic,” said Aldred. “Key to mainstream adoption of app-only banks and other fintech options will be how trust is developed in availability of these services.

Cyberattacks: Europe gets ready to face crippling online assaults

The agency said to be certain that it was a criminal attack, the electronic evidence that could be found within the IT systems affected by the attack must be preserved, as this is essential for any criminal investigation. "It is of critical importance that we increase cyber preparedness in order to protect the EU and its citizens from large scale cyberattacks," said Wil van Gemert, deputy executive director of operations at Europol.  While European governments and businesses face a range of threats, it is notable the announcement comes ahead of European elections in May and a number of other votes across Europe this year. As well as large-scale ransomware attacks, Europe is keen to stop any repeat of the election meddling that affected the US Presidential election in 2016. In February, Microsoft warned that it had seen recent hacker activity targeting democratic institutions in Europe, including attacks on election campaigns, but also think tanks and non-profit organizations working on topics related to democracy, electoral integrity, and public policy and that are often in contact with government officials, and said that Russian intelligence was behind the attacks.

Cyber security skills shortage driving outsourcing — NETSCOUT research

Operational challenges are further compounded by difficulty in hiring and retaining skilled personnel, which, together with lack of headcount or resources, were cited as the top challenges faced by security leaders. The findings show that this is driving an increased reliance on outsourced services, with approximately a third of enterprises outsourcing at least a part of their security operation, up 12% from 2017. This trend looks set to continue for the foreseeable future, with 39% of respondents stating they expect to increase their investment in outsourced services in the next 12 months. “In leaning on outsourced security professionals, businesses are identifying the short-falls of their internal processes and capabilities and are moving to address risk in the only way they can,” added Anstee. “There is nothing wrong with this strategy, as long as businesses are clear that they still own the underlying risk.” Adding to the challenge facing organisations is an evolution in DDoS attack size, with 91% of companies experiencing an attack indicating that their internet connectivity was saturated on at least one occasion.

The Dawn Of The Deep Tech Ecosystem

Deep tech startups rarely follow the established funding progression of other types of young tech enterprises—seeking money from friends and family, then angel or seed investors, then successive rounds of venture capital investment at increasing valuations (which validate the decisions of previous investors), leading ultimately to a trade sale or an IPO. In deep tech, public funding plays an important role in the early phase, and friends-and-family money is rarely significant relative to the substantial capital requirements of early R&D. Private-public financing schemes are becoming increasingly important to financing deep tech ventures along their entire life cycle, and corporate venture capital (CVC) funds, incubators, and accelerators also have become prevalent partners since they provide not only funding but other critical forms of support. ... The growing deep tech ecosystem facilitates research into almost any kind of technology, from things we can’t see to concepts that relatively few can explain. This ecosystem is rooted in a handful of trends.

---

Quote for the day:

"Inspired leaders move a business beyond problems into opportunities." -- Dr. Abraham Zaleznik

---

Daily Tech Digest - July 19, 2018

6 usability testing methods that will improve your software

Successful software projects please customers, streamline processes, or otherwise add value to your business. But how do you ensure that your software project will result in the improvements you are expecting? Will users experience better performance? Will the productivity across all tasks improve as you hoped? Will users be happy with your changes and return to your product again and again as you envisioned? You don’t find answers to these questions with a standard QA testing plan. Standard QA will ensure that your product works. Usability testing will ensure that your product accomplishes your business objectives. Well planned usability testing will shed a bright light on everything you truly care about: workflow metrics, user satisfaction, and strength of design. How do you know when to start usability testing? Which usability tests are right for your product or website? Let’s examine the six types of usability testing you can use to improve your software.

Facial Recognition Backlash: Technology Giants Scramble

Microsoft's president responded specifically to those allegations in his blog post, first touching on Microsoft's work with ICE, a law enforcement agency that is part of the U.S. Department of Homeland Security. "We've since confirmed that the contract in question isn't being used for facial recognition at all. Nor has Microsoft worked with the U.S. government on any projects related to separating children from their families at the border, a practice to which we've strongly objected," Smith said. Instead, the contract involves supporting the agency's "legacy email, calendar, messaging and document management workloads," Smith said. But at what point should an organization put down its foot with a federal agency operating in a manner to which at least some of its employees object? "This type of IT work goes on in every government agency in the United States, and for that matter virtually every government, business and nonprofit institution in the world," Smith said. "Some nonetheless suggested that Microsoft cancel the contract and cease all work with ICE."

How to Query JSON Data with SQL Server 2016

JSON (JavaScript Object Notation) is now the ubiquitous language for moving data among independent and autonomous systems, the primary function of most software these days. JSON is a text-based way to depict the state of an object in order to easily serialize and transfer it across a network from one system to the next -- especially useful in heterogeneous environments. Because a JSON string equates to a plain text string, SQL Server and any other relational database management system (RDBMS) will let you work with JSON, as they all allow for storing strings, no matter their presentation. That capability is enhanced in SQL Server 2016, the first-ever version that lets developers query within JSON strings as if the JSON were organized into individual columns. What's more, you can read and save existing tabular data as JSON. For a structured and comprehensive overview of the JSON functions in SQL Server 2016, read the "JSON Data (SQL Server)" MSDN documentation. Also, the "JSON Support in SQL Server 2016" Redgate Community article provides a more business-oriented view of JSON in SQL Server 2016, along with a scenario-based perspective of the use of JSON data in a relational persistence layer.

Heuristic automation prevents unmitigated IT disasters

IT platforms are constantly under attack from all sorts of possible malicious efforts, ranging from open port sweeping to intrusion attacks and denial-of-service assaults, such as the sophisticated distributed DoS move that took down Dyn in 2016. Historically, IT and security professionals identify that an attack is happening and then simply apply a defined means to deal with the problem. With heuristic automation in the mix, automation becomes responsive to changes in the IT environment caused by the attack. Instead of applying a simple and often ineffective fix, a heuristic IT management system looks at the IT deployment as an overall entity and applies the right fix for the situation. In this example, heuristic automation could change traffic patterns to offload incoming streams to a separate area of the platform and block certain traffic from access to those streams. It also could reallocate running workloads to a public cloud instead of the private cloud, or vice versa, to prevent service disruption. Provide the heuristics engine with information about possible attacks, and it can harden the platform in real time to prevent them from ever happening.

What’s new in the Anaconda distribution for Python

Anaconda, the Python language distribution and work environment for scientific computing, data science, statistical analysis, and machine learning, is now available in version 5.2, with additions to both its enterprise and open-source community editions. ... This enterprise edition of Anaconda, released this week, adds new features around job scheduling, integration with Git, and GPU acceleration. Earlier versions of Anaconda Enterprise were built to allow professionals to leverage multiple machine learning libraries in a business context—TensorFlow, MXNet, Scikit-learn, and more. In version 5.2, Anaconda offers ways to train models on a securely shared central cluster of GPUs, so that models can be trained faster and more cost-effectively. Also new in Anaconda Enterprise is the ability to integrate with external code repositories and continuous integration tools, such as Git, Mercurial, GitHub, and Bitbucket. A new job scheduling system allows tasks to be run at regular intervals—for instance, to retrain a model on new data. 

Are organizations over-engineering their data centers?

With such incredible off-premise computing momentum, the potential impact of a wide-spread outage from a major data center provider grows daily. Enterprises are acutely aware of how outages could impact their mission-critical data – security was listed as a major concern for 77 percent of cloud users in RightScale’s report. Understandably, data center owners and operators have placed resiliency at the top of their priorities and turn to third-party certifiers to help address the most common root causes of outages, including human error, software issues, network downtime, and hardware failure with a corresponding failure of high availability architecture. However, there are limited offerings for data center operators to get a holistic audit of all factors that contribute to the resiliency of their services. We’ve been hearing directly from providers that existing offerings have not kept up with the pace of change in the industry. Incumbent programs will sometimes require a facility to be unnecessarily over-engineered. It’s not cost effective, and takes the focus away from what truly matters to enterprise users: security and reliability.

Raspberry Pi supercomputers: From DIY clusters to 750-board monsters

While the $35 Pi is by no means a computing powerhouse, in recent years enthusiasts have begun harnessing the power of armies of the tiny boards. There's a wide range of Pi clusters out there, from modest five-board arrangements all the way up to sprawling 750-Pi machines.If you're curious to find out more, then here's five Pi clusters built in recent years, starting with some you can try yourself and moving on to the Pi-based supercomputers being built by research labs. ... The Los Alamos National Lab (LANL) machine serves as a supercomputer testbed and is built from a cluster of 750 Raspberry Pis, which may later grow to 10,000 Pi boards. According to Gary Grider, head of its LANL's HPC division, the Raspberry Pi cluster offers the same testing capabilities as a traditional supercomputing testbed, which could cost as much as $250m. In contrast 750 Raspberry Pi boards at $35 each would cost just under $48,750, though the actual cost of installing the rack-mounted Pi clusters, designed by Bitscope, would likely be more. Grider highlights power-efficiency benefits too, and estimates that each board in a several-thousand-node Pi-based system would use just 2W to 3W.

LabCorp. Cyberattack Impacts Testing Processes

"LabCorp immediately took certain systems offline as part of its comprehensive response to contain the activity," the company said in its SEC filing. "This temporarily affected test processing and customer access to test results on or over the weekend. Work has been ongoing to restore full system functionality as quickly as possible, testing operations have substantially resumed [Monday], and we anticipate that additional systems and functions will be restored through the next several days." Some customers of LabCorp Diagnostics may experience brief delays in receiving results as the company completes that process, LabCorp added. "The suspicious activity has been detected only on LabCorp Diagnostics systems. There is no indication that it affected systems used by Covance Drug Development," a research unit of LabCorp, the company said. "At this time, there is no evidence of unauthorized transfer or misuse of data. LabCorp has notified the relevant authorities of the suspicious activity and will cooperate in any investigation."

An introduction to ICS threats and the current landscape

An ICS is a key underlying element of the OT world. According to the National Institute of Standards and Technology report NIST SP 800-82 R2, "Guide to Industrial Control Systems (ICS) Security," ICS is a "general term that encompasses several types of control systems, including supervisory control and data acquisition (SCADA) systems, distributed control systems (DCS), and other control system configurations such as skid-mounted Programmable Logic Controllers (PLC) often found in the industrial sectors and critical infrastructures." ICS is used in the industrial, manufacturing and critical infrastructure sectors. For instance, railway controls are a type of SCADA. A street light controller may be a PLC, but it can also be part of a SCADA system. Finally, an ICS includes combinations of control components, including electrical, mechanical, hydraulic or pneumatic, that act together to achieve an industrial objective, such as manufacturing, transportation, or the distribution of material or energy.

Q&A on the Book Testing in the Digital Age

A good example for generating test cases can be the use of an evolutionary algorithm in testing automated parking on a car. You can imagine that with automatic parking, the amount of situations the car can be in are nearly infinite. The starting position may vary with surrounding cars positioned in many different ways, or other attributes that cannot be hit are around the car. The automatic parking function may not hit anything when parking and the car needs to be parked in a correct way. In this case we can generate a series of starting positions that the automatic park function needs to tackle. Ideally this is virtual so we can run a lot of tests quickly. It could be physical tests of course, but it would take more time in test execution. We need to define a fitness function that is evaluated with each test execution run. In this case it would be a degree of passing for the parked car. You can imagine some points for not hitting anything, and points for how well the car is parked in the end. Now we generate a series of tests and run them. Each outcome is evaluated and assigned a total points value.

---

Quote for the day:

"Strength lies in differences, not in similarities." -- Stephen R. Covey

---