Daily Tech Digest by Kannan Subbiah

Daily Tech Digest - February 09, 2017

Hacking Is Here to Stay: 6 Steps to Protect Yourself

Today, hacking has evolved into a wide-ranging web of cybercrime that is hard to avoid, with perpetrators carrying out their misdeeds for a variety of motives – selling data for profit, hacktivism, stealing state secrets, and revenge against former employers or enemies. But make no mistake, the prime motive is profit. The cost of cybercrime will top $2 trillion by 2019, according to Juniper Research. ... Hacking is a fact of life and it’s only going to become more widespread. The sooner we accept that, the better we can defend ourselves. Pretending it doesn’t exist, that it’s somebody else’s problem or some technical genius somewhere will come up with a silver bullet against cybercrime is unrealistic and dangerous. Everyone has a responsibility to defend against cybercrime because it affects us all.

BankThink Rather than copy startups, banks need their own innovation model

We need to re-address how corporations are using the startup model for their own innovation efforts. As the last few years have seen inadequate responses from different types of accelerators (an outside entity that assists the corporate’s startup efforts) and incubators or innovation labs (that are owned by the corporate), we are re-entering testing mode with corporate innovation once again. Now is the time to create an optimal new approach. As with each in-vogue wave, there is preaching and swallowing without really understanding what something is, when to use it and how to really do it. In the application of lean startup, the emphasis has been on “build, measure, learn,” and this mantra has been used as justification to start with building an un-validated hypothesis (read: gut-feeling ideas not based on any customer insight, aka mud). The focus is on speed while customer research and learning is often lost from sight.

My expanded interests in technology for the wider world

In India, early-stage internet of things architectures were becoming apparent. Dot-matrix displays could be set up in small towns stating when the travelling doctor would visit next. Details of how to book an appointment could be included — a simple text message. The patient could then be sent reminders as the date became closer — cutting down on missed appointments and wasted time. All this seemed to get me noticed, and I was invited to become a Fellow of the Royal Society for the encouragement of Arts, Manufactures and Commerce (RSA). This 260-year-old institution works to enrich society through ideas and action. The RSA stands for everything I believe in. It is looking at how the world can be made into a better, fairer place; in how those who are the ‘haves’ can better help those who are the ‘have less.’

From automation to autonomy, IoT is powering Industry 4.0

While the technological components that make up the foundation of Industry 4.0 are many– robots, big data, augmented reality, cloud computing, cyber security, additive manufacturing, system integration etc., AIM explores how IoT is playing an important role in the fourth industrial revolution. Intelligent connectivity of devices has made is easy for objects to communicate in a way like never before. Not just at an individual level, but manufacturing companies are keenly implementing this intelligent connectivity of smart devices in factories and shops. By combining the physical, virtual, IT and cyber-system worlds, manufacturers are aiming to transform into “smart factory operators”, who can manage highly automated, connected equipment and analyse data provided by the systems. In other words, it is set to create a new working environment of integrated productivity between worker and machine.

Competing in the Age of Artificial Intelligence

The naked algorithms themselves are unlikely to provide an edge. Many of them are in the public domain, and businesses can access open-source software platforms, such as Google’s TensorFlow. OpenAI, a nonprofit organization started by Elon Musk and others, is making AI tools and research widely available. And many prominent AI researchers have insisted on retaining the right to publish their results when joining companies such as Baidu, Facebook, and Google. Rather than scrap traditional sources of competitive advantage, such as position and capability, AI reframes them. (See Exhibit 2.) Companies, then, need a fluid and dynamic view of their strengths. Positional advantage, for example, generally focuses on relatively static aspects that allow a company to win market share: proprietary assets, distribution networks, access to customers, and scale. These articles of faith have to be reimagined in the AI world.

6 big Business Intelligence trends of 2017

Knowledge is the hard part. It’s taking that data and turning it into something meaningful. It’s converting an avalanche of data into action-oriented insights. That’s the hard part. How do you turn data into knowledge? That’s where business intelligence (BI) comes into play. BI is the process of turning unusable data into actionable insights. When done correctly, BI will improve visibility, provide insights into customer behavior, improve efficiency, and so much more. How can you get the most out of your BI investment? I won’t get into the details here, as it’s a topic covered in a previous article. But, I would like to add one point: To truly get the most out of BI, it’s important that you stay ahead of the curve. The world of BI is constantly changing. New tools emerge. New trends take hold. If you can stay ahead of the curve, you’re better positioned to turn your data into knowledge–and a competitive advantage.

Why Your Company's First Line Of Cybersecurity Is Not Your CTO

Executives do not realize that a major threat to their company’s security is social engineering, which refers to the psychological manipulation of users who unknowingly divulge confidential information. Cybercriminals can use tricks to gain the confidence of company employees and partners. The goal is usually to execute a larger -- and more complex -- fraudulent transaction. The problem is not the use (or lack) of security tools and technology, but rather employees who are unknowingly the objects of security threats. The latest trick employed by criminals is to emulate executives within a company in a trusted environment. For example, an employee receives a legitimate-looking email from the CEO or CFO, instructing them to wire money. Before, employees used to be able to tell if the email was real, but today, employees are often duped by sophisticated hackers.

Why this company will help change the future of artificial intelligence

Elemental Cognition's technology seems to be aimed at the problem of going beyond the simple recognition/response models that dominate the A.I. landscape right now. I suspect Ferrucci is building out a technology that will combine outputs of deep learning and other machine-learning systems with the ability to draw inferences from, reason about and support decisions using the facts that they generate. I have faith in Ferrucci for a very specific reason: He is less a scientist and more an engineer. His history at IBM was one of building toward the solution rather than in service of a theory. He succeeded in building a system that leveraged existing technologies, but was built in such a way that it did the job at hand and did it exceedingly well.

IT And C- Level Leaders Point Fingers At Each Other Over Cyber Defense

Overall, the results show "an interesting disparity between the views of C-level respondents and those of IT decision makers," said Kevin Taylor, managing director at BAE. "Each group's understanding of the nature of cyber threats, and of the way they translate into business and technological risks, can be very different." ... The survey lends support to the opinions of other analysts who say C-level executives need to get more informed on cybersecurity threats. Tom Ridge, former secretary of Homeland Security, recently urged CEOs and corporate board to increase their level of cyber-risk awareness. "Cybersecurity is the most significant governance challenge for the public and private sector," Ridge said in a recent interview. "It's not just the exclusive domain of the CIO and CTO, and is now in the domain of the CEO and the corporate board."

The darkside of the internet of things: The security challenge

Overall, the cybersecurity industry is progressing with its R&D efforts in order to come up with solutions that will alleviate various security challenge pain points. If everyone involved is committed to fixing the problem, then developing new technologies with built-in security features will become the norm and the result will be a much safer IoT. With the emergence of software-defined technology, tight security protocols and encryption can be implemented at the fraction of the cost of hardware components. Vendors should consider de-commoditizing and coming up with a more differentiated product offering that, for example, includes security features. It’s obvious that these features come with a price tag. However, only when vendors translate these features into tangible benefits will consumers be prepared to pay a higher premium.

Quote for the day:

"For success, attitude is equally as important as ability." -- Harry F. Banks

Daily Tech Digest - February 08, 2017

Preventing Insider Threats from Affecting Health Data Security

Secure connections are also important. Any mobile users should not log in from unsecured wireless locations. Strong authentication measures will also be beneficial for healthcare organizations, ensuring that users are who they claim to be. Toward the end of 2016 the Office for Civil Rights (OCR) touched on this very issue, as healthcare will “usually use login passwords or passphrases to access information on public or private networks, internet portals, computers, medical devices, servers, and software applications.” A comprehensive, accurate, and thorough risk analysis for the entire organization is critical, according to OCR. This will help identify potential ePHI vulnerabilities and to identify any vulnerabilities in current authentication methods and practices.

IBM launches cognitive computing hardware unit

In many respects, a hardware unit tied to analytics and artificial intelligence is counterintuitive. After all, won't most of these workloads be handled in the cloud? Picciano said that analytics, cognitive computing and artificial intelligence will be consumed in multiple channels. "One thing I know is that our clients and data scientists are all experimenting and have initiatives," said Picciano. ... Part of IBM's cognitive play revolves around upending Intel's dominance. Picciano argues that IBM's optimized hardware approach will enable systems to better handle neural networks, deep learning and training systems to use inference. "This is the first inning of a longer game," said Picciano, who noted that a 10x improvement in training cycles is an early goal. "When you go to the edge of computing and IoT we want training cycles to be instantaneous with continuous inference and predictive recommendations."

Enterprise Intelligence Brief: Threat Hunting Takes Center Stage

Khalil Sehnaoui, founder and managing partner at Krypton Security, argued that “threat hunting is absolutely feasible and, even more so, definitely recommended.” He said that experts have been proactively pushing organizations to implement threat hunting strategies for years. “It is important because you cannot rely on just alerts and monitoring to know your network is either safe or under attack,” he said. “Alert systems can only monitor for known threats, and the best defense remains a good offense. Threats come in many a form and the battle is continuously ongoing between defenders and attackers.” Sehnaoui challenged companies to actively look for threats before the threats find them. “Just like information security researchers keep looking for new vulnerabilities and exploits, organizations should keep challenging themselves proactively instead of just waiting to react to a problem,” he said.

Use Application Delivery Technologies to Accelerate and Automate the Boring Tasks

The ADC can use programmed intelligence to adjust the application content by reordering components of the page to display the most relevant pieces first, adjust image size to provide a satisfactory visual experience while minimizing bandwidth consumption, and consolidate libraries and code to prevent the sending of duplicate content. If programmed with the appropriate intelligence, the ADC can even send content that is needed later while the user is viewing the content to make efficient use of the connection bandwidth and availability. ... Since it is likely that if products are selected that the user will go to a checkout page to order the items, the shopping cart and checkout components of the website can be loaded while the user is browsing the site.

Why Modern Data Integration? Core Drivers and Characteristics

Until recently, data integration solutions were tools only for tech-savvy teams. With modern data integration, business roles in organizations are taking more proactive participation in making sure that the right technologies are implemented. Vital data and the processes that produce it can better connect to business requirements and objectives. Organizations that recognize - and act on - the strategic value of data, also understand and embrace the need for technologies that get the most out of information and data, with continuous improvement and change. Another key driver for the emergence of modern data integration is simply the imperative of keeping up with everything data, every day. Data, information, and intelligence are the fuel for effective business processes throughout the organization – more of which must be handled in real-time.

How strategy is evolving—and staying the same—in the hypergrowth digital age

The one that’s almost obvious is Amazon. They completely disrupted the retail industry, not only with their vision of the supply chain that led to their massive success, but also with the ability to innovate. That’s the birth of AWS, Amazon Web Services. The one that may surprise you is the one that surprises me—institutions like Siemens. Siemens is more than a century old. It used to be machines, telephones, and manufacturing. Nowadays, it’s really high-tech medical instruments with big data providing preventive maintenance, with data lakes that analyze real-time data from the wind turbines to provide a flow of information and drastically reduce costs. It’s a business that has evolved as a massive conglomerate through wars and crises, and it’s still standing and strong.

Microsoft lays out the future direction for its .NET languages

C# is going to continue to pick up more complex features as it has throughout its history. Microsoft promises to "innovate aggressively, while being very careful to stay within the spirit of the language." It wants to make sure improvements benefit all or most developers, avoiding over-focusing on a given segment. C# 7.0 will gain integrated support for tuples and pattern matching syntax as its primary new features. As for Visual Basic 15, it will also gain some tuples support but not to the same degree as C#. Microsoft wants to keep Visual Basic approachable for new developers and focus on things like cross-language tooling experiences since many VB users also use C#. Microsoft admits this is a shift from the co-evolution strategy it laid out in 2010, where C# and VB were set on a "shared course."

Open Source Users: It's Time For Extreme Vetting

Fundamentally, what it comes down to is you need to understand where your software came from, which means in the open source context, you have to think of open source as a third-party vendor, which means who's paying attention to it? From an organizational perspective, you need either a team paying attention and taking care of this, or you need to find a vendor to work with who will be your representative here and will do all the heavy lifting in terms of vetting the software, understanding what's good, what's bad, keeping it updated, making sure you understand what that means. That's the piece that's missing today. There's lots of organizations that have developers that will go out, find what they need in the open source universe, pull it in, and then they don't think about it a second time. Obviously, if you do that, if you never update this stuff, eventually there's going to be some sort of problem that you have to deal with in the software.

Wearable AI Detects Tone Of Conversation To Make It Navigable (And Nicer) For All

Made possible in part by the Samsung Strategy and Innovation Center, the work centered on using both physical feedback and audio data to train AI for the task of analyzing, and recognizing, when conversations take a turn. Study participants were asked to tell "a happy or sad story of their own choosing" while the AI system, mounted in an experimental Samsung Simband, measured wearers' physical responses (such as heart rate, blood pressure, and temperature) and recorded audio and text transcripts to capture such elements as vocabulary, energy, and pitch. Based on 31 such conversations, researchers trained two algorithms to analyze the data for its overall "happy or sad" nature and to classify each five-second chunk of conversation as positive, neutral, or negative.

Survey Indicates 'Citizen Developer' Security, Data Risks

A key insight uncovered from Appian's research is that 75 percent believe an enterprise low-code platform is a solution to harness the energy of citizen application developers and alleviate the burden on IT departments. IT leaders surveyed cited operational efficiency (35 percent), data security (32 percent), and agility (32 percent) among the top benefits of low-code. and the bad: IT leaders state that citizen developers pose risks for data integrity (73 percent of respondents), security (69 percent of respondents), integration (58 percent of respondents with experience with citizen developed apps) and other aspects of enterprise business application development.

Quote for the day:

"A person with a new idea is a crank until the idea succeeds." -- Mark Twain

Daily Tech Digest - February 07, 2017

Tech stance against immigration ban aims to protect employees

Industry analysts say the companies could face similar criticism from Trump, but likely feel the need to defend themselves and their employees. "There could also be backlash if they did not participate, especially if a large number of other companies did," said Ezra Gottheil, an analyst with Technology Business Research. "I think this was a principled stand, but it is also a sound business move. All the populations these companies deal with are diverse - employees, prospective employees, customers, and partners. The U.S. being, and being seen as, hostile to refugees, immigrants, and people from other countries would impede their businesses." Judith Hurwitz, an analyst with Hurwitz & Associates, said many companies, particularly international businesses, may be feeling the strain of what the immigration ban could mean to them.

The Evolution of Phishing

Some of the most infamous cybercrimes over the last ten years — taking out retail chains, universities and even banks — started with a single user opening a spear phishing email. Where conventional phishing uses wide-scope attacks predicated on chance and opportunity, spear phishing is highly targeted. Technology research firm Vanson Bourne clocked the average financial impact of a successful spear phishing attack at $1.6 million. Using gathered knowledge and open-source intelligence (OSINT) feeds, threat actors craft personalised pretexts for small, select groups of employees. Because spear phishing emails are so distinctive, traditional reputation and spam filters often fail to detect the malicious content within. A spear phishing attack can also incorporate sender forgery, polymorphic URLs and drive-by downloads to circumvent common protections.

Internet Of Things Security Market To Hit Highest Growth By 2021

The global IoT security market is segmented on the basis of end-users as utilities, automobiles, and healthcare. Based on the software, IoT in utility market is segmented as security, analytics, smart grid management, operations control, Customer Information System (CIS), and predictive asset management. To ensure the efficient functioning of devices such as smartphones, tablets, and PDAs at the workplace, it is crucial to maintaining network infrastructure security. Moreover, traditional business models are being developed, as utilities are using emerging technologies for optimization of information flow, for improvement of asset performance, and to increase energy efficiency and ensure supply.

Why companies don't hack back

"The idea is that you make something in your network look so attractive that it becomes the focus for the attacker," Sirota said. Companies even create entirely fake servers to confuse an attacker. Active techniques, however, are where most people start to have objections, though they can be valuable, according to Herberger. Whether it's a DDoS attack, SQL injections or a brute force attack, those techniques can also be available to an attacked company. Active techniques center around companies taking action during the first disrupted session, not waiting for attackers to continue their attack. Organizations can identify an attackers application as a potential problem and "proactively make sure that application doesn't work," Herberger said.

How to protect your privacy with a VPN on Android

A VPN (Virtual Private Network) is basically a way to funnel all your web traffic through a remote server. This makes it look like you’re in a different location and obscures your real IP address. VPNs encrypt the traffic passing through them, making it harder for anyone else to listen in on your connection, even if you connect to an unsecured Wi-Fi network. Since your connection appears to be coming from a different area, you can access geo-restricted services like the BBC. Some of the more popular ones like Netflix and Hulu have gotten serious about blocking VPNs, though. It’s also important to note possible security issues with the VPN providers. They are getting access to all your traffic, after all. Some providers like Hola VPN have had security issues, so you should steer clear.

Critical DOD cybersecurity functions safe from hiring freeze

Officials who grant exemptions under the exempt functions section of the new DOD memo have to be ready to justify those choices on a position-by-position basis, according to the memo. Those officials are also going have to submit reports on a bi-weekly basis. According to the memo, “in addition to numeric metrics, reports will afford delegated officials the opportunity to provide narrative inputs assessing mission risk and readiness impacts of the hiring freeze.” It is unclear if the function exceptions to the freeze issued today would specifically exempt the National Security Agency, whose primary function is to provide intelligence. An NSA spokesperson told FedScoop via email the agency received notification of the order, and is “looking into the specifics of it and still working to determine any exemptions.”

What's keeping enterprises from using G Suite?

"The reality we've seen, we've seen better collaboration, better communication and frankly had better [employee] engagement," Ringman said. "We actually measure our engagement scores ... and have seen an increase in our engagement scores somewhat directly as well as indirectly due to our rollout of the Google G Suite." Businesses build entire workflows around Office products, and will often use macros to automate some of their work, said Patrick Moorhead, the founder and principal analyst at Moor Insights and Strategy. That entrenched use of specific features can also hinder adoption. “So, for instance, a company will go in and do macros and run their business on a spreadsheet. And that is a factor. I can’t just dial up G Suite and have those macros work,” Moorhead said. “G Suite was born in the cloud, Office 365 was born on the desktop..."

Data Realities Of 2017 And Beyond

Who determines what data will be shared with what devices under which circumstances? Will we need a database to keep track of all the devices we have relationships with, another of which devices have relationships with which other devices and yet another of data permissions we have granted and revoked? A question looming in the not-so-distant future is how much of machine-to-machine language humans will need to understand. Two ways of considering the balance of power between individuals and the data colossi are data empowerment and transparency. Data empowerment is the degree to which you can decide who knows what about you and when — now and in the future. Transparency is how knowable an individual or organization is. In this early stage of our digital society, individuals are becoming more and more transparent, while some organizations are becoming more opaque.

A company’s biggest cybersecurity threat is often inside the building

A combination of factors is responsible for the new environment in which employees are an equally treacherous cybersecurity risk as hackers – the blurring of network boundaries brought about by cloud services, the Bring-Your-Own-Device (BYOD) trend that gives employees the flexibility to stay connected through their personal devices, and the rise of more sophisticated attack methods. And the offenders aren’t always disgruntled or deceitful employees bent on ransacking the company’s systems; in fact, they seldom are. In most cases, the damage occurs unintentionally or negligently, such as an employee accidentally installing malware by clicking on a link in a fraudulent email or workers sharing passwords to save time.

Size Estimation Approaches for use with Agile Methods

There is strong agreement among software practitioners that estimates to bound the resources needed to successfully complete development projects, agile included. While some controversy exists within the agile community over whether such estimates are needed for sprints or iterations, many agree that they are needed at the project level and higher ... It is important to recognize that such estimates are driven by the size of the job which can be represented by a variety of related metrics (function points, user stories/story points, etc.). The purpose of this article is to identify the most popular agile size metrics and their relative strengths and weaknesses from a user point-of-view. To perform this assessment, we conducted a fact-finding survey on the topic to which 112 practitioners responded.

Quote for the day:

"Hitting the goal is about fulfilling the mission, lifting your people is about fulfilling your legacy" -- @Rory_Wells

Daily Tech Digest - February 05, 2017

How the Internet of Things Is Transforming Medical Devices

Not surprisingly, the IoT is making strong inroads in the medical devices industry. Medical devices companies are transforming themselves from devices/consumables providers to disease/care management organizations. Digitization in acute care, chronic care or in adherence is greatly aided by IoT-powered medical devices such as subcutaneous drug delivery units, continuous glucose monitors and vitals monitoring equipment. There are also more fundamental shifts forcing medical devices companies to reinvent themselves: the consolidation of group purchasing organizations (GPOs) and accountable care organizations (ACOs) under healthcare reform, the growing focus on prevention and wellness management, technology convergence, value-based healthcare, etc. The arrival of digital enterprises such as Google and Apple into the consumer health space is ushering in new possibilities.

HTTPS abusers hide malware in encrypted tunnels to avoid security

Things are never that clear cut in the world of cyber-crime and, as last year's Hidden Threats in Encrypted Traffic report revealed, almost half of cyber attackers used encrypted traffic to evade detection. So, are the kinds of encrypted tunnels created using HTTPS helping the bad guys, and how can enterprises best secure data from attackers hiding in encrypted traffic? SC Media has been investigating. We started by looking at how threat actors typically use something like HTTPS as part of an attack scenario. "HTTPS creates encrypted tunnels that go in and out of our organisations. Security controls can't look inside unless they are enabled to do so,” Kevin Bocek, VP security strategy at Venafi, reminds us, continuing “cybercriminals exploit the inability to look inside of encrypted HTTPS tunnels to launch their attacks…”

Transforming companies must put cyber security front and center

No matter what industry you’re in, data is the lifeblood of modern business. A high-quality cyber preparedness program will not only focus on keeping the data safe and secure. It will also help to increase and improve the integrity of that data to make sure that you have the right and complete data upon which to base your business decisions. Recently, an equipment manufacturer with a long track record of strong sales and premium pricing noticed that they were losing market share. Their analysis revealed that their products were having a much higher fail rate than usual. As a result, an increasing number of customers were opting to buy from other competitors. After further investigation, the company realized it had actually been the subject of a cyber attack. However, this wasn’t a typical breach in which customer or company information was stolen.

Talking to the Hacker Who Took Down a Fifth of the Dark Web

"This is in fact my first hack ever," they said in an email sent from the same address posted to the hacked Freedom Hosting II sites. "I just had the right idea." The hacker said they first compromised the service on January 30, but only had read access; meaning they couldn't change or delete files, but just see what sites were hosted. "Initially I didn't want to take down FH2, just look through it," the hacker said. But they then allegedly found several large child pornography sites which were using more than Freedom Hosting II's stated allowance. Usually, Freedom Hosting II has a quota of 256MB per site, but these illegal sites comprised of gigabytes of material, the hacker claimed. "This suggests they paid for hosting and the admin knew of those sites. That's when I decided to take it down instead," the hacker said. At the time of writing, the hacker claims to have found 10 child pornography sites with approximately 30GB of files.

Google's Biggest Search Algorithm Updates of 2016

Just when you think you've got search engine optimization down, Google shakes things up. And in 2016, the search behemoth was busy. An animated infographic published by digital agency E2M explains Google's algorithm changes and how they affect marketers. The good news for marketers is that the impact of those changes has lessened over the years, the infographic explains. But marketers should still understand what happened and why. For example, AdWords placement changes had a big effect on clickthrough rates, the infographic says, and the Possum update in September changed how local results rank. For more on Google's 2016 SEO updates, check out the animated infographic

Strictly Confidential: Blockchain-based Solutions for Securing User Data

When you visit an emcSSL-enabled site, the site requests your browser to present a client certificate. If the client has no certificate or doesn't present one, the server, depending on the settings, can switch to a traditional password authentication system or refuse to proceed. If the certificate exists, you submit it and the browser automatically associates the server with a certificate. Upon receiving a certificate, the server, in turns, checks its signature. Successful signature verification proves that the certificate was generated for the emcSSL system. The server generates a random number (session password), encrypts it with the public key of the presented certificate, and sends it to user’s browser. The session password is established for this and only this connection.

2017 Fintech Predictions – the year of macro risks

In the retail asset management sector we have witnessed a wave of consolidation in the US, notably with roboadvisors. Most incumbents have placed their bets and the few remaining independent startups have survived, so far. We have yet to see consolidation in Europe. Arguably, there are fewer roboadvisors in Europe than in the US and most are younger so we might not see full consolidation yet. I would not be surprised if a European incumbent or two makes an acquisition though. I remain interested in roboadvisor models, especially those that will make effective use of ETFs, micro investing or micro saving and build a social layer that enables high engagement. I think there is still space for these types of models. Additionally, there is still much to be done to modernize incumbents and to date few fintech startups with a b2b model have emerged in asset management.

Three cloud computing skills to make your resume stand out in 2017

"Nowadays, everything about technology moves fast, including what skills companies look for in their IT staff," said John Reed, senior executive director for Robert Half Technology, an IT staffing company based in Menlo Park, Calif. Interest in cloud technology continues to grow: IDC expects spending on public cloud services to rise from $96.5 billion in 2016 to $195 billion in 2020 -- a compound annual growth rate (CAGR) of 20.4%. And, as that growth continues, companies face a dearth of available talent as they try to deploy more cloud technologies, said Jay Lyman, principal analyst, cloud management and containers, at 451 Research, an analyst firm based in Boston. There are a few steps IT pros can take to nudge their resumes toward the top of the Human Resources pile.

The Impending Crisis of the Internet of Things

“The conversation hasn’t even gotten to the hill because [the Mirai attack] happened during the elections,” Scott says. “The hill is slow to evolve because they think additional standards will somehow snuff out the entrepreneurial marketability. But security-by-design as an enforceable standard is no different from car manufacturers having to include brakes on their vehicles.” The manufacturers won’t do anything until their hand is forced. And the consumers can only do so much. We’re all left floating in the iceberg field, waiting for the big one to crack the hull. When I ask Grau to predict the future of these attacks, he mentions the possibility of hackers using ransomware to infect a bunch of devices and then telling the manufacturers to pay up or face the consequences.

6 Challenges CISOs Will Face in 2017

What is less well documented are the pain points which are common across all industries. The differences often come to the fore - security execs tend to stay within a vertical, and for the majority of my career, I was no exception. I have taken the leap from the end-user or customer space, into the world of security platform vendor and in my new role, I get to speak with leaders in all industries and the similarities far outweigh any esoteric differences. While regulation differs across industry, technology is pervasive in all fields. Everyone is handling customer data, all industries have a web presence, a breach has a catastrophic effect on stock price, shareholder confidence, and your board credibility. Granted, regulations in certain industries which require prescriptive controls but good security hygiene should not be reserved for those in government or financial services.

Quote for the day:

"Do what you can, with what you have, where you are." -- Theodore Roosevelt

Daily Tech Digest - February 04, 2017

Data Science: Identifying Variables That Might Be Better Predictors

The data science team embraced the iterative, “fail fast / learn faster” process in testing different combinations of variables and metrics. The data science team tested different data enrichment and transformation techniques and different analytic algorithms with different combinations of the variables and metrics to see which combinations of variables yielded the best results ... The challenge for the data science team is to not settle on the first model that “works.” The data science teams needs to constantly push the envelope and as a result, fail enough in their testing of different combinations of variables to feel personally confident in the results of the final model. After much testing and failing – and testing and failing – and testing and failing, the data science team came up with an “Attrition Score” model that had failed enough times for them to feel confident about its results

The Next Step in Finance: Exponential Banking

“Conversational interfaces” that improve the users’ experiences; “Automated Complex Reasoning,” which permits totally automated decision making; and “Deep Learning,” anticipating more advanced systems for fraud detection, are key cognitive technologies for the development of banking. As well as “risk scoring,” the definition of dynamic clusters of customers, the construction of artificial stress scenarios, and much more. And artificial intelligence is fundamental for the development of natural-language processing, which allows computers to maintain a conversation with human beings. This would enormously accelerate customer digitalization. On the other hand, user convenience calls for much more global and integrated solutions to their needs, and that this will be achieved through platforms combining products and services from different providers.

Friend or Foe? Why fintech and banks need each other

While the popular view is that few entrepreneurs want to tie up with a large, traditional corporation, the smartest and most ambitious innovators see the benefit of working with a leading financial institution to amplify the reach of their game-changing technology. On the flip side, some might assume that big, more risk-averse financial institutions would shy away from embracing innovation from a startup that thrives on failing fast and cheap. But the truth is banks embrace trends and technology that benefit their customers. And, speed-to-market is the new bank lexicon. That’s why Wells Fargo created a startup accelerator in 2014. Think of it like startup speed dating — we’re providing a framework and structure to nurture relationships with the startup community. The program mentors startups as they work to bring potential breakthrough technologies to financial services and other sectors.

How to mitigate containerized microservices risks

"Some people literally want to lift and shift," said Bryant. That is often a motivation for moving into the cloud, as organizations want to strip themselves of the burden of maintaining large datacenters, or even simply avoid spending millions of dollars upgrading legacy servers. Or perhaps the goal is to simplify the maintenance and enhancement of existing SOA applications, a motivation that commonly drives the adoption of microservices, and often the adoption of container-based architectures that use technologies like Docker and Kubernetes. Understanding the underlying goals that are motivating the move to cloud computing or containerized microservices is important, but equally important is being able to objectively know if the goals have been achieved when the migration is done.

Internet of Things: Setting business vision on speed and agility

Delivering on this IoT vision demands that CIOs, CDOs and CTOs catalyze a fundamental change in how their organizations develop applications. The IoT-driven applications that truly transform business are expected to be those that are developed with speedy, agile, team-based practices. And, in turn, those practices require that your IoT app development teams—which should include business analysts, data engineers, data scientists and subject matter specialists—share a common, cloud-based collaborative platform. This development environment should be built on a high-performance data lake and span a hybrid architecture that’s equally capable of handling structured and unstructured data. It needs to also support agile building, testing, refinement and deployment of analytics algorithms into myriad IoT deployment roles, both at the edges and in the cloud.

Enterprise Architecture will increasingly take over from the IT function

EA has to select, together with the business, the SaaS, FaaS, IaaS, PaaS, iPaaS, and business service solutions that integrate best and minimise unnecessary diversity by standardising on certain clouds and services. It also has to also align the information formats at the interface level because each outsourced component may have its own format. Yet, note though that the technology behind the IT cloud services is not really visible to the Enterprise and relevant to its architecture and as such IT needs not be documented in detail. But, while the IT decisions remain in the jurisdiction of each company, because companies in the value chain remain still autonomous, the virtual cloud enterprise Governance function, may still aim to coordinate with long term partners the harmonisation of information formats and cloud approaches in order to reduce unnecessary variation of cloud suppliers standards and technology to obtain overall economies of scale, minimise duplication and integration issues and align information format.

How to use Cortana to perform file management tasks in Windows 10

While this article isn't about the Echo, I bring it up because while I was waiting for my unit to arrive, I was reading everything I could find about it on the Web. As I did, my interest in digital assistants was reinvigorated and I delved back into investigating Cortana on my Windows 10 system. I had played around with it a couple of times in the past, but since I have an iPhone, I use Siri for directions, weather, reminders, music, and impromptu internet searches. I never really found it compelling to use Cortana for those types of things while sitting at my desk. However, I decided to give Cortana a second chance and found that she does a nice job of providing me with the same types of features that I've grown accustomed to with Siri on my iPhone. Now, I haven't yet attempted to add Cortana to my iPhone, but I just might do that sometime.

From a DevOps bottleneck to a DevOps partner

Organizations can deliver apps faster and with higher quality by following by following an agile framework, but they also need to leverage DevOps tools that automate the process of moving code from Development to Operations. Sticking with our CNN Politics app example, one sprint would include developers writing APIs, application programming interfaces that are the building blocks of digital transformation, to request CNN polling data. Developers use a fast, distributed source control system such as Git, and synchronize local filesith a remote repository such as GitHub. The API code is checked into GitHub, which continuously integrates the code with a DevOps tool such as Jenkins, which automates software builds and may orchestrate with other tools to test and deploy code to an application server running in a production

How Google's Amazing AI Start-Up 'DeepMind' Is Making Our World A Smarter Place

Perhaps DeepMind’s most famous accomplishment so far is being the brains behind AlphaGo, the first computer program to beat a professional human player of the board game Go. AlphaGo was developed by feeding DeepMind’s machine learning algorithms with 30 million moves from historical tournament data, and then having it play against itself and learn from each defeat or victory. DeepMind’s work is based on a solid grounding in neuroscience. Two of the founders – Demis Hassabis and Shane Leg - met while undertaking research at the UCL’s computational neuroscience unit, and Hassabis has a PhD in the subject. This has underpinned their strategy of developing AI by teaching computers to mimic the thought processes of our own brains, in particular how we use information to make decisions and learn from our mistakes.

Q&A on The Great ScrumMaster

At a certain point of being agile, the traditional methods for achieving the next state fail because they are not based on self-organization and don’t see the organization as a system but as a hierarchy. The methods that were useful on the previous two levels of the #ScrumMasterWay model, such as organizing workshops, explaining, bringing in new concepts, and coaching at the team level are failing as the organization is already too complex. You would have to experiment, be playful and curious, and try different things to stimulate reactions. The system will give you some feedback, and all you have to do is to believe that every system is naturally creative and intelligent, so the people in that system don’t need you to tell them what to do. They will find out. However, they might not see it in the first instance, so they need you as a coach to challenge their status quo and reveal to them what you have seen from your different viewpoint.

Quote for the day:

"There is no monument dedicated to the memory of a committee." -- Lester J. Pourciau?

Daily Tech Digest - February 03, 2017

These 10 cities have the worst malware infection rates in the US

Malware attacks are on the rise across the US, but some cities are more susceptible than others, according to a recent report from Enigma Software Group (ESG). In 2016, Tampa, Orlando, and St. Louis each had malware infection rates per capita more than five times the national average—the highest in the US, the report found. ... "The important thing is that people in these cities, and everywhere else for that matter, need to always remain vigilant against malware, spyware, and other nefarious online activity." ESG compiled malware detection data from its SpyHunter anti-spyware software in the 100 largest cities in the US in all of 2016. Enterprises should be on the lookout for ransomware attacks in particular: Nearly half of businesses report that they were the subject of a cyber-ransom campaign in 2016, according to a recent Radware report.

Global Application and Network Security report finds ransom is top motivation for cyber attacks

“The intent of today’s threat actor is to develop the best tools possible to either disable an organisation or steal its data,” said Geenens. “While businesses focus on delivering the highest value to their customers, they will also have to stay vigilant and ensure they are able to meet the security challenges they will likely face. Security must be woven into the customer experience for a company to truly succeed. Without this change in thinking, organisations will remain vulnerable.” Radware’s Emergency Response Team (ERT), which actively monitors and mitigates attacks in real-time, creates this annual report for use by the security community. The ERT team compiles this report using a combination of data from a vendor-neutral survey of organisations, Radware’s in-the-trenches experience fighting cyber-attacks, as well as the perspective of third-party service providers.

IT execs: Most sought-after skills aren't IT-focused

There are lots of technologies that are developing, but coding, to my mind, is primarily syntax. [I try to] find somebody who's a good problem solver, who knows how to take a problem, break it down into pieces and get to a solution. Whether they're doing that in Java code or in Python or in CSS or in whatever the next JavaScript technology we're going to roll out to market is going to be, that's syntax that smart people can learn. If I can find people who are great problem solvers and who are really aggressive learners [that] constantly want to be playing and learning with new things, [those] are the [people] that are going to be the best to build into my team. That's a team that I can point at any problem, even one that I can't anticipate, and any technology -- even one that I haven't seen -- and know that they're going to be able to pick it up and carry it to a new place.

Attention to cyber-security is becoming daily routine in the C-suite

Nearly half (45 percent) said the responsibility for monitoring “immediate risks to cyber-security” rests with those who are directly in charge of cyber-security (meaning cyber teams). Thirty-three percent picked either C-suite or both (meaning cyber teams and C-suite). When asked about responsibility for “emergent risks to cyber-security”, responsibility resting solely with the cyber team fell to 30 percent and the portion of respondents who picked C-suite or both jumped to 46 percent. Widespread social issues present business risk for companies around the world. Whatever the underlying causes of insecurity may be, they manifest themselves in many ways, physical and cyber-threats among them. Executives are confident in political authorities' ability to mitigate the causes of insecurity, but there remain opportunities for companies to address their exposure to the threats motivated by insecurities.

A value stream mapping process is best under a DevOps approach

Value stream mapping usually starts with the product person or team as they are the direct line to the customer, Alley said. The process moves through the development lifecycle, QA testing, release and operations, and how the IT team monitors and manages this product or feature after release. The value stream doesn't end there; it looks down through deployment and up at the customer to see if the project achieves its goals. The value stream mapping process assembles everyone involved with a workflow into the same room at the same time, to clarify their roles in this product delivery process and identify bottlenecks, friction points and handoff concerns. Value stream mapping reveals steps in development, test, release and operations support that waste time or are needlessly complicated.

Convert your big data into beautiful graphics with Google’s Data Studio tool

Part of the Analytics 360 suite that Google Inc. revealed earlier this year, Data Studio provides enterprises and small businesses alike with a simple, user-friendly interface that lets them build living charts and graphs using their analytics data. “One of the fundamental ideas behind Data Studio is that data should be easily accessible to anyone in an organization,” developers Nick Mihailovski and Nathan Moon wrote in a May 25 blog post announcing the American version of Data Studio. “We believe that as more people have access to data, better decisions will be made.” In addition to the main subscription-based program, American users can access a free version of Data Studio that limits each account to five reports, though both versions allow access to unlimited data and report viewing, editing and collaboration. A Canadian beta version has since been released.

RSA 2017: The Internet of Things security threat

IoT gear doesn’t exist in isolation, so attackers will seek ways to compromise other devices that they interact with in an effort to affect their usefulness, according to Anthony Gambacorta, the vice president of operations at Synack, who is speaking at the conference. He’ll present specific examples to look out for including products such as IoT’s relationships with cloud servers and mobile applications. Using data that IoT devices gather as legal evidence poses its own set of problems, which include preserving the data and its integrity, and analyzing it for incident investigations and to present as evidence in court. The nuances of these emerging needs will be examined by attorney Erik Laykin of Duff & Phelps LLC. Security luminary Bruce Schneier will offer up two sessions about regulating IoT devices, which are woefully insecure, some say because they are not held to any set of security standards.

Mesh networking: Why it's coming to a home or office near you

Increasing your range is only one advantage to mesh networking. You also increase your network stability. With a mesh, even if one node goes down, you still have a working Wi-Fi network. In addition, a mesh can deliver more bandwidth on average to each device and deal better with heavy-traffic congestion. Setting up a mesh network used to require either high-end equipment or considerable networking skill. Today, you just need to buy the gear, plug it in, and run a simple setup routine. Unlike ordinary routers, though, you're more likely to set up mesh gear from an Android or iOS program instead of a web page. Most mesh networking packages comes in sets of three nodes. 802.11s enables you to expand to dozens. But there are limits. The more nodes you have, the more hops are needed to send messages between devices. The result is increased latency and poorer bandwidth

New Chrome Beta Feature Looks To Make Web Apps As Powerful as Native Ones

This could be the future of Mobile: Apps on Android are changing. A couple weeks ago, Google began testing its new Instant Apps that let users interact with aps without needing to download them in the Play Store, but Progressive Web Apps takes that concept one step further. Not only do they eliminate the Play Store middleman altogether, they let developers build powerful apps right in Chrome and deliver them quickly without the hassle of downloads and updates, or concern about compatibility. Native apps have served us well (and likely will for years to comes), but Google is already thinking beyond the present implementation of apps to a future where everything is instant and connected.

Protecting your critical digital assets: Not all systems and data are created equal

In determining the priority assets to protect, organizations will confront external and internal challenges. Businesses, IT groups, and risk functions often have conflicting agendas and unclear working relationships. As a result, many organizations attempt to apply the same cyber-risk controls everywhere and equally, often wasting time and money but in some places not spending enough. Others apply sectional protections that leave some vital information assets vulnerable while focusing too closely on less critical ones. Cybersecurity budgets, meanwhile, compete for limited funds with technology investments intended to make the organization more competitive. The new tech investments, furthermore, can bring additional vulnerabilities.

Quote for the day:

"My great concern is not whether you have failed, but whether you are content with your failure." -- Abraham Lincoln

Daily Tech Digest - February 02, 2017

These are the threats that keep me awake at night

The concept of threat intelligence is sound: Use another organization’s discoveries about potential threats to augment your own security. The problem is that the quality of threat intelligence data is highly variable. Those who rely on it without the proper vetting may make matters worse and not better. As an example, many organizations applied the indicators of compromise provided by the U.S. government as part of the Grizzly Steppe investigation to their own monitoring systems. Burlington Electric was one such organization, and it quickly identified a PC with activity matching information in the government alert, causing a media storm related to the U.S. electrical grid being "hacked." Sadly, some of the information in the alert turned out to be inaccurate, and much time was expended investigating an employee who had innocently checked his Yahoo email.

Data from pacemaker used to arrest man for arson, insurance fraud

A man has been charged for arson and fraud after law enforcement used data gleaned from his pacemaker to uncover an alleged plot to cheat his insurance company. ... Suspicions were aroused when Compton's statements did not seem to match up with how the blaze begun, especially after he told a 911 dispatcher that after spotting the fire, he packed a number of suitcases and threw them out of his bedroom window after breaking the glass with a walking stick. Compton has medical conditions which include an artificial heart linked to an external pump. According to court documents, a cardiologist said that "it is highly improbable Mr. Compton would have been able to collect, pack and remove the number of items from the house, exit his bedroom window and carry numerous large and heavy items to the front of his residence during the short period of time he has indicated due to his medical conditions."

How Machine Learning Can Improve Healthcare Cybersecurity

Currently SIEM technology is considered one of the most advanced types of infrastructure cybersecurity. SIEM aggregates event data from all solutions across an IT infrastructure and applies security analytics in real-time for the earliest possible security threat detection. Introducing machine learning into enterprise cybersecurity will separate and integrate SIEM log-based methods with other UEBA. Machine learning will allow this process to be unsupervised, eliminating breaches caused by human error. Machine learning has proved useful in healthcare analytics, with providers and vendors looking to apply the technology to security solutions to protect clinical health data store on-premise and in the cloud. ... "This radical transformation is already underway and is occurring as a response to the increasingly menacing nature of unknown threats and multiplicity of threat agents," Pavlakis concluded.

Why You’re Doing Cybersecurity Risk Measurement Wrong

Broadly speaking, cybersecurity is risk identification and risk mitigation in the cyber domain. Measuring risk quantitatively is good because it helps security teams measure their capabilities somewhat objectively, which helps everyone make better decisions. For example, when deciding whether to upgrade all your firewalls or invest in organization-wide two-factor authentication, that decision should be based, in part, on what risk exists now and what risk will be after you implement a change. It may surprise you but people are generally pretty bad at this, resulting in things like transportation disasters, major breaches, economic bubbles, wars, and bad movies. ... Here’s where it gets more complicated: evaluating current and future risk requires accounting for people … and people make everything harder. A good risk analysis should account for risky behaviors by users, administrators, and security personnel, both before and after you make the change.

EVGA splashes into CPU chilling with new closed-loop liquid coolers

EVGA's venture into CPU cooling is further evidence that the enthusiast sector of PCs is thriving. Indeed, the AIO coolers are just the tip of the iceberg for EVGA, which is poised to meet the cooling needs of more sophisticated users, as well. While all-in-one coolers are designed for simple, straightforward installation, EVGA will soon expand its selection into something much more ambitious. EVGA’s QRC, or quick-release cooling, system will mix the ease of AIOs with the flexibility of custom water-cooling setups by offering a variety of prefilled liquid-cooled components with snap-on quick-release connections at their ends. The idea is you can buy these separate AIO parts and expand the cooling system to fit the needs of your particular system.

The digital workplace - IT’s biggest challenge?

The opportunity is huge. A successful digital workplace is not only a means of attracting talent it also maximizes the creative potential of the workforce and enables new ways of working that deliver better business outcomes. So much so that Gartner predicts that by 2020 the greatest source of competitive advantage for 30 percent of organizations will come from the workforce’s ability to creatively exploit digital technology. I also see the digital workplace as a foundation stone for any organization that is approaching artificial intelligence and automation as an opportunity to empower employees to create value in new ways. It puts people, and what they need to be more collaborative and creative when administrative tasks are automated, in the spotlight. At its simplest, the digital workplace is one that offers employees anytime, anywhere access to technology devices and services in a way that boosts engagement, creative thinking and agility.

How security can directly impact the bottom line at banks, financial institutions

Financial organizations certainly recognize that these technologies impact their bottom line, but calculating the precise ROI of preventive solutions can be difficult. As a result, security is often viewed simply as a cost center. However, security has a valuable and untapped role to play that can deliver immediate tangible results across the entire organization – while using many of the security technologies already deployed. The transformation and expanded role of security can best be seen in its potential to contribute via technology to four additional key business operations: reducing inefficiencies in processes and procedures, predictive analysis, delivering actionable data and reports and achieving compliance. These tasks are often performed with time-consuming, costly and error-prone manual processes.

How Facebook and Google are battling internet terrorism

In one initiative, Facebook has been partnering with universities to set up challenges for teams of students to develop counter-messaging campaigns. ... "The campaigns have reached tens of millions of people," she said. "Some of the campaigns are just absolutely amazing in terms of how many people they reach." Google has been backing other efforts to counter extremist propaganda online, including offering up tailored ads to users who might be recruitment targets. Last September, Google launched the "Creators for change" campaign, through which the company identifies potentially influential YouTube users and works to "resource them up and help them understand how to utilize their audience, which is really millennials around the globe, to kind of convey messages that push back on hate and extremis and violence and xenophobia," Walden said.

Vespa team creates Gita, a robot for lugging your stuff

Introducing Gita -- a little round robot that will carry up to 40 pounds of your stuff. It is the first offering from Piaggio Fast Forward (PFF), a new company from the folks who created Vespa, the iconic Italian scooter. Michele Colaninno, Chairman of the Board of PFF tells us that the company is part of a 21st century revolution on mobility. He says, "... The way forward is that robotics engineering must help people and not substitute people." We spoke with Colaninno and members of the Boston-based team that developed Gita. The team isn't developing a self-driving car. Instead, they envision a future where cities are filled with active pedestrians and their robot assistants. In a closed environment, Gita can navigate entirely on its own. But it can also head outside to tag along with a person, following the human operator's wearable device and avoiding obstacles along the way.

Businesses are at a database crossroads

As the SQL monolith splinters, developers are ending up with increasingly more data handling options; programmer website DB-Engines counts more than 300 different options. That’s a great array of choices, and choice is good. But it’s a number that also shows the complexity of the problems organisations are looking to solve in the information age. However, it can’t continue in this vein – that’s not how markets work, so consolidation and market transformation are clearly coming. However, the question for the CIO, who needs to make the largest bets on technology, is who will emerge as the Oracle or DB2 of tomorrow. By 2020 there’ll be a fragmentation of the database world into three parts.

Quote for the day:

"You can have anything in the world you want if you'll just help enough other people get what they want." -- Zig Ziglar

Daily Tech Digest - February 01, 2017

Experts explain why microservices are overhyped

In reality, granular software applets add unnecessary complexity that stymies growth, increases overhead, and is at odds with how most contemporary cloud systems operate. This is "because [microservice] applications must be refactored to realize their value," Sweet said. "It's easy to get containerization mixed up with microservices," he said. "But where a traditionally monolithic application can be delivered in a large container model, moving an application from a traditional monolithic architecture to microservices requires complete refactoring. And as many enterprises learned when they tried to build private clouds, just because a new technology is hot doesn't mean there's enough engineering talent to go around." Microservice systems also demand a skilled employment ecosystem. Market demand and interest in microservices currently exceeds the pool of available, trained workers.

The Industrial Internet of Things is full of transformational potential

Zhang observes that IIoT is not a new concept for manufacturing as most production facilities have had process control systems, SCADA data and historians for decades. However, with the advent of IIoT the next wave of manufacturing productivity is at the doorstep (or on the loading dock). The application of analytics to volumes of data produced by instrumented, connected assets can deliver quantifiable savings and benefits across supply chain and manufacturing processes. However, one of the immediate challenges frequently voiced by manufacturers undertaking an IIoT initiative is acknowledgement that much of the data generated by their assets is never captured, particularly “unstructured” data. And this is where IBM’s Watson IoT cognitive capabilities can transform that data, once captured, into meaningful insight.

The Data Science Puzzle, Explained

Several concepts central to data science will be examined. Or, at least, central in my opinion. I will do my best to put forth how they relate to one another and how they fit together as individual pieces of a larger puzzle. As an example of somewhat divergent opinions, and prior to considering any of the concepts individually, KDnuggets' Gregory Piatetsky-Shapiro has put together the following Venn diagram which outlines the relationship between the very same data science terminology we will be considering herein. The reader is encouraged to compare this Venn diagram with Drew Conway's now famous data science Venn diagram, as well as my own discussion below and modified process/relationship diagram near the bottom of the post.

Harnessing the value of big data with MDM

Big data can act as an external source of master information for the MDM hub and can help enrich internal Master Data in the context of the external world. MDM can help aggregate the required and useful information coming from big data sources with internal master records. An aggregated view and profile of master information can help link the customer correctly and in turn help perform effective analytics and campaign. MDM can act as a hub between the system of records and system of engagement. However, not all data coming from big data sources will be relevant for MDM. There should be a mechanism to process the unstructured data and distinguish the relevant master information and the associated context. NoSQL offering, Natural Language Processing, and other semantic technologies can be leveraged towards distilling the relevant master information from a pool of unstructured/semi-structured data.

AI Isn't Just For The Good Guys Anymore

Security providers are increasingly using machine learning to tell good software from bad, good domains from bad. Now, there are signs that the bad guys are using machine learning themselves to figure out what patterns the defending systems are looking for, said Evan Wright, principal data scientist at Anomali. "They'll test a lot of good software and bad software through anti-virus, and see the patterns in what the [antivirus] engines spot," he said. Similarly, security systems look for patterns in domain generation algorithms, so that they can better spot malicious domains. "They try to model what the good guys are doing, and have their machine learning model generate exceptions to those rules," he said. Again, there's little hard evidence that this is actually happening.

How to practice cybersecurity (and why it's different from IT security)

In cybersecurity, the defenders acknowledge that highly motivated and creative adversaries are launching sophisticated attacks. There’s also the realization that when software is used as a weapon, building a stronger or taller wall may not necessarily keep out the bad guys. To them, more defensive measures provide them with additional opportunities to find weak spots and gain access to a network. This mentality goes against the fundamental principle in IT security of erecting multiple defensive layers around what you’re trying to protect. By separating what you’re trying to protect from the outside world, you’re keeping it safe—at least in theory. While this works in physical security, where IT security has its roots, it doesn’t really work when you’re facing enemies who need to be successful just once to carry out their mission.

Security is the categorical imperative of the Internet of Things

Security is the categorical imperative of the IoT. Many companies have always understood this and have never abdicated their responsibilities. But that understanding needs to be made absolute. Security must be baked directly into every IoT solution; incorporated into the development process of all devices and systems and suppliers; normalized across every application. All stakeholders need to be on a common ground — and education is the first step. Efforts like those of the Internet of Things Consortium (IoTC) Privacy and Security Committee seek to establish and disseminate guidelines for minimum viable products and policies to strengthen privacy and security. There is no such thing as infallible security and there will always be people looking for ways to exploit and subvert IoT technologies. But we don’t have to make it so easy for them.

Business Transformation Demands Modern Data Integration

Vital data needed by organizations frequently is found not only outside the enterprise data warehouse, but outside the enterprise. Businesses are pressed to recognize the value that can come from integrating data from a variety of sources. Data management and data integration solutions have been strongly challenged to handle continuous changes in data and how it's used, increasingly in real-time. Modern data integration builds on technologies and processes that long have been part of the bigger world of data integration, beyond basic ETL functions. Practices like data quality, data profiling and data governance (also highly relevant to business users) comprise important capabilities that are central to reliable up-to-date data, no matter the source or structure. Modern data integration offerings encompass interoperating multi-platform solutions (iPaaS and on-premises), as well as pure-play cloud and SaaS solutions, where the lines continue to blur between application and data integration.

Rise of the 'accidental' cybersecurity professional

Cybersecurity is inherently interdisciplinary, Hurley said. "One thing I've done over and over is bring people from different disciplines into a room, to create a common vocabulary and work through a particular issue or problem that needs to be resolved," she said. Depending on your background, you may be able to make the leap to security within your own company, Hurley said. "There are tons of opportunities in cyber and many doors of entry," Hurley said. "Whatever doorway you come through, you will be working with colleagues from many disciplines, and becoming more expert." Shelley Westman, senior vice president of alliances and field operations at Protegrity, started her career as a lawyer. She left the field and went to work at IBM in a number of different roles ranging from procurement to product management. Eventually, she was assigned a role in hardware security.

The Misaligned Middle and Getting off the Hamster Wheel Using Kanban

So optimizing in one area can cause problems downstream in another area, and we don't recognize that if we're not looking at the big picture. Getting people to see and understand the big picture, and then having that help bring previously maybe even warring tribes together to have a conversation about how to fix it. Secondly, DevOps has a lot to do with culture. It's not just about automation and how can we change culture from a top-down command and control approach to a more distributed power to give people autonomy to do the work that they need. So some of the models that we're looking at is the Western behavior model which is the elements for a pathological kind of organization that's run by fear, versus a bureaucratic organization that's usually run by rules, versus a really agile organization to work with that's run by high cooperation and diversity

Quote for the day:

"Don't let today's opportunities become tomorrow's what ifs." -- Pat Flynn