Daily Tech Digest - November 16, 2017

How blockchain will change the future of the freelancer industry

Since blockchains are still (relatively) new pieces of technology, we are not exactly sure which decentralized applications will survive long term. The only certainty is that with advancement comes disruption, and we are likely to see fundamental shifts in the way many common markets work. One of the more exciting ways in which blockchain is affecting an industry is in the independent freelancers’ space. Freelancers and independent contractors make up a sizable chunk of the U.S. population: there are currently over 55 million domestic freelancers. Though this group has been growing significantly over the past several years, they are still plagued with annoying transaction costs and plenty of competition. Blockchains, in theory, will open up new doors for freelancers across the globe.

You Let That In? IoT Security Concerns

To this day, malware attacks based on similar technology are a part of daily Internet life. Conservative estimates predict 25 billion Internetconnected sensors by 2020. It’s unlikely that this horde will be protected by strong security. Security experts are spooked about the dangers of IoT and have recommended that the US federal government regulate the field to ensure that standard cybersecurity measures are part of the new devices. However, the current administration looks askance at new regulations, and even if they were to act, it would take some years to stop the current onslaught of an insecure IoT. We will be left to our own devices for cybersecurity protection for the immediate future. Let’s step back and look at the risks and what the educated consumer can do about mitigation.

Why AI Is the ‘New Electricity’

Just as electricity transformed the way industries functioned in the past century, artificial intelligence — the science of programming cognitive abilities into machines — has the power to substantially change society in the next 100 years. AI is being harnessed to enable such things as home robots, robo-taxis and mental health chatbots to make you feel better. A startup is developing robots with AI that brings them closer to human level intelligence. Already, AI has been embedding itself in daily life — such as powering the brains of digital assistants Siri and Alexa. It lets consumers shop and search online more accurately and efficiently, among other tasks that people take for granted. “AI is the new electricity,” said Andrew Ng, co-founder of Coursera and an adjunct Stanford professor who founded the Google Brain Deep Learning Project, in a keynote speech at the AI Frontiers conference that was held this past weekend in Silicon Valley.

How patchable software can secure the IoT

A new generation of patchable gadgets and software, such as Kidgy, is then needed for the IoT to endure. Already, smaller programs have sprung up from the initiative of tech-enthusiast around the country, but a broader approach, ideally one led by government regulators and tech-behemoths working in tandem, is desperately needed. Until the biggest fish in the pond realize that our current pattern of releasing unpatchable programs and hardware is fixed, the IoT will continue to suffer massive data breaches that plague companies and consumers alike. Of course, it shouldn’t come as a surprise to the business-savvy that the current generation of IoT gadgets is defined by their inability to be patched; the producers of these gadgets and software stand to make much more money if they can churn our unsecure products, and would shoulder the brunt of the cost if more stringent regulations were imposed.

Data Visionaries Help Companies Thrive Through Digital Transformation

Data Thrivers are taking steps to increase revenue, improve business outcomes, and transform data into dollars. Many Fortune 100 companies are building out innovation labs, as well as creating new roles for innovation executives and data management officers. Of the organizations who participated in the study, almost half already have a Chief Data Officer.  Data Survivors are losing revenue opportunities, lagging in employing data to enhance customer satisfaction, and being overwhelmed by their data. They use disparate tools to manage data that is in different formats and different locations, which adds extra complexity to managing security, risk, privacy, and compliance. ... Organizations that exhibit Data Thriver behaviors are adopting a diverse set of technologies, including data services for the hybrid cloud.

Blockchain-as-a-service allows enterprises test distributed ledger technology

While heavily hyped, blockchain technology – which gained its initial notoriety from bitcoin cryptocurrency – has the potential to offer a new paradigm for the way information is shared; tech vendors and companies are rushing to figure out how they can use the distributed ledger technology to save time and admin costs. BaaS offerings are particularly attractive because many enterprises can look to their current cloud providers to offer them use of the nascent technology. "As with any new technology, there is a learning curve as enterprise customers put it into production," Fearnley said. "One advantage of partnering with a BaaS provider is users can leverage the lessons learned by the provider to help make their systems more secure." BaaS providers are also acting as consultants on the technology, Fearnley said.

Most Banks Still Not Ready For AI, Robotics: Study

The study reveals digitizing products and services, customer journey and security as top focus areas for innovation and transformation. According to the report, retail banks continue their thrust on innovation in all functional areas, with customer experience and channels (both at 78%) being at the forefront. Other segments that have witnessed higher spends in innovation include products (67%), process improvement (64%) and marketing (57%). The research, in which over 300 bankers globally participated, found that retail banks consider large technology companies, challenger banks, and smaller fintech start-ups as threats to their growth. Similar to 2016, the greatest impact of transformation is expected to be in the areas of payments and mobile wallets. The study however points out that the top three innovation challenges include systems integration, legacy technology, and the time and cost required to move from concept to reality.

Banks are increasingly turning to open source projects. Here’s why.

“We want to get to open source as quickly as possible, to start to unlock tools you can use to test software you’re developing in open source — things that won't save us a dime from a human perspective but will make our software better,” said John Stecher, managing director, group head of open innovation and Rise at Barclays. (Rise is the fintech co-working space Barclays runs in seven cities.) “If we pick up developers on the outside world that start to contribute bug fixes, we then benefit from the economies of scale of doing open source development.” This can be a tough sell inside a firm due to legal and regulatory constraints, he acknowledged. “It's a long process, it takes time, but there is a big payout at the end because you slowly start to get higher-quality software at the end of the day,” Stecher said.

The US Pentagon ready to embrace open source software

Commenting on the news is Javvad Malik, security advocate at AlienVault: “The arguments for and against the use of open-source software are long-standing. While licence costs are eliminated by using open source software, it doesn’t eliminate the associated costs of support, maintenance, and hardware requirements. In the big scheme of things, the license cost may be insignificant in some instances.” “The second widely-debated aspect is the security. The general consensus is that open source software may be more secure because there are more chances for researchers to discover flaws. However, as we saw with OpenSSH and similar, that is not always the case.” “Ultimately, it comes down to individual companies, its risk appetite, and financial requirements. ...”

The benefits of multi-cloud computing

Cloud-hosting providers come in all different and shapes and sizes, but rare is the provider that can fit all your requirements to a tee. Characteristics like upload speed, size requirements and more influence what makes the most sense for each of your business units can vary. Rather than bend your business processes to fit a specific provider’s setup and execution, play the field and explore different providers to find the best match for each part of your business to line up its functionality for a perfect fit.  ... When the Rebel Alliance figured out that the Empire’s Death Star had a weakness in that small thermal exhaust port, it was only a matter of time before the whole battles station went up in smoke. Some SPOF events occur through machine errors, others come by hacker attacks. Web architects use redundancy to avoid SPOF incidents but what happens when the system host goes down?

---

Quote for the day:

Failure is the opportunity to begin again more intelligently. -- Henry Ford

---

Daily Tech Digest - November 15, 2017

Digital transformation the career-defining issue for CEOs 

"If a CEO doesn't have a metric to drive a transformation, it's not a Transformation with a capital 'T'," Raskino said. "CIOs need to boil down digital into some very simple metrics of whatever matters to a company. "You have to define what a digital business means for your business. What is the number one goal, the metric which shows we are moving towards this digital goal? Then, what are the KPIs we will use in the management structure to drive that change?" The next step for CIOs was to propose more creative digital business strategy ideas like setting up a startup incubator, creating a tech or digital joint venture, setting up a venture capital fund, joining a consortium or acquiring a new business entity, Gartner suggested. Thus CIOs need to grow as leaders and be comfortable engaging in conversations around these subjects.

How Hackable is Your Smart Enterprise?

By the very nature of an IoT being connected, once a device becomes infected, the threat can spread throughout the entire network, continuing to exploit vulnerabilities, and requiring IT security to attempt to keep up with the infection and limit the damage. The necessity of security as part of an organization’s IT policy and processes is deeply ingrained in even the most old-fashioned of companies, but there is a curious blind spot when it comes to the IoT. A study commissioned by ForeScout Technologies shows that often organizations are not even aware of the number of connected devices they currently have on their networks (4 of 5 organizations surveyed). The obvious conclusion is that a network can not be secured if they do not know what devices are supposed to be there. 

OnePlus Phones Were Shipped With a Hidden Backdoor

Alderson found an application on OnePlus devices intended for factory testing, and discovered it could be used to obtain “root access” to the phone. Rooting an Android device allows a developer to essentially gain access to everything in the operating system, and permission to change anything about the device’s software. The application the researcher found is called “Engineer Mode.” It’s meant to be used while the smartphone is still in the factory, to test whether it’s working properly. Engineer Mode was hidden behind a password, but Alderson along with researchers at app security firm NowSecure were able to quickly crack it. The password is “angela,” which could ironically be another Mr. Robot reference. Alderson believes that the vulnerability can only be exploited with physical access, at least for now. He said in a tweet that it’s “too early to speak about a random app getting root access, but we are on the good tracks.”

Frustrated with coding? Microsoft releases new tools to relieve the grind

"Developers are core to Microsoft. We put developers at the heart of everything we do, deeply recognizing the role they play in developing the applications driving digital transformation across all organizations and industries," said Microsoft corporate VP of communications Frank Shaw, speaking ahead of event. First to be announced was Visual Studio App Center, which should help developers build and deploy apps more efficiently, according to Shaw. The service will make it easier to deploy, test, build and monitor applications, without having to stitch together multiple products to maintain this workflow, freeing up developers to spend more time adding features and improving the user experience. Shaw said it is a "one-stop" service where developers connect their code repository to app center and "within minutes App Center creates a pipeline of automated builds, testing on real devices in the cloud".

Fundamentals of Prescriptive Analytics

An average business today has a digital footprint, which forces the business owner or operator to collect, ingest, analyze, and present the data to gain competitive intelligence. As business owners or operators are typically very busy folks running their day-to-day business operations, they do not have the time and leisure to pursue data technologies or more specifically, advanced business analytics for increased profit. However, they need the profit margins to remain healthy for future sustenance. For most business owners like these, either a Data Center or an advanced Data Analytics team or an out-sourced data service provider has to step in to handle and manage all data technology tasks. A previous executive survey indicated that most business executives prefer to get ready-made business solutions in times of need.

Cloud Computing Makes Everyone Their Own CIO -- Is That A Good Thing?

Cloud may have made everyone their own CIO, but there is too much cloud adoption for cloud's sake taking place, Crawford observes. "A great example of this -- and it’s something that just kind of raises the hair on the back of my neck -- is when I hear that boards of directors of publicly traded companies are giving mandates to their organization to 'go cloud,'" he illustrates. "The board should be very business-focused and instead they're dictating specific technology -- whether it’s the right technology or not. Another example is folks that try and go all-in on cloud but aren’t necessarily thinking about what’s the right use of cloud – in all forms, public, private, software as a service. What’s the right combination to use for any given application? It’s not a one-size-fits-all answer."

MasterCard has filed a patent on its own blockchain-based money transfer solution

While the abstract itself doesn’t mention blockchain, MasterCard intends to use the technology in the process, describing a step in which “the payment guarantee data stored in the third data element included in the received transaction message includes at least a blockchain network identifier and (i) a public key or (ii) a destination address, the record of payment guarantee is a blockchain transaction for payment of the transaction amount stored in the second data element included in the received transaction message to (i) the destination address or (ii) a destination address associated with the public key, and the computing system is a node in a blockchain network corresponding to the blockchain network identifier.”

Can fintech deliver the personal touch in banking?

Backed by analytical insights, banks also know the most preferred channels to reach out to their customers. And when banks reach customers at the right time using the right channel, customers are much more likely to engage in interactive conversations. With mobile banking apps in their smartphones, customers are far more connected to their banks. So the personal touch is not just restricted to the first engagement during the initial “sale” of the product but extends throughout the loan lifecycle. For example, lending provides considerably more opportunities to interact with customers during the loan servicing period, than in the short time when the original loan is being “sold”. During the life of the loan, a well-crafted personalized approach can translate into repeat business for the bank. 

Fileless malware attacks 10x more likely to infect your machine than others

"This survey reveals that ignoring the growing threat of fileless attacks could be costly for organizations." Larry Ponemon, chairman and founder of Ponemon Institute, said in a press release. "The cost of endpoint attacks in the companies represented in this study could be as much as $5 million, making an enterprise-wide endpoint security strategy more important than ever." Ransomware also continues to wreak havoc on many businesses, with more than half of the organizations surveyed reporting that they experienced one or more ransomware attacks in 2017. Of those, 40% said they experienced multiple ransomware attacks. Some 65% of organizations hit reported that they paid the attackers, with the average ransom payment hitting $3,675.

Business in digital world demands considered approach

“We have to think about things to do with applications, infrastructure, identity, privacy and many other domains, as we execute on our strategies in response to the environment in which we all operate today,” said Verdonck. The next thing to consider, he said, is the need to be vigilant. “This means when an incident occurs, we need to know instantly what happened, what the impact is and how we need to respond. “For many organisations, vigilance is a new dimension, and for organisations which have complex environments, vigilance is consequently a complex domain, but a sense of urgency is important for all of us as we operate in our specific environments.” Finally, said Verdonck, when something happens, organisations need to be resilient and able to understand the extent of the event and how to restore normal business operations as quickly as possible.

---

Quote for the day:

"Knowledge is the new capital, but it's worthless unless it's accessible, communicated, and enhanced." -- Hamilton Beazley

---

Daily Tech Digest - November 14, 2017

Investigating IoT Crime in the Age of Connected Devices

Smart devices are the main components of the IoT. They are easy to use and deploy and are usually connected to the internet without any security enabled. These devices range from smart locks to medical equipment, TVs, refrigerators, light controls, security systems, baby monitors and automobiles, any of which can be used to steal personal information, spread malicious code, eavesdrop or even interfere with the operation of machinery. In a worst-case scenario, these malicious acts can potentially put human lives at risk. Due to the rising number of connected devices, it has become necessary to develop new approaches and tap all available resources to combat future crimes. This new strategy should be implemented in the early stages of the investigation, particularly when investigators don’t know where to begin.

3 ways enterprises can reduce their cybersecurity risk profile

The first issue is how enterprises think about cybersecurity. There are two aspects to consider when looking at how cybersecurity is viewed. The first is that enterprises often want to be secure, but are unwilling or unable to provide the funding to match. That is, until a breach occurs. This has created a behavior within IT organizations where they leverage breaches to gain cybersecurity funding. Spending in cybersecurity is often seen in a similar vein as insurance and comes back to risk mitigation. Many IT organizations are challenged to get adequate funding to appropriately protect the enterprise. It should be noted that no enterprise will be fully secured and to do so creates a level of complexity and cost that would greatly impact the operations and bottom line of the enterprise. Therefore, a healthy balance is called for here.

Researchers developing building-free data centers

The idea is that common servers are fully submerged in the barrels where they are chilled by the immersion. Expensive humidity control and air conditioning thus become irrelevant, as do buildings. One could even place the containers, which the researchers call RuggedPODs, out in the middle of a field (rendered image pictured above), observes Simon Sharwood, of The Register, who has reported on the project from the Sydney OpenStack Summit, where the idea is being bandied around. Horizon’s proposed outdoor cooling boxes have numerous other benefits, it explains on its website: The micro-ATX motherboard-containing, case-like pod can operate in an “extreme environment,” such as outdoors, and in “positive temperatures.” Costs might be low partly because the barrel is easy to make. Maintenance, too, is simple with an easy-to-operate gasket for the tub. It includes sealed connectors for the external power and network.

Russian Developer Snuck Cryptocurrency Mining into Android Apps

A Russian developer installed cryptocurrency mining code in his popular crossword game app Puzzle as well as his in-game awards and bonuses app Reward Digger, without notifying users they would be mining cryptocurrency coins on his behalf, according to researchers. Although it's not illegal for developers to put cryptocurrency-mining capabilities into their own apps, the issue becomes an ethical one if users are not aware their mobile devices are being used to mine cryptocurrency, says Steve McGregory, who leads the Application & Threat Intelligence (ATI) team at Ixia that recently studied the rigged apps. Oxothuk, the user name of the independent developer who created the two apps, included crypto-mining features in the apps without adequately informing users, McGregory told Dark Reading.

Digital transformation may be overhyped, but so is business as usual – with Brian Solis

Companies should be worried about the gap that gets exposed here as the so-called mavericks advance – not through financial investment, but good old trial-and-error. Digital is very much a learn-by-doing pursuit. When the gap becomes a chasm, you have a problem. I like that Solis emphasizes the culture and human impediments to digital change. I largely agree with Solis that digital is a culture and economic force rather than a marketing invention. However, change agents don’t have much protection in many organizations. The unsexy truth is that being a change agent is hard. To me, the next steps in this research are two-fold. One is documenting the practices of the mavericks and early adopters, and learning from their wins and struggles. The next is focusing these learnings on verticals and micro-verticals.

Google’s AI guru predicts humans and machines will merge within 20 years

The deadliest war in recorded human history, World War II, ended just 72 years ago. In the time since, humanity has engaged in what feels like countless skirmishes, police actions, and outright wars. And while the US remains engaged in the longest war in its history – with no end in sight – the human species is currently enjoying the most peaceful period in the history of our civilization. The existential fear is that AI will somehow compromise this progress and send us careening into the next extinction-level event. If technology like the atom bomb made World War II so much worse than everything before it, doesn’t it follow that WWIII will be even more devastating? It’s more complex than that, according to Kurzweil. He believes part of the reason we’re able to coexist so wonderfully (in the grand historical scheme) for so long is because democracy has begun to take hold globally.

How to Cultivate Leadership That Is Honed to Solve Problems

Talent development for challenge-driven leaders should focus on creating what Ideo CEO Tim Brown calls “T-shaped” contributors: people who can go deep in their particular, vertical specialty while maintaining a high-level understanding of other fields — and who can make connections between the two. This has serious implications for talent development. Development should focus more on developing singular strengths, and less on transitioning people from being individual contributors to being generalist managers. One person we interviewed used the phrase “Jedis in training” to describe the ongoing process of honing skills. In the Star Wars film franchise (which is, of course, popular at MIT), a qualified knight must master a series of skills, not just one, and each of them with deep proficiency.

Artificial Intelligence Will Automate Business Processes

In banking, we’ve enabled a trading platform to engage more customers via a mobile trading app. ... When a new market trigger occurs, we’re able to reach out to each client with a personalized stream of market insights every day, providing personalized insight at scale. In addition, there’s a built-in feedback loop for business performance. For the digital channel of a large retailer, we started a small pilot to learn the profiles and preferences of anonymous shoppers, resulting in a double-digit increase in conversions. By showing the client how the machine learning algorithm was learning with additional data and seeing the impact on conversions, this solution was rolled out across the entire digital commerce platform so the retailer is now making personalized, real-time recommendations based on each click.

Worried About Hackers, States Turn to Cyber Insurance

Pizzini said the insurance company helped with the mailings, set up a call center, and provided forensic investigation, legal and communications assistance, and credit monitoring. “We used all of the services in our insurance policy,” she said. “It would have cost us a ton more than the premium we pay.” The state has a $2 million policy, which covers all agencies, including the university system, she said. It pays an $88,200 annual premium and has a $100,000 deductible per incident and a 10 percent copayment for credit monitoring. But Pizzini and IT officials in other states caution that having cyber insurance shouldn’t make states complacent and view it as a substitute for a comprehensive security program. While the coverage can be a big help after the fact, they say, states need to invest in security, keep their technology updated, and be prepared for hackers and cybercriminals.

Cisco: Most IoT projects are failing due to lack of experience and security

"The inaugural phase of IoT is characterised by numerous point solutions from a multitude of new -- often startup -- vendors. Typically, these solutions have been designed to solve a particular societal problem such as lighting or parking. In each case, a complete IT stack needs to be built in support of the solution," Bloch explained. "Eventually, customers find themselves with multiple siloes from multiple vendors that don't interoperate, are not cybersecure, use different protocols, and generate more complexity at greater cost." According to Bloch, this is why Cisco is constructing an "IoT Phase 2" foundation, which consists of a platform that is able to cope with multiple different sensors, vendors, applications, and data interchanges. The CTO added that IoT projects are also failing due to a lack of cybersecurity, qualified skills by those running them, project definition, governance, and support.

---

Quote for the day:

"Everything that irritates us about others can lead us to an understanding of ourselves." -- Carl Gustav

---

Daily Tech Digest - November 13, 2017

A framework for improving cybersecurity discussions within organizations

Trust among business stakeholders is a necessary component of digitally resilient cultures; without it, organizations will have a difficult time successfully shielding the customer data that nowadays is so critical for achieving business goals. The board needs to trust that senior management has a long-term view of cybersecurity, with a strategic road map and plans in place to adequately protect information assets and IT systems, regardless of where and how new threats emerge. The business units, the IT organization, and the cybersecurity team need to trust one another enough to get to a mutual agreement about how security protocols can be integrated into daily business processes without creating operational challenges and frustrations. Companies need to have faith that external partners—for instance, cloud vendors—are willing and able to protect shared data and infrastructure.

What it means to lead a "driving digital" organization

Businesses have to be more data driven even where there is significant competition for data scientists, PhDs, and quants. That mean most firms have to be creative and leverage technologies and practices that enable more people across the organization to perform analysis and deliver insights. Citizen data scienceprograms are a combination of technology, practices, and governance that enable business analysts in marketing, operations, finance, and other departments to self-serve the analytics they require to drive their organizations. Similarly, CIOs can leverage low code and citizen development platforms to enable departments to create the applications they need to drive collaboration and workflow. Between citizen data science programs and low code development platforms, CIOs can use IT resources on the most strategic projects and extend the boundaries of traditional IT to departmental technology practices.

6 steps you need to take to evaluate your business' cyber risks

Traditionally, the focus for cyber security was on using products or services that protected you from potential attacks or detected virus or malware. However now, especially within the current IT security landscape, this approach doesn't hold enough power. A cyber security strategy needs to first hone in on your company’s unique risk profile, considering what assets are of interest to hackers, and how and why they might seek to attack your business. From this position of knowledge, you’ll have a much more effective level of protection. Plus with small businesses, on the whole, having fairly limited budgets, this strategy will ensure you focus your time and energy on the products and services that work for you, and protect the data that you believe is most likely to get hit. This approach requires you to conduct a threat and risk analysis. From this, you’ll be able to create a profile of the current threats to your business and how attackers might gain access.

UK threatens to shut down popular Bitcoin investment site BitConnect

BitConnect has two months to prove “cause to the contrary” until the decision has been formally enforced, according to an official filing on the British Companies House website. Should the company fail to comply with these terms, the government agency will strike off its registration and seize its assets. “Upon dissolution all property and rights vested in, or held in trust for, the company are deemed to be bona vacantia, and accordingly will belong to the crown,” the document reads. Many have speculated that BitConnect likely stashes its funds abroad, though there is no evidence to back this up. ... While the notice makes no mention of the people behind the shifty Bitcoin investment platform, another filing reveals BitConnect was registered by a British man going by the name of Ken Fitzsimmons. According to the same filing, Fitzsimmons holds 75 percent or more of the shares in the company.

Risk assessment: The first step in improving cyber security

Whichever combination of frameworks the company decides to incorporate for its risk assessment, it is essential to relate the process back to the organisation’s unique operational structure and business objectives. One of the most important activities in preparing a comprehensive assessment is to conduct in-depth interviews with senior management, IT administrators and other stakeholders across the organisation. This will help to develop a much more realistic understanding of the organisation’s potential threats, likelihood of compromise and the impact of the loss, as well as relating everything back to its business priorities. It is also essential that the risk assessment is understood and supported at the highest level of the organisation. PwC’s survey found that only 44% of boards are actively participating in their security strategy.

IT leaders failing to prepare for cyber attacks, despite fears

“It is encouraging that IT professionals are understanding that it is a matter of when, not if, their organisation will be hit by a damaging cyber attack,” said John Carlin, chairman of Morrison & Foerster’s global risk and crisis management practice. “However, their level of confidence, when it comes to security, is inconsistent with what we see in practice. “The reality is that businesses are consistently failing to restrict access to sensitive information and are regularly experiencing issues such as data loss, data theft and extortion in the form of ransomware.” But Varonis CMO David Gibson said that while attackers are upping their game by using more sophisticated, blended attacks, valuable data remains vulnerable to attacks that require little to no sophistication, such as disgruntled employees snooping through overly accessible folders.

IoT technology is a major cybersecurity headache for businesses

The survey found that a combination of top-down executive support, proper security tools and audits instil greater confidence in device visibility. 48pc of all respondents stated that improving awareness and visibility of IoT devices is a top priority for improving IoT security overall, and 82pc of respondents expect their IoT or OT security spend to increase over the next one to two years. “IoT and OT bring significant benefits to organisations around the world,” said a spokesperson at Forrester. “Enterprises are heading in the right direction when it comes to IoT security investments, and our hope is to bring greater awareness to both the challenges as well as the best practices. However, this survey brings to light that more is needed to be done around IoT security.”

Homeland Security team remotely hacked a Boeing 757

This hack was not conducted in a laboratory, but on a 757 parked at the airport in Atlantic City, N.J. And the actual hack occurred over a year ago. We are only now hearing about it thanks to a keynote delivered by Robert Hickey, aviation program manager within the Cyber Security Division of the DHS Science and Technology (S&T) Directorate. “We got the airplane on Sept. 19, 2016. Two days later, I was successful in accomplishing a remote, non-cooperative, penetration,” Hickey said in an article in Avionics Today. “[That] means I didn’t have anybody touching the airplane; I didn’t have an insider threat. I stood off using typical stuff that could get through security, and we were able to establish a presence on the systems of the aircraft.” While the details of the hack are classified, Hickey admitted that his team of industry experts and academics pulled it off by accessing the 757’s “radio frequency communications.”

Challenges, Implications, and Opportunities for Autonomous Systems in Aerospace and Defense

Defense applications of artificial intelligence and robotics are nascent and recent Defense Science Board and Department of Defense documents speak to the challenges, gaps, and goals of incorporating autonomous systems into military operations. The key technical challenges include human-system collaboration, perception and understanding, manned and unmanned teaming, and test and evaluation. One of the primary gaps that needs to be addressed includes the testing and lifecycle maintenance of autonomous systems that learn and adapt. Military operations are soldier-centric and the goal of autonomous systems is not to replace the soldier, but to give him another tool in his arsenal that improves his survivability and mission effectiveness. Thus, autonomous system technology developments alone will not suffice.

11 top tools to assess, implement, and maintain GDPR compliance

The European Union’s General Data Protection Regulation (GDPR) goes into effect in May 2018, which means that any organization doing business in or with the EU has six months from this writing to comply with the strict new privacy law. The GDPR applies to any organization holding or processing personal data of E.U. citizens, and the penalties for noncompliance can be stiff: up to €20 million (about $24 million) or 4 percent of annual global turnover, whichever is greater. Organizations must be able to identify, protect, and manage all personally identifiable information (PII) of EU residents even if those organizations are not based in the EU. Some vendors are offering tools to help you prepare for and comply with the GDPR. What follows is a representative sample of tools to assess what you need to do for compliance, implement measures to meet requirements, and maintain compliance once you reach it.

---

Quote for the day:

"The role of leadership is to transform the complex situation into small pieces and prioritize them. -- Carlos Ghosn

---

Daily Tech Digest - November 12, 2017

This Robot Swarm Finishes Your Grocery Shopping In Minutes

“Because the robots are brand new, it looks like a render but in fact it’s 100% real,” answers Alex Voica, the head of technology PR and communications at Ocado, a British online-only supermarket that delivers orders to customers straight from its warehouses. Ocado sells everything you can find in a brick-and-mortar supermarket–from meat, dairy, and produce to its own brand of home products, third-party goods, and even flowers, toys, and magazines. When it comes to online delivery, speed and efficiency are paramount, which is why the company has been working on automation since it was founded in 2000. While other companies rely on human workers to find and buy all of the items on an online customer’s shopping list, Ocado is using a new kind of robot–or, more specifically, a swarm of them.

Accountability is not the problem you’re looking to solve

Perceived lack of accountability is a symptom of a larger problem in the organization. If the organization believes their people are not accountable or responsible, that points directly to a deficit in trust. We see both in Patrick Lencioni’s hierarchy of the 5 dysfunctions of a team, though avoidance of accountability is not the root problem, absence of trust is. ... One way management often hinders teams in in forming trust is by frequently changing their members around, thus causing them to have to re-form relationships. How can we expect people to be accountable to people they have never worked with before and immediately deliver on everything that is expected of them? Those are unfair expectations and teams are at a disadvantage from their inception

Commanding Large Datasets With Ease

You would think that since data integration is something every successful dashboard deployment requires, most dashboards would come with software that would allow such integration out of the box. Far from it. Most dashboards ship with very basic Extract-Transform-Load (ETL) functions, if any. Such simple ETL works great for demo software but fails miserably when presented with real-world challenges. The Syncfusion Dashboard Platform is unique in this respect. Not only is it one of the most powerful, elaborate, and mobile-enabled dashboard platforms available (at any price), it is complemented by a complete data integration platform. Syncfusion's Data Integration Platform allows you to easily integrate data from multiple data sources. You can perform complex integration tasks without writing any code. There are out-of-the-box processors for all your data handling needs. There is also support for custom processors.

Severe shortage of cyber skills poses data security threat

“The cyber-security skills shortage represents an existential threat to our national security, and this year-over-year comparison data bears out this fact,” says Jon Oltsik, an ESG analyst and the report’s author. “We are not making progress, cyber-security professionals can’t scale, and the implications of the skills shortage are becoming more pervasive and ominous. “It is clear that the solution must be about more than filling jobs,” he adds. “It is about creating an environment from the top down of cybersecurity as a priority.” In the report, Oltsik also identifies the five most important investment mistakes that businesses make with regards to cybersecurity and suggests remedies based on the study: Failing to align cybersecurity and business goals: To correct this, 43 percent of the survey respondents suggest establishing security-related goals and metrics for IT and business managers.

Proactively Managing Data Compliance With Encryption Strategies

There is a perception problem with encryption, where companies consider it to be a time-consuming process that is not worth the effort when compared to the perceived risk of being hacked. The “it won’t happen to us” mentality is pervasive, despite the industry predictions that cybercrime damages will cost the world $6 trillion annually by 2021 (according to Cybersecurity Ventures). Whether a firm believes their current safeguards are sufficient, or that hackers won’t target their business, they avoid encryption until it’s simply too late. They are not performing the usual risk/reward that organizations should consider when weighing the value of data and the downsides of a breach. Encryption is also not as mysterious and complex as many believe. It simply involves taking data and translating it into a different form that requires an access key to read, share and edit.

Big Data, IoT and the need for high density and ultra high density computing

IoT and big data put intense pressure on the security, servers, storage and network of any organisation - and the impact of these demands is being felt across the entire technological supply chain. IT departments need to deploy more forward-looking capacity management to be able to proactively meet the business priorities associated with IoT connections. And big data processing requires a vast amount of storage and computing resources. All this means that, ultimately, the data centre now sits firmly at the heart of the business. Apart from being able to store IoT generated data, the ability to access and interpret it as meaningful actionable information - very quickly - is vitally important, and will give huge competitive advantage to those organisations that do it well.

How better data governance can help banks keep pace with the rising tide of regulations

In the case of GDPR, for example, Australian banks operating in Europe will need to implement a personally identifiable information (PII) data hub where they can pull all relevant data together in one place. They will also need to reconcile and harmonise disparate PII data into a “single version of the truth” using data quality and master data management (MDM) together with metadata management to establish data lineage. Data lineage is frequently seen as the first step towards good data governance. In fact, data governance effectively takes data lineage one stage further by outlining a full set of processes that ensure important data assets are formally managed across the entire enterprise. Having in place the right data governance systems and solutions is vital in delivering a fully secure, well-managed and compliant data environment within banks.

Best Practices to Help Safeguard Your Organization for the Internet of Things

First of all, because advanced threats like Hajime and WannaCry were so successful at targeting known vulnerabilities, this has become an increasingly popular attack vector for cybercriminals. As a result, patch management is essential. WannaCry targeted a vulnerability for which a patch had been available for more than two months. ... And the new Reaper IoT botnet can simultaneously target multiple vulnerabilities across a number of manufacturers using a constantly updated vulnerability list. Organizations that are spared the effects of these sorts of attacks all have one thing in common - a strong cyber-hygiene policy that includes applying patches as soon as they're available. But physical patching is only part of the solution. There are billions of vulnerable devices out there with no patches in sight. This is where intrusion-prevention systems (IPS) are essential. 

What's Worse for Your Account: a Data Breach or a Phishing Attack?

The good news is that data breaches tend to only contain username and password information, which is sometimes not enough to break into an account. For instance, Google has protections in place to also analyze where a login takes place and from what device. Any deviations found can prompt Google to verify your identity. Attacks from phishing kits, on the other hand, can be designed to extract more detailed information from their victims, including geo-location data, the login device, and even account recovery questions. "Our findings indicate that while credential leaks may expose the largest number of passwords, phishing kits and keyloggers provide more flexibility to adapt to new account protections," the study said. Google has forced a password reset for the company users found in the sample datasets.

New age insurers are technology and data driven

Insurers might have to do a cost-benefit analysis to finalise build or buy decisions. Once a data infrastructure is in place, data can be tapped and insights can be generated using advanced analytics algorithms. These insights can then further fine-tune data needs, which can again enhance/update data collection and aggregation. Whether an insurer begins this process on a small or large scale, the deployment of big data and advanced analytics in business decisions is a complex undertaking which requires a structured approach with multiple dimensions. We believe that a framework for such a transformation involves interdependent components, each of which adds distinctive characteristics. It starts with the source of value, accordingly deriving the needed data ecosystem and modelling insights, further moving on to workflow integration and adoption.

---

Quote for the day:

"Leadership is a privilege to better the lives of others. It is not an opportunity to satisfy personal greed." -- Mwai Kibaki

---

Daily Tech Digest - November 11, 2017

Forrester's top 6 cybersecurity predictions for 2018

It's become easier for firms to monitor employees and their activities as a means to thwart malicious insiders, employees making mistakes, or an attacker with compromised employee credentials. However, employees may find this to be an invasion of privacy. In September, the European Court of Human Rights ruled that companies must inform employees in advance if their work email accounts are going to be monitored. Further, such monitoring must not infringe upon workers' privacy, the court ruled. The EU GDPR also applies to employee privacy and data handling, and includes large fines for noncompliance. "Conventional wisdom dictates that mishandling of customer data will draw the ire of regulators, but employee data is personal data, and Forrester predicts that regulators will be just as likely to focus on employee privacy violations as they are customer violations," according to the report.

Android security audit: An 11-step checklist

Android security is always a hot topic on these here Nets of Inter — and almost always for the wrong reason. As we've discussed ad nauseam over the years, most of the missives you read about this-or-that super-scary malware/virus/brain-eating-boogie-monster are overly sensationalized accounts tied to theoretical threats with practically zero chance of actually affecting you in the real world. If you look closely, in fact, you'll start to notice that the vast majority of those stories stem from companies that — gasp! — make their money selling malware protection programs for Android phones.  The reality is that Google has some pretty advanced methods of protection in place for Android, and as long as you take advantage of those and use a little common sense, you'll almost certainly be fine. The biggest threat you should be thinking about is your own security surrounding your devices and accounts — and all it takes is a few minutes a year to make sure your setup is sound.

Ensuring data security in customer support programs

In today’s digital era, the implications of data breaches can be extremely far reaching. When valuable information is stolen from a company, the damage goes beyond initial cost to include brand reputation, customer loyalty and ultimately, revenue. Every company wants to avoid becoming tomorrow’s next mega breach headline, but one of the biggest missteps here is a lack of understanding that it’s no longer a matter of if a company will be breached, but when. October was National Cybersecurity Awareness Month, and yet this month alone brought forth a number of troubling security incidents. While the security outlook may seem bleak these days, there are several measures organizations can implement to prevent breaches across their systems.

Artificial intelligence is going to completely change your life

Just as electricity transformed the way industries functioned in the past century, artificial intelligence — the science of programming cognitive abilities into machines — has the power to substantially change society in the next 100 years. AI is being harnessed to enable such things as home robots, robo-taxis and mental health chatbots to make you feel better. A startup is developing robots with AI that brings them closer to human level intelligence. Already, AI has been embedding itself in daily life — such as powering the brains of digital assistants Siri and Alexa. It lets consumers shop and search online more accurately and efficiently, among other tasks that people take for granted. “AI is the new electricity,” said Andrew Ng, co-founder of Coursera and an adjunct Stanford professor who founded the Google Brain Deep Learning Project, in a keynote speech at the AI Frontiers conference that was held this past weekend in Silicon Valley.

How will AI change the future of banking and financial services?

Crooks are getting smarter about fooling the casual observer with their financial actions. It might take a forensic accountant to identify instances of illegal money laundering. This is not so when you combine machine learning use cases in finance with artificial intelligence. AI, armed with the knowledge of hundreds of forensic accountants, could quickly spot telltale activity. It makes the Federal Reserve, the FBI, and in some cases, the CIA happy; it increases the bank’s reputation; it increases the likelihood of appropriate taxation for the IRS; and, more than likely, it puts a significant dent in crime.  ... It also works for identifying employees for access to restricted areas, or the ability to perform specific actions. It can even identify a pre-actions characteristic of a robbery before it happens, and alert staff, security, and the police before it occurs.

“Unlearn” to Unleash Your Data Lake

It takes years – sometimes a lifetime – to perfect certain skills in life: hitting a jump shot off the dribble, nailing that double high C on the trumpet, parallel parking a Ford Expedition. Malcolm Gladwell wrote a book, “Outliers,” discussing the amount of work – 10,000 hours – required to perfect a skill (while the exactness of 10,000 hours has come under debate, it is still a useful point that people need to invest considerable time and effort to master a skill). But once we get comfortable with something that we feel that we have mastered, we become reluctant to change. We are reluctant to unlearn what we’ve taken so long to master. Changing your point of release on a jump shot or your embouchure for playing lead trumpet is dang hard! Why? Because it is harder to unlearn than it is to learn. It is harder to un-wire all those synoptic nerve endings and deep memories than it was to wire them in the first place.

Are You Ready to Have a Robot as Your Boss?

While there is much focus on the adverse implications of the AI and robot revolution on frontline jobs, it can impact the roles of professionals and managers, too. AI could replace routine administrative tasks and financial-based decision-making processes. Managers need to think of strategies to educate and prepare workers and assist them with job realignment. They should also take actions to reduce increased income inequality, such as reduced workweeks and skills training. Managers will also have to redefine and rethink their roles and consider collaboration and creative thinking with AI and robots. They will be able to collaborate with intelligent systems by using them as an advisor or assistant to help them explore different scenarios or evaluate the consequences of their decisions.

What Tech Is Getting Wrong With The Culture Of Youth

Individuals who have experience in product development know the ropes and have seen complex products through from their development and ongoing iterations. While today’s products may go from conceptualization to implementation faster than ever before, the process is complex and requires highly skilled individuals. And once a product is live, it requires constant iterations, improvements and changes in order to keep up with customer expectations. And this means … Building an iterative system is complex. Systems should not have an expiration date — they evolve over time. Software products constantly change. If you need to replace the system over time, then you are not doing it right. As Uzi stated to me, “This is why I still love to code: You are creating products that will be forever, and they will evolve, but you need to build this into the product.”

Artificial Intelligence Is a Game-Changer for Risk Management in Finance

The prevalence of data-driven decisions and artificial intelligence will also have impact on the kinds of jobs at financial services firms. A recent report by the consulting firm McKinsey estimated that about 50% of staff today are dedicated to risk-related operational processes such as credit administration while 15% focus on analytics. The firm suggests that by 2025 – thanks to the rise in technological advances – the numbers will shift closer to 25% on operational processes and 40% on analytics. One change that is already taking place: the roles of chief technology officer, information officer and chief data officer are starting to see more overlap. These roles were previously disparate, but as investments become more data-driven, CTOs, CIOs and CDOs are finding they need to work together. 

Culture: a Farming Tale

The soil of your company must encompass a culture of learning. The concept of learning is comprised of other concepts such as motivation, curiosity, logic, problem solving, and comprehension. Embedding these concepts in your soil can be achieved with dedication to growth. Nutrients for your soil include activities such as mentoring programs, online subscriptions to tech tutorials, a sizable and accessible training budget (many companies forgo training since turnover is high in their organizations - is this causality?), clear career paths, and tuition reimbursement. Many companies which do not possess large financial assets can substitute feature development for innovation cycles, but something more than a one-day hack-a-thon would be preferable and more productive.

---

Quote for the day:

"Information is pretty thin stuff unless mixed with experience." -- Clarence Day

---

Daily Tech Digest - November 10, 2017

DevOps Adoption and Operational Models at Ticketmaster

The tooling is critical. If you have a solid, well tested pipeline with code reviews which includes infrastructure code, then you are already ticking a lot of the boxes and can iterate faster. This means you can be more secure by responding faster to issues. Sharing ownership of DEV/QA with Operations and Dev teams means any concerns on security or performance happen faster, and you expose Operations teams to the challenges faced by Engineering when environments are different. The tool chain now available means it’s easier to share and these are significant improvements for compliance, particularly if automation means little to no production access. Why would you need it if logging and instrumentation give you all the insight you need? In a container world the notion of RDP or SSH to systems doesn’t make sense anymore unless you’re dealing with state and data where things can get a little more complex.

Transitioning to the role of CISO: Dr. Alissa Johnson

One is that there are a lot of instances where we allowed the culture to drive the security governance, and, a lot of the time, we found ourselves behind the adversary. You have to let security governance drive things -- for example, with multifactor authentication. There may be a better way of doing that, but when we let the culture in a company or agency drive security governance or innovation, that's a problem. The second thing that I learned was that there really isn't a lot of difference between there and here. ... Xerox has no nuclear secrets, but hackers are still attacking us and trying to get data using the same tools and technology. What they want to get is different, but how they get it is the same. All organizations have unique aspects, but when you peel it back and look at the way the attackers come in, [it] is largely the same.

Why Europe’s GDPR privacy regulation is good for business

Organisations need to look after their information assets with the utmost care because they are responsible for its safe keeping as custodians. GDPR is a great reminder to businesses that people lend their information and organisations have a responsibility to look after it. It’s not just about confidentiality, it’s about integrity, accuracy and availability – and it’s just plain good business practice. If you’re managing customer information in a fit and proper way, then requests for that information – known as subject access requests – are nothing to fear. GDPR is expected to lead to a significant increase in consumers submitting subject access requests, which require businesses to disclose copies of the data they hold on individuals. If a company has done all the right work, finding and disclosing information for a subject access request will be easy to do, and there should be a streamlined approach in place for this.

Will human drivers always be the weak link when sharing the road with autonomous vehicles?

If all cars on the road were autonomous, accidents would decline, Ramsey told TechRepublic after the Uber accident. "While they are mixed together, the inflexibility of computers may lead to accidents that wouldn't have happened before even as some other accidents are prevented," he said. In May 2016, a Tesla driver was killed in an accident while the car was operating in its semi-autonomous Autopilot mode. A US Department of Transportation investigation did not identify any defects in design or performance of the Autopilot system. According to data released by Tesla during the investigation, Autopilot has lowered the number of crashes among its drivers by 40%. It remains to be seen if these accidents will hinder self-driving efforts moving forward.

Four Strategies for Cultivating Strong Leaders Internally

“In industry, 95 percent of your time is spent operating on the thing that you’re currently engaged in,” Banks says. “In the military, even if you’re in the midst of combat operation, you will still conduct these training exercises to continue building capacity. Imagine if a company was in the midst of delivering goods and services to its customers. Yet it still created some scenarios—like, what would HR have to do in order to merge systems associated with an acquisition?—and ran through them via a short-duration exercise while also meeting its external obligations.” Some businesses have begun to latch onto this idea, creating innovation incubators that let them experiment in real time, or even sending employees to immersive, multiple-day business simulations. Banks expects more organizations will soon follow suit.

How Law Firms Can Make Information Security a Higher Priority

There are now several prominent examples of how things can go wrong. Earlier this year, global law firm DLA Piper was hit by a strain of ransomware that forced management to shut down its offices for several days while IT dealt with the problem. In 2016, a breach referred to as the Panama Papers entailed a massive document disclosure of 2.6 terabytes of data from Panamanian-based law firm Mossack Fonseca. German newspaper Süddeutsche Zeitung got hold of the documents, resulting in coverage of celebrities' and politicians' financial transactions and other personal details.  If events like these have a silver lining, it is the possibility that other firms might learn from them in hopes of avoiding the same fate. Here are four best practices law firms should consider as they seek to make information security a higher priority:

Google: Our hunt for hackers reveals phishing is far deadlier than data breaches

Despite the huge numbers, only seven percent of credentials exposed in data breaches match the password currently being used by its billion Gmail users, whereas a quarter of 3.8 million credentials exposed in phishing attacks match the current Google password. The study finds that victims of phishing are 400 times more likely to have their account hijacked than a random Google user, a figure that falls to 10 times for victims of a data breach. The difference is due to the type of information that so-called phishing kits collect. Phishing kits contain prepackaged fake login pages for popular and valuable sites, such as Gmail, Yahoo, Hotmail, and online banking. They're often uploaded to compromised websites, and automatically email captured credentials to the attacker's account.

Key Steps to Building and Managing an Effective API Marketplace

Generally, an API marketplace comprises several components. In a typical scenario, producers first publish APIs, and these are then catalogued and displayed via an API developer portal. This encourages consumers of the APIs to access the developer portal directly or indirectly (via system APIs for instance) to find, discover, and explore them. The developer portal displays different types of APIs, grouped by division, category, type etc. With specific APIs, users can then test and subscribe to them. ... Successfully implementing a marketplace requires taking a more advanced approach to implementing some aspects of the API management system, most notably the API developer portal and analytics. At the same time, organizational practices will also play an important role in establishing a highly functional marketplace.

Assessing the business, societal value of AI capabilities

People are starting to understand that we can hand off cognitive tasks -- not just physical tasks -- that we used to ask experts to do. They're not exactly robotic tasks; they're very difficult tasks. For example, if you look at the oil and gas industry, a lot of oil and gas discovery is reading seismic responses. These things are monochrome; they look like a bunch of waves on a piece of paper. It's going to take a geoscientist with years of experience to recognize the pattern. What they're really doing is mentally extracting a set of features from the data, making some inferences about it and then trying to interpolate that against other forms of information. That other information includes things like maps, other types of surveys or even just information from local people who say, 'Once upon a time, there was a legend that there were puddles of oil in the ground there.'

Severe shortage of cyber skills poses data security threat

A report last month by the Information Systems Security Association (ISSA) and the IT analyst firm Enterprise Strategy Group (ESG), shed light on the scope of the problem and offered guidelines to businesses for easing the skill crunch. This was the second year in a row that the two organizations have partnered to conduct the study, and the results depict a widespread business problem that is becoming more severe. Nearly three-fourths of the respondents (70%) of the ISSA and ESG survey respondents indicate that the shortage of people with cyber-security skills has had an impact on their organization. Yet 62% of them also concede that they are falling behind in providing an adequate level of training for their data security personnel. And that figure is up almost 10% percent from last year’s study.

---

Quote for the day:

"Leaders must know where they are going if they expect others to willingly join them on the journey." -- Kouzes & Posner

---