Daily Tech Digest - February 06, 2019

People Are Key to a Tech-Enabled Audit


Technological innovation is taking audit and assurance by storm. But for PwC, it’s not all about robots and technology. It’s also about upskilling their people. “I think that technology has a role to play, and me being in the technology field, I'm very fond of technology. The reality is without competent people, technology's only going to take you so far, and it's not far enough,” explained Mike Baccala, U.S. Assurance Innovation Leader. “It's critically important that any organization that is taking this journey, including our clients, can't leave their people behind.” Baccala was joined by PwC’s Maria Moats, U.S. Audit & Assurance Leader and Pierre-Alain Sur, U.S. Assurance Process & Technology Leader at a recent a PwC Audit Innovation Demo in New York where they sat down with members of the media to showcase the technologies enhancing PwC’s audit and the many ways they’re investing in their people.  There are clear risks, Baccala says, to overemphasizing technology at the expense of people and process, giving lease accounting as an example.


This is how AI bias really happens—and why it’s so hard to fix


The introduction of bias isn’t always obvious during a model’s construction because you may not realize the downstream impacts of your data and choices until much later. Once you do, it’s hard to retroactively identify where that bias came from and then figure out how to get rid of it. In Amazon’s case, when the engineers initially discovered that its tool was penalizing female candidates, they reprogrammed it to ignore explicitly gendered words like “women’s.” They soon discovered that the revised system was still picking up on implicitly gendered words—verbs that were highly correlated with men over women, such as “executed” and “captured”—and using that to make its decisions. Imperfect processes. First, many of the standard practices in deep learning are not designed with bias detection in mind. Deep-learning models are tested for performance before they are deployed, creating what would seem to be a perfect opportunity for catching bias.


Prepping the Enterprise for the AI Apocalypse

Image: phonlamaiphoto - stock.adobe.com
There are a lot of steps on this journey, according to Linthicum. For instance, how do you go about getting the talent and skill sets you need in-house? How do you migrate to new modernized platforms in the cloud? What's the collection of technologies that need to be put together, and how will you implement that technology in an orderly way? Enterprises need to create new kinds of infrastructure that can quickly adapt itself to the needs of the organization. Speed is important. "I think if you ask the CEOs they would say we're not funded to do it. And if you ask the board of directors and CEOs they say we want it to happen," said Linthicum. "So we just get fingers pointing both ways and nothing ends up getting done." Linthicum is predicting a brand apocalypse in which many of the familiar company names that we see every day are going to just disappear or be sold. He points to the fact that Ford Motor Co. is not building cars anymore -- just trucks and SUVs. "We need to understand that if we are going to survive in the market we have to react to the disruptors and try to disrupt them before they disrupt you. You have to leverage the technology you need to make that happen."


C# Futures: Static Delegates and Function Pointers

With each release of C#, it gains more low-level capabilities. While not useful to most business application developers, these features allow for high performance code suitable for graphics processing, machine learning, and mathematical packages. In these next two proposals, we see new ways to reference and invoke functions. A normal delegate in C# is a somewhat complex data structure. It contains a function pointer, an optional object reference for the this parameter, and a link to a chained delegate. The whole structure is heap-allocated like any other reference type, with the corresponding memory pressure. Furthermore, whenever it is used with unmanaged code it needs to be marshalled. Compared to a normal delegate, a “static delegate” is greatly simplified. It is implemented as a struct with one field, a function pointer of type IntPtr. This makes it blittable, which means it has exactly the same memory layout when used in managed and unmanaged code. Or in other words, marshalling isn’t required when calling a native system function.


2019 – Rise of the Robots? What lies ahead…


As members of the public become more aware of the capabilities and limitations of AI, they will demand more transparency and accountability in AI decision making, which will drive funding and research into such “explainable” tech. As a result, we will see more responsible use of AI, rather than just using AI for AI’s sake. The European Union’s General Data Protection Regulation will also promote a cautionary approach to machine learning rollouts within the EU, particularly where use cases involve direct or indirect processing of personal data. Underpinning this is a massive technological research drive to try and unpick the inherent “black box” nature of deep neural networks, either by re-architecting or developing complementary explicatory systems. Data Scientists are for example working on solutions to “slice” up complex ML decisions into more manageable (and defined) steps, each of which will hopefully make the task of auditing decisions easier.


14 Signs Your Smartphone Has Been Hacked


Today’s smartphones are powerful computers that allow us to perform tasks that only a generation ago would have literally been considered science fiction. Our portable devices also often contain a significant amount of personal and confidential information, including the contents of our text and email communications, as well as direct access to various of our social media and other accounts via pre-logged-in apps. It is imperative, therefore, that we keep our smartphones safe from hackers, and take immediate corrective action if we discover that any of our phones has been breached. So, how can you know that your smartphone was compromised, and that you need to take immediate, corrective action? Below are some symptoms for which to look out. Please keep in mind, however, that none of the clues that I discuss in this article exists in a vacuum, or is, on its own, in any way absolute. There are reasons other than a breach that may cause devices to act abnormally, and to exhibit one or more of the ailments described below.


Tech sector tells government that digital identity policy is 'urgently required'


“To ensure the UK does not fall behind other countries, we must create an interoperable framework for digital IDs which spans the public and private sectors,” said Julian David, CEO of TechUK. “We see instances where companies which want to bring world-class solutions to UK users often struggle to get support, either due to a reluctance to innovate or lack of a joined-up approach from key public sector bodies,” he said. “Too often, tech companies encounter difficulties which delay or obstruct innovation. It is particularly frustrating to hear British companies do not experience these problems in other countries.” Citing the growth in fraud, identity theft and the hindering of online innovation as the cost of further delay, the report says that “a coherent strategy is urgently required”. “The plea from many in the tech industry is that the issue of identity needs to be joined up to tackle the need to manage multiple digital identities and consumer expectations on ease of access to all types of online service,” said the report.


The top 4 IT security hiring priorities and in-demand skills for 2019

programmer devops certification skills code data scientist student by fatos bytyqi unsplash
It’s no surprise that according to CIOs, security and people/talent top the list of core investment priorities for 2019. For IT security specifically, Information Security (InfoSec) ranked as the primary IT Security hiring priority for the next 12 to 18 months among decision-makers, according to Mondo’s IT Security Guide. Enterprise executives are taking note of the increased risks and PR damage associated with data breaches given the increase in coverage of these types of cyber attacks at major tech giants and global organizations in 2018. Additionally, the increased access and use of sensitive consumer data by various departments in a given business is providing hackers with new access points and vulnerabilities to exploit, resulting in an increased demand for enhanced InfoSec investments. As a result, Information Security Analysts, Engineers, and Manager roles are the in-demand positions for this high-end skill set.


The future of robotics: A convergence of the physical and digital

The future of robotics: A convergence of the physical and digital image
The hybridisation (there’s a word for you, technology and the dictionary are seeing hybridisation) of robots and humans are already coming together. There are ‘simple’ examples in healthcare, where robotic limbs are connecting to the user’s brain, so that an arm, for example, feels like it’s yours. It becomes an extension of that person, and adds to their sense of being. On the other side, robots are increasingly acting like humans, because the best way to interact with humans is to imitate them. But, to get this right we need to eradicate racial, gender, sexual and background prejudices that have stained society. Why? Because our robots and AI systems are going to use the social norms that we’re used to. 300 years ago prison architecture changed so that the guard could always see a prisoner. This, consequently, changed the behaviour of that prisoner. Information and knowledge of individuals can change their behaviour. In London, for example, the erection of 420,000 cameras and their position has changed the dynamic of crime.


Is 2019 the Year Agile Transformation Finally Works?

The traditional analogy of mass production encourages specialist teams focused on delivering the most efficient process for their activity. This works well when the problems are not that complex, the process can be defined, and problem well understood. Delivering value to customers is MUCH more complex than in the past where many projects were automating existing manual processes, with customers now requiring faster delivery cycles, with unknown requirements and potential technology solutions changing every few months. To be effective in this new world, it requires the formation of new, dynamic teams. Not just for the building elements but also marketing, operations and even finance. Specialists will still be required to do the work, but they will work in very different team models with different specialists. Management will change from coordinating the different teams to providing direction and helping the teams self-organize as necessary.



Quote for the day:


"Power concedes nothing without a demand. It never did and it never will." -- Frederick Douglass


Daily Tech Digest - Feb 04, 2019

Facebook Gets Its First Real Privacy Penalty - From Apple

Facebook Gets Its First Real Privacy Penalty - From Apple
When Apple revoked Facebook's enterprise certificate, it subsequently broke all of Facebook's other internal employee apps. The side effect was likely unintentional, as just one certificate signed all of the apps. But it still had a far greater impact than any regulator could match for a privacy-related issue. The two companies, however, were working to restore Facebook's ability to use internal apps. Could Apple take this further and use its power in the mobile OS market to bring Facebook in line with evolving privacy wisdom? It's an idea floated in a column by Kevin Roose in the New York Times on Thursday. Apple could boot all of Facebook's apps - Instagram, WhatsApp included - literally with a few digital certificate revokations, a power no regulator has.There are all kinds of obvious problems with this, of course. A multi-billion dollar tech company shouldn't be taking up the slack for governments that are failing to protect consumers' privacy rights. Apple can take a strong privacy stance because it has little stake in the personal data trade. That could change, of course, depending on how Apple's business interests shift.


An inconvenient truth: Companies are struggling with technology in audit

Organizations first need to define the right balance between stability and innovation: starting with an evaluation of their environment from a regulatory and compliance perspective in order to determine where the most critical audit risks lie. Because every sector is different, the requirements can go from securing the crown jewels (personal data, intellectual property, etc.) and responding to regulatory and governing bodies to ensuring the high availability of customer-facing applications. This risk assessment must then feed into an overall technology strategy meant to address the most critical issues, starting with basic IT controls and extending to the enhancement of monitoring and reporting. The organizations’ objective should be to enable an approach where traditional auditing of its systems (Audit of IT) is no longer the norm.... Once all of these IT controls have been addressed and strong, effective processes are in place, organizations can focus on innovating and making more intelligent use of technology, like advanced analytics or control automation, for audit and insights. 


10 ways AI will enable self-service capabilities for enterprise automation

Within the past two years we’ve seen digital transformation dramatically impact businesses around the world. In the realm of enterprise automation, we saw artificial intelligence emerge as an impactful technology promising significant automation gains – in 2017 AI gained traction in the IT department, and during 2018 we saw its entry into boardrooms. In 2019, we will see AI combined with mobility and content understanding change entire workflows and processes within organizations, offices and factory floors. This requires not only transformation in IT strategy, but also in skills, recruitment and corporate attitudes. One of the most impactful technology trends we will see in 2019 is broad enterprise technology transition to self-service models. ... Corporate users are now eager to let robots take over. After panic of robots taking over their jobs have subsided, business users will initiate opportunities for digital workers to handle mundane, repetitive, manual tasks so they can focus on more cognitive and strategic work.


Chinese OEMs increase semiconductor buying power, says Gartner

Chinese OEMs increase semiconductor buying power, says Gartner image
According to Gartner, the buyers’ ranking was significantly impacted by consolidation in the smartphone and PC markets. The big Chinese smartphone OEMs, in particular, have increased their market domination by taking out or purchasing competitors. This also meant that the top OEMs’ spending increased and their share reached 40.2% of the total semiconductor market in 2018, up from 39.4% in 2017. This trend is expected to continue, which will make it more difficult for semiconductor vendors to maintain high margins. ... Memory prices also impacted the market. Despite being high in the past two years, the Dynamic random-access memory (DRAM) average selling price (ASP) is now declining. However, the impact is limited, as OEMs will increase their memory content when the ASP drops and also invest in premium models. Gartner predicts that the share of total memory chip revenue in the total semiconductor market will be 33% in 2019 and 34% in 2020, higher than its 31% share in 2017.



Applying Industry Standards to Address Cybersecurity Risk

The need to improve industry response to address cybersecurity risk is well established. Each new incident report increases awareness of the risks faced. The nature of the risks continues to evolve as new vulnerabilities and threats are discovered. Beginning with the Stuxnet attack in 2010 a steady stream of incidents have shown that industrial systems are vulnerable to both general and targeted attacks. While they may accept the need to protect their critical systems better, many asset owners struggle to understand what type of guidance information is available and how industry standards can help them formulate their response. The number and variety of available standards and related sources and complexity of the topic add to the confusion. An effective response to the threat must address all phases of the life cycle, from conception and selection through operations and support. Established standards reflect this need and provide requirements for all involved, from suppliers and integrators to asset owners and support providers.


Can power be software-defined?

Software-defined
Does this disruptive and revolutionary change in IT have an equivalent in the way that power is distributed and managed? Power is, after all, not so dissimilar to the flow of bits: it is a flow of electrons, which can be stored, generated and consumed, is distributed over a network, and is switchable and routable, and therefore manageable, from a distance. A follow-on question to this is: Even if power can be managed in this way, when is it safe, economic and useful to do so, given the many extra complexities and expenses involved in managing power? The answer to both questions is not quite as binary or as definitive as at the IT level, where the impact of software-defined has been immediate, significant and clearly disruptive. While the application of more intelligence and automation is clearly useful in almost all markets, the opportunities for innovation in power distribution are much less clear. Data centers are a stand-out example: Large facilities present a great opportunity for suppliers, because of the size and growth of the market, vast over-provisioning, high costs, and inflexibility in power distribution and use.



Bangladesh Bank Sues to Recover Funds After Cyber Heist

The Bangladesh Bank heist also highlighted operational weaknesses at the New York Fed, a 2016 investigation by Reuters found (see: Report: New York Fed Fumbled Cyber-Heist Response). Notably, attackers timed their attack to occur on the evening of Feb. 4, 2016, a Thursday, which was the day before the weekend begins in Bangladesh. They also used malware that suppressed printouts of concerned messages sent by New York Fed officials after they saw suspicious transactions. When Bangladesh Bank officials spotted the activity on Saturday, Feb. 6, they attempted to contact the Fed via email, sending a message that read: "Our system has been hacked. Please stop all payment (debit) instructions immediately," according to the report. But the New York Fed reportedly apparently didn't receive the message until the start of its workday on Monday morning, and it didn't inform Bangladesh Bank that it had alerted correspondent banks to the fraud until Monday evening, New York time.


Smarter Connectivity for The Data-Driven Enterprise


It just seems that as the number of data sources grows, connectivity just becomes harder with the user having to know how to get at all the data he or she needs. Going back to IoT for a second, consider if you walk in to the office in the morning and there are 1000 more devices on the network than there were yesterday. What happens if you want access to the data on those new devices? Is the user expected to just know how to connect? Are we not just pushing more and more complexity onto the user? Can we not simplify it? Could it not be more dynamic? Or is it that we will continue to see software like BI tools lengthening the list of connectors to data sources, release by release? It just seems to me that we need to hide the connectors to all these data sources and connect to data at a higher level of abstraction. There are multiple ways of doing that. For example, you could use data virtualisation. Alternatively, we could look for some kind of advances in the data connectivity area itself – something that does not seem to have changed much in a couple of decades. If we look at the latter i.e. smarter connectivity, then what are we asking for?


How to Cultivate a Data-Inclusive Culture

We have seen organizations jump to acquire the latest cutting-edge technology in the hopes of capitalizing on data opportunities. But often the efforts are, again, myopic, driven by a single department, and not connected to the organization’s broader strategy. As a direct result of failing to coordinate with other parts of the business, organizations often will miss the opportunity to harness existing data to develop a deeper understanding of the customers and insights related to their business. In fact, the Katzenbach Center’s 2018 Global Culture Survey reveals that the biggest challenge to culture evolution is having certain areas of an organization more on board with an initiative than others. The solution is to instead bring in members of diverse teams throughout the organization to share the current state of how things actually work and make holistic decisions about how to move forward to best capitalize on data. This way, every department feels heard and is part of the process.


Brexit Preparation: Get Personal Data Flows in Order

In the event of "no deal," there also won't be an "adequacy" agreement in place. Such an agreement would mean that the U.K.'s laws are seen by the EU as being good enough to comply with European law. "Companies and organizations operating within countries with adequacy agreements enjoy uninterrupted flow of personal data with the EU," Denham says. Unfortunately, no withdrawal agreement also means no adequacy agreement, at least not right away. "An assessment of adequacy can only take place once the U.K. has left the EU," she says. "These assessments and negotiations have usually taken many months," she says. "Until an adequacy decision is in place, businesses will need a specific legal transfer arrangement in place for transfers of personal data from the EEA to the U.K., such as standard contractual clauses." ... EU data protection authorities can impose fines of up to €20 million ($23 million) or 4 percent of an organization's annual global revenue - whichever is greater - on any organization found to have violated GDPR. Regulators can also revoke an organization's ability to process individuals' personal data.



Quote for the day:


"The quality of a leader is reflected in the standards they set for themselves." -- Ray Kroc


Daily Tech Digest - February 03, 2019

Serverless computing’s dark side: less portability for your apps

Serverless computing̢۪s dark side: less portability for your apps
How that serverless development platforms calls into your serverless code can vary, and there is not uniformity between public clouds. Most developers who develop applications on serverless cloud-based systems couple their code tightly to a public cloud provider’s native APIs. That can make it hard, or unviable, to move the code to another platforms. The long and short of this that if you build an application on a cloud-native serverless system, it’s both difficult to move to another cloud provider, or back to on-premises. I don’t mean\ to pick on serverless systems; they are very handy. However, more and more I’m seeing enterprises that demand portability when picking cloud providers and application development and deployment platforms often opt for what’s fastest, cheapest, and easiest. Portability be dammed. Of course, containers are also growing by leaps and bounds, and one of the advantages of containers is portability. However, they take extra work, and they need to be built with a container architecture in mind to be effective.


Grady Booch on the Future of AI

To put things in perspective, there have been many springs and winters in the development of artificial intelligence. The first winter was in the 1950s during the height of the Cold War. There was a great deal of interest in machine translation in order to translate Russian into some other language. According to an often quoted story, they put in statements such as "The spirit is willing, but the flesh is weak". Translated into Russian and back, the result was "The vodka is strong, but the meat is rotten." Language learning was a lot harder than people first thought. The next spring arose with the ideas of Newell and logic theorist Terry Winograd that used the idea of manipulating small world blocks, which led to some progress. Of course that was the time when Marvin Minsky stated that there will be human level intelligence in three years. No one makes those kinds of claims any more. Computational power and expressiveness were the limits to this approach.


Blockchain and biometrics: The patient ID of the future?

iris.jpg
This isn't the first time blockchain has paired with biometrics for identification purposes. Starting back in 2017, Microsoft and Accenture joined to create a blockchain solution that used biometric data to act as digital identification for refugees. Pharmaceuticals have also considered utilizing blockchain to improve track-and-trace serialization. IrisGuard's technology has previously been used by the United Nation Agencies to prevent human trafficking, providing refugees with iris-based registration and e-payment solutions through the High Commissioner for Refugees (UNHCR) and the World Food Programme (WFP), the release said. "Patient identification is a growing problem in today's healthcare system," Chrissa McFarlane, CEO and founder of Patientory, Inc., said in the release. "This technology can help providers identify an individual with unparalleled accuracy, through iris-recognition and data matching. And because it's verified on the blockchain, it's scalable without sacrificing data security—which is one of the main problems with our current healthcare-data infrastructure."


State Machine Design in C

A common design technique in the repertoire of most programmers is the venerable finite state machine (FSM). Designers use this programming construct to break complex problems into manageable states and state transitions. There are innumerable ways to implement a state machine. A switch statement provides one of the easiest to implement and most common version of a state machine. Any transition is allowed at any time, which is not particularly desirable. For most designs, only a few transition patterns are valid. Ideally, the software design should enforce these predefined state sequences and prevent the unwanted transitions. Another problem arises when trying to send data to a specific state. Since the entire state machine is located within a single function, sending additional data to any given state proves difficult. And lastly these designs are rarely suitable for use in a multithreaded system. The designer must ensure the state machine is called from a single thread of control.


Privacy: Several States Consider New Laws

Privacy: Several States Consider New Laws
"Each of the 50 states now has its own breach notification laws, with nearly one-half adopting data security and/or data disposal requirements to protect consumers' personally identifiable information from unauthorized disclosure," says privacy attorney David Holtzman, vice president of compliance at security consultancy CynergisTek. "While most states are not taking a sectorial approach to the type of PII that must be protected, New York, Ohio and South Carolina have adopted cybersecurity requirements that target industries that include health plans and insurers," he adds. "A theme seen in state legislation to update breach notification laws in recent years is to set shorter notification periods. Some argue that this would give consumers more time to take action to protect themselves against the threat of financial fraud or identity theft by notifying major credit reporting agencies." Privacy attorney Kirk Nahra of the law firm Wiley Rein notes: "The states continue to examine the possibilities for increasing privacy and data security protections, both in currently regulated areas and in situations where federal law is not directly applicable through a specific law or regulation."


The 3 Secret Types of Technical Debt

Unfortunately, the cost of repaying debt is much higher by that point, just because of the compound interest you have to pay back that was consolidated into the debt. In other words, 2 hours invested in repaying technical debt 6 months ago, could be equivalent to 1 day of work today to repay the same amount of debt. The problem with this type of approach is it feels you are going fast to start with because you are delivering features and the technical debt is not hurting you as much at the very beginning. The problem is you are putting yourself on the compound interest curve, instead of staying linear. Linear and compound curves look similar at the start, very different later on. In most cases, you want to avoid ending up in this category. An example of where this type of debt is acceptable is when you need to hit a regulatory deadline, where the cost of not hitting the deadline outweighs the cost of repaying the compound debt accumulated later on.


Decision Trees — An Intuitive Introduction

Regression works similar to classification in decision trees, we choose the values to partition our data set but instead of assigning class to a particular region or a partitioned area, we return the average of all the data points in that region. The average value minimizes the prediction error in a decision tree. An example would make it clearer. Predicting rainfall for a particular season is a regression problem since rainfall is a continuous quantity. Given rainfall stats like in the figure below how can a decision tree predict rainfall value for a specific season? ... But being a supervised learning algorithm how does it learn to do so; in other words how do we build a decision tree? Who tells the tree to pick a particular attribute first and then another attribute and then yet another? How does the decision tree know when to stop branching further? Just like how we train a neural network before using it for making predictions we have to train (build) a decision tree before prediction.


Before AI is a human right, shouldn't we make it work first?

istock-675938062.jpg
Benioff warned that AI-powered countries and companies will be will be "smarter," "healthier," and "richer," while those less generously endowed with AI will be "weaker and poorer, less educated and sicker." I guess he hasn't seen the AI that currently powers the Western world—you know, like IBM's Watson, which one of its engineers characterized as "like having great shoes but not knowing how to walk." Not that IBM is alone—take a walk through the transcripts of public companies' reporting earnings, and you'll see artificial intelligence mentions on a precipitous rise. Look around the real world, however, and finding true artificial intelligence is an exercise in futility. Even the companies packed with PhDs like Google seem to only be able to muster advertising that feels like weak pattern matching. It's one thing to insist that companies like, say, Google, give free access to its algorithms, but quite another to figure out how to do that in practice.


Overcoming RESTlessness

Broad as it was, the idea of using the Web for network-based sharing of data and services beyond the browser was a popular one. Software developers quickly seized on Fielding's work and put it into practice.3 The rise of REST was itself fuelled by a false dichotomy, with SOAP playing the role of bogeyman. Whereas SOAP attempted to provide a method of tunneling through the protocols of the web, the REST approach embraced them. This notion of REST being "of the web, not just on the web" made it a more intuitive choice for software engineers already building web-based solutions. As the SOAP and WS-* ecosystem became more complicated, the relative simplicity and usability of REST won out. Over time, JSON replaced XML as the de facto data format for web APIs for similar reasons. As the usage of the web computing paradigm expanded to new scenarios -- enterprise application integration, cloud provisioning, data warehouse querying, IoT -- so did the adoption of REST APIs.


Scrum Guide Decomposition, Part 2

In the enterprise, it would be difficult (but not impossible) to have a team with all competencies to do all the work simply because teams are siloed into specific competencies. For example, DBA’s, Middleware, specific back-end systems like SAP, and so forth. The enterprise's unwillingness to break apart these silos may hinder them from fully getting the benefits of Scrum. By having team members that are cross-functional, but not necessarily proficient in all competencies, you can avoid delays when someone, for example, is sick or on leave. Someone can continue the work. The team can also share the workload. No single person is carrying the team because they are the only person who knows that competency. The term “Jack of all trades – master of none” comes to mind. Good luck finding people who know everything. It is the team as a whole who becomes the masters. Not individuals. The Scrum Team has proven itself to be increasingly effective for all the earlier stated users, and any complex work.



Quote for the day:


"Dont be afraid to stand for what you believe in, even if that means standing alone." -- Unknown


Daily Tech Digest - February 01, 2019

What is application security? A process and tools for securing software

security
The faster and sooner in the software development process you can find and fix security issues, the safer your enterprise will be. And, because everyone makes mistakes, the challenge is to find those mistakes in a timely fashion. For example, a common coding error could allow unverified inputs. This mistake can turn into SQL injection attacks and then data leaks if a hacker finds them.  Application security tools that integrate into your application development environment can make this process and workflow simpler and more effective. These tools are also useful if you are doing compliance audits, since they can save time and the expense by catching problems before the auditors seen them.  The rapid growth in the application security segment has been helped by the changing nature of how enterprise apps are being constructed in the last several years. Gone are the days where an IT shop would take months to refine requirements, build and test prototypes, and deliver a finished product to an end-user department. The idea almost seems quaint nowadays.


India’s largest bank SBI leaked account data on millions of customers

The server, hosted in a regional Mumbai-based data center, stored two months of data from SBI Quick, a text message and call-based system used to request basic information about their bank accounts by customers of the government-owned State Bank of India (SBI), the largest bank in the country and a highly ranked company in the Fortune 500. But the bank had not protected the server with a password, allowing anyone who knew where to look to access the data on millions of customers’ information. It’s not known for how long the server was open, but long enough for it to be discovered by a security researcher, who told TechCrunch of the leak, but did not want to be named for the story. SBI Quick allows SBI’s banking customers to text the bank, or make a missed call, to retrieve information back by text message about their finances and accounts. It’s ideal for millions of the banking giant’s customers who don’t use smartphones or have limited data service.



The Crucial Academy Diversity in Cyber Security project is a Brighton-based initiative aiming to retrain veterans in cyber security, and is focused on female, neurodiverse and BAME candidates. Neil Williams, CEO of Crucial Group, said the funding will help support its initiative, and that, as a veteran, he understands the importance of projects such as Crucial. The QA: Cyber Software Academy for Women runs across several cities in the UK, including London, Bristol and Manchester, training women for cyber security roles. The Blue Screen IT: Hacked project will use the funding to scale a project that already exists, giving people, including those from poorer socio-economic backgrounds, neurodiverse and special needs talent, the skills needed for a cyber career. As well as train people in cyber, the project will also aim to create a “network of community Security Operations hubs”, according to Michael Dieroff, CEO of Bluescreen IT.



Don't Measure Unit Test Code Coverage

Some people use code coverage metrics as a way of enforcing the habits they want. Unfortunately, habits can't be enforced, only nurtured. I'm reminded of a place I worked where managers wanted good code commit logs. They configured their tool to enforce a comment on every commit. They most common comment? "a." They changed the tool to enforce multiple-word comments on every commit. Now the most common comment was "a a a." Enforcement doesn't change minds. Instead, use coaching and discipline-enhancing practices such as pairing or mobbing. To build up tests in legacy code, don't worry about overall progress. The issue with legacy code is that, without tests, it's hard to change safely. So the overall coverage isn't what matters; what matters is whether you're safe to change the code you're working on now. So instead, nurture a habit of adding tests as part of working on any code. Whenever a bug is fixed, add a test first. Whenever a class is updated, retrofit tests to it first. Very quickly, the 20% of the code your team works on most often will have tests. The other 80% can wait.


Meet The Chatbots That Will Make You Feel Better, One Text At A Time


The AI is trained to hold actual conversations rather than being a response generating program, like the early ELIZA. X2AI’s Tess is being used to support health care professionals like psychologists in clinics and hospitals across the US and Europe by giving patients access to 24/7 therapy support. They’ve also most notably collaborated with organisations and aid agencies in Lebanon to help Syrian refugees cope with their unimaginable situation. The Karim chatbot provides a mental healthcare service in an area where it is not available and now has one of the largest structured Arabic conversation data sets in the world. Similarly, Woebot Labs recently launched the first scientifically backed mental health therapy chatbot. You can chat with Woebot via Facebook Messenger for a two-week free trial, before then signing up to a $39 a month service. Stanford University researchers published a study showcasing how Woebot was able to help alleviate depression and anxiety over two weeks in its users. 


Don’t Collect Biometric Data Without Providing Notice

Interestingly, a lot of lawsuits and would-be lawsuits fail because the plaintiff is unable to show harm. For example, if a biometric identifier were stolen and the thief used that identifier to steal a prototype from a manufacturer, that manufacturer could show harm since there was a cost associated with developing the prototype, likely a cost associated with developing the associated intellectual property, lost revenue, etc. However, the Rosenbach v. Six Flags case isn’t about a security breach, it’s about a lack of disclosure. Under BIPA, plaintiffs don’t have to show actual harm in order to receive a monetary award. For BIPA case defendants, the effect is “unjust enrichment” because plaintiffs are getting money for nothing. “It’s not always huge businesses that get hurt by this and get sued,” said Kay. “A number of top tier companies were among the first entities sued. The second wave over the past two years has been mostly focused on finger scanning by employers. Some of them are big national companies [including] hotel chains, airlines and restaurant franchises. 


Android Pie: 30 advanced tips and tricks

Android 9 Pie
Looking to do a little housekeeping and clear away all your recently used apps from Pie's Overview list? Swipe up once from the nav bar to open the Overview interface, then scroll all the way to the left of the app-representing cards. Once you've moved past the leftmost card, you'll see a "Clear all" command that'll do exactly what you desire. Android Pie tries to predict what you're likely to need next and then offer up specific actions — commands within apps, like calling a particular person or opening a certain Slack channel — at the top of your app drawer. If you see a shortcut there that strikes you as being especially useful, you can touch and hold it and then drag it onto your home screen for permanent ongoing access. You can also find any shortcut offered within Pie's app drawer by pressing and holding the icon for the associated app and looking at the menu of options that appears. You can touch and hold any item from that menu to drag it onto your home screen for future use, too.



What is digital health? Everything you need to know about the future of healthcare

The industry's aims are diverse and complicated: preventing disease, helping patients monitor and manage chronic conditions, lowering the cost of healthcare provision, and making medicine more tailored to individual needs. What makes the healthcare industry interesting is that those aims could potentially stand to benefit both patients, as well as their healthcare providers. By gathering more data on markers of health, from activity level to blood pressure, it's hoped that digital health will allow individuals to improve their lifestyles and maintain good health for longer, and so need fewer visits to their physician. Digital health tools could also help identify new illnesses or the worsening of existing ones. By enabling doctors to step in earlier during the course of a disease, digital health tools could help shorten the length of a disease, or help ease symptoms before they really take hold.


Cisco goes after industrial IoT

6 industrial iot oil rig oil drilling cranes
The industrial IoT rollout has enabled the network edge to extend its natural boundaries into places that traditional IT and network support hasn't had to have a lot of complexity and innovation, noted Vernon Turner, Principal and Chief Strategist at Causeway Connections. “Now that there is a lot of application development and deployment being done at the 'Extended Enterprise,’ it is only natural that a company such as Cisco follows with its capabilities in software, Turner said. "In particular, the ability to drive intent-based network functionality is critical for industrial-based workloads that now demand traditional IT-based attributes such as security, scale and flexibility.” One of the stumbling blocks for success is the customer experience of end-to-end integration and delivery of services. “For example, there can't be natural breaks between sensor-based data being generated by a shop-floor robot on a production line and the enterprise back-office systems for parts and material because of either different networks and different data systems – they both need to be delivered in a seamless manner,” Turner said.


How organizations need to react to new data privacy challenges

Development of inventories of personal data is likely the biggest trend, given how important they were to GDPR compliance in 2018 and how important they’ll be for CCPA compliance this and next year. They’re sometimes called “data maps,” and they’re crucial for understanding where personal data is located in an organization down to the server level, how it’s being protected, and with whom it’s being shared. ... The best data protection technology ever invented is an alert employee. The best way to get alert employees is through routine training in best practices. That include topics such as: what qualifies as personal information, how to recognize phishing and similar attacks, and who to ask when you have questions. I believe the majority of employees understand the gravity of the threats to personal information and expect their employers to acknowledge this and act accordingly.



Quote for the day:


"The leader has to be practical and a realist, yet must talk the language of the visionary and the idealist." -- Eric Hoffer


Daily Tech Digest - January 31, 2019

Singapore releases guidelines for deployment of autonomous vehicles

Permanent Secretary for Transport and chairman of the Committee on Autonomous Road Transport for Singapore, Loh Ngai Seng, said plans were underway to launch a pilot deployment of autonomous vehicles in Punggol, Tengah, and Jurong Innovation District in the early 2020s, and TR 68 would help guide industry players in "the safe and effective deployment" of such vehicles in the city-state.  Enterprise Singapore's director-general of quality and excellence group Choy Sauw Kook said: "In addition to safety, TR 68 provides a strong foundation that will ensure interoperability of data and cybersecurity that are necessary for the deployment of autonomous vehicles in an urban environment. The TR 68 will also help to build up the autonomous vehicle ecosystem, including startups and SMEs (small and midsize enterprises) as well as testing, inspection, and certification service providers."


Network programmability in 5G: an invisible goldmine for service providers and industry

5G network programmability value chain
5G promises many disruptive functionalities, such as ultra-low latency communication, high bandwidth/throughput, higher security, and network slicing, all of which embed the potential to address new business opportunities not addressed by service providers today. But another functionality not always mentioned--and that has equal business potential--is network exposure, which can enable new levels of programmability in telecom core networks. Programmability in 5G Core networks allows providers to open up telecom network capabilities and services to third-party developers allowing them to create new use cases that don’t exist today. This is possible thanks to standardized APIs on the new network architecture for 5G. With APIs, a new frontier for business innovation in telecom will surge. Application developer partners will focus on new services applications, while telco service providers will focus on a new dimension of experience called “developer experience” and increase its position in the OTT value chain.


Internet Of Things (IoT): 5 Essential Ways Every Company Should Use It

Internet Of Things (IoT): 5 Essential Ways Every Company Should Use It
Strategic decision making is where the senior leadership team identifies the critical questions it needs answering. Operational decision-making is where data and analytics are made available to everyone in the organization, often via a self-service tool, to inform data-driven decision at all levels. More and more companies make IoT-enabled products which connect them directly to their customers’ behaviours and preferences. For example, Fitbit knows how much we all exercise and what our normal sleeping patterns are. Samsung can collect usage data from their smart TVs. Elevator manufacturer Kone learns how their customers are using their elevators and Rolls Royce knows how airlines use the jet engines they make. Even companies that don’t make IoT devices can often gain access to data from other people’s devices, just think app makers that are able to collect user data because of the data collection and connectivity capabilities of the smart phones or tablets that run them. Used correctly, companies can leverage these insights to make quicker and better business decisions.


No-deal Brexit could lead to data issues, MPs told


The no-deal Brexit planning notice warns that the legal framework for transferring personal data from organisations in the EU to organisations in the UK would have to change when the country leaves the EU.  This means that although businesses will be able to continue to send personal data from the UK to the EU, and would “at the point of exit continue to allow the free flow of personal data from the UK to the EU”, it may not be the same for the other way around. “We’ve been saying for a while that we would like the adequacy discussions to start as soon as possible. But the EU, as with everything else, is saying they won’t start the discussions until we are a third country. So, I’d be surprised if a decision could be made in under a year,” Derrington told the committee. There are also issues relating to legacy data, which was transferred from the EU to the UK before Brexit.


DARPA explores new computer architectures to fix security between systems

DARPA explores new computer architectures to fix security between systems
A better solution, then, in today's environment is to accept that users need or want to share data and to figure out how to keep the important bits more private, particularly as the data crosses networks and systems, with all having varying levels of, and types of, security implementations and ownership. The GAPS thrust will be in isolating the sensitive “high-risk” transactions and providing what the group calls “physically provable guarantees” or assurances. A new cross-network architecture, tracking, and data security will be developed that creates “protections that can be physically enforced at system runtime.” How they intend to do that is still to be decided. Radical forms of VPNs — an encrypted pipe through the internet would be today’s attempted solution. Whichever method they choose will be part of a $1.5 billion, five-year investment in government and defense electronics systems. And enterprise and the consumer may benefit. “As cloud systems proliferate, most people still have some information that they want to physically track, not just entrust to the ether,” says Walter Weiss, DARPA program manager, in the release.


There's more to WSL than Ubuntu

By integrating WSL with the updated Windows command-line environment, it's possible to integrate it directly with any application that offers a terminal. You can write code in Visual Studio Code, save it directly to a Linux filesystem, and test it from the built-in terminal, all without leaving your PC. And when it's time to deploy to a build system, you don't need to worry about line-ending formats or having to test code on separate systems. Support for SSH also ensures that you've got secure remote access to any Linux servers, in your data center or in the cloud. If you're using WSL to develop and test server applications, then you'll probably want to install SuSE Enterprise Server. It's a popular Linux server, and can be configured to handle most server tasks. With WSL now supported on Windows Server, you can use it to build test environments for cloud applications before deploying them on Azure or another public cloud. SuSE bundles a one-year developer subscription, which gives you more support resources than its standard community-based support forums.


Why we need less people, more skills for digital transformation

Why we need less people, more skill image
The fundamental argument comes down to value. Often in business, a corporate mentality exists in which executives boast about the number of people they have working for their company or on a project because they believe that provides the best value for their clients. This attitude has existed for more than two decades yet companies are still failing to understand that this might not provide the best value for their business or clients. Companies need to do more research to understand what works for them as an individual business, and often this means they don’t need to hire lots of people. Rather, they need the right people. While it may seem reassuring to have a large team working on an expensive project, often the work is easier, smoother and quicker when led by a small team who are highly-skilled, have good experience and who can be there working on the ground together, not spread around or working remotely. This may be more expensive at first, but it is worth it in the long term.



The FTC's cyberinsurance tips: A must-read for small business owners

cyberinsurance.jpg
Dan Smith, president, co-founder, and COO of Zeguro, a cybersecurity company that has grabbed the attention of investors, admits in this PYMNTS article the company came under a spear-phishing attack recently. It was unsuccessful, but it pointed out a very real need. Most small businesses do not think they need cyberinsurance (only 4% in the US currently have it) or do not know it's available. Smith adds that another problem area is that brokers providing the insurance are not spending enough time explaining it or may not understand it themselves.To fix the situation, Smith, in the PYMNTS article, announced that Zeguro will be partnering with the QBE Insurance Group to offer tailored cyberinsurance solutions. According to Smith, the idea is to use the company's expertise and acquired cybersecurity intelligence to craft the appropriate cyberinsurance solution for each client. Insurance on any level is a complicated subject, and then add the complexity of trying to secure a digital infrastructure from cybercriminals—using a partnership like Zeguro and QBE Insurance Group seems like good business.


What programming languages rule the Internet of Things?

What programming languages rule the Internet of Things?
Clearly, there’s a consensus set of top-tier IoT programming languages, but all of the top contenders have their own benefits and use cases. Java, the overall most popular IoT programming language, works in a wide variety of environments — from the backend to mobile apps — and dominates in gateways and in the cloud. C is generally considered the key programming language for embedded IoT devices, while C++ is the most common choice for more complex Linux implementations. Python, meanwhile, is well suited for data-intensive applications. Given the complexities, maybe IoT for All put it best. The site noted that, “While Java is the most used language for IoT development, JavaScript and Python are close on Java's heels for different subdomains of IoT development.” Perhaps, the most salient prediction, though, turns up all over the web: IoT development is multi-lingual, and it's likely to remain multi-lingual in the future.


How to accelerate digital identity in the UK


To encourage the reuse of a digital identity, the critical first step involves striking the right balance in the initial creation of a digital identity, based on the appropriate level of trust and friction for a first-time interaction. Digital services must be designed with the appropriate initial levels of trust, subsequently increasing levels of trust when required. It is a mistake to start with the maximum level of trust, which may be too high for the service. Instead, enhance trust as and when required. Digital identity standards allow services to map their increasing identity trust requirements effectively. Digital identity should be used at the point of need, with appropriate controls where absolutely necessary to complete the task. There is evidence that motivated users achieve high levels of success in verifying their identity in the right circumstances. The UK identity standards, built in response to real-world threats and risks, are world-leading, support the European Union’s eIDAS equivalence, and are closely aligned to the US NIST 800-63-A standard.



Quote for the day:


"Leading people is like cooking. Don_t stir too much; It annoys the ingredients_and spoils the food" -- Rick Julian


Daily Tech Digest - January 30, 2019

Cisco serves up flexible data-center options
Cisco has now extended ACI with ACI Anywhere to the cloud – specifically Amazon AWS and Microsoft Azure environments. The idea is that customers will have the flexibility to run and control applications anywhere they want across private or public clouds or at the edge and while maintaining consistent network policies across their entire domain. “There is nothing centered about data centers anymore,” said Roland Acra, senior vice president and general manager for Cisco’s Data Center Networking business. “IT teams have been forced to make a hard choice: stay with their on-premises data centers with a rich set of tools of their choice for automation or assurance or security; or move to the cloud, where a different set of capabilities can make consistent compliance a true challenge. ACI Anywhere removes that challenge and places workloads where it makes the most sense regardless of the platform or hypervisor.” ACI Anywhere would, for example, let policies configured through Cisco’s SDN APIC use native APIs offered by a public-cloud provider to orchestrate changes within both the private and public cloud environments, Cisco said.


Unconfigured IoT is a security risk, warns researcher

Many IoT devices work initially in an access point mode, so users can connect to the device using a smartphone to reconfigure it to become a client on the wireless network by entering the network security key, thereby making it much more secure. But businesses and consumers will often elect not to connect appliances to the internet, believing this is safer. ...  “This means that if the device remains unconfigured, it will remain in the default state, making it even more vulnerable than if it were connected to the internet and configured,” said Munro. “Although this opens up another set of vulnerabilities, organisations and consumers are becoming increasingly aware of these vulnerabilities and are therefore more likely to be aware of the risks and how to mitigate them.” But with an unconfigured device, attackers could use a war driving or access mapping attack, which would make it easy to compromise these devices, said Munro, because the attacker could identify a target wireless network using a geolocation site, such as wigle.net, that shows wireless access points in any given location and enables account holders to search its database for unconfigured IoT devices.


Serverless computing’s dark side: less portability for your apps

Serverless computing̢۪s dark side: less portability for your apps
How that serverless development platforms calls into your serverless code can vary, and there is not uniformity between public clouds. Most developers who develop applications on serverless cloud-based systems couple their code tightly to a public cloud provider’s native APIs. That can make it hard, or unviable, to move the code to another platforms. The long and short of this that if you build an application on a cloud-native serverless system, it’s both difficult to move to another cloud provider, or back to on-premises. I don’t mean\ to pick on serverless systems; they are very handy. However, more and more I’m seeing enterprises that demand portability when picking cloud providers and application development and deployment platforms often opt for what’s fastest, cheapest, and easiest. Portability be dammed. Of course, containers are also growing by leaps and bounds, and one of the advantages of containers is portability. However, they take extra work, and they need to be built with a container architecture in mind to be effective.


Success or Burnout? Q&A on How Personal Agility Can Help

Personal Agility is a simple coaching framework; it is based on just six powerful questions, a weekly event for asking the questions, and an “information radiator” to help you understand and act upon the answers. You can do it yourself without needing agreement or permission from anyone else! The key question “What really matters?” provides guidance for deciding how to spend your time. The next question, “What did you accomplish last week?” helps you understand where you are and to feel good about yourself and what you’ve done! The next questions help you to figure out what is (or is not) important to do this week. “What could you do?” looks at possibilities; “Of those things, which are important or urgent?” helps you to identify the essentials; finally, “Which ones do you want to get done this week?” helps you set a course with realistic objectives, so you can make steady progress to achieve bigger goals. Finally “Who can help?” is a classic coaching question that helps you get unstuck.


IT leaders must address integration to support business ecosystem


The survey found that almost half (48%) of organisations want to modernise their IT in order to compete more effectively in today’s digital business landscape. Respondents said modernisation is key to consolidating disparate technologies, automating data transaction processes and gaining visibility into their critical data flows. However, the research found that modernisation is one of the enterprise’s biggest challenges. According to Cleo, while the surveyed IT decision-makers understand the limitations and high maintenance cost of legacy technologies, they also recognise the systems’ importance to day-to-day operations. In Cleo’s experience, a major part of digital transformation is balancing old and new technologies, which means integrating legacy systems with modern applications cost-effectively and without disruption. For this reason, enterprises must simultaneously maintain legacy systems while adopting newer cloud services and software-as-a-service (SaaS) solutions to engage in and support how business is done today, it said.


How to Estimate Software Projects in A Test-Driven Development Environment

A good project manager intentionally limits the amount of information available to participants for discussion. The less information is provided, the lower the chance of an error. If we look back at the above description, what’s in it for us in it? First, it helps us define the user. In our case, it’s a registered user who has previously placed an order on the website. Second, the required functionality should have time and data limitations. Third and very importantly, the action that the user performs is atomic. Sequences or non-linear sequences of actions indicated in the description of the functionality are the roads straight to hell. And for all the participants involved, not just for the customer! Subjectively speaking, the ideal user stories imply that the user needs a minute or less to become aware of how to perform this or that action. In this case, by “aware” we mean that a user has already performed the same or very similar action in a different application.


Japan's IoT Security Strategy: Break Into Devices

Japan's IoT Security Strategy: Break Into Devices
Identifying potentially vulnerable IoT devices that face the internet can be accomplished using search engines such as Shodan, which allow for search queries based on certain parameters. Once a device has been found, taking it to the next level - attempting to log into the device - is generally a criminal offense in most countries. That presumably is the case in Japan as well and the reason why the law had to be modified to make it legal for the survey (see: Could a Defensive Hack Fix the Internet of Things?). With the law changed and permission to proceed, it should be easier to identify vulnerable devices. The larger problem is trying to resolve the vulnerabilities. Fixing vulnerabilities that lead to large botnets has been vexing. A decade ago, attackers commandeered large networks of desktop computers via browser and operating system vulnerabilities. Law enforcement agencies and private companies found success in shutting down the command-and-control servers for those botnets. But it left the problem of cleaning up infected devices, which usually involved the owners of those devices installing security patches.


CEOs and software

Neither software leaders nor CIOs can catapult their software organizations into the digital era without the right CEO support. CEO actions, or lack thereof, can stymie progress toward the software capability that digital business demands. Why? Software success depends on factors that only CEOs control. CEO control starts with funding for software initiatives — buy, build, and everything in between, plus modernization of outdated software. We track software leaders’ views on the top 10 barriers to improved software delivery (see Figure 1), with the barriers owned by CEOs highlighted in red. ... Software Delivery Speed Is Stuck“Things are moving so fast in our market,” said the CEO of a professional services firm. “I live in terror of being left behind.” Speed of software delivery is a leading indicator of health and vitality in a software-delivery organization and a signal that a software team’s digital transformation is underway. During the past five years, developers have made almost no progress in their ability to deliver software quickly


How traffic scrubbing can guard against DDoS attacks


A growing number of enterprises are investing in DDoS solutions, especially cloud-based DDoS mitigation services, with a shift away from a service-provider-centric market. A DDoS attack is one of the most complex threats that businesses can face. The goal of the individual hacker, organised criminals or state actors is to overwhelm a company’s network, website or network component, such as a router. To begin with, organisations have to determine whether a spike in traffic is legitimate or is an attack. “Without a solid understanding of baselines and historic traffic trends, organisations are unlikely to detect an attack until it is too late,” said Sherrel Roche, senior market analyst at IDC’s Asia-Pacific business and IT services research group. Landbank, the largest government-owned bank in the Philippines, has taken the step of implementing F5’s BIG-IP local traffic manager to understand its application traffic and performance better, as well as to gain full visibility into customer data as it enters and leaves an application. This enables the security team to inspect, manage and report fraudulent transactions as soon they are spotted.


DevOps Adoption Practices

Many organizations start with an environment that is full of variables: different processes, different environments, different tools, and several permutations of configurations and data. All this makes automation hard and reduces your ability to learn as each variable could be the cause of the problem. The first step is to look at all those variables and see what you can remove. Can you align the patch levels across environments? Can you deploy the same version of the application across environments? Some variables can only be removed later on, but understanding what all the variable pieces are and doing a clean-up first will make later efforts easier. ... Someone once told me: "You cannot automate what you cannot document." After all, automation is a form of documentation of a process. What is even more important is that automating a bad process just creates more problems. I also think that writing down a solution forces you to think it through in a way that verbal communication or just starting to write code does not.



Quote for the day:


"A leadership disposition guides you to take the path of most resistance and turn it into the path of least resistance." -- Dov Seidman