Daily Tech Digest - August 19, 2018

How AI is decommoditizing the chip industry

GPUs are already not commoditized relative to CPUs, and what we’re seeing with the huge surge of investment in AI chips is that GPUs will ultimately be replaced by something even more specialized. There is a bit of irony here considering Nvidia came into existence with the premise that Intel’s x86 CPU technology was too generalized to meet the growing demand for graphics intensive applications. This time, neither Intel nor Nvidia are going to sit on the sidelines and let startups devour this new market. The opportunity is too great. The likely scenario is that we’ll see Nvidia and Intel continue to invest heavily in Volta and Nervana. AMD has been struggling due to interoperability issues but will most likely come up with something usable soon. Microsoft and Google are making moves with Brainwave and the TPU, and a host of other projects; and then there are all the startups. The list seems to grow weekly, and you’d be hard-pressed to find a venture capital fund that hasn’t made a sizable bet on at least one of the players.

Will AI Disrupt Our Financial Systems?

According to the WEF report, “unlocking the full potential of AI requires an extensive network of partnerships.” Financial institutions will become “ecosystem curators” with “massive scale of data and insight.” China-based Ping An’s One Connect provides hundreds of small and medium-sized banks services developed on AI technology. The company has data from “over 880 million users, 70 million businesses and 300 partners” that fuel its suite of applications for finance, insurance, payments, and even telemedicine. Partnerships between financial service institutions and technology companies are on the rise. For example, WEF highlights the recently announced joint venture between Amazon, Berkshire Hathaway and JPMorgan Chase to develop a health plan for employees. The challenges of this new dynamic include protecting proprietary data between institutional partners, selecting the right services that will generate revenue, and regulating third-party services.

TensorFlow 2.0 Is Coming; Here’s What You Should Look Forward To

TensorFlow would soon be holding a series of public design reviews covering the planned changes. “This process will clarify the features that will be part of TensorFlow 2.0, and allow the community to propose changes and voice concerns,” said Wicke. Wicke also added that to ease the transition, they would be creating a conversion tool which would update Python code to use TensorFlow 2.0 compatible APIs, or at least warn the user in cases where such a conversion is not possible automatically. “TensorFlow’s tf.contrib module has grown beyond what can be maintained and supported in a single repository. Larger projects are better maintained separately, while we will incubate smaller extensions along with the main TensorFlow code. Consequently, as part of releasing TensorFlow 2.0, we will stop distributing tf.contrib. We will work with the respective owners on detailed migration plans in the coming months, including how to publicise your TensorFlow extension in our community pages and documentation,” Wicke concluded.

How Alibaba is championing the application of blockchain technology in China and beyond

Alibaba, through its subsidiary Lynx International, integrated blockchain technology to track information in its cross-border logistics services. With the successful application of blockchain, Lynx can all keep an immutable record of shipment information such as production, transportation, customs, inspection and any third party verification. Although the concept of blockchain has only recently started to emerge, it has a very wide range of applications” Tang Ren -The technical Director, Lynxx  For a shipping and logistics arm like Lynx, security and transparency cannot be overemphasized. It’s really no surprise Alibaba looked no further than blockchain. More recently, another of Alibaba’s subsidiaries, T-Mall in partnership with Cainiao adopted blockchain technology for its cross-border supply chain. Similar to the Lynx project, blockchain is being used to track information about shipments from over 50 countries.

Is data science a bubble?

Though that sounds like prime bubble, I’m actually pretty optimistic. Growing data means growing opportunities — it all just needs good management. My friend, for example, ended up conquering a lot of his problems by recognizing that the rest of his organization needed training in how to work with data scientists. Since then, his teams have been more thoughtful about how to assign work and great things followed. Training decision-makers in how to make use of data science saved the day!

Check that your decision-makers have the right skills for working with data scientists. If a bubble exists, that might be the root of it. The challenge for today’s data science leaders is help decision-makers get training like that, creating more people with the skills to point the technical brilliance of data scientists in valuable directions. Once data scientists are able to make themselves useful, keeping them around becomes a no-brainer, rather than a matter of fashion. Will we manage it before their data scientist title falls out of favor and they scramble towards another rebranding?

CBP launching blockchain testing

“Data without borders,” a fundamental principle of blockchain technology, “sounds good if you’re only looking at shipping, but you have to take into account that we have importation entry data coming in, and we have 47 agencies ... that aren’t just going to give up their sovereignty of their laws and their rules,”Annunziato said. “So it’s a very interesting time right now, but I think it’s a good time for the government to be involved because we’re starting to really push forward and make sure things are honest and working the way they’re supposed to.” CBP also is working with the Commercial Customs Operations Advisory Committee (COAC) on a proof-of-concept exercise exploring the use of blockchain in the intellectual property environment to identify IP licensees and licensors, Annunziato said. “So if you have a rights holder that is granting licenses to Company A, and then did they also grant the right for Company A to license out? You can now follow generationally what’s going on. So in a way the government’s got a view of that interaction with the company, and we see it as a worthwhile venture for the rights holders,” he said.

How to prevent phishing by studying the psychology behind digital fraud

Two researchers working in Carnegie Mellon University's Department of Social and Decision Science decided to look beyond the reasons why users fall for online fraud attacks. "Psychological research on human adversarial behavior is necessary to uncover factors that determine how deception and phishing strategies originally manifest in phishing emails," explain Prashanth Rajivan and Cleotilde Gonzalez in their coauthored paper Creative Persuasion: A Study on Adversarial Behaviors and Strategies in Phishing Attacks. "Currently, there is a severe lack of work on the psychology of criminal behaviors in cybersecurity." The two decided to change that, looking specifically at: The importance of incentives; How much of a role creativity plays; and The effect of adversarial strategies on attack success. To determine the importance of each item above, Rajivan and Gonzalez developed a two-part experiment consisting of these phases.

Google Is Turning Itself Into An AI Company

To maintain its foothold and protect its main source of revenue, Alphabet (Google’s parent company) is positioning itself to dominate adjacent sectors — such as digital commerce, branded hardware products, and content — and attempting to integrate its services into every aspect of the digital user experience. The company is also seeking out new streams of revenue in sectors with large addressable markets, namely on the enterprise side with cloud computing and services. Furthermore, it’s looking at industries ripe for disruption, such as transportation, logistics, and healthcare. Unifying Alphabet’s approach across initiatives is its expertise in AI and machine learning, which the company believes will help it become an all-encompassing service for both consumers and enterprises. In this teardown, we dive into Google’s approach to maintaining its search platform dominance, outlining the strategic investments, acquisitions, and partnerships across its top priorities moving forward.

On Becoming A Scientific HR Function – Learning From Amazon And Google

As Amazon puts it, “We manage HR as a business.” So, rather than simply “aligning with business goals,” the scientific model focuses on HR actions and resources so that they produce the maximum direct, measurable impact on business results. The two primary areas where HR can traditionally produce the highest business impacts include increasing the productivity of the workforce and improving the volume and speed of product and process innovation. Under this scientific approach, HR focuses on solving broad strategic business problems (e.g., decreased sales, product development or missed deadlines) rather than tactical HR problems. And finally, under this model, HR problems and results are converted to their dollar impact on revenue (e.g., the retention efforts on salespeople allowed us to maintain $2.5 million in sales revenue). Reporting results in revenue impact dollars allow executives to quickly compare HR’s dollar impacts to those from other business functions.

Hybrid optical-electronic CNN with optimized diffractive optics for image classification

Convolutional neural networks (CNNs) excel in a wide variety of computer vision applications, but their high performance also comes at a high computational cost. Despite efforts to increase efficiency both algorithmically and with specialized hardware, it remains difficult to deploy CNNs in embedded systems due to tight power budgets. Here we explore a complementary strategy that incorporates a layer of optical computing prior to electronic computing, improving performance on image classification tasks while adding minimal electronic computational cost or processing time. We propose a design for an optical convolutional layer based on an optimized diffractive optical element and test our design in two simulations: a learned optical correlator and an optoelectronic two-layer CNN. We demonstrate in simulation and with an optical prototype that the classification accuracies of our optical systems rival those of the analogous electronic implementations, while providing substantial savings on computational cost.

---

Quote for the day:

"Good leaders make people feel that they're at the very heart of things, not at the periphery." -- Warren G. Bennis

---

Daily Tech Digest - August 18, 2018

Cloud ERP isn’t a handshake deal – it’s a value extraction challenge

“Modern ERP” has the potential to change that, but I believe customers, partners, and vendors must go all-out to get there – long after go-live is over, and the handshakes and smiles are in the rearview. Virtually all the cloud ERP use cases I’ve conducted are small to midmarket. That doesn’t mean these benefits can’t extend to large enterprise, but we should acknowledge that the problem of cleansing and integrating data to achieve a single source of the truth is much tougher as companies get bigger. As for the obvious/looming question: “Can you do this with on-premise ERP?” Yes, I believe you can. “Cloud” in this case is really just a placeholder for something wonky, like: “standardized and easily upgradeable ERP systems on a platform you can easily extend and integrate via open standards.” In other words, “modern” is more about data accessibility and, yes, scalability than where the software lives. However, custom coding the heck out of on-premise systems looms as a catastrophic temptation.

Office 365 outage: Sign-in issues blight users across Europe and the US

Pete Banham, cyber resilience expert at Microsoft-focused email management company Mimecast, said enterprises need to ensure resilience is built into their Office 365 deployments to ensure their businesses can keep operating during downtime incidents. “IT teams and frustrated users struggled to remain productive [on Thursday] as they were unable to log in and use Office 365 services,” he said. “Due to operational dependency on the Microsoft environment, businesses are putting themselves at risk of being affected by commonplace outages such as this. “Anyone outsourcing a critical communication service like cloud or hosted email must consider a cyber-resilience strategy that assures the ability to recover and continue with business as usual.” Apart from fielding queries about yesterday’s outage, the Microsoft Office 365 Twitter account was also having to respond to questions about a recurring subscription activation issue that Mac users of the software have been encountering for a few weeks.

Women in Tech 2018: What the Statistics Tell Us

PwC recently looked at the role of women in tech in the UK. In STEM fields, women accounted for only 15 percent of employees. More distressingly, there are few signs that this number will rise without extra action, as only 15.8 percent of undergraduates in STEM fields are women. Leadership examples can be key toward encouraging more participation among women, yet only five percent of leadership positions in STEM fields are held by women. In PwC’s report “The Female Millennial — The New Era of Talent,” researchers found that young women want to work with employers with a strong history of inclusion, diversity, and equality. Many women see the low number of women in tech and choose to enter other fields. The PwC reports highlights the problems these disparities create for UK companies. Two-thirds of CEOs in the UK claim to have difficulty hiring people with digital skills, a numbers that significantly exceeds the 43 percent of CEOs who claimed the same in the US and the 24 percent of CEOs in China.

How the Boston Children’s Hospital Is Innovating on Top of an Open Cloud

“The open cloud model is really advantageous for companies to innovate at the infrastructure level, but even to manage it,” says Krieger, who has seen services like those of Boston Children’s Hospital’s radiology programs built on top of it. “There’s a huge cost in running experiments. When you’re a not-for-profit university, it’s even greater, with a huge capital investment to start anything on a cloud at sufficient scale.” Krieger contends that it’s always cheaper for universities — at least in the United States — to purchase their own equipment than to rent servers on the private cloud. But he said that “In the end the success will only come from something like the open cloud, if industry participates in it.” Krieger says only an aggregate of all these universities could inject the necessary capital investment to start out a cloud at sufficient scale to allow for experimentation on top of it. Plus, he says that universities have a long history of standing up large-scale computational infrastructure long before today’s public clouds.

Should Staff Ever Use Personal Devices to Access Patient Data?

HIPAA violation or not, is it ever a good idea to allow healthcare employees to use their personal smartphones to access patient records? What about during a crisis situation? "These are really tricky issues," says privacy attorney Kirk Nahra of the law firm Wiley Rein. "You have to think about two paths on these questions - how is this situation [involving employee smartphone access to patient records] handled normally, and what - if anything - can be done differently in an emergency situation? Both questions essentially involve thorough thinking as part of an overall risk assessment process." Companies of all kinds - in healthcare and otherwise - have to figure out how to manage the fact that data can be transmitted to mobile devices, whether personal or employer based, Nahra says. "What a company allows and what it does not allow - and how it 'prevents' what it doesn't allow - is a critical component of any risk assessment today." Companies have to develop a strategy that balances appropriate risks as well as business needs, the attorney adds.

Software Quality Is a Competitive Differentiator

The digital world is creating intriguing challenges related to software quality. These extend beyond the sheer volume of code that’s required to run systems. For instance, UI/UX has emerged front stage center — particularly as apps have proliferated. Maturing technologies, such as augmented reality and virtual reality, have introduced new challenges. The takeaway? It's no longer acceptable to view UI/UX testing as a traditional, commoditized function — a quality experience is paramount. There are other challenges, too. As the IoT matures and grows, there's a need for innovation in testing. The variety and number of edge devices is exploding, and all of this introduces enormous QA challenges. Ensuring that software performs adequately and meets user requirements is critical. The need for service level agreements between service providers and consumers has never been more important. Artificial intelligence changes the testing landscape as well. It can take over some human roles.

The Consumerization of Enterprise Architecture: Everyone’s an Architect!

In the longer term, we are seeing a more profound shift in the role of architecture: positioning enterprise architecture not as a high-level, top-down operating discipline, but as the connective fabric between different types of change. Within the enterprise, this means that everyone will have a role in the development and evolution of the architecture in some way. Essentially, everyone becomes an architect!  Of course that doesn’t mean that every employee should go on a TOGAF course. Rather, you should provide everyone with the instruments that let them see what the options and effects of local or global changes might be and act accordingly. All these changes can then align with the shared enterprise vision and work together in concert, ranging from the result of a local process improvement or the priority of some agile user story to the impact of a merger or the effect of new regulatory requirements on your business model.

What Harry Potter Teaches us about Constant Vigilance and Insider Threats

“Constant vigilance” is sage advice for businesses too. With the threat of malicious insiders, undetected attackers moving around a network and other risks to mitigate, there is no “one-and-done” solution in security. Industry research such as the 2018 Verizon Data Breach Investigations Report (DBIR) helps the collective community keep an eye on trends and glean insights from lessons learned to get ahead of potential vulnerabilities before they become problems. A few key trends identified in the report caught my eye. While the report indicates that 78 percent of people didn’t click on a single phishing link all year (which is promising news), phishing and pretexting remain popular attack methods. Attackers only need one employee to click a link and open the door for the attacker to enter. Once an attacker has stolen credentials, they can manoeuvre within the network, escalating levels of privilege until they have the access they need to wreak the havoc they intend. The report’s emphasis on education—making sure that employees are trained to identify and report social attacks such as phishing—is one important line of defence. Knowing what to look for is half the battle.

Why Your Approach to Cybersecurity Needs to Be Proactive Rather Than Reactive

One of the major challenges facing businesses is the increasing sophistication of hackers. Ever-evolving hacking tactics and techniques, as well as more readily available hacking tools, has made it possible for cyber criminals to circumvent traditional defenses such as firewalls and anti-virus software. This leads to a further problem where attacks are becoming harder to detect. In fact, it is common for businesses to be breached without even knowing it. According to the Ponemon Institute, it takes an average of 191 days for a business to detect that it has been hacked. To counteract these problems, it is important to gain visibility of what activity is happening across networks and endpoints in order to be able to detect malicious activity in its infancy before it spreads. You need to assume that your business will be breached at some point and have appropriate monitoring controls and procedures in place to mitigate the risks.

Security architecture for the mobile ad hoc networks

Security in mobile ad hoc networks (MANETs) has been an actively researched topic for the several years. As opposed to wired networks, MANETs have dynamic topology, limited resources, limited bandwidth and are usually deployed in emergency scenarios outside, where landscape plays important role. MANETs are susceptible to insider and outsider attacks and bring new security challenges which were not present in the wired networks. The most important difference is that every node in MANET acts as a router and routes traffic throughout the network. Compromising one node can hugely affect network performance. In this paper, we present our security architecture for MANETs which secures important aspects of the network. We bring trust model into the network and nodes are secured by different mechanisms tailored specifically for the use in distributed environment.

---

Quote for the day:

"The key to being a good manager is keeping the people who hate me away from those who are still undecided." -- Casey Stengel

---

Daily Tech Digest - August 17, 2018

Android 9 Pie review: Google gets more thoughtful

Android 9 Pie is a massive, AI-infused software update, and it’s generally a pleasure to use. The handful of features made possible by machine learning are helpful additions, but there’s much more to Pie than that. Google has done a lot nipping and tucking to make Android itself easier to use, and some system-level changes give the platform room to grow in some important ways. Not everyone will love the changes Google made here -- power users in particular -- but overall, it’s a thoughtful, worthy update that will only get better when even more features arrive later this year. That's all because Google built Android 9 Pie to pay more attention to what you do, and to help out accordingly. That suggestion wasn't random: It was based on behavior that Android picked up on. Beyond that, there are plenty of important system-level improvements and a handful of tweaks that make Android more pleasant to use. There's still plenty of work to be done, but after using the update (in its various forms) for a while, I can confidently say Google's efforts are paying off.

Improving testing architecture when moving to microservices

Before Gamesys rethought its testing architecture, its software development was split across client-side and core development teams. The client team focused on front-end application development, while the core team focused on back-end services. However, these separate teams often managed the same swaths of code, which caused a variety of communication and testing challenges. The back-end application was a monolith. If someone on the client team sought to add functionality, such updates would have to integrate with services on the monolith. Bugs sometimes required fixes on the back end. "As the situation got more complex, the synchronization between the client and core teams would get sloppy," Borys said. The overlapping responsibility and complexity of a monolithic architecture led to release delays. Gamesys shifted to a microservices approach, which made it easier to decouple application functionality across the entire stack.

Increasing Security with a Service Mesh

In some cases, security is an afterthought, and we try to shoehorn it into our apps at the last possible moment. Why? Because doing security right is hard. For example, something foundational like "encrypting application traffic" should be commonplace and straightforward, right? Configuring TLS/HTTPS for our services should be straight forward, right? We may have even done it before on past projects. However, getting it right in my experience is not as easy as it sounds. Do we have the right certificates? Are they signed by the CA that the clients will accept? Are we enabling the right cipher suites? Did I import that into my truststore/keystore properly? Wouldn't it just be easy to enable the “--insecure” flag on my TLS/HTTPS configuration? Mis-configuring this type of thing can be extremely dangerous. Istio provides some help here. Istio deploys sidecar proxies (based on Envoy proxy) alongside each application instance that handles all of the network traffic for the application.

Australia appoints information and privacy commissioner

"Falk has extensive experience delivering the functions of independent regulators and a track record of working across Commonwealth and state agencies, business, and the community in law, policy, and education," Porter said on Friday. "The commissioner role is critical to helping ensure the privacy of Australians, particularly in the online environment." Australia's Notifiable Data Breaches scheme requires organisations covered by the Privacy Act 1988 to notify individuals whose personal information is involved in a data breach that is likely to result in "serious harm" as soon as practicable after becoming aware of a breach. During Falk's tenure as acting privacy commissioner, the Office of the Australian Information Commissioner (OAIC) opened an investigation into the Facebook-Cambridge Analytica improper use of data after revealing that more than 311,127 Australians were caught up in the scandal. The investigation, kicked off in April, will consider whether Facebook breached the Privacy Act. "All organisations that are covered by the Privacy Act have obligations in relation to the personal information that they hold," Falk said at the time.

IoT on the edge: revolutionary use cases create new privacy concerns

Emerging use cases for IoT and video are even more concerning. Retailers have been piloting systems that identify shoppers when they enter a store by sensing their mobile devices. Advancements are allowing retailers to use security camera footage to capture shoppers’ faces and identify individuals in real time. From here, retailers can identify a shopper’s age, gender, ethnicity and other visual attributes; track their movements, actions and sentiments throughout the store; and create and compile shopping profiles based on this and other data. In another innovative use case, artificial intelligence-assisted video-monitoring software can simultaneously process footage from dozens of security cameras and identify abnormal and potentially criminal or dangerous situations, including theft or violence. Using the technology, one university in Australia has been able to thwart a variety of criminal events from bike theft to assault during if not before the crimes occur.

As CTO you are responsible for both engineering and product

To succeed, CTOs need to have a deep understanding of the market they operate in and a broad knowledge across lots of different technologies. “The ability to go very deep very quickly on any single technology,” is essential, said Weinberg. What’s the best way to understand the market? According to Weinberg, the best way is to surround yourself by people who can feed you key information and insights. “That way you can distill information into patterns and opportunities, and act upon them. In my case, the person I rely on for this is my co-founder and CEO.” ... This is slightly paradoxical, as engineers and product people are typically very different types of people. “You can reason with engineers using cold logic, and most of the time there is quantifiable right or wrong answer,” said Weinberg. “With product design, there is typically no strict right or wrong answer. Everything needs to be debated subjectively, alternate theories need to be compared and decisions often need to be made based on intuition.”

How to protect your privacy in Windows 10

You can turn that advertising ID off if you want. Launch the Windows 10 Settings app (by clicking on the Start button at the lower left corner of your screen and then clicking the Settings icon, which looks like a gear) and go to Privacy > General. There you'll see a list of choices under the title "Change privacy options"; the first controls the advertising ID. Move the slider from On to Off. You'll still get ads delivered to you, but they'll be generic ones rather than targeted ones, and your interests won't be tracked. ... Wherever you go, Windows 10 knows you're there. Some people don't mind this, because it helps the operating system give you relevant information, such as your local weather, what restaurants are nearby and so on. But if you don't want Windows 10 to track your location, you can tell it to stop. ... You can turn it off on a user-by-user basis as well — so if you have several people with different accounts using the same device, they can each turn location tracking on or off. To turn location tracking on or off for any single account, sign into the account, head back to this same screen and, instead of clicking Change, go to the slider beneath the word "Location" and move it to On or Off.

The road to effective bot development in DevOps environments

The important thing to understand is that repository webhooks provide the means by which bots can interact with a source code repository and perform instructive validation as part of their response behavior. There's already a good deal of work to do with repository bot development. Probot provides a framework that simplifies bot writing by adding a wrapper around the GitHub webhook architecture. The framework makes programming easier. Kore.ai is a bot development tool that allows developers to create fairly powerful bots using a low-code, graphical interface. A Kore.ai bot can be integrated with Bitbucket, GitHub and GitLab. Tools such as these will make bot development a lot easier. However, just because you can make a bot does not necessarily mean you have a useful bot. Believe me, the world does not need another confusing session with a chatbot. One bot that does one thing really well is better than an army of bots that cause confusion and frustration.

Avoiding the reference data quagmire

A company can put master data management (MDM) in place and make a tremendous effort to ensure its data quality. It can take pains to develop good data governance procedures and invest in leading-edge analytics technologies to make the most of its data. But any errors in its reference data can undermine all of these initiatives. Reference data is a non-volatile and slow-moving subset of enterprise data. It is often standardized by external bodies and businesses generally use the same reference data throughout their operations. Examples include country codes, SIC codes, currencies and measurement units. Typically, companies make use of several applications that feature drop-down lists of reference data, and may have various forms that are prefilled with certain reference data. To keep this data synchronized, some companies rely on reference data management or RDM.

New Trickbot Variant Touts Stealthy Code-Injection Trick

Upon execution, the malware sleeps for 30 seconds to evade sandboxes (by calling Sleep(30000)), and it then decrypts a dynamic link library file (named “shellcode_main,” which contains instructions that other programs can call upon to do certain things), which is then mapped to a buffer. Like older samples of Trickbot, researchers observed this newest variant make use of a technique called process-hollowing for unpacking. Instead of injecting code into the host program, Trickbot unmaps — or hollows out — legitimate code from target’s memory, and then overwrites the memory space with a malicious executable. First, a suspended process is created by the malware using CreateProcessW, which is then used to obtain a handle and copy the handle to a buffer, essentially re-reading and re-mapping that handle for various functions. These functions include unmapping the original malware module, creating a section to write the malicious code onto, mapping out the hollowed process, and resuming the suspended process and starting execution.

---

Quote for the day:

"If you find a path with no obstacles, it probably doesn't lead anywhere." -- Frank A Clark

---

Daily Tech Digest - August 16, 2018

U.S. Treasury: Regulators should back off FinTech, allow innovation

"Banks are very adept at innovating and experimenting with new products and services. The catch is the implementation of those products and services to ensure data privacy and security; it may take months or longer to prove data privacy and security efficacy," Steven D’Alfonso, a research director with IDC Financial Insight said. The federal agency, however, specifically identified a need to remove legal and regulatory uncertainties that hold back financial services companies and data aggregators from establishing data-sharing agreements that would effectively move firms away from screen-scraping customer data to more secure and efficient methods of data access. Today, many third-party data aggregators unable to access consumer data via APIs resort to the more arduous method of asking consumers to provide account login credentials (usernames and passwords) in order to use fintech apps. "Consumers may or may not appreciate that they are providing their credentials to a third-party, and not logging in directly to their financial services company," the report noted.

Are microservices about to revolutionize the Internet of Things?

Individual edge IoT devices typically need to be extremely power efficient and resource efficient, with the smallest possible memory footprint and consuming minimal CPU cycles. Microservices promise to help make that possible. “Microservices in an edge IoT environment can also be reused by multiple applications that are running in a virtualized edge,” Ouissal explained. “Video surveillance systems and a facial recognition system running at the edge could both use the microservices on a video camera, for example.” Microservices also bring distinct security advantages to IoT and edge computing, Ouissal claimed. Microservices can be designed to minimize their attack surface by running only specific functions and running them only when needed, so fewer unused functions remain “live” and therefore attackable. Microservices can also provide a higher level of isolation for edge and IoT applications: In the camera function described above, hacking the video streaming microservice on one app would not affect other streaming services, the app, or any other system.

Companies may be fooling themselves that they are GDPR compliant

A closer look at the steps taken by many of these companies reveals a GDPR strategy that it is only skin deep and fails to identify, monitor or delete all of the Personally Identifiable Information (PII) data they have stored. Such a shallow approach presents significant risks, as these businesses may be oblivious to much of the PII data that they hold and would have difficulty finding and deleting it, if requested to do so. They would also be unable to provide the regulatory authorities with GDPR-mandated information about data implicated in a breach within 72 hours of its discover—another GDPR requirement. To address these risks, companies need a holistic strategy to manage their data—one that automates the process of profiling, indexing, discovering, monitoring, moving and deleting all of their data as necessary, even if it’s unstructured or perceived to be low-risk. This will significantly reduce their GDPR and other regulatory compliance risks, while simultaneously allowing them to make greater use of the data in ways that create business value.

Banks lead in digital era fraud detection

Banks have recognised the need to have an omni-channel view of the different interactions and do their fraud risk assessments across the various channels, he said, because not only are cyber fraudsters working across multiple channels, but so do ordinary consumers, starting something on a laptop, continuing it on the phone and perhaps completing it through a virtual assistant while travelling in a car. “This is true for all consumer-facing businesses that have different channels through with they interact with consumers, and they should follow the banks’ lead and adopt an omni-channel approach to doing their risk profiling and gain from the visibility you have in each of the channels,” said Cohen. “In enterprise security, we were talking about breaking down channels years ago, and now we are starting to talk about it in the context of fraud, so that fraud assessments are carried out in the light of what is going on across all the available channels of interaction, especially as interactions become increasingly through third parties.”

Over 9 out of 10 people are ready to take orders from robots

Perhaps organisations are not doing enough to prepare the workforce for AI. Almost all (90 percent) of HR leaders and over half of employees (51 percent) reported that they are concerned they will not be able to adjust to the rapid adoption of AI as part of their job, and are not empowered to address an emerging AI skill gap in their organization. Almost three quarters (72 percent) of HR leaders noted that their organization does not provide any form of AI training program. Other major barriers to AI adoption in the enterprise are: Cost (74 percent), failure of technology (69 percent), and security risks (56 percent). But a failure to adopt AI will have negative consequences too. Almost four out of five (79 percent) HR leaders and 60 percent of employees believe that it will impact their careers, colleagues, and overall organization Emily He, SVP of Human Capital Management Cloud Business Group at Oracle, said: "To help employees embrace AI, organizations should partner with their HR leaders to address the skill gap and focus their IT strategy on embedding simple and powerful AI innovations into existing business processes."

Network capacity planning in the age of unpredictable workloads

When an application or a component of a distributed application moves or scales up, it needs a new IP address and capacity to route traffic to that new address. Every decision around workload portability and elasticity generates traffic on the data center network and the cloud gateway(s) involved. A workload's address determines how workflows through it connect, which defines the pathways and where to focus network capacity plans. To plan realistic capacity requirements, formal network engineers dive into the complex math of the Erlang B formula, and if you are inclined to learn it, check out the older book James Martin's Systems Analysis for Data Transmission. However, there are also easier rules of thumb. As a connection congests, it increases the risk of delay and packet loss in a nonlinear fashion. This tenet contributes to network capacity planning fundamentals. Problems ramp up slowly until the network reaches about 50% utilization; issues rise rapidly after that threshold.

Data recovery do's and don'ts for IT teams

Many, but not all, modern backup applications perform bit-by-bit checks to ensure the data being read from primary storage does in fact match the data being written to backup storage. Add that to your backup software shopping list, Verma advised. "The other thing I've noticed the industry's heading over to in the last couple of years is away from this notion of always having to do a full restore," Verma said. For example, you could restore a single virtual machine or an individual database table, rather than a whole server or the entire database itself. That's easy to forget when under pressure from angry users who want their data back immediately. "The days of doing a full recovery are gone, if you will. It's get me to what I need as quickly as possible," Verma said. "I would say that's the state of the industry." A virtual machine can actually be booted directly from its backup disk, which is useful for checking to see if the necessary data is there but not very realistic for a large-scale recovery, Verma added.

Web Application Security Thoughts

Web application security is a branch of Information Security that deals specifically with security of websites, web applications and web services. At a high level, Web application security draws on the principles of application security but applies them specifically to Internet and Web systems. Web application should follow a system for security testing. ... The company has to decide or project owner has to decide which remediation will take effective solution for the application. Because each application has different purpose and user groups. For financial application, you have to be more careful about the transaction and money stored in the database. So here, application and database both security is important. If we deal with card-data, then we must meet the PCI recommended guideline to mitigate or prevent fraud. In this case, owasp Top 10 vulnerabilities should be maintained properly. To protect the application now a days, not only you have to depend on only the application. You also have to depend on PCI recommended next generation firewall or waf. The next generation firewall will do the following things for an Web Application.

DDoS attackers increasingly strike outside of normal business hours

While attack volumes increased, researchers recorded a 36% decrease in the overall number of attacks. There was a total of 9,325 attacks during the quarter: an average of 102 attacks per day. While the number of attacks decreased overall – possibly as a result of DDoS-as-a-service website Webstresser being closed down following an international police operation, both the scale and complexity of the attacks increased. The LSOC registered a 50% increase in hyper-scale attacks (80 Gbps+). The most complex attacks seen used 13 vectors in total. Link11’s Q2 DDoS Report revealed that threat actors targeted organisations most frequently between 4pm CET and midnight Saturday through to Monday, with businesses in the e-commerce, gaming, IT hosting, finance, and entertainment/media sectors being the most affected. The report reveals that high volume attacks were ramped up via Memcached reflection, SSDP reflection and CLDAP, with the peak attack bandwidth recorded at 156 Gbps.

AIOps platforms delve deeper into root cause analysis

The differences lie in the AIOps platforms' deployment architectures and infrastructure focus, said Nancy Gohring, an analyst with 451 Research who specializes in IT monitoring tools and wrote a white paper that analyzes FixStream's approach. "Dynatrace and AppDynamics use an agent on every host that collects app-level information, including code-level details," Gohring said. "FixStream uses data collectors that are deployed once per data center, which means they are more similar to network performance monitoring tools that offer insights into network, storage and compute instead of application performance." FixStream integrates with both Dynatrace and AppDynamics to join its infrastructure data to the APM data those vendors collect. Its strongest differentiation is in the way it digests all that data into easily readable reports for senior IT leaders, Gohring said. "It ties business processes and SLAs [service-level agreements] to the performance of both apps and infrastructure," she said.

---

Quote for the day:

"It is a terrible thing to look over your shoulder when you are trying to lead and find no one there." -- Franklin D. Roosevelt

---

Daily Tech Digest - August 15, 2018

Servitisation: What it is and how it can transform companies

It’s an idea that has certainly gained impetus, thanks largely to the growing capability of the internet of things (IoT). As we keep hearing, there will be approximately 20 billion IoT devices in place by 2020, and that level of connectivity is giving organisations an incredible amount of data on how products and services are being used, when they are performing well or when they are showing signs of malfunction, and so on. Such intelligence is worth something and, in field service circles, it’s already being used to provide predictive maintenance on products – a sort of weird science whereby the technicians can foresee problems and fix them before they happen. That’s the theory, anyway. ... For some, these figures may not be particularly enlightening – value-added services have always been good for business. But this is more than just bolting on a few services to products. This is also about using the product as a catalyst for offering customers something bigger and more ongoing. 

Bitcoin's Taproot Privacy Tech Is Ready – But One Thing's Standing In The Way

Because bitcoin's ledger is public, it's obvious when someone uses one of these complex transactions. Taproot puts an end to that by making these transactions look the same as every other "boring payment," as Maxwell put it in the technology's announcement post. Yet, it can't do this without Schnorr, an upgrade to bitcoin's signature scheme that's been on developer's coding agenda for years. The signature scheme is supposed to be better than bitcoin's current signature scheme "in basically every way." And it enables Taproot because it allows signature data to be mashed together into one. "Schnorr is necessary for that because without it, we cannot encode multiple keys into a single key," Wuille continued in his presentation. ... But since developers have long been thinking about other enhancements, including those enabled by Schnorr, it's worth noting that Taproot isn't the only important change being considered. Towns thinks the privacy enhancement might be rolled in with a bunch of other upgrades going into bitcoin at the same time.

IoT Disruption Has Begun. And Retail Is Just the Start. When Will Your Industry Be Affected?

Recent research from Aruba found that 79 percent of retail companies surveyed said they will have internet of things (IoT) technology in their businesses by next year. This is good news for consumers, considering that Aruba also found that IoT improves the customer experience in 81 percent of cases examined. The IoT’s impact is also more immediate than that of other consumer tech. While virtual reality (VR) and artificial intelligence (AI) may provide in-depth knowledge and perspective, their technologies are at least one step removed from what someone is actually experiencing in the real world. IoT connectivity, in contrast, allows customers to enhance their experiences in real time, making it the most direct way for businesses to improve their customer experience. ... If an innovation costs too much to implement, the increased cost will offset the improvements a company has made in the customer experience.

The Sensors That Power Smart Cities Are A Hacker's Dream

"There are people out there who aren’t white hat hackers who have had at least one of these exploits for ages and who knows what they’ve done with it," Savage says. "This is something that people have been looking into." Industrial control hacking has recently become a major focus of nation state attackers, for instance, with Russia taking the most prolific known interest. State-sponsored Russian hackers have probed US grid and election infrastructure and have wreaked havoc overseas, causing two blackouts in Ukraine and compromising payment systems in the country with malware campaigns. As the risk grows worldwide, US officials have increasingly acknowledged the vulnerability of US infrastructure, and agencies like the Department of Homeland Security are scrambling to implement systemic safeguards. Cities will continue to invest in smart technology. Hopefully as they do, they'll appreciate that more data will often mean more risks—and that those vulnerabilities aren't always easy to fix.

5 Trends For The Truly ‘Intelligent,’ Data-Driven Business

Opportunities to push intelligence into the physical world go way beyond smart toasters, fridges, or door locks. It’s not just the Internet of Things but the “Internet of Thinking.” The next generation of intelligent systems will transform industries, using techniques including collecting sensor data from distributed utility grids, scheduling predictive maintenance of industrial equipment, monitoring workforce safety, supporting healthcare patient engagement and research, and creating new business models for insurance. All these initiatives rely on the efficient storage, movement, and analysis of data. Global revenue for big data and analytics practices in 2017 were $151 billion, up nearly 12% from the year before. And companies around the world are betting big on advances in data-hungry technologies, with AI investments in 2017 at more than $12.5 billion and IoT at more than $800 billion, according to IDC. These investments will result in more than fast and efficient businesses, concludes Accenture.

How smart contact lenses will help keep an eye on your health

One of the main problems with such diabetic contact lenses is wearability. Creating a smart contact lens means putting rigid, non-see-through components onto a lens that will be in direct contact with the eye. The eye might be clever, but it's also sensitive: whatever touches it over a long period needs to be gentle enough not to damage the delicate cornea, while not obstructing the vision of the wearer. It's no mean feat, but the Purdue University researchers have come up with a new approach that they hope will open the doors to the long-delayed commercialisation of smart contact lenses. Using a new process called interfacial debonding, Lee's team were able to separate thin-film electronics from their own wafer substrate, and then print them onto another material -- in this case, contact lenses. The glucose sensors that are attached to the contact lens are covered by a "thin layer of transparent, biocompatible, and breathable polymer", according to Lee, meaning the lens won't irritate the eye or interfere with the normal vision of the wearer.

Why Even AI-Powered Factories Will Have Jobs for Humans

Just as the internet revolution ushered in completely novel jobs — for example, web designer and search-engine optimization engineer — so will the new era of AI. Telsa, for instance, is recruiting robot engineers, computer vision scientists, deep learning scientists, and machine learning systems engineers. And the company has also posted job listings for more-esoteric AI specialties such as a battery algorithms engineer and a sensor-fusion object tracking and prediction engineer. For the former position, the requirements go beyond knowledge of lithium-ion cells (cell capacity, impedance, energy, and so on) to include expertise to develop algorithms for state-of-the-art feedback control and estimation. Moreover, it’s not just technology-related jobs that are being reimagined with AI. In fact, as Tesla and other companies have discovered, AI technologies are having a profound impact throughout the enterprise, from sales and marketing, to R&D, to back-office functions like accounting and finance.

Cisco Patches Its Operating Systems Against New IKE Crypto Attack

According to Cisco, this flaw "could allow an unauthenticated, remote attacker to obtain the encrypted nonces of an Internet Key Exchange Version 1 (IKEv1) session." "The vulnerability exists because the affected software responds incorrectly to decryption failures. An attacker could exploit this vulnerability sending crafted ciphertexts to a device configured with IKEv1 that uses RSA-encrypted nonces," Cisco said in a security advisory. "With our attack you can do an active online attack. But it is impossible to recover data from an already established IPsec session with our approach," Martin Grothe, one of the researchers behind this new attack has told Bleeping Computer via email. "IKE runs before IPsec, thus you can only attack the first Phase of IKE and if you succeed you are able to impersonate another IPsec endpoint or be an active man-in-the middle and read/write data to that session," he added. With this in mind, applying the Cisco patches is highly recommended. Clavister, Huawei, and ZyXELL have also released security advisories here, here, and here, respectively.

Mimecast extends core email security to enable cyber resilience

Not all organisations appreciate the importance of email security, according to Bauer. “The more advanced and mature enterprise security teams understand how wide open an attack vector email is because of all the opportunities it presents to attackers, including malicious attachments and links, email compromise attacks and a range of social engineering attacks. “The most sophisticated security teams are looking for the best technologies and they know how to evaluate those technologies. But at the opposite end of the spectrum, there are those businesses who think the email threat is limited to spam and is not that serious, perhaps because they have not yet had a serious incident or they have seen some attacks, but think it is just ‘bad luck’ and do not really address the problem. “But this is something that will not go away and can be extremely costly to targeted organisations, so organisations that have not done so already should pay attention to shoring up their defences against email threats.”

What’s the role of the CTO in digital transformation?

A CTO needs to take on the role of the ‘bridge builder’ between the strictly technical components of a transformation strategy and how they can apply to people and process in the specific context of an organisation. ... The CTO has specific technological insight and therefore needs to be directly involved in helping the entire organisation identify where technical systems are simply obsolete and not fit for purpose so as well as being a bridge builder, CTOs naturally lead the charge when dealing with a technology-led approach. They must be able to explain where the value is in the application of technological change in context – too often we see visions that are de-contextualised from the reality on the ground. De-contextualised technological planning does not allow for realistic strategic planning. With visions of the ambitious but feasible in sight it is then the whole leadership team’s task to decide what course they are going to map out and to work together on the digital transformation journey.

---

Quote for the day:

"Entrepreneurship is neither a science nor an art. It is a practice." -- Peter Drucker

---

Daily Tech Digest - August 14, 2018

DevOps Experts Share Advice on Measuring Success

Once your DevOps team understands the metrics that connect your work to customer satisfaction, look at all the tools your DevOps team uses to deliver for your success metrics, says Rosalind Radcliffe, a distinguished engineer at IBM. "Many of the tools that people adopt as part of their DevOps transformation help generate data that can help drive numbers into these metrics," says Radcliffe.  Knowing what to measure and how to measure is half the battle, but what's possibly more important is knowing who needs to raise their hand to keep the DevOps team on track.  “The glib answer,” says Mann, “is that everyone should care [about DevOps success metrics].” However, the more specific answer Mann gives is leaders of application development or a project management office (PMO) or project manager (PM) for application development at larger companies. If you’re at a smaller company, Mann says a scrum master could be in charge of evaluating a DevOps team’s value stream and success metrics.

Does Facebook even need a CSO?

As sister publication CIO has reported, not every company needs a CSO. “It's not a person who needs a seat at the table,” Simple Tire CIO CJ Das said at a CSO event, “The topic needs a seat at the table.” Indeed, Flick says, “We expect to be judged on what we do to protect people's security, not whether we have someone with a certain title.” Pinterest and Tumblr don’t have CSOs. ... “The creation -- and I guess I would say appointment of any leadership role,” Coates notes, “also tells a story to the public, intentional or otherwise. In some regards, a chief security officer is also a central point to inspire confidence that this is something where they're putting a senior role at the table to tackle this issue.” That’s why, he says, New York State mandates all financial institutions have a CSO. “Because there is a challenge in security when the work is distributed amongst teams without a central owner, you can lose some of that experience and central visibility that a security organization brings to the table,” Coates explains, “A commitment to a high placed individual shows the company has kind of matured to that level and is thinking of it that way.”

Why you should shift from systems thinking to capability thinking

At a basic level, a capability is nothing more than an ability to perform a function. This capability could be unique in the industry, or relatively rudimentary, and in some cases a seemingly simple capability requires all manner of supporting capabilities to successfully realize it. For example, Amazon has a capability for same-day package delivery in most areas, a feature that's easy to articulate and understand, but it provides a significant advantage over competitors that don't have the logistical prowess to match Amazon. Generally speaking, most IT projects and policies start with a capability in mind. That capability might range from an ability to close financial reporting within a certain time frame to providing low-cost voice communications across geographies. However, most IT shops abandon this capability mindset once they select a suite of tools designed to deliver that capability. Suddenly, IT shifts from "providing a supply chain capability" to "we're an Oracle shop." Think of this like a carpenter going from saying "I'm a cabinet maker" to "I'm a Stanley 15-106A coping saw shop."

Why Choosing Python For Data Science Is An Important Move

Python has also become ubiquitous on the web powering numerous high-profile websites with Web development frameworks like Django, Tornado, and TurboGears. More recently, there are signs that Python is also making its way into the field of cloud services with all major cloud providers including it in some capacity in their offerings. Python obviously has a bright future in the field of data science, especially when used in conjunction with powerful tools such as Jupyter Notebooks, which have become very popular in the data scientist community. The value proposition of Notebooks is that they are very easy to create and perfect for quickly running experiments. In addition, Notebooks support multiple high-fidelity serialization formats that can capture instructions, code, and results, which can then very easily be shared with other data scientists on the team or as open source for everyone to use. For example, we’re seeing an explosion of Jupyter Notebooks being shared on GitHub with more than 2.5 Million and counting.

Malicious Cryptocurrency Mining: The Road Ahead

Scammers are even resorting to API abuse to freeze their victims’ browsers with the primary target being Chrome, followed by Brave and Firefox. Fraudsters that operate by providing fake tech support services mainly depend on gaining control of easily-exploitable business functions rather than on specific tools. Apart from exploiting security flaws in Bitcoin transactions, scammers are capitalizing on the long patch lag time for tech support cases to make large profits. In January of this year, processors were greatly impacted by vulnerabilities namely, Meltdown and Spectre. While Meltdown was exclusively used against Intel processors, Spectre could attack almost all processors. These vulnerabilities can be used to access people’s login credentials, banking information, and personally identifiable information. Notably, Microsoft, Intel, and other vendors have implemented patches, but there are issues that may need to be addressed in the long run.

Smart cities face challenges and opportunities

One constant across all projects is data traffic. Although replicating projects is a challenge, data collection and traffic variation among various city pilot projects, compared to full-scale deployments, varies greatly. In a recent RootMetrics by IHS Markit test of internet of things (IoT) technologies in Las Vegas, even at a full-scale phase, the network exhibited significant problems. In fact, certain IoT networks were unable to provide enough coverage to support even the simplest smart city applications. Due to the ever-increasing volume of sensors and their data, robust connectivity technology is a requirement for success. It is also often limited by a city’s budget. According to RootMetrics, coverage and reliability across the entire city is the key to launching any successful smart city programme. Digital security is another threat cities face when they try to implement smart city projects. As personal data gets uploaded into the cloud, it is often shared with digital devices, which, in turn, share the information among multiple users.

The Impact Of Artificial Intelligence On The (Re)Insurance Sector

AI and data will take us into a world of ex-ante predictability and ex-post monitoring, which will change the way risks are observed, carried, realized and settled. This fundamental change will lead to profound changes to market balances and equilibriums in the (re)insurance sector, and will completely redefine the dynamics of the insurance market, on both the supply and the demand side. Although (re)insurers might have an early advantage given that they have greater means and more tools and, for the time being, more data, AI will transform both sides of the insurance transaction in the long run. All parties to the insurance ecosystem, be they risk carriers, brokers, or even customers, will use AI tools. It is even likely that negotiations and discussions could take place between the AI systems of the different parties to the insurance contract! This might appear futuristic, but the idea of two AI systems dueling with each other and trying to “fool” each other already underpins generative adversarial networks (GAN) and the concept of adverse learning, which are used in research for video recognition and analysis

Web security gets a boost as TLS gets major overhaul

CloudFlare implemented one of those early versions of TLS 1.3 on its servers in 2016, but by the end of 2017 found most traffic still relying on TLS 1.2. ... Since then however web giants like Facebook have enabled TLS 1.3. Google enabled it in Chrome 65 -- the latest version of Chrome is version 68 -- but at the time had only rolled out support on Gmail. Firefox-maker Mozilla also announced that TLS 1.3 draft 28 is already shipping in Firefox 61, noting that one of its biggest improvements on the security front is that it cuts out outdated cryptography in TLS 1.2 that made attacks like FREAK, POODLE, Logjam and others possible. It will ship the final version off TLS 1.3 in Firefox 63, due out in October. "Although the previous version, TLS 1.2, can be deployed securely, several high profile vulnerabilities have exploited optional parts of the protocol and outdated algorithms," IETF engineers said in a statement. "TLS 1.3 removes many of these problematic options and only includes support for algorithms with no known vulnerabilities."

Samsung Announces New SmartThings Mesh Wi-Fi System

SmartThings Wifi works as a SmartThings Hub to serve as the “brain” of the smart home. Samsung’s open SmartThings ecosystem makes it easy to automate and manage the smart home with one hub and the SmartThings app. Compatible with hundreds of third-party devices and services, SmartThings enables users to expand their smart home with lights, door locks, cameras, voice assistants, thermostats and more. SmartThings Wifi delivers a simple, convenient 2-in-1 solution, offering whole-home automation out of the box. For corner to corner coverage, users can choose the right Wi-Fi configuration to fit their needs, from a home with multiple levels to a small apartment. Each SmartThings Wifi router has a range of 1,500 square feet, with the 3-pack covering 4,500 square feet, and users can expand coverage by adding additional mesh routers to the set-up. It is easily set-up and managed by the Android and iOS compatible SmartThings app.

Five key security tips to avoid an IoT hack

While layered security must remain the key priority, it is essential to understand that generic networking equipment and IoT devices are the weak link. They often have no continuous update program for firmware and software, low lifetime support, and insufficient computational power to host an antivirus or any other security agents. As practice shows, they are almost always left alone without proper supervision at consumer homes, network perimeter of small & medium business offices or branches of huge corporations. It is crucial to keep up with the evolving threat landscape. To do that, companies need to move away from traditional security approaches to the next generation solutions, especially security controls that are driven by artificial intelligence. The latter are capable to precisely map a network and identify all devices (even those that might be left alone somewhere on the edge of the network).

---

Quote for the day:

"When you have to make a decision, you can't wait for tomorrow to make it. You've got to make it now, and then if it's wrong, maybe tomorrow you can make a better one." -- Harry S. Truman

---