May 26, 2015

How to Better Guard Against a Security Breach
Despite their investments in SIEM and the notable progress in developing strategy and policy, barely half (51%) of survey respondents that utilize security and event log data have strong confidence in their ability to detect or mitigate breaches. That may reflect the continuing focus on perimeter protection and firewall technologies—the top priority for coming investments, according to 56% of survey respondents. Interestingly, that’s despite the growing industry-wide recognition that building higher fences is no longer a viable security strategy in the face of sophisticated cyber assaults. Many enterprises “are investing, typically, in the same things they invested in last year and the year before,” says Schou.

Q&A on the Book More Fearless Change
The primary purpose of a pattern is to document a common, recurring problem with ​the solution that has been validated. This is why they are called "patterns"​ -- because the problem and solution have been seen in more than one instance. So, each of the Fearless Change patterns is not simply the idea of one person-- rather, each one has been used by different types of change leaders in different environments. Therefore, others can use the patterns ​knowing that they have been shown to work. In addition, each pattern documents the benefits and challenges of using ​ it​. Therefore, leaders of change can not only feel confident in the solution, but will also know the consequences. And, when each individual pattern is combined with other patterns (in the form of a pattern language), the organization now has a collection of powerful strategies for addressing complex problems.


Identity Management in the Cloud Goes Beyond Security
IAM (identity and access management) is clearly the best security model and best practice for the cloud. That’s why some cloud providers, such as AWS, provide IAM as a service out of the box. Others require you to select and deploy third-party IAM systems, such as Ping Identity and Okta. But you should be thinking of identity management not only as a security technology, but also as a business driver. Thus, when you deploy IAM, you need to focus on the core business processes and on the details around security. This is a shift from the recent thinking in which the business drivers were largely out of IT’s consideration. Enterprises that develop mature IAM capabilities can reduce their identity management costs and, more important, become significantly more agile in supporting new business initiatives.


Agile security lessons from Aetna and the state of Texas
Moving to an agile model can make some traditional security professionals nervous, he said, especially those with a command-and-control view of the process. "There's a perception among security people that developers don't care about security," he said. But agile offers security employees the opportunity to become resources early on in the development process, instead of coming in afterwards and looking for mistakes. "Which is still an important thing to do. but you don't want your development team to have all the interactions with the security team be negative," he said. "That creates a pretty toxic environment."


Entertain, inform, and connect with the AT&T ZTE Spro 2 Smart Projector
While the device works fine without a connected power source, you are limited to low and medium (100 lumen) brightness. In order to experience the full 200 lumen output, you need to connect the external power source. With dimensions of 5.3 x 5.2 x 1.2 inches and 19.4 ounces, the ZTE Spro 2 is quite portable. ZTE also includes a carrying case that holds the device, charger, and HDMI cable. The device is powered by a Snapdragon 801 quad-core 2.0 GHz processor, Adreno 330 GPU, 2GB RAM, 16GB integrated storage, WiFi, and Bluetooth. ... It performed flawlessly, projecting onto blank walls with good brightness and even included audio. I connected external speakers through the audio out port and also tested Bluetooth audio output, both of which were much better than the small internal speaker.


How a change in thinking can stop 59% of security incidents
So, how do you approach this problem with employees? ISO 27001, the leading information security standard, offers a less attractive, yet much more effective approach to this problem: (1) strictly defining the security processes, and (2) investing in security training & awareness. The security experts who developed this standard long ago realized that the technology itself cannot resolve the organizational and the people issues: technology is only a tool; it is only a part of the wider picture. Or, to view this issue from the management theory point of view, the organization is basically a mixture of three essential elements: people, processes, and technology.


NoSQL Databases: comparing MongoDB, HDInsight, and DocumentDB
Availability is not a problem with both MongoDB and DocumentDB. MongoDB ensures there is high availability through the configuration of a secondary server to act as the primary server when the primary server goes down. DocumentDB uses the Azure feature to manage server availability. DocumentDB is designed specifically for web applications and mobile devices. This means you will not get the best from it if you are not using web applications or mobile devices. ... For consistency, both DocumentDB and MongoDB are good options because they use ACID properties (at the document level) to ensure safe updating of documents. If there is error, the operation rolls back. With MongoDB, developers can specify the write concerns.


Hybris-as-a-Service: A Microservices Architecture in Action
Micro Services are a new paradigm for software architecture: small services in separated processes take the place of large applications. This way monolithic architecture can be avoided, and systems are easily scalable and changeable. The microXchg conference looks at a variety of aspects of Micro Services. ... Andrea Stubbe explains how to create cloud applications with microservices using Hybris’ platform and API. Andrea Stubbe is Product Lead of the core part of the as-a-service product at Hybris. Having been a software developer for most of her career, she loves working on an architecture that addresses many of the problems and challenges she has observed in earlier projects. She also finds this a perfect fit for lean and agile development principles.


5 Critical Ways to Take a More Collaborative Approach to IT Security
First, it seems that most organizations‘ approach to security is inward-focused. Call it the “outrunning the bear“ response: the IT team at your organization doesn‘t have to be faster than the cybercriminals, only faster than the other organizations trying to outrun them. While about 75 percent of IT security staffers say they have plenty of opportunity to collaborate with peers within their organization, 60 percent say they have little to no opportunity to collaborate with peers at other companies. ... Second, IT security staffers get most of their information about security trends, threats, vulnerabilities, warnings, and technologies not from their peers, but from online forums and cybersecurity news sites.


Mobile Internet To Be Worth More Than Apple By 2018
Despite huge scale and growth, mobile is still evolving. M-commerce remains the primary engine of growth, which is why VCs bet more than half of $41 billion invested in mobile in the last 12 months into m-commerce-related sectors. Mobile advertising is set to leapfrog in-app purchases to move from third to second place in the revenue hierarchy by 2018, as app developers rebalance their business models to capture new opportunities. Enterprise mobility growth continues, although not as fast as the consumer market. Finally, the Apple Watch is helping the wearables sector to gain deeper penetration and revenue.

---

Quote for the day:

"A leader has the vision and conviction that a dream can be achieved.He inspires the power and energy to get it done." -- Ralph Nader

---

May 25, 2015

Startup Beams the Web’s Most Important Content from Space, Free
Outernet is putting together the first 100 prototypes of those devices, code-named “Pillars,” and starting to test them in the field. One is up and running in a village in western Kenya. Another is in the Dominican Republic, and a third will soon be installed at a Detroit anarchist community attempting to live off the grid. Outernet’s current signal broadcasts about 200 megabytes of data over the course of a day, making it possible to update content such as daily news and weather forecasts periodically. It covers North and Central America, all of sub-Saharan Africa, Europe, and parts of Asia and the Middle East.


Software Defined Reality – NFD9 Redux
The idea that SDN means networking engineers have to be Python programmers persists in the minds of many and, sadly, the products of many as well. Even just a year ago, the first thing we were being told about any SDN-compliant product was what APIs it supported. Is it RESTful? XML RPC? Does it support OpenFlow fully? Bottom line: we (the sane) are not going to be writing code to program every single flow on a switch using OpenFlow. I believe what we really want is products that support standardized interfaces, yes, but only because we like the idea that somebody other than the product vendor might be able to do a better job of controlling that device.

Your SaaS Metrics Are Wrong if You Include These Customers
Ultimately, when it comes to defining “users” you probably want to start only with those that are actually “engaged” with your product or service (whatever “engaged” means… hopefully it’s well-defined in your world). This means getting away from low-value metrics like “signups” or “installs” or “logins” or even general “activity” and into specific metrics like “contextual activity” or activity that indicates whether the user is doing something from which they will derive value. I’ll be honest… this will likely reduce the number of “users” you have – which will cause a hit to the ego – but it will give you a better, more realistic view of what’s really going on in your business.


How to Make the First Minutes of a Major IT Incident Count
How an IT or DevOps organization communicates during the first few minutes of a service outage is crucial – businesses are negatively impacted by even a IT outage lasting only a few minutes.A recent survey of more than 300 IT professionals by Dimensional Research reveals that finding the right person to restore service takes at least 15 minutes. While IT searches for the right individual, the business is often suffering. However, it doesn’t have to be that way. Here are some ways reduce business downtime and improve the customer interaction significantly: .. If everyone is transparent with communications, the major incident manager can designate someone other than resolvers to proactively communicate what happened and next steps to customers, partners, marketing and public relations teams and executives.

8 Reasons IT Pros Hate The Cloud
Some find it hard to believe that cloud computing is only continuing to gain popularity. Some object to the purely technical issues that pose problems for IT pros who are used to maintaining data and applications in-house. They feel the cloud creates more work for them. Oftentimes, the issue is rooted in the difficulty that IT admins are having transitioning to new roles. With cloud-based infrastructure, platforms, or software, hands-on technical skills aren't needed as much as they once were in IT. Instead, many enterprises seek professionals who can act as systems architects, bringing a high-level vision of end-to-end infrastructure. With time, these and other pet peeves will be resolved. For now, though, cloud hatred is a serious problem.


Big Data: Uncovering The Secrets of Our Universe At CERN
Crunching all of the data collected from monitoring 600 million particle collisions per second would require more processing power than any one organization has at its disposal. To get around this problem, CERN initiated the construction of the Worldwide LHC Computing Grid, utilising computer facilities available to the universities and research groups collaborating on the project, as well as private data and computing centers. This “distributed computing” gives the experiment access to processing power and storage capacity which would be far too costly to build into one data center. It has other advantages over a centralized system – the data can be accessed at greater speed by researchers wherever they are in the world, and if disaster strikes at one location, multiple mirrors of the project exist elsewhere.


The best of jobs, the worst of jobs
All CIOs need the gravitas to be perceived as a peer of the other executives. Without it, they will not garner the respect necessary to manage the corporate project prioritization process. But with many fewer staff than their Fortune 500 counterparts, mid-tier CIOs also need enough technology expertise to be respected by their IT staff and to avoid being viewed simply as a “suit.” The best mid-tier CIOs have a broad set of skills. They are equally comfortable discussing detailed technology options, project management methodologies and shareholder value.


Connecting Big Data, Cloud and Watson to the Car for a Safer Ride Home
Many high-end cars already have electronic stability control plus adaptive cruise control and lane departure warnings. If you merge these technologies together, you get the first step in automated driving. When we make that leap, the car will be able to obtain and process even more information to keep the driver informed. The car will know the street ahead and make the necessary adjustments. In 2016, we will start seeing mass production for semi-automated driving solutions. By 2020, we will be ready for highly automated driving scenarios and fully automated by 2025. One of the main tasks will lie in using the cloud as an information carrier for the vehicle. Automated vehicles will need to know what lies around the next corner – is the road free, or is there a construction site?


Practitioner's Guide to Establishing a SOC
Establishing a Security Operation Center is a necessary step for an organization to be able to detect and efficiently contain a breach. Once you’ve determined to establish a SOC, the next important question to ask is, “how can my organization most efficiently achieve this goal?”  ... When establishing the Security Operation Center it is important that realistic understandings of these constraints are considered in order to ensure that an effective solution is created. If technology already exists, but access to the data cannot be guaranteed due to political reasons, it is of little use. Similarly, if technology is acquired but the overhead required for deployment, integration and management is beyond the capabilities of the current employees then it will be of little help.


The science behind virtual routers and their emerging roles
To understand a virtual router, it's important to understand the elements of a physical router. In its simplest form, a router links two LANs together via a protocol that implements and understands sub-networks and the routes between those subnets. That is, a routable protocol. Moving up a step, routers also link subnets -- via a wide area network (WAN) -- to subnets that are based in different geographic locations. Thus, three components are needed: a LAN interface, a WAN interface and the routing code that can decide which traffic needs to traverse the WAN and how to package it accordingly. When WAN routing first became a viable way to connect geographically dispersed corporate LANs in the 1990s, the routing world was in its "Wild West" phase.

---

Quote for the day:

"Feedback is the breakfast of champions." -- Ken Blanchard

---

May 24, 2015

6 Psychological Triggers That Make UX Design Persuasive
You must learn about human psychology to design compelling user experiences. If you understand how the human mind works, it’s easier to get people’s attention and keep it. It’s also easier to get them to take some form of action (like subscribing or buying). But how do you find out what goes on inside the mind of your users? Well that’s where psychological triggers come in. They’re invisible forces that influence and persuade people. And when you use them in your design you can get more people to say yes to what you’re asking. In this post I’ll break down psychological experiments and academic research into simple, actionable steps that can help you design better experiences that lead to more sales online.


5 Smart Ways to Convince your CEO to Go Mobile
A common (and surprising) complaint I have been hearing is the difficulty CIOs and CTOs face in persuading CEOs to extend their business to mobile platforms. Today the mobile revolution seems to be pretty obvious just by looking at Apple’s performance. However, I realized that some are still reluctant to change their success formula. ... As mobile technology is evolving, we are finding newer ways to interact. Apple recently updated touch screens with force touch. Voice assistants are getting smarter, wearable devices have gained interest, fingerprint technology has become a lot better and new payment methods like Apple Pay are available. All these advancements have significant business applications. It’s important to be proactive and be a company that innovates instead of waiting for your industry to change dramatically and then reacting.


Security Concerns Extend to ‘Big Data Life Cycle’
The security flaws in Hadoop are well known. Apache Hadoop was an open source development project with little initial regard for security. As Hadoop’s security problems emerged, distributors and the Apache community began offering security add-ons for access control and authentication (Apache Knox), authorization (Apache Sentry), encryption (Cloudera’s Project Rhino) along with security policy management and user monitoring (the proposed Apache Argus based on Hortonworks‘ XA Secure acquisition). “Hadoop itself is very weak in security. You can be a Linux user and take all the data from Hadoop,” Manmeet Singh, co-founder and CEO of Dataguise, a provider of data masking and encryption tools for Hadoop, told Datanami last November. “The problem is the insider threat. Anybody can walk away with billions of credit card numbers.”


The City of Burnaby’s CIO offers an Internet of Things reality check
“What we’d like to get to is really to start thinking of these sensors more out of the optimization of the business process to how we can do things better as a city,” she said. This could include smarter traffic flows, remote proactive information before infrastructure fails, or being able to email citizens or send out tweets about something important happening in their area. Other use-case scenarios for sensor-based technologies today is on the City of Burnaby’s pump stations, which Wallace said are used to remotely monitor things like pressure flow and depth. “What really interests me is the education piece: if your water usage has gone up for 20 percent, for example, this is what it means for our reservoir,” she said. “Some of these things we’re doing were not called the Internet of Things. They were just things good cities did.”


Banking on IT Governance: Benefits and Practices
In banking today, more systems, applications and services are exposed to the customer through self-service channels which have a direct bearing on customer experience. They can create significant opportunities but increase the risk of poor performance. Thus, quality of IT governance has become an important tool for managing risk and marketplace effectiveness. However, IT governance comes with a slew of risks, and the distinctions among them are distorted with the merger of people, process and technology. This can lead to a serious impact on operational effectiveness. There is a need for security governance within banks, which entails building a robust framework and laying down a comprehensive information security policy. In addition, it relates to creating a data prevention framework for minimizing data breach.


Halamka and Branzell Urge CIOs To Be “Revolutionaries”
It is particularly difficult now that CIOs are pelted daily with new requests and demands from inside and outside their organizations, Halamka said. “People say, ‘OK, I get it, we need to be prepared for the accountable care future, we need to prepare for care management and care in the home, and even though there’s this cool project that some stakeholder wants, we really don’t have the bandwidth for that.’ And so what not to do” as a CIO “is as important as what to do, because each of us gets this laundry list of hundreds of things that stakeholders wants.” He said with a bit of humor, “The technique I usually use is not to say ‘no’; ‘no’ is such a negative word, so loaded with emotion. So, I say, ‘not now.’” Meanwhile, he added, “My role on the resource side is not to create fear, uncertainty and doubt, but to explain to the board what we need to do.”


DAM and the Art of Governance
A good DAM manager, like a librarian who is differentiating between reference-only items and circulating materials, will keep records. These may take the form of spreadsheets or flowcharts in a secure location delineating user group permissions, asset restrictions, metadata fields both required and optional, workflows, controlled vocabulary terms and taxonomy structure. The most important aspects of the governance strategy are the organizational buy-in on the policies for digital asset management and the documentation of these rules. The benefit will be the ease of decision-making enabled by an established governance plan. Don’t worry about how formal or official these policies may be – the value is in having the discussions leading to the creation of the governance plan and simply in having it all written down.


Three Ways Data Breaches Are Reshaping Data Governance
With the public increasingly cognizant of the amount of personal data they share with businesses, the organizations that collect this information will need to do a better job of determining how much stored data could be potentially exposed in a breach. Businesses need more context around stored data and a stronger understanding of the type of personal information that is collected and how it is protected. Metadata analysis enables businesses to take stock and identify which systems interact with what data, where that data is stored, how much of it is personally identifiable data (PID), and more. This can reveal gaps in data security or material risk factors – a crucial capability for businesses that desire proactive breach mitigation.


Is MDM BI?
There is certainly a reliance on each other; however, a solid BI strategy cannot exist without MDM. Let's face it, a report is only as good as the data from which it is drawn. ... MDM ensures the data you present in your BI layer is clean, complete, consistent and de-duplicated. These data issues arise when you are combining several data sources, eg, CRM, ERP, billing, stock, helpdesk, etc. Duplicates also arise as a result of fast-growing companies which, while on the acquisition path, acquire many new ERP and CRM systems along the way. ... If all this data is pulled into a data warehouse, they will be seen as different records and be counted as different customers. When creating BI views or reports, the data will be incorrect because of underlying problems in the source systems.


e-Book: Managing Third-Party Risks
This e-Book, produced by Compliance Week in cooperation with ProcessUnity, reviews the latest thinking in vendor and third-party risk. It provides compliance professionals with everything they need to know about third-party risk management and how to avoid regulatory complications. In the first article, we explore topics from a recent executive forum, which discussed vendor risks and why building a systematic approach is important. Next, in “Four Keys to Creating a Vendor Risk Management Program That Works,” ProcessUnity deconstructs the idea of vendor risk management and provides four principles that compliance practitioners should follow. Then we examine what happens when third parties engage in bribery and corruption. “Mapping Third-Party Risks” discusses the size and scope of the third-party universe and why companies should have a plan to monitor their vendors.

---

Quote for the day:

"If you can’t handle others’ disapproval, then leadership isn’t for you." -- Miles Anthony Smith

---

May 23, 2015

Government should take agile approach to policy and service delivery, says Hancock
Speaking at the Institute for Government, Hancock hailed the development of digital services during the last government, such as the Gov.uk website and online identity system Verify, as an illustration of how the Cabinet Office is “leading by example” on matters of providing solutions. “Small teams of developers building a product quickly and cheaply then iterating to improve it, not through long consultations and private advice but by seeing how it survives contact with reality,” said Hancock. “It will more and more be the way of the future – not just in digital but for all policy-making and service delivery.” Hancock said the next steps for the Cabinet Office will be to deliver a better government and society by acting as a “cohesive centre” for government to challenge and support the Cabinet.


Firefox Maker Battles to Save the Internet—and Itself
Suddenly, though, the Internet looks nightmarish to Mozilla. Most of the world now gets online on mobile devices, and about 96 percent of smartphones run on either the Apple iOS or Google Android operating systems. Both of these are tightly controlled worlds. Buy an iPhone, and you’ll almost certainly end up using Apple’s Web browser, Apple’s maps, and Apple’s speech recognition software. You will select your applications from an Apple-curated app store. Buy an Android phone, and you will be steered into a parallel world run by Team Google. The public-spirited, ad hoc approaches that defined Mozilla’s success in the Internet browser wars have now been marginalized. Developers don’t stay up late working on open-source platforms anymore; instead, they sweat over the details needed to win a spot in Apple’s and Google’s digital stores.


Data Encryption In The Cloud: Square Pegs In Round Holes
In the end, the resulting encryption algorithms are not only secure, but solve the key usability issues of making it easy to specify a “peg size.” Innovative security vendors offer the ability to specify regular expressions to allow fast prototyping of formats at customer sites, and to greatly decrease the cost of developing new encryption engines. In most encryption products for structured data, each different type of field needs its own encryption engine. This is time-consuming, complex, and error-prone. With FPE, the process of creating a new encryption engine is as simple as picking a regular expression, which describes the field. Thus, creating a new encryption engine is something that any developer can do seamlessly. This allows them to quickly adapt to the particulars of different cloud services.


Three must-read cyber security green papers
All businesses must address the issue of cyber security. You need to know what risks your business faces, what to do about them, and how to protect yourself in the future. Cyber criminals lurk everywhere and look for weaknesses in systems and networks. It’s not personal (most of the time); it’s simply the exploitation of a vulnerability. If you don’t address these vulnerabilities, you put your business and your customers at risk. But before you panic and throw your computer out the window, help is at hand. At IT Governance we specialise in helping businesses find cost-effective cyber defences. We’ve distilled this knowledge into a range of green papers to help you get to grips with what you need to know and what you need to do to protect yourself.


Application Delivery, Management, And Ongoing Change Are All Part of DevOps
Every business today is a digital business, and every digital business runs on apps. There are apps for employees, internal constituents, vendors, and customers. Some apps are focused business to business (B2B) while others are geared business to consumer (B2C). For many companies, application delivery and management are competitive differentiators in the marketplace, critical to acquiring and retaining customers. Apps are the way people engage, interact, and get business done. It’s no surprise, then, that IT departments are pouring time, effort, and money into application development – whether for their own company’s proprietary use or to sell on the open market. And the twin guiding lights for all application development are speed and quality.


VPI Gateway Considerations
A VPI gateway looks exactly like a switch from the outside, but its logical behavior is more complex. This additional complexity must be taken into consideration during fabric design. Unless this is done, serious issues can result. For example, aggregate bandwidth may be low, or disruptive fabric changes may be required, or unexpected credit loops may be created. From the InfiniBand fabric perspective, ‘in band’, a gateway consists of an InfiniBand switch plus an internal HCA. The HCA is sometimes referred to as a TCA, and is connected to port N+1 on the switch ASIC.


Big data brings new power to open-source intelligence
Two overlapping developments in particular have greatly influenced the growth of open-source intelligence. First, the explosion of social media has given us instant access to a wealth of user-generated content. From Facebook to Twitter to Google+, we are now only ever a few keystrokes away from a potentially global audience. And as these tools increase global connectivity, people seem increasingly willing to project their thoughts, opinions and observations into cyberspace. The process of information generation has produced what has been described as “new digital commons of enormous size and wealth”. Second, and on a larger scale, the scope of open-source intelligence has been completely changed by the rise of big data.


Why Businesses Should Exercise Caution with Full Cloud Integration
No matter how popular cloud-based technology becomes, or how expedient it seems, consumers should exercise caution when it comes to full cloud integration. The cloud is not always as easy to access and use as the providers may claim. At any given time you could be denied access to data. This is not good at all considering the fact that cloud services are paid for and can get costly. The most concerning aspect of full cloud integration is security. The bottom line is that cloud security and privacy are not guaranteed. It is important to be fully aware of the terms and conditions, as well as the things you upload and store, when using cloud services and especially when considering full cloud integration.


Should I learn Java? Maybe, maybe not
The question is what depth of knowledge you need, given your stated professional direction. The answer to this question will help you decide if learning the desired new technology is nice-to-know, good-to-know, should-definitely-know, or cannot-live-without. For example, if you are a Business Analyst and would like to speak more technically with the programmers, then Java would be a good-to-know. If you are a programmer and want to expand your marketability, Java would be a should-definitely-know. Lastly, if you’re a production DBA and are just curious what the programmers are doing all day, learning Java is a nice-to-know, but your time may be better spent expanding your knowledge of database and data center based technologies.


Enterprise Architecture Beyond the Perimeter
An increasingly mobile workforce and the ubiquity of attacks on client platforms limit the effectiveness of the traditional corporate network perimeter-security model. Beyond Corp is a broad effort to re-architect the delivery of Google corporate computing services, removing privileges granted solely on the basis of network address. The Overcast architecture blueprint is key to this, presenting a model of machine identity, authentication, and inventory-aware authorization. We discuss the background of our work, our general approach, challenges encountered, and future directions. ... USENIX is committed to Open Access to the research presented at our events. Papers and proceedings are freely available to everyone once the event begins. Any video, audio, and/or slides that are posted after the event are also free and open to everyone.

---

Quote for the day:

"Our business in life is not to get ahead of others, but to get ahead of ourselves." -- E. Joseph Cossman

---

May 22, 2015

Fido Alliance launches authentication standards certification
“Where passwords are still used, the Fido authenticator supplants the security dependence on the password, which is then just an identifier,” said Fido Alliance executive director Brett McDowell. “Security shifts to the U2F device, and it is much easier to use than any other two-factor authentication method available before Fido 1.0,” he told Computer Weekly. Announcing the certification programme, the Fido Alliance said 31 suppliers have already passed Fido certification for existing products and services. These include Google’s login service that uses a USB security key as a simpler, stronger alternative to the six-digit, one-time passcodes (OTPs) used by its 2-Step Verification facility.

How Virtual Reality May Change Medical Education And Save Lives
Spio’s hope is that Next Galaxy’s virtual reality model will better educate and prepare health care providers–as well as consumers–for learning CPR, based on a more realistic learning environment. She advocates a paradigm shift, away from the current approach–which relies upon passively watching videos and taking written exams–to a method for learning that involves the use of gestures, voice commands and eye gaze controls, thereby transforming the how medical providers and laypersons experience such situations. As a first step towards developing this new reality, Next Galaxy Corporation recently announced an agreement with Miami Children’s Hospital to engage Next Galaxy’s VR Model and develop immersive virtual reality medical instructional content to educate medical professionals as well as patients.


Americans’ Attitudes About Privacy, Security and Surveillance
Key legal decisions about the legitimacy of surveillance or tracking programs have hinged on the question of whether Americans think it is reasonable in certain situations to assume that they will be under observation, or if they expect that their activities will not be monitored. A federal appeals court recently ruled that a National Security Agency program that collects Americans’ phone records is illegal. In striking down the program, Judge Gerald Lynch wrote: “Such expansive development of government repositories of formerly private records would be an unprecedented contraction of the privacy expectations of all Americans. Perhaps such a contraction is required by national security needs in the face of the dangers of contemporary domestic and international terrorism. But we would expect such a momentous decision to be preceded by substantial debate, and expressed in unmistakable language.”


Bring your own cloud: Understanding the right policies for employees
By ignoring cloud policies, employees are also contributing to cloud sprawl. More than one quarter of cloud users (27%), said they had downloaded cloud applications they no longer use. Moreoever, with 40% of cloud users admitting to knowingly using cloud applications that haven’t been sanctioned or provided by IT, it’s clear that employee behaviour isn’t going to change. So, company policies must change instead – which often is easier said than done. On the one hand, cloud applications help to increase productivity for many enterprises, and on the other, the behaviour of some staff is unquestionably risky. The challenge is maintaining an IT environment that supports employees' changing working practices, but at the same time is highly secure.


Description, Discovery, and Profiles: A Primer
Most of the approaches today are support the API-First concept. You describe your API using a meta-language based on XML, JSON, or YAML and the resulting document (or set of documents) is used to auto-generate implementation assets such as server-side code, human-readable documentation, test harnesses, SDKs, or even fully-functional API clients. An example of the API-First approach is Apiary's API Blueprint format. It’s based on Markdown and has the goal of supporting human-readable descriptions of APIs that are also machine-readable. In the example below you can see there is a single resource (/message) that supports both GET and PUT. You can also see there is support for human-readable text to describe the way the API operates.


How Big Data Can Drive Competitive Intelligence
The practice of selling data to the marketplace appears to be much more prevalent in Asia than in Europe or the United States, according to Tata. That may reflect regulatory considerations. U.S. data brokers generally ensure that big data sets have been stripped of individually-identifiable consumer information, both to ensure regulatory compliance and to prevent the inevitable public backlash. But it’s telling that China’s southwestern province of Guizhou is establishing an exchange,GBDex, to provide data cleaning, modeling, and data platform development. Alibaba is a partner in the exchange in Guiyang. A small firm with a progressive attitude toward analytics may be able to carve out a competitive advantage against a much bigger rival simply by understanding their niche in the market better.


CIO interview: Myron Hrycyk, CIO, Severn Trent Water
“A lot of organisations that run large asset bases are always looking for ways they can run that infrastructure more productively, ultimately giving customers a better service,” says Hrycyk.  “The two technologies that I see as key to driving the productivity and efficiency that are needed to drive bills down are improved telemetry and technologies related tothe internet of things that can pull data back from the infrastructure so we can proactively manage it.  “That way, we can have a lower-cost infrastructure overall and avoid reactive work and outages by managing our assets to keep the flow of water to our customers going, and doing a lot more predictive and proactive maintenance.”


Why Skills Matter More than Ever in Our Data-Driven Economy
There are no easy solutions. Two well-known factors affecting employment decisions — compensation and culture — require flexible budgets and organizational change, neither of which plays to government’s strengths. But government should not give up. The UK’s Government Digital Service fundamentally rebuilt the nation’s public-sector strategy for IT, proving that disruptive innovation in government is possible. Moreover, government agencies do have an advantage in that many of the problems they’re working on — like increasing access to affordable health care, improving the quality of schools, and making cities safer and cleaner — are the types of problems that attract the sharpest minds. While they may not be able to match the pay or benefits of Silicon Valley, they offer the chance to improve the world.


Harnessing the power of your hidden leaders
To the naked eye, it may seem they are simply able to get things done. Look closer, and you’ll see that they are demonstrating strong leadership and influence by dint of relationships they’ve developed. Look closer still, and you’ll see that it isn’t simply niceness or collegiality that has earned them this influence. Too many people seek to establish trusting business relationships centering on likeability. ... Try identifying your Hidden Leaders. Who are they? What do they do differently? Ask yourself what kind of an impact it would have on your business if more employees behaved as they do — even 20% or 30% more? My bet is that you’ll see great power in cultivating more of them. And if you are reading this article, it is likely that is your job.


Here comes the future of application development: Treating infrastructure as code
Key to this approach is the idea of the immutable container. Containerization is perhaps best thought of as a way of adding more abstraction into our virtual infrastructure, though instead of abstracting virtual infrastructures from the physical, here we're making our applications and services their own abstraction layers. With immutable containers, a Docker or similar container wrapping an application or a service is the end of a build process. Deployment is then simply a matter of unloading the old container, installing the new, and letting your application run. The immutable container is an ideal model for a microservice world. Wrapping up a node.js service with all its supporting code in a container means not only having a ready-to-roll service, we also have an element that can be delivered as part of an automated scale-out service.

---

Quote for the day:

"Whenever you find yourself on the side of the majority, it is time to pause and reflect." -- Mark Twain

---

May 21, 2015

Q and A on The Scrum Culture
Bluntly speaking, command and control is not compatible with Scrum. As soon as you allow Scrum to spread throughout the command and control enterprise, there is a clash of cultures and only one will survive. On the one hand command and control is more effective in a production line environment, and it is usually also the dominant approach in the organization. So it has the home field advantage and is the primary source of "gravity", drawing people back to the old way of doing things. The Scrum Culture on the other hand is more effective in development and research environments and is what more and more people demand from their employers.

Can OpenStack free up enterprise IT to support software-driven business?
Although it is often considered as a way to build a private cloud, OpenStack can also be used to provision datacentre hardware directly. Subbu Allamaraju, chief engineer for cloud at eBay, said he would like to use OpenStack as the API for accessing all datacentre resources at the auction site, but the technology is not yet mature enough. Walmart's Junejan added: "We aim to move more markets onto OpenStack and eventually offer datacentre as a service." OpenStack can also be used to manage physical, bare metal server hardware. James Penick, cloud architect at Yahoo, said the internet portal and search engine had been using bare metal OpenStack alongside virtualisation.


Certification, regulation needed to secure IoT devices
Xie explained in an interview with ZDNet that in traditional networks where components such as switches and routers were wired, there were well-established architecture frameworks that outlined where and how firewalls should be connected to switches, be it redundantly or as a single connection. These guidelines would no longer be effective with SDNs where the these "wires" were now defined by software and where switches could be "relocated" by the stroke of a key, he said. Firewalls, instance, would need to continue to operate the necessary policies to secure a database within a SDN, when that database is virtually relocated to a different city. "So all that becomes more intangible, and the big challenge is for security to be able to adapt to that kind of architecture," he noted.


Net Neutrality Rules Forcing Companies To Play Fair, ... Giant ISPs Absolutely Hate It
While the FCC's rules on interconnection are a bit vague, the agency has made it clear they'll be looking at complaints on a "case by case basis" to ensure deals are "just and reasonable." Since this is new territory, the FCC thought this would be wiser than penning draconian rules that either overreach or contain too many loopholes. This ambiguity obviously has ISPs erring on the side of caution when it comes to bad behavior, which is likely precisely what the FCC intended. ... And by "well functioning private negotiation process," the ISPs clearly mean one in which they were able to hold their massive customer bases hostage in order to strong arm companies like Netflix into paying direct interconnection fees. One in which regulators were seen but not heard, while giant monopolies and duopolies abused the lack of last mile competition.


Leaderless Bitcoin Struggles to Make Its Most Crucial Decision
The technical problem, which most agree is solvable, is that Bitcoin’s network now has a fixed capacity for transactions. Before he or she disappeared, Bitcoin’s mysterious creator, Satoshi Nakamoto, limited the size of a “block,” or group of transactions, to one megabyte. The technology underlying Bitcoin works because a network of thousands of computers contribute the computational power needed to confirm every transaction and record them all in a permanent, publicly accessible ledger called the blockchain (see “What Bitcoin Is and Why It Matters”). Every 10 minutes, an operator of one of those computers wins the chance to add a new block to the chain and receives freshly minted bitcoins as a reward. That process is called mining.


Machine learning as a fluid intelligence harvesting service
Developers are only human. They have limited capabilities, attention spans and so on. But data and the knowledge that can be gained from it are seemingly unlimited. Even the world’s data scientists and domain experts have to prioritize their efforts to extract insights from some relevant portion of the vast ocean of information that surges around them.  With only so many hours in the day, data scientists and analysts need to leverage every big data acceleration, automation and productivity tool in their arsenals to sift, sort, search, infer, predict and otherwise make sense of the data that’s out there. As a result, many of these professionals have embraced machine learning.


Software development skills for data scientists
You should learn a principle called DRY, which stands for Don't Repeat Yourself. The basic idea is that many tasks can be abstracted into a function or piece of code that can be reused regardless of the specific task. This is more efficient from a "lines of code" perspective, but also in terms of your time. It can be taken to an illogical extreme, where code becomes very difficult to follow, but there is a happy medium to strive for. A good rule of thumb: if you find yourself writing the same line of code with only minor changes each time, think about how you can turn that code into a function that takes the changes as parameters. Avoid hard-coding values into your code. It is also good practice to revisit code you've written in the past to see if the code can be made cleaner, more efficient, or more modular and reusable. This is called refactoring.


Marketing vs. IT: Data Governance Bridges the Gap
The key is to first understand how to govern information in the modern data era – not going back to the stone ages where marketers – and for that matter all business users -- had to follow naming conventions, put everything into schemas and build their work into models. Today, IT teams can empower the data-driven marketing organization by providing better tools and automation across the entire analytic process, including a new class of self-service data preparation solutions, which simplify, automate and reduce the manual steps of the analytic process. This new self-service data preparation “workbench” empowers marketing, sales, finance and business operations analysts with a shared environment that captures how they work with data, where they get it from and ultimately what BI tool they use to analyze it.


Full Stack Web Development Using Neo4j
Neo4j is a Graph database which means, simply, that rather than data being stored in tables or collections it is stored as nodes and relationships between nodes. In Neo4j both nodes and relationships can contain properties with values. ... While Neo4j can handle "big data" it isn't Hadoop, HBase or Cassandra and you won't typically be crunching massive (petabyte) analytics directly in your Neo4j database. But when you are interested in serving up information about an entity and its data neighborhood (like you would when generating a web-page or an API result) it is a great choice. From simple CRUD access to a complicated, deeply nested view of a resource.


Executive's guide to the hybrid cloud (free ebook)
Hybrid strategies have begun making inroads in several industries, including the financial sector, healthcare, and retail sales. In a widely cited report, Gartner predicted that nearly 50 percent of enterprises will have hybrid cloud deployments by 2017. Hybrid clouds can help ensure business continuity, allow provisioning to accommodate peak loads, and provide a safe platform for application testing. At the same time, they give companies direct access to their private infrastructure and let them maintain on-premise control over mission-critical data. Is hybrid an ideal strategy for all companies — or a panacea for all cloud concerns? ... This ebook will help you understand what hybrid clouds offer, and where their potential strengths and liabilities exist.

---

Quote for the day:

“It’s what you do in your free time that will set you free—or enslave you.” -- Jarod Kintz

---

May 20, 2015

Gartner Doubles Estimate Of Amazon Cloud Dominance
The revised Magic Quadrant kept Amazon in the desired top right of the leaders quadrant, with Microsoft also in the leader quadrant -- far below but moving a little closer to Amazon on the "completeness of vision" axis. On the second measure, the "ability to execute" axis, the companies remained basically the same as a year ago. Gartner put only those two vendors in the leaders quadrant, and that status is unlikely to change anytime soon. That's because the upper left quadrant next door, meant to illustrate the challengers to the leaders, was completely empty in this year's chart. No one is threatening Amazon as the dominant public cloud infrastructure provider, nor Microsoft as the runner up.


NoSQL for Mere Mortals: Designing for Document Databases
Redundant data is considered a bad, or at least undesirable, thing in the theory of relational database design. Redundant data is the root of anomalies, such as two current addresses when only one is allowed. In theory, a data modeler will want to eliminate redundancy to minimize the chance of introducing anomalies. ...  There are times where performance in relational databases is poor because of the normalized model. ... Document data modelers have a different approach to data modeling than most relational database modelers. Document database modelers and application developers are probably using a document database for its scalability, its flexibility, or both. For those using document databases, avoiding data anomalies is still important, but they are willing to assume more responsibility to prevent them in return for scalability and flexibility.


How do you solve a problem like big data?
Knowing where to begin with all of this information is one thing; having the time to actually get to work on it is completely different. So much of the data mentioned above is useful to marketers, but sifting through to identify and collect the necessary parts is an extremely long-winded task; far from ideal in an industry where spare hours are a rarity. Unfortunately, this tedious aggregation process is a necessity for most marketers, despite the availability of so many useful tools. According to a January 2015 Econsultancy report, just over half (51 per cent) of organisations are using more than 20 digital marketing technologies at present. With such a collection of data sources to tend to, though, it’s no surprise that so much valuable time is being wasted.


Executive interview: Google's big data journey
“Google fundamentally rethought the practice of building bigger machines to solve these problems. We only build using commodity machines and we assume systems will fail. “We have done several iterations of almost every piece of technology we showed in the white papers.” The use of massively scalable low-cost commodity infrastructure is almost diametrically opposite to how the big four IT suppliers go about tackling big data. Yes, they do NoSQL and offer Hadoop in the cloud. But SAP, for example, wants customers to spend millions on S/4 Hana, Oracle pushes Exadata and its engineered appliance family, IBM sells the merits of the z13 mainframe, and Microsoft has SQL Server.


What a new survey on payment solutions reveals about your security leadership
“Companies in the payments industry face a huge challenge in securing emerging technologies like virtual currencies, mobile payments and e-wallets. While the industry has always prioritized the implementation of new technologies for customer convenience, in today’s landscape, it is critical that they equally emphasize the security of new technologies to protect customer data.” -- Michael Bruemmer, vice president of Experian Data Breach Resolution ... The challenge is the balance between customer convenience (especially when it comes to their ability to give your company money) and the appropriate level of protection . This survey underscores that we’re under pressure to adopt new systems without a clear understanding of the risks or methods to reduce those risks.


Back-end complexity slows XenMobile deployments

The problem for some organizations is that they don't have the expertise in house to handle a XenMobile implementation. Deploying XenMobile is much different than Citrix virtual desktops, applications or cloud infrastructure, so the IT department's resident Citrix experts might not be able to easily transition, Gamble said. "Just because you're a good Citrix guy, doesn't equate to being a good XenMobile guy," he said. But it's not always the back-end complexity that makes XenMobile deployment difficult. Handling users is a challenge, too. "Once we did a pilot, the deployment wasn't that bad," said Noel Prevost, a services delivery manager at Ingalls Shipbuilding in Pascagoula, Miss.


SaaS and the Cloud are Still Going Strong
Aside from the prominent cost benefits of cloud computing, innovation and mobility are highlighted as key reasons for uptake. Cloud technology enables faster, cheaper software development, with key cloud usage scenarios including collaboration, file sharing, business productivity, CRM and marketing. Mobile applications including Vend applications, PayPal platforms and secure VPN access are some of the top requirements of businesses in 2015. ... QuoteColo’s infographic sums up many of the key stats and predictions for the future of cloud computing throughout the world, and highlights the importance of strong cloud infrastructure and application development through 2015 and into the future.


Celebrate mistakes: Creating a culture of forgiveness
When you encourage healthy risk-taking, you encourage innovative behavior in your team. Employees who know that they’ll have your help and support when problems arise feel empowered to integrate changes into new projects and daily operations. Those changes could save time, save money or bring in a big win for the organization — just the sort of behavior you want to encourage. But does your team know you’ll make it a learning opportunity and not a mark of shame if something doesn’t work? Of course we’re talking about reasoned risk, with plenty of planning. There are always ways to learn from a thought-out endeavor that failed.


Toward Omniscient Cybersecurity Systems
CISOs recognize this disjointed situation and many are undertaking cybersecurity integration projects to address this problem. This is certainly a step in the right direction, but I find that a lot of these projects are one-off point-to-point integration efforts. Good idea, but CISOs should be pushing toward an ambitious endgame – omniscient cybersecurity systems. ... In summary, CISOs need a single system or an integrated architecture that can tell them everything about everything – in real-time. This system must be smart enough to recognize patterns and offer user-friendly visual analytics interfaces enabling analysts to easily pivot from one data point to all others. Armed with this type of system, cybersecurity professionals could move on to the next task – automated remediation and security operations.


Finance and retail sectors struggle to detect cyber intrusions, study finds
Key findings in the financial services sector included that 71% of organisations polled view technologies that provide intelligence about networks and traffic as most promising at stopping or minimising advanced threats during all phases of an attack. But the study showed that only 45% have implemented incident response procedures, and only 43% have established threat-sharing agreements with other companies or government groups. More than half of financial services firms consider distributed denial-of-service (DDoS) attacks as an advanced threat, but only 48% say they are effective in containing DDoS attacks, and only 45% have established threat-sharing agreements to minimise or contain the impact of DDoS attacks.

---

Quote for the day:

"The measure of success isn't if you have a tough problem, but whether it's the same one you had last year." -- J.F. Dulles

---

May 19, 2015

IS Audit Basics: The Soft Skills Challenge
A really good listener must also learn how to take into account nonverbal communications, also known as body language. This includes body movements, gestures, eye contact, facial expression, physiological changes and more. Warning: Body language is, like national languages, not universal and is strongly embedded in the culture. For example, some cultures allow body language to be explicit and show emotions openly through gestures, physical proximity and strong—even challenging—eye contact; whereas, other cultures are more focused on controlling emotions and body language and reveal little, unless you are truly familiar with the particular culture. Control and understanding of body language can be learned and mastered, as evidenced by the best poker players and diplomats.


Industry's First Schema-free SQL Engine - Apache Drill 1.0 is Now Generally Available
Drill expands the spectrum of BI use cases by providing the ability to get value from all of the raw datasets available in organizations, wherever it is. The ability to explore and ask ad hoc questions on full fidelity data—in its native format as it comes in—is what sets Drill apart from traditional SQL technologies, which only solve part of the puzzle by working with only centrally-structured data. The BI/Analytics use cases that Drill enables include self-service raw data exploration and complex IoT/JSON data analytics, as well as ad hoc queries on Hadoop-powered enterprise data hubs. ... With the solid foundation paved with the GA release, the Drill community is planning to add new, exciting features in a variety of areas such as JSON, complex data functions, new file formats and SQL.


Ownership: to risk or not to risk
Risk-taking is one of those things that sounds easier than it is to practice. The plethora of success stories that have embedded itself into the mythos of big-name companies have certainly contributed to this concept: the genius who pursues an idea that has never been undertaken before and is able to reap the considerable benefits after, the startup company that began in a friend’s basement and within three years, has taken over most of the market share in its industry, or the project that took 100 failures to find success, making the entire process worth it. And while businesses will always strive for success, dreaming of becoming the next Apple, the prospect of failing at a new venture can often give pause, if not discourage risk-taking entirely. That’s why it’s up to the champion to take ownership by calculating the associated risks with the projected benefits, and decisively directing his or her team to move forward with a course of action.


DDoS reflection attacks are back – and this time, it's personal
“There's a fertile ground of home systems,” he said. “A property configured home firewall can block this, but there are many improperly configured home systems connected to the Internet – and there are also industrial systems that can be used to reflect attacks as well.” This attack source is also harder to shut down, he said. “It's easier to go into the data center and have the service providers do the clean-up,” he said. Last quarter, SYN flood attacks – where “synchronize” messages are sent to servers – was the leading attack vector, accounting for 17 percent of all attacks, down slightly from 18 percent of all attacks at the start of 2014. There has also been a change in the size of the median attack, and the typical size range of attacks, Kobrin said, as defensive measures have improved.


10 tips to get the most out of your project management system
“Many companies stumble with adopting project management solutions because the software is intrinsically hard to use,” says Scott Bales, director of Solutions Engineering at Replicon, a provider of timesheet management software. “Businesses should find a solution where workflow and configurability feel intuitive, and it has built-in intelligence that anticipates what you need to get your work done,” he says. “The best software gives you a comprehensive set of functions that can be easily added to over time.” If you have a small or no budget, “define your goals and objectives and see if there are any free PM solutions which satisfy them,” says Victoria Kartunova, marketing manager, Bitrix24, a social collaboration and communications platform.


Making the first 100 days count: How a new CIO sets the right priorities
The second area of immediate attention for Bramwell and his team is to think about how the IT team can be agile and support new initiatives at Said. For example, that support might cover how the organisation interacts with its students or how it delivers content, including across distance learning platforms and collaborative systems. Finally, Bramwell's third initial focus is to consider the type of IT organisation that will help deliver business change for the School. He says the technical skills of the team he is inheriting at Said are not as mature as the one he left behind at Wellcome Trust, so talent and succession management will be crucial. "It's an educational journey for everyone, not just for those working in the IT team," he says. "We must make sure our technical capabilities are aligned with the aspirations of the business. We need a clear, well-communicated change


How to Pivot Your Data
Capturing and storing this increasing volume of data is extraordinarily taxing on IT departments. Whether businesses know it or not, the cost of storing and keeping data is one of the heaviest burdens on a company’s infrastructure resources. These costs extend beyond the monetary price of a data storage system. Physically, the data explosion sucks power in data centers more than ever before. Data growth also slows system processes and forms outage windows, creating situations ranging from inconvenienced users to total system shutdowns. As expensive as it is, however, companies cannot afford not to capture these huge volumes of data, for while Big Data promises huge business advantage to those who harness it, the dark side is that those who do not will face an increasing competitive disadvantage.


Bitcoin Startup 21 Unveils Product Plan: Embeddable Chips for Smartphones
21’s concept of “embedded mining” marks a very different approach. It foresees mainstream consumer devices quietly mining in the background to receive very small, ongoing distributions from a managed pool of bitcoin earnings. Embedded mining was long assumed to be part of the company’s mission. However, the business philosophy outlined in Mr. Srinivasan’s blog post paints a different vision than many bitcoin enthusiasts had assumed to be the case ever since a regulatory filing revealed an initial $5 million fundraise in November 2013. Rather than seeking to dominate the highly competitive business of bitcoin mining for profit, 21 is focused on a future “Internet of Things” era in which interconnected appliances will, in Mr. Srinivasan’s words, draw from an “infinite stream of digital currency” to engage in micro-transactions.


Global risk management survey, ninth edition
Risk management must respond to “the new normal”—an environment of continual regulatory change and ever more demanding expectations. In the United States, the Federal Reserve has introduced the Enhanced Prudential Standards and the Comprehensive Capital Adequacy Review. ... Two emerging risks in particular are receiving increased attention from financial institutions and their regulators. Cyber attacks on corporations, including financial institutions, have increased dramatically in the last few years, requiring institutions to strengthen the safeguards for information systems and customer data. Regulators are more closely scrutinizing how institutions manage conduct risk and the steps they are taking to create a risk culture and incentive compensation programs that encourage ethical behavior.


Microsoft offers IT guidance to prepare for Windows as a Service
Currently, Microsoft's wording in its guidance around some hotfixes is to only apply them if trying to fix a very specific set of problems. But when there's data corruption, a bug check or a system hang, it's actually more detrimental than not to wait, Paquay argued. He said if more users would apply optional hotfixes and update rollups proactively, Microsoft would be able to gather more telemetry data and fix path and hotfix problems more rapidly, allowing the company to promote tested fixes as "recommended" or "important" updates/rollups for a broader group of customers. Once an update appears in Windows Update as "recommended," it has already been installed on and deployed to millions of Windows devices already, meaning it has been vetted to a fairly substantial degree (and not just inside Microsoft or by Windows testers only), he said.

---

Quote for the day:

"If two men on the same job agree all the time, then one is useless. If they disagree all the time, then both are useless." -- Daryyl F. Zanuck

---

May 18, 2015

Software Licensing got you down? Get your SaaS in gear and go cloud
Why is software so complex to license correctly and why are there are so many SKUs and editions? Let's count the reasons -- localization issues and judicial decrees, different sets of customers having different sets of needs and being in different sectors (public vs. private) -- but the real problem stems down to compliance. I can't go into exact detail how much revenue is lost by large software vendors by incorrectly reported software usage -- whether intentional or unintentional -- but what I can say is that the reason why the legal teams for these enterprise software companies are so large is that quarterly/yearly compliance audits and settlements with large companies can often shift revenue reporting in a business segment from "meh" to "good" or "good" to "excellent" .


Barclays adds extra security through domain name switch
Barclays Group CISO Troels Oerting said the changed domain names simplify the user experience and make it clear to customers they are engaging with a genuine Barclays site. “This clarity, along with the advantages of controlling our own online environment, enables us to provide an even more secure service, which we know is of utmost importance to our customers, and ultimately serves to increase trust and confidence in Barclays’ online entities,” he said. With online banking becoming the channel of choice for more consumers, cyber fraud is on the rise and banks are under pressure to increase security. One IT security professional in the banking sector said initiatives like this will help, but he warned that educating customers to check the actual domain name they are visiting is essential.


How machine learning works
Computers are hyper-literal, ornery beasts: anyone who has tried programming one will tell you that the difficulty comes from dealing with the fact that a computer will do exactly and precisely what you tell it to, stupid mistakes and all. ... But the ever-increasing power of computers has allowed deep learning machines to simulate billions of neurons. At the same time, the huge quantity of information available on the internet has provided the algorithms with an unprecedented quantity of data to chew on. The results can be impressive. Facebook's Deep Face algorithm, for instance, is about as good as a human being when it comes to recognising specific faces, even if they are poorly lit, or seen from a strange angle. E-mail spam is much less of a problem than it used to be, because the vast quantities of it circulating online have allowed computers to realise what a spam e-mail looks like, and divert it before it ever reaches your inbox.


Design Thinking: a tested method for creating breakthrough innovation
Real innovations that make major traction in the market solve problems people didn’t know they had. Real innovations get out of the office and embody the matter. They walk in the shoes of the intended audience, even visit them at home or their office. They begin with empathy, then follow an iterative process, and then reap substantial rewards. This formal innovation process was named just a few years ago. While it remains contested, Design Thinking is a set of principles—from mindset and roles to process—that work for consumer products, software, services, even in the social sector. Design Thinking is a method for solving complex problems. Think of Design Thinking as installing a new operating system for life: it’s that revolutionary. Looking at the world with an inspired eye for redesigning every aspect that could be improved is the mindset. There are few experiences that could not be improved.


Advice for mobile users who choose simplicity over security
Each of the password managers above is simple to install from the Google Play Store. Once you've installed and set them up, you'll only need one password to rule them all. Some of these tools even offer random password generators. You want seriously strong passwords, so use that feature like your data depends on it. Yes, random passwords are nearly impossible to remember, but when you have a password manager at your disposal, it won't matter. And before I forget, the master password that allows you access to your password manager? If you set it as 123 or password or jackiscool... your data may as well just walk out on its own volition. What if you're not willing to use challenging passwords or a password manager? What then? For those, I have a few suggestions:


Cloud Security – Tips for a Better Cloud Architecture
There are powerful new tools around IPS/IDS and data loss prevention (DLP). Are you deploying them? Do you have policies in place for monitoring anomalous traffic hitting an application? Do you know if a user is accidentally (or maliciously) copying data from a share or network drive? How good are your internal data analytics? These are critical questions to ask to ensure that your environment is locked down and that data isn’t leaking. Big cloud providers go out of their way to ensure that multi-tenant architectures stay exactly that – multi-tenant. Your data must be isolated when needed and have very restricted access. Furthermore, that information must regularly be tested and truly segmented using next-generation networking and security policies. If not, the results can be similar to what Sony, Target, or even Anthem experienced.


Healthcare Leaders Express Tech Legislation Concerns
One of those areas is telehealth. Section 3021 of the bill, “Telehealth services under the Medicare program,” calls on the Centers for Medicare and Medicaid Services to provide Congress with a report on the populations of Medicare beneficiaries whose care may be improved most by the expansion of telehealth services, the types of high volume procedures codes or diagnoses which might be suitable for telehealth, as well as the barriers that might prevent expansion of such services. However, the American Telemedicine Association (ATA) expressed its disappointment at the lack of substantive telehealth provisions in the current version of the 21st Century Cures bill. “It appears that the staff and members of the committee have once again been led by CMS and the Congressional Budget Office into asking for a study instead of taking real action,” said Jonathan Linkous


9 programming languages and the women who created them
Software development has a well-known reputation for being a male-dominated world. But, despite this, women have made many important and lasting contributions to programming throughout the decades. One area, in particular, where many women have left a mark is in the development of programming languages. Numerous pioneering women have designed and developed the languages programmers use to give computers instructions, starting in the days of mainframes and machine code, through assemblers and into higher level modern day languages. Use the arrows above to read the stories behind 9 programming languages that have had a significant impact over the years and the women who created them.


Cloud and mobility call for new network defense tactics
Enter network security. While networking gear itself is typically not the ultimate target of an attack, malicious code and other threats often travel through infrastructure devices to reach their mark. To that end, the network plays a crucial role as a multi-layer defense against threats: both as a source of data on malware and other threats, and as a mechanism to block attacks and prevent leaks. Within this landscape, what are some of the greatest threats to network security today and what can enterprises do to stave off attacks? ... Cybercriminals have also eagerly exploited other access points into the network -- paying particular attention to remote and mobile devices. As businesses continue to make it easier for employees to use their own mobile devices, IT must be able to protect the network against techniques hackers may use to infiltrate the network perimeter via an unmanaged device.


Q&A with Alex Blewitt on Swift Essentials
The advantage of Swift is that the binary is statically linked with its Swift dependencies, so once you've compiled and built the app, it will continue to run even if Swift itself evolves. It may mean that the source has to be updated if compiling with a newer version of the compiler, but the version that's installed on end users' phones shouldn't require any changes if Apple updates the OS. This can be used to migrate parts of an application to Swift whilst leaving the rest in Objective-C, but it's not going to be long before Objective-C and Swift trade places on the TIOBE charts. I think Swift will continue to be released with minor changes for a couple of years - I doubt we'll see Swift 2.0 at WWDC this year, for example. But when Apple announces the binary backwards compatibility which will allow Swift frameworks to be created, that's when it can be considered mature.

---

Quote for the day:

"Don't limit yourself. Many people limit themselves to what they think they can do." -- Mary Kay Ash

---

May 17, 2015

Never Waste A Good Crisis
When something goes wrong, someone takes the fall. But for an influencer like an Enterprise Architect, a crisis can be a good thing. Why? Because we are change agents. And people won’t change unless they are forced to change. John Kotter, in his book “Leading Change” suggests that one of the greatest obstacles to change is complacency. Change just isn’t urgent enough. He’s completely right, and a crisis is often what is needed to break through complacency. To take advantage of a crisis, you have to be ready. Have your arrows sharpened and sitting in your quiver, ready to go. During a crisis, you may get exactly one shot to propose an idea, and it may not be the moment you expect. There won’t be a “right” time. Just the opportune time. So be prepared.


Using JavaScript to Create Geospatial and Advanced Maps
Until recently, developing geospatial apps beyond a 2D map required a comprehensive GIS service such as ArcGIS, Nokia Here, or Google Maps. While these APIs are powerful, they are also expensive, onerous to learn, and lock the map developer to a single solution. Fortunately, there are now a wealth of useful, open source JavaScript tools for handling advanced cartography and geospatial analysis. In this article, I’ll examine how to implement GIS techniques with JavaScript and HTML, focusing on lightweight tools for specific tasks. Many of the tools I’ll cover are based on services such as Mapbox, CloudMade, and MapZen, but these are all modular libraries that can be added as packages to Node.js or used for analysis in a web browser.


BioBeats founder warns of the dark side of wearables and biometrics
Plans worries some organisations are more interested in using wearables and the data they collect for "sinister purposes". In a twist he describes as "Orwellian", he claims that "some of the insurance providers we work with want to calculate insurance premiums in real-time," which he sees as problematic. Howver, Plans notes that "while some of the aspects of biometric data gathering from wearables may at first seem surveillance-like and therefore Orwellian in nature, they offer very clear and potentially life-saving advantages to human life and the provision of care. This means that whilst we have a lot of work to do to ensure privacy, security and choice for people and their data, we also have a tremendous amount of potential health benefit to deliver."


Hadoop demand falls as other big data tech rises
Hadoop vendors will almost surely languish -- unless they're willing to embrace adjacent big data technologies that complement Hadoop. As it happens, both leaders already have. For example, even as Apache Spark has eaten into MapReduce interest, both companies have climbed aboard the Spark train. But more is needed. Because big data is much more than Hadoop and its ecosystem. ... As Aerospike executive and former Wall Street analyst Peter Goldmacher told me, a major problem for Hortonworks and Cloudera is that both are spending too much money to court customers. While these companies currently have a lead in terms of distribution Goldmacher warns that Oracle or another incumbent could acquire one of them and thereby largely lobotomize the other because of its superior claim on CIO wallets and broad-based suite offerings.


IT Pro Panel: How the IoT will change your business
The IoT describes a phenomenon in which everyday devices can send and receive data over the internet, and potentially between one another, too. Everything from your kettle to aircraft parts could – and probably will – become connected, with the burgeoning industry set to grow as broadband quality and coverage improves. In fact, analyst firm Gartner predicts there will be 25 billion connected devices by 2020 – more than three for every person on the planet. In 2015 alone, it puts the number of connected machines at 4.9 billion come the end of the year. So what does this mean for your business?


Sourcing Security Superheroes: Part 1: Battling Retention and Recruitment
The mindset of cybersecurity practitioners is very different from most others in the corporate world. Think about what makes security professionals successful. They are smart, creative and don’t like to follow rules for the sake of compliance. It’s their ability to ignore constraints and to be disruptive that allows them to solve problems in new ways. Structured thinkers are important in all organizations. But the bottom line is that enterprises need creative hunters, not just responders, on the frontlines. If we apply that way of thinking and interacting to the traditional workforce, we can see where conflicts start to arise. Organizations like to hire from the highest pedigree of universities and pick the best and brightest graduates.


How to Be an Indispensable Force in the Workplace
In order to be the best, take advantage of any professional development opportunities available to you, and continuously build your knowledge using resources like trade journals and industry events. Actively seizing every possible opportunity to improve yourself as a professional makes you a better employee and gives you more opportunities to connect with hiring managers looking for top talent. ... Use your skills and the knowledge you've procured becoming the best at what you do, and diversifying your skills, to anticipate any issues that may arise. Whether it's a work or local trade organization meeting or just an issue brought up at a networking event, be prepared to provide intelligent, insightful solutions.


From Information to Action: The Importance of the Data Story
An important part of this process is humanizing the data. Like any story, your data story should describe how events affect people. For example, it’s one thing to say that recalibrating a QA process will lead to reduced failure rates. It’s another to say that doing this will mean fewer angry customers returning products and demanding refunds. Of course, with all this talk of dragons and damsels (sorry, but the old stories were rather sexist!), it’s useful to remember another use of the word story – that is, the news story. The way that stories are presented in the news differs from some other forms of storytelling. Rather than structure the story as an entertaining journey and keeping the audience guessing what the outcome will be, a news report aims to grab your attention right away and give you the facts as concisely as possible.


Enterprise Architecture's Missing Models
An essential part of the enterprise architecture description is the set of organisational models – organisations, divisions, departments etc. and their relationships – for the organisations participating in the enterprise. By any rational methodology, this set must include the significant temporary organisations – the programmes and projects – not just the “BAU“- Business-As-Usual – operational organisations. Yet, how many Enterprise Architecture descriptions actually model the temporary organisations – the programme and projects – that will deliver the changes? This omission is even more glaring when you consider that Programme Management will, if it uses a proper systematic methodology, produce most of the models anyway! Every programme will have an explicit model of the target or transitional state of the enterprise at the end of the programme.


RaptorDB - the Document Store
The main driving force behind the development of RaptorDB is making the developer's and support jobs easier, developing software products is hard enough without complete requirements which becomes even harder when requirements and minds change as they only do in the real world. ... To aid the searching in such databases most Document store databases have a map function which extracts the data needed and saves that as a "view" for later browsing and searching. These databases do away with the notion of transactions and locking mechanism in the traditional sense and offer high data through-put and "eventually consistent" data views. This means that the save pipeline is not blocked for insert operations and reading data will eventually reflect the inserts done

---

Quote for the day:

"Nothing is so potent as the silent influence of a good example" -- James Kent

---