Daily Tech Digest - March 19, 2019

Time-series monitoring helps ops teams predict long-term trends based on patterns found in historical data. This type of monitoring digs into past metrics to forecast what's likely to occur next in a system. Organizations can use time-series monitoring to predict trends around autoscaling, required capacity and more. The time-series method can also support more accurate troubleshooting due to the expansive range of data collected over time. ... APM tools track the performance of enterprise software. They monitor an application over time, offering data around memory demands, code execution, network bandwidth and disk read/write speeds. Admins can use this data to evaluate how an app's dependencies might affect its performance and to pinpoint the cause of any performance issues ... This category of monitoring measures IT performance, based specifically on the perspective of end users. It might track, for example, the response time of a virtual desktop or other user-facing applications. 


How a small company can make use of data image
Clearly, the effective use of AI and data science can be game-changing, but it is not only small businesses that are struggling to deploy data science. The same report reveals that 51% of UK leaders admit their organisation does not currently have an AI strategy in place. Incorporating data science into an operating model is as big a challenge as it is an opportunity, but what are the issues specific to smaller businesses and are they so very different to larger companies? Data can be tricky to make sense of and, though start-ups or small organisations may not be sitting on the same volume of data as their larger counterparts, the variety and velocity will often be comparable. Precisely because small companies are often competing with larger, better-resourced competitors, it’s often absolutely critical that they can quickly make use of their data. The good news is that smaller organisations are in some ways better able to do this than larger, better-established ones. 


With Pulumi, you can create, deploy, and manage any cloud resource using your favorite language. This includes application- and infrastructure- related resources, often in the same program. One area this gets really fun is serverless. Because we're using general purpose languages, we can create resources, and then wire up event handlers, just like normal event-driven programming. This is the way serverless should be! In this article, we'll see how. There's a broad range of options depending on what you want to do, and how your team likes to operate. We'll be using AWS and TypeScript, but other clouds and languages are available. ... Serverless app models today make you think of the event sources -- the S3 buckets -- and event handlers -- the Lambdas and associated code -- as very different things -- "infrastructure" versus "app code" -- managed with distinct tools and workflows. Pulumi, in contrast, gives you a single CLI, pulumi, to manage everything consistently.


Autism, Cybercrime, and Security's Skill Struggle

Rebecca Ledingham, vice president of cybersecurity at Mastercard, spotted the trend earlier in her career as a cyber agent for the UK's National Crime Agency. "They weren't the kinds of offenders I was used to dealing with in drugs and sex crimes," she said in an interview with Dark Reading. Their social behavior, she said, was different from what she'd seen in other areas of crime. Often, she continued, cybercriminals are first diagnosed as being on the autism spectrum during the criminal justice process. Later in her career, as a cyber agent for INTERPOL's Global Complex for Innovation (IGCI), she realized the issue was broader. Ledingham's work with global agencies revealed outside of cybercrime, no other offense came with a foundational condition. "There's no other organic set of offenders that may be predisposed to cybercrime due to the nuances of their disorder," she said. Autism presents itself at the age of two or three, and more than 17 million people worldwide are diagnosed, said Ledingham in an RSA Conference talk. 


Middle East tech: Nine things the region must do to safeguard its financial future


The outlook for growth in the Middle East, North Africa region is expected to improve slightly in 2019 and 2020, the World Bank reported last June, noting a range of factors including "a favorable global environment, post-conflict reconstruction efforts, and from oil importers' reforms to boost domestic demand and increase foreign investment". Although welcome, these conclusions do not mask the longer-term economic realities that the region needs to address. The fourth industrial revolution driven primarily by AI and automation is going to radically change how we work, rest and play, bringing about major shifts to societies and economies. States such as Saudi Arabia, Qatar, UAE, and Oman have acknowledged this upheaval, with bold policy documents identifying a new vision for their counties. But the transition to these new digital realities will inevitably be haphazard and uncertain.


EU law enforcement agencies prepare for major cyber attacks


The newly adopted EU Law Enforcement Emergency Response Protocol determines the procedures, roles and responsibilities of key players both within the EU and beyond, including secure communication channels and contact points for the exchange of critical information as well as a coordination and de-confliction mechanism. The protocol is designed to complement the existing EU crisis management mechanisms, said Europol, by streamlining transnational activities and facilitating collaboration with the relevant EU and international players, making full use of Europol’s resources. It further facilitates the collaboration with the network and information security community and relevant private sector partners. Only cyber security events of a malicious and suspected criminal nature fall within the scope of this protocol. It will not cover incidents or crises caused by a natural disaster, man-made error or system failure.


3 ways AI is already changing medicine


Take ophthalmology. The top cause of loss of vision in adults worldwide is diabetic retinopathy, a condition that affects about a third of people with diabetes in the US. Patients should be screened for the condition, but that doesn’t always happen, which can delay sometimes diagnosis and treatment — and lead to more vision loss. Researchers at Google developed a deep learning algorithm that can automatically detect the condition with a great deal of accuracy, Topol found. According to one paper, the software had a sensitivity score of 87 to 90 percent and 98 percent specificity for detecting diabetic retinopathy, which they defined as “moderate or worse diabetic retinopathy or referable macular edema by the majority decision of a panel of at least seven US board-certified ophthalmologists.” Doctors at Moorfields Eye Hospital in London took that work a step further. They trained an algorithm that could recommend the correct treatment approach for more than 50 eye diseases with 94 percent accuracy.


Is it time we raised expectations of politicians on cyber security? image
Fortunately, not all MPs today are as dismissive of the cyber security threat as they may have been in the past. Sir David Amess provided an example from his constituency in Southend West, where he described “cybercrime having a devastating impact on individuals and businesses.” Amess spoke of a not-for-profit organisation being bankrupted as the result of a data breach – an all-too-familiar occurrence in recent years. MPs themselves are not immune to suffering data breaches. Onwurah explained how her office was a victim of a cyber-attack, but fortunate that it did no real damage. “As an MP’s office we had a big department supporting us and there was no compromise of constituents’ data,” Onwurah remarked. “If we had been a small business, we wouldn’t have had access to that kind of support, and it could have put us out of action for a lot longer.” This is undeniably true, as data breaches have become extinction events for many businesses.


password spray IMAP attack
Legacy protocols (such as POP and IMAP) make it more difficult for service administrators to implement authentication protections like multi-factor authentication, according to Proofpoint. In turn, the lack of multi-factor authentication means that threat actors launching attacks through IMAP can avoid account lock-out and compromise accounts unnoticed. “Attacks against Office 365 and G Suite cloud accounts using IMAP are difficult to protect against with multi-factor authentication, where service accounts and shared mailboxes are notably vulnerable,” researchers said. IMAP-based password-spraying campaigns appeared in high volumes between September 2018 and February 2019, according to the report, especially those targeting high-value users such as executives and their administrative assistants. “Targeted, intelligent brute-force attacks brought a new approach to traditional password-spraying, employing common variations of the usernames and passwords exposed in large credential dumps to compromise accounts,” researchers said in a posting.



Cybersecurity: Why bosses are confident, and tech workers are scared


At the top of business, there seems to be a lot of self-congratulatory box ticking, while elsewhere in the organisation there is a nagging sense that something very bad is about to happen. Two recent pieces of research reflect the ongoing disconnect. The UK government's annual survey of cyber security at big businesses shows that awareness of cyber risk is growing at the top of business. Nearly three quarters of firms said their board sees the risk of cyber threats to be high or very high, in comparison to all risks that they face. And nearly all FTSE 350 companies now have a cybersecurity strategy, even if only half of them will actually back up those fine words with cold, hard cash. Similarly, nearly all have a cybersecurity incident-response plan, even if only 57 percent actually test them on a regular basis. And yet, a separate survey by security company LogRhythm of 1,500 IT professionals in big businesses, shows that while the board may feel it is in control, the tech workers themselves are deeply worried.



Quote for the day:



"If you're not failing once in a while, it probably means you're not stretching yourself." -- Lewis Pugh


Daily Tech Digest - March 17, 2019

Data Science Is Now Bigger Than 'Big Data'

The most obvious is that search interest in cloud computing at its peak surpassed all of the other terms over the past decade and a half. The second is that search interest in the phrase “artificial intelligence” plunged from the data’s start in January 2004 through mid-2008 and began climbing again in 2014 as the current AI renaissance began. Searches for AI begin to really accelerate in 2017 just as searches for “deep learning” level off. This is worrisome in that it suggests that to the general public these neural advances are increasingly pulling away from their mathematical underpinnings of “deep learning” and back towards the science fiction catch-all of AI. As this transition strengthens it raises concerns that the public sees these creations as more than mere statistical equations codified in software and once again as silicon incarnations of a new form of artificial life. This raises the danger of another AI winter as the public’s soaring imagination begins to collide with the primitive reality of current advances.


How To Survive The Future of Banking

To be prepared for the future of banking requires an ability to embrace the change that is upon us, a willingness to take intelligent risks and the internal commitment to disrupt yourself. The marketplace is no longer moving in incremental steps, but this means that opportunities for growth are everywhere. Unfortunately, since most bankers have a bias against risk, we overestimate the threats related to change and underestimate the rewards that change can bring — we talk ourselves out of moving forward. Most people would look at ‘the next step’ as being permanent, irreversible and not a ‘perfect’ fit. The reality is that uncertainty does not always equate to being risky. Especially if you have made a plan and done the learning process in a manner that minimizes negative consequences. In the end, you will never have complete certainty about the next great opportunity. But that is part of the fun … really. You have an amazing opportunity to invest the time and effort to be prepared for the future … and disrupt yourself.


Four Strategic Frameworks for Digital Transformation

An Adaptable Framework for Digital Transformation by Dion Hinchcliffe
We almost universally know now we must adapt to the digital future, to change and grow. But how best to do it remains the top question. We’ve also learned along the way there are numerous submerged obstacles to digital transformation that won’t be denied and must be overcome before we can really even get started. Sometimes, as they say, we must first go slow to go fast later. Stubborn and long-standing issues related to technology like technical debt or poor master data posture, to name just two, threaten to derail efforts before they even start. Issues related to the nature of people take up the rest, and can sometimes seem intractable. ... Consequently, in my work advising and/or leading digital transformation efforts, I’ve developed and refined four key frameworks built out of years of repeated use and validation in organizations around the world. These reflect many of the central issues that I believe we’ve learned that we must address and then codified them into a plan that most organizations can execute against.


FinTech: Making Genuine Change in Finance

Legacy technology is one of the major setbacks for big financial institutions. In April 2018, TSB found out just how damaging outdated infrastructures can be when they tried to migrate to a new system. The reported cost to the bank was £105.4m and 80,000 customers. However, for Panzarino, legacy technology is only part of the issue. “People talk a lot about legacy tech, but we are still dealing with legacy culture. I worked for a time in the world’s third largest bank, so it was very much steeped in legacy culture. Things moved quite slowly, it was very political, people had their own agendas… It was very difficult to navigate.” An upshot of the legacy mentality is that banks often struggle to forge meaningful partnerships with startups. “There is an opportunity for banks to learn from genuine early stage startups, and for startups to be able to run a pilot or similar, but very rarely does anything come to market. They just don’t have the financial or human resources, and the growth experience to be able to sustain themselves through the process,” says Panzarino.


AI in cybersecurity: a new tool for hackers?

Face of Pepper the AI robot
Before the advent of AI in cyberattacks, the security landscape was already challenging. But the use of AI in targeted criminal attacks has made cybersecurity more treacherous. Not only are attacks more likely to be successful and personalised, but detecting the malicious piece of intelligent code and getting it out of your network is likely to be much more difficult, even with AI security in your corner. Adoption of AI by cybercriminals has led to a new era of threats that IT leaders must consider, such as hackers using AI to learn and adapt to cyberdefence tools, and the development of ways to bypass security algorithms. It won’t be long before a continuous stream of AI-powered malware is in the wild. In the short term, cybercriminals are likely to harness AI to avoid detection and maximise their success rates,” says Fraser Kyne, Europe, Middle East and Africa (EMEA) chief technology officer at Bromium. “For example, hackers are using AI to speed up polymorphic malware, causing it to constantly change its code so it can’t be identified.


21st-century CIO job description puts CIOs in vortex of emerging tech

The shift to a strategic rather than supporting role for IT isn't a new notion. Indeed, it has been a well-recognized trend for years and has been happening ever since the technology team's main job moved beyond keeping the mainframe and computers up and running. What's new is the pace at which this evolution is now happening and the criticality of being able to adapt the IT department and technology leadership to a higher level of strategic involvement. "You have to lead more with the technology than ever before," Le Clair said. Forrester outlined this vision in its recent report, "The Future of IT," stating: "A company's fate and fortune will be determined by its ability to exploit technology to its highest potential." Other research has reached similar conclusions. For example, in its 2018 report "Using Strategic IT for Competitive Advantage," CompTIA said: "The critical difference between today's IT and the IT of 10 or 20 years ago is the degree to which technology is being used to drive the strategic goals of a business."


Blockchain solutions – are they for you?

blockchain-solutions-do-you-need-one
Building a blockchain solution is about finding the most efficient way to solve a real-world problem, while also building a profitable and legal business. Who cares what Satoshi Nakamoto would think? For most enterprise solutions, private permissioned blockchains are the way to go. They are faster, cheaper and allow for a certain degree of centralized control. Because public blockchains are slow, it only makes sense if transparency and anonymity are at the core of the solution. It’s all about the use-case. Financial service firms, for example, rarely ever work with public blockchains, as they don’t want to share any financial data on a public blockchain. That’s why Ripple is a private network. Another consideration is the consensus mechanism. Proof-of-Work and Proof-of-Stake are the most common, but there are a lot more. Each solution comes with its benefits and disadvantages; thus, choosing the right mechanism will be paramount on the way to success.


Why are fintechs getting a regulatory pass?

While this new and budding industry presents opportunities and innovations, ill-supervised and underregulated industries can present sizable risks for consumers and the financial marketplace as a whole. As new players begin offering alternative banking models, they may prioritize disruption over proper risk management protocols and regulatory know-how, as several high ranking officials at the Federal Reserve have warned. Even St. Louis Fed President James Bullard noted his concern that fintech will be the “source of the next crisis.” Today, some digital financial services serve around 80 million members, while consumer data aggregators can serve more than 21 million customers, according to a report from the Treasury Department. That is a significant number of consumers served and a hefty amount of financial and personal information at risk. These services, in many cases, have proven beneficial, but Washington policymakers must act to protect consumers from devious marketplace actors by ensuring fintechs are subject to the same data security standards


The Evolving Role of the Public Sector CIO Creates New Opportunity


One of the first actions toward evolving as a public sector CIO is stepping back and taking a critical, objective look at the current technology infrastructure and software underlying core business processes. More often than not, this means accepting that certain systems and processes that have served well for years — even decades — may yet run for decades more, just at a higher or lower volume of transactions. Most public sector CIOs don’t have the luxury of scrapping everything and starting fresh in the cloud. However there is likely significant and increasing cost and risk of maintenance on these legacy platforms. It doesn’t necessarily imply a total rip and replace of all operations, but this fresh look is likely to reveal several pieces and processes within the department that could be shored up and made more efficient for the long haul. Fortunately, if the CIO can get past their comfort zone in these systems and processes, as well as the overwhelming pressure to maintain the status quo, there is opportunity. The most immediate savings that are under the control of the public sector CIO can often be found within the existing mainframe environment.


Banking + Fintech Collaboration: More Important Than Ever

The success of Bank+Fintech collaboration rests with those organizations who can understand each other’s strength and weaknesses to improve the customer experience while also reducing operational costs. Potentially more important will be whether these collaborations can deliver the level of personalization, speed, contextuality, and seamless delivery to defend positions against the threat of the more pronounced competition that could come from the likes of Google, Amazon, Facebook and Apple (GAFA) or challenges from Alibaba and Tencent. The good news is that infrastructure-based technology, enabled through the potential of open Application Programming Interfaces (APIs), is transforming the financial services industry. Combined with the ability to process and analyze increasing amounts of consumer data with machine learning, and the automation benefits of robotic process automation (RPA), chatbots, and Distributed Ledger Technology (DLT), there is greater potential for agility, efficiency, and accuracy.



Quote for the day:


"Every great leader can take you back to a defining moment when they decided to lead" - John Paul Warren


Daily Tech Digest - March 16, 2019


Even if blockchains provide data immutability, the amount of transaction throughput that blockchains can support compared to those of transaction platforms currently in production is tiny. The best blockchain deployments that are known today maybe can handle 10,000 transactions per second, according to Parizo. “That is controversial because so few people understand the details and those systems are not truly blockchain,” he added. “You have to dissemble blockchain until it is no longer blockchain to get it to scale.” However, blockchain deployments do not need to compete with such implementations. The technology’s sweet spot is in environments where there are low volumes of highly valuable discrete transactions, according to Peter Lindstrom, vice president of securities strategies at IDC and who moderated the panel. Blockchain’s greatest weakness may be its reliance on public key encryption, which can be a single point of failure. “If the key is lost, so is the data and, potentially, the transaction,” said Parizo. “If the key is compromised, someone else can access the data or the related asset.”



“Software will account for 90 percent of future innovations in the car,” Herbert Diess told VW’s annual press conference. Volkswagen is retooling its strategy in the wake of the so-called dieselgate scandal, which has cost it more than 28 billion euros ($32 billion) in fines and penalties after the uncovering in 2015 of VW’s use of engine management software to mask excess pollution levels. Demand for software functions has risen exponentially as customers increasingly expect advanced driver assistance systems, smartphone connectivity and self-driving functions. “Today our 20,000 developers are 90 percent hardware-oriented. That will change radically by 2030. Software will account for half of our development costs,” Diess said. Compared to a smartphone, a car has ten times as many lines of software code, and a self-driving car will have a thousand times that amount, Diess explained.


“The stakes suddenly just got higher, which is why governments are really worrying about it, but on the positive side, what they really want to build in trust and security early.” To address this, Hannigan said there are three key things to do. First, understand the risks better such as the complex and deep interdependencies in modern supply chains. “Many companies do not really understand the vulnerabilities in their supply chains and the risks they are exposed to as a result.” Second, he said, security needs to be retro-fitted to infrastructure that was not designed with security in mind. “An obvious example is the trusted platform module, where industry worked together to show that it can be done. “And the third thing we need to do is to ensure that everything we build is secure by design and by default, and every government is worrying about this,” said Hannigan. “Building in security and trust when you design something is absolutely critical, and every government is looking at regulation on this.”


After the Cambridge Analytica scandal which found Facebook complicit in allowing the firm to harvest millions of user profiles for political purposes without their consent, politicians around the world are demanding Facebook be regulated. Consumer trust in Facebook was shattered following the scandal. A Ponemon Institute survey found a 66% decline in consumer trust in advance of Zuckerberg’s Senate testimony where it was clear that most senators did not understand what Facebook does. So, following a significant data breach, a titanic loss of consumer trust, calls by numerous politicians for regulation, and a massive service outage, Facebook wants to become a bank issuing its own cryptocurrency. A year is a long time in social media. Banking and financial services are built on consumer trust and Facebook is overdrawn in the trust account. Bankers’, politicians’, policy makers’, and regulators’ spider senses are tingling. Whilst the last decade has been a decennium horribilis for the banking sector, from the Lehman Brothers sub-prime mortgage driven bankruptcy to the Wells Fargo account fraud scandal, consumer trust and confidence in banks has also been eroded.


Tech-proofing the millennial workplace of the future

null
As worker expectations evolve, so must the abilities of employers, who need to recognise the impact that these demands will have on their workplace. Employers should prepare themselves to meet the needs of tech-savvy workers of the future, who will make up the workforce of tomorrow. Millennials are already dominating the workplace – 160 million currently make up the European workforce – and this figure is only set to increase, with millennials due to account for 75 per cent of the global workforce by 2025. The future generation of workers possess the digital skills that organisations need in order to achieve long-term success. They bring new perspectives and habits to the workplace, and their tech-savvy knowhow is invaluable. Consequently, companies must tailor their office set-ups to their needs and expectations, as the numbers of this age continue to swell the working ranks. Research has shown that 25-to-34-year-olds are the most enthusiastic age segment about tech-enabled working conditions. So, when it comes to recruitment, a tooled-up office could help with hiring these younger workers.


TEMPO And The Art Of Disruption

Boyd’s analysis revealed that the ace pilots had faster OODA loops: they were able to observe, orient, decide, and act more quickly than their peers. By continually shortening their OODA loops, and thus increasing the tempo of the battle, they consistently caught their opponents off-guard. According to Boyd, when the loop is so fast and tight that a competitor’s response rate drops to zero, the opponent with the faster tempo has disrupted the competitor—and the end result is victory. The same concept applies to today’s uncertain business environment. Disruptors—the most agile, responsive, and aggressive companies—put the squeeze on competitors with a similar dynamic loop. But since a solo pilot’s reaction time is unique to the circumstances and is far faster than an organi­zation’s, we have adjusted the loop to better reflect that business reality. Our business version consists of four repeating aspects: scan, orient, decide, and act (SODA). Disruptors continually scan the landscape, orient themselves to new circumstances, decide how to respond, and act quickly.


At these factories, robots are making jobs better for workers


“In one case, the company found that people are actually better than any robot when it comes to installing the interior and engine of the car,” explains Adrian. But BMW also found that some of that work requires more strength than the typical worker might possess. So it devised a “co-roboting” system, where a worker’s ability is augmented by a machine. “The operator on the left side of the car guides the installation,” Adrian explains, “while also controlling a robot positioned on the right side, which can apply tremendous torque to complete the fit wherever needed. So strength is no longer a barrier to entry for this role,” Adrian explains. “It’s open to anyone with the right skills.” Diego Hernandez-Diaz, who’s also an engagement manager, visited five factories through the project. “I was really impressed by the lengths to which one electronics manufacturer went to help its people learn new skills,” he says. “It built out a fully-spec’d, virtual version of its factory.


10 Deadly Mistakes to Avoid When Learning Java

To code or not to code? It seems that you’ve made your choice in favor of the first option. Programming is a great field for professional growth. It gives you an opportunity to take part in interesting projects and work wherever you want. The only obstacle that restrains many beginners from starting a new career is the lack of understanding of how exactly they should learn to code. What’s more important is that even the best universities can’t fully provide a complete programming education that will guarantee a stark career as a software developer. This is because programming is too dynamic and flexible: once you start learning, you better do it for the rest of your life. Some programmers say that they had to try learning how to code a few times before finally reaching their goal. Yes, we all learn by mistakes, but you’ll be surprised how many common lapses there are in mastering this skill.


How digital payment solutions will shape the future of banking


While technological advancements have been revolutionising the banking space in terms of biometric security through unique identifiers like fingerprints, facial recognition, and voice recognition, the advent of ‘big data’ is one of the most crucial interventions for the banking industry. Through effective storage, analysis, and interpretation of vast and complex sets of data, previously untapped patterns and trends can be uncovered for new client insights. This may result in significant commercial benefits while assuring privacy. Further, data management has the potential to make payments, finance, assurance, engagement, and banking more effective and tailor-made for each client, helping industry partners to optimise their internal processes and add value through a data-based business understanding. By extending these augmented data management competencies directly to clients, banks can make use of insights such as consumer-spending habits as a means of promoting cost saving by identifying frauds or errors, proving to be a source of competitive advantage.


Shadow IT a Risk to Operational Resilience of Financial Institutions

While providing enormous business flexibility, Shadow IT applications can pose a significant operational, regulatory or reputational risk to the business. For example, an uncontrolled spreadsheet might provide calculations that feed into multiple models. ... Worse, there would likely be no visibility of this change, so identifying and remediating it would take time, extending the scale of business and market impact that the Operational Resilience initiative is designed to address. While as yet, the UK regulators haven’t defined or scheduled any regulation relating to Operational Resilience, there’s no doubt that it’s on the horizon. Informal discussions with the regulators allude to this. Financial institutions need to build a framework for Shadow IT risk management. This will enable them to understand their Shadow IT landscape and the critical business services and processes these applications support, define the risk they pose to the institution’s operations, determine the potential financial, operational, regulatory and reputational impact of errors and establish governance processes for change.



Quote for the day:


"Leadership Principle: As hunger increases, excuses decrease." - Orrin Woodward


Daily Tech Digest - March 15, 2019

Your digital ecosystem is under performing but no one can figure out why

Your digital ecosystem is under performing but no one can figure out why image
Senior IT professionals have to focus on the human experience to fully understand the intricacies of a sophisticated digital ecosystem and how it affects user experience both inside and outside the enterprise. Otherwise it’s just guesswork and looking for a needle in a haystack. But guesswork is time consuming and resource intensive and can significantly jeopardise business success or even a company’s survival. As a result IT departments are under huge pressure to understand, find and solve the issues in the shortest time possible. To do this IT professionals need to take a different approach and use an analytics solution that doesn’t focus on engineering parameters but on how real users interact with the digital services. CIOs can now use smart analytics tools that cut through the complexity of the digital ecosystem and are able to analyse the system through the human experience lens. Only in this way can they uncover why the company’s digital infrastructure is under performing and correlate it with the effect on user experience.



Interoperability testing verifies that components within the application, server and database work together and deliver the expected results. It's not sufficient to only test components or applications; you must test all the components with which they interact. A development team could create mock systems that simulate interoperability testing for a solid first step. But simulations don't replace interoperability tests, which cover as many possible connection points and functions as possible for all partners. Interoperability testing is challenging, which is why software development teams attempt to get around it. For example, in a partnership, one development team from Company A won't have its code ready until right before the expected release date, while Company B wants to thoroughly test their interoperable code before release. So, Company B's developers create mock code that simulates the existence of Company A's expected code. That simulation, while imperfect, helps both teams avoid logistical challenges.



Securing the mobile enterprise means thinking outside the VPN box


Not long ago it was sufficient to meet corporate security and external audit requirements by implementing a VPN constructed with firewalls and network access control (NAC) protocols, which secured access to network nodes when devices attempted to access them. But in today's world, users increasingly sign in to applications and off-premise clouds and cloud-based systems directly. They don't necessarily go through a VPN tied to an internal network-resident IT to gain access. This creates many more points of access to enterprise IT resources that might be in-house or off premises. ... The message is clear for IT network managers: New ways of creating secure perimeters around corporate IT resources must be found and establishing perimeters must go beyond what was historically defined as a physical network. "Business leaders face a digital imperative to boost user productivity, while also mitigating the risk of data breaches that are growing in size and frequency," said Sudhakar Ramakrishna, CEO of Pulse Secure, which provides software-defined secure access.


Two-thirds of all Android antivirus apps are frauds

The AV-Comparatives team said that out of the 250 apps they've tested, only 80 detected more than 30 percent of the malware they threw at each app during individual tests. The tests weren't even that complicated. Researchers installed each antivirus app on a separate device (no emulator involved) and automated the device to open a browser, download a malicious app, and then install it. They did this 2,000 times for each app, having the test device download 2,000 of the most common Android malware strains found in the wild last year --meaning that all antivirus apps should have already indexed these strains a long time ago. ... However, results didn't reflect this basic assumption. AV-Comparatives staffers said that many antivirus apps didn't actually scan the apps the user was downloading or installing, but merely used a whitelist/blacklist approach, and merely looked at the package names Essentially, some antivirus apps would mark any app installed on a user's phone as malicious, by default, if the app's package name wasn't included in its whitelist.


How did Facebook go down despite multiple data centers?

Facebook / privacy / security / breach / wide-eyed fear
Facebook said it wasn’t an attack, like a Denial of Service attack, and has since issued a statement attributing it to a configuration error. “Yesterday, we made a server configuration change that triggered a cascading series of issues. As a result, many people had difficulty accessing our apps and services," said Travis Reed, a Facebook spokesman. "We have resolved the issues, and our systems have been recovering over the last few hours. We are very sorry for the inconvenience and we appreciate everyone’s patience,” The question for me is how could a company with redundant data centers around the U.S., not to mention internationally, be taken down like this? All told it has seven data centers in the U.S. Redundancy is supposed to help prevent this kind of problem. Well, not exactly. In the case of a bug or operating problem, redundancy doesn’t help. In fact, it can spread the problem quickly, notes analyst Rob Enderle. “Redundancy can help with certain things like a complete system failure, but it doesn’t help with a virus or software bug because it can replicate it, so redundancy can’t help here,” he said.


Android Q's quietly important improvements


Android Q picks up where Pie left off and limits access to even more non-resettable device identifiers — numbers that are unique to your phone and can't be changed. Such numbers can easily be used to track your activity over time, since they're consistent and tied exclusively to you. With Q, both the device IMEI (international mobile subscriber identity) and serial number join the list of restricted identifiers, meaning apps can access them only in very limited and genuinely necessary scenarios. The software also now randomizes your phone's MAC address — another unique number that's traditionally permanent and unchangeable — every time it connects to a new Wi-Fi network. That was introduced as an off-by-default "experimental" feature in Android P and is now an on-by-default primary setting in Q. What else? Android Q changes the way apps are able to access your phone's Bluetooth, Wi-Fi, and mobile data functions so that they don't receive any associated location info unless it's absolutely necessary.


National Cyber Security Programme at risk of missing targets


“Improving cyber security is vital to ensuring that cyber attacks don’t undermine the UK’s ability to build a truly digital economy and transform public services. The government has demonstrated its commitment to improving cyber security,” said NAO head Amyas Morse. “However, it is unclear whether its approach will represent value for money in the short term and how it will prioritise and fund this activity after 2021. Government needs to learn from its mistakes and experiences to meet this growing threat.”  MP Meg Hillier, chair of the Public Accounts Committee (PAC), said the programme was another example of an important government initiative being launched without getting the basics right. “There were serious weaknesses in its initial set up, undermining its contribution to government’s overall cyber security strategy,” she said. “The increasing cyber threat faced by the UK, and events such as the 2017 WannaCry attack, make it even more critical that the Cabinet Office take immediate action to improve its current programme and plan for safeguarding our cyber security beyond 2021.”


Fresh POS Malware Strikes Small and Midsize Companies

Although DMSniff is newly discovered, it likely has been around since 2016, Reaves and Platt write. They suspect, with low confidence, that attackers may be brute-forcing SSH credentials on devices or scanning for other vulnerabilities, leading to an infection. The malware uses several tricks to maintain persistence and keep a low profile. DMSniff is encoded with a domain generation algorithm, or DGA, which generates an endless pattern of domains. If the malware's creator activates one of those domains, it can be used as a command-and-control server. That's a technique borrowed from botnet herders. Using DGAs helps maintain a botnet's resiliency. If hosting companies or law enforcement shut down a known C&C node, the malware can call out to a different one. The C&C servers can be frequently rotated, making it difficult to cut off communication to the botnet. Flashpoint notes that that use of a DGA in POS malware is rare.


F5-Nginx deal reflects mainstream trend toward microservices


As network and application management worlds collide in IT, a wide array of vendors scrambles to target developers. Thus, as with container management and IT monitoring, DevOps pros will have a bounty of choices among microservices network management products that attack the problem from multiple angles. Network management competitors to F5, such as Cisco, also offer software-defined network tools and microservices management platforms that incorporate Kubernetes container orchestration. Server virtualization bellwether VMware plans to join its NSX software-defined network IP with Heptio's ingress controller and service mesh capabilities. Meanwhile, DevOps software players such as HashiCorp already offer multi-cloud network abstraction tools that F5 said it plans to deliver through Nginx. Nginx is also something of an outsider in service mesh, which has generated strong buzz among DevOps early adopters. 



While the comfort and elegance of serverless architectures is appealing, they are not without their drawbacks. In fact, serverless architectures introduce a new set of issues that must be considered when securing such applications, including increased attack surface, attack surface complexity, inadequate security testing, and traditional security protections such as firewalls. Today, many organizations are exploring serverless architectures, or just making their first steps in the serverless world. In order to help them become successful in building robust, secure and reliable applications, the Cloud Security Alliance’s Israel Chapter has drafted the “The 12 Most Critical Risks for Serverless Applications 2019.” This new paper enumerates what top industry practitioners and security researchers with vast experience in application security, cloud and serverless architectures believe to be the current top risks, specific to serverless architectures.



Quote for the day:


"You can't just wish change; you have to live the change in order for it to become a reality." -- Steve Maraboli


Daily Tech Digest - March 14, 2019

A second 737 Max crash raises questions about airplane automation


Instead of improving safety, innovations can allow airlines “to run greater risks in search of increased performance.” A high-ranking Boeing official told the Wall Street Journal that “the company had decided against disclosing more details to cockpit crews due to concerns about inundating average pilots with too much information—and significantly more technical data—than they needed or could digest.” But what good is a safety system that’s too intricate for highly trained professional airline pilots to understand? Each new automatic device, Perrow wrote, might solve some problems only to introduce new, more subtle ones. Make the system too complicated, he said, and it’s inevitable that regulators will lose track of which pilots had been told what, and that some pilots will get confused about which procedures to follow. It didn’t, he said, make much sense to blame pilots in cases like this. Pilot error, he said, “is a convenient catch-all.” But it’s the complexity of the system that’s really to blame.



Observability in Testing with ElasTest

In a distributed system, finding the root cause of a bug is definitely not easy. When I face the problem, I’d like to be able to compare a success execution with a failure one, side by side. This is difficult due to the nature of logs, which can vary between executions. Such a tool should be able to identify the common patterns and discard the irrelevant pieces of information that might vary between two different executions. This comparison feature should be available as well for any other kind of metric. If I can compare the memory consumption or latency of requests of two consecutive executions I might be able to understand why the second failed. In general, we need more specific tools for this task. In a testing environment, we have more control as to what information to store but we need to raise awareness within the tools about the testing process. This way, we can gather the necessary information during test runs, and provide the appropriate abstractions to understand why a specific test failed.


The Effect of The Data Revolution in Enterprise Software Development

enterprise software development
The advent of Big Data marks the rebirth of enterprise software. In the traditional model, it was a common practice for the entire enterprise to adapt around the software they used. In a recent survey, 80% of executives who used traditional software responded that the software negatively affected their company’s growth and that it wasn’t flexible enough to adapt to their changing needs. Meanwhile, Big Data made possible custom software development that works for the enterprise and moves with it. Focusing on short learning curves and intuitive interfaces, modern, data-driven software is empowering, not challenging. Enterprise software development now fuels innovation and boosts workplace productivity, preparing businesses for the digital age. Every business faces unique challenges and now, thanks to Big Data, dedicated enterprise software can address these challenges and modernize workflows. When bottlenecks are eliminated, all departments can collaborate seamlessly, utilize resources to the maximum, and stay agile across all project stages.


Security is a constant battle: Be the Secure Code Warrior in your organisation

Image 1 for Security is a constant battle: Be the Secure Code Warrior in your organisation
The skills you learn using Secure Code Warrior cover over 150 types of vulnerabilities, including the OWASP Top 10 – this is very important to note. The Open Web Applications Security Project is a global organisation that has done tremendous work over the years in formalising and promoting best practice in application security. Amongst other things, it provides the OWASP standard that is a baseline of impartial, practical and cost-effective security best practice that can be used to establish a level of confidence in application security both within an organisation, and to external parties (list customers and regulators) to demonstrate a commitment to security. The importance of the alignment to the OWASP standard is that it is non-vendor specific, industry recognised and widely respected, and is not simply learning a single tool. The Secure Code Warrior platform teaches real-world skills, in the coding language of your choice, that is applicable to every industry on every platform, be that Enterprise, Cloud, Mobile or IoT.


How WebAssembly will change the way you build web apps

WebAssembly isn't a finished product, with plenty of room for improvement in both its support, features, and performance. "WebAssembly is young, what has landed in the browser right now is certainly not a fully mature product," says Williams, giving the example of garbage collection not being implemented in WASM as yet. "If you've started working with WebAssembly now, you'll immediately going to go 'Why is my WASM so big and why is it not as fast as I want it to be?'. "It's because it's a new technology, but that being said it is designed to be faster than JavaScript and it is often faster, and, simply by function of it being an instruction set, your programs are going to be significantly smaller." Williams is bullish on the prospects for WebAssembly, and with many people looking to the future of the web as it celebrates its 30th birthday, she has high hopes for how WebAssembly might transform the platform.


Container management tools must overcome limitations


"A lot of different pieces are coming together and driving new opportunities, as well as creating new challenges [with container management]," said Stephen Elliot, program vice president at IDC.  Much like virtualization, containers move application development one layer away from the computing infrastructure, so developers spend more time enhancing applications and less time configuring system resources. This approach fits with today's continuous development mantra, which stresses speed. Consequently, containers are becoming quite popular. In fact, the application containers market will create $4.3 billion in revenue in 2022, according to 451 Research's November 2018 Market Monitor study on application containers. When companies deploy containers, many find they require new container management tools to use them at scale. "Monitoring container platforms means managing numerous moving parts, from a security, performance, compliance and availability perspective," said Torsten Volk


Culture & Methods – the State of Practice in 2019


It is only with cultural change that the promise of the new ways of working will be achieved. Many organizations are embarking on “Digital Transformation”, and it is often the same organization which has undergone two or three “Agile Transformations” in the past without seeing the promised benefits. We believe that this is because the adoption is often implemented to “pay lip-service” to the idea, and is shallow rather than truly transformational. According to the State of Agile report, agile software development has become a late majority approach; almost all software is now built using iterative and incremental approaches, and mainly using some derivation of Scrum or Kanban. The strong technical practices from eXtreme Programming are still the exception rather than the norm in early and late majority firms. As an industry, we may know how to build software better, but there isn’t the appetite to truly empower the teams and make the organisational changes needed to actually achieve the outcomes that Innovators have shown is possible.


Millions hit by major Android-based malware campaigns


After installation, the malware then connects with the command and control server to receive orders. These may range from opening a browser with a given URL to removing the app icon from the launcher. The app's three-pronged capabilities include showing ads, opening phishing pages, and exposing users to other applications. The attackers are also able to install a remote application from a designated server, allowing them to further infect users with malware at their discretion. "With the capabilities of showing out-of-scope ads, exposing the user to other applications, and opening a URL in a browser," the researchers said, "'SimBad' acts now as an Adware, but already has the infrastructure to evolve into a much larger threat." CheckPoint Research also outlined 'Operation Sheep' in a second report yesterday. This involves a group of Android apps harvesting contact information from users' phones on a mass scale without their consent. This malware has similarly been loaded in an SDK built for data analytics, and has been seen in up to 12 different Android apps to date.


Standardising The Data Scientist

Data scientist
With the data scientist categorised as an endangered species, it is difficult not only for organisations to recruit people into these roles, but also to ensure that they have the skills and expertise required for the job in hand. For James de Raeve of The Open Group, this can be attributed to a lack of standardisation in the profession. “There needs to be a common understanding around the skills and experiences of professional data scientists,” he says. “This way, there is guidance to help individuals grow their professional competence, while organisations gain support in building career models that meet the requirements of the business now and in the future.” In an effort to remedy this, The Open Group and IBM have come together to create a new certification programme for data science. Through the programme, individual data scientists can certify their skills via the process of peer review, thereby building trust in their profession. Similarly, at the business level, organisations can not only ensure that job opportunities are filled appropriately, but also develop individuals through their own, accredited programme


Power BI Security

Power BI uses two primary repositories for storing and managing data: data that is uploaded from users is typically sent to Azure BLOB storage, and all metadata as well as artifacts for the system itself are stored in Azure SQL Database. The dotted line in the Back-End cluster image, above, clarifies the boundary between the only two components that are accessible by users (left of the dotted line), and roles that are only accessible by the system. When an authenticated user connects to the Power BI Service, the connection and any request by the client is accepted and managed by the Gateway Role (eventually to be handled by Azure API Management), which then interacts on the user’s behalf with the rest of the Power BI Service. For example, when a client attempts to view a dashboard, the Gateway Role accepts that request then separately sends a request to the Presentation Role to retrieve the data needed by the browser to render the dashboard.



Quote for the day:


"Enthusiasm spells the difference between mediocrity and accomplishment." -- Norman Vincent Peale


Daily Tech Digest - March 13, 2019

Wearable tech in the enterprise grows, but few workplace uses exist
More interesting than the growth predictions, perhaps, the report splits enterprise wearable use into two parts: employee use and customer applications. The top employee uses include workplace security, employee time management, and employee communications. From my perspective, though, much of that sounds like messaging and checking the time. The customer application side seems more promising. Common customer applications predicted include loyalty programs, point-of-sale (PoS) uses and something called an “integrated shopping experience.” I don’t know about you, but I’m not seeing a lot of smartwatch-based loyalty programs or PoS applications. I have no idea what an integrated shopping experience is, but I’m pretty sure I haven’t seen one on of those on a smartwatch, either. The report cited the lack of applications as the biggest barrier to B2B adoption of wearable tech, and that problem doesn’t seem to have disappeared. Nor have other concerns in the report, including cost, device capabilities, and security.



Cyber attackers favouring stealthier attacks, says Darktrace


Despite the rise in popularity of cryptojacking, however, banking Trojans once again appear to be the most profitable tool for cyber criminals, according to Max Heinemeyer, director of threat hunting at Darktrace. “Unlike ransomware, banking Trojans do not rely on a victim’s conscious willingness to pay. Instead, they use deception to perform transactions without the victim’s knowledge. Given the decline in ransomware incidents in 2018, it seems that subtler attacks have become the weapons of choice for hackers,” he said. In one Fortune 500 e-commerce company, Darktrace discovered a privileged access user – a disgruntled systems administrator – was hijacking power sources from the company’s infrastructure for monetary gain. The employee co-opted other users’ credentials and service accounts to stealthily take over multiple machines for the purpose of cryptomining. Darktrace’s 2018 threat data also revealed that more than 15% of internet of things (IoT) devices detected by its AI technology were unknown to businesses concerned, with a 100% year-on-year increase in IoT attacks.



Researchers build nanoscale distributed DNA computing systems from artificial protocell


Living cells communicate with each other by sending and receiving molecular signals that diffuse between neighboring cells to activate key molecular processes. This communication enables cell populations to implement collective information processing functions that cannot be achieved by individual cells in isolation. Although synthetic biologists have made significant progress in engineering cell populations to perform computation, such engineering still remains a major challenge because of the complex interplay between synthetic devices and natural cellular processes. In a new paper published in the journal Nature Nanotechnology, a team of researchers led by Tom de Greef at the Eindhoven University of Technology and Radboud University, Stephen Mann at the University of Bristol, and Andrew Phillips at Microsoft Research present a method for implementing distributed DNA computing systems by compartmentalizing DNA devices inside artificial protocells.


Data and analytics offer a seismic opportunity in manufacturing

Data and analytics offer a seismic opportunity in manufacturing image
Until recently, predictive maintenance was a time consuming, manual process requiring large teams of data scientists. It was used in industries where regulation demands it, as well as by a small number of pioneering industrialists to monitor their most important production assets. Although predictive maintenance was proven to keep aircraft in the air and the most vital wheels of industry turning, the vast majority of manufacturers couldn’t capitalise on the opportunity due to the high cost and complexity of gathering and analysing sufficient data to drive tangible results. Things started to move on, however, with the adoption of IoT sensors and machines capable of recording their own vital statistics. Manufacturers can now collect large amounts of data from across their production environments and relay to factory historians or third-party platforms such as Siemens MindSphere and the OSIsoft Pi System. The ease with which this can be done has led to a data rush. Around two-thirds of manufacturers today are gathering data from their production environments.


Why Every Company Needs A Data Strategy For 2019

Why Every Company Needs A Data Strategy For 2019
Creating a data strategy isn’t a standalone activity; it must be driven by your overarching business strategy. Therefore, a critical starting point for any data strategy is the business’s strategic objectives. To put it another way, what is your business trying to achieve and how can data help you get there? After all, what's the point of a data strategy – indeed, what's the point of data in general – if it doesn't help you achieve your organizational goals? So before you charge ahead to your data strategy, review your business strategy first and then develop your data strategy ... When you use data to make smarter decisions, optimize business process and so on, it's likely to have a positive effect on the bottom line. But this link between data and the bottom line can also be much more direct. In other words, data can be monetized to increase revenue and create a new income stream. This monetization may take many forms. For example, it may involve bringing new, data-driven products or services to market. Or it may involve selling data to customers through optimized services.


The NSA Makes Ghidra, A Powerful Cyber Security Tool, Open Source


The NSA announced Joyce’s RSA talk, and Ghidra’s imminent release, in early January. But knowledge of the tool was already public thanks to WikiLeaks’ March 2017 “Vault 7” disclosure, which discussed a number of hacking tools used by the CIA and repeatedly referenced Ghidra as a reverse-engineering tool created by the NSA. The actual code hadn’t seen the light of day, though, until Tuesday—all 1.2 million lines of it. Ghidra runs on Windows, MacOS, and Linux and has all the components security researchers would expect. But Joyce emphasized the tool's customizability. It is also designed to facilitate collaborative work among multiple people on the same reversing project—a concept that isn't as much of a priority in other platforms. Ghidra also has user-interface touches and features meant to make reversing as easy as possible, given how tedious and generally challenging it can be. Joyce's personal favorite? An undo/redo mechanism that allows users to try out theories about how the code they are analyzing may work, with an easy way to go back a few steps if the idea doesn't pan out.


Unbelievable Ways Artificial Intelligence Is Revolutionizing Education

ways artificial intelligence is revolutionizing education
How have teachers been developing their careers in the new technological age? In the past, they did it with the help of specialized workshops, seminars, or courses. Unfortunately, professors have little time for self-development because they must come up with an individual approach to their students. The development of both AI and global education ecosystems can change this situation. For example, American Institutes for Research (AIR), provides teachers with online training courses and webinars to share experiences with colleagues. Another solution is The Global Education Conference, a project that gives access to educational conferences and hundreds of courses for professional growth. Such innovations can deliver astonishing results. For teachers, AI has become synonymous with expanding the boundaries of how you can share experiences and knowledge. ...  An intellectual curriculum can also be developed on a turnkey basis for a particular student. In this case, there is no need to buy costly textbooks and materials.


You can’t benchmark culture


A benchmarking exercise is one of analyzing and copying the things another company does. (Companies can also benchmark their own current performance against past performance.) That won’t work for cultural elements, because every company’s cultural situation is as unique as a fingerprint. It incorporates emotionally resonant, deeply embedded perspectives and habits that have built up through years of challenges and experience; these factors can’t be easily separated from one another. Moreover, these elements have to fit the company’s strategy and core capabilities, or the company won’t be able to continue delivering value. The behaviors and emotions that should be emphasized in one company may be precisely those that would hold another company back. For example, at PetroChem, the leaders sought to borrow a new behavior from Polymer Plus and Google: rapid launches of imperfect products, which would be improved later, after the product had been on the market.


NVMe startups’ different routes to flash performance gains


All the startup solutions presented so far are based on new hardware designs, but another route being taken by startups such as Excelero and WekaIO is to eliminate the storage hardware and go completely software-defined. Of course, there has to be some storage hardware somewhere, but the benefit of the software-defined architecture is that solutions can be implemented either as a hyper-converged infrastructure (HCI), dedicated storage or even in public cloud. Excelero has created a storage solution called NVMesh that implements NVMe-over-Fabrics through a proprietary protocol called RDDA. Where RDMA connects multiple servers together and provides direct memory access, RDDA takes that step further and makes NVMe storage devices accessible across the network. This is achieved without the processor of the target server and so delivers a highly scalable solution that can be deployed in multiple configurations, including HCI.


Hackers Love to Strike on Saturday

Hackers Love to Strike on Saturday
Attackers were more likely to strike on a Saturday than any other day. This makes obvious sense, since organizations are likely to have fewer employees minding the shop. After a successful attack, hackers would also have more time to explore a network before employees returned to work on Monday. One caveat, however, is that in some parts of the world, the weekend begins on a Friday. In Bangladesh, for example, Friday is a Muslim day of prayer. Not coincidentally, that's the day attackers hit Bangladesh Bank. ... Want to bury bad news? One age-old strategy long practiced by businesses and politicians in the U.s. is to release bad news on a Friday, after markets have closed, in the hope that it will be old news by Monday. Many breached businesses, likely not coincidentally, publish their first public data breach notification on a Friday. Redscan found that half of all breach reports were submitted to the ICO on a Thursday or Friday, suggesting that this ethos exists in the U.K. as well.



Quote for the day:


"Leadership in today's world requires far more than a large stock of gunboats and a hard fist at the conference table." -- Hubert H. Humphrey