Daily Tech Digest by Kannan Subbiah

September 04, 2014

The Rack Endgame: A New Storage Architecture For the Data Center
To many SDDC is the holy glue of datacenters, the primordial soup. I’m referring to the term introduced by Oparin, not Teenage Mutant Ninja Turtles although some datacenters do have most characteristics of a mutant. In reality many virtual infrastructures rest on a disparate set of hardware components. This equipment, typically multi-vendor, is expected to provide deterministic performance levels. Now it’s expected that SDDC will be this soup that transforms into a more mature form. And yet I don’t see this happening soon.

Connected car company Zubie signs deal with Progressive
For Progressive, which has been a pioneer in usage-based pricing, it wants to start getting out of the business of sending customers hardware in order to track their driving habits. Currently under a program called Snapshot, Progressive customers opt in to a device that plugs into their cars’ on-board diagnostics(OBD) ports and shares their driving data with the insurer. They use the device for six months and then send it back. In return, Progressive charges them based on how well they drive, presumably giving them a lower rate on their insurance. (I can’t see someone who gets a bad rate sticking with Progressive.)

Machine Learning – The Engine Behind Big Data Processing
Now we find ourselves in wave three, where the challenge is not only to analyze the data, but do it quickly and deliver as much tailored information as possible without additional personnel. Machine learning has finally hit its stride by helping to solve the challenges associated with rapidly obtaining relevant insights. Especially in the world of unstructured machine data, machine learning is making CIOs think again about what – and when – they can gather insights from their own infrastructure. Today, organizations generate more data in 10 minutes than they did during the entire year of 2003.

How to Unlock the Potential in Your Business Analytics
With its anticipatory shipping, Amazon has taken its understanding of data to the next level. The retail company could conceivably ship products before you even place an order. A forecasting model uses data from your prior Amazon activity, including time on site, duration of views, links clicked and hovered over, shopping cart activity, and wish lists. The algorithm also factors in real-world information from customer telephone inquiries and responses to marketing materials to offer Amazon an in-depth view of user needs and behavior and inform new changes.

Data shows Home Depot breach could be largest ever
"The banks I spoke with in reporting this story say the data they're looking at suggests that the breach probably started in late April or early May. To put that in perspective, the Target breach impacted just shy of 1,800 stores, lasted for approximately three weeks, and resulted in the theft of roughly 40 million debit and credit card numbers. "If a breach at Home Depot is confirmed, and if this analysis is correct, this breach could be much, much bigger than Target," Krebs wrote. Home Depot itself has so far not confirmed a data breach and has only said that it is investigating reports of "unusual activity" involving credit and debit cards used at its stores.

For CFOs, Tech Transition Is A Matter Of When, Not If
Another area that’s often overlooked is the ability to model the long-term impact of your current decisions, particularly for technology companies where there’s a maintenance element to what you’re selling. Having the right tools in place – for example, tools you use to procure products and manage long-term contracts – allows you to spend more time with analytics. The use of big data tools allow you to combine your financial or human resource data with unstructured data from other sources, including social media, compensation and economic or market data, to gain new insights for the business. This will change the way finance professionals work over the next decade.

What Kind of CIOs Will Millennials Make?
In order to understand millennial techies' future buying habits and how they view brands, just look at their approach to consumer goods. Millennials have been bombarded with brands in email advertisements, Web-based marketing, social networks and mobile apps, as well as traditional radio and television, whereas Gen Xers learned about brands mostly from a few vendors that could afford television commercials. "This may have caused millennials to be distrustful of larger brands, because they sense those companies have nothing but an ulterior motive," Thibodeaux says.

Setting up a ruby development VM with Vagrant, Chef, and rbenv
In recent years I've had more colleagues and friends write articles on my site using the toolchain. To work with them I set up a stripped down copy of my core website repo and we collaborate using git. Since my collaborators are mostly programmers this workflow is pretty effective. To run all this, it's necessary to install some software. All the software I use for the toolchain is open-source, but recently there have been some installation issues. In particular you find that many basic ruby installations are elderly, so we need to install a newer version of ruby.

Future Of Work: 5 Trends For CIOs
These trends -- which include social business, big data analytics, and the millennial workforce, among others -- have forced an "adapt or disappear" scenario for CIOs. Ray Kurzweil, director of engineering at Google, says that technology has reached the second half of the chessboard -- or that the rate of change and growth is now exponential. This analogy, though, can extend beyond technology and into new business practices and ways of working. To keep up with the changes that employees and businesses are experiencing, CIOs need to recognize five trends driving these changes, and plan accordingly to stay ahead of the curve.

Are Cloud Services Safe? iCloud Breach Revives Debate
"The cloud is a mistake. No one's data is safe," banking attorney Timothy Naegele wrote in an online comment posted to American Banker's Tuesday story about the breach. "It is vulnerable to hackers, terrorists and others. Anyone who tells you differently is mistaken." In addition to financially motivated cybercriminals, Naegele, a former counsel to the Senate Banking Committee, points to the threat of hackers from other countries. "China has hacked us and a lot of phishing comes straight out of Russia," he said in a later interview. Russian hacking attempts are believed to be retaliation for U.S. economic sanctions against the country over its military presence in Ukraine.

Quote for the day:

"Patience, persistence and perspiration make an unbeatable combination for success." -- Napoleon Hill

September 03, 2014

Privacy laws create obstacles for e-discovery in the cloud
In many countries outside the United States -- and increasingly inside the [U.S.] within specific industries such as healthcare and financial services -- national laws are protecting how personally identifiable information such as our name, our address, our health condition or our banking history is collected and used. Generally, those laws have a restriction that personally identifiable information cannot cross national borders unless the receiving location or entity can provide assurances that the interests for persons for whom the data is relevant are being protected.

Building Lambda Architecture with Spark Streaming
Spark is well known as a framework for machine learning, but it is also quite capable for ETL tasks, as well. Spark has clean and easy-to-use APIs (far more readable and with less boilerplate code than MapReduce), and its REPL interface allows for fast prototyping of logic with business users. Obviously, no one complains when the aggregates execute significantly faster than they would with MapReduce. But the biggest advantage Spark gave us in this case was Spark Streaming, which allowed us to re-use the same aggregates we wrote for our batch application on a real-time data stream.

Top 10 Ways In-Memory Computing Can Revitalize Tech at Federal Agencies
With IT experts agreeing that RAM is the new disk, in-memory computing is being seen as the secret to cost-effective modernization. As a result, more and more organizations are moving data into machine memory and out of disk-based stores and remote relational databases. While still more prevalent in the commercial sector, the public sector is rapidly learning that if data resides right where it’s used – in the core processing unit where the application runs – several benefits arise. Below are the top 10 reasons why federal agencies are embracing in-memory computing:

When It Comes to Innovation, Small Ideas Can Mean Big Wins
A common criticism of big companies, regulated companies, and companies with “traditional” cultures is that they move slower than a snail crawling through peanut butter. Government compliance and accounting for the widespread impacts of an idea are necessary steps in the innovation process. Necessary or not, these steps are time-consuming and frustrating for employees and partners trying to push fresh ideas forward. Employees interpret the meetings and approvals as a fear of innovation among executives. When things don’t move fast enough, team members give up and stop suggesting ideas all together.

Insurers will now be able to track driver behavior via smartphones
A new usage-based insurance (UBI) software platform will allow companies to track drivers' behavior through smartphone sensors and geolocation services. Agero, one of the nation's largest suppliers of roadside safety software and services to automakers and insurance companies, said its new UBI telematics suite will transmit to insurers the information needed to offer discounts to good drivers, penalize others, and send alerts to emergency assistance service providers.

IT jobs' big threat: Robots, automation; The solution: More humanity
A survey that went along with ZDNet's special report on IT jobs found that 59 percent of technology workers worried that their skills would become obsolete. Mainframe programmers, systems admins, help desk technicians and small business IT managers are becoming obsolete. Systems admins are likely to be automated in the future. Data scientists, IT architects, mobile software developers and security analysts are in demand. It's unclear how many workers that are out of demand can be morphed into ones that are coveted.

Google says Android Wear about to get even smarter
One of the things we're going to be able to do is add the ability for these devices to start working with some of the other devices you might wear on your body. So we'll have an update coming that allows you to pair a Bluetooth headset with your watch. And that means you can play music stored on your watch directly on your Bluetooth headset. Alongside that, we're introducing GPS support for the platform. So that's obviously only for devices that have the GPS hardware. But we're excited about those two features together because it unlocks a whole set of new use cases.

Cloud economics subject to business drivers, customer perception
"It's always perception that we're battling, right?" Nustad said. "If a client perceives for any reason that there's less security, it's not worth the hassle to try to dissuade them, because it's always going to be a 'gotcha' if something does go bump in the night, God forbid." Cloud-based business applications, however, are another story. "It's pretty easy to get a Salesforce, Silkroad, a Red Carpet … that are tuned to what the business team needs," she said. Indeed, HMS' use of SaaS predates her tenure, Nustad said, noting that these apps are now mature enough to either meet or beat any on-premises solutions she could come up with -- and they save her maintenance costs.

Agile Business Intelligence: Leaving the Comfort Zone
Agile methods, whether adhered to strictly or more in spirit, can provide a framework and road map for business and IT to improve collaboration. "Managing Agile BI for the Enterprise" is the theme of the TDWI World Conference coming up in San Diego (September 21-26, 2014). Many organizations today are seeking to replace waterfall development with iterative approaches that involve closer, ongoing partnerships between business and IT professionals. Agile approaches have enabled organizations to accelerate the pace of projects, apply shared best practices, consolidate siloed efforts, and continuously improve quality.

Hackers make drive-by attacks stealthier with fileless infections
Fileless malware threats are not new, but their use is rare, especially in large scale attacks, because they don't persist across system reboots when random access memory (RAM) is cleared. In a typical drive-by download attack the victims visit a compromised website that redirects their browsers to an attack page -- usually an exploit kit's landing page. The exploit kit scans browsers for outdated versions of Flash Player, Adobe Reader, Java or Microsoft Silverlight and tries to exploit known vulnerabilities in those plug-ins to install malware.

Quote for the day:

"A great man is one who can have power and not abuse it." -- Henry L. Doherty

September 02, 2014

11 Steps Attackers Took to Crack Target
Leveraging all the publicly available reports on the breach, Aorato Lead Researcher Tal Be'ery and his team catalogued all the tools the attackers used to compromise Target in an effort to create a step-by-step breakdown of how the attackers infiltrated the retailer, propagated within its network and ultimately seized credit card data from a Point of Sale (PoS) system not directly connected to the Internet. Many of the details of how the breach occurred remain obscured, but Be'ery says it is essential to understand how the attack happened because the perpetrators are still active.

The state of IT jobs in Australia
"Certainly, all of our operations engineers are DevOps engineers; they're all very proficient now with scripting and coding, with automation — whether it's for integration deployment or monitoring — so, certainly I think that skill-set is vital," Kennedy told ZDNet. "Around the world, of the people who had those traditional infrastructure skills, it's the ones that have adapted, that have gone and learned some new tools, that are doing well," he said. The company initially shifted to a VMware environment to deliver on its DevOps approach, but has since settled into the Amazon Web Services (AWS) cloud infrastructure. That move to the cloud required further integration of a multi-skilled toolkit for Kennedy's team.

Bugs Are Bad, But So Are Flaws: IEEE Sponsors Center for Secure Design
There's a difference between a bug and a flaw, and an impressive group of software security mavens thinks it's time to pay more attention to the latter. To shift some of the industry's focus away from finding implementation bugs and toward identifying common design flaws -- "the Achilles' heel" of security engineering -- the IEEE Computer Society has formed the Center for Secure Design (CSD). The CSD grew out of a foundational workshop, held in April, which brought together software security experts from industry, academia and government to talk about the problem of secure software design.

Derailing Your Supply Chain BI Project
Indeed, the foundation of every Supply Chain information system is the desire to let objective, relevant information drive action — in other words, to empower and enlighten workers about data and to make decisions after they’ve looked carefully at “just the facts.” Unfortunately, all of this happy talk about focusing on facts presumes that we’re dealing with Homo Economicus (aka “Rational Man”) as if Rational Man were plentiful and in charge. Today I’m going to grapple with a far more common being — Irrational Man — we’ll call him Homo Irrationalis. Where Homo Economicus seeks out facts and is willing to be persuaded by them, Homo Irrationalis pays lip service to facts, but in reality the facts don’t matter, his mind is already made up.

Making Analytics a Corporate Strategic Role
"There absolutely are disconnects between CXOs and big data, because CXOs are daily getting hit with all of the market buzz about big data and analytics, without really gaining a crisp understanding of what big data is about and what it can mean to their organizations," John Lucker, principal and global advanced analytics and modeling leader for Deloitte, told me in a recent interview. There's a risk that organizations never get to the "crunchy questions" that can be asked of big data because of persisting habits of looking at hindsight, "rearview mirror" data.

How Big Data Can Transform Consumer Finance
Some of the inferences Merrill makes from Big Data sound as though they violate the “correlation is not causation” maxim. For example, Big Data tells ZestFinance that creditors are more likely to collect on delinquent student loans if the borrower has comparatively more addresses after graduation – unless they move super-frequently. Similarly, borrowers who move far away from college are somewhat less likely to repay delinquent loans. Merrill says this additional data helps collections outfits decide which loans are most likely to be repaid. The belief is that with a population chosen using these techniques, it’s more likely that lender and borrower can work out repayment plans.

CEOs on point – Securing the Internet of Things on your watch’
The Internet of Things will lead to hundreds, thousands, maybe even hundreds of thousands of physical devices in your enterprise being connected to the Internet. And every single one of those devices will be a potential point of vulnerability. It doesn’t take much imagination to see the compromising impact of powering down or interfering with millions of devices through a single Internet of Things vulnerability, potentially resulting in physical damage to environments, injuries or death. But securing the Internet of Things represents new challenges in terms of the type, scale and complexity of the technologies and services that are required.

Hillary Clinton talks NSA and privacy, data security, tech jobs in San Francisco
"I think it's fair to say the Government, the NSA, didn't so far as we know cross legal lines, but they came right up and sat on them," said Clinton. "It could perhaps mean their data was being collected in metadata configurations, and that was somehow threatening. We have to be constantly asking ourselves what legal authorities we gave to the NSA and others and make sure people know what the tradeoffs are." Clinton lamented that "probably the most frustrating part of this whole debate" is trying to convey that the United States is not the only country trying to manage and balance these conflicts.

India ranks fourth among most malware-affected nations: F-Secure
Commenting on the India findings, F-Secure security advisor (ASIA) Goh Su Gim said, "India is seeing a rise in premium content SMS type malware." Besides, mobile ransomeware is going to be the next wave of attack for handsets and it is being increasingly seen that these ransomeware is also targeting enterprises. Earlier they were confined to individual users, he added. Ramsomware, a kind of malicious software, is designed to block access to a computer until a certain sum of money is paid. Generally, it targets individuals. F-Secure India country head Amit Nath said there is a rise in botnet cases in India.

The Fall of Intuition-Based Decisions and Rise of Little Data
While most managers agree on the importance of using data, many believe that the big data hype often associated with companies like Google and Amazon doesn’t apply to them. Or perhaps they are intimidated with the internal resources and hefty investment required to tap into that data. Others may be skeptical that the use of predictive models can actually lead to better business performance. As a result, managers too often fall back on subjective, intuition-based methods to make business decisions, missing the benefits reaped by those who have tapped into the data available to them.

Quote for the day:

"The contest for ages has been to rescue liberty from the grasp of executive power." -- Daniel Webster

September 01, 2014

CryptoWall ransomware held over 600,000 computers hostage, encrypted 5B files
The CryptoWall command-and-control servers assign a unique identifier to every infection and generate RSA public-private key pairs for each one. The public keys are sent to infected computers and are used by the malware to encrypt files with popular extensions -- movies, images, documents, etc. -- that are stored on local hard drives, as well as on mapped network shares, including those from cloud storage services like Dropbox and Google Drive. Files encrypted with an RSA public key can only be decrypted with its corresponding private key, which remains in the possession of the attackers and is only released after the ransom has been paid.

Business Services: What are they, really?
As a starting point, we can focus on the business processes from the process landscape comprised of core and noncore functionality. These processes can usually be represented at various abstraction levels referred to as process levels in a process model (e.g. descriptive, analytical/operational, and executable). Business services can then be identified and extracted from these levels with a top-down approach. Higher abstraction levels provide inputs for composite Business services, while lower levels provide inputs for fine grained candidates. Such a focus on processes and Business service candidates would also help identify functional redundancy across the enterprise. Still the results from such approach may differ from one organization to another.

Q&A with Marshall Van Alstyne, Research Scientist MIT Center for Digital Business
I think of “platform” as a combination of two things. One, a set of standards or components that folks can take up and use for production of goods and services. The second thing is the rules of play, or the governance model – who has the ability to participate, how do you resolve conflict, and how do you divide up the royalty streams, or who gets what? You can think of it as the two components of the platform—the open standard together with the governance model. The technologists usually get the technology portion of it, and the economists usually get the governance and legal portions of it, but you really need both of them to understand what a ‘platform’ is.

Big Data’s Two-Way Customer Conundrum
Yes, big data can address all of those things as well, though you won’t hear this side of the industry touted as its biggest benefit. And yet, it certainly should be. By approaching big data as a customer-centric imperative, not merely a money-making strategy (though that is important as well), companies can use it to a customer’s benefit. The end game: better customer service, increased convenience, greater brand loyalty and, ultimately, higher customer lifetime value from every single customer that engages with a brand.

Nigeria launches new biometric ID card - brought to you by Mastercard
"There are many use cases for the card, including the potential to use it as an international travel document," Onyemenam said. "NIMC is focused on inclusive citizenship, more effective governance, and the creation of a cashless economy, all of which will stimulate economic growth, investment and trade." The new cards carry two photographs of the holder, and a chip storing an individual's biometric information including 10 fingerprints and an iris scan using a system developed by Cryptovision. Nigeria first attempted to introduce identity cards 10 years ago and, as well as modernising the service delivery and improving bureaucracy ...

UK lags France and Gemany in big data analytics, but sees itself ahead
British IT executives seem to be more drawn to the view that doing big data means employing MapReduce and NoSQL specialists rather than taking a “holistic view of how new data types can be joined to relational data”, said Duncan Ross, director, data science at Teradata. MapReduce is a programming model for large-scale data processing, and the Hadoop framework is an example of it. Ross added: “It is possible that this is a side-effect of the UK being slightly ahead of Europe on the big data bandwagon, and seeing it more as a technology-focused activity than a business one.

Five SDN protocols other than OpenFlow
While the Open Networking Foundation defines OpenFlow as the first standard communications interface between the control and forwarding layers of an SDN architecture, it may not remain the predominating protocol. With all of its promise, OpenFlow also poses a slew of challenges from scalability to security. Most troubling, network vendors must create supporting switching in order for OpenFlow to take hold industry wide. While most network vendors have already developed OpenFlow-based equipment, they're also designing SDN architectures that use alternate communication methods -- including existing networking protocols, such as MPLS and NETCONF.

The future of mobile commerce is commerce
“Mobile commerce” is a bit of a rabbit hole. As a concept it makes sense to look at all the ways in which users will transact on their mobile devices. But mobile commerce encompasses a number of entirely different spaces. A Square-enabled mobile POS, a video game offering in-app purchases, FeLiCa’s tap-to-pay system at train stations, and a retailer’s mobile-enabled website all fit the criteria, but there’s very little overlap. The spectrum of mobile commerce into can be divided into six distinct areas:

Will the meteoric rise of Android popularity result in an insecure platform?
This particular topic is very hard to nail down. First of all, you have to know what mobile malware is. Google is constantly on the lookout for malware-infected apps. What constitutes a malware-infested app? Let's take a look at one of the most recent notorious pieces of mobile malware to hit Android -- BadNews. This malicious code looked like a framework for serving up ads in ad-based software. What the code did was send your private data (including phone number and IEMI) to a server (not surprisingly, a Russian server). It can't be debated that this is malware. Google recently removed 32 applications (mostly Russian language) from the Play Store that contained the BadNews code.

Stories of Collaboration in Remote Teams
Lisette Sutherland and Elinor Slomba have been collecting and sharing stories from people whose business models depend upon getting remote teams right. These stories showing how remote TEAMS COLLABORATE, bridge distance, build trust and get things done together will be described in the upcoming book Collaboration Superpowers: The Field Guide. InfoQ interviewed Lisette and Elinor about how people work in remote teams, which tools they use to collaborate and communicate, and what it takes to work remotely as a team.

Quote for the day:

"A life spent making mistakes is not only more honourable, but more useful than a life spent doing nothing" -- GB Shaw

August 31, 2014

Defining Web 3.0 and Developing the Fastest Enterprise Mobility Apps
There is also a definite demand for skills in the market in next generational frameworks and I call out Angular and Backbone as leading the way commercially, with Ember and Meteor also highly respected frameworks. This is created by a demand to build a higher quality of Web Applications and the learnings of the last projects of what went wrong when anyone tried to maintain the last attempt. The job specification is no longer “Web Developer” but instead it is “JavaScript Architect”. I interview a lot of people and the majority of web developers with 5 – 10 years of experience still do not know the following seven vital things:

How an Enterprise Architect Used Change Management Tools to Diagnose Business Problems
Desire is a difficult stage of change to get through. How do you create desire in the face of resistance to change? Keeping people informed helps overcome initial reactions against change. More desire is gained by clearly showing solutions that people will find useful. But in most engagements, we should be building buy-in with ongoing participation of stakeholders and those who will be affected by the changes. Influencing desire begins early in the planning process. Invest in stakeholder engagement early. During this phase, it can be very useful to make a vocal champion out of someone who was antagonistic at the beginning, but who has since become a supporter of the changes.

Perspectives of Business Reference Model
We are all witnessing the steady progress of the Enterprise Architecture(EA) discipline and it is now well understood that the EA is not just about IT infrastructure and the Business Architecture(BA) forms an integral part of EA. Unlike in the past, when Business Architecture was used for the purpose of eliciting the requirements for the IT systems, BA is used to develop and describe the targe business model and work on a road map that will get the business towards the target. The Open Group, as part of its "World Class EA" series, has published a White Paper on the Buiness Reference with an objective of providing the need help to organizations in developing BA assets and plan for the future.

eBook. The practice of Enterprise Architecture
This book does not propose a new framework, theory, or approach to Enterprise Architecture. Instead, we share the experience and lessons learned of many projects that we have conducted around the world over the last few years. There are three parts (1) a high-level introduction to Enterprise Architecture using TOGAF and ArchiMate, (2) an overview of good practices to get started with EA and (3) an overview of advanced topics and techniques. When you are interested after reading the first two chapters, we recommend you to contact our salesdepartment at: insidesales@bizzdesign.com. They can help you to purchase this book.

Visualizing and Measuring Enterprise Architecture: An Exploratory BioPharma Case
The focus of this paper is to test if it can also uncover new facts about the components and their relationships in an enterprise architecture, i.e., if the method can reveal the hidden external structure between architectural components. Our test uses data from a biopharmaceutical company. In total, we analyzed 407 components and 1,157 dependencies. Results show that the enterprise structure can be classified as a core-periphery architecture with a propagation cost of 23%, core size of 32%, and architecture flow through of 67%.

How Can Enterprise Architects Drive Business Value the Agile Way?
As an Enterprise Architect, chances are you are responsible for achieving business outcomes. You do this by driving business transformation. The way you achieve business transformation is through driving capability change including business, people, and technical capabilities. That’s a tall order. And you need a way to chunk this up and make it meaningful to all the parties involved. ... An Enterprise scenario is simply a chunk of organizational change, typically about 3-5 business capabilities, 3-5 people capabilities, and 3-5 technical capabilities.

Guide to OpenIG
This guide is written for access management designers and administrators who develop, build, deploy, and maintain OpenIG deployments for their organizations. This guide covers the tasks you might perform once or repeat throughout the life cycle of an OpenIG release. You do not need to be an expert to learn something from this guide, though a background in HTTP, access management web applications can help. You do need some background in managing services on your operating systems and in your application servers. You can nevertheless get started with this guide, and then learn more as you go along.

Service Bus Authentication and Authorization with the Access Control Service
Service Bus and ACS have a special relationship in that each Service Bus service namespace can be paired with a matching ACS service namespace of the same name, suffixed with “–sb”. The reason for this special relationship is in the way that Service Bus and ACS manage their mutual trust relationship and the associated cryptographic secrets. Inside the “-sb” ACS service namespace, which you can explore from the Azure Portal by selecting the Service Bus service namespace and then clicking the ACS icon on the ribbon, is a “ServiceBus” relying party definition following the ‘Relying Party Applications’ navigation.

8 Open Source Web Application Security Testing Tools
Web application security testing might seems intimidating and esoteric to many web administrator, especially to the new ones. Have you ever asked yourself why so many IT professionals ignore the security aspects of the applications? We seem to have a tendency to ignore things that is unperceivable. ... Good news for those who are new to web security is that once you have the basic understanding of the most common web app vulnerabilities, you will find it much easier to protect your application from various types of well-known web attacks.

Nigel Dalton at Agile Australia on System Thinking, Social Experiments and 20 by 2020
Probably one of the biggest breakthroughs for us last year was getting a really crisp statement of purpose for the company and it is “empowering people by making the property process, simple, efficient and stress free”. Everyone who has worked for us has had a complex, inefficient and stressful property experience - whether it was renting an apartment, a share flat, or whether it was buying, or going to an auction, or otherwise. It is thus pretty easy to get a few hundred people aligned around that as a purpose.

Quote for the day:

"Products are made in the factory, but brands are created in the mind." -- Walter Landor

August 30, 2014

The long game: How hackers spent months pulling bank data from JPMorgan
Because of the multiple layers of the attack and the use of custom “zero-day” code in each of them, Bloomberg’s sources said that JPMorgan’s security team believed it was the target of “something more than ordinary cybercrime.” But such sophisticated attacks have already become the hallmark of Eastern European electronic crime rings, which frequently use custom code developed specifically to stay under the radar of target companies for long periods. The recent attacks on Neiman-Marcus,Target, and other retailers are examples of such long-game hacks that infiltrated corporate networks with malware designed specifically for their systems

CFOs’ Quest for the Golden Source of Data
“CFOs are frustrated with the situation right now,” says BearingPoint’s director Ingmar Röhrig, who led the survey of 65 finance officers at companies ranging from multinationals to midsize businesses. More often than not, it takes manual work to calculate how profitable a product is. Data is stored in multiple systems, so finding the answers you need at the press of a button is virtually impossible. Mergers and acquisitions add to the complexity. - See more at: http://www.news-sap.com/cfos-quest-golden-source-data/#sthash.IjWI8ina.dpuf

Tesla recruits hackers to boost vehicle security
Tesla's cars are among the most digitally connected vehicles in the industry with the battery, transmission, engine systems, climate control, door locks and entertainment systems remotely accessible via the Internet. So the company has a lot at stake in ensuring that the connectivity that allows its vehicles to be remotely managed doesn't also provide a gateway for malicious hackers. Security researchers have already shown how malicious attackers can break into a car's electronic control unit and take control of vital functions including navigation, braking and acceleration.

Management vs Leadership: the Divide
A sense of leadership is a quality that all managers strive for – an ability to effectively motivate and guide their employees to success. But where many employers fail to hit the mark is in understanding exactly what separates a manager from a leader. Admittedly, leadership is a somewhat abstract concept, and as much a state of mind as a skill or talent – but for employers to flourish within their roles, it’s essential to know how they can transition from management to leadership. So we know that managers aren’t, by nature, leaders – but how can they be?

Vulnerabilities on the decline, but risk assessment is often flawed, study says says
“It is difficult to point to any one factor that has contributed to the decline in the number of vulnerability disclosures in 2014,” the X-Force researchers said. “However, it is interesting to note that the total number of vendors disclosing vulnerabilities has decreased year over year (1,602 vendors in 2013, compared to 926 vendors in 2014).” Security experts have argued in the past that overall number of vulnerabilities is not as relevant for as their impact. However, despite attempts to standardize methods of assessing the severity of vulnerabilities, like the Common Vulnerability Scoring System (CVSS), there are many cases where the true risk posed by certain flaws is not represented accurately.

Understanding and Analyzing the Hidden Structures of a Unstructured Data Set
To do this you need to fetch out information from the free transactions text available on Barcllays transaction data. For instance, a transaction with free text “Payment made to Messy” should be tagged as transaction made to the retail store “Messy”. Once we have the tags of retail store and the frequency of transactions at these stores for Metrro high value customers, you can analyze the reason of this customer outflow by comparing services between Metrro and the other retail store.

Developers, Academia Team Up on Manual for Secure Software Design
Thirteen software companies and universities have banded together to create a group focused on educating developers about how to design secure software, releasing a report offering the 10 best practices to avoid common software flaws. Called the IEEE Computer Society Center for Secure Design, the group includes participants from Google, Twitter, RSA, McAfee, Harvard University and the University of Washington. The group, which has formed under the auspices of the Institute of Electrical and Electronics Engineers (IEEE), met in April at a workshop to compare examples of the design problems encountered by their development teams.

Why in-air gestures failed, and why they'll soon win
Leap Motion also released a demo video that I think you should see. It shows what's displayed in Oculus Rift, with two screens that (when you're wearing the Oculus Rift goggles) provide the illusion of 3D. It shows how Leap Motion's extreme accuracy in the real-time location of arms, hands and fingers translates into the ability to have total control in augmented reality and virtual reality programs. ... Extremely accurate motion control like what Leap Motion offers is not only a winning application for in-the-air-gestures, it's a perfectly necessary and inevitable one.

The Good, The Bad and The Ugly Of Enterprise BI
Our research often uncovers that — here's where the bad part comes in — enterprise BI environments are complex, inflexible, and slow to react and, therefore, are largely ineffective in the age of the customer. More specifically, our clients cite that the their enterprise BI applications do not have all of the data they need, do not have the right data models to support all of the latest use cases, take too long, and are too complex to use. These are just some of the reasons Forrester's latest survey indicated that approximately 63% of business decision-makers are using an equal amount or more of homegrown versus enterprise BI applications.

What We Do and Don't Know about Software Development Effort Estimation
An apparent lack of improvement in estimation accuracy doesn’t mean that we don’t know more about effort estimation than before. In this article, I try to summarize some of the knowledge I believe we’ve gained. Some of this knowledge has the potential of improving estimation accuracy, some is about what most likely will not lead to improvements, and some is about what we know we don’t know about effort estimation. The full set of empirical evidence I use to document the claims I make in this summary appear elsewhere

Quote for the day:

"I don't understand why people are frightened of new ideas. I'm frightened of the old ones." -- John Cage

August 29, 2014

From Sensors to Big Data: Chicago Is Becoming a Smart City
Chicago is the first major city in the USA that is building a permanent infrastructure to collect Big Data. They are installing hundreds of environmental sensors that will measure temperature, humidity, light, sound and cellphone signals. All this data will enable Chicago to become a safer and cleaner city. The sensors will be placed on top of lampposts along Chicago’s Michigan Avenue. ... They are true data generators, where all sensors placed within a city gathers vast amounts of data. Chicago will open source all this data to the public, so that anyone can access the data and make use of it.

Poor data quality hindering government open data programme
A source working on the open data programme at the Cabinet Office said public data releases had been dirty and inconsistent. "I would agree the evidence is there to support that," said the source. "They talked about armchair auditors – there hasn't been a lot of that. You can look around and not find them. Some busybody can read through the PDFs, but to make some sense of the aggregated mass is almost impossible with the raw data you've got.”

One small step for IT security: a beginner's guide to threat intelligence
Armed with this knowledge, the organisation can procure the right threat intelligence feed that focuses on the relevant threat actors and provides signatures to help detect attacks before they impact. The board can be briefed about the general overall threat and how activities in the business could heighten the likelihood of attack. Technical teams can be briefed on attacker tools, techniques and procedures so that protective monitoring and software patching can be performed more strategically to identify or mitigate malware. And finally, staff can be made aware of attacks to reduce the risk of compromises.

Architectural Security aspects of BGP/MPLS
There are a number of precautionary measures outlined above that a service provider can use to tighten security of the core, but the security of the BGP/MPLS IP VPN architecture depends on the security of the service provider. If the service provider is not trusted, the only way to fully secure a VPN against attacks from the "inside" of the VPN service is to run IPsec on top, from the CE devices or beyond. This document discussed many aspects of BGP/MPLS IP VPN security. It has to be noted that the overall security of this architecture depends on all components and is determined by the security of the weakest part of the solution.

Three security practices that IoT will disrupt
The early days of cloud services provided a direct challenge to central management, but this challenge has largely been beaten back by cloud services that support “external authentication” (such as Active Directory agents or SAML). The BYOD movement also challenged this tenet, but is being defeated through integrations that require common credentials to access email, IM and file servers. Now a similar challenge to centralized credential management is being mounted by the onslaught of IoT devices -- most of which only allow local user management -- and associated IoT management systems, which frequently also only allow local user management.

Hidden Obstacles for Google’s Self-Driving Cars
Among other unsolved problems, Google has yet to drive in snow, and Urmson says safety concerns preclude testing during heavy rains. Nor has it tackled big, open parking lots or multilevel garages. The car’s video cameras detect the color of a traffic light; Urmson said his team is still working to prevent them from being blinded when the sun is directly behind a light. Despite progress handling road crews, “I could construct a construction zone that could befuddle the car,” Urmson says. Pedestrians are detected simply as moving, column-shaped blurs of pixels—meaning, Urmson agrees, that the car wouldn’t be able to spot a police officer at the side of the road frantically waving for traffic to stop.

Unravelling the anatomy of Archimate
To anyone working in enterprise-architectures, Archimate ought to be the first point we turn to when starting to model any aspect of the enterprise. Unlike Zachman, for example, it places just as much attention to the ‘lines’, the connections between the ‘boxes’ (the ‘things’) of the architecture ... But to me, and to many others, it just… I don’t know… just doesn’t seem to work? Something doesn’t quite gel… something like that, anyway. It gives the sense that it ought to be right, that itought to work – but somehow it just… doesn’t. And that sense of it not-quite-working gets more and more extreme the more we try to move outward from anything but the most IT-centric of architecture views. Odd. Very odd.

Cyber attacks on US banks fuel financial sector concerns
“These capabilities are in the realm of nation-state capabilities,” said Philip Lieberman, chief executive of security firm Lieberman Software. “JP Morgan and similar entities employ sufficient technology to protect themselves from criminals, but typically fail to invest enough in technology and processes to shield themselves from nation states’ ability to access their systems at will,” he said. According to Lieberman, most financial services providers have little to no protection from nation-state attacks and are not willing to spend the money to protect themselves.

Debugging multithreaded code in real time!
We all love Visual Studio, using its breakpoints and single stepping through code to find out why a program behaves differently than expected. Alas, setting a break point or single stepping will completely change the behaviour of a multithreaded application, where it matters which thread executes which instruction in which sequence, measured in microseconds or less. Stop or delay anything in the multithreaded system and it behaves completely differently. So obviously, we cannot stop a single thread when debugging. Which means we should use tracing, looking something like this

CEO praises Juniper team and anticipates success in the cloud
Looking forward Kheradpir highlighted his plans for success saying he wants to focus on cloud builders and high-IQ networks; “Why cloud builders? Because in this current, “everything-as-a-service” application-driven economy, the cloud is our customers’ new delivery engine of innovation to their customers. As enterprises and service providers adapt to this new business model, the network experience is critical to their business. Juniper understands how to unleash the power of the cloud through High-IQ Networks.”

Quote for the day:

"Success isn't magic or hocus-pocus - it's simply learning how to focus." -- Jack Canfield

August 28, 2014

Managing Risk With Big Data & Analytics
However, scale continues to be an issue. Recent mega-breaches are often precursors to large-scale attacks that are identified by network monitors, systems, or individuals responsible for managing risk. But because there is such a high volume of attacks against major corporations, important clues may be missed, and the most critical threat information may not reach the team or executive responsible for protecting the organization in a timely fashion. To combat this problem many institutions have brought information security professionals into the boardroom.

The hunt for your strategic blind spots: Assign data scientists to the case
To understand what's in your blind spot, look for places where your competition will leave a digital trail. First, look to the obvious: your competition's direct communication channels. Sometimes a company will signal what they intend to do by their marketing messages. You should have your data scientists comb through the information on competitors' pages on Twitter, Facebook, and other social media platforms to see if they can pick up on something you may be missing. Even a simple sentiment analysis may uncover a shift in market preferences that you missed.

NASA launches massive cloud migration
The space agency will continue to move apps to the cloud and build apps in the cloud. Its goal is to move or build another 20 to 30 apps by the end of the year. "I want to give people the ability to collaborate," Kadakia said. "I want to give them a repository on the cloud where we can be doing code sharing and code reuse within NASA. And we're looking at disaster recovery as a service." NASA didn't just inch its way into Amazon's cloud offering. The agency has about 60 apps, such as its public-facing websites, on Amazon's public cloud, and 40 more, including NASA's workflow and privacy-impact applications, on Amazon's virtual private cloud, which offers a certain amount of isolation in the public cloud.

CIOs: Stop hugging your servers, start hugging the business people
You can blame the cloud or the rise of the niche vendors but few in IT management would doubt that running an IT department is a much more complex task than it once was. Vendor management is increasingly important skill according to analysts because new ways of delivering IT services introduce a high degree of risk that requires tight control. Analyst Gartner has put together a four-step strategy which it says can help:

Thinking Open Source with Phil Haack
Carl and Richard talk to GitHub denizen and former Microsoftie Phil Haack about what it means to build open source software. The conversation starts off with a reminder that back in Phil's Microsoft days, he was a huge advocate of taking various Microsoft products open source - and today it's actually happening! Phil may have moved on to GitHub, but the spirit of open source has permeated the web team at Microsoft, the ultimate manifestation being ASP.NET vNext! So what about your projects? What does it takes to make them open source, and what benefits can you expect?

Revolution in Progress: The Networked Economy
In fact, the revolution is already under way. “Over the last few decades, we’ve grown beyond the industrial economy to the IT economy and the Internet economy, each of which led to significant inflection points in growth and prosperity,” says Vivek Bapat, SAP’s global vice president for portfolio and strategic marketing. “Now we’re looking at the Networked Economy.” This new economy, resulting from a convergence of the economies that came before it and catalyzed by a new era of hyperconnectivity, is creating spectacular new opportunities for innovation. And, like any revolution, the Networked Economy is going to be big. Very big.

Listen, learn and lead: Key communication skills for IT pros
Tom Catalini is a CIO by profession, accomplished blogger and writer. He said he decided to write his new eBook as a way of paying forward the great advice he had been given throughout his career. He also noted the important role that strong communication skills play in the success of IT professionals, especially if they wish to move up the technical and managerial ranks. I asked Tom what career advice he would like to give to those reading my column. He said that people should enhance their ability to listen, because it expands their ability to learn, which enhances their ability to lead.

4 Outsourcing Mistakes Companies Still Make
There's still no script for the Great American IT outsourcing project. But today's most common outsourcing pitfalls have less to do with technology and everything to do with relationships and communication. Or lack thereof. "Both companies have to rise to the occasion to make it work," says Romi Mahajan, president of marketing consulting firm, the KKM Group, which outsources some of its IT operations. Nevertheless, communication breakdowns and finger pointing frequently derail even the best-laid outsourcing plans. Here are four missteps to avoid.

Location Data Could Become Key to Fighting Bank Fraud
BillGuard said it has been testing the location-monitoring service with a limited beta group of 7,000 cardholders. The location monitoring methods are supposed to be battery life friendly. In an online FAQ, BillGuard said it may only sample a person's geolocation two to three times a day and can often do so without activating the phone's GPS, which is a battery hog. BillGuard did not immediately provide more detail on how it tracks the location data. Some companies gather location data through wireless triangulation, which works by collecting data from cell towers. The firm's efforts are applauded by industry observers who perceive a growing appetite among consumers to let them choose stronger card controls

Apache CouchDB: The Definitive Introduction
The most notable implementations of The Couch Replication Protocol are PouchDB, Couchbase Lite (née TouchDB), and Cloudant Sync for Mobile. PouchDB is implemented in JavaScript and is designed to run in a modern web browser (including mobile browsers). Couchbase Lite and Cloudant Sync come in two flavours: one for iOS written in Objective-C and one for Android written in Java and both are meant to be embedded in native mobile applications. They are all Open Source projects separate from Apache CouchDB, but they share the same replication capabilities, although some implementation details that we explain for Apache CouchDB below differ in the various other projects.

Quote for the day:

"If you want to reach a goal, you must "see the reaching" in your own mind before you actually arrive at your goal." -- Zig Ziglar

August 27, 2014

Clinical Intelligence and Analytics: The Future of Healthcare Delivery
Our opportunity is now to enable the processes that deliver the right information, in the right context, to the right person at the right time. Our opportunity is now to keep patients as healthy as possible while minimizing admissions and care cost. Our opportunity is now to deliver better, more efficient, more valuable healthcare. And while our opportunity may be ripe now, our future—the future of the healthcare industry and the impact we can have on our communities—is only just beginning. The question is whether or not we will turn opportunity into reality fast enough, or if we will continue to lag behind as an industry.

Mobile Health Apps Have Role In Ebola Crisis
A handful of applications already exist that allow users, aid workers, and other medical practitioners to test and share results for illnesses such as HIV, malaria, and flu using only a smartphone. Why are such technologies not being used to test and track Ebola? Geo-referenced, real-time maps of infected patients could be key to tracking and controlling the spread of the virus. In a potential global crisis such as this, the World Health Organization has already called on governments to use exceptional measures, and the US FDA has bypassed its normally rigorous approval processes to fast-track military technology for civilian use.

Big Data scientists get 100 recruiter emails a day
Offering salaries of $200,000 to $300,000 for data scientists with just a couple years of experience, tech recruiters are also going after academics with experience in areas like genome mapping and breast cancer research, dangling the big bucks to get them to help figure out what search terms people use and the impact of tiny changes in online ads. ... The Insight Data Science Fellows Program, in Silicon Valley and New York City, claims to be “your bridge to a career in data science,” offering an “intensive six-week post-doctoral training fellowship bridging the gap between academia and data science.” The programs’ website claims a 100% placement rate (duh) and notes fellows with doctoral backgrounds in astrophysics, biology, statistics, and so on.

Infographic: Four Actions to Help Employees ‘Live’ Quality
A strong quality culture not only reduces the risk for customer-facing errors, but also helps companies find new sources of value in the form of improved customer experience and employee productivity. Unfortunately, 60% of employees say they work in an environment with a weak culture of quality. Our latest infographic outlines what it means to have a “culture of quality” and the four actions quality leaders should take to build and sustain it. For more culture of quality insights, join our September 10th webinar that shows how to get business partners to act on planned quality initiatives.

Disaster Recovery and Business Continuity: Putting Your Plan in Place
Many organizations are looking increasingly to third party solutions to perform a Business Impact Analysis (BIA) and handle DR and BC/BCM initiatives. For small to medium sized businesses however, many large scale DR systems can be cost-prohibitive. Before you throw a whole lot of cash at the problem, there are four key areas you need to consider ... Take the time to calculate how much you could lose with just one to two days of downtime, and then compare this to the cost of aggressively managing your DR plan. Take the time to discuss what your current plan is, train your employees – and then test it out. If it works, you will sleep well knowing that your data is protected!

Regulatory compliance challenges mount in recession’s wake
U.S. companies, particularly those in the financial services industry, continue to wrestle with compliance regulations: Recent headlines show that the current regulatory environment remains a top issue for CEOs and that many companies have difficulty measuring the effectiveness of compliance training programs. Meanwhile, in recent weeks, PricewaterhouseCoopers was fined for watering down a bank report, and a complaint filed with the Federal Communications Commission (FCC) alleges that 30-some U.S. tech giants are violating Safe Harbor agreements.

Eight steps for comprehensive BYOD governance
A comprehensive BYOD governance roadmap must therefore include goals, objectives, value statements, operating principles, policies, procedures, standards and guidelines that address the scope of required cultural and operating model changes. The roadmap should carefully balance strategies for device management and used with a focus on good user experience. Let's look at some good practices for establishing and maintaining safe and effective mobile BYOD practices. The good practices described below are adapted from "BYOD in the Enterprise – a Holistic Approach", ISACA Journal, Volume 1, 2013, S. Ravindran, R. Sadana and D. Baranwal.

Surge pricing is the next wave of digital ordering
Airlines and hotels have been surge pricing for years. But other than a “market price” for fresh fish or other rare commodities, the restaurant industry has largely stayed away. All this could soon change as mobile ordering gains momentum. Uber raises pricing on the fly based on real-time data gathered via mobile devices, the primary source for ride requests. Digital ordering for restaurants allows a similar opportunity by enabling fluid pricing. If, for example, a concert lets out at Madison Square Garden, Uber might charge higher rates to encourage drivers to come to the area.

Intel reveals world’s smallest wireless modem for the Internet of things
The entire XMM 6255 chip board with modem and other features is 300 millimeters square. It includes a SMARTi UE2p transceiver component, which operates on a tiny amount of electrical power. It has transmit and receive functionality, power management, and integrated power amplifier — all on a single chip. The smaller the chip and its components, the less electrical power they need and the less heat they dissipate. That helps them survive in conditions where Internet of things sensors are deployed. A farmer, for instance, may deploy a bunch of sensors to detect ground moisture in fields. Those sensors can send data over 3G modems to a computer, which can produce a report for the farmer on where and when he or she should water the field.

Tips for addressing cybersecurity with the board
"As hackers get better at their exploits, corporate security is failing to keep up, resulting in the main thing keeping directors up at night." ... To help those executives sleep a bit better, BitSight co-founder and CTO Stephen Boyer has shared advice with FierceCIO targeted to both board members and IT security executives on how they can "clear up the confusion and start moving the conversation forward" on cyber-security. Boyer's advice follows. Tips for board members:

Quote for the day:

"Courage is what it takes to stand up and speak; courage is also what it takes to sit down and listen." --Winston Churchill

August 26, 2014

Data Erasure Technology: Ensuring Security, Savings and Compliance
Erasing data from failed drives is critical, as up to 80 percent of them are still operational and vulnerable to data breach. Many industry standards and regulations like healthcare (HIPAA, HITECH), finance (GLBA, SOX, FACTA) and retail (PCI DSS) require data sanitization and proof of erasure for each drive in the form of auditable reports. Non-compliance may result in large fines, civil liability and costly damage to brand image. Hardware appliances that sanitize drives in-house using advanced data erasure ensure data integrity and regulatory compliance with audit-ready reports, and enable data centers to safely return failed disks to OEMs within RMA timeframes.

When transaction management becomes a business (technical) issue
Benefits of Crittercism’s mobile optimized transaction management solution include proactive visibility into the business and revenue impact of key mobile transaction performance; an ability to define and monitor true mobile transactions that span across multiple views, user interactions and service calls; and an ability to automatically track all mobile-specific dynamic states such as network connectivity changes, application backgrounding/foregrounding and user view transitions that provide complete user flow visibility.

Seven Things the CIO should consider when adopting a holistic cloud strategy
In order to successfully leverage a cloud-based solution, several things need to change that may contradict current norms. Today, cloud is leveraged in many ways from Software as a Service (SaaS) to Infrastructure as a Service (IaaS). However, it is most often a very fractured and disjointed approach to leveraging cloud. Yet, the very applications and services in play require that organizations consider a holistic approach in order to work most effectively. When considering a holistic cloud strategy, there are a number of things the CIO needs to consider including these six:

5 Ways Federal CIOs Plan to Improve Security Monitoring
"Though the CIO and [CISO] have sort a perch seat to look at the security happening in the department, the actual circumstances are that security is often performed by decentralized teams," Streufert says. "Our first recommendation on people and processes is to identify and establish your agency's continuous diagnostics and mitigation team." Streufert, speaking at a government IT forum on Wednesday, also offered several additional tips for agencies to consider when implementing their own CDM programs to secure the buy-in of both security and business workers and to evaluate the success of the initiative.

Building Information Technology Liquidity
IT organizations desperately need to embrace the concept of “liquidity”—not by having extra cash lying around, but creating agile and flexible infrastructures that can take advantage of unplanned demand. This is especially hard when an estimated 75% of the IT budget is already spent on maintaining legacy infrastructure. Even worse, IT capacity planning efforts are often based on simple linear regression models or other quick and dirty heuristics that don’t account for huge spikes in demand such as a major corporate merger or “one-hit wonder” product.

Nginx and Android: A great on-the-go web dev tool
There are times when you just need to develop on the go. When this happens, you might not want to carry around that bulky laptop -- or maybe your only option is a tablet or smartphone. If that's the case, and you have an Android device handy, you're in luck! The Nginx (pronounced engine-x) web server is great way to have a portable web server for testing, developing, and even serving up web pages. NAMP (nginx android web server) is a 10-day trial app (after the trial, the cost of a license is $0.99 until Sept 1st, 2014, after which the price will raise to $4.99). Here are some of the app features:

GCHQ produces BYOD guidelines for organisations
“With the rapid increase in the use of mobile devices - and the growth of remote and flexible working - staff now expect to use their own laptops, phones and tablets to conduct business,” said the document. The guidance has been produced for both public and private organisations. Due to the involvement of the CPNI, the guidelines will be also aimed at companies involved in the UK’s critical national infrastructure, such as energy, transport and banking firms. But the document also encourages public sector organisations working at the lowest security standard (official) to seek further guidance from CESG before implementing BYOD.

Shadow cloud services pose a growing risk to enterprises
"There is a new form of shadow IT and it is likely more pervasive across the company" than many might imagine, given the easy access to cloud services, Beston said. "It is harder to find, because it is being procured at small cost and is no longer operating within the bounds of the company." ... "Shadow cloud is happening under the radar" at many organizations, Beston said. Without governance, such cloud services present significant data security risks and the potential for technology and service redundancies. Risks include inadvertent exposure of regulated data, improper access and control over protected and confidential data and intellectual property and breaching of rules pertaining to how some data should be handled.

5 Ways to Steal Your Innovations
It is the dream of most small manufacturers to invent a new product and sell it to a larger company to handle all of the manufacturing and marketing. The dream includes getting a big upfront payment and then relaxing as the royalty or other payments come in. Very seldom will the inventor company get all of his money up front, which means they have to negotiate some kind of agreement. These agreements are very problematic, so it is a good idea to understand the various strategies used to steal your invention, or not pay you in full. Here are five of the most common strategies used:

Analysts Say Mobile App Development Requires New Strategy, Techniques
If enterprises don't change their tune on mobile development and instead stick with traditional desktop app development techniques, their efforts will fail, said Gartner analyst Van Baker last week. "Enterprise application development teams use traditional practices to define and develop desktop applications; however, most don't work with mobile app development, due to device diversity, network connectivity and other mobile-specific considerations," said Baker during a presentation to IT leaders in China. "Instead, [application development] managers should use functional, performance, load and UX testing, as well as agile development practices."

Quote for the day:

"How things look on the outside of us depends on how things are on the inside of us." -- Parks Cousins