Daily Tech Digest - November 16, 2019

Facebook machine learning aims to modify faces, hands and… outfits

Deepfakes use a carefully cultivated understanding of the face’s features and landmarks to map one person’s expressions and movements onto a completely different face. The Facebook team used the same features and landmarks, but instead uses them to tweak the face just enough that it’s no longer recognizable to facial recognition engines. This could allow someone who, for whatever reason, wants to appear on video but not be recognized publicly to do so without something as clunky as a mask or completely fabricated face. Instead, they’d look a bit like themselves, but with slightly wider-set eyes, a thinner mouth, higher forehead and so on. The system they created appears to work well, but would of course require some optimization before it can be deployed as a product. But one can imagine how useful such a thing might be, either for those at risk of retribution from political oppressors or more garden variety privacy preferences. In virtual spaces it can be difficult to recognize someone at all — partly because of the lack of nonverbal cues we perceive constantly in real life.

Cybersecurity is heading into a recruitment crisis: Here's how we fix the problem

Part of the problem is how people get into cybersecurity. Only 42% of the security professionals in the survey started out working in the field. There are few university degrees in cybersecurity, and there isn't an A-level or GCSE in security. There are plenty of certifications (not least the CISSP program (ISC)2 runs) and almost half of the organizations in the survey are increasing their training budget for security - but cross-training existing staff isn't going to fill the whole gap. And to get people interested in gaining a certification, they have to know that it's a viable career in the first place. "When you choose what you're going to do in your life, you probably make your choice when you choose your university and your course, and even the first year of university may be too late [to reach people]," says (ISC)2 board member Biljana Cerin. "I think we need to give high school students a bit more information about the field and the different aspects of it." There are plenty of bootcamps and campaigns to encourage children (and adults who want to switch into a technology job) to go into coding; there are far fewer teaching IT administration or security.

Cybersecurity remains the top concern for middle market companies

"The middle market is low hanging fruit for attackers," said Brad LaPorte, senior director analyst of end security and threat intelligence at Gartner. "They often do not have the budget, skillset, or ability to implement proper security best practices."  Nearly half of organizations (47%) said they believe risk in their industry will increase in the next year, and almost the same number (48%) said they believe risk for their company will also grow, the report found. Cybersecurity remains the most challenged risk to manage for companies. In Q2, 47% of organizations rated cybersecurity as their top concern, and the trend followed in Q3, with cybersecurity taking the top spot at 46%, according to the report. "Midmarket enterprises have the same security concerns as larger enterprises," said Paul Furtado, senior director analyst at Gartner. ... However, stakeholders for middle market organizations are recognizing these issues and investing in proper security tools; and those that haven't, should, he said. Beneficial investments include cybersecurity awareness training, insider threat mitigation, cloud security, improved authentication, and managed security providers (MSSP) or managed detection response (MDR), Furtado said.

Could AI’s next chapter bring design of feeling machines?

New research paper from Kingson Man and Antonio Damasio at Brain and Creativity Institute, University of Southern California, Los Angeles, looks into robots with feeling. Feelings are a mental expression of the state of life in the body and play a critical role in regulating behavior. “Our goal here is to inquire about conditions,” said the authors, “that would potentially allow machines to care about what they do or think.” Jan Cortes in Medical Daily: “The gist is simple: Simply build a robot that would have the ability to be aware of its existence, and the perils of it… a modern A.I. brain could easily develop feelings and behavior that will help guide it to self-preservation and survival.” “Even if they would never achieve full-blown inner experience in the human sense,” said the authors about the robots, “their properly motivated behaviour would result in expanded intelligence and better-behaved autonomy.”

The Time To Tackle Cybersecurity In Self-Driving Cars Is Now

Futurists and experts predict that if self-driving cars become widely adopted by the public, the vehicle itself will transform into something of an entertainment or leisure zone. Parents could watch animated films with their children on long drives. Executives could conduct presentations and hold conference calls en route to their destination. And if passengers traveling from out-of-town forgot to pack their razor or toothpaste, some casual online shopping from the vehicle's network will ensure that new grooming and hygiene products await them when arrive at their hotel. For every instance of digital convenience a self-driving car may provide, there is an equal or greater cybersecurity risk associated with it. Hackers could manipulate a vehicle's AV system and disable screens or potentially stream malicious content. There may be an anonymous, unidentified viewer or eavesdropper on the executive's call taking note of confidential information, while also gaining access to other participants' computer systems and networks outside of the car.

5G Industrial Automation Isn't Right Around the Corner

"It is not enough if just industrial automation companies get together and discuss this because we are not necessarily the 5G experts," said Bosch's Andreas Mueller, who serves as chairman of 5G-ACIA, in explaining the purpose of the association. "It's hard to say what the infrastructure will be capable of. It's hard to say what the network operators will do. So that's why... we have to reach out to all these other stakeholders as well." The group counts almost 60 members spanning manufacturers, network operators, radio equipment vendors, chipmakers, module makers and test equipment vendors. "We are very much interested in attracting more companies," said Mueller. "We want to attract end users." End users of 5G industrial automation solutions are the big prize for the companies that are investing in and testing these new technologies. But so far, none of them have launched live production lines using 5G. Even at Bosch's own factories, the 5G trials run parallel to the live production lines, but are not responsible for actual manufactured deliverables. In the future, Mueller hopes to see Bosch and many other companies using 5G to connect mobile control panels that can instantaneously start and stop factory machines.

Intel Capital Invests In Innovation To Improve Cybersecurity For Everyone

Intel has put in a fair amount of effort in an attempt to fully bake cybersecurity into its technology strategy. The acquisition, integration, and eventual spinoff of McAfee played a central role in recent years and demonstrated that the road is not necessarily easy. Intel is still focused on improving cybersecurity, though, and has made a decision to disregard business as usual and try a different approach. Now, they’re focused on cybersecurity and will continue to invest in the industry. ... Kurkure explained to me that the Intel Capital investment philosophy around cybersecurity is to partner with innovative companies that can integrate and work with Intel to create a more holistic approach to cybersecurity. As opposed to the acquisition path Intel pursued with McAfee, the new strategy is to invest in companies that provide some synergy and that can collaborate with Intel—and with each other—in a way where the sum is hopefully greater than its parts. With Duality in particular, Kurkure stressed the importance of the privacy space right now.

Google Chrome experiment crashes browser tabs, impacts companies worldwide

According to hundreds of reports, users said that Chrome tabs were going blank, all of a sudden, in what's called a "White Screen of Death" (WSOD) error. The issue was no joke. System administrators at many companies reported that hundreds and thousands of employees couldn't use Chrome to access the internet, as the active browser tab kept going blank while working. In tightly controlled enterprise environments, many employees didn't have the option to change browsers and were left unable to do their jobs. Similarly, system administrators couldn't just replace Chrome with another browser right away. "This has had a huge impact for all our Call Center agents and not being able to chat with our members," someone with a Costco email address said in a bug report. "We spent the last day and a half trying to figure this out." "Our organization with multiple large retail brands had 1000 call center agents and many IT people affected for 2 days. This had a very large financial impact," said another user.

Make people, not tools, the focus of DevOps initiatives

What differentiates high-performers from less-productive teams? It all starts with a dedicated approach to upskilling team members, Groll said, which can include online resources and other techniques. "Companies that have really adopted a digital approach, an immersive learning approach, are much more successful." There are several ways for organizations to establish community structures to promote learning, both to identify common internal struggles and be more resilient to personnel or product changes. According to Accelerate, more than half of elite performers use communities of practice -- small groups of voluntary practitioners -- which was a common thread among attendees at the conference, as well. The report also named bottom-up DevOps initiatives and proofs of concept as common elements among elite performers -- those who nailed DevOps.

3 Reasons to Do a 'Proof of Concept' With MDR Providers

Every security vendor promises the moon in their marketing materials. As a small organization, we need to be confident that any tool we buy will do what we need it to do in our environment. The only way to do that is to kick the tires. PowerPoint presentations and demos are a helpful starting point. But just like buying a new car, you need to take technology for a test drive. Otherwise, you risk wasting time and money, not to mention your own reputation. A POC won't answer every possible question about a piece of technology or a service provider. But a provider's willingness to engage with you - and the way they engage with you - will help you learn a great deal about what your relationship will be like once the ink on the contract is dry. One of the most surprising things I found as we evaluated managed detection and response providers was how few of them would even agree to do a POC. When vendors refused, I could only conclude that our business wasn't a good fit for them or they couldn't back up their marketing claims. Ultimately, we selected Expel.

---

Quote for the day:

"Your greatest area of leadership often comes out of your greatest area of pain and weakness." -- Wayde Goodall

---

Daily Tech Digest - November 15, 2019

IT Ecosystems Have Come of Age: Has Your Organization?

Don’t allow chaos to take over. Ever heard the term, “organized chaos”? Transforming your team will likely mean you’re changing every person’s role in your organization. It’s challenging. There will be a point in time where no one will quite know what they should be doing. And that’s OK. But it’s also where planning comes in. The planning process helps you think through any potential drawbacks and anticipate where there may be friction. This means continually looking for opportunities to evolve your processes or replace them with new ones. Failure to spend enough time planning can lead to breakdowns, which can affect your systems availability or important programs. This could spell disaster, so be sure to spend enough time in the planning stage and organize the transformation as much as possible. There may be those in your organization who feel that jumping in feet first and making the changes very quickly is the best way to overcome the naysayers and show progress. Many times, the senior management team or your board may support this path. However, it can be the quickest way to fail.

Vulnerability in Qualcomm's Secure Execution Environment

Researchers at cyber security firm Check Point have discovered a vulnerability in Qualcomm chipset, which could allow attackers to have unauthorised access to sensitive data. The vulnerability (CVE-2019-10574) exists in Qualcomm's Secure Execution Environment (QSEE), an implementation of Trusted Execution Environment (TEE) based on ARM TrustZone technology. QSEE, more commonly known as Qualcomm Secure World, is a secured area present on the main processor. The purpose of creating this hardware-protected space is to secure sensitive information, such as passwords, payment card credentials and encryption keys, from unauthorised access. ARM TrustZone has now become an integral part of all modern mobile devices. These devices come with specialised, trusted components that handle movement from device's Rich Execution Environment (REE) to TEE. In this way, the hardware-based security capabilities of the TEE can be prevented from being compromised by software or apps outside the trusted zone.

Monoliths to microservices: What to know about modernising enterprise applications

Shifting to microservices can be done in one of two ways. The first option is to keep a solid monolithic base and start building microservices around it. The second option is to iteratively transform whole applications to microservices. In either case, teams need to identify the boundaries of each microservice — they must encapsulate each business function as a ‘bounded context.’ To do so, teams must minimise dependencies of newly formed microservices to monolith applications. They must establish service-to-service intercommunication outside monoliths and begin fostering trust in a new, decomposed application environment. In this setting, they can extract bounded contexts to a single microservice and its database. ... Deploying microservices in this way increases the organisation’s ability to provide cross-unit and cross-application functions. Companies can create a perpetual evolution of their architecture and support new business processes by enforcing the established boundaries between new and existing modules as well.

3 ways to implement a functional programming architecture

While functional programming falls outside of the mainstream code languages, developers and architects interested in it should consider three ways to implement it: as part of a functional architecture, as part of an isolated or independent architecture, or as part of a hybrid programming model. Fundamentally, a pure functional programming language should not retain state and is more like a math expression than a procedural program. This architecture works for compiler construction or, perhaps, for APIs. A program to shorten and forward a URL, for example, might better fit a pure functional language than other, more common approaches. List processing, or LISP, is an impure functional language in that it can mix in traditional procedural programming along with the functional approach by using states and control flow. Unfortunately, few applications tend to fit a pure functional approach, and few programmers want to program in a mixed language like LISP. Software architectures, however, allow for two other functional programming approaches that fit some projects.

Why retailers can’t get enough data scientists

Retailers are on the hunt for data scientists, now more than ever. Given the rise in online shopping and the cut-throat competition from e-commerce giant Amazon, smaller retailers have begun closing their physical locations around the world. Dubbed the “retail apocalypse,” 8,600 stores will close in 2019 alone. Studies show that retailers are also forced to shift their sales strategies, offering more personalized online experiences to customers. Given this shift, retailers are actively seeking candidates in the data world who can help capture customer loyalty and keep sales high. The shift to a more data-centric approach in retail is not necessarily new, though there has been a big push in recent years. Retail giant Target Corporation arguably led the charge when, in 2013, the company hired Paritosh Desai as vice president of business intelligence, analytics and testing. Not only did Desai hire a robust data team, but he also created a data-driven culture company-wide. He established fluidity between the data team and managers by creating an analytics system that managers could use themselves, promoting data-driven decision-making across the board.

DevSecOps: The Answer to the Cloud Security Skills Gap

As security moves into the cloud, that team is going to be responsible for rebuilding that infrastructure in the cloud, and if security isn't a part of the conversations around this infrastructure, organizations are missing a huge opportunity. When organizations decide they want to do DevSecOps, they turn to a team, be it development, operations, or security, and tell them they need to get on board with transforming, often without the proper skills, resources, or guidelines. You need to know your DevOps teams' comfort level with security, and around digital transformation. For example, if they don't know about serverless infrastructure, beyond the obvious, then you're in for trouble. Expecting a team to exclusively learn on the fly is basing a strategy on hope, which is always doomed to fail. Instead, take your spare moments and offer your DevSecOps team opportunities to learn from their blind spots, whether with additional certifications or shadowing. It doesn't have to be perfect, but every bit helps.

IT heads praise hybrid cloud models but still opt for traditional data centers

"As organizations continue to grapple with complex digital transformation initiatives, flexibility and security are critical components to enable seamless and reliable cloud adoption," said Wendy Pfeiffer, CIO of Nutanix, in a statement. "The enterprise has progressed in its understanding and adoption of hybrid cloud, but there is still work to do when it comes to reaping all of its benefits. In the next few years, we'll see businesses rethinking how to best utilize hybrid cloud, including hiring for hybrid computing skills and reskilling IT teams to keep up with emerging technologies," she added. More than 80% of respondents told the survey that hybrid cloud environments were the ideal model for IT operations, especially in the Americas. Three out of every five IT managers surveyed said flexibility and mobility are some of the main features they look for in a cloud system, and the report said, "cherry-picking infrastructure in this way to match the right resources to each workload as needs change results in a growing mixture of on- and off-prem cloud resources, like the hybrid cloud."

The success of machine learning rests on scalability

For some years embedded processors have had the ability to vary their operating frequency and supply voltage based on workload. Essentially, a processor’s core can run slower when it isn’t busy; scaling back the main clock frequency directly translates to fewer transistors switching on and off per second, which saves power. When the core really needs to get busy, the clock frequency is scaled up, increasing the throughput. There is a relationship between supply voltage and clock frequency; by reducing both, the amount of power conserved is amplified. This kind of scaling isn’t going to be enough to deliver the power and performance needed in the embedded devices now being developed to run ML models. That’s because the way we measure performance is going to change. Right now, processors are typically measured in terms of operations per second; we’re now measuring that in teraops, or trillions of operations per second (TOPS). Using TOPS to measure the performance of a processor executing inferences won’t make as much sense as it does when executing sequential code, because the way the model runs isn’t directly comparable to regular embedded software. ML processors will be measured on the accuracy they achieve when delivering a given number of inferences per second for a given amount of power.

How The Internet Of Things Will Turn Us Into Connected Workers

There's little doubt that connected workers are the future, but one thing that employees and unions should be mindful of is the possibility of mission creep. Sure, IoT wearables are now helping workers stay safe and helping them be more efficient in their work, but there's a risk that this seemingly innocent beginning will provide the groundwork for the gradual yet inevitable encroachment of smart technology into most or all aspects of an employee's day. In the future, wearables and smart tech may be used to push employer control over employees to excessive, even counterproductive levels. Does this sound like an exaggerated prediction? Maybe, but there are signs that at least some companies may end up moving in a recognisably dystopian direction. Most notably, Amazon patented a wristband in 2018 that tracks employee movements within warehouses, and that even uses ultrasonic detectors and vibrations to direct workers' hands in the right direction of ordered items. Coupled with reports of how Amazon summarily and routinely fires employees who don't labor speedily enough, this kind of development invokes a future where IoT is exploited by employers to increasingly tighten the yoke they tie around the necks of their employees.

9 Recommendations to Manage Cloud Migration Complexities

Is your organization still in a state of flux on how to leverage this trend? Or, are you among the innovators who are inclined to adopt cloud-first strategies and encash the cloud opportunity? For most of the SMBs experiencing the high operational cost of IT infrastructure and compromised app performance, migration to the cloud environment seems like a lucrative option. With the multitude of benefits such as the pay-as-you-go purchase model, enhanced collaboration with globally distributed teams, robust database backup, seamless implementation of the disaster recovery system, and faster application implementation—cloud migration is the right mainstream strategy for any evolving business. But for a cloud newbie, considering to migrate their first workload to the cloud, a little consideration into prerequisites and caution in implementation will ensure that they can maximize cloud investments. A stalled cloud implementation will increase cost, lead to loss of sensitive information and operational disruption. While the implementation of any new technology is bound to encounter minor glitches, complying with the below-listed recommendations can help in minimizing errors.

---

Quote for the day:

"If a leader loves you, he makes sure you build your house on rock." -- Ugandan Proverb

---

Daily Tech Digest - November 14, 2019

Digital Transformation is the Industrial Revolution of our age

Digital transformation isn’t just about technology. It’s about leadership and partnership and stewardship. It should come as no surprise that one of the most important influences McKinsey identified when it comes to determining the ultimate outcome of any transformation is a team of leaders who not only understand digital tech but also feel a sense of urgency about leveraging it; who can’t wait to start the process and bring the rest of the organization along. That’s a tall order, becoming that kind of leader. Being someone who’s willing to challenge the status quo, experiment with the unfamiliar and get comfortable with the prospect of failure. But the only time I’ve ever seen any organization enjoy dramatic growth is when they tried something (and hired someone) dramatically different. Which brings us to an equally important ingredient of transformational leadership: Integrators. According to McKinsey, the leaders most likely to succeed in exacting change are those willing to step back and recruit uniquely qualified partners who’ll help them integrate -- and translate -- new digital tactics into existing and evolving business strategies.

Atlassian expands Jira Service Desk to non-IT biz teams

Although billed as a collaborative IT service management (ITSM) tool, many Jira Service Desk customers have, in practice, adapted the application to deliver a variety of services to end users in the enterprise, Atlassian said. With that in mind, the company today introduced new templates and workflows in Jira Service Desk to encourage its use outside of IT. Templates make it easier to configure the application to better meet the demands from HR, facilities and legal teams. The “out-of-the-box” functionality allows HR or operations managers to create and maintain their own service desks with minimal involvement from IT, Atlassian said. “HR and facilities teams can now leverage Jira Service Desk to more easily manage tasks like employee on-boarding and fielding maintenance requests, and legal teams can shift from manually chasing down signatures to working collaboratively with an automated digital workflow,” the company said in a blog post. The announcement comes as a range of vendors in the market, including ServiceNow and others, have also moved to expand their products with modules that support non-IT use, driving a trend around enterprise service management (ESM).

Cybercrime, meet AI

The good news is that any such automated APTs will arrive slowly, because AI is complicated. An AI algorithm isn’t usually designed to be user friendly. Instead of pointing and clicking, you have to customise the hacking tool to a degree that needs AI expertise. Those skills are in short supply in the industry, let alone the hackersphere, so we’re likely to see this achieved first by nation-states, not by hobbyists – which means that the first likely targets are those with national interest. Let’s look at some public examples. A while ago there were hacks on Anthem, Primera and Care First, major healthcare providers in the US, all of which worked with a lot of federal employees. At the same time, Lockheed and the Office of Personnel Management, which handles Class 5 security clearance, were hacked, losing fingerprint and personal data for thousands of people. One theory about these hacks was that a nation state stole the data. As it didn’t turn up on the dark web for sale, where did it end up? If this nation does now possess it, they have terabytes of healthcare, HR, federal background check and contractor data at their command.

3 emerging memory technologies that will change how you handle data

Intel’s Optane DC persistent memory drops into a standard DIMM slot connected to a CPU’s memory controller. Available in capacities of up to 512GB, it can hold several times more data than the largest DDR4 module. The information on an Optane DC persistent memory DIMM operating in App Direct Mode is retained when the power goes out. In contrast, volatile memory technologies like DRAM lose data quickly if they aren’t constantly refreshed. Software does need to be optimized for Intel’s technology. However, the right tweaks allow performance-bound applications to access Optane DC persistent memory with low-latency memory operations,. Alternatively, the DIMMs can be used in Memory Mode, where they coexist with volatile memory to expand capacity. Software doesn’t need to be rewritten to deploy Optane DC persistent memory in Memory Mode. The technology can also be used in what Intel calls Storage Over App Direct Mode, where persistent memory address space becomes accessible through standard file APIs.

Consumer Data Privacy Rights: Emerging Tech Blurs Lines

Security experts say that consumers should have fundamental data-privacy rights. If a company or government collects a consumer’s private data, it must have a legal basis, and must also have correct security measures in place to properly protect it. Individuals should also have the right to decide what and how their personal data is stored, experts like De Guzman have agreed. However, over the years court systems, companies and lawmakers have mulled over the data privacy implications of new tech, as exemplified through various legal cases throughout the years. For instance, Riley v. California shed light on warrantless searches of cell phones. In 2014, the Supreme Court ruled that the “search incident to arrest” exception does not extend to a cell phone, and police need to obtain search warrants to search cellphone data. Another case, U.S. v Microsoft, in 2013 brought data ownership and privacy into the spotlight, after U.S. authorities tried to access customer emails through Microsoft from a data center housed in Dublin, Ireland as part of a U.S. trafficking investigation.

Employees – the weakest link in email security?

Email is not only one of the most important channels of communication in day-to-day business, but unfortunately also one of the biggest gateways for cyber attacks. According to the safety and network specialists Barracuda Networks, 91% of all attacks start with an email. Gateway solutions such as Barracuda Essentials therefore represent an important first line of defence against the dangers posed by malicious emails. Not only do such solutions reliably recognise spam and phishing emails, they also provide protection against sophisticated attacks like zero-day attacks in which cyber criminals exploit unpatched security flaws in firmware and software in order to release malware or steal data. Thanks to the use of cutting-edge techniques such as sandboxing and artificial intelligence, it is becoming increasingly difficult for cybercriminals to overcome these defence systems. They are, therefore, increasingly mounting targeted attacks on workers by sending personal messages tailored to the recipient. Such emails are often not recognised as spam or phishing attempts by the defence systems, and these messages are therefore able to thwart the shield settings in place.

Cybersecurity Is An Asset, Not A Nuisance

IT teams are under enormous pressure to keep up with changing tech trends. The list of current tech capabilities is long and growing by the day — right-speed IT, blockchain, augmented and virtual reality, machine learning, and advanced analytics are just a few examples of technologies that IT teams are expected to be experts in. While businesses are happy to invest in the technology itself, they often neglect to likewise invest in the team making it all work. A Business Reality Check survey found that upwards of 40% of senior executives are increasing spending on tech, but fewer are investing in tech talent. As a result, many IT teams are stranded in firefighting mode, cleaning up after attacks, mitigating vulnerabilities, and improving security defenses rather than leveraging new technology to its full strategic potential. To solve this problem, organizations are turning to cybersecurity automation. A 2019 Domain Tools/Ponemon survey found that 53% of respondents don’t have enough staff to monitor their organization’s cyberthreats 24/7, and 60% believed automation will be used in the next few years for threat hunting.

Attention cybersecurity entrepreneurs: CISOs want simplicity!

Like many CISOs today, Guttman has a mission to simplify her organizational security. To that end, she warns that “CISOs must be ruthless about selecting and leveraging products and security environments,” explaining that tight budgets require IT organizations to adopt a strict and systematic evaluation process. “I'm looking at strategic gaps in cybersecurity, and whether legacy products provide the needed coverage. To some degree, it’s a zero-sum game – I often need to shed incumbent components and solutions to free up budget for new tech.” Adam Ely concurs, citing the popular “shift-left” approach to managing solutions at Walmart. “I'm looking at how can we build security into the fabric of our operations, as a process, as a technology, so that we can stop bolting on tech ad hoc, force-fitting tools and solutions that were not designed for a given workflow.” He warns cybersecurity vendors against narrow point solutions, as large companies are increasingly drawn towards migration to a single platform that can be leveraged across use cases and applications.

Plugging the Data Leak in Manufacturing

IIoT helps bring visibility to managers, allowing them to see whether machines are on, if they’re running efficiently and if there are any issues to address. In the event an issue arises, because of the data that IIoT provides, the technology can also allow manufacturers to trace back parts to where they were made and assess whether there’s been a problem with the machine, the part or something else entirely. As IIoT systems depend on these sensors to collect and parse through vast amounts of data, it’s vital to ensure that there are controls in place to safeguard that data and ensure its integrity. However, it can be easy to overlook the fact that this data needs to be protected in the first place. After all, it’s unlikely these systems are handling sensitive data that’s subject to regulatory compliance like protected health information (PHI) or personally identifiable information (PII). However, IIoT-generated data – calibrations, measurements and other parameters – still need to be stored, managed and shared securely to provide a company with maximum impact.

How retail companies can better protect themselves against cyberattacks

The "carders" who obtain stolen cards are able to upload them to a website, which then sells them anonymously and at huge discounts to their customers. This type of scam costs retailers millions of dollars in lost sales from both the gift cards and the products they're used to purchase, according to IntSights. Another popular method is card-not-present (CNP) fraud, a type of scam in which the customer doesn't have to physically present the card to a merchant during a transaction. Typically occurring online, this kind of fraud has risen due to the increased popularity of e-commerce sites. To fight this type of crime, many online retailers now require the CVV code from the card during a transaction. However, even CVV codes are now available on the Dark Web. In fact, full profiles of victims with their ZIP codes, PINs, and CVVs are worth more on the Dark Web because they help criminals more easily sneak past any security measures on a retail site. The Dark Web is home to many marketplaces that sell such credit card information, including one known as the Jokers Stash, according to the report. The underground credit card theft industry even works like a regular business with customer support and user reviews.

---

Quote for the day:

"Don't necessarily avoid sharp edges. Occasionally they are necessary to leadership." -- Donald Rumsfeld

---

Daily Tech Digest - November 13, 2019

Best Strategies For Data Security And Compliance

Assessing which obligations apply to your organisation can be arduous but it’s a vital process when considering the consequences of non-compliance. On balance, the costs incurred to establish the necessary policies, acquire the relevant applications, and hire the right staff are far outweighed by the huge costs which come from failing to comply. The value of adequate preparation is even higher for those industries held accountable to the most stringent regulation. In particular, financial services, healthcare and public sector organisations are key targets for cybercriminals due to the ‘sensitive’ data they handle. Companies operating in these sectors must be even more focused on boosting collaboration between security, privacy and compliance teams to ensure the appropriate privacy and security policy-setting and monitoring has taken place. Organisations can avoid major fines and hits to their bottom line caused by reputation damage and lack of customer trust if they adhere to the data privacy and security regulations that apply to their data. The costs of proactively protecting an organisation against bad actors will very likely save a lot of money in the long run.

PCI DSS payment security compliance drops again

“After witnessing a gradual increase in compliance from 2010 to 2016, we are now seeing a worrying downward trend and increasing geographical differences,” said Rodolphe Simonetti, global managing director for security consulting at Verizon. “We see an increasing number of organisations unable to obtain and maintain the required compliance for PCI DSS, which has a direct impact on the security of their customers’ payment data. With the latest version of the PCI DSS standard 4.0 launching soon, businesses have an opportunity to turn this trend around by rethinking how they implement and structure their compliance programmes.” Verizon’s report also incorporated data from its in-house Threat Research Advisory Centre (VTRAC), which found that compliance programmes lacking the proper controls to protect data were completely unsustainable and far more likely to be hit by a cyber attack. 

China Said It’s Developing 6G. What Does That Mean?

Though the United States has not launched its own assertive statement about 6G endeavors, critical research on the next generation of wireless technology is already happening at academic institutions across the country. Professor in the Bradley Department of Electrical and Computer Engineering at Virginia Tech Walid Saad and his team are already exploring the future of 6G wireless communication systems—with funding from the United States’ government.  “From my perspective, this announcement doesn’t worry me—it actually corroborates that we are doing the right thing in doing this research. From an academic perspective, it’s also nice to see, whether it’s China or other countries working on similar topics, because we can have collaboration and the exchange of ideas,” Saad said. “So it doesn’t feel threatening at all from an academic perspective, it’s more like ‘that’s nice, let’s see more activity happening.”

7 Ways to Make Test Automation Effective in Agile Development

One of the main reasons behind not achieving desired results in agile testing with automation is that agile development is all about continuous delivery with a number of short iterations in a development and deployment pipeline. Because of which QA teams often get to run short and frequent regression testing sprints as well. Small testing cycles means that it has now become more complicated for the testers to find, fix, and test the products of each iteration. Thus, it is essential to allocate enough time for testing, automation testing as well. The first step in reducing the test times is to start executing parallel testing, i.e., running multiple test threads at the same time. Parallel testing will not only improve the automation process, but it will also improve the team’s productivity. It will even allow your testers to invest time in more exploratory testing and actually debugging the issues there are. Another vital factor to consider is building robust tests. Testers need to develop quality test scripts that can be integrated with regression testing easily.

How much does it cost to launch a cyberattack

The low cost of entry, relative ease with which attacks can be deployed, and the high returns means the potential pool of threat actors isn’t limited by technical skill level. “If we look at the barrier to entry three years ago versus the barriers to entry now, a lot of these very focused services really didn't exist or were just starting to kind of really come into the market,” says Keith Brogan, managed threat services leader at Deloitte Cyber Risk Services. “It really isn't that expensive or hard for cybercriminals to go out and make some money very easily. The barrier to entry is very low; you could very easily get access to these different services and enablers and really turn a profit pretty easily. You are in some cases limited by your own imagination,” Brogan adds. This low cost of doing business and high rate of return means disparity between the profit criminals make versus the cost of repairing the damage is huge, says Oliver Rochford, director of research at Tenable. With ransomware, for example, he says even with a payment rate of 0.05% the ROI is estimated to be over 500%. While estimated global revenue of cybercrime is around $1.5 trillion, Rochford says the cost of damage is thought to be upwards of $6 trillion.

Why your providers should support IPv6

It would be disappointing to discover that a service provider has not yet implemented IPv6 at all. That would be a huge red warning flag that the service provider is not innovative when it comes to network technology. If the provider isn’t offering IPv6 services at this stage, it calls into question its prioritization of innovation and whether it is falling behind the competition in other areas. This situation really puts the enterprise into a bind if they may need IPv6 capabilities sooner rather than later because the enterprise’s ability to enable IPv6 is based on the IPv6 deployment schedule of the provider. Each enterprise is different and has a different motivation for enabling IPv6 on their public-facing applications and services. IPv6 deployment is an inevitable technology as there is no other alternative to the IPv4 address exhaustion problem. Given that IPv6 is an eventuality for enterprises, they should start to plan for the deployment and assess the constraints to their deployment schedules. Enterprises should ask providers what services they offer with IPv6 to determine where they stand and what options they have.

Micron announces 1TB industrial microSD, aimed at surveillance markets

Micron is positioning the card for edge compute, with surveillance systems increasing storing video on-device, rather than transmitting everything to external storage as it is recorded, eliminating the need for on-site DVRs, lowering TCO costs. This may be an application where QLC NAND makes sense, if it takes three months to fill the microSD on a continuous write (though increasing the resolution of the storage image could undercut this). Given that QLC is rated for 100 to 1,000 erase/write cycles, for three months per device write, a pessimistic view would put the lifespan at 25 years. Micron returned to the microSD market earlier this year with the release of the c200 series, also powered by 3D QLC NAND.  The company previously owned the consumer-focused brand Lexar from 2006-2017, selling it to Longsys in August 2017. Under the direction of Longsys, Lexar re-entered the market in August 2018, introducing its first 1TB (full-size) SD card this January, 15 years after Lexar introduced its first 1GB SD card.

Shared responsibility model key to solving 5G security problem

“With the large number of devices associated with 5G, authentication and identity need to be considered in the scope of security, similar to the public cloud. The 5G service provider can help confirm device identity as well, because the network will know a device’s physical location. In a way, the 5G service provider uses the network itself as a security tool,” she added. Lanowitz said that while introducing 5G networking affected many different technical areas, it was also an ideal opportunity to enhance and modernise approaches to security. For example, software-defined networking (SDN) and network functions virtualisation (NFV) technology will help organisations prepare for the sheer scale of 5G, but in parallel, there is no reason why security cannot also be virtualised and automated to some degree.

Everything you need to know about brain-computer interfaces and the future of mind-reading computers

I'm not sure I'm willing to have a chip put in my brain just to type a status update. You may not need to: not all BCI systems require a direct interface to read your brain activity. There are currently two approaches to BCIs: invasive and non-invasive. Invasive systems have hardware that's in contact with the brain; non-invasive systems typically pick up the brain's signals from the scalp, using head-worn sensors.  The two approaches have their own different benefits and disadvantages. With invasive BCI systems, because electrode arrays are touching the brain, they can gather much more fine-grained and accurate signals. However, as you can imagine, they involve brain surgery and the brain isn't always too happy about having electrode arrays attached to it -- the brain reacts with a process called glial scarring, which in turn can make it harder for the array to pick up signals. Due to the risks involved, invasive systems are usually reserved for medical applications. Non-invasive systems, however, are more consumer friendly, as there's no surgery required -- such systems record electrical impulses coming from the skin either through sensor-equipped caps worn on the head or similar hardware worn on the wrist like bracelets.

Diligent Engine: A Modern Cross-Platform Low-Level Graphics Library

This article describes Diligent Engine, a light-weight cross-platform graphics API abstraction layer that is designed to solve these problems. Its main goal is to take advantages of the next-generation APIs such as Direct3D12 and Vulkan, but at the same time provide support for older platforms via Direct3D11, OpenGL and OpenGLES. Diligent Engine exposes common C++ front-end for all supported platforms and provides interoperability with underlying native APIs. It also supports integration with Unity and is designed to be used as graphics subsystem in a standalone game engine, Unity native plugin or any other 3D application. The full source code is available for download at GitHub and is free to use. ... The repository contains tutorials, sample applications, asteroids performance benchmark and an example Unity project that uses DiligentEngine in native plugin.

---

Quote for the day:

"Bad times have a scientific value. These are occasions a good learner would not miss." -- Ralph Waldo Emerson

---

Daily Tech Digest - November 12, 2019

SASE is more than a buzzword for BioIVT

Making the leap to this SASE platform was quite a change for BioIVT. How did Thomson justify the transition to his executives? “We positioned it as a platform for everything that we wanted to be able to do over the next three years with the business,” he says. “The big goal, the business strategy, is growth and acquisition. We presented this as a platform, as a base service that we just had to have in place in order to leverage things like voice over IP, Office 365, Azure, cloud-based computing services, hosting servers in the cloud. Without a common core solid foundation, we wouldn't have been able to do any of those things reliably without adding staff to do monitoring or maintenance or administrative overhead.” Further, Thomson says he positioned the Cato solution as almost a black box tool for networking where they would know what services they were getting. “We could manage it through a web interface, didn't have to worry about specific technical skillsets that we would need to bring in. Just going with Cato's SD-WAN, we dealt with all of those networking things as well as security, which just continues to become more and more important and wasn't something that we could afford to treat as just a single vendor outsource that's half paying attention to what was going on.”

US Cyber Command uploads new malware samples linked to North Korean state-backed financial heists

Analysis of malware samples revealed that one backdoor was capable of uninstalling or updating itself, suggesting that North Koreans hackers are currently trying to hide their identities from security teams. In September, US Cyber Command uploaded 11 malware samples on VirusTotal, many of them linked to Lazarus Group - an umbrella term used to describe the hacking activity carried out to advance the interests of the North Korean government. Some of those samples were found to be similar to "HOPLIGHT," a trojan used by hackers to collect information on the operating systems of victims' machines. Earlier in August, Cyber Command released two malware samples, one of which was a dynamically linked library, while another was an executable file. All these announcements come weeks after a UN report that revealed that North Korea had used 35 cyber attacks to steal $2 billion from foreign financial institutions, and spent the money on its weapons programmes. In September, the US Treasury sanctioned three hacking groups - Lazarus, Bluenoroff and Andariel - all linked with North Korea.

Top concerns for audit executives? Cyber risks and data governance

Cybercriminals are now operating highly sophisticated organizations with a variety of low-cost, readily available hacking tools. A lack of relevant skills and low cybersecurity budgets means that organizations are falling behind in their attempts to counter the growing number of cyberattacks. Without an increase in resources, organizations will continue to be unable to mitigate the threat of cyberattacks, leading to potential data breaches, loss of intellectual property and regulatory exposure. At a minimum, organizations should have foundational security measures in place, such as privileged access controls on sensitive assets and mature vulnerability identification. It is also important to evaluate not only employee cybersecurity training and access management policies, but also the organization’s overall network security mechanisms and operational technology assets. Finally, organizations should ensure their response plan for cyber-physical attacks (which target the control of an organization’s physical infrastructure) addresses all of its vulnerabilities in the event of an incident.

Low-code and no-code development platforms

Low-code tools come with libraries which provide off-the-shelf components, for instance to support the latest innovations such as blockchain and artificial intelligence. Components may be provided by the supplier, third parties or the community of users, and may be free or paid for. There are also application programming interfaces (API) that enable external integrations – calling web services, for example. APIs were often lacking in the original 4GLs. Low-code tools will vary in their support for other features many consider now central to any application building effort, such as version control and support for DevOps. Low-code tools providers also claim faster testing of applications, lower error rates and more reliable security, all of which reduce cost and are areas where 4GLs were felt to fall short. Of course, the low-code tools themselves must be paid for, whereas many 3GL compilers are open source and make use of free open source libraries.

The data science gender pay gap is shrinking—barely

No matter what strategy is used, maintaining a diverse workforce is advantageous for any organization. "Organizations benefit from successful collaboration amongst different perspectives and viewpoints," said June Severino Feldman, CMO of Intelligent Product Solutions. "The greater the gender and ethnic diversity and a company's ability to collaborate effectively, the greater the potential for successful outcomes." Across the world, improvements have been made, but we are far from equality. Here is the break down, by region, of Harnham's research. ... Regardless of what strategy the company uses to encourage a diverse team, all team members must be on-board, starting from the top, Romansky said. "We suggest a holistic approach," Romansky continued. "It has to be a mandate supported by leadership with a variety of strategies that not only attract underrepresented talent—from sourcing, selection, and conversion—but then also engage and include that talent once they're in the door." To welcome diverse talent,companies must work to eliminate bias. "Employers must also look at themselves and their biases honestly -- it feels so much easier and natural to hire the guy who looks just like you, but to routinely follow this practice shortchanges the teams' abilities to adapt, create and innovate," Feldman said.

Real-World Cybersecurity: Keeping Ourselves And Our Children Safe

Our society is in a period of hyper-connectivity. This goes beyond our cellphones and laptops to include smart TVs, IoT-connected baby monitors and much more. If it’s a popular appliance, there’s at least one manufacturer out there touting an internet-connected version. This trend is creating massive personal data trails. There’s a high likelihood that almost every day, you’re handing over your valuable information without even giving it much thought – whether it’s at the grocery store, on social media channels or within your fitness tracker. Every bit of this data has value assigned to it, both for legitimate organizations and for cyber criminals who are determined to capitalize on it. Risks can include everything from gas pump and ATM card skimmers to schemes as nefarious as scamming people out of their life savings under the auspices of purchasing their dream home. The most vulnerable in the physical world – senior citizens and children – face similar risk in the cyber world. As the general population goes about daily life, convenience and ease of use are top of mind– risk isn’t usually a consideration. As a private citizen, you’re not likely to invest in heavy-duty cybersecurity tools.

Retirements pose threat to cybersecurity expertise in Congress

The retirements of Republican Reps. Hurd, Mac Thornberry (Texas), and Greg Walden (Ore.) previously underlined the threat to cyber leadership in the House. Hurd, a former CIA official, is viewed as one of the major cybersecurity voices in Congress, and has co-sponsored numerous bills around this issue, including those intended to secure internet-connected devices against cyberattacks and to secure elections. Hurd also serves as the top Republican on the House Intelligence Subcommittee on Intelligence Modernization and Readiness. In announcing that he would not run for reelection in 2020, Hurd highlighted cyber and tech issues as areas that the government would still need to address, and tweeted that he hoped to "pursue opportunities outside the halls of Congress to solve problems at the nexus between technology and national security." In a separate statement, Hurd highlighted cyber and tech issues, saying, "We are in a geopolitical competition with China to have the world's most important economy. There is a global race to be the leader in artificial intelligence, because whoever dominates AI will rule the world. We face growing cyberattacks every day."

Augmented Reality to Fill Skills Gap

Augmented reality is a new tool that can make the mining and retention of that expertise much better and much more automated. Having an experienced worker perform, for example, a regular maintenance procedure on a piece of equipment and recording a voice over using augmented reality greatly enhances skill and experience transfer rom one generation of workers to the next. “Using an augmented reality headset, a new employee can follow, very specifically, the procedure that was performed by a more experienced worker, with great knowledge transfer and a fraction of the time it would otherwise take,” explains Higgins. With augmented and mixed reality-enabled headsets, workers can safely train, in a digital environment, to address problems such as – increased line speed, quality issues, breakdowns, hazardous conditions, among others. “Systems like Vuforia from PTC is aimed at helping close the skill gap by expertly capturing a procedure that is done in an industrial environment and passing that expertise on to someone else,” he said. Workers can more effectively and efficiently address challenges with more real-to-life instructions presented by veteran co-workers with tribal knowledge of the work environment in this 3D-based work instruction format.

The FBI multi-factor authentication notification that should have never been

There are two factors that can prevent account takeover, which results from the above types of attacks. Mixing true multi-factor authentication with rich context ensures that you are interacting with the intended user and that they understand what they are approving. In a SIM swap scenario, using a secondary form of authentication that isn’t outside the person’s control would be enough to thwart the FBI documented attacks. For instance, a device that is registered to that person and not their phone number. However, such a solution on its own would not be enough to prevent account takeover resulting from a session hijacking. What could help is providing more context around authorization requests and on a secondary device. I find it hard to imagine a hijacking attempt being successful if a user was prompted by their baking website to re-authenticate their session while receiving a request on their authentication device to authorize a credential change. The rich context provides the intended victim with enough information to reject the attempt by the attacker no matter how well they perform the phishing attack.

Cheap IoT satellite network gets approval

“Swarm will begin rolling out its commercial, two-way data offerings in early 2020,” Sara Spangelo, co-founder and CEO told me in a recent e-mail. The company aims to deploy 150 satellites before the end of 2020, she says. The FCC, in October, granted Part 25 approval for the startup to deploy and operate 150 non-geostationary, Low Earth Orbit (LEO) satellites, for non-voice purposes. Swarm intends to target logistics, energy and the maritime verticals with what it promises to be a cheap service. Data over satellite, while allowing connections remotely across the entire globe unlike cellular, has historically been expensive: Satellite-communications incumbent Iridium’s Short Burst Data rates can be a dollar per kilobyte, for example. Swarm doesn’t say how much its service will cost. However, in January, the company obtained $25 million in Series A funding to build what Spangelo then described as “the world’s lowest cost satellite network.” Telemetry from connected vehicles, farmland agricultural sensors, on-board shipping logistics and remote rural sensors, such as water monitoring in Africa or smart meters, plus remote-area, human-to-human texting are all applications the company believes appropriate for its network.

---

Quote for the day:

"Leaders are more powerful role models when they learn than when they teach." -- Rosabeth Moss Kantor

---

Daily Tech Digest - November 11, 2019

5 Potential Oversights In Enterprise Identity Management

If you don’t take the time to consider these potential oversights in identity management, you could face some unneeded costs in your cybersecurity. First, you should seek out a singular solution for your identity and access management (as discussed above). The fewer solutions on your network, the fewer the costs. However, you need to weigh more than just your solutions’ integrations. In addition, you need to weigh the initial deployment costs—you need a solution that fits with your budget. Ideally, you should consider identity management a critical business process and budget accordingly. On the other hand, you still need a solution which fits your network—a more expensive solution may not benefit you.  Finally, your enterprise needs to also consider your IT security team. These individuals will maintain and work with it intimately, and they deserve proper compensation for their services. Moreover, the solution you select must fit with their individual skill sets so they can optimize their performance. “You can’t protect what you can’t see,” says the old cybersecurity adage. 

Real digital transformation starts with data governance

Data cannot be democratised without giving the consumers of that data an understanding of its trustworthiness and relevance to the business. That means having a firm grasp of the context, quality and business value of all available information sources – both inside and outside the organisation. Data governance is fundamental to enabling businesses to give their executives a holistic view of the metrics that matter and empower them to make agile, evidence-based decisions. It allows data scientists to focus on answering business questions and training AI models with confidence in the outcomes. It enables more and more workflows to be informed or transformed by putting contextual insight or predictive capability in the hands of non-technical users. And when provided within a framework of privacy, data can actively help to preserve customer trust as well as driving automation and delivering intelligent, engaging customer experiences. Amid the great DX gold rush, data needs to be perceived and treated in the same way as any other strategic asset, like people and facilities: managed with the right tools and governed by the appropriate policies and practices.

AT&T Sounds Alarm on 5G Security

Not surprisingly, the top security concerns related to 5G include the larger attack surface (44%), and the number of devices on networks (39%), followed by the need to extend security policies to new IoT devices (36%), and authenticate a greater number of devices (33%). “Most of the transitions in networking have been about faster speeds or increased capacity. 5G introduces more complex networking and is being delivered with virtualization in mind,” analysts wrote in the report. “The latter appears to be a crucial gap in the way enterprises are preparing for 5G, as enterprises will need to take advantage of virtualization to make the network nimbler and more responsive.” Many enterprises have yet to embrace that approach, according to the study. Only 29% of respondents said their organizations plan to implement security virtualization and orchestration during the next five years. Moreover, only 25% are confident that their organization’s current security policies will be effective in a 5G environment. More than half, or 53%, say some adjustments will be required and 22% anticipate a need to completely rethink their security policies.

Bitcoin and the disruption of monetary oppression

One of the tangible social impacts of Bitcoin can be witnessed in the human rights arena. As one example, Song offers an overview of the refugee crisis in Venezuela, explaining that Bitcoin is allowing those wishing to flee the country to sell their belongings and retain their money when crossing the border to Columbia. “There’s very clear evidence of this,” Song explains “because the price of Bitcoin in Columbia is actually lower than everywhere else in the world because there’s such a big supply. Four million Venezuelans have left. That’s 10% of their population. That’s a serious impact. Usually in refugee crises, it has gotten so bad that people were willing to leave everything behind. With this, they get to carry their wealth. It undermines the Maduro government to a large degree.”  The US’s market-driven monetary imperialism has led, Song argues, to a sort of global US dollar hegemony—the impact of which is that all global trade is settled in US dollars; if you’re in Kenya and want to trade with someone in neighboring Nigeria, you have to trade for the US dollar and then back to the Kenyan shilling.

The cybersecurity industry is evolving, but it’s still broken

Companies are also finding it hard to recruit enough skilled security personnel to properly protect their systems as there simply isn’t enough talent to go around, Vellante said. And so it may come as a surprise to learn that enterprises are actually becoming more circumspect about how much money they’re willing to spend on security relative to previous years, according to data from Enterprise Technology Research. According to Sagar Kadakia, director of research at ETR, “CIOs no longer have a blank check to spend on security.” One could be mistaken for thinking this means enterprises have thrown in the towel, so to speak, but in fact it’s more of a reflection of how fluid the cybersecurity space is right now. What’s actually happening according to ETR is that spending on cybersecurity is bifurcating, with a select few companies seeing their spending momentum and market share grow at the expense of others. Among those on the up are startups such as CrowdStrike Holdings Inc. and Okta Inc., plus more established players such as Palo Alto Networks Inc., Cisco Systems Inc. and Microsoft Corp. In contrast, the likes of Dell EMC, IBM Corp., Symantec Corp., Check Point Software Technologies Ltd. and SonicWall Inc. are all losing ground according to ETR surveys.

Breaking Into Data Science

Data scientists are critical in transforming massive volumes of data into action for companies. They were in high demand in the past too but limited to large enterprises and digital natives until recently. Today almost all companies worldwide are investing in data science skills. A top job seeker site, Indeed, shows a 29 percent increase in demand for data scientists year over year and an increase of 344 percent compared to five years prior. According to the LinkedIn Workforce Report, as of late 2018, every large U.S. city reported a shortage of data science skills. There is a gap of 151,717 people with data science skills, particularly acute in New York City (34,032 people), the San Francisco Bay Area (31,798 people), and Los Angeles (12,251 people). The U.S. Bureau of Labor Statistics estimates that there will be around 11.5 million jobs in data science and analytics by 2026. No doubt, data scientists need a strong educational background. If we look at the qualifications of currently working data scientists, 88 percent have a Master’s degree, and 46 percent hold a Ph.D.

IoT Has Spawned Entity-Based Risks -- Now What?

The exponential growth in IoT devices has led to more ransomware, malware and botnet attacks that are specifically targeting certain equipment. The Mirai botnet is a recent, high-profile example. Using a distributed denial of service (DDoS) attack against infrastructure provider Dyn, it disabled much of the internet on the U.S. East Coast on October 21, 2016. Mirai took over poorly secured IoT devices like security cameras, DVRs and routers by logging in using default passwords. In comparison, smaller, more targeted attacks can easily evade detection by conventional security products. ... Another approach involves using machine learning models to learn what constitutes normal behavior for an IoT device and monitor its activity to detect anomalies as they occur. This requires a mature User and Entity Behavior Analytics (UEBA) system capable of monitoring large numbers of IoT devices in real time. Machine learning provides the force multiplier needed to monitor for IoT security threats at scale. While IoT devices are not complicated equipment in and of themselves, connecting hundreds, thousands or more of them to the network creates a massive attack surface that can be difficult to protect using traditional methods.

Microservices security calls for zero-trust, data classification

"It's looking at running processes and system calls -- looking at what the server is actually doing, not what the log says is being done," Dougherty said. Omada has a small SecOps staff, so it leans on Threat Stack's security operations center (SOC) service to escalate alerts as well. Some tech futurists believe a zero-trust model will eventually mean that security is primarily the domain of applications, and that microservices security will rely on app functions that decide in real time whether to use a certain piece of infrastructure. But for now, zero-trust practitioners say sound security calls for proactive and reactive defenses at both the application and infrastructure level. FullStory is still building up its zero-trust model and microservices security practice, but at GitLab, Wang said the company used all the cybersecurity practices available, from code scanning to developer training to red teaming and bug bounties, and that full spectrum will be necessary for the foreseeable future.

Encrypted Emails on macOS Found Stored in Unprotected Way

Gendler discovered something curious in some of those .db files. “The main thing I discovered was that the snippets.db database file in the Suggestions folder stored my emails,” he wrote. “And on top of that, I found that it stored my S/MIME encrypted emails completely UNENCRYPTED.” Further, he discovered that even with Siri disabled, the OS still collects and stores data for Siri, in effect, storing encrypted emails without encryption in a database. This defeats “the purpose of utilizing and sending an encrypted email,” Gendler wrote. Typically, emails encrypted with S/MIME do so with a recipient’s public key, with a corresponding private key—also in the hands of the recipient–required to decrypt the messages, he explained. “If the private key is unavailable or removed, the message should not be readable, by anything,” Gendler wrote. “Unless the private key is compromised, you can be confident that only your intended recipient will be able to access the sensitive data in your email.” Gendler informed Apple on July 29 of the problem, which he discovered occurring on macOS Mojave 10.14 and the beta of macOS Catalina 10.15.

How to navigate cybersecurity in a 5G world

"Security virtualization could be the most crucial advancement related to 5G security, for both the provider and their enterprise customers. Enterprise IT is becoming more distributed, and through virtualization networking is following suit. Security needs to follow that trend," according to the report. Endpoint security is also a concern for 5G users. As more 5G devices are connected to the network, such as Multi-access Edge Computing (MEC) nodes, authentication and certification becomes paramount. However, only 33% of respondents said they planned to implement tighter network access controls in the next five years, and only 37% said they were creating new systems for device authentication, the report found. A zero-trust security model could help address these concerns, as it would continually check a user's presence and behavior, regardless if the user is a human or machine. Enterprises are embracing zero-trust, with 68% saying they have implemented it or are in the process, but only 33% said they have multifactor authentication (MFA) in place, the report found.

---

Quote for the day:

"Failure is simply the opportunity to begin again, this time more intelligently." -- Henry Ford

---