Daily Tech Digest - February 14, 2020

Can you put your trust in AIops?

The objective was and is obvious. Since most of these tools have been data gathering tools and analytics tools from the beginning, adding AI allows them to learn from that data rather than just externalize issues with the services under management. In some cases, they can correct issues using preprogrammed routines, such as restarting a server or blocking an IP address that seems to be attacking one of your servers. Now that we’re a few years into this paradigm and its technology offerings, we’re starting to note some patterns—some good, and some not so good. Let’s explore both.  As far as what’s working, AIops tools in many instances are ops tools in their fourth, fifth, or sixth generations. Moreover, most of them have had public cloud management in mind for a while and are able to bridge the gap between on-premises legacy system management and managing applications and services in the public clouds. They are capable tools for managing and monitoring cloud, multicloud, legacy, and even IoT and edge-based systems. This ability to support complex system heterogeneity is really the true value of the ops tools, and why they are important to those implementing cloud or noncloud systems.

Server sales projected to decline 10% due to coronavirus

Vladimir Galabov, principal analyst for data-center compute in Omdia’s cloud and data-center research practice, also expects to see server shipments impacted by the coronavirus driving a prolonged holiday period in China. “I think the majority of the hit will be in the Chinese market,” he said. “This does impact server shipments globally as China represents about 30% of server shipments worldwide. So, I expect the quarterly decline to be more significant than the seasonal 10%. I expect that China will have a 5% additional downward impact on the growth.” He added that Q4 of 2019 did significantly overachieve his expectations due to cloud service providers making massive purchases. Omdia expected servers shipped in 2019 to be flat compared to 2018 based on data from 1Q19-3Q19. Instead, it was up 2% to 3% for the year, thanks to the fourth-quarter spurt. And servers aren’t the only products taking a hit. DigiTimes says that should the outbreak of the coronavirus last until June, sales of smartphones in the country would be slashed by about 30%, from a projected 400 million units to 280 million units in 2020.

Ohio man arrested for running Bitcoin mixing service that laundered $300 million

The Bitcoin blockchain is a public database. In many cases, purchases of new Bitcoin funds aquired by a user can sometimes be linked to a credit card, bank account, or PayPal account. Helix functioned as a Bitcoin mixer (Bitcoin tumbler), a type of service that takes funds from a user, split the sum into small parts, and using thousands of transactions, sends and reassembles the original funds at a new Bitcoin address, in an effort to hide the original funds under a cloud of micro-transactions. "The sole purpose of Harmon's operation was to conceal criminal transactions from law enforcement on the Darknet, and because of our growing expertise in this area, he could not make good on that promise," Don Fort, Chief, IRS Criminal Investigation, said today in a DOJ press release. "Working in tandem with other sites, he sought to be the 'go-to' money launderer on the Darknet, but our investigators once again played the role of criminal disrupters, unraveling the interlinked web from one tentacle to another," Fort said.

Q&A on the Book Agile Machine Learning

With data projects - especially those which continuously output a data product - having metrics in place to fill this role is essential. The range of metrics helps elaborate on the general idea of the customer wanting to "improve" the quality of the data. With this in mind, projects of a certain scale should consider investing in a metrics team. This team needs to handle the collection of data, the (human) annotation of that data as well as the regular computation of metrics. We found that while it is useful to design a single metric that summarizes the quality and progress of the product, this is often of less value within the team and so we design a number of metrics as required by the components of the products and the dimensions that we wish to optimize for. We also innovated around the idea of a data wallow. This is a semi-structured meeting in which an engineer presents some data and the team as a whole provides feedback and insights into the characteristics of the data and the performance of any inference being made.

LokiBot Impersonates Popular Game Launcher and Drops Compiled C# Code File

LokiBot, which has the ability to harvest sensitive data such as passwords as well as cryptocurrency information, proves that the actors behind it is invested in evolving the threat. In the past, we have seen a campaign that exploits a remote code execution vulnerability to deliver LokiBot using the Windows Installer service, a Lokibot variant that uses ISO images, and a variant with an improved persistence mechanism using steganography. Recently, we discovered LokiBot (detected by Trend Micro as Trojan.Win32.LOKI) impersonating a popular game launcher to trick users into executing it on their machines. Further analysis revealed that a sample of this variant employs a quirky, installation routine that involves dropping a compiled C# code file. This unusual LokiBot variant, which uses a “compile after delivery” detection evasion technique, was proactively detected and blocked by machine learning detection capabilities built into Trend Micro solutions as Troj.Win32.TRX.XXPE50FFF034. The infection starts with a file that is supposedly the installer of the Epic Games store. This fake installer was built using the NSIS (Nullsoft Scriptable Install System) installer authoring tool.

Android facial recognition is more secure than you think

After careful consideration, I've drawn a conclusion that isn't meant to shame or blame but to highlight what I believe is at the heart of the concerns about the Android facial recognition system. The pushback to facial recognition isn't about the ability to crack it--it's about the ability to abuse it. I'm not talking about the ability of a rogue user being able to abuse your mobile phone via facial recognition; this is about companies and governments being able to use facial recognition in such a way that might invade citizens' privacy. I believe that is why so many people are concerned about how much facial recognition systems have improved. If the Android system is any indication, it is certainly ready for prime time. However, as far as a system to secure your mobile device? You shouldn't worry about it. Cracking the Android facial recognition system isn't easy--just short of someone taking your phone and forcing you to unlock it, chances are slim it's going to be cracked. Of course, if someone wants to get inside your phone that badly, it wouldn't matter if the device used facial recognition, fingerprint biometrics, or a password.

What’s next for serverless architecture?

Container platforms are the latest incarnation of IaaS. Instead of offering full-blown server hosts, CaaS providers let you host your services or applications within containers, and manage the containers on your behalf. Containers are more efficient at utilizing underlying host resources than virtual machines. One can think of containers as “tiny machines.” They launch quickly, and multiple instances can run on a single server. CaaS providers offer tools to deploy containers on servers and to scale the number of container instances up and down. The most advanced offerings completely manage the underlying servers for you, allowing your company to focus on the code (or containers) instead of the infrastructure. CaaS has quickly become one of the building blocks for PaaS and SaaS, resulting in a layered architecture. There has been a shift toward developing applications as high on the pyramid as possible. Many complex applications are still a combination of SaaS, PaaS, and CaaS, since the available platforms are not flexible enough to deliver everything an application needs. By relying as much as possible on SaaS, you free yourself from provisioning and scalability concerns. For the remaining parts, companies typically resort to running containers, which means they still have configuration and provisioning concerns.

Serverless computing: Ready or not?

Serverless computing can lighten IT workloads in several ways, most noticeably by freeing staff from routinely managing server performance, reliability, maintenance and security tasks. "The need to implement health checks to ensure application uptime, managing the underlying OS in regard to applying the latest security patch, or ensuring the underlying infrastructure has been provisioned with enough capacity to handle peak workloads are all things that are essentially handled for you by the serverless platform," Austin says. Serverless also lightens developers' workloads. "Writing less code, particularly infrastructure code, is attractive to the IT bottom line," Austin notes. "Having more developers deploying business functionality, while letting the serverless technology handle infrastructure provisioning, is a powerful benefit to an IT organization." Accelerating development speed can also make organizations nimbler and more innovative. Serverless is the fastest way to turn an idea into a functional solution, Kralj says. "The approach is perfect for rapid application development; you can now achieve it with just a few lines of code."

Google to Samsung: Stop messing with Linux kernel code. It's hurting Android security

"Android has been reducing the security impact of such code by locking down which processes have access to device drivers, which are often vendor-specific," explains Horn. An example is that newer Android phones access hardware through dedicated helper processes, collectively known as the Hardware Abstraction Layer (HAL) in Android. But Horn says vendors modifying how core parts of the Linux kernel work undermines efforts to "lock down the attack surface". Instead, he suggests handset makers use direct hardware access features already supported in Linux, rather than customizing Linux kernel code. Horn says some of the custom features that Samsung added are "unnecessary" and wouldn't affect the device if they were removed. He speculated that PROCA is meant to restrict an attacker who has already gained read and write access on the kernel. But he reckons Samsung could be more efficient by directing engineering resources to preventing an attacker from getting this access in the first place. "I believe that device-specific kernel modifications would be better off either being upstreamed or moved into userspace drivers, where they can be implemented in safer programming languages and/or sandboxed, and at the same time won't complicate updates to newer kernel releases," explained Horn.

Mono: From Xamarin to WebAssembly, Blazor, and .NET 5

With .NET 5, we are unifying the implementation of the class libraries, yet providing two options of runtimes for users. At a high-level, we have a high-throughput, high-performance runtime in CoreCLR, and we have the lightweight, (but not as fast) Mono runtime. Each runtime has been tuned for the workloads where they have been used the most — CoreCLR, for server and desktop applications, and Mono, for mobile and lightweight uses, such as WebAssembly. Also in .NET 5, we will have a unified runtime that can execute your C# or F# code on all the platforms that we support. On some of the platforms, users will be able to choose the runtime they want to use, and on other platforms, there will be a single runtime to use. For example, for desktop applications on Windows, only the CoreCLR runtime is suitable, and for iOS, only the Mono runtime is available. Now, historically, Mono has had two execution and code generation engines. One, we called the "mini" code generator, and it produced native code very quickly, but also without many optimizations.

---

Quote for the day:

"One measure of leadership is the caliber of people who choose to follow you." -- Dennis A. Peer

---

Daily Tech Digest - February 13, 2020

Revolut automates compliance workflows to fuel expansion

“There’s a couple of aspects to it: the ability to coordinate approval and review from the same location, and the ability to organize and connect our policy to the rest of our risk and compliance data points,” said Nicholas Melas, senior global policy manager at Revolut. According to Evgeny Likhoded, CEO and founder of ClauseMatch, the platform allows for real-time content collaboration and workflow management, and lets users map the content across the platform. The tool also uses natural language processing and machine learning to suggest relevant content. ClauseMatch allows Revolut to coordinate input, approvals and workflow in the same location without having to provide users with links to different passwords; it also lets the company automate the policy-approval process. This offers two benefits: consistency of approach and the ability to make changes to policies with minimal legwork. While ClauseMatch streamlines policy approvals and changes, it doesn’t eliminate humans completely, emphasized Melas. Instead, it takes away menial tasks, allowing staff members to focus on more complex roles, including oversight and verification.

US finds Huawei has backdoor access to mobile networks globally, report says

The backdoors were inserted for law enforcement use into carrier equipment like base stations, antennas and switching gear, the Journal said, with US officials reportedly alleging they were designed to be accessible by Huawei. "We have evidence that Huawei has the capability secretly to access sensitive and personal information in systems it maintains and sells around the world," Robert O'Brien, national security adviser, reportedly said. O'Brien also called less-expensive Chinese solutions "tempting of a gift to turn down" for some countries, according to CNN, but that they come "with a price" of the Chinese company having access to information on the network. Huawei denied the reports, saying it's the US government that's been "covertly accessing telecom networks worldwide, spying on other countries." "US allegations of Huawei using lawful interception are nothing but a smokescreen," Huawei said in an emailed statement Wednesday. "Huawei has never and will never covertly access telecom networks, nor do we have the capability to do so."

Spearheading the defence against a cyber attack requires c-suite buy-in

Cyber security and data security risks have climbed to the top of UK plcs’ boardroom agenda to become a top five issue following recent high profile cyber attacks, such as the ransomware attack on Travelex. This shift is largely because the business consequences of such an event can be catastrophic — loss of revenue and major disruption, plus steep fines due to GDPR, damage to reputation and a hit on the share price. Depending on the severity of the breach it is possible that jobs, including those of the CEO and CISO, could be put at risk. The c-suite must live up to its responsibility for protecting the business by taking whatever action is necessary to prevent it suffering from an attack. But what form should this action take? The C-suite needs to ensure the right cyber security policies and procedures are in place, as well as a response plan should the worst happen.

2020 And The Dawn Of AI Learning At The Edge

One of the biggest challenges when it comes to the implementation of AI today is its inflexibility and lack of adaptability. AI algorithms can be trained on huge amounts of data, when available, and can be fairly robust if all data is captured for their training beforehand. But unfortunately, this is not how the world works. We humans are so adaptable because our brains have figured out that lifelong learning (learning every day) is key, and we can’t rely solely on the data we are born with. That’s why we do not stop learning after our first birthday: We continuously adapt to changing environments and scenarios we encounter throughout our lives and learn from them. As humans, we do not discard data, we use it constantly to fine-tune our own AI. Humans are a primary example of edge learning-enabled machines. In fact, if human brains acted in the same way as a DNN, our knowledge would be restricted to our college years. We would go about our 9-to-5s and daily routines only to wake up the next morning without having learned anything new. Traditional DNNs are the dominant paradigm in today’s AI, with fixed models that need to be trained before deployment.

Ericsson's eSIM technology - fully dynamic and automatic provisioning of eSIMs

Ericsson’s eSIM solution is comprised of Ericsson Secure Entitlement Server (SES) and Ericsson eSIM manager (GSMA certified SM-DP+) serving the onboarding of eSIM consumer devices. The solution provides a fully automated end-to-end device and subscription orchestration procedure managing the device detection, user authorization for onboarding the eSIM device, creation of user and subscription profile, provisioning handling of both eSIM device and network elements as well as updating the Service Provider’s back office system as relevant. It contributes with simplified user experience process for end users and, at the same time for the Service Provider, saving operational expenses for handling eSIM devices over their life cycle management. Ericsson’s eSIM solution will give the Service Provider the opportunity to launch many attractive services for a wide range of eSIM devices. Users can instantly enable new services on their new eSIM device with minimum efforts. The need to pre provision, create batch processes or use middleware solutions for eSIM profiles, is removed.

How Can We Fix Biased AI?

“There seem to be countless stories of ways that bias in AI is manifesting itself, and there are many thought pieces out there on what contributes to this bias,” says Fay Payton, a professor of information systems/technology and University Faculty Scholar at NC State. “Our goal here was to put forward guidelines that can be used to develop workable solutions to algorithm bias against women, African American and Latinx professions in the IT workforce. “Too many existing hiring algorithms incorporate de facto identity markers that exclude qualified candidates because of their gender, race, ethnicity, age and so on,” says Payton, who is co-lead author of a paper on the work. “We are simply looking for equity – that job candidates be able to participate in the hiring process on an equal footing.” Payton and her collaborators argue that an approach called feminist design thinking could serve as a valuable framework for developing software that reduces algorithmic bias in a meaningful way. In this context, the application of feminist design thinking would mean incorporating the idea of equity into the design of the algorithm itself.

Is AI cybersecurity’s salvation or its greatest threat?

Security experts predict that 2020 could be the year hackers really begin to unleash attacks that leverage AI and machine learning. “The bad [actors] are really, really smart,” said Burg of EY Americas. “And there are a lot of powerful AI algorithms that happen to be open source. And they can be used for good, and they can also be used for bad. And this is one of the reasons why I think this space is going to get increasingly dangerous. Incredibly powerful tools are being used to basically do the inverse of what the defenders [are] trying to do on the offensive side.” In an experiment back in 2016, cybersecurity company ZeroFox created an AI algorithm called SNAPR that was capable of posting 6.75 spear phishing tweets per minute that reached 800 people. Of those, 275 recipients clicked on the malicious link in the tweet. These results far outstripped the performance of a human, who could generate only 1.075 tweets per minute, reaching only 125 people and convincing just 49 individuals to click.

Emotet evolving to exploit coronavirus fear

“One of the main abilities of Emotet is that it stays topical, and we will see campaigns similar to those leveraging fear of the coronavirus throughout the year. As the US enters tax season, for example, Emotet is gearing up to offer the public help to file the forms on their behalf. “The email messages will not be sophisticated and can contain a link to download infected files or will have an attachment of a fake W9 form. We can anticipate that malware campaigns related to tax season will continue towards the filling date in April.” The best way for users to protect themselves against threats exploiting the coronavirus is to trust only official government or health service guidance, or legitimate news services. In IT terms, standard guidance to use antivirus programs with automatic updates, to download and apply patches and software updates, and to not open suspicious or unsolicited emails, applies.

Machine Learning in the cloud vs on-premises

The hyper cloud providers (AWS, Azure, GCP) are able to offer a smaller total cost of ownership while delivering superior features from scalability to security. It doesn’t make financial sense to build everything in-house when you can get it off the shelf for only the time you need it. The cloud vendors are constantly innovating with solutions such as servers that only cost for the time they are used, as opposed to the time they are up and waiting for requests. They are also able to attract talent specialized in e.g. scalability and security in ways that would be impossible for every other vendor on their own. ... Most machine learning experimentation starts from understanding your data on your laptop and doesn’t require that much computation power. But very quickly you will run into the need more than your local CPU can provide you with. The cloud is by far the more scalable place to do machine learning. You’ll get access to the latest GPUs or, even TPUs that you wouldn’t be able to afford and maintain on your own.

Your phone talks about you behind your back. These researchers are listening in

By taking a look under the hood, they've found that many apps are sending data that goes beyond what people agree to under privacy policies and permissions requests. "In the end, you're left with a policy that's essentially meaningless because it doesn't describe what's accurately happening," said Serge Egelman, director of usable security and privacy research at the International Computer Science Institute. "The only way to answer that question is going in and seeing what the app is doing with that data." Sometimes, the data is just headed to advertisers, who think they can use it to sell you products. Phone location data can be a gold mine for advertisers, who tap it to figure out where people are at certain times. But it may also be going to government agencies that leverage the technology to surveil people using data collected by apps that never disclosed what they were doing. Recently, The Wall Street Journal reported that government agencies were using such data to track immigrants. These researchers are shining a light on a hidden world of data tracking, and raising concerns about how much information people are giving away without knowing it.

---

Quote for the day:

"The most important quality in a leader is that of being acknowledged as such." -- Andre Maurois

---

Daily Tech Digest - February 12, 2020

What is data governance? A best practices framework for managing data assets

Data governance is just one part of the overall discipline of data management, though an important one. Whereas data governance is about the roles, responsibilities, and processes for ensuring accountability for and ownership of data assets, DAMA defines data management as "an overarching term that describes the processes used to plan, specify, enable, create, acquire, maintain, use, archive, retrieve, control, and purge data. While data management has become a common term for the discipline, it is sometimes referred to as data resource management or enterprise information management. Gartner describes EIM as "an integrative discipline for structuring, describing, and governing information assets across organizational and technical boundaries to improve efficiency, promote transparency, and enable business insight." Data governance may best be thought of as a function that supports an organization’s overarching data management strategy. A data governance framework provides your organization with a holistic approach to collecting, managing, securing, and storing data.

Average tenure of a CISO is just 26 months due to high stress and burnout

Today, CISO jobs come with low budgets, long working hours, a lack of power on executive boards, a diminishing pool of trained professionals they can hire, but also a constant stress of not having done enough to secure the company's infrastructure against cyber-attacks, continuous pressure due to newly arising threats, and little thanks for the good work done, but all the blame if everything goes wrong. Across the years, many CISOs have often pointed out the problems with their jobs and the stress and damage they inflict. However, there has been no conclusive study to support broad assertations. ... The Nominet study only surveyed high-ranking CISO executive jobs, but the problem is widespread across the industry. Infosec -- or cyber-security -- has a habit of grinding through employees due to the rigors of the job. Low-level infosec positions, like threat analyst or penetration tester, are just as bad in terms of stress level, if not worse, primarily for the same reasons -- constant fear of new incoming attacks, long-working hours, low pay, almost no job satisfaction.

How do I build a cloud-ready network?

Enterprises that decide to move processing to a cloud provider must prepare their networks for the migration. That will almost certainly mean upgrading WAN links, but enterprises shouldn't start talking to internet service providers until they've performed a careful analysis of the applications they plan to move. Here are some considerations enterprises should evaluate when preparing a cloud-ready network: Are you planning to move an interactive application to the cloud or begin using a SaaS platform? Are you simply eliminating the need to maintain the resources for end-of-month processing or application testing? Are you currently operating an in-house private cloud but plan to move some of the processing to a public cloud to create a hybrid cloud? Look carefully at what network resources each type of application requires. Interactive applications typically don't move a great deal of data across the network.

Half of cybercrime losses in 2019 were the result of BEC scams

For comparison, BEC/EAC-associated losses were $1.3 billion in 2018, $676 million in 2017 and $360 million in 2016 (with a $30,000 average monetary loss per complaint). The IC3 also observed an increase in the number of BEC/EAC complaints related to the diversion of payroll funds. Some victims can get their money back, though: IC3’s Recovery Asset Team (RAT), which was established to streamline communication with financial institutions and assist FBI field offices, gets involved if the victims made transfers to domestic accounts under fraudulent pretenses. In 2019, they recovered $305 million of the $384 million lost in 1,307 such incidents, by reacting quickly and requesting banks to freeze the accounts involved. In some cases, they even managed to identify the scammer. “In February 2019, the IC3 RAT received a complaint involving a BEC incident for $138,000, where the victim received a spoofed email and wired funds to a fraudulent bank account in Florida. The RAT took quick action and worked with key financial partners to freeze the funds,” the IC3 shared.

Presidential campaigns taking email security more seriously--not so much at the local level

While the picture for email security at the presidential campaign level appears to be improving, at the local level, email security seems to be overlooked: 142 of 187 domains used by election officials in the three largest counties (or parishes) in every state don't use DMARC at all. Of the remaining jurisdictions, 42 use monitor-mode only, and 11 use invalid DMARC, leaving only 5.3% of those local domains protected by DMARC, Valimail's research shows. At the local level, "it appears to be awareness more than anything else," that is a problem with adopting DMARC and other secure email technologies, Blank says. "There is an enormous amount of technology that exists [but local officials] don't even know where to start and that there are tools that can help." Organizations such as the Messaging, Malware and Mobile Anti-Abuse Working Group (M3AAWG) stand ready to help campaign officials learn what the best technologies are and how to deploy them. Last week the group issued summary guidance for what it calls "essential cybersecurity" for election officials. The three key technologies the M3AAWG advises campaigns to use are multi-factor authentication (MFA), email authentication and encryption.

Cybersecurity Jobs Going Begging As College Computer Science Grads Lack Skills

Many of the half-million cybersecurity job openings are going begging because college computer science graduates often lack the needed skills and hands-on experience, House Research and Technology Chair Haley Stevens (D-MI) asserted today. She added the nation’s education system is further exacerbating the problem because few high school students have any exposure to computer science in the classroom, let alone cybersecurity. Another reason for the cybersecurity workforce abyss Stevens pointed to is a lack of women in the profession. “The cybersecurity field as a whole lacks diversity, even more so than many other STEM fields. The math is simple: Last year, women accounted for only 20 percent of the global cybersecurity workforce,” she noted. Aggrieved women of color in cybersecurity jobs make on average $10,000 less than their male counterparts, Congressman Stevens contended: “We cannot address our current and future cybersecurity workforce needs without recruiting and retaining more women and minorities into the field.”

The tech IT professionals love: 5G, cloud management, Graph API

The biggest appeal? Increased speed. 5G networks have potential download speeds of 20Gbps, which is not only faster than 4G but faster than cable internet connections, according to Josh Fruhlinger in What is 5G? How is it better than 4G? Plus, 5G significantly reduces network latency, which is critical for Internet of Things uses such as telemedicine and autonomous vehicles that require fast transmissions. “5G is looking extremely promising: better coverage, less energy consumption, low latency, high data rates. This is a game-changer that will take us to new levels,” said Scott Schober, CEO of Berkeley Varitronics Systems, during the Twitter chat. “We are working with a lot of the carriers and teams actively testing, and they are making some great progress. There is enough money and marketing behind this, so they have to make it happen sooner than later.” 5G installations are starting to appear, such as Whirlpool’s private 5G network, provided by AT&T for its fleet of driverless vehicles. The company is in the process of rolling out the 5G network across the plant, and hopes to make 80% of its 100 vehicles driverless.

Cloud computing security: These two Microsoft tools can help you battle shadow IT

You get more control by analysing and controlling cloud app usage on the device directly. Microsoft Cloud App Security (MCAS, a Cloud Application Service Broker, which is itself a cloud service) now includes a shadow IT discovery tool that integrates with Defender ATP to discover cloud app and service usage on any managed device. Defender already monitors what processes are running and what files are being opened as it checks for malware, and that same information lets it report back on what cloud services are being used. It's an automated process that creates a catalog of cloud apps that are in use, by which users and on which devices, with security and compliance risk scores for each app. But because MCAS is integrated with Defender, you get the option to block and whitelist apps directly on the device. That works for all devices, not just the ones on the corporate network -- and it even lets you enforce read-only access to your corporate resources for external users like suppliers and partners. Defender ATP can look at the labels you apply with Azure Information Protection, so you can tell when data tagged as sensitive or confidential is being sent to a cloud service -- in real time, or later on, even if that device is no longer connected for you to scan or available for you to look at physically.

What are the newest cyber attacks to look out for?

Swarm technology refers to decentralised systems that use automation such as AI to operate without the need for human intervention. Named after the term that defines a group of insects and acting in a similar manner, although swarm tech has been known to have the potential to benefit society, some experts are wary of its possible cyber attacking capabilities as well. Derek Manky, chief of security insights & global threat alliances at Fortinet, explained: “Over the past few years, the rise of swarm technology, which can leverage things like machine learning and AI to attack networks and devices has shown new potential. “Advances in swarm technology have powerful implications in the fields of medicine, transportation, engineering, and automated problem solving. However, if used maliciously, it may also be a game changer for adversaries if organisations do not update their security strategies. “When used by cyber criminals, bot swarms could be used to infiltrate a network, overwhelm internal defences, and efficiently find and extract data.

Police use of facial recognition ‘unjustifiable’, says Scottish Justice Committee

“The sub-committee believes that there would be no justifiable basis for Police Scotland to invest in technology which is known to have in-built racial and gender bias, and unacceptably high levels of inaccuracy,” said the report. It said the committee had not received sufficient evidence to justify the introduction of LFR technology, or that it is even possible to use the technology in a “proportionate” way. “Its use on people who attend legitimate and legal pursuits, such as peaceful protests, concerts or sporting events, is not necessary or proportionate,” the report said. Although Police Scotland does not currently use LFR, plans to introduce it were included in its 10-year Policing 2026 strategy, which the committee said must be reviewed and updated if the police still plan to deploy the technology. “The Scottish Police Authority must ensure that comprehensive human rights, equalities, community impact, data protection and security assessments are carried out,” it said, adding these must all be made publicly available.

---

Quote for the day:

"Leadership is a matter of having people look at you and gain confidence, seeing how you react. If you're in control, they're in control." -- Tom Laundry

---

Daily Tech Digest - February 11, 2020

Cybersecurity in 2020: From secure code to defense in depth

Pity the poor CSO in the hotseat. Understandably, some feel compelled to jump on every new threat with a point solution, which plays right into the security software industry’s marketing strategy. But no organization’s cybersecurity budget is infinite. How can CSOs possibly determine how to allocate their defensive resources most effectively? The simple answer is twofold: Rationally prioritize risk and, at the same time, make the most of the useful defenses you already have in place. Few dispute that unpatched software and social engineering (including phishing) represent the highest risk in most organizations, followed by password cracking and software misconfiguration. Cut through political and operational barriers to ensuring prompt patching, establish an effective security awareness program, train your ops folks to lock down configurations, and put two-factor authentication in place…and you’ll reduce your overall risk by a magnitude. Sure, anyone can reel off other big risks and vulnerabilities. If you’re operating an electric utility, for example, you need to understand highly targeted threats to critical infrastructure and how to defend against them.

Developers Can Now Get Their Google Glass Enterprise 2

When Google launched Google Glass to both consumers and developers in 2013, it raised a number of harsh critiques, mostly due to it opening a large can of privacy concerns. This led the company to discontinue the product in 2015, only to relaunch it in 2017 with a focus on specialized enterprise applications. Since then, as Google explains, Google Glass Enterprise Edition 2 has seen adoption in logistics, manufacturing, healthcare, and other industries where the availability of an AR display projecting useful information while leaving the hands free to carry through one's duty is key. This state of things is echoed by Facebook Reality Labs lead Michael Abrash, who recently stated that mass AR adoption through devices such as Google Glass will take still five to ten years. Abrash identifies a number of technical hurdles that need to be overcome before glass-based AR technology can become successful in the consumer arena, with the top one being user interaction: There is no way that the way we’re going to interact with AR is going to be the way that we interact with our devices today. You’re not going to take out your phone every time you want to do something.

Biden comments reignite debate over Section 230 rule protecting online platforms

Biden and other Democratic Senators have expressed concerns about the increase in hate speech and the flood of unchecked disinformation making their way onto these digital platforms, while Republicans want tech companies to be restricted from moderating any speech for fear that it would curb conservative content. Each side has put forth a number of proposals but none have gained any traction, and while there may be minor changes to the rule in the future concerning specific topics like sex trafficking, it is more likely Section 230 will be here to stay. One of the most contentious aspects of the debate over the rule concerns corporations and the differing business reasons companies either want Section 230 removed or want it reinforced.  "The fight being put up by large, established, and long venerable companies like Disney, Marriott, and IBM to deflate Section 230 and remove or at least significantly diminish the protections it provides is quite multifaceted and driven by each company's individual motives," Tomaschek said. "Ultimately, however, what their individual grievances against 230 all seem to show is that the fight is essentially between old, hulking companies that have failed to adapt to the rapidly changing landscape and relatively new-on-the-scene Big Tech giants that were able to offer innovative services that consumers were quick and eager to adopt."

Cybersecurity's Perception Problem

Zero trust is based on static, concrete barriers that both disrupt operations and fail to actually stop any level of intelligent compromise. The core of zero trust is to set up barriers between otherwise connected systems in order to provide protection. For operations, employees go from connected control to being forced to log into multiple locations to get their jobs done. From a security perspective, once inside a walled garden, everything is trusted. Thus, our average Joe has a great conversation with the guard, walks into the bank and robs it — and nobody is ever alerted. Intelligent trust, on the other hand, interviews our buddy Joe and then lets him know what he can and cannot do. The second Joe tries to do something bad, he is stopped before he can actually perpetrate any crime. Many people in the zero trust world are looking to increase the dynamic components of zero trust frameworks through options such as microsegmentation, but again, perimeter protection just does not work. In order to effectively monitor the behavior of an enterprise, that enterprise has to be broken down into its fundamental behaviors at the level of each device.

Resilience is a skill that’s just as important as tech know-how

Even the need to learn new skills might be challenging, in that it will require people to agree to and participate in the training process, adding to the cognitive load that is already part of their job. Then, once workers have been retrained, they will face a new environment. They could be employed in different roles with no clear career trajectory. Those who move from being employed to being contingent workers may have to manage their own long-term goals. And, most daunting of all, no one knows how long this period of economic transition will last. We don’t know whether employees who make one transition will be “done,” or whether retraining and role changes will remain a continuous process. ... Governments also have a role to play in elevating resilience and could choose to incentivize or mandate action by employers. They can also prepare the next generation of workers by building these resilience skills into school curricula at all levels. Success will inevitably require a combination of all stakeholders — business, government, and individuals — driving change.

The 25 most impersonated brands in phishing attacks

Microsoft remained the primary corporate target in Q4, coming in at #3 on this quarter’s Phishers’ Favorites list. With 200 million active business users and counting, Office 365 continues to be the primary driver for Microsoft phishing. Cybercriminals seek O365 credentials in order to access sensitive corporate information and use compromised accounts to launch targeted spear phishing attacks on other employees or partners. In Q4, large volumes of file-sharing phishing were still seen, including fake OneDrive/SharePoint notifications leading directly to a phishing page and legitimate notifications leading to files containing phishing URLs. There’s also the emergence of note phishing impersonating services like OneNote and Evernote. While the campaigns are similar, the key difference is that OneNote or Evernote notes are not files, but rather HTML pages. Thus, the same technology that is used by email security vendors to scan the contents of files doesn’t work with HTML pages, which means these emails have a higher likelihood of reaching users’ inboxes.

Who should lead the push for IoT security?

“The challenge of this market is that it’s moving so fast that no regulation is going to be able to keep pace with the devices that are being connected,” said Forrester vice president and research director Merritt Maxim. “Regulations that are definitive are easy to enforce and helpful, but they’ll quickly become outdated.” The latest such effort by a governmental body is a proposed regulation in the U.K. that would impose three major mandates on IoT device manufacturers that would address key security concerns: device passwords would have to be unique, and resetting them to factory defaults would be prohibited; device makers would have to offer a public point of contact for the disclosure of vulnerabilities; and device makers would have to “explicitly state the minimum length of time for which the device will receive security updates” This proposal is patterned after a California law that took effect last month. Both sets of rules would likely have a global impact on the manufacture of IoT devices, even though they’re being imposed on limited jurisdictions. That’s because it’s expensive for device makers to create separate versions of their products.

Jenkins Creator Launches ML Startup in Continuous Risk-Based Testing

Launchable is currently inviting applications to join its public beta. According to the Launchable website, their solution can identify the surface of tests which provide sufficient confidence, based on the specific risks of changes made in the software.The site states that this is made possible by machine learning engine that predicts the likelihood of a failure for each test case given a change in the source code. This allows you to run only the meaningful subset of tests, in the order that minimizes the feedback delay. In his blog, Kawaguchi explained this further and wrote about a hypothetical scenario, where he asked the reader to consider a long running test suite. He proposed that the time to feedback could be greatly reduced if machine learning could be used to "choose the right 10% of the tests that give you 80% confidence." Ariola described successful continuous testing as an activity which is targeted at "business risk," rather than requirements verification alone. He provided examples of how increasing levels of business agility and automation allowed companies to create a range of "competitive differentiators" in their products.

Why the Fed is considering a cash-backed cryptocurrency

By creating a digital coin tied to the U.S. dollar and its owner through cryptographic hash keys, consumers and businesses alike would be able to track a token they own on an immutable electronic ledger, and possibly even retrieve it if an error is made after a transfer. In turn, government agencies could trace tokens, and ensure banks are complying with know-your-customer and anti-money laundering laws. “In the US…, you have a bank account and so much money according to bank's ledger. [You] can’t say that’s my dollar,” Kornfeld said. “I think maybe they’re looking now and saying that we’ve thought about it more and there are things we could do that may make sense and maybe we should formally tokenize U.S. currency. I think this is in the early stages.” More than 80% of central banks say they're engaged in some type of central bank digital currency (CBDC) effort, according to Bank for International Settlements survey of 66 central banks. “The latest survey suggests there is greater openness to issuing a CBDC than a year ago, and a few central banks report that they are moving forward with issuing a CBDC,” Brainard said.

AI in public service must be accountable

Bill Mitchell, director of policy at BCS, the Chartered Institute for IT, added: “There is a very old adage in computer science that sums up many of the concerns around AI-enabled public services: ‘Garbage in, garbage out.’ In other words, if you put poor, partial, flawed data into a computer, it will mindlessly follow its programming and output poor, partial, flawed computations. “AI is a statistical-inference technology that learns by example. This means that if we allow AI systems to learn from ‘garbage’ examples, we will end up with a statistical-inference model that is really good at producing ‘garbage’ inferences.” Mitchell said the report highlighted the importance of having diverse teams that would help to make public authorities more likely to identify any potential ethical pitfalls of an AI project. “Many contributors emphasised the importance of diversity, telling the committee that diverse teams would lead to more diverse thought, and that, in turn, this would help public authorities to identify any potential adverse impact of an AI system,” he said.

---

Quote for the day:

"We are reluctant to let go of the belief that if I am to care for something I must control it." -- Peter Block

---

Daily Tech Digest - February 09, 2020

Ransomware attacks are now targeting industrial control systems

Researchers found Ekans contains a list of commands and processes associated with a number of industrial control system-specific functionalities aimed at stopping these functions in a ransomware attack. While this functionality is described as limited, researchers' analysis of Ekans notes that it still represents "a deeply concerning evolution in ICS-targeting malware" because it indicates that cyber criminals are now targeting ICS operation systems purely for financial gain. Files encrypted are renamed with a random five character file extension, while victims are presented with a ransom note with an email address to contact to negotiate a ransom to be paid in cryptocurrency. In order to deploy the ransomware, the attackers behind Ekans likely need to compromise the network before executing the attack. This follows the same trend as ransomware variants like Ryuk and Megacortex, which rely on a hands-on method of deployment rather than the self-propagation followed by other forms of ransomware. The way in which Ekans is designed to target ICS operations indicates that the attackers very much have a specific target in mind, so are likely to take their time to compromise targets relevant to their plans.

Security Predicted by Gartner to Improve in DevOps Teams

One tool on Gartner’s roadmap is IAST, or "Interactive Application Security Testing". IAST helps teams understand and address security during development and testing, in a manner similar to how Application Performance Management tools helped teams understand performance. Instead of sending code to a specialized performance team to evaluate isolated tests in a lab, APM tools such as New Relic, Dynatrace, and AppDynamics used instrumentation to continuously monitor what happened in an application without requiring code changes. As a result, teams could monitor their own data without requiring dedicated study in the field of performance engineering. With tools such as IAST, teams can leverage tools to find security defects without requiring dedicated study in security risk. As a result, these newer DevOps tools can locate security defects by identifying interesting occurrences, such as: when user input reaches an SQL command without validation, where an XML parser is configured to provide local files to external users, and many other types of risk.

Why private micro-networks could be the future of how we connect

The current social-media model isn’t quite right for family sharing. Different generations tend to congregate in different places: Facebook is Boomer paradise, Instagram appeals to Millennials, TikTok is GenZ central. Updating family about a vacation across platforms—via Instagram stories or on Facebook, for example—might not always be appropriate. Do you really want your cubicle pal, your acquaintance from book club, and your high school frenemy to be looped in as well? “Social media treats everyone—a friend, a family member, an acquaintance—the same,” says Courtney Walsh, a lecturer in human development and family sciences at the University of Texas who consulted for Cocoon. “I would argue that what we are doing is impersonal on social media.” Cocoon aims to change the way we share. It launched on Thanksgiving, with more than 10,000 users signing up from 163 countries that week, according to Monga. Everything you post stays within the group. The app is its own small world: a feed is the home screen, greeting users with updates since they last signed on; messaging capabilities include threads to help corral conversations.

Add a Turbocharged Data Grid to Your Angular Application

Developers of enterprise web applications that need to display data in grids are faced with a dilemma. Do you use plain HTML tables, which are simple and easy to build, but tired and featureless (especially since you know users will compare them to Google Sheets)? Or do you try again to find that elusive, free, open-source (but reliable) datagrid tool that will give you the performance, features, and support you need? Oh, and page bloat is always an issue... Enter Wijmo FlexGrid, a mature, fully supported data grid. It’s now over five years old and, at version 5, it’s feature-rich, incredibly fast, and has a tiny code footprint. FlexGrid features an Angular wrapper that simplifies the work required to create the Angular components you need, with support for all versions from Angular 2 through Angular 9. We will use Angular 8 in this tutorial. To see how easy it is to use Wijmo FlexGrid tables in an Angular 8 application, we’ll start with a simple Angular component containing a data-bound HTML table. Once the basic version works, we’ll alter the code and switch to Wijmo FlexGrid.

How to prioritize IT security projects

The state of IT security has never been more precarious. Advanced Persistent Threats (APTs), often state-sponsored, can embed themselves in a security environment, move laterally, and steal an organization’s critical assets without being detected for months. Cloud migration – and the challenges of handling on prem/cloud risks in an integrated manner – has created new attack paths while greatly increasing the demands placed on modern organizational security teams. These developments exacerbate the already tough mandate for IT security pros: they must be right every time, and the attackers need only be successful once. This doesn’t mean that hackers can operate with an entirely free hand; they, too, must pick and prioritize their spots. If your security is robust enough relative to other targets, attackers may judge it to be more trouble than it is worth, especially when there are so many other lightly guarded networks, devices, etc. Automation is the critical weapon in this game of attack and defend, as it allows attackers to maximize their resources and probe for the most vulnerable targets at scale. For defenders, automation plays an equally essential role.

Success follows Indiana Tech cybersecurity team

Darryl Togashi, director of Indiana Tech's cybersecurity program, was hired in June to beef up the university's offerings to increase lab space and align classes with current industry requirements. As cyber-threats evolve, professional training must adapt, he said. His vision includes creating more hands-on opportunities for students to gain practical experience. Togashi's focus includes securing a CAE-CDE – of Center of Academic Excellence in Cyber Defense Education – designation from the National Security Agency and the Department of Homeland Security. Results of the review should be available in March or April, he said. If Indiana Tech doesn't receive the prestigious designation, it will get feedback on what deficiencies were found and allowed to correct them and reapply, Togashi said. Within a year to two, university officials hope to offer working IT professionals opportunities to receive training in specific cybersecurity skills or topics. Voting machine security issues might be a focus of one, for example. Togashi is also charged with sponsoring and participating in events that introduce middle and high school students to cybersecurity at a level they can understand.

Google releases TyDi QA, a data set that aims to capture the uniqueness of languages

Whether we’re aware of it or not, AI and cybersecurity technology are nearly omnipresent in our daily lives, and they’re only gaining importance as our world becomes more connected, “intelligent,” and reliant on online or automated systems. Yet both can seem intractably technical, even to tech-savvy people, with an ominous gravity that multiplies at the intersection of their Venn diagrams. The easy metaphor is that cybersecurity is an escalating arms race between good actors and bad actors, while the advent of AI is proverbial nuclear warfare. Some of that’s true, but the reality is far more illuminating, nuanced, and accessible. Huge cybersecurity threats can be amplified by AI technologies, so cybersecurity experts need to employ AI to protect us — and they are. In this issue, we’ll discuss how some threats are more sophisticated than ever, but most are not. We’ll learn that even as attack and defense systems are supercharged by technology, the need for human expertise has become more critical, not less. And we’ll look at practical solutions to some of the most onerous threats, like deepfakes and the increasing presence of AI-powered cameras.

How Twitter Improves Resource Usage with a Deterministic Load Balancing Algorithm

Twitter has been using a client-side load balancing technique for several years with its microservices architecture. They call this technique a "deterministic aperture," and it's part of Finagle's RPC framework, an open-source project for the JVM. Finagle embeds a client-side load balancer in every client. Instead of making calls to a central server-side load balancer, all requests go straight to a destination server, without an intermediary. This reduces the need for an extra infrastructure layer, and also reduces network hops, bandwidth, and points of failure in the system. Client-side load balancing is an approach that other projects like Baker Street and Netflix Ribbon use. And also companies like Yelp, Airbnb, or Stripe use it to run microservices systems. Using client-side load balancers means that now there can be multiple load balancers distributed within clients throughout the system—at least one per client. Therefore, it gets complicated when trying to distribute traffic load to servers in an even manner, especially when there are thousands of servers. For this reason, Finagle's deterministic aperture algorithm combines the P2C approach for distributing traffic load with the combination of a deterministic approach when picking which servers to connect.

This crafty malware makes you retype your passwords so it can steal them

Once running on the compromised Windows system, Metamorfo terminates any running browsers and then prevents any new browser windows from using auto-complete and auto-suggest in data entry fields. This prevents the user from using auto-complete functions to enter usernames, passwords and other information, allowing the malware's keylogger functionality to collect the data the users are thus obliged to retype. It then sends that data back to a command-and-control server run by the attackers. Metamorfo even includes a function that monitors 32 keywords associated with the targeted banks, likely so that the attackers can be alerted in real time as to when a victim is trying to access online services. Researchers haven't revealed the keywords or the names of the financial institutions being targeted, as it's likely the Metamorfo campaign is still active. To help protect against falling victim to attacks using the malware, users should be wary of unexpected emails and attachments, while using an antivirus product can also help detect the malware.

How Enterprise Architecture can reduce risk in Mergers and Acquisitions

A merger involves two or more entities combining in such a way that previously recognized legal entities cease to exist. The merging entities have a shared burden in defining the new or changed business model; changes in their go-to-market strategy; customer journey, etc. This includes the complexity of the risks involved in getting the necessary clearance and support required in clearing a myriad of regulatory hurdles. All of this means risk and resource allocation decisions above and beyond the typical day to day business operations. Merging companies share an interest in articulating organizational structure and behavior from a strategy, operational, regulatory, and financial perspective. For Acquisition, the balance of sharing risk and resource allocation shifts depending on the nature of the purchase. In a friendly acquisition, it could look more like a merger in which parties are sharing some level of risk and resource decisions. Both participating organizations have an interest in representing their companies in the best possible light, but perhaps for different reasons. The acquiring firm wants to ensure they can demonstrate to the market and shareholders they are doing the right thing and will bring increased value.

---

Quote for the day:

"Leadership is particularly necessary to ensure ready acceptance of the unfamiliar and that which is contrary to tradition." -- Cyril Falls

---

Daily Tech Digest - February 08, 2020

Cultural Transformation Is Needed Before Traditional Banks Can Go Digital

Traditional banks and other financial institutions need to go through a cultural transformation before they can successfully undergo a digital transformation, according to the chief technology advocate at Starling Bank, whose statements came during a recent panel discussion. The recent debate, which was an initiative supported by widely-used messaging service Slack, was held on February 6 in London. It covered several 21st century developments including ongoing digital transformation efforts, the future of work and jobs, and how professionals will communicate and work cooperatively on projects. Slack’s panel included commentary from Stuart Templeton, head of Slack’s UK division, Jason Maude, chief technology advocate at Starling Bank, Flora Coleman, head of government relations at TransferWise, ... While speaking about recent digital transformation efforts, Maude noted that he thinks it might be possible for traditional financial institutions to adapt to change, however, it would definitely be challenging for them to do so.

Cybersecurity Priorities Are A Matter Of Perspective

Cybersecurity and compliance are crucial for organizations—but they are also challenging. The threat landscape is constantly growing and shifting, making it difficult to stay one step ahead of attackers and adequately defend networks and data. A survey of cybersecurity professionals at Black Hat USA 2019 in August of last year found that 65% believe their organization will have to respond to at least one major cybersecurity breach in the next year. Addressing cyber threats and compliance mandates is even harder if the effort is not coordinated. The report from Real Time Research Reports, sponsored by Authentic8, examines survey results from 163 senior level compliance, legal, and IT managers from financial services companies or law firms with clients in the financial industry. Among the organizations that took part in the survey, it seems that these three teams each view both the issues of cybersecurity and compliance and how to address them through their own skewed lens. In other words, every problem is a “nail” that only their particular “hammer” can solve.

Ransomware installs Gigabyte driver to kill antivirus products

Gigabyte's fault resides in its unprofessional manner in which it dealt with the vulnerability report for the affected driver. Instead of acknowledging the issue and releasing a patch, Gigabyte claimed its products were not affected. The company's downright refusal to recognize the vulnerability led the researchers who found the bug to publish public details about this bug, along with proof-of-concept code to reproduce the vulnerability. This public proof-of-concept code gave attackers a roadmap to exploiting the Gigabyte driver. When public pressure was put on the company to fix the driver, Gigabyte instead chose to discontinue it, rather than releasing a patch. But even if Gigabyte had released a patch, attackers could have simply used an older and still vulnerable version of the driver. In this case, the driver's signing certificate should have been revoked, so it wouldn't be possible to load the driver's older versions either. "Verisign, whose code signing mechanism was used to digitally sign the driver, has not revoked the signing certificate, so the Authenticode signature remains valid,"

A new money-laundering rule is forcing crypto exchanges to scramble

Critics have argued that the new rule is onerous because it calls on the industry to build a completely new technical infrastructure for sharing information. Because of the pseudonymous nature of cryptocurrency, it’s not necessarily obvious to exchanges, for instance, when a customer is sending money to another exchange. All they can see is a string of letters and numbers, so the sender could just as well be transferring money to another wallet the same person controls. Now exchanges will somehow have to identify themselves. Others have argued that the rule will drive would-be money launderers to use services and tools that are harder to police. Nonetheless, the industry has been left with no choice but to come up with something like the SWIFT network, but for crypto. And they’ve got to come up with something fast; FATF plans to review its progress in June. According to a new, detailed look inside the process by CoinDesk, thorny questions remain about how exactly exchanges should transmit information to each other. Should that process use a blockchain, or rely on a more traditional, centralized design?

White House reportedly aims to double AI research budget to $2B

Simply doubling the budget isn’t a magic bullet to take the lead, if anyone can be said to have it, but deploying AI to new fields is not without cost and an increase in grants and other direct funding will almost certainly enable the technology to be applied more widely. Machine learning has proven to be useful for a huge variety of purposes and for many researchers and labs is a natural next step — but expertise and processing power cost money. It’s not clear how the funds would be disbursed; It’s possible existing programs like federal Small Business Innovation Research awards could be expanded with this topic in mind, or direct funding to research centers like the National Labs could be increased. Research into quantum computing and related fields is likewise costly. Google’s milestone last fall of achieving “quantum superiority,” or so the claim goes, is only the beginning for the science and neither the hardware nor software involved have much in the way of precedents.

Top Tech for Mobile Banking? GPS.

As the banking industry moves toward fully real-time solutions, with millisecond response times and immediate access to funds, precise time becomes vital. As banks continue to pursue modernization of batch-based, memo-post core solutions – which tended to use the server time for transactional timestamps – those date and time stamps, as well as location stamps, become the most important pieces of data the solutions maintain with a transaction. GPS is globally available, can be checked from anywhere, and is free for everyone to use – including banks and their mobile banking solutions. Cell towers use GPS signals to place phone activity; ATMs and cash registers use GPS data for transactions; and stock exchanges use GPS to regulate the trades that go into stock portfolios and investment funds. GPS technology not only identifies positioning; it can be used to ensure systems all over the world agree on the exact time. When you withdraw cash from an ATM or swipe your card or wearable at a store, the underlying systems need to determine (and agree upon) the exact time that the transaction occurs, for example, to prevent accounts from being overdrawn.

Why 2020 Will Be the Year Artificial Intelligence Stops Being Optional for Security

There has always been tension between the need for better security and the need for higher productivity. The most usable systems are not secure, and the most secure systems are often unusable. Striking the right balance between the two is vital, but achieving this balance is becoming more difficult as attack methods grow more aggressive. AI will likely come into your organization through the evolution of basic security practices. For instance, consider the standard security practice of authenticating employee and customer identities. As cybercriminals get better at spoofing users, stealing passwords and so on, organizations will be more incentivized to embrace advanced authentication technologies, such as AI-based facial recognition, gait recognition, voice recognition, keystroke dynamics and other biometrics. The 2019 Verizon Data Breach Investigations Report found that 81 percent of hacking-related breaches involved weak or stolen passwords. To counteract these attacks, sophisticated AI-based tools that enhance authentication can be leveraged.

Academics steal data from air-gapped systems using screen brightness variations

The method relies on making small tweaks to an LCD screen's brightness settings. The tweaks are imperceptible to the human eye, but can be detected and extracted from video feeds using algorithmical methods. This article describes this innovative new method of stealing data, but readers should be aware from the start that this attack is not something that regular users should worry about, and are highly unlikely to ever encounter it. Named BRIGHTNESS, the attack was designed for air-gapped setups -- where computers are kept on a separate network with no internet access. Air-gapped computers are often found in government systems that store top-secret documents or enterprise networks dedicated to storing non-public proprietary information. Creative hackers might find a way to infect these systems -- such as using an infected USB thumb drive that's plugged into these systems -- but getting data out of air-gapped networks is the harder part. This is where a team of academics at the Ben-Gurion University of the Negev in Israel have specialized themselves.

5 Mistakes Startups Make And How To Avoid Them

The most common mistake founders make when starting out is hiring people just like themselves. The danger in this unconscious bias, Weinstein says, is that without people who challenge the founder’s thinking, companies fail to identify new opportunities or to spot risks until it’s too late. The most successful startups hire people who bring a diversity of ideas, backgrounds and (complementary) skillsets, he says. Weinstein also cautions founders against hiring too many people too quickly. “Run lean,” he says. For early-stage technology startups, for example, there tend to be two critical roles: “one person who builds the product and the other who sells it.” ... Startups are notorious for overestimating the demand for their products and not knowing how to bring their big ideas to market. Both de Beco and Weinstein urge B2B startups in particular to document their “paths to profitability,” conducting rigorous analyses that challenge their initial market estimates. That analysis requires a deep understanding of the strengths and weaknesses of competitors and, above all, determining the company’s proprietary advantage in each market segment it’s looking to penetrate.

A new implant for blind people jacks directly into the brain

This was possible thanks to a modified pair of glasses, blacked out and fitted with a tiny camera. The contraption is hooked up to a computer that processes a live video feed, turning it into electronic signals. A cable suspended from the ceiling links the system to a port embedded in the back of Gómez’s skull that is wired to a 100-electrode implant in the visual cortex in the rear of her brain. Using this, Gómez identified ceiling lights, letters, basic shapes printed on paper, and people. She even played a simple Pac-Man–like computer game piped directly into her brain. Four days a week for the duration of the experiment, Gómez was led to a lab by her sighted husband and hooked into the system. Gómez’s first moment of sight, at the end of 2018, was the culmination of decades of research by Eduardo Fernandez, director of neuroengineering at the University of Miguel Hernandez, in Elche, Spain. His goal: to return sight to as many as possible of the 36 million blind people worldwide who wish to see again. Fernandez’s approach is particularly exciting because it bypasses the eye and optical nerves.

---

Quote for the day:

"Before you are a leader, success is all about growing yourself. When you become a leader, success is all about growing others" -- Jack Welch

---