Daily Tech Digest by Kannan Subbiah

October 05, 2014

Dirk Slama Keynote on The Internet of Things
"The vision for the Internet of Things is very powerful – a world in which assets, devices, machines, and cloud-based applications seamlessly interoperate, enabling new business models and services; with big data analytics as a foundation to support intelligent decision making in this connected world. As with every vision, the question is how to make it happen. This presentation provides key success factors for IoT, as well as a detailed overview of concrete IoT uses cases in the areas of automotive and transport, manufacturing and supply chain, as well as energy. Finally, a framework for IoT implementation is presented, which helps making your IoT projects a success."

NoSQL Databases: An Overview
Over the last few years we have seen the rise of a new type of databases, known as NoSQL databases, that are challenging the dominance of relational databases. Relational databases have dominated the software industry for a long time providing mechanisms to store data persistently, concurrency control, transactions, mostly standard interfaces and mechanisms to integrate application data, reporting. The dominance of relational databases, however, is cracking.

BMC Is Fixing Its Enterprise IT Software With User Experience Design
The key is being able to understand what the call center agent needs in a given point of time and how much workload Smart IT can handle. Combine this with a better front-end user experience for the call center agent and everything runs that much more quickly. “Pick the world's largest company and think about the number of employees they have,” Kaempf says. “To deliver better service to employees--that's a real win for them.” In Kaempf's opinion, enterprise has been too focused on solving technical problems--not user problems.

IBM Tries to Make Watson Smarter
“We never would have thought of it; we don’t have that DNA,” he said. “It validated the idea that we needed to open up the platform and make it available to the startup marketplace.” Ultimately, Rhodin said, IBM will pursue a revenue-sharing model for any effort that reaches market. The company also continues to pursue applications in the medical, financial, and legal sectors. Using Watson to examine thousands of documents could, for example, help doctors see different diagnoses in order of probability and “rule out things they didn’t think of,” Rhodin said.

Honda's in-car Connect system does Android its own way
Honda's engineers definitely squeezed a lot of functionality into the system, which may suit some folks and not others. For instance, you can download and use Android and Honda's own car-specific apps, including an optional Garmin-powered GPS. Other functions include FM radio, CD playback, USB and HDMI connectivity, Mirrorlink and Bluetooth. While it's great to have choices, we hope all of that functionality doesn't make the system difficult to use. The interface was a bit more fussy than we'd like, which could distract the driver. On the other hand, it's not lacking much in functionality compared to a smartphone, making it potentially more useful than other in-car systems.

Fixing the internet for confidentiality and security
First, it became clear that total surveillance is the norm even amongst Western democratic governments. Now we hear the UK government wants to be able to ban organisations without any evidence of involvement in illegal activities because they might “poison young minds”. Well, nonsense. Frustrated young minds will go off to Syria precisely BECAUSE they feel their avenues for discourse and debate are being shut down by an unfair and unrepresentative government – you couldn’t ask for a more compelling motivation for the next generation of home-grown anti-Western jihadists than to clamp down on discussion without recourse to due process.

Cyber Threat Intelligence
Threat intelligence is often presented in the form of Indicators of Compromise (IoCs) or threat feeds, although despite various attempts by vendors, it does not come in the form of an XML spreadsheet. Hence, threat intelligence requires organizations to understand themselves first and then understand the adversary. If an organization does not understand its assets, infrastructure, personnel and business operations – it cannot understand if it’s presenting opportunity to malicious actors. If an organization does not understand themselves fully to thus, identify what malicious actors might be interested in them – then it cannot properly recognize the intent of actors.

"Robotics Has Too Many Dreamers, Needs More Practical People"
Grishin said he wants to do more deals per year but, of course, he wants to find the right deals. "Robotics need dreamers," he said. "But there are too many dreamers now, and we need more practical people developing actual products." Grishin said that while looking for business opportunities, he saw too may entrepreneurs proposing cool new robots and concepts but with no business cases to support them. The robotics industry, he added, needs more startups to fail to allow entrepreneurs to learn from past mistakes and come up with more enduring plans.

Travel Intelligence and its big (data) benefits
The emergence of new technologies offers real-time data analyses and cutting edge forecasting capabilities across the entire travel cycle, allowing travel industry players to start doing things they had never even considered doing before. Big data is also today’s most powerful ingredient in the ongoing battle for competitive differentiation and personalisation. Understanding today’s traveller is vital to gain the competitive edge: the travel industry is moving beyond standard leisure and business segmentation towards a more personalised view of the customer. Real customer understanding can be drawn from multiple sources that exist at a company, industry and global level.

How to transform USB sticks into an undetectable malicious devices
Nohl explained that his team has written malicious code and deployed it intoUSBcontrol chips used in thumb drives and smartphones, at this point it is sufficient that victims connect the USB device to a computer to trigger the execution of malicious software. Nohl and Lell’s BadUSB demonstrations during Black Hat illustrated how their code could overwrite USB firmware and turn a USB device into anything. A flash drive plugged into a PC, could for example, emulate a keyboard and issue commands that steal data from the machine, spoof a computer’s network interface and redirect traffic by altering DNS settings, or could load malware from a hidden partition on the drive.

Quote for the day:

"You’ve got to get up every morning with determination if you’re going to go to bed with satisfaction.” -- George Lorimer

October 04, 2014

Driving IT Business Alignment: One CIOs Journey
To fix things, Dale and his team partnered with the business. Doing it together rather than separately enabled the IT organization and the business to collaborate and to build a better and more permanent partnership. Dale says, “We have really enjoyed implementing the solution, because the business units are now working very closely with IT”. Dale claims as well the relationship with their business units has gotten to be a very solid, trusting relationship with them, and very collaborative. They have learned to trust IT’s input, and IT has learned a lot from the business units about how they operate and like to operate.”

EA in practice: The Case Container
A central part to any typical Enterprise Application is the Case or Dossier, and the process handling this. The information going in to a Case, the business logic applied to it, and the subsequent business decision(s). It all has to be filed with accuracy. Case handling get complex because information changes over time, business decisions are made, and the business logic and the information going into it are also complex. Just look at financial institutions and insurance systems, as well as government systems. These have a load of legislation and business rules - that change over time – and every business decision must comply to the rules and information that was valid at that point in time. Otherwise that decision does not have integrity.

Examine API integration trends in the enterprise
As customers are looking to API integration tools more and more for mobile enablement, [representational state transfer (REST)/Javascript Object Notation] has become an accepted standard for exposing enterprise applications as APIs. Tools should facilitate the creation of these REST APIs, and on the back end [they should] support service discovery, shaping, cataloging and publishing APIs, and [monitor] the health and performance of these APIs at runtime.

Your Roadmap to Successful Adoption of Agile
Lean software development presents the traditional Lean principles in terms that relate to software development. Often when Lean is discussed, there tends to be a strong focus on eliminating waste and rightly so. However the real focus of Lean is the identification of value to the customer: delivering what they want, when they want it, and with the minimum amount of effort. To be sure, what is considered “valuable” also becomes a driver for what is considered wasteful. As folks think about Agile principles, I suggest that they also consider the Lean software development principles to help them in their Agile journey.

Information Security Controls Relating to Personnel
While the risk of threats are increasing, study says that the threat is more from the inside than from the outside. This has mandated the need for framing polices, procedures and controls around the employees of the organization, so that such risks arising from within can be mitigated or managed well. Whilst personnel security controls cannot provide guarantees, they are sensible precautions that provide for the identity of individuals to be properly established.

An immature security program is an exciting challenge
There are similarities between where my new company is right now with regards to security and where my old company was when I started there. But I don’t expect this new job to be a repeat of the last four years. For one thing, I am starting with all the knowledge and experience that I gained over the past four years. In the course of that time, I have learned a lot about things like cloud computing, mobile devices, advanced malware, data handling and security awareness. And I expect to keep on learning, since new things that I can’t even anticipate are sure to crop up.

Inside the Secret Clash of CIOs and CMOs
There's a fundamental problem in the way CMOs and CIOs look at technology projects. CIOs don't like loose ends. That is, they want to see projects that have a clear beginning and end -- a clear-cut return on investment. CMOs, however, can't afford to wait for this kind of clarity before embarking on projects. ... CMOs call this open-ended approach as being "agile," which is very different from what CIOs hear. For CIOs, "agile" means a software development methodology, according to The CIO-CMO Omnichannel study

When Good Federation Goes Bad
Given a choice of identity providers to leverage when logging in to a service provider, I generally choose the IdP that has the least data about me. In loose order of preference, this translates to Twitter, Microsoft, Google, and finally, Facebook. The first three generally require only my email address and a few other attributes, such as profile information I share publicly. Facebook, however is a whole other matter. I've written before on how Facebook throws a plethora of user identity attributes at a service provider when you use it as identity provider for a federated login.

Identity and Access Management Through the Enterprise Service Bus is a Pipe Dream
The first is the bi-directional nature of the ESB’s interface with the rest of your systems. This simply means the ESB can send and receive data and commands to any system it is connected to. Identity and Access Management processes don’t work the same way, however, as the type of data is “very different.” The changes involved, such as “a change in job or surname, or a promotion or departure of employees,” often can’t be read by the applications in their default modes, requiring significant development work on the part of the application supplier to make the system function. A result is that only very basic messages can be sent, such as the creation of a new identity.

The Problem with “Always On” Deduplication
The bigger problem is the way in which database systems store data. Relational databases use tables to improve performance and manage operations. A relational database such as Oracle has no duplicate data blocks, because each block in a tablespace (the logical container in which tables and indexes are stored) contains a unique key at the start and a checksum containing part of that key at the end. As a result, most shops are going to see little space saving, while paying the price of increased latency as the hardware pointlessly attempts to find matching blocks.

Quote for the day:

"A leader takes people where they would never go on their own." -- Hans Finzel

October 03, 2014

Security Think Tank: Minor failings can trigger major data breaches
When small incidents go unchallenged – or even unnoticed – they become the accepted culture. So, the first time a door to a file room is propped open for the sake of convenience, the security policy is bypassed. If this goes unchallenged, it will happen again because “Fred” does not see the importance of putting his PIN code into the door entry system for the file room. This mindset cascades, with more and more people believing it to be acceptable behaviour. Before you know it, propping the door open is the norm within the business, offering an opportunity for files to be removed by unauthorised staff, altered and copied – and a more major security breach could occur.

10 Tips to Ensure Your IT Career Longevity
Many organizations are getting better at providing embedded employee performance and career management processes, according to Karen Blackie, CIO of Enterprise Systems & Data for GE Capital. However, she warns that you are your own best advocate and should always strive to "own" your career. Don't wait for your organization to do it for you because that day may never come. This means stepping back and thinking about where you want to be in X amount of time and then outlining the different skills and experience needed to get there.

Blowing the Lid off BYOD Containers for Security and Productivity
With the MaaS360 Secure Productivity Suite, you can prevent data leakage by controlling emails and attachments. This facet of the larger Enterprise Mobility Management suite also conducts online and offline compliance checks before email can be accessed. You can set it to restrict forwarding, moving data to other applications via cut and paste restrictions, and screen captures. This last point is a very important consideration as public apps embed deeper into the enterprise and homegrown programs are updated to serve the app world.

Artificial intelligence in your shopping basket: Machine learning for online retailers
BloomReach is able to aggregate data from many sources, with user data kept in silos for privacy reasons - an approach which also means keeping the computational, data-processing and machine leaning infrastructure separate from the serving infrastructure. The result is a micro services model that can deliver millions of pages from the cloud, while still learning from user interactions and new content. De Datta points out that without new information search boxes degrade over time, and the more inputs you have, the smarter the system gets.

CIOs must argue for smarter, more strategic technology investments
"We certainly see shifts in the IT budget, because growth was previously very strong in areas like storage and physical servers, but clearly that growth is reducing, as there are shifts to virtualisation and higher uptake of cloud models," she said. At the same time, these new forms of technologies and the service delivery models of the cloud are changing the way that IT is consuming technology, most evident in the shift of IT spending from a capital expense (capex) to an operating expense (opex) model.

Government Toils To Create Big Data Infrastructure
"This is not necessarily a new problem," said Steve Wallach, former technical executive at the National Geospatial-Intelligence Agency (NGA). As long as 30 years ago computers were producing more data than could be practically used, and the ability to produce it has outpaced our ability to manage it since then, he noted. "We are moving into a new area," said Wallach. The other major challenge is making the data available to other researchers who can add value to it. "I spend a lot of the taxpayers' money producing this data with the big machines,"

Does Hadoop Mean the End of the Data Model?
The natural result of separating the data content from the data structure is that the MapReduce program becomes the place where the two are linked. Depending on the data processing needs, this may or may not be a complete data structure definition. In addition, each developer will define this mapping in slightly differing ways, which results in a partial view that makes unified definition hard to assemble. The late-binding of data content to the data structure essentially places the developer as the middleman between the data and the data consumer since most data consumers are not MapReduce trained.

Cyber risk and the UK’s Cyber Essentials Scheme
The scheme builds on elements of ISO 27001, laying out a procedure for establishing resistance to cyber risk; the key aspect of the new initiative is that this resistance can be externally certified. External certification is important: it is designed to enable those dealing with an organisation – customers, suppliers and perhaps insurers – to know whether it meets a measurable minimum standard of cyber hygiene. This in turn should create a competitive advantage for those who demonstrate compliance over rivals who do not. Once the scheme is up and running, applicants will be able to get certification showing the level of compliance they have attained.

A Rails Enthusiast’s take on MEAN.js
To dive into MEAN, what better way for a Rails fan to get up to speed than by following the path of the famous demo, and creating my own blog application with MEAN.js. A more up-to-date version of the Rails blog exercise, without the “Uoooops,” is the Rails getting started guide. Our journey here will mirror this guide and summarize my comparison with Rails. To follow along with my code, check out the project on GitHub. ... To start a new app in MEAN, like Rails, we use a generator. MEAN.js uses Yeoman for automation, and is configured with a generator for a starter application. In this case, I created an application called Blog.

How iPaaS integration gains platform status
IPaaS service offerings are built around an Agile development methodology where time to market speed is crucial. An iPaaS service platform typically provides prebuilt connectors and development and configuration tools that are user-accessible, drag-and-drop type tools. Using the provided tools, organizations can implement integration projects involving SaaS or on-premises endpoints, data sources, applications, services, APIs and processes. Users are able to develop, deploy, execute, manage and monitor integrated interfaces linking multiple endpoints.

Quote for the day:

"Talent hits a target no one else can hit; Genius hits a target no one else can see." -- Arthur Schopenhauer

October 02, 2014

Encryption IS for the children; it's the gift of electronic privacy rights
But it’s for the children! Sorry, but I’m as tired of that rationalization being used as a reason to justify surveillance and censorship as using the terrorism threat as an excuse. Both were used by FBI Director James Comey in the form of warning about how restricting quick access by law enforcement to a smartphone could cost lives in some kidnapping and terrorism cases. “What concerns me about this,” Comey said, “is companies marketing something expressly to allow people to place themselves beyond the law.”

UK falling behind in cyber intrusion detection, study shows
Global information security budgets decreased 4% in the past year compared with 2013, and security spending as a percentage of IT budget has remained stalled at 4% or less for the past five years. Leadership is cited by 30% of respondents as the biggest obstacle to improving the overall effectiveness of the security function. More than a quarter of respondents do not think there is a senior executive who proactively communicates the importance of information security. UK respondents said the top three obstacles to improving security are: insufficient capital funding, a lack of leadership from the CEO or board and the lack of an effective information strategy.

The battle for the IT budget: Operation versus experimentation
"Justifying the ROI for maintaining old solutions or building expensive new ones has become very challenging," Dufour said. "The win rate for on-premise has decreased a lot — below 20 percent for some products — and most companies have a solid aversion against buying hardware, paying for implementations and waiting for tangible results." Outsourcing is another way that many companies are saving money on operating expenses. Traditional outsourcing is still a popular way to save costs on helpdesk, but using platform-as-a-service (PaaS) and infrastructure-as-a-service (IaaS) tools are, in a way, a form of outsourcing support as well.

The scary truth about data security with wearables
The amount of data being collected by just the wearable device on your wrist is simply astounding. Damien Mehers, a wearables developer who built the Evernote app for Pebble and the Samsung Galaxy Gear, said, "Especially with the fitness [devices], if you read the license agreements, if people really realized what they are signing up for, they might be horrified at what they're allowing the companies to do with the data. I think there needs to be more clarity and perspective from the user."

Building a disaster recovery plan starts with IT disowning DR
Once we have scored the risks, we define mitigation plans, which should map correctly to the risks. Disaster recovery can be expensive and it is easy to over-invest in recovery options that we will never actually trigger. And, because redundancy -- in systems, processes and capabilities -- is incredibly expensive, we should have redundancy or partial redundancy only on the high impact/high probability risks. For everything else, we think of how to quickly recover from a disaster, with "quickly" being highly situational.

Implementing repository Pattern With EF4 POCO support
Here all the method responsible to do query, return result in ObjectQuery Which have been used for a special reason and that is ObjectQuery.EnablePlanCachingProperty that indicates whether the query plan should be cached. Plan-caching caches information which is computed as part of putting together the query itself. By caching this, a subsequent execution of the same query (even if you change parameter values) will run much faster than the first one. This information is cached per app-domain so you will generally benefit from the query cache across multiple client requests to the same web app and the like.

IT pros told to pay attention to 'shadow IT'
The newest form of shadow IT, which Comstock also called "dark IT," is cloud services. These are platform, software and infrastructure services that can be obtained by using a personal credit card. Such services are popular because they allow employees to more quickly set up the services they need, without going through a probably already-overworked IT department. Comstock urged the audience to embrace this new form of shadow IT, because it provides a glimpse to IT staff of what their users require.

Microsoft partners with financial services industry to fight cyber crime
Under the new collaboration agreement, Microsoft will provide FS-ISAC members with visibility into malware infections on banking networks. This agreement is the latest example of Microsoft proactively partnering with customers, industry leaders and global law enforcement to counter cyber threats. Criminals have moved into cyber space to target banks, businesses and customers to steal millions of dollars without ever cracking a safe, said Richard Boscovich, assistant general counsel at Microsoft’s Digital Crimes Unit.

The channel needs the right blend of youth and experience
The lack of knowledge of business processes is the primary reason why many IT integration projects fail. Let’s face it, IT salesmen aren’t the greatest listeners in the world. They only ever stop talking in order to think about what they’re going to say next – meanwhile, your queries wash over them. At the risk of making a massive generalisation, it might be said that women are better listeners than men. Surely, listeners are what we need in this industry. Which is why another movement, Women Who Code, could be useful too.

CFOs – Vanguards or Villains?
The bold CFOs are unafraid to admit that their existing reported information may be both flawed and incomplete. The flawed aspect deals with continued use of non-causal cost allocation factors that lead to misleading simultaneous under and over-costed products and services (because cost allocations must have a zero-sum error to reconcile). The incomplete aspect deals with not tracing and assigning the channel and customer-related expenses reported below the gross profit margin line. These channel, selling, customer service and marketing-related “costs to serve” are arguably more important than product costs.

Quote for the day:

"We think of our brains as thinking machines, but they're not. They're survival machines." -- Kris Kimmel

October 01, 2014

The innovation dilemma: Who really calls the shots on new tech?
Modern IT goes beyond tactical issues, traditional sourcing models and resources, said Justice: "It is about aligning technology to people and processes to meet business goals (no matter where the service comes from) by continually aligning, vetting and leveraging technology options as they evolve." John Gracyalny, VP IT at SafeAmerica Credit Union, said the CIO is the right person to make these decisions "if, and only if" they are as well versed in business as they are in technology. "The day of the pure technologist is long gone," he added.

A Simple and Effective Algorithm for Anonymizing Location Data
The study of human mobility can potentially unlock great value for both commercial players, as well as the public sector. Location data can, for example, assist city traffic planning, and intelligent trans portation [9], as human movement patterns are not likely to significantly change over time [3, 22, 20, 18]. Individuals can also directly benefit from location-based services which provide personalized services to smartphone and tablet users, such as navigation, tracking, and recommendations for entertainment or new friendships. These location-based services heavily rely on the availability of location data.

Re-architecting the Data Center for the Digital Service Economy
Shannon Poulin, the Vice President of the Data Center Group; General Manager of the Datacenter Marketing Group; and General Manager of the Enterprise IT Solutions Group at Intel Corporation, is responsible for driving Intel's enterprise data center business. In this keynote Shannon will provide Intel's vision for re-architecting the data center for the digital service economy and highlight how Intel is investing in key technologies that will help enable enterprises to access the increased efficiency and agility of software defined infrastructure.

The 5 Sexiest Big Data Jobs Available Today
It’s been estimated that by 2015, almost two million people will be employed in big data jobs in the US. Hal Varian, Google’s chief economist, is quoted as saying “…the sexy job in the next 10 years will be statisticians” and Tom Davenport, Distinguished Professor at Babson College, believes that a data scientist has the sexiest job of the 21st century. So what are these sexy jobs? Here’s a quick look at some of the positions available today that might allow you to break into the glamorous and exciting world of the big data professionals:

5 Big Data Hadoop Use Cases for Retail
Now, Apache Hadoop provides the necessary technology and data pipeline for analyzing customers as individuals and creating individual marketing campaigns accordingly. Rather than guessing, gambling, and hoping campaigns succeed, businesses can make observations on retail data and focus on the individual shopper. Not only does this reduce the amount of time spent researching; it can lower marketing budgets significantly and allows ads to reach the right people. It’s not just about ad campaigns. There are a vast number of applications that can be built using Hadoop, from analyzing the customer to analyzing the brand, five of the most common of which are detailed below.

Google Execs Have Ideas on How to Run Your Business
Most companies think that the set of stuff that needs to be done is much more onerous than it really is today, and that’s because they’re not thinking in terms of information, reach, and computing power. They’re thinking in terms of the inputs that go into the old 20th-century manufacturing world. If you look at software today, much software is built on open standards. We have much more powerful APIs. It’s very easy to do things, like the guys at Waze did or the guys at Uber did, to put information together and accomplish something very significant with a very small number of people.

Microsoft to detail more of its next-generation developer story in November
Microsoft will hold an invitation-only developer-focused event, targeted primarily at the CXO community, on November 12 in New York City, several sources of mine have said. That event coincides with the third, developer-focused day of the company's planned "Future Decoded" event in London. Microsoft CEO Satya Nadella is one of the speakers at the three-day Future Decoded conference. ... The next Microsoft Build conference isn't slated until April 2015 (no exact dates yet), Microsoft officials disclosed yesterday. But in the interim, the Softies are continuing to roll out updated versions of a number of Windows developer tools.

Information Governance: Principles for Healthcare (IGPHC)™
Called the Information Governance Principles for Healthcare (IGPHC), the framework is aimed at governing information across all organizational functions. Adapted from ARMA International’s Generally Accepted Recordkeeping Principles, IGPHC includes established practices from relevant areas such as quality improvement, safety, risk management, compliance, data governance, privacy and security. AHIMA defines information governance as “an organization-wide framework for managing information throughout its lifecycle and for supporting the organization’s strategy, operations, regulatory, legal, risk, and environmental requirements.”

Open source is starting to make a dent in proprietary software fortunes
This isn't good for incumbent vendors. As the report signals, "The popularity of open-source software has reached a point such that almost every incumbent and publicly-traded proprietary software vendor has an emerging privately held open-source rival that is targeting it." Still, a market like Business Intelligence is so large that an up-and-coming open-source vendor can easily get lost as a rounding error. At least for now. Where open source is having a near-term impact, according to the report, is "more in the data management and infrastructure software sectors." Still, others are also feeling the heat:

Chief analytics officer: The ultimate big data job?
Not every organization hiring a CAO is a digital pioneer, but many have matured to the point where they need to take a more strategic approach to analytics. Often, these businesses have deployed pockets of analysts and data scientists across the organization -- in marketing, IT, operations or finance -- but they aren't yet harnessing the collective wisdom or economies of scale. These companies are the prime candidates for a CAO. "When you start thinking about how to organize your analytics better and how to get more bang for the buck, you'd better be thinking about hiring a chief analytics officer," says Bill Franks, CAO at data-services firm Teradata.

Quote for the day:

"Truth alone will endure, all the rest will be swept away before the tide of time." -- Mahatma Gandhi

September 30, 2014

DevOps in Telecoms – Is It Possible?
Unlike IT and Internet platforms, they don't create a virtual service to be deployed somewhere in the cloud, nor can it be “continuously” patched in an Agile manner. They deliver hardware that may cost millions to commission and is maintained over years with strict SLA's. So on a technical level, by using OpenStack, Puppet, Chef, Salt or other technologies DevOps isn't going to do anything for the Telco guys. When I first asked my former colleagues from my time working in SaaS in 2012 what DevOps actually was, the confusing answer by advocates was:

6 Key Defenses Against Shellshock Attacks
Security vendor Cloudflare reported Monday that it has counted more 1.5 million distributed-denial-of-service attacks against the Shellshock flaw daily on its network. Web application firewall vendor Incapsula reported Monday that over the four days since Shellshock was made public Sept. 25, it has deflected more than 217,000 exploit attempts on over 4,115 domains. Incapsula has documented attacks originating from more than 890 IP addresses worldwide. So, what should companies do to defend against attackers? Experts from the SANS Institute, which provides data, network and cyber security training, offer the following advice:

Why Great CEOs Often Work Less to Achieve More
We are endlessly told that hard work creates more profit. Work harder to create more profit in your new business. Does more work really mean more profit? Do we have to put in ludicrously long hours to be successful? We have been brought up to believe that working more equates to being more successful. More input equates to more output. Well, I am not sure I agree. I think the logic (and many of the assumptions behind it) is flawed. Sure, if you are a one-person-business, charging per unit of time, then more units equals more money. But most businesses try to grow by employing people to spread the workload. Or, maybe you should simply charge more per unit of time!

Is the cloud instable and what can we do about it?
Like many of the web-scale applications using cloud-based infrastructure today, enterprise applications need to rethink their architecture. If the assumption is that infrastructure will fail, how will that impact architectural decisions? When leveraging cloud-based infrastructure services from Amazon or Rackspace, this paradigm plays out well. If you lose the infrastructure, the application keeps humming away. Take out a data center, and users are still not impacted. Are we there yet? Nowhere close. But that is the direction we must take.

"Upgrading" Pair Programming
Pair Programming it is a highly effective practices, but the remaining question if has enough coverage to describe the needed cooperative work inside the team. Unfortunately, the practice name it is interpreted too literally, only for direct coding activities. Yes, Agile has restore the importance of the coding in the overall development, but let think a little: what is the meaning of “Programming” from XP name? In fact it is “Development”, where the effective programming/coding it is, of course, very important. An XP programmer it is, in fact, a multi-role developer involved also in planning, requirements, architecture, and design, coding and testing. A much better term could be then “Pair Development”.

Enterprise Cloud Architecture: 3 Questions You Should Ask to Determine the Right Approach
Looking to minimize capital expenditures and convert to an OpEx-based model? Then a third-party cloud solution should probably be part of your equation. Want to move to the cloud but constrained by data storage regulations? A private cloud solution or a public cloud offering that meets your compliance requirements might be more up your alley. Have some apps that would easily convert to the cloud, as well as other legacy apps that wouldn’t be quite so easy to virtualize? A hybrid approach could be the right answer. As with many things in life and in business, the answer to the cloud computing architecture question is, “It depends.”

Through microservices, a renewed push for simplicity and IT minimalism
So what are microservices, and is there anything new about them? It feels like deja vu all over again. Microservices are, in essence, finely grained services, deployed without middleware or brokers -- such as an enterprise service bus. There are shades of Jim Webber's "Guerrilla SOA," which he advocated a number of years back as a way to quickly build and deploy services for tactical quick hits. APIs and RESTful services also fit this mold. Gruman and Morrison suggest that MSA is all of these things, with an emphasis on taking a minimalist approach to services:

Service model driving cyber crime, says Europol report
"The inherently transnational nature of cyber crime, with its growing commercialisation and sophistication of attack capabilities, is the main trend identified in the IOCTA,” said Rob Wainwright, director or Europol. “It means issues concerning attribution, the abuse of legitimate services, and inadequate or inconsistent legislation are among the most important challenges facing law enforcement today," he said. EU home affairs commissioner Cecilia Malmström said the fact that almost anyone can become a cyber criminal is putting ever-increasing pressure on law enforcement authorities.

Report: Crime-as-a-Service tools and anonymization help any idiot be a cyber-criminal
Almost any idiot with malicious intentions can jump into the cybercrime arena thanks to 'Crime-as-a-Service' tools that lower the entry barriers into cybercrime; wannabe cyber-criminals who lack technical expertise can simply buy the tools and skills needed. In fact, “Crime-as-a-Service business models” and anonymization have helped many traditional organized crime groups move to cybercrime, according to the 2014 Internet Organized Crime Threat Assessment (iOCTA) published today.

Trust in cloud security at all-time low: Execs still betting on the cloud
BT says this trust drop (82 percent in the US, 76 percent globally) is "a substantial increase of 10 percent globally from previous research in 2012." With recent news of serious cloud security breaches, such as the Xen bug forcing Amazon to reboot its EC2 instances, and Xen making Rackspace do the same this weekend, plus consumer fears fanned by the "celebrity nudes iCloud hack" -- it's no wonder IT is losing its faith. But with cloud security trust as rock bottom, is enterprise IT nuts for putting its data security into cloud and SaaS?

Quote for the day:

“If we did all the things we were capable of, we would literally astound ourselves.” -- Thomas A. Edison

September 29, 2014

Smarter algorithms will power our future digital lives
Basically, even though most people haven't even heard of deep-learning algorithms, better ones could mean a future that includes smarter homes, and robots that care for parents and walk our dogs. "This type of research is important in that it could yield better ways to wade through the infinitely expanding pool of data driven by the Internet of Things and mobility," said Patrick Moorhead, an analyst with Moor Insights & Strategy. "Deep learning is a critical part of the future of the digital world even though most people don't know anything about it."

Can “Agile” break the Iron Triangle? Can open allocation?
Without further exploring the rabbit hole of subordinacy, let’s return to a question that I’m sure many readers have asked. Why is this set of three traits (subordinacy, dedication, and strategy) called an Iron Triangle? The answer is that an organization gets at most two from each person. To see why that is, it’s useful to examine the eight combinations formed by the absence or presence of each trait. People with zero or one of the Iron Triangle traits tend to be organizationally inert, so I won’t focus on them. At 2 out of 3, we get the MacLeod archetypes.

Jeff Hawkins on why his approach to AI will become the approach to AI
We’re very confident that by the end of the 2020s, we’re going to be settled on a dominant paradigm. It’s going to be quite different than the one we’re currently in today, where specific algorithms that excel at one task dominate. We believe it’s going to be based instead on the universal algorithms that work on many problems. They’re going to be memory-based, not mathematically based. They’re going to be based primarily on time-based patterns, and they’re going to be online learning paradigms. Our belief in this comes really from studying the brain. This is what the neocortex does.

Samsung to offer PC gamers a 27-inch curved display
Critics who have reviewed curved TVs report that pictures seem to have more depth, and that objects at the edges of the screen look sharper because the curve of the display tracks the curve of your eye. But those reviews have been of TVs with screens that are at least twice as big as a computer monitor, and that are viewed across much greater distances. On the downside, faultfinders have noted that distracting reflections—especially from ambient light sources—are much more prominent in curved displays.

Be open and honest
What prevents leaders from apologizing freely, from owning up to mistakes and taking full responsibility for them? One contributor, no doubt, is the cultural axiom that leaders, particularly aspiring ones, should hide weaknesses and errors. However, we need to realize that it is not only healthy for leaders to admit their wrongdoings, but such practice can be a powerful tool for them, increasing their legitimacy among their co-workers. People need courageous leaders in order to feel there is someone to make the tough calls and to take responsibility for them; they need to know that the buck truly does stop with the leader.

5 features Windows 9 needs to succeed
On Tuesday Microsoft will preview the next-generation Windows operating system – currently codenamed Windows Threshold, but expected to be called Windows 9 – and it will be a keystone to Microsoft's plans over the coming years. With that in mind, here are five features that Microsoft must add to Windows 9 if it is to have a chance of not only tempting me back into the ecosystem, but also of dissipating the cloud of negativity that Windows 8 currently finds itself engulfed in.

Architecting IT for cloud integration platforms
Choosing an iPaaS product allowed InsideTrack to repurpose IT staff that had been doing back-office roles and other development activities to higher-value work. They created new roles for business analysts who could understand business process workflow and partner with other business units to ensure the company was getting what it needed. This made it possible for InsideTrack to use business analysts to do much of the integration work instead of technical experts. Sue found that individuals coming from the business side had a greater understanding of the business process and were able to work more effectively with the different business units than the traditional IT staff.

CTO to startup founder: The reprogramming process
Startups provide a polar opposite environment. You'll remain the decision maker, but you'll take on the role of chief producer as well. As a new founder, time is a luxury when it comes to product testing. This will inevitably change the way you look at production. "The biggest change in philosophy was to start thinking incremental vs large scale releases. As an engineer, you want the application deployed flawlessly, and without issues," said Larry Kiss, former Senior Design Engineer at Motorola, now co-founder of SpotHero. "But in a startup, every minute that a user isn't using the new production/feature, is lost time for user experience or production validation."

Citi Calls Coders to Develop Apps for 'Internet of Things'
Citi will make available a set of APIs (application programming interfaces) to individuals around the world selected to participate, and invite them to create apps for mobile devices, the Internet of things and wearable apps. An internal team from Citi will select applicants who can code while a panel of judges will determine who participates on one of three demo days. The innovation initiatives underscore what banking execs have publicly stated: They are strugglingto keep up with customers' digital demands at a time when the industry is getting disrupted on payments and other fronts while consumers are using branches less.

Let Me Graph That For You
Variably structured data is the kind of messy, real-world data that doesn't fit comfortably into a uniform, one-size-fits-all, rigid relational schema; the kind that gives rise to lots of sparse tables and null checking logic. It’s the increasing prevalence of variably structured data in today’s applications that has led many organisations to adopt schema-free alternatives to the relational model, suand document stores. But the challenges that face us today aren’t just around having to manage increasingly large volumes of data, nor do they extend simply to us having to accommodate ever increasing degrees of structural variation in that data.

Quote for the day:

"A culture of discipline is not a principle of business; it is a principle of greatness." -- Jim Collins

September 28, 2014

Emergence: the next efficient evolution of crowd-sourced innovation
While this model is great for generating mass content, having a large number of suggestions means there’s often a lot of ‘background noise’ which can drown out that one truly great idea. The average employee also has a fairly limited attention span, which is proven to plateau – meaning they lose interest after a certain point in the process and engagement levels drop. This killer combination creates tension in the innovation process. Current crowd-sourcing solutions and methods attempt to ease this by killing weak ideas as quickly as possible. Although this isn’t always for the best, as I’ll explain later.

3 Days on the Road and this is what is moving and shaking in Information Management
There were a number of themes and threads that arose over the couple of days that align, as it happens, align with numerous other inquires in the last few months. So thought I would detail some of these for you. There was one overarching theme that solidified in my mind, and that of complexity. More specifically how firms in general are tending to continuously overlay new complex processes and rules atop what was already a complex business or organization. This ‘adding to complexity’ seems to be everywhere and is creating all kinds of perverse or unintended consequences.

Too many cooks spoil the broth
There is a well-known case study of a major consulting firm being hired by a big airline company to help with its strategy formulation, and the consulting firm recommended a significant shift in strategy. The company later recruited the country head of the consulting firm to join its board, who then used his dominant influence to defend the strategy. The company pursued the new strategy until it was run into the ground. Apart from providing a lesson in harmful over-reliance on consultants, this case highlights the dangers of a board having too strong a vested interest in a particular strategy.

Agile Self Governance
Today in the Agile project world the idea of self-governance is pervasive. But the parallels with the Irish governance regime in the noughties is too close for comfort. The Agile principles guide that projects should be built around motivated individuals, given the environment and support needed and trust them to get the job done. Further valuing working software over comprehensive documentation is effectively encouraging teams to dispense with transparency and traceability. While this may work in small scale environments, in a large enterprise the idea that all teams will be highly skilled, properly resourced and motivated contradicts general experience.

Does IT Strategy Matter?
Increasingly, I have heard CIOs and other IT executives say, “There is no IT strategy; there only business strategy.” This sounds great, especially for a division of the corporate structure that has historically referred to itself as separate from “the business.” The problem is that this would seem to suggest that there is only one strategy: the enterprise strategy. When you extend this logic, it would suggest that there need not be a Marketing strategy, an Operations strategy, product or service strategies, HR strategies, and the like.

5 Realities about Agile Cost Savings
Every project has to juggle scope, resource costs, and schedule. If your scope is constant then you need a certain amount of resources and type of resource to achieve your goals. If you use fewer resources to complete your project, you will need more time in the schedule to complete all your scope. Ultimately, you need to strike the right balance between resources and time to achieve the scope. Either way, the cost will be the same for the most part. Here are five of our observations regarding agile’s impact on project costs:

The NHS journey to digital
By deploying a technology that is simple to use and does not require management overheads or IT specialists, the project has helped to reduce the time required by pathologists to input findings and, as a result, to diagnose cancer. It can be used on both computers and mobile devices allowing hundreds of simultaneous users and keeping costs to a minimum. Granted, healthcare provision is not the same as purchasing groceries in the supermarket. It is nonetheless important that it works for those it is designed to serve – whether they are patients or customers – just as a business,

The Open Group Panel: Internet of Things – Opportunities and Obstacles
The Internet of Things is more than the “things” – it means a higher order of software platforms. For example, if we are going to operate data centers with new dexterity thanks to software-definited networking (SDN) and storage (SDS) — indeed the entire data center being software-defined (SDDC) — then why not a software-defined automobile, or factory floor, or hospital operating room — or even a software-defined city block or neighborhood? And so how does this all actually work? Does it easily spin out of control? Or does it remain under proper management and governance? Do we have unknown unknowns about what to expect with this new level of complexity, scale, and volume of input devices?

Why Your SOC and NOC Should Run Together but Separately
Another reason the NOC and SOC should not be combined is because the skillset required for members of each group is vastly different. A NOC analyst must be proficient in network, application and systems engineering, while SOC analysts require security engineering skills. Furthermore, the very nature of the adversaries that each group battles differs, with the SOC focusing on “intelligent adversaries” and the NOC dealing with naturally occurring system events. These completely different directions result in contrasting solutions which can be extremely difficult for each group to adapt to.

Unconventional Approach to Shift-Left by Removing Scripting from the Equation
A scriptless approach can help overcome these challenges by providing greater agility to test automation teams. Script-based Test Automation Challenges Historically, test automation has been perceived as a process in which tests drive an application through its user interface (UI).2 Our experience with UI-based test automation finds that the typical bottlenecks limiting ROI are in the devel-opment of test scripts. Scripted approach limita-tions include: • Test scripts are developed in a tool-specific language, which non-technical users and busi-ness stakeholders do not understand. • There is often a steep learning curve before mastering the required technical skills.

Quote for the day:

"Leadership is a privilege to better the lives of others. It is not an opportunity to satisfy personal greed." -- Mwai Kibaki

September 27, 2014

Fluentx: A Special .NET Library
Fluentx covers all major C# control statements, and eliminates the limitations within them, and adds more features, the assembly holds 5 major categories: C# control statements, Helper Classes, Extension Methods, Specifications Pattern, Object to Object Mapper, the assembly will get bigger and bigger by time as we will add more and more to it to make it used and helps everybody out there. It also has an implementation of Specification Pattern as a validation for any type of code, whether its a business validation or anything.

Leaders in Lean Software Knowledge
The primary thing that we are advocating is not to think of software development as coding and testing. Rather to think of it as figuring out what is worth doing, what’s going to delight the customer, doing it, making sure it’s working well, getting it in service to the customer, and getting feedback from the customer. The really important metric is how fast you can get feedback from a customer about the actual, deliverable application that you are creating. That is beyond the realm of most people who are thinking about software all by itself. It gets toward the devops on one end, and it gets toward the design thinking on the front end.

CAPEX Deferred Eventually Makes the Company Sick
The constant deferral of CAPEX has the real potential to make your company sick. Investments in computers, machines, plants, equipment, buildings and more are the backbone of a company. When CAPEX is intentionally constrained in favor of parking cash for a rainy day or buying back stock (at already high prices), much needed upgrades are deferred. Worse, constant deferrals of capital upgrades are like a “hidden tax” in that by not spending cash on upgrading creaking systems and infrastructure, it’s highly likely something much worse can happen down the road (i.e. the millions extra Los Angeles has to spend just to clean up the messes resulting from infrastructure failures).

Fighting fraud in banking with big data and analytics
Current systems often cannot handle the volume, frequency or the complexity of today’s fraud activity. Also many banks have, over time, cobbled together numerous fraud point solutions, making a holistic view of threats impossible. The old model of responding to attacks and fraud well after the fact just won’t work in today’s world of sophisticated and organized financial crimes. Adding to the problem, banks have created a corporate silo mentality that’s often a barrier to successfully fighting fraud. As a result, too many organizations remain vulnerable to fraud because they aren’t taking advantage of new capabilities to fight these threats.

Need for Speed: Parallelizing Corporate Data
A critical success factor is enabling iterative, variable, and transparent results tuned to the personal and organizational work tempo of analysts, managers, and business product delivery. In almost all mission-critical activities, the specific requirements of the business on the data environment are neither static nor known at a level of detail sufficient to supply traditional tools and methods. This leads to the accursed business-technical organizational chasm. - See more at: http://vision.cloudera.com/need-for-speed-parallelizing-corporate-data/#sthash.LzlvfqiA.dpuf

5 tips for keeping IT projects on track
After more than 20 years managing IT projects at global enterprises, I have seen and experienced many situations. I’ve celebrated many successes and also faced many challenges. Some of these experiences have served as good examples of what works and what doesn’t in IT project management. Now I am putting these lessons to work in my current role as chief technology risk officer at GE Capital. My job includes oversight of our IT investments, making sure our largest-scale IT projects stay on track and remain strategic to our business. Based on this broad set of experience, here are five key lessons that have proven particularly useful:

SQL Server unit testing framework
This unit test framework has no dependencies beyond SQL server and does not rely on the common language runtime. The tables and functions in the downloadable source files (.sql) should ideally be created in a separate database on the server that hosts the databases being tested. The process will be familiar to anyone who has used the unit test frameworks such a NUnit, MSTest etc. First you set up the prerequisites for the test (pre test setup) then you perform the assertion (unit test) then you clean up anything created by the unit test (tear down).

Shellshock: How to protect your Unix, Linux and Mac servers
A more serious problem is faced by devices that use embedded Linux — such as routers, switches, and appliances. If you're running an older, no longer supported model, it may be close to impossible to patch it and will likely be vulnerable to attacks. If that's the case, you should replace as soon as possible. The real and present danger is for servers. According to the National Institute of Standards (NIST),Shellshock scores a perfect 10 for potential impact and exploitability.

Freaky Data Science
Practical freak advice pertinent for data science includes focus on solving small problems, being wary of “moral” solutions to practical problems, acknowledging what you don't know – “Everyone's entitled to their own opinion but not to their own facts” – and being cognizant of when it's time to quit. And of course the gold standard of determining truth for freaks is the randomized experiment “The impulse to investigate can only be set free if you stop pretending to know answers that you don't.” Perhaps no chapter has more to offer the budding data scientist than “How to Persuade People Who Don't Want to Be Persuaded”.

Take Aways from the Reifer 2014 Quantitative Analysis of Agile Methods Study
Reifer Consultants LLC recently published a benchmarking report that compared the productivity, cost and quality performance achieved by software development projects that use agile methods against similar ones that employ traditional, plan-driven approaches. The results of the analysis were based on 1,500 projects, 500 of which employed a variety of agile methods, over a ten year period using data supplied by 100 organizations. This condensed white paper summarizes seven ‘trends and take-aways’ taken from our report entitled “Quantitative Analysis of Agile Methods1.”

Quote for the day:

"There are many elements to a campaign. Leadership is number one. Everything else is number two." -- Bertolt Brecht

September 26, 2014

The modern workforce: an evolving culture of work
We are seeing a rapid move toward more mobile workers, changing patterns of work and communications, and changing work-life balance. Those changes are creating the 3D workforce, which is distributed, discontinuous, and decentralized. Technology decision-makers and business leaders are adapting to this changing culture of work.

Web caching: Facebook’s Problem of a Thousand Servers
Mcrouter is a piece of middleware that sits between a client and a cache server, communicating on the cache’s behalf, Nishtala explained. It has a long list of functions, three of the most important ones being cache connection pooling, splitting of workloads into “pools” and automatic failover. Pooling cache connections helps maintain site performance. If every client connected directly to a cache server on its own, the cache server would get easily overloaded. Mcrouter runs as a proxy that allows clients to share connections, preventing such overloads.

The Role of Technology in Managing Anti-Bribery, Corruption & Fraud
The distributed and dynamic nature of business makes anti-bribery, corruption, and fraud compliance a challenge. Compliance in the context of a complex and dynamic business environment is particularly challenging as organizations face broadening anti-bribery and corruption laws and regulations. Ultimately, the best offense is a good defense. Regardless of the models, technologies and strategies enabled to help, organizations must be prepared to show they have a strong compliance program in place to mitigate or risk exposure to investigations, penalties and possible prosecution.

Three Questions with the CEO of D-Wave
Computers capable of exploiting quantum physics for computation on a large scale promise to solve in mere seconds problems that would take conventional machines millions of years. But whether D-Wave’s machine uses quantum tricks to process data more efficiently is still an open question. Nonetheless, the company has attracted significant investment funding, and it has struck deals to supply its hardware to companies including Google and Lockheed Martin for research

White House blames IT systems for immigration data problems
"Their IT systems are ridiculous," said Donnelly. "I think there is a disconnect between the people who do the IT systems and everyone else," he said. Criticism about U.S. immigration data, its quality and availability, was a continuing refrain at a National Academies conference this week on high-skilled immigration. Politics and incompetence were blamed for the problem. Immigration data often includes mistakes and is being typed in by people "whose highest priority is not the accuracy of the data," said Madeleine Sumption, director of international research at the Migration Policy Institute, who spoke at the conference.

In pursuit of universal IoT standards
Dozens of consortiums, commercial alliances, and standards groups have been formed in the past few years to address that question. All of them profess essentially the same goal: to speed the growth of the Internet of Things (IoT) and its subset, Machine-to-Machine (M2M) systems, by creating common standards for, as standards group AllSeen Alliance outlines, “interoperable products that can discover, connect, and interact directly with other nearby devices, systems, and services regardless of transport layer, device type, platform, operating system, or brand.”

4 Outsourcing Mistakes Companies Still Make
There's still no script for the Great American IT outsourcing project. But today's most common outsourcing pitfalls have less to do with technology and everything to do with relationships and communication. Or lack thereof. "Both companies have to rise to the occasion to make it work," says Romi Mahajan, president of marketing consulting firm, the KKM Group, which outsources some of its IT operations. Nevertheless, communication breakdowns and finger pointing frequently derail even the best-laid outsourcing plans. Here are four missteps to avoid.

IT Leaders Aren't All Coming From Tech
"Our theory is that within leadership roles, folks have to understand the entire business so they can better serve customers -- both external and the internal customers, users, that IT supports," Van Noort says. "Our external clients are facing skills shortages not with technology and certifications, but with business skills and seeing the larger business strategy," she says. "Instead of focusing so much on speeds, feeds, technical specifications, what we advise our clients is to treat their internal users as customers. We want them to ask, 'What does success look like? What does successful business usage look like?' and that takes a cross-functional, multifaceted approach," Van Noort says.

SDN warning: Firms will be affected by skill shortage and increasing complexity
The chase to plug this skills gap is causing conflicts between departments, the NetEvents conference where Oakley was speaking heard yesterday. He said: “There are challenges in terms of skills - what we are seeing is a diversification in skills required for people to be able to both understand complexity of data plane environment but also understand the control plane and the higher orders.” But Citrix’s group vice president and general manager, John Bukowsky, said this will be solved by increasingly easier-to-use cloud services.

Apple to release fix for Bash bug
"With OS X, systems are safe by default and not exposed to remote exploits of bash unless users configure advanced Unix services,” Apple said, adding that it is working on a software update. However, Apple has not indicated which “advanced Unix services” could make Mac OS X users vulnerable to attack. The biggest threat is to the enterprise because many web servers are run using the Apache system, software which includes the Bash component. But, while most of the main Linux distributions have rushed to release updates, security experts have raised concerns about Unix-based embedded systems in internet of things (IoT) devices.

Quote for the day:

"Great things are done by a series of small things brought together." -- Vincent van Gogh