Daily Tech Digest by Kannan Subbiah

October 09, 2016

IBM launches industry first Cognitive-IoT ‘Collaboratory’ for clients and partners

German industrial heavyweight and one of the world’s leading automotive and industrial suppliers, has signed a multi-year strategic partnership agreement with IBM to accelerate the digital transformation of its entire operations and customer solutions using Watson’s cognitive intelligence and insight from billions of sensors. Schaeffler’s goal is to be the world’s leading manufacturer of cognitive solutions which keep the world moving. Tapping the connectivity and analytics capabilities of IBM’s cloud technologies and Watson IoT platform, Schaeffler will analyze huge amounts of data from millions of sensors and devices across its operations and provide insight to help it to be more flexible, make faster decisions and optimize the performance of equipment in the field.

Russian hacking crisis tests Obama's nerve

“What we cannot do is have a situation in which suddenly, this becomes the wild, wild West, where countries that have significant cybercapacity start engaging in unhealthy competition or conflict through these means,” Obama said. There is no evidence that Obama has taken punitive cyber action in response to several major cyber breaches in the past few years, although by its nature cyber war is often invisible to outsiders. After the government of North Korea hacked Sony’s email servers in 2014, for instance, Obama issued a stern condemnation of North Korea’s actions but took no visible action beyond adding modestly to the long list of sanctions against that rogue state.

Data Science – The MUST KNOW to become a successful Data Scientist!

Data Science / Data Analytics / Business analytics is all about analyzing the data, which is getting generated through multiple sources. Sources range from traditional databases to satellite signals to sensors in Internet of Things, and the list will go endlessly. Easier asked question is, “Where is data not getting generated?” Also the technological advancements are happening at a pace, which will leave us dumbstruck. With these advancements, comes new data, which gets generated relentlessly, for e.g., wearable devices are tracking your heart rate, sleeping pattern (data being generating even while we sleep!), calories consumed, etc. Analyzing such wide variety of data, which is getting generated at a rapid continuous pace, requires extraordinary reasoning and skills.

Digital IDs will revolutionize your health and banking

Having a digital ID would put the power back in your hands, where it belongs. With a digital ID, you control your own personal information, and you decide who to share it with. You retain control over your identity and your health, financial, demographic and other personal data. All this sounds great — and even better, it’s becoming possible. Earlier this week, I attended the Distributed: Health conference, focusing on blockchain technology’s impact on the health industry. When you create a digital ID with blockchain, you get a private key and a public key that you use to securely exchange money or data. Your digital ID can even indicate that certain information about you can be disclosed if you are incapacitated. Blockchain is really just a sequential, irrefutable ledger of encrypted digital events that is shared between parties.

Data management for cybersecurity: Know the essentials

If your cybersecurity program focuses primarily on keeping intruders out of your networks, that needs to change. The answer isn’t to build higher walls and tighter controls around our information infrastructures. The answer is to have threat deterrence that works even against determined, targeted threats. You have to have visibility into network activities and the ability to rapidly detect and trace attacks. That requires strong data management in cybersecurity. Security teams generally haven’t needed to have a deep data science background, so they tend to underestimate the importance of data management in security analytics. As with any function or application, weak data leads to weak results. In cybersecurity, that means too many false positives for overburdened security analysts, higher risk of successful breaches, and greater losses from each breach.

How blockchain can change the music industry

In the music industry, the blockchain could transform publishing, monetization and the relationship of artists with their communities of fans. First, music can be published on the ledger with a unique ID and time stamp in a way that is effectively unalterable. This can solve the historic problem of digital content being downloaded, copied and modified at the leisure of users. Each record can store metadata containing ownership and rights information in a transparent and immutable way for everyone to see and verify. This will ensure that the correct people will get paid for the use of the content. Blockchain technology can also revolutionize the monetization of music. The infrastructure is based on smart contracts, programs that can be run on the blockchain along with the payment transactions.

The Internet of Things and security: smart business requires smarter security in IoT

There needs to be a mandate coming from the boardroom, where CSOs, CISOs, CIOs and data experts should get a place around the table (and increasingly do get one) and where the money and message needs to come from, to embed security everywhere, steer away from developing new solutions with a mindset of just maximal profit (leaving investments in key security controls out), go for security by design and not just talk the talk but also walk the walk when it boils down to mitigating the risks of that key business asset, called data, which in the end, along with process automation, is what the Internet of Things is all about. This boardroom aspect is also mentioned in another article on The Register, covering an event where the IoT and security/privacy issue was tackled, again with the ‘Krebs case’ in mind.

IoT, sensors, and all things digital: can we handle it all?

The interesting question here is: How will our life-world and behavior change when sensors are present everywhere? With the omnipresence of sensors and devices that sense locations and other types of human agency, we find ourselves in an environment that is not only tracked by living beings, but also by highly interconnected technological devices. You could even one day say that walls, streets, or cars have eyes in the most literal sense possible. Sensing is not a concept only about living organisms anymore. Rather, it’s a ubiquitous property of our life-world. This will deeply change how we act and interact with each other – but more important, it will transform how we engage with objects. Our life-world is altered by the Internet of Things as objects sense and communicate among themselves. The impact of this technological development has yet to be estimated and described.

6 Growth Tips From America's Most Valuable Fintech Startup

The company in question is Social Finance -- the San Francisco fintech company commonly known as SoFi (I invested in SoFi in December 2014) -- valued at $4 billion in its latest round of fund-raising. SoFi provides student loans, mortgages, and other services to Millennials whom it believes have the brains and discipline to use those services to achieve financial success. SoFi generates fees from selling bundles of loans. More specifically, it sells loans to third-party investors via securitizations or whole loan sales. ... SoFi has expanded considerably along other dimensions as well. It now has over 600 employees with offices in San Francisco, Healdsburg, Calif, Utah, Montana, and New York. And it has made about $12 billion worth of student loans mortgages and others -- serving 175,000 members.

Financial markets face disruption from artificial intelligence

One of the risks for individual and professional investors is that those investment companies that start to build AI into their processes will start to outperform other investors, making those investors increasingly reluctant to trade. "Disruption is likely to come from an uprising of disenfranchised investors around the world who are losing to technology. As taxi drivers feel disenfranchised by Uber, fund managers and investors will feel disenfranchised by other fund managers who have access to AI," Mr Sicilia said. "They will stop trading. Why play the game when you are always going to lose? This is all uncharted territory," he said. Looking further ahead, markets face even greater disruption as intelligent computers trade against each other and, having studied the same patterns, want to buy and sell the same security at the same time, potentially causing trading to stop altogether.

Qoute for the day:

"Your success will be the degree to which you build up others who work with you. While building up others, you build up yourself." -- James Casey

October 08, 2016

How Companies Can Deal With Insider Data Theft

"Inadvertent leakage is also a big problem," said Salim Hafid, product manager for Bitglass. Cloud-based applications and bring-your-own-device policies have only made it easier to accidentally share or publish confidential data, he said. As a result, more corporate data is getting out of company networks and into personal smartphones and file-sharing systems. "A huge number of organizations that have cloud applications deployed have no means to identify these careless activities and no way to mitigate the threat," Hafid said. Companies like Bitglass sell services to fill those gaps. Security vs. Privacy. To solve the problem, security firms are also coming up with products that can monitor access to a company's most sensitive files.

On-premise IT still the only way to run certain tasks

A hybrid cloud that incorporates cloud bursting will allow you to take a workload and spin it up on the private cloud, but if the workload needs more resources, it can be seamlessly moved out to the public cloud and easily work with data sources, no matter where they are – in the cloud or on-premise. Cloud bursting is therefore a great way for businesses to handle peaky demand patterns, such as e-commerce providers with big peaks in sales at Christmas, or news and sports websites with steady demand that spikes when something big happens, for example the World Cup or the Olympics. Cloud bursting can also be a useful tool for businesses that need to carry out analysis on large datasets, and for traditional applications such as month-end accounting runs where the demand is predictable but requires servers and storage to sit idle most of the time.

Beware of “spear phishing”

The scammer sends an e-mail to an employee at the company, often from a hacked or “spoofed” e-mail address or an address that closely resembles the company’s e-mail format. For example, if a company’s e-mail format is user@321company.com, a scammer might use user@321company.co, or user@321compny.com. Spear phishing is often more profitable than a basic phishing scam. First, scammers research a company to convincingly impersonate the target’s boss or co-worker. People are more likely to be victimized because the e-mail appears to come from a trusted source. Second, spear phishers may use the information they obtain to steal the identities of every employee at a business and file thousands of fake tax returns. By filing fake tax returns or selling private information to other criminals, spear phishers can make a lot of money very quickly, even if only one person falls for the scam.

What will happen to blockchain in 2017?

For blockchain to truly function properly, its builders need to fully comprehend the entire ecosystem. A great example of this is Blythe Masters and her company Digital Asset Holdings. They’re completely changing public capital markets, not just one piece of the market, but every cog in the public capital markets machine. For that, the company needed to make sure it had the sector expertise it needed to ensure on implementation its product would work, and the company has both Nasdaq and the Australian Stock Exchange in its corner to demonstrate that. No other blockchain provider has had this level of success. In 2017, many of the blockchain companies that want to enter the business application sector will not survive beyond their concept stage.

Security concerns rising for Internet of Things devices

Indeed, when LIFX found out about the Wi-Fi credentials flaw, they patched it right away. Because there are so many small companies making IoT devices, the problem won’t go away anytime soon. Foeckl says IT departments need to start including IoT devices in their security monitoring efforts and certification and testing processes, and that they should work with their vendors to make sure these devices are patched, tracked, and protected. “Another important task is the development of privacy policies that inform users about the collected information and guide them to maintain a security good practice, advising on changing passwords, reporting unusual activity,” says Foeckl. “A well informed user represents a great premise to prevent data breaches regardless of the threat vector.”

A CTO's IT spending strategy for a fast-growing platform startup

"Every business has to maintain that delicate balance between reinforcing the old and creating the new," she said. "They need to be ambidextrous: exploiting their existing infrastructure and the capabilities which they have already built while simultaneously exploring new opportunities and innovating for the future." Morgan said he didn't lose sight of how the technology needed to support business objectives and strategic goals. His early re-engineering work, in addition to correcting problems, allowed for the addition of new functions that could drive company growth. As part of his strategy for the growth, Morgan said he moved his team away from a monolithic design toward a client front-end model, exposing APIs which led the team into building out its enterprise portal.

Password Guidance: Simplifying Your Approach

The death of the password was predicted some ten years ago. It was assumed that alternative authentication methods would be adopted to control access to IT infrastructure, data, and user material. But since then, password use has only risen. This increase in password use is mostly due to the surge of online services, including those provided by government and the wider public sector. Passwords are an easily-implemented, low-cost security measure, with obvious attractions for managers within enterprise systems. However, this proliferation of password use, and increasingly complex password requirements, places an unrealistic demand on most users. Inevitably, users will devise their own coping mechanisms to cope with ‘password overload’.

Business transformation proves to be a catalyst for cybersecurity spending

Pescatore agrees: “Increased use of SaaS and IaaS is definitely causing breakage in security approaches. It is causing a shift in spend from security software and hardware to actually more skills on the security staff side,” he says, adding that it’s common for SANs to hear such challenges from large enterprises. The reason for this, Pescatore explains, is that “SaaS means you cannot use security agents or appliances except the big SaaS services, such as Outlook365, Google at Work, Salesforce, and so on. They have security features and APIs that can be used to extend security policies to the SaaS app -- but that takes a higher level of skill in the security staff. Similarly, in IaaS you can use software and virtual appliances,” he says.

When a Payment is More Than a Transaction

One of the most important implications of electronic payments (whether domestic or international remittances) is the opportunity for disadvantaged groups of population to plug into the global financial system. A notable example of the way electronic payments are put to benefit the developing world is the joint effort by Stellar, the Stripe-backed open-source payment network, and Oradian, a cloud-based software provider for microfinance institutions in developing countries. Those companies have developed a payment-transfer network inside Oradian – built on top of Stellar’s platform – that allows 300,000 Nigerians (90% of them women) to cheaply transfer money between microfinance institutions over the Stellar network. International remittance services by FinTech startups are another case.

Information sharing still a heavy lift

Raskin said her department, “encourages a lot of sharing of information. We would like institutions to feel that they can benefit just as much from receiving information as giving information.” She added a failure of security in the banking system would lead to a different breakdown of trust – trust from depositors that their assets are safe. “Potential exploitation has the effect of undermining trust,” she said. “Our ultimate objective should be to reinforce the public's trust in the resiliency of the financial product, service, or institution.” McCabe, interviewed by Walter Isaacson, president and CEO of Aspen, admitted there is resistance “throughout the private sector” to allowing the FBI to monitor their systems in real time, even though he said that would let the agency notify an organization much sooner in the event of an attack.

Quote for the day:

"The future belongs to those who believe in the beauty of their dreams." -- Eleanor Roosevelt

October 07, 2016

Why Michael Dell is Smiling

“The open ecosystem of VMware is absolutely critical to its success,” said Dell from the same VMworld stage. “So we’re only going to continue to encourage that. That hasn’t changed, and won’t change.” It was the message that both technologists and investors attending the show wanted to hear most, even as measurable changes in the enterprise data center market place new stress and constraints upon VMware separately from Dell. While Dell Technologies will continue to be a private entity, as it has been since 2013, VMware will represent the only facet of the post-merger behemoth whose capital is tradable through common stock. VMware will be Dell’s most sensitive component to changes in investors’ moods about the infrastructure market.

Cybersecurity is just too much trouble for the general public, claims study

Yes, the typical person does feel exhausted at the prospect of having to ensure that their passwords are not just unique, more than 20 characters long, and compiled of a gobbledygook random collection of letters, characters and numbers, let alone the challenge of remembering them. But that’s where computers and smartphones come in. The most common question I am asked by members of the public is “I know I’m supposed to have lots of different, complex passwords… but how am I supposed to remember them?” Well, good news! You’re not supposed to remember them. In fact, if you can remember them you’re probably doing it wrong! Instead, invest in a decent password manager which will securely store your passwords for you and even generate properly random, complex passwords when you need to create a new account online.

Venture capitalist Marc Andreessen explains how AI will change the world

All of a sudden, you have a lot more computer science graduates coming out knowing how to do this because this has become the hot new area of computer science. You also have a lot of the engineers who have been at the big incumbents working on this stuff who are now realizing they can start their own companies. There's a whole new generation of autonomous vehicle startups that are spinning out of Google. Otto was a prominent one, but there are, like, six others that are in flight right now. Meanwhile, the technology itself is becoming more tractable. A lot of the interesting new projects we’re seeing don't need 1,500 people. They need five. Google open sourced this thing called TensorFlow, which is one of the building blocks of deep learning.

Inside the mind of a state-sponsored hacker

The anonymity of web-based attacks means that nation-states can operate via puppet actors, making it extremely difficult to prove links between individual hacks and state intelligence. Even if those links are made, it is still unlikely that analysts will be able to determine the exact origin and purpose of the orders behind them. For example, FANCY BEAR carried out the WADA breach using patterns which are strikingly similar to known Russian modi operandi. The waters are muddied, however, by the fact that they also claim allegiance with Anonymous Poland, a hacker group which ordinarily operates within the Polish political sphere and with Polish interests in mind. As a result, its purported involvement seems suspicious – it certainly doesn’t sit easily with the hack’s clearly pro-Russian motives. This ambiguity makes it extremely hard for analysts to pin down the culprit.

Inside A Bug-Hunter's Head: 6 Motivators

As a whole, the hacker community is relatively young. Nearly 60% of respondents were between 18 and 29 years old, and 34% were between 30 and 44. Most respondents either identified as students or are employed outside of bug hunting, but 15% identified themselves as full-time bug hunters, and many respondents reported they aspire to become full-time bug hunters in the future. Bugcrowd anticipated the number of full-timers is poised to grow. Similar findings were discovered in the 2016 Bug Bounty Hacker Report from HackerOne. In this survey, 90% of respondents were under 34 years old and 43.5% were between 18 and 24 years old. They also reported a preference for web apps, with 77% stating these were their favorite hacking target. So what motivates hackers to hunt for bugs?

Can EdgeConneX Disrupt Incumbent Data Center Providers?

In 2016, EdgeConneX has now upped the ante by rolling out high-speed on-ramps for Amazon Web Services, Microsoft Azure and Google Cloud. This nascent cloud initiative is already active in Portland and Boston in conjunction with connectivity partner Megaport. Notably, EdgeConneX has also provided the first AWS Direct Connect physical location to serve the Portland market. Access to the Big Three cloud providers is also available in Detroit, where EdgeConneX has partnered with Console to provide scalable, private, direct connections for customers. EdgeConneX also offers colocation space for managed services companies and system integrators which can facilitate enterprise hybrid cloud deployments at these cloud-enabled locations.

To the cloud, big data sisters and brothers, to the cloud

It's clear then that data ingestion is a major part of cloud-based analytics, as network latency is added to the inherent computational and I/O cost associated with ETL and/or data mapping and integration. Recently IBM claimed to be the fastest around in data ingestion, but revealing very little to substantiate this. So is this an anything goes, mine is better than yours game? Architectural blueprints, standards, and benchmarks might help clients have a better picture of the oversubscribed data infrastructure and analytics landscape and contribute towards fair comparisons, so one might wonder why don't we see more vendors publishing benchmark results for example. Snowflake's take is that this is not really due to marketing taking precedence over architecture, but more due to benchmarks not being able to catch up with the explosion in the use case diversity and cloud flexibility.

Cloud computing's true value can't be measured in dollars

The problem is companies consider IT an overhead expense with little to no strategic importance. Thus, success is measured in terms of how much money the company can save in IT operations, not how much money IT can make for the company. That's a huge mistake. I can list hundreds of companies that work with IT to their strategic advantage, including Uber, Airbnb, and nearly all travel aggregators such as Kayak.com. Note: These are not Global 2000 companies that have their heads back in the 1980s. Instead, they're new names willing to take a fresh view of business IT to reap new benefits. According to the report, “Gartner estimates, as cited by CompTIA, indicate that the public cloud services market will grow to $204 billion in global revenue this year -- a 16.5 percent increase over $175 billion in 2015.”

Most Organizations Lack Confidence In Their Data Security Measures

“When it comes to managing a data breach, having a response plan is simply not the same as being prepared,” says Michael Bruemmer, vice president at Experian Data Breach Resolution. “Unfortunately many companies are simply checking the box on this security tactic. Developing a plan is the first step, but preparedness must be considered an ongoing process, with regular reviews of the plan and practice drills.” Bruemmer says the lack of planning is especially troublesome when considering the rise of new threats, such as ransomware. “In fact, the study showed that 56 percent of surveyed organizations are not confident that they could deal with a ransomware incident. Additionally, only 9 percent of survey respondents have determined under what circumstances they would pay to resolve a ransomware incident,” Bruemmer noted.

Cyber Risk Costs Not Big Enough to Spur Investment by Businesses

“If it is true that on average that businesses lose 5 percent of their annual revenue to fraud, and that the cost of a cyber event represents only 0.4 percent of a firm’s revenues, then one may conclude that these hacks, attacks and careless behaviors represent a small fraction of the costs that firms face, and therefore only a small portion of the cost of doing business,” Romanosky said. Given that finding — and surveys that indicate consumers are mostly satisfied with the ways companies respond to data breaches — he says that businesses “lack a strong incentive to increase their investment in data security and privacy protection.” Moreover, if their losses are not out of line with other costs, he said, “maybe the firms are already doing the right thing,” making government policies to induce more precautions unnecessary.

Quote for the day:

"Nobody can go back and start a new beginning, but anyone can start today and make a new ending." -- Maria Robinson,

October 06, 2016

EU privacy watchdogs have questions about Yahoo's secret email scanning

Caspar, one of the more outspoken of Germany's regional data protection commissioners, pointed out that, thanks to former National Security Agency contractor Edward Snowden's revelations, we've known for some time that big U.S. internet companies were obliged to give their user data to the country's security services. "The suspicion that Yahoo has actively assisted to scan mails of their users as a henchman of the NSA is not really surprising regarding the information of the PRISM program. On the other hand it goes far beyond what is acceptable," Caspar said. He wants to know what really happened at Yahoo, too. "There has to be a clear and fast examination of these allegations by the competent data protection authority," he said.

Secure Docker on Linux or Windows platforms

Linux alone cannot secure Docker. On the contrary, when administrators allow a subset of end users access to the Docker daemon, they are implicitly granted root access. Therefore, use great caution when granting access. Within the context of Docker, when an end user accesses the daemon, the user could alter the host machine's file system, even without intending to do so. When the developers, IT team or business leaders decide to utilize Docker containers, systems administrators should take comfort in the fact that some of their usual burden is eased by Docker's cross-platform portability. However, admins cannot ignore that the cross-platform nature of Docker containers also gives rise to various other issues, not the least of which is security.

The Big Data Challenge: Getting from Data to Decisions in the Era of IoT

The Internet of Things (IoT) already has enabled connectivity in billions of devices – from thermostats to cars to wearables. But there is a new stumbling block on the horizon. Sensors are now spreading across almost every industry, triggering a massive onslaught of new data that will clearly lead us into the next era of the information age. This reality presents both an opportunity and a challenge. On the upside, many believe that big data will unleash new opportunities for businesses, support decision-making, and lead to the development of new products and services. The question is how to get from data to decisions on a massive scale. After all, the value in big data lies in our ability to analyze and make sense of the information, and as the IoT expands many fear big data will simply become too big, too fast, or too hard for existing tools to process, analyze, and convert into insights.

The need for updated technology

Data play a large role in successful revenue management today. The airline industry has moved to a retailing mindset, and to properly attract and retain today's customers and competitive nuances, airlines need data in the form of proactive, actionable information. Traditional revenue-management systems have relied on a batch-based, processing methodology and predefined data-processing intervals. However, airlines need to be aware of market and competitive changes as they occur. Markets evolve dynamically, not at preset intervals. One of the greatest influences on the success of an airline's business and competitive standing in the market is the ability to understand who is traveling across its network and how much each passenger spends across all revenue streams.

Research Reveals Why Hacked Patient Records Are So Valuable

Typically after a health record hack, the data will "go dark" for some time before resurfacing in different variations, he says. "So, it will look like basic short-form ID theft material, but eventually the electronic health record will surface as a 'fullz' - the slang term on the deep web [for] a complete long-form document [containing] of all the intricacies of a person's health history, preferred pharmacy, literally everything," he says. "What happens is the people who purchase those [fullz] then go to another vendor on the deep web for what's called 'dox,' the slang term for documentation, where they then proceed to have passports, drivers' licenses, Social Security cards - all these things that will help the counterfeit imitation of the victim. ..., and once it's an identity kit, you can sell it for $1,500 to $2,000."

Samarth Shekhar of FinTech Forum: „Banks can’t generate innovations on their own“

We have been fortunate to be the first-movers in the FinTech space in Continental Europe, giving us the chance to build relationships with founders early, as well as giving us visibility on the global stage. Our eleven events since 2013 have brought together nearly 200 startups with over 450 investors and corporations. Over one-third of the FinTech funding rounds in 2015 involved alumni of FinTech Forum. This was also the first year when German FinTech funding overtook the UK. To give you a comparison: As of 2013, Germany’s share of FinTech investments was less than $60 million, versus UK’s $3.2 billion! We have been invited to present the German FinTech scene at leading global events like Innotribe/SIBOS (Boston, 2014),

8 challenges that keep financial services CTOs and CIOs up at night

“Security is the thing that keeps me up at night,” says Michael Thorne, CTO at Bristlecone Holdings. “Nothing else compares. It is never done. The minute you think you're secure, you're at risk again. Being on top of it is nearly impossible. To gain some traction though, I make sure I'm following what's happening with data security and understand the flaws exposed, I stay up to date on developing tech, and, most importantly, I share information among my peers in groups that promote shared insights to enhance security across the board.” ... The challenge for financial services CIOs and CTOs is to “figure out how to update and proactively maintain infrastructures in order to mitigate security risks and keep adversaries at bay during a time when boards of directors are asking IT to further cut budgets to help meet ROE targets”

Are you encouraging your employees to take security risks?

In the information security world, the not so carefully guarded little secret is that conforming to security rules reduces productivity. I might claim that everyone could follow safe security practices and continue to be as productive as they would without following them, but this would be dishonest In fact, following the rules will definitely impact productivity to a varying degree. As an example, we tell our employees to be cautious about clicking on links in email, but then we press them to finish work that relies on links sent via email. We may also require them to research topics, while blocking a large number of websites for security reasons.

Proper Usage of Metrics with Flow Debt as an Example

Flow debt is incurred when Lead Time defined as (Completed Date – Started Date) is artificially reduced for some work items in progress by “borrowing” Lead Time from other work items in progress. The term was coined by Daniel Vacanti in his excellent book Actionable Agile Metrics for Predictability: An Introduction. Here is a flow debt example. Let’s say we have only one work item in progress. If we start another work item before finishing the first one, then we will have two in progress. If we finish the second work item before the first one, then we have incurred flow debt. ... One way to calculate Flow Debt for a given reporting interval is:Flow Debt = The Approximate Average Lead Time (as predicted by the CFD) minus the exact average Lead Time for the items that finished.

Chief risk officers ‘must change course’ to avert another economic crash

Ever more complex financial products, growing technical automation and a narrow focus on regulatory box-ticking could be the perfect storm for banks to lose control of their decision-making processes and potentially wreak havoc on the financial system, warns Dr. Colin Lawrence, partner and managing director of financial services at Parker Fitzgerald. A thirty-year veteran of the financial risk management arena, Lawrence believes CROs need to move far beyond conducting measurement, and start driving strategic change. “Risk officers often don’t have the full picture and don’t know the core risks,” he told delegates at Bloomberg’s recent Risk Day 2016 in London.

Quote for the day:

"Optimism is the faith that leads to achievement; nothing can be done without hope." -- Helen Keller,

October 05, 2016

Github’s Phil Haack on Moving from Engineering to Management

It’s important to be able to take an evidential approach to identifying the practices and approaches that work for collaborative outcomes, however there is not a lot of research in these areas. Take what research we do have and try it out – does it really work or is it just “conventional wisdom” that may not actually apply in the development space? ... Sane Development Practices: techniques like setting up a build environment that just works – download the project and hit F5 to have it build without having to configure many different things before you can even do the simplest activity. If you clone a repository there should only be a couple of steps needed to have it running on your machine. ... Having things like automated builds and continuous integration are about helping developers maintain their sanity.

Beyond Dashboards – Predictive Analytics and Decision Management

The first and most obvious benefit provided by the combination of decision management and predictive analytics is the collaboration inherently resulting from the former. No longer are we dependent on the mad data scientist in a white lab coat! Now every concerned group – business analyst, IT, business owner and the data scientists can all view, understand and work with the same information. This removes the ubiquitous black box and enables truly effective data governance. But let’s face it – what we really want most of all is to create something actionable from all that data. We know more and more of it will be coming in real time. By beginning to incorporate additional elements of decision management while collaborating across all stakeholders, we can create (or significantly enhance) the ability to:

Malaysia and Singapore face IT talent shortage

Randstad’s ranking of the most popular tech jobs in Singapore shows cyber security and technology risk professionals being in highest demand, with the potential to earn S$120,000 (£69,000) to S$240,000 a year. Project management and business analysts are ranked next highest. Their functional knowledge and in-depth technical know-how are in demand as organisations seek to become more lean and cost-effective. Randstad ranked application developers as third most in demand, due to Singapore being an attractive hub for companies setting up centres of excellence. Demand for experienced developers exceeds supply in the country due to a lack of experienced developers and an influx of startups.

The Data Science Hierarchy of Needs

The urgency to establish a big data strategy propels companies into the third step of diving into infrastructure without a clear directive. You start with installing Hadoop, maybe some Kerberos and SSO for security, even a NoSQL Database just for fun. However, if you start with the business problem, you may find that you don’t need any new infrastructure or complex machine learning at all. A good rule of thumb is to employ the YAGNI (You Ain’t Gonna Need It) principle from agile programming. Start by doing the simplest thing that could possibly work. A lot of problems can be solved by smart people armed with modest data and tools designed with the business in mind, before ever requiring a big data infrastructure.

7 ways DevOps benefits security programs

Organizational culture and its processes and technology are evolving at a pace we have never experienced before. As a result, we can’t just sit back and wait for the “DevOps fad” to fade away because it isn’t going to. It’s not a fad – it’s an evolved way of software development. Furthermore, security cannot be the elephant in the room that everyone avoids because it gets too complicated. Security must evolve, as well, segueing into SecDevOps. Many organizations are regularly pushing out tens if not hundreds of releases and updates on a daily basis. With help and guidance from the security team, organizations can push secure releases on the first try and save lots of money and time along the way. Checkmarx explains why DevOps can end up being a major benefit to security.

2016 State of Digital Transformation

When everyone and everything is connected to the Internet, companies must leverage information and digital technologies including cloud computing, mobile, social, Internet of Things (IoT) and AI to transform how they connect with customers in a whole new way. Per Gartner, 89% of marketers expect to compete primarily on the basis of customer experience. Customer experience is a top priority and managed as a team sport. Digital business transformation will require an experimental and technology-led mindset that must be inclusive of the entire business - marketing, sales, services, IT, R&D and customer and partner communities. How can companies today leveraging technology to drive digital business transformation?

Google Home: What it does and when you can get one

Google Home has a built-in edge when it's time to ask the speaker a question...Google Assistant. Take the speaker's My Day feature. Tell Google Home "Good morning," and it will launch in with today's weather and information about your commute. It will also tell you about upcoming appointments you've got scheduled for the day and list any reminders...Google Assistant is pulling all this information from your Gmail, calendar and other Google Maps. ... Google Home...will go on sale Nov. 4 for $129...The purchase price also comes with a free six-month trial of YouTube Red, an ad-free version of the video sharing service. ... Google Home is coming to the U.S. only at first, and will be sold in the online Google Play Store...Target, Walmart and Best Buy; Google starts taking preorders Tuesday.

How today’s CIOs are getting sales cycles ‘Back in Black’

"The job of a CIO has changed," said Gainsight CEO Nick Mehta, whose company helps sales organizations deliver customer success through big data. "Server design has been replaced with service delivery." As CIOs are now accountable to business users, they demand results — not products — from their vendors. Modern CIOs are asking vendors about their business process — often called their "customer success" process — to ensure that they are achieving their desired outcomes from the business relationships. "It's all about the outcome," Mehta said. To accomplish this, vendors need to get business users and CIOs talking to one another to make sure it's a good fit for everyone.

Putting the pieces together: The intersection of strategy and agility

Generally speaking, strategic responsiveness increases with the frequency of corporate strategic-planning activities. Most of the survey respondents use an annual planning cycle. However, organizations that conduct either continuous or annual planning with quarterly rolling plans have the highest level of strategic responsiveness. Though ongoing corporate planning has the highest level of strategic responsiveness, there is negligible improvement between ongoing planning and using an annual planning with quarterly rolling plans. Organizations that use an annual planning cycle with quarterly rolling plans have the ability to balance long- and short-term goals and ensure a structured method to review changes in the external business environment and incorporate them in the strategy as needed

By 2020, your Wi-Fi-connected car will pay for parking, gas

"Connected vehicles will streamline many of the processes currently in use in the businesses. For example, a rental car could be provisioned remotely, allowing the customer to pick it up and drop it off without having to go to an office," said James Hines, a research director at Gartner and the report's author. "They will also enable new modes of operation; for example, when combined with autonomous driving capability, connected vehicle technology will allow a customer to request a ride and a vehicle could be automatically dispatched to the customer’s location." Connected vehicles will improve access to EV charging by locating available stations and paying for charging services; they'll also be able to monitor the state of charge of the battery in the vehicle, Hines said.

Quote for the day:

"A man must be big enough to admit his mistakes, smart enough to profit from them, and strong enough to correct them." -- John C. Maxwell

October 04, 2016

How Big Data Velocity Informs Population Health, Patient Safety

“You may have a patient surveillance system that requires really large datasets to monitor their vitals and maybe do some predictive analytics about how they’re trending, and that requires immediate, truly real-time insights for the patient while they are still in your care setting.” But population health management prioritizes different metrics and aims to achieve somewhat different results, he added. “Population health is about identifying groups of patients and figuring out a commonality around their needs. After you identify a common need, you redesign care around delivering that service or improving that outcome.” Population health programs also tend to generate large volumes of data that is often used to track improvements over time.

New alliances focus on open-source, data science empowerment

Continuum Analytics, the creator and driving force behind Anaconda — a leading open data science platform powered by Python — has allied with IBM to advance open-source analytics for the enterprise. Data scientists and data engineers in open-source communities can now embrace Python and R to develop analytic and machine learning models in the Spark environment through its integration with IBM’s DataWorks Project. ... This program empowers corporations to better understand, use and maximize the value of their data. The program will support IBM’s DataFirst Method, a methodology that IBM says provides the strategy, expertise and game plan to help ensure enterprise customers’ succeed on their journey to become a data-driven business.

Core systems should have built-in obsolescence

The issue is that this mentality of the “big deal” still pervades for many senior bank decision-makers, yet today it’s no big deal. If a startup can get a full suite of banking software up and running like Ant Financial, Solaris, Thought Machine, PrivatBank and more, then you know the answer today is all about speed and agility at low-cost. There’s no big deal here. In fact, as alluded to in an earlier blog, if you can build a developer-driven bank where a micro-services architecture allows very small teams to change little parts of the architecture continually, then you have a bank built for today – a bank that can provide updates for its apps and APIs every day (or even intraday), rather than every year or even biannually.

The Challenges Fintech Startup Companies Are Facing

Behind every successful fintech firm, there is an agile and well-diversified team of forward-thinkers. Since startup companies operate with limited resources, every employee counts. Therefore, it is imperative to have employees with a combination of experience and relevant skills for fintech companies. Even if you find skilled individuals, they will most likely ask higher wages because their opportunity cost is very high. ... Unless one is speaking to a financially and technologically savvy investor, it’s often difficult for startups companies to describe the value proposition and more explanation is needed than in other industries. Therefore, fintech companies are required to know their products and to have efficient ways to tell their story for anyone to understand.

Yahoo hack spurs push for legislation

The Yahoo breach has drawn particular attention not only for its size — 500 million accounts were exposed by hackers Yahoo says were nation state actors — but for the time the company took to notify victims. The breach occurred in 2014, with Yahoo only announcing it this month. But reports indicate that the company may have been aware of the hack in July or August of this year. The timing of the disclosure drew swift criticism from lawmakers who suggested that the company might have sat on the breach to avoid disrupting a purchase deal with Verizon. “As law enforcement and regulators examine this incident, they should investigate whether Yahoo may have concealed its knowledge of this breach in order to artificially bolster its valuation in its pending acquisition by Verizon,” Sen. Richard Blumenthal

3 survival skills for reluctant IT managers

Systems programmers and database administrators in large shops earn six-figure incomes. They earned these incomes by polishing their skills in a particular technical specialty, and by mastering tools that have proven their worth over time and that they trust. Their career calling cards are their expertise and their ability to use these tools to solve difficult problems, so they are not always open to new tools and technologies that challenge the tools and approaches that they cut their teeth on. If you are considering a new approach or vendor toolset, it is really important to obtain staff buy-in before moving forward. If you can't get buy-in, and you and the company have determined that it's absolutely necessary to move forward, you should be prepared to lose people.

What CIOs Need To Know About Open Source

"At one extreme, forking is one of the fundamental rights you have with open source code and we talk about how great it is to have the freedom to fork — it can be a good way to revive a dying project," says Allison Randal, president of the Open Source Initiative. As an example, Randal points out that before the LibreOffice fork, OpenOffice.org was suffering from "human problems" that prevented the code from moving forward. The LibreOffice fork was successful and now has overshadowed OpenOffice.org. Unfortunately, forking doesn't always produce such a positive outcome. "I have seen cases when forking a project divides the community, introduces tensions, cuts resources and ultimately kills both projects," Randal says.

Attacks Are Advancing; Are Your Threat Detection and Response Capabilities?

Many organizations rely on traditional SIEMs to store data and run simple, real-time, rules-based analytics. This works for providing insights into activities at a point in time, but most attacks are more subtle and may unfold over weeks or even months. The ability to consider more and varied data types over a longer period of time offers richer insight as to who the attacker was, what malicious activities were performed, and how to remediate the threat. Newer big data platforms overcome the limitations of traditional SIEMs and provide the ability to keep up with the volume, velocity, and variety of data while conducting more sophisticated statistical and machine learning analytics.

Transactional Microservices Using Aggregates, Event Sourcing and CQRS

It is an approach to modularity that functionally decomposes an application into a set of services. It enables teams developing large, complex applications to deliver better software faster. They can adopt new technology more easily since they can implement each service with the latest and most appropriate technology stack. The microservices architecture also improves an application’s scalability by enabling each service to be deployed on the optimal hardware. Microservices are not, however, a silver bullet. In particular, domain models, transactions and queries are surprisingly resistant to functional decomposition. As a result, developing transactional business applications using the microservice architecture is challenging.

Mobile is part of e-commerce, not a rival

Mobile devices are at the heart of merged channel because those handheld computers — and, yes, mobile phones are computers — make any other compensation approach ridiculous. How, for example, is a Macy's in-store-versus-online mentality supposed to deal with someone scanning a barcode in-store with a mobile device and then purchasing it from Macys.com? No need to worry about which division gets what percentage of the sale. It's a Macy's purchase and that's that. The point is to look at purchases from the shopper's perspective. That is what retailers tell their shareholders, right? That they are so customer-centric? Shoppers see it as a Kohl's transaction or a Walmart purchase.

Quote for the day:

"Even if you are doing robust risk assessments, between that and human error, breaches will happen."

-- Pam Hepp

October 03, 2016

Body-based transmission system keeps passwords secure

The system works by making use of the low-frequency signals generated by a smartphone's fingerprint sensor that locate the finger's position in space and read the grooves in a user's fingerprint using capacitive coupling. Registering between 2 and 10 MHz, these signals aren't strong enough to travel through the air, but do travel through the human body well. Usually read by the sensors as input, the UW team's technique turns these signals into output containing the authentication data, which is then transmitted through the body and picked up by a receiver, such as the electronic door handle. "Fingerprint sensors have so far been used as an input device," says senior author Shyam Gollakota. "What is cool is that we've shown for the first time that fingerprint sensors can be re-purposed to send out information that is confined to the body."

Evaluating customer engagement cloud solutions: Key questions to ask

It’s important to note that it’s not enough to move monolithic applications to public cloud infrastructures. To truly deliver on the promise of the cloud, applications must be developed from scratch (or re-written) to take full advantage of advanced infrastructure and platform-as-a-service capabilities—similar to writing a brand new operating system with unique characteristics. Thus, be careful not to get stuck with the old stuff in the new world. You’ll be left with more of the same. Whether you’re experiencing exponential growth like a hot new startup or are a more traditional business going digital, make sure you select a cloud customer engagement and business communications solution designed for the future.

Rise of the SPI: Atlassian spin or a better variation of the API?

SPI originated when Atlassian was a young company and had only a single product, JIRA. As a young company wanting to scale, the company released its source code for others to hack on and build their own features. Over time, some of these developments were included back up the chain and made part of the core product. Initially, this was achieved through the use of Java applets. Developers coded against a Java API that would modify the core application code without forking the source code. Over time, this approach was adopted into Atlassian’s other products, and, almost randomly, a partner ecosystem grew around it. From this ecosystem, the company then built the Atlasssian marketplace, which allowed third-party software vendors to build and market products.

The Biggest Risks of Big Data

Any project can fail for any number of reasons - bad management, under-budgeting or a lack of relevant skills. However Big Data projects, due to their nature, bring their own specific risks. Due to the advanced technology often needed, and the relative newness of the skillsets required to truly “think Big” (or as I prefer to say, “think Smart”) with data, care must be taken at every step to ensure you don’t stumble into pitfalls which could lead to wasted time and money, or even legal hot water! Business people are used to taking risks – assessing those risks and safeguarding against them comes naturally, or we don’t stay in business for long! So there’s no need to be scared of Big Data. But of course we always need to be aware of dangers that could potentially arise if we fail to cover all of the bases.

Consortium Forms Framework for Industrial Cybersecurity

"The Security Framework looks at IIoT security from three different perspectives," Hamed Soroush, the IIC's security working group chair, told EE Times in an interview. "Chip makers, equipment developers, and end users all have an important role in security for the IIoT, but often work without knowing one another's perspectives. The Framework will help them talk to each other." It also provides guidance to management on risk management when considering security, he added. Part of the motivation for creating the Framework is the difference between industrial IoT and consumer IoT security needs, Soroush noted, which calls for a discussion focused on industrial IoT system needs. Security in the industrial IoT should be more robust than for consumer IoT, for instance, to reduce the risks to critical infrastructure such as power generation.

How Microsoft Cortana will run your entire office by 2020

Cortana will take over for Tell Me someday. You’ll talk to the bot and tell her you want to create a presentation for the shareholder meeting or a brochure for your startup. Like MyAnalytics, she’ll know you have been working in Excel the past few days and offer to create some of the slides with your financial data. You’ll dictate the bullet points. She’ll know to use a color scheme that matches your company logo. She’ll even know how to correct your wording, a capability that is already in Microsoft Word called the Editor. Cortana will know if you are talking in passive voice and correct your wording on the fly. She’ll fact check what you say, and offer to use stronger verbs.

Killer Keyboard Shortcuts To Help You Master Windows

Despite notable advancements in speech-recognition technology and voice input, and the popularity of tablets, the humble PC continues to be the workhorse device of choice for many workers around the world. And whether you're an office-bound professional slouched behind a desktop PC, or a globetrotting executives armed with the latest ultrabook, the "physical" hardware keyboard continues to play a crucial role in productivity. The last thing you want in the heat of the moment is to fumble around for a mouse or have to take multiple steps to complete a task that could be done with a quick keyboard shortcut. Of course, learning and remembering such shortcuts can be hard work, and you'll need to take some time to find the appropriate shortcuts for you.

What makes IoT ransomware a different and more dangerous threat?

“While traditional ransomware affects your computer and locks your files, IoT ransomware has the opportunity to control systems in the real world, beyond just the computer,” says Neil Cawse, CEO at Geotab, a manufacturer of IoT and telematics for vehicles. “In fact, due to the many practical applications of IoT technology, its ransomware can shut down vehicles, turn off power, or even stop production lines. This potential to cause far more damage means that the potential for hackers can charge much more, ultimately making it an appealing market for them to explore.” Some argue that in most cases, IoT hacks can be reversed with a simple device reset. However, the incentive to pay for IoT ransomware will not stem from irreversibility but rather from the timeliness of the attack and the criticality and potential losses of losing access to critical devices for any amount of time.

Largest DDoS attack ever delivered by botnet of hijacked IoT devices

Some of the attacking machines are running clients known to run on cameras, he says. “It’s possible they are faking it or it’s possible it’s a camera that was doing these attacks,” he says. “There are indicators that there are IoT devices here, at scale” The attack didn’t use reflection or amplification, so all the traffic consisted of legitimate http requests to overwhelm Krebs’s site, Ellis says. “It’s not junk traffic.” A lot of things about the attack are still unknown such as who’s behind it and what method the botmasters used to infect the individual bots. Ellis says some other providers Akamai had contacted report similar but smaller attacks likely from the same botnet. Many of them were aimed toward gaming sites, and Krebs has written about such attacks, so there may be a connection there, he says.

Conduct an honest IT performance evaluation in problem areas

A good first step for IT performance measurement is to at least somewhat follow either a DevOps methodology or ITIL; both have their merits and each team or business needs to decide what fits them best. Some measures to improve IT will line up with DevOps and others won't, but are best practices that solve these issues. When reviewing a failure, consider whether the fault occurred in the project, due to a change, or in the IT operation. Each need to be treated a bit differently, but will also have overlaps with how it is assessed and remediated during the IT performance evaluation.

Quote for the day:

"Opportunities don't happen. You create them." -- Chris Grosser

October 02, 2016

Standardizing Requirements Descriptions on Scrum Projects for Better Quality

The direct impact of standardizing requirements descriptions on development can be seen in the example of a large social media company that owns several popular websites used by millions. A rapidly developing Agile project, with high reaching market goals set by stakeholders, existing documentation was narrowed down to information that served users and ongoing development purposes. The stakeholders were not interested in investing in the creation and support of hundreds of pages of documentation, which would have made sense and is common practice for most Agile projects. The client already had their own development team and many ambitious plans, but needed more resources to implement them.

Will the coming robot nanny era turn us into technophiles?

Despite the thorniness of some of the issues between humans and robots, the reason we are entering this robot age is because of one simple fact: functionality. Robots will make our lives far easier. In fact, the robot nanny is a prime example: It will be adored by parents — and likely much more so than the human nannies who are known to call in sick, show up to work late and, on occasion, sue their employers when they hurt themselves on the job. Robot nannies will replace real nannies like the automobile replaced the horse and cart — allowing parents much new free time and opportunity to pursue careers. One major factor going for the development of robot nannies is their cost effectiveness. I’ve been either watching my kids or hiring nannies for the last five years.

Dear tech industry: Stop renaming stuff all the time. Just. Stop. It.

G Suite is the new name of Google Apps. Except Google Cloud is the new name for Google for Work (which is Google Apps, but for more people) and Google Apps, Enterprise, which had a comma in its name. Okay. Okay. Deep breath. Get off my lawn! No. wait. This isn't a get off my lawn moment. This isn't just whining on the part of a tech pundit who doesn't want to remember new names anymore. I got this. I read 50 tech news articles every morning. I can keep track of this because it's my job, and we have an editorial guide here at ZDNet. But regular users don't have the time for this crap. Renaming core products has serious repercussions beyond merely my desire to rant.

Retail cloud computing: The key benefits of moving to cloud-based SCM

The fact is, customers expect to be able to make purchases from whatever channel they choose in a fast, efficient manner. To make this happen, retailers are increasingly working to update traditional supply chain management (SCM) systems by embracing retail cloud computing. By using cloud-based SCM technologies and services, retailers can gain visibility and track inventory throughout the entire lifecycle, allowing them to ultimately become more agile, profitable and relevant to today’s tech-savvy and increasingly demanding consumers. Though traditional SCM platforms take a more siloed and transactional approach to the entire fulfillment lifecycle, this method no longer works in an omnichannel, hyperconnected world.

Banks like to talk about blockchain, but none wants to be the first to actually use it

If it becomes mainstream, proponents see many possibilities for blockchain. Instead of each party in a transaction keeping separate records and copies of contracts, blockchain is a bit like a Google document, where many people can look at the same record at once. The transaction takes place between two parties without an intermediary, and all changes are clear, unchangeable, and validated by everyone involved. Any additional transactions that take place get added to the chain and form part of a golden record of transactions. This opens up the possibility of what the industry calls "smart contracts." For example, let's say shoes are being manufactured in China for sale in the US. Every step of the process could be part of a blockchain.

Silicon Valley Selects Synereo Over Ethereum As Blockchain Platform

With this recent partnership Synereo is likely to catapult in the blockchain discussion and attract many of the top dApp developers. James Currier, Managing Partner at NFX, explained the Guild’s decision to choose Synereo’s technology for the project, stating: “If you do the analysis, Synereo comes out as the superior platform for developing decentralized apps. It runs fully distributed instead of massively replicated. It’s JVM top to bottom rather than Python. It’s forward compatible, vs other platforms anticipating multiple hard- forks. Synereo has the identity layer built in which provides distribution advantages and network effects. Lastly, fine-grained concurrency, vs other platforms’ linearity, provides greater speeds and scalability”

.Net application that works online and offline [Smart Client Concept]

In windows application, we are going to log in with same credentials which we have registered in web application and while we are logging for the first time in windows application we need an Internet connection to that you can also login into the application while the application is offline. After Successful login, a new form is shown in which User is going to add new product and while doing this process we do not require an internet connection. When an internet connection is available it will sync all data from windows application to web application [web server] and this process will run in background. Meanwhile it is transferring all data to the web server it will also delete that data from windows application database which is transferred.

Ways to Make Code Reviews More Effective

As with all architecture/design areas, the non-functional requirements for the performance of a system should have been set upfront. Whether you’re working on a low-latency trading system which has to respond in nanoseconds or you’re writing a phone app to manage a “To Do” list, you should have some idea of what’s considered “too slow.” Before deciding on whether we need to undertake code reviews based on performance, we should ask ourselves a few questions about what our requirements are. Although some applications really do need to consider how every millisecond is spent, for most applications there’s limited value spending hours agonizing over optimizations that will save you a few CPU cycles. But there are things a reviewer can check for in order to ensure that the code doesn’t suffer from common avoidable performance pitfalls.

Goldman Sachs: We're in the 'second wave' of fintech

Gido believes that we are currently in the second wave of fintech development, wherein "incumbents are using their brands and infrastructure to remain competitive with the startups." ... This third wave in fact, is already happening. An increasing number of fintech startups are focusing on B2B models, with the goal of selling to and partnering with traditional players. They want to take advantage of incumbents' vast and loyal customer base and offer up their own nimble, innovative technology. And what are people most excited about in fintech? Insurance policies, he said. These seemingly unexciting two words hold a ton of possibility for innovation.

One proven way to boost software quality: Increase your QA team's diversity

Diversity is not just about hiring equal shares of male, female, black, white, Asian, and Hispanic professionals. Real, meaningful diversity requires a collection of individuals with unique perspectives based on their backgrounds, knowledge, past experiences. and environments. Diverse testers better understand diverse end users Your applications are supposed to work for a variety of users: young, old, new language learners, people with disabilities, etc. So who better to test them than people from a wide variety of backgrounds? What’s intuitive for a teenager may not be so easy for a person not as comfortable with today’s fast-changing digital realities. A recent college grad will look at her health care provider page differently than a parent researching ways to treat a child’s condition.

Quote for the day:

"Good leaders make people feel that they're at the very heart of things, not at the periphery." -- Warren Bennis

October 01, 2016

Too few women in cybersecurity: a gap in our protections that must be addressed

Diversity in cybersecurity matters for a very practical reason. Those seeking to breach cybersecurity are willing and able to exploit any flawed thinking, any inadvertent blind spot. Cybersecurity teams that fall into group-think or are blind to alternative ways of working through challenges are more likely to miss things and enable hostile actors. Teams that include people with different expertise, backgrounds, genders, ages, cultures are more likely to deliver robust cybersecurity outcomes; implicit assumptions can be more easily challenged and the fullest range of insights on what can go wrong (and hence what can be done) can be gathered.

How to steal the mind of an AI: Machine-learning models vulnerable to reverse engineering

Taking advantage of the fact that machine learning models allow input and may return predictions with percentages indicating confidence of correctness, the researchers demonstrate "simple, efficient attacks that extract target ML models with near-perfect fidelity for popular model classes including logistic regression, neural networks, and decision trees." That's a polite way of saying such models can be reverse engineered. The researchers tested their attack successfully on BigML and Amazon Machine Learning, both of which were told of the findings in February. In an email, Cornell Tech computer science professor Ari Juels, a coauthor of the paper, suggested mitigating these attacks could prove challenging. "Effective countermeasures to model extraction could well be possible, but this remains an open research question," he said.

How Blockchain can bolster interoperability and information security at the same time

Blockchain has potential value due to its shared, fixed record of peer-to-peer transactions, built from linked transaction blocks and stored in a digital ledger, Deloitte said. The network is both secure and actionable by relying on established cryptographic techniques, and letting participants in a network interact (e.g. store, exchange, and view information), without pre-existing trust between the parties. “Interactions with the blockchain become known to all participants and require verification by the network before information is added, enabling trustless collaboration between network participants while recording an immutable audit trail of all interactions,” Deloitte explained.

Industrial IoT leaders work towards interoperability and open source collaboration

GE and Bosch are working together to shape the connected world through a collaboration between the software divisions of both organizations, GE Digital and Bosch Software Innovations. The organizations have signed a memorandum of understanding where GE Digital and Bosch Software Innovations will further facilitate openness and growth of the Industrial Internet of Things (IoT). The agreement focuses on technology interoperability and platform integration through GE’s Predix operating system and the Bosch IoT Suite. GE Digital and Bosch Software Innovations intend to make complementary software services available on the other company’s cloud platforms to enhance the overall value of each cloud offering and provide solutions to a wider customer base.

Shaw says NHS is under frequent cyber attack

“We are seeing more and more ransomware attacks,” he said. This included one big, but unsuccessful, national level attack early this month which “may or may not have been state sponsored”. “It was big and it was hard and it was sustained... before, we didn’t know this sort of thing was happening until we got the worst outcome, but now we are in detect mode, rather than defence mode.” Shaw revealed a wide range of attacks were being made on the NHS, with some of these using well-known techniques such as spear phishing, in which hackers target an individual to inadvertently reveal useful information or spread malware. He said NHS Digital itself was successfully targeted in a spear phishing attack by a hacker pretending to be an old friend of one of its staff, using information from social media.

Tech Giants Team Up To Devise An Ethics Of Artificial Intelligence

The Partnership on AI announcement lays out an ambitious agenda for research to be conducted or funded by members, in partnership with academics, user group advocates, and industry experts. Topics on the research agenda include ethics, fairness, inclusivity, transparency, privacy, and interoperability. A recent white paper from IBM called "Learning to Trust Artificial Intelligence Systems" provides some hints as to what the Partnership on AI might be tracking. Authored by Guruduth Banavar, IBM's chief science officer for cognitive computing, it basically expands the concept of garbage-in/garbage-out to now include garbage in-between.

What to do when hackers break into your cloud

There are two major types of public cloud computing attacks: single-tenant and cross-tenant. A cross-tenant attack is the stuff of IT nightmares, but it has not yet occurred. Single-tenant breaches are more likely to occur. In these attacks, the hacker has compromised one or more machine instance, but can't go beyond that. The most likely cause of a single-tenant breach is that user IDs and passwords have been compromised. That's typically due to malware or phishing attacks on client devices. In this case, it's all on you; the cloud provider has done its job, but you haven't done yours. When such breaches occur, hopefully you'll figure it out quickly. When you recognize the breach, the best response is to invoke a prebuilt set of processes that can do the following

Task Force Tackles Healthcare Cybersecurity Challenges

According to Theresa Meadows, co-chair of the Health Care Industry Cybersecurity Task Force and CIO of Cook Children’s Health Care System, the panel’s 20 subject matter experts are drawn from a wide variety of organizations including providers, payers, pharmaceutical companies, medical device manufacturers, IT vendors, and government agencies. “We have representation from all the segments within healthcare so that we can have well-rounded discussions,” said Meadows. “There’s also a patient advocate on the task force.” Meadows said the task force has held several public and private meetings to date and will be “wrapping up its charge” early next year, after which it will report to Congress on its findings and recommendations.

An Open API Initiative Update

WebHooks can be tricky, but with the support we’ve been planning, a server designer can tell the consumer exactly what sort of signature they need to implement for successful handling of a WebHook, and even how the consumer can send messages back to the event producer with different response codes, so you can potentially describe the subscription, unsubscription, and retry flows, making the connections 100% automatable. Also, looking at representations and schemas; it may be a JSON world right now, but remember when the XML world would rule forever? We do, and getting more support for different schema formats is essential for the next 5-10 years of API design. Expect to see new and flexible techniques in 3.0 for this topic. Again, we’ll ensure that the final solution is implementable and not just a modeling proof-of-concept.

DNS Security Extensions - Complexities To Be Aware Of

Interoperability amongst the DNS software is another issue that is adding to the problems. Above all, attackers can abuse improperly configured DNSSEC domains to launch denial-of-service attacks. The following are some such major complexities that one should be aware of. .. This is an attractive target for attackers since it allows them to ‘amplify’ their reflection attacks. If a small volume of spoofed UDP DNSSEC requests is sent to nameservers, the victim will receive a large volume of reflected traffic. Sometimes this is enough to overwhelm the victim’s server, and cause a denial of service. Specifically, an attacker sends a corrupted network packet to a certain server that then reflects it back to the victim.

Quote for the day:

"The underlying principles of strategy are enduring, regardless of technology or the pace of change." -- Michael Porter