Daily Tech Digest - January 13, 2019

Experts Say Blockchain Has Yet To Become The Game-Changer Many Had Expected


Brent Jaciow, head of blockchain affairs at Utopia Music, a music data tracking platform, argues, though, that as with any software or technology, the user experience must make the end user's life easier. "Blockchain is still an emerging technology (even if it has been around in one form or another for 20 years), and developers must work hard to remove any roadblocks to firm's harnessing its capabilities," he added. "Given the current market environment, only those projects which clearly provide value to its end users in a compliant structure which investors understand will receive the funding necessary to bring their idea to fruition." Of course, while the authors of the McKinsey & Company report note that the "blockchain is a poorly understood (and somewhat clunky) solution in search of a problem," it's not all doom and gloom about the technology.



Blockchain and the reshaping of investment management

Blockchain offers no exception to the rule that new technologies involve some degree of risk and disruption. The road ahead is unlikely to be smooth, and the consequences will not be uniformly positive. Regulation may pose the greatest threat to blockchain’s widespread adoption in the short term. This was certainly the consensus among CCAF’s Global Blockchain Benchmarking Study respondents, who deemed extant legal frameworks “unclear”. The fact that distributed ledgers, by their very nature, have neither a specific location nor a centralized source of administration raises substantive hurdles in terms of jurisdiction and applicable law. Obtaining a framework that recognizes blockchains as genuinely tamperproof is likely to prove a contentious affair, as is the task of persuading multiple agencies to reach consensus on global standards


Self-driving cars will create 30,000 engineering jobs that the US can't fill

istock-921019596.jpg
Emerging mobility technologies like autonomous trucks and drones could mean even more engineers than predicted will be needed, the report found. While typical engineers today work on specific automotive components, like engines or electronics, in the future, they will need to have more cross-functional skills to work on interconnected automotive systems. This means they will need skills in math, physics, artificial intelligence (AI), machine learning, robotics, data science, and software, the report said. Because these skills remain in high demand and low supply, the talent gap will likely persist, it added. Along with engineers, the move toward connected vehicles will created more than 65,000 jobs for skilled trade workers, including autonomous vehicle and electric vehicle mechanics, and autonomous vehicle safety drivers, according to the report. Thousands more jobs for remote-support staff for self-driving vehicles and fleet maintenance will also be needed.


Serious cybersecurity enforcement is coming in 2019, but are advisers ready?

The good news is that the financial services industry has done a pretty good job of adapting to new cybersecurity requirements, at least in comparison to other industries like retail, said Robert Cattanach, partner at law firm Dorsey & Whitney. Where it's most often falling apart is with the smaller registered investment advisers and broker-dealers. "Modest-sized companies lack the resources to really make good on their paper policies," Mr.Cattanach said. "Someone can gin up the right-sounding IT governance policies and procedures. But it's a whole additional step to make sure they are followed." At smaller firms, there can be a sense of fatigue and helplessness when it comes to cybersecurity, because even the largest companies get hacked. "There is this general feeling of, 'Holy cow, how can I, this little RIA out here, protect [against a breach] if these large institutions can't?'" said Wes Stallman, provider of cloud-based cybersecurity for advisers. "I do think that causes some frustration."


A framework for auditing blockchain


In case of a private blockchain, the information is shared among all the participating nodes, but if competitors are present on the same blockchain, they may be able to discover the commercial-in-confidence information stored in the blockchain platform, thus putting sensitive data at risk. Lack of a governance model for blockchain, therefore, may lead to unresolved disputes over incorrect transactions or cross-border transaction flows. Other concerns remain with respect to ownership, governance, dispute resolution, security and privacy around smart contracts, and the blockchain-based platforms themselves. The risks are amplified due to the absence of a central regulator or governing body to deal with disputes when they arise. Traditional models of audit fail to take into consideration many of the risks associated with blockchain-enabled processes, and hence the need for understanding the specific set of unique risks and development of an evolved auditing approach specifically for blockchain-enabled solutions.


Fintech sector hurt by shutdown

The federal government’s influence on fintech is proving even more expansive than many expected, touching on the latest developments in banking, derivatives, securities, online lending and more. The halt of most agency operations is impacting a host of key issues concerning every fintech business, from the rate at which money can be raised to how (and even whether) business plans are finalized. However, not all pockets of the industry are impacted in the same way. Most visibly affected are companies issuing securities to raise capital. Large technology firms planning to do initial public offerings (IPOs) — think Lyft, Airbnb and Slack — could be affected with no one at the Securities and Exchange Commission to process registration statements of firms seeking to sell stock to the public. Planned IPOs would then have to be delayed, and if the stock market deteriorated, indefinitely postponed. In any event, when the SEC reopens, staff face a daunting backlog of filings.


Germany's Mega-Leak Takeaway: Noisy Young Hacker Got Caught

Germany's Mega-Leak Takeaway: Noisy Young Hacker Got Caught
Individuals and organizations would do well to treat the German personal data mega-leak as a cautionary tale. Here's the right question for all public figures, politicians or celebrities to be asking right now: "Could I fall victim to any attacker who used the same tactics, and how do I protect myself?" If so, the obvious next question is: "What should I do now to solve it?" Authorities in Germany say they're crafting guidelines for their country's politicians in the wake of last month's mega-leaks. Arguably, Germany's cybersecurity agency is already well behind the curve. "Why are standards agencies only now telling politicians and others how to protect their ID?" Woodward asks, noting that in the U.K., the National Cyber Security Center has long provided information security advice to lawmakers. On the other hand, "I'm not entirely sure politicians listen to that advice, or even read it," he says.


Bitcoin’s Revolution Is Only Just Beginning

It is interesting to note that countries, now recognizing that they are in competition with one another, are trying to make sure they win the bitcoin economy. The smartest of these are either allowing bitcoin to prosper or recognize that they need a light touch in regulating bitcoin to attract all the creativity, money and startups that are flooding into the field. The U.S. was wise to leave the internet unregulated and free because all the internet entrepreneurs created startups domestically and the economy around the internet blossomed. Keeping its regulatory hands light should help innovators stay in the U.S. There are many parallels between bitcoin now and the internet in 1994. In 1994, the internet was just for hobbyists and hackers. I remember when I first used the Internet, the only things I could do were to buy diamonds and try to break into NORAD. There were very few uses. It took many years for the internet to become mainstream, but when it did, it transformed industries.


Is GDPR Compliance Tougher Than HIPAA Compliance?

"U.S. healthcare entities that are subject to GDPR need to ensure that they undertake proper diligence when using third-party products and services to ensure that they do not cause them to be in violation of their GDPR obligations," she says. "The hospital in this case argued that it was using a system provided by the Portuguese healthcare authorities, but the regulators pushed back on this argument on the basis that the hospital could, and should, have known that its use was in violation of GDPR." Attorney Steven Teppler of the law firm Mandelbaum Salsburg P.C., notes: "The findings that the security measures were so lax as to present a threat to the maintenance of integrity and confidentiality of the PHI itself - although no PHI was referred to as having been compromised from either a integrity or confidentiality perspective - would in my opinion be sufficient to trigger an investigation."


This campaign has targeted victims across the globe on an almost unprecedented scale, with a high degree of success. We have been tracking this activity for several months, mapping and understanding the innovative tactics, techniques and procedures (TTPs) deployed by the attacker. We have also worked closely with victims, security organizations, and law enforcement agencies where possible to reduce the impact of the attacks and/or prevent further compromises. While this campaign employs some traditional tactics, it is differentiated from other Iranian activity we have seen by leveraging DNS hijacking at scale. The attacker uses this technique for their initial foothold, which can then be exploited in a variety of ways. In this blog post, we detail the three different ways we have seen DNS records be manipulated to enable victim compromises.



Quote for the day:


"If you are not willing to give a less experienced qualified professional a chance, don't complain you are charged double for a job worth half." -- Mark W. Boyer


Daily Tech Digest - January 12, 2019


Many businesses and individuals are optimistic that this AI-driven shift in the workplace will result in more jobs being created than lost. As we develop innovative technologies, AI will have a positive impact on our economy by creating jobs that require the skill set to implement new systems. 80% of respondents in the EY survey said it was the lack of these skills that was the biggest challenge when employing AI programs. It is likely that artificial intelligence will soon replace jobs involving repetitive or basic problem-solving tasks, and even go beyond current human capability. AI systems will be making decisions instead of humans in industrial settings, customer service roles and within financial institutions. Automated decisioning will be responsible for tasks such as approving loans, deciding whether a customer should be onboarded or identifying corruption and financial crime. Organisations will benefit from an increase in productivity as a result of greater automation, meaning more revenue will generated. This thus provides additional money to spend on supporting jobs in the services sector.



One important characteristic distinguishing startup projects from strategic initiatives is an expectation that the idea might not work. This is an appreciably different mindset. Established companies that pursue major strategic initiatives invariably make big investments of resources, making the initiative both high profile and high risk. Leaders end up loathe to abandon struggling initiatives, usually choosing instead to revamp and reinvest. Startups simply pivot. Because the initial goal of the startup is to identify a viable value proposition, most leaders of startups will be quick to jump ship if an idea is headed nowhere. They are eager to explore for ideas that work and are not possessive of those that don’t. Admirers tend to pay most of their attention to the successful innovations at digital companies. But failures play just as important a role in the success of digital businesses. Airbnb’s founders learned early on that the market for renting an air mattress on a stranger’s floor was limited. 


microsoft edge browser resized2
If Microsoft were to dump IE, when would be the best time? The logical moment would be when Windows 7 - currently the world's second-most-popular operating system - is itself retired Jan. 14, 2020. IE and Windows 7 have a relationship, forged in the years when the browser accounted for more than half of all user share, that simply doesn't exist between IE and Windows 10; in Windows 10, the browser was never more than a sop to backwards compatibility. Not coincidentally, by that time Microsoft should be finished with its conversion of Edge to the technology that powers Google's Chrome. The transformation of Edge, announced in early December, is to take place "over the next year or so," a Microsoft executive said a month ago. The "full-Chromium" Edge - called that because Microsoft will adopt the Chromium open-source code to power its browser - will be available not just for Windows 10, but also for Windows 7 and Windows 8.1.


Improbable vs. Unity: Why enterprise cloud users should take notice

“As we move towards more online, more complex, more rapidly-evolving worlds, we will become increasingly interdependent on a plethora of platforms that will end up having enormous power over developers. The games we want to make are too hard and too expensive to make alone,” the blog post reads. “In the near future, as more and more people transition from entertainment to earning a real income playing games, a platform going down or changing its Terms of Service could have devastating repercussions on a scale much worse than today.” The company then goes on to make a case for the creation of a “code of conduct” that would offer developers a degree of protection in disputes like this, by laying down some rules about what is (and what is not) permissible behaviour for suppliers within the ecosystem to indulge in. There are similar efforts afoot within the enterprise cloud space focused on this, led by various governing bodies and trade associations. 


Intel announces new data center processors and more
The bigger news was that Intel showed off the 10nm Ice Lake architecture, which is based on a whole new microarchitecture and finally achieves 10nm fabrication. Intel has been stymied for years at getting to 10nm. The company expects to ship desktop and notebook Ice Lake processors at the end of this year, with server processors coming in 2020. The Ice Lake architecture is called Sunny Cove, which promises a significant improvement in performance over the current Skylake generation of processors through a set of changes that are inordinately complex to explain, and I don’t want to spend time on it. Suffice it to say, all of the changes mean the processor can execute code with much more depth and breadth than Skylake. It also has fixes for the Spectre v2 exploit. Spectre v1 has already been fixed in shipping products. Intel also announced a brand-new class of AI processor called the Nervana NNP-1, which stands for neural network processor and is being positioned as an alternative to GPU-based AI.



Moving to the cloud? 3 critical data efforts you must make

No matter if you’re talking about a blockchain database, an in-memory database, a distributed database, or a data lake, there are special-purpose databases that are built for a particular purpose that may be better fits for your applications. At least ask the question before your migration. With many enterprises using the same old enterprise relational databases that are demanding higher and higher license fees, moving to a special-purpose database not only will be an increase in functionality and optimization, but it is likely to be much cheaper in the cloud. Most databases are not designed well, and many organizations are just picking up those bad designs and relocating them to the cloud. Moreover, they are not considering other databases models, such as object databases and graph databases. Moving to the cloud is a great time to look at other database models. However, what is pretty much mandatory is that you revise any deficiencies in the existing structures. This means revising your databases so they best resemble the business.


Commercial drones… Ready for take-off?

Commercial drones… Ready for take-off? image
While the mainstream adoption of drone deliveries is not quite ready, the technology is already displaying how it can make a significant impact across different industries. The public sector, in particular, is a beneficiary of its use. Most recently, the New York Police Department, America’s largest police force, announced that it will be trialling drone technology in hostage situations as well as search and rescue operations. Drones will be used to scope out incidents before officers arrive, warning of any potential hazards or emergencies. Similarly, it was recently revealed that Chinese students have designed Net Guard, drone technology that uses netting to safely rescue those who have to abandon buildings due to fire emergencies. In healthcare, commercial drones are already being used to administer aid. Zipline, a Silicon Valley start-up, is helping medical professionals to overcome locational barriers by medicine to those in difficult-to-reach areas. In fact, it has already helped to deliver 1000 blood drops in Rwanda, saving lives and providing relief.


Where You Go Tells Who You Are—and Vice Versa

Estimating travel demand in a city is a critical tool for urban planners to understand traffic patterns, predict traffic congestion, and plan ahead for transportation infrastructure maintenance and replacement. For years, researchers have used the classic practice of multiplying the number of trips per day per person for different demographic groups to model activity-based travel demand. But because this method was developed before the current era of ubiquitous sensors—GPS devices, smartphones, cameras on light poles, and connected vehicles, among them—researchers have found it difficult to validate their estimates in real-world situations. Mining data to analyze tracking patterns, Sharon Di, assistant professor of civil engineering and engineering mechanics at Columbia Engineering, has discovered that she can infer the population travel demand level in a region from the trajectories of just a portion of travelers.


A neural network can learn to organize the world it sees into concepts


“There’s a chance for us to learn what a network knows from trying to re-create the visual world,” says David Bau, an MIT PhD student who worked on the project. So the researchers began probing a GAN’s learning mechanics by feeding it various photos of scenery—trees, grass, buildings, and sky. They wanted to see whether it would learn to organize the pixels into sensible groups without being explicitly told how. Stunningly, over time, it did. By turning “on” and “off” various “neurons” and asking the GAN to paint what it thought, the researchers found distinct neuron clusters that had learned to represent a tree, for example. Other clusters represented grass, while still others represented walls or doors. In other words, it had managed to group tree pixels with tree pixels and door pixels with door pixels regardless of how these objects changed color from photo to photo in the training set.


Reimagining the Digital Bank Branch of the Future: Let’s Get Practical

Virtually all banks have been migrating service transactions to digital channels, yet the pace of change and the return on investment vary substantially. The leaders make it easy for customers and take care to help them adopt and use digital tools. Citibanamex, for instance, took on the bad volume challenge, which is particularly vexing in Mexico. The bank reckoned that its customers and employees were spending 5 billion minutes per year in service transactions at branches, with the vast bulk of that time on the customers’ end. This waste took a toll on the bank’s cost-to-income ratio and ultimately on profits—not to mention customer and employee advocacy. Through a combination of initiatives ranging from simplifying online forms and printing formats, to migrating more transactions to ATMs, to reducing wait time at teller windows, Citibanamex freed up 1 billion minutes—providing a major boost to customer satisfaction and employee advocacy. 



Quote for the day:


"It's not about how smart you are--it's about capturing minds." -- Richie Norton


Daily Tech Digest - January 10, 2019


Senior leaders must objectively assess not only their own strengths, but also where they have knowledge or experience gaps — areas where they need to build new skills. A recent PwC study (pdf) found, as one might expect, that those in senior management roles are less likely than, for example, those in factory or clerical roles to be entirely displaced by automation. But the nature of leaders’ work will undoubtedly undergo major shifts. These shifts will open up more time for forward-looking activities; executives will be helped further here by the presence of increasingly sophisticated data. Meanwhile, leaders in customer-facing roles need to figure out how to best serve customers, taking advantage of automation to provide customized products and services on demand. Functional leaders must consider the following matters as they define their role in the age of robots: What actions will they need to take now to prepare for the ways that robots will transform their industry and business? Structurally, what has to change in the organization?


fog obscures the horizon beyond a highway / uncertainty / unknown future
The inevitable next step — something that is already happening — is the augmentation and eventual automation of corporate decision making based on this proprietary knowledge. Cognitive platforms such as CognitiveScale and Maana are at the forefront of this type of contextual, knowledge management automation — but they are just the leaders in a rapidly developing market full of some of the brightest, most progressive minds in technology. While every company that is developing AI-based technologies today will tell you that their goal is to augment human capabilities rather than replace workers, the reality is that this story is leading to an inevitable conclusion. While it may not be politically correct (or good for sales) to acknowledge it openly today, the writing is on the wall: if we can reduce something to an algorithm, we will automate it in the very near future. 


How to tackle phishing with machine learning

istock-625496696phishing.jpg
As the various elements of an email are very clearly defined (return-path, content-type, etc.) EdgeWave reviews each of these for every email against our threat database. In many cases, we see where individual elements can be suspicious, but when combined together they create a malicious email. ... The challenge for email is that it tends to be the starting point for cyber-attacks rather than the sole perpetrator. Consider, for example, situations where JavaScript is embedded in a PDF attachment, which is opened. JavaScript only kick-offs the exploit process. Determining if the JavaScript itself is malicious is challenging without directly running the script and evaluating the subsequent actions (sandboxing). The outcome of the JavaScript actions can be evaluated against our threat database to determine a level of suspicion. EdgeWave has a taxonomy of over 40k rules based on the information and processes described above. Many of these are the result of machine learning (A+B+C = bad) plus detailed analysis by our threat detection analysts.



Moving to a Next-Generation SOC: Critical Factors

Organizations looking to migrate to a next-generation security operations center must first carefully assess any problems they are facing with current security technology, says Vikram Mehta. "The first thing that organizations would need to do before they embark on this journey is to identify which problems they are really trying to solve, identify pain points and document use cases which are challenging to solve with the traditional framework of SOC implementation," Mehta says in an interview with Information Security Media Group. Organizations should make a gradual shift to a next-generation SOC, he advises. "Just implementing a piece of technology and expecting it to solve all problems is absolutely not the way to go," he says. In this interview Mehta also discusses: Common mistakes companies make while shifting to a next-generation SOC; Problems that a next-generation SOC can help resolve; The technology stack, including open source components, that MakeMyTrip leveraged to implement a next-generation SOC.


Unified communications market sees demand for customized offerings


"Some customers want a simple workflow that expands outside of a traditional UC application," he explained. "When we are helping customers with UC API engagements, we tend to look at the larger picture typically through an ideation process. As a result, we may help investigate ways to build a custom digital transformation outcome that may include ... UC, mobility and customer experience." But with the opportunity comes challenges, and the biggest one Lazar sees is the ability to find developer expertise. "API [and CPaaS] vendors like Nexmo/Vonage tout about 700,000 developers; others are diligently working to build developer awareness or create tools that enable nondevelopers to use API-based services," he said. Another challenge is matching API capabilities to customer's business workflows, said Derek Lohman, Cisco prototype lead at WWT.


How agile development can give organizations competitive edge

This works especially well in the tech industry, especially when dealing with new technologies like Blockchain, for a number of reasons, namely that there are a lot of pedants working to make those environments unpleasant and rigorous. This, fortunately, is an unsuccessful way to run almost any businesses as it prevents ingenuity and uniformity. Instead of fearing changelogs or criticism, the agile developers welcome it and work tirelessly to bring value to products over meeting deadline requirements. Agile developers value collaboration and welcome change. In other words, they eschew traditional working values. Individuals come first. Teams self-organize. Developers and corporate people interact and communicate. Why are Agile methodologies such a big deal in tech? Making it in the tech industry can be hard. Projects can get lost. Budgets can get devoured. It’s all very simple to lose track of it all when building a software product.


2FA bypass tool highlights top business security vulnerabilities


The reverse proxy tool, which is available on GitHub along with user guidelines, can be used to bypass most of the currently used 2FA authentication schemes and uses a technique that DuszyÅ„ski said he has exploited for “quite a while already”. He further justifies the creation and release of the tool by saying it should be useful to all penetration testers who want to carry out an effective phishing campaign as well as for organisations’ red teaming exercises to test the effectiveness of their cyber defences. The tool puts an imperceptible phishing site between the user and the legitimate site in a classic man in the middle-style attack to harvest credentials including second factor authentication codes, and therefore does not require the attacker to create a fake version of the site to trick users into entering their details. However, this reverse proxy technique does not work against 2FA schemes that use universal 2nd factor (U2F), which is a type of physical authentication device that uses encryption and private keys to protect and unlock supported accounts.


Server sales projected to slow, while memory prices drop

While total server sales were up 5 percent, with Q2 of 2018 being especially strong with more than 10 percent quarter-over-quarter growth in global server shipments, the shipment growth is expected to slow down to 2 percent in the first half of the year. The reason is that there are new generations of processors from Intel and AMD on the way. Intel just announced its latest Xeon Scalable Platform processor, code-named “Cascade Lake,” while AMD has a next-generation Epyc code-named “Rome” in the works. ... Something else that’s slowing down: NAND flash memory output. The bit output from the NAND Flash industry in 2018 turned out to be higher than expected. Vendors such as Hynix and Micron got great yields from their 64-layer 3D NAND production lines. However, NAND Flash demand has remained sluggish for several reasons: the looming trade war between China and the U.S., the shortage of Intel CPUs, and the lower-than-expected sales of the new, overpriced iPhone.


The future of the CIO

Architectural dome reflected in a crystal ball. / future / predictions / forecast / fortune telling
CIOs say that today is crazy and challenging and in 5 years, it will be much the same. One CIO responded by saying as many years as I've been doing this, the details of what kind of crazy is what changes. Historically, IT was a supporting function to business strategy, but more and more with digital, IT is redefining business strategy. In 5 years, AI will manage all infrastructure (networks and systems) and machine learning may replace the need for strategic planning and robots will replace the CIO? The CIO role today has different impact across organizations and industries. In the future, CIOs will emerge into the front-line of driving customer engagement and business innovation.  IT is clearly moving from the back office to center stage, so any disruption instantly impacts every customer and employee. CIOs, for these reasons, must be more adept at communicating, leading, persuading, apologizing, and selling. One CIO suggest here that they call the path forward a three-legged race.


Digital insurance in 2018: Driving real impact with digital and analytics

We believe the industry is now in a position in which executives can embark on a digital journey to achieve real impact. It is no longer “if” digital technologies will change the industry, it is “how” and “when.” The challenge—or opportunity—for incumbents in the digital transformation lies in determining the concrete steps they should be taking right now to join (if not lead) the digital revolution while maximizing existing assets. With new attackers on the hunt for customers, incumbents must move quickly to integrate digital technologies into their operations. Claims should be a top priority. To capture the value of digital, claim functions must embark on a transformation to become customer-centric, digitally enabled organizations. So where to start? We offer five essential elements needed to digitize and transform property-and-casualty (P&C) claims. By examining each of these areas, P&C claim functions can start to rethink the claims customer journey and back-office processes.



Quote for the day:


"True leaders bring out your personal best. They ignite your human potential" -- John Paul Warren


Daily Tech Digest - January 09, 2019

bmw-northface-design.png
At CES 2019, there are a few examples of what I'll call design mashups. These mashups are created by companies with expertise in disparate areas coming together to collaborate. These companies are going for design collaborations to better digitize their businesses. Panasonic refers to its approach to design with its brand as "comfortable disruption." The general idea is that you can take devices and technologies that are already comfortable -- and even retro -- and update them to reflect modern reality. Panasonic is taking this comfortable disruption approach with its portfolio of products. Exhibit A in this comfortable disruption concept is Procter & Gamble, which outlined how it is integrating technology into everyday products. Yes kids, AI is coming to a toothbrush near you.  The catch is that the line between evolving concepts and disrupting existing products is delicate.


The 9 Cybersecurity Practices All Firms Should Follow in 2019

The 9 Cybersecurity Practices All Firms Should Follow in 2019
An entry window is also an exit window. The human being is curious by nature, and as soon as he sees something that is not his placed at his disposal, the most probable thing is that, at least out of curiosity, he makes use of that gift of becoming. This usually happens in cybercafés, in work offices and in all the places where computers are shared. If you open Facebook, Gmail or any other service, get used to closing the session before getting out of the chair to leave. With this you will avoid entering the immense rate of users who lose data by leaving their sessions open there. A good exercise to generate the habit is to do it at home too, every time you get up from the computer; close the session ... This means comfort, but also possibilities for sniffing to take shape and bank, social, mail, etc. accounts. In a blink of an eye. To avoid this, you should avoid connecting, and that’s like telling you to cut the light of your home so you never get electrocuted.


Rust programming language: Seven reasons why you should learn it in 2019

Born out of a personal project by then Mozilla developer Graydon Hoare in 2006, the language, like the Rust fungus it is named after, is starting to spread, and today is used to build software for the web, embedded computers, distributed services, and the command line. "The biggest strength of Rust is that it's an empowering technology," says Carol Nichols, from the Rust programming language core team and co-author of The Rust Programming Language book. "To write extremely fast code with a low memory footprint previously meant using C or C++. However, using those languages in production code requires you to manage memory manually and know all the ways you might cause undefined behavior." Nichols points out that the ever-expanding CVE database of code vulnerabilities is evidence that "even the best programmers" can struggle with this level of freedom.


Feds Urge Private Sector 'Shields Up' Against Hackers

Feds Urge Private Sector 'Shields Up' Against Hackers
"Make no mistake, American companies are squarely in the cross-hairs of well-financed nation-state actors, who are routinely breaching private sector networks, stealing proprietary data and compromising supply chains," Evanina says. "The attacks are persistent, aggressive, and cost our nation jobs, economic advantage, and hundreds of billions of dollars." Last year, Director of National Intelligence Dan Coats told Congress that in the online realm, Russia poses the top online attack threat to United States, while China, North Korea and Iran are also top threats, "although many countries and some non-state actors are exploring ways to use influence operations, both domestically and abroad." Indeed, the former head of the U.K.'s signals intelligence agency, GCHQ, last year warned that it was becoming increasingly difficult to tell cybercriminals and nation-state actors apart


How AI and automation will impact cybersecurity strategies

My real first experience with data security came in 2000 when my personal information was exposed on a website where a disgruntled employee was able to steal an HR spreadsheet that had hundreds of people’s names, DOB, SS#, addresses and how much they earned. Even though we have moved PII to a “more secure” storage method, those storage solutions and access to them are still insecure. And this has been largely proven in the massive breaches of 2018. We need to become better stewards of data that impacts people. I read an article introducing an InfoSec Color Wheel, and they discuss involving and integrating red teams with DevOps. I think that is a great idea to move quicker towards a more secure application development process that will ultimately impact the safety of our data. I had one potential customer tell me, “thank you for not saying that this product uses AI.” I found that to be interesting. More and more applications in several different verticals are gravitating towards AI.


Never mind killer robots—here are six real AI dangers to watch out for in 2019


Carmakers like Ford and General Motors, newcomers like Uber, and a horde of startups are hurrying to commercialize a technology that, despite its immaturity, has already seen billions of dollars in investment. Waymo, a subsidiary of Alphabet, has made the most progress; it rolled out the first fully autonomous taxi service in Arizona last year. But even Waymo’s technology is limited, and autonomous cars cannot drive everywhere in all conditions. ... Last year, an AI peace movement took shape when Google employees learned that their employer was supplying technology to the US Air Force for classifying drone imagery. The workers feared this could be a fateful step towards supplying technology for automating deadly drone strikes. In response, the company abandoned Project Maven, as it was called, and created an AI code of ethics. Academics and industry heavyweights have backed a campaign to ban the use of autonomous weapons. 


wireless connectivity signal in an outdoor landscape / wifi / mesh network
ODFMA should alleviate much of the unpredictability users experience in highly congested areas. Consider a case where a person arrives several hours early to an airport gate and is one of only a few people in a small area. The user connects, watches something on Netflix, and sends out Tweets to their followers. Over time, the gate area gets crowded and the network becomes unusable. The most likely cause of this isn’t bandwidth, but congestion from too many users. ODFMA will take care of this problem by enabling more clients to connect to a single AP simultaneously. Technically what’s happening is that the channels are dividing up into subcarriers through some fancy mathematical functions. The spacing of these subcarriers is orthogonal (hence the O in ODFMA) preventing interference with subcarriers. With Wi-Fi 5, a 20 MHz channel consists of 64 312.5 kHz subcarriers with all of them being used to transmit data to a single client. Wi-Fi 6 operates differently and lets the space shrink from 312.5 kHz to 78.125 kHz, allowing for the number of subcarriers to increase to 256.


How to automate machine learning on SQL Server 2019 big data clusters

H2O provides popular open source software for data science and machine learning on big data, including Apache SparkTM integration. It provides two open source python AutoML classes: h2o.automl.H2OAutoML and pysparkling.ml.H2OAutoML. Both APIs use the same underlying algorithm implementations, however, the latter follows the conventions of Apache Spark’s MLlib library and allows you to build machine learning pipelines that include MLlib transformers. We will focus on the latter API in this post. H2OAutoML supports classification and regression. The ML models built and tuned by H2OAutoML include Random Forests, Gradient Boosting Machines, Deep Neural Nets, Generalized Linear Models, and Stacked Ensembles.H2OAutoML can automatically split training data into training, validation, and leaderboard frames. The h2o.automl.H2OAutoML API also allows these frames to be specified manually, which is useful when the task is to predict the future using a model trained on historical data.


Encryption: Avoiding the Pitfalls That Can Lead to Breaches

Encryption: Avoiding the Pitfalls That Can Lead to Breaches
In its revised findings about a mega-breach that it now says affected 327 million customers, Marriott notes that 25.6 million passport numbers were exposed in the breach, of which 5.25 million were unencrypted. "There is no evidence that the unauthorized third party accessed the master encryption key needed to decrypt the encrypted passport numbers," Marriott says. But that doesn't mean that the attackers couldn't later brute-force decrypt the numbers. Also exposed in the breach were approximately 8.6 million encrypted payment cards that were being stored by Marriott. By the time the breach was discovered in late 2018, however, Marriott says most of the payment cards had already expired. As with the passport data, "there is no evidence that the unauthorized third party accessed either of the components needed to decrypt the encrypted payment card numbers," Marriott says. U.S. Sen. Mark Warner, D-Virginia, says the breach highlights a failure by many organizations to minimize the amount of data they routinely store on consumers.


How Chrome extensions are making organisations vulnerable to attack

How Chrome extensions are making organisations vulnerable to attack image
Application developers can create Chrome extensions to provide a richer experience for their users. Chrome extensions can perform a variety of tasks, from showing the Alexa ranking of websites to blocking ads to processing cryptocurrency payments on-site, and much more. However, to perform these tasks, extensions require permission to access various data, such as the content of visited pages, bookmarks, browser history, clipboards, list of installed apps and even a user’s geographical location. Some extensions might request access to a microphone or webcam, and others might require permission to modify web page content. Chrome extensions are complex applications in their own right. And complex apps can easily hide malicious behaviour. Chrome has a Web Store where developers can publish extensions and users can install them on their browsers. This is the equivalent of Google’s App Store for Android devices. And while Google does its best to keep its marketplace free of malware, cybercriminals are finding new ways to publish and distribute their malicious Chrome extensions and conduct man-in-the-browser attacks.



Quote for the day:


"Your first and foremost job as a leader is to take charge of your own energy and then help to orchestrate the energy of those around you." -- Peter F. Drucker


Daily Tech Digest - January 08, 2019

5G versus 4G: How speed, latency and application support differ

4g versus 5g compare fruit apples to apples
5G uses new and so far rarely used radio millimeter bands in the 30 GHz to 300 GHz range. Current 4G networks operate on frequencies below 6GHz. Low latency is one of 5G's most important attributes, making the technology highly suitable for critical applications that require rapid responsiveness, such as remote vehicle control. 5G networks are capable of latency rates of under a millisecond in ideal conditions. 4G latency varies from carrier to carrier and cell to cell. Still, on the whole, 5G is estimated to be 60 to 120 times faster than average 4G latencies. Over time, 5G is expected to advance wireless networking by bringing fiber-like speeds and extremely low latency capabilities to almost any location. In terms of peak speed, 5G is approximately 20 times faster than 4G. The new technology also offers a minimum peak download speed of 20 Gb/s (while 4G pokes along at only 1 Gb/s). Generally speaking, fixed site users, such as offices and homes, will experience somewhat higher speeds than mobile users.



This old ransomware is using an unpleasant new trick to try and make you pay up

This ransomware attack begins, like many others, with brute force attacks targeting weak passwords on RDP ports. Once inside the network, the attackers harvest the admin credentials required to move across the network before encrypting servers and wiping back-ups. Victims are then presented with a ransom note that tells them to send an email to the ransomware distributors, who also warn victims not to use any security software against CryptoMix, with the attackers claiming that this could permanently damage the system (a common tactic used by attackers to dissuade victims from using security software to restore their computer). But if a victim engages with the attackers over email, they'll find out that those behind CryptoMix claim that the money made from the ransom demand -- usually two or three bitcoins -- will be donated to charity. Obviously, this isn't the case, but in an effort to lure victims into believing the scam, the CryptoMix distributors appear to have taken information about real children from crowdfunding and local news websites.


DevOps to DevSecOps adjustment banks on cross-group collaboration


Eventually, the CIO and chief information security officer (CISO) must participate in the DevOps discussion. This is especially true when a development project needs to be compliant with the Sarbanes-Oxley Act, Health Insurance Portability and Accountability Act or other compliance standards. This discussion needs to cover how teams can work together to achieve IT delivery goals with the best use of resources. For Peterson, the borderless environment of the cloud makes it tougher for CISOs and their teams to keep an organization secure. Security, development and operations teams must agree to communicate and share knowledge across domains. Because so many people have roles in a company's security strategy, Sadin suggested organizations designate a single point person for risk or security -- DevOps shop or not. But don't let security silo itself, Rowley cautioned. When security becomes so removed from the process that it doesn't function well with the other C-level executives or departments, security will fail.


HQ 2.0: The Next-Generation Corporate Center


In short, the economies of scale associated with centralized services have eroded. The functional security blankets justifying their expense no longer apply; it is not enough anymore to meet regulatory requirements and provide basic internal services. The business units and the new generation of talent are demanding more. Finally, the combination of new digital Industry 4.0–style platforms, robotics, intelligent machines, and advanced analytics are allowing companies to harness the explosion of data and fundamentally alter how and where work gets done. ... The new corporate center will be smaller, but it will still have executive and functional leaders and their staffs, mostly limited to five ongoing roles. First, they will define and communicate the company vision, values, and identity. Second, they will develop the corporate strategy and be responsible for the necessary critical enterprise-wide capabilities. Third, they will oversee the business unit portfolio, and related legal, regulatory, and fiduciary activities. Fourth, they will allocate capital.


Don’t Panic: Biometric Security is Still Secure for Enterprises

Don't Panic: Biometric Security is Still Secure for Enterprises
The early assumptions surrounding biometric security—that it could supplant passwords—fuels the current panic in the discourse. However, biometric security remains secure so long as your enterprise treats it as another layer in your overall authentication platform. When you incorporate biometric security into your two-factor authentication, your access management becomes stronger; hackers will have to acquire both your employees’ passwords and their biometric information to try and break into the network.  However, two-factor authentication faces its own scrutiny. Hackers have found ways to subvert the traditional authentication use of mobile devices and insert themselves into the authentication process. Therefore, enterprises embrace multi-factor authentication (MFA) for its more layered approach to access management. Additionally, multifactor authentication can be applied in a granular fashion. Your regular employees may only require two-factor authentication, whereas your most privileged users may need as many as five factors to access your sensitive digital assets.


Threat of a Remote Cyberattack on Today's Aircraft Is Real

Responding to the attack, Boeing issued a multiparagraph statement that included this passage: "Boeing is confident in the cyber-security measures of its airplanes. … Boeing's cyber-security measures … meet or exceed all applicable regulatory standards." ... To solve it, we need industry regulations that require updated cybersecurity policies and protocols, including mandatory penetration testing by aviation experts who are independent of manufacturers, vendors, service providers and aircraft operators. Be mindful of those who claim aviation expertise; few have the necessary experience, but many claim they do. "Pen testing" is essentially what DHS experts were conducting during the Boeing 757 attack. A pen test is a simulated attack on a computer system that identifies its vulnerabilities and strengths. Pen testing is one of many ways to mitigate risk, and we need more trained aviation and cyber personnel to deal with the current and emerging cyber threats — those that haven't even been conceived of yet.


Enterprise search trends to look for in 2019

Enterprise search trends to look for in 2019 image
Imagine if your company’s Intranet search were as easy, personalised, and contextual as Google’s Internet search. Cognitive search will help make this a reality by giving enterprise users the ability to locate truly relevant text, image, and video files from within large volumes of both internal and external data. One the biggest challenges facing enterprise search is the nature of much of the data. Gartner estimates that 80% of organisational data is unstructured, meaning that it doesn’t adhere to predetermined models. This results in irregularities and ambiguities that can make it difficult to find using traditional search programs. AI programs help automatically tag this unstructured information, making it much more easily discoverable. Cognitive search also improves accuracy by considering the context of each query. By examining and learning from past searches, these types of systems can identify the person who is looking for the information and what type of content the person is expecting to find.


IoT devices proliferate, from smart bulbs to industrial vibration sensors

IoT devices proliferate, from smart bulbs to industrial vibration sensors
Arguably the biggest and most-established use in this area is preventive maintenance, usually in an industrial setting. The concept is simple, but it relies on a lot of clever computational work and careful integration. Preventive maintenance uses gadgets like vibration and wear sensors to measure the stresses on and performance of factory equipment. For example, in a turbine those sensors feed their data into software running on either an edge device sitting somewhere on the factory floor for quick communication with the endpoint or on a server somewhere in the data center or cloud. Once there, the data can be parsed by a machine-learning system that correlates real-time data with historical, enabling the detection of potential reliability issues without the need for human inspection. Fleet management’s another popular use case for IoT devices. These systems either take advantage of a GPS locator already installed on a car or add a new one for the purpose, sending that data via cellular network back to the company, allowing rental car firms or really any company with a large number of cars or trucks to keep track of their movements.


A Framework in C# for Fingerprint Verification


Fingerprint recognition is an active research area nowadays. An important component in fingerprint recognition systems is the fingerprint matching algorithm. According to the problem domain, fingerprint matching algorithms are classified in two categories: fingerprint verification algorithms and fingerprint identification algorithms. The aim of fingerprint verification algorithms is to determine whether two fingerprints come from the same finger or not. On the other hand, the fingerprint identification algorithms search a query fingerprint in a database looking for the fingerprints coming from the same finger. There are hundreds of papers concerning fingerprint verification but, as far as we know, there is not any framework for fingerprint verification available on the web. So, you must implement your own tools in order to test the performance of your fingerprint verification algorithms. Moreover, you must spend a lot of time implementing algorithms of other authors to compare with your algorithms.


Towards Successful Resilient Software Design

What is different these days, is the fact, that almost every system is a distributed system. Systems talk to each other all the time and also usually the systems themselves are split up in remote parts that do the same. Developments like microservices, mobile computing and (I)IoT multiply the connections between collaborating system parts, i.e., take that development to the next level. The remote communication needed to let the systems and their parts talk to each other implies failure modes that only exist across process boundaries, not inside a process. These failure modes like, e.g., non-responsiveness, latency, incomplete or out-of-order messages will cause all kinds of undesired failures on the application level if we ignore their existence. In other words, ignoring the effects of distribution is not an option if you need a robust, highly available systems. This leads me to the “what” of RSD: I tend to define resilient software design as “designing an application in a way that ideally a user does not notice at all if an unexpected failure occurs or that the user at least can continue to use the application with a defined reduced functional scope”.



Quote for the day:


"The quality of a leader is reflected in the standards they set for themselves." -- Ray Kroc


Daily Tech Digest - January 07, 2019

Want a hybrid workforce? The trick is getting humans and machines speaking to each other

hybrid.jpg
A stealth company is trying to solve one of the oddest interoperability problems of the modern era: How do you get robots and non-engineers talking to each other? Founded by the former Director of Robotics for Google, the company, Formant, is making its first public bow thanks to a recently-announced $6 million in funding from SignalFire. Formant's pitch is straightforward, and it illustrates the peculiar problem of automation in 2019: Robots perform a lot of tasks in industries like logistics and manufacturing, but those industries still rely on humans for crucial decisions robots can't yet make. Getting robots and humans communicating in real time to facilitate that decision-making has been tricky and usually requires an intermediary in the form of an engineer. ... "We founded Formant to answer the biggest problem that faces automation today: robots produce too much information, in disparate forms that cannot be viewed simultaneously," said Jeff Linnell, founder, and CEO of Formant and a robotics insider with deep industry connections.


Expect banks and fintechs they trust to reach wider arrangements that give banks more confidence in the security surrounding data sharing and third-party innovation.  The Financial Data Exchange, made up of big banks like JPMorgan Chase and Wells Fargo as well as data aggregators and fintechs, was established in 2018 to create a standard to safely share information and address risks tied to open banking. The group — along with the “Secure Open Data Access” framework formed earlier this year with support from Envestnet’s Yodlee, Quovo and Morningstar's ByAllAccounts — could put banks more at ease with open banking.  Meanwhile, banks such as BBVA Compass, Capital One, Citibank and Silicon Valley Bank continue to move forward with open-banking initiatives. ... Meantime, blockchain advocates at financial institutions are weary of trying to convince others of the technology's potential. Blockchain proponents admit bank executives and regulators still link the technology to wild swings in cryptocurrency values.



The well-crafted phishing web pages use custom web font files known as “woff files” to implement a substitution cypher that makes the source code of phishing pages appear benign. When the phishing landing page renders in the browser, users are presented with a typical online banking credential phish using stolen bank branding, but includes encoded display text. Substitution functions in phishing kits are frequently implemented in JavaScript, the researchers said, adding that no such functions appeared in the page source. Instead, the researchers identified the source of the substitution in the CSS [cascading style sheet] code for the landing page. The researchers extracted, converted and viewed the woff and woff2 web font files to discover the phishing landing page was using those custom web font files to make the browser render the ciphertext as plaintext, while the malicious code remained hidden.



Top 4 enterprise tech trends to watch in 2019

Top 4 enterprise tech trends to watch out for in 2019
How can security be improved? Advances in cloud computing and blockchain will help organizations better protect their data, Climer wrote in a recent article. “Though these aren’t new technology trends — blockchain and the cloud led conversations throughout 2018 — how businesses utilize these tech tools for their operational security will likely transition dramatically,” she wrote. Jessica Marie, director of product marketing at Vera Security, also said tech advances in cybersecurity will help. “I'm most excited about advancements in cybersecurity, particularly encryption technologies and securing data in the cloud/collaboration tools. Something tells me with recent breaches, this might become very necessary,” she said during the Twitter chat. Data governance will also play a large role in improving cybersecurity and data privacy, said Tyler James Johnson, founder and CEO of PrivOps. “I'm big on data and analytics solutions, as well,” Johnson said. “I see a big connection between that and data privacy and security. For me, 2019 will be the year all these trends converge.”


Security and patching: 5 resolutions for 2019

Security and patching: 5 resolutions for 2019
The number of IT assets that companies have in place continues to go up, with more endpoint devices, servers and applications in place that all need to be kept up to date. At the same time, the number of known vulnerabilities continues to rise, and the amount of time to deploy the available patches is coming down. The amount of time between vulnerabilities getting announced and exploits becoming available is dropping. The reducing window makes it difficult to keep systems up to date when there are hundreds, thousands or even millions of assets to consider. The second issue is error proofing. Patches may break other applications, or introduce other flaws that lead to more security issues in the future. In some cases, they may not work or break the machines they are applied to. Whatever the output, a poorly applied patch may cause more harm. Testing to check that these failure conditions don't take place is therefore necessary to avoid problems coming up. The third issue is prioritization. With so many assets to look after and so many applications to test, it can be hard for teams to know where to put their efforts.


UK contactless card fraud doubles


Unlike chip and PIN transactions, contactless payments can be made without additional authentication, such as a PIN. Under current rules, payments of up to £30 can be made using the technology. Contactless is overtaking chip and PIN as the most popular way of paying for goods and service because of its convenience. According to recent figures from payment processing firm Worldpay, more card payments were made using contactless technology than chip and PIN in the UK over the 12 months from June 2017 to June 2018. It revealed that, after increasing by 30% on the previous year, contactless payments were the most used card payments in shops. ... “Fraudsters will do all they can to steal your card and account details and take money from your account. If you’ve seen unusual activity on your bank statements, such as purchases you don’t remember making or cash withdrawals from places you don’t remember visiting, tell your bank immediately.”


The attack surface is growing faster than it has at any other point in the history of technology

attack surface growth
In 2019, well known tactics such as advertising, phishing and fake apps will continue to dominate the mobile threat landscape. In 2018, we tracked and flagged countless fake apps using our apklab.io platform. Some were even found on the Google Play Store. Fake apps are the zombies in mobile security, becoming so ubiquitous that they barely even make the headlines as new fake apps pop up to take the place of the ones already flagged for removal. They will continue to persist as a trend in 2019, exacerbated by fake versions of popular app brands doing their rounds on the Google Play Store. In 2018, the return of banking Trojans was also particularly pronounced on the mobile side, growing 150 percent year-on-year, from three percent to over seven percent of all detections we see worldwide. While perhaps not a big shift in terms of the overall volume, we believe that cybercriminals are finding banking to be a more reliable way to make money than cryptomining.


Singapore Airlines data breach affects 285 accounts, exposes travel details

Singapore Airlines employees urged to innovate, fail without fear
"We have established that this was a one-off software bug and was not the result of an external party's breach of our systems or members' accounts. The period during which the incident occurred was between 2am and 12.15pm, Singapore time, on 4 January 2019, at which point the issue was resolved," the spokesperson said.  The airline said it will contact all affected customers and has "voluntarily informed" Singapore's Personal Data Protection Commission about the data breach. ... Upon contacting SIA's customer hotline, the SIA customer was informed by the call agent that the airline was performing a system upgrade and instructed to log out of her account and log back in after 24 hours. "Such incidents are unacceptable for a company as big as Singapore Airlines. How can you do a system upgrade without proper testing?" the customer had said. "It's frustrating that we're held hostage by these companies that demand our personal details, but don't keep the data safe. When you ask for my personal data, I expect you to have the technology and systems in place to keep it secured."


Expanding the boundaries of the digital workplace


One of the central principles in establishing a perimeterless digital workplace is that the network alone does not determine which services users can access. Unlike the perimeter-based security model, the decision to grant or deny access is not tightly bound to a physical location, IP address or the use of a virtual private network (VPN). Instead, user, device and other contextual data, such as threat signals, dynamically determine the appropriate access policy, which may trigger the need for multifactor authentication, access denial or other trust elevation techniques. User and contextual trust should be appropriate to the level of risk associated with the resource being accessed. This is best illustrated with an example of a user accessing sensitive data. Sometimes, the access to sensitive data – for example, company financials – might require the user to be a full-time employee using a fully managed device.


Super Charge the Module Aware Service Loader in Java 11

Java’s answer to provide developers the ability to design and implement extensible applications without modifying the original code base came in the form of services and the ServiceLoader class--introduced in Java version 6. SLF4J uses this service loading mechanism to provide its plug-in model that we described earlier. Of course, dependency injection or inversion of control frameworks are another way to achieve the same and more. But, we will focus on the native solution for the purpose of this article. ... The default ServiceLoader’s “load” method searches the application classpath with the default class loader. You can use the overloaded “load” method to pass a custom class loader to implement more sophisticated searches for service providers. In order for the ServiceLoader to locate service providers, the service providers should implement the service interface--in our case the PaymentService interface.



Quote for the day:


"Management is about arranging and telling. Leadership is about nurturing and enhancing." -- Tom Peters