Daily Tech Digest - March 06, 2018

Introduction to Learning to Rank (LTR) search analysis

A classification technique called Learning to Rank (LTR) is used to perfect search results based on things like actual usage patterns. LTR isn’t an algorithm unto itself. The actual ranking is often done with an algorithm called support vector machine (SVM), but recently gradient-boosting trees (GBTs) have been used instead. There are multiple implementations of Learning to Rank available. The most famous open source implementations are XGBoost, RankLib, and part of Apache Solr, which was donated by Bloomberg. ... Learning to Rank has been part of search efforts for a couple of decades. It is used generally to fix results based on user preferences or implicit behavior (read: clicks). Because LTR is based on a machine learning classification model, it is a supervised learning method. This means that you train a model based on some preprocessed data. This data with hand-labeled ranks is then used to optimize future results

Nearly half of CIOs now plan to deploy artificial intelligence

"Don’t fall into the trap of primarily seeking hard outcomes, such as direct financial gains, with AI projects," Andrews said. "In general, it’s best to start AI projects with a small scope and aim for 'soft' outcomes, such as process improvements, customer satisfaction or financial benchmarking." Expect AI projects to produce, at best, lessons that will help with subsequent, larger experiments, pilots and implementations. In some organizations, a financial target will be a requirement to start the project. "In this situation, set the target as low as possible," Andrews said. "Think of targets in the thousands or tens of thousands of dollars, understand what you’re trying to accomplish on a small scale, and only then pursue more-dramatic benefits." Big technological advances are often historically associated with a reduction in staff head count.

Millennials are bigger victims of fraud than senior citizens, FTC finds

The FTC report is the latest study to challenge the conventional wisdom that older adults are the ones falling prey to fraud. As previously reported by TechRepublic, younger adults are more likely to lose money to a tech support scam, and self-reported tech-savvy people are more likely to become the victim of phishing and identity theft. All these studies point to an incorrect perception about tech users that needs to change for the sake of personal and organizational security: Young adults aren't safer by default. There is, of course, a caveat to the FTC's report: It's a collection of complaints the organization received, so it can't necessarily be treated as an absolute representation of who is paying out to scammers. That said, the numbers do line up with a report from Microsoft mentioned by our sister site ZDNetin late 2016: Half of adults between the ages of 18 and 34 fell for online tech support scams, while only 17% of those over 55 did.

Enterprise IoT: Business uses for RFID technology

Internet of Things (IoT) has made a big buzzword over the past few years as organizations have added intelligent controls to refrigerators, soda machines, washer and dryers, medical robots and lightbulbs. While the consumerization of IoT is in our everyday life, enterprises have been looking for ways IoT can benefit them and their users to improve day to day tasks. One of the big enablers of IoT in enterprises has been the simple addition of RFID tags for day-to-day operational functions. Some RFID tags that have batteries, active transmitters and built-in electronics to capture and relay information run $15-$50 apiece. On the other hand, passive RFID tags are extremely inexpensive running 5 to 10 cents each. Passive tags have no active electronics, they merely have an identification code similar to a barcode, but unlike barcodes that require line-of-sight readers to scan them, passive RFID tags can activate and respond several feet away with no need for line-of-sight access.

Windows Defender can now spot FinFisher government spyware

Microsoft says it has cracked open the notorious FinFisher government spyware to design new ways to detect it and protect Windows and Office users. FinFisher is sold to law-enforcement agencies around the world and its maker, European firm Gamma Group, has been criticized for selling it to repressive regimes. Last year, researchers at FireEye discovered FinFisher being distributed in Word documents loaded with an attack for an Office zero-day targeting Russian-speaking victims. In some countries ISPs have also assisted FinFisher rollouts by redirecting targets to an attack site when they attempt to install popular apps. Malware researchers at ESET have found it difficult to analyze recent versions of FinFisher due to techniques it uses to prevent sandboxing, debugging, and emulation. Microsoft's threat researchers say FinFisher's level of anti-analysis protection puts it in a "different category of malware" and reveals the lengths its makers went to ensuring it remains hidden and hard to analyze.

SEC's new cybersecurity guidance falls short

By comparison, other cybersecurity regulations have significant enforcement power behind them. Breach notification laws, for example, are in place in 48 states, Washington, DC, and Puerto Rico, according to the law firm Perkins Coie. A year ago, New York began requiring comprehensive cybersecurity assessments from financial services companies in the state. This May, the European Union's General Data Protection Regulation (GDPR) goes into effect with fines of up to 20 million euros or 4 percent of annual global revenues, whichever is higher. This new SEC guidance doesn't compare to that, says Badway. "Not even close." As a result, he says, he doesn't see corporations rushing out to improve their cybersecurity processes in response to the new SEC guidance. They might be more motivated to improve by shareholder lawsuits, he adds, but the new guidance isn't likely to provide more fuel for the plaintiffs. "The criteria are the same," he says. "I don't think anything has changed."

Smart homes pose a cyber threat to their owners and tenants

Cyber criminals can use a smart home system as an entry point for remote attacks. David Emm, principal security researcher at Kaspersky Lab, said: “The fact that smart home hub meters are open to attack from cybercriminals is very concerning due to the wealth of people using these devices on a day-to-day basis.” Kaspersky Lab has discovered vulnerabilities that could affect smart homes. Criminal hackers could gain access to a smart product’s server, steal personal data, and use it to access accounts and take control of systems within a person’s home. Researchers testing a smart device found that it sent user data, including smart hub login credentials, to a corresponding server. Other personal information, such as the user’s phone number for text alerts, may have also been included and sent. Malicious actors have found a way to send seemingly legitimate requests to servers to download information, including the device’s serial number. If the serial number is not included, cyber criminals can use basic methods to obtain it.

6 Questions to Ask Your Cloud Provider Right Now

The cloud is fairly new territory for many organizations and, consequently, it’s an area where mistakes are made stemming from confusion around the role cloud service providers play in security, and how companies should work with them. "Organizations looking to host their data in cloud service providers have the best intentions in mind, and the clients I speak with are looking at security as being a key motivator," says Mark Judd, research analyst at Gartner's Research Analyst Lab. But, Judd says, many businesses are in the mindset of thinking that because major players like Amazon and Microsoft have not been directly compromised, any data they put in those companies' cloud environments will automatically be secure. The problem is, security works both ways. "They neglect to realize that moving into a cloud does not automatically make their data secure, but requires an understanding of the shared responsibility in regards to security controls between the organization and the cloud provider," Judd explains.

Cryptocurrency mining malware now as lucrative as ransomware for hackers

One of the reasons the cryptocurrency mining operation has proved to be so lucrative for one of the most successful groups observed is because the malware is deployed using techniques more usually associated with sophisticated and state-backed hackers. In this instance, the cryptocurrency mining malware is being distributed with the aid of process-hollowing - a technique which lets the malware unmap the legitimate code of processes and overwrite them with malicious code. Victims of this campaign are lured into downloading legitimate-looking software which has instructions to download the miner hidden inside. As the process initially looks like a legitimate form of software, it isn't detected by anti-virus products. Once the dropper software has been installed, a Windows installer 'msiexec' is run, and it downloads and executes malicious modules from a remote server which carry out the process-hollowing, allowing the attackers to alter the code with the instructions to carryout mining for cryptocurrency.

Data-Driven Thinking for Continuous Improvement

It’s a culture where there is no "status quo" or "because that is how we do things here." People are encouraged to find better ways of doing their jobs. We allow trials of new approaches. If they work well, we adopt them. We not only give people ownership over their work but also over the organization and its processes. One example of this is our Journey Team structure. We knew that our existing team model wasn’t working well for the individuals on the teams, but they never got "permission" to fix it. After moving towards our new culture, an ad-hoc group of product and engineering team members came together to design a new team structure. Journey Teams are now our organizational model. ... It was an extended effort that involved creating a solid foundation of multiple elements. First, we created a framework to bring clarity to the company strategy and priorities. For people to make good suggestions, they need to understand the company’s business context.

---

Quote for the day:

"He uses statistics as a drunken man uses lamp posts... for support rather than for illumination." -- Andrew Lang

---

Daily Tech Digest - March 05, 2018

Israel Developing Cutting Edge AI Crime-Fighting Tools

Alsheikh said that the police’s Cyber Unit, which was created to lead the national effort to combat cybercrime, would collaborate with the university’s cybersecurity experts to improve police enforcement and prevention capabilities. “The cooperation will enable the police to bring technology to bear more effectively in enforcing the law and fighting crime – whether cybercriminals or traditional criminals – by turning a threat into an opportunity,” Alsheikh said. Ben-Gurion has in recent years become a recognized international leader in cybersecurity and big data research with a national initiative to promote Beersheba as the “Cyber Capital of Israel.” The Center joins Cyber@BGU (CBG), a shared research platform for the most innovative and technologically challenging cyber-related projects run in collaboration with multi-national companies and government organizations. Among others, the CBG includes the Cyber Security Research Center, a joint initiative with the Israel National Cyber Bureau and Telekom Innovation Laboratories, in partnership with Deutsche Telekom.

A Secure Development Approach Pays Off

There's often a belief that security slows down the development process, which ultimately affects time to delivery. But by avoiding security until the end of the process, there's a huge risk that vulnerable products will be released. Clearly, neither option is ideal. This is where automation comes in. Ideally, you need transparent integration and full automation of the security solution at all stages of the development process. As opposed to conducting the process manually, automating the process will provide findings and feedback continuously with every alteration in the code analyzed without the need for human intervention. The code can then either be returned to developers or virtually fixed, and a patch issued for the source code — all automatically. Automation solves a number of the old problems associated with traditional SSDLC processes — it means security is a core element throughout and doesn't slow down DevOps.

How Modern Infrastructure And Machine Intelligence Will Disrupt The Industry

Cloud computing has fundamentally changed the IT infrastructure landscape. The attributes like self-service, pay-by-use, elasticity and automation added a new dimension to infrastructure management. Modern infrastructure is not the same as cloud computing. It is predominantly driven by emerging use cases, and business problems that cloud alone cannot adequately address. The rise of containers, container orchestration, microservices, cloud-native architectures, container-defined-storage and container-defined-networking lead us to the next phase of infrastructure. Next-generation infrastructure will be built on the firm foundation laid by containers. Like the way VMs abstract the underlying physical hardware, containers will make virtual machines irrelevant. Container images will become the de facto mechanism for packaging, distributing and deploying software. With containers becoming the new VMs, Infrastructure as a Service (IaaS) will gradually transform into Container as a Service (CaaS).

Understanding the difference between machine learning and predictive analytics

A simple machine learning algorithm that uses the data of employee satisfaction ratings between 1 and 100 against their salaries as training data is a perfect business application even though most other real life applications are a lot more complex involving trillions of dimensions. Instead of simply plotting a predictive satisfaction curve against salary figures for the various employees as predictive analytics will suggest, the machine learning algorithm automatically assimilates huge random training data upon entry, and the prediction results are affected by any added training data. All this aims at moving towards more real-time accuracy and more helpful predictions. This machine learning algorithm like all others apply self-learning and automated recalibration in response to pattern changes in the training data making machine learning a lot more reliable for real time predictions than other artificial intelligence concepts. Repeatedly increasing or updating the bulk of training data guarantees better predictions.

Fintech and RegTech win over compliance skeptics

The challenges for firms range from the need to have the appropriate skill sets at all levels of the business, to the capability to be able to evaluate possible RegTech, fintech or InsurTech solutions. Give your organization the tools to manage heightened global regulatory pressure with Conflicts Compliance All of which is set against a background of a near universal need to revamp legacy systems, while also implementing and embedding massive regulatory rulebook changes. Against this backdrop, Thomson Reuters Regulatory Intelligence undertook it’s second global survey to assess the impact of developments in RegTech and fintech on the role and remit of the compliance function in financial services firms. ... The biggest financial technology challenge for firms in the coming year is the need to upgrade legacy systems along with cyber resilience and technology risks. On the benefit side, the deployment of fintech is expected to lead to improvements in efficiency and productivityproviding greater commercial opportunities.

IoT: Sensor-as-a-service, run by blockchain, is coming

In the case of Nokia’s sensor-as-a-service offering, which it alternately calls IoT for Smart Cities, the company says parking, trash management, environmental sensing, smarter lighting, and security (e.g., video surveillance) are primary commodities that MNOs can offer municipalities. They use existing base station sites, also known as towers. Enterprises may also want access to that kind of data, Nokia says. That could include weather forecasting operations, healthcare and insurance. Smart cars and drones will also require better municipal data, the company says. There’s minimal capital expense, and the blockchain “anonymized, private and secure micro-transactions” pays the MNO from the city coffers. Nokia, not the MNO, performs all of the edge gateway and sensor installation. Data is stored on Microsoft Azure, Amazon Web Services (AWS), or a private cloud. The Nokia AVA platform or a choice of Amazon IoT or Microsoft IoT performs the data transfer. 

Get ready for an explosion of smartphone innovation

Innovation these days seems to be all about thinner bezels, or face authentication. Which is impressive from a technology standpoint. But these aren’t features that fundamentally change how we interact with our devices. New cameras give us incredibly advanced technology, and pictures that are slightly better than previous models. While that’s true with the Apples and Samsungs of the world, it’s not true with some of the smaller, more interesting players. In recent days, a smattering of truly innovative, mostly enterprise-focused and business-friendly phones have emerged that enable us to do amazing new things. ... The Light Phone 2 is a 4G LTE phone with an e-ink display. It’s designed to function as a second phone for times when you want to leave your full smartphone behind. This is a great phone for on-site security, enabling the user to make and receive voice calls, send and receive SMS text messages and do other basic functions. You can’t use the Light Phone 2 to take pictures, use social media, register location or do anything else that might compromise company secrets.

Getting an ROI for Your IoT Cybersecurity Investment

A certain amount of spending on, say, helping employees better understand the risk IoT cybersecurity poses to their organization might be helpful, additional spending might not be. “People will tell you: ‘User education is a good thing. It makes people more aware. It seems like a place to spend money.’ “And what ends up happening with education spending is that, to a certain degree, it works,” Ramzan said. But ultimately, spending on cybersecurity education will fail in neutralizing cyber threats or preventing end users from making security errors.Normally, we tend to think about security in terms of big buckets of things such as prevention, education, detection and response The same principle applies to threat prevention. An organization could spend vast amounts of money trying to prevent attacks with the theory that would keep them safe. “But in practice, there is a lot of stuff you still won’t be able to prevent no matter how much money you spend,” Ramzan said. “At this point, it is better to do things like invest in detection and response.”

Sophisticated RedDrop Malware Targets Android Phones

“RedDrop is one of the most sophisticated pieces of Android malware that we have seen in broad distribution,” said Wandera in an overview of its research published Wednesday. “Not only does the attacker utilize a wide range of functioning malicious applications to entice the victim, they’ve also perfected every tiny detail to ensure their actions are difficult to trace.” Wandera told Threatpost it’s unsure how many Android devices may be infected with the malware. “One thing we have noticed is that the pace of attempted infections appears to be accelerating,” Wandera said. Since the company initially identified the malware, the company has blocked roughly 20 further requests by infected apps to reach the criminal’s distribution network – where additional malware would be downloaded from. The apps are being promoted via ads displayed on the popular Chinese search engine Baidu. Researchers said those who click on the ads are “taken to huxiawang[.]cn, the primary distribution site for the attack.

Millions of Office 365 Accounts Hit with Password Stealers

Tens of millions of people have been affected by these phishing emails, Shi says, and attackers evade detection by crafting different emails. "What they do is they rotate the content of the email; they rotate sender information," he continues. Signature-based systems won't catch these messages because changing the characteristics of malicious emails changes their fingerprint. Password theft is increasing overall, a sign of attackers shifting their goals and strategies, Shi explains. Ransomware was big last year; this year, password stealers are appearing in phishing emails, browser extensions, and other programs as criminals hunt login data. It's all part of a broader trend of sneaky spearphishing and targeted attacks, he says. Usernames and passwords grant access to multiple systems and applications a particular user is attached to, as well as social media sites and contact lists to fuel future attacks. "Some attackers try to be like a sleeper cell on your system," Shi notes. 

---

Quote for the day:

"The good you do today may be forgotten tomorrow. Do good anyway." -- Kent Keith

---

Daily Tech Digest - March 04, 2018

To Find IT Talent, Think Differently – and Move Quickly

With so much rapid change in technology, workers at all levels will need to expect dynamic shifts in their career development, including changing jobs every five or six years, Hatfield said. "Workers need to be geared to lifelong learning where they maneuver and re-invent," he said. That need implies that workers (and even HR and training departments) "develop a capacity for long-term learning and a passion for it, which is more important than any [one] skill set." Companies also need to focus more carefully on the actual technology they will need — everything from databases to IoT microcontrollers, Finke said. A CTO must help figure out who the lieutenants will be to oversee such technology, then determine where the company will invest and which back-end infrastructure and other technology are needed. More broadly, companies need leaders at the highest levels – not only CIOs – who understand business trends and the context and implications of potential technology disruption.

Microsoft Directly Challenges MongoDB and Cassandra with Cosmos DB

Given that all of the third-party databases listed above are free/open source, Microsoft has to offer something more than just hosting. Otherwise customers will switch back as soon as someone else offers a compatible cloud solution with better performance and/or lower prices. This is where Microsoft's other Azure products come into play. Cosmos DB can be integrated with open source products such as Apache Spark or Apache Kafka as well as proprietary products such as Azure Search, Azure Data Factory, and HDInsight. Rather than extending the file format, Microsoft is attempting to extend what you can do with the database. While switching from MongoDB's cloud hosting to Cosmos DB is mostly a QA and operations question, the use of other Azure products can put significant limitations on your future architectural options. 

 What is natural language processing? The business benefits of NLP explained

In addition to helping companies process data, sentiment analysis also helps us understand society. Periscopic, for example, has paired NLP with visual recognition to create the Trump-Emoticoaster, a data engine that processes language and facial expressions in order to monitor President Donald Trump’s emotional state. Similar tech could also prevent school shootings: At Columbia University, researchers have processed 2 million Tweets posted by 9,000 at-risk youth, looking for the answer to one question: How does language change as a teen comes closer and closer to getting violent? “Problematic content can evolve over time,” says program director Dr. Desmond Patton. As at-risk youth grow closer to the brink, they reach out for help, using language. Natural language processing then flags problematic emotional states so that social workers can intervene. Like Periscopic, Columbia pairs sentiment analysis with image recognition to improve accuracy.

Anthem CIO: How agile helped us drive value

One of the ways we are getting past this issue is by bringing in a set of executives and hosting a Shark Tank day. Various innovation project leaders pitch their ideas to the executives – who are the large budget holders in the company – so that they can roll their product out into the business. It’s been amazingly successful because it has required both our corporate functions and our field business units to partner together in innovation. It’s been a great way to prioritize the most important ideas and get everybody excited about participating in them, and it gets people involved and engaged. We also publish everything we’re working on to an innovation microsite that everyone has access to. The entire workforce sees what we’re working on in the Studio via video demos. Additionally, we invite everyone in the company to participate in ideating around a certain topic using collaboration tools. It’s another way we are doing more to engage the entire workforce, which helps ensure innovation isn’t getting stuck in the studio.

How to decide if open source or proprietary software solutions are best for your business

Initial skepticism regarding free software and questions about the business model ("Why would programmers work for free?") have led to steadfast enterprise adoption of open source software, with an array of options such as "completely free," "free to a certain number of users/functions" and "free but with paid support licenses." As someone who has administered hundreds of Linux servers (which run Red Hat via paid support subscriptions, although it's worth pointing out that CentOS is a totally free alternative with largely the same code base) I can attest to the benefits that open source has provided both to organizations and the technology realm in general. Without it the internet would be a far different place; much more limited, expensive, less robust, less feature-driven and less scalable. Big name companies would be much less powerful and successful as well in the absence of open source software. There's something to be said for proprietary software as well, however; it also has a rich history of providing many proven benefits to organizations.

The Smart City Ecosystem Framework – A Model for Planning Smart Cities

The smart city is a complex ecosystem of people, processes, policies, technology and other enablers working together to deliver a set of outcomes. The smart city is not “owned” exclusively by the city. Other value creators are also involved, sometimes working in collaboration and sometimes by themselves. Successful and sustainable smart cities take a programmatic approach to engage its stakeholders across the ecosystem. Our research has found that many cities are not taking an ecosystem approach to smart city projects. This is due in part to smart city projects being managed by the Information Technology (IT) organization where their charter is on systems development and deployment. In contrast, more experienced smart cities manage their smart city programs through internal cross functional “Transformation” or “Innovation” organizations. Regardless of where cities are in their smart city journey, they must get ahead of the “curve” with smart city projects.

Google’s Cross-Platform Mobile UI Framework Flutter Now in Beta

Flutter supports a reactive-style approach to UI definition, similar to React Native. What sets it apart from other cross-platform Web view-based frameworks is its reliance on Dart to avoid the need for a JavaScript bridge between the UI and the native services provided by the OS platform. This includes, for example, location services, sensor access, camera, etc. By using Dart, which is compiled ahead-of-time into native code, Flutter does not pay the cost of context switching due to the JavaScript bridge. Cross-platform frameworks that aim to provide a native UI look and feel also use natively-implemented widgets to represent buttons, tables, etc. This also usually requires different parts of an app to communicate using the JavaScript bridge, which tends to be slow. To circumvent this, Flutter provides its own collection of widgets and draws them directly on the canvas provided by the OS platform.

Powerful New DDoS Method Adds Extortion

Because memcached doesn’t support authentication, an attacker can “spoof” or fake the Internet address of the machine making that request so that the memcached servers responding to the request all respond to the spoofed address — the intended target of the DDoS attack. Worse yet, memcached has a unique ability to take a small amount of attack traffic and amplify it into a much bigger threat. Most popular DDoS tactics that abuse UDP connections can amplify the attack traffic 10 or 20 times — allowing, for example a 1 mb file request to generate a response that includes between 10mb and 20mb of traffic. But with memcached, an attacker can force the response to be thousands of times the size of the request. All of the responses get sent to the target specified in the spoofed request, and it requires only a small number of open memcached servers to create huge attacks using very few resources. Akamai believes there are currently more than 50,000 known memcached systems exposed to the Internet that can be leveraged at a moment’s notice to aid in massive DDoS attacks.

Manufacturing & Innovation

The Advanced Technologies Initiative provides important insights on US and global innovation trends, and highlights the challenges faced by businesses in maintaining or improving their technology competitiveness. In addition, Deloitte and the Council have consolidated the interviewees’ thoughts and perspectives to develop a set of high-priority recommendations detailing immediate and longterm critical needs to improve the national innovation ecosystem vital to sustaining US competitiveness. The study aims to increase attention and discussion on the current US science and technology system and pinpoint deficits to address its vitality. An ancillary aim is to spur an ongoing national dialogue among stakeholders on advanced technologies, industries, and foci of research from a systematic, versus siloed, perspective. The report captures the voices and opinions of both government and industry leaders on US and global R&D, as well as innovation, trends.

This year banking changes for good. Are you ready for the revolution?

It’s certainly a timely move. On the consumer side, privacy and personal data security are becoming an increasing concern. On the business side, the free flow of data has the potential to enable institutions to innovate, creating competition, and more choice for consumers and small to medium enterprises (SMEs). Historically, SMEs have often been seen as costly for banks to service in relation to the size of business. This has led to them having limited services to choose from, with access to credit being an ongoing concern. As competition increases from FinTech startups and challenger banks, there is potential for institutions who overcome these issues to take market share and better serve the market – generating benefits for themselves and their customers. As you may expect with a GDPR linked initiative, privacy and trust are at the heart of open banking — particularly important when you consider heightened sensitivity around what happens to our personal data when we hand it over.

---

Quot for the day:

"A leader does not deserve the name unless he is willing occasionally to stand alone." -- Henry A. Kissinge

---

Daily Tech Digest - March 03, 2018

New Cyber Security Style Guide helps bridge the communication gap

Security without communication is worthless. You can scream yourself blue in the face, but if no one groks what you're saying, then you're wasting your time. Information security is an unintuitive discipline, in many ways backwards from how we think about security and power and threats in meatspace. Worse, the security community has developed its own slang over the years that deliberately excludes outsiders. All fields do this, of course, and if infosec were metalworking or plumbing or air traffic control, that would be fine and dandy. Ordinary people don't have a pressing need to understand the inner workings of those fields. The human race has moved online, and information security affects everyone now. It used to be we lived in the "real world" and "went online." Now we live online and visit the "real world." Soon even that will fade, until the only "real world" left will be quaint amusement parks that offer the unplugged experience

Companies ready to spend on IT hardware again

While undoubtedly enterprises are moving software applications from “on-premises data centers to the cloud,” that’s not the whole story, Huberty says. Currently, 21 percent of computing is accomplished in the cloud. That number will indeed rise, as we expect, and should be 44 percent by 2021. However, because enterprise cloud plans are beginning to solidify, or become less vague, firms are now ready to upgrade the IT gear they are retaining or think they’ll need. “They aren't abandoning on-premises computing. Instead, many are adopting a hybrid IT model in which applications move between a public cloud and their own internal data centers,” she explains. Other factors coming into play and contributing to the optimism, according to Morgan Stanley, include more cash being available because of tax law changes in the U.S. and advantages to depreciating equipment costs in the first year due to economic growth. A weak dollar and lower memory costs are also helping the shift.

How digital service providers should prepare for the NIS Directive

Last year, the European Commission published a draft implementation regulationfor DSPs, which Elizabeth Denham, the UK’s information commissioner, commented on. She criticised “the overly rigid parameters” of the regulation, which “may be undesirable and may lead to a failure to report incidents which nevertheless have a substantial impact on the users of the service and which should, by the nature of the impact, be considered for regulatory action”. The European Commission has since approved the final draft, and the UK government has released the findings of a public consultation on how it should implement and regulate the NIS Directive. IT Governance has also published a compliance guide. Each of these documents will help you understand where the NIS Directive fits into the cyber security landscape. DSPs will have to be particularly organised, as they are expected to define their own information security measures proportionate and appropriate to the potential risks they face.

CIOs ill-prepared for IT changes to enable digital business transformation

The Hackett Group reported that 64% of respondents lack confidence in their IT organisation’s capability to support transformation execution. This is all the more worrying given Hackett’s analysis, which predicted that in 2018, IT’s workload will increase by more than the number of full-time employees in IT. The Hackett Group suggested this would mean that IT needs a 2% productivity boost, on average, just to keep pace. However, it said the largest percentage increases in workload (5%) and IT staff (4.2%) are happening outside corporate IT. Instead, business groups appear to be investing in their own IT capabilities. Hackett’s benchmark study said: “Digital transformation goals are at least partial motivators for this, in that IT needs to help business units transform and differentiate customer experiences, locating IT resources closer to the end-customer’s facilities.”

The Irrational Exuberance That is Blockchain

In 2017, we saw some evolution on that front as blockchain platforms such as Hypeledger Fabric announced new versions closer to enterprise use and Ethereum progressed towards making these solutions perform and scale to suit enterprise needs. However, the exuberance has also led to new levels of hucksterism. For example, we have seen companies with dubious blockchain abilities add blockchain to their name or business to try to increase their stock price. In response, the U.S. Securities and Exchange Commission (SEC) said it will crack down on such companies It is critical at this stage in blockchain’s evolution that hype is recognized, and the emergent nature of the technology and its capabilities are clearly understood. ... Gartner does not expect large returns on blockchain until 2025. Which means today companies will have to try different blockchain projects to determine if there is value for them in blockchain — that is, whether there will be new revenue possibilities, cost savings or improvements in their customers’ user experience.

AI Is Now Analyzing Candidates' Facial Expressions During Video Job Interviews

Have you ever lied during a job interview? Most of us have, at least a little. But next time around, artificial intelligence may be watching your face's every move, assessing the honesty of your answers, as well as your emotions in general. It may also try to determine whether your personality is a good fit for the job. ... Applicants, who often find the company's job opportunities through Facebook or LinkedIn, can skip uploading their resumés and simply use their LinkedIn profiles if they wish. They then spend about 20 minutes playing a dozen neuroscience-based games intended to evaluate their personalities for such things as embracing or avoiding risk, to see if their personalities are a good fit for the particular job.  Then they perform a video interview, with preset questions, which they can do on a smartphone or tablet as well as a computer. That's where AI comes in, measuring their facial expressions to capture their moods and further assess their personality traits.

6 Experts Discuss How AI Will Change The Future Of Wall Street (Part 1)

The technology behind AI has been around for more than 40 years, but for AI to work one needs two other ingredients: massive computing power at a reasonable price and massive amounts of data to train the AI. ... The biggest issue is the aversion of asset owners to “black box” strategies. Many consider AI as another version of algorithmic trading (to some extent this is true), and algorithmic strategies have not performed well in the past. While investors are comfortable with having AI playing an important role in many parts of their lives, they seem to prefer human judgment to AI when it comes to the investment process. Another potential obstacle is that an AI approach to trading requires a whole new organization structure for trading operations. While it is desirable to put discretionary traders in silos to reduce group thinking and correlations among traders, this approach will backfire when applied to AI trading, which requires a team effort to test thousands of strategies in order to pick the best. 

HSBC ready to do live trade finance transactions on blockchain

It’s worth noting, however, that the technology is still a long way from commercial use, for HSBC at least. As well as developing the platform and the solution, a network must be in place so that the full transaction can be completed on the blockchain, which means on-boarding other banks, regulators, customs and all parts of the trade cycle. “We see that developing throughout the year so that in 2019, around the same time, we should be in a position to have both the network of banks, corporates and others, and the app ready to use on a wider scale,” Kroeker said. Meanwhile, the bank is hoping that its adventures in blockchain will leave it well-placed to cater for the “digital natives” in Asean, which is projected to be one of the world’s growth hubs for digital services over the coming years. The press conference was called to discuss the bank’s digital agenda in the region, which is shaping up to be an online battleground in the years to come.

10 Common Mistakes To Avoid In Fintch Software Development

Financial Technology, or FinTech, is a relatively new aspect of the financial industry, which focuses on applying technology to improve financial activities. This has the potential to open the doors to new kinds of applications and services for customers, as well as more competitive financial technology. However, like all new technologies, there are mistakes lurking. In contrast to software domains like end-user web apps or mobile application development, a software bug in FinTech may not just lead to annoyed users. In the wrong piece of software, bugs can result in hundreds of millions of dollars lost. The list below are some of the most common mistakes we see in software projects in general—and FinTech software development in particular—that you should watch out for when launching into the FinTech sector.

The future of IoT device management

One potential vision for the future of consumer IoT – one which might be a lot more appealing to consumers - involves IoT devices whose identity and firmware are managed using a standardized process and entirely independently from the application layer service. When you buy a connected consumer IoT device, you should be able to securely associate that device’s identity with your personal identity and securely manage its software and firmware using a familiar, standardized workflow supported by all device vendors. This means that any consumer IoT device should be easily associated with any consumer IoT gateway that supports its protocols and be able to get to the device vendor’s management service. You then need a way to associate that device with any provider of application layer services that you choose. When you sign up for an application layer service, you should be able to easily allow the application to discover relevant IoT devices associated with this identity and provision them for use.

---

Quote for the day:

"When people talk, listen completely. Most people never listen." -- Ernest Hemingway

---

Daily Tech Digest - March 02, 2018

GitHub hit with the largest DDoS attack ever seen

GitHub explained how such an attack could generate vast amounts of traffic: "Spoofing of IP addresses allows memcached's responses to be targeted against another address, like ones used to serve GitHub.com, and send more data toward the target than needs to be sent by the unspoofed source. The vulnerability via misconfiguration described in the post is somewhat unique amongst that class of attacks because the amplification factor is up to 51,000, meaning that for each byte sent by the attacker, up to 51KB is sent toward the target," it said. GitHub said that, because of the scale of the attack, it decided to move traffic to Akamai, which could help provide additional edge network capacity. It said it is now investigating the use of its monitoring infrastructure to automate enabling DDoS mitigation providers and will continue to measure its response times to incidents like this -- with a goal of reducing mean time to recovery.

Load Testing Tool Must-Haves

One of the most dangerous moves software developers and testers can make is being lulled into a false sense of security. For example, when application features and performance levels meet expectations during pre-production, only to crash and burn when presented to real users in production. In that same vein, if your organization has any kind of performance testing strategy, chances are you're conducting load testing. However, you may not be truly emulating the real world behavior of your end users in your load tests. Realism in load tests, when overlooked, can cause a myriad of performance problems in production, and end users won't wait around. If you're not performing accurate and realistic load testing, you risk revenue loss, brand damage and diminished employee productivity. The solution: cloud-based load testing. Right off the bat, the cloud provides two major advantages to load and performance procedures that help testing teams better model realistic behavior: instant infrastructure and geographic location.

Building AI systems that work is still hard

Domain expertise, feature modeling and hundreds of thousands lines of code now can be beaten with a few hundred lines of scripting (plus a decent amount of data). As mentioned above: That means that proprietary code is no longer a defensible asset when it’s in the path of the mainstream AI train. Significant contributions are very rare. Real breakthroughs or new developments, even a new combination of the basic components, is only possible for a very limited number of researchers. This inner circle is much smaller, as you might think. Why is that? Maybe it’s rooted in its core algorithm: backpropagation. Nearly every neural network is trained by this method. The simplest form of backpropagation can be formulated in first-semester calculus — nothing sophisticated at all. In spite of this simplicity — or maybe for that very reason — in more than 50 years of an interesting and colorful history, only a few people looked behind the curtain and questioned its main architecture.

Another massive DDoS internet blackout could be coming your way

While older, more established companies are still more likely to host their own DNS, the emergence of cloud as infrastructure means that newer companies are outsourcing everything to the cloud, including DNS. "The concentration of DNS services into a small number of hands...exposes single points of failure that weren't present under the more distributed DNS paradigm of yesteryear (one in which enterprises most often hosted their own DNS servers onsite)," John Bowers, one of the report's co-authors, tells CSO. "The Dyn attack offers a perfect illustration of this concentration of risk--a single DDoS attack brought down a significant fraction of the internet by targeting a provider used by dozens of high profile websites and CDNs [content delivery networks]." The shocking part of this report is that despite the clear danger this concentration poses, too few enterprises have bothered to implement any secondary DNS.

Zero-Day Attacks Major Concern in Hybrid Cloud

Despite their growing reliance on containers, many businesses will continue to at least partially rely on legacy systems for years to come, he continues. Security becomes a challenge when multiple users are accessing multiple environments from multiple different locations. The biggest hybrid cloud security challenge is maintaining strong, consistent security across the enterprise data center and multiple cloud environments, says Cahill. Businesses want consistency; they want to be able to centralize policy and security controls across both. Security teams also struggle to maintain the pace of cloud, an increasingly difficult challenge as cloud continues to accelerate. It used to be that cloud adoption was slowed by security, Cahill points out. Now, containers are driven by the app development team. Security has to keep up. "One of the things we know about cloud computing in general, and about DevOps, is it's all about moving fast," he points out.

Can APIs Bridge the Gap between Banks and Fintechs?

Fintech companies are forcing banks to go beyond their comfort zone, innovate and accept change as a way of staying in business. With APIs handling the translation between legacy systems and the new technologies, fintech companies can focus on providing more value to the clients instead of learning about obsolete systems. Adopting a client-centric vision helps both banks and fintech companies fulfill their goals. For example, a bank doesn’t offer its corporate clients the ability to compare their yearly financial results with the industry average, but a fintech company can make it its value proposition and, by cooperating with the bank through an API, to help them learn more about their results. For the bank, it doesn’t make sense to create such a niche service, while the fintech’s algorithm is useless without the proper big data input. International organizations and forums support this collaboration between banks and fintech companies since it brings added value to the client.

Cloud firms need $1bn datacentre investment a quarter to compete with AWS and co

“If companies can’t find at least a billion dollars per quarter for datacentre investments and back that up with an aggressive long-term management focus, then the best they can achieve is a tier-two status or a niche market position,” he said. Dinsdale’s comments coincide with the publication of Synergy’s research into how much capital expenditure (capex) the hyperscale cloud firms pumped into their operations in 2017. Its findings are based on an analysis of the capex and datacentre footprint of the world’s 24 biggest cloud and internet service firms. This reveals that the hyperscale community collectively spent $75bn in capex during 2017, which is 19% up on the previous year. Of that $75bn, $22bn was paid out in the fourth quarter alone. Most of the capex is channeled towards helping the hyperscale cloud firms expand and upgrade their datacentres, with Amazon, Apple, Facebook, Google and Microsoft name-checked by Synergy as being top five biggest spenders, accounting, in aggregate, for more than 70% of capex spend in the fourth quarter.

The Banking Industry Sorely Underestimates The Impact of Digital Disruption

Many organizations associate being a ‘Digital Bank’ with the development and deployment of their mobile banking application. Others look at the digital transformation from a sales or marketing perspective. The reality is that digital transformation goes beyond the way a financial services organization deploys their services across digital devices. Even though by 2025, more than 20 billion devices will be connected, the real power of these connections comes from the insight these connection produce. Use of this data, combined with advanced analytics, can change the level of back office automation, connectivity, decision making and existing business models. “Lacking a clear definition of digital, companies will struggle to connect digital strategy to their business, leaving them adrift in the fast-churning waters of digital adoption and change,” states McKinsey. “What’s happened with the smartphone over the past ten years should haunt everyone - since no industry will be immune.”

AI will create new jobs but skills must shift, say tech giants

“For sure there is some shift in the jobs. There’s lots of jobs which will. Think about flight attendant jobs before there was planes and commercial flights. ... So there are jobs which will be appearing of that type that are related to the AI,” he said. “I think the topic is a super important topic. How jobs and AI is related — I don’t think it’s one company or one country which can solve it alone. It’s all together we could think about this topic,” he added. “But it’s really an opportunity, it’s not a threat.” “From IBM’s perspective we firmly believe that every profession will be impacted by AI. There’s no question. We also believe that there will be more jobs created,” chimed in Bob Lord, IBM’s chief digital officer. “We also believe that there’ll be more jobs created. “I firmly believe that augmenting someone’s intelligence is going to get rid of… the mundane jobs. And allow us to rise up a level. That we haven’t been able to do before and solve some really, really hard problems.”

How to build skills that stay relevant instead of chasing the latest tech trends

Knowledge about core functions of the software would eventually be available from a broad pool of people, driving down wages unless you were willing to participate in the "arms race" of always learning the latest and greatest. What became quickly apparent was that the people who succeeded in this area were those who were the most adaptable and able to sense where the market was going, so they could retool their skillset based on what was hot at any given time. The individual who was a supply chain specialist a couple of years ago might now be an accounts payable expert, based on the demand for a particular skillset. These individuals had developed a core talent—the ability to sense where the market for this software package was going—and combined it with an ability to rapidly learn and apply the new technical elements of that software. While those focused on deepening their skills were seeing the market pass them by, the talent-focused individuals happily abandoned and changed skills in order to stay relevant.

---

Quote for the day:

"Leaders are more powerful role models when they learn than when they teach." -- Rosabeth Moss Kantor

---

Daily Tech Digest - March 01, 2018

How New York City plans to become a smart city leader

We're thinking right now about how we can create a platform or partner with folks to create a platform that offers a truly open access environment to technologists and startups and existing companies who have smart cities projects to make this platform accessible to all of them. And in that platform create the opportunity to exchange data between them to potentially have inter-operation between them. So, what I mean is, can your payment at a parking meter tell the street light that you're there and accomplish some action? Can we have trash cans interact with other pieces of street furniture that is responsive to what is happening around it? I know those are fairly conceptual, but the idea is, can we take our position and facilitate the interaction between the agencies who are focused on, as they should be, accomplishing their independent missions? ... Some other cities are now doing some things similar and there's some conversation about a city operating system that is similar to what I'm thinking about.

Journey to the Cloud: Overcoming Security Risks

As for detective and monitoring security tools, most large IaaS vendors provide virtual networking capability, which the consultancy tapped for packet capture and analysis. PaaS vendors are used differently, but most provided detailed audit logs on user logins and actions which they needed for audit purposes. Some large IaaS vendors also provided additional monitoring alarms to help with pesky things like developers accidently dropping authentication credentials into public code repositories. One major challenge for the consultancy was dealing with different cloud environments. Some cloud vendors who have multiple offerings can have different knobs and gauges for their varying services. The consultancy’s security operations team would learn how to lock down and monitor something in one service area, only to find that things worked much differently in another.

Pizza Hut customers can now pay for meals with Mastercard Qkr mobile app

“Over the past six years we have invested over £60m in transforming our restaurants and menu, and this allows us to continue to improve the service and experience we offer our guests, as well as embracing technology, which has become so central to modern culture.” Betty DeVita, chief commercial officer at Mastercard Digital Payments & Labs, said Qkr would allow Pizza Hut to accommodate more customers without having to rush them. “By removing the headache of managing bills, it will allow their staff to focus more on service,” she added. Merchants can also add delivery and takeaway options for customers through the app, as well as targeted promotions and rewards schemes. Mastercard said organisations have been using its application programming interfaces (APIs) to create specific brand experiences for customers at the table as well.

Staff awareness is the financial industry’s biggest cybersecurity concern

The report urges CISOs to prioritize employee training regardless of their reporting structure, as employees are organizations’ first line of defense and their biggest vulnerability. “Employee training should include awareness about downloading and executing unknown applications on company assets, and in accordance with corporate policies and relevant regulations, and training employees on how to report suspicious emails and attachments,” the report says. Knowing where to begin with employee training can be tough, which is why IT Governance provides an Information Security Staff Awareness E-learning Course. This course can be deployed across your organization to help anyone involved in information security understand how to stay secure. It aims to reduce the likelihood of human error by familiarizing employees with security policies and procedures, covering topics such as password security, creating backups, information security incidents, and business continuity.

How to protect Macs from malware threats

As malware threats increase in number and frequency, the next big attack could be looming just beyond the horizon. Which OS is the safest? I will give you a hint: If you believe it is Apple, that type of thinking might be what leads your Mac to be one of the next victims. Malware attacks against Apple computers have been growing exponentially and, in some cases, more than other attacks. While the threshold for these types of malware attacks has been rather low compared to its competitors, Apple's massive popularity and growing market share have shifted the focus over to its popular line of computing devices in an effort by threat actors to cash in (literally) on this growing target. Even the biggest malware attacks may have small beginnings, and threats targeting Apple devices will continue to proliferate unless users protect their devices by adhering to the following tips in conjunction with best practices for data and network security.

SaaS support challenges IT ops admins to shift gears

SaaS support doesn't introduce new problems for IT -- we've all dealt with browser plug-in support changes, internet connection issues and application upgrades. SaaS changes when these issues occur. Modern IT organizations get things done by adapting quickly, but behind the scenes, they have some notification of upgrades and changes. Testing, staff training and communications are planned out ahead of time, which dramatically lessens the disruption the changes cause to users and management. SaaS-based apps shorten the support lead time. There's also a risk that the SaaS update isn't compatible with an enterprise's setup, and there aren't viable alternatives. Prepare contingencies, and be ready to make adjustments after updates. SaaS support requires skill from IT operations. Things that once were minor systems quirks are now critical. IT staff are in a weaker position to control changes, and the safety nets in testing and preproduction don't work as they did for software hosted and managed in-house.

Is your vendor being honest about AI?

“True AI is about the future. AI says, ‘I don’t know what this is, but we’ve seen something similar so we will flag it.’ Or, ‘We’ve never seen this before, it’s an anomaly, so we will flag it.’ The key difference between rules engines and AI is where they are focused. Rules are IF-THEN decisions based on past data. AI is all about recognizing anomalies simply because they are new. We are interested when the machine says, ‘I don’t know. I haven’t seen this before.’ This is when AI is the most powerful and useful.” Laurent offered, “A key way to tell the difference between AI and rules-based engines, is that a rules-based engine will never improve on its own until someone updates the rules. AI improves its accuracy the more it is used. The more you use it the better it becomes. The adaptability of the model is what makes AI work.” Yuri strongly agreed, "Rules are basically in the past. The machine [AI] can predict the future."

TiDB: Performance-tuning a distributed NewSQL database

TiDB is an open source, hybrid transactional/analytical processing (HTAP) database, designed to support both OLTP and OLAP scenarios. One TiDB cluster has several TiDB servers, several TiKV servers, and a group of Placement Drivers (PDs), usually three or five nodes. The TiDB server is a stateless SQL layer, the TiKV server is the key-value storage layer, and each PD is a manager component with a “god view” that is responsible for storing metadata and doing load balancing. Below is the architecture of a TiDB cluster. You can find more details on each component in the official TiDB documentation. We gather a lot of metrics inside each TiDB component. These are periodically sent to Prometheus, an open source system monitoring solution. You can easily observe the behaviors of these metrics in Grafana, an open source platform for time series analytics. If you deploy the TiDB cluster using Ansible, Prometheus and Grafana will be installed by default.

The future of work: How to thrive through IT’s latest revolution

Kim Smith, venture strategist and chief innovation officer at IBM, likens such employees to the early NASA employees portrayed in the movie Hidden Figures. Back then, “computer” was a job title, not a piece of office equipment, and it was the job held by the movie’s central characters. Then NASA acquired a mainframe capable of replacing a building full of human computers “so they taught themselves Fortran,” Smith says. To be successful in the future, your company must support, encourage and enable lifelong retooling. At IBM, it means giving people access to training and allowing them to rotate in and out of jobs and departments, she explains. “They can be in one role for a period of time, then go to something completely different.” “I think expectations are going to morph,” Burns adds. “Tech professionals need to be more forward thinking. A lot of the ones I’ve seen were order takers, and we have to get away from that world. We have to help disrupt industries rather than letting our organizations be disrupted.”

Top 10 Lessons in Building a Distributed Engineering Team

One poignant question that came up early on was: how do we communicate our core values to people who are not in the office? As it turns out, instilling the company's and teams' principles in remote employees actually is no more difficult than with local ones. We decided to bring people into the office for their first week. Additionally, we get together every quarter with the whole team for working sessions and team building activities. Culture is what you do when nobody's looking; for remote employees, that means a lot of opportunities to exercise the company culture. In our experience, we've found that shared values prevail regardless of physical location. By now you might be wondering whether a distributed workforce is actually practical, and that's a valid question. How can you guarantee a culture that fosters innovation even though employees aren’t in the same room? In the past, companies often claimed that having everyone under the same roof was the only way to innovate. Nowadays, the story has changed.

---

Quote for the day:

"Technology makes it possible for people to gain control over everything, except over technology" -- John Tudor

---