Daily Tech Digest - March 23, 2020

You Need to Know SQL Temporary Table

We have been warned to NOT write any business logic in databases using triggers, stored procedures, and so on. It doesn’t mean we don’t need to know database systems. Being competent in database systems could save us a lot of work. For example, managers or customers often send us an email or a short notice asking for some one-off reports. Then we need to quickly log into the database servers and generate reports with either a list of parameters or a CSV file from requesters. ... There are two types of temporary tables: local and global temporary tables. Both of them share similar behaviors, except that the global temporary tables are visible across sessions. Moreover, the two types of temporary tables have different naming rules: local temporary tables should have names that start with a hash symbol (#); while the names of global temporary tables should start with two hash symbols (##). All temporary tables are stored in System Databases -> tempdb -> Temporary Tables.

Remote work tests corporate pandemic plans

IT leaders across the country are shifting gears from accommodating short-term remote work strategies for snowstorms, hurricanes and other natural disasters to how to help workers plan for and remain productive in a longer-term remote work environment. Due to the duration of the pandemic, Miami-based ChenMed, an operator of 60 senior health centers in the eastern U.S., intends to offer the small number of 2,500 users who don't have a laptop, such as front desk staff, the opportunity to take home their desktops so they can continue to answer patient calls and conduct other business. "Yes, it creates a lot more complexity in helping users set that up, but we want them to have a great experience versus trying to use an old computer at home," CIO Hernando Celada said. This strategy gives him confidence that the machines will be secure when the time comes for workers to be sent home, which will be at the first sign of community spread of the virus because ChenMed's patient population is the most vulnerable.

Private cloud reimagined as equal partner in multi-cloud world

Forrester's Gardner argues that repatriation is not a broad trend. "It's simply not true," he says. There may be some companies moving a specific application back to the private cloud for performance, regulatory or data gravity reasons, but repatriation is a relatively isolated phenomenon. The latest Gartner thinking on repatriation is in agreement with Gardner. "Contrary to market chatter that customers are abandoning the public cloud, consumption continues to grow as organizations leverage new capabilities to drive transformation. Certain workloads with low affinities to public cloud may be repatriated, largely because the migrations were not sufficiently thought through. But few organizations are wholly abandoning the public cloud at any technology layer," reads a 2019 Gartner report from analysts Brandon Medford, Sid Nag and Mike Dorosh. Warrilow says flatly, "Repatriation in net terms is not happening." He adds that there will always be a small number of workloads that go back to the private cloud as part of an organization's ongoing evaluation of the best landing spot for specific workloads.

What’s New in SQL Monitor 10?

SQL Monitor does the best job it can, out of the box, of setting up a useful core set of metrics and alerts, with sensible thresholds. However, the right alerts and the right thresholds are 100% dependent on your systems. A group or class of servers may all need the same alert types with the same thresholds, but these may well be different from those for other classes of server. Also, your group of VMWare-based servers, for example, may need different thresholds than your bare-metal servers for the same set of memory-related alerts. Configuring all this in the GUI, server-by-server, can be time consuming and it’s easy to introduce discrepancies. This alert configuration task, just like any other SQL Server management or maintenance task should be automated. With the PowerShell API, you now write PowerShell scripts to set up the alerts on a machine in a way that is exactly in accordance with your requirements. You then use that as a model to copy all the settings to other machines, or just groups of machines.

Can APIs be copyrighted?

The law is very clear about copyright. If a programmer writes down some code, the programmer owns the copyright on the work. The programmer may choose to trade that copyright for a paycheck or donate it to an open source project, but the decision is entirely the programmer’s. An API may not be standalone code, but it’s still the hard work of a person. The programmers will make many creative decisions along the way about the best or most graceful way to share their computational bounty. ... APIs are purely functional and the copyright law doesn’t protect the merely functional expressions. If you say “yes” to a flight attendant offering you coffee, you’re not plagiarizing or violating the copyright of the ancient human who coined the word “yes.” You’re just replying in the only way you can. Imagine if some clever car manufacturer copyrighted the steering wheel and the location of the pedals. The car manufacturers have plenty of ways to get creative about fins and paint colors. Do they need to make it impossible to rent or borrow a car without a lesson on how to steer it? The law recognizes that there are good reasons not to allow copyright to control functional expressions.

From Zero to Hero: CISO Edition

With new attacks forming faster than the technologies to fight them, holding CISOs to an entirely unrealistic standard doesn’t actually serve anyone. The truth is that no matter how many technologies are deployed or how good the security posture is, 100% protection from cyberattacks is simply not possible. Perhaps senior leadership and boards of directors are finally starting to acknowledge this fact, or perhaps they're starting to realize that a successful response to an attack, along with actions by other parts of the organization, contribute to the ultimate scale and scope of the event. CISOs are uniquely capable of gauging cyber-risk and how to reduce it. Experienced CISOs understand the threats their companies face and know how to deploy the optimal mix of people, processes, and technologies, weighed against threats, to provide the best possible level of protection. Organizations that understand this are leading the charge in shifting the perception of the CISO from technical manager to strategic risk leader.

Most common cyberattacks we'll see in 2020

By convincingly impersonating legitimate brands, phishing emails can trick unsuspecting users into revealing account credentials, financial information, and other sensitive data. Spear phishing messages are especially crafty, as they target executives, IT staff, and other individuals who may have administrative or high-end privileges. Defending against phishing attacks requires both technology and awareness training. Businesses should adopt email filtering tools such as Proofpoint and the filtering functionality built into Office 365, said Thor Edens, director of Information Security at data analytics firm Babel Street. Business-focused mobile phishing attacks are likely to spread in 2020, according to Jon Oltsik, senior principal analyst for market intelligence firm Enterprise Strategy Group. As such, IT executives should analyze their mobile security as part of their overall strategy. "Spam filters with sandboxing and DNS filtering are also essential security layers because they keep malicious emails from entering the network, and protect the user if they fall for the phishing attempt and end up clicking on a malicious hyperlink," said Greg Miller, owner of IT service provider CMIT Solutions of Orange County.

Las Vegas shores up SecOps with multi-factor authentication

Las Vegas initially rolled out Okta in 2018 to improve the efficiency of its IT help desk. Sherwood estimated the access management system cut down on help desk calls relating to forgotten passwords and password resets by 25%. The help desk also no longer had to manually install new applications for users because of an internal web portal connected to Okta that automatically manages authorization and permissions for self-service downloads. That freed up help desk employees for more strategic SecOps work, which now includes the multi-factor authentication rollout. Another SecOps update slated for this year will add city employees' mobile devices to the Okta identity management system, and an Okta single sign-on service for Las Vegas citizens that use the city's web portal. Residents will get one login for all services under this plan, Sherwood said. "If they get a parking citation and they're used to paying their sewer bill, it's the same login, and they can pay them both through a shopping cart."

Coronavirus challenges capacity, but core networks are holding up

Increased use of conferencing apps may affect their availability for reasons other than network capacity. For example, according to ThousandEyes, users around the globe were unable to connect to their Zoom meetings for approximately 20 minutes on Friday due to failed DNS resolution. Others too are monitoring data traffic looking for warning signs of slowdowns. “Traffic towards video conferencing, streaming services and news, e-commerce websites has surged. We've seen growth in traffic from residential broadband networks, and a slowing of traffic from businesses and universities," wrote Louis Poinsignon a network engineer with CloudFlare in a blog about Internet traffic patterns. He noted that on March 13 when the US announced a state of emergency, CloudFlare’s US data centers served 20% more traffic than usual. Poinsignon noted that Internet Exchange Points, where Internet service providers and content providers can exchange data directly (rather than via a third party) have also seen spikes in traffic. For example, Amsterdam (AMS-IX), London (LINX) and Frankfurt (DE-CIX), a 10-20% increase was seen around March 9.

7 ways the tech and services industry could be transformed

With a large segment of the population confined to their homes having to consume bandwidth, the internet free-for-all we have enjoyed to date is all but done. Emergency legislation or an executive order needs to be enacted to limit video content streaming to 720p across all content services, such as from Netflix, Hulu, Apple TV, Disney+, YouTube, and other providers. Traffic prioritization and shaping need to be put in place for core business applications during prime hours, which includes video conferencing for business and personal use. This would effectively be the opposite of net neutrality, as an emergency measure. Internet video streaming traffic should be prioritized for essential news providers, and the government should provide incentives for them to broadcast their content (and for home-bound citizens to consume it) over-the-air (OTA) so that additional bandwidth can be freed up. Remember the antenna and devices with built-in tuners? It may be an appropriate time to shift some programming back to the airwaves, and even bring back the DVR, so that programming can be transferred to devices during off-hours when networks aren't saturated.

---

Quote for the day:

"Individual commitment to a group effort - that is what makes a team work, a company work, a society work, a civilization work." -- Vince Lombardi

---

Daily Tech Digest - March 22, 2020

How Is AI Helping To Commercialize Space?

The power of deep learning and AI-enabled recognition provides significant power in analyzing images and providing ability to review the millions of images produced by spacecraft. Artificial intelligence on the other end can analyze the images as they are being taken and determine if there are any issues with the images. Unlike humans, AI does not need to sleep or take breaks so it can rapidly process a lot of data. Using AI to capture images of Earth also prevents the need for large amounts of communication to and from Earth to analyze photos and determine whether a new photo needs to be taken. By cutting back on communication, the AI is saving processing power, reducing battery usage, and speeding up the image gathering process. Satellites are also being used to analyze natural disasters from space. Detailed imagery from a satellite can help those on the ground to see victims, determine the course of the disaster, and more. Artificial intelligence is being used to help speed up the response of satellites to natural disasters. With the help of the onboard AI, satellites are able to determine where a natural disaster is located and navigate to that location.

COVID-19: How to Adjust Business Continuity Plans

The COVID-19 pandemic present new challenges to healthcare IT and security teams, including the need to reassess and adjust business continuity plans, says Christopher Frenz, who leads information security at New York's Interfaith Medical Center. He's chair of an industry committee that has developed new guidance for dealing with those challenges. ... "Business continuity is something organizations should constantly test, particularly in healthcare," he says in an interview with Information Security Media Group. "Testing your backup and disaster recovery plans is something we should always be doing. But at a time like this where we're seeing an upswing in malware attacks against hospitals related to coronavirus, and you're going to have influxes of patients ... that puts additional stresses on systems. So it's definitely a good idea to test and verify that all this stuff works ahead of time," he says.

Once hailed as unhackable, blockchains are now getting hacked

Susceptibility to 51% attacks is inherent to most cryptocurrencies. That’s because most are based on blockchains that use proof of work as their protocol for verifying transactions. In this process, also known as mining, nodes spend vast amounts of computing power to prove themselves trustworthy enough to add information about new transactions to the database. A miner who somehow gains control of a majority of the network's mining power can defraud other users by sending them payments and then creating an alternative version of the blockchain in which the payments never happened. This new version is called a fork. The attacker, who controls most of the mining power, can make the fork the authoritative version of the chain and proceed to spend the same cryptocurrency again. For popular blockchains, attempting this sort of heist is likely to be extremely expensive. According to the website Crypto51, renting enough mining power to attack Bitcoin would currently cost more than $260,000 per hour. But it gets much cheaper quickly as you move down the list of the more than 1,500 cryptocurrencies out there.

Cyber crooks continue to exploit COVID-19 for their malicious schemes

“BEC attacks are often delivered in stages. The first email sent is typically innocuous, meaning that they do not contain the attacker’s end goal. The attackers craft plausible scenarios in hopes the recipient will reply. Once they’re on the hook, the attacker will send their true ask. (I need you to buy gift cards, wire transfer funds, etc.),” the researchers explained. “These coronavirus-themed BEC attacks often come with spoofed display names, which are likely real people known to the recipient. In the body of this message, the actor attempts to eliminate the possibility of voice-verification, in hopes of ensuring a higher success rate, by saying their phone is ‘faulty at the moment.'” They’ve also spotted an assortment of fake notices impersonating doctors and local health agencies and institutions (aimed at the general population), as well as more targeted emails aimed at enterprises (employees), such as fake internal emails for credential phishing attacks impersonating the organization’s president, IT staff, risk manager, and so on.

CIOs say personal disruption comes before digital disruption

CIOs suggest personal disruption should be part and parcel to the overall disruptions that their organizations are making. At the same time, they say transformation needs to happen at many levels these days including the personal level. With this said, if an organization has been comfortable with the status quo for too time, CIOs say they need to start by driving the organizational change needed to be receptive to change and to perceive changes the organization needs. A key part of this, CIOs say is that IT leaders should resolve to be open to new ideas and ways of thinking this year and in the coming decade. Part of this involves getting out of the natural comfort zone and being open to thinking differently about how to impact the organization. CIOs suggest in 2020 IT leaders need to have increased awareness of the social and cultural impacts occurring from technology. CIOs say, for this reason, it makes sense to encourage the entire team to self-disrupt itself. To fix businesses, CIOs should get the business out of its comfort zone too.

4 Reasons Central Banks Should Launch Retail Digital Currencies

While domestic retail payments in many OECD countries are now free, cross border payments remain a minefield of pain, cost and delays for consumers. If I send money to my mum in India, she has no digital identity in the UK and I have no digital identity in India. So my bank in the UK verifies that I sent the money, my mum’s bank verifies that she’s the person the money is for and both the banks verify (or at least hope) that neither I nor my mum is a nefarious character. Then the banks wait until they have compared their respective spreadsheets and make me wait for this reconciliation. Only after that, both the banks take a nice cut on the FX and send the rest to my mum. If the bank was in rural Ghana instead of Delhi, there’d probably be two more banks in this bank-chain, which’d quadruple the delay and the pain. This whole process of cross border payments is not only a pain for consumers, it also makes the global AML regime ineffective and unenforceable. Instead, if the Bank of England and the Reserve Bank of India both were to rely on a shared set of data standards for their respective digital currencies and for the corresponding digital identity infrastructure

Exploring the risky behavior of IT security professionals

Almost 65% of the nearly 300 international cybersecurity professionals canvased by Gurucul at RSA Conference 2020 said they access documents that have nothing to do with their jobs. Meanwhile, nearly 40% of respondents who experienced bad performance reviews also admitted to abusing their privileged access, which is double the overall rate (19%). “We knew insider privilege abuse was rampant in most enterprises, but these survey results demonstrate that the infosecurity department is not immune to this practice,” said Saryu Nayyar, CEO of Gurucul. “Detecting impermissible access to resources by authorized users, whether it is malicious or not, is virtually impossible with traditional monitoring tools. That’s why many organizations are turning to security and risk analytics that look at both employee and entity behaviors to identify anomalies indicative of insider threats.” ... This showcases the problems organizations have with employees behaving outside of the bounds of practical and published security policies.

Covid-19: NHS tackles coronavirus crisis with the help of tech

NHS Digital’s website states: “Patients should be enabled to get advice and care without attending the practice unless in-person care is clinically required.” But although phone appointments are great, they won’t cover everything. This is where video appointments are invaluable – not just for patients who may be displaying coronavirus symptoms, but for anyone who needs to be seen by a GP. Some GPs already have online systems and video consultations in place, but many of those who have the service available have not yet begun to use it. EMIS is one of the biggest GP IT system providers in England, with nearly 4,000 GP practices using its EMIS Web service. In 2017, it launched its Video Consult service, but uptake has been limited. This echoes throughout GP practices in the UK – suppliers often offer the service, but few GP practices use it. EMIS, which normally charges GPs for the use of video consultations, has now decided to offer it free for the next few months.

To succeed in DevOps these days, go hybrid

DevOps is not just a technical undertaking, it's a business proposition. This calls for hybrid skills that enable a more holistic view of the entire software development and deployment process. With a majority of enterprises (52%) intending to ramp up their recruiting of DevOps skills. close to two-thirds, 65%, reported having difficulties with finding these combinations of skills. DevOps is not just a technical undertaking, it's a business proposition. This calls for hybrid skills that enable a more holistic view of the entire software development and deployment process. With a majority of enterprises (52%) intending to ramp up their recruiting of DevOps skills. close to two-thirds, 65%, reported having difficulties with finding these combinations of skills. The DevOps journey is still very difficult for more than 50% of respondents. "DevOps is a fundamental change in the traditional structure of IT. It not only represents the adoption of new technology, but also an organizational transformation challenge with all that it implies with the 'evangelization of the existing responsibility silos.

The Anatomy of a Microservice, One Service, Multiple Servers

In addition to supporting multiple transport mechanisms that can improve performance and efficiency, when providing more than one API Server, there’s an architectural benefit. That is helping to enforce separation of concerns. While the high-level architecture diagram presented in Microservice Definition and Architecture depicts a clear separation of concerns, like any other development effort, implementing this pattern does require diligence. In a previous article in this series, I stated that I believe developers have the best intentions in mind. Of course, there are exceptions, but individuals do want to do a good job. The problem comes in when deadlines loom. Things start to get thrown off the back of the truck. Shortcuts are taken. Non-functional requirements such as metrics gathering and reporting are missed. The more an architecture helps guide a team, the less likely these things will happen. Specifically, in the case of having two API Servers, business logic remains where it’s supposed to remain: in the business service.

---

Quote for the day:

"Leadership is the other side of the coin of loneliness, and he who is a leader must always act alone. And acting alone, accept everything alone." -- Ferdinand Marcos

---

Daily Tech Digest - March 21, 2020

Cisco moves WiFi roaming technology to wireless broadband consortium

With OpenRoaming, device users can employ methods such as Samsung ID, their mobile SIM card, or their cloud provider to sign into OpenRoaming once, granting them seamless access to participating wireless networks around the world, according to Cisco. In addition, OpenRoaming brings together a federation of trusted identity providers, to automatically allow users to join any network managed by an OpenRoaming federation member. The membership include service providers, device manufacturers, cloud ID, or even loyalty memberships. Boingo Wireless, GlobalReach Technology, Intel, Korea Telekom, and others have pledged support for OpenRoaming. “There is considerable pull from the industry and our customers, both enterprise and service provider, to automate secure onboarding across multiple verticals,” wrote Matt MacPherson, Cisco’s Wireless CTO in a blog about the transfer. WBA’s global ecosystem can integrate OpenRoaming into its technologies, regardless of equipment provider. He says that OpenRoaming supports seamless, secure roaming that can iprove Wi-Fi service in general.

Completely Free Machine Learning Reading List

There are many free online courses for learning data science and machine learning available. I previously covered a list of my top five in this article. However, books can be a really useful tool for learning the detail and theory behind these subjects. Fortunately, if you look hard enough you will find that there are a wealth of completely free books online that cover the majority of topics and concepts that you need to learn. ... "Think Stats" by Allen B. Downey can be read online or downloaded as a pdf here. It covers many of the core statistical concepts for data science including data analysis, distributions and probability. It also leans heavily towards coded examples written in python rather than mathematical equations, which I think makes it easier to digest for those without advanced maths degrees. ... "Bayesian Methods for Hackers: Probabilistic Programming for Bayesian Inference" by Cameron Davidson-Pilon attempts to bridge the gap between theoretical Bayesian machine learning methods and their practical application in probabilistic programming. It provides a really good introduction to Bayesian inference with a practical first approach.

60% of Security Pros Trust Cyberthreat Detections Verified by Humans over AI

According to research findings, based on the responses of 102 professionals in the cybersecurity industry, 45% of respondents opined that their companies lack a sufficiently staffed cybersecurity team. Over 70% of respondents agreed that AI-based tools made their security teams more efficient by eliminating over 55% of everyday security operations. Incorporating AI tools into security operations decreased employees’ stress levels, according to 40% of respondents. And, 65% claim that AI tools allow them to focus on cyberattack mitigation and preventive measures. Despite the advantages AI-based technologies offer, the majority of respondents stressed that there are skills and benefits the human element provides cybersecurity teams that AI and machine learning cannot match. WhiteHat provides services that are required for organizations to secure the entire software lifecycle (SLC) from the development through deployment and operation. Its Application Security Platform technology solutions include Software Composition Analysis (SCA), Static Application Security Testing (SAST), and Dynamic Application Security Testing (DAST).

How artificial intelligence is changing the game for banks

“Natural language processing will dramatically change the way we will operate. There is a tremendous amount of hidden knowledge locked away at a bank — we’re sitting on a goldmine. This will give us a way to access it,” he says. “We will be able to make faster, better decisions on everything from mortgages to calculating how much collateral the bank holds.” Legrand’s mention of collateral begs a big question: would AI — with all its better, faster ways of handling data — have been able to sound an early alarm on a big systemic problem like the financial crisis? Liu, for all his ambition, baulks at making quite such a big claim. “I don’t think it would avert a crisis because there are so many different elements that come into it. But it would help with crisis management. [This technology] can help show you things such as if one part of the bank goes bankrupt, how quickly would that crisis spread.” With the world economy rocked by COVID-19, he adds, banks are again coming under pressure to spot problems with liabilities and non-performing loans as quickly as possible.

Architectural Implications of IoT Data

Due to potential implications for enterprise and our transformation programs, we must plan data collection via IoT sensors carefully. Data sources for IoT solutions can be diverse and complex. As a first design activity, we must determine the type of physical signals to measure. Then, we can identify the number of sensors to be used. We need to calculate speed of signals for these sensors and document in our data acquisition plan. Digital transformation architects need to closely work with the IoT Solution Architects and solution designers to create stringent governance and innovative measures around streaming data collection plans. In addition to the architectural, design, and innovation challenges of massive data, application usage patterns are also essential factors for the performance of IoT solutions particularly in the enterprise modernisation and digital transformation initiatives. For example, minute details such as the processors and memory of the servers hosting the IoT applications matter and must be considered carefully using benchmarks. By using benchmarks for application, data, and infrastructure, we can create an exclusive IoT performance model and a set of test strategies to use in our digital transformation solutions.

Singapore introduces contact tracing app to slow coronavirus spread

The mobile app can plug the gaps and more quickly identify potential carriers, who then can monitor their health and take the necessary action sooner. Early detection is crucial in slowing down the spread of the coronavirus, according to the government agency. To safeguard personal privacy, it added that users would have to provide consent during the initial setup of the app to participate in TraceTogether and agree to have their mobile number and captured data used for contact tracing. GovTech said only the user's mobile phone was required during the installation, and no other data such as name, location, contact list, or address book would be collected. Data logs were stored locally on the mobile phone and contained only cryptographically generated temporary IDs. The data logs would be extracted only when needed by the authorities for contact tracing, it said.  TraceTogether is available for download via Google Play and Apple App Store.

Intel trains neuromorphic chip to detect 10 different odors

Nabil Imam, a neuromorphic computing lab senior research scientist at Intel, believes the research will pave the way for neuromorphic systems that can diagnose diseases, detect weapons and explosives, find narcotics, and spot signs of smoke and carbon monoxide “We are developing neural algorithms on Loihi that mimic what happens in your brain when you smell something,” he said in a statement. “This work is a prime example of contemporary research at the crossroads of neuroscience and artificial intelligence and demonstrates Loihi’s potential to provide important sensing capabilities that could benefit various industries.” Neuromorphic engineering, also known as neuromorphic computing, describes the use of circuits that mimic the nervous system’s neuro-biological architectures. Researchers at Intel, IBM, HP, MIT, Purdue, Stanford, and others hope to leverage it to develop a supercomputer a thousand times more powerful than any today. ... According to Intel, Loihi processes information up to 1,000 times faster and 10,000 more efficiently than traditional processors, and it can solve certain types of optimization problems with more than three orders of magnitude gains in speed and energy efficiency.

Auto ML and the future of self-managing networks with Dr. Behnaz Arzani

Things like video analytics, like natural language processing, things like that are always needed, not necessarily something for networking. So my friend and I, Bita Rouhani from Doug Burger’s group, started to look at well, what happens if you just dump networking data into these systems? Like, just let’s see how well they do. And they did it abysmally bad. The state-of-the-art was like terrible. And so we looked at it and said okay, why is that the case? And what we found was that, well, there’s simple domain customizations that we could do, even on the input. Not anything to the machine learning, but just how we present the data that would significantly boost their accuracy. And so the idea was well, actually, operators are really good at that part. Like they really know their data. They really know things about the data that the auto ML frameworks don’t know. So is there a way to bridge this gap? Is there a way to provide that domain knowledge without him knowing anything about ML?

The Two Trends that Will Shape the Future of ITSM

The first trend is what I call the primacy of the customer. Essentially, this trend means that organizations are no longer creating value by delivering a mass product to a mass market as efficiently as possible. Instead, differentiating value is created by delivering a differentiated customer experience. Those that positively transform the experience win. This idea also has a few associated buzzwords like the experience economy, mass customization, and the market of one. These catchphrases all relate to this idea, but the big difference is that it’s now becoming the primary driver of organizational value. The second trend is more personal. I call it the primacy of algorithm. Throughout the industrial age, organizations needed workers who could perform work consistently, reliably, and repeatedly. Essentially, they needed robots, so we trained generations of humans to be the robots that would power the literal and figurative machinery of the industrial age. Today, however, we’re on the cusp of an algorithmic tipping point.

Mass move to work from home in coronavirus crisis creates opening for hackers

“People who have never worked from home before are trying to do it and they are trying to do it at scale,” said Wendy Nather, a senior advisor with Cisco’s Duo Security who has spent the past decade working from home for various jobs. She said the sudden transition would mean more scope for mistakes, more strain on information technology staff, and more opportunity for cyber criminals hoping to trick employees into forking over their passwords. Criminals are dressing up password-stealing messages and malicious software as coronavirus-themed alerts, warnings, or apps. Some researchers have found hackers masquerading as the U.S. Centers for Disease Control and Prevention in a bid to break into emails or swindle users out of bitcoin, while others have spotted hackers using a malicious virus-themed app to hijack Android phones. Advanced cyber spies also appear to be exploiting the coronavirus outbreak that has infected tmsnrt.rs/3aIRuz7 more than 210,000 people and killed 8,700 worldwide.

---

Quote for the day:

"The highest proof of virtue is to possess boundless power without abusing it." -- Lord Thomas Macaulay

---

Daily Tech Digest - March 20,2020

How to Spot Disruption Before It Strikes

In this modern age, everything is interconnected, which means that if you’re trying to see the future of one thing — let’s say your field — you really do have to pay attention to developments in adjacent areas to see which connections will catapult change forward into the future. That means you have to pay attention to things like wealth distribution and education. And in both of those cases, we’re talking about who has access to what. Are there groups that are gaining more agency and ability where they live? Are there changes happening to regulations and to permissions? Essentially, this new app was a way to help people make money while they sleep. Gollum got its idea from something that existed in the ’90s and in fact still exists today. In the ’90s, while you were asleep, you could donate the unused compute power of your computer to others — to researchers and academics who needed supercomputing networks but maybe couldn’t afford to get access to one. So instead, there were these distributed networks of computers all around the world where people had donated their unused compute time while they were asleep, for great projects.

Attack Surface, Vulnerabilities Increase as Orgs Respond to COVID-19 Crisis

Predictably, a lot of the activity has involved phishing and social-engineering campaigns where COVID-19 has been used as a thematic lure to get people to click on malicious attachments and links in emails or to download malware on mobile and other devices. There have also been reports about account takeover and business email compromise activity, a growth in domains serving up drive-by malware, and attempts to exploit virtual private networks (VPNs) and other remote access tools. The danger posed by these threats has been exacerbated by new requirements for "social distancing" and the resulting push by many organizations to widen or implement telework capabilities for their workforce. The sudden COVID-19-related surge in the use of videoconferencing, remote access, and VPN services — especially at organizations that have not used them before — is giving attackers more targets to go after and defenders a lot more terrain to protect.

France warns of new ransomware gang targeting local governments

CERT-FR said it is still investigating how the Pysa gang is gaining access to victim's networks. However, forensics clues left behind paint a picture of what could have happened on some of the infected/ransomed networks. For example, CERT-FR said there was evidence suggesting that the Pysa gang launched brute-force attacks against management consoles and Active Directory accounts. These brute-force attacks were followed by the exfiltration of a company's accounts & passwords database. Victim organizations also reported seeing unauthorized RDP connections to their domain controllers, and the deployment of Batch and PowerShell scripts. Furthermore, the Pysa gang also deployed a version of the PowerShell Empire penetration-testing tool, stopped various antivirus products, and even uninstalled Windows Defender in some instances. CERT-FR says that in at least one case they analyzed, they also found a new version of the Pysa ransomware, which used the .newversion file extension instead of the older .pysa.

How organizations can maintain a third-party risk management program from day one

Third parties certainly are having a lot to do with data breaches these days. You read any study, Deloitte, Ernst & Young, any of the unbiased studies out there, a number of the data breaches are actually coming from third parties and vendors, so that we recognize that you might have your four walls or your firewalls under control, but what you’re doing with other vendors and other folks in your supply chain, certainly puts your data at risk. We think that’s certainly important. A lot of these heavily regulated industries are actually getting audited and examined to understand how they understand the ecosystem of third parties. But we’re also seeing it go down-market. Not just the heavily regulated industries, but other areas and other verticals are starting to really think about how they interact with third parties, what data they’re sharing, and also what kind of value they could get from those third parties. Are they understanding the metrics, the measurements that they measure those vendors on? Are they getting what they paid for? Are they getting the level of performance they expect? And because of that, I think we can optimize a lot of those relationships and help them better understand that ecosystem in which they behave.

7 Spring Cleaning Tasks to Improve Data Security

Begin this year’s spring by reviewing your data assets. Move any sensitive information offline if it doesn’t need to be network-accessible. Keep in mind that any data not in your possession cannot be stolen from you. If you are storing information about other people or organizations and you can’t foresee any possible future use for that data, get rid of it. If you need it, move it to a secure offline facility. For instance, if you are storing credit card CVC codes — which you should not need to — get rid of them. There is no better method of ensuring data security than not having irrelevant data in the first place. Make sure you’re backing up properly and frequently. You should back up often enough that if something were to go severely wrong, you wouldn’t be panicking about lost personal or enterprise data. If you are responsible for ensuring that others back up, make sure that they understand the importance of doing so, and deploy technology that simplifies and automates the backup process. If you aren’t sure whether you’re backing up often enough, you probably are not.

Managing Service-to-Service Communications in the Era of Microservices

Broadly speaking, the data plane "does the work" and is responsible for "conditionally translating, forwarding, and observing every network packet that flows to and from a [network endpoint]." In modern systems, the data plane is typically implemented as a proxy, that is run out-of-process alongside each service as a "sidecar." Klein states that within a service mesh, the data plane "touches every packet/request in the system, and is responsible for service discovery, health checking, routing, load balancing, authentication/authorization, and observability." There is work underway within the CNCF to create a Universal Data Plane API, based on concepts from Klein's earlier blog post The Universal Data Plane API. This proposal extends the xDS API that has been defined and implemented by Envoy and is supported in other proxies such as MOSN. A control plane "supervises the work," and takes all the individual instances of the data plane — a set of isolated stateless sidecar proxies—and turns them into a distributed system.

Everything you need to connect with your teammates and be more productive

In the face of COVID-19, there are countless stories from customers who are using Teams to connect and thrive in inspiring ways. A professor at University of Bologna in Italy shared on Twitter how the school moved 90 percent of courses online to Teams within four days, which is definitely a first in the university’s 900-plus year history. Doctors at St. Luke’s University Health Network in Pennsylvania will use Teams for videoconferencing with patients, especially those who are most vulnerable to coronavirus, as a way to protect both patients and healthcare providers. And the City of Osaka in Japan is using Teams to conduct orientations and trainings for hundreds of new incoming employees in April. Stories like these are playing out in countries the world over. We believe that this sudden, globe-spanning move to remote work will be a turning point in how we work and learn. Already, we are seeing how solutions that enable remote work and learning across chat, video, and file collaboration have become central to the way we work.

3 Technologies That Can Ease the M&A Process

Robotic process automation (RPA) is a form of business process optimization that automates tasks using software robots, or digital workers. RPA can play a major role in automating repetitive and manual data-related tasks, freeing up employees for higher-value work. During mergers and acquisitions, employees have new systems and processes to adjust to, within a limited time frame and staff may not have learned the skills required to complete these tasks efficiently. RPA can help to ease this process by using artificial intelligence workers to help with data entry, data mapping, data extraction and moving data into multiple systems, which is critical for systems consolidation after a merger or acquisition. ... While custom point-to-point integration can help companies reach a short-term goal, it drastically complicates matters in the long run when integrating multiple companies’ subsystems and data centers. Fortunately, there are a variety of off-the-shelf alternatives that can create connectivity across a company’s entire business ecosystem, without needing complex custom code.

Security Ratings Are a Dangerous Fantasy

Why are security ratings so bad? For starters, the data is terrible. The quality of security ratings is contingent on the quality of the underlying data and the science with which this data is interpreted. Unfortunately, the cybersecurity ratings industry has nowhere close to the depth and breadth of data of other ratings sectors. Security ratings companies do not have accurate network maps, and ratings are regularly deflated due to misattribution or improper understanding of network configurations. Security ratings companies typically use incomplete third-party data and do not communicate caveats or error estimates to their customers. By the time you read them, security ratings are already out of date, because the data is not quickly refreshed and refresh timestamps aren't clearly communicated. Another challenge is that ratings aren't scientific or statistically relevant. Given those problems, vendors committed to a ratings product have no choice but to hack their way to a partial solution.

Beware Of AI Assisted Ransomware

The AI component of Ransomware does some clever stuff like conceal the conditions needed to unlock the files as well as deploy untraceable malicious applications, but it doesn’t stop here. Just like businesses use AI for language learning, so too can the malware be trained to recognise types of content and be on the lookout for specific words as well as listen to voice prompts. Face recognition log in is popular now too so of course, the smart malware can be trained to recognise images. Cybercriminals are also using advanced image APIs for face recognition on webcams, and security cameras. Hackers get a lot of personal information or data from the dark corners of the Internet, aka ‘dark web’. For example, where you shop online or do your personal banking data can be stolen, and it often ends up on the dark web where it is traded to hackers who can use it in their malware. Open source tools are also the target of hackers where they can be used to compromise website, servers and cloud infrastructure. So with the influx of smart hacking, what can we do to protect data and devices, so we’re not a victim of a malicious cyber attack?

---

Quote for the day:

"If You only have a hammer everything looks like a nail." -- Abraham Maslow

---

Daily Tech Digest - March 19, 2020

Microsoft: .NET 5 preview for Windows 10, iPhone, Android Surface Duo apps is out

Ahead of the final version of .NET 5, Microsoft has a clear message for developers: ".NET Core and then .NET 5 is the .NET you should build all your NEW applications with."  "Having a version 5 that is higher than both .NET Core and .NET Framework also makes it clear that .NET 5 is the future of .NET, which is a single unified platform for building any type of application," said Scott Hunter, director of program management at Microsoft .NET.  The first preview includes support for Windows Arm64 and the .NET Core runtime, while the second preview will include an SDK with ASP .NET Core but not WPF or Windows Forms, which should arrive in a subsequent preview.  The preview should allow developers to update existing projects by updating the target framework.  The main goals for .NET include providing a unified .NET SDK with a single Base Class Library (BCL) across all .NET 5 applications, with Xamarin moving to the .NET core BCL. Since Xamarin is integrated into .NET 5 the .NET SDK will support mobile. Microsoft's ongoing work on Blazor should also mean web application support across platforms, including browsers, on mobile devices and as a native desktop application for Windows 10 and Windows 10X.

IR35 reform delay: how tech companies and contractors should respond

Paul Wright, head of the technology practice, Odgers Interim has some very important advice on how companies should respond to the regulatory respite- revoke any blanket bans on contractors. He says “businesses have now been given some breathing room to get their houses in order and I cannot stress enough how important it is for them to take this time to revoke any blanket assessment statues they have enforced and re-evaluate their contingent workforce needs. “As the impact of Covid-19 steers the economy into unchartered waters, the UK’s freelance, independent and contractor workforces will be more important than ever for tech firms – which already rely heavily on this industry.” Wright also sees contractors and freelancers as the solution to absences in the permanent workforce cause by Covid-19. “Many organisations will not only need to procure the specialist skillsets of contractors and independents to help guide them through increasing levels of disruption but will also need to call upon their support to fill in for permanent staff who are either self-isolating or having to look after family members.

Data Governance: How to Tackle 3 Key Issues

Some security practitioners argue that larger organizations should designate different accountable parties for protecting the privacy of customer, product and financial data - or even designate those in charge in each region. But organizations need someone at the top of the chain, such as a chief data officer, so that federated ownership can be kept in check, Deb says. Deb has also implemented a RACI - responsible, accountable, consulted and informed - matrix that helps him assign data owners. "So respective business units or their heads own the data and the accountability," he says. "For instance, IT is the data custodian, assurance functions are the data governors and so on. That way, an entire RACI matrix is built for every application, platform and data we process internally." One of the major roadblocks in the data governance process is the problem of shadow IT, Deb says. Shadow IT is where development happens either in-house or through an outsourced partner without the supervision and governance of the IT InfoSec and privacy teams.

9 Cybersecurity Takeaways as COVID-19 Outbreak Grows

Security experts cite phishing attacks as being one of the biggest threats in this new environment, and warn that existing efforts to safeguard employees are too often inadequate. "Phishing attacks are on the rise, and employees at home might be especially vulnerable," attorneys Jonathan Armstrong and André Bywater say in a client note. "We've expressed concerns before that a lot of 'off-the-shelf' phishing training is not fit for purpose. It's important to make sure employees are trained and that they have regular reminders. Organizations using [Office 365] may be especially vulnerable at this time." To help, many organizations are releasing materials for free. For example, the SANS Institute has released large parts of its commercial awareness materials. But with phishing attacks that prey on coronavirus fears already surging, many organizations are playing catchup. "Like many phishing scams, these emails are preying on real-world concerns to try and trick people into doing the wrong thing," the U.K.'s National Cyber Security Center says, noting that shipping, transport and retail industries were being targeted.

Reasons For Transitioning To Cloud Computing In 2020

Cloud computing has now become a common term that all of us have heard of. However, unfortunately, many of us still don’t understand the complete potential of cloud computing. It is high time for all us to understand how it can make our lives easier. Instead of storing data on a computer or hard drive, cloud computing stores programs and data over the internet. In other words, in order to access your data, you must be connected to the internet. In fact, many of us already use cloud computing unknowingly, while listening to our favorite tunes on Spotify or using Google Drive for data storage.  The flexibility and functionality of cloud computing have already proven to be a lifesaver for businesses. However, cloud computing for a business is entirely different from the personal use of the cloud. Before the implementation of cloud computing, businesses need to choose between Software-as-a-Service (SaaS), Platform-as-a-Service (or PaaS), or Infrastructure-as-a-Service (IaaS). In a nutshell, PaaS allows users the freedom to come up with customized applications as per their requirements. On the other hand, SaaS requires users to subscribe to a chosen application.

IT Priorities 2020: Digitisation drives IT modernisation growth

Opening up APIs, with access controlled via an API management platform, is one of the ways IT departments can minimise the effort needed to modernise applications. The survey reported that 47% of IT professionals said they planned to increase the use of cloud infrastructure to support digital transformation initiatives in 2020. Applications can be replatformed from on-premise servers to public cloud-hosted infrastructure-as-a-service (IaaS) platforms. In fact, 38% of the respondents said they would increase their cloud budgets in 2020. This potentially shifts spending from a capital expenditure model for on-premise datacentre hardware to pay-as-you-go in the public cloud. Many of the legacy applications that are migrated to the cloud can only run in virtual machines (VMs). VMs in the public cloud replace physical servers or on-premise VMs. But as organisations move along their journey to become cloud-native, in some instances, IT professionals are looking at splitting legacy code into functional building blocks.

AI adoption in the enterprise 2020

AI adoption is proceeding apace. Most companies that were evaluating or experimenting with AI are now using it in production deployments. It’s still early, but companies need to do more to put their AI efforts on solid ground. Whether it’s controlling for common risk factors—bias in model development, missing or poorly conditioned data, the tendency of models to degrade in production—or instantiating formal processes to promote data governance, adopters will have their work cut out for them as they work to establish reliable AI production lines. Survey respondents represent 25 different industries, with “Software” (~17%) as the largest distinct vertical. The sample is far from tech-laden, however: the only other explicit technology category—“Computers, Electronics, & Hardware”—accounts for less than 7% of the sample. The “Other” category (~22%) comprises 12 separate industries. One-sixth of respondents identify as data scientists, but executives—i.e., directors, vice presidents, and CxOs—account for about 26% of the sample. The survey does have a data-laden tilt, however: almost 30% of respondents identify as data scientists, data engineers, AIOps engineers, or as people who manage them.

Electronics should sweat to cool down, say researchers

Computing devices should sweat when they get too hot, say scientists at Shanghai Jiao Tong University in China, where they have developed a materials application they claim will cool down devices more efficiently and in smaller form-factors than existing fans. It’s “a coating for electronics that releases water vapor to dissipate heat from running devices,” the team explain in a news release. “Mammals sweat to regulate body temperature,” so should electronics, they believe. The group’s focus has been on studying porous materials that can absorb moisture from the environment and then release water vapor when warmed. MIL-101(Cr) checks the boxes, they say. The material is a metal organic framework, or MOF, which is a sorbent, a material that stores large amounts of water. The higher the water capacity one has, the greater the dissipation of heat when it's warmed. MOF projects have been attempted before. “Researchers have tried to use MOFs to extract water from the desert air,” says refrigeration-engineering scientist Ruzhu Wang, who is senior author of a paper on the university’s work that has just been published in Joule.

Silverlight Reborn? Check Out 'C#/XAML for HTML5'

Now ... comes C#/XAML for HTML5 from Userware, which today announced its Silverlight-replacement project, also called CSHTML5, has reached release candidate status after a lengthy beta program. The tool comes as a Visual Studio extension in the Visual Studio Marketplace, promising to create HTML5 apps using only C# and XAML -- or migrate existing Silverlight apps to the Web. "Developers are now able to use C# and XAML to write apps that run in the browser," the French company said. "Absolutely no knowledge of HTML5 or JavaScript is required to use the extension, as it compiles your files to HTML5 and JavaScript for you. That means you can now build Web apps with static typing and all the strengths of C# and XAML, and make sure your code is ready when WebAssembly comes out." WebAssembly is upcoming experimental technology presented as an open standard that lets developers write low-level assembly-like code for the browser in non-JavaScript languages like C, C++ and even .NET languages like C# for improved performance over JavaScript. Until WebAssembly fully supported in the Web ecosystem, CSHTML5 might be seen as an alternative for .NET-centric developers.

More Business Websites Hit by Credit-card Skimming Malware

A malicious script planted on the NutriBullet website's payment page stole credit card numbers, expiry dates, CVV codes, names, and addresses of unsuspecting blender buyers and sent it to a server under the control of cybercriminals. According to the report, the sensitive data was then sold to other criminals on underground forums. RiskIQ says that although NutriBullet has attempted to clean up the poisoned webpages, the attackers continue to break back in and plant malicious code - suggesting that the attackers continue to exploit a way of compromising the blender maker's infrastructure. Peter Huh, the CIO of NutriBullet, confirmed that a security breach had occurred and said that a forensic investigation into the incident had been initiated. There is no word yet as to what plans NutriBullet has to inform affected customers. In both cases it feels like the companies at the centre of the security breaches should be responding more transparently with their users, ensuring that they are informed promptly and given as much detail as possible about what has occurred.

---

Quote for the day:

"Leaders must encourage their organizations to dance to forms of music yet to be heard." -- Warren G. Bennis

---

Daily Tech Digest - March 17, 2020

How Biometric Identity Will Drive Personal Security In Smart Cities

While smart cities can offer unprecedented levels of convenience to improve our everyday lives they also rely on vast networks of data, including personal customer information to predict our preferences. This has led to concerns around the high levels of data used and stored by smart systems, and the security provided to our digital identity. We know that existing personal and unique identifiers, such as passwords and PINs are no longer secure enough to protect our systems, and this is even more important in hyper-connected cities as, once a city becomes ‘smart’ the inter-connected networks widen, and the potential for cyberattacks or data breaches grows. So as this trend continues, how can we develop smart cities that are both convenient and secure? To resolve this, providers of smart city networks need to establish a chain of trust in their technology. This is a process common in cybersecurity, where each component in a network is validated by a secure root. In wide connected networks, this is vital to protect sensitive personal or business data and ensure consumer trust in the whole system.

Coronavirus challenges remote networking

The security of home Wi-Fi networks is also an issue, Nolle said. IT pros should require workers to submit screenshots of their Wi-Fi configurations in order to validate the encryption being used. "Home workers often bypass a lot of the security built into enterprise locations," he said. Education of new home workers is also important, said Andrew Wertkin, chief strategy officer with DNS software company BlueCat. "There will be remote workers who have not substantially worked from home before, and may or may not understand the implications to security," Wertkin said. "This is especially problematic if the users are accessing the network via personal home devices versus corporate devices." An unexpected increase in remote corporate users using a VPN can also introduce cost challenges. "VPN appliances are expensive, and moving to virtualized environments in the cloud often can turn out to be expensive when you take into account compute cost and per-seat cost," Farmer said. A significant increase in per-seat VPN licenses have likely not been budgeted for.

Implementing CQRS Pattern with Vue.js & ASP.NET Core MVC

If you’re a software professional, then you’re familiar with the Software enhancement and maintenance work. This is the part of software development life cycle; so that, you can correct the faults, delete/ enhance the existing features. The software maintenance cost can be minimized if you use software architectural pattern, choosing right technologies and be aware of the industry trends for the future, consider resource reliability/availability for now and future, use design pattern/principle in your code, re-use your code and keep open your option for future extension, etc. Anyway, if you use any known software architectural pattern in your application, then it will be easy for others to understand the structure/component design of your application. I’ll explain a sample project implementation according to the CQRS pattern using MediatR in ASP.NET Core MVC with vue.js. ... The main goal of this project is to explain the CQRS architectural pattern. I’m plaining to implement a tiny Single-Page-Application (SPA) project. The choice of the technology is important, and you should choose it according to your requirements.

What does 'network on demand' mean for enterprises?

Network on demand -- or on-demand networking -- can be delivered as either a managed network service or as cloud-based networking. In a managed network service model, a third party manages, meters and bills the infrastructure. In a cloud-based networking model, a business contracts directly with the cloud provider and makes all the decisions about its network. In either model, on-demand networking changes the dynamics from a Capex model in which customers pay upfront and amortize to a consumption-based model where users pay monthly for what they consume. Network on-demand options can be more flexible, enabling businesses to scale their network bandwidth and provision up and down to match business needs. In the on-demand world, burdens shift toward more planning and monitoring of service-level agreements and consumption versus hardware and traffic. The most logical customers for on-demand managed networking services are smaller businesses that don't have the internal resources to adequately handle networking.

Data is your best defence against a coronavirus downturn

Remember, good information in its many forms, including analytics, insights, predictions, diagnoses, prescriptions, and so forth, often is a lower-cost substitute for inventory, property and even money. Uber and Lyft for example have substituted information about who needs a ride and who has a car for fleets of taxis. Airbnb and HomeAway have done the same for bedrooms. Even most traditional retailers and manufacturers have been able to reduce their inventory levels, some to just-in-time inventory, based on detailed, near real-time supply and demand information. Moreover, more than 30% of companies today exchange information they collect or generate in return for goods and services from others. And this merely represents one of several ways to monetize your data. Investors themselves even seem to favor organisations that make significant investments in data and analytics. Public companies with chief data officers, data governance programs, and data science organizations command a nearly 2x market-to-book valuation over the rest of the market.

Needed: A Cybersecurity Good Samaritan Law

As the US becomes more sophisticated in protecting the digital world, physical systems are becoming a target — one with an attack surface that's relatively easy to penetrate. Gaining physical access is one of the easiest ways to hack into a network. This could include accessing paper records, installing equipment or software on the network, or simply putting in covert backdoor systems. The concept of combining physical attacks and cyberattacks to test a system is nothing new. The term "red teaming" is used in the industry to describe a method of system testing based on thinking and acting like a bad guy. Red teams help businesses to see how break-ins and business disruptions occur, to test strength and durability of their defenses, to identify where vulnerabilities exist, and to expose weaknesses that could be considered negligent and contributing to a breach. The risks of conducting red teaming increase as more bad guys hide themselves in cyberspace. Law enforcement and the legal system have the power to interpret the legality of our work.

CIO interview: Malcolm Lowe, head of IT, Transport for Greater Manchester

“The organisation has a lot of data and information,” he says. “It was in lots of pockets; people were using all sorts of different tools and techniques. We recognised there was a great opportunity for the organisation to really embrace analytics.” Lowe says his initial efforts were focused on getting people from across the organisation to understand what opportunities data might provide. He focused on showing business stakeholders what he calls “the art of the possible” through a proof of concept. “We had some spare capacity, we had some spare licences and we got a couple of data engineers to create an alpha,” he says. “I’ve got some bright people in my team. I tasked them to get as much data as they could from across the organisation for a single month. We put that data into an Azure SQL Server Data Warehouse and put Power BI over the top of it. “We found a couple of use cases across the organisation for people who were really interested in our ideas. We built something for them, they got to use it and they really liked it. I’m a big believer in people seeing something tangible...."

What is natural language processing? The business benefits of NLP explained

Natural language processing (NLP) is the branch of artificial intelligence (AI) that deals with communication: How can a computer be programmed to understand, process, and generate language just like a person? While the term originally referred to a system’s ability to read, it’s since become a colloquialism for all computational linguistics. Subcategories include natural language generation (NLG) — a computer’s ability to create communication of its own — and natural language understanding (NLU) — the ability to understand slang, mispronunciations, misspellings, and other variants in language. ... Machine translation is one of the better NLP applications, but it’s not the most commonly used. Search is. Every time you look something up in Google or Bing, you're feeding data into the system. When you click on a search result, the system sees this as confirmation that the results it has found are right and uses this information to better search in the future. Chatbots work the same way: They integrate with Slack, Microsoft Messenger, and other chat programs where they read the language you use, then turn on when you type in a trigger phrase. Voice assistants such as Siri and Alexa also kick into gear when they hear phrases like “Hey, Alexa.”

Keeping machine learning algorithms humble and honest in the ‘ethics-first’ era

Removing the complexity of the data science procedure will help users discover and address bias faster – and better understand the expected accuracy and outcomes of deploying a particular model. Machine learning tools with built-in explainability allow users to demonstrate the reasoning behind applying ML to a tackle a specific problem, and ultimately justify the outcome. First steps towards this explainability would be features in the ML tool to enable the visual inspection of data – with the platform alerting users to potential bias during preparation – and metrics on model accuracy and health, including the ability to visualise what the model is doing. Beyond this, ML platforms can take transparency further by introducing full user visibility, tracking each step through a consistent audit trail. This records how and when data sets have been imported, prepared and manipulated during the data science process. It also helps ensure compliance with national and industry regulations – such as the European Union’s GDPR ‘right to explanation’ clause – and helps effectively demonstrate transparency to consumers.

Decipher the true meaning of cloud native

The definition of cloud native has become more confusing as organizations and IT professionals incorporate it into their everyday usage, despite defining the term in different ways. The most oft-cited definition is the murky CNCF definition that was introduced in 2018. That cloud native definition mostly reiterates the points that the CNCF made when it launched in 2015, though it does emphasize some concepts not included at the CNCF launch, such as automation, observability and resiliency. Still, the current CNCF definition doesn't explain exactly what counts as cloud native and what doesn't. That is, unless you think any type of application that uses containers and microservices or relies on automation or resiliency counts as cloud native. ... At a high level, certain technologies, like containers and microservices, form an important part of what many people consider to be cloud native. Yet, there is virtually no specific guidance from any organization regarding how, exactly, these technologies need to be used in order for an app to meet the requirements of the cloud native definition.

---

Quote for the day:

"What great leaders have in common is that each truly knows his or her strengths - and can call on the right strength at the right time." -- Tom Rath

---