Daily Tech Digest - March 10, 2018

Why You Should View Linux as a Core IT Skill

Twenty-five years ago, some fellow students and I were sitting in a computer lab at the University of Waterloo trying to compile a new open-source UNIX operating system called Linux on a PC. Back then, installing a Linux system was about as difficult as nailing Jell-O to a tree, but we managed to get a system installed after only four days of work. Linux has come a long way since then. Today, Linux is the most diverse and aggressively developed operating system in the world, primarily due to its open-source nature. And if you work in an IT field, you’ve probably been exposed to more Linux in the last few years than before. In fact, the Gartner research company identified Linux as the fastest-growing operating system segment in the computing industry in 2017. So, what does this mean for you as an IT professional? It means that you’ll likely be working with far more Linux systems and technologies in coming years, regardless of whether you currently work with them or not.

Cisco attacks SD-WAN with software from Viptela, Meraki acquisitions

The SD-WAN is typically made of diverse networks and technologies that many times are outside the control of IT. Add to that the increased use of multi-cloud services and other advances, and the traditional complexity of the WAN has been increased, Cisco stated. Cisco cited a recent IDC study that found almost three out of 10 organizations considered network outages to be a top WAN concern, with the same number stating they need better visibility and analytics to manage application and WAN performance. IDC also estimates that worldwide SD-WAN infrastructure and services revenues will hit $8.05 billion by 2021. In order to address some of these challenges, Cisco rolled out SD-WAN vAnalytics, a cloud-based SaaS application that will collect data from the SD-WAN and let customers spot and fix communications problems quicker, gauge application performance, oversee bandwidth planning, and predict how policy changes might impact the network. 

Big data analytics: The cloud-fueled shift now under way

Cloud-based big-data silo convergence is speeding enterprise time-to-value. Users are beginning to step up the pace of consolidation of their siloed big data assets into public clouds. The growing dominance of public cloud providers is collapsing the cross-business silos that have heretofore afflicted enterprises’ private big data architectures. Just as important, big data solutions, both cloud-based and on-premises, are converging into integrated offerings designed to reduce complexity and accelerate time to value. More solution providers are providing standardized APIs for simplifying access, accelerating development, and enabling more comprehensive administration throughout their big data solution stacks. Innovative big data startups are bringing increasingly sophisticated AI-infused applications to market. Innovative application providers are starting to disrupt the big data competitive landscape with AI-based solutions.

Why Startup CEOs Still Have to Make Sales Calls

For all the obvious reasons. (1) People don't really care how much you know until they know how much you care. Showing up shows them that you actually do care. (2) Startups are notoriously scattered and in a hurry. Focus and attention to detail are scarce commodities and the customers want to know that you personally are connected, paying attention, and directly engaged with their business, their concerns and their problems. And finally, (3) they want to hear it from the horse's mouth. Not second hand. They want commitments and assurances from you (since they know that the sales guys will tell them anything and promise them the world) that you will stand up for and stand behind your product or service and make good on whatever they've been promised. The buck always stops with you. None of this is very tough. You just have to say what you're going to do and do what you said you would and everything will be hunky-dory.

What is a virtual CISO? When and how to hire one

Why would you need a vCISO when you could simply hire a real one on a permanent contract? The answer is varied and not necessarily the same for everyone. For starters, well-rated, full-time CISOs can be hard to come by, often stay in their job for two years or less, and critically, especially for smaller businesses, can command six-figure salaries. In contrast, vCISOs are estimated to cost between 30 percent and 40 percent of a full-time CISO and are available on-demand. The benefits go well beyond cost. Virtual CISOs usually require no training, can hit the ground running, and don’t feel obliged to play nice with office politics. In this model, it’s purely about results, and vCISOs worth their salt will provide reasonable KPIs and reporting. While different vCISOs offer different skillsets, many should be able to cover myriad tasks, from the tactical to strategic. They could help pull together security policies, guidelines and standards. That could entail anything from coming to grips with HIPAA or PCI compliance, to staying on top of vendor risk assessment. 

Josh Bersin on the Importance of Talent Management in the Modern Workplace

Bersin reminds us that, even though the top, hot job of the moment may be technical, there are are plenty of non-technical jobs that are growing in demand, too. “Soft skills are just as in demand as hard skills. There will be an increased need for social, integrative, and hybrid skills. Empathy, communication, speaking, judgement… these renaissance skills are the jobs of the future,” said Josh. “Even the job of data scientist now requires persuasion, interpretation, not just looking at data.” Although many worry that technology will render some workers obsolete, this appears to be far from the case. Many of these workers can easily transition into new roles that leverage their skills, and these new roles are good for the workers, too. In fact, 96% of all transitions have “good-fit” options and 65% of transitions will increase wages.

Machine learning: What developers and business analysts need to know

In the case of supervised learning, you train a model to make predictions by passing it examples with known inputs and outputs. Once the model has seen enough examples, it can predict a probable output from similar inputs. ... The results of the prediction can’t be better than the quality of the data used for training. A data scientist will often withhold some of the data from the training and use it to test the accuracy of the predictions. With unsupervised learning, you want an algorithm to find patterns in the data and you don’t have examples to give it. In the case of clustering, the algorithm would categorize the data into groups. For example, if you are running a marketing campaign, a clustering algorithm could find groups of customers that need different marketing messages and discover specialized groups you may not have known about. In the case of association, you want the algorithm to find rules that describe the data.

Software leaders pick these three technologies as top investments

Companies that have been slower to invest in technology solutions have either prioritized changing their business model or have felt the negative, if not fatal, repercussions of not doing so. Regardless of industry, staying ahead of the technological curve in today’s software-centric world is a must for business success. However, it can be difficult for even the most experienced IT leaders to wade through the long list of technology buzzwords and solutions that promise to be the “next best things.” So how can businesses cut through the noise to determine what will actually bring business value? They can start by determining the technologies the experts are actually pursuing. To find out what these tech trends are, O’Reilly analyzed search data from more than two million users on its online learning platform, most of which are trained software and technology leaders. By taking into consideration what these professionals are focusing on, other professionals can begin to determine what their companies should be investing time and money in.

RoboTiCan is building low-cost industrial robots for the masses

Balshai said, "We have moving, navigation, a manipulation of an arm, computer vision. Everything combined in one platform. Basically to be able to master all this knowledge and be able to find the algorithm for making it work is really complex. With ROS, it gives us a lot of opportunity to combine algorithms from one point to another. For example, if something was developed in a Carnegie Mellon University in the United States and we want to use this particular system, image work, or cognition of an object that was developed in Carnegie Mellon, we can extract this information and extract these ideas and implement it in our robot real easily. "By that, we don't need to have a really huge company to be able to do a lot of different tasks with one robot. This is basically the idea and the advantage of using ROS and open source architects for how we use robotics. By doing something that is generic for everybody, you can use it all over the globe. Of course, there is stuff that we extract to others. ..."

Data Mining What Why

Data mining sits at the intersection of statistics (analysis of numerical data) and artificial intelligence / machine learning (Software and systems that perceive and learn like humans based on algorithms) and databases. Translating these into technical skills leads to requiring competency in Python, R, and SQL among others. In my opinion, a successful data miner should also have a business context/knowledge and other so called soft skills (team, business acumen, communication etc.) in addition to the above mentioned technical skills. Why? Remember that data mining is a tool with the sole purpose of achieving a business objective (increase revenues / reduce costs) by accelerating the predictive capabilities. A pure technical skill will not accomplish that objective without some business context. The following article from KDNuggets proves my point that data mining job advertisements mentioned the following terms very frequently: team skills, business acumen, analytics among others.

---

Quote for the day:

"Vulnerability is the birthplace of innovation, creativity and change." -- Brené Brown

---

Daily Tech Digest - March 09, 2018

Autonomous Cars: The Road to 2030

Although many elements of self-driving cars seem beneficial for the environment, there are likely downsides as well. When given the option, people generally prefer taxis to buses, but taxis release far more carbon monoxide. If taxis are less expensive since there’s no driver to pay, more people are likely to hail them instead of waiting for a bus or train. Similarly, commuters often prefer to live near their places of work to avoid lengthy commute times. If drivers can work, watch video, or even sleep while en route, the lower cost of more distant suburbs may increase average commute times and lead to wasted energy. When going on a long trip, drivers might choose to take their vehicle instead of more efficient mass transportation options. Self-driving cars will open up a range of conveniences, but there’s no guarantee they’ll ultimately be better for the environment unless we can find an economical solution. Even if cars in 2030 are more efficient, increased use might offset these advantages.

Machine Learning Is Our Best Weapon Against Spiraling Cyberthreats

As promising as machine learning is when it comes to addressing our security needs, we should assume that attackers have access to the same technology. That’s where collaboration can be our secret weapon. Organizations have historically been reluctant to share details about vulnerabilities, intrusions and responses, but the magnitude of today’s threats require us to put aside competitive concerns for the greater good. Fortunately, numerous collaborative efforts are under way. One success story is the sector-based Information Sharing and Analysis Centers (ISACs), of which there are currently 24 representing major vertical industries. The Institute of Electrical and Electronics Engineers (IEEE)’s Industry Connection Security Group (ICSG) addresses issues that are common to all industries, such as malware and encrypted traffic inspection. There are also regional groups, like the Columbus Collaboratory, which is one of about 30 Information Sharing and Analysis Organizations established with the support of the U.S. Department of Homeland Security (DHS).

How banks can make sense of digital disruption

Amid the financial technology (fintech) gold rush, Narayanaswamy observed that some fintech startups do not fully grasp the seriousness of the banking business. “We can bring down economies and start wars, but unfortunately the people I meet daily don’t seem to understand what banking is,” he said. “When I ask them what happens when something goes wrong, they say they will just release the next patch, but by then millions of dollars would have been transferred,” he added. With more software-driven innovation, Narayanaswamy also believes the software industry will be regulated in time to come. “If you say everything is software, how can it not be regulated? There’s always a downside to everything, and when the downside happens at scale, regulators will step in,” he said. To stay ahead, Narayanaswamy called for banks to go back to basics and make sense of what they are doing – which often includes a hodgepodge of initiatives and technologies recommended by consultants and analysts.

Why Digital is the Key Driver of Disruptive Restaurant Services?

With loads of information being uploaded on the digital portals on a daily basis, online is the new screen from where awareness is generated and delivered to the masses on a daily basis. Talking about the food world, in particular, issues like organic farming, food wastage problem and global warming have gained limelight of most amongst the online community. But it’s not the problem tellers but the problem solvers who will lead ahead in the ever competitive scenes. Considering the present scenes, food companies addressing these problems with innovative solutions might just have the advantage of gaining growth by tapping on the ethical points in the society, but in future situations ignoring these issues wouldn’t be easy as they will soon convert into mainstream demands of the industry. The much enhanced and innovative mobile phone technologies like that of iBeacons have added a new dimension to the overall dining experience.

Stop Blaming AI: Humans Don't Need Robots To Destroy Themselves

The robot obviously won’t be able to erase these security rules. We can then argue that the robot can still ignore these rules and act as it sees fit. If this happens, let us then also predict in this non-erasable memory, a rule that would say: « If the robot does not follow the non-aggression rules, then let’s return these non-aggression rules to the robot indefinitely! ». And then this will have the effect of paralyzing and blocking the action of our little too crafty robot-machine, just by a simple « Overfow » loop! So, finally, we can imagine that our smart robot, having understood this, simply decides to get rid of the chip containing the rules that annoys him. For example by disassembling itself the chip or by turning it off. To avoid this, we can also imagine that this chip, attacked by the robot, triggers an internal mini-bomb that will neutralize this AI from the inside (and obviously, if our friendly robot decides to turn off this bomb, so, of course, our future Terminator implodes too!

Ruby Finally Gains In Popularity

Ruby historically benefitted from its ties to the Ruby on Rails framework, which made it easy to build webpages, software quality services vendor Tiobe said. But “hipsters” later began moving to other languages after Ruby peaked in 2008. Its gradual resurgence in popularity is a good sign, the company said. But the publisher of the index, Tiobe Managing Director Paul Jansen, sees Ruby simply getting mature as opposed to making a comeback. This maturity makes it a stable Top 10 language. Also in this month’s index, Kotlin and Julia both entered the top 40. Kotlin, which has benefitted from Google’s endorsement of it for Android mobile application development, came in 38th place with a rating of 0.278 percent. Julia, in 37th place, rated at 0.301 percent, is used in scientific computing and burgeoning field of machine learning. Rust and Groovy, meanwhile, fell out of the index’s Top 50 spots.

Gamification, Encouragement Vital To Boosting Worker Engagement

It's important that employees not feel demoralized when it comes to their security posture and preparedness, Street said. "You're dealing with people, not servers," Street said. "Servers don't get their feelings hurt when they're compromised." One simple thing Street recommended is having the IT department go through the offices and look under the keyboards of every employee. The security team is likely to find that a number of workers have left a sheet of paper in that location with all of their passwords written down, which Street said presents a good, real-world opportunity for user education. Solution providers also need to make the security training engaging for customers, Street said. A multiple-choice online quiz that's administered yearly isn't going to capture employees' attention or truly make them security-conscious, according to Street.  "Make it something interesting for them, which will then make it interesting for you," Street said. "That's how you battle the battle fatigue."

How admins can manage mobile devices with G Suite

Advanced mobile management options remain available. These give a G Suite administrator more control of specific mobile security settings. For example, advanced mobile management allows a G Suite admin to remotely wipe an entire device (everything, not just the organization's data), manage app installs, and set a specific lock screen, password, or pin policies. (See Google's chart that compares basic and advanced mobile management features) But for more control, a G Suite admin needs to do more work. They'll need to install the Google Device Policy app on each device and configure a connection between G Suite and Apple's Device management services. And they'll need to review and configure several screens full of advanced mobile management security settings for Android and iOS. Organizations that provide company-owned phones to employees will likely prefer advanced mobile management. Organizations that require rigorous security may also prefer the additional controls, too.

Passwords Are Scarily Insecure. Here Are a Few Safer Alternatives.

The main problem with passwords is twofold: For starters, passwords just aren’t that secure. Every company in the world uses them to authenticate users to confirm they are who they say they are, but a recent Verizon study showed that a majority of hacks leverage weak or guessable passwords. Additionally, passwords are susceptible to being stolen or extracted by hackers using various methods, like impersonating someone you know or trust to gain login information or personal details. Careless practices such as exposing hard or digital copies of passwords are also a major contributor to their becoming compromised. Think about that the next time you write down your work account password on a piece of paper and stick it in a desk drawer at the office.  There are numerous examples that demonstrate the vulnerabilities of passwords to theft. In 2017, online image sharing community Imgur made headlines when it had troves of user passwords stolen from the company database because of weak security protocols.

Data Privacy: What Your Employees Don't Know But Should

What do employees in your organization understand about security, data privacy, and compliance? According to a recent report from Bothell, Wash.-based MediaPro, perhaps not as much as they should. With data privacy fast becoming a hot-button issue, and the European Union's General Data Protection Regulation (GDPR) right around the corner, what your employees don’t know about handling data at your company could burn you. The news isn’t all bad. In general, U.S.-based employees are proficient at identifying sensitive and private documents, and understand whether such data should be destroyed or securely stored. But they struggle with privacy regulations (particularly the GDPR and the EU-U.S. Privacy Shield), as well as handling sensitive data in their personal and professional lives. In October of last year, MediaPro, a specialist in security awareness, privacy awareness and compliance training, surveyed 1,007 U.S. residents about data privacy best practices and regulations.

---

Quote for the day:

"There is nothing more dangerous than the moment you become a hostage to yesterday's comfort zone." -- Rob Thompson

---

Daily Tech Digest - March 08, 2018

How to avoid the organizational flu

Unfortunately, as long as humans operate in close proximity we’re going to infect one another. That’s where the term “communicable disease” comes from, and communicability can be as dangerous to an organization as it is to an organism.One way to understand health is as an incessant war against things that are trying to kill us. Our bodies come into contact with a wide variety of germs every day which proliferate and attack until stopped. When a vigorous immune system successfully defends the body from marauding invaders, the resulting stasis is defined as health. But it’s a never-ending battle. My firm’s research discovered four common “germs” that continually lurk within organizations -- destructive internal dynamics that can easily cause a business to be bedridden. They are management misalignment, loss of focus, lack of nerve and strategic inconsistency. As with real germs, they’re ever-present at some level, even within thriving companies. The primary task is to keep them contained. 

Microsoft fights massive cryptocoin miner malware outbreak

Microsoft said that the Dofoil trojan performs a fancy trick called 'process hollowing' on the legitimate explorer.exe binary. The technique creates a new instance of the legitimate binary but swaps out its code with malware. "The hollowed explorer.exe process then spins up a second malicious instance, which drops and runs a coin-mining malware masquerading as a legitimate Windows binary, wuauclt.exe," said Mark Simos, a cybersecurity architect at Microsoft. Kaspersky researchers observed sophisticated attackers using the process-hollowing technique to deliver miners that earned them millions of dollars in the second half of 2017. Process hollowing is useful because antivirus often mistakes it for harmless software. Kaspersky said victims are typically infected after downloading legit-looking software. To maintain a position on an infected PC, Dofoil tweaks the Windows registry after process-hollowing explorer.exe.

Here are the 10 most in-demand AI skills and how to develop them

It's no secret that artificial intelligence (AI) is an emerging technological trend, with talent in the field in high demand as companies look for a competitive edge. AI is expected to create 2.3 million jobs by 2020, replacing the 1.8 millions it will eliminate, according to a Gartner report. That job growth has already hit the field itself: Employer demand for AI positions and skills has more than doubled over the past three years, according to job search site Indeed. Titles like machine learning engineer, computer vision engineer, and data scientist are among the most in-demand AI jobs, as companies search for candidates to help bring AI to their workplace or external efforts. Knowing which skills are most sought after can help tech professionals pinpoint what they need to work on to break into the field. Indeed looked at job postings from 2017 for AI-related job titles to determine the most common skills hiring managers are requesting from candidates.

The role of container management software in IT ops

Ultimately, having a consistent management experience across all the potential container deployment platforms will be essential for management, said Edwin Yuen, an analyst at Enterprise Strategy Group. "Businesses should consider how other additional features and services integrate with their management tools, including the emerging areas of container-specific security and backup/recovery solutions," Yuen said. "The ecosystem for container management is building, and how those tools work together will be key to determining how easy or difficult management will be as containers continue to become more mainstream." But perhaps it is even simpler. "In the end, the two biggest things to consider are price and support," said Mike LaFleur, global head of solution architecture at Provenir, a software vendor in risk management. "In terms of price, an organization has to measure the return on investment that the container management system will provide, meaning how big must the efficiency and scalability gains be in order to cost-justify the expense," LaFleur said.

70% of Leaders are Scared to Talk With Their Employees.

It's one thing to feel uncomfortable giving bad news or constructive feedback, but this survey indicates a general unease among managers when it comes to communicating with the people on their team. That not only makes feedback difficult, but all conversations become less productive. So, how does love solve this? Because to love someone, you have to know them. And if you know them -- really know them -- then it becomes easier to have conversations, even conversations that are difficult. Now, I don't expect you to love your employees in the same way that I love my wife. After all, she's my wife! But there's no reason you can't get to know your employees in much the same way as you get to know the people you love in your personal life. In fact, there's every reason that you should. But here's the ironic twist: To make hard conversations easier and less uncomfortable, you have to do some hard work that will make you uncomfortable. The results, however, are worth it.

UK Government sets cyber security guidelines for millions of IoT devices

“Today’s call by the government is welcomed, but they must set the standards for developing security practices for IoT devices,” explained David Emm, principal security researcher at Kaspersky Lab. We’ve all come to expect that everyday objects – from children’s toys to furniture – come with certification marks indicating that they are physically safe, but developers of smart devices do little to secure them, rarely release firmware updates, and don’t explain to users that they should change their passwords. Software should be updated automatically with clear guidance for customers.” Moving forward ,Julian David, CEO of TechUK said that this project represents the start of a security revolution when it comes to IoT devices. “Industry has been keen to engage in the review and demonstrate what is best practice. It is important that companies throughout the supply chain now adopt and build on this Code of Practice to build the trust required to drive widespread take-up of the IoT.”

Connected Cars Pose New Security Challenges

It's too early to tell how vehicle connectivity may impact an enterprise and it may seem absurd to think about a car as an enterprise network endpoint, but some luxury vehicle brands already have office productivity tools in-dash. Using the car as a workstation will only increase in popularity as autonomous driving replaces manual driving. In addition to the in-dash email, cars are also providing Wi-Fi hotspots and interfaces like Apple iOS CarPlay and Google Android Auto, which make our cars look and act more like our phones, raising the same kinds of concerns that are present with mobile devices in personal life and for the enterprise. Autonomous driving isn't limited to making knowledge workers' windshield time more productive. Logistics companies, for example, will benefit tremendously from autonomous vehicles, but imagine an attacker compromising and shutting down those vehicles: the results would be disastrous not only to the logistics company but to all of the businesses that rely on them as a vendor.

AI is Changing the Way We Use VR in the Workplace

In what may be the oddest example of VR, The New York Times recently created a VR newspaper. That’s right, you can use buttons to flip the pages of a virtual newspaper using VR, rather than buying a physical newspaper and flipping those pages with your fingers. Whether this is to reduce paper waste or just get the newspaper to more people, they did it, and one may wonder how the digital world will ultimately affect paper media in the future. It may be hard to imagine other magazines and newspapers moving to this format, but one never knows. With the conjunctions of AI and VR we’ve seen thus far however, imagine if machine learning could start to predict design trends in something like a VR newspaper? Or a magazine? It seems completely possible that machine learning could predict market trends in print design through these VR publications, especially once their algorithms start to keep track of sales in addition to commonly used visual trends over time. This will take a while to see however.

4 Priceless Tactics to Create Top-Tier Homegrown Talent

We’re at a fascinating time in history. Since the turn of the millennium, there have been countless technological breakthroughs that have changed the business world as we know it. Even more, the generation raised over this time (trying not to use the “M” word) is beginning to form the majority of the workforce. One of the major consequences of these changes is that the value of company culture is at an all-time high. As the cost of employee turnover certainly isn’t getting any less, business owners need to take the oft-neglected practice of developing in-house talent VERY seriously. While this process can definitely be cumbersome, it must be viewed as a long term investment in the most crucial resource for any organization: people. For business owners, the workplace isn’t just an entity that benefits the bottom line. If you want people to stick around for the long haul, there needs to be a focus on making your company a breeding group for exceptional talent.

Cybersecurity and Brexit: What does it mean for the fight against hackers?

"International operations are pretty much standard now for dealing with especially high level and more dangerous types of cybercrime," Edmunds said. That international perspective isn't limited to the borders of the European Union - Europol will regularly work with the FBI and other law enforcement bodies around the globe in order to fight a worldwide threat. "Irrespective of what happens during Brexit, the international nature of the attacks and where the attackers come from is going to be really prominent going forward," said Edmunds. But there's one area where some are already worried that Brexit will have a negative impact -- hiring new tech professionals, which is especially worrying for cyber security as many organisations already find it difficult to fill information security roles. Some have concerns that a Brexit deal which heavily restricts freedom of movement could have repercussions for UK firms when it comes to hiring talent.

---

Quote for the day:

"You are cruising along, and then technology changes. You have to adapt." -- Marc Andreessen

---

Daily Tech Digest - March 06, 2018

Introduction to Learning to Rank (LTR) search analysis

A classification technique called Learning to Rank (LTR) is used to perfect search results based on things like actual usage patterns. LTR isn’t an algorithm unto itself. The actual ranking is often done with an algorithm called support vector machine (SVM), but recently gradient-boosting trees (GBTs) have been used instead. There are multiple implementations of Learning to Rank available. The most famous open source implementations are XGBoost, RankLib, and part of Apache Solr, which was donated by Bloomberg. ... Learning to Rank has been part of search efforts for a couple of decades. It is used generally to fix results based on user preferences or implicit behavior (read: clicks). Because LTR is based on a machine learning classification model, it is a supervised learning method. This means that you train a model based on some preprocessed data. This data with hand-labeled ranks is then used to optimize future results

Nearly half of CIOs now plan to deploy artificial intelligence

"Don’t fall into the trap of primarily seeking hard outcomes, such as direct financial gains, with AI projects," Andrews said. "In general, it’s best to start AI projects with a small scope and aim for 'soft' outcomes, such as process improvements, customer satisfaction or financial benchmarking." Expect AI projects to produce, at best, lessons that will help with subsequent, larger experiments, pilots and implementations. In some organizations, a financial target will be a requirement to start the project. "In this situation, set the target as low as possible," Andrews said. "Think of targets in the thousands or tens of thousands of dollars, understand what you’re trying to accomplish on a small scale, and only then pursue more-dramatic benefits." Big technological advances are often historically associated with a reduction in staff head count.

Millennials are bigger victims of fraud than senior citizens, FTC finds

The FTC report is the latest study to challenge the conventional wisdom that older adults are the ones falling prey to fraud. As previously reported by TechRepublic, younger adults are more likely to lose money to a tech support scam, and self-reported tech-savvy people are more likely to become the victim of phishing and identity theft. All these studies point to an incorrect perception about tech users that needs to change for the sake of personal and organizational security: Young adults aren't safer by default. There is, of course, a caveat to the FTC's report: It's a collection of complaints the organization received, so it can't necessarily be treated as an absolute representation of who is paying out to scammers. That said, the numbers do line up with a report from Microsoft mentioned by our sister site ZDNetin late 2016: Half of adults between the ages of 18 and 34 fell for online tech support scams, while only 17% of those over 55 did.

Enterprise IoT: Business uses for RFID technology

Internet of Things (IoT) has made a big buzzword over the past few years as organizations have added intelligent controls to refrigerators, soda machines, washer and dryers, medical robots and lightbulbs. While the consumerization of IoT is in our everyday life, enterprises have been looking for ways IoT can benefit them and their users to improve day to day tasks. One of the big enablers of IoT in enterprises has been the simple addition of RFID tags for day-to-day operational functions. Some RFID tags that have batteries, active transmitters and built-in electronics to capture and relay information run $15-$50 apiece. On the other hand, passive RFID tags are extremely inexpensive running 5 to 10 cents each. Passive tags have no active electronics, they merely have an identification code similar to a barcode, but unlike barcodes that require line-of-sight readers to scan them, passive RFID tags can activate and respond several feet away with no need for line-of-sight access.

Windows Defender can now spot FinFisher government spyware

Microsoft says it has cracked open the notorious FinFisher government spyware to design new ways to detect it and protect Windows and Office users. FinFisher is sold to law-enforcement agencies around the world and its maker, European firm Gamma Group, has been criticized for selling it to repressive regimes. Last year, researchers at FireEye discovered FinFisher being distributed in Word documents loaded with an attack for an Office zero-day targeting Russian-speaking victims. In some countries ISPs have also assisted FinFisher rollouts by redirecting targets to an attack site when they attempt to install popular apps. Malware researchers at ESET have found it difficult to analyze recent versions of FinFisher due to techniques it uses to prevent sandboxing, debugging, and emulation. Microsoft's threat researchers say FinFisher's level of anti-analysis protection puts it in a "different category of malware" and reveals the lengths its makers went to ensuring it remains hidden and hard to analyze.

SEC's new cybersecurity guidance falls short

By comparison, other cybersecurity regulations have significant enforcement power behind them. Breach notification laws, for example, are in place in 48 states, Washington, DC, and Puerto Rico, according to the law firm Perkins Coie. A year ago, New York began requiring comprehensive cybersecurity assessments from financial services companies in the state. This May, the European Union's General Data Protection Regulation (GDPR) goes into effect with fines of up to 20 million euros or 4 percent of annual global revenues, whichever is higher. This new SEC guidance doesn't compare to that, says Badway. "Not even close." As a result, he says, he doesn't see corporations rushing out to improve their cybersecurity processes in response to the new SEC guidance. They might be more motivated to improve by shareholder lawsuits, he adds, but the new guidance isn't likely to provide more fuel for the plaintiffs. "The criteria are the same," he says. "I don't think anything has changed."

Smart homes pose a cyber threat to their owners and tenants

Cyber criminals can use a smart home system as an entry point for remote attacks. David Emm, principal security researcher at Kaspersky Lab, said: “The fact that smart home hub meters are open to attack from cybercriminals is very concerning due to the wealth of people using these devices on a day-to-day basis.” Kaspersky Lab has discovered vulnerabilities that could affect smart homes. Criminal hackers could gain access to a smart product’s server, steal personal data, and use it to access accounts and take control of systems within a person’s home. Researchers testing a smart device found that it sent user data, including smart hub login credentials, to a corresponding server. Other personal information, such as the user’s phone number for text alerts, may have also been included and sent. Malicious actors have found a way to send seemingly legitimate requests to servers to download information, including the device’s serial number. If the serial number is not included, cyber criminals can use basic methods to obtain it.

6 Questions to Ask Your Cloud Provider Right Now

The cloud is fairly new territory for many organizations and, consequently, it’s an area where mistakes are made stemming from confusion around the role cloud service providers play in security, and how companies should work with them. "Organizations looking to host their data in cloud service providers have the best intentions in mind, and the clients I speak with are looking at security as being a key motivator," says Mark Judd, research analyst at Gartner's Research Analyst Lab. But, Judd says, many businesses are in the mindset of thinking that because major players like Amazon and Microsoft have not been directly compromised, any data they put in those companies' cloud environments will automatically be secure. The problem is, security works both ways. "They neglect to realize that moving into a cloud does not automatically make their data secure, but requires an understanding of the shared responsibility in regards to security controls between the organization and the cloud provider," Judd explains.

Cryptocurrency mining malware now as lucrative as ransomware for hackers

One of the reasons the cryptocurrency mining operation has proved to be so lucrative for one of the most successful groups observed is because the malware is deployed using techniques more usually associated with sophisticated and state-backed hackers. In this instance, the cryptocurrency mining malware is being distributed with the aid of process-hollowing - a technique which lets the malware unmap the legitimate code of processes and overwrite them with malicious code. Victims of this campaign are lured into downloading legitimate-looking software which has instructions to download the miner hidden inside. As the process initially looks like a legitimate form of software, it isn't detected by anti-virus products. Once the dropper software has been installed, a Windows installer 'msiexec' is run, and it downloads and executes malicious modules from a remote server which carry out the process-hollowing, allowing the attackers to alter the code with the instructions to carryout mining for cryptocurrency.

Data-Driven Thinking for Continuous Improvement

It’s a culture where there is no "status quo" or "because that is how we do things here." People are encouraged to find better ways of doing their jobs. We allow trials of new approaches. If they work well, we adopt them. We not only give people ownership over their work but also over the organization and its processes. One example of this is our Journey Team structure. We knew that our existing team model wasn’t working well for the individuals on the teams, but they never got "permission" to fix it. After moving towards our new culture, an ad-hoc group of product and engineering team members came together to design a new team structure. Journey Teams are now our organizational model. ... It was an extended effort that involved creating a solid foundation of multiple elements. First, we created a framework to bring clarity to the company strategy and priorities. For people to make good suggestions, they need to understand the company’s business context.

---

Quote for the day:

"He uses statistics as a drunken man uses lamp posts... for support rather than for illumination." -- Andrew Lang

---

Daily Tech Digest - March 05, 2018

Israel Developing Cutting Edge AI Crime-Fighting Tools

Alsheikh said that the police’s Cyber Unit, which was created to lead the national effort to combat cybercrime, would collaborate with the university’s cybersecurity experts to improve police enforcement and prevention capabilities. “The cooperation will enable the police to bring technology to bear more effectively in enforcing the law and fighting crime – whether cybercriminals or traditional criminals – by turning a threat into an opportunity,” Alsheikh said. Ben-Gurion has in recent years become a recognized international leader in cybersecurity and big data research with a national initiative to promote Beersheba as the “Cyber Capital of Israel.” The Center joins Cyber@BGU (CBG), a shared research platform for the most innovative and technologically challenging cyber-related projects run in collaboration with multi-national companies and government organizations. Among others, the CBG includes the Cyber Security Research Center, a joint initiative with the Israel National Cyber Bureau and Telekom Innovation Laboratories, in partnership with Deutsche Telekom.

A Secure Development Approach Pays Off

There's often a belief that security slows down the development process, which ultimately affects time to delivery. But by avoiding security until the end of the process, there's a huge risk that vulnerable products will be released. Clearly, neither option is ideal. This is where automation comes in. Ideally, you need transparent integration and full automation of the security solution at all stages of the development process. As opposed to conducting the process manually, automating the process will provide findings and feedback continuously with every alteration in the code analyzed without the need for human intervention. The code can then either be returned to developers or virtually fixed, and a patch issued for the source code — all automatically. Automation solves a number of the old problems associated with traditional SSDLC processes — it means security is a core element throughout and doesn't slow down DevOps.

How Modern Infrastructure And Machine Intelligence Will Disrupt The Industry

Cloud computing has fundamentally changed the IT infrastructure landscape. The attributes like self-service, pay-by-use, elasticity and automation added a new dimension to infrastructure management. Modern infrastructure is not the same as cloud computing. It is predominantly driven by emerging use cases, and business problems that cloud alone cannot adequately address. The rise of containers, container orchestration, microservices, cloud-native architectures, container-defined-storage and container-defined-networking lead us to the next phase of infrastructure. Next-generation infrastructure will be built on the firm foundation laid by containers. Like the way VMs abstract the underlying physical hardware, containers will make virtual machines irrelevant. Container images will become the de facto mechanism for packaging, distributing and deploying software. With containers becoming the new VMs, Infrastructure as a Service (IaaS) will gradually transform into Container as a Service (CaaS).

Understanding the difference between machine learning and predictive analytics

A simple machine learning algorithm that uses the data of employee satisfaction ratings between 1 and 100 against their salaries as training data is a perfect business application even though most other real life applications are a lot more complex involving trillions of dimensions. Instead of simply plotting a predictive satisfaction curve against salary figures for the various employees as predictive analytics will suggest, the machine learning algorithm automatically assimilates huge random training data upon entry, and the prediction results are affected by any added training data. All this aims at moving towards more real-time accuracy and more helpful predictions. This machine learning algorithm like all others apply self-learning and automated recalibration in response to pattern changes in the training data making machine learning a lot more reliable for real time predictions than other artificial intelligence concepts. Repeatedly increasing or updating the bulk of training data guarantees better predictions.

Fintech and RegTech win over compliance skeptics

The challenges for firms range from the need to have the appropriate skill sets at all levels of the business, to the capability to be able to evaluate possible RegTech, fintech or InsurTech solutions. Give your organization the tools to manage heightened global regulatory pressure with Conflicts Compliance All of which is set against a background of a near universal need to revamp legacy systems, while also implementing and embedding massive regulatory rulebook changes. Against this backdrop, Thomson Reuters Regulatory Intelligence undertook it’s second global survey to assess the impact of developments in RegTech and fintech on the role and remit of the compliance function in financial services firms. ... The biggest financial technology challenge for firms in the coming year is the need to upgrade legacy systems along with cyber resilience and technology risks. On the benefit side, the deployment of fintech is expected to lead to improvements in efficiency and productivityproviding greater commercial opportunities.

IoT: Sensor-as-a-service, run by blockchain, is coming

In the case of Nokia’s sensor-as-a-service offering, which it alternately calls IoT for Smart Cities, the company says parking, trash management, environmental sensing, smarter lighting, and security (e.g., video surveillance) are primary commodities that MNOs can offer municipalities. They use existing base station sites, also known as towers. Enterprises may also want access to that kind of data, Nokia says. That could include weather forecasting operations, healthcare and insurance. Smart cars and drones will also require better municipal data, the company says. There’s minimal capital expense, and the blockchain “anonymized, private and secure micro-transactions” pays the MNO from the city coffers. Nokia, not the MNO, performs all of the edge gateway and sensor installation. Data is stored on Microsoft Azure, Amazon Web Services (AWS), or a private cloud. The Nokia AVA platform or a choice of Amazon IoT or Microsoft IoT performs the data transfer. 

Get ready for an explosion of smartphone innovation

Innovation these days seems to be all about thinner bezels, or face authentication. Which is impressive from a technology standpoint. But these aren’t features that fundamentally change how we interact with our devices. New cameras give us incredibly advanced technology, and pictures that are slightly better than previous models. While that’s true with the Apples and Samsungs of the world, it’s not true with some of the smaller, more interesting players. In recent days, a smattering of truly innovative, mostly enterprise-focused and business-friendly phones have emerged that enable us to do amazing new things. ... The Light Phone 2 is a 4G LTE phone with an e-ink display. It’s designed to function as a second phone for times when you want to leave your full smartphone behind. This is a great phone for on-site security, enabling the user to make and receive voice calls, send and receive SMS text messages and do other basic functions. You can’t use the Light Phone 2 to take pictures, use social media, register location or do anything else that might compromise company secrets.

Getting an ROI for Your IoT Cybersecurity Investment

A certain amount of spending on, say, helping employees better understand the risk IoT cybersecurity poses to their organization might be helpful, additional spending might not be. “People will tell you: ‘User education is a good thing. It makes people more aware. It seems like a place to spend money.’ “And what ends up happening with education spending is that, to a certain degree, it works,” Ramzan said. But ultimately, spending on cybersecurity education will fail in neutralizing cyber threats or preventing end users from making security errors.Normally, we tend to think about security in terms of big buckets of things such as prevention, education, detection and response The same principle applies to threat prevention. An organization could spend vast amounts of money trying to prevent attacks with the theory that would keep them safe. “But in practice, there is a lot of stuff you still won’t be able to prevent no matter how much money you spend,” Ramzan said. “At this point, it is better to do things like invest in detection and response.”

Sophisticated RedDrop Malware Targets Android Phones

“RedDrop is one of the most sophisticated pieces of Android malware that we have seen in broad distribution,” said Wandera in an overview of its research published Wednesday. “Not only does the attacker utilize a wide range of functioning malicious applications to entice the victim, they’ve also perfected every tiny detail to ensure their actions are difficult to trace.” Wandera told Threatpost it’s unsure how many Android devices may be infected with the malware. “One thing we have noticed is that the pace of attempted infections appears to be accelerating,” Wandera said. Since the company initially identified the malware, the company has blocked roughly 20 further requests by infected apps to reach the criminal’s distribution network – where additional malware would be downloaded from. The apps are being promoted via ads displayed on the popular Chinese search engine Baidu. Researchers said those who click on the ads are “taken to huxiawang[.]cn, the primary distribution site for the attack.

Millions of Office 365 Accounts Hit with Password Stealers

Tens of millions of people have been affected by these phishing emails, Shi says, and attackers evade detection by crafting different emails. "What they do is they rotate the content of the email; they rotate sender information," he continues. Signature-based systems won't catch these messages because changing the characteristics of malicious emails changes their fingerprint. Password theft is increasing overall, a sign of attackers shifting their goals and strategies, Shi explains. Ransomware was big last year; this year, password stealers are appearing in phishing emails, browser extensions, and other programs as criminals hunt login data. It's all part of a broader trend of sneaky spearphishing and targeted attacks, he says. Usernames and passwords grant access to multiple systems and applications a particular user is attached to, as well as social media sites and contact lists to fuel future attacks. "Some attackers try to be like a sleeper cell on your system," Shi notes. 

---

Quote for the day:

"The good you do today may be forgotten tomorrow. Do good anyway." -- Kent Keith

---

Daily Tech Digest - March 04, 2018

To Find IT Talent, Think Differently – and Move Quickly

With so much rapid change in technology, workers at all levels will need to expect dynamic shifts in their career development, including changing jobs every five or six years, Hatfield said. "Workers need to be geared to lifelong learning where they maneuver and re-invent," he said. That need implies that workers (and even HR and training departments) "develop a capacity for long-term learning and a passion for it, which is more important than any [one] skill set." Companies also need to focus more carefully on the actual technology they will need — everything from databases to IoT microcontrollers, Finke said. A CTO must help figure out who the lieutenants will be to oversee such technology, then determine where the company will invest and which back-end infrastructure and other technology are needed. More broadly, companies need leaders at the highest levels – not only CIOs – who understand business trends and the context and implications of potential technology disruption.

Microsoft Directly Challenges MongoDB and Cassandra with Cosmos DB

Given that all of the third-party databases listed above are free/open source, Microsoft has to offer something more than just hosting. Otherwise customers will switch back as soon as someone else offers a compatible cloud solution with better performance and/or lower prices. This is where Microsoft's other Azure products come into play. Cosmos DB can be integrated with open source products such as Apache Spark or Apache Kafka as well as proprietary products such as Azure Search, Azure Data Factory, and HDInsight. Rather than extending the file format, Microsoft is attempting to extend what you can do with the database. While switching from MongoDB's cloud hosting to Cosmos DB is mostly a QA and operations question, the use of other Azure products can put significant limitations on your future architectural options. 

 What is natural language processing? The business benefits of NLP explained

In addition to helping companies process data, sentiment analysis also helps us understand society. Periscopic, for example, has paired NLP with visual recognition to create the Trump-Emoticoaster, a data engine that processes language and facial expressions in order to monitor President Donald Trump’s emotional state. Similar tech could also prevent school shootings: At Columbia University, researchers have processed 2 million Tweets posted by 9,000 at-risk youth, looking for the answer to one question: How does language change as a teen comes closer and closer to getting violent? “Problematic content can evolve over time,” says program director Dr. Desmond Patton. As at-risk youth grow closer to the brink, they reach out for help, using language. Natural language processing then flags problematic emotional states so that social workers can intervene. Like Periscopic, Columbia pairs sentiment analysis with image recognition to improve accuracy.

Anthem CIO: How agile helped us drive value

One of the ways we are getting past this issue is by bringing in a set of executives and hosting a Shark Tank day. Various innovation project leaders pitch their ideas to the executives – who are the large budget holders in the company – so that they can roll their product out into the business. It’s been amazingly successful because it has required both our corporate functions and our field business units to partner together in innovation. It’s been a great way to prioritize the most important ideas and get everybody excited about participating in them, and it gets people involved and engaged. We also publish everything we’re working on to an innovation microsite that everyone has access to. The entire workforce sees what we’re working on in the Studio via video demos. Additionally, we invite everyone in the company to participate in ideating around a certain topic using collaboration tools. It’s another way we are doing more to engage the entire workforce, which helps ensure innovation isn’t getting stuck in the studio.

How to decide if open source or proprietary software solutions are best for your business

Initial skepticism regarding free software and questions about the business model ("Why would programmers work for free?") have led to steadfast enterprise adoption of open source software, with an array of options such as "completely free," "free to a certain number of users/functions" and "free but with paid support licenses." As someone who has administered hundreds of Linux servers (which run Red Hat via paid support subscriptions, although it's worth pointing out that CentOS is a totally free alternative with largely the same code base) I can attest to the benefits that open source has provided both to organizations and the technology realm in general. Without it the internet would be a far different place; much more limited, expensive, less robust, less feature-driven and less scalable. Big name companies would be much less powerful and successful as well in the absence of open source software. There's something to be said for proprietary software as well, however; it also has a rich history of providing many proven benefits to organizations.

The Smart City Ecosystem Framework – A Model for Planning Smart Cities

The smart city is a complex ecosystem of people, processes, policies, technology and other enablers working together to deliver a set of outcomes. The smart city is not “owned” exclusively by the city. Other value creators are also involved, sometimes working in collaboration and sometimes by themselves. Successful and sustainable smart cities take a programmatic approach to engage its stakeholders across the ecosystem. Our research has found that many cities are not taking an ecosystem approach to smart city projects. This is due in part to smart city projects being managed by the Information Technology (IT) organization where their charter is on systems development and deployment. In contrast, more experienced smart cities manage their smart city programs through internal cross functional “Transformation” or “Innovation” organizations. Regardless of where cities are in their smart city journey, they must get ahead of the “curve” with smart city projects.

Google’s Cross-Platform Mobile UI Framework Flutter Now in Beta

Flutter supports a reactive-style approach to UI definition, similar to React Native. What sets it apart from other cross-platform Web view-based frameworks is its reliance on Dart to avoid the need for a JavaScript bridge between the UI and the native services provided by the OS platform. This includes, for example, location services, sensor access, camera, etc. By using Dart, which is compiled ahead-of-time into native code, Flutter does not pay the cost of context switching due to the JavaScript bridge. Cross-platform frameworks that aim to provide a native UI look and feel also use natively-implemented widgets to represent buttons, tables, etc. This also usually requires different parts of an app to communicate using the JavaScript bridge, which tends to be slow. To circumvent this, Flutter provides its own collection of widgets and draws them directly on the canvas provided by the OS platform.

Powerful New DDoS Method Adds Extortion

Because memcached doesn’t support authentication, an attacker can “spoof” or fake the Internet address of the machine making that request so that the memcached servers responding to the request all respond to the spoofed address — the intended target of the DDoS attack. Worse yet, memcached has a unique ability to take a small amount of attack traffic and amplify it into a much bigger threat. Most popular DDoS tactics that abuse UDP connections can amplify the attack traffic 10 or 20 times — allowing, for example a 1 mb file request to generate a response that includes between 10mb and 20mb of traffic. But with memcached, an attacker can force the response to be thousands of times the size of the request. All of the responses get sent to the target specified in the spoofed request, and it requires only a small number of open memcached servers to create huge attacks using very few resources. Akamai believes there are currently more than 50,000 known memcached systems exposed to the Internet that can be leveraged at a moment’s notice to aid in massive DDoS attacks.

Manufacturing & Innovation

The Advanced Technologies Initiative provides important insights on US and global innovation trends, and highlights the challenges faced by businesses in maintaining or improving their technology competitiveness. In addition, Deloitte and the Council have consolidated the interviewees’ thoughts and perspectives to develop a set of high-priority recommendations detailing immediate and longterm critical needs to improve the national innovation ecosystem vital to sustaining US competitiveness. The study aims to increase attention and discussion on the current US science and technology system and pinpoint deficits to address its vitality. An ancillary aim is to spur an ongoing national dialogue among stakeholders on advanced technologies, industries, and foci of research from a systematic, versus siloed, perspective. The report captures the voices and opinions of both government and industry leaders on US and global R&D, as well as innovation, trends.

This year banking changes for good. Are you ready for the revolution?

It’s certainly a timely move. On the consumer side, privacy and personal data security are becoming an increasing concern. On the business side, the free flow of data has the potential to enable institutions to innovate, creating competition, and more choice for consumers and small to medium enterprises (SMEs). Historically, SMEs have often been seen as costly for banks to service in relation to the size of business. This has led to them having limited services to choose from, with access to credit being an ongoing concern. As competition increases from FinTech startups and challenger banks, there is potential for institutions who overcome these issues to take market share and better serve the market – generating benefits for themselves and their customers. As you may expect with a GDPR linked initiative, privacy and trust are at the heart of open banking — particularly important when you consider heightened sensitivity around what happens to our personal data when we hand it over.

---

Quot for the day:

"A leader does not deserve the name unless he is willing occasionally to stand alone." -- Henry A. Kissinge

---