Daily Tech Digest - March 05, 2020

CISO Imperatives in the Age of Digital Transformation

With proliferation of open source, enterprises need to secure not just commercial software, but also invest in securing open source software. Every member in a connected ecosystem from vendors, services providers, practitioners to end consumers, needs to be secure. Any weak link can put the entire ecosystem at risk. Open source usage is increasingly seen in categories like cloud management, security, analytics and storage, which have historically been dominated by proprietary products. Some of the key emerging open source technologies are open source firewall, instantaneous server-less workloads, trustworthy AI, blockchain, quantum computing, etc. Fueled by open methodologies and peer production, employees from enterprises are contributing to open source communities and collaborating better, thus forcing management to rethink their strategies. 5G next generation wireless technology will enable enhanced speed and performance, lower latency and better efficiency. It is expected to be broadly used for IoT communications and videos while controls/automation, fixed wireless access, high-performance edge analytics, and location tracking are the second tier uses for 5G-capable networks.

Verizon: Companies will sacrifice mobile security for profitability, convenience

"For a number of reasons, mobile today is a smaller issue than many others," Zumerle said via email. "Among other factors, the operating system is more hardened, and mobile devices have less access to critical enterprise infrastructure and data." The Verizon report found that 39% of organizations admitted to suffering a security compromise involving a mobile device — up from 33% in the 2019 report and 27% in 2018. Of those that suffered a compromise, 66% said the impact was major and 36% said it had lasting repercussions. Twenty-percent of organizations that suffered a mobile compromise said a rogue or insecure Wi-Fi hotspot was involved. "Although the risks of public Wi-Fi are becoming well known, convenience trumps policy – even common sense — for many users. Some organizations are trying to prevent this by implementing Wi-Fi-specific policies, but inevitably, rules will be broken," Verizon said. According to MobileIron, 7% of protected devices detected a man-in-the-middle (MitM) attack in the past year.

Report: Most IoT transactions are not secure

Zscaler is a bit generous in what it defines as enterprise IoT devices, from devices such as data-collection terminals, digital signage media players, industrial control devices, medical devices, to decidedly non-business devices like digital home assistants, TV set-top boxes, IP cameras, smart home devices, smart TVs, smart watches and even automotive multimedia systems. “What this tells us is that employees inside the office might be checking their nanny cam over the corporate network. Or using their Apple Watch to look at email. Or working from home, connected to the enterprise network, and periodically checking the home security system or accessing media devices,” the company said in its report. Which is typical, to be honest, and let (s)he who is without sin cast the first stone in that regard. What’s troubling is that roughly 83% of IoT-based transactions are happening over plaintext channels, while only 17% are using SSL. The use of plaintext is risky, opening traffic to packet sniffing, eavesdropping, man-in-the-middle attacks and other exploits. And there are a lot of exploits.

Envision The Future To Unlock Business Value

While we were busy applying service packs and working out how to prevent “dumb users” from getting themselves into trouble at work, those same people were beginning to enjoy the spoils of the 21st century. Armed increasingly with high speed domestic and even mobile broadband, as well as a wide range of tactile consumer tech devices, they were gradually starting to enjoy a dizzying array of consumer services that were transforming their daily lives. From building stronger relationships with friends and family through social networking, through to the transformation in their retail and lifestyle habits, for the first time ever, normal, every day people (not just nerds like me and my colleagues) were beginning to enjoy the opportunity of a world where technology is something that lifts our capability, helping us to achieve more in all aspects of our lives. Slowly, the centre of gravity of people’s use of technology shifted from the world of work to their personal lives to the point where, certainly by the end of the last decade, most people had access to better technology in their domestic lives than they did at work.

5 big microservices pitfalls to avoid during migration

Rushing into microservices adoption is one of the most common mistakes software teams make. Even though microservices provide a chance to deploy new applications and updates quickly, the distributed architecture's inherent complexity means it's not ideal for certain types of organizations or applications. Teams should review the state of their existing development culture to see if management skills are in place. They should also examine existing applications to determine whether they are suitable and ready for a migration to microservices. Agile and DevOps principles should be in place, as microservices tend not to play well with a Waterfall development approach. Teams also need diligent training and access to documentation before they begin a migration of monolith-based workloads. Performance issues soon arise when a microservices migration starts without a proper plan and appropriate infrastructure investments in place. Teams can mitigate these issues if they ensure services are strictly independent from each other but can still communicate normally, as is the target for a loosely coupled architecture.

AI, Azure and the future of healthcare with Dr. Peter Lee

What’s interesting about AI for Health is that it’s the first pillar in the AI for Good program that actually overlaps with a business at Microsoft and that’s Microsoft Healthcare. One way that I think about it is, it’s an outlet for researchers to think about, what could AI do to advance medicine? When you talk to a lot of researchers in computer science departments, or across Microsoft research labs, increasingly you’ll see more and more of them getting interested in healthcare and medicine and the first things that they tend to think about, if they’re new to the field, are diagnostic and therapeutic applications. Can we come up with something that will detect ovarian cancer earlier? Can we come up with new imaging techniques that will help radiologists do a better job? Those sorts of diagnostic and therapeutic applications, I think, are incredibly important for the world, but they are not Microsoft businesses. So the AI for Health program can provide an outlet for those types of research passions. And then there are also, as a secondary element, four billion people on this planet today that have no reasonable access to healthcare.

Why Unsupervised Machine Learning is the Future of Cybersecurity

There are two types of Unsupervised Learning: discriminative models and generative models. Discriminative models are only capable of telling you, if you give it X then the consequence is Y. Whereas the generative model can tell you the total probability that you’re going to see X and Y at the same time. So the difference is as follows: the discriminative model assigns labels to inputs, and has no predictive capability. If you gave it a different X that it has never seen before it can’t tell what the Y is going to be because it simply hasn’t learned that. With generative models, once you set it up and find the baseline you can give it any input and ask it for an answer. Thus, it has predictive ability – for example it can generate a possible network behavior that has never been seen before. So let’s say some person sends a 30 megabyte file at noon, what is the probability that he would do that? If you asked a discriminative model whether this is normal, it would check to see if the person had ever sent such a file at noon before… but only specifically at noon. Whereas a generative model would look at the context of the situation and check if they had ever sent a file like that at 11:59 a.m. and 12:30 p.m. too, and base its conclusions off of surrounding circumstances in order to be more accurate with its predictions.

Advanced Tech Needs More Ethical Consideration & Security

The recent confrontation between the US and Iran is a case in point. Threats of cyber warfare along with conventional military action put security executives at every major organization on high alert and questioning what to do in the event of a breach. There are worries of vulnerabilities to the infrastructure and that attackers could be impossible to identify. Very few organizations are fully prepared to respond to an incident at an enterprise or organizational level. An effective response to a major cyber incident requires current, effective IT-focused cyber plans, but also participation from all lines of business and operational support areas to ensure a successful integrated, orchestrated recovery. The benefits of advanced technologies to industry and commerce are manifold. In healthcare, robotic surgeries improve recovery rates and reduce days spent in the hospital. AI and machine learning boost productivity in the data-dependent financial services industry, increasing analytical efficiency while reducing manual work and human errors. The same goes for most industries. 

Who should lead the push for IoT security?

IoT-specific regulations aren’t the only ones that can have an impact on the marketplace. Depending on the type of information a given device handles, it could be subject to the growing list of data-privacy laws being implemented around the world, most notably Europe’s General Data Protection Regulation, as well as industry-specific regulations in the U.S. and elsewhere. The U.S. Food and Drug Administration, noted Maxim, has been particularly active in trying to address device-security flaws. For example, last year it issued security warnings about 11 vulnerabilities that could compromise medical IoT devices that had been discovered by IoT security vendor Armis. In other cases it issued fines against healthcare providers. But there’s a broader issue with devising definitive regulation for IoT devices in general, as opposed to prescriptive ones that simply urge manufacturers to adopt best practices, he said. Particular companies might have integrated security frameworks covering their vertically integrated products – such as an industrial IoT company providing security across factory floor sensors – but that kind of security is incomplete in the multi-vendor world of IoT.

Intel CSME bug is worse than previously thought

At the time, the CVE-2019-0090 vulnerability was only described as a firmware bug that allowed an attacker with physical access to the CPU to escalate privileges and execute code from within the CSME. Other Intel technologies, like Intel TXE (Trusted Execution Engine) and SPS (Server Platform Services), were also listed as impacted. But in new research published today, Ermolov says the bug can be exploited to recover the Chipset Key, which is the root cryptographic key that can grant an attacker access to everything on a device. Furthermore, Ermolov says that this bug can also be exploited via "local access" -- by malware on a device, and not necessarily by having physical access to a system. The malware will need to have OS-level (root privileges) or BIOS-level code execution access, but this type of malware has been seen before and is likely not a hurdle for determined and skilled attackers that are smart enough to know to target the CSME.

---

Quote for the day:

"The problem with being a leader is that you're never sure if you're being followed or chased." -- Claire A. Murray

---

Daily Tech Digest - March 04, 2020

A Cyber View Of Smart Cities

No single cybersecurity solution on the market today provides automated remediation, and while options such as SOAR attempt to orchestrate responses, the reality is that most are simple isolation and reactive patching routines. While cyber vendors tout machine learning and AI systems, those efforts are focused on cleaning out noise from incoming information and attempting to find anomalies. None provides any level of remediation that does not require a human to directly run that effort. Not only are these cybersecurity tools not providing automated remediation, but they are also architected in such a way that they disrupt when they make changes and are unable to move into a full remediation capability down the road. For modern cybersecurity, smart cities are a zero-sum game that will never reach the levels of protection that will be required. The final insult is the future wherein AI, already much faster than humans, will be used to attack these already improperly protected smart cities. 

AI platform helps developers spend less time on unit tests, bug fixes, documentation

The platform has been tested with private developers and startups in the US and in France, Joubert said. So far, the feedback has been good with two suggested areas of improvement, he said. Testers said they want to see enhanced coverage so the platform can generic more specific unit tests, and they want to see an increase in the number of languages Ponicode is supporting, according to Joubert. "We're trying to make it very smooth and integrated for developers," he said. "It's really, really important that the developer keeps control." Generating unit tests is complex because developers need to first understand the function and what the intention is inside the code. Then they have to generate a test case and then give some values to tell the function what to do, he said. The third task is generating specific values to test properly. "We created an algorithm that trains the AI to generate unit tests," Joubert said. With Ponicode, developers can run their app in VS Code because the platform will understand how it can be tested; choose easily among the suggestions generated by the platform, and increase coverage in a click, without writing a single line of code, he said.

The Missing Piece In Quantum Computing And IoT

Using the key principles of quantum computing mentioned earlier, we can create quantum key distribution, the most secure way to encrypt and decrypt information – and thereby send messages securely – that has been developed to date. This is true for several reasons. For one, quantum cryptology such as this utilises a property of quantum physics called entanglement. Maria Korolov explains this process as when ‘two particles become entangled so that they have the same state, and then one of these particles is sent to someone else. When the recipient looks at the particle, it’s guaranteed to be the same state as its twin…the state of the two entangled particles, while identical, is also random.’ As such, entanglement allows you to send an encryption key in the form of two ‘identical, random particles’, which can be used to send messages using symmetric encryption. This method doesn’t require a means of transmission and, as such, it becomes more difficult for information to leak. Encryption is therefore made considerably stronger.

Cryptocurrency Bourses Win India Case Against Central Bank Curbs

A three-judge bench headed by Justice Rohinton F. Nariman agreed with petitions by cryptocurrency exchanges, start ups and industry bodies that had challenged the Reserve Bank of India’s April 2018 decision to ban banks from offering any services to support digital currencies. The court struck down the RBI’s curbs on Wednesday. The ruling is an opportunity for virtual currency investors and businesses in India to push against stricter rules being planned by a skeptical government, and potentially raises hope for projects such as Facebook Inc.’s Libra cryptocurrency. The Supreme Court is separately hearing another case, in which it will decide on regulations for digital currencies, and Wednesday’s judgment weakens the case for strict norms. “Cryptocurrencies are an exciting technology that needs to be carefully studied,” said Vaibhav Kakkar, a partner at law firm L&L Partners. “With this order, there is a likelihood of more mature and balanced regulation of cryptocurrencies and the fintech sector as a whole.”

What is the difference between LoRa and LoRaWAN?

LoRa, or Long Range, is a proprietary, low-power and long-range wireless technology that uses license-free wireless spectrum -- much like Wi-Fi uses the unlicensed 2.4 GHz and 5 GHz frequencies. The exact frequency LoRa uses depends on the physical location of a deployment. For example, LoRa uses the 915 MHz band in North America and the 868 MHz band in Europe. Thus, it's important to know which frequencies can be legally used in each LoRa deployment location. From a range perspective, LoRa can communicate up to 10 km away under optimal, line-of-sight conditions. ... LoRaWAN is an open, cloud-based protocol -- designed and maintained by the LoRa Alliance -- that enables devices to communicate wirelessly with LoRa. Essentially, LoRaWAN takes LoRa wireless technology and adds a networking component to it, while also incorporating node authentication and data encryption for security. From an enterprise IT deployment perspective, LoRaWAN networks are ideal for IoT devices that continuously monitor the status of something and then trigger alerts back to gateways when the monitored data surpasses a specified threshold.

'Malware-free' attacks now most popular tactic amongst cybercriminals

The increasing popularity of malware-free attacks underscored the need for organisations not to rely solely on antivirus tools, said CrowdStrike. The security vendor defined malware-free attacks as those in which files or file fragments are not written to disk. These could be attacks where codes executed from memory or where stolen credentials are tapped to enable remote logins. It added that malware-free attacks typically require various detection techniques to identify and intercept, such as behavioural detection and human threat hunting. The 2020 threat report also saw more incidents of ransomware and ransom demands from cybercriminals who, increasingly, conducted data exfiltration, which enabled them to exploit sensitive data that was proprietary information or potentially embarrassing for victims. In addition, nation-state adversaries last year targeted a range of industries, but were especially interested in the telecommunications sector, which saw increased attack frequency from nations such as China and North Korea, noted CrowdStrike. State actors from China, in particular, were keen to target the industry in a bid to steal intellectual property and competitive intelligence, said the US security vendor.

How IT Leaders Can Attract and Retain the Right Talent

Beyond looking to recent graduates, consider untapped pools of talent to diversify your workforce. While often overlooked because of “lack of relevant technical experience,” veterans offer skills that could greatly impact your existing teams, including strong leadership, productivity and decision-making capabilities. We can look to companies like Salesforce for inspiration: Its veteran program Vetforce connects the military community with open IT positions. Another pool of talent often left behind are those who have taken time off and want to restart their careers, including parents with new children or those who had to care for a loved one in a time of need. For example, we partnered with Path Forward to offer returnship programs. These programs help professionals with five or more years of work experience, and who have been out of the paid workforce for a minimum of two years, to bridge their transition back into the workforce. We have found excellent, talented employees through this channel. Once you have a candidate in mind, ask the right interview questions to determine their potential fit on your team.

Could Crypto Exchanges, Wallets Be Targetted With Banking Trokans?

Using Remote Access Trojans (RATs), hackers can reportedly bypass security infrastructure on smartphones, enabling cybercriminals to carry out transactions directly from the infected mobile devices. According to the report, hackers are already using banking trojans like Hydra and Gustuff to attack crypto exchanges and wallets. Using Hydra’s screencast capabilities, cybercriminals can remotely monitor real-time activities on the infected mobile devices. Hydra also allows hackers to clone the infected device, providing access to stored financial information. As part of its report, ThreatFabric revealed that rogue actors are using Hydra to hack crypto wallets on platforms like Binance, Bitfinex, and Coinbase among others. With Gustuff, hackers have access to keylogging and browser overlay attack vectors allowing rogue actors to trick victims into entering their financial details on fake websites that closely resemble their real banking or crypto exchange platforms. According to ThreatFabric, Gustuff’s potential target is also currently expanding to include crypto wallets like Electrum, Blockchain.com, and Xapo.

AI for Payment Optimization: Current Practices and Use Cases

Fraud detection is a major problem in the financial world as it slows down payment processing. Furthermore, it can be difficult to detect, using standard methods, in accounts with a large number of payments on a daily basis. A good example of how AI is used in fraud detection comes from VISA, one of the largest digital payment processors in the world. They’ve been using AI systems for the last 25 years, which allowed the system to improve and learn as the technology got better. Their artificial intelligence system for payment authorization and fraud detection learns user behavior and understands patterns. So, whenever an activity is not according to a user’s profile, it is being flagged as suspicious. Once a transaction is considered suspicious, VISA’s AI connects with the bank that issued the card letting them know about the situation. From here, the bank will either block the transaction (based on the risk assessment made by VISA) or send a text message asking the account owner to confirm that he/she initiated the transaction. 

Parliament: New cyber security label for smart devices

Announced by Singapore's Senior Minister of State for Communications and Information (MCI) Janil Puthucheary in Parliament on Tuesday (March 2), the initiative aims to address this "growing area of concern". "The scheme will raise consumer awareness of more secure products and aims to encourage manufacturers to adopt additional cyber security safeguards," said Dr Janil during the debate on MCI's budget. To be launched later this year, the scheme will initially be voluntary, administered by the Cyber Security Agency of Singapore. Singapore's labelling scheme will follow the European Union's standard for IoT devices, which spells out the minimum standards for manufacturers, including having no default passwords and ensuring that there are regular software updates over the air without user supervision. Singapore is among the first group of countries to adopt the standard. CSA said that the labels will indicate the security provisions present in the smart devices. More details will be announced later.

---

Quote for the day:

"Leaders dig into their business to learn painful realities rather than peaceful illusion." -- Orrin Woodward

---

Daily Tech Digest - March 03, 2020

This phishing email contains a password-protected file. Don't open it

Uncovered by security analysts at Palo Alto Networks' Unit 42 research division, the campaign appears to have started in January this year and uses a number of sneaky techniques to compromise chosen victims and gain remote access to systems. Targets of this hacking campaign receive an email that encourages them to open a phoney password-protected document that claims to have been locked in order to secure personal information supposedly contained within. Many of the emails are themed around refunds, online transactions and other invoices. Researchers believe the password comes in the phishing email and the use of a document featuring the branding in this case of a real cybersecurity provider is a means of generating additional trust from the victim. Unlocking the document will enable macros and execute the commands for the next stages of the attack, which ultimately uses PowerShell to install a remote access tool onto the system, along with mechanisms to ensure it maintains persistence. The tool installed is NetSupport Manger, a legitimate form of remote access control software often used in IT support or for remote collaboration to gain access to the PC.

Industry group launched to develop standards for fibre deployment in sewer network

“Although fibre in the sewers is no new concept, the TUG was established to bring key stakeholders from across the industry together to agree on consistent standards for this process, and share knowledge,” said Wayne Earp, chair of the TUG and consultant at WFE Consulting. “This will make laying fibre quicker, while also enabling the deployment of cutting-edge network monitoring technology, helping to reduce wastage, flooding and driving forward a better customer experience.” The TUG will regularly convene to allow the utility companies to exchange technical information, with the purpose of using their shared knowledge to create specifications and codes of practice relating to the deployment of fibre optic cables within sewer pipes. The idea is that these standards, as well as SSE’s new infrastructure, will help mobile network operators to deploy 5G services more quickly and efficiently, as well as at a potentially lower cost.

A Siri for Network Security: How Chatbots can Enhance Business Agility

Imagine how useful it would be if the benefits of chatbots could be applied to enterprise IT environments, to accelerate and automate information-sharing across areas of the business where data has traditionally been siloed and hard to gain access to – even though sharing that information would benefit the organization. A great example of this is the data siloing that often happens with IT and network security teams, and with business application owners. For example, if an application owner wants an answer to the simple question “Is network traffic currently allowed from this specific server to this second server?” getting it can be complicated if the enterprise does not have a Network Security Management (NSM) solution. The process would involve asking several different stakeholders and having to use multiple firewall and device management consoles. Even if the organization does use a NSM solution, the application owner might not get an immediate answer to their question: they would have to either access the NSM system and know how to use it themselves, or ask a member of the IT or security team – which may interrupt more important security-related tasks.

Researchers use ultrasound waves vibrating through tables to access cellphones

Zhang and his co-authors were able to send “voice” commands to cellphones as they sat inconspicuously on a table, next to the owner. With the addition of a stealthily placed microphone, the researchers were able to communicate back and forth with the phone, ultimately controlling it from afar. Ultrasonic waves are sound waves in a frequency that is higher than humans can hear. Cellphone microphones, however, can and do record these higher frequencies. “If you know how to play with the signals, you can get the phone such that when it interprets the incoming sound waves, it will think that you are saying a command,” Zhang said. To test the ability of ultrasonic waves to transmit these “commands” through solid surfaces, the research team set up a host of experiments that included a phone on a table. Attached to the bottom of the table was a microphone and a piezoelectric transducer (PZT), which is used to convert electricity into ultrasonic waves. On the other side of the table from the phone, ostensibly hidden from the phone’s user, is a waveform generator to generate the correct signals.

5G-ready ruggedized server from Supermicro is a "datacenter on a pole"

The SuperServer is 5G-ready and was designed in cooperation with the O-RAN Alliance, a consortium of tech companies dedicated to "industry movement to non-proprietary hardware platforms and the growing adoption of standardized system interfaces," Supermicro said. A radio access network (RAN) is the backbone of cellular infrastructure: It's the entire chain from your personal device to its local tower, through a radio network controller, and on to the cellular network.  O-RAN is pushing for a 5G world that operates on an open interface that will "enable smaller vendors and operators to introduce their own services, or customize the network to suit their own unique needs," as well as "enable multi-vendor deployments, enabling a more competitive and vibrant supplier ecosystem." O-RAN said that 5G will result in wireless networks that are increasingly complex while also running more demanding applications. Without an open interface, O-RAN argues, traditional methods of deploying, maintaining, and operating networks will become too burdensome for human IT professionals. 

The 3 fundamentals of hybrid cloud architecture management

To integrate data center hosting and public cloud services, developers can choose between two main strategies: treat cloud as the front-end application hosting point or turn both the data center and the cloud into an elastic resource pool. This decision will dictate the toolset you use to manage and monitor application components. A public cloud front-end hosting strategy uses the cloud provider's hosting service to manage your app deployment, which means developers can manage back-end infrastructure on a separate platform from the deployed apps. This can lead to integration issues since the hosting environments are managed separately and developers do not have to manually configure app compatibility with the data center. However, complications can arise when front-end components need to access data sitting in on-premises databases. To mitigate this, you must implement an additional APM strategy that sets easy-to-identify trace points to monitor communication between the front-end app and the data center. In a unified resource pool strategy, the cloud and data center share a hosting pool for an app. Abstraction tools, such as Apache Mesos, can help create resource pools that link your tools and provide support for scaling and failover.

What is Deno? A ‘better’ Node.js

The way Deno improves security over Node.js is simple: By default, Deno won’t let a program access disk, network, subprocesses, or environmental variables. When you need to allow any of these, you can opt in with a command line flag, which can be as granular as you like, for example --allow-read=/tmp or --allow-net=google.com. Another security improvement in Deno is that it always dies on uncaught errors, unlike Node.js, which will allow execution to proceed after an uncaught error, with results that may not be predictable. In Node.js, you load CommonJS modules using the require keyword and they all, standard and third-party alike, implicitly come from npmjs.com. In Deno, you load ES modules using the import keyword and explicitly state the URL. ... Deno modules can be hosted anywhere – there is no centralized repository for third-party modules. In addition, modules are always cached and compiled locally, and aren’t updated unless you explicitly ask for a refresh. Therefore, you should be able to run Deno programs that are already on your laptop, as long as all the imports have been resolved once, even if you are on an airplane with no connectivity.

Coronavirus prep could spark better disaster recovery

If your company strongly encourages workers to stay home in response to the virus a significant portion of your company might be working from home for extended periods of time. From a data-protection standpoint; this significantly increases the chances that important intellectual property will be created outside of your data center. If your company currently relies on storing such data on file servers or similar systems, remote employees will probably not be able to use such systems easily. As a result, they will create and store important data directly on their laptops, leaving centralized company storage out of the picture. This means that you should probably examine your company's policy regarding data protection of laptops and mobile devices. Many companies don’t provide backup and recovery for mobile devices, despite the fact that most experts feel they should. Now might be a good time to do so. The main reason early attempts at laptop backup failed was users would kill the backup process because it slowed them down, and it cost too much. The good news is several providers can back up your laptops and mobile devices in such a way that users never realize backups are running.

Compare serverless tools and services in the public cloud

Google Cloud Functions is the platform's serverless, event-driven computing service. Similar to AWS Lambda, Google Cloud Functions abstracts away the underlying infrastructure management and enables developers to focus on writing code and other tasks. With Google Cloud Functions, small programmatic code segments execute functions into a cloud environment in response to specific events. This service can be trigged by resources within or outside of Google Cloud Platform (GCP). Google Cloud Functions connect with other GCP services along with other third-party services. GCP's serverless compute tool can trigger log analysis and data backups and carry out redundant tasks on data sets, among other tasks. Users pay for the number of functions they use. ... App Engine scales resources of any size with automatic infrastructure management and server maintenance. This tool provides built-in services, such as load balancing, application logging and health checks. The serverless compute platform also offers data storage and configuration capabilities.

DoppelPaymer Ransomware Slams Supplier to Boeing and Tesla

In the case of DoppelPaymer, the gang has been publishing data from organizations it purportedly compromised, since the middle of last month. The group's name-and-shame website has at times featured data from more than a dozen organizations, although as of Tuesday it featured data from just six organizations. "Below you can find private data of the companies which were hacked by DoppelPaymer," the site reads. "These companies decided to keep the leakage secret. And now their time to pay is over." As of Tuesday, the alleged Visser data was featured alongside alleged data from Furniture Row, which is an American furnishing retailer with 330 stores across 31 states. Furniture Row and Visser Precision were both founded by Barry Visser, an entrepreneur who in the 1980s also founded the chain retailer Big Sur Waterbeds. Dumped data includes what is purportedly Visser's nondisclosure-agreements with both SpaceX and Tesla, as well as sales contact lists, tax forms and receipts. The sales contact lists contain email addresses and phone numbers for individuals working at a variety of companies.

---

Quote for the day:

"A leadership disposition guides you to take the path of most resistance and turn it into the path of least resistance." -- Dov Seidman

---

Daily Tech Digest - March 02, 2020

5G and IoT security: Why cybersecurity experts are sounding an alarm

There are five ways in which 5G networks are more susceptible to cyberattacks than their predecessors, according to the 2019 Brookings report, Why 5G requires new approaches to cybersecurity. They are: The network has moved from centralized, hardware-based switching to distributed, software-defined digital routing. Previous networks had "hardware choke points" where cyber hygiene could be implemented. Not so with 5G; Higher-level network functions formerly performed by physical appliances are now being virtualized in software, increasing cyber vulnerability; Even if software vulnerabilities within the network are locked down, the 5G network is now managed by software. That means an attacker that gains control of the software managing the network can also control the network; The dramatic expansion of bandwidth in 5G creates additional avenues of attack; and Increased vulnerability by attaching tens of billions of hackable smart devices to an IoT network. ... The lack of regulations for 5G security, "is why these attacks happen day in and day out" and is also the reason, "2019 was considered the worst year for cybercrime,'' Bencenti said.

More than 40% of privacy compliance technology will rely on AI by 2023

At the forefront of a positive privacy user experience (UX) is the ability of an organization to promptly handle subject rights requests (SRRs). SRRs cover a defined set of rights, where individuals have the power to make requests regarding their data and organizations must respond to them in a defined time frame. According to the survey, many organizations are not capable of delivering swift and precise answers to the SRRs they receive. Two-thirds of respondents indicated it takes them two or more weeks to respond to a single SRR. Often done manually as well, the average costs of these workflows are roughly $1,400 USD, which pile up over time. “The speed and consistency by which AI-powered tools can help address large volumes of SRRs not only saves an organization excessive spend, but also repairs customer trust,” said Mr. Willemsen. “With the loss of customers serving as privacy leaders’ second highest concern, such tools will ensure that their privacy demands are met.”

Cisco security warnings include firewall holes, Nexus software weaknesses

The firewall and UCS vulnerabilities all have a severity level of “high” on the Common Vulnerability Scoring System and include: A vulnerability in the CLI of Cisco FXOS Software and Cisco UCS Manager Software could let an authenticated, local attacker execute arbitrary commands on the underlying operating system (OS). The vulnerability is due to insufficient input validation. A successful exploit could allow the attacker to execute arbitrary commands on the underlying OS with the privileges of the currently logged-in user for all affected platforms excluding Cisco UCS 6400 Series Fabric Interconnects. On Cisco UCS 6400 Series Fabric Interconnects, the injected commands are executed with root privileges, Cisco stated. A second vulnerability in the local management of the same CLI interface in Cisco FXOS Software and Cisco UCS Manager Software could allow similar problems. A weakness in the Cisco Discovery Protocol feature of Cisco FXOS Software and Cisco NX-OS Software could let an unauthenticated, adjacent attacker exploit this vulnerability by sending a crafted Cisco Discovery Protocol packet to a Layer 2-adjacent affected device.

Everything you need to know about the Chief Information Security Officer role

In short, crucial – ensuring that IT systems comply with security and regulatory requirements is the top priority for tech chiefs, according to Grant Thornton LLP and the Technology Business Management Council. They report as many as 83% of IT leaders have increased spending on cybersecurity in the past 12 months. Kind of. While it's good news that CISOs have an increasingly high-profile executive audience for their opinions, the strategic importance of cybersecurity is far from guaranteed. Almost half (43%) of CISOs feel that they are in direct competition with other business and IT initiatives for funding, reports 451 Research and Kaspersky. That battle for cash is at odds with wider business trends: almost every expert recognises businesses need to take security more seriously than ever before. But while 40% of CISOs say their organisation has been subjected to a security attack in the past two years, just 29% of CISOs believe they're very well-positioned to deal with security risks, according to KPMG and Harvey Nash. Consultant EY says organisations can only stay one step ahead of the cyber threat by creating what it refers to as "a culture of security by design". This approach relies on bridging the divide between the security function and the C-suite.

How to find the right zero trust strategy

Where data is anonymised, the security visibility needed for zero trust is reduced. Data anonymisation can mitigate some data protection concerns, but according to the GDPR, only completely anonymous data is not personal in nature. Data is pseudonymised in most cases, meaning it’s possible to re-identify individuals. However, the application of data anonymisation techniques complicates ZT visibility by making it harder to identify the sensitivity or criticality of data in its anonymised form. Colin McMillan, technical director for security at Cisco, says: “Data anonymisation has been used by some European customers to deal with data sovereignty issues. But when implementing ZT, they still want visibility. Customers have implemented technical solutions in non-standard ways to get around this, making maintenance and support challenging for everyone involved.” Non-security executives think that zero trust is just a network security architecture.

Is Artificial Intelligence (AI) A Threat To Humans?

AI will change the workplace and the jobs that humans do. Some jobs will be lost to AI technology, so humans will need to embrace the change and find new activities that will provide them the social and mental benefits their job provided. As Bostrom advises, rather than avoid pursuing AI innovation, "Our focus should be on putting ourselves in the best possible position so that when all the pieces fall into place, we've done our homework. We've developed scalable AI control methods, we've thought hard about the ethics and the governments, etc. And then proceed further and then hopefully have an extremely good outcome from that." If our governments and business institutions don't spend time now formulating rules, regulations, and responsibilities, there could be significant negative ramifications as AI continues to mature. Artificial intelligence will change the way conflicts are fought from autonomous drones, robotic swarms, and remote and nanorobot attacks. In addition to being concerned with a nuclear arms race, we'll need to monitor the global autonomous weapons race.

Cloud spending set to outpace traditional on-prem

Although many who follow the hype thought perhaps this shift took place a few years back, this is actually much earlier than I expected, and perhaps faster than most enterprises can manage. Part of this is a bit of “cloud washing,” considering that those with older, on-premises solutions have now rebranded their technology as “private clouds.” Although some of the technology is indeed private cloud technology, many so-called private cloud solutions predate cloud computing and don’t support cloud computing features such as auto- and self-provisioning or supporting automated elastic scalability. You would have to audit all of those technology providers who claim “private cloud” to determine how many of those exist, which is not likely to happen. Putting that issue aside for now, the fact that we’re spending more on cloud computing than traditional on-premises solutions has a few considerations for enterprise IT as we reach the tipping point. ... Most organizations are behind on skills and cultural changes needed to support cloud computing. Indeed, if skills are not updated to meet the needs of cloud-based solutions, they have no chance of succeeding. Most cloud computing failures can be traced to enterprises neglecting human factors.

What Disney+ Can Teach Businesses About Customer Security

Credential stuffing events are pretty straightforward: Hackers gather a massive repository of pre-existing login credentials secured from hundreds, if not thousands, of previous security breaches — leading to nearly 8 billion exposed records — and then attempt to use them to log in to other online services and platforms via automated tools, called bots, trying combinations in rapid succession. Password reuse is the basis for these attacks, given that 65% of Americans admit to using the same password for multiple websites, according to a 2019 Google poll. Aside from password reuse, the failure rate of stuffing attacks is low because launching an attack is easy — plus, subscription services with low price points and massive numbers of users are tempting targets. Once hackers gain access to an account, they also have access to just about any piece of a user's personal information they would need to carry out malicious activities, such as identity theft or credential sales on the Dark Web for as little as $3.

5 Things Google Duplex Means For The Future of Chatbots

Thanks to Duplex, people's expectations of what's possible just changed. Now, whether communicating via voice or text, bots need to be able to act and react in ways that make sense based on human conversational flows. In other words, being mid-flow in customizing your pie with the Pizza Hut bot shouldn't stop you from remembering that you want delivery at the office, not your home. And the bot should be smart enough to accept that input, react naturally, and re-start the tomatoes-or-olives toppings conversation without a hitch. That said, there are different use cases. "Duplex is a better version of a personal assistant," says Julie Blin, former strategy exec at Samsung Mobile. "I think they are complementary." To date, bots have been mostly about text. And that's great when you're in public, or don't want to disturb people, or need privacy. But it'd also be nice to be able to simply speak your requests on occasion ... and maybe even do that in full duplex mode. There are serious speed advantages to speech over texting, at least for those over the age of 15.

Microsoft Teams just added new Outlook integration, chat updates and more

Microsoft has also added the option to assign a tag to members of an organization, so that users can better target their messages. For instance, a store manager could @mention all the cashiers in a given channel and get their message across to all relevant members at once. Calls and meetings got an upgrade in the form of live captions, which can be turned on during Teams meetings to let participants read what people are saying in real time. Salazar wrote that the tool would improve the accessibility and effectiveness of meetings, say, if you are calling from a crowded airport terminal – but it is worth noting that the company recommends speaking clearly, slowly, and to avoid background noise, in order to make the most of the service. The feature supports English language for now, added Salazar, but more languages will be coming soon. And Teams administrators can record meetings to store them in Microsoft Stream cloud storage. Additional security measures also let administrators monitor the content shared on Teams more closely. Microsoft has turned on the option for a legal hold' on private channel chats, which are stored in user mailboxes, should it be necessary to preserve messages related to a specific topic or individual that are relevant to a case.

---

Quote for the day:

"Stand up for what you believe, let your team see your values and they will trust you more easily." -- Gordon Tredgold

---

Daily Tech Digest - March 01, 2020

Athenahealth CISO describes the company’s new ‘internal offense’ security strategy

The platform serves as a virtual mirror for nation-state actors and cybercriminals and unlike a simulation, which replays historical attacks inside artificial boundaries, it provides the ability to safely launch real-world attacks against production assets, he added. “Athenahealth uses Randori’s reconnaissance capabilities to understand the accessibility and value of assets that could be attacked and make determinations on how best to prioritize and protect them,” Hazzard continued. “The company’s tooling helps us identify internet-facing systems – where we are, how we appear to attackers on the internet, what avenues to access are available, and what data exists in the internet that could be used to acquire access.” Much of the reconnaissance is conducted automatically in the same way threat actors conduct such activities, he explained. “We’ve found opportunities in using the company’s data to improve our security posture and make certain attacks less possible, more difficult, or require a much higher level of sophistication to execute,” he said.

Reinventing tech finance: The evolution from IT budgets to technology investments

Agile and other flexible delivery styles are on the rise—the CIO survey found that 56 percent of CIOs expect to implement Agile, DevOps, or a similar flexible IT delivery model to increase IT responsiveness. But these efforts could be stymied by traditional budgeting processes, which aren’t optimized for the Agile development environment. Rather than promoting cross-functional teaming, iterative sprints, and the customer- and product-oriented mindset—the hallmarks of Agile development—fixed IT budgets are typically structured to provide incremental annual increases and encourage functional silos, inflexible requirements, and a project-focused mindset. Agile’s laissez-faire approach to project scope and requirements dictates more flexible timelines, processes, and financing, which fly in the face of the fixed annual budget’s insistence on predictable costs and resources.  ... To cultivate the most diverse set of investments, many CIOs are managing technology portfolios, allocating funding across various time horizons and according to potential risk, reward, and value. Depending on corporate strategy and competitive and market factors, CIOs look for the right balance of technology investments in three areas: existing business operations, business capability enhancements, and adjacent and new capabilities.

DeepCode taps AI for code reviews

DeepCode learns from open source code bases and has built up a knowledge base to make suggestions on improving code. Code is analyzed with each change. The DeepCode cloud service integrates with code hosting platforms GitHub and Bitbucket, and supports on-premises deployments to watch over Bitbucket Server or GitLab. Core features of DeepCode include: AI QA Audits. DeepCode analyzes any branch of a repository and displays results in a web browser; and AI Code Reviews including commit analysis and pull request analysis. DeepCode analyzes all code commits and pull requests and notes any issues. DeepCode also offers semantic analysis, which examines changes before and after problems and understands context. Security and performance bugs are analyzed, as well as logical mistakes made by developers. Compatibility issues, such as when a new version of a language is being used, also are assessed. Formatting and API issues are checked as well. Other items looked for include resource leakage, null pointer exceptions, and date formatting issues.

Microsoft is expanding its antivirus software to iOS and Android

With the new release, Microsoft is staking out its place in a growing market of antivirus providers compatible with smartphones - and it's pitching its own security tech as a one-stop provider for companies with employees that use multiple devices and operating systems on the job (the newly announced software will be available for businesses, but not individual consumers). Microsoft engineers and executives who spoke to Business Insider about the offering said Defender primarily aims to prevent employees from falling for phishing scams and to detect insider threats, a rising security concern for companies. Corporate Vice President for cybersecurity solutions Ann Johnson touted Defender's features that give companies tools to more closely oversee individuals who might pose an insider threat. "Let's say I resigned from Microsoft tomorrow, and I give my two weeks notice," Johnson told Business Insider. "Insider risk management gives the organization, with the right HR and legal permissions, the ability to monitor me much more closely."

Changing the mindset of the CISO: From enforcer to enabler

Security leaders can no longer adopt the role of enforcer, but rather need to pivot to a new role: the enabler. CISOs today have the opportunity to help enable the organization to grow by delivering a digital experience that delights customers while mitigating digital risk. This requires the CISO to advise the business about when and where cyber risks could manifest. Security leaders must now be able to transform their security practices in lockstep with all the other changes wrought by business-wide digital transformation. Today’s CISO needs to be able to provide advice to the business to help it understand the risk landscape so that it can then make informed decisions about which risks are tolerable and which ones to avoid at all costs. In addition to providing this counsel, security leaders must be able to implement the technology to mitigate risks and protect the business as it continues on the path to digitally transform. As part of this change in mindset, security leadership needs to take into account the impact of friction on the user experience as it can “break or make” security initiatives.

Infosys CISO: Being good at technology is no longer enough

The future is going to be about cyber resilience, and CISOs need to lead the charge to recalibrate how security teams and entire companies think about security. Security leaders have to engage board members and team members in the right way and drive the shift to a new mindset about security. "A truly effective CISO can shape the thinking of the organization, and that's where influence comes in," he said. Salvi said that the pressure to shift to a secure-by-design approach is not yet as powerful as the need to get a product on the market as quickly as possible. "You need a leader who is willing to take the business loss for two weeks to make sure the product is secure," he said. Salvi spends a lot of time cultivating a secure-by-decision mindset in the industry and internally at Infosys. "You have to drive that thinking on an ongoing basis, it's not something that is easy because it is not natural," he said. Salvi's team at Infosys includes three direct reports, a leadership team of 50 people, and about 300 staff members. "The average tenure on the leadership team is 10 years, so compared to them, I am a newbie," Salvi said.

Bringing A Concierge Approach To Cyber Risk Management

Suhs’s experience with concierge medicine formed his vision for a new delivery model for cyber risk management, which today exists as Concierge Cyber®. Here’s how it works: “In return for a set annual membership fee, my firm provides businesses and individuals guaranteed quick and easy access to cyber risk resources,” explains Suhs, founder and managing director of Cyber Special Ops, LLC, which offers the product. “These include same-day appointments and phone or email access on evenings and weekends, information security policy templates, and pre- and post-breach services, as needed, at pre-negotiated rates. “We work with a respected and highly credentialed group of legal, information security, credit and identity restoration, and public relations specialists from firms located around the globe to deliver advanced cyber risk management services,” he adds. “The specialists operate under the umbrella of My-CERT™ which stands for My-Cyber Emergency Response Team; they provide what we describe as ‘expertise, experience and agility to effectively respond to a cyber incident under the protection of attorney-client privilege.’”

Massive DoD DevSecOps standards push may aid enterprise IT

As government agencies and private-sector enterprises increasingly use the same open source technologies, many commercial companies look to the government, particularly the DoD, as the gold standard for cybersecurity, one IT consultant said. "There's a saying, 'Nobody ever got fired for using IBM,'" said Jeremy Pullen, principal technical consultant at Polodis, a digital transformation consulting firm in Atlanta, who's closely following the DoD's DevSecOps work, including a recently published repository of hardened container images for general use. "There's a similar confidence in using systems hardened to the standards of the US government." Pullen said the breadth of the collaboration will also help legitimize the DevSecOps concept as a set of practices, rather than tying it to any particular tool, vendor or method used by specific household-name enterprise IT teams. "The last two years, I've had to educate people about what DevSecOps is and isn't -- it's not just using a tool from White Hat, Sonatype or Veracode," he said. "This paints a better picture of DevSecOps as an area of practice rather than just implementing somebody's product."

One in four Americans won’t do business with data-breached companies

This study included data breaches that occurred from Jan. 1, 2018, to Dec. 31, 2018, regardless of the public reporting date. Only breaches leaking over 500,000 consumer records that affected consumers on a national scale were included. It found that most people were only loosely familiar with the total number of corporate breaches that occurred in 2018. Though the majority of people admitted to losing trust in corporations that experienced data breaches, most were unwilling to cut ties with these companies. To counter this, most people made their account passwords harder to guess and were more selective with whom they gave their financial information after learning of a breach, even though one in three people who experienced a data breach ultimately weren't sure which information was targeted. The findings showed that almost one in four Americans stop doing business with companies who have been hacked, and more than two in three people trust a company less after a data breach. Almost all respondents (92%) agree that companies are financially liable to their customers after a breach and over one in five people are unwilling to give their financial information to a company who's been hacked

Malaysia: A Flourishing Fintech Ecosystem

Developments in Malaysian fintech are altering the country’s financial sector landscape. For example, while fintech products offered by traditional financial institutions expand, the number of physical commercial bank branches is declining, and the number of automated teller machines has fallen over the last two years. Traditional Malaysian banks continue to dominate in deposits, lending, and raising capital while, at the same time, adopting new technologies and either competing or collaborating with new tech startups. As of April 2019, there were close to 200 startups in Malaysia in a range of fintech areas, including payments, lending, and blockchain. Of course, the rapidly evolving technology—alongside new consumer habits—is not without risk or challenges. Malaysia has been a leader on regulations to ensure that the financial system remains safe amid the possibility of cybersecurity incidents. Well aware that cyberattacks can undercut customer confidence and inflict widespread damage, Malaysian banks and regulators list cybersecurity among their issues of top concern.

---

Quote for the day:

"What I've really learned over time is that optimism is a very, very important part of leadership." -- Bob Iger

---

Daily Tech Digest - February 29, 2020

Why your brain is not a computer

The metaphors of neuroscience – computers, coding, wiring diagrams and so on – are inevitably partial. That is the nature of metaphors, which have been intensely studied by philosophers of science and by scientists, as they seem to be so central to the way scientists think. But metaphors are also rich and allow insight and discovery. There will come a point when the understanding they allow will be outweighed by the limits they impose, but in the case of computational and representational metaphors of the brain, there is no agreement that such a moment has arrived. From a historical point of view, the very fact that this debate is taking place suggests that we may indeed be approaching the end of the computational metaphor. What is not clear, however, is what would replace it. Scientists often get excited when they realise how their views have been shaped by the use of metaphor, and grasp that new analogies could alter how they understand their work, or even enable them to devise new experiments. Coming up with those new metaphors is challenging – most of those used in the past with regard to the brain have been related to new kinds of technology.

How Machine Learning Can Strengthen Insider Threat Detection

To mitigate insider threats, experts suggest that enterprises develop their own risk algorithms by coupling machine learning capabilities with behavioral analytics to understand discrepancies in employee activities. Companies can use human resources data to help create these new algorithms, said Dawn Cappelli, CISO of Rockwell Automation. "The key is having HR data. You can build your risk models by taking the contextual employee data along with their online activity and create risk algorithms." But the real challenge is refining and contextualizing this data in order to correctly identify potential threats, said Solomon Adote, CISO for the state of Delaware. "Data without context might not tell you the full story," Adote said. "It has to be about identifying what is abnormal about a particular activity." Once the data is contextualized, Adote noted, enterprises then can use this information to create alerts, advise employees about their activities and make them aware that the company is aware of what's happening internally. "That's sometimes all you need to prevent a significant catastrophe," Adote said.

Microsoft's Blazor for building mobile apps gains traction

While the mobile bindings project is still considered experimental, it is encouraging for fans of Blazor that Microsoft appears set to update it regularly and fix bugs. Microsoft has previously demonstrated how Blazor can be used to build all types of apps, including server-based web apps, offline web apps with WebAssembly, progressive web apps, hybrid .NET native apps that render to Electron and work offline, as well as native desktop and mobile apps. Blazor fan Chris Sainty, a UK-based developer, has posted a helpful explanation of Blazor on the Stack Overflow blog. He details what sets Blazor and its mobile bindings apart from other popular JavaScript UI frameworks, such as Angular and ReactJS, and how it leans towards web developers' existing work processes. "By using different renderers Blazor is able to create not only web based UIs, but also native mobile UIs as well," he notes. "This does require components to be authored differently, so components written for web renderers can't be used with native mobile renderers. However, the programming model is the same. Meaning once developers are familiar with it, they can create UIs using any renderer."

AI is helping Microsoft rethink Office for mobile

Microsoft this week launched an Office app that replaces Word, Excel, and PowerPoint on Android and iOS. Merging three apps into one, while adding more features, is quite the achievement. The new Office app is not just for consuming content and maybe a little light editing on the side, but actually creating content on the go. Most interestingly, a lot of these features fundamentally require AI and machine learning to achieve this new mobile productivity paradigm. Microsoft has been adding AI-driven features to its once most profitable product line for years now — we did a recap of just a handful last year. This week’s Office launch, however, showed Microsoft’s embrace of AI as not merely augmenting what you can already do with the productivity suite, but added new use cases altogether. Most of the new features are not simply traditional desktop features ported to mobile. They are use cases that are better on mobile, or not even possible on desktop. Office lets you take a picture of a document and turn it into a Word file.

3 ways AI is transforming the insurance industry

In the car insurance sector, insurers use telematics to collect real-time driving data from vehicles. As opposed to the past, where they had to rely on basic information about the vehicle and driver to craft their insurance policies, they can now analyze telematics data with machine learning algorithms to create personalized risk profiles for drivers. Many insurers use this data to give discounts to drivers who have safe driving habits and penalize dangerous behavior such as speeding, hard braking, harsh acceleration, and hard cornering. The same data can help reconstruct accident scenes and enable insurers to better understand and assess what happened, which results in much faster claims processing. In the health insurance sector, service providers use machine learning to help patients choose the best health insurance coverage options to fit their needs. Data collected from wearables such as fitness trackers and heart rate monitors help insurers monitor track and reward healthy habits such as regular exercise, and encourage preventive care by providing healthy nutrition tips.

Seven cybersecurity and privacy forecasts for 2020

Over the past ten years, personal medical devices such as insulin pumps, heart and glucose monitors, defibrillators and pacemakers have been connected to the internet as part of the Internet of Medical Things (IoMT). At the same time, researchers have identified a growing number of software vulnerabilities and demonstrated the feasibility of attacks on these products. This can lead to targeted attacks on both individuals and entire product classes. In some cases, the health information generated by the devices can also be intercepted. So far, the healthcare industry has struggled to respond to the problem – especially when the official life of the equipment has expired. As with so many IoT devices of this generation, networking was more important than the need for cybersecurity. The complex task of maintaining and repairing equipment is badly organized, inadequate or completely absent. Through the development of software and hardware platforms, vehicles and transport infrastructure are increasingly connected. 

Don't be like Bezos: How to keep your phone from being hacked

Turner explained, "In our own research we have shown that it is conceivable that the roots of trust pre-installed in all iOS devices can be a very fertile ground for attacking mobile devices in the way that the FTI Consulting report outlined. It is also very convenient that Apple does not allow for third party monitoring of their devices or operating systems, allowing attackers to completely remove any forensic evidence by merely forcing a shutdown of the device, with nearly all evidence destroyed once it is finished rebooting." But, you can't stop some cyberattacks from happening. "Unfortunately, in the case of zero-day exploits like the ones that were probably used in the Bezos case, even the best threat defense tools cannot protect users from that class of attacks. We have worked with several organizations to build programs to protect executives from these types of attacks, but they require resources and operational discipline to be effective," he said. Turner said that anyone without a properly maintained mobile device, meaning security updates installed within three weeks of release, is at risk. First and foremost, get rid of WhatsApp on anyone's phone at your company.

The Need for a 'Collective Defense'

Breaching private companies can create doorways into government networks as the two heavily rely on each other, he notes in an interview with Information Security Media Group. For example, Granicus, one of the largest IT service providers for U.S. federal and local government agencies, recently left a massive Elasticsearch database exposed to the internet. Alexander says private sector organizations need to share anonymized information on cybersecurity issues with the government so that further attacks can be prevented. "In cyber, each company works by itself and shares what is important. But you don't get the whole picture so you don't see what's going on," Alexander says. A "collective defense" approach means the entire cybersecurity community would work together, he explains. The Cybersecurity Information Sharing Act of 2015 provides a legal framework for government agencies and private sector organizations to voluntarily share cybersecurity information and other security data, Alexander points out.

4 fundamental microservices security best practices

Defense-in-depth is a strategy in which several layers of security control are introduced in an application. Sensitive services get layers of security cover, so a potential attacker who has exploited one of the microservices in the application may not be able to do so to another microservice or other layers of the application. Rather than depending on a single, seemingly robust security measure, use all the security measures at your disposal to create layers of security that potential attackers will have to break through. For instance, even if you already have a strong network perimeter firewall in place, ensure that you still practice strong token-based identification, keep addresses of sensitive microservices private and maintain a strong monitoring layer that diligently identifies unusual behavior. In a typical microservices-based application, it's ideal that service consumers do not communicate with microservices directly.

Three things CISOs need to do differently in 2020

The entire security team needs to be a learning organization to attract talent and keep up with new threats and new defenses, Michaux said. Developing this attitude will let prospective employees know that they are joining a company that is open to innovation and experimentation, not one that hyper-risk-averse and slow moving. To reinforce this culture, security leaders should think small and act fast and use the cloud to break things, rebuild, and improve. "Security teams have to realize that it's OK to break things as long as you learn something from it and quickly and apply that knowledge productively," said Caleb Queern, a director of KPMG cybersecurity services. CISOs should take an honest look at automation in 2020 as well. Ask what artificial intelligence can handle and what requires human attention. The goal should be to automate at least 50% of the basic controls of the security environment. Finally, security professionals should be able to read and write basic code. This has two benefits: it will earn the respect of DevOps engineers and it will help security pros know when to influence the development process.

---

Quote for the day:

"Even the demons are encouraged when their chief is "not lost in loss itself." -- John Milton

---