Daily Tech Digest by Kannan Subbiah

Daily Tech Digest - April 11, 2017

Why a Quiet Blockchain Consortium Could Soon Make Noise

Amidst this backdrop, an upcoming piece of legislation is set to buffet the industry with a sweeping change that will produce upheaval and possibly contraction. I'm talking about MiFid II. It's hard to overstate the impact these regulations will have on asset management. Due to come into force in January 2018, MiFid II aims to increase transparency, enhancing investor protection and removing shady practices in pricing and allocation. Fund managers will be required to pay separately for research, financial advisers will no longer earn a commission and reporting requirements will multiply. And that's just scratching the surface. An independent report estimates the cost of complying with Mifid II to be more than £2.5bn. This is likely to bring about a sector shift, with many smaller firms not being able to bear the cost, and larger enterprises offsetting the increase elsewhere.

Why the board needs security leaders to fuel disciplined growth

As the risk of breaches increases, boards – whose role when they oversee the CEO is to act as fiduciaries on behalf of shareholders– are increasingly at risk of falling short of their responsibilities. While board members are not expected to be experts on information security, they must make sure that the company has the right people and processes in place to erect defenses against information security violations, to establish procedures for monitoring the level of information security, and to make sure that the right steps are taken should a security breach occur. At the same time, CISOs should educate board members about the best information security practices among peer companies as well as introducing board members to important trends in hacking and defense. Such briefings will help directors to evaluate proposals for investment of people and capital into new technologies and processes to protect companies against an ever-evolving information security threat environment.

Blockchain: The Battle To Secure Digital Identities

Recently, IBM and SecureKey also announced they are working together with the main goal of creating a “new digital identity and attribute sharing network” to make it easier for users to verify their data in a privacy-enhanced, secure and efficient way. Deloitte is doing a similar project using the Ethereum blockchain. It is an open source based on a smart identity platform available for users and companies that want to obtain, verify and identity credentials when communicating with one another. This way, customers can create and store identity info such as ID reference, driving license or passport, which can be confirmed by third parties to create verifiable credentials to be used for any digital communication. This Deloitte’s platform provides many opportunities for the automation of identity-related process including customer registration and Know Your Customer (KYC).

Is Digital Privacy A Right Or A Privilege?

The proponents of net neutrality rollbacks argue that tiered rate schedules will fund infrastructure innovation. The supporters of anti-privacy legislation argue that there’s little distinction between media companies (like Facebook) and ISPs, and both should have the right to collect and sell data that reflects the behavior of their customers. These are the business arguments. Are there other arguments we might want to consider? First, everyone should have the right to opt-out of the collection and distribution of personal data without losing privileged services or paying higher rates or extra fees. If a media company or an ISP wants to collect and sell my data it should only do so with my explicit permission – which I might well give (for a price). Why shouldn’t individuals share in these revenue streams? If I spend a ton of money online every year and everyone wants to follow me, stream to me and entice me, why shouldn’t I get a piece of the action?

MapR Announces Availability of Native Tableau Connector for Apache Drill

“Strong demand from our joint customers led to this tighter integration,” said Robert Green, director of product management at Tableau. “Tableau and Apache Drill share a common view on self-service data discovery and this development opens up new avenues for users of both technologies.” Apache Drill is a supported data source for Tableau bringing more robust integration compared to generic ODBC. The MapR Tableau Connector for Apache Drill delivers tighter metadata integration between Tableau and Apache Drill, and brings advanced analytics capabilities that leverage Tableau Sets to Apache Drill users. Additionally, Tableau users on Macs can now access Apache Drill.

No vendor lock-in fear with converged infrastructure

Cisco reached out to all the appropriate experts, who joined in on a call. The problem resided within a software-based Trend Micro firewall. The firewall was deactivated, which resolved the PCoIP problem. Before settling on HyperFlex, Safonov said he shopped around. He got three quotes from hyper-converged vendors and three quotes for more traditional architectures, including all-flash arrays. While his paramount concern was price, Safonov was still worried about managing servers, storage and networking gear from different vendors. "We would still have to troubleshoot across all the vendors," he said. Perry said the reduced concern about vendor lock-in may not last forever. It could change if server software and management tools head down an increasingly proprietary path.

Software developers – business enabler or hostage taker?

The skills attained during a computer science degree will be out of date by graduation, meaning organisations need to look beyond blunt qualification statements. Without undertaking specific skills tests, it is impossible to ascertain whether an individual can truly do the job. In addition, technical skills alone are not the only requirement. These individuals need to work as part of a team – are they team players? Do they buy in to the specific development processes of that organisation? Many developers are perfectionists which sounds great in theory, but is useless in practice – the software will never be good enough, never ready to be deployed. A pragmatic attitude is essential; plus an understanding of the importance of a standardised development process. Determining whether or not an individual has the right mix of skills and expertise to become a good software developer is a very significant challenge

Mobile Analyst: Factoring in Progressive Web Apps a Matter of 'When,' Not 'If'

More recently, Google announced deeper integration of PWA technology into its Android mobile OS. "Once a user adds a progressive Web app to their home screen, Chrome will integrate it into Android in a much deeper way than before," Google said. ... "PWAs aim to disrupt the mobile app paradigm by bridging the Web experience with native app functionality, by using the latest browser technologies to meld the accessibility of the Web with the presence of the mobile app," Wong said in a recent blog post promoting that research. "Most of the leading desktop and mobile browsers (except for Safari and browsers on iOS at the time of writing) have embraced the browser advancements (service workers) brought forth by Mozilla, Google, Facebook and others to implement service workers that enable a Web site to behave like an app," Wong continued.

Why smart stores don't check out

Amazon's "Just Walk-Out Technology" has one job: to figure out what you're taking out of the store. As you remove items from the shelf, A.I. uses multiple inputs to figure out what you grabbed. Cameras watch you take it. Scales built into the shelves provide data to calculate the weight of what you took. Amazon's patent filing suggests that the system may also refer to past purchases to help identify current ones. In other words, intelligent software analyzes a video feed to determine that you removed something from the shelf that looked like a cupcake. It considers data from the shelf, which is also a scale, and calculates that you took something that weighs about as much as a cupcake. And it checks your purchase history — it knows you're a cupcake-eating maniac. After all that input, the software decides that you took a cupcake off the shelf and adds it to your list, which is kept up-to-date in real time as you shop.

Why we must strengthen cyber risk management now

When it comes to combating financial crime, financial institutions are increasingly in the frontline of defense. Regulators the world over require financial institutions to meet stringent Know Your Customer (KYC), anti-money laundering and sanctions rules and regulations. Complying with such obligations in multiple jurisdictions is demanding – and increasingly costly – but the costs and reputational impact of non-compliance are even higher. SWIFT has a broad finance crime compliance portfolio, developed with the SWIFT community. It’s a suite of managed and shared services that leverages our platform, technology and standards expertise to cut through the complexity and give the industry simpler, more cost-effective ways to meet the challenges of financial crime compliance.

Quote for the day:

"It's the little details that are vital. Little things make big things happen." -- John Wooden

Daily Tech Digest - April 10, 2017

Building a strategic threat intelligence program

In spite of more modern protocols available, Barros views SIEM as more simplistic than UEBA models. SIEM correlation typically generates alerts for each situation, treating potential threats as isolated. Some SIEM products, such as Qradar, are capable of aggregating potential threats based on timing and IP addresses, but Barros said this product is primarily intended for aggregation and reducing the number of alerts rather than correlation. "SIEM correlation is still useful, but we need to recognize its limitations and embrace the new capabilities of new tools such as UEBA to improve that. As we've been talking, SIEM and UEBA are getting closer every day, so now it's just a matter of time before SIEMs move (or give the option) to track issues based on entity scores. But if you want to have that now, you should look at UEBA tools," Barros said.

What one company learned from testing Intel's superfast Optane SSDs

Optane gives tremendous flexibility to how Aerospike deploys its software because it helps speed up critical tasks like database indexing. The Aerospike database is highly flexible thanks to its hybrid memory architecture, meaning it can be deployed on different types of systems including all-flash arrays, converged infrastructures, or through major cloud services like Amazon AWS. The software is notably adaptable to a cluster topology via direct-attached storage managers. The database architecture can be broken into spokes and set up for high availability through database replication on interconnected servers. Optane cuts the network round-trip time, and that helps build a faster and more reliable database. Aerospike's database can help can create an environment where Optane can be used like RAM for in-memory processing or SSD for caching or hot storage.

The evolution of data center segmentation

In a nutshell, micro-segmentation offers a more granular method for separating workloads and controlling application in these cloud environments. Individual workloads can be isolated using a zero-trust model with whitelist controls enabled for specific network and application flows between workloads. Products and features such as firewalls, IPS, VRFs and VLANs have long been used to provide segmentation as a common best practice. While these can shrink the attack surface, the operational aspects can prove to be difficult. Traffic must be hair-pinned to firewalls, and there is a lack of granular controls to filter the east-west traffic inside of a VLAN. Getting visibility and telemetry can also be an issue, especially for east-west traffic. As a result, assets requiring separation are often placed in different VLANs. This leads to the creation of new firewall rules, IP subnets, routing and default gateways.

Email-Based Attacks Exploit Unpatched Vulnerability In Microsoft Word

When the rogue documents used in this attack are opened, they reach out to an external server and download an HTA (HTML Application) file that contains malicious VBScript code. The HTA file is disguised as an RTF (Rich Text Format) document and is automatically executed. "The successful exploit closes the bait Word document, and pops up a fake one to show the victim," the McAfee researchers said. "In the background, the malware has already been stealthily installed on the victim’s system." By searching back through its data, McAfee has tracked down attacks exploiting this vulnerability to late January. Following McAfee's report, security researchers from FireEye also confirmed that they've been aware of these attacks and exploit for several weeks and have coordinated disclosure with Microsoft.

Three Of The Biggest Cyber Security Threats To Australian Business

"Attackers will research employees' personal information and activity online and leverage these details to convince them to click a link and/or download a document that subsequently infects their device." Bentley believes the best way to combat against personalised, socially engineered attacks is to not just create awareness programs but also to deploy advanced email security solutions. These work by helping to identify and quarantine these emails before they ever reach an employee's inbox. Itay Glick, CEO and co-founder Votiro told HuffPost Australia the three key elements to good protection are training, detection and protection. "Training will only take you so far. When someone in the HR department receives an email from a job applicant with a CV, they will most likely open this file. They are simply doing their job and through doing so, can put an organisation at risk," Glick said.

Flatbed scanners are latest cyberattack vector

The malware compromises the scanner and allows the scanner to receive the light-modulated commands at certain pre-defined times: Every day at 11 o’clock, is one example the researchers use. The attacker, however, remotely controls the light source creating the commands. That allows the actual attack to be run on the fly at a pre-determined day of the perpetrator’s choosing—destroying files just before a moving-target important event, like a presentation, say. Control of the light source could be through a micro-controller, connected to the light source, and running an algorithm creating sequences of bright shades of light that fool the scanner. The attacker does have his work cut-out for him, though. The attack will fail if the flatbed scanner lid is fully closed, and the algorithm isn’t all that easy to figure—light is influenced by distance, and other light sources, for example. The further the distance the harder the attack is.

AI, Machine Learning as a Service Set to Overhaul Healthcare

Coupled with an artificial intelligence sector slated to bring more than $46 billion in revenue to vendors by 2020, MLaaS could fundamentally revolutionize the way healthcare organizations approach big data analytics by making these tools more budget-friendly for a broader range of organizations. “Intelligent applications based on cognitive computing, artificial intelligence, and deep learning are the next wave of technology transforming how consumers and enterprises work, learn, and play,” says David Schubmehl, research director, cognitive systems and content analytics at IDC, which compiled the AI report. “These applications are being developed and implemented on cognitive/AI software platforms that offer the tools and capabilities to provide predictions, recommendations, and intelligent assistance through the use of cognitive systems, machine learning, and artificial intelligence. ...”

Machine Learning At American Express: Benefits & Requirements

In the case of fraud detection and prevention, machine learning has been helpful to improve American Express’s already excellent track record, including their online business interactions. To do this, modeling methods make use of a variety of data sources including card membership information, spending details, and merchant information. The goal is to stop fraudulent transactions before substantial loss is incurred while allowing normal business transactions to proceed in a timely manner. A customer has swiped their card to make a purchase, for instance, and expects to get approval immediately. ... Chao mentioned that one of his favorite uses of machine learning at American Express is to build a machine learning mobile phone application to provide customized recommendations for restaurant choices.

Setting Up Security as a Business: 3 Best Practices for Security Execs

The existence of CyberGRX and other new services signals a movement in the security community. It's a clear confirmation that security is now a fundamental business issue and a potential growth advantage — and that security executives must take the lead in convening the business and having discussions about how security becomes a strategic lever. And more often, security execs have the floor. The massive amount of cyberattacks, exploits, and cybercrime have made it clear that every company will be affected by a security issue. Security officers no longer have to waste time legitimizing security as a business risk; they should be the lead executives who provide the insightful information and details on business impact that business leaders need to make sound decisions.

Predictive Analytics Can Stop Ransomware In Its Tracks

“Protecting an organization from ransomware or any type of malware is similar to an arms race, as the threat evolves so must your defenses!” Malewicz said. The county turned to predictive analytics in hopes of halting the ransomware attacks. Livingston County uses Unitrends backup solution to provide Malewicz's team peace of mind that in the event our cyber defense fails. “Ransomware was largely unheard of years ago, but today it's a household name - everyone knows someone or some organization which has been infected. The future guarantees that more menacing ransomware variants will take center stage wreaking havoc in our homes and places of business. When ransomware exploits bypass perimeter cyber defenses you have only to rely on your predictive analytic cyber defenses to protect you, else I hope you have stable and secure backup to fall back on!” he said.

Quote for the day:

"We'd achieve more if we chased the dream instead of the competition." -- @simonsinek

Daily Tech Digest - April 09, 2017

Why more tech workers should take sabbaticals

Taking a break from work, like a long weekend, is one way that employees and their managers can use to counteract burnout. Another tactic is to move an employee to a less stressful assignment, or to transfer an employee to a new area of work where he/she can get away from older pressures and start fresh. Still another tactic is to develop staff "bench strength" so that project stresses don't continuously fall on the same group of people. Finally, it helps to have fun and relaxation at work! An occasional pizza party, an onsite exercise workout room, or even a quiet sanctuary where employees can meditate or relax their minds, all contribute. Five years ago, only 4% of American companies offered sabbaticals, and the reality is, many smaller and mid-sized companies simply don't have the bench strength to offer them.

Bank consortium demonstrates leveraged loan trade via blockchain

Long said the goal of the test was to prove not just that a trade can be done over blockchain, but that it is well worth the investment in terms of time and cost savings for syndicated loan buyers and sellers. The demonstration, which involved a typical roster of syndicated loan trade participants, showed that a trade could potentially be settled in a few days, at much lower cost. Other efforts are underway to speed up trade settlement. The LSTA recently introduced rules aimed at discouraging buyers from dragging their feet in bringing their money to the table. As a result, median settlement times have been reduced from 16 days to 11 days since 2013. But banks are still aiming for loan-trade settlements in under three days, Long said. “We were looking to automate processing and remove all duplication and we did succeed at that,” Long said.

Why a combination of agile and DevOps is essential in propelling digital transformation

New research commissioned by CA Technologies shows that 67 per cent of UK organisations using an agile methodology experience an improvement in customer experience. It also highlights how DevOps and agile are better together than apart: Organisations that add DevOps practices to an agile environment improve new business growth by 38 per cent more than using agile alone. Agile and DevOps together also increase operational efficiency by 23 per cent, compared to using agile alone. However, organisations need to do more than simply launch both in unison and assume great customer experiences will emerge. They need to mature their agile and DevOps deployments as quickly as possible, because that’s where the greatest payback lies.

How CIOs can drive change by setting a vision

“We lead people,” he continues, “not projects.”Shurts forged that perspective through, among other experiences, a series of challenging and complicated CIO assignments, all of which involved organizations in massive need of change, and in massive need of decisive leadership. ... The mission mattered, not just for motivational purposes, but also because it was true and transparent. And sharing ownership of that mission was sorely needed to get past the reticence of many IT staffers. “Otherwise, to some degree, we were a bunch of professionals coming into the office just to do something,” Shurts says. To a high degree, it worked. After Shurts invited his boss, the division president, to a town hall about the project, the executive told his colleagues (as Shurts recalls) that Shurts’ team ‘really believes they’re working on the most important thing for this company.’ Shurts thought to himself, “Damn it, Rick — you should, too!”

The Unreasonable Ineffectiveness of Machine Learning in Computer Systems Research

A contemporary example of such “unreasonable effectiveness” is the success that machine learning has had in transforming many disciplines in the past decade. Particularly impressive is the progress in autonomous vehicles. In the 2004 DARPA Grand Challenge for autonomous vehicles, which popularized the idea of driverless cars, none of the vehicles was able to complete a relatively simple route through the Mojave Desert, and I thought it unlikely that I would see driverless cars operating in urban environments in my lifetime. Since that time, progress in this area has been phenomenal, thanks to rapid advances in using machine learning for sensing and navigation. Driverless long-haul trucks are apparently just a few years away, and the main worry now is not so much the safety of these trucks but the specter of unemployment facing millions of people currently employed as truck drivers.

Artificial intelligence (AI) and cognitive computing: what, why and where

Artificial intelligence is being used faster in many technological and societal areas although there is quite some hype about what “it” can do from vendors. Still, the increasing attention and adoption of forms of AI in specific areas triggers debates about how far we want it to go in the future. Prominent technology leaders have warned about the danger and think tanks and associations have been set up to think about and watch over the long-term impact of AI (and robotics) with dicussions on the future of humanity and the impact of superintelligence but also, closer to today’s concerns, impact of automation/AI/robots on employment. Anyway, it again adds to that mix of ingredients that creates the conditions to strengthen the negative connotation regarding the term artificial intelligence

So You Want to Be a Data Scientist? – It’s Complicated

Anyone who is considering a career in data science needs to understand first, the myriad of things such a career involves, the type of education and training required, and exactly what the job market holds. And because the field is growing so fast, students and mid-career professionals both have an opportunity to move into data science careers, if they get the right education and training. ... There is no single definition of data science, as it varies with industry, specific business, and what the purpose of the data scientist’s role is. And different roles require different skill sets, therefore the educational and training path is not uniform. Data scientists can come from many fields – math, statistics, computer science, and even engineering.

Technology has forever changed our creative thinking. Here's how to take it back

When you walk around these days, count how many people are looking down at their phones. Almost everyone! Surprising, right? It’s sad how frequently screens have substituted the need for others in our lives. The same is true when working on projects. Having a person around IRL is more valuable than shooting an email over or setting up a call to ask for feedback. When creating with others, you’re able to share your ideas and creations at the moment they’re being made. While you chat things through, new ideas could even come to light based on the discussions that you’re having with real time feedback. In addition, behind a screen, you don’t get to see the actual project you’re working with nor have the luxury to read the body language behind the other individual to see their thoughts and feelings.

The Synthesis Of Enterprise Architecture And Design Thinking

To be human-centred is to focus on people and outcomes. While traditionally Enterprise Architecture has arguably been pre-occupied with outputs (i.e., various domain specific models or views of the business) a human-centred approach demands a shift in focus to the outcomes that a design process delivers (including the experience of the design process itself as an outcome). This dynamic has seen us re-think the TOGAF ADM as a series of design activities that each require a meshing of both Enterprise Architecture and Design Thinking to deliver not only the blueprints and plans needed to guide change, but also carefully crafted experiences that change individuals, organisational culture and create opportunity for insight.

The relationship between enterprise architecture artefacts

Considerations (principles, policies, maxims, etc.) are global conceptual rules and fundamental considerations important for business and relevant for IT. Standards (technology reference models, guidelines, reference architectures, etc.) are global technical rules, standards, patterns and best practices relevant for IT systems. Visions (business capability models, roadmaps, future state architectures, etc.) are high-level conceptual descriptions of an organization from the business perspective. Landscapes are high-level technical descriptions of the organisational IT landscape. Outlines (solution overviews, conceptual architectures, options papers, etc.) are high-level descriptions of specific IT initiatives understandable to business leaders. Designs are detailed technical descriptions of specific IT projects actionable for project teams.

Quote for the day:

"There will always be someone who thinks you can't succeed. Make sure that someone is never you."-- @LeadToday

Daily Tech Digest - April 08, 2017

For CIOs, email data security should still be a top priority

CIOs first need to understand the DMARC standards that have been published and understand that there are companies that can help prevent the fraudulent use of your email domains, thus protecting your brand. For example, there are a number of customers whose email domains were hijacked to elicit personal information or extort money. There have also been instances where an email, appearing to come from the same company, is sent to a corporate executive with instructions that are intended to harm the company -- such as transferring large amounts of money. In my role as CIO at U.S. Customs and Border Protection, criminal organizations would use the CBP email domain to send out demand notices for payment of duty and fine. Spear phishing is another core problem for corporations. Cybercriminals use targeted spear phishing of corporations' emails as one of their most common attack vectors.

Analytics As A Source Of Business Innovation

At Bridgestone, analytics allows the company to innovate new processes in key areas, such as site selection and staffing. A new staffing program, using predictive analytics, determines the appropriate allocation of 22,000 workers across 2,200 stores — putting enough workers in stores for peak demand while avoiding unneeded labor costs when business is slower. “The headcount model we built is based on standard industry practice, but it’s groundbreaking here at Bridgestone,” says Moody. The payoff will be millions of dollars per year in efficiency gains and increased sales, he says. The key advantage for Bridgestone is applying those industry standard practices in ways that capitalize on Bridgestone’s unique capabilities.

How AI, IoT and blockchain will shake up procurement and supply chains

Are the machines going to be able to make all the decisions and we will have no role to play? You can say the same thing about all aspects of life, so why only procurement? I think human intelligence is still here to stay. I believe, personally, it can be augmented. Let's take a concrete example to see what it means. At SAP Ariba, we are working on a product called product sourcing. Essentially this product takes a bill of material (BOM), and it tells you the impact. So what is so cool about it? One of our customers has a BOM, which is an eight-level deep tree with 10 million nodes in it. In this 10 million-node commodity tree, or BOM, a person is responsible for managing all the items. But how does he or she know what is the impact of a delay on the entire tree? How do you visualize that?

Tracking the explosive growth of open-source software

High on the list, at No. 3, was MySQL, the database technology first developed in 1995. MySQL currently helps run huge, Web-scale companies like Google, Facebook and Twitter. But it’s also worth noting that several “NoSQL” database technologies — which are non-relational databases, unlike MySQL, and are often better suited for parsing the unstructured data being thrown off by many companies today — also ranked highly. These NoSQL technologies include MongoDB, which came in at No. 9 in our index; Redis, which is being commercialized by company Redis Labs, at No. 12; Cassandra, which came in at No. 25 and is behind the database company DataStax; and Elasticsearch at No. 7, which is being commercialized by Elastic. MongoDB raised a new round of financing in late 2015 — the company is estimated to be valued at around $1.5 billion

Experience The Magic Of Internet of Things Automation (IoT)

Several industries and domains are now experimenting with Internet of Things automation (IoT) to step into a new age where everything can be controlled centrally. Smart homes, smart cities, smart parking systems to smart shopping malls, everything is covered under this technology. Some of these Internet of Things automation systems are already implemented in some countries, while others are still in planning phase. Once everything is set up through internet of things automation, anything can be controlled centrally! It has the potential to spoil users for convenience, flexibility and comfort. Technology is advancing at an unprecedented rate. Businesses have to adapt to these technological updates and trends to match their customer’s expectations and survive in the highly competitive IT market. Let’s join hands with Internet of Things to redefine our lifestyles.

Managing Logistical Relationships in a Graph Database

One concrete example of graph databases being used in logistics is eBay, who (owing to the acquisition of Shutl) provides a service that uses graphs to compute fast, localized door-to-door delivery of goods between buyers and sellers, scaling their business to include the supply chain. Incidentally, eBay observed that before turning to graphs the latency of their longest query was higher than their shortest physical delivery, both around 15 minutes — something that can’t now be replicated when an average query is powered by a graph database and takes 1/50th of a second! The eBay example is not isolated. Organizations large and small are adopting and winning with graphs in retail, finance, telecoms, IT, gaming, real estate, healthcare, science, and dozens of more areas.

Low-tech threats make high-tech cybersecurity everyone's business

Firewalls and cutting-edge technology designed to keep networks safe and secure can be undone simply by asking employees to click a link. An email requesting employee W-2s that looks like it's coming from the CEO can turn a well-meaning worker into the unwitting source of a data leak. That's why Kris Evans travels the country to speak about cybersecurity and why it's everyone's business, whether it's a janitor or a CEO. He gave a keynote last month at a cybersecurity conference on the North Dakota State University campus. "We're seeing that hackers' best friends are friendly employees," said Evans, a certified identity theft risk management consultant and national marketing director for Harvard Risk Management Corp. NDSU makes cybersecurity everyone's business, not just tech professionals like Marc Wallman.

Analytics, IT security and cloud among top areas for IT investment

Business analytics not only tops the list of IT investments, but it also ranks first on the list of departments that executives think deserve even more investment. It has also, according to Torres, ranked as one of the highest investments for a longer period of time than any other item. “This topic area has been number one on this investor list for the last eight years, and it’s been in the top three for well over a decade now,” he said. “Even other technologies that had huge interests for long periods of time — ERP comes to mind — didn’t see this level of stability at that top spot.” Torres explained that the competition to hire the best talent is what’s driving much of the spending on business analytics. “If you look at business analytics programs, particularly at the graduate level, these are springing up all over the place at colleges and universities,” he said.

IBM InterConnect pushes new new thing as now

Disruptive technologies also have their place in more day-to-day, but no less important, uses. In a session on managing multicloud environments -- combinations, for example, of software applications, infrastructure services and private cloud implementations -- speaker Judith Hurwitz said cognitive computing can be used to collect data about IT systems and then understand what optimal performance levels IT systems should be at. "It doesn't happen on day one," said Hurwitz, president of Hurwitz & Associates and author of many books on IT. "But over time you'll start to collect this data and say, 'Gee, I know the normal condition for these three systems exchanging information and working together should act like this. And one day it acts differently. It goes ping-ping-ping. Well, that's not normal.'"

Why Google BigQuery Excels At BI On Big Data Concurrency

"Concurrency, I think, was the biggest one," Klahr says. "But the user experience with BigQuery was also really nice. Maybe this isn't a surprise because Google has focused so much on consumer products over the years: Everything about using the product was really nice. The thing that actually took the longest was loading the data from our local network onto the cloud. Once we had the data there, the creation of the tables was really easy." For its benchmark, AtScale used the same model it deployed last year for its benchmark tests of SQL-on-Hadoop engines on BI workloads. For that test, the idea was to help technology evaluators select the best SQL-on-Hadoop technology for their BI use cases. The goal was the same for the Google BigQuery benchmark.

Quote for the day:

"Yesterday is dust. Tomorrow is a dream. Our gift is now." -- Gabriel Byrne

Daily Tech Digest - April 07, 2017

Why artificial intelligence still needs a human touch

If AI is currently struggling to discern facts from fiction, could it be that human intelligence is still a necessary component for the continued successful integration of AI? In a much simpler time, Google was a search engine that indexed websites. Today, the search giant is evolving towards giving users summarised answers to their billions of questions. Type in a word and you’ll get the definition. Type in a name and you’ll get a short biography. Type in a question and roughly one in five times, Google will generate a specific answer. This evolution of Google Search into something one could call Google “Q&A” goes hand in hand with the rapid evolution away from typed search towards AI-powered voice assistants.

Trust issues: Know the limits of SSL certificates

There are many reasons a domain owner may decide to obtain a TLS/SSL certificate, but the most common one is to give users a way to verify that the site is authentic and the owner is legitimate. Another reason is that—in this day of rampant surveillance, tracking, and eavesdropping—there is growing interest in encrypting all traffic moving from the user’s computer or mobile device and the web server hosting the application. These are two distinct reasons for getting certificates, but both rely on HTTPS. That HTTPS reliance has made it easy for domain owners and internet users to conflate the two, causing further confusion beyond the trust issues, said Ilia Kolochenko, CEO of web security company High-Tech Bridge. “We should separate the HTTP traffic encryption and website identity verification questions.

How IBM wants to use Watson to speed up IT help desk support

The solution will be offered at a set price, the release noted, and will help personalize the helpdesk experience for all employees, even those who are more tech-savvy. The new service will also be able to support a mobile-centric IT environment as well. Users can chat with Watson thanks to its natural language processing capabilities, and the helpdesk service will suggest solutions based on previous experiences. The more interactions that the Watson service has and learns from, the better it will understand common IT problems, the release said. However, if it encounters a new problem that it doesn't have a solution for, the user will be transferred to a human support agent. The new service is always on, and will be available to employees at all times. And the automation that is built into it can take actions on behalf of the customers, like "adding additional storage to an email account, unlocking a password, ordering of a new phone etc.," the release said.

How Big Data is Becoming Smaller Than Small Data

Owners of e-commerce companies are often unaware that they are using Big Data. The owner of an online boutique, for example, could look at her premium Google Analytics reports and order her webmaster to make certain changes beneficial to visitors and conducive to more sales. Unless this boutique is getting millions of visitors each day, the owner made a decision based on small data; however, the recommendation came from Big Data. Business solutions such as Google Analytics essentially turn Big Data into small data. The results are easy to interpret so that actionable decisions can be made, and this is very important for e-commerce operators. An example of an e-commerce website that makes good decisions based on small data is SNI’s pharmaceutical sales training, which has been carefully designed after looking at "heat maps" that show how visitors behave when they browse each page and where they are more likely to click.

10 Fun Tech Ads Through the Years

It's rare for us to spend an hour-long staff meeting in nonstop laughter. But that's pretty much what happened when we gathered to go through old print issues of Computerworld as part of our 40th anniversary celebration. The original idea of hauling those Computerworld issues out of storage was to look at important stories we've covered. But we couldn't get over the ads! "80 Mbytes of storage for less than $12,000!" boasts one. In another, a woman in hot pants touts a modem that's, yes, "maybe even sexy." There's even a campy B movie celebrity hawking development software. It was too much fun not to share. So after one of the best meetings ever, we bring you 10 of our favorite, most entertaining IT ads from Computerworld throughout the years.

Wish list: What I’d like to see in the new Mac Pro

A lot of Mac Pro users rely on external storage, but you also need enough internal storage. The current Mac Pro includes 256GB of flash storage, and for content developers, that’s too small. At least 1TB is ideal, but it’s expensive. 512GB, while probably on the small side, is a good cost/capacity compromise. You can upgrade the current cylindrical Mac Pro with a third-party SSD, like one offered by OWC. But the installation involves more than simply disconnecting and removing the old drive and connecting and placing the new one. A new tower case could make it really easy to perform a storage upgrade. Also revealed during Apple’s Mac Pro briefing: The company is working on a pro display. No details were offered on the display, but Apple worked with LG on the UltraFine 5K Display, which can lead you into the direction Apple will probably take with its pro display.

People Are Paying to Work From Bars and Restaurants

Co-working spaces, where people rent desks and offices alongside other freelance or satellite workers, have become a global sensation, led by WeWork Cos. The New York-based company was valued at more than $17 billion last month after an investment from SoftBank Group Corp. WeWork provides members with free snacks and access to in-office beer kegs. It has 162 office locations in 41 cities around the world. WeWork’s hometown is one of the world’s co-working capitals. Commercial real estate devoted to co-working in New York City has grown fivefold in the past five years, according to Jonathan Mazur, managing director at real estate firm Newmark Grubb Knight Frank. The city, with its high concentration of restaurants and bars, offers plenty of options for Spacious and its rivals, such as WorkEatPlay and KettleSpace.

Keeping the enterprise secure in the age of mass encryption

Businesses urgently need to improve their management of encrypted tunnels, or they risk compromising the effectiveness of our cyber security defences. But for that to happen, organisations must first gain visibility and control over their expansive estates of digital keys and certificates. These keys and certificates are the cryptographic assets that form the foundation of encryption, allowing machines to identify each other in the same way usernames and passwords work for human users. ... The growth of HTTPS is both a positive and negative thing. Encryption is the primary tool used to keep internet transactions out of the reach of prying eyes, and we’ve seen increased adoption over the past few years, partly driven by revelations of mass state surveillance exposed by NSA whistleblower Edward Snowden.

2017 State of Testing Report

Testers’ ability to dissect products built on AI or VR would give them great benefit for designing more and more test ideas. I would personally try applying a variety of heuristics that I know (SFDIPOT, I SLICED UP FUN, FCC CUTS VIDS, Huh? Really? So? Etc.) in order to understand the product better. To keep up with such fascinating developments, I would recommend practicing critical thinking and develop a deeper understanding of the man-machine relationship. ... A piece of advice that I think is extremely important for people, specially for testers starting to work on something new such as VR and AI, is to work as a user with these things. “Get your hands dirty” and experience first hand what your users will be doing with the products you are testing. This first hand experience will be second to none when approaching your projects and looking for those important bugs that represent the behavior of your users in the real world.

Google's defense in depth

Google is a firm believer of defense in depth when it comes to security. This much is evident from the physical security of its data centers, where multiple layers of checks ensure that only authorized personnel can step into the highly-secured facilities. Only employees that are on a preauthorized list, consisting of a very small fraction of all Google employees, are allowed through the gates of a Google data center. Much like a typical data center, a second check is required before one can enter the building. Finally, stepping into the secure corridor leading into the data center hall necessitates clearing a biometric scan such as an iris scan, said Joe Kava, vice president of Google’s data center operations in a 2014 video. Inside, the data center is segregated for security, with the most secure areas protected by laser-based underfloor intrusion detection systems.

Quote for the day:

"The way to get started is to quit talking and begin doing." -- Walt Disney

Daily Tech Digest - April 06, 2017

How to apply DevOps practices to legacy IT

“The same DevOps principles still apply to those people who manage legacy software stacks, so the team that writes software also has operational duties,” says Dean. “Part of our DevOps transformation has been to support teams that may not have had access to the technical environments needed to deploy their software and let them operate in a DevOps fashion.” In some cases, this means adding operational staff to the team directly, such as embedding into the development team the application engineers or system engineers who previously worked in operations supporting the legacy systems. “We really changed their mission from an operations role to a site reliability engineer role or a DevOps engineer role, where their mission is to help the team take control and ownership of their own software,” says Dean.

How Banks and Fintech Companies Can Benefit From Each Other

Rather than view the new technology offered by today’s fintech startups as a total disruption of the banking industry, it might be useful to see it as a way to fine-tune the successes that banks already have. Banks still own the bulk of customer relationships, both personal and business. What they don’t often own, however, is the best technology for the best customer service. It’s not that they haven’t wanted to have it—spending on compliance technology had to come first—but by partnering with fintech companies they can get the lending technology they need for their most important business segments quickly and easily. They can serve small businesses in a much more cost-effective way. Fintech startups can also help banks to better mine customer data and, in doing so, perhaps expand their boundaries way beyond the area of payment and consumer credit.

Scammers Phishing for financial credentials on Twitter

Attacks like these are the risk that's attached to conducting support on social media. The best defense is awareness, and knowing who you're interacting with. For banks like Nationwide and NatWest, their support channels are all verified accounts, and they'll only discuss the basics online, often via direct message. If you have to obtain support via social media, you should only work with those verified accounts. Anyone asking for sensitive information via public channels (even verified accounts) should be treated as suspect, especially if they're directing you to follow links on free hosting services. If you do accidentally click a link, ensure that the URL is the one you're supposed to be on, and that it's using SSL. If you've logged in via a fake website, contact your bank and change your password.

Engaging millennials in the workplace: instant gratification is not enough

For the millennial employee, job hopping may, in the short term, lead to new opportunities, increases in pay and better titles, but these transitions cannot infinitely keep up with a need for regular progress. As millennials move into mid-level management roles and senior individual contributor positions, they must balance longer periods between levels while finding intrinsic means to remain motivated and engaged towards achieving substantial goals required to eventually move up into even greater responsibility. Setting realistic goals and ensuring these goals are aligned across upper management and direct reports is one of the leading factors in upwards mobility in the workplace. Yet many employees in this demographic struggle with setting goals and making progress towards them.

High-tech startups need a different type of banking

The high-tech ecosystem consists mostly of start-ups founded by young individuals who crave personal, direct and around-the-clock contact with their financial adviser. This builds a close relationship where the banker is intimately acquainted with the business, its characteristics and its managers. ... To deliver an adapted service, the banker has to be in a position to provide overseas banking services, facilitate the execution of complex digital banking transactions and to offer solutions typical for the investor environment of the high-tech world, like venture capitalists. Banks must provide a carefully tailored package of financial services for each stage in the start-up's lifecycle. A high-tech bank must also support its customers throughout the company’s development, advising them on how to safeguard investor funds and make optimal use of money received.

Walking Through the European Minefield of Cyber-Threats

Managing cyber-security in Europe sometimes feels like walking through a minefield, where you have to calculate the risks with each step in order to make it safely. Between EU and / or local regulations, the ambition to keep the organization secure by all means, and the business demands to be dynamic and agile, it is easy to spot the CISO in a board meeting – look for the person who looks the most frustrated. There is a correlation between a growing number of unhappy CISOs and security events. A lot has been discussed concerning the evolution of cyber-attack tools into mature, powerful and sophisticated programs, and the growing resources companies have to invest in technology, labor, compliance and skill. We at Radware went ahead to get a closer look at the concerns and experiences of European companies.

McAfee report reveals five challenges to cyber threat intelligence

McAfee counted 197 publicly-disclosed security incidents in Q4 and 974 publicly-disclosed security incidents in 2016. Security incidents are events that compromise the integrity, confidentiality or availability of information assets. Some, but not all, of these incidents are breaches. Breaches are incidents that result in the confirmed disclosure of data. According to the report, the public sector experienced the greatest number of incidents by far, but McAfee believes this may be the result of stricter requirements for reporting incidents, as well as an increase in attacks related to the US election process, mostly voter database incidents and defacing of election websites.

The reality of hacking….or a new hacking reality?

A cyber-physical system is closely coupled with, but is not synonymous with, the Internet of Things (IoT). IoT devices are typically the controllers of the cyber-physical domain. They use one or multiple connective technologies (e.g. cellular or Bluetooth) and are governed by service providers or user applications on a mobile device. For instance, the iPhone application provided by your vehicle manufacturer enables you to unlock your car or start the engine remotely. The Amazon Echo smart speaker app that controls your home lighting is another good example. What is common to these examples is that they allow us, as end users, to wirelessly manipulate physical functions. Our control over these systems is terminated at the IoT controller. The IoT controllers communicate with physical objects using two key elements – sensors and actuators.

Microsoft reveals what data Windows 10 collects from you

Opting for the “full” telemetry level, according to Microsoft, will allow the company to “use diagnostic data to improve Windows 10 for everyone and deliver more personalized experiences for you where you choose to let us do so.” The actual data collected under “full” is broken down into the following nine categories: common data; product and service usage data; software setup and inventory data; content consumption data; browsing, search and query data; inking, typing, and speech utterance data; and licensing and purchase data. If you go back and look at “basic” level, it is noted that “every event generated includes common data, which collects device data.” You should look at some of the common data. There is an entire section devoted to obtaining users’ privacy settings before and after upgrading to Creators Update.

Prevent Or Detect? What To Do About Vulnerabilities

In order to build a strong security program, CISOs need to invest in the right balance of prevention, detection, and response, which means that they may want to leave some vulnerabilities that they can manage in order to focus more on detection. Jeff Williams, CTO and co-founder at Contrast Security, said, "Winkler is trying to make a distinction between protect, detect, and react. And of course, a responsible security strategy has all three." The question then is one of prioritization. Williams said, "Prioritizing detect and react over protect is offering candy to CISOs overwhelmed with their security challenge." If one were to use the analogy of home security, not trying to prevent a vulnerability, said Williams, "Is like saying, don’t worry about locking your doors and windows. Just wait for the alarm to go off and the police will protect you."

Quote for the day:

"Sometimes a pessimist is only an optimist with extra information." -- Idries Shah

Daily Tech Digest - April 05, 2017

Businesses Hit by More W-2 Fraud as Cybercriminals Shift Tax Season Targets

Cybercriminals often collect W-2 data by pretending to be a company exec and emailing HR or payroll for employee information, which is used to file fraudulent returns and collect refunds. In addition, they may also request a wire transfer to a specific bank account. Attackers who are more technically inclined may bypass the fake emails and breach an organization's servers to steal data directly, says Kessem. In addition to using W-2 data for their own scams, fraudsters will sell it on the dark web, the report states. The most valuable bundles of information are called "Fullz" and contain the victim's address, contact info, Social Security and driver's license numbers, plus all W-2 and W-9 information. Each record runs for $40-$50 in Bitcoin on the Dark Web.

What home products are most susceptible to cyber burglars?

Just like the lock on your front door to keep out burglars, you should protect your high-tech devices from cyber threats. Start by choosing different passwords for your internet router and each of your smart devices. It is also important to use multi-factor authentication as an added protection to prevent a hacker who guesses your password from breaking into your home. You should regularly install manufacturer updates to make sure you are running the most current security system in your home. Ovum's "Smart Home Devices Forecast: 2016–21" found that the largest smart home markets will be China and the US, because of high availability of devices and greater consumer interest in smart home services and products. Device sales will grow to more than 1.4 billion units by 2021, up from 224 million in 2016, driven particularly by sales of security devices, such as cameras, door locks, and sensors, and by utilities devices, such as connected light bulbs and smart thermostats.

You are not very incognito in incognito mode

Basically, incognito mode just means that the browser doesn't save cookies, temporary internet files or your browsing history when you are in incognito mode. The main thing it does is hide your browsing history from other people who use the same computer. Not all of reasons someone might want to do this are nefarious; I used incognito mode when I was shopping for Christmas presents on a shared computer this past year, and successfully managed to keep the gifts I searched for and purchased a secret. There are other uses for incognito mode apart from keeping your browsing history secure from prying eyes. For example, you can be logged into your main Google account, then open an Incognito Window and use it log into a separate or secondary Google account at the same time.

NASA official warns of 'the internet of dangerous things'

The reason why software security is weak, Davis said, is because industry is "all about speed to market." Plus, there are "not enough people out there who can actually build these things the correct way," he said. Exacerbating the concerns about the internet of things, Davis said, is that the information-sharing systems currently in place are "just completely broken." Even though security groups share the same mission to protect users, Davis pointed to shareholder issues and concerns about attribution and embarrassment as reasons why both public and private groups are reluctant to share. To keep up with the emerging security problems, Davis said that industry and government alike must work to foster security skill sets. Both government and industry have to navigate the shortage of cybersecurity specialists, but government is at a disadvantage because of its protracted hiring process and inability to compete with top private-sector compensation, Davis said.

IT leaders share how they quell cybersecurity attacks

"God forbid someone drop a cyber nuke or DDOS from malware -- they can take down a whole environment," Belfiore says. "If we're down it doesn't really matter how secure we are -- we have a problem." Even so, security chiefs have to protect their data. Aon is a heavy consumer of Tanium, whose endpoint security software monitors IT operations and detects malware, among other threats. Belfiore says the software covers anything from kernel operations of a server processor to the application portfolio that is operating on it. “Think of it as an agent, almost like a spy to every asset on environment to give you real-time status on any attribute related to operations and security,” says Belfiore who joined Tanium’s board of directors this year. “It's almost like a central management system on steroids for security and operations.”

Notorious IoS Spyware Has An Android Sibling

The spyware was uncovered when a human rights activist in the United Arab Emirates was found infected by it. His phone had received an SMS text message, which contained a malicious link to the spyware. Apple quickly issued a patch. But Lookout had also been investigating into whether NSO Group developed an Android version. To find out, the security firm compared how the iOS version compromises an iPhone and matched those signatures with suspicious behavior from a select group of Android apps. Those findings were then shared with Google, which managed to identify who was affected. However, unlike the iOS version, the Android variant doesn’t actually exploit any unknown vulnerabilities. Instead, it taps known flaws in older Android versions. Chrysaor was never available on Google Play, and the small number of infected devices found suggests that most users will never encounter it, the search giant said.

McAfee Returns to Its Roots After Intel Spin-Out

Now, McAfee is embarking on yet another chapter: It has officially been spun out of Intel and is a standalone security player, yet again. Its new overlords? Well, Intel’s still in the mix, with 49% equity in the now-independent McAfee. The majority backer, however, is private equity firm TPG Capital, which has a 51% share in the company. (Another PE firm, Thoma Bravo, has also joined as a minority investor through an agreement with TPG.) As for the price tag? McAfee was valued at $4.2 billion in this most recent deal, a far cry from its former valuation. The decreased price isn’t the only thing that’s different at the newly-free McAfee. The company also has a new chief executive officer: former Intel Security head Chris Young. The CEO, a long-time security exec, has an ambitious to-do list.

The best laptops of 2017: Ultrabooks, budget PCs, 2-in-1s, and more

Dell might be sticking to the adage of “If it ain’t broke, don’t fix it” when it comes to the XPS 13, but that strategy keeps producing the best ultrabook of the bunch. The Kaby Lake XPS 13 shares the same design as its predecessors: a quality aluminium exterior and carbon-fiber top, and that wonderfully compact, bezel-free 13-inch screen. Dell actually released two updates to the XPS 13 in 2016: The one at the start of the year swapped in a Skylake CPU, added a USB Type-C port that served as an alternative charging port, and offered upgraded storage options. The most recent refresh—and our new pick for Best Ultrabook—keeps the same chassis changes as the Skylake XPS 13, features a jump to Intel’s new Kaby Lake processor, and sports a slightly larger battery. You get improved performance across the board, with a nice bump of an extra half-hour of battery life during video playback.

Why Android's ongoing domination actually matters

The better Android does in the big picture, the more app developers will be motivated to invest in it and make it a priority. The more people who use Android, the more hardware manufacturers will be driven to make standout devices and accessories. The companies that don't will miss out on reaching the overwhelming majority of internet-using consumers -- an increasingly difficult position to justify from a common-sense business perspective. ... The bottom line is this: When it comes to something like market share, no single statistic or study is as important as it may initially appear. But taken together as a whole, ongoing trends absolutely are meaningful -- in a way that has an indirect though very practical impact on users.

Enhance Your Testing Skills with Mindset Tools

Quite a lot of testers often miss out on the mindset that’s needed for testing and delivery of quality products. Sometimes it seems that quality consciousness is missing. Little wonder why some testers only find obvious bugs and why quality is far-fetched from the PUT (Program under test), despite the presence of testers on the project. Adding up to this is the overwhelming and unnecessary challenges that awaits a project where individuals in each role (programmer, project manager, test lead, testers), lack proper understanding and appropriation of the level of test mindset that is needed for each role, in order to enhance successful release of quality products. This article is about how I discovered a way to grow my test mindset and how my discovery has been useful in enhancing my testing skills.

Quote for the day:

"The machine does not isolate man from the great problems of nature but plunges him more deeply into them." -- Antoine de Saint

Daily Tech Digest - April 04, 2017

Augmented, Virtual, and Mixed Reality: the Outlook for Tomorrow

Augmented reality can be described as an additional layer to our reality. It does not replace the real world, it just adds something, you can still see or hear the environment around you, whereas VR completely puts you in a different reality with total immersion. AR can’t change people’s imagination of the world and its representation, but complements the real world with artificial objects and new information. There are various types of AR. The key differences between them are the objectives and use of applications. ... Of all the three ‘realities’, this one is the least known, but ironically, perhaps, has the easiest path to consumers. The easiest way to explain MR is to say it combines the best aspects of VR and AR. MR mixes with virtuality, adds believable virtual elements to the world. The aim of MR is to unite the best characteristic of virtual reality and AR.

The 2 Biggest Cybersecurity Fears of NASDAQ's Chief Information Security Officer

I recently spoke with Lou Modano, Chief Information Security Officer of NASDAQ, and asked him what his greatest fears are right now when it comes to keeping NASDAQ cyber-safe. Of course, there are many threats facing NASDAQ - from criminals to hacktivists to nation states - and the stock exchange obviously has an army of highly skilled information-security professionals, intensive information-security-related training, and a robust information-security technological infrastructure, so my question went beyond the usual technological and human issues, and, instead focused on what risks are hardest to correct even with significant cybersecurity resources. As such, CISO Modano's observations provide insight into the big-picture problems that businesses, cybersecurity professionals, and policymakers should be thinking about.

Fortify IoT infrastructure now, even for simple deployments

"A lot of the current deployments really don't need that much bandwidth," Stolarski said. Latency is not a concern for these IT pros, and they typically view data on dashboards, rather than use real-time analytics or decision-making at the edge, Stolarski said. Kevin Roberts, director of platform technology at FinancialForce, a cloud-based software startup in San Francisco, is building out the financial back end to support a growing number of IoT deployments in the enterprise. Roberts said he's seen a turnaround in terms of the acceptance of cloud computing in recent years, which has shifted from mistrust of the cloud to widespread acceptance. Right now, it's unclear what sort of backbone enterprises will use to support their IoT efforts, Roberts said. There will continue to be a shakeout to decide who will buy, own and manage IoT infrastructure.

Chinese hacking group targeted firms though IT MSPs

The espionage campaign has targeted managed MSPs, potentially allowing the APT10 group unprecedented access to the intellectual property and sensitive data of those MSPs and their clients around the world. This campaign provides a useful reminder that an organisation’s entire supply chain needs to be managed and that organisations cannot outsource their risk, said the NCSC, adding that MSPs are particularly attractive to attackers because they often have highly privileged access to systems and data. “As part of your procurement, you should have ensured that your service providers all manage their security to a level broadly equivalent to that you would expect from your internal functions. This incident provides a useful impetus to revisit those discussions,” the NCSC said.

Cybercriminals Seized Control of Brazilian Bank for 5 Hours

The operation actually began at least five months prior to the actual hijack on Saturday, Oct. 22. Bestuzhev says it's unclear just how the attackers were able to compromise the DNS provider, but notes that Registro.br in January of this year patched a cross-site request forgery flaw on its website. "Maybe they [the attackers] exploited the vulnerability on that website and got control. Or … We found several phishing emails targeting employees of that registrar, so they could have spear-phished them," he says. "We don't know how exactly they originally compromised" the DNS provider, he says. The bank didn't deploy the two-factor authentication option offered by Registro.br, which left the financial institution vulnerable to an authentication-type attack as well as authentication-type flaws such as CSRF, Fabio Assolini, a Kaspersky Lab researcher said here today during a presentation about the bank hijack discovered by Kaspersky.

A Comprehensive Look at F# 4.1

At the top of the list are Struct Tuples. Tuples are very important to idiomatic code in F# and other functional programming languages. A major criticism of F#’s implementation, known as System.Tuple, was that it is a reference type. This means potentially expensive memory allocation is needed each and every time a tuple is created. Being immutable objects, that can happen quite frequently. This was solved in .NET by the introduction of the ValueTuple type. Also used by VB and C#, this value type will improve performance in scenarios where memory pressure and GC cycles are an issue. Care has to be used, however, as repeatedly copying ValueTuples more than 16 bytes in size may introduce other performance penalties. In F#, you can use the struct annotation to declare a struct tuple instead of a normal tuple. The resulting type works similarly to a normal tuple, but is not compatible so switching is a breaking change.

Data Deduplication: It’s Not Just About Storage Savings Anymore

The data backup and deduplication solution should allow discovery of how content propagates across the organization. It should not obscure the trail that shows where a piece of content originated. And it’s important to remember that dark data doesn’t just comprise files but also the metadata associated with each file, which tells what devices contain the content, when the file was created, when modifications were made and other key data points. Endpoint data is incredibly vulnerable to theft and loss since the devices that contain it are more likely to be lost or stolen. And the dangers are growing since there is a huge profit motive to gain access to that data. Ransomware attacks, for example, are growing at an alarming pace. And data breach costs in general are rising.

Why Enterprises Are Upgrading To Windows 10 Faster Than Expected

One reason the pilots and deployments are going so smoothly is that, in many cases, enterprises are rolling out Windows 10 as if it were Windows 7, says Kleynhans. “It's pretty much as a direct replacement; they're not necessarily making much use of the new features.” Instead they’re using the pilots and early deployments to gain familiarity with the new OS, starting with an experimental pilot in one division (or even one country) that then expands across the organization. “They're turning on maybe one or two new features but they're not really rushing forward with all the new enterprise features,” he says. The features enterprises do adopt are the security enhancements in Windows 10. “They’re really intrigued by the new security capabilities; they're looking forward to those. That's one of the things driving Windows 10 adoption,” says Kleynhans.

Application support and maintenance add up to operational ALM

To achieve true software-enabled automation of application support and maintenance -- the holy grail -- the operations team must implement the complete state-event description of an application's operational lifecycle in DevOps tooling. Continuous delivery and application availability management becomes a reality when development and change management tasks, implemented through ALM practices and tools, are integrated with DevOps-based operational application maintenance and support. With more cloud and virtualization adoption, the imperative to manage operational lifecycles grows. These same forces demand the use of software automation to improve efficiency and reduce configuration errors. Without an effective way of managing the operational lifecycle of applications, much of the effort put into traditional ALM will go to waste.

Analytics, internet of things to drive data volumes to 163ZB by 2025

According to the study, we are transitioning from a period in which information has been transformed from analog to digital to one in which digital information will increasingly be a critical part of systems required for everyday life-critical systems that use analytics, machine learning and the internet of things (IoT). According to the study, Data Age 2025: The evolution of data to life critical, nearly 20% of the world’s data will be critical to our daily lives by 2025, and nearly 10% of that will be “hypercritical”. A large portion of this will be created by embedded systems and the IoT. By 2025, an average connected person anywhere in the world will interact with connected devices nearly 4,800 times per day. That’s one interaction every 18 seconds. The amount of data subject to analysis is estimated to grow by a factor of 50 to 5.2 ZB in 2025.

Quote for the day:

"If you're not prepared to be wrong, you'll never come up with anything original." -- @SirKenRobinson