Daily Tech Digest - March 22, 2020

How Is AI Helping To Commercialize Space?

The power of deep learning and AI-enabled recognition provides significant power in analyzing images and providing ability to review the millions of images produced by spacecraft. Artificial intelligence on the other end can analyze the images as they are being taken and determine if there are any issues with the images. Unlike humans, AI does not need to sleep or take breaks so it can rapidly process a lot of data. Using AI to capture images of Earth also prevents the need for large amounts of communication to and from Earth to analyze photos and determine whether a new photo needs to be taken. By cutting back on communication, the AI is saving processing power, reducing battery usage, and speeding up the image gathering process. Satellites are also being used to analyze natural disasters from space. Detailed imagery from a satellite can help those on the ground to see victims, determine the course of the disaster, and more. Artificial intelligence is being used to help speed up the response of satellites to natural disasters. With the help of the onboard AI, satellites are able to determine where a natural disaster is located and navigate to that location.

COVID-19: How to Adjust Business Continuity Plans

The COVID-19 pandemic present new challenges to healthcare IT and security teams, including the need to reassess and adjust business continuity plans, says Christopher Frenz, who leads information security at New York's Interfaith Medical Center. He's chair of an industry committee that has developed new guidance for dealing with those challenges. ... "Business continuity is something organizations should constantly test, particularly in healthcare," he says in an interview with Information Security Media Group. "Testing your backup and disaster recovery plans is something we should always be doing. But at a time like this where we're seeing an upswing in malware attacks against hospitals related to coronavirus, and you're going to have influxes of patients ... that puts additional stresses on systems. So it's definitely a good idea to test and verify that all this stuff works ahead of time," he says.

Once hailed as unhackable, blockchains are now getting hacked

Susceptibility to 51% attacks is inherent to most cryptocurrencies. That’s because most are based on blockchains that use proof of work as their protocol for verifying transactions. In this process, also known as mining, nodes spend vast amounts of computing power to prove themselves trustworthy enough to add information about new transactions to the database. A miner who somehow gains control of a majority of the network's mining power can defraud other users by sending them payments and then creating an alternative version of the blockchain in which the payments never happened. This new version is called a fork. The attacker, who controls most of the mining power, can make the fork the authoritative version of the chain and proceed to spend the same cryptocurrency again. For popular blockchains, attempting this sort of heist is likely to be extremely expensive. According to the website Crypto51, renting enough mining power to attack Bitcoin would currently cost more than $260,000 per hour. But it gets much cheaper quickly as you move down the list of the more than 1,500 cryptocurrencies out there.

Cyber crooks continue to exploit COVID-19 for their malicious schemes

“BEC attacks are often delivered in stages. The first email sent is typically innocuous, meaning that they do not contain the attacker’s end goal. The attackers craft plausible scenarios in hopes the recipient will reply. Once they’re on the hook, the attacker will send their true ask. (I need you to buy gift cards, wire transfer funds, etc.),” the researchers explained. “These coronavirus-themed BEC attacks often come with spoofed display names, which are likely real people known to the recipient. In the body of this message, the actor attempts to eliminate the possibility of voice-verification, in hopes of ensuring a higher success rate, by saying their phone is ‘faulty at the moment.'” They’ve also spotted an assortment of fake notices impersonating doctors and local health agencies and institutions (aimed at the general population), as well as more targeted emails aimed at enterprises (employees), such as fake internal emails for credential phishing attacks impersonating the organization’s president, IT staff, risk manager, and so on.

CIOs say personal disruption comes before digital disruption

CIOs suggest personal disruption should be part and parcel to the overall disruptions that their organizations are making. At the same time, they say transformation needs to happen at many levels these days including the personal level. With this said, if an organization has been comfortable with the status quo for too time, CIOs say they need to start by driving the organizational change needed to be receptive to change and to perceive changes the organization needs. A key part of this, CIOs say is that IT leaders should resolve to be open to new ideas and ways of thinking this year and in the coming decade. Part of this involves getting out of the natural comfort zone and being open to thinking differently about how to impact the organization. CIOs suggest in 2020 IT leaders need to have increased awareness of the social and cultural impacts occurring from technology. CIOs say, for this reason, it makes sense to encourage the entire team to self-disrupt itself. To fix businesses, CIOs should get the business out of its comfort zone too.

4 Reasons Central Banks Should Launch Retail Digital Currencies

While domestic retail payments in many OECD countries are now free, cross border payments remain a minefield of pain, cost and delays for consumers. If I send money to my mum in India, she has no digital identity in the UK and I have no digital identity in India. So my bank in the UK verifies that I sent the money, my mum’s bank verifies that she’s the person the money is for and both the banks verify (or at least hope) that neither I nor my mum is a nefarious character. Then the banks wait until they have compared their respective spreadsheets and make me wait for this reconciliation. Only after that, both the banks take a nice cut on the FX and send the rest to my mum. If the bank was in rural Ghana instead of Delhi, there’d probably be two more banks in this bank-chain, which’d quadruple the delay and the pain. This whole process of cross border payments is not only a pain for consumers, it also makes the global AML regime ineffective and unenforceable. Instead, if the Bank of England and the Reserve Bank of India both were to rely on a shared set of data standards for their respective digital currencies and for the corresponding digital identity infrastructure

Exploring the risky behavior of IT security professionals

Almost 65% of the nearly 300 international cybersecurity professionals canvased by Gurucul at RSA Conference 2020 said they access documents that have nothing to do with their jobs. Meanwhile, nearly 40% of respondents who experienced bad performance reviews also admitted to abusing their privileged access, which is double the overall rate (19%). “We knew insider privilege abuse was rampant in most enterprises, but these survey results demonstrate that the infosecurity department is not immune to this practice,” said Saryu Nayyar, CEO of Gurucul. “Detecting impermissible access to resources by authorized users, whether it is malicious or not, is virtually impossible with traditional monitoring tools. That’s why many organizations are turning to security and risk analytics that look at both employee and entity behaviors to identify anomalies indicative of insider threats.” ... This showcases the problems organizations have with employees behaving outside of the bounds of practical and published security policies.

Covid-19: NHS tackles coronavirus crisis with the help of tech

NHS Digital’s website states: “Patients should be enabled to get advice and care without attending the practice unless in-person care is clinically required.” But although phone appointments are great, they won’t cover everything. This is where video appointments are invaluable – not just for patients who may be displaying coronavirus symptoms, but for anyone who needs to be seen by a GP. Some GPs already have online systems and video consultations in place, but many of those who have the service available have not yet begun to use it. EMIS is one of the biggest GP IT system providers in England, with nearly 4,000 GP practices using its EMIS Web service. In 2017, it launched its Video Consult service, but uptake has been limited. This echoes throughout GP practices in the UK – suppliers often offer the service, but few GP practices use it. EMIS, which normally charges GPs for the use of video consultations, has now decided to offer it free for the next few months.

To succeed in DevOps these days, go hybrid

DevOps is not just a technical undertaking, it's a business proposition. This calls for hybrid skills that enable a more holistic view of the entire software development and deployment process. With a majority of enterprises (52%) intending to ramp up their recruiting of DevOps skills. close to two-thirds, 65%, reported having difficulties with finding these combinations of skills. DevOps is not just a technical undertaking, it's a business proposition. This calls for hybrid skills that enable a more holistic view of the entire software development and deployment process. With a majority of enterprises (52%) intending to ramp up their recruiting of DevOps skills. close to two-thirds, 65%, reported having difficulties with finding these combinations of skills. The DevOps journey is still very difficult for more than 50% of respondents. "DevOps is a fundamental change in the traditional structure of IT. It not only represents the adoption of new technology, but also an organizational transformation challenge with all that it implies with the 'evangelization of the existing responsibility silos.

The Anatomy of a Microservice, One Service, Multiple Servers

In addition to supporting multiple transport mechanisms that can improve performance and efficiency, when providing more than one API Server, there’s an architectural benefit. That is helping to enforce separation of concerns. While the high-level architecture diagram presented in Microservice Definition and Architecture depicts a clear separation of concerns, like any other development effort, implementing this pattern does require diligence. In a previous article in this series, I stated that I believe developers have the best intentions in mind. Of course, there are exceptions, but individuals do want to do a good job. The problem comes in when deadlines loom. Things start to get thrown off the back of the truck. Shortcuts are taken. Non-functional requirements such as metrics gathering and reporting are missed. The more an architecture helps guide a team, the less likely these things will happen. Specifically, in the case of having two API Servers, business logic remains where it’s supposed to remain: in the business service.

---

Quote for the day:

"Leadership is the other side of the coin of loneliness, and he who is a leader must always act alone. And acting alone, accept everything alone." -- Ferdinand Marcos

---

Daily Tech Digest - March 21, 2020

Cisco moves WiFi roaming technology to wireless broadband consortium

With OpenRoaming, device users can employ methods such as Samsung ID, their mobile SIM card, or their cloud provider to sign into OpenRoaming once, granting them seamless access to participating wireless networks around the world, according to Cisco. In addition, OpenRoaming brings together a federation of trusted identity providers, to automatically allow users to join any network managed by an OpenRoaming federation member. The membership include service providers, device manufacturers, cloud ID, or even loyalty memberships. Boingo Wireless, GlobalReach Technology, Intel, Korea Telekom, and others have pledged support for OpenRoaming. “There is considerable pull from the industry and our customers, both enterprise and service provider, to automate secure onboarding across multiple verticals,” wrote Matt MacPherson, Cisco’s Wireless CTO in a blog about the transfer. WBA’s global ecosystem can integrate OpenRoaming into its technologies, regardless of equipment provider. He says that OpenRoaming supports seamless, secure roaming that can iprove Wi-Fi service in general.

Completely Free Machine Learning Reading List

There are many free online courses for learning data science and machine learning available. I previously covered a list of my top five in this article. However, books can be a really useful tool for learning the detail and theory behind these subjects. Fortunately, if you look hard enough you will find that there are a wealth of completely free books online that cover the majority of topics and concepts that you need to learn. ... "Think Stats" by Allen B. Downey can be read online or downloaded as a pdf here. It covers many of the core statistical concepts for data science including data analysis, distributions and probability. It also leans heavily towards coded examples written in python rather than mathematical equations, which I think makes it easier to digest for those without advanced maths degrees. ... "Bayesian Methods for Hackers: Probabilistic Programming for Bayesian Inference" by Cameron Davidson-Pilon attempts to bridge the gap between theoretical Bayesian machine learning methods and their practical application in probabilistic programming. It provides a really good introduction to Bayesian inference with a practical first approach.

60% of Security Pros Trust Cyberthreat Detections Verified by Humans over AI

According to research findings, based on the responses of 102 professionals in the cybersecurity industry, 45% of respondents opined that their companies lack a sufficiently staffed cybersecurity team. Over 70% of respondents agreed that AI-based tools made their security teams more efficient by eliminating over 55% of everyday security operations. Incorporating AI tools into security operations decreased employees’ stress levels, according to 40% of respondents. And, 65% claim that AI tools allow them to focus on cyberattack mitigation and preventive measures. Despite the advantages AI-based technologies offer, the majority of respondents stressed that there are skills and benefits the human element provides cybersecurity teams that AI and machine learning cannot match. WhiteHat provides services that are required for organizations to secure the entire software lifecycle (SLC) from the development through deployment and operation. Its Application Security Platform technology solutions include Software Composition Analysis (SCA), Static Application Security Testing (SAST), and Dynamic Application Security Testing (DAST).

How artificial intelligence is changing the game for banks

“Natural language processing will dramatically change the way we will operate. There is a tremendous amount of hidden knowledge locked away at a bank — we’re sitting on a goldmine. This will give us a way to access it,” he says. “We will be able to make faster, better decisions on everything from mortgages to calculating how much collateral the bank holds.” Legrand’s mention of collateral begs a big question: would AI — with all its better, faster ways of handling data — have been able to sound an early alarm on a big systemic problem like the financial crisis? Liu, for all his ambition, baulks at making quite such a big claim. “I don’t think it would avert a crisis because there are so many different elements that come into it. But it would help with crisis management. [This technology] can help show you things such as if one part of the bank goes bankrupt, how quickly would that crisis spread.” With the world economy rocked by COVID-19, he adds, banks are again coming under pressure to spot problems with liabilities and non-performing loans as quickly as possible.

Architectural Implications of IoT Data

Due to potential implications for enterprise and our transformation programs, we must plan data collection via IoT sensors carefully. Data sources for IoT solutions can be diverse and complex. As a first design activity, we must determine the type of physical signals to measure. Then, we can identify the number of sensors to be used. We need to calculate speed of signals for these sensors and document in our data acquisition plan. Digital transformation architects need to closely work with the IoT Solution Architects and solution designers to create stringent governance and innovative measures around streaming data collection plans. In addition to the architectural, design, and innovation challenges of massive data, application usage patterns are also essential factors for the performance of IoT solutions particularly in the enterprise modernisation and digital transformation initiatives. For example, minute details such as the processors and memory of the servers hosting the IoT applications matter and must be considered carefully using benchmarks. By using benchmarks for application, data, and infrastructure, we can create an exclusive IoT performance model and a set of test strategies to use in our digital transformation solutions.

Singapore introduces contact tracing app to slow coronavirus spread

The mobile app can plug the gaps and more quickly identify potential carriers, who then can monitor their health and take the necessary action sooner. Early detection is crucial in slowing down the spread of the coronavirus, according to the government agency. To safeguard personal privacy, it added that users would have to provide consent during the initial setup of the app to participate in TraceTogether and agree to have their mobile number and captured data used for contact tracing. GovTech said only the user's mobile phone was required during the installation, and no other data such as name, location, contact list, or address book would be collected. Data logs were stored locally on the mobile phone and contained only cryptographically generated temporary IDs. The data logs would be extracted only when needed by the authorities for contact tracing, it said.  TraceTogether is available for download via Google Play and Apple App Store.

Intel trains neuromorphic chip to detect 10 different odors

Nabil Imam, a neuromorphic computing lab senior research scientist at Intel, believes the research will pave the way for neuromorphic systems that can diagnose diseases, detect weapons and explosives, find narcotics, and spot signs of smoke and carbon monoxide “We are developing neural algorithms on Loihi that mimic what happens in your brain when you smell something,” he said in a statement. “This work is a prime example of contemporary research at the crossroads of neuroscience and artificial intelligence and demonstrates Loihi’s potential to provide important sensing capabilities that could benefit various industries.” Neuromorphic engineering, also known as neuromorphic computing, describes the use of circuits that mimic the nervous system’s neuro-biological architectures. Researchers at Intel, IBM, HP, MIT, Purdue, Stanford, and others hope to leverage it to develop a supercomputer a thousand times more powerful than any today. ... According to Intel, Loihi processes information up to 1,000 times faster and 10,000 more efficiently than traditional processors, and it can solve certain types of optimization problems with more than three orders of magnitude gains in speed and energy efficiency.

Auto ML and the future of self-managing networks with Dr. Behnaz Arzani

Things like video analytics, like natural language processing, things like that are always needed, not necessarily something for networking. So my friend and I, Bita Rouhani from Doug Burger’s group, started to look at well, what happens if you just dump networking data into these systems? Like, just let’s see how well they do. And they did it abysmally bad. The state-of-the-art was like terrible. And so we looked at it and said okay, why is that the case? And what we found was that, well, there’s simple domain customizations that we could do, even on the input. Not anything to the machine learning, but just how we present the data that would significantly boost their accuracy. And so the idea was well, actually, operators are really good at that part. Like they really know their data. They really know things about the data that the auto ML frameworks don’t know. So is there a way to bridge this gap? Is there a way to provide that domain knowledge without him knowing anything about ML?

The Two Trends that Will Shape the Future of ITSM

The first trend is what I call the primacy of the customer. Essentially, this trend means that organizations are no longer creating value by delivering a mass product to a mass market as efficiently as possible. Instead, differentiating value is created by delivering a differentiated customer experience. Those that positively transform the experience win. This idea also has a few associated buzzwords like the experience economy, mass customization, and the market of one. These catchphrases all relate to this idea, but the big difference is that it’s now becoming the primary driver of organizational value. The second trend is more personal. I call it the primacy of algorithm. Throughout the industrial age, organizations needed workers who could perform work consistently, reliably, and repeatedly. Essentially, they needed robots, so we trained generations of humans to be the robots that would power the literal and figurative machinery of the industrial age. Today, however, we’re on the cusp of an algorithmic tipping point.

Mass move to work from home in coronavirus crisis creates opening for hackers

“People who have never worked from home before are trying to do it and they are trying to do it at scale,” said Wendy Nather, a senior advisor with Cisco’s Duo Security who has spent the past decade working from home for various jobs. She said the sudden transition would mean more scope for mistakes, more strain on information technology staff, and more opportunity for cyber criminals hoping to trick employees into forking over their passwords. Criminals are dressing up password-stealing messages and malicious software as coronavirus-themed alerts, warnings, or apps. Some researchers have found hackers masquerading as the U.S. Centers for Disease Control and Prevention in a bid to break into emails or swindle users out of bitcoin, while others have spotted hackers using a malicious virus-themed app to hijack Android phones. Advanced cyber spies also appear to be exploiting the coronavirus outbreak that has infected tmsnrt.rs/3aIRuz7 more than 210,000 people and killed 8,700 worldwide.

---

Quote for the day:

"The highest proof of virtue is to possess boundless power without abusing it." -- Lord Thomas Macaulay

---

Daily Tech Digest - March 20,2020

How to Spot Disruption Before It Strikes

In this modern age, everything is interconnected, which means that if you’re trying to see the future of one thing — let’s say your field — you really do have to pay attention to developments in adjacent areas to see which connections will catapult change forward into the future. That means you have to pay attention to things like wealth distribution and education. And in both of those cases, we’re talking about who has access to what. Are there groups that are gaining more agency and ability where they live? Are there changes happening to regulations and to permissions? Essentially, this new app was a way to help people make money while they sleep. Gollum got its idea from something that existed in the ’90s and in fact still exists today. In the ’90s, while you were asleep, you could donate the unused compute power of your computer to others — to researchers and academics who needed supercomputing networks but maybe couldn’t afford to get access to one. So instead, there were these distributed networks of computers all around the world where people had donated their unused compute time while they were asleep, for great projects.

Attack Surface, Vulnerabilities Increase as Orgs Respond to COVID-19 Crisis

Predictably, a lot of the activity has involved phishing and social-engineering campaigns where COVID-19 has been used as a thematic lure to get people to click on malicious attachments and links in emails or to download malware on mobile and other devices. There have also been reports about account takeover and business email compromise activity, a growth in domains serving up drive-by malware, and attempts to exploit virtual private networks (VPNs) and other remote access tools. The danger posed by these threats has been exacerbated by new requirements for "social distancing" and the resulting push by many organizations to widen or implement telework capabilities for their workforce. The sudden COVID-19-related surge in the use of videoconferencing, remote access, and VPN services — especially at organizations that have not used them before — is giving attackers more targets to go after and defenders a lot more terrain to protect.

France warns of new ransomware gang targeting local governments

CERT-FR said it is still investigating how the Pysa gang is gaining access to victim's networks. However, forensics clues left behind paint a picture of what could have happened on some of the infected/ransomed networks. For example, CERT-FR said there was evidence suggesting that the Pysa gang launched brute-force attacks against management consoles and Active Directory accounts. These brute-force attacks were followed by the exfiltration of a company's accounts & passwords database. Victim organizations also reported seeing unauthorized RDP connections to their domain controllers, and the deployment of Batch and PowerShell scripts. Furthermore, the Pysa gang also deployed a version of the PowerShell Empire penetration-testing tool, stopped various antivirus products, and even uninstalled Windows Defender in some instances. CERT-FR says that in at least one case they analyzed, they also found a new version of the Pysa ransomware, which used the .newversion file extension instead of the older .pysa.

How organizations can maintain a third-party risk management program from day one

Third parties certainly are having a lot to do with data breaches these days. You read any study, Deloitte, Ernst & Young, any of the unbiased studies out there, a number of the data breaches are actually coming from third parties and vendors, so that we recognize that you might have your four walls or your firewalls under control, but what you’re doing with other vendors and other folks in your supply chain, certainly puts your data at risk. We think that’s certainly important. A lot of these heavily regulated industries are actually getting audited and examined to understand how they understand the ecosystem of third parties. But we’re also seeing it go down-market. Not just the heavily regulated industries, but other areas and other verticals are starting to really think about how they interact with third parties, what data they’re sharing, and also what kind of value they could get from those third parties. Are they understanding the metrics, the measurements that they measure those vendors on? Are they getting what they paid for? Are they getting the level of performance they expect? And because of that, I think we can optimize a lot of those relationships and help them better understand that ecosystem in which they behave.

7 Spring Cleaning Tasks to Improve Data Security

Begin this year’s spring by reviewing your data assets. Move any sensitive information offline if it doesn’t need to be network-accessible. Keep in mind that any data not in your possession cannot be stolen from you. If you are storing information about other people or organizations and you can’t foresee any possible future use for that data, get rid of it. If you need it, move it to a secure offline facility. For instance, if you are storing credit card CVC codes — which you should not need to — get rid of them. There is no better method of ensuring data security than not having irrelevant data in the first place. Make sure you’re backing up properly and frequently. You should back up often enough that if something were to go severely wrong, you wouldn’t be panicking about lost personal or enterprise data. If you are responsible for ensuring that others back up, make sure that they understand the importance of doing so, and deploy technology that simplifies and automates the backup process. If you aren’t sure whether you’re backing up often enough, you probably are not.

Managing Service-to-Service Communications in the Era of Microservices

Broadly speaking, the data plane "does the work" and is responsible for "conditionally translating, forwarding, and observing every network packet that flows to and from a [network endpoint]." In modern systems, the data plane is typically implemented as a proxy, that is run out-of-process alongside each service as a "sidecar." Klein states that within a service mesh, the data plane "touches every packet/request in the system, and is responsible for service discovery, health checking, routing, load balancing, authentication/authorization, and observability." There is work underway within the CNCF to create a Universal Data Plane API, based on concepts from Klein's earlier blog post The Universal Data Plane API. This proposal extends the xDS API that has been defined and implemented by Envoy and is supported in other proxies such as MOSN. A control plane "supervises the work," and takes all the individual instances of the data plane — a set of isolated stateless sidecar proxies—and turns them into a distributed system.

Everything you need to connect with your teammates and be more productive

In the face of COVID-19, there are countless stories from customers who are using Teams to connect and thrive in inspiring ways. A professor at University of Bologna in Italy shared on Twitter how the school moved 90 percent of courses online to Teams within four days, which is definitely a first in the university’s 900-plus year history. Doctors at St. Luke’s University Health Network in Pennsylvania will use Teams for videoconferencing with patients, especially those who are most vulnerable to coronavirus, as a way to protect both patients and healthcare providers. And the City of Osaka in Japan is using Teams to conduct orientations and trainings for hundreds of new incoming employees in April. Stories like these are playing out in countries the world over. We believe that this sudden, globe-spanning move to remote work will be a turning point in how we work and learn. Already, we are seeing how solutions that enable remote work and learning across chat, video, and file collaboration have become central to the way we work.

3 Technologies That Can Ease the M&A Process

Robotic process automation (RPA) is a form of business process optimization that automates tasks using software robots, or digital workers. RPA can play a major role in automating repetitive and manual data-related tasks, freeing up employees for higher-value work. During mergers and acquisitions, employees have new systems and processes to adjust to, within a limited time frame and staff may not have learned the skills required to complete these tasks efficiently. RPA can help to ease this process by using artificial intelligence workers to help with data entry, data mapping, data extraction and moving data into multiple systems, which is critical for systems consolidation after a merger or acquisition. ... While custom point-to-point integration can help companies reach a short-term goal, it drastically complicates matters in the long run when integrating multiple companies’ subsystems and data centers. Fortunately, there are a variety of off-the-shelf alternatives that can create connectivity across a company’s entire business ecosystem, without needing complex custom code.

Security Ratings Are a Dangerous Fantasy

Why are security ratings so bad? For starters, the data is terrible. The quality of security ratings is contingent on the quality of the underlying data and the science with which this data is interpreted. Unfortunately, the cybersecurity ratings industry has nowhere close to the depth and breadth of data of other ratings sectors. Security ratings companies do not have accurate network maps, and ratings are regularly deflated due to misattribution or improper understanding of network configurations. Security ratings companies typically use incomplete third-party data and do not communicate caveats or error estimates to their customers. By the time you read them, security ratings are already out of date, because the data is not quickly refreshed and refresh timestamps aren't clearly communicated. Another challenge is that ratings aren't scientific or statistically relevant. Given those problems, vendors committed to a ratings product have no choice but to hack their way to a partial solution.

Beware Of AI Assisted Ransomware

The AI component of Ransomware does some clever stuff like conceal the conditions needed to unlock the files as well as deploy untraceable malicious applications, but it doesn’t stop here. Just like businesses use AI for language learning, so too can the malware be trained to recognise types of content and be on the lookout for specific words as well as listen to voice prompts. Face recognition log in is popular now too so of course, the smart malware can be trained to recognise images. Cybercriminals are also using advanced image APIs for face recognition on webcams, and security cameras. Hackers get a lot of personal information or data from the dark corners of the Internet, aka ‘dark web’. For example, where you shop online or do your personal banking data can be stolen, and it often ends up on the dark web where it is traded to hackers who can use it in their malware. Open source tools are also the target of hackers where they can be used to compromise website, servers and cloud infrastructure. So with the influx of smart hacking, what can we do to protect data and devices, so we’re not a victim of a malicious cyber attack?

---

Quote for the day:

"If You only have a hammer everything looks like a nail." -- Abraham Maslow

---

Daily Tech Digest - March 19, 2020

Microsoft: .NET 5 preview for Windows 10, iPhone, Android Surface Duo apps is out

Ahead of the final version of .NET 5, Microsoft has a clear message for developers: ".NET Core and then .NET 5 is the .NET you should build all your NEW applications with."  "Having a version 5 that is higher than both .NET Core and .NET Framework also makes it clear that .NET 5 is the future of .NET, which is a single unified platform for building any type of application," said Scott Hunter, director of program management at Microsoft .NET.  The first preview includes support for Windows Arm64 and the .NET Core runtime, while the second preview will include an SDK with ASP .NET Core but not WPF or Windows Forms, which should arrive in a subsequent preview.  The preview should allow developers to update existing projects by updating the target framework.  The main goals for .NET include providing a unified .NET SDK with a single Base Class Library (BCL) across all .NET 5 applications, with Xamarin moving to the .NET core BCL. Since Xamarin is integrated into .NET 5 the .NET SDK will support mobile. Microsoft's ongoing work on Blazor should also mean web application support across platforms, including browsers, on mobile devices and as a native desktop application for Windows 10 and Windows 10X.

IR35 reform delay: how tech companies and contractors should respond

Paul Wright, head of the technology practice, Odgers Interim has some very important advice on how companies should respond to the regulatory respite- revoke any blanket bans on contractors. He says “businesses have now been given some breathing room to get their houses in order and I cannot stress enough how important it is for them to take this time to revoke any blanket assessment statues they have enforced and re-evaluate their contingent workforce needs. “As the impact of Covid-19 steers the economy into unchartered waters, the UK’s freelance, independent and contractor workforces will be more important than ever for tech firms – which already rely heavily on this industry.” Wright also sees contractors and freelancers as the solution to absences in the permanent workforce cause by Covid-19. “Many organisations will not only need to procure the specialist skillsets of contractors and independents to help guide them through increasing levels of disruption but will also need to call upon their support to fill in for permanent staff who are either self-isolating or having to look after family members.

Data Governance: How to Tackle 3 Key Issues

Some security practitioners argue that larger organizations should designate different accountable parties for protecting the privacy of customer, product and financial data - or even designate those in charge in each region. But organizations need someone at the top of the chain, such as a chief data officer, so that federated ownership can be kept in check, Deb says. Deb has also implemented a RACI - responsible, accountable, consulted and informed - matrix that helps him assign data owners. "So respective business units or their heads own the data and the accountability," he says. "For instance, IT is the data custodian, assurance functions are the data governors and so on. That way, an entire RACI matrix is built for every application, platform and data we process internally." One of the major roadblocks in the data governance process is the problem of shadow IT, Deb says. Shadow IT is where development happens either in-house or through an outsourced partner without the supervision and governance of the IT InfoSec and privacy teams.

9 Cybersecurity Takeaways as COVID-19 Outbreak Grows

Security experts cite phishing attacks as being one of the biggest threats in this new environment, and warn that existing efforts to safeguard employees are too often inadequate. "Phishing attacks are on the rise, and employees at home might be especially vulnerable," attorneys Jonathan Armstrong and André Bywater say in a client note. "We've expressed concerns before that a lot of 'off-the-shelf' phishing training is not fit for purpose. It's important to make sure employees are trained and that they have regular reminders. Organizations using [Office 365] may be especially vulnerable at this time." To help, many organizations are releasing materials for free. For example, the SANS Institute has released large parts of its commercial awareness materials. But with phishing attacks that prey on coronavirus fears already surging, many organizations are playing catchup. "Like many phishing scams, these emails are preying on real-world concerns to try and trick people into doing the wrong thing," the U.K.'s National Cyber Security Center says, noting that shipping, transport and retail industries were being targeted.

Reasons For Transitioning To Cloud Computing In 2020

Cloud computing has now become a common term that all of us have heard of. However, unfortunately, many of us still don’t understand the complete potential of cloud computing. It is high time for all us to understand how it can make our lives easier. Instead of storing data on a computer or hard drive, cloud computing stores programs and data over the internet. In other words, in order to access your data, you must be connected to the internet. In fact, many of us already use cloud computing unknowingly, while listening to our favorite tunes on Spotify or using Google Drive for data storage.  The flexibility and functionality of cloud computing have already proven to be a lifesaver for businesses. However, cloud computing for a business is entirely different from the personal use of the cloud. Before the implementation of cloud computing, businesses need to choose between Software-as-a-Service (SaaS), Platform-as-a-Service (or PaaS), or Infrastructure-as-a-Service (IaaS). In a nutshell, PaaS allows users the freedom to come up with customized applications as per their requirements. On the other hand, SaaS requires users to subscribe to a chosen application.

IT Priorities 2020: Digitisation drives IT modernisation growth

Opening up APIs, with access controlled via an API management platform, is one of the ways IT departments can minimise the effort needed to modernise applications. The survey reported that 47% of IT professionals said they planned to increase the use of cloud infrastructure to support digital transformation initiatives in 2020. Applications can be replatformed from on-premise servers to public cloud-hosted infrastructure-as-a-service (IaaS) platforms. In fact, 38% of the respondents said they would increase their cloud budgets in 2020. This potentially shifts spending from a capital expenditure model for on-premise datacentre hardware to pay-as-you-go in the public cloud. Many of the legacy applications that are migrated to the cloud can only run in virtual machines (VMs). VMs in the public cloud replace physical servers or on-premise VMs. But as organisations move along their journey to become cloud-native, in some instances, IT professionals are looking at splitting legacy code into functional building blocks.

AI adoption in the enterprise 2020

AI adoption is proceeding apace. Most companies that were evaluating or experimenting with AI are now using it in production deployments. It’s still early, but companies need to do more to put their AI efforts on solid ground. Whether it’s controlling for common risk factors—bias in model development, missing or poorly conditioned data, the tendency of models to degrade in production—or instantiating formal processes to promote data governance, adopters will have their work cut out for them as they work to establish reliable AI production lines. Survey respondents represent 25 different industries, with “Software” (~17%) as the largest distinct vertical. The sample is far from tech-laden, however: the only other explicit technology category—“Computers, Electronics, & Hardware”—accounts for less than 7% of the sample. The “Other” category (~22%) comprises 12 separate industries. One-sixth of respondents identify as data scientists, but executives—i.e., directors, vice presidents, and CxOs—account for about 26% of the sample. The survey does have a data-laden tilt, however: almost 30% of respondents identify as data scientists, data engineers, AIOps engineers, or as people who manage them.

Electronics should sweat to cool down, say researchers

Computing devices should sweat when they get too hot, say scientists at Shanghai Jiao Tong University in China, where they have developed a materials application they claim will cool down devices more efficiently and in smaller form-factors than existing fans. It’s “a coating for electronics that releases water vapor to dissipate heat from running devices,” the team explain in a news release. “Mammals sweat to regulate body temperature,” so should electronics, they believe. The group’s focus has been on studying porous materials that can absorb moisture from the environment and then release water vapor when warmed. MIL-101(Cr) checks the boxes, they say. The material is a metal organic framework, or MOF, which is a sorbent, a material that stores large amounts of water. The higher the water capacity one has, the greater the dissipation of heat when it's warmed. MOF projects have been attempted before. “Researchers have tried to use MOFs to extract water from the desert air,” says refrigeration-engineering scientist Ruzhu Wang, who is senior author of a paper on the university’s work that has just been published in Joule.

Silverlight Reborn? Check Out 'C#/XAML for HTML5'

Now ... comes C#/XAML for HTML5 from Userware, which today announced its Silverlight-replacement project, also called CSHTML5, has reached release candidate status after a lengthy beta program. The tool comes as a Visual Studio extension in the Visual Studio Marketplace, promising to create HTML5 apps using only C# and XAML -- or migrate existing Silverlight apps to the Web. "Developers are now able to use C# and XAML to write apps that run in the browser," the French company said. "Absolutely no knowledge of HTML5 or JavaScript is required to use the extension, as it compiles your files to HTML5 and JavaScript for you. That means you can now build Web apps with static typing and all the strengths of C# and XAML, and make sure your code is ready when WebAssembly comes out." WebAssembly is upcoming experimental technology presented as an open standard that lets developers write low-level assembly-like code for the browser in non-JavaScript languages like C, C++ and even .NET languages like C# for improved performance over JavaScript. Until WebAssembly fully supported in the Web ecosystem, CSHTML5 might be seen as an alternative for .NET-centric developers.

More Business Websites Hit by Credit-card Skimming Malware

A malicious script planted on the NutriBullet website's payment page stole credit card numbers, expiry dates, CVV codes, names, and addresses of unsuspecting blender buyers and sent it to a server under the control of cybercriminals. According to the report, the sensitive data was then sold to other criminals on underground forums. RiskIQ says that although NutriBullet has attempted to clean up the poisoned webpages, the attackers continue to break back in and plant malicious code - suggesting that the attackers continue to exploit a way of compromising the blender maker's infrastructure. Peter Huh, the CIO of NutriBullet, confirmed that a security breach had occurred and said that a forensic investigation into the incident had been initiated. There is no word yet as to what plans NutriBullet has to inform affected customers. In both cases it feels like the companies at the centre of the security breaches should be responding more transparently with their users, ensuring that they are informed promptly and given as much detail as possible about what has occurred.

---

Quote for the day:

"Leaders must encourage their organizations to dance to forms of music yet to be heard." -- Warren G. Bennis

---

Daily Tech Digest - March 17, 2020

How Biometric Identity Will Drive Personal Security In Smart Cities

While smart cities can offer unprecedented levels of convenience to improve our everyday lives they also rely on vast networks of data, including personal customer information to predict our preferences. This has led to concerns around the high levels of data used and stored by smart systems, and the security provided to our digital identity. We know that existing personal and unique identifiers, such as passwords and PINs are no longer secure enough to protect our systems, and this is even more important in hyper-connected cities as, once a city becomes ‘smart’ the inter-connected networks widen, and the potential for cyberattacks or data breaches grows. So as this trend continues, how can we develop smart cities that are both convenient and secure? To resolve this, providers of smart city networks need to establish a chain of trust in their technology. This is a process common in cybersecurity, where each component in a network is validated by a secure root. In wide connected networks, this is vital to protect sensitive personal or business data and ensure consumer trust in the whole system.

Coronavirus challenges remote networking

The security of home Wi-Fi networks is also an issue, Nolle said. IT pros should require workers to submit screenshots of their Wi-Fi configurations in order to validate the encryption being used. "Home workers often bypass a lot of the security built into enterprise locations," he said. Education of new home workers is also important, said Andrew Wertkin, chief strategy officer with DNS software company BlueCat. "There will be remote workers who have not substantially worked from home before, and may or may not understand the implications to security," Wertkin said. "This is especially problematic if the users are accessing the network via personal home devices versus corporate devices." An unexpected increase in remote corporate users using a VPN can also introduce cost challenges. "VPN appliances are expensive, and moving to virtualized environments in the cloud often can turn out to be expensive when you take into account compute cost and per-seat cost," Farmer said. A significant increase in per-seat VPN licenses have likely not been budgeted for.

Implementing CQRS Pattern with Vue.js & ASP.NET Core MVC

If you’re a software professional, then you’re familiar with the Software enhancement and maintenance work. This is the part of software development life cycle; so that, you can correct the faults, delete/ enhance the existing features. The software maintenance cost can be minimized if you use software architectural pattern, choosing right technologies and be aware of the industry trends for the future, consider resource reliability/availability for now and future, use design pattern/principle in your code, re-use your code and keep open your option for future extension, etc. Anyway, if you use any known software architectural pattern in your application, then it will be easy for others to understand the structure/component design of your application. I’ll explain a sample project implementation according to the CQRS pattern using MediatR in ASP.NET Core MVC with vue.js. ... The main goal of this project is to explain the CQRS architectural pattern. I’m plaining to implement a tiny Single-Page-Application (SPA) project. The choice of the technology is important, and you should choose it according to your requirements.

What does 'network on demand' mean for enterprises?

Network on demand -- or on-demand networking -- can be delivered as either a managed network service or as cloud-based networking. In a managed network service model, a third party manages, meters and bills the infrastructure. In a cloud-based networking model, a business contracts directly with the cloud provider and makes all the decisions about its network. In either model, on-demand networking changes the dynamics from a Capex model in which customers pay upfront and amortize to a consumption-based model where users pay monthly for what they consume. Network on-demand options can be more flexible, enabling businesses to scale their network bandwidth and provision up and down to match business needs. In the on-demand world, burdens shift toward more planning and monitoring of service-level agreements and consumption versus hardware and traffic. The most logical customers for on-demand managed networking services are smaller businesses that don't have the internal resources to adequately handle networking.

Data is your best defence against a coronavirus downturn

Remember, good information in its many forms, including analytics, insights, predictions, diagnoses, prescriptions, and so forth, often is a lower-cost substitute for inventory, property and even money. Uber and Lyft for example have substituted information about who needs a ride and who has a car for fleets of taxis. Airbnb and HomeAway have done the same for bedrooms. Even most traditional retailers and manufacturers have been able to reduce their inventory levels, some to just-in-time inventory, based on detailed, near real-time supply and demand information. Moreover, more than 30% of companies today exchange information they collect or generate in return for goods and services from others. And this merely represents one of several ways to monetize your data. Investors themselves even seem to favor organisations that make significant investments in data and analytics. Public companies with chief data officers, data governance programs, and data science organizations command a nearly 2x market-to-book valuation over the rest of the market.

Needed: A Cybersecurity Good Samaritan Law

As the US becomes more sophisticated in protecting the digital world, physical systems are becoming a target — one with an attack surface that's relatively easy to penetrate. Gaining physical access is one of the easiest ways to hack into a network. This could include accessing paper records, installing equipment or software on the network, or simply putting in covert backdoor systems. The concept of combining physical attacks and cyberattacks to test a system is nothing new. The term "red teaming" is used in the industry to describe a method of system testing based on thinking and acting like a bad guy. Red teams help businesses to see how break-ins and business disruptions occur, to test strength and durability of their defenses, to identify where vulnerabilities exist, and to expose weaknesses that could be considered negligent and contributing to a breach. The risks of conducting red teaming increase as more bad guys hide themselves in cyberspace. Law enforcement and the legal system have the power to interpret the legality of our work.

CIO interview: Malcolm Lowe, head of IT, Transport for Greater Manchester

“The organisation has a lot of data and information,” he says. “It was in lots of pockets; people were using all sorts of different tools and techniques. We recognised there was a great opportunity for the organisation to really embrace analytics.” Lowe says his initial efforts were focused on getting people from across the organisation to understand what opportunities data might provide. He focused on showing business stakeholders what he calls “the art of the possible” through a proof of concept. “We had some spare capacity, we had some spare licences and we got a couple of data engineers to create an alpha,” he says. “I’ve got some bright people in my team. I tasked them to get as much data as they could from across the organisation for a single month. We put that data into an Azure SQL Server Data Warehouse and put Power BI over the top of it. “We found a couple of use cases across the organisation for people who were really interested in our ideas. We built something for them, they got to use it and they really liked it. I’m a big believer in people seeing something tangible...."

What is natural language processing? The business benefits of NLP explained

Natural language processing (NLP) is the branch of artificial intelligence (AI) that deals with communication: How can a computer be programmed to understand, process, and generate language just like a person? While the term originally referred to a system’s ability to read, it’s since become a colloquialism for all computational linguistics. Subcategories include natural language generation (NLG) — a computer’s ability to create communication of its own — and natural language understanding (NLU) — the ability to understand slang, mispronunciations, misspellings, and other variants in language. ... Machine translation is one of the better NLP applications, but it’s not the most commonly used. Search is. Every time you look something up in Google or Bing, you're feeding data into the system. When you click on a search result, the system sees this as confirmation that the results it has found are right and uses this information to better search in the future. Chatbots work the same way: They integrate with Slack, Microsoft Messenger, and other chat programs where they read the language you use, then turn on when you type in a trigger phrase. Voice assistants such as Siri and Alexa also kick into gear when they hear phrases like “Hey, Alexa.”

Keeping machine learning algorithms humble and honest in the ‘ethics-first’ era

Removing the complexity of the data science procedure will help users discover and address bias faster – and better understand the expected accuracy and outcomes of deploying a particular model. Machine learning tools with built-in explainability allow users to demonstrate the reasoning behind applying ML to a tackle a specific problem, and ultimately justify the outcome. First steps towards this explainability would be features in the ML tool to enable the visual inspection of data – with the platform alerting users to potential bias during preparation – and metrics on model accuracy and health, including the ability to visualise what the model is doing. Beyond this, ML platforms can take transparency further by introducing full user visibility, tracking each step through a consistent audit trail. This records how and when data sets have been imported, prepared and manipulated during the data science process. It also helps ensure compliance with national and industry regulations – such as the European Union’s GDPR ‘right to explanation’ clause – and helps effectively demonstrate transparency to consumers.

Decipher the true meaning of cloud native

The definition of cloud native has become more confusing as organizations and IT professionals incorporate it into their everyday usage, despite defining the term in different ways. The most oft-cited definition is the murky CNCF definition that was introduced in 2018. That cloud native definition mostly reiterates the points that the CNCF made when it launched in 2015, though it does emphasize some concepts not included at the CNCF launch, such as automation, observability and resiliency. Still, the current CNCF definition doesn't explain exactly what counts as cloud native and what doesn't. That is, unless you think any type of application that uses containers and microservices or relies on automation or resiliency counts as cloud native. ... At a high level, certain technologies, like containers and microservices, form an important part of what many people consider to be cloud native. Yet, there is virtually no specific guidance from any organization regarding how, exactly, these technologies need to be used in order for an app to meet the requirements of the cloud native definition.

---

Quote for the day:

"What great leaders have in common is that each truly knows his or her strengths - and can call on the right strength at the right time." -- Tom Rath

---

Daily Tech Digest - March 16, 2020

How Machine Learning, A.I. Might Change Education

One area in which A.I. intersects with student learning is in ethics. Some studies are already exploring the ethical issues of replacing teachers with bots. However, although bots can enhance education, they can’t replace teachers, according to Bernhardt L. Trout, professor of chemical engineering and director of Society, Engineering, and Ethics at the Massachusetts Institute of Technology. Trout argues that A.I. can enrich the learning of students as they master skills, languages and basic math, but it can’t help students learn creativity or critical thinking. “Bots will not be able to decide for us what is good, although they might be able to help us learn better the issues around the decision of what is good,” he said. “Bots are limited in making certain choices about education in ways that human beings are not limited, so this is where we get into the more ethical issues.” Trout sees bots teaching themes or the usage of certain words, for example, but they may be limited in helping students critique literature. He believes a bot is unable to teach the essential concepts needed to understand the work of philosophers such as Plato or Dante, or painters such as Michelangelo: “That’s where I think there is an intrinsic limitation.”

Rethinking change control in software engineering

When organizations mandate that their ops teams focus solely on stability, change control can quickly become change prevention, much to the chagrin of development teams that are mandated to continuously update and deliver new features. With DevOps now inverting the traditional IT delivery model, the question becomes: Can change control still work in the way it was intended? It's likely that small, software-focused organizations running in the cloud won't use the term change control. They may just execute deployments when it makes sense, especially if the team doesn't yet charge for their services, or they have a way to turn a new service on for only a limited number of users. On the other end, large organizations that still run COBOL tend to use monolithic ticketing systems to manage permissions and change approvals. However, most teams probably find themselves somewhere in the middle of these two extremes, leaving them in a place where they need to find a realistic balance between both the resiliency and flexibility of feature deployments.

What is the internet backbone and how it works

Like any other network, the internet consists of access links that move traffic to high-bandwidth routers that move traffic from its source over the best available path toward its destination. This core is made up of individual high-speed fiber-optic networks that peer with each other to create the internet backbone. The individual core networks are privately owned by Tier 1 internet service providers (ISP), giant carriers whose networks are tied together. These providers include AT&T, CenturyLink, Cogent Communications, Deutsche Telekom, Global Telecom and Technology (GTT), NTT Communications, Sprint, Tata Communications, Telecom Italia Sparkle, Telia Carrier, and Verizon. By joining these long-haul networks together, Tier 1 ISPs create a single worldwide network that gives all of them access to the entire internet routing table so they can efficiently deliver traffic to its destination through a hierarchy of progressively more local ISPs. In addition to being physically connected, these backbone providers are held together by a shared network protocol, TCP/IP. They are actually two protocols, transport control protocol and internet protocol that set up connections between computers, insuring that the connections are reliable and formating messages into packets.

Working from home: Your common challenges and how to tackle them

Interruptions come from outside, like a knock at the door from a delivery driver asking you to take in a parcel for a neighbour. Other potential interruptions; family and pets and friends who fail to understand that just because you are at home, you are still working. Closed doors, do not disturb signs and noise-cancelling headphones all come in handy. More working from home tips here. Distractions are slightly different. These are mostly the result of being in a different environment to the one which you are used to, and that means habits are disrupted and priorities get muddled. In the office your priorities are (mostly) well defined – you're there to work. At home your priorities are different; having fun, cooking, eating, cleaning, watching TV – almost by definition everything not work related. Bringing work into the home, especially if it's for the first time, especially now, confuses all of this. It also makes you think you can combine the two, which is why you'll try to wash the dishes while on a conference call (and yes, everyone will know). Here the solution is around building a new work routine so that focusing is easier. That's why every set of remote working tips talks about getting up and getting dressed, and attempting to work regular hours.

Telehealth and Coronavirus: Privacy, Security Concerns

Keith Fricke, principal consultant at tw-Security, notes that it's critical for healthcare entities to take a number of critical security measures when using telemedicine applications. That includes ensuring the transmission of information over the internet is encrypted and making sure that the endpoints where telehealth transmissions begin and end are secured, he notes. "I don't think these risks are heightened by the coronavirus," he says. "However, a rush to establish new telehealth applications or a rush to expand existing ones to meet demands driven by COVID-19 can lead to overlooking important controls necessary to maintain security and privacy of information. "As with any technology deployment involving the storage, processing or transmission of PHI or other confidential information, it is important to implement telehealth services with the appropriate technical, physical and administrative controls." As the use of telemedicine expands in dealing with the outbreak, new risks will also evolve, Fricke adds.

When Will 100% Remote Be an Accepted Norm?

Picture yourself graduating from college in the 1980s or 1990s, ready to change the world with your college degree and your freshly polished programming skills. Depending on the year you started working in the industry, you might have to share a terminal to write the program code required to complete your job. The idea of having a computer at your desk wasn't a reality. For those starting a little later, you might have a computer at your desk, but it is merely a client to a host system housing your program logic and processing power. The system you programmed on was in near proximity to you. Later, that idea was broken into an application server and some type of data store or database. There wasn't a cloud option to host your system, but some did have custom connectivity to align data centers across private corporate networks. Remember, the internet wasn't a "thing" we could rely on, yet. There was a fleet of programmers who grew up in this reality. 

What is the difference between SIT and UAT?

With user acceptance testing, the development organization gives the build or release to the target consumer of the system, late in the software development lifecycle. Either the end users or that organization's product development team perform expected activities to confirm or accept the system as viable. The UAT phase is typically one of the final steps in an overall software development project. ... Testers who evaluate functionality as it's delivered are usually prepared to also check application functionality as a whole, integrated solution. SIT is often a more technical testing process than UAT. Testers design and execute SIT, as they've become familiar with the types of defects common in the application throughout the SDLC. The SIT phase precedes UAT. Because the technical expertise between users and testers varies significantly, the two demographics are likely to find vastly different defects between UAT and SIT. SIT often uncovers bugs unit tests didn't catch -- defects that rely on a workflow or interaction between two application components, such as a sequential order of operations.

How Red Hat tackles security

In the just-released Red Hat Product Security Report 2019, Red Hat said it's seeing more customers than ever trying to grapple with ever-mounting security issues by using third-party scanners. But, he said, "While scanning tools can provide a useful 'single pane of glass' view of vulnerabilities across an enterprise-wide environment, they generally do a poor job of articulating risks specific to a technology or implementation." So, Red Hat Engineering and Red Hat Product Security both explain exactly what's what with security issues and making Red Hat's "upstream packages enterprise-ready by regression testing, hardening, and tweaking the package to meet our customers' unique business demands and our release standards." To help improve this process, Red Hat made a fairly sizable change to Red Hat Enterprise Linux (RHEL) support life cycle. Because "RHEL is the foundation of all of our products and services, we felt it was important to expand the scope of what we supported."  So, RHEL now includes patches and fixes for Important-rated issues, which typically cover the largest share of issues. Previously, Red Hat was more selective about which Important-rated issues were addressed in RHEL's Extended Update Support.

Banks are adopting account aggregator framework on data

Account aggregators are responsible for transferring, but not storing, client data. An AA ecosystem, as envisaged by the Reserve Bank of India (RBI), would be a platform for financial services companies to reach out to the consumer to seek consent before using their personal data to optimise their product offerings. "All the work is going in that direction. We are coordinating between the ecosystems. The scale-up will see a hockey stick effect. These banks and AA companies are part of the first wave. Many are waiting to join the second wave," said BG Mahesh, a cofounder of Sahamati, a non-profit collective of account aggregators. So far, Cams Finserv, FinSec AA Solutions and Cookiejar Technologies have received operating licences from the Reserve Bank of India. Kotak Mahindra Group said it was launching a pilot among 50,000 employees to test use cases for the AA framework in banking, broking, wealth management, and insurance. "As we speak we are launching a pilot with our employees before we launch it for our customers.

Making Your Code Faster by Taming Branches

Most software code contains conditional branches. In code, they appear in if-then-else clauses, loops, and switch-case constructs. When encountering a conditional branch, the processor checks a condition and may jump to a new code path, if the branch is taken, or continue with the following instructions. Unfortunately, the processor may only know whether a jump is necessary after executing all instructions before the jump. For better performance, modern processors predict the branch and execute the following instructions speculatively. It is a powerful optimization. There are some limitations to speculative execution, however. For example, the processor must discard the work done after the misprediction and start anew when the branch is mispredicted. Thankfully, processors are good at recognizing patterns and avoiding mispredictions, when possible. Nevertheless, some branches are intrinsically hard to predict and they may cause a performance bottleneck. Programmers can be misled into underestimating the cost of branch mispredictions when benchmarking code with synthetic data that is either too short or too predictable.

---

Quote for the day:

"You can't lead anyone else further than you have gone yourself." -- Gene Mauch

---