Daily Tech Digest by Kannan Subbiah

September 08, 2016

John McAfee’s company could spoil the party for Intel’s new venture

John McAfee states in the filing that he entered in 1991 into an agreement with McAfee Associates to transfer certain assets to it in exchange of stock and a promissory note, but at no point did he “assign the rights to his personal name, via assignment of trademark or otherwise, or agree to restrict his right to do business using his own name.” At the time of the agreement, John McAfee had not filed for or registered the trademark to “John McAfee” or “McAfee” or any other variation of the name, according to the filing. ... But none refer to John McAfee, who claims that Intel "never consulted, requested or otherwise obtained the permission of McAfee to use his last name as part of Defendants’ Marks on its products," according to the filing.

The Next Successful Hack May Be Your Fault

By a careful design and timing of the message, it should be possible to make virtually any person to click on a link, as any person will be curious about something, or interested in some topic, or find themselves in a life situation that fits the message content and context. Expecting from the users error-free decision making under these circumstances seems to be highly unrealistic, even if they are provided with effective awareness training. It's easy to become pessimistic about cybersecurity in the face of such behavior by advanced internet users who are well aware of the threat. Ordinary users, just because they are curious or easily distracted, appear to be the most vulnerable element in any computer system, and they are the one that cannot be fixed. As Benenson wrote, "human traits such as curiosity will remain exploitable forever, as humans cannot be patched against these exploits.

As strong as your weakest link: A look at application vulnerability

When it comes to patching and updating software vulnerabilities, operating systems and web browsers seem to get all the love. But in reality, vulnerabilities in those two types of software usually account for a minority of the publicly disclosed vulnerabilities published in the National Vulnerability Database (NVD), the U.S. government’s repository of standards-based vulnerability management data. Where are the rest of the vulnerabilities? The majority are in applications (i.e. software that doesn’t ship as part of operating systems or browsers), and unless you’re spending time protecting those too, your application layer could be a big chink in your IT armor. CIOs, CISOs and their security teams need to focus on assessing and patching known vulnerabilities in all business apps, or they could in fact be missing the bulk of the vulnerabilities that exist in their environments.

IoT for Logistics in India – One of the Largest Upcoming Domains

At the first level, the biggest contribution that IoT has is to monitor assets and focus on avoiding predictable delays. For instance a connected truck will throw up the information on the diminishing engine oil or an over exerted clutch in advance – averting either an accident or an unprecedented delay – thus enabling greater transit predictability. This connected asset will also enable organisations to achieve greater asset utilization. Fleet management can also extend to public services management tracking peak and lean times, to and fro destinations, optimizing the number of vehicles available basis the traffic flow, optimizing the available routes to minimize on road time, minimize fuel consumption, thus impacting better bottom lines.

Encrypting the Internet of Things

"We're talking about some very constrained devices, 8-bit processors [with] little memory, low speed, low power," says cryptographer and IT security author Bruce Schneier. He sees the lightweight cryptography project as important because "a lot of the algorithms we have just aren't suitable for these constrained environments. ... We want good algorithms for constrained devices." NIST plans to create a portfolio of lightweight primitives through an open process, in which submitters describe physical, performance and security characteristics of these algorithms. NIST used a similar process to develop its portfolio of block cipher modes of operations. A block cipher mode is an algorithm that provides an information service, such as confidentiality or authentication.

Half of network management systems vulnerable to injection attacks

Getting access to a network management system gives an attacker a current map of the company's environment, without risking detection by running their own scans. To take advantage of one of these vulnerabilities, an attacker could physically enter an organization's facility and connect a small device, such as a Raspberri Pi, to the network. Or an attacker who already has access to a networked device through some other kind of attack could use this vulnerability to escalate their privileges, Heiland said. The products were Spiceworks Desktop, Ipswitch WhatsUp Gold, Castle Rock SNMPc, ManageEngine OpUtils, CloudView NMS, Opmantek NMIS, Opsview Monitor, Netikus EventSentry, and Opmantek NMIS. All nine vendors have been notified and have released patches to their products, said Heiland.

New tech can help catch spearphishing attacks

"We look at the IP address of the sending domain, the age of the domain, the DNS servers that are being used, all those elements," he said. The average cost of a spear phishing attack is $1.6 million, according to a survey released earlier this year by security firm Cloudmark and research firm Vanson Bourne, and 73 percent of respondents said that spearphishing was a significant threat. Over the past 12 months, 27 percent of organizations received a targeted spearphishing attack, according to a report released today by Osterman Research. And 11 percent of organizations were successfully tricked. "That's a little sobering," said Tim Helming, director of product management at DomainTools, the company that sponsored the research.

Smart Wearables Hold Productivity Potential In Enterprises

Specifically, enterprises such as manufacturing and science labs are starting to use smart eyewear in limited settings, said Jitesh Ubrani, a senior research analyst for IDC, and the coauthor of the Sept. 6 report. Ubrani told InformationWeek that IT is still trying to find where these types of devices fit within the larger enterprise. "Right now we're in the very early stages of how this benefits [enterprises]," Ubrani said in a phone interview. "We're talking about very small pilot programs and not mass deployments, at least not yet. If businesses are not in pilots this year, they may be considering them for next year." In addition to the few pilot programs, the number of offerings for enterprise-ready equipment is slim.

Quote for the day:

"Leaders should use sweet and soft words in case they need to eat those words sometime in the future." -- @GPackwood

September 07, 2016

CIO travels new path to IT governance at native cloud company

"It’s like the European Union – we have too many conversations that go on at the company within the confines of collaboration tools,” says Settle. “We need to swallow hard, pick some winners and losers and some people are going to have to change their day-to-day activities to get some benefit out of it.” Settle must win over departments accustomed to procuring their own solutions with the promise of services they cannot render themselves, including data management, enterprise application integration and information security. In effect, he must centralize a decentralized and fragmented IT landscape. This entails instituting change control procedures, in which his department will make changes to Workday, NetSuite, Zuora and Concur, according to evolving business requirements.

Is FinTech really a game changer?

Today, FinTech is the term that sounds the death of the banking as we know it. It is shorthand for a seismic disruption of payments and lending so transformative that in less than a decade the banking system as we know it will be replaced by new services and new service providers in equal measure. Or perhaps not. To truly understand the likely impact of FinTech, you need to look rather more closely at the market participants, and what they are up to. First and foremost, that means recognising that FinTech encompasses a broad range of technologies across payments, digital currencies, personal finance and lending. From that starting point, you can begin to analyse what it takes to succeed.

Fintech Startups Face Dilemma on Banks: Are They Friend or Foe?

Fintech firms that don’t partner with banks are often at risk when big banks come into their niche, or when market forces turn against them and they don’t have deposits to fall back on. Many online lenders have learned that the hard way this year. On the other hand, startup firms that do partner with banks can be subject to all kinds of scrutiny and criticism. They are seen as capitulating to incumbents, and increasingly come under the watchful eye of regulators. “Rent-a-charter” models, in which banks backstop or formally provide services behind fintech websites, have been recently scrutinized by the Federal Deposit Insurance Corp. in the case of lending, and by states such as California and Texas in the case of money transfers.

The AI revolution is coming fast. But without a revolution in trust, it will fail

AI is going to unleash a whole new level of productivity and augment our lives in many ways. As in past industrial revolutions, AI will also be a disruptive force, dislocating people from jobs and surfacing profound existential questions about the relationship between man and machine. It’s inevitable that jobs will be impacted as AI automates a variety of tasks, but just as the internet did 20 years ago, the AI revolution will transform many jobs as well as spawn new kinds of jobs that drive economic growth. As a society, we need to adapt to the changing nature of work by focusing on training people for the jobs of tomorrow and addressing growing economic inequality.

Two Mistakes You Need to Avoid When Integrating Services

Since, an organization cannot influence the external service vendors to adhere to specific business semantics, reliability should not be tightly coupled to the business application level. Therefore, it would be essential to use a more generic (independent of its business semantics) mechanism to achieve reliability of system. Message-Broker is an intermediary pattern which decouples message senders and receivers. Most of the ESB vendors support integrating with Message Brokers (MB) via protocols such as JMS. The next sections would focus on elaborating how ESB and MB patterns together could be used to achieve a more reliable communication link between the services which are chained through the ESB (achieve zero message lost).

What Tech-Enabled Startups Should Do to Grow in a Turbulent Economy

“Start-ups of today are teenagers of corporate world, and they are disrupting the whole industry, challenging the conventional thoughts, and bringing in innovation,” said Sandeep Majumdar, Chief of Operations-North, Sify Technologies. The current generation is always on the move and connectivity for them is as essential to them as roti, kapda aur makaan. Most start-ups want to be very transparent with their customers. Many companies want to share notifications with their customers and be visible in their supply chains. So if you don’t provide transparency, the brand suffers. Today’s millennial generation is very different from pervious generations. People who belong to the selfie generation are obsessed unabashedly about themselves. It’s a good business strategy for brands if they sell products more through customer engagement and personalization.

4 Ways SaaS Is Transforming IT Departments

CIOs are quickly learning that the skills, infrastructure, and processes that have governed their fields for the past two decades are becoming obsolete, and a shift to SaaS necessitates a radical reevaluation of how they approach their jobs. “This is much bigger than just a technology change,” said Matt Griffiths. “There’s an entire organizational and cultural shift required to support that change.” Griffiths spent 16 years at Dell serving in various roles that included running the automation tech behind the company’s supply chain and leading the internal IT infrastructure within the organization. More recently, he served as CIO of Biogen, a biotech company that specializes in treating autoimmune diseases. It was there that he witnessed the full potential of cloud technology and began to think through the various pain points of adopting a SaaS-based infrastructure.

In Information Security, the Only Constant is Change

In the security world, new techniques for intruding into organizations appear fairly frequently. Some of them grab big headlines, which of course can increase attention and pressure on security types from non-security types in leadership or executive positions within our respective organizations. But how firm of a grasp do we have on the primary ways in which we are being attacked and owned, as well as broader patterns and trends across the industry? It is far too easy to divert important resources away from their strategically prioritized day-to-day work and onto the hack du jour. But if today’s distraction poses a minor risk to our organization, does it make sense to divert resources from mitigating risks or plugging holes that we know pose serious risk to the organization?

Mobile app reversing and tampering

When you think about hacking a mobile device you might intuitively think about an attacker trying to get a better understanding of the device so they can reverse it and build their own, similar, possibly malicious, masquerading version. Maybe they want to modify the logic so that they can bypass certain controls like authentication. Or perhaps they are just looking to steal sensitive data. In all these cases you would be correct. But there is a forth and perhaps lesser thought of motivation. As apps become more advanced they often have richer logic flows. That logic likely interacts with an organization’s backend IT infrastructure. Hacking an app can put sensitive processes, systems, networks and data in the hands of an attacker that can be used to attack traditional IT assets

The future of innovation management software

While ideas themselves are often generated rapidly, it takes considerable time to rationalize the ideas and develop the most promising into a vision board, business model canvas or similar form of initial business case that the organization can then review in more depth and decide how to proceed. Today's innovation management software does a good job of supporting idea management, but needs to expand to help companies focus their innovation teams more on deciding "where to play" and "how to scale" their big bets. If we can automate the idea-management function as much as possible -- for example, with intelligent automation to streamline processes and with analytics to aid decision making -- we can help free up resources to spend more time on the critical front-end and back-end components of the innovation life cycle.

Quote for the day:

"He uses statistics as a drunken man uses lamp posts... for support rather than for illumination." -- Andrew Lang

September 06, 2016

The Importance of Continuing Education for Digital Leaders

Chief information officers (CIOs), of course, should regularly brief the management team and the board on new developments, demoing exciting new technology, bringing in external speakers and vendors, and using other tactics that promote tech learning and engagement. But keeping up on technology trends is also the responsibility of every executive. And while that can be daunting given the vast tech landscape and seemingly limitless avenues for learning, it’s also incredibly exciting. So, if your job title doesn’t include the words information, technology, or digital, how do you stay current? And how do you ensure your organization isn’t falling behind? Consulting digitally literate kids, grandkids, or Millennial staff for help, as many chief executives tell us they do, won’t cut it.

BGP routing joining OpenFlow in software-defined networks

The use of BGP routing makes it possible for the network to continue to operate if the controller fails, or if the link from the controller to the routers goes down. Routers would no longer be able to exchange updates with the controller on network operations, status and policy, but packets would continue to flow based on previously set policies. BGP is a path vector protocol that maintains path information that gets updated dynamically and in which routing decisions are based strictly on distance and policy. Unlike link-state protocols, like OSPF, they do not create a complete network map or maintain QoS information. The size of the internet makes it virtually impossible to create and maintain a map describing each of the thousands of autonomous systems and the links between them.

How security teams can embrace the millennial shift in the workplace

The good news is that increased flexibility doesn’t need to mean that businesses are at a greater security risk. In fact, 80% of millennials feel it is important to secure sensitive information, such as data containing personal, financial, and medical information. Companies just need to embrace millennials’ acceptance of security with the understanding that security measures can’t get in the way of the on-demand mindset or inhibit work flexibility. So what can companies do? They can ensure a safer environment by prioritizing technologies that have minimal to no impact on the employee work experience. This means embracing new innovations based on artificial intelligence and predictive analytics that minimize user involvement and don’t rely on workers to keep software updated.

Adaptable or Predictable? Strive for Both – Be Predictably Adaptable!

There are three types of systems – ordered, chaotic and complex. In ordered systems a desired output can be predicted and achieved via planning based on historical data and analysis. A Chaotic system is one with complete randomness or lack of connections between the components of the system.

Our definitions of adaptability and predictability will come from the perspective of Complex Adaptive Systems (CAS). CAS are systems that have a large numbers of components, often called agents, that interact and adapt or learn3. Complex systems are non-linear and not causal. We can only understand the system by engaging with it. The components and the system itself coevolve so that we cannot predict the future.

The H Factor – Why you should be building “human firewalls”

The “H factor” can be attributed to two aspects: The attackers and the conduit for attack. On one hand, businesses in all industries, especially lucrative ones, are faced with attackers who keep growing in their sophistication, capabilities and brazenness. They keep coming up with creative ways of attacking organisations by discovering new vulnerabilities in systems and software and by tricking innocent people into falling into their traps. On the other hand, humans are considered the weakest link and can expose organisations to cyber threats through three main types of risks: human errors, ignorance and intentional harm.

Leveraging GPU-Enabled Graph Analytics to Accelerate Cyber Security Investigation

The ability to effectively enable the security information and event (SIEM) analysts becomes significantly more difficult. Threat detection can take a significant amount of time, and often cannot be done until long after the breach has taken place. Developing more effective ways for analyzing and visualizing cyber threats is critical, and that is where graph analytics comes in. Cyber security is effectively a graph problem: network traffic transactions link the external systems attempting to breach the environment with the internal systems that require protection. Each access attempt establishes a directed link between the source of the attempt and the target, and the details of the attempted access become the properties of the directed edge.

Putin Says DNC Hack Was a Public Service, Russia Didn’t Do It

Clinton’s campaign struck back at Putin on Friday for characterizing the cyber intrusions at Democratic Party groups as a public service and accused him of endorsing the disruption of the U.S. vote. “Unsurprisingly, Putin has joined Trump in cheering foreign interference in the U.S. election that is clearly designed to inflict political damage on Hillary Clinton and Democrats,” Clinton spokesman Jesse Lehrich said in an email. “This is a national security issue and every American deserves answers about potential collusion between Trump campaign associates and the Kremlin.” In a two-hour conversation near Russia’s eastern fringe, Putin touched on subjects ranging from the war in Syria to oil prices and trade with China. It came just two days before Putin, Barack Obama and other world leaders gather at a Group of 20 meeting in Hangzhou.

Security Think Tank: Malware infection is inevitable, so be prepared

It seems some companies have already hit the self-destruct button by permitting users to access company resources using their own devices, with limited protection in place. While all your machines in the office might have the latest and greatest malware protection available, Mrs Trellis from her holiday home in north Wales is unlikely to even know what this is. Users should not be able to double click and open an untrusted file. They should be prompted with a warning message before being allowed to open untrusted files. This is a basic Cyber Essentials control that most small companies fail when I go in and assess them, yet remarkably simple and effective once in place. Do it. No excuses.

Python vs. C/C++ in Embedded Systems

Python isn't only the most-popular language for introductory CS programs, it's also the fastest-growing language for embedded computing. Maybe that sounds silly when you scan the numbers again and realize it's the fastest-growing language of the remaining 5% of embedded systems code that aren't C/C+ +, but Python will start eating into C/C++'s monopoly even more over the next few years. Hobbyists migrating into the industry with experience programming drones, robots, or other projects frequently have an Arduino or Raspberry Pi background. They'll likely have dealt with Python on some level in that time, and it's also likely that they'll have bumped up against some embedded systems programming.

Data science industry eyes machine learning, recommendation engines

The traditional roles of systems analyst or business analyst are still there, but what has changed is the intensity and enormity of how they are used across the business. Data science used to answer questions of a limited scope. If you look at where the changes are in the industry today, data science is used far more profusely across the organization. This means applying analytics and insights across every stage of the business. It's a lot more pervasive and that makes the demands on data scientists a lot more pervasive, too. ... Yesterday's database administrator is today's data engineer. If you look at what data engineers do, they do some programming, math, SQL, administration and storage. Data scientists are different; they do model building, develop algorithms and do storytelling based on what the data says.

Quote for the day:

"Too often we think we can act without explaining and take decisions without justifying them." -- Peter Mandelson

September 03, 2016

Informatica CEO: 'Data security is an unsolved problem'

"We think our focus on data can bring a new approach," Chakravarthy explained. "Rather than focusing on infrastructure and networks, you need to focus on the data, wherever it is." The problem requires insight and visibility into data at a detailed level, in other words, and Informatica thinks it can offer that in a way no other provider can. "I don't see anyone else with the same approach," Chakravarthy said. It's been just over a year since Informatica went private in a US$5.3 billion buyout that included investments from Microsoft and Salesforce. Chakravarthy, who had been chief product officer, took the CEO chair at the same time, replacing Sohaib Abbasi. Speeding Informatica's transformation for the cloud and big data was the primary objective in going private, and the past year has brought good progress, Chakravarthy said.

20 of the biggest influencers on US CIOs

Bearing in mind the increasing importance of security to the enterprise, we were surprised by how few security specialists the typical CIO follows. An explanation for this could be that serious security issues and news find its way into the technology press pretty quickly, so the imperative to follow people like Brian Krebs is probably not as urgent as it would be for the CISO. The report is an essential information source for anyone involved in selling to CIOs based in the USA. Whether your role is comms, marketing, social media, advertising, sponsorship, events organisation, etc. this report will make your life easier and help you do your job better. The report is available from our website but please feel free to email me at richard [at] apolloresearch.com or leave comments here if you have any questions regarding this research.

How to increase profits with digital transformation fueled by mobile

How does digital transformation unlock value and increase profitability? Research from IBM shows that combining mobile with data and analytics unleashes the power of employees. The concept is simple: Deliver the right information to the right person, when and where he or she needs it. This is the concept of the “individual enterprise,” and it represents digital transformation at its best. Think of an employee bringing to bear the capabilities of the enterprise. Digital transformation with the individual enterprise means using technology to work smarter and more productively. Let’s take a look at two companies that are using mobile as a catalyst for digital transformation to empower employees and increase profits:

Prescriptive Analytics: The Ultimate Self Help Tool

What is making prescriptive so attractive is that it does not discriminate between internal and external behaviors. For example, a retailer might leverage prescriptive to determine which sections of a store are receiving the most attention from customers and how to capitalize upon that (i.e. external behaviors). Versus a supply chain manager who uses prescriptive to identify average shipping times which can increase the efficiency of deliveries (i.e. internal behaviors). Furthermore, it democratizes analytics by delivering the information in plain English, right to the person who should see it, rather than requiring a trained professional for interpretation. But prescriptive also has the potential to go beyond simple practice improvement. As solution providers create more intelligent engines, they are able to actively identify problem areas that are costing the organization in revenue.

Will Artificial Intelligence help Big Data deliver on its promise?

One area which will be interesting to observe is the relationship between Data Scientists and AI. As AI and Machine Learning progresses and evolves, some of the more basic and straightforward tasks that Data Scientists perform routinely will become automated and will yield great results in productivity. AI is certainly not going to replace Data Scientists any time soon, and can in fact be a massively helpful tool to utilise, however how will they view it: Friend or Foe? Could this also be one of the many ways that the industry can combat the talent deficit, automating the more basic tasks and reserving the more complicated Data Science processes for the Data Scientists?

What Makes FinTech So Successful and Disruptive?

Traditional financial institutions have been in this game for a while and operate in a vast and complex ecosystem, which now serves a foundation for FinTech growth and development. In fact, some estimates suggest that three of the largest FinTech investors are international financial institutions – Citi Ventures by Citi, followed by Goldman Sachs and JPMorgan. Aside from the largest investors, a range of financial institutions has been actively supporting financial technology startups in one way or another – through substantial money injections, accelerators/incubators, challenges, etc. And although no money can guarantee success, as the saying by Tim O’Reilly goes, “Money is like gasoline during a road trip. You don’t want to run out of gas on your trip, but you’re not doing a tour of gas stations.”

How algorithms rule our working lives

These algorithmic “solutions” are targeted at genuine problems. School principals cannot be relied upon to consistently flag problematic teachers, because those teachers are also often their friends. And judges are only human, and being human they have prejudices that prevent them from being entirely fair – their rulings have been shown to be harsher right before lunch, when they’re hungry, for example – so it’s a worthy goal to increase consistency, especially if you can rest assured that the newer system is also scientifically sound. The difficulty is that last part. Few of the algorithms and scoring systems have been vetted with scientific rigour, and there are good reasons to suspect they wouldn’t pass such tests. For instance, automated teacher assessments can vary widely from year to year, putting their accuracy in question.

5 Traits Effective IT Leaders Need

What are the characteristics that make these and other industry luminaries so revered? The technology they created? The artful design they infused into function? The plethora of free food and other perks they doled out to employees? Turns out there are five characteristics that more than 8,000 IT workers surveyed in North America by Robert Half Technology pointed to as traits that are important for an IT leader to possess. But often challenges crop up that prevent tech executives, managers, and team leaders from reaching such regarded heights. "The most successful leaders are in touch with the needs of the organization and their team, but are also keenly aware of industry trends and factors that impact the tech industry as a whole," John Reed, senior executive director for Robert Half Technology, told InformationWeek.

Why a security team embraces shadow IT

Bartholomy says the end-user technology unit also works with the broader IT unit on corporate technology strategy, including implementing other cloud solutions, such as Workday. While the company consumes a lot of cloud software for a financial services firm, it doesn’t adopt cloud casually. Like any other vendor Western Union works with, SaaS providers go through a risk assessment process to ensure that they meet the company’s rigorous security standards. "Because we are in a financial services organization, compliance is a big part of what we do so making sure that those vendors are doing all of the right things to make sure that we feel good about using them,” Bartholomy says.

Christine Doig on Data Science as a Team Discipline

Data science is about the design and development of solutions to extract insights from data (structured and unstructured) using machine learning and predictive analytics techniques and tools. Data Science as a discipline and Data Scientist as a role have been getting lots of attention in the recent years to solve real world problems with solutions ranging from fraud detection to recommendation engines. Christine Doig, Senior Data Scientist at Continuum Analytics, spoke at this year’s OSCON Conference about data science as a team discipline and how to navigate the data science Python ecosystem. She talked about how to transition from data to models to applications. Christine also discussed the different roles and skillsets needed for the data science discipline: Statistician, Computational Scientist, and Developer.

Quote for the day:

"Together we must learn how to compose differences, not with arms, but with intellect and decent purpose." -- Dwight David Eisenhower

September 02, 2016

Digital Transformation: A ‘make or break’ challenge

The Progress research says that CEOs are the main advocates of change but IT leaders will lead the charge. That said, many respondents who observe recalcitrance to change put the blame on IT. It’s not just about who leads the project though; digital transformation is all about widespread organisational reform according to Progress’s Armstrong. “There appears to be a lack of joined-up thinking in many businesses,” he says. “Digital transformation is like any other project in that it needs buy in from all relevant stakeholders. The challenge comes from the fact that digitalisation affects your whole business and everyone is a stakeholder. When it comes to digital transformation, the biggest risk isn’t choosing the wrong software – it’s actually a lack of internal alignment.”

Hackers prey on human resources using ransomware

"They are very focused. In a spear phishing attack, many times I get somebody compromised, but it’s someone who won’t get me any closer to the crown jewels," Nesmith said. Hackers know that they have to be careful and strike a balance with their attacks, but they have come to understand that volume is not in their favor. "Ransomware is a little different because with most attempts to penetrate, you want to compromise the device and be fairly quiet. Ransomeware, once in, moves aggressively. HR is the perfect world for ransomware. It infects one device and thirty others get infected," said Nesmith. HR departments are useful to bad actors because they have access to a lot of systems. Once in, they can move laterally and they are quickly onto something really important.

Why Google Might Make a Big Change to Its Android Strategy

Now, Google may be showing signs of changing its approach to Android and smartphones more broadly. The move, experts say, appears motivated by a desire to make the Android experience more uniform. Technology news site The Information reported earlier this year that Google is looking to take more control of its Nexus devices, which the company typically creates in collaboration with hardware partners. Google CEO Sundar Pichai said this summer that Google would “be more opinionated about the design of [Nexus] phones” moving forward. And just this week, tech blog Android Central reported that Google may even go so far as to add features on top of so-called “vanilla Android” for its Nexus phones. A rebranding effort, possibly along with a new name besides “Nexus,” might follow. Google declined to comment for this story.

IT Project:Internet of Things

Some of the issues associated with IoT involve privacy and security, both of which can be minimised with standardisations and security best practices (both built-in and at the same time enforced by organisations), according to Catalin Cosoi, chief security strategist at Bitdefender. "IoT ubiquity will not only mean placing more security controls in place, but also including them in the security lifecycle of the company. While the rewards of supporting IoT in organisations have yet to be fully explored, companies cannot afford to be ill-prepared for full-blown IoT market penetrationwithin coming years," he says. There is also a risk that in developing an IoT project that a firm simply deploys technology for its own sake.

U.S. Cloud Vendors Adjust To Snowden Effect

“Just the fact that we have these discussions tells me… that you can’t just run it all from U.S. soil,” says Gartner analyst Carsten Casper, who is based in Germany and regularly advises U.S. cloud providers about their go-to-market strategies in Europe. Casper says common questions from clients include whether vendors must establish a new subsidiary or build a data center to meet data residency and sovereignty requirements. He pointed to the deliberate expansion of data center facilities by AWS, Microsoft and Google in recent years. But even that sometimes isn’t enough. In one scenario, which Casper calls the most extreme of its kind, Microsoft owns a data center in Germany that is actually operated by Deutsche Telecom. “Providers must adapt,” he says.

U.S. Cyber Command director: We want 'loud,' offensive cyber tools

The development of “loud” offensive cyber tools, able to possibly deter future intrusions, represent a “different paradigm shift” from what the agency has used to in the past, Turskey said. “We will continue to work with the intelligence community for offensive means and offensive operations," he said. "But as the United States Cyber Command, we need totally separate tools and infrastructure to conduct our operations.” The comments come at a critical time for the command as the organization shifts from “capacity building to capability delivery” since its inception six years ago, Turskey said.

The future of machine learning in cybersecurity: What can CISOs expect?

While most of the people we’ve spoken to for this piece agree there may be the less jobs in the future, no one is currently under threat. Kris Lovejoy, President and Chief Executive of Acuity Solutions Corporation, believes there will be a ‘change in the dynamics’ of how security is run. The lower-level, ‘eyes on glass’ type analysts who are there merely to log incident and discard the false positives, may end up seeing their services required less and less and the systems learn what’s right and wrong. The people above them and providing initial analysis into what kind of threat the business is facing, however, will be more useful. “People don't realise how much just horrible manual labour and just waiting around sitting around is involved in these kinds of investigations,” she says.

Google will not make Project Ara modular smartphone

Google said in May that developers would get their hands on an early release version of Ara by the end of this year to start building custom hardware modules for the device. It changed its design philosophy to integrate many core mobile phone components like the CPU and radio into the Ara 'frame,' while leaving other modules to be customized. The company said at Google I/O 2016 that it had integrated the phone technology into the frame to free up space for modules that add new functionality not found on smartphones today. Future frames could be larger, smaller or completely different from a smartphone, executives said, while talking about a modular computer platform. Other vendors have also been experimenting with modular phones, with some variations in the main concept.

Hong Kong Government Hacked by Chinese Cyberspies, FireEye Says

On at least three occasions in early August, the China-based group APT 3 targeted the organizations with “spear-phishing” attacks, in which e-mails with malicious links and attachments containing malware are used to access computer networks, said John Watters, president of iSIGHT, a unit of FireEye Inc. He said the hacks were “certainly” politically motivated, based on their targets. Watters declined to say what agencies were attacked because his firm seeks to identify attackers, not shine a spotlight on the victims. It wasn’t possible to confirm whether APT 3 was linked to any Chinese government organization, he said, adding that the Hong Kong authorities had been informed of the incidents.

Latent-to-live code & forward compatible interim versions

Latent-to-live code pattern is the process of gradually putting latent code in use in production, before the related feature, or feature changes, are made available to the users, while keeping it invisible from the user and at the same time collecting valuable learnings from the execution of the new or changed code. ... Once the code is shipped into production, the incomplete feature enhancement is not exposed in the front-end, thanks to the feature toggle, while the 4 variables calculation is executed live every time the original feature invoke the 3 variables version of CalculateTyreDegradationDeltaTime. From running the new calculation into production we can learn sooner if new code works as expected for all the cases where the 4th variable is set to zero, and if it works without breaking existing features.

Quote for the day:

"Preconceived notions are the locks on the door to wisdom." -- Mary Browne

September 01, 2016

Technical Practices as a Hack on Consciousness: Why to Hack Yourself

The emergence of integral consciousness is a result of rapidly increased access to many different perspectives and many people of different backgrounds coming together in postmodern society. As a result individuals then can begin to realize the vast range of choice in who they are and the burden of self-authorship. In other words, they realize that both their mental models of who they are and how the world is are not necessarily as immutable as they appear. The principle of “mutual causality” as described by Buddhist scholar and environmental activist Joanna Macy means the doer and the deed are co-arising and create each other. We are created by our actions. We co-arise through our work and our interactions with others. When teams form and perform well, they likely have taken advantage of mutual causality.

3 new programming languages: What their creators say

It’s one matter to create a language; it’s another to ensure it’s of use to others who may be bumping up against similar problems. Each of the developers of these three emerging languages see use cases already evolving. Oden, Wickström says, is good at tasks within Go’s wheelhouse: web servers, back-end services, and command-line tools, to name a few. It is also good for building libraries that provide generic user-defined data structures, generic algorithms, and control-flow abstractions, he says. Crystal, meanwhile, is suited for web services, because it has nonblocking I/O and lightweight processes, Borenszweig says. Existing applications have included command-line applications, emulators, websites, and IRC bots. “It can also be used in competition programs, where you need to prototype fast but achieve good performance,” Borenszweig says. “Finally, it can be used to build compilers, such as Crystal.”

10 Essential Resources for Evaluating Backup and Disaster Recovery Solutions

When it comes to the selection of a solution for a new backup and recovery initiative, where should you start? A typical internet search may yield some worthwhile answers, though you’ll likely be bombarded with sponsored links to so-called ‘expert’ analysts pushing their own agendas. Consulting trustworthy sources of information is the name of the game. At Solutions Review, we put ourselves in the middle of it all, searching for resources that can assist buyers of enterprise technology to achieve their goals in selecting the tools that best fit their needs. With this in mind, we’ve compiled a list of the 10 best resources solutions-seekers should consult while in the research phase of a new backup and recovery solution project.

SQL engines boost Hadoop query processing for big data users

Deploying a SQL-on-Hadoop query engine might require more processing horsepower in a Hadoop cluster, as well. For example, Premier added five compute nodes to its cluster when it moved the ETL processing for physician performance data to the Hadoop system, increasing the total number of nodes to 19. And Palmer said he expects the cluster to grow further as the company puts more applications on it. But he added that the SQL-driven expansion of the cluster, which currently holds about 65 TB of data, has saved money overall by enabling Premier to completely replace one data warehouse appliance system and reduce its use of another one -- both being higher-cost processing platforms than Hadoop. The new Hadoop math is simple, according to Palmer: "I like to say that the more we expand the cluster, the more money we save."

Notebook Workflows: The Easiest Way to Implement Apache Spark Pipelines

Databricks Notebook Workflows are a set of APIs to chain together Notebooks and run them in the Job Scheduler. Users create their workflows directly inside notebooks, using the control structures of the source programming language (Python, Scala, or R). For example, you can use if statements to check the status of a workflow step, use loops to repeat work, or even take decisions based on the value returned by a step. This approach is much simpler than external workflow tools such as Apache Airflow, Oozie, Pinball, or Luigi because users can transition from exploration to production in the same environment instead of operating another system. Notebook Workflows are supervised by the Databricks Jobs Scheduler. This means that every workflow gets the production functionality provided by Jobs, such as fault recovery and timeout mechanisms.

Keezel's wireless device protects hotel Wi-Fi , home IoT connections

The latest use is as a security layer for connected home appliances. Smart lightbulbs often contain dumb security flaws, and many of them are never patched. Rather than leave your entire home network at risk of some hacker finding your lightbulb and using it as a staging post for an attack, you could to use Keezel to isolate it from other devices on your home network, co-founder Friso Schmid said. Future software updates to Keezel could also block ads or prevent access to malicious websites, Muller and Schmid suggested. Keezel recently upgraded its design with a new Wi-Fi chip that covers the 5 GHz band, so it now supports 802.11 b, g, and n. There's no point in adding 802.11ac, Muller said, because the dual-core ARM chip at the heart of the device wouldn't be able to keep up.

Why Agile Is Critical for Attracting Millennial Engineers

A Millennial-generation developer who works on JIRA Software at Atlassian told me, "I chose to work in an Agile environment because our industry moves fast, and I don't want to sink time and energy into something that doesn't matter, or won't help me move forward." Agile development, he said, "goes beyond the technologies we use or the processes we follow. It's an attitude, and it needs to be present throughout the entire organization." For some Millennials, working with less-than-pure Agile methods is a compromise. A 27-year-old project manager told me he left a Big 5 Consulting Firm after nearly 5 years because the architecture-driven version of Agile practiced there was "too constrained by governance." He made a lateral move to a job with a software developer focused on small, private customers.

Creating the next wave of data center innovations

The biggest opportunity for the data center industry lies in the effective use of the vast quantities of data unleashed by IoT, combined with big data analytics as a catalyst for the next wave of innovation. As an industry, we must not only be able to instrument a data center and provide data to the data center operators, we must also be able to consolidate millions of data points every minute from multiple data centers and use sophisticated data mining tools to spot trends. ... If the industry can come together to achieve that, we will be able to perform true benchmarking with universal metrics across the entire industry, and with that, we are looking at the possibility of true machine learning – not just machine learning on one data center in one location, but machine learning throughout the entire data center ecosystem – where not only does one company benefits but the ecosystem as a whole benefits.

Encryption hiding malware in half of cyber attacks

The trend is expected to grow in parallel with the greater legitimate use of encryption. Inbound encrypted traffic is expected to rise from 39% to 45% next year, and outbound encrypted traffic from 33% to 41%. When asked about malware hiding outbound data within encrypted traffic, 74% said this was highly likely but only 16% thought their organisation could identify and mitigate SSL-encrypted malware attack before data exfiltration. When asked if traffic from an SSL-secured malware server could be spotted by their intrusion prevention system (IPS), 79% of respondents said it is highly likely this could occur in their organisation; only 17% thought their organisation has the ability to mitigate such an attack.

Detection & Response: Where To Begin

As with any technology, though, machine learning is another one of the many layers in the entire security infrastructure. "It’s an additional layer on top of a SIEM that augments and helps to tune the system," Poulin said. CISOs struggle with determining which of those layers are most important, and when there are so many layers that the technology becomes redundant or inharmonious. Poulin said, "Perspective is everything. My personal philosophy is borrowed from a wood-working expression, 'measure twice cut once'. You need to have something to measure the information." All they have to do to weed through the overgrowth is determine where the problem is for them--at the perimeter, user role management, data access? The problem for many who are feeling so overwhelmed and understaffed is that looming question,Where do I begin?

Quote for the day:

"Program testing can be used to show the presence of bugs, but never to show their absence!" -- Edsger W. Dijkstra

August 31, 2016

UAE infrastructure ministry upgrades IT to support smart government

“As a result of this project, we have also been able to bring our e-services back in-house, which were earlier hosted at a third-party datacentre. Now, all 23 services are available through our website and can paid for through e-dirhams or credit card. “We had the support of higher management, especially Abdullah Belhaif al Nuaimi, minister of public works, in achieving our goal of 100% small governance.” The MoID’s datacentre and network upgrade project has won multiple independent awards. It is an example of how to harness the power of technology to improve customer service, enhance employee collaboration and keep costs in line.

How bitcoin was brought down by its own potential—and the banks

Bitcoin may be the platform on which this coming blockchain boom operates, or it may not. I imagine this will depend on some purely economic calculations being done by unfathomably vast and powerful financial institutions. In comparison to the almost $5 trillion traded on the international currency markets each and every day, bitcoin’s $10 billion market cap is next best thing to a rounding error. It could vanish entirely and only a small cadre of true believers (and high-end drug dealers) would even mark its passing. What does seem certain is that the revolution heralded by bitcoin now looks more likely to be transactional rather than transformational. Don’t get me wrong: I think bitcoin is a fundamentally useful thing. Its myriad advantages over fiat currency would seem to demand its widespread adoption.

How Cyber Security Pros Transition To Board Level Decision Makers

Many successful candidates were CISOs or CSOs with a cyber or IT background and a deep understanding of cybersecurity issues from a more technical point of view, he says. ... Candidates from the consulting or legal world who focused on cybersecurity were also successful in getting board positions, Comyns says. CEOs of cybersecurity companies who have moved on from those roles after acquisitions or IPOs have also become very interesting to boards, he adds. “These candidates also shared a strong business acumen that adds value to the board beyond the cyber topic. That’s always the tricky part,” Comyns says. “Finding a true, deep cyber-level expert and somebody who is a broad business leader and can communicate at that level with the board on other topics beside cybersecurity – that would always be first choice.”

Enterprise Architects “Know Nothing”: A Conversation with Ron Tolido

Because customer and business needs are constantly changing there really is no way to know what IT landscapes will look like in the future or what type of solutions organizations will need, Tolido says. Therefore, rather than asking clients what they need, IT must instead provide users an architected platform of services that can be mixed and matched to meet a variety needs, enabling business customers to go in any direction they want. As such, Tolido says Enterprise Architects in this emerging digital era are comparable to the character Jon Snow from HBO’s Game of Thrones—a character who is often told “You know nothing.” Like Jon Snow, today Enterprise Architects effectively know nothing because businesses have no idea what the future will hold, whether two days or ten years from now. With new business scenarios developing in real-time, architectures can no longer be painstakingly planned for or designed.

Global cybercrime costs will exceed $6T annually by 2021

"The lack of user awareness when combined with a significant uptick in criminal activity (and improved tactics) has given rise to a number of large scale private and public sector breaches that have resulted in a global epidemic of issues surrounding confidentiality, integrity and availability of data and services," he added. Ransomware attacks have risen a whopping 300 percent in 2016, the report found. And cybercriminals produced malware at a rate of 230,000 new samples per day in 2015. However, 2016 figures are predicted to be much higher. Even worse, a new zero-day vulnerability was discovered every day in 2015.

Devops and cloud: Great together, great apart

Most enterprises still use laborious processes for design, development, testing, and deployment of new and incremental software releases. And many claim they use those complex approaches because they are not yet ready to move to the cloud, which would be a catalyst for adopting devops. Yes, there's a synergy between devops and cloud computing. But one does not require the other. Devops is useful for any software development, not cloud deployments alone. Similarly, you can use different development models for the cloud, such as agile -- not only devops. Devops and cloud computing should be independent but complementary concepts. If you remember the old Reese's peanut butter cup commercials, devops and cloud computing go together like peanut butter and chocolate.

87 percent of IT execs think mobile apps are secure — they're wrong

According to several sources, between 54 and 84 percent of cyberattacks are occurring at the application layer. This data means that there are actual attempts to exploit these vulnerabilities. These types of attacks are only expected to increase due to the continued dramatic rise in mobile and IoT, and applications represent the soft, vulnerable underbelly for organizations. Devices have been shown time and time again to be vulnerable, from hospital infusion pumps to remotely-accessed automobile controls. The good news is that no catastrophic incidents have been prevalently reported. However, we are at a tipping point where there have been numerous wake-up calls for organizations to adapt their security strategies to be better prepared for the new wave of risks and threats that are in front of them.

Cyber threat grows for bitcoin exchanges

The security challenge for the bitcoin world does not appear to be letting up, according to experts in the currency. "I am skeptical there's going to be any technological silver bullet that's going to solve security breach problems. No technology, crypto-currency, or financial mechanism can be made safe from hacks," said Tyler Moore, assistant professor of cyber security at the University of Tulsa's Tandy School of Computer Science who will soon publish the new research on the vulnerability of bitcoin exchanges. His study, funded by the U.S. Department of Homeland Security and shared with Reuters, shows that since bitcoin's creation in 2009 to March 2015, 33 percent of all bitcoin exchanges operational during that period were hacked.

Swift warns banks of fresh wave of cyber heists

Elite cyber criminal groups are investing heavily in penetrating high-value payment platforms, high-value corporate and banking networks, and payment processes such as Swift. “Hackers targeting financial institutions are much more professional than they used to be,” said Troels Oerting, group chief security and information security officer at Barclays and former head of Europol’s European Cybercrime Centre (EC3). “They take their time, they look at the processes, they have good resources, they are very adaptive, and they are more dedicated to going after bigger prizes rather than going after easier targets with smaller prizes,” he told Computer Weekly. These elite groups typically use social engineering and spend a lot of time identifying who in a bank has privileged access to payment platforms to target them exclusively to steal their login credentials.

How can cities with 18th century infrastructure support 21st century life?

In Los Angeles, a simple move of switching the city’s street lamps to LED bulbs equipped with mobile sensors is saving the city $8 million a year. And most Americans probably recall the disastrous and deadly collapse of a bridge in Minneapolis in 2007—today the “smart bridge” that replaced it is outfitted with over 300 sensors that track temperature, vibration and possible corrosion, among other factors. Similar technology is being used in bridges across the US to anticipate similar tragedies before they can happen. Among transportation experts, mobility-focused digital innovations like apps that encourage car-sharing and microsimulations that predict travel demand are expected to be essential for the safe and efficient growth of the 21st-century city, as reported in a new study from EY.

Quote for the day:

“It’s okay that we’re not perfect...that we all have problems. It’s okay to cry, to show emotions” -- Marina Abramovic

August 29, 2016

Generation Blockchain’s Move To The Mainstream

As corporate lawyers, media executives, politicians, environmentalists, and mom and pop shops begin to harness and realize the power of the blockchain, discount online retailers are creating FinTech subsidiaries prompted by it. Panelist Judd Bagley, Director of Communications at Overstock.com, described the creation of their FinTech subsidiary, t0. t0 was established to bring greater efficiency and transparency to capital markets through the integration of blockchain technology. It was established after Overstock, one of the first online retailers to accept Bitcoin, recognized its power. Furthering environmental applications, are companies using blockchain to cater to farmers and sustainable agriculture. Bill Schafer, CEO of Fairledger, described how their system creates and executes digital contracts that are confirmed and recorded on the blockchain in order to trace agricultural products through the entire supply chain.

Cyber Extortion Is No Way to Get Rich

A recent study of Cerber estimates that the operator does pretty well, earning $78,000 in the month of July. The average affiliate, by contrast, brought in $726 in revenue. From that, subtract operating expense. The affiliate needs to buy an exploit kit -- a piece of software that scans a victim’s machine for known security holes. Before the kit can be delivered to a victim, it must pass through a crypter, which modifies malware to get it through virus filters. Both exploit kits and crypters must be updated every few weeks to stay ahead of security experts. Between tools of the trade and email spam campaigns, an attack could cost more than the expected income before a single ransom payment comes in

Considering Privacy in the Age of the Camera

“We have a fundamental problem with monitoring everybody just because somebody might do something wrong. That’s not how life is supposed to work in a democracy,” he explained. “The government is not supposed to be looking over your shoulders all the time, just because you might be engaged in wrongdoing, and we’re approaching the point as a technological matter, that is increasingly something that is possible to do.” Stanley also doubts the ability of video analytics technology to fully understand the complex and varied behavior of human beings. This was the case in San Diego several years ago, when the Municipal Transit Agency tried a program that didn’t pan out. Though the agency still uses cameras for monitoring purposes, the analytics deployed at the time wasn't quite ready for prime time.

Deception technology grows and evolves

The new approach is to cast a wider net, of more subtle traps. "We want to create a large decoy surface area -- a cyber minefield field," said James. TrapX, along with several other vendors in this emerging space, uses automation to create phony workstations, servers, databases, even medical devices, point of sale terminals and automatic teller machines. Then TrapX lays a trail of breadcrumbs that leads them to the decoys. The breadcrumbs are only visible to attackers, who are using backdoor tools or command line interfaces to explore corporate networks. "The real trick is that the legitimate user never sees these links," James said. "They're never stumbling on a trap and tripping the alarm." Then the TrapX decoys keep the hacker on the hook, giving the security team time to respond.

Enabling business-aligned cybersecurity

Business leaders, more attuned to the need to support cyber risk efforts, now routinely consult with cyber risk leaders before making changes to applications and technology infrastructure, and have enforced a program among their own technology teams to regularly provide IT asset updates to the central monitoring operations team. As executives and business risk leaders gained confidence in the effectiveness of DriveNice’s monitoring program, it was easier for IT leaders to gain support for new technology investments. Implementing an end-user behavioral analytics program has provided analysts with better pattern detection capabilities to help identify previously unknown cyberattack tactics. The success of DriveNice—in the second hypothetical case, that is—cannot be attributed solely to either enhanced technology or enlightened leadership.

How to spot signs your project is about to fail

When considering the enormous amount of planning, time and effort that goes into project's, any 11th-hour changes can completely derail a project, especially when we're talking about major changes. This can be a sign that the planning stage was too light, or requirements were not sufficiently identified. It can also mean stakeholder expectations have changed throughout the project, but, regardless it still should be of significant concern. ... There can be a multitude of other HR-based issues that can negatively impact the project. Some others that are of more concern could be constant conflict, team members who don't really understand their role, and if the wheels fall off the wagon during every meeting, a PM should be concerned and deal with these right away before they get out of control.

How to Build an Economically-Driven Cyber Defense Strategy

A standard ransomware campaign could earn an attacker a 1,425 percent ROI, according to a report by Trustwave. This is in large part thanks to the explosion of Exploit Kits (EKs) – toolkits with packaged exploit codes – and other black market malware that puts sophisticated attack techniques into criminals’ hands for a fraction of the cost of the potential payout. Commercial crimeware can be purchased for as little as $500 a month. For an extra fee, customers can even rent “crypting services” to make the malicious software harder to detect. As with any SAAS product, more sophisticated packages are available for a higher price. Some exploit kits come complete with built-in distribution channels, technical support and are updated regularly with newly discovered vulnerabilities.

The curious technology shift that is making television shows better than movies

What’s changed in technology that has caused this massive shift in my own thought process? I’m a major movie buff and, for the past two decades, I’ve always picked a theatrical release like Star Trek: Beyond over anything on HBO. Even up until last year, I viewed Netflix as a movie-watching channel (such as they are) and not as a way to stream original shows. If I used the HBO app, it was to find movies. Here’s the shift: Instant access definitely favors episodic television. It took me a long time to make this transition, though, and I still plan to watch the new Star Wars movie this December. It’s not like I’m giving up on Hollywood. And yet, I can tell that I’m a bigger fan now of a different format, one that encourages not just binge watching but, more importantly, lean-in entertainment.

Laying the foundation for a virtualized network infrastructure

The placement of the VNF, as it relates to data flow, must be considered when looking at virtualizing a formerly physical appliance. If data flowing in or out of your network must be significantly rerouted so it passes through a VNF residing in the data center, you may want to reconsider a virtualized network infrastructure. A benefit of physical appliances is they are point-based services that can be physically installed anywhere along the network path. Redirecting traffic into a data center can increase complexity -- and potentially create network bottlenecks, as the amount of north-south data center traffic can increase exponentially. Ultimately, enterprise organizations have adopted the approach of "virtualize when possible."

Getting Started with ASP.Net Performance Monitoring and Optimization

A top-bottom approach, i.e. identifying an issue more and more precisely, works well in the context of an issue localized to a single page. How about issues that spawns multiple pages? What if, for example, various pages experience intermittent slow response time due to a subsystem not keeping up or an antique network switch which each reboot may be its last? This is where a monitoring approach focused on the application shows its limitations. At this level, other metrics are needed to assess the healthiness of every component in the system, both at software and hardware level. At the hardware level, the first machines that comes to mind are the web and database servers. However, these are only the tip of the iceberg. All hardware components must be identified and monitored: server, network switch, router, load balancer, firewall, SAN, etc.

Quote for the day:

"About the time we can make the ends meet, somebody moves the ends." -- Herbert Hoover

August 28, 2016

Cyberthreats Targeting the Factory Floor

Cyberattacks targeting manufacturing companies are on the rise, according to a recent report from IBM X-Force Research’s 2016 Cyber Security Intelligence Index. The report noted that the sector is the second most-attacked industry behind healthcare. Automotive manufacturers were the top targets for criminals, accounting for almost 30% of all cyberattacks in 2015, while chemical companies were attackers’ second-favorite targets. ... Until recently, industrial networks were separated from the rest of the world by ‘Air Gaps.’ In theory, an ‘Air Gap’ is a great security measure — disconnecting the industrial network from the business network and the Internet. However, an ‘Air Gap’ is no longer operationally feasible in today’s connected world.

French submarine maker data breach highlights challenges of IP security

“Often these controls are poorly understood. A file will be placed in what is thought to be a restricted location, but it turns out many more people have access than realised through poorly configured permissions,” Jonathan Sander said. Without diligent data access governance, Sander said these misplaced files are easy targets for malicious insiders, malware and other mundane attacks. “It’s hard to blame people for misplacing these files as most organisations lack data classification. They may have a policy on the books about it and if you open the file to read it you may see all manner of references to its level of secrecy, but those typically fail to be marked on the file in a way that will signal who should open it at all or where it should be allowed to live on fileshares.

Experts challenge Skyhigh's patent for cloud-based encryption gateway

The Skyhigh patent also appears to overlap with the Key Management Interoperatbility Protocol, said Rich Campagna, VP of products at Campbell, Calif.-based security firm Bitglass, Inc. KMIP dates back to 2010, and is a standard protocol for the exchange of encryption keys, he said, that is widely adopted commercially. It includes a function that "is used to derive a symmetric key or Secret Data object from a key or secret data that is already known to the key management system," he said, adding that this is "exactly the process described in claim number one of the patent." Garrett Bekker, analyst at New York-based 451 Research LLC, said that while Skyhigh has some unique aspects to their technology, several vendors already offer encryption gateways for cloud applications.

Artificial intelligence and the future of cyber-security

The future of cyber-security will continue as it always has, as a game of cat and mouse. Attackers will create new methods of concealment and defenders will create new methods of detection. The difference with AI is that we are trying to make something that will adapt to the changes the attackers make. Current research suggests we will soon see distributed AI detection schemes operating similarly to the human immune system, giving some form of environmental awareness. Like the human immune system, one part would be dedicated to addressing common threats (innate immune system), whilst another part would investigate anomalies to detect threats that have not yet been seen by the system (adaptive immune system).

How the Internet of Things will affect security & privacy

New developments would allow connected cars to link up with smart city infrastructure to create an entirely different ecosystem for the driver, who is simply used to the traditional way of getting from Point A to Point B. And connected healthcare devices give people a deeper and fuller look at their own health, or lack thereof, than ever before. But with all of these benefits comes risk, as the increase in connected devices gives hackers and cyber criminals more entry points. Late last year, a group of hackers took down a power grid in a region of western Ukraine to cause the first blackout from a cyber attack. And this is likely just the beginning, as these hackers are looking for more ways to strike critical infrastructure, such as power grids, hydroelectric dams, chemical plants, and more.

Target is shifting focus to in-sourcing technology and not outsourcing

Moving away from the out-sourcing model, CIO McMamara says that he is emphasizing on in-sourcing and building internal engineer teams. "About 70% of our engineering staff was third-party contractors vs. 30% Target team members. We had far more contractors than we needed—especially once we pared back our roster of projects to focus on key priorities," McMamara writes. "In just a year's time, we've completely flipped that ratio—so that now about 70% of our engineering staff is team members while 30% is made up of contractors. ...". Since McMamara's IT strategy is focused on in-sourcing, obviously company will have to ramp up hiring in a big way that would ensure he has a big team and support staff to execute business aligned IT plans.

Bridging the business intelligence and analytics gaps

Of course, internal politics also play a part in failed BI projects. Overcoming this requires data silos between departments to be broken down. At the same time, it’s important to get the balance right, so each department is still in control of its own performance. Therefore, companies need to create the right metrics that they can track over time. They should create an overall key performance indicator (KPI) for the business, as well as sets of key value indicators (KVIs) and drivers assigned to individual departments to show how each delivers value. This can be achieved using analytics tools to create the right dashboards that can show the contribution each particular role makes to the organisation. The KPI can sum up a business-critical process – for example, customer acquisition or profitability. The KVIs are then provided for each team involved.

Design Thinking and the Business Agility Ecosystem

Design Thinking can provide a mature and proven set of principles and practices that both the business/product management and software development parts of the organization can use to identify which problems are worth solving and very rapidly ideate potential solutions to those problems by using prototypes and testing assumptions. It can fill the gap that exists in many organizations that have successfully passed through the first and second waves of Agile and are looking for a set of practices to help them enter into the third wave of Business Agility. One approach to implementing Design Thinking toward achieving Business Agility is to view it in relation to the entire value stream.

How Fintech is improving Retail Banking

Fintech and retail banks have complementary strengths which should be leveraged to make a better central financial experience for customers. Banks offer capital and deep customer bases while fintech excel in innovation, agility and exploiting new technology. Fintech firms are sprouting all over the world and they have come up with Robo-advisers, online wealth advisors, mobile banking, improved and fast payments , easy and inexpensive transfer of money. Consequently, fintech has positively impacted the customer experience in retail banking. A Robo-advisor offers automated algorithm-based portfolio management advice without using financial planners. Retail banks have adopted this new technology because it requires a lower minimum investment to get started than traditional financial advisors.

Growing up in the intelligence era

Today, information technology is shifting from the SaaS workflow applications that characterized the cloud computing era to those that help customers make decisions.Characterized as the intelligence era, the source of competitive advantage is shifting from code to unique data + self-learning code. As with the previous shift, this brings a change in the expectations of investors. We are seeing investors outright ignore SaaS companies with solid traction in favor of companies that have a strategic position in the market granted by their “intelligent” software. This post generalizes the requirements of enterprise software investors in the intelligence era in the hope that it helps founders of enterprise software companies think about how to sequence their fundraising, product development and data strategy.

Quote for the day:

"Perfecting oneself is as much unlearning as it is learning." -- Edsger W. Dijkstra