Daily Tech Digest - October 03, 2019

Is hybrid cloud certification right for you?

One of the biggest mistakes a company could make, in Russell’s opinion, is having only one hybrid cloud expert. “You can have someone who acts as a catalyst – someone who is curious about the technology and gets you started. But the organization won’t survive well if only one person has the skill set. You need to have best practices for mindshare and knowledge transfer,” he says. Fuchs feels similarly: “We want to encourage purposeful cloud adoption.” NetApp holds workshops at customer sites to get stakeholders up to speed on the foundational aspects of hybrid cloud, as well as to provide specialized training for specific roles relative to the cloud such as how to best use analytics. “These decisions are getting more sophisticated and more data-driven because the tools are getting stronger, the processes are getting stronger, and education is getting stronger. Organizations are able to review their bills and try to reduce costs. The more trained your team is, the likelier they are to make good decisions,” he says. Williams recommends that anyone interested in gaining certification “should examine their own role in managing hybrid cloud operations and go after the certification that best supports the organization’s needs as well as their own,” she advises

Everything you need to know about Microsoft's dual-screen OS

For all intents and purposes, yes, Windows 10X is the official name for Windows Lite/Santorini. It is not a new operating system. It's Windows 10, in a more modular form, optimized for dual-screen/foldable devices. ... WCOS is one piece of the underpinnings of Windows 10X. In the past, I (and others) have described WCOS as the successor to Windows OneCore -- Microsoft's attempt to standardize a set of core components in Windows so that they would work across different types of devices. But WCOS is a combination of the OneCore OS pieces, UWP/Web and Win32 app packages, and the composable C-Shell. (See architectural diagram above.) Together, these are the foundational pieces of Windows 10X. ... As officials said today, Surface Neo, the dual-screen Surface device due around holiday 2020, will run Windows 10X. Any new dual-screen and foldable Windows devices from Microsoft partners like Dell, Lenovo, HP, Asus, and others also will likely ship with Windows 10X (and likely not before holiday 2020). Just to keep things confusing, the just-announced Arm-based Surface Pro X cannot run Windows 10X, despite the "X" in both product names.

Organizational vs. operational resilience: What's the difference?

Operational resilience examines what the business actually does and what it needs to continue performing those activities. This differs from organizational resilience in that OR looks at the entire organization, while OpR is more process-oriented, examining how the business functions and what the organization needs to protect those processes. What do businesses need to operate today? As with any business initiative, the push for OpR must start at the top. Senior management must be aware of the importance of maintaining OpR and must support initiatives such as the creation of policies, frameworks and structures that support OpR. These then filter down to operational teams to implement programs, controls and procedures to produce products and services. ... BC/DR, cybersecurity and supply chain initiatives are all essential building blocks for achieving organizational resilience as noted in the above figure.

It's time to change your cloud operating model

As the organization moves to cloud computing, application workloads should be able to move directly to a new operating model. This is a big job and requires support for IT leadership. If your organization is so inclined, consider becoming a cloud center of excellence that many enterprises are building these days. Enterprises typically have a large backlog of applications—numbering in the thousands—that can move through an assessment and be mapped onto a new operational model. This means that a roadmap is created for how applications will be processed and operated in the public cloud. I’ve found that short enablement sprints are better than one long one; moreover, the teams learn a lot as they move applications through the new operational model. However, this is a disruptive change in workflow for most enterprises, with associated pain and costs. Many changes are necessary, including training, mentoring, coaching, knowledge sharing, and open-door policies to make this work. Finally, you need support from the boardroom. This is the only way you’ll be an organization that’s able to leverage the public cloud to a productive end.

How to Dynamically Build the UI in Blazor Components

You can, using familiar Razor tools when creating a View (or page), dynamically build your component's UI. Alternatively, you can also use the rendering tools built into Blazor to dynamically construct the UI that makes up your component at startup. I'm going to show how both of those options work in this column. That's not the same as manipulating your component's HTML as your component executes. For that you can use binding, buy a third-party component, or call out to jQuery through Blazor's JavaScript interop. But if you want to create an initial UI dynamically, here's how you'll do it. As my case study I'll use an (admittedly, contrived) View that contains multiple forms. In this case study, the Model object that's passed to this View contains an ArrayList of objects for a single customer. The ArrayList can contain any combination of different "customer related" objects: the customer's profile object, the customer's address object , the customer's billing plan and so on. In this View, we'll set up each object with a different form and each form will have a button that invokes a different C# method to handle processing that form.

The Flavors of APIs

“RESTful” (or “REST-like”) APIs are those which conform to all or most of the principles and constraints of REST, as defined by Roy Fielding in his 2000 dissertation titled “Architectural Styles and the Design of Network-based Software Architectures”. ... The HTTP methods are based off of verbs, which are accessing resources. The same way I would go to the store to get some groceries — a client goes to a location (URL) to get (method) a resource (URI). Everything on the web is a resource, and each resource has a uniform resource identifier. We use unified resource locators to find those resources. Finally, we use the methods to indicate what we want to do with those resources. In the example below, we’re using the HTTP GET method — to get the resource. ... gRPC builds on the traditional remote function or procedure calls utilized in systems of the past. Essentially, an RPC or RFC is a type of API that allows a function or procedure to be called as if it were local — despite that function or procedure living on a remote server. It leverages a form of a client-server model and incorporates the concept of a stub. gRPC takes this concept and optimizes it for modern cloud infrastructure.

Westcon-Comstor Builds a more Visible WAN

“We had too many site routers and we had a mix of aging and new infrastructure,” said Soler. “There were two pieces we were looking for: To improve resiliency in terms of failover and deliver resiliency to the business. SD-WAN was there. Players were already doing it and some of our partners were getting into the game.” Soler says that overall, the move to SD-WAN has made his life easier. He can see detailed reporting data about what’s happening everywhere on the network, all from a single screen. And with the new capabilities for failover, users don’t notice network outages, giving him more time to work behind the scenes. “There is failover redundancy so when something happens, we can focus on resolving the issues and our users don’t even notice,” he said. The most attractive features of the Silver Peak Unity EdgeConnect™ SD-WAN edge platform, according to Soler, are the ease of use in the deployment using centralized software-based orchestration, as well as the failover and performance features such as forward error correction FEC and path conditioning.

Minerva attack can recover private keys from smart cards, cryptographic libraries

The Minerva attack at the heart of all these issues is a classic side-channel attack. A side-channel attack is when a third-party observes leaks in cryptographic operations that, when put together, can help the attacker break the encryption scheme and reconstruct the original data. This is what happens in Minerva, as well. The Czech team found a problem in the ECDSA and EdDSA algorithms used by the Atmel Toolbox crypto library to sign cryptographic operations on Athena IDProtect cards. These operations leaked "the bit-length of the scalar during scalar multiplication on an elliptic curve," researchers said. If an attacker is able to observe or record enough cryptographic operations signed by a vulnerable smart card or by one of the vulnerable open-source cryptographic libraries, then they'll be able to compute the private encryption keys that sign these operations. During tests, researchers said they only needed to record 11,000 operations (card swipes) from an Athena IDProtect card to obtain in private key. All this process took 30 minutes, researchers said.

Banking, Tech Communities Are ‘Breathless’ About Fintech, But Is It All Hype?

“The deep-seated belief that cloud is insecure remains for a large swathe of bankers. It hasn’t helped that Capital One recently had a breach of their data in the [Amazon Web Services] cloud,” wrote fintech expert Alex Jimenez in a blog post. Lawrence White, professor of economics at New York University’s Leonard N. Stern School of Business, told InsideSources he thinks Deutsche Bank’s report exaggerates the impact of fintech on the banking community. New technology will improve existing banking processes, he said, but not fundamentally transform it the way tech experts say. “Yes there are some new entities in this lending world, what are called marketplace lenders, peer-to-peer type lending platforms, which have a little bit of a niche, but haven’t really eaten the lunch of the existing institutions,” White said. “As data gathering and analysis gets better, and the inexpensive transport of the data from one place to another [gets better], all of that makes this analysis more comprehensive and ought to make the banks better at what they’re doing. The world of Big Data brings more information and the need for greater analytical tools and techniques. At the end of the day, [banking is] basically the same process, trying to figure out who’s a good risk, who should I lend my money to?”

Q&A on the Book Managing Technical Debt

For many development projects, technical debt is discovered when symptoms of slowing development or defects point to workarounds or "fix me" comments in the code. It is important not to stop at the symptom, but to trace to the underlying software artifact so the technical debt item can be described and managed just like other software development issues. ... not all technical debt can be detected automatically. The number one step in recognizing technical debt successfully is to empower the development teams to concretely and openly share technical debt when they see it. ... We also advocate teams to make technical debt conversations as part of their routine review, retrospective and planning procedures. And of course, as we give many examples in the book, the most costly technical debt is the one that accumulates over time with an impact on the systems architecture, therefore having an architecture mindset; conducting design reviews and making architecture design trade-offs as explicit as possible will also help in uncovering existing technical debt as well as recognizing technical debt as teams are taking it on.

---

Quote for the day:

"Leaders need to strike a balance between action and patience." -- Doug Smith

---

Daily Tech Digest - October 02, 2019

U.S. Government Confirms New Aircraft Cybersecurity Move Amid Terrorism Fears

Modern aircraft are essentially “flying data centers in the sky,” says Ian Thornton-Trump, security head at AMTrust Europe. “It's natural for the Air Force to apply its cyber defensive and offensive skills in order to insure the logistical and refuelling fleet is robust when it comes to physical and cybersecurity. I believe this is a great idea and the Airforce is about to pick up the cybersecurity ball after the FAA–for a lot of reasons–either dropped it or had it taken away.” He points out that the Airforce's mission of “fly, fight and win in air, space and cyberspace”’ cannot be achieved “if the civilian platforms they have prove vulnerable to cyberattack.” It’s a major issue—The consequences of cyberattacks targeting commercial aircraft could be “devastating” and put peoples’ lives in danger, says Andrea Carcano, co-founder of Nozomi Networks. “Airlines therefore need to develop security strategies where vulnerabilities are monitored and mitigated continuously.”

Why military minds should fill cybersecurity seats on corporate boards

Well this is not about appointing somebody to go through the techno-babble or the IT geekiness of it. It's really about understanding operational risk, and this is where veterans can come into play because veterans at a lot of levels, but really at the senior officer levels, understand operational risk and mission risk to mission. They're trained to understand technical issues. I'll take my background, for example, is with the US Navy. Ships are complex machines; they are whole mechanical and electrical systems. There are systems of systems that are embedded within these ships, and so it doesn't matter what your job is on board, you understand technical issues, and you understand how those systems play with each other to carry the whole. And so it's all about operational risk, and the senior ranks have extensive planning and strategy, the decision making experience that could benefit the board's oversight role. And again, getting back to the information and risk part, understanding and mitigating risks to the mission is a core competency in the military.

Singapore online falsehoods law kicks in with details on appeals process

The legislation was mooted as a way to"protect society" against online false news created by "malicious actors", which the Law Ministry said could be used to divide society, spread hate, and weaken democratic institutions. The government, however, was urged to make key amendments to better reassure the public it would not be used to stifle free speech, with several arguing that the act provided the government "far-reaching powers" over online communications. Industry players and observers expressed concerns the law would afford the Singapore government "full discretion" over whether a piece of content was deemed true or false. Under POFMA, two criteria requirements must be met for the law to apply: there must be a false statement of fact and it must be in the public interest to act. It also does not cover criticisms, satire or parody, and opinions. Comments on falsehoods also are excluded, though, the Law Ministry has cautioned that "care" should be exercised to "avoid repeating" the falsehood. It also assures that the act will not be used to punish people for sharing falsehoods "in ignorance [and] good faith".

The Inestimable Values of an Attacker's Mindset & Alex Trebek

For three years, Pardee performed network analysis to include target characterization, exploitation usage, documentation, and exploit planning to help the intelligence agency extract insights from targets. Yet he'd begun as an electrical engineering major, with dreams of working on mobile communications, and was initially hired by NSA to work on power distribution logistics. Pardee didn't have any training on cyberattacks or defense. What he did have was a strong set of critical thinking, logic, and problem-solving skills – a highly translatable skillset that was further honed by his NSA work. The agency trained him on the rest. "Looking back on it, I got a lot of interesting classes and experiences there to learn about security from the other side first. Everything was taught through an attacker's lens," he says. "Now, as I've continued my career, I see how valuable that is.” Many IT professionals, he explains, will begin their careers learning about the right way to do things.

Here's What Hackers Don't Want You to Know

It's not enough to just set up a segmented network and forget about it. Security isn't a set-it-and-forget-it proposition. It requires constant monitoring, scrutiny, and support. Your CSO has to inspect the logs every day to ensure everyone who has gained access to the network is supposed to be there. Your CSO has to ensure that everyone who has access to the network only has access to what they need and nothing more. Your CSO has to ensure that people are changing their passwords on a regular basis, not using those passwords anywhere else, and using passwords with the proper amount of complexity. This, of course, means that your summer intern can't serve as your company's CSO. Neither can Bob in the accounts receivable department. You have to have someone whose dedicated job is to maintain the security in your network. If you have a small-to-medium-size business and you can't afford this, hiring a third party to manage this for you is probably going to be your best option.

Serverless Security Threats Loom as Enterprises Go Cloud Native

As companies start using new cloud-native technologies including serverless functions, they also need to update their understanding of security threats and how to implement the right security controls. The study found that API-related vulnerabilities are the top threat concern (63% of respondents) when it comes to serverless usage within organizations. An example of this threat is attackers misusing privileged accounts to execute serverless functions. “So even though we are talking about something new,” Cahill said, referring to serverless, “the attack vectors and methods are old methods applied to a new technology. So we should always be thinking about how privileged accounts are being used. We want to make sure we implement a least-privilege model” to restrict access for accounts to only the resources required to perform routine, legitimate activities. Another example, he said is fuzzing, “which is basically putting in parameters at the end of an API call as a way to take over the API call.”

Intel proposes new SAPM memory type to protect against Spectre-like attacks

Researchers say their "proposal provides more flexibility to software" by moving most of the mechanism that prevents speculative execution attacks at the hardware level. The idea is that most speculative execution side-channel attacks can be split into two parts: the "frontend" part of the exploit code, and its "backend." Intel STORM researchers say the second part (backend) of most speculative execution attacks performs the same actions. SAPM was designed to introduce hardware-based protections against the backend part of most attacks. It's because of this concept that Intel's research team believes that SAPM will also future-proof the next generations of Intel CPUs against other -- currently undiscovered -- speculative execution attacks. But the idea of introducing new mitigations will always raise questions about reducing CPU performance. Intel STORM researchers don't deny that there's a performance hit; however, this impact is low and could be mitigated further by dropping other existing protections.

Automation with intelligence

Organisations believe they can transform their business processes, achieving higher speed and accuracy by automating decisions on the basis of structured and unstructured inputs. They expect an average payback period of 15 months – and in the scaling phase just nine months. Process fragmentation – the way in which processes are managed in a wide range of methods – is seen by 36 per cent of survey respondents as the main barrier to the adoption of intelligent automation. IT readiness is considered the main barrier by 17 per cent of organisations. ... almost two-thirds of organisations have not considered what proportion of their workforce needs to retrain as a result of automation. Even organisations that have automated at scale (51+ automations) are not yet thinking about this, with 53 per cent stating that they have not yet explored whether their workforce needs to reskill as a result of their automation strategy. Reskilling based on how the human workforce will interact with machines, including changes to role definitions, should be baked into organisations’ plans for intelligent automation adoption in order to leverage the expected capacity enhancement.

Is Swarm AI the answer to fears over AI and jobs?

Swarm AI is a technology developed by Unanimous AI. A previous study, conducted at Stanford University School of Medicine, looked at groups of radiologists using Swarm AI to collaboratively diagnose chest x-rays. Published results showed a 33% reduction in diagnostic errors when using Swarm AI. Compare this finding with the results of another study showing AI can match humans in disease diagnosis. It seems that AI is powerful, but in combination with humans, more so. But add to the mix, AI being used to help humans more effectively collaborate — and the end result could be formidable indeed. In another recent study, business teams were tested on a standard IQ test using Swarm AI and were shown to increase their effective IQ by 14 points. The latest study looking at Swarm AI, this time produced in conjunction with the California Polytechnic State University, found “AI technology modelled on biological swarms could be used to accurately predict which business teams would be high performing based on the personality of the individual members.”

Singapore outlines initiatives to tackle OT and IoT security

Developed together with industry partners, Teo said the OT cyber security masterplan will guide the development of capabilities to secure systems in an OT environment and mitigate emerging threats to those systems. He added that the masterplan has outlined plans to train more OT cyber security professionals with advanced cyber security skills, and to establish an OT cyber security information sharing and analysis centre with the Global Resilience Federation (GRF). Managed by the Asia-Pacific business unit of GRF, the centre will serve as a threat information sharing hub for companies in energy, water and other CII sectors in Singapore. “Singapore offers a strong economy, a highly educated workforce, a central location, and an environment friendly to trade and investment,” said Mark Orsi, president of GRF.

---

Quote for the day:

"Integrity is the soul of leadership! Trust is the engine of leadership!" -- Amine A. Ayad

---

Daily Tech Digest - October 01, 2019

The dark web's latest offering: Disinformation as a service

The campaigns followed similar strategies to nation-state-backed disinformation campaigns, using newly created and long-established accounts on 'major social media platforms' to help spread information. In some cases, what appeared to be real users were replying to the accounts of the companies. But it isn't just by exploiting social media that those selling disinformation services on the dark web go about their business: they'll create their own articles and blogs to help push the agenda they've been provided with. ... Researchers say an article ended up being published as news on two media sources, illustrating the ease at which the information can spread. The other user also offered edits based on feedback before setting about sharing the disinformation using social media accounts, including older, more established accounts – which then had their message amplified by bots and sock-puppet accounts.  Some of these accounts even went so far as to communicate with or attempt to befriend users in the targeted countries to make the campaigns more effective by encouraging real people to share the disinformation.

Phish Uses Google’s URL Decoding to Swim Past Defenses

A phishing campaign that takes advantage of Google’s ability to decode non-ASCII URL data on the fly is making the rounds – looking to fool the unsavvy by effectively hiding the website address of the campaign’s phishing page. The campaign makes use of what’s called percentage-based URL encoding – a basic URL-encoding technique in which normal ASCII characters (i.e., “abc” and “123”) are converted into a string that starts with “%” and is followed by two hexadecimal digits. When resolving such an address, Google will convert this non-ASCII format into a string that is universally accepted and understood by all web browsers and servers, on the fly. The cybercrooks are making use of this in order to trick secure email gateways (SEG) into delivering their phishing emails, by hiding the true destination of the messages’ embedded malicious links. That’s according to the Cofense Phishing Defense Center, which last week observed a specific campaign using the method.

Former Army Contractor Gets Prison Term for Insider Attack

Barrence Anthony, 40, of Waldorf, Maryland, pleaded guilty in May to a single count of unlawfully accessing a protected computer. On Friday, a federal judge in Virginia sentenced the former systems engineer to two years in prison as well as ordering him to pay $50,000 in restitution, according to court documents. For several years, Anthony worked as an engineer for Federated IT, a federal contractor that provides technology and support services for a number of different military and federal government agencies, according to the Justice Department. In this case, Federated IT built and maintained financial applications on Microsoft SharePoint instances the U.S. Army's Chaplain Corps Religious Support System, which is based in the Pentagon and provides religious services and support for soldiers, according to court documents. These instances were hosted on Amazon Web Services cloud infrastructure, the documents show. Federated IT also provided IT support services for about 9,000 people working for the Army's Chaplain Corps, documents show.

8 uses for RPA in HR operations

RPA is an ideal way to review data change requests from a ticketing system and make appropriate changes in the HRIS, which can then route through the appropriate channels for approval. The software can check changes against compliance and organizational rules to ensure they are eligible and accurate; rejected changes are sent back to be updated or routed to HR for further review. RPA can also automate data sharing between systems. Some processes require data to be uploaded into one system from another system. For example, think performance ratings for compensation planning or compensation history for variable pay processing. RPA software can automate the extraction of this data from the source system, transform it into the target system format and then upload the data into the target system. RPA software can analyze data sets -- either directly in the system or by downloading or extracting data -- and provide audited results to HR for review and eventually correction, if required.

Why quantum needs a classic approach for supremacy

Generally speaking, a quantum computer does not offer the precision of a classical computer architecture, which relies on binary, 0 and 1, yes and no decisions. Stefan Woerner, global leader for quantum finance and optimisation at IBM, said: “Classical computers use binary optimisation and make many yes/no decisions that have to be correlated. Whenever you add a binary variable to the problem, you double the number of checks.” In practice, this means that when attempting to solve a problem that has several variables, the computations needed to run these correlations grows exponentially. However, Woerner added: “Some problems can be formulated in a way similar to quantum chemistry.” This is the domain of quantum computing and, for companies like IBM, it can be applied in areas such as quantum mechanics, genomics, supply chain optimisation and financial risk models.

Is the Object-Oriented Paradigm a False Hope?

For the last 20 years, Java has become the most popular object-oriented language. It conquered the enterprise world and still has one of the biggest communities. Now industrial development exists only because of the object-oriented paradigm (OOP). But here, I want to bring up skepticism about its fundamental paradigm. First, let's return to the past when Java didn't exist. ... Unfortunately, the majority of enterprise projects become unsupportable quite rapidly. As a consequence, many enterprise projects are facing a constant migration process and unacceptable timelines. And sometimes, bug-fix estimation takes more time than simply re-writing from scratch. In addition, the word "legacy" scares IT employees more than ever before. According to my experience (more than 30 enterprise projects), the key problem is the project's architecture, which looks like a mess of patterns than anything else. Often, many patterns are used inappropriately or without any purpose, and this is all so that they can follow "modern OOP trends," sometimes referred to as the OOP cargo cult.

How to become an Alexa developer: A cheat sheet

Any developers or businesses that want to build out and utilize intelligent, voice-powered services will be affected by advances and changes that are being driven by Amazon Alexa. Alexa is built using artificial intelligence (AI) technologies, but Sobolewski said that would-be developers don't need a background in natural language understanding or speech recognition to get started. Additionally, there are beginner tutorials available as well, so even very junior software engineers can start working with the platform. Non-developers can build their own simple skills using predetermined frameworks called Alexa Skill Blueprints, which were revealed in April 2018. Amazon also offers Alexa SDKs for Node.js, Java, and Python, as well as an ASK Toolkit for Visual Studio Code, making it easy for developers to build Alexa skills using familiar languages and IDEs. Alexa is not confined to home and consumer use cases. Alexa for Business provides functionality for professional/productivity use cases, and Alexa for Hospitality provides the Alexa experience in hotels for controlling in-room devices, playing music, and contacting the hotel for guest services, among other features.

Enterprise Guide to Multi-Cloud Adoption

Multi-cloud may appeal to organizations that want as many choices as possible to exploit the cloud. Using multiple cloud providers offers core advantages, which in the past worked as disadvantages. Now, enterprises can avoid vendor lock-in, they can pick and choose/mix or match strengths of cloud providers to their specific needs, they see more reliability and less down time by spreading their bets, and they can uphold stronger data governance and security. But it’s been a painful process to get there. All this doesn’t mean enterprises are giving up on private or hybrid cloud, which, by the way hybrid cloud is often used synonymously with multi-cloud by some people. Multi-cloud is a subset of hybrid cloud. Companies are struggling to get the most value out of cloud in general, and multi-cloud may be the answer for some. In a recent column for InformationWeek, Kishore Durg, a senior managing director of Accenture Cloud, wrote that “when it comes to realizing the value of cloud … ”

The 7 Biggest Technology Trends In 2020 Everyone Must Get Ready For Now

Technology is currently transforming healthcare at an unprecedented rate. Our ability to capture data from wearable devices such as smartwatches will give us the ability to increasingly predict and treat health issues in people even before they experience any symptoms. When it comes to treatment, we will see much more personalized approaches. This is also referred to as precision medicine which allows doctors to more precisely prescribe medicines and apply treatments, thanks to a data-driven understanding of how effective they are likely to be for a specific patient. Although not a new idea, thanks to recent breakthroughs in technology, especially in the fields of genomics and AI, it is giving us a greater understanding of how different people’s bodies are better or worse equipped to fight off specific diseases, as well as how they are likely to react to different types of medication or treatment. Throughout 2020 we will see new applications of predictive healthcare and the introduction of more personalized and effective treatments to ensure better outcomes for individual patients.

Interview: James Smith, director of digital, Nationwide Building Society

As part of its digital journey, the company needs access to a wide talent base. To this end, the building society will open its first major technology hub in London next year to give it access to the IT professionals it needs to continue its digital journey. The new digital innovation hub will add 750 tech jobs, and the building society is also expanding operations in its home town of Swindon, which currently houses all its 3,500 technology operations staff. In total, Smith manages about 1,500 staff in the digital team. There are about 5,000 IT staff at Nationwide in total. Its people are organised around the work, with squads aligned to particular domains, using agile principles and focusing on digital, says Smith. ... Part of this additional investment will see Nationwide use AI technology and big data to help it understand customers so it can provide additional services, such as money management. This will involve working with financial technology (fintech) suppliers.

---

Quote for the day:

"Leaders speak truth into people who believe lies about themselves." -- Orrin Woodward

---

Daily Tech Digest - September 29, 2019

AI used for first time in job interviews in UK to find best applicants

Candidates are ranked on a scale of one to 100 against the database of traits of previous “successful” candidates, with the process taking days rather than weeks or months, says the company. It claims one firm had a 15 per cent uplift in sales. “I would much prefer having my first screening with an algorithm that treats me fairly rather than one that depends on how tired the recruiter is that day,” said Mr Larsen. Griff Ferris, Legal and Policy Officer for Big Brother Watch, said: "Using a faceless artificial intelligence system to conduct tens of thousands of interviews has really chilling implications for jobseekers. "This algorithm will be attempting to recognise and measure the extreme complexities of human speech, body language and expression, which will inevitably have a detrimental effect on unconventional applicants. "As with many of these systems, unless the algorithm has been trained on an extremely diverse dataset there's a very high likelihood that it may be biased in some way, resulting in candidates from certain backgrounds being unfairly excluded and discriminated against."

Traditional banks are struggling to stave off the fintech revolution

The other blind spot for legacy banks is their tendency to have a narrow and misguided understanding of disruptive business models. This usually begins with treating a new species of competitors as traditional ones. For example Cathy Bessant, Bank of America's CTO, commented on Apple's announcement of a new credit card: "My reaction when I saw the announcement was, first competitively, all of the features that are in that card are offerings we have today." The propensity to see only the product or service and not the entire business model is common among incumbents across a range of industries. Kodak, Blockbuster and Nokia were only three of the hundreds of disrupted incumbents which were able to see only the product (and associated features) that threatened them and not how the business models of their competitors allowed the creation of entirely new ecosystems that they were poorly equipped to survive in. By stooping down to competing on a feature by feature basis, incumbents lose the chance to redefine an industry that they once dominated.

Arizona getting help developing cybersecurity professionals

From the global to the local, cybersecurity breaches affect us in nearly every aspect of our lives. Hackers don’t discriminate. They attack small businesses and multinational corporations, federal agencies and local school districts, the young and old, the rich and poor. Many people have called the internet the modern battlefield and cybersecurity professionals the warriors of the digital age. Getting better at protecting ourselves, our businesses, our citizens and our communities against cyber threats will be one of the defining challenges of the next decade — and something we absolutely have to get right. The chief reason cyber attacks are increasing in number, scope, sophistication and damage is it is really hard to get ahead of the hackers. Cybersecurity in 2019 and beyond requires a very different approach than we’re used to. And that requires a very different kind of cybersecurity professional. The problem is there are far more job openings in cybersecurity than qualified candidates to fill them.

Venture Capital 2.0: This Time It's Different?

We’re starting to see some rationality about this creeping in around the edges. Take Uber, whose theory of success (at least for now) is that it will dominate local markets for both drivers and riders eventually. If you believe that, then it’s worth subsidizing both sides with venture money. Uber may well be Exhibit A of the mythical first-mover advantage illusion. In just three months, Uber lost over $5 billion. The real problem here is one that we’ve seen before—to seed a market, a startup subsidizes early customers. The theory is that once you have them in the door, you can eventually create pricing power and raise prices. Eventually, unless you have some other revenue stream like darkly trading in people’s personal information, you have to charge enough to cover the cost of the service and make a profit. Once those $7 Uber rides start costing $30, riders will be back in their own cars or on the bus.  Another “what were they thinking?” example? E-cigarette maker Juul.

The CIO’s role in driving agile transformation

Some CIOs channel solutions to what their internal teams are skilled and have the technologies to implement on their own. Others look to outsource more and seek partners or system integrators to oversee implementation. And some CIOs gripe when business leaders have already selected partners or when the CIO is asked to assist or bail out shadow IT. None of these are optimal, and innovative solutions delivered faster and with higher quality more often requires a blend of internal resources, partners, reuse of existing platforms, and experimentation with new technologies.  CIOs should partner with their business leaders on developing an ecosystem of partners and technologies that drive current and future needs. This is not a procurement process nor is it a vendor due-diligence process as both of these assume requirements are known and one ore more vendors already in consideration. This is an exploration, and innovative, digitally minded CIOs are best equipped to define and manage this journey.

HPE Extends Its Cybersecurity Capabilities And Earns Two Cyber Catalyst Designations

Understanding that no cyber resilience solution is complete without the capability to recover from a cyber incident, HPE followed up its delivery of Silicon Root of Trust with its Server System Restore capability, built into iLO 5 amplifier pack. This capability enables organizations to restore servers to its original operating environment. MI&S detailed these capabilities here. HPE continues to deliver on its cyber resilience with two new features that further put the company in a leadership position. One of the newer features that hasn’t been covered too much is called One-Button Secure Erase. This feature is exactly what it implies - the ability to completely erase every byte of data that sits on an HPE server when an IT Department decides to end-of-life infrastructure. When that old server is ready to be recycled or donated, IT organizations can have confidence there will be no traces of data or proprietary information. This is an invaluable feature for organizations of all sizes.

Chatbot: The intelligent banking assistant

With chatbots gaining more traction, many firms across the globe have started offering off-the-shelf products that help developers to build, test, host and deploy these programs using Artificial Intelligence Markup Language (AIML), an open source specification for creating chatbots3. A few platforms support integration with payment providers for seamless processing of customer payments based on a customer’s interaction with the bot. Increasingly, chatbots are also attracting interest in the world of FinTech, and a number of companies have developed their own chatbots using proprietary technology and algorithms. Chatbots utilise application programming interfaces (APIs) to integrate with data management platforms. This allows them to analyse the extracted data as well as web- and mobile-based user interfaces and deliver the necessary insights to the end customer. ... In their current form, chatbots have reached a certain level of maturity.

CIOs Should Be Asking Questions In The Boardroom, Not Just Answering Them.

“A company with a clear vision of the future is more likely to win by either setting the rules of the game or being quick to take advantage of an unfolding new industry landscape defined by other players.” The CIO can catalyze a board to “look for gaps; reframe closed mindsets; provide external perspective; and point to potentially better options or directions. “Executive teams, no matter how effective at current operations, can often become myopic. A (CIO’s) big, well-aimed, simple question can disrupt such complacency,” he says. But, before this can even begin to happen, there remains the non-trivial matter of achieving board appointment for a technologist in the first place.  CIO or CTO NED board appointment is a needle that is hard to move in a boardroom culture dominated by finance and general management. To move it, Gartner’s formula is to invite board candidates with technology backgrounds to a series of dinners, also attended by major recruiting firms and board chairmen.

Dear network operators, please use the existing tools to fix security

It's tempting to point the finger at network operators for failing to deploy RPKI. But another finger needs to be pointed at the software vendors for providing shoddy documentation. Routing security isn't the only system where deploying existing tools can make a big difference. Huston said in 2017 that failing to secure the DNS with DNSSEC is savage ignorance. Network operators should get onto that before fingers are pointed at them. Network operators should also avoid being the recipient of pointing fingers by deploying DMARC message authentication to prevent spammers from spoofing their domains for email. The UK's National Cyber Security Centre (NCSC) has used DMARC to significantly reduce that risk for government domains. "That's how you stop people clicking on the link, because they never get the crap in the first place. Simple things done at scale can have a difference," said Dr Ian Levy, the NCSC's technical director in 2018. The Australian government has also been deploying DMARC on its domains, though its efforts have lagged behind the UK.

Postgres Handles More Than You Think

Thinking about scaling beyond your Postgres cluster and adding another data store like Redis or Elasticsearch? Before adopting a more complex infrastructure, take a minute and think again. It’s quite possible to get more out of an existing Postgres database. It can scale for heavy loads and offers powerful features which are not obvious at first sight. For example, its possible to enable in-memory caching, text search, specialized indexing, and key-value storage. ... Postgres provides a powerful server-side function environment in multiple programming languages. Try to pre-process as much data as you can on the Postgres server with server-side functions. That way, you can cut down on the latency that comes from passing too much data back and forth between your application servers and your database. This approach is particularly useful for large aggregations and joins. What’s even better is your development team can use its existing skill set for writing Postgres code. Other than the default PL/pgSQL (Postgres’ native procedural language), Postgres functions and triggers can be written in PL/Python, PL/Perl, PL/V8 (JavaScript extension for Postgres) and PL/R.

---

Quote for the day:

"Give whatever you are doing and whoever you are with the gift of your attention." -- Jim Rohn

---

Daily Tech Digest - September 28, 2019

5G and IoT: How to Approach the Security Implications

The first thing is an IoT bot. The botnet nodes, they actually spend most of their time scanning the network looking for other victims. That’s their primary, the primary thing that they do. And because of that these botnets naturally increase in size over time. Eventually once they’ve covered all the devices available, again, the botnet sizes are sort of self-limiting. And that’s a thing to bear in mind when we start talking about the 5G thing. Because in the future with 5G, the number of IoT devices is going to increase exponentially and so the size of these potential botnets is going to be quite, quite incredible. That’s one thing to bear in mind. When an IoT bot finds a new victim, it responds back to its command-and-control server. And then they go ahead and infect that new device that’s been detected. And that device will then become a member of the bot. And the botnet gets larger and it continues to scan. One of the key things here is that in order to be infected, the device has to be visible from the internet, visible from the existing botnet members.

Can Blockchain Become More Accessible?

Much like any disruptive technology, blockchain has a diversity problem which further limits accessibility. For the most part, blockchain expertise is confined to the financial and technological industries and the affluent white men that dominate them. Services from Amazon, IBM, Microsoft and Oracle may bolster blockchain use, but they don’t solve this fundamental issue. Tech education startup Maiden aims to make blockchain more accessible by teaching members of traditionally underrepresented groups about transactions, smart contracts, and other applications of the technology. Ultimately, if blockchain products are created by groups that genuinely represent society, they will impact more people and break down educational barriers. Big businesses with tech expertise are making it possible for more organisations to benefit from blockchain with hosted platforms and BaaS. However, without more effort given to education and understanding, companies will continue to shy away from distributed ledger technology.

More Data Doesn’t Guarantee That Analytics Will Deliver Digital Transformation

We often overlook the presence of disconnected and fragmented data silos – making it impossible to paint a complete picture of the business because different segments linger in detached states or isolated buckets. Left disintegrated, these data buckets rust in data warehouses and lakes – unless they evolve into cohesive and compatible building blocks that form the foundation of an intelligent enterprise. ... Having more data doesn’t do much good if we aren’t asking the right business questions or don’t understand the assumptions behind them. Through critical thinking, we need to carefully examine evidence based on what’s relevant to the question before reaching any conclusions or making any decisions. That starts by asking questions, which is a prerequisite for asking the right questions. The process of creating value with data begins and ends with business leaders who promote a culture of data-driven decision-making. When it’s absent, we lose direction and guidance and cannot make a significant impact.

GDPR: Only one in three businesses are compliant – here's what is holding them back

"For many organisations, the true size of the GDPR challenge only became apparent as they began the initial projects to identify the applicable data that they held. As a result, only the most focused organisations had completed their GDPR readiness by the time the legislation came into force," Chris Cooper, head of cybersecurity practice at Capgemini, told ZDNet. Businesses that aren't yet compliant with privacy legislation point to a number of obstacles that prevent them from being so. Chief among those is legacy IT systems, with 38% of those surveyed suggesting that their current IT landscape isn't aligned to the complexities of GDPR. Meanwhile, 36% believe the requirements of GDPR are too complex and require a lot of general effort to implement, while one third of respondents say that the financial costs of achieving alignment with GDPR are too prohibitive. Not only are businesses that remain non-compliant putting themselves at risk of falling victim to a data breach and the financial and reputational damage that could create – alongside the financial cost of a regulator fine – they're also holding themselves back from the benefits that compliance can bring.

New SIM card attack disclosed, similar to Simjacker

This new attack, named WIBattack, is identical to Simjacker, an attack disclosed at the start of the month by mobile security firm AdaptiveMobile. Both attacks work in the same way, and they grant access to similar commands, with the exception that they target different apps running on the SIM cards. Mainly, Simjacker runs commands against the S@T Browser app, while WIBattack sends commands to the Wireless Internet Browser (WIB) app. Both are Java applets that mobile telcos install on SIM cards they provide to their customers. The purpose of these apps is to allow remote management for customer devices and their mobile subscriptions. In a report released earlier this month, AdaptiveMobile said it discovered that a "private company that works with governments" was using rogue commands sent to S@T Browser apps running on SIM cards to track individuals. In a report published last weekend, security researchers from Ginno Security Labs said that the WIB app was also vulnerable to similar attacks, although they were not aware of any attacks.

10 principles of workforce transformation

Many business leaders realize that they can’t just hire the workforce they need. There aren’t enough prospective recruits, and the expense would be enormous. Instead, companies must upskill their existing employees or members of their communities. This means expanding people’s capabilities and employability, often using adult learning and training tools, to fulfill the talent needs of a rapidly changing economy. Upskilling is part of the answer. But you also need to rethink your jobs: redesign the workflow, combine some positions, add others, and probably eliminate some. You need to be more creative in finding and onboarding people, including through acquisitions, partnerships, gig economy–style freelancing arrangements, and talent pools oriented to flex work. Finally, you must fill your enterprise with opportunities for continual self-renewal via modern learning strategies and digital technologies, so that becoming adept in new technologies is just part of everyday life.

AI And The Evolutionary Commoditisation Of RPA

Artificial Intelligences’s evolutionary path is actually very different. Although it’s been around in various forms since the 1950s, we are still very early in the journey, but with the technology developing at an exponential rate. What we have now is the perfect storm of ubiquitous data (which AI feeds off), storage costs for all this data that is so cheap that they almost become irrelevant, the processing power to run complex models in minutes rather than days, and everything connected together(including access to publicly available data training sets). AI is ready to really lift off. But before we get carried away and start to imagine sentient machines that will take over the world, we need to remember that everything that AI does is very narrow. That means that each AI model can do one thing, and one thing only, very well. An AI trained to recognise pictures of dogs can’t read text. It can’t even be used to recognise pictures of cats – the system would need to be completely wiped and retrained using cat pictures instead of dog pictures.

The IT Pyramid of Pain: how IBM’s CIO Fletcher Previn retains top talent

For many organisations, digital transformation has shifted the function of IT from being solely a service provider to a business driver. On these grounds, Fletcher encourages other IT departments to get more involved in the cultural aspects of their organisation. He said: “The culture of any work environment is largely a function of how work gets done. That, in turn, means that the tooling and IT surrounding the employees is not trivial – it’s core to any strategy for creating a high-performance workforce. “In order to create an environment where talented people want to work, and in particular, where gifted engineers want to work, I have to provide a productive environment for our people. “Also important is building out a modern DevOps software development stack, and enabling employees with the best tools available. Our general approach to this is: give people the right tools and equipment, manage those assets in a modern way, and enable self-service in the environment.”

10 Ways AI And Machine Learning Are Improving Endpoint Security

AI and machine learning are proving to be effective technologies for battling increasingly automated, well-orchestrated cyberattacks and breach attempts. Attackers are combining AI, machine learning, bots, and new social engineering techniques to thwart endpoint security controls and gain access to enterprise systems with an intensity never seen before. It’s becoming so prevalent that Gartner predicts that more than 85% of successful attacks against modern enterprise user endpoints will exploit configuration and user errors by 2025. Cloud platforms are enabling AI and machine learning-based endpoint security control applications to be more adaptive to the proliferating types of endpoints and corresponding threats. ... Combining supervised and unsupervised machine learning to fine-tune risk scores in milliseconds is reducing fraud, thwarting breach attempts that attempt to use privileged access credentials, and securing every identity on an organizations’ network. Supervised machine learning models rely on historical data to find patterns not discernable with rules or predictive analytics.

The best API strategy is not to start with an API strategy

Business requirements first -- APIs later, says David Berlind, editor of ProgrammableWeb, in his keynote presentation at the recent MuleSoft Connect event in New York.  "The APIs come at the very end," he says. Every effort should start with customer experience and business strategy, he explains. "You don't start with an API strategy. You tart with a business strategy and customer experience. Then you figure out what APIs need to be in place, so information can be exchanged between you and your partners. Then you think about the design of those APIs, the technical specifics and tactical stuff. Then you have an API strategy, and an ecosystem." There's been plenty of talk that the "i" in CIO or IT should stand for "innovation." However, Berlind believes "imagination" is more appropriate. "For decades now, we've been struggling to keep the lights on in IT, reduce costs, do more with less. In my view, its time to rethink that process. Get the organization to understand the power of the API, and how it could be such a game-changer to whatever industry you're in." ... "It's important to get everybody in the organization aware of where the APIs are. But it's also equally important to make sure the entire organization understands the power of the APIs, and how it allows them to imagine different outcomes -- outcomes that were quite unimaginable just a few years ago. ..."

---

Quote for the day:

"Valor in the leader is often an expression of the leader's character, fortitude, grace, vulnerability, openness, and honesty." -- Catherine Robinson

---

Daily Tech Digest - September 26, 2019

Social engineering explained: How criminals exploit human behavior

Social engineering has proven to be a very successful way for a criminal to "get inside" your organization. Once a social engineer has a trusted employee's password, he can simply log in and snoop around for sensitive data. With an access card or code in order to physically get inside a facility, the criminal can access data, steal assets or even harm people. In the article Anatomy of a Hack a penetration tester walks through how he used current events, public information available on social network sites, and a $4 Cisco shirt he purchased at a thrift store to prepare for his illegal entry. The shirt helped him convince building reception and other employees that he was a Cisco employee on a technical support visit. Once inside, he was able to give his other team members illegal entry as well. He also managed to drop several malware-laden USBs and hack into the company's network, all within sight of other employees. You don't need to go thrift store shopping to pull off a social engineering attack, though.

Why you should hire staff from firms that have fallen victim to hackers

Being equipped with the experience of having been through it before can provide benefits not only for setting up systems to prevent damaging attacks, but the processes required if an organisation does fall victim to hackers. Rather than viewing staff who've worked at organisations that have suffered a cyberattack as having failed to do their job, other organisations should be actively seeking out these people to learn from them – even to the extent of hiring them for their own security teams. "Senior members of security staff who've worked in organisations which have had a major, publicised breach, that can be seen as a negative – somehow individuals can be tarnished with that. That's probably the exact opposite to the way to how the industry should be thinking," Darren Thomson, CTO EMEA at Symantec, told ZDNet. "Someone who has lived through one of these incidents and been through the whole process, recovering from the bad experience then implementing additional security and privacy measures: that knowledge and experience is valuable and it's good to have someone with it," he added.

When to use AWS OpsWorks vs. CloudFormation or Elastic Beanstalk

With AWS OpsWorks, developers can deploy Puppet or Chef to manage declarative configurations within EC2 instances. Like CloudFormation, you can use OpsWorks to deploy AWS resources. However, OpsWorks automates the initial deployment of applications, as well as the ongoing changes to the operating system and application infrastructure. Both Puppet and Chef can also control the deployment of AWS infrastructure. You should use OpsWorks in place of CloudFormation if you need to deploy an application that requires updates to its EC2 instances. If your application uses a lot of AWS resources and services, including EC2, use a combination of CloudFormation and OpsWorks. IT teams can integrate CloudFormation with OpsWorks to configure newly deployed EC2 instances with Chef or Puppet, rather than simple shell scripting.

New Relic CEO Lew Cirne on Observability in Development

A large enterprise might have 2,000 applications. Some of those applications are cloud native and many of those may be actively worked on right now. For those applications, they may be choosing to manually instrument them to not only be functional but also observable. When they do that, they use open APIs. That data would go to some other tool. Then they’ve got some applications they don’t have time to instrument and they want to see in production -- they drop our agent in. They go to New Relic for some of their stuff and go to other tooling for other needs. Now they can have it all in one place. “That open telemetry is a big change for us. For people familiar with New Relic it’s a new way to look at us. The second part of that is with all of this telemetry data coming into one place, we’ve believed for some time that dashboards are not enough. If you look at why people love our APM [application performance management] product, for example, it’s more than a dashboard. It’s an interactive application that understands the telemetry data we collect and presents it to our customers in a useful way.

Enterprises tap edge computing for IoT analytics

Putting analytics, servers and storage together at the edge to process data from the cameras and IoT sensors on the equipment eliminates the need “to send command and control to the cloud or a centralized data center,” which can take 40 milliseconds to get from one spot to another, Pugh says. “That’s too long to interpret the data and then do something about it without impacting production.” That type of decision-making needs to happen in real time, he says. Edge computing can be taxing on an IT department, though, with resources distributed across sites. In SugarCreek’s case, six manufacturing plants span the Midwest U.S. SugarCreek plans to move from its internally managed Lenovo edge-computing infrastructure to the recently launched VMware Cloud on Dell EMC managed service. SugarCreek beta-tested the service for Dell EMC and VMware when it was code-named Project Dimension. SugarCreek already uses edge computing for local access to file and print services and Microsoft Active Directory; to store video from indoor and outdoor surveillance cameras; and to aggregate temperature and humidity sensors to assess how well a machine is running.

75% of execs cite phishing as the most significant security threat to businesses

"Organizations worldwide are realizing the need to invest in employee training and deploy different security awareness training solutions with the hope of mitigating the risk of data breaches," Gian said. "The problem is that many organizations settle for dated phishing simulation solutions that train employees randomly and require manual effort to operate. The outcome is disappointing, employee behavior doesn't change and information security teams remain powerless and frustrated in the face of successful phishing attacks. Effective training should not become an IT and financial burden, but be done autonomously, via data science driven methodology that offers each employee a customized, continuous training every single month and significantly changes employee behavior, hence mitigates organizational risk of cyber-attacks. "Just like the right technology," Osterman said, "such as firewalls or endpoint detection and response solutions, can protect an organization's data and financial assets from theft or destruction, so can the right employee training."

Have a Failing Big Data Project? Try a Dose of AI

AI is a broad category that can include supervised and unsupervised machine learning, neural networks and reinforcement learning. "The key to knowing which of these tools to use is predicated on a detailed understanding of the problem you are trying to solve and the types of data -- structured, semi-structured, unstructured -- with which one has to work," Schmarzo explained. A good data scientist, he noted, is like a skilled carpenter in that both will use the best combinations of tools to solve the problem at hand. AI may not be new, but AI at scale within complex organizations is still in its early stages. "We still do not yet understand every consequence of integrating AI into larger systems," Gallego said. "Organizations should be ready to take on this risk and should be mature enough to understand the consequences and tradeoffs." Heineken noted that all big data projects, regardless of the approach used, have three basic failure points: understanding the question that needs to be answered, the data architecture and its availability, and having the ability to land insights into a business workflow at scale. Effectively addressing these issues "are all critical success factors," he advised.

Russian pleads guilty in massive JPMorgan hacking scheme

According to the indictment unsealed at the time, Shalon was the mastermind of the whole operation, which prosecutors dubbed “hacking as a business model.” Shalon was the owner of US-based Bitcoin exchange Coin.mx, which he operated with Orenstein. Both are Israelis. With the help of Aaron, an American, the group allegedly bought up the type of penny stocks so often used in pump-and-dump scams. Then, using the customer data allegedly stolen from JPMorgan, Dow Jones, Scottrade and others, they blasted out emails to dupe the financial organizations’ customers and subscribers into buying the junk. It worked like a charm: they allegedly pocketed $2m from one deal alone. Prosecutors said the scheme generated “tens of millions of dollars in unlawful proceeds.” According to Monday’s indictment, Tyurin took his marching orders from Shalon. The New York Times reports that Tyurin’s lawyer, Florian Miedel, said in a statement that his client was “hired by the originators and brains of the scheme to infiltrate vulnerable computer systems at their direction.”

Data Security in the Age of Online Payments and Social Media Validation

Amidst threats that are looming large, it is important to guard against descending into a spiral of pessimism and hate. Finding the objective middle ground between abandonment of technology and resigning to a total surrender of privacy for instant benefit is the need of the hour. And that begins with the acknowledgement of all the advantages leveraged so far. To put things in perspective, it is necessary to ask three questions integral to this global dilemma. One, where does the buck stop in regards to data security? Two. What is the role of the user in protecting his data and privacy, while continuing to integrate the digital advantage in routine tasks? Is it possible to overcome the trust deficit that is growing by the day? Before looking at the answers, let’s shed light on the evolution of the smart-world that we claim to inhabit. From the days of barter system to paying bills and having food delivered to your doorstep, we have come a long way indeed.

Mind the Gap – a Road to IT/OT Alignment

Few organizations currently manage IT and OT with the same staff and tools. After all, these networks evolved with a different set of priorities and they operate in inherently different environments. Nevertheless, in order to address this new complex threat and to protect this broader attack surface, many industrial organizations have begun to converge their IT and OT groups. The ‘convergence initiative’ is anything but simple. The growing pains associated with bringing together these two substantially different worlds can prove to be a challenge. The IT/OT convergence trend is not only driving integration of IT tools with OT solutions, it also requires alignment of the strategic goals, collaboration and training; and bridging between two departments with people that have different backgrounds, different mindsets and concerns for their departments. In general, IT people are used to working with the latest and greatest hardware and software, including the best security available out there to protect their networks. They tend to spend time patching, upgrading and replacing systems.

---

Quote for the day:

"Real leadership is being the person others will gladly and confidently follow." -- John C. Maxwell

---