Daily Tech Digest - February 09, 2020

Ransomware attacks are now targeting industrial control systems

Researchers found Ekans contains a list of commands and processes associated with a number of industrial control system-specific functionalities aimed at stopping these functions in a ransomware attack. While this functionality is described as limited, researchers' analysis of Ekans notes that it still represents "a deeply concerning evolution in ICS-targeting malware" because it indicates that cyber criminals are now targeting ICS operation systems purely for financial gain. Files encrypted are renamed with a random five character file extension, while victims are presented with a ransom note with an email address to contact to negotiate a ransom to be paid in cryptocurrency. In order to deploy the ransomware, the attackers behind Ekans likely need to compromise the network before executing the attack. This follows the same trend as ransomware variants like Ryuk and Megacortex, which rely on a hands-on method of deployment rather than the self-propagation followed by other forms of ransomware. The way in which Ekans is designed to target ICS operations indicates that the attackers very much have a specific target in mind, so are likely to take their time to compromise targets relevant to their plans.

Security Predicted by Gartner to Improve in DevOps Teams

One tool on Gartner’s roadmap is IAST, or "Interactive Application Security Testing". IAST helps teams understand and address security during development and testing, in a manner similar to how Application Performance Management tools helped teams understand performance. Instead of sending code to a specialized performance team to evaluate isolated tests in a lab, APM tools such as New Relic, Dynatrace, and AppDynamics used instrumentation to continuously monitor what happened in an application without requiring code changes. As a result, teams could monitor their own data without requiring dedicated study in the field of performance engineering. With tools such as IAST, teams can leverage tools to find security defects without requiring dedicated study in security risk. As a result, these newer DevOps tools can locate security defects by identifying interesting occurrences, such as: when user input reaches an SQL command without validation, where an XML parser is configured to provide local files to external users, and many other types of risk.

Why private micro-networks could be the future of how we connect

The current social-media model isn’t quite right for family sharing. Different generations tend to congregate in different places: Facebook is Boomer paradise, Instagram appeals to Millennials, TikTok is GenZ central. Updating family about a vacation across platforms—via Instagram stories or on Facebook, for example—might not always be appropriate. Do you really want your cubicle pal, your acquaintance from book club, and your high school frenemy to be looped in as well? “Social media treats everyone—a friend, a family member, an acquaintance—the same,” says Courtney Walsh, a lecturer in human development and family sciences at the University of Texas who consulted for Cocoon. “I would argue that what we are doing is impersonal on social media.” Cocoon aims to change the way we share. It launched on Thanksgiving, with more than 10,000 users signing up from 163 countries that week, according to Monga. Everything you post stays within the group. The app is its own small world: a feed is the home screen, greeting users with updates since they last signed on; messaging capabilities include threads to help corral conversations.

Add a Turbocharged Data Grid to Your Angular Application

Developers of enterprise web applications that need to display data in grids are faced with a dilemma. Do you use plain HTML tables, which are simple and easy to build, but tired and featureless (especially since you know users will compare them to Google Sheets)? Or do you try again to find that elusive, free, open-source (but reliable) datagrid tool that will give you the performance, features, and support you need? Oh, and page bloat is always an issue... Enter Wijmo FlexGrid, a mature, fully supported data grid. It’s now over five years old and, at version 5, it’s feature-rich, incredibly fast, and has a tiny code footprint. FlexGrid features an Angular wrapper that simplifies the work required to create the Angular components you need, with support for all versions from Angular 2 through Angular 9. We will use Angular 8 in this tutorial. To see how easy it is to use Wijmo FlexGrid tables in an Angular 8 application, we’ll start with a simple Angular component containing a data-bound HTML table. Once the basic version works, we’ll alter the code and switch to Wijmo FlexGrid.

How to prioritize IT security projects

The state of IT security has never been more precarious. Advanced Persistent Threats (APTs), often state-sponsored, can embed themselves in a security environment, move laterally, and steal an organization’s critical assets without being detected for months. Cloud migration – and the challenges of handling on prem/cloud risks in an integrated manner – has created new attack paths while greatly increasing the demands placed on modern organizational security teams. These developments exacerbate the already tough mandate for IT security pros: they must be right every time, and the attackers need only be successful once. This doesn’t mean that hackers can operate with an entirely free hand; they, too, must pick and prioritize their spots. If your security is robust enough relative to other targets, attackers may judge it to be more trouble than it is worth, especially when there are so many other lightly guarded networks, devices, etc. Automation is the critical weapon in this game of attack and defend, as it allows attackers to maximize their resources and probe for the most vulnerable targets at scale. For defenders, automation plays an equally essential role.

Success follows Indiana Tech cybersecurity team

Darryl Togashi, director of Indiana Tech's cybersecurity program, was hired in June to beef up the university's offerings to increase lab space and align classes with current industry requirements. As cyber-threats evolve, professional training must adapt, he said. His vision includes creating more hands-on opportunities for students to gain practical experience. Togashi's focus includes securing a CAE-CDE – of Center of Academic Excellence in Cyber Defense Education – designation from the National Security Agency and the Department of Homeland Security. Results of the review should be available in March or April, he said. If Indiana Tech doesn't receive the prestigious designation, it will get feedback on what deficiencies were found and allowed to correct them and reapply, Togashi said. Within a year to two, university officials hope to offer working IT professionals opportunities to receive training in specific cybersecurity skills or topics. Voting machine security issues might be a focus of one, for example. Togashi is also charged with sponsoring and participating in events that introduce middle and high school students to cybersecurity at a level they can understand.

Google releases TyDi QA, a data set that aims to capture the uniqueness of languages

Whether we’re aware of it or not, AI and cybersecurity technology are nearly omnipresent in our daily lives, and they’re only gaining importance as our world becomes more connected, “intelligent,” and reliant on online or automated systems. Yet both can seem intractably technical, even to tech-savvy people, with an ominous gravity that multiplies at the intersection of their Venn diagrams. The easy metaphor is that cybersecurity is an escalating arms race between good actors and bad actors, while the advent of AI is proverbial nuclear warfare. Some of that’s true, but the reality is far more illuminating, nuanced, and accessible. Huge cybersecurity threats can be amplified by AI technologies, so cybersecurity experts need to employ AI to protect us — and they are. In this issue, we’ll discuss how some threats are more sophisticated than ever, but most are not. We’ll learn that even as attack and defense systems are supercharged by technology, the need for human expertise has become more critical, not less. And we’ll look at practical solutions to some of the most onerous threats, like deepfakes and the increasing presence of AI-powered cameras.

How Twitter Improves Resource Usage with a Deterministic Load Balancing Algorithm

Twitter has been using a client-side load balancing technique for several years with its microservices architecture. They call this technique a "deterministic aperture," and it's part of Finagle's RPC framework, an open-source project for the JVM. Finagle embeds a client-side load balancer in every client. Instead of making calls to a central server-side load balancer, all requests go straight to a destination server, without an intermediary. This reduces the need for an extra infrastructure layer, and also reduces network hops, bandwidth, and points of failure in the system. Client-side load balancing is an approach that other projects like Baker Street and Netflix Ribbon use. And also companies like Yelp, Airbnb, or Stripe use it to run microservices systems. Using client-side load balancers means that now there can be multiple load balancers distributed within clients throughout the system—at least one per client. Therefore, it gets complicated when trying to distribute traffic load to servers in an even manner, especially when there are thousands of servers. For this reason, Finagle's deterministic aperture algorithm combines the P2C approach for distributing traffic load with the combination of a deterministic approach when picking which servers to connect.

This crafty malware makes you retype your passwords so it can steal them

Once running on the compromised Windows system, Metamorfo terminates any running browsers and then prevents any new browser windows from using auto-complete and auto-suggest in data entry fields. This prevents the user from using auto-complete functions to enter usernames, passwords and other information, allowing the malware's keylogger functionality to collect the data the users are thus obliged to retype. It then sends that data back to a command-and-control server run by the attackers. Metamorfo even includes a function that monitors 32 keywords associated with the targeted banks, likely so that the attackers can be alerted in real time as to when a victim is trying to access online services. Researchers haven't revealed the keywords or the names of the financial institutions being targeted, as it's likely the Metamorfo campaign is still active. To help protect against falling victim to attacks using the malware, users should be wary of unexpected emails and attachments, while using an antivirus product can also help detect the malware.

How Enterprise Architecture can reduce risk in Mergers and Acquisitions

A merger involves two or more entities combining in such a way that previously recognized legal entities cease to exist. The merging entities have a shared burden in defining the new or changed business model; changes in their go-to-market strategy; customer journey, etc. This includes the complexity of the risks involved in getting the necessary clearance and support required in clearing a myriad of regulatory hurdles. All of this means risk and resource allocation decisions above and beyond the typical day to day business operations. Merging companies share an interest in articulating organizational structure and behavior from a strategy, operational, regulatory, and financial perspective. For Acquisition, the balance of sharing risk and resource allocation shifts depending on the nature of the purchase. In a friendly acquisition, it could look more like a merger in which parties are sharing some level of risk and resource decisions. Both participating organizations have an interest in representing their companies in the best possible light, but perhaps for different reasons. The acquiring firm wants to ensure they can demonstrate to the market and shareholders they are doing the right thing and will bring increased value.

---

Quote for the day:

"Leadership is particularly necessary to ensure ready acceptance of the unfamiliar and that which is contrary to tradition." -- Cyril Falls

---

Daily Tech Digest - February 08, 2020

Cultural Transformation Is Needed Before Traditional Banks Can Go Digital

Traditional banks and other financial institutions need to go through a cultural transformation before they can successfully undergo a digital transformation, according to the chief technology advocate at Starling Bank, whose statements came during a recent panel discussion. The recent debate, which was an initiative supported by widely-used messaging service Slack, was held on February 6 in London. It covered several 21st century developments including ongoing digital transformation efforts, the future of work and jobs, and how professionals will communicate and work cooperatively on projects. Slack’s panel included commentary from Stuart Templeton, head of Slack’s UK division, Jason Maude, chief technology advocate at Starling Bank, Flora Coleman, head of government relations at TransferWise, ... While speaking about recent digital transformation efforts, Maude noted that he thinks it might be possible for traditional financial institutions to adapt to change, however, it would definitely be challenging for them to do so.

Cybersecurity Priorities Are A Matter Of Perspective

Cybersecurity and compliance are crucial for organizations—but they are also challenging. The threat landscape is constantly growing and shifting, making it difficult to stay one step ahead of attackers and adequately defend networks and data. A survey of cybersecurity professionals at Black Hat USA 2019 in August of last year found that 65% believe their organization will have to respond to at least one major cybersecurity breach in the next year. Addressing cyber threats and compliance mandates is even harder if the effort is not coordinated. The report from Real Time Research Reports, sponsored by Authentic8, examines survey results from 163 senior level compliance, legal, and IT managers from financial services companies or law firms with clients in the financial industry. Among the organizations that took part in the survey, it seems that these three teams each view both the issues of cybersecurity and compliance and how to address them through their own skewed lens. In other words, every problem is a “nail” that only their particular “hammer” can solve.

Ransomware installs Gigabyte driver to kill antivirus products

Gigabyte's fault resides in its unprofessional manner in which it dealt with the vulnerability report for the affected driver. Instead of acknowledging the issue and releasing a patch, Gigabyte claimed its products were not affected. The company's downright refusal to recognize the vulnerability led the researchers who found the bug to publish public details about this bug, along with proof-of-concept code to reproduce the vulnerability. This public proof-of-concept code gave attackers a roadmap to exploiting the Gigabyte driver. When public pressure was put on the company to fix the driver, Gigabyte instead chose to discontinue it, rather than releasing a patch. But even if Gigabyte had released a patch, attackers could have simply used an older and still vulnerable version of the driver. In this case, the driver's signing certificate should have been revoked, so it wouldn't be possible to load the driver's older versions either. "Verisign, whose code signing mechanism was used to digitally sign the driver, has not revoked the signing certificate, so the Authenticode signature remains valid,"

A new money-laundering rule is forcing crypto exchanges to scramble

Critics have argued that the new rule is onerous because it calls on the industry to build a completely new technical infrastructure for sharing information. Because of the pseudonymous nature of cryptocurrency, it’s not necessarily obvious to exchanges, for instance, when a customer is sending money to another exchange. All they can see is a string of letters and numbers, so the sender could just as well be transferring money to another wallet the same person controls. Now exchanges will somehow have to identify themselves. Others have argued that the rule will drive would-be money launderers to use services and tools that are harder to police. Nonetheless, the industry has been left with no choice but to come up with something like the SWIFT network, but for crypto. And they’ve got to come up with something fast; FATF plans to review its progress in June. According to a new, detailed look inside the process by CoinDesk, thorny questions remain about how exactly exchanges should transmit information to each other. Should that process use a blockchain, or rely on a more traditional, centralized design?

White House reportedly aims to double AI research budget to $2B

Simply doubling the budget isn’t a magic bullet to take the lead, if anyone can be said to have it, but deploying AI to new fields is not without cost and an increase in grants and other direct funding will almost certainly enable the technology to be applied more widely. Machine learning has proven to be useful for a huge variety of purposes and for many researchers and labs is a natural next step — but expertise and processing power cost money. It’s not clear how the funds would be disbursed; It’s possible existing programs like federal Small Business Innovation Research awards could be expanded with this topic in mind, or direct funding to research centers like the National Labs could be increased. Research into quantum computing and related fields is likewise costly. Google’s milestone last fall of achieving “quantum superiority,” or so the claim goes, is only the beginning for the science and neither the hardware nor software involved have much in the way of precedents.

Top Tech for Mobile Banking? GPS.

As the banking industry moves toward fully real-time solutions, with millisecond response times and immediate access to funds, precise time becomes vital. As banks continue to pursue modernization of batch-based, memo-post core solutions – which tended to use the server time for transactional timestamps – those date and time stamps, as well as location stamps, become the most important pieces of data the solutions maintain with a transaction. GPS is globally available, can be checked from anywhere, and is free for everyone to use – including banks and their mobile banking solutions. Cell towers use GPS signals to place phone activity; ATMs and cash registers use GPS data for transactions; and stock exchanges use GPS to regulate the trades that go into stock portfolios and investment funds. GPS technology not only identifies positioning; it can be used to ensure systems all over the world agree on the exact time. When you withdraw cash from an ATM or swipe your card or wearable at a store, the underlying systems need to determine (and agree upon) the exact time that the transaction occurs, for example, to prevent accounts from being overdrawn.

Why 2020 Will Be the Year Artificial Intelligence Stops Being Optional for Security

There has always been tension between the need for better security and the need for higher productivity. The most usable systems are not secure, and the most secure systems are often unusable. Striking the right balance between the two is vital, but achieving this balance is becoming more difficult as attack methods grow more aggressive. AI will likely come into your organization through the evolution of basic security practices. For instance, consider the standard security practice of authenticating employee and customer identities. As cybercriminals get better at spoofing users, stealing passwords and so on, organizations will be more incentivized to embrace advanced authentication technologies, such as AI-based facial recognition, gait recognition, voice recognition, keystroke dynamics and other biometrics. The 2019 Verizon Data Breach Investigations Report found that 81 percent of hacking-related breaches involved weak or stolen passwords. To counteract these attacks, sophisticated AI-based tools that enhance authentication can be leveraged.

Academics steal data from air-gapped systems using screen brightness variations

The method relies on making small tweaks to an LCD screen's brightness settings. The tweaks are imperceptible to the human eye, but can be detected and extracted from video feeds using algorithmical methods. This article describes this innovative new method of stealing data, but readers should be aware from the start that this attack is not something that regular users should worry about, and are highly unlikely to ever encounter it. Named BRIGHTNESS, the attack was designed for air-gapped setups -- where computers are kept on a separate network with no internet access. Air-gapped computers are often found in government systems that store top-secret documents or enterprise networks dedicated to storing non-public proprietary information. Creative hackers might find a way to infect these systems -- such as using an infected USB thumb drive that's plugged into these systems -- but getting data out of air-gapped networks is the harder part. This is where a team of academics at the Ben-Gurion University of the Negev in Israel have specialized themselves.

5 Mistakes Startups Make And How To Avoid Them

The most common mistake founders make when starting out is hiring people just like themselves. The danger in this unconscious bias, Weinstein says, is that without people who challenge the founder’s thinking, companies fail to identify new opportunities or to spot risks until it’s too late. The most successful startups hire people who bring a diversity of ideas, backgrounds and (complementary) skillsets, he says. Weinstein also cautions founders against hiring too many people too quickly. “Run lean,” he says. For early-stage technology startups, for example, there tend to be two critical roles: “one person who builds the product and the other who sells it.” ... Startups are notorious for overestimating the demand for their products and not knowing how to bring their big ideas to market. Both de Beco and Weinstein urge B2B startups in particular to document their “paths to profitability,” conducting rigorous analyses that challenge their initial market estimates. That analysis requires a deep understanding of the strengths and weaknesses of competitors and, above all, determining the company’s proprietary advantage in each market segment it’s looking to penetrate.

A new implant for blind people jacks directly into the brain

This was possible thanks to a modified pair of glasses, blacked out and fitted with a tiny camera. The contraption is hooked up to a computer that processes a live video feed, turning it into electronic signals. A cable suspended from the ceiling links the system to a port embedded in the back of Gómez’s skull that is wired to a 100-electrode implant in the visual cortex in the rear of her brain. Using this, Gómez identified ceiling lights, letters, basic shapes printed on paper, and people. She even played a simple Pac-Man–like computer game piped directly into her brain. Four days a week for the duration of the experiment, Gómez was led to a lab by her sighted husband and hooked into the system. Gómez’s first moment of sight, at the end of 2018, was the culmination of decades of research by Eduardo Fernandez, director of neuroengineering at the University of Miguel Hernandez, in Elche, Spain. His goal: to return sight to as many as possible of the 36 million blind people worldwide who wish to see again. Fernandez’s approach is particularly exciting because it bypasses the eye and optical nerves.

---

Quote for the day:

"Before you are a leader, success is all about growing yourself. When you become a leader, success is all about growing others" -- Jack Welch

---

Daily Tech Digest - February 07, 2020

Storing for the future: How data centers will advance in 2020

Data center construction is big business, with cloud companies spending over US$150 billion on new construction in the first half of 2019 alone. Does this spell doom for the on-premise server farm. Gartner Research VP David Cappuccio certainly thinks so. In a blog post called “The Data Center is Dead,” the veteran infrastructure researcher asserts his belief that by 2025 no less than 80% of enterprises will have shut down their on-premise data centers. The crux of his argument is that most of the advantages of traditional data centers have evaporated thanks to technological advancements—notably faster data transfer and the greater operational efficiencies at hyper-scale that mammoth server farms enable. The real tipping, though, is at the Edge. Edge data centers are located close to customers’ physical locations, reducing latency. This improves service for more intensive needs like gaming, streaming and cloud computing. Having local nodes allows larger distributed cloud networks to also offer consistent enterprise-quality performance, even outside of high-tier regions like New York and San Francisco.

Why trust and technology go hand in hand

Business leaders also have a responsibility to ensure their wider ecosystem embodies the same values. To do this they must actively engage with their supply chain. At BT, we’re continually working with our suppliers to make sure they’re embracing the same standards as us. This year, we identified 368 high and medium-risk suppliers and followed up with all of them within a three-month period. We can all do more, such as looking deeper, beyond direct suppliers, to expose other risks. Technology is an important part of the solution to this. Blockchain and robotic process automation allows every step of the supply chain to be tracked and verified, while similar technology in the financial space can shine a light on the flow of money, highlighting suspicious behaviour. These examples highlight how trust is a long-term project, and one that must be built over time. It’s about transparency, integrity and collaboration and the balance between allowing innovation to take place while safeguarding privacy and security.

IoT is a gold mine for hackers using fileless malware for cyberattacks

The SonicWall researchers found a 5% increase in IoT malware with 34.3 million attacks during 2019. The report lists common IoT security weaknesses as weak or hard-coded passwords, insecure networks and interfaces, and lack of secure update mechanisms. Check Point Research just announced a vulnerability in Philips Smart Hue lightbulbs. A flaw in the firmware allows attackers to take control of an individual bulb, push malicious firmware to it, and spread other malicious software throughout a network. The exploit comes from the Zigbee low-power IoT protocol used for device communication by Philips and many other IoT product manufacturers. It seems obvious, but it's worth repeating this observation from the report, "Given the tenuous landscape regarding data privacy, and the face that everything from nanny cams to doorbell are connected, IoT-focused attacks will only increase in 2020 and beyond." For 2019, SonicWall Capture Labs threat researchers recorded a 52% year-over-year increase in web app attacks and found that the attacks are getting more sophisticated.

Move over, Google: Microsoft's the new Android trailblazer

After failing to serve the Android faithful for ages — first ignoring the platform entirely and then wildly misunderstanding its nature for a while — Microsoft started getting serious about our virtual stomping ground a few years back. It made almost shockingly good versions of its office apps for Android, created its own Android launcher to turn Microsoft into a focal point of the phone-using experience, and then little by little built out an entire Microsoft sub-platform that existed within Google's virtual walls. The company essentially created a Windows Phone 2.0, in other words, only this time doing it in a way that piggybacked off the world's most widely used operating system instead of trying to go up against it. Just like Google, amusingly enough, Microsoft is now taking a post-OS era approach and focusing on ecosystem over operating system. So when we heard last year that Microsoft was building its first self-made Android device, the dual-screened Microsoft Surface Duo, it was clear this wasn't gonna be Yet Another Unremarkable Android Phone. Microsoft was up to something grander here — something intriguingly unusual and decidedly different.

Secret CSO: Emily Heath, DocuSign

There are so many metrics for different aspects of security, most people think of it in terms of incidents but there are so many other facets of what we do. We do track events, investigations and incidents like most companies do, but we also track things like critical vulnerabilities, risks (including 3rd party risks), and a whole bunch of other things. It's part of my job to be able to demonstrate what risk we are carrying at any one moment in time, and risks come in many different categories. ... Read, read, read! I am also a member of a number of security organisations, the wonderful thing about the security community is that everyone shares, no one wants to see anyone else get in the headlines so it's a really strong sharing community. I am also a board advisor for a venture capital firm based in Tel Aviv called Cyberstarts who specialise in early stage seed funding for young entrepreneurs in the cyber space. It's really great to be a part of seeing where the new technology trends are going and working with young entrepreneurs to help shape their products,

Samsung's Galaxy S20 to usher in 5G upgrade cycle, savvy pricing, camera upgrades, futureproof specs

Make no mistake, the Samsung Galaxy S20 launch will be critical to the consumer electronics giant, which is also making a B2B push in 2020. Counterpoint is projecting Galaxy S20 shipments to be at least 40 million units in the first year. That tally should prop up Samsung's smartphone unit, which hasn't delivered a massive upgrade cycle since the Galaxy S7 launch. ... Samsung has become a lot savvier with its pricing models. The Galaxy S10 Lite and Galaxy Note 10 Lite illustrated how Samsung is thinking through pricing. By offering lower price points, Samsung can bring more premium features down market while keeping kitchen sink, high-spec devices high priced. The Galaxy S20 lineup is likely to keep that approach going with Counterpoint betting that the base Galaxy S20 will start at $850. Also, keep in mind that the Galaxy S10 line is likely to see price cuts. It's unclear whether the Note 10 will see price cuts too. ... Aside from Knox for security and DeX for productivity and desktop usage, Samsung is likely to tout 5G's impact on tasks like video conferencing, collaboration and sharing documents.

Q&A on the Book Managing the Unmanageable

Because software is so abstract, many executives don’t really understand it and have false expectations for how long something will take to be coded. It doesn’t help that most programmers are optimists by nature, and tend to underestimate the work to be done. So as a manager you find yourself managing expectations up, even as you’re managing programmers and teams to actually get the work done. Both are challenging tasks. Also, one of the things that makes managing programmers harder than other technical disciplines is that the work is "intangible". That is, it’s "thought stuff". You can’t look at it the way you can a printed circuit board and see that you’re making progress. Finding ways to make the software more tangible, and progress more visible, is very important. ... In Managing the Unmanageable, we talk about some of the great programmers we have known, and how their contributions have been foundational for the companies they worked for. We’ve seen it time and time again – great programmers stand above the rest by their clear contributions.

Senior IT execs blame digital transformation for outage

"The pressure is mounting for IT leaders to prepare their organizations for the future, but the impact and cost of these transformation initiatives are far greater than anyone realized," said Tej Redkar, LogicMonitor's chief product officer, said in a statement. "Our research finds that the very initiatives that are supposed to be helping modernize global organizations are in fact contributing to an initial spike in outages and brownouts, costing organizations time and money," Redkar said. Of the 300 IT leaders surveyed, 59% believe mobile computing is making brownouts and outages more common; 57% say cloud, artificial intelligence (AI), and edge computing are causing availability issues. Interestingly, perceptions of digital transformation vary according to seniority within the IT teams. Practitioners see IT transformation in a more positive light than senior executives. Nearly 65% of executives, those with a vice president titles and above, say the digital initiatives are making brownouts and outages more common. This contrasts with just 49% of IT practitioners who share the same view.

Could Google carry the BlackBerry torch?

Let's be honest, though: BlackBerry, as a phone brand, had basically been on life support for a while. The Android-based BlackBerry phones of recent years were never especially exceptional, and for all the lingering fond feelings toward the name, it didn't seem like many people were actually buying the devices. And that's to say nothing of the brand's dismal performance with delivering Android operating system updates — a harsh reality that was firmly at odds with its security-centric message. Still, if we think back a ways, there was a time when BlackBerry was synonymous with security-first, business-friendly smartphones — devices designed not for Snapchatting or WhatsApping but rather for serious professionals who wanted to get work done, use the best productivity services available, and know that their technology would always be maximally secure. ... Apple, meanwhile, plays up the security card when it's convenient, but few would dispute that Google's services are generally superior. Even critical reviews of Pixel phones tend to talk about how the devices are a delight to use because of their superlative software and the holistic, cohesive-feeling way in which they integrate Google's best properties.

How real-time data is changing governance practices

The automated features of data governance programs simplify the process of profiling data, cataloging files, inferring meaning and detecting schema changes. These programs even automatically check the quality of the data to make sure it is trustworthy and secure before a user implements it. The increasing need for real-time information has, in turn, increased the speed of professionals doing data governance. When using the programs that expedite the process, entire collections of data can be analyzed and profiled automatically instead of one file at a time. Incrementally, the IT Team can meet their needs when new data is discovered. Some sources believe that implementing AI into data governance policies can quicken the data analysis and security processes. AI can detect anomalies in the system by machine learning algorithms and consuming huge amounts of data. It can pick out an abnormal pattern and be able to notify authorities before data can be compromised. 

---

Quote for the day:

"Individual commitment to a group effort - that is what makes a team work, a company work, a society work, a civilization work." -- Vince Lombardi

---

Daily Tech Digest - February 06, 2020

Is your CISO stressed? According to Nominet, they are

Overworked CISOs would sacrifice their salary for a better work-life balance, according to the research. Investigating the causes of CISO stress, the research found that almost all CISOs are working beyond their contracted hours, on average by 10 hours per week. And, the report suggests that even when they are not at work many CISOs feel unable to switch off. As a result, CISOs reported missing family birthdays, holiday, weddings and even funerals. They’re also not taking their annual leave, sick days or time for doctor appointments — contributing to physical and mental health problems. The key findings: 71% of CISOs said their work-life balance is too heavily weighted towards work; 95% work more than their contracted hours — on average, 10 hours longer a week — which means CISOs are giving organisations $30,319 (£23,503) worth of extra time per year; Only 2% of CISOs said they were always able to switch off from work outside of the office, with the vast majority (83%) reporting that they spend half their evenings and weekends or more thinking about work.

This latest phishing scam is spreading fake invoices loaded with malware

The attachment claims the user needs to 'enable content' in order to see the document; if this is done it allows malicious macros and malicious URLs to deliver Emotet to the machine. Because Emotet is such a prolific botnet, the malicious emails don't come from any one particular source, but rather infected Windows machines around the world. If a machine falls victim to Emotet, not only does the malware provide a backdoor into the system, allowing attackers to steal sensitive information, it also allows the attackers to use the machine to spread additional malware – or allow other hackers to exploit compromised PCs for their own gain. The campaign spiked towards the end of January and while activity has dropped for now, financial institutions are still being targeted with Emotet phishing campaigns. "We are continuing to see Emotet traffic, though the intensity has reduced considerably," Krishnan Subramanian, researcher at Menlo Labs told ZDNet. In order to protect against Emotet malware, it's recommended that users are wary of documents asking them to enable macros, especially if it's from an untrusted or unknown source. Businesses can also disable macros by default.

Research network for ethical AI launched in the UK

The initiative is being led by the Ada Lovelace Institute, an independent data and AI think tank, in partnership with the Arts and Humanities Research Council (AHRC), and will also seek to inform the development of policy and best practice around the use of AI. “The Just AI network will help ensure the development and deployment of AI and data-driven technologies serves the common good by connecting research on technical solutions with understanding of social and ethical values and impact,” said Carly Kind, director of the Ada Lovelace Institute. “We’re pleased to be working in partnership with the AHRC and with Alison Powell, whose expertise in the interrelationships between people, technology and ethics make her the ideal candidate to lead the Just AI network.” Powell, who works at the London School of Economics (LSE), specifically researches how people’s values influence how technology is built, as well as how it changes the way we live and work.

How Can We Make Election Technology Secure?

Let's start with some common problems presented by modern-day election machines. Single point of failure. A compromise or malfunction of election technology could decide a presidential election. Between elections. Election devices might be compromised while they are stored between elections. Corrupt updates. Any pathway for installing new software in voting machines before each election, including USB ports, may allow corrupt updates to render the system untrustworthy. Weak system design. Without clear guidelines and thorough, expert evaluation, the election system is likely susceptible to many expected and unexpected attacks. Misplaced trust. Technology is not a magic bullet. Even voting equipment from leading brands has delivered wildly wrong results in real elections. Election administrators need to safeguard the election without relying too heavily on third parties or technologies they don't control. It takes a lot of work to lock down a complex voting system to the point where you'd bet the children's college fund — or the future of society — on its safety.

The Human-Powered Companies That Make AI Work

Machine learning is what powers today’s AI systems. Organizations are implementing one or more of the seven patterns of AI, including computer vision, natural language processing, predictive analytics, autonomous systems, pattern and anomaly detection, goal-driven systems, and hyperpersonalization across a wide range of applications. However, in order for these systems to be able to create accurate generalizations, these machine learning systems must be trained on data. The more advanced forms of machine learning, especially deep learning neural networks, require significant volumes of data to be able to create models with desired levels of accuracy. It goes without saying then, that the machine learning data needs to be clean, accurate, complete, and well-labeled so the resulting machine learning models are accurate. Whereas it has always been the case that garbage in is garbage out in computing, it is especially the case with regards to machine learning data.

Infrastructure-as-code templates are the source of many cloud infrastructure weaknesses

There are multiple IaC frameworks and technologies, the most common based on Palo Alto's collection effort being Kubernetes YAML (39%), Terraform by HashiCorp (37%) and AWS CloudFormation (24%). Of these, 42% of identified CloudFormation templates, 22% of Terraform templates and 9% of Kubernetes YAML configuration files had a vulnerability. Palo Alto's analysis suggests that half the infrastructure deployments using AWS CloudFormation templates will have an insecure configuration. The report breaks this down further by type of impacted AWS service -- Amazon Elastic Compute Cloud (Amazon EC2), Amazon Relational Database Service (RDS), Amazon Simple Storage Service (Amazon S3) or Amazon Elastic Container Service (Amazon ECS). ... The absence of database encryption and logging, which is important to protect data and investigate potential unauthorized access, was also a commonly observed issue in CloudFormation templates. Half of them did not enable S3 logging and another half did not enable S3 server-side encryption.

Serverless computing: Ready or not?

By nature, serverless computing architectures tend to be more cost-effective than alternative approaches. "A core capability of serverless is that it scales up and down to zero so that when it’s not being used you aren’t paying for it," Austin advises. With serverless technology, the customer pays for consumption, not capacity, says Kevin McMahon, executive director of mobile and emerging technologies at consulting firm SPR. He compares the serverless model to owning a car versus using a ride-sharing service. "Prior to ride sharing, if you wanted to get from point A to B reliably you likely owned a car, paid for insurance and had to maintain it," he explains. "With ride-sharing, you no longer have to worry about the car, you can just pay to get from A to B when you want—you simply pay for the job that needs to be done instead of the additional infrastructure and maintenance." Serverless computing can also help adopters avoid costs related to the overallocation of resources, ensuring that expenses are in line with actual consumption, observes Craig Tavares, head of cloud at IT service management company Aptum.

Oops! Microsoft gets 'black eye' from Teams outage

“This is definitely a black eye for Microsoft, especially when it has touted its reliability in the wake of some high-profile Slack outages in the last couple of years,” said Irwin Lazar, vice president and Service Director at Nemertes Research. “It is surprising that Microsoft didn't renew its certificate, and it shows that as Teams rapidly grows they will have to ensure they are addressing operational issues to prevent further downtime.” Indeed, the prompt reaction to the outage is an indication of the growing importance of Teams as more and more office workers rely on team messaging tools. “There is nothing like taking a service down to illustrate its popularity and importance. However, this is not a best practice we recommend,” Larry Cannell, a research director at Gartner, dryly noted. An SSL certificate enables a secure connection between a web browser or app and a server, and is required for HTTPS-enabled sites. It helps protect users against security risks such as man-in-the-middle attacks by allowing data to be encrypted. When a certificate expires, the server can’t be identified and information cannot be sent. That was the case with Teams on Monday.

Looking to hire a '10x developer'? You can try, but it probably won't boost productivity

As Nichols notes in a blog, various studies since the 1968 one have estimated that top-performing developers are between four and 28 times more productive than average performers. But Nichols says his study found evidence to contradict the idea that some programmers are inherently far more skilled or productive than others. Performance differences are partly attributable to the skill of an individual, he writes, but each person's productivity also varies every day, depending on the task and other factors. "First, I found that most of the differences resulted from a few, very low performances, rather than exceptional high performance. Second, there are very few programmers at the extremes. Third, the same programmers were seldom best or worst," he explains. He argues that these findings should change the way a software project manager approaches recruitment. For example, they shouldn't necessarily just focus on getting the top programmers to boost organizational productivity, but find "capable" programmers and develop that talent. The study involved 494 students with an average of 3.7 years' industry experience. The students used the C programming language and were tasked with programming solutions through a set of 10 assignments.

5 steps to creating a strong data archiving policy

Suppose you decide to archive data that hasn't been modified or accessed in three years. That decision leads to a number of other questions related to the data management. For example, should all the data that meets the three-year criteria be archived, or can some types of data simply be deleted rather than archived? Likewise, will data remain in your archives forever or will the data be purged at some point? You must have specific plans that address the exact circumstances under which data should be archived, as well as a plan for what will eventually happen to archived data. Many companies assume that having a data archiving policy means they have a deletion policy; they eventually wind up wishing they had spelled out the specifics of deletion and archival. ... Regulatory compliance is also critical. Not every organization is subject to federal regulatory requirements surrounding data retention policy, but those that are can face severe penalties if they fail to properly retain required data. Multinational companies also must be aware of varying regulatory policies.

---

Quote for the day:

"Leadership does not always wear the harness of compromise." -- Woodrow Wilson

---

Daily Tech Digest - February 05, 2020

G Suite vs. Office 365: What's the best office suite for business?

Both suites work well with a range of devices. Because it’s web-based, G Suite works in most browsers on any operating system, and Google also offers apps for Android and iOS. Microsoft provides Office client apps for Windows, macOS, iOS and Android, and its web-based apps work across browsers. The suites also offer the same basic core applications. Each has word processing, spreadsheet, presentation, email, calendar and contacts programs, along with videoconferencing, messaging and note-taking software. Each has cloud storage associated with it. But those individual applications are quite different from one suite to the other, as are the management tools for taking care of them in a business environment. And both suites offer scads of additional tools as well. So it can be exceedingly difficult to decide which suite is better for your business. That’s where this piece comes in. We offer a detailed look at every aspect of the office suites, from an application-by-application comparison to how well each suite handles collaboration, how well their apps integrate, their pricing and support and more. Our focus here is on how the suites work for businesses, rather than individual use.

How remote work rose by 400% in the past decade

The report found that the rise of remote work popularity is thanks to the evolution of supporting technologies including powerful mobile devices, ultra-fast internet connections, and proliferation of cloud-based storage and SaaS solutions. "The rise of cloud-based SaaS software has been instrumental to the growth of remote work," de Lataillade said. "Employees can now instantly connect and collaborate with colleagues around the world at any time." Employees definitely took advantage: The majority (78%) of employees said they work remotely some of the time; more than half (58%) said they work remotely at least once a month; and, 36% of respondents said they work remotely at least once a week, the report found. While 36% might not seem like a huge percentage, it's a significant jump from 10 years ago. In 2010, the US Census Bureau found that only 9.5% of employees worked remotely at least once a week, indicating that the number of people working remotely on a weekly basis has grown by nearly 400% in the last decade, according to the report.

Social media targeting algorithms need regulation, says CDEI

“Platforms should be required to maintain online advertising archives, to provide transparency for types of personalised advertising that pose particular societal risks. These categories include politics, so that political claims can be seen and contested and to ensure that elections are not only fair but are seen to be fair; employment and other ‘opportunities’, where scrutiny is needed to ensure that online targeting does not lead to unlawful discrimination; and age-restricted products.” The report acknowledged, however, that personalisation of users’ online experiences increased the usability of many aspects of the internet. “It makes it easier for people to navigate an online world that otherwise contains an overwhelming volume of information. Without automated online targeting systems, many of the online services people have come to rely on would become harder to use,” it said.

NIST Drafts Guidelines for Coping With Ransomware

The proposed guidance offers a "how to" guide to implementing best practices. For example, it includes tips on vulnerability management and using backups to protect data. The second draft, "Data Integrity: Detecting and Responding to Ransomware and Other Destructive Events," offers advice on improving the detection and mitigation of ransomware and other security issues within their infrastructure. It also delves into how integrity monitoring, event detection, vulnerability management, reporting capabilities and mitigation and containment can be implemented to improve network defenses. Much like the NIST Cybersecurity Framework, these guidelines offers best practices that organizations can pick and choose based on their own network architectures, says Jennifer Cawthra, the National Cybersecurity Center of Excellence lead for data security and healthcare. "We put together a reference architecture to demonstrate that you can solve a cybersecurity challenge," Cawthra tells ISMG. "Now this is not the only way to solve a problem; it's just an example. ..."

From Legacy to Hybrid Data Platforms: Managing Disparate Data in the Cloud

Specifically, as part of an overall adaptive analytics fabric (the virtualized data and associated tools to aid analytics speed, accuracy, and ease of use), virtualization empowers companies to treat all their disparate data repositories as a single, unified data source that's extensible to support future technologies. A fabric provides a bridge across data warehouses, data marts, and data lakes, delivering a single view of an organization's data without having to physically integrate, engineer, or re-architect it. This abstraction enables enterprises to instantly surface usable data, no matter where it's actually stored, to produce fast, timely insights. The ability to merge data from different sources reveals another advantage. Rather than combining data into a single system that necessitates formatting data for the lowest common denominator of capability, adaptive analytics fabrics enable enterprises to store data in the data structures that best fit its use.

Eclipse Foundation Launches Edge-Native Working Group

The Foundation unveiled the new working group at the EDGE Computing World conference, currently underway at the Computer History Museum in Mountain View, CA. The distributed architecture called edge computing is transforming the way data is handled, processed, and delivered from millions of devices that are distant from a datacenter by bringing the compute power and storage physically closer to the application. The industry watchers at Allied Market Research expect the edge computing market to be worth $16.5 billion within the next five years. This isn't the Foundation's first work with computing at the edge. The independent, not-for-profit steward of the Eclipse open-source software development community already hosts production-ready code designed to enable devs to build, deploy, and manage edge apps at enterprise scale. But the working group provides an organized focus on the edge. The new working group already has two flagship projects: Eclipse ioFog, which provides a complete edge computing platform, including all the pieces needed to build and run apps at the edge at enterprise scale;

MIT's blockchain-based 'Spider' offers 4X faster cryptocurrency processing

The Spider topology allows cryptocurrency network users to invest only a fraction of funds in each account associated with a network and process roughly four times more transactions “off chain” before rebalancing on the blockchain. The Spider routing scheme "packetizes" transactions and uses a multi-path transport protocol to achieve high-throughput routing in PCNs. Packetization allows Spider to complete even large transactions on low-capacity payment channels over time, while the multi-path congestion control protocol ensures balanced use of channels and fairness across flows, the researchers said in their research paper. Ultimately, the more balanced the routing of PCNs, the smaller the capacity required — meaning, overall funds across all joint accounts — for high-transaction throughput, the school said. “The MIT researchers’ network performance improvement techniques are akin to packet switching used commonly in the telecommunications systems and queue management used by many system/network management solutions to alleviate network congestion and traffic at data centers and other data aggregation points,” said Avivah Litan, a vice president of research at Gartner.

5G will bring smart cities to life in unexpected ways

There's an interesting trend that we see developing, and when you look into smart city, we actually got and I like to call it also intelligent urban ecosystem. We started to look into not just government engagement with citizens but also all the private sector stakeholders like the vehicle manufacturers, the real estate development, the construction companies, the lifestyle and leisure companies, tourism. If you start to connect to a smartphone, all these data streams and experiences together as you look for maybe a semi-autonomous car to look for the right parking, close to the museum, for an elderly person that doesn't speak the language, so you see how that processing comes together, then 5G might as well be a very good venue to actually allow that technology and that process to apply a very good service experience for that elderly person. We have cities that, from a location perspective in smart streets or smart districts are starting to develop strategies to a smart post, for instance, where you have multiple sensors for security,

How Data Will Drive the Transportation Industry in 2020

The advent of new technologies in transportation continues to evolve industry practices at a rapid pace. As network connectivity continues to improve, customers are benefiting from convenience and speed. The eventual culmination of this evolution is the autonomous roadway. In 2020, the industry will experience the rise of 5G, which will drive the framework for the connected roadway. The increased bandwidth of 5G will allow for the placement of advanced sensors on roadways and traffic signals. The sensors will kick-start real-time data collection that allows for living 3-D maps, affording a safe environment for autonomous vehicles. The growth of 5G technology will allow for all fundamental components of an autonomous roadway to be built out; regulatory standards and safety practices can be tested and put into practice, eventually leading to the construction of smart infrastructures on a global scale. The more companies can educate themselves now about 5G’s capabilities and its adoption, the more successful they will be in 2020 and beyond.

Setting Up a Virtual Office for Remote Teams

Once you’re ready to go virtual, one of the best ways to ensure flawless collaboration between office and remote workers is having all employees use the same technology stack and digital tools. This will eliminate the merry-go-round of apps and software for individual developers, teams, and their managers. At MightyCall, we have an open culture regarding remote work, allowing our developers, product designers, and other employees to work from their virtual office whenever they need to. Regardless of the specific tech niche your company serves, we found there are several components to creating a productive environment for remote teams. ... Building a proactive remote working environment today is key to seeing your company thrive in the future. According to expert reports, by 2028 an overwhelming 73% of teams will have remote workers. This will result not only in greater workplace autonomy but demographically diverse and more inclusive hiring. While technology plays an essential role in birthing the idea of virtual offices, the success of the remote work experiment for each team depends on the human factor.

---

Quote for the day:

"I believe that the capacity that any organisation needs is for leadership to appear anywhere it is needed, when it is needed." -- Margaret J. Wheatley

---

Daily Tech Digest - February 04, 2020

What to know about software development security — why it’s still so hard and how to tackle it

When it comes to securing applications, consider threat modelling, a process that identifies but also prioritises potential threats from an attacker’s perspective. Questions to ask might include: what kind of data would an attacker be seeking? One popular threat model is STRIDE, which can be used in tandem with the DREAD risk assessment framework: this helps work out how likely is the threat to happen, the threat’s potential consequences, and whether the risk can be tolerated. For web applications, the Open Web Application Security Project Foundation, has published its top 10 list of the most common and critical security risks and this is an excellent reference source. Each threat is ranked by its agents, exploitability, prevalence, detectability, technical impact, and business impact. The top 10 OWASP help with API security, too. There is a shifting emphasis towards securing them at every part of the lifecycle, starting with the development stage.

Top 10 underused SD-WAN features

For enterprises that do business with the federal government, such as aerospace and defense companies, or enterprises with PCI compliance responsibilities, which includes just about everybody else, encryption keys need to be rotated on a regular basis (typically every 90 days). This can be a tedious manual process that entails complex change control policies and can require planned downtime. SD-WAN platforms can replace conventional VPN-based key rotations with an automated system that can be programmed to make the rotations as frequently as every minute without any interruption to data plane traffic. The result is better security, no downtime and no need for manual intervention. ... There are many scenarios in which companies need to keep different types of traffic separated from each other. For example, in the case of a merger or acquisition, the combined company might be a single entity on paper, but for business or compliance or security reasons, each business unit continues to operate independently. If the company then decides to upgrade to SD-WAN, it might be considering the purchase of two sets of physical devices.

Programming languages: Go and Python are what developers most want to learn

Do developers need a degree? Apple CEO recently said the skills needed to code could be achieved by teaching kids at an earlier stage in high school. Job seekers without a degree can also get jobs at Google, IBM, Home Depot, and Bank of America. HackerRank found that most developers hired at companies of all sizes do have a degree. But it found that small businesses with between one and 49 employees are the biggest source of employment for developers without a degree. It found that 32% of developers at small companies lack a degree compared with 9% of developers who work for firms with more than 10,000 employees. The top recruiting priority, with 38%, for hiring managers in 2020 is finding full-stack developers. The second and third most commonly sought after categories are back-end developers and data scientists. However, full-stack developers face more pressure than other groups, with 60% tasked with learning a completely new framework and 45% required to learn a new language last year. That proportion is higher than all other categories, including front-end developers, back-end developers, data scientists, DevOps engineers, and quality-assurance engineers.

Brexit messes up IT project plans

Bartels said in the report: “The slowdown in tech purchases by business and government is real and reflects the fact that business executives are generally reluctant to grow their tech budgets faster than the growth in their revenues.” Referencing the UK’s exit from the European Union on 31 January, Bartels noted that prime minister Boris Johnson and the Conservative majority in Parliament will need to negotiate a transition agreement that still leaves many key issues to be negotiated. “Those continued uncertainties will depress UK economic growth,” he said. Forrester expects tech purchasers to cut their budgets in response to these uncertainties, and forecast that the UK will experience a 1.4% decline in tech spending in 2020. Forrester noted that tech market growth across Western Europe “was not too bad in 2019”, with the region’s constant currency growth of 4.5% actually higher than the global growth rate of 3.9%. But Bartels noted in the report that Brexit uncertainties will knock down the UK’s tech spending.

Multi-cloud adoption is the future, so be prepared

Multi-cloud architectures add complexity. Each platform has its own set of rules for operations and management, which makes it harder to cross-train staff and give IT teams a holistic view of a company's cloud and on-premises assets. "Most organizations are pretty clear that they do not want broad silos operating independently in perpetuity," Johnston Turner said. Enterprises want to be able to optimize these different assets within their own constraints around security, cost and performance. That's why IDC predicts 70% of enterprises will deploy unified VMs, Kubernetes and multi-cloud management processes by 2022 to facilitate standardized governance and to provide a single view across environments. "You're just always going to have to do the talking to the lower level systems," she said. "But increasingly, the level of [automated extraction] -- the policy and controls that you can put on top of those controllers -- is really what matters."

Smart Cities: Accelerating the Path to Digital Transformation

Accessing data and achieving interoperability from various smart city IoT services are also critical steps on any digital transformation journey. Otherwise, data remains locked in siloes, making it difficult and expensive to develop smart city applications. Unfortunately, the smart city market is still young and lacks standard data models for sensors and applications. Cisco Kinetic for Cities addresses this and reduces deployment complexity by normalizing data to consistent, well-defined data models by integrating an ecosystem of over 90 pre-integrated partners. This allows CKC to bring multiple services and vendors together in a single-pane-of-glass dashboard to enable better operation and smarter correlated policies. We also offer a series of CKC API training modules and CKC sandbox on Cisco DevNet where cities can join or leverage over 600,000 Cisco developers to develop new applications and services. At Cisco, we believe smart city technologies must be secure, scalable, and interoperable — not just to meet today’s needs, but also to enable cities to undergo a sustainable journey towards digital transformation.

The 5 Hottest Technologies In Banking For 2020

APIs are about speed, agility, and personalization. You’e dead in the water if: 1) It takes nine to 12 months to integrate partners’ products and/or data, or 2) The partnership process requires significant time and resources to negotiate legal matters, revenue sharing, pricing, etc. And for all the talk about personalization in banking, nothing that exists today comes close to what’s possible in an environment with a robust set of partial-stack fintech providers and smart full-stack banks integrated through APIs. ... For all the hype surrounding chatbots and machine learning (ML), few community-based financial institutions have deployed these technologies. Going into 2020, just 4% of the institutions surveyed by Cornerstone have already deployed chatbots—twice as many as had deployed them going into 2019. But going into 2019, 13% of the survey respondents said they would be making investments in chatbots—and most ended up not investing. There was a big jump in the percentage of institutions who have deployed machine learning from 2% in 2019 to 8% in 2020. And for 2020, another 17% expect to deploy ML tools. If history is any guide, however, fewer will actually invest.

Tech spending slowing along with world economy

The one bright spot in their forecast is software. Forrester expects spending on software and cloud computing to actually grow during the forecast period by 5% in 2020 and 5.1% in 2021. Still these numbers are significantly less than 2018's 8.3% growth in software spending. "Any transformation of business operations or processes today involves the purchase of software," the report states. "The investments that firms are making to replace on-premises software with cloud alternatives is another factor driving the growth in software." After surging in 2017 and 2018 because of better economic activity globally and tax incentives in the US, however, spending on computer and telecom equipment is expected to fall. Even with growth slowing, spending on technology goods and services by businesses and governments will be robust in the coming years, going from $3.09T in 2016 to $3.71T in 2021.  As usual, the US outpaces the rest of the world by a massive margin. Anticipated US spending on technology for 2020, is $1.50T. At $289B, China, the next biggest spender, is expected to spend about a fifth of that amount.

Tesla and other autopilot-driven cars tricked with 2D projections

Researchers say that objects can be projected in a variety of ways, using cheap $300 projectors that you can buy from Amazon. These projectors can be handheld, or installed on flying drones. In addition, the research team says that projecting rogue 2D objects doesn't necessarily mean the projections need to be visible for long periods of time. A few hundreds milliseconds is enough, they said. Short-burst projections would be invisible to the human eye, but they'd still be visible and picked up by the powerful sensors and video cameras used by ADAS and autopilot systems. This opens the door for real-world scenarios where human drivers wouldn't even spot the projections, but the car would suddenly break or steer towards oncoming traffic. This is an important observation because most car makers advise drivers to use the autopilots only under direct supervision. Car vendors say the systems should be used to assist drivers while driving, but hands should always be kept on the wheel and eyes on the road.

Digital strategy for 2020-2030 sets out police technology plans

The strategy’s five ambitions are underpinned by seven enablers, which will provide the foundation for the nationwide digital transformation. These include data, strategic alignment and design, modernised core technology, connected technology, risk and security, talent, and transforming procurement. The enablers primarily focus on the need to develop common standards, approaches and structures across UK policing organisations, as well as to deliver better value for money. For example, the strategy recommends creating a national data management guide to drive data quality and consistency, while also developing a holistic data and technology framework to enable more consistent risk decisions. The strategy also recommends defining a “technology blueprint” for the next decade that avoids “the creation of bespoke solutions in favour of commercial off-the-shelf (Cots) applications.” The strategy claims that using Cots products, which it recommends setting specific procurement frameworks for, will ensure the standardisation of procurement and enhance value for money.

---

Quote for the day:

"Take time to deliberate; but when the time for action arrives, stop thinking and go in." -- Andrew Jackson

---