Daily Tech Digest - April 24, 2018

The Importance Of EA for Business Transformation: Lessons Learned

In short, managing uncertainty is a necessity. Despite all the turbulence created by digital disruption, we believe that EA is mandatory for becoming a pioneer of innovation and a critical enabler of business vision. The main driver of this is that business reality is changing, and therefore IT needs to change. And EA practices need to reflect this change as well. Organizations that support Business Architecture as an integral part of EA have a significantly higher ability to execute on their corporate strategy because they have a clear understanding of the strategy and its impact on business and IT – and therefore have guidance to drive delivery. Enterprise Architects that deliver the highest business value and outcomes to their organization are those that focus on understanding the impact of major trends and opportunities on their business ecosystem, not just their own business. SKF IT uses Business and Enterprise Architecture to gain business insight and increase the relevance of IT.

Study Reveals Hottest Trends in Industrial IoT

Any time automation is mentioned, concerns about jobs are raised. While disruptive technology will affect job markets, it’s also leading to increased demand for talent, as AI and machine learning provide valuable information that must be carefully interpreted. When asked, CEOs around the globe discuss how critical talent is for remaining competitive, and demand will fuel higher salaries as companies compete for the best talent available. In the US, for example, over 80 percent of manufacturers claim to have difficulty finding qualified talent. Furthermore, 3.5 million jobs across the globe are likely to be created, leading to an increasing skills gap. New technology provides valuable opportunities for manufacturing and other fields, but it’s also placing pressure on C-level executives, as the cost of this new technology will demand responses for companies to remain viable. Executives will need to ensure they properly understand these new technologies and how they affect their segments, and they’ll need to uncover problems promptly to avoid being undercut by competitors.

Threat Actors Turn to Blockchain Infrastructure to Host & Hide Malicious Activity

Because blockchain top-level domains such as .bit are not centrally managed and have DNS lookup tables shared across a peer-to-peer network, takedown efforts become much more difficult. "When an individual registers a .bit — or another blockchain-based domain — they are able to do so in just a few steps online, and the process costs mere pennies." Domain registration is not associated with an individual's name or address but with a unique encrypted hash of each user. "This essentially creates the same anonymous system as Bitcoin for Internet infrastructure, in which users are only known through their cryptographic identity." Criminal interest in cryptocurrency-related topics are not new. As FireEye notes, threat actors have been exploring the possibility of leveraging the unique properties of blockchain technology to support malicious operations since at least 2009. One example is malicious actors' interest in Namecoin, a Bitcoin code-based cryptocurrency that allows pretty much anyone to register and manage domain names with the .bit extension. 

Next generation of SCADA industrial controls will protect against cyber attack

Industrial control systems – known as supervisory control and data acquisition (SCADA) systems – which are used to control valves, motors and other industrial processes, are frequently based on technology that pre-dates the internet, and can be vulnerable to attack in modern control systems which transmit and receive data over the internet. But large oil and manufacturing companies are working on plans to replace existing control system infrastructure with lower-cost alternatives that promise greater security against cyber attacks on control devices connected to the industrial internet of things which links millions of internet-connected industrial devices. The project, co-ordinated by the Open Process Automation Forum, part of independent standards organisation The Open Group, aims to help oil and gas and process companies break free from manufacturer-specific industrial control systems, which are expensive to maintain and upgrade and difficult to patch to protect against the latest security vulnerabilities.

Spring Has Splunk'd: Announcing New & Expanded Artificial Intelligence Capabilities

Reports claim AI is shaping the latest in consumer tech and also threatening future job growth. All of this is in the absence of a widely accepted definition of the term. Those of us dedicated to enterprise software are presented with a critical opportunity to move beyond the buzz. I’m excited to lead Platform marketing at Splunk, a company that has, for a decade, invested heavily in machine learning (ML)—predictive analytics, data clustering, and anomaly detection—which is a subset of artificial intelligence. Our customers—Hyatt, Recursion Pharmaceuticals, and TransUnion to name a few—rely on Splunk AI and ML to deliver actionable performance, productivity, and security benefits that map their real-world IT, security and business needs. Artificial intelligence through machine learning is integrated across our portfolio. AI through ML is embedded in our premium solutions (Splunk ITSI and Splunk UBA) for specific IT and security use cases. We also offer a customizable solution, Splunk Machine Learning Toolkit (MLTK)—applicable for a broad variety of use cases—within Splunk Cloud and Splunk Enterprise.

Nurses want to use IT, but are held back by barriers

“Poor connectivity when mobile working hinders information technology from being used to best effect,” the report said. “Systems fail to update and/or synchronise, programmes used for recording information fail to load and systems crash. This leads to nurses having to use paper-based methods of recording information and duplicating this onto IT systems back at base.” Another challenge is the cost of good IT systems. NHS organisations often work on yearly budgets, whereas the return on investment (ROI) of implementing digital systems is usually more long-term. “The ‘up-front’ cost of IT in a tight financial climate serves to increase the risks of waste if technology is not fully used,” the report said. “Systems are prone to crashing and are slow, leading to frustration and compelling community nurses to work from paper.” Some of the nurses surveyed also highlighted concerns that the use of IT took away from time spent with the patient, and that they often felt like the use of technology has “detracted from the role of being a nurse”.

Tech support scams are on the rise, up 24%, warns Microsoft

Not all of those scams were cold calls from fake tech support; some started at random websites that had a popup warning about detecting fake threats or fake error message popups. Other social engineering attacks started in email campaigns where the user would click on a URL or open a malicious attachment; once malware is on a computer, it can make system changes or flash fake error messages with a number to call to fix the problem. Scammers continue to resort to these tactics because they work so well to scare the pants off non-tech-savvy users. Of the 153,000 tech support scams reported to Microsoft, 15 percent of victims admitted to losing money in the scam. While most paid between $200 and $400 for the fake problems to be “fixed,” one scammer managed to drain the bank account of a user in the Netherlands. That poor person lost €89,000, which is about $108,838.54. For anyone wondering how a scammer managed to empty the victim’s bank account, Oregon’s FBI explained that some victims of tech support scammers first received a notification about a refund after overpaying for a previous tech support incident.

5 key enterprise IoT security recommendations

Not so long ago, the phrase “consumerization of IT” was on everyone’s lips. Whole publications and conferences (remember CITE, for Consumerization of IT in the Enterprise?) were created to chronicle the trend of corporations relying on products and services originally created for consumers — which was often easier to use and of higher quality than its business-oriented competitors. ... It turns out that in addition to the “enterprise grade” Internet of Things (IoT) devices they buy, corporate IT teams also have to deal with “consumer-grade” devices that may enter the company via a variety of channels, from non-IT company purchases to staff members bringing them in on their own. Examples include smart TVs, thermostats, smart speakers, fitness trackers, video cameras … basically anything connected to the company network that isn’t a computer, a phone, or a router. Not surprisingly, these devices often lack the comprehensive security features more commonly found on IoT products designed for enterprise use. Worse, perhaps, IT teams may not even be aware that these devices are being connected to their networks, much less be able to plan for their security.

'Death to JavaScript!' Blazor, for .NET Web Apps Using WebAssembly, Goes Alpha

Instead of a heavy dependence on JavaScript, notorious for its complex ecosystem, the new .NET Web framework lets developers use C#, Razor and HTML to create Web apps, with the help of WebAssembly, a low-level assembly-like language that serves as a compilation target for higher-order languages, including C, C# and C++. Razor is "an ASP.NET programming syntax used to create dynamic Web pages with ... C# or Visual Basic .NET." All those technologies combine to form Blazor, which we first reported on when a developer asked Microsoft's Scott Hanselman if the company was working on .NET targeting WebAssembly "so that we can get delivered from the insanity of JavaScript." The answer was "yes," and that answer has been realized in the first public preview. "Blazor enables full stack Web development with the stability, consistency, and productivity of .NET," Microsoft's Daniel Roth announced in a post yesterday. "While this release is alpha quality and should not be used in production, the code for this release was written from the ground up with an eye towards building a production quality Web UI framework."

Optimizing web apps with the Sonarwhal linter

The heart of Sonarwhal is its rule set. These contain the tests it applies to your website, and you can turn them on and off or adjust severity in its configuration files. The default configuration offers a selection of rules, so you can choose to test HTTP options, as well as HTML, site security, and support for PWA functions. Many of the tests require a deep knowledge of web server capabilities as well as HTML and JavaScript. However, once you’ve tested a site, the report data can help tune content and server for the best, and most secure, performance. Results arrive in any of several formats. One option gives you the data in a raw JSON format, ideal for use in other applications. While JSON isn’t human-readable, other options show summaries, a list of specific code issues, or a table of error data. You can even drop result data in an Excel spreadsheet. The formatter model is extensible, so you can create your own and offer them to other users.

---

Quote for the day:

"Speak when you are angry, and you'll make the best speech you'll ever regret." -- Laurence Peter

---

Daily Tech Digest - April 23, 2018

Microsoft Boosts Anti-Phishing Skills 

Dubbed "Windows Defender Browser Protection" (WDBP) the free extension can be added to Chrome on Windows or macOS, and after a post-launch fix, Chrome OS as well. Like the defenses built into Edge, the add-on relies on Microsoft's SmartScreen technology that warns users of potentially malicious websites that may try to download malware to the machine or of sites linked in email messages that lead to known phishing URLs. Microsoft keeps a constantly-changing list of these likely bad destinations on its servers, that list generated in part from telemetry sent by SmartScreen users. At least that's what it appears WDBP does: Microsoft has not documented the extension's operation beyond some general information on its site and in the description on the Chrome Web Store. In the latter, Microsoft said: "If you click a malicious link in an email or navigate to a site designed to trick you into disclosing financial, personal or other sensitive information, or a website that hosts malware, Windows Defender Browser Protection will check it against a constantly updated list of malicious URLs known to Microsoft." That is SmartScreen.

IoT in agriculture: farming gets ‘smart’

Cattle farms and ranches usually stretch over a large land area, making it difficult to monitor the whereabouts of grazing animals without human involvement. Using tracking collars, one can find the location of these animals in real time. Then, a data storage system can record this information in a database to ultimately form a baseline model of their movements during a given time period. Applying intelligent algorithms on these patterns helps us identify if the cattle’s movements are irregular, of if one or more animals are separated from the herd. This usually occurs if they are sick or injured. This solution can easily be implemented by small IoT trackers that communicate over an IoT network like Wi-SUN or other WANs. One could then have networking towers distributed across the fields to cover a large area. This information is then exposed to the farmer or rancher via a web portal or smartphone application, thus making it easy from them to consume it. Another area of IoT use in farming is the utilization of drones to improve crop health. Disease, and the ease of which disease spreads amongst crops, is a real cause for concern as this directly impacts crop yield.

'Tech Accord' Emphasizes Teamwork to Prevent Hacking Damage

The accord is designed to form a more cohesive defense among private companies, researchers, "civil society" and nongovernmental organizations against the range of threats. It also crucially includes a pledge to not assist governments in cyberattacks. "We will protect against tampering with and exploitation of technology products and services during their development, design, distribution and use," Smith writes in a blog post. "We will not help governments launch cyberattacks against innocent citizens and enterprises." Tension sparked between Microsoft and the U.S. government following the WannaCry ransomware outbreak in May 2017. The ransomware used a vulnerability in Microsoft's operating system to rapidly spread, causing millions of dollars in damages. North Korea has been accused by the U.S. and U.K. of developing WannaCry. The vulnerability was believed to have been one of the most productive ones used by U.S. National Security Agency. But a mysterious group calling itself the Shadow Brokers leaked the vulnerability in April 2017. 

Why human vulnerabilities are more dangerous to your business than software flaws

"Email remains the top attack vector...Attackers are adept at exploiting our natural curiosity, desire to be helpful, love of a good bargain, and even our time constraints to persuade us to click," the report said. Some 50% of all clicks on malicious emails occurred within an hour of it showing up in the victim's inbox. And 30% happened within 10 minutes of receiving the email. Hackers, either working on their own, with a group, or with a state-sponsored entity, attempted to take advantage of human trust in most cases. Nearly 55% of social media attacks that impersonated customer-support accounts were aimed at financial institutions. "Many of these attacks rely on social engineering," the report noted. "Others simply take advantage of inclinations for immediate gratification, improved status, or even the reward of 'getting something for nothing.'" The report continued: "But as the old adage goes, there is no such thing as a free lunch. The hidden costs of a bargain in social media channels can often be credential loss to phishing, coin mining through browser hijacking, and malware infections."

Analyst balks at blockchain distributed ledger in networking

Mike Fratto, an analyst at GlobalData in Sterling, Va., said he sees no purpose for the blockchain distributed ledger in networking. To Fratto, the technology that has attracted lots of industry attention is little more than a "relatively slow" database scattered across a network of computers. As a foundation for network management, blockchain "would be wildly inefficient," Fratto said in an interview. Also, there are much better technologies already in place for grappling with networks. "Fundamentally, blockchain doesn't solve the problems in network management that need to be solved," he said. In general, blockchain is a ledger used to store transactional information across a network of computers. The distributed nature of the technology makes it highly secure, because any change to a transaction that isn't validated by the whole system is immediately rejected.

Engineering Culture Revived: The Key to Digital Transformation

Superbet has established a market-leading position in Central and Eastern Europe for Retail betting; meanwhile, over the last year we have invested heavily in the establishment of a ‘dot com’ team that will launch us globally online. Along the way, we have embedded many acquisitions and so we have quite a ‘melting pot’ of nationalities and practices, but the entrepreneurial flair runs core through all. So for instance, our Slovakian Payment System team operates completely distinctly from our UK Pricing / Trading products team, but both came to our business with an existing implementation-driven approach to market evolution: the capability to test and learn built in as core practice. As we evolve our teams we are taking care to establish the right ‘conditions’ for engineering culture from the start; so for instance, working to a business outcome, it is the team that decides HOW this will be achieved. The teams are also responsible for recruitment such that new team members are selected by the team.

The New Rules Of IT Business Alignment In The Digital Era

“Budgets are shifting and budgets are everything. Whoever’s got the budget has final say,” observes Matthew Mead, CTO of digital technology consulting firm SPR. Mead has observed this transition in his own work. “Traditionally, if you were selling a business system, you’d sit down with IT representatives and one business person and have a very technical conversation. Nowadays, it’s shifted completely. A lot of times we’ll find ourselves in a meeting where the business has much more representation in terms of numbers of people and IT has much less. I think IT has become more of an influencer and consultant. It used to rule the roost and make the call. Now there are many voices and IT is just one of them.” That makes vendors’ jobs easier in ways that ought to worry every CIO. “When we sold to IT, the information we went over was so much more detailed and rigorous. There were a lot of details that had to be disclosed. Now when we work with a business, the experience is a much larger focus and some details that used to be important are no longer important,” Mead says, adding that some of those no-longer-discussed details might include security and maintenance requirements.

Will enterprise IoT become BYOD on steroids?

Unlike BYOD, IoT tools are “headless,” typically tied to line of business to drive top line revenue or bottom line cost cutting objectives. This means the importance of monitoring and managing of these new things, to ensure the best possible performance over computer networks, will eclipse that of conventional networked clients. With all the power and benefits of IoT, IoT will also present a new host of challenges to enterprise IT teams that will exceed other recent challenges enterprise IT teams have had to deal with like interoperability, protocols and security. IoT management is further complicated by the fact that some IoT devices have limited hardware capabilities, restricted networking capabilities and don’t run operating systems that support conventional IT or mobile device management. What’s more, IoT management tasks may be split across different factions in IT or network operations. Without a single source of insight into the performance of IoT devices that can be used by all the different networking constituents, more finger pointing among IT staff is sure to result. Another difficult thing for network managers to get a grip on is the impact of IoT-networked devices on capacity planning. 

Get Ready for Cloud Native, Service-Meshed Java Enterprise

Java EE, cloud native and service meshes — this doesn’t really sound like a good fit. Or does it? Is it possible to develop modern, cloud native Java Enterprise applications that fulfill concerns such as scalability, monitoring, tracing, or routing — without implementing everything ourselves? And if so, how? In an enterprise landscape of microservices there is the challenge of adding technical concerns, such as discovery, security, monitoring, tracing, routing, or failure handling, to multiple or all services in a consistent way. Software teams can potentially implement their individual services in different technologies, yet they need to comply with organizational standards. Adding a shared asset such as an API gateway tangles the services together and somehow defeats the purpose of a microservice architecture. Redundancy, however, should be avoided as well. Service meshes transparently enhance each microservice that is part of the mesh with consistent technical concerns. These enhancements are added in a technology-agnostic way, without affecting the application.

Innovative CIOs make shift to managing IT as a product

"It's about: How do I move fast, continually adopting capabilities for our organization, much like if we had a product in the market we're evolving based on customer feedback and needs?" Piddington says. Piddington brought these practices with him to MRE in 2014, instituting a culture around crisper, agile software delivery tied to data operations. Piddington soon discovered a hidden gem: IT had built a software tool that uses machine learning algorithms to assess the health of laptops, server farms and other critical machines MRE consultants use to generate revenue. MRE’s help desk technicians used this information to fix machines before they went down. Recognizing the potential to create a new revenue stream, Piddington commercialized the tool, seeding an early version with some services clients to see if it would work in environments supporting thousands of machines. Under Piddington's leadership, MRE fine-tuned the app to support network endpoint devices and virtual machines and boosted the algorithm’s accuracy from 85 percent to 98 percent, before taking it to market in early 2017. Several customers are using it, he says.

---

Quote for the day:

"I count him braver who overcomes his desires than him who overcomes his enemies." -- Aristotle

---

Daily Tech Digest - April 22, 2018

New Fraud Statistics Show Rising Volume of Identity Theft

The Cifas data indicated that online retail fraud rose 49 percent last year. According to the report, identity fraud “remains a predominantly internet-based offense, with 84 percent of identity fraud occurring through online application channels.” Account takeover (ATO) fraud is also on the rise, experiencing a 7 percent increase over 2016. A recent Javelin report found that ATO fraud tripled last year, causing more than $5 billion in losses. In addition, the average resolution time for ATO was 16 hours. New account fraud (NAF), meanwhile, rose 70 percent as cybercriminals leveraged personally identifiable information (PII) to create fake credit card and bank accounts. The Cifas report also noted that actors are increasingly targeting older age groups for ATO fraud using social engineering techniques. These often take the form of phishing emails or over-the-phone “security checks” that ask victims to provide personal information for “verification.” Once attackers have PII in hand, they’re able to either compromise existing accounts or create new ones that may lead to claims of credit fraud or identity theft.

'WordPress of Blockchain' Startup Seeks to Solve Enterprise Pain Points

The Federated Network Protocol is aware of the number of validators, and their health, at all times. This awareness allows Hadron to predict the point of failure on the network and prevent it by spinning up temporary validators that keep the network alive while participants are alerted to the imbalance and instructed to remedy it. In this way, Dukkipatty said, the blockchains that use Elemential (which has designed its middleware for Hyperledger Fabric, Corda, Tendermint and private instances of ethereum) can continue working even when a problem arises. Currently, Elemential is working with the National Stock Exchange of India on a know-your-customer (KYC ) compliance scheme that's built on a private blockchain. The pilot includes ICICI Bank, IDFC Bank, Kotak Mahindra Bank, IndusInd Bank and RBL Bank, as well as HDFC Securities, a Mumbai-based brokerage. While the system allows nodes on the same networks to communicate with each other, Elemential's aspirations go further than that.

The truth about data

There are many things that impact the quality and veracity of data throughout its life cycle. Errors can be introduced in the collection process, as it is cleaned or moved across disparate systems. It may have been gathered for a different purpose than what it is now being used for. Or it can simply be too old. When United Airlines recently looked at the data it was using to predict seating demands, the company discovered it was actually data from forecasts that were decades old. This lack of veracity resulted in inaccurate pricing models that cost United Airlines $1 billion (£700 milllion) per annum in missed revenue. It is therefore both surprising and alarming to discover that while 79pc of executives agree that their organisations are basing their most critical systems and strategies on data, many have not invested in the capabilities to verify the truth within it. Without establishing the veracity of that data, businesses leave themselves vulnerable and open to a threat that is critically overlooked.

How DataOps Is Transforming Data Management Practices

Data should be a shared asset, but many companies struggle to treat it as such. Data transcends traditional organizational structures and lines of business, and managers find it difficult to reconcile its governance against traditional business structures. It is not uncommon for data management projects to digress into organizational turf battles. This lack of sharing can result in many different versions of reality, where managers compete to promote their own. When data users don’t trust the data or each other, it’s hard to unlock value. Emerging technology providers think that they’ve found a path forward for building trust through a discipline called Data Operations, or “DataOps.” TAMR’s Palmer has been a pioneer in the field of DataOps, which he describes as “the framework of tools and culture that allow data engineering organizations to deliver rapid, comprehensive and curated data to their users”. He continues, “DataOps enable users to help curate and correct data when they consume it by providing feedback from the point of consumption”.

The biggest challenges for true modernization in 2018

"It's a great opportunity to have the top cover from the administration and the funding, hopefully, to get this done," one executive said. "But I see another opportunity in my organization to change some things. I'm looking at a culture shift and a kind of mind shift on how we do business. I want to be more adaptable, have more agility and be able to focus on cyber and data, and the only way to do those activities effectively is to change the skill set in-house. We also need to have a new strategy for managing data because I'm looking at things like deep learning and artificial intelligence." Other participants said they, too, are taking advantage of the opportunity to consider dramatic changes. "Our agency had eight CIOs in 10 years — and a year and a half without a CIO," one executive said. "It was constant turmoil. Staffing, hiring, rewarding, contracts — everything was broken. So we decided to blow it all up and start over. And we tell everybody to steal from anybody who's done this already. Let's not reinvent it if you don't have to."

AI In Marketing: Where And When It Can Make A Difference

Today’s CMO is tasked with the challenge of understanding a far greater number of channels, platforms and technologies than ever before. Couple that with the never-ending flow of data coming from every device, method and channel and it’s a recipe for data-processing disaster. The right investment can determine whether a CMO lasts less or more than the average 18-month lifetime. Artificial intelligence offers fascinating possibilities for marketing. While it’s still in its infancy, the power is in the hands of marketers to push for answers to the hard questions. Marketers looking to invest in new technologies must know how and why they’re going to apply them and evaluate how they will solve specific pain points. By working with teams made up of traditional marketers, who focus on the practical applications or technical investment, and more technically savvy computer scientists, who will be responsible for building out and deploying new solutions, CMOs can make far more informed decisions.

Tapping Into Data Capital with AI and Machine Learning

The enterprise data being leveraged includes a complete history of all candidates selected and hired, their key attributes, how they were on-boarded once hired, and their eventual performance in the organization. An analysis engine extracts key features that contributed to candidates’ success and creates a recommendation engine that can rate new applicants along their likelihood to thrive at the organization. Simple data analytics, right? Yes, except that the algorithms, rather than people, decide which factors matter and which do not. Furthermore, the system continually processes ongoing results of those candidates, updating its recommendation engine rules over time. The system learns from actual experience, just like humans do. But it does so far more rapidly and objectively. “Now, extend this capability to other high-value, high-frequency business processes,” Hollis writes. “Timing and pricing of supply chain purchasing. Negotiating discounts on large orders. Measuring the temperature of your customers to determine when a small issue might become a big one. Today’s AI-informed recommendations become tomorrow’s advanced automation.”

Confused about mobile platforms? You’re not alone. Here’s clarity.

The very thin thread of evidence for a dual boot into Windows is a reference in the same commit to an internal Google document called “go/vboot-windows.” Trouble is, Google offering Windows on Pixelbooks doesn’t make sense. Google hardware exists to support Google software and services. What makes a little more sense is Fuschia OS as “Alt OS.” (More on Fuschia below.) It’s also possible that Google wants to enable enterprises, schools and developers to more easily dual-boot in whatever OS they want to tinker with as a way to encourage such customers to try Chrome OS. A number of experimental alternative OS projects are being worked on in the Linux community. They include GalliumOS, which is based on Xubuntu and is designed for Chrome OS devices specifically. However, GalliumOS itself contains a script that enables users to dual-boot Chrome OS and GalliumOS. So the answer to the question of whether Chromebooks will run Windows is: Maybe, but probably not.

Moving your data analytics to the cloud isn’t so easy

Moving the data doesn’t magically solve your integration challenges. Also, systems of record may still remain on premises, and so need to be synced with the data now stored in the cloud in a timely manner to get up-to-date results. This means using a mix of old and new data-integration technologies and setting up processes that include data movement and structure transformation. Finally, the cloud-based analytics databases themselves are complex and difficult to configure. Some of that complexity is due to the security subsystems in the database; these are necessary but must be figured out in the context of the database and data analytics. This security must also be systemic with the rest of the systems the data analytics systems touch, both in the cloud and on premises—and that can mean most of the other operational systems that need to feed analytics in real time. Although these cloud analytics challenges can all be overcome, it’s up to IT to understand the level of effort may actually be an 8 out of 10, when it thought (or more likely was told) that it would be a 5 out of 10.

Overcoming hidden data risks when managing third parties

Third party risk management is becoming increasingly top-of-mind for organizations as they attempt to protect their privacy and confidential data and improve their security and risk exposure as part of the overall health of their organization. High-profile breaches, like the one suffered by Target in 2014 or more recently by Netflix in 2017, continue to bring to the forefront the risks third parties can introduce to an organization. As the cloud has increasingly become mainstream, an entirely new set of external risks has been introduced to our environment. Most organizations today rely on several—if not dozens—of external/SaaS applications to run their business, not to mention cloud-based infrastructure and platform offerings. Data ranging from employee vacation time to business documentation to confidential customer information now resides in the cloud, creating a new frontier of risk with which organizations must now contend. For many, the ability to manage this new frontier has not kept pace with the adoption of new, cost-effective technologies to better enable operations.

---

Quote for the day:

"Program testing can be used to show the presence of bugs, but never to show their absence!" -- Edsger W. Dijkstra

---

Daily Tech Digest - April 21, 2018

IoT Security Concerns Peaking - With No End In Sight

While IoT security has been criticized over the past few years, IoT device privacy is another rising pain point highlighted at RSAC, particularly with the rise of voice assistant devices such as Amazon Echo and Google Home. “One issue we found with these [IoT] devices is that it might not be a vulnerability – it might be that we’re oversharing data,” said Anscombe. In the case of the IoT scales, these scales could be connected with Amazon Alexa so that data stores various interactions between the scale and the user – a “cybercriminal’s dream,” said Anscombe. Despite the various security issues with IoT devices, significant steps still need to be taken from both IoT device manufacturers and the end users themselves to ensure device security. IoT device manufacturers, for their part, see security as a costly alternative to other factors that small, low power connected devices need. For instance, said Marc Bown, senior director of security at Fitbit, many connected device manufacturers would prefer to use low power, cheaper chips as opposed to ones that come with higher levels of security.

How Blockchain Could Put an End to Identity Theft

With blockchain-based Decentralized Identifiers (DiDs), individuals could regain complete control of their data. DiDs are basically a secret URL (which actually stands for Uniform Resource Locator) stored on a blockchain ledger, with each being assigned to the different parts of a user’s identity, such as their name, birthdate, and Social Security number. Using a digital wallet app on their smartphone or desktop, users have the power to temporarily grant access to the DiDs of their choosing. For example, when you sign up for a new app today, you typically have to share your name, email address, and other basic information. With DiDs, the process is faster and more secure. The app shows a QR code, you scan it, your digital wallet app automatically transfers your relevant DiDs over the blockchain, and the app grants access. The changing parts of our identity, like phone numbers, job titles, and home addresses, further complicate individual privacy because it is possible for a single identifier to become associated with more than one person at different times. 

Avoiding the IOT ‘Twister’ Business Strategy

Business stakeholders make isolated IOT product decisions because of the compelling ROI from the perspective of that particular business unit. However, the IOT solution vendor is motivated to sell the solution to other business units and that’s when the scalability problems start because many IOT solutions don’t scale. Scalability” refers to the ability to expand without running into obstacles that increase the per-unit costs of doing business, the ability to increase production inputs by a certain percentage, and get an equal percentage increase in output. However, most organizations want more than just “linear scalability”; these organizations want to leverage “economies of scale” to drive down incremental or marginal costs. Economies of scale arise when there is an inverse relationship between the quantity produced and per-unit fixed costs; i.e. the greater the quantity of goods produced, the lower the per-unit fixed cost because costs are spread over a larger number of goods. Economies of scale reduce variable costs per unit via operational efficiencies and synergies

This malware will take screenshots, steal your passwords and files

Named 'SquirtDanger' after a dynamic-link library (DLL) file consistently served by its distribution servers, the malware is written in C Sharp and has multiple layers of embedded code. The malware is set up to perform its tasks on an infected PC every minute in order to hand the attacker as much information as possible. Uncovered by Palo Alto Networks Unit 42 researchers, the malware has infected individuals and organisations around the world, including a Turkish university, an African telecommunications company and a Singaporean internet service provider. Given SquirtDanger is for sale for any user who wants to buy it, so no specific industry is under attack. But those who do opt to make use of it have a large box of malicious tricks at their disposal. Attackers gain access to a wide variety of functions through the malware, including taking PC screenshots, sending, downloading and deleting files, and stealing passwords. Other functions include swiping directory information and potentially taking the contents of cryptocurrency wallets using switch tactics similar to those found in ComboJack malware.

Three ways the Internet of Things and the GDPR will impact Third Party Risk

The IoT rests on the use of the data that IoT devices generate to shape additional engagement. For example, a television that is IoT enabled will create data around what is being viewed and when. For the user, this could be valuable – the device could suggest programming, or automatically record things it knows its users watch. This data could also be combined with information from other sources – area social-economic data, for example – to create a generic user profile for a neighborhood. This data could then be sold to marketing companies keen to better understand the dynamics of their audience. A TV manufacturer who didn’t get user permissions correct was recently fined in the US for doing just this. For some opportunities, organizations may wish to partner with third parties – for example, if delivering a new service that is related to a product but not in an area of core competency. An example of this might be a concierge service for a car based on the data the car was sending back via the IoT. Other organizations may vertically integrate or evolve, acquiring new types of operations to help grow an IoT-based offering. Such expansion will most likely bring it into relationship with new third parties too.

Cisco Extends Its Intent-based Networking to IoT

Cisco is working on three areas in IoT. The first is an Identity Service Engine (ISE) software that will help enterprises recognize devices when those devices connect to the network, and report detailed information about those devices such as the manufacturer, model number, and what software is installed on the device. In the latest ISE upgrade, Cisco said it has doubled the number of IoT device and user device groups that can be classified and identified including those that use industrial protocols like BACNet, Profinet, CIP, and Modbus. The ISE 2.4 software is available today. The second area is software-defined access (SD-Access), which Cisco is extending to enterprises with distribution centers, manufacturing plants, or warehouses. SD-Access is basically a new model for network administrators to use to automate access and management of devices. According to Shenoy, an IoT gateway agency will take information from devices and create a set of profiles. Those profiles determine what device gets access to what information. SD-Access then takes those profiles and matches them with users.

Future Factory: How Technology Is Transforming Manufacturing

3D printing is already a staple in any design studio. Before ordering thousands of physical parts, designers can us 3D printing to see what a future product looks like. Similarly, robotics is automating the physical process of trial-and-error across a wide array of verticals. In R&D for synthetic biology, for example, robotics making a big impact for companies like Zymergen and Ginkgo Bioworks, which manufacture custom chemicals from yeast microbes. Finding the perfect microbe requires testing up to 4,000 different variants concurrently, which translates to lot of wet lab work. Using automatic pipette systems and robotics arms, liquid handling robots permit high-throughput experimentation to arrive at a winning combination faster and with less human error.  Below is the robot gene tester Counsyl (left), used for transferring samples, and Zymergen’s pipetting robot (right) for automating microbe culture testing.

How complexity, multicloud sprawl, and need for maturity hinder hybrid IT

For the short term, I would say everyone. It’s not as simple as it has been in the past where we look to the IT organization as the end all, be all for all things technology. As we begin talking about different consumption models—and cloud is a relatively new consumption model for technology—it changes the dynamics of it. It’s the combination of changing that consumption model, but then there’s another factor that comes into this. There is also the consumerization of technology, right? We are “democratizing” technology to the point where everyone can use it, and therefore everyone does use it, and they begin to get more comfortable with technology. It’s not as it used to be, where we would say, “OK, I'm not sure how to turn on a computer.” Now, businesses may be more familiar outside of the IT organization with certain technologies. Bringing that full circle, the answer is that we have to look beyond just IT. Cloud is something that is consumed by IT organizations. It’s consumed by different lines of business, too. It’s consumed even by end consumers of the products and services. I would say it’s all of the above.

2018: The ‘Year of AI and Machine Learning’ for Financial Marketers

Making matters worse, the vast majority of these consumers engage with one of your well-trained customer service representatives less than they ever have in the past. Bottom line, financial marketers have their work cut out for them. The only viable and potentially scalable solution is content that is so personalized and relevant that it’s impossible to ignore. We need to look for ways to communicate to an ‘audience of one,’ using artificial intelligent (AI) systems that constantly work in the background to enhance every step of the customer journey. We need to leverage new tools that were previously only available to the very largest companies with huge support staffs. True personalization at scale requires advanced analytics, which is why banks and credit unions of all sizes are using AI and machine learning to customize all components of the marketing mix. Your marketing team can no longer postpone using AI-powered solutions in your content development, offer selection, segmentation and targeting, website integration, customer service/support, product pricing and churn management.

Why Artificial Intelligence Roles Need Cross-Over Skillsets

The report has a very specific focus through. It outlines what the authors believe are the opportunities for the United Kingdom in an AI-driven world and what the UK government needs to do to turn the workplace change to the advantage of its citizens. It is, in fact, a thought provoking and enlightened report that treats AI not as a problem to be overcome, but as a technology that future-looking workers should embrace and can use to their own advantage. “It [AI] is a tool which is already deeply embedded in our lives. The prejudices of the past must not be unwittingly built into automated systems, and such systems must be carefully designed from the beginning. Access to large quantities of data is one of the factors fueling the current AI boom,” the report reads. It also warns that the builders of AI driven applications need to take heed to make sure their machines are accessible to everyone. The report warns, “Companies and organizations need to improve the intelligibility of their AI systems. Without this, regulators may need to step in and prohibit the use of opaque technology in significant and sensitive areas of life and society.”

---

Quote for the day:

"All journeys have secret destinations of which the traveler is unaware." -- Martin Buber

---

Daily Tech Digest - April 20, 2018

Google disables “domain fronting” capability used to evade censors

Domain fronting uses a manipulation of the secure HTTP Web protocol (HTTPS) and the Transport Layer Security (TLS) standard to help fool deep packet inspection systems and firewall rules about the intended destination of a Web request and to exploit the functionality of content delivery networks (CDNs). Domain names show up three times during a Web request—as part of a DNS query for the IP address of the site, in the Server Name Indication (SNI) extension of TLS (which tells a server with multiple sites which domain the traffic is for), and in the HTTP "host" header of the Web request. For HTTP traffic, all three of those instances of the domain name are visible to a censor's network gear; when surfing an HTTPS site, the HTTP header is encrypted. In a domain fronting scheme, the DNS request and SNI extension use the domain name of an unblocked host, but the HTTPS header contains the actual destination—which the request is then forwarded to, as long as it's part of the same CDN. That destination is usually a proxy server, VPN gateway, or a Tor bridge.

Software Design Principles DRY and KISS

DRY stand for "Don't Repeat Yourself," a basic principle of software development aimed at reducing repetition of information. The DRY principle is stated as, "Every piece of knowledge or logic must have a single, unambiguous representation within a system." "We enjoy typing" (or, "Wasting everyone's time."): "We enjoy typing," means writing the same code or logic again and again. It will be difficult to manage the code and if the logic changes, then we have to make changes in all the places where we have written the code, thereby wasting everyone's time.To avoid violating the DRY principle, divide your system into pieces. Divide your code and logic into smaller reusable units and use that code by calling it where you want. Don't write lengthy methods, but divide logic and try to use the existing piece in your method. ... The KISS principle is descriptive to keep the code simple and clear, making it easy to understand. After all, programming languages are for humans to understand — computers can only understand 0 and 1 — so keep coding simple and straightforward. Keep your methods small. Each method should never be more than 40-50 lines.

Nine Things That Are Poised To Impact Cybersecurity

The next wave of cybersecurity attacks will come from the internet-of-things (IoT) devices like appliances, lights and cameras. These types of devices are cheap, easy to hack, can be found in large numbers and are geographically distributed, making them ideal targets for a hacker to commandeer and launch a distributed-denial-of-service (DDoS) attack on an unsuspecting enterprise. ... Utilize multi-factor authentication and SSO technologies to get a handle on authentication. Integrating this with Hashicorp Vault or an HSM solution can bring about encryption key management, encryption key rotation and administration of all your data. For sensitive information within databases, consider field-level encryption so that even with the breach, any data that is leaked is encrypted. ... Decentralizing data used for authentication is here and doing it for more PII is next. Firms are abandoning storage of biometrics, PINs, and passwords and now secure them on endpoints like mobile devices. Users authenticate on-device and swap public keys with their service provider.

Data firm leaks 48 million user profiles it scraped from Facebook, LinkedIn, others

The data was found in a human-readable, newline-delimited JSON file. The data collected includes names and physical addresses, and employment information and job histories data, and more, scraped from Facebook, LinkedIn, and Twitter profiles. UpGuard's own report, published Wednesday, contained search queries that Localblox would use to cycle through email addresses that it had collected through Facebook's search engine to retrieve users' photos, current job title and employer information, and additional family information. Facebook locked down its search feature earlier this month after scammers were running automated searches to harvest people's data. It's also believed that the company supplements its collected data from non-public sources, like purchased marketing data. The data is then compiled, organized and blended into existing individual profiles. The report described the collection operation as an effort to "build a three-dimensional picture on every individual affected" to use for advertising or political campaigning.

DevOps is key to low-code BPM, digital process automation

Created to reduce manual intervention in business process implementations across organizations, business process management (BPM) software did automate manual tasks. Until recently, however, the development of that software wasn't an automated affair. During a business process software development project a decade ago, Scrum master Reshma Nagrani relied on tools that were hardcoded and that had fragile code. It was hard to modify the existing software, so the project needed to be customized, and it wasn't easy to find the talent to do the customization work. Today, older BPM suites (BPMS) are more robust than ever in that they are customizable and customer-centric. New low-code BPM tools are so simple that non-IT business people can develop enterprise apps, although they're not so simple that companies don't need business process developers and managers. Indeed, their roles in DevOps teams and emerging digital process automation (DPA) projects remain critically important.

UK Commonwealth cyber security funding welcomed

The Commonwealth Cyber Declaration sets out, for the first time, a common vision for ensuring the internet remains free and open across the Commonwealth. It will commit members to raising national levels of cyber security and increased cooperation to counter those who seek to undermine nations’ values, security, even the integrity of elections. The new funding will help Commonwealth countries to prevent and respond to cyber security risks affecting governments, businesses and citizens. Some £5.5m of the funding has been earmarked to enable low- and middle-income Commonwealth members to carry out national cyber security capacity reviews before the next CHOGM in 2020. Prime minister Theresa May said cyber security affects all countries because online crime does not respect international borders. “I have called on Commonwealth leaders to take action and to work collectively to tackle this threat,” she said. “Our package of funding will enable members to review their cyber security capability, and deliver the stability and resilience that we all need to stay safe online and grow our digital economies.

What is hybrid cloud really, and what's the best strategy?

In an attempt to create clarity, some companies and vendors started using the term multi-cloud instead of hybrid, indicating that the strategy simply involves more than one cloud – public-public or public-private. Others have applied their own definitions to hybrid cloud to include any combination of public and private cloud with consistent platforms and/or services, but those are relatively new, she says.  Indeed, the market itself is shaping the definition of hybrid cloud, and analysts and vendors are beginning to fall in line in agreement on the definition a true hybrid cloud strategy. Increasingly, it’s about moving workloads seamlessly between public and private cloud platforms and creating a consistent architecture across both environments. Some vendors are promising these capabilities soon, while others are already starting to deliver. “Hybrid cloud is a cloud computing environment that uses a mix of private cloud and public cloud services with orchestration between the platforms allowing data and applications to be shared between them,” says Ritu Jyoti, research director on IDC's enterprise storage, server and infrastructure software team.

Understanding fast data and its importance in an IoT-driven world

The first necessity is a streaming system that processes various events as quickly as they arrive. Next, there must be a data store that extracts information just as speedily. When they both work together, businesses are well-equipped to understand why fast data offers such a wealth of information they won’t want to overlook. Investigating what’s available now gives companies a leg up to prepare for the increasing prominence of IIoT technologies. Being proactive also gives business leaders a chance to think about how they can use fast data most effectively to get closer to their goals. There are several ways fast data aligns with business objectives. As the IoT becomes more prominent than ever, the gadgets people use every day increasingly have Wi-Fi-enabled sensors that collect data and give personalized information. Among the likely use cases for the industrial sector are intelligent lights that sense when people leave the room and turn off to save energy, plus water fixtures that measure utility usage over time to let leaders know when and where waste happens.

Data protection is a business issue, says IAPP

Unlike the information security industry, the data privacy industry does not have a gender bias issue, he said. “Our membership is approximately 50/50 and there is roughly equal representation of men and women at all levels of seniority, right from the very top down, with equal salaries for men and women doing the same jobs.” The privacy industry started about 20 years ago, said Tene, when companies started appointing privacy officers and treating privacy as a strategic business issue rather than a compliance issue. The first movers were data-intensive companies such as DoubleClick, IBM, Axiom and Microsoft. As a result, the privacy industry is more mature in the US, but has started to pick up significantly in Europe and in recent years, largely driven by the GDPR, said Tene. “Data privacy is increasingly a business issue, and we are seeing a growing emphasis in business on data management, data governance and data risk,” he said.

The Importance of Validating the Testing Infrastructure

Sometimes when given something to test, some key details may be forgotten—and that’s okay. That’s why, as testers, it’s on us to validate the test infrastructure before diving in. Fortunately, there are several ways to do so. ... Access each node by checking the IPs of the components and that they have the indicated services. Validate the operating systems, and verify their versions, as well as the versions of the components (for example, Java, Apache, etc). In a performance test, looking for optimizations, different configurations are usually tested, trying to improve the results, comparing the performance of different options. So, to validate that what is documented in the results is accurate, it is necessary to review the initial configurations (at least the most relevant ones). For example, the size of each connection pool (in the database or the web server), the maximum and minimum allocated memory (in the case of JVM), etc.

---

Quote for the day:

"You do not lead by hitting people over the head. That's assault, not leadership." -- Dwight D. Eisenhower

---

Daily Tech Digest - April 19, 2018

5G Security Challenges and Ways to Overcome Them

5G is on its way to serve vertical industries, not just individual customers who are more bothered about experiencing a faster mobile network or richer smart phone functionalities. When it comes to serving vertical industries, security requirements may vary from one service to the other. As the Internet of Things (IoT) continues to gain momentum, more people will be able to remotely operate networked devices and this will surely call for the deployment of a stricter user-authentication method to prevent unauthorized access to IoT devices. For example, biometric identification systems can be installed in smart homes. ... 5G networks are believed to be enhanced by the deployment of new cost-effective IT technologies such as virtualization and Software Defined Network (SDN)/Network Functions Virtualization (NFV). However, 5G services can be equipped with appropriate security mechanisms only if the network infrastructure is robust enough to support the security features. The security of function network elements, in legacy networks, depends, to a large extent, on how well their physical entities could be separated from each other.

Broadband Forum targets in-home IoT device security, management with USP standard

As IoT devices grow in popularity, it creates a greater security vulnerability for consumers. Service providers and consumer electronics manufacturers can now leverage the USP standard to perform lifecycle management of connected devices and carry out upgrades to address critical security updates. Newly installed or purchased devices and virtual services can also be easily added, while customer support is improved by remote monitoring and troubleshooting of connected devices, services and home network links. Additionally, the specification enables secure control of IoT, smart home and smart networking functions and helps map the home network to manage service quality and monitor threats. Work on the USP specification was carried out by the Broadband User Services (BUS) Work Area, which is led by Co-Directors John Blackford of Arris, who is also a Broadband Forum board member, and Jason Walls of QA Cafe. AT&T, Axiros, Google, Greenwave Systems, Huawei, NEC, Nokia, and Orange also participated in developing USP.

Notes from the AI frontier: Applications and value of deep learning

Neural networks are a subset of machine learning techniques. Essentially, they are AI systems based on simulating connected “neural units,” loosely modeling the way that neurons interact in the brain. Computational models inspired by neural connections have been studied since the 1940s and have returned to prominence as computer processing power has increased and large training data sets have been used to successfully analyze input data such as images, video, and speech. AI practitioners refer to these techniques as “deep learning,” since neural networks have many (“deep”) layers of simulated interconnected neurons. ... Deep learning’s capacity to analyze very large amounts of high dimensional data can take existing preventive maintenance systems to a new level. Layering in additional data, such as audio and image data, from other sensors—including relatively cheap ones such as microphones and cameras—neural networks can enhance and possibly replace more traditional methods. AI’s ability to predict failures and allow planned interventions can be used to reduce downtime and operating costs while improving production yield.

From BDD to TDD, the pros and cons of various agile techniques

Distributed agile makes it possible to escape any constraints of space or skills and experience in your immediate location. Modern collaboration tools like Slack, Skype, Teams, and Hangouts have made this possible. You can actually work together on stories without being in the same place and ask questions without disturbing your coworkers’ flow. Trust, rapport and communication are still essential. That’s why distributed agile works best when you have at least two teammates in any given location, they meet face to face periodically, and understand each other’s language and culture well. It’s helpful to have the whole team within a short flight and similar time zones so you can easily collaborate physically as well as virtually when needed. That team solidarity makes all the difference when you’re trying to crack a tough problem, get business or user feedback, or just onboard new team members. Agile works best when there is fast, frequent communication through standups and other formal and informal collaboration.

The evolution of forensic investigations

Protecting data, intellectual property (IP), and finances has become an increasing priority at the board room level as fraudsters proliferate and constantly adapt to more sophisticated controls and monitoring. While most organizations are susceptible to seemingly boundless criminal ingenuity, those lacking antifraud controls are predictably worse off, suffering twice the median fraud losses of those with controls in place. However, even organizations with antifraud controls can have their investigative efforts impeded by several factors. Reliance on rules-based testing is a primary culprit. Rules-based tests typically assess and monitor fraud risks across a single data set, giving only a yes or no answer. Information silos further impede analytics-aided investigative efforts. Organizations often struggle to balance the need for locally-tailored processes with the potential benefits of integrated data sharing, unintentionally creating barriers to investigative exploration as a result. The vast and growing volumes of unstructured data amassing in organizations, such as videos, images, emails, and text files.

City & Guilds Group deploys SD-WAN to improve Office 365 performance

It’s a different story, though, for workers located remotely like in the Asia-Pacific region. For those individuals, the experience can be very frustrating. I have first-hand experience with this. Prior to being an analyst, I spent some time as a consultant, and I remember trying open PowerPoint and Word documents out of region and it would often take minutes. Sometimes the process would go “not responding,” necessitating the need to shut down the application and start over. The most frustrating part was that there was no way of telling whether the file was still being downloaded or if the process died. I would often “open” the files and then go do something else for a while and come back and hope they finished opening. Bandwidth speeds have increased, but so have the size of Office documents. This is the situation that remote City & Guilds workers were facing. For example, users in Wellington, New Zealand, saw extremely slow response times when accessing files from the corporate Share Point drive, leading to a number of user complaints and a loss of productivity.

Google Cloud speech-to-text service gets revamp

In the future, enterprises will be able to feed automatically generated transcripts of business conversations into virtual assistants like IBM Watson or Google Assistant, helping those machines learn how to assist workers or customers better. "If you have your VP of marketing provide an overview of what a particular product does, that video is captured, that audio is converted into text, that text becomes searchable, and, ultimately, that text can be fed into machine intelligence systems," Vonder Haar said. Vendors are continually improving their speech-to-text tools, but enterprises shouldn't wait until those platforms are perfect before experimenting with them, said Jon Arnold, principal of Toronto-based research and analysis firm J Arnold & Associates. "To me, the big takeaway is these platforms definitely provide a lot of exciting possibilities," Arnold said. "Do some harmless in-house trials, get a feel for it, because the use cases will come out of the woodwork once you start getting comfortable with it."

15 Ways To Build Security Into Your Development Process

Knowing where to focus your likely very limited resources is key, and can be tackled by performing application risk assessments and threat modeling. By better understanding where your product or service may have unacceptable risk exposure, you can focus your time and resources appropriately. - Vijay Bolina, Blackhawk Network  As with any collaborative endeavor that brings together people from different backgrounds, experiences and outlooks, it’s important to acknowledge the possibility of conflict up front and deal with it head-on. Senior leaders should be involved to explain why the DevSecOps ethos is so vital to the company’s future, and hold everyone accountable for advancing its success. - Todd DeLaughter, Automic Software, owned by CA Technologies (NASDAQ: CA) One of the most effective ways to embed security into software is to initiate the security on boot-up. When a user restarts their device or software, the manufacturer should run a series of boot tests to determine any changes in the software and that the software is entirely authentic.

Beyond Java: Programming languages on the JVM

If there is any language that is a known and proven quantity for developers, it’s Java. Enterprise developers, web developers, mobile developers, and plenty of others besides, have made Java ubiquitous and contributed to the massive culture of support around Java. What’s more, the Java runtime, or Java Virtual Machine (JVM), has become a software ecosystem all its own. In addition to Java, a great many other languages have leveraged the Java Virtual Machine to become powerful and valuable software development tools in their own right. Using the JVM as a runtime brings with it several benefits. The JVM has been refined over multiple decades, and can yield high performance when used well. Applications written in different languages on the JVM can share libraries and operate on the same data structures, while programmers take advantage of different language features. Below we profile several of the most significant programming languages created for the JVM. 

Microservices Communication and Governance Using Service Mesh

A service mesh is an infrastructure layer for service-to-service communication. It ensures reliable delivery of your messages across the entire system and is separate from the business logic of your services. Service meshes are often referred to as sidecars or proxies. As software fragments into microservices, service meshes go from being nice-to-have to essential. With a service mesh, not only will you ensure resilient network communications, you can also instrument for observability and control, without changing the application run-time. ... In the direct interpretation it could be used to describe both the network of microservices that make up distributed applications and the interactions between them. However, recently the term has been mostly applied to a dedicated infrastructure layer for handling service-to-service communication, usually implemented as lightweight network proxies (sidecars) that are deployed alongside application code. The application code can treat any other service in the architecture as a single logical component running on a local port on the same host.

---

Quote for the day:

"You never will be the person you can be if pressure, tension and discipline are taken out of your life." -- Dr James G Bilkey

---