Daily Tech Digest - November 12, 2017

This Robot Swarm Finishes Your Grocery Shopping In Minutes

“Because the robots are brand new, it looks like a render but in fact it’s 100% real,” answers Alex Voica, the head of technology PR and communications at Ocado, a British online-only supermarket that delivers orders to customers straight from its warehouses. Ocado sells everything you can find in a brick-and-mortar supermarket–from meat, dairy, and produce to its own brand of home products, third-party goods, and even flowers, toys, and magazines. When it comes to online delivery, speed and efficiency are paramount, which is why the company has been working on automation since it was founded in 2000. While other companies rely on human workers to find and buy all of the items on an online customer’s shopping list, Ocado is using a new kind of robot–or, more specifically, a swarm of them.

Accountability is not the problem you’re looking to solve

Perceived lack of accountability is a symptom of a larger problem in the organization. If the organization believes their people are not accountable or responsible, that points directly to a deficit in trust. We see both in Patrick Lencioni’s hierarchy of the 5 dysfunctions of a team, though avoidance of accountability is not the root problem, absence of trust is. ... One way management often hinders teams in in forming trust is by frequently changing their members around, thus causing them to have to re-form relationships. How can we expect people to be accountable to people they have never worked with before and immediately deliver on everything that is expected of them? Those are unfair expectations and teams are at a disadvantage from their inception

Commanding Large Datasets With Ease

You would think that since data integration is something every successful dashboard deployment requires, most dashboards would come with software that would allow such integration out of the box. Far from it. Most dashboards ship with very basic Extract-Transform-Load (ETL) functions, if any. Such simple ETL works great for demo software but fails miserably when presented with real-world challenges. The Syncfusion Dashboard Platform is unique in this respect. Not only is it one of the most powerful, elaborate, and mobile-enabled dashboard platforms available (at any price), it is complemented by a complete data integration platform. Syncfusion's Data Integration Platform allows you to easily integrate data from multiple data sources. You can perform complex integration tasks without writing any code. There are out-of-the-box processors for all your data handling needs. There is also support for custom processors.

Severe shortage of cyber skills poses data security threat

“The cyber-security skills shortage represents an existential threat to our national security, and this year-over-year comparison data bears out this fact,” says Jon Oltsik, an ESG analyst and the report’s author. “We are not making progress, cyber-security professionals can’t scale, and the implications of the skills shortage are becoming more pervasive and ominous. “It is clear that the solution must be about more than filling jobs,” he adds. “It is about creating an environment from the top down of cybersecurity as a priority.” In the report, Oltsik also identifies the five most important investment mistakes that businesses make with regards to cybersecurity and suggests remedies based on the study: Failing to align cybersecurity and business goals: To correct this, 43 percent of the survey respondents suggest establishing security-related goals and metrics for IT and business managers.

Proactively Managing Data Compliance With Encryption Strategies

There is a perception problem with encryption, where companies consider it to be a time-consuming process that is not worth the effort when compared to the perceived risk of being hacked. The “it won’t happen to us” mentality is pervasive, despite the industry predictions that cybercrime damages will cost the world $6 trillion annually by 2021 (according to Cybersecurity Ventures). Whether a firm believes their current safeguards are sufficient, or that hackers won’t target their business, they avoid encryption until it’s simply too late. They are not performing the usual risk/reward that organizations should consider when weighing the value of data and the downsides of a breach. Encryption is also not as mysterious and complex as many believe. It simply involves taking data and translating it into a different form that requires an access key to read, share and edit.

Big Data, IoT and the need for high density and ultra high density computing

IoT and big data put intense pressure on the security, servers, storage and network of any organisation - and the impact of these demands is being felt across the entire technological supply chain. IT departments need to deploy more forward-looking capacity management to be able to proactively meet the business priorities associated with IoT connections. And big data processing requires a vast amount of storage and computing resources. All this means that, ultimately, the data centre now sits firmly at the heart of the business. Apart from being able to store IoT generated data, the ability to access and interpret it as meaningful actionable information - very quickly - is vitally important, and will give huge competitive advantage to those organisations that do it well.

How better data governance can help banks keep pace with the rising tide of regulations

In the case of GDPR, for example, Australian banks operating in Europe will need to implement a personally identifiable information (PII) data hub where they can pull all relevant data together in one place. They will also need to reconcile and harmonise disparate PII data into a “single version of the truth” using data quality and master data management (MDM) together with metadata management to establish data lineage. Data lineage is frequently seen as the first step towards good data governance. In fact, data governance effectively takes data lineage one stage further by outlining a full set of processes that ensure important data assets are formally managed across the entire enterprise. Having in place the right data governance systems and solutions is vital in delivering a fully secure, well-managed and compliant data environment within banks.

Best Practices to Help Safeguard Your Organization for the Internet of Things

First of all, because advanced threats like Hajime and WannaCry were so successful at targeting known vulnerabilities, this has become an increasingly popular attack vector for cybercriminals. As a result, patch management is essential. WannaCry targeted a vulnerability for which a patch had been available for more than two months. ... And the new Reaper IoT botnet can simultaneously target multiple vulnerabilities across a number of manufacturers using a constantly updated vulnerability list. Organizations that are spared the effects of these sorts of attacks all have one thing in common - a strong cyber-hygiene policy that includes applying patches as soon as they're available. But physical patching is only part of the solution. There are billions of vulnerable devices out there with no patches in sight. This is where intrusion-prevention systems (IPS) are essential. 

What's Worse for Your Account: a Data Breach or a Phishing Attack?

The good news is that data breaches tend to only contain username and password information, which is sometimes not enough to break into an account. For instance, Google has protections in place to also analyze where a login takes place and from what device. Any deviations found can prompt Google to verify your identity. Attacks from phishing kits, on the other hand, can be designed to extract more detailed information from their victims, including geo-location data, the login device, and even account recovery questions. "Our findings indicate that while credential leaks may expose the largest number of passwords, phishing kits and keyloggers provide more flexibility to adapt to new account protections," the study said. Google has forced a password reset for the company users found in the sample datasets.

New age insurers are technology and data driven

Insurers might have to do a cost-benefit analysis to finalise build or buy decisions. Once a data infrastructure is in place, data can be tapped and insights can be generated using advanced analytics algorithms. These insights can then further fine-tune data needs, which can again enhance/update data collection and aggregation. Whether an insurer begins this process on a small or large scale, the deployment of big data and advanced analytics in business decisions is a complex undertaking which requires a structured approach with multiple dimensions. We believe that a framework for such a transformation involves interdependent components, each of which adds distinctive characteristics. It starts with the source of value, accordingly deriving the needed data ecosystem and modelling insights, further moving on to workflow integration and adoption.

---

Quote for the day:

"Leadership is a privilege to better the lives of others. It is not an opportunity to satisfy personal greed." -- Mwai Kibaki

---

Daily Tech Digest - November 11, 2017

Forrester's top 6 cybersecurity predictions for 2018

It's become easier for firms to monitor employees and their activities as a means to thwart malicious insiders, employees making mistakes, or an attacker with compromised employee credentials. However, employees may find this to be an invasion of privacy. In September, the European Court of Human Rights ruled that companies must inform employees in advance if their work email accounts are going to be monitored. Further, such monitoring must not infringe upon workers' privacy, the court ruled. The EU GDPR also applies to employee privacy and data handling, and includes large fines for noncompliance. "Conventional wisdom dictates that mishandling of customer data will draw the ire of regulators, but employee data is personal data, and Forrester predicts that regulators will be just as likely to focus on employee privacy violations as they are customer violations," according to the report.

Android security audit: An 11-step checklist

Android security is always a hot topic on these here Nets of Inter — and almost always for the wrong reason. As we've discussed ad nauseam over the years, most of the missives you read about this-or-that super-scary malware/virus/brain-eating-boogie-monster are overly sensationalized accounts tied to theoretical threats with practically zero chance of actually affecting you in the real world. If you look closely, in fact, you'll start to notice that the vast majority of those stories stem from companies that — gasp! — make their money selling malware protection programs for Android phones.  The reality is that Google has some pretty advanced methods of protection in place for Android, and as long as you take advantage of those and use a little common sense, you'll almost certainly be fine. The biggest threat you should be thinking about is your own security surrounding your devices and accounts — and all it takes is a few minutes a year to make sure your setup is sound.

Ensuring data security in customer support programs

In today’s digital era, the implications of data breaches can be extremely far reaching. When valuable information is stolen from a company, the damage goes beyond initial cost to include brand reputation, customer loyalty and ultimately, revenue. Every company wants to avoid becoming tomorrow’s next mega breach headline, but one of the biggest missteps here is a lack of understanding that it’s no longer a matter of if a company will be breached, but when. October was National Cybersecurity Awareness Month, and yet this month alone brought forth a number of troubling security incidents. While the security outlook may seem bleak these days, there are several measures organizations can implement to prevent breaches across their systems.

Artificial intelligence is going to completely change your life

Just as electricity transformed the way industries functioned in the past century, artificial intelligence — the science of programming cognitive abilities into machines — has the power to substantially change society in the next 100 years. AI is being harnessed to enable such things as home robots, robo-taxis and mental health chatbots to make you feel better. A startup is developing robots with AI that brings them closer to human level intelligence. Already, AI has been embedding itself in daily life — such as powering the brains of digital assistants Siri and Alexa. It lets consumers shop and search online more accurately and efficiently, among other tasks that people take for granted. “AI is the new electricity,” said Andrew Ng, co-founder of Coursera and an adjunct Stanford professor who founded the Google Brain Deep Learning Project, in a keynote speech at the AI Frontiers conference that was held this past weekend in Silicon Valley.

How will AI change the future of banking and financial services?

Crooks are getting smarter about fooling the casual observer with their financial actions. It might take a forensic accountant to identify instances of illegal money laundering. This is not so when you combine machine learning use cases in finance with artificial intelligence. AI, armed with the knowledge of hundreds of forensic accountants, could quickly spot telltale activity. It makes the Federal Reserve, the FBI, and in some cases, the CIA happy; it increases the bank’s reputation; it increases the likelihood of appropriate taxation for the IRS; and, more than likely, it puts a significant dent in crime.  ... It also works for identifying employees for access to restricted areas, or the ability to perform specific actions. It can even identify a pre-actions characteristic of a robbery before it happens, and alert staff, security, and the police before it occurs.

“Unlearn” to Unleash Your Data Lake

It takes years – sometimes a lifetime – to perfect certain skills in life: hitting a jump shot off the dribble, nailing that double high C on the trumpet, parallel parking a Ford Expedition. Malcolm Gladwell wrote a book, “Outliers,” discussing the amount of work – 10,000 hours – required to perfect a skill (while the exactness of 10,000 hours has come under debate, it is still a useful point that people need to invest considerable time and effort to master a skill). But once we get comfortable with something that we feel that we have mastered, we become reluctant to change. We are reluctant to unlearn what we’ve taken so long to master. Changing your point of release on a jump shot or your embouchure for playing lead trumpet is dang hard! Why? Because it is harder to unlearn than it is to learn. It is harder to un-wire all those synoptic nerve endings and deep memories than it was to wire them in the first place.

Are You Ready to Have a Robot as Your Boss?

While there is much focus on the adverse implications of the AI and robot revolution on frontline jobs, it can impact the roles of professionals and managers, too. AI could replace routine administrative tasks and financial-based decision-making processes. Managers need to think of strategies to educate and prepare workers and assist them with job realignment. They should also take actions to reduce increased income inequality, such as reduced workweeks and skills training. Managers will also have to redefine and rethink their roles and consider collaboration and creative thinking with AI and robots. They will be able to collaborate with intelligent systems by using them as an advisor or assistant to help them explore different scenarios or evaluate the consequences of their decisions.

What Tech Is Getting Wrong With The Culture Of Youth

Individuals who have experience in product development know the ropes and have seen complex products through from their development and ongoing iterations. While today’s products may go from conceptualization to implementation faster than ever before, the process is complex and requires highly skilled individuals. And once a product is live, it requires constant iterations, improvements and changes in order to keep up with customer expectations. And this means … Building an iterative system is complex. Systems should not have an expiration date — they evolve over time. Software products constantly change. If you need to replace the system over time, then you are not doing it right. As Uzi stated to me, “This is why I still love to code: You are creating products that will be forever, and they will evolve, but you need to build this into the product.”

Artificial Intelligence Is a Game-Changer for Risk Management in Finance

The prevalence of data-driven decisions and artificial intelligence will also have impact on the kinds of jobs at financial services firms. A recent report by the consulting firm McKinsey estimated that about 50% of staff today are dedicated to risk-related operational processes such as credit administration while 15% focus on analytics. The firm suggests that by 2025 – thanks to the rise in technological advances – the numbers will shift closer to 25% on operational processes and 40% on analytics. One change that is already taking place: the roles of chief technology officer, information officer and chief data officer are starting to see more overlap. These roles were previously disparate, but as investments become more data-driven, CTOs, CIOs and CDOs are finding they need to work together. 

Culture: a Farming Tale

The soil of your company must encompass a culture of learning. The concept of learning is comprised of other concepts such as motivation, curiosity, logic, problem solving, and comprehension. Embedding these concepts in your soil can be achieved with dedication to growth. Nutrients for your soil include activities such as mentoring programs, online subscriptions to tech tutorials, a sizable and accessible training budget (many companies forgo training since turnover is high in their organizations - is this causality?), clear career paths, and tuition reimbursement. Many companies which do not possess large financial assets can substitute feature development for innovation cycles, but something more than a one-day hack-a-thon would be preferable and more productive.

---

Quote for the day:

"Information is pretty thin stuff unless mixed with experience." -- Clarence Day

---

Daily Tech Digest - November 10, 2017

DevOps Adoption and Operational Models at Ticketmaster

The tooling is critical. If you have a solid, well tested pipeline with code reviews which includes infrastructure code, then you are already ticking a lot of the boxes and can iterate faster. This means you can be more secure by responding faster to issues. Sharing ownership of DEV/QA with Operations and Dev teams means any concerns on security or performance happen faster, and you expose Operations teams to the challenges faced by Engineering when environments are different. The tool chain now available means it’s easier to share and these are significant improvements for compliance, particularly if automation means little to no production access. Why would you need it if logging and instrumentation give you all the insight you need? In a container world the notion of RDP or SSH to systems doesn’t make sense anymore unless you’re dealing with state and data where things can get a little more complex.

Transitioning to the role of CISO: Dr. Alissa Johnson

One is that there are a lot of instances where we allowed the culture to drive the security governance, and, a lot of the time, we found ourselves behind the adversary. You have to let security governance drive things -- for example, with multifactor authentication. There may be a better way of doing that, but when we let the culture in a company or agency drive security governance or innovation, that's a problem. The second thing that I learned was that there really isn't a lot of difference between there and here. ... Xerox has no nuclear secrets, but hackers are still attacking us and trying to get data using the same tools and technology. What they want to get is different, but how they get it is the same. All organizations have unique aspects, but when you peel it back and look at the way the attackers come in, [it] is largely the same.

Why Europe’s GDPR privacy regulation is good for business

Organisations need to look after their information assets with the utmost care because they are responsible for its safe keeping as custodians. GDPR is a great reminder to businesses that people lend their information and organisations have a responsibility to look after it. It’s not just about confidentiality, it’s about integrity, accuracy and availability – and it’s just plain good business practice. If you’re managing customer information in a fit and proper way, then requests for that information – known as subject access requests – are nothing to fear. GDPR is expected to lead to a significant increase in consumers submitting subject access requests, which require businesses to disclose copies of the data they hold on individuals. If a company has done all the right work, finding and disclosing information for a subject access request will be easy to do, and there should be a streamlined approach in place for this.

Will human drivers always be the weak link when sharing the road with autonomous vehicles?

If all cars on the road were autonomous, accidents would decline, Ramsey told TechRepublic after the Uber accident. "While they are mixed together, the inflexibility of computers may lead to accidents that wouldn't have happened before even as some other accidents are prevented," he said. In May 2016, a Tesla driver was killed in an accident while the car was operating in its semi-autonomous Autopilot mode. A US Department of Transportation investigation did not identify any defects in design or performance of the Autopilot system. According to data released by Tesla during the investigation, Autopilot has lowered the number of crashes among its drivers by 40%. It remains to be seen if these accidents will hinder self-driving efforts moving forward.

Four Strategies for Cultivating Strong Leaders Internally

“In industry, 95 percent of your time is spent operating on the thing that you’re currently engaged in,” Banks says. “In the military, even if you’re in the midst of combat operation, you will still conduct these training exercises to continue building capacity. Imagine if a company was in the midst of delivering goods and services to its customers. Yet it still created some scenarios—like, what would HR have to do in order to merge systems associated with an acquisition?—and ran through them via a short-duration exercise while also meeting its external obligations.” Some businesses have begun to latch onto this idea, creating innovation incubators that let them experiment in real time, or even sending employees to immersive, multiple-day business simulations. Banks expects more organizations will soon follow suit.

How Law Firms Can Make Information Security a Higher Priority

There are now several prominent examples of how things can go wrong. Earlier this year, global law firm DLA Piper was hit by a strain of ransomware that forced management to shut down its offices for several days while IT dealt with the problem. In 2016, a breach referred to as the Panama Papers entailed a massive document disclosure of 2.6 terabytes of data from Panamanian-based law firm Mossack Fonseca. German newspaper Süddeutsche Zeitung got hold of the documents, resulting in coverage of celebrities' and politicians' financial transactions and other personal details.  If events like these have a silver lining, it is the possibility that other firms might learn from them in hopes of avoiding the same fate. Here are four best practices law firms should consider as they seek to make information security a higher priority:

Google: Our hunt for hackers reveals phishing is far deadlier than data breaches

Despite the huge numbers, only seven percent of credentials exposed in data breaches match the password currently being used by its billion Gmail users, whereas a quarter of 3.8 million credentials exposed in phishing attacks match the current Google password. The study finds that victims of phishing are 400 times more likely to have their account hijacked than a random Google user, a figure that falls to 10 times for victims of a data breach. The difference is due to the type of information that so-called phishing kits collect. Phishing kits contain prepackaged fake login pages for popular and valuable sites, such as Gmail, Yahoo, Hotmail, and online banking. They're often uploaded to compromised websites, and automatically email captured credentials to the attacker's account.

Key Steps to Building and Managing an Effective API Marketplace

Generally, an API marketplace comprises several components. In a typical scenario, producers first publish APIs, and these are then catalogued and displayed via an API developer portal. This encourages consumers of the APIs to access the developer portal directly or indirectly (via system APIs for instance) to find, discover, and explore them. The developer portal displays different types of APIs, grouped by division, category, type etc. With specific APIs, users can then test and subscribe to them. ... Successfully implementing a marketplace requires taking a more advanced approach to implementing some aspects of the API management system, most notably the API developer portal and analytics. At the same time, organizational practices will also play an important role in establishing a highly functional marketplace.

Assessing the business, societal value of AI capabilities

People are starting to understand that we can hand off cognitive tasks -- not just physical tasks -- that we used to ask experts to do. They're not exactly robotic tasks; they're very difficult tasks. For example, if you look at the oil and gas industry, a lot of oil and gas discovery is reading seismic responses. These things are monochrome; they look like a bunch of waves on a piece of paper. It's going to take a geoscientist with years of experience to recognize the pattern. What they're really doing is mentally extracting a set of features from the data, making some inferences about it and then trying to interpolate that against other forms of information. That other information includes things like maps, other types of surveys or even just information from local people who say, 'Once upon a time, there was a legend that there were puddles of oil in the ground there.'

Severe shortage of cyber skills poses data security threat

A report last month by the Information Systems Security Association (ISSA) and the IT analyst firm Enterprise Strategy Group (ESG), shed light on the scope of the problem and offered guidelines to businesses for easing the skill crunch. This was the second year in a row that the two organizations have partnered to conduct the study, and the results depict a widespread business problem that is becoming more severe. Nearly three-fourths of the respondents (70%) of the ISSA and ESG survey respondents indicate that the shortage of people with cyber-security skills has had an impact on their organization. Yet 62% of them also concede that they are falling behind in providing an adequate level of training for their data security personnel. And that figure is up almost 10% percent from last year’s study.

---

Quote for the day:

"Leaders must know where they are going if they expect others to willingly join them on the journey." -- Kouzes & Posner

---

Daily Tech Digest - November 09, 2017

Data breached in translation

So what can those companies do? Instead of plugging data in random tools online, tell employees to route all translation through a professional provider. Translation vendor selection is usually based on quality, turnaround and cost. To ensure data security, ask prospective resources how they receive and deliver files for translation. If they say email, watch out. “[Email is] 10 times riskier than any [online] solution because it’s very easy to break into people’s email,” Vashee says. Email is also readily forwarded — something many translation companies depend on. A human translator gets the job by specializing in that content type and the language direction needed — English into Polish, for example. If either of those factors change, so does the translator. As a result, even the largest translation companies don’t have in-house resources for everything you need. 

What to consider when deploying a next-generation firewall

When consulting with vendors on a NGFW deployment, one of the first conversations will be around the organization’s security posture. No amount of technology can replace the critical work of evaluating an environment and prioritizing the most important business-critical assets that need to be protected. This is a conversation that may include multiple departments, from IT to network and security services, to HR and executive leadership. “Basically, organizations need to figure out, if they don’t already know, where the pearls of their data are and make a plan around protecting that,” says Gartner researcher Hils. Organizations typically gather these requirements and approach multiple vendors for a quote. Most firewalls are still deployed at the perimeter of the data center, but depending on if customers have adopted microsegmentation and network virtualization there could be firewalls deployed within the data center as well.

Tim O'Reilly: The flawed genie behind algorithmic systems

The algorithms took on the biases of the user, delivering content that reflected their likes -- and dislikes. Algorithmic systems, he argued, are a little like the genies of Arabian mythology. "These algorithms do exactly what we tell them to do. But we don't always understand what we told them to do," he said. Part of the problem is that developers don't know how to talk to algorithms and ask for the right wish, he said. Consider the financial markets, which today are vast algorithmic systems with a master objective function to increase profits. "The idea was that this would allow businesses to share those profits with shareholders who would use [them] in a socially conscious way," he said. "But it didn't work out that way." Instead, financiers are gaming the system, creating income inequality.

Q&A: Secure data centres and fintech companies

We believe there are two core aspects to a data centre that make them attractive to Fintech businesses. The first is security. This does not just include physical and cyber security, which of course are immensely important, it also includes security of service. Fintechs need to know that their product will always be available, that they won’t experience any outages or disruption in service, that could potentially prove to be a huge cost financially and to their reputation. Data centres must ensure that they have a robust infrastructure in place to ensure that they can provide a secure and reliable service to their partners. ... Fintech businesses must be able to prove to the Financial Conduct Authority (FCA) that they are not introducing any degree of risk to the financial services environment, so opting for a data centre provider who has a pedigree in compliance and security is vital.

3 Ways to Mitigate Insider Threat Risk Prior to an Employee’s Departure

We are seeing a disturbing insider threat trend impacting operations and causing reputational harm in the days leading up to an employee’s departure from an organization. For example, last week a Twitter employee deleted President’s Trump’s Twitter account prior to leaving the premises on his last day of employment. In September, a contractor was convicted of cyber sabotage on an Army computer toward the end of his contract, costing U.S. taxpayers millions. These cases highlight the importance of ensuring that the appropriate insider threat risk mitigations are in place to help your organization prevent, detect, and respond to an insider incident. Whether termination or resignation, an employee’s pending departure from your organization increases the chance that data leaks or sabotage will occur that could impact operations, lead to the loss of competitive advantage, affect shareholder value, or result in embarrassment and devaluation of image and brand.

Three trends to keep top of mind when crafting an AI strategy

New interfaces will dramatically change the way consumers and employees access computing resources, Andrews said. Specifically, the new wave of interfaces relies on natural language processing and generation, visual analytics and gesture interpretation -- technologies powered by AI.  ... AI capabilities are being embedded into the internet of things (IoT) devices that operate on the computing edge, but those capabilities will be limited. Model building with AI will happen elsewhere, but runtime analysis and "interaction into action models" that provide, say, visual analysis can live on an edge device, Andrews said. ... AI-powered applications will be able to tell each other what they need to meet a goal without human interaction. But to create this kind of commonplace AI, application diversity is crucial. "In any ecosystem, strength comes from that diversity and from multiple perspectives," he said.

Xerox CISO: How business should prepare for future security threats

As we move to AI, then we also have to move into AI in a security space ‑‑ thinking about the talent shortage, thinking about the fact that we're not going to close this talent gap. How do we close the talent gap? How do we get around it? By allowing AI, allowing robots and smart learning and things like that to play a role in this. We need to challenge our vendors and say, “You've got great platforms that perform analytics for me, but now I need these great platforms to not just perform the analytics, but to actually do something.” That's where it stops. It stops at analytics, and then it expects you've got a team of people that will actually do [something with the data]. It would be great if, as the smart security people that we are, we could say these are the list of security things that I am comfortable with a machine doing for me.

Hacking medical devices is the next big security concern

“Successful exploitation of these vulnerabilities may allow a remote attacker to gain unauthorised access and impact the intended operation of the pump,” says the ICS-CERT report. In other words, with enough skill, a hacker could change the quantities of medication administered to a patient. Smiths Medical said the chances of this happening are “highly unlikely”, but has promised a software security update to resolve the issues by January 2018. Smiths Medical is not the only device manufacturer under fire. There are plenty of others, including St Jude Medical, which is currently battling lawsuits relating to vulnerabilities in its implantable cardiac defibrillators and pacemakers. These triggered a recall of some 465,000 devices in August this year, which will involve patients attending hospitals and clinics in order for the devices to be updated. No invasive surgery will be needed, but the procedure must be carried out by medical staff.

Why speeds and feeds don’t fix your data management problems

Applications and storage have long been oblivious to each other’s capabilities and needs. The majority, if not nearly all, of today’s enterprise applications do not know the attributes of the storage where its data resides. Applications cannot tell if the storage is fast or slow, premium or low cost. They are also unaware of storage’s proximity, and factors like network congestion between storage and the application server, which can significantly impact latency. Conversely, storage does not know what data is the most important to an application. It only knows what was recently accessed, and uses that information to place data in caching tiers, which will increase performance if that same data happens to be accessed again. Some enterprises try to address these issues with caching tiers, but unfortunately caches do not have the intelligence needed to reserve capacity for mission-critical applications.

Security Think Tank: Web security down to good risk management

Encrypting data, both when it is in transit and being stored, is key, and its importance will grow with the adoption of GDPR in 2018. Similarly, encrypting the hard drives of corporate laptops minimises breaches if they are lost or stolen. However, it is not just the external threat landscape that is changing. Having robust internal controls, including access management strategies can also minimise threats. Many security fails are down to providing users with more system access than is needed to undertake the task they are required to do. Outlining the inputs that an application needs to work and then engaging in role management and access control to ensure that no more than that is available prevents this – and is particularly important where external attacks attempt to take control of an existing user in the target application.

---

Quote for the day:

"Education is when you read the fine print. Experience is what you get if you don't." -- Pete Seeger

---

Daily Tech Digest - November 08, 2017

How to Make the Most Out of Email GIFs

An email packed with info may cause readers to skim and overlook important details. Use GIFs to make pieces of information stand out—or to help explain concepts. When we redesigned MailChimp’s dashboard in 2013, for example, we used several GIFs in an email to show the changes to our users. Breaking up this information with short, digestible visuals helped our users understand the concepts and get them used to the new dashboard without spending a ton of time reading. Most email clients don’t offer great support for video. Currently, videos only render in Apple Mail, Thunderbird, iOS10’s native client, and Samsung Galaxy’s native client. On top of poor support, video files can be huge and slow to load if subscribers are using a poor connection, which can disengage the viewer. Making subscribers download large files isn’t a great idea, either, because it can send users over their data plans if they’re not on WiFi.

Top Use Cases for IoT in Property and Casualty Insurance

IoT enablement in Insurance is the new normal for both Insured and Insurer. For Insurers, it helps improve the underwriting process through finer risk segmentation, agile pricing, improved loss and combined ratios, cross sell and up sell opportunities. Further, it enables customer- centric product offerings, increased brand loyalty, customer churn reduction, simplified claims processing and more. Similarly, the Insured is able to reap the benefits of competitive pricing, quicker policy and claims servicing, personalized offerings, constant updates on risk variations through proactive alerts and advice on risk management and more. The incremental adoption of IoT enabled connected device usage by Insurers is helping conceptualize a “Pay as You Use” model that offers customized pricing and servicing to eligible customers.

What ‘born in the cloud’ means for developers

Sigler notes that cloud-native means developers no longer have to keep reinventing the wheel, and “going cloud native acts as a ‘forcing function’ for how applications are built on top of infrastructure”. By standardising on the behaviour of lower-level components such as compute and networking, he says businesses are effectively telling individual teams working on these smaller, more agile units of software to stop wasting their time on changing everything below the application layer. This, says Sigler, is different to the approach previously taken with traditional or virtualised application designs, where developers tended to spend lots of time reinventing how they would ship the software. Not only is this a painful process, it is one that does not often result in useful business value, he says.

How Artificial Intelligence Could Change the Medical Field

Most intriguing is the possibility of AI identifying new associations and correlations that are yet to be detected by humans. For example, UK researchers turned over the data of about 295,000 patients to AI, to allow them to correlate medical history with the rate of heart attacks. After that, the AI was given another record of 82,000 patients whose history of heart attacks were already known for the AI to predict the ones that are most likely to have a heart attack. The result of the AI when compared to the predictions based on current “best practice” American College of Cardiology/American Heart Association (ACC/AHA) guidelines, which include patient age, smoking history, cholesterol levels, diabetes history, etc. the AI beat the human's hands down.

How to Create an Intelligent Company

Design Thinking is one of the ways in which this change can be brought about. Design Thinking is part of a broad methodology that amalgamates elements of imagination, intuition, holistic reasoning, and logic to explore all the probable solutions for a given problem. It includes the identification of all unarticulated needs expressed by a consumer. After the identification of the needs, the team creates solutions that address all needs and end up creating the “wow” effect. The solutions are generated creatively and analytically as Design Thinking is more solution oriented than being problem oriented. Reaching a feasible conclusion is frequent in Design Thinking. The risk inherent within innovative solutions is minimized by transitioning users through numerous prototypical solutions that give leverage for learning, testing and completely refining the ultimate solution.

How to choose a database for your microservices

In many cases these new databases were “NoSQL” or “non-relational”—solutions based on data models other than that dominant relational model, such as document, key-value, column oriented, and even graph databases. Frequently these databases sacrificed some of the familiar guarantees of relational databases like strong consistency, ACID transactions, and joins. At the same time as this revolution in database technology, the SOA trend of the early 2000s was maturing into the microservices architectural style, as many organizations began to move away from heavyweight SOA infrastructures such as the enterprise service bus (ESB) toward a more decentralized approach. The appeal of microservices architecture lies in the ability to develop, manage and scale services independently. This gives us a ton of flexibility in terms of implementation choices, including infrastructure technology such as databases.

Cheat sheet: How to become a data scientist

"One of the big reasons we continue to see such demand for data scientists is every company out there is becoming a tech company," Allison Berry, Glassdoor community expert, told TechRepublic. "In any industry that has to deal with digitized data, or has an app or an online presence, you need people who can help support all of that and find insights from the data." However, we are currently facing a shortage of professionals with data science skills: By 2020 the number of annual job openings for all data savvy professionals in the US will increase to 2.7 million, IBM predicted. Those with data science skills can command an average salary of $96,441 in the US as of October 2017, with 0.9% year-over-year growth, according to Glassdoor. To help those interested in the field better understand how to break into a career in data science, we've created a guide with the most important details and resources.

Cyber threat, not credit, is what keeps today’s bank CEOs up at night

“The new cyber threat to deal with — which we’ve never dealt with before — is how do we ensure that the information from our customers is really accurate? Is it really our customers?” Sloan said, pointing to the “amount of data that is now out there” following the Equifax hack. “We haven’t dealt with that, and we’re going to all figure it out,” Sloan added. Several of the executives emphasized the importance of collective action in addressing the growing threat from cybercriminals. “We have a tremendous amount of data on our customers,” says Grayson Hall, chairman and CEO of Regions Financial. “With that information comes an awful lot of responsibility and accountability.” The comments — made at an industry conference sponsored by The Clearing House — illustrate some of the most pointed commentary to date on what the massive Equifax breach means for banks’ core businessess.

4 Ways the Next Generation of Security Is Changing

There are two forces that demonstrate my point. First is the reality that breaking news on a weekly basis surrounds enormous data leaks — just recently, Equifax, Yahoo, the Securities and Exchange, and Sonic — and a stunning lack of clarity around the extent and scope of data that has been compromised in each case. The second force is the European Union's General Data Protection Regulation. Organizations have not mapped out their data, and they're struggling now to comply with EU regulations. As a result, enterprises are making moves to locate, classify, and understand who's accessing their data and where it's being stored, and utilizing more advanced frameworks for data monitoring and controls. This data transparency is no longer a nice-to-have, particularly given impending regulatory deadlines.

Proactively Managing Data Compliance With Encryption Strategies

There is a perception problem with encryption, where companies consider it to be a time-consuming process that is not worth the effort when compared to the perceived risk of being hacked. The “it won’t happen to us” mentality is pervasive, despite the industry predictions that cybercrime damages will cost the world $6 trillion annually by 2021 (according to Cybersecurity Ventures). Whether a firm believes their current safeguards are sufficient, or that hackers won’t target their business, they avoid encryption until it’s simply too late. They are not performing the usual risk/reward that organizations should consider when weighing the value of data and the downsides of a breach. Encryption is also not as mysterious and complex as many believe. It simply involves taking data and translating it into a different form that requires an access key to read, share and edit.

---

Quote for the day:

"Don't wait for inspiration. It comes while one is working." -- Henri Matisse

---

Daily Tech Digest - November 07, 2017

Culture Is The Biggest Hurdle For Industrial Digital Transformation

The best way to bring groups together and bridge the cultural divide is to identify a common benefit for the company, Streenstrup said. Potential benefits include reducing technology costs (number of software licenses, support staff requirements) reducing risk (exposure to cybersecurity attacks), agility and speed (moving more quickly than competitors) and unlocking the benefits of equipment data (“the big holy grail”). “If you can unlock the value in that equipment data, safely and reliably, now you get much better visibility into the plant or the machinery is doing,” Streenstrup said. “The two highlights there are operational efficiency, how much material energy or materials do you put in to get a benefit and also reliability – how do we know what the machine is doing so we can get in there before it fails?”

40% of IT security leaders don't change default admin passwords

IT faces challenges in monitoring admin accounts as well: 57% of professionals said they only monitored some privileged accounts, or did not monitor privileged access at all. And 21% said they are unable to monitor or record activity performed with admin credentials at all. Gaining access to privileged accounts is the easiest way for cybercriminals to steal an organization's critical data and systems, One Identity noted in the report. "By not adhering to these best practices, privileged accounts are vulnerable to open the door to data exfiltration or worse, if compromised," according to a press release. "When an organization doesn't implement the very basic processes for security and management around privileged accounts, they are exposing themselves to significant risk," John Milburn, president and general manager of One Identity, said in a press release.

Chatbots can do more than chit-chat

For businesses, chatbots have the potential to be an incredibly financially-efficient solution. Take a use case that is commonly explored today: customer service. At their best, a chatbot can solve a customer’s query on its own, reducing the human resource required by a brand and satisfying the customer’s need – which we know is the best way to have customers coming back for more. However, the mysticism and confusion around chatbots means that, too often, businesses that are building and deploying AI and chatbot solutions focus on the wrong thing – trying to make their chatbots good at chat. This is not to say a natural conversation flow isn’t important to a customer experience – it is. However, brands should remember their bots are not going to be used in the same way Siri and Alexa are – they are there to fulfil a business function, not answer questions on the weather in Barcelona tomorrow.

5 Predictions On How Blockchain Will Drive Digital Transformation

The power of Blockchain can essentially eliminate the “middle man” in financial transactions like loans, wire transfers, and other services that require often exorbitant transaction service fees. And I don’t just mean removing the need for bank tellers. I’m talking about the ability to turn all currency digital so that it no longer needs to stored or secured at all. Even beyond Bitcoin, Blockchain could be used to develop local currency or internationally accepted money — depending on the needs of the industry or user. Although you’d think Big Business in the form of the country’s major financial institutions would be pushing hard against Blockchain because of its potential to put them out of business, you’d be wrong. Research shows 65% of banks plan to implement some form of Blockchain in the next few years. That’s how powerful this technology has become.

The Industry Just Can't Decide about DevOps Teams

For developers to take responsibility for the systems they create, they need support from operations to understand how to build reliable software that can be continuous deployed to an unreliable platform that scales horizontally. They need to be able to self-service environments and deployments. They need to understand how to write testable, maintainable code. They need to know how to do packaging, deployment, and post-deployment support. Somebody needs to support the developers in this, and if you want to call the people who do that the "DevOps team", then I'm OK with that. ... Dedicated DevOps teams are often made up of experienced operations people with a mix of skills including using version control, writing infrastructure as code, and continuous delivery. These teams typically start by addressing the things that are most painful, such as deployment automation, and if they're successful, can evolve to providing shared services for the rest of the organization.

Is artificial intelligence safe?

"Data is the feedstock of AI, especially unstructured data, giving insights into customer intent, employee behavior. However, as consumers realise quite how much data is being collected on them to fuel these models and algorithms, there will be pushback as more stringent privacy controls are demanded. "There is the danger of bias being baked into machine learning applications at any stage, be it the data, the training of models and or the programming of algorithms. Developers and owners of those applications need to guard against this but also make the applications sufficiently transparent so biases can be detected and fixed at whatever stage they occur." ... Jane Zavalishina, CEO of Yandex Data Factory, argues that firms will likely struggle to integrate AI systems into existing business operations and humans will still be more capable in other areas, such as common sense and compassion.

Demand for enterprise architecture surges

"At the same time as these technology developments are happening companies are also globalising, innovating their business models while having to deal with different regulatory regimes around the world. "Enterprise architects are therefore required to ensure that IT landscapes are optimised: cost-effective, open and collaborative yet secure and private, scalable and flexible," Carpenter explains. Roland Woldt, director of KPMG's Enterprise Architecture Practice, says EA has evolved substantially from its early days when it was seen strictly as a technical way to wire up an organisation's infrastructure. Today's EA is more focused on business outcomes – what KMPG calls "capability-centric architecture": the capabilities needed to make digital transformation happen. According to Woldt, with its many moving parts and a myriad of direct and indirect relationships with partners, customers and vendors, EA has become incredibly complex.

CIOs should lean on AI 'giants' for machine learning strategy

"It may not be true that you can solve it with machine learning," Wilder-James said. "This is one important difference from other technical rollouts. You don't know if you'll be successful or not. You have to enter into this on the pilot, proof-of-concept ladder." The most time-consuming step in deploying a machine learning model is feature engineering, or finding features in the data that will help the algorithms self-tune. Deep learning models skip the tedious feature engineering step and go right to the training step. To tune a deep learning model correctly requires immense data sets, graphic processing units or tensor processing units, and time. Wilder-James said it could take weeks and even months to train a deep learning model.

SaaS, PaaS, and IaaS: Understand the differences

According to 451 Research analyst Carl Brooks, for a technology solution to qualify as "as a Service," it has to meet the National Institute of Standards and Technology (NIST) definition parameters, which he paraphrased as "self-service, paid on-demand, elastic, scalable, programmatically accessible (APIs), and available over the network." In a general sense, the cloud is divided into three distinct layers: Software as a Service (SaaS), Platform as a Service (PaaS), and Infrastructure as a Service (IaaS). The fundamental model of cloud computing that underpins all three of these layers is a service rental model, according to Forrester Research principal analyst Dave Bartoletti. "You are renting infrastructure, or you are renting development platforms and tools, or you are renting software. That's IaaS, PaaS, and SaaS," Bartoletti said.

Bridging the Cyber Security Skills Gap

As threats have become increasingly dynamic and automated, DDoS detection and mitigation solutions are rising to the challenge with their own increase in automation and adaptability. According to Radware’s Cyber-Security Perceptions and Realities: A View from the C-Suite report, 38% of IT executives throughout the United States and Europe indicate that automated security systems – such as machine learning and AI – will be the primary resource for maintaining cyber security within the next two years. But it presents a catch-22 for the next-generation security professional. As a security professional, when you’re increasingly relying on automation to defend the network, you’re not “practicing” or fine tuning your skill sets. The DDoS mitigation solution is doing a lot of the heavy lifting and the network security professional is receiving and digesting reports. This can create a void in skill sets due to lack of “practice.”

---

Quote for the day:

"Hiding from yourself is the surest path to self hatred, self pity and a whole lot of missed potential." -- Jon Westernberg

---

Daily Tech Digest - November 06, 2017

Google can read your corporate data. Are you OK with that?

The big concern from enterprises this week was not being locked out of Google Docs for a time but the fact that Google was scanning documents and other files. Even though this is spelled out in the terms of service, it’s uncomfortably Big Brother-ish, and raises anew questions about how confidential and secure corporate information really is in the cloud.  So, do SaaS, IaaS, and PaaS providers make it their business to go through your data? If you read their privacy policies (as I have), the good news is that most don’t seem to. But have you actually read through them to know who, like Google, does have the right to scan and act on your data? Most enterprises do a good legal review for enterprise-level agreements, but much of the use of cloud services is by individuals or departments who don’t get such IT or legal review.

How microservices governance has evolved from SOA

Governance with monoliths is centralized. Decisions are made top-down, and rigid control is maintained to ensure uniformity across the organization and the application stack. Over time, this model degenerates, creates a system that becomes technologically and architecturally stagnant and slows down the pace of innovation. Teams are forced to merely conform to the set order of things rather than look for new, creative solutions to problems. For microservices governance, a decentralized model works best. Just as the application itself is broken down into numerous interdependent services, large, siloed teams are broken down into small, multifunctional teams. This follows the progression from development, testing and IT teams morphing into smaller DevOps teams.

5 cyber threats every security leader must know about

The first is Consumer IoT. These are the devices we are most familiar with, such as smartphones, watches, appliances, and entertainment systems. Users insist on connecting many of these to their business networks to check e-mail and sync calendars, while also browsing the Internet and checking on how many steps they have taken in the day. The list of both work and leisure activities these devices can accomplish continues to increase, and the crossover between these two areas presents increasing challenges to IT security teams. ... The cloud is transforming how business is conducted. Over the next few years, as much as 92 percent of IT workloads will be processed by cloud data centers, with the remaining 8 percent continuing to be processed in traditional on-premises data centers.

Inside-Out: How IoT Changes Everything

"Design thinking is a way to place the user at the heart of the innovation process," he said. "Our company strategy is really that innovation is not coming from startups or technologies, but from the end users and the customer observation. It's really focused on the end user. We are working, for example, with ethnologists and psychologists to understand the problems and to describe the problems. It's really important for us." Celier explained that VISEO created specialized innovation centers as part of their One Roof program. The idea is to bring clients into their production studios, much like filmmakers bring all the talent into a studio for producing movies. "We are incubating our customer's project in our building. It's a way to go faster. They come with their vision, their idea, and they leave with a platform or product," he said.

Cybersecurity thwarts productivity and innovation, report says

The top priority of most organizations — cybersecurity — is hindering productivity and innovation, according to a recent report by Silicon Valley-based virtualization firm Bromium. Based on a survey of 500 chief information security officers in large organizations in the U.S., U.K. and Germany, 74 percent of respondents said end users were frustrated by how security requirements disrupt operations. "Our research found, on average, an organization gets complaints from users twice a week saying that legitimate work activity is being blocked or rejected by over-zealous security systems," the report reads. Citing that most — 88 percent — of organizations use a prohibition approach to cybersecurity, the firm suggests "a new approach" that allows more technological innovation within the organization.

Securing Smart Homes

“The industry is starting to get educated about the need for [better security],” Dirvin says. “Now they ask more questions about it and are willing to spend more time and effort,” but not always money. Manufacturers of smart home devices typically haven’t had to think about security in the same way as a medical device maker or a manufacturer of industrial automation. “It’s a whole new area for them, so they’re rushing to build connectivity and incorporate these devices into a broader IoT strategy,” says Warren Kurisu, director of product management in the embedded systems division at Mentor, a Siemens business. “The security, from a software perspective, is something they’re just now starting to realize that they need to do.” This is especially true in the wake of the Mirai attack. The number of connected devices is expected to reach 20.4 billion by 2020, according to Gartner.

Was BadRabbit a distraction? Malware 'used to cover up smaller phishing attacks'

"There is an open, let's say instantly obvious attack, while underneath there is a hidden, fairly well-thought-out attack, to which nobody pays attention," police chief Serhiy Demedyuk told attendees while speaking at the Reuters Cyber Security Summit in Kiev. "During these attacks, we repeatedly detected more powerful, quiet attacks that were aimed at obtaining financial and confidential information." He said the so-called "hybrid attack" – meaning a multi-pronged assault – was also found to be targeting users of a popular form of Russian accounting software called 1C. "The main theory we're working on now is that they [the hackers in both attacks] were one and the same," Demedyuk added. "The goal was to get remote and undetected access."

The Internet of Things is about much more than just connecting devices

The connected nature towards which we are migrating will allow manufacturers to better understand what their customers require on a real-time basis. This in turn enables the manufacturer to recalibrate not only the actual manufacturing part of the business and what they procure, but also to become highly competitive, super in-tune with what their customer requirements are, down to quality requirements per customer. That transparency will drive product improvement and customer satisfaction to new levels. Manufacturers will not order more raw material than they need. Think about latency and how this will be addressed. Consider this example: a customer wants a product; there’s the procurement of materials, import, export, shipping, logistics, manufacturing – it can take up to six months or more.

7 habits of highly effective digital transformations

The collaborative efforts have paid off. “As a result of sharing practices, we have identified cases where we see a common failure mode in our continuous integration, delivery and operational practices — and then we are able to propagate the fix across all teams and improve and correct across all teams,’’ Fairweather says. Management also conducted a survey of its strategic foundational technology program. Fairweather recalls one comment an employee gave as feedback: “Instead of being a cog in the wheel I’m a better-informed contributor. The best part of learning from peers is gaining new contacts. We are more united as global organization in pursuing these 10 areas because we had done this.’’ ... As organizations get larger, different groups can begin to cut themselves off from one another, creating silos of information, he says.

6 Steps Up: From Zero to Data Science for the Enterprise

Different stakeholders have different views about the desire for a Customer360, but perhaps the most clarifying is that for a company to truly drive value and delight its customers, the business must understand those customers and approach every question from their perspective. Without a Customer360 built on a foundation of data science, the business will only ever have a qualitative view of customers. I believe a true, quantitative understanding of customers relies on rigorous data science. Less attention has been paid to the concept of a Product360, but it's no less important. Depending on the business, a Product360 can potentially drive more value through cost savings and cost avoidance than the business can derive from new revenue. The ultimate goal of a Product360 is creating assets that allow the business to explore each product from earliest inception through the end of its lifecycle.

---

Quote for the day:

"Instinct is intelligence incapable of self-consciousness." -- John Sterling

---