Daily Tech Digest - November 20, 2018


Making the banking business even more difficult, smaller fintech and large techfin companies are developing solutions that use insight and digital technology to improve the customer experience across product lines. These new competitors threaten legacy financial institutions of all sizes. ... Failing to respond could lead to the demise of less agile organizations. The good news is that many of the new technologies that are threatening the banking industry also present significant opportunities. In fact, those organizations that can leverage big data, advanced analytics and new technologies to improve the customer experience can build trust, loyalty and revenues that are the keys to success in the future. According to Dan Cohen, Senior Vice President, Global Financial Services and Insurance at Atos, “Banks are at a crossroads. Continuous finTech innovation and new technologies such as blockchain are disrupting the market. While it creates threats, it also opens multiple opportunities for financial services to reinvent themselves and thrive.”



How automating feature engineering can help data scientists

Deep Feature Synthesis is an automated feature engineering approach that, essentially, can be applied to many different types of data, ranging from marketing use cases to financial services use cases to healthcare use cases. The general principle behind it is we're trying to emulate how human data scientists would approach these problems. Deep Feature Synthesis works by having a library of feature engineering building blocks called primitive functions, and each one of these primitives is labeled with the type of data it can input and the type of data it can output. To give you a very simple example, you can imagine a primitive that took in a list of numbers and outputted the maximum value in that list. We have a library of many of these primitives and when we get a new data set, Deep Feature Synthesis looks at the specific column and relationships in the data and figures out which primitives to apply. That's how it can take the generic primitives and create specific features.


Managing cloud infrastructure post-migration — a CTO guide

Managing cloud infrastructure post-migration รข€” a CTO guide image
“This is something many businesses have quickly realised as they have continued along their deployment journeys. ...” “The skills gap has been an extremely prevalent issue in the cloud world for some time, with many businesses either lacking the budget to meet the substantial salaries that people with cloud skill sets now command, or simply unable to find people with the required level of technical expertise. This highlights the importance of finding the right partners so that businesses can hand off the most complicated jobs to a team of experts.” “However, it also highlights the need for better tooling for lifecycle management and operations. Lowering the barrier to entry, a solid choice of orchestration and management frameworks will take a pragmatic view on what’s needed to increase productivity around the day to day operations, and exceed expectations around even complicated processes such as upgrades of complex infrastructure software.”


Has storage become sexy?

The web-scale companies adopted this ethos with gusto and enterprise organizations soon began to follow suit. This march towards a commodity hardware dominated and software-driven world seemed inexorable. And then AI happened. Considering how long AI has been part of the public consciousness, it's almost funny that it snuck up on the entire tech industry. While industry leaders have been working on AI technologies for decades, until recently it didn't play a meaningful role in enterprise strategy nor was it a significant element of tech company go-to-market motions. And then, AI was everywhere. Because of its sudden rise as a top-of-mind issue, enterprise leaders were largely unprepared to deal with AI — and most critically, were ill-equipped to deal with the impact these new AI workloads would have on their newly cloudified architectures. As enterprises have begun working with AI, machine learning, advanced analytics, and other data- and resource-intensive workloads, they have found that commodity-based architectures built for traditional workloads buckle under the demands of these much more intense workloads.


Is Artificial Intelligence Dangerous? 6 AI Risks Everyone Should Know About


AI programmed to do something dangerous, as is the case with autonomous weapons programmed to kill, is one way AI can pose risks. It might even be plausible to expect that the nuclear arms race will be replaced with a global autonomous weapons race. Russia’s president Vladimir Putin said: “Artificial intelligence is the future, not only for Russia, but for all humankind. It comes with enormous opportunities, but also threats that are difficult to predict. Whoever becomes the leader in this sphere will become the ruler of the world.” Aside from being concerned that autonomous weapons might gain a “mind of their own,” a more imminent concern is the dangers autonomous weapons might have with an individual or government that doesn’t value human life. Once deployed, they will likely be difficult to dismantle or combat.


Code First: Girls teaches more women to code in UK than universities

“We are working very closely with, for example, the Institute of Coding,” she said. “We are very much working together to try and address this challenge because they also acknowledge that these numbers just aren’t good enough.” The social enterprise has announced a partnership with telecoms and broadband provider BT to teach cohorts of 30 women the skills they need for a job in tech in a free four-month course. The programme will teach women skills such as web development, Python programming, databases, test-driven development, agile development and cyber security, and participants will be given the opportunity to be interviewed for a job in a BT tech team. De Alwis said BT approached Code First: Girls to ask for help in training groups of women with the potential goal of hiring them, and she pointed out that the organisation helps companies feel confident in hiring outside their usual talent pool.


A closer look at HTC’s blockchain phone, the Exodus 1


The future of all of this is still very much up in the air. “I see us as the trusted Android,” Chen says, vaguely alluding to a future road map that finds HTC shifting its focus from hardware to software and IP. “We’re not talking about [monetization] right now, but we have some ideas.” While the devoted blockchain phone is largely a stepping stone toward incorporating that technology into more mainstream devices, there are plans to continue development on the line, as the Exodus 1 name optimistically implies. Chen explains that the company is working on follows that will be further distinguished from other handsets, though he’s not ready to discuss specifics. Presently HTC has between 20 and 30 engineers working on the blockchain project, bringing in expert in the space to educate them on the intricacies of the technologies. Event among those who are currently devoted to building out the device, this is all clearly very much a learning process.


The actual cost of downtime in the manufacturing industry

Of course, while gathering data is a key driver in solving problems and having a better understanding of downtime, just obtaining more data does not mean that an organization will know what to do with it. According to a recent study by Accenture, 60% of operators cite dealing with outcomes of data gathered as a major challenge. It is important to understand the reasons for collecting increasing amounts of data and how the data can be applied to improve condition-based monitoring and predictive maintenance, including: The ability to identify data-based patterns; Cognitive learning capabilities; Opportunities to leverage data in the Cloud for cross-organization/industry comparisons; and The ability to share data with trusted service providers for additional analysis and insights There is a significant opportunity to continuing carving down unplanned downtime through digitization, but as Deloitte notes in a recent report, “Simply ‘doing’ digital things will not make an organization digital.” Organizations need to go beyond just technology changes to truly embrace the benefits of digitization.


Supporting Multiple API Protocols with Thriftly


Bitfire Safety is a fictional fire protection company. Bitfire Safety provides dry pipe sprinkler system installations for customers that own cold-climate structures, such as parking garages. These systems are installed and configured with a command panel system interface and software that is used to locally monitor and test various aspects of the system. As part of a modernization initiative, Bitfire Safety is enhancing their services to include remote monitoring and issue remediation. They are first concentrating on the monitoring of the supervisory pressure switches. These switches are responsible for ensuring the proper system pressure and will pump or release pressure through a ball valve to maintain the correct levels. Through monitoring, Bitfire Safety can identify when pressures are tracking low or high. Low pressures could be indicative of an air compressor failing or a leak in the system; pressures tracking high could lead to damaging clappers and gaskets in the system, and could pose a safety risk in the event of a fire where open clappers would just bleed off system air rather than delivering water to a fire.


Building Human Interfaces With Artificial Intelligence

The main trick here is to allow humans to stay human. For decades computers were not exciting to use as they required us to change our ways. We needed to click the right buttons, in the right order to achieve a task. We needed to remember passwords and addresses and know which program to use for different tasks. In essence, we needed to get conditioned to software to use it and to learn how to interface with it before we enjoyed it. When you talk to Cortana, Siri or Google, you don’t need to use a keyboard or a mouse and you can ask questions like "what is the temperature today in the capital of Denmark?" without having to know what the capital is or tell the computer what "today" means. We have a lot of data already out there and computers can analyse the data without extra work from our side. That way we add the extra information the computer needs to give us the right results for the questions we ask.



Quote for the day:



"The final test of a leader is that he leaves behind him in other men, the conviction and the will to carry on." -- Walter Lippmann


Daily Tech Digest - November 19, 2018

Tips for protecting your data when losing an employee


The hard reality is that the majority of your departing employees will try to take company data with them, but there are proactive steps companies can take to ensure their data is safe after the staffers leave. You can’t protect what you don’t know you have. So, the first step is to perform a detailed inventory of your organization’s data and where it’s stored. This involves a thorough audit of the files within your company, which may include in-depth questionnaires for every employee or department. The end result should be a data “map” that details where all of your data is kept, who has access to which files, and when those files were created and modified. Regardless of a former employee’s motives for removing data from your business, if you confront them with evidence of the file-copying, many times they will simply delete or return the files to settle the matter without the need for further action.


Cyber crime: why business should report it as soon as possible

Data breach investigations reveal that some organisations can takeweeks or months to discover a cyber attack, but some cyber criminal activities are identifiable immediately such as distributed denial of service (DDoS) attacks, ransomware and other types of extortion. The message here is not to delay in reporting cyber criminal activity. “Report as soon as possible, particularly if it is a crime in action. We have much more chance of being able to help and of being able to catch the criminals responsible if the crime is reported to us while it is taking place,” says Hulett. The NCA recognises that it can appear to be a “cluttered landscape” for the businesses’ point of view in terms of how to go about reporting a cyber crime, particularly as many organisations will have to report personal data breaches to their data protection authority for the first time under the EU’s General Data Protection Regulation (GDPR) and new GDPR-aligned data protection laws in the UK.


What network pros need to know about IoT

it pros executives iot smart city machine learning ai city skyline metamorworks getty
When it comes to IoT, latency is the enemy. With thousands of devices spread across offices, factories, hospitals, and remote locations, more and more data and computing resources will reside on the edges of the network. "I always say, 'I don't care how fast your network is, you don't deploy your car's airbag from the cloud,'" says Shepherd. "Similarly, if I'm an operations person who needs real-time control over a manufacturing line, I want to move computing for process control and quality as close as feasible to the line, so I'm not relying on a wide-area network to respond." By 2022, Gartner estimates that 75% of all enterprise data will be generated and processed on the network's edge. And that raises a host of new data governance issues. Determining which data stays on the edge and what travels across the network can be complicated, says Kimberly Clavin, vice president of engineering for Pillar Technology, which designs IoT solutions for the automotive, healthcare, and retail industries.


These are the programming language features that really matter to developers

In general, developers want more of a safety net when creating complicated applications, writes Thomas Elliott, data scientist at GitHub. That desire for safety and predictability is evident in the rise of languages that support static typing, where developers can specify the type of each variable, allowing many errors to be flagged when code is compiled. "With the exception of Python, we've seen a rise in static typing, likely because of the security and efficiency it offers individual developers and teams working on larger applications," writes Elliott, who adds there is also an increased appetite for languages that make it easier to build stable multi-threaded applications. "TypeScript's optional static typing adds an element of safety, and Kotlin, in particular, offers greater interactivity, all while creating trustworthy, thread-safe programs." Among the fastest-growing languages, Elliott identifies a common theme of modern, more fully featured languages that can interoperate with older languages, and that, in some cases, are starting to supersede them.


CarsBlues Bluetooth attack Affects tens of millions of vehicles

CarsBluesร‚ Bluetooth attack
A new Bluetooth hack, dubbed CarsBlues, potentially affects millions of vehicles, Privacy4Cars warns. The CarsBlues attack leverages security flaws in the infotainment systems installed in several types of vehicles via Bluetooth, it affects users who have synced their smartphone to their cars. Privacy4Cars develops a mobile app for erasing PII from vehicles, according to the firm tens of millions of vehicles could be affected worldwide, and it is an optimistic estimate because the number could be much greater. The riskiest scenario sees drivers who sync their phones to vehicles that have been rented, borrowed, or leased and returned. Their data might be exposed to attackers that can use them for various malicious purposes. “The attack can be performed in a few minutes using inexpensive and readily available hardware and software and does not require significant technical knowledge.” reads the post published by the company. “As a result of these findings, it is believed that users across the globe who have synced a phone to a modern vehicle may have had their privacy threatened. It is estimated that tens of millions of vehicles in circulation are affected worldwide, with that number continuing to rise into the millions as more vehicles are evaluated.”


IoT Home Assistant API for Raspberry Pi

Home Assistant is an open-source home automation platform running on Python 3. It is used to track and control all devices at home and has many utilities to help us with automation control. You can check at Home Assistant blog how dynamic is the community with constant updates and upgrades for the platform. We expect to interact Home Assistant with the embryo API available at the IoT.Starter.Pi thing device. There are many ways to install Home Assistant, since it supports many different hardware platforms. This project focus on Haspbian, a disk image that contains all needed to run Home Assistant on a Raspberry Pi. The Haspbian image is built with same script that generates the official Raspbian image's from the Raspberry Pi Foundation. The same tool used to create the raspberrypi.org Raspbian images was forked from home-assistant/pi-gen repository. The final stages were ripped off and a new stage-3 was replaced to install Home Assistant. With the exception of git , all dependencies are handled by the build script.


Can Artificial Intelligence Improve Learning?


Hard data can indeed help identify learning challenges for individual students. Virtual reality can enliven a science lesson visually, and for engineering students, in particular, simulate and break down connections between moving parts in ways that even the most imaginative teacher cannot put together in a lecture. Engineering education in India is being criticized for churning out unemployable graduates in large numbers. Most of them seem to lack communication skills and find themselves at a loss when asked to solve practical challenges in the workplace. Technologies such as Artificial Intelligence and Virtual Reality can help monitor and identify personal preferences and aptitudes. And they can do this much faster than any human, providing the opportunity for much-needed intervention at exactly the stage at which it is required. That is the crux of providing students with a complete vocational experience and making their education relevant to what is required by industry.


A quick guide to important SDN security issues

Traditional network security vulnerabilities are bad enough without adding SDN security issues to the mix. But, as organizations deploy SDN, they risk exposing their networks to new types of threats and attacks, especially if they don't have proper plans in place. A prevalent concern with SDN security focuses on the SDN controller. The controller contains and provides intelligence for the entire network. Whoever has access to the controller has control of the network. This means organizations need to configure policies and design the network to make sure the right people are in charge. Here are four useful tips to help organizations avoid detrimental SDN security issues and get the most from their SDN deployments. ,,, The SDN controller is a vital part of the security discussion, because successful attacks on the controller can totally disrupt network operations, he said. To combat these attacks, organizations can configure role-based authentication to make sure the right people get access to applications and data. 


How open source makes lock-in worse (and better)

opensourceistock000038083056mindscanner.jpg
Open source creates lock-in? Surely not! Well, surely yes, at least in the enterprise. Why? Because enterprise computing doesn't like change. As hard as it is to get an enterprise to embrace new technologies, once they do, they tend to stick around forever. Remember when mainframes died a decade or two back? Except, of course, they didn't die: Enterprises continue to spend billions each year on old-school tech that had its day back when Flock of Seagulls was still on the radio. Fast forward to Amazon vs. Oracle. Amazon, with a multi-billion dollar database business of its own that directly competes with Oracle's, had every reason to move off the legacy database vendor. And yet it didn't. Year after year, Amazon wrote massive checks worth tens of millions to Oracle, its stated enemy. Finally, on November 9, AWS chief Andy Jassy said that Amazon's consumer business finally weaned itself off Oracle's data warehouse for Amazon Redshift, and was getting close to moving all other applications to Amazon Aurora and DynamoDB.


Robots and the NHS: How automation will change surgery and patient care

Surgeons are one of the first medical specialties to welcome their robot overlords: in the NHS, surgical robots can already be found assisting with a range of operations, including urology, colorectal, and prostate procedures. These robots -- which are made up of a set of arms wielding cameras, lights and medical instruments -- are controlled by a surgeon sitting at a console who is then able to control the actions of the robot's arms with great precision. Using robots means surgeons can make smaller incisions, reducing blood loss and pain for patients, which can mean a faster recovery time and a shorter stay in hospital. That's good news for the patients, who can get back to their normal life quicker, but also good news for the NHS, which has fewer infections and complications to deal with, and sees beds freed up faster. Another attraction is that these robots can reduce the physical burden on surgeons -- bending over patients for several hours a day over years is not kind on the back -- which can allow clinicians to carry on operating for longer.



Quote for the day:


"Honor bespeaks worth. Confidence begets trust. Service brings satisfaction. Cooperation proves the quality of leadership." -- James Cash Penney


Daily Tech Digest - November 18, 2018


“Before integrating any new technologies into American life, we must be absolutely sure that those innovations are imbued with our values,” Democratic Sen. Edward Markey, who sent a letter to Amazon CEO Jeff Bezos expressing his concern about the company's facial recognition services, told BuzzFeed News. “I am not convinced Rekognition passes that test.” By contrast, decision-makers from Orlando seem prepared to go full steam ahead with tests of Amazon’s technology, though emails between city officials and Amazon reveal there were setbacks. Sgt. Eduardo Bernal, a public information officer for the city’s police department, told BuzzFeed News that Amazon provided no hands-on training on Rekognition, just standard documentation. Test results were flawed. There were miscommunications, including an embarrassing misstep that required an apology from Amazon — to the public and to Orlando PD.


Alphabet stops its project to create a glucose-measuring contact lens for diabetes patients

Google smart contact lens to measure glucose levels in tears.
"Our clinical work on the glucose-sensing lens demonstrated that there was insufficient consistency in our measurements of the correlation between tear glucose and blood glucose concentrations to support the requirements of a medical device," the company said. Verily made a big splash when if first launched the program in 2014, while it was still known as Google Life Sciences. The company partnered with Alcon, Novartis' eye-care division, on the project. However, it's been quiet about the project in the past few years, leading to speculation that it was winding down. Verily said it did have some success with the experiment in a controlled environment, but not in actual tests because of the dynamic environment of the eye. It's a problem that goes beyond Verily. Billions of dollars have been spent on research and development, but companies across both technology and life sciences have struggled. There's even a book dedicated to documenting these failures titled "the pursuit of noninvasive glucose: hunting the deceitful turkey."


Is the Ransomware Scare Over?

The primary emphasis in ransomware preparation, other than user education and perimeter defense, is backups. In response to ransomware, IT needs to protect all data more frequently including file servers and endpoints. To some extent, backing up all data is data protection 101, but in our experience, most organizations, except for critical applications, back up most of their data once per night. Ransomware makes once per night backups obsolete. While the public announcement of ransomware attacks may be down, the “creativity” of these attacks is on the rise. According to Proofpoint, the number of ransomware variants is up 30X. The variations make it harder for perimeter defense solutions to detect them. Some of the variants specifically attack components of the data protection process like protected data stores and backup configuration files. Also, some malware strains now sit idle, instead of immediately executing their encryption attack. This ensures that the malware file is backed up repeatedly by the data protection process.


Why tech-enabled go-to-market innovation is critical for industrial companies

Why tech-enabled go-to-market innovation is critical for industrial companies--and what to do about it
While most industrial companies have come to terms with the need to make more strategic use of technology,1 they are often unsure of how to proceed or are focused on the wrong initiatives, resulting in halting action and a failure to build significant value. On the other hand, those companies that move quickly and decisively to transform their go-to-market channels, models, and culture through technology should be able to unlock substantial value: top quartile B2B players generate 3.5 percent more revenue and are 15 percent more profitable than the rest of the B2B field. Our detailed analysis has identified a pool of $74 billion to $298 billion in revenue growth that could be tapped through enabling technology in sales (Exhibit 2). The value comes primarily through new customer experiences, refined pricing, and enhanced selling processes. ... Our experience in working with dozens of industrial companies has helped to identify where the main source of value is across the four main steps of the selling process: the presales stage, the sales process, the transaction itself, and IoT-enabled selling


Big banks are not feeling the FinTech heat (yet)

It’s the push-pull syndrome. FinTech apps push a lot of information to me because they’re intelligent; big bank apps force me to pull the information because they’re dumb. FinTech apps can predict and present my financial lifestyle to me intelligently; big bank apps show me what I’ve spent in a traditional debit and credit ledger that has no insight at all. Or that’s my experience of two of the most frequently used big bank apps. They’re pretty dumb. Meantime, my experience of some of the most popular FinTech apps is the opposite. ... Top of the fintechs is established payments unicorn TransferWise, with just 0.5 per cent of the visitor share in the most recent week. Revolut, which recently announced it had signed up 1 million UK users, has just 0.3 percent of the market share, while Starling Bank has 0.2 per cent. Traditional banks even dominate the new downloads list, though Starling manages to sneak into the top 10, with 4.6 per cent of downloads in the most recent week.


How Do HIPAA Regulations Apply to Wearable Devices?

HIPAA regulations could potentially apply to new technologies used by covered entities and business associates.
Wearable devices and how HIPAA regulations potentially apply is a very difficult issue, Spencer said. “There is a lot of ambiguity about exactly where HIPAA is triggered and where it's not,” she stated. “The only real clarity is where a company that offers a wearable, or a mobile app that collects health information, where that arrangement is just directly between the device maker and the individual. Or it’s between the app maker and the individual, and there's no covered entity or business associate involved. Then there's no application of HIPAA, that's clear.” HIPAA regulations only apply to covered entities and business associates, Spencer reiterated. This includes health plans, healthcare clearinghouses and certain healthcare providers that engage in certain payment and other financial transactions. Business associates are those organizations that specifically have access to health information to provide a service or perform a function on behalf of a covered entity, she noted.


Are We Nearing The End Of Hadoop And Big Data?

So, it’s no longer just Hadoop. Cloudera Chief Executive, Tom Reilly, admitted as much, in his comments after the merger: “Hadoop has evolved so drastically that we don’t even mention it anymore.” This analysis provides an overview of the different options available to enterprises instead of using Hadoop. And you have to wonder, if this trend continues, what the future will be for the technology. As the author writes, “The center of gravity has moved elsewhere.” What this development represents is how big data is now becoming just data. Every organization, large and small, now has access to an unparalleled quantity and quality (and more current/real-time) data than at any time in history. They have more technological options to build services using this data — and this is important because different use cases (using different types of data) mean it’s possible to choose the right technology for what you need. For example, there are numerous open-source options, as well as proprietary machine learning platforms. Many of these make the 10-year-old Hadoop technology look dated.


In bigger crackdown of crypto abuses, SEC goes after unregistered coin offerings

The U.S. Securities and Exchange Commission in Washington, D.C.
The settlement comes a week after the agency notched another "first," setting charges that a crypto firm called EtherDelta was operating as an unregistered exchange. The cases underscore the SEC's insistence that the relatively new digital financial products must follow traditional securities rules. "We have made it clear that companies that issue securities through ICOs are required to comply with existing statutes and rules governing the registration of securities," Stephanie Avakian, the SEC's co-director of enforcement, said in a statement. "These cases tell those who are considering taking similar actions that we continue to be on the lookout for violations of the federal securities laws with respect to digital assets." On Thursday, federal prosecutors in New York announced a guilty plea by a man who defrauded investors with two cryptocurrencies he founded during the initial coin offering boom.


All Roads Lead to Liquidation: Crypto Companies Cash in Big

All Roads Lead to Liquidation: Crypto Companies Cash in Big
The rising trend of acquisition could be the result of simple, sudden opportunity. Of the Bitstamp acquisition, CEO Nejc Kodriฤ, said that “the sale wasn’t planned. There was no active effort to go around and solicit buyers. The vibrant industry last year sparked potential interest from buyers to make a footprint in the industry. We started to get approached by buyers in the middle of last year.” Indeed, acquisition is a swift, simple way for a company’s owners to profit while maintaining some control over the company’s operations. Kodriฤ still holds a 10 percent stake in the company; Damian Merlak, his co-founder, sold all of his 30 percent stake. Generally speaking, “the benefits of [acqisition] include receiving valuable intellectual property and the talented employees of the acquired company – those are precious resources that can help companies grow quickly. Communities and a new user-base are also precious resources the acquirer gets after the deal,” explained Ruslan Gavrilyuk Co-Founder, President of Kepler Finance.


Spark Application Performance Monitoring using Uber JVM Profiler, InfluxDB and Grafana

Apache Spark provides a web-ui and REST API for metrics. Spark also provides a variety of sinks including Consoles, JMX, Servlet, Graphite etc. There are few other open source performance monitoring tools available like dr-elephant, sparklint, prometheus, etc. Metrics provided by these tools are mostly server level metrics, and few of them also provide information of running applications. Uber JVM Profiler collects both server level and application code metrics. This profiler can collect all metrics (cpu, memory, buffer-pool etc) from the driver, executor or any JVM. It can instrument existing code without modifying it, so it can collect metrics about methods, arguments and execution time. For storing metrics for timeseries analysis, we will use InfluxDB, which is a powerful timeseries database. We will extend Uber JVM Profiler and add a new reporter for InfluxDB so metrics data can be stored using HTTP API. For the dashboard of graphs and charts we will use Grafana, which will query the InfluxDB for metrics data.



Quote for the day:


"We get our power from the people we lead, not from our stars and our bars." -- J. Stanford


Daily Tech Digest - November 17, 2018

newyorkdeepmasterprints.jpg
The researchers from New York University detail in a new paper how they used a neural network to create 'DeepMasterPrints', or realistic synthetic fingerprints that have the same ridges visible when rolling an ink-covered fingertip on paper. The attack is designed to exploit systems that match only a portion of the fingerprint, like the readers used to control access to many smartphones. The aim is to generate fingerprint-like images that match multiple identities to spoof one identity in a single attempt. DeepMasterPrints are an improvement on the MasterPrints the researchers developed last year, which relied on modifying details from already captured fingerprint images used by a fingerprint scanner for matching purposes. The previous method was able to mimic the images stored in the file, but couldn't create a realistic fingerprint image from scratch. The researchers tested DeepMasterPrints against the NIST's ink-captured fingerprint dataset and another dataset captured from sensors.


The strategy of treating containers as logically identical units that can be replaced, spun up, and moved around without much thought works really well for stateless services but is the opposite of how you want to manage distributed stateful services and databases. First, stateful instances are not trivially replaceable since each one has its own state which needs to be taken into account. Second, deployment of stateful replicas often requires coordination among replicas—things like bootstrap dependency order, version upgrades, schema changes, and more. Third, replication takes time, and the machines which the replication is done from will be under a heavier load than usual, so if you spin up a new replica under load, you may actually bring down the entire database or service. One way around this problem—which has its own problems—is to delegate the state management to a cloud service or database outside of your Kubernetes cluster. That said, if we want to manage all of your infrastructure in a uniform fashion using Kubernetes then what do we do?


A data lake is where vast amounts of raw data or data in its native format is stored, unlike a data warehouse which stores data in files or folders (a hierarchical structure). Data lakes provide unlimited space to store data, unrestricted file size and a number of different ways to access data, as well as providing the tools necessary for analysing, querying and processing. In a data lake each data item is assigned with a unique identifier and metadata tags. In this way the data lake can be queried for relevant data and that smaller set of relevant data can be analysed. Also, data can also be stored in data lakes before being curated and moved to a data warehouse. ... The Azure Data Lake is a Hadoop File System (HDFS) and enables Microsoft services such as Azure HDInsight, Revolution-R Enterprise, industry Hadoop distributions like Hortonworks and Cloudera all to connect to it. Azure Data Lake has all Azure Active Directory features including Multi-Factor Authentication, conditional access, role-based access control, application usage monitoring, security monitoring and alerting.


Harvard researchers want to school Congress about AI

Funded by HKS’s Shorenstein Center on Media, Politics, and Public Policy, the initiative will focus on expanding the legal and academic scholarship around AI ethics and regulation. It will also host a boot camp for US Congress members to help them learn more about the technology. The hope is that with these combined efforts, Congress and other policymakers will be better equipped to effectively regulate and shepherd the growing impact of AI on society. Over the past year, a series of high-profile tech scandals have made increasingly clear the consequences of poorly implemented AI. This includes the use of machine learning to spread disinformation through social media and the automation of biased and discriminatory practices through facial recognition and other automated systems. In October, at the annual AI Now Symposium, technologists, human rights activists, and legal experts repeatedly emphasized the need for systems to hold AI accountable.  “The government has the long view,” said Sherrilyn Ifill, president and director-counsel of the NAACP Legal Defense Fund.


Role of digitisation and technologies like AI & ML in digital transformation of SMEs?


More specifically, AI-based solutions like automation can be greatly beneficial to SMEs in reducing several processes like sales planning, managing finances and supply chain, marketing, etc. These processes which most SMEs still conduct through offline methods considerably reduce the efficiency of the enterprise, since the managers’ focus is largely on the operations, rather than on serving customers and retaining them. Simultaneously, digitised business management and enterprise mobility solutions can enable SMEs to expand their business to any region within the country or outside, without having to worry about the infrastructural and monetary challenges associated. Customised, enterprise-centric solutions with AI and Machine Learning Every organisation faces a different set of issues and challenges. The solutions, then, to effectively tackle these challenges should also be specific to the business segment, as well as the industry, which the enterprise is involved in.


What Edge Computing Means for Infrastructure and OperationsLeaders

Edge computing solutions can take many forms. They can be mobile in a vehicle or smartphone, for example. Alternatively, they can be static — such as when part of a building management solution, manufacturing plant or offshore oil rig. Or they can be a mixture of the two, such as in hospitals or other medical settings. The capabilities of edge computing solutions range from basic event filtering to complex-event processing or batch processing. “A wearable health monitor is an example of a basic edge solution. It can locally analyze data like heart rate or sleep patterns and provide recommendations without a frequent need to connect to the cloud,” says Rao. More complex edge computing solutions can act as gateways. In a vehicle, for example, an edge solution may aggregate local data from traffic signals, GPS devices, other vehicles, proximity sensors and so on, and process this information locally to improve safety or navigation. More complex still are edge servers, such as those found in next-generation (5G) mobile communication networks.


The rare form of machine learning that can spot hackers who have already broken in


In cybersecurity, supervised learning works pretty well. You train a machine on the different kinds of threats your system has faced before, and it chases after them relentlessly. But there are two main problems. For one, it only works with known threats; unknown threats still sneak in under the radar. For another, supervised-learning algorithms work best with balanced data sets—in other words, ones that have an equal number of examples of what it’s looking for and what it can ignore. Cybersecurity data is highly unbalanced: there are very few examples of threatening behavior buried in an overwhelming amount of normal behavior. Fortunately, where supervised learning falters, unsupervised learning excels. The latter can look at massive amounts of unlabeled data and find the pieces that don’t follow the typical pattern. As a result, it can surface threats that a system has never seen before and needs few anomalous data points to do so.


Building a Web App With Yeoman

Released in 2012, Yeoman is an efficient open-source software system for scaffolding web applications, used for streamlining the development process. It is known primarily for its focus on scaffolding, which means the use of many different tools and interfaces coordinated for optimized project generation. GitHub hosts Yeoman. The Yeoman experience is three-tiered. Though they work together seamlessly, each part of Yeoman was developed separately and works individually. Primarily, Yeoman includes "Yo," the command line utility form used with Yeoman. This is the baseline of the Yeoman software platform. Next, Yeoman has "Grunt," and "Gulp," which are application builders to help automate your application development. Finally, the Yeoman software features "npm", which is a package manager. Package managers manage code packages for back-end and front-end development and their dependencies for you to develop your application. Yeoman provides developers with many options to combine in their development process.


Enterprise architecture still matters


Rather than checking in on how each team is operating, EAs should generally focus on the outcomes these teams have. Following the rule of team autonomy (described elsewhere in this booklet), EAs should regularly check on each team’s outcomes to determine any modifications needed to the team structures. If things are going well, whatever’s going on inside that black box must be working. Otherwise, the team might need help, or you might need to create new teams to keep the focus small enough to be effective. Most cloud native architectures use microservices, hopefully, to safely remove dependencies that can deadlock each team’s progress as they wait for a service to update. At scale, it’s worth defining how microservices work as well, for example: are they event based, how is data passed between different services, how should service failure be handled, and how are services versioned? Again, a senate of product teams can work at a small scale, but not on the galactic scale. 


Put Your BLL Monster in Chains

A very popular architecture for enterprise applications is the triplet Application, Business Logic Layer (BLL), Data Access Layer (DAL). For some reason, as time goes by, the Business Layer starts getting fatter and fatter losing its health in the process. Perhaps, I was doing it wrong. Somehow very well designed code gets old and turns into a headless monster. I ran into a couple of these monsters that I have been able to tame using FubuMVC's behaviour chains. A pattern designed for web applications that I have found useful for breaking down complex BLL objects into nice maintainable pink ponies. ... The high code quality is very important if you want a maintainable application with a long lifespan. By choosing the right design patterns and applying some techniques and best practices, any tool will work for us and produce really elegant solutions to our problems. If on the other hand, you learn just how to use the tools, you are going to end up programming for the tools and not for the ones that sign your pay-checks.



Quote for the day:


"A positive attitude will not solve all your problems. But it will annoy enough people to make it worth the effort" -- Herm Albright


Daily Tech Digest - November 16, 2018

Microsoft now offers blockchain development kit

Microsoft now offers blockchain development kit
Microsoft has released its serverless Azure Blockchain Development Kit, which promises to extend the capabilities of earlier blockchain-based development templates. “Apps have been built for everything from democratizing supply chain financing in Nigeria to securing the food supply in the UK, but as patterns emerged across use cases, our teams identified new ways for Microsoft to help developers go farther, faster,” Marc Mercuri, Microsoft’s Block Engineering principal program manager wrote in a blog post. “The Azure Blockchain Development Kit is the next step in our journey to make developing end to end blockchain applications accessible, fast, and affordable to anyone with an idea,” he said. A serverless approach, according to Mercuri, would “reduce costs and management overhead.” Without a virtual machine (VM) server to deal with, the kit is made affordable and “within reach of every developer—from enthusiasts to ISVs [independent software vendors] to enterprises.”


8 features a cybersecurity technology platform must have
Any security researcher will tell you that at least 90% of cyber attacks emanate from phishing emails, malicious attachments, or weaponized URLs. A cybersecurity platform must apply filters and monitoring to these common threat vectors for blocking malware and providing visibility into anomalous, suspicious, and malicious behaviors. ... Cybersecurity technology platform management provides an aggregated alternative to the current situation where organizations operate endpoint security management, network security management, malware sandboxing management, etc. ... CISOs want their security technologies to block the majority of attacks with detection efficacy in excess of 95%. When attacks circumvent security controls, they want their cybersecurity technology platforms to track anomalous behaviors across the kill chain (or the MITRE ATT&CK framework), provide aggregated alerts that string together all the suspicious breadcrumbs, and provide functions to terminate processes, quarantine systems, or rollback configurations to a known trusted state.



Vaporworms: New breed of self-propagating fileless malware to emerge in 2019

self-propagating fileless malware
Fileless malware strains will exhibit wormlike properties in 2019, allowing them to self-propagate by exploiting software vulnerabilities. Fileless malware is more difficult for traditional endpoint detection to identify and block because it runs entirely in memory, without ever dropping a file onto the infected system. Combine that trend with the number of systems running unpatched software vulnerable to certain exploits and 2019 will be the year of the vaporworm. Attackers hold the Internet hostage A hacktivist collective or nation-state will launch a coordinated attack against the infrastructure of the internet in 2019. The protocol that controls the internet (BGP) operates largely on the honour system, and a 2016 DDoS attack against hosting provider Dyn showed that a single attack against a hosting provider or registrar could take down major websites. The bottom line is that the internet itself is ripe for the taking by someone with the resources to DDoS multiple critical points underpinning the internet or abuse the underlying protocols themselves.


Making sense of Microsoft's approach to AI

As Guggenheimer explains, Microsoft's idea is to let customers jump in where they are. Those on the lower end of the AI experience chain might want to begin dabbling with AI with business intelligence and apps. Microsoft's announcement this week about its plan to add AI capabilities to Power BI (as explained here by my ZDNet colleague Andrew Brust) is the cornerstone of this part of Microsoft's strategy. For customers with a little more AI experience and who are willing to do a bit more customization, Microsoft's Dynamics 365 software-as-a-service apps -- especially those which recently got their own AI boost -- provides another place for customers to get their AI feet wet, Guggenheimer suggests. The next two pieces of Microsoft's AI strategy are where there's been a lot of announcements, as of late. Microsoft is working on a number of AI "Accelerators," solution templates and analytics templates to give users a way to build on top of some repeatable patterns and practices around AI.


Why women leave tech

Why women leave tech
“Lack of career growth or trajectory is a major factor driving women to leave their jobs — this was the most common response (28 percent) when we asked why they left their last job,” writes Kim Williams, senior director of design at Indeed, in a summary of Indeed's research. “The second most-common reason for leaving was poor management, with a quarter of respondents choosing this reason. Slow salary growth came in as the third most-common reason (24 percent) respondents left their last job. By contrast, issues related to lifestyle, such as work-life balance (14 percent), culture fit (12 percent) and inadequate parental leave policies (2 percent) were less common reasons for leaving a job,” Williams says. ... As Williams writes, “Meanwhile, many women in tech believe that men have more career growth opportunities — only half (53 percent) think they have the same opportunities to enter senior leadership roles as their male counterparts. And among women who have children or other family responsibilities, almost a third (28 percent) believe they’ve been passed up for a promotion because they are a parent or have another family responsibility.”


What is the MEAN stack? JavaScript web applications

What is the MEAN stack? Next-gen web applications
In short, the MEAN stack is JavaScript from top to bottom, or back to front. A big part of MEAN’s appeal is this consistency. Life is simpler for developers because every component of the application—from the objects in the database to the client-side code—is written in the same language.  This consistency stands in contrast to the hodgepodge of LAMP, the longtime staple of web application developers. Like MEAN, LAMP is an acronym for the components used in the stack—Linux, the Apache HTTP server, MySQL, and either PHP, Perl, or Python. Each piece of the stack has little in common with any other piece.  This isn’t to say the LAMP stack is inferior. It’s still widely used, and each element in the stack still benefits from an active development community. But the conceptual consistency that MEAN provides is a boon. If you use the same language, and many of the same language concepts, at all levels of the stack, it becomes easier for a developer to master the whole stack at once.


Shift to outcomes-based security by focusing on business needs

As well as an emphasis on education, it is essential that organisations foster a culture that supports “doing the right thing”. This requires mechanisms and processes that enable concerns to be raised easily and without fear of retribution. This does not happen overnight, however, and enterprises need to allow time for it to embed fully. It is important that people throughout the organisation feel supported and confident in speaking up about any activities that may adversely affect the security design or increase the threats. This may sound obvious, but business projects have defined plans and milestone dates, and standing in the way of these to raise concerns from a secure architecture point of view is a daunting prospect. However, a supportive culture and an outcomes-focused security strategy will champion legitimate challenges, hearing and considering the claim regardless of the seniority of the individual making it. Similarly, there need to be appropriate channels for individuals to flag poor practice, without having to challenge the perpetrator directly.


Google Cloud Scheduler brings job automation to GCP

While Google encourages customers to use Cloud Scheduler for App Engine workloads on GCP, the service also works with any HTTP/S endpoint or Publish/Subscribe messaging topic. One example of the former is an on-premises enterprise application that exposes back-end data to a cloud service via HTTP/S. Publishers take many forms, such as a sensor installed at a remote oil rig. As the sensor generates various types of messages, the publish/subscribe approach sends them to a broker system, which then forwards them on to subscribers in real time. This approach can save time and effort by eliminating the maintenance of a slew of point-to-point integrations, and it makes sense for use cases such as IoT. Google offers a publish/subscribe service for GCP. Google Cloud Scheduler uses a serverless architecture, so customers only pay for job invocations as needed; pricing starts at $0.10 per job, per month, with three free jobs per month. It's difficult to compare Cloud Scheduler's cost to, for example, Azure Scheduler, which has a much more granular pricing model.


Securing the IoT has become business-critical

Securing the IoT has become business-critical
The near ubiquity of IoT does raise the security flag, as it presents a significant threat vector for hackers to breach companies. DigiCert’s goal in running the survey was to understand the state of IoT adoption, understand security implications, and quantify the benefits of having made the investments in IoT security. The survey focused on the four industry verticals where IoT was most mature — industrial, consumer products, healthcare, and transportation — and sampled companies of all sizes, with the median size being 3,000 employees. The survey asked what objective companies were trying to achieve with IoT. The top responses were operational efficiency, customer experience, increased revenue, and business agility. It’s been my experience that businesses that are early in the adoption cycle of IoT are looking to cut costs through automation, which leads to better efficiency, but they quickly pivot to customer experience as a way of creating new revenue streams.


Ahead of Black Friday, Rash of Malware Families Takes Aim at Holiday Shoppers

“The malware can intercept input data on target sites, modify online page content, and/or redirect visitors to phishing pages,” Kaspersky Lab researchers noted in a posting on Thursday, one week ahead of Thanksgiving. They added that the malicious code, once installed often lies in wait for the consumer to visit an e-commerce page, and then simply grabs the payment form wholesale. “Form-grabbing is a technique used by criminals to save all the information that a user enters into forms on a website,” the team noted. “And on an e-commerce website, such forms are almost certain to contain: login and password combination as well as payment data such as credit card number, expiration date and CVV. If there is no two-factor transaction confirmation in place, then the criminals who obtained this data can use it to steal money.” Armed with the stolen credentials, cybercriminals could hawk them on the Dark Web, or simply use the stolen accounts themselves – they can buy things from a website using victims’ credentials, and then resell the ill-gotten goods to make a nice profit – a process that comes with built-in money-laundering.



Quote for the day:


"The ultimate measure of a man is not where he stands in moments of comfort, but where he stands at times of challenge and controversy." -- Martin Luther King,


Daily Tech Digest - November 15, 2018

1 tsunami
Every technological advance can and will be exploited at some point, but if we think before we quickly push devices out into consumer’s and corporation’s hands – if we build security and privacy in to start with – we’ll have a better handle on what can go wrong. Take medical devices, for instance. Per a recent study by Trend Micro, more than 100,000 medical devices were discovered to be insecure. Think of an infusion pump precisely monitoring the flow of a lifesaving fluid into your loved one. Don’t think it can be hacked and the dosage changed? Think it doesn’t happen? The HIPAA journal recently featured a study done by Vanderbilt University that suggested healthcare data breaches cause 2,100 deaths a year. Was this IoT related? I don’t know, but the evidence of what can happen with unmanaged, unsecure IoT is powerful and must be addressed. So, where to now? Want to learn more about IoT? It really applies to everything: medicine, health, transportation, smart cities and smart homes.


How to add IoT functions to legacy equipment

vintage voltmeter gauge
The hardest part of bringing the IoT to older systems seems to be dealing with the unique, one-off characteristics of each legacy situation — often without accurate documentation. “Older equipment sometimes requires a necessary, unique design step in each individual case,” Flynn says. The key, he adds, is to avoid disrupting the existing control scheme and operations of the legacy system. “We have to be careful not to create new issues. If the legacy system uses an older communication protocol, then we have to ensure not to overload any bandwidth or processor,” he says. If that’s not possible, using new IoT sensors requires selecting the right new IoT sensors and instrumentation to solve a particular problem. That, in turn, requires a higher level of operational technology expertise. But that’s only part one, Flynn says. You still have to network into an existing IT infrastructure, often using a combination of edge devices and sensors. New Wi-Fi connections may be needed.


Elastic tackles containers and APM in the new 6.5 release

elastic.png
As Elastic adds capabilities for supporting the new forms of deployments, largely cloud-native, involving containers and serverless infrastructure, another theme of the new release is going higher up the stack and ramping up competition with, as opposed to complementing, APM vendors. The new release of Elastic APM allows users to correlate data on application performance with infrastructure logs, server metrics, and security events to identify bottlenecks. In itself, this capability overlaps those of APM vendors. APM vendors have built their IP over the years understanding how to abstract low level log readings from the standpoint of application processes making their way through IT infrastructure. A major difference form Elastic is that the APM crowd built their expertise in the walled gardens of data center deployments. By contrast, Elastic was not necessarily engineered for the cloud, but its scale-out, big data architecture made it a natural for the cloud.


Terraform orchestration matures as multi-cloud lingua franca

Terraform 0.12 makes remote state storage available free to users of the open source edition as well. Without this feature, multiple IT administrators might overwrite one another's infrastructure code or lack a single "source of truth" for infrastructure configurations. With 0.12, HashiCorp established a SaaS remote state management product for open source users that can indefinitely store an unlimited amount of state information. Terraform 0.12 also revamps the HashiCorp Configuration Language (HCL), its domain-specific language for infrastructure code, to make it more consistent and easy to use. Enterprise IT shops already favor Terraform orchestration for multi-cloud microservices management but said there was a time when ease of use was an issue. "Terraform has been instrumental for us to tame the chaos of multiple clouds and data centers," said Zack Angelo, director of platform engineering at BigCommerce, an e-commerce company based in Austin, Texas. "But in the past, if you weren't on Terraform Enterprise, migrating a state file was a pain point ..."


Global Family Business Survey 2018


The release of our ninth PwC Global Family Business Survey comes at a time of extraordinary transformation. Digital technology is disrupting whole industries; sustainability is becoming central to the conduct of business; in the corporate and financial worlds, winning trust is more important than it’s ever been; and millennials represent an enduring demographic change. After surveying nearly 3,000 family businesses across 53 territories, we were able to prove that family businesses - built around strong values and with an aspirational purpose - have a competitive advantage in disruptive times, that pay off in real terms. Therefore we believe there is an enormous opportunity for family businesses to start generating real gains from their values and purpose by adopting an active approach that turns these into their most valuable asset.


How Kubernetes is becoming a platform for AI

Xinglang Wang, a principal engineer at eBay, said AI had a high barrier to entry, but packaging tools in a Kubernetes cluster made it easier for businesses to get started on an AI project. At eBay, he said Kubernetes was used to create a unified AI platform, which enables data sharing and sharing of AI models. The AI platform also provides automation to enable eBay to train and deploy AI models.  One of the big users at the KubeCon Shanghai event was Chinese e-commerce retailer JD.com. Explaining the use of AI at JD.com, principal architect Yuan Chen described how the the company was running one of the largest Kubernetes clusters in the world. While it was traditionally used to support a microservices architecture, he said: “Everything is now driven by AI, so we have to use Kubernetes for AI. It is the right infrastructure for deep learning to train the AI models. AI scientists are expensive, so they should focus on their algorithms and not have to worry about deploying containers.”


The Linux desktop: With great success comes great failure

Missed target.
First, while the major Linux companies — Canonical, Red Hat and SUSE — all support Linux desktops, they all decided early on that the big money was to be made with servers (and nowadays with containers and the cloud). The biggest Linux players determined that the Linux desktop was a small market — and then they did very little to change that. But there’s more to it than that. The Linux desktop has also been plagued by fragmentation. There is no one Linux desktop; there are dozens, and they are not at all alike. There’s the Debian Linux family, which includes Ubuntu and Mint; the Red Hat team, with Fedora and CentOS; Arch Linux;Manjaro Linux; and numerous others. And then there are the desktop interfaces. Personally, as a dedicated Linux desktop user for decades, I love that I have a choice between GNOME, KDE Plasma, Cinnamon, Xfce, MATE, etc. for my desktop interface. But most people just find it confusing. All of that just scratches the surface.


GPS killer? Quantum 'compass' promises satellite-free navigation

quantumcompassimperialnov18.jpg
The transportable quantum accelerator could address GPS's dependence on satellite signals, which can be jammed or spoofed by an attacker, rendering the system useless for navigational information. Instead of using GPS, scientists from Imperial College London and UK laser instrument maker M Squared have demonstrated a way to measure how super-cooled atoms respond when inside an accelerating vehicle. Accelerometers are used for navigation, but as the researchers explain, they quickly lose accuracy over time unless aided by satellite signals. The satellite-free navigational device they created relies on M Squared's laser, which cools atoms in a chamber to the point where they behave in a quantum way, as both matter and waves. When a vehicle carrying the device moves, the wave properties of the cooled atoms are affected by its acceleration. A laser beam that acts as an 'optical ruler' measures how atoms move over time.


Zero-trust security not an off-the-shelf product


Zero trust is a “business enabler” because, done correctly, it enables businesses to be faster more quickly and more securely because it is a combination of processes and technologies, he said. “Security is improved because it effectively blocks lateral movement within organisations.” It is widely recognised that complexity is the enemy of security because it encourages end-users and business leaders to bypass security, said Simmonds. “The zero-trust model once again improves security by reducing complexity, and if you get it right, it works for everyone, including business partners, by providing a unified experience with greater flexibility and productivity,” he said. On the other hand, zero trust is not about trusting no one, said Simmonds, it is not a “next-generation perimeter” and it is not “VPN modernisation”. “It is not an off-the-shelf product,” he said.


Understanding the CEO’s role early in digital transformation programs

2 ceo
First, the CEO should be marketing the mission. It must be repeated to leaders and employees several times and the CEO should help answer several key questions. Why must the organization pursue the defined digital business strategy? What are the issues with the existing business model? Who are the new competitors that are disrupting existing businesses, products, and services? What markets is the organization targeting? What are the new and emerging customer needs and expectations? Why technology is critical for future success? These communications should always end with some of the short-term goals of the program and how people can participate. The CIO and others on the leadership team also be communicating and answering these questions, but the staff wants to know and see that the CEO is truly behind it and driving it. With a strategy and mission defined, their needs to be clarity on how the program is being led and how responsibilities are aligned.



Quote for the day:


"A leader must have the courage to act against an expert's advice." -- James Callaghan