Daily Tech Digest - April 05, 2020

AI Transforming & Automating The Consumer Goods Industry

Utilizing AI algorithms, machines outfitted with intelligent automation can assess emerging production issues and are liable to mess quality up. At the point when they detect a potential issue, they can automatically notify manufacturing personnel and may even autonomously execute corrective actions. By improving the customer experience, retailers can release altogether new ways to deal with customer engagement and interaction. With intelligent automation, they can identify customers’ anticipated needs at exact times and catch the correct minute with the correct idea in the quest for competitive advantage. The automation of customer experience processes is seeing somewhat less footing compared to different parts of intelligent automation. Today, brands and retailers have started to use AI-fueled engines to automatically trigger email campaigns. A much progressively amazing utilization of this capability is to apply it to the order fulfillment process, empowering users to make purchases legitimately from within the campaign.

Corporate culture complicates Kubernetes and container collaboration

When it comes to navigating corporate culture, things get a bit difficult for Kubernetes and container proponents. For example, 40% of survey respondents cited a lack of internal alignment as a problem when selecting a Kubernetes distribution. Surprisingly, in some cases, business leaders want to get their hands in the process. Plus, there are many other hands involved in the decision -- 83% say more than one team is involved in choosing a Kubernetes distribution.  The primary decision-maker varies from organization to organization, depending in part on whether Kubernetes is running in development or production. Development teams are the primary decision makers 38% of the time when Kubernetes is deployed only for development, while infrastructure teams are the primary decision makers 23% of the time in production environments. It's notable that C-level executives are involved 18% of the time. "This involvement is occurring because enterprises are choosing their next-generation platform, and that earns executive attention," the survey's authors relate. The survey also finds a significant disconnect between the views of upper-level company executives and developers: 46% of executives think the biggest impediment to developers is integrating new technology into existing systems.

Accelerating data-driven discoveries

Matz says SciDB did 1 billion linear regressions in less than an hour in a recent benchmark, and that it can scale well beyond that, which could speed up discoveries and lower costs for researchers who have traditionally had to extract their data from files and then rely on less efficient cloud-computing-based methods to apply algorithms at scale. “If researchers can run complex analytics in minutes and that used to take days, that dramatically changes the number of hard questions you can ask and answer,” Matz says. “That is a force-multiplier that will transform research daily.” Beyond life sciences, Paradigm4’s system holds promise for any industry dealing with multifaceted data, including earth sciences, where Matz says a NASA climatologist is already using the system, and industrial IoT, where data scientists consider large amounts of diverse data to understand complex manufacturing systems. Matz says the company will focus more on those industries next year. In the life sciences, however, the founders believe they already have a revolutionary product that’s enabling a new world of discoveries.

Cyber Attack Disrupts COVID-19 Payouts: Hackers Take Down Italian Social Security Site

We've already seen supposed "elite hackers" attacking the World Health Organization, cyber criminals hitting a COVID-19 vaccine testing facility with ransomware and healthcare workers being targeted with Windows malware using coronavirus information as the lure. Now, it has been reported, hackers have forced the Italian social security website to shut down for a period, as the most vulnerable in society started their claims for a €600 ($655) crisis payout. The general director of Italian welfare agency INPS, Pasquale Tridico, told the state broadcaster RAI on April 1 that there had been several hacker attacks across the previous few days. "They continued today, and we had to close the website," Tridico said. This at the same time as the site was receiving 100 application requests per second, according to Tridico. Italian police have been informed of the ongoing cyberattacks, and the ruling Democratic Party has suggested that national security services could be put on the case of finding out who is responsible.

What is a design sprint? A 5-day plan for improving products and services

Design sprints start with a team of around four to seven people, which is the recommended team size according to GV. Teams include a facilitator, designer, decision maker, product manager, engineer and someone from a relevant business unit. The decision maker on the team is often the CEO, especially at smaller companies or startups. A design sprint is intended to move quickly, lasting just five days, and it’s designed to spur ideas and create learning opportunities without having to build and launch a completed product or service. With a design sprint, you can get fast feedback, improve products and services and find new opportunities throughout the five-day sprint by creating a testable prototype. The prototype will allow your team to get a better sense of how customers and clients will react to the finished product, what needs to be changed and what customers enjoyed about the product or service. Design sprints are broken out into five major phases that take place over the five-day sprint. These phases are intended to help you develop the best team to tackle a project and to guide your business through the design sprint.

Distributed disruption: Coronavirus multiplies the risk of severe cyberattacks

When it comes to remote work, VPN servers turn into bottlenecks. Keeping them secure and available is a number-one IT priority. Hackers can launch DDoS campaigns on VPN services and deplete their resources, knocking out the VPN server and limiting its availability. The implications are clear: Since the VPN server is the gateway to a company’s internal network, an outage can keep all employees working remotely from doing their job, effectively cutting off the entire organization from the outside world. During an unprecedented time of peak traffic, the risk of a DDoS attack is growing exponentially. If the utilization of the available bandwidth is very high, it does not take much to cause an outage. In fact, even a tiny attack can become the last nail in the coffin. For instance, a VPN server or firewall can be taken down by a TCP blend attack with an attack volume as low as 1 Mbps. SSL-based VPNs are just as vulnerable to an SSL flood attack, as are web servers. Making matters worse, many organizations either use in-house hardware appliances or rely on their Internet carrier to ward off incoming attacks.

How to Prepare for Your Next Cybersecurity Compliance Audit

Reading a list of cybersecurity compliance frameworks is like looking at alphabet soup: NIST CSF, PCI DSS, HIPAA, FISMA, GDPR…the list goes on. It’s easy to be overwhelmed, and not only because of the acronyms. Many frameworks do not tell you where to start or exactly how to become compliant. Cybersecurity best practices from the Center for Internet Security (CIS) provide prioritized, prescriptive guidance for a strong cybersecurity foundation. And, they support your efforts toward compliance with the aforementioned alphabet soup. CIS offers multiple resources to help organizations get started with a compliance plan that also improves cyber defenses. Each of these resources is developed through a community-driven, consensus-based process. Cybersecurity specialists and subject matter experts volunteer their time to ensure these resources are robust and secure. What they are: The CIS Controls approach cyber defense with prioritized and prescriptive security guidance. There are 20 top-level CIS Controls and 171 Sub-Controls, prioritized into three Implementation Groups (IGs). The CIS Controls IGs prioritize cybersecurity actions based on organizational maturity level and available resources.

‘Trustworthy AI’ is a framework to help manage unique risk

Trustworthy AI must be designed and trained to follow a fair, consistent process and make fair decisions. It must also include internal and external checks to reduce discriminatory bias. Bias is an ongoing challenge for humans and society, not just AI. However, the challenge is even greater for AI because it lacks a nuanced understanding of social standards—not to mention the extraordinary general intelligence required to achieve “common sense”— potentially leading to decisions that are technically correct but socially unacceptable. AI learns from the data sets used to train it, and if those data sets contain real-world bias then AI systems can learn, amplify, and propagate that bias at digital speed and scale. For example, an AI system that decides on-the-fly where to place online job ads might unfairly target ads for higher paying jobs at a website’s male visitors because the real-world data shows men typically earn more than women. Similarly, a financial services company that uses AI to screen mortgage applications might find its algorithm is unfairly discriminating against people based on factors that are not socially acceptable, such as race, gender, or age. In both cases, the company responsible for the AI could face significant consequences, including regulatory fines and reputation damage.

AI runs smack up against a big data problem in COVID-19 diagnosis

It's simple in theory to identify what a computer should look for. An X-ray or a CT scan will show formations in the lung that are associated with a number of respiratory conditions including pneumonia. The feature in an image most often linked to a COVID-19 case, although not exclusive to COVID-19, is what's called "ground-glass opacity," a kind of haze hovering in an area of the lung, caused by a build-up of fluid. Opacities and other anomalies can show up even in asymptomatic COVID-19 patients. What slows things down is that neural networks have to be tuned to pick out opacities in the pixels of a high-resolution image, and that takes data. It also takes time working with physicians who know what to look for in the data. Both data and expertise are in short supply at the outset of a pandemic.  The neural network programs that Xu and others are deploying have been refined by computer scientists to a high degree of sophistication over many years and they are providing ready tools with which to build new systems. The system that Xu and team built combines two deep learning neural networks, a "ResNet-50," the standard for many years for image recognition, and something called "UNet++" that was developed at Arizona State University in 2018 for the specific purpose of processing chest CT scans.

Code Search Now Available to Browse Google's Open-Source Projects

Code Search is used by Google developers to search through Google's huge internal codebase. Now, Google has made it accessible to everyone to explore and better understand Google's open source projects, including TensorFlow, Go, Angular, and many others. CodeSearch aims to make it easier for developers to move through a codebase, find functions and variables using a powerful search language, readily locate where those are used, and so on. Code Search provides a sophisticated UI that supports suggest-as-you-type help that includes information about the type of an object, the path of the file, and the repository to which it belongs. This kind of behaviour is supported through code-savvy textual searches that use a custom search language. For example, to search for a function foo in a Go file, you can use lang:go:function:foo. For repositories that include cross-reference information, Code Search is also able to display richer information, including a list of places from where a given symbol is referenced. Code Search repositories that provide cross-reference information include Angular, Bazel, Go, etc.

---

Quote for the day:

"Change your friends if they are holding you back - pick the new ones with caution and care." -- Tim Fargo

---

Daily Tech Digest - April 04, 2020

How AR is helping keep ventilators running during the coronavirus pandemic

"Unlike regular times when you could dispatch a technician to hospitals, or you could actually show the doctors how to operate equipment, fix it, and so on, they need to do it remotely," Churchill said. "So we combined them with video and AR." Once TechSee receives an inquiry, it is given to a technician and the technician sends a web link via SMS to a hospital staff member. This allows the hospital support person to use their smartphone camera or tablet camera to show the technician the issue, Churchill noted. The user shows the technician the problem, and then the technician diagnoses the issue and uses AR to visually guide the hospital employee to a resolution, he added. Churchill said that TechSee works with more than 100 enterprises in a variety of sectors, with Medtechnica being one of its biggest clients in healthcare. While TechSee's solution can be applied to any system--including X-rays, routers, smart thermostats, and more--the demand for ventilators is amplifying that use case. This solution is completely web-based, so the user isn't forced to download an app. The AI-powered platform can recognize devices and technical issues, as well as automate the support process, Churchill said.

Enterprise Risk Management- Challenges and Innovation

Very rarely, can risk be completely eliminated. However, inherent risk can be mitigated through a combination of risk mitigation strategies, risk shifting, and at the end of the day, acceptance of the residual risk. When addressing big data risks, in particular, two types of risks must be discussed: the risk of data breaches and the risk of data misuse. The former is addressed through data security, while the latter is most commonly addressed through data privacy and regulation. When it comes to data security, one of the most significant sources of risk is the overreliance on fairly immutable data elements for identification such as, for example, social security number, names, addresses, dates of birth, credit card numbers, and the like. When any long-lived data element is exposed and misused, the damage is usually broad and long-lasting because changing those data elements is difficult and costly. The mechanism that I’m referring to is known as public-key cryptography and digital signatures, which was invented in the ’80s. While this is widely spread as the method that web browsers use to identify websites (adding the “secure” or “SSL/TLS” labels to the URL bar), it has not had enough traction outside of that specific domain.

What is WireGuard? Secure, simple VPN now part of Linux

For one, the WireGuard protocol does away with cryptographic agility -- the concept of offering choices among different encryption, key exchange and hashing algorithms -- as this has resulted in insecure deployments with other technologies. Instead the protocol uses a selection of modern, thoroughly tested and peer-reviewed cryptographic primitives that result in strong default cryptographic choices that users cannot change or misconfigure. If any serious vulnerability is ever discovered in the used crypto primitives, a new version of the protocol is released and there’s a mechanism of negotiating protocol version between peers. WireGuard uses ChaCha20 for symmetric encryption with Poly1305 for message authentication, a combination that’s more performant than AES on embedded CPU architectures that don’t have cryptographic hardware acceleration; Curve25519 for elliptic-curve Diffie-Hellman (ECDH) key agreement; BLAKE2s for hashing, which is faster than SHA-3; and a 1.5 Round Trip Time (1.5-RTT) handshake that’s based on the Noise framework and provides forward secrecy. It also includes built-in protection against key impersonation, denial-of-service and replay attacks, as well as some post-quantum cryptographic resistance.

How to start your career in cyber security

Unlike many professions, you don’t need cyber security experience to get into the field, although many people entering the field will come from jobs that have similar skillsets, such as systems administration or information analysis. If you can demonstrate the relevance of your existing experience – what recruiters call ‘transferable skills’ – there’s no reason why you can’t get a foothold on the cyber security career ladder. There are also plenty of entry-level positions available. Account executives and junior penetration testers, for example, tend to have little work experience, and can learn while on the job. ... The best way to gain an advantage over other prospective cyber security professionals is to become qualified. The qualifications you need will depend on your career path. If you don’t have this mapped out yet, or you simply want a strong overall understanding of how to navigate security risks, you should seek out a course that covers general topics, such as our Certified Cyber Security Foundation Training Course. This one-day course explains the fundamentals of cyber security and shows you how to protect your organisation from a range of threats.

Is COVID-19 Driving a Surge in Unsafe Remote Connectivity?

As more organizations shift to a remote workforce, new working patterns and technology adoption - including shadow IT - may lead to corporate data suddenly being poorly secured or stored in a manner that violates regulatory requirements. And more systems may be spun up that fail to secure commonly used protocols, such as RDP. "Changes to the network perimeter can also create unanticipated threats, as a higher burden is placed on remote-access systems, and if not correctly implemented, may expose systems to the internet," says Matt Linney, a senior security consultant at 7 Elements. "Looking at this now could save substantial loss in the future." The problem may be exacerbated by COVID-19 driving many organizations to rapidly embrace the equivalent of bootstrap approaches to digital transformation and moving to cloud-based platforms and core services without having first carefully planned, tested, validated and secured their approach (see: Zoom Fixes Flaw That Could Allow Strangers Into Meetings).

Why Continuous Monitoring of Critical Data Is So Essential

To ensure business continuity, manufacturers in India that now have a 100 percent remote workforce because of the COVID-19 pandemic must be vigilant about ensuring critical data is protected through continuous monitoring, says Ravikiran S. Avvaru, head of IT and security at the Gurgaon-based manufacturing group Apollo Tyres Ltd. "As part of our business continuity plan, we identified critical applications for the business which are integrated with the dealers, customers and suppliers and discussed with our third-party vendors, such as Amazon and Microsoft, how to extend support in ensuring the applications are up and running and in secure fashion," Avvaru says in an interview with Information Security Media Group. In addition to enhancing security for business-critical applications accessible in the cloud, for accessing legacy applications housed at a data center, the company has deployed personal firewalls, a VPN along with remote desktop protocols and data leak prevention tools, he explains.

Microsoft: How one Emotet infection took out this organization's entire network

According to Microsoft, Fabrikam called in Microsoft's Cybersecurity Solutions Group's Detection and Response Team (DART) eight days after the employee had opened the phishing email, by which time its computers and critical systems were failing and its network bandwidth had been completely overrun by Emotet. The malware used the victim's compromised computers to launch a distributed denial of service (DDoS) and overwhelm its network. "The virus threatened all of Fabrikam's systems, even its 185-surveillance camera network. Its finance department couldn't complete any external banking transactions, and partner organizations couldn't access any databases controlled by Fabrikam. It was chaos," Microsoft's DART team writes. "They couldn't tell whether an external cyberattack from a hacker caused the shutdown or if they were dealing with an internal virus," it explains further. "It would have helped if they could have even accessed their network accounts. Emotet consumed the network's bandwidth until using it for anything became practically impossible. Even emails couldn't wriggle through."

CSO Pandemic Impact Survey

As of March 23rd, that number had climbed to 77.7%, an increase of 4.7-fold. Notable was high tech firms grew which grew from 31.9%, to 90.2%. While 81% expressed confidence that their existing security infrastructure could handle their employees working from home, 61% were more concerned about security risks targeting WFH employees today than they were three months ago. ... Despite the high levels of confidence that their security infrastructures are up to the task at hand, 22% of organizations have found themselves out shopping for new security solutions/services to address the new work dynamic. Businesses least likely to be investing in new technology or services came from the same industries that identified as most prepared: financial services (12%) and healthcare (14%). Only 7% of SMB organizations (fewer than 1,000 employees) indicated that they had to make security purchases in response to the current conditions, which may indicate either a lack of visibility into their risk environments, a lack of available budget to support new investments, or a combination of both.

Coronavirus prep could prompt better disaster recovery

If your company strongly encourages workers to stay home in response to the virus a significant portion of your company might be working from home for extended periods of time. From a data-protection standpoint; this significantly increases the chances that important intellectual property will be created outside of your data center. If your company currently relies on storing such data on file servers or similar systems, remote employees will probably not be able to use such systems easily. As a result, they will create and store important data directly on their laptops, leaving centralized company storage out of the picture. This means that you should probably examine your company's policy regarding data protection of laptops and mobile devices. Many companies don’t provide backup and recovery for mobile devices, despite the fact that most experts feel they should. Now might be a good time to do so. The main reason early attempts at laptop backup failed was users would kill the backup process because it slowed them down, and it cost too much. The good news is several providers can back up your laptops and mobile devices in such a way that users never realize backups are running.

Return On Artificial Intelligence: The Challenge And The Opportunity

One key driver of lack of return from AI is the simple failure to invest enough. Survey data suggest most companies don’t invest much yet, and I mentioned one above suggesting that investment levels have peaked in many large firms. And the issue is not just the level of investment, but also how the investments are being managed. Few companies are demanding ROI analysis both before and after implementation; they apparently view AI as experimental, even though the most common version of it (supervised machine learning) has been available for over fifty years. The same companies may not plan for increased investment at the deployment stage—typically one or two orders of magnitude more than a pilot—only focusing on pre-deployment AI applications. Of course, with any technology it can be difficult to attribute revenue or profit gains to the application. Smart companies seek intermediate measures of effectiveness, including user behavior changes, task performance, process changes, and so forth—that would precede improvements in financial outcomes. But it’s rare for these to be measured by companies either. Along with several other veterans of big data and AI, I am forming the Return on AI Institute, which will carry out programs of research and structured action, including surveys, case studies, workshops, methodologies, and guidelines for projects and programs.

---

Quote for the day:

"Leadership development is a lifetime journey, not a quick trip." -- John Maxwell

---

Daily Tech Digest - April 03, 2020

How to balance privacy concerns around facial recognition technology

Facial recognition without an individual’s consent has been at the center of controversy in recent news. It’s often associated with widespread surveillance and a breach of civilian privacy. Its use should be distinguished as a technology that removes control from the person whose likeness is being captured without consent — in some cases to catch bad actors or known terrorists, but in other cases, the intent is more malicious. For example, American billionaire John Catsimatidis was recently criticized for using the Clearview AI app to profile his daughter’s date. Catsimatidis simply captured a photo of the individual and uploaded it to the app to conduct a full-fledged background check. ... This use case can and should be considered an abuse of the technology and needs to be reinforced by regulatory bodies. Facial authentication, on the other hand, gives the individual full control by offering a choice as to whether they would like to allow the technology to identify them. Facial authentication is performed to protect logins and is permission-based — it offers a superior level of account protection compared to usernames and passwords, knowledge-based authentication or even SMS-based two factor authentication.

FCC wants to add a new swath of bandwidth to Wi-Fi 6

The driving factor, as ever, is the bottomless demand for spectrum caused by the increasing use of wireless just about everywhere, and the FCC’s announcement cites projections from Cisco that say about 60% of worldwide data traffic will move across Wi-Fi links within the next two years. Using the full 6GHz spectrum – all 1,200MHz of it – is part of the Wi-Fi 6 (802.11ax) standard that can’t be put into use until it is freed up by the FCC. With that spectrum extension in place the standard is known as Wi-Fi 6E, and devices with new silicon would be needed to implement it. “By doing this, we would effectively increase the amount of spectrum available for Wi-Fi almost by a factor of five,” said FCC chair Ajit Pai in a statement. “This would be a huge benefit to consumers and innovators across the nation.” But the incumbent licensed users of parts of the 6GHz spectrum – which are mostly businesses using microwave links for wireless backhaul and public safety services – aren’t pleased. The Utilities Technology Council is one of several groups that has been critical of earlier proposals to open the 6GHz band to broad-based unlicensed use, saying in response to Wednesday’s announcement that assurances that existing users would be protected from interference are unconvincing.

Cnvrg.io launches a free version of its data science platform

Ettun describes CORE as a ‘lightweight version’ of the original platform but still hews closely to the platform’s original mission. “As was our vision from the very start, cnvrg.io wants to help data scientists do what they do best – build high impact AI,” he said. “With the growing technical complexity of the AI field, the data science community has strayed from the core of what makes data science such a captivating profession — the algorithms. Today’s reality is that data scientists are spending 80 percent of their time on non-data science tasks, and 65 percent of models don’t make it to production. Cnvrg.io CORE is an opportunity to open its end-to-end solution to the community to help data scientists and engineers focus less on technical complexity and DevOps, and more on the core of data science — solving complex problems.” This has very much been the company’s direction from the outset and as Ettun noted in a blog post from a few days ago, many data scientists today try to build their own stack by using open-source tools. They want to remain agile and able to customize their tools to their needs, after all.

Australian Privacy Foundation labels CLOUD Act-readying Bill as 'deeply flawed'

"It enshrines an inappropriate level of discretion and weakens parliamentary oversight regarding interaction with governments that disrespect human rights. "It is a manifestation of a drip by drip erosion of privacy protection in the absence of a justiciable constitutionally-enshrined right to privacy in accord with international human rights frameworks." The remarks were made in the opening of APF's submission [PDF] to the Parliamentary Joint Committee on Intelligence and Security (PJCIS) and its review of the Telecommunications Legislation Amendment (International Production Orders) Bill 2020. The Bill is intended to amend the Telecommunications (Interception and Access) Act 1979 (TIA Act) to create a framework for Australian agencies to gain access to stored telecommunications data from foreign designated communication providers in countries that have an agreement with Australia, and vice versa, as well as remove the ability for nominated Administrative Appeals Tribunal members to issue certain warrants.

Windows 10 security: How the shadow stack will help to keep the hackers at bay

Microsoft and Intel worked together on a design called Control-flow Enforcement Technology (CET) several years ago, which adds the new Shadow Stack Pointer (SSP) register and modifies the standard CPU call and return instructions to store a copy of the return address and compare it to the one in memory -- so most programs won't need any changes for compatibility. If the two addresses don't match, which means the stack has been interfered with, the code will stop running. "The shadow page table is assigned in a place that most processes or even the kernel cannot access, and this is supported by a new page table attribute that is not even exposed right now and people can't query it either," Pulapaka said. "The idea is that you will not be able to see that it exists, and you will not be able to touch it -- and if you try to touch it, the kernel doesn't allow it to allow any arbitrary process to touch it." CET also includes some forward call protection: indirect branch tracking does a similar check to CFG but in hardware. The CET specification was first released in 2016 and for compatibility, silicon released since then has had a non-functional version of the instruction that marks indirect branch addresses as safe.

Cyber security matters more than ever

Networks can be accessed in multiple ways, remote offices are common, there is an abundance of bandwidth and cyber security harnesses the power of artificial intelligence and other advanced technologies to help make the mobile office a reality. With more and more people now able to work from home and an estimated 4.1 million people electing to do so, companies need to ensure their cyber security extends beyond the confines of the office walls. With the increasing escalation of the COVID-19 situation in Australia, organisations have closed their physical premises and are enforcing work from home policies to ensure the health, wellbeing, and safety of employees. With much of the workforce now tapping into their home networks to enable business and operational continuity, this raises serious cyber security issues. The State of Cybersecurity in Asia Pacific survey by Palo Alto Networks found that almost half of respondents stated their biggest cyber security challenge was their employees’ lack of cyber security awareness. Imagine if those employees are working from home and accessing devices used by the family for business purposes, this exposes the employee to potential exploitation by cyber criminals and puts the employer at risk.

Zoom Rushes Patches for Zero-Day Vulnerabilities

In recent days, Zoom has faced intense scrutiny over the platform's security and privacy. On Wednesday, researchers revealed that a Zoom feature that's designed to help individuals within an organization quickly connect to others through the desktop app can expose email addresses, full names and profile photos to other users who should not have access, according to Motherboard. Zoom also issued an apology this week for sharing large sets of user data by default with Facebook, blaming the social network's software development kit, which it has removed from its iOS app. Exposed users' data included IP addresses and device model. Zoom has now stopped that data sharing practice and updated its privacy guidelines (see: Zoom Stops Transferring Data by Default to Facebook). On Monday, the New York Times reported that New York Attorney General Letitia James sent a letter to Zoom asking about the company's privacy and security practices. The letter also sought information about vulnerabilities "that could enable malicious third parties to, among other things, gain surreptitious access to consumer webcams," according to the report.

Are you overengineering your cloud apps?

People building applications on public clouds have a multitude of cloud services that can be integrated into that application with little time and very little money. AI services, such as deep learning and machine learning, are often leveraged from applications just because of the ease of doing so. In many cases, the use of AI within a specific application is actually contraindicated. Other tempting services include containers and container orchestration systems. Although these are a great addition for a good many apps, I’m seeing them more and more force-fit these days. Developers are being lured by their hype. The trade-off here is that overengineered cloud apps are more costly to build, overly complex, and thus harder to operate over time. Indeed, they may double the cost of cloudops after deployment, as well as double the cloud bill you’ll get monthly. Cloud app designers and developers need to focus on the minimum viable features that the cloud applications need to solve the core problems. An inventory control application perhaps does not need a machine learning system bolted on, but a fraud detection system does.

Microsoft to hospitals: 11 tips on how to combat ransomware

Ransomware can be damaging to any business, as it holds critical data hostage; with most companies, the loss can be measured financially. But when a hospital is attacked with ransomware, the cost can be measured in human life, either through direct patient care or through research being done on vaccines and medicine. Further, hospitals are now so focused on the coronavirus that medical staff and employees may forget the usual security protocols when dealing with email and other content. All of this makes them potentially easy prey for ransomware. Though a range of criminal groups and campaigns are known to employ ransomware, Microsoft in its blog post focused on REvil, also known as Sodinokibi. This campaign exploits gateway and VPN flaws to gain entry into organizations. This type of strategy is especially rampant now as so many more people are working from home or remotely. If successful, these attackers can steal user credentials, elevate their privileges, and then move across compromised networks to install ransomware and other malware. Gangs like REvil use human-operated methods to target organizations most vulnerable to attack.

Is remote work the new normal?

As COVID-19 continues to spread, remote work is no longer an experiment, but a requirement in many nations. While it represents a huge change, the results of a research conducted by OnePoll and Citrix, reveal that a majority of employees around the world are adapting to working from home and believe it will become the new normal for the way work gets done. “Remote work is not business as usual. It represents a totally new way of thinking and operating and can be a difficult adjustment for employees and employers to make,” says Donna Kimmel, Chief People Officer, Citrix. “But business must go on, even in times of crisis. And as the research makes clear, companies that give their people the right tools can help them make the transition, empower them to be and perform at their best, and emerge stronger when conditions improve.” As Kimmel notes, remote work is a completely new concept for most employees. ... “You can have the best technology in the world. But if you don’t provide employees with resources to help them make the adjustment, they won’t use it and continue to engage and be productive,” Kimmel says.

---

Quote for the day:

"A good objective of leadership is to help those who are doing poorly to do well and to help those who are doing well to do even better." -- Jim Rohn

---

Daily Tech Digest - April 02, 2020

A crypto-mining botnet has been hijacking MSSQL servers for almost two years

The brute-force attacks that seek to guess the password of MSSQL servers have sprayed the entire internet. Guardicore says that since May 2018, they've more than 120 IP addresses used to launch attacks, with most IPs coming from China. "These are most likely compromised machines, repurposed to scan and infect new victims," Harpaz said. "While some of them were short-lived and responsible for only several incidents, a couple of source IPs were active for over three months." Harpaz said that the botnet has been in a constant churn, with the botnet losing servers and adding new ones daily. Per Guardicore, more than 60% of all hijacked MSSQL servers remain infected with the Vollgar crypto-mining malware only for short periods of up to two days. Harpaz said that almost 20% of all MSSQL systems, however, remain infected for more than a week, and even longer. Harpaz believes this is because either the Vollgar malware manages to disguise itself from the local security software, or the database isn't running one in the first place.

Thousands of potential phishing sites created to target Zoom users as usage soars

As well as targeting companies through Zoom, cybercriminals are trying different cyber scams to trick companies. These scams include impersonation on social media platforms or phishing emails. The scams are aimed at tricking employees into giving money away, provide the credentials to cloud-based applications, or pay fake invoices. This increase in online fraud is a significant threat that most companies are not prepared for. Yoav Keren, CEO, BrandShield, said: “With global businesses big and small become increasingly reliant on video conferencing facilities like Zoom, sadly, cybercriminals are trying to capitalise. Businesses need to educate their employees quickly about the risks they may face, and what to look out for. The cost of successful phishing attacks is bad for a company’s balance sheet in the best of times, but at the moment it could be fatal. “BrandShield protects some of the biggest corporations in the world and we takedown thousands of threats across websites and social media. 

Edge computing environments: what you need to know

Edge will evolve, from local deployments to regional, to the core; from regional to regional, or from regional to core. Increasingly, users won’t want to rely on public wide-are network (WAN) to relay data between datacentres or integrate data from different applications, especially since IoT apps mean a lot of integrated data. “Colocation provider VPNs and virtual interconnections are able to offer a kind of private routing,” Ascierto says. “You can track where the data is routed; it doesn’t go on the internet and a black hole appears at the core.” Edge computing startup Vapor IO signed a deal with network provider Cloudflare in January to roll out on the former’s Kinetic Edge integrated edge colocation, networking and exchange services platform. Nitin Rao, head of global infrastructure at Cloudflare, says the interconnection ecosystem includes small datacentres at wireless aggregation hubs, owned by investors. 

AI and big data won’t work miracles in the fight against coronavirus

It’s not that these applications of AI are bad, but rather that they belong to a set with few actionable outcomes. If your big data analysis of traffic supports or undercuts a proposed policy of limiting transportation options in such and such a way, that’s one thing. If your analysis produces dozens of possible courses of action, any of which might be a dead end or even detrimental to current efforts, it’s quite another. Because these companies are tech companies, and by necessity part ways with their solutions once they are proposed. Any given treatment lead requires a grueling battery of real-life tests even to be excluded as a possibility, let alone found to be effective. Even drugs already approved for other purposes would need to be re-tested for this new application before they could be responsibly deployed at scale. Furthermore, the novel substances that are often the result of this type of drug discovery process are not guaranteed to have a realistic path to manufacturing even at the scale of thousands of doses, to say nothing of billions. That’s a completely different problem!

How enterprise networking is changing with a work-at-home workforce

DNS vendor BlueCat says it has been tracking the use of DNS over HTTPS (DoH) – a method of encrypting queries to prevent visibility into DNS traffic patterns. Over the last week through March 27, the company said it has seen a massive increase in the use of DoH across its customer base wrote Ben Ball, director of strategy and content marketing at BlueCat in a blog about the trend. “In the course of a single weekend, the number of endpoints attempting to use DoH went from an average of 90 to about 1,400. That’s a 1,500% increase in the use of DoH. Around 45% of these queries are from Firefox (which now activates DoH by default). Aside from that, we’re seeing queries to eleven different DoH services from all kinds of applications. DoH usage is fairly uniform across our customer base as well – this isn’t one company or industry vertical; this is a broad trend. While we haven’t seen any clear indications that any of these queries are from DoH enabled malware, that is an emerging threat that we are tracking,” Ball stated.

Windows 10 bug that broke internet connectivity gets patched – here’s how to install the fix

Affected users are those running a VPN (or proxy) who might experience net connectivity issues with some applications (or the system may indicate there’s no internet connection, even if there actually is – a more minor glitch where connectivity isn’t actually disrupted). ... Note that Windows 10 users won’t get this new fix from Windows Update, as is commonly the case (at least not yet, at the time of writing). Rather, it is necessary to grab this one manually and install it that way. Luckily, this is a simple process which we’ll explain in full now. If you’re running Windows 10 November 2019 Update or May 2019 Update, head over to the Microsoft Update Catalog here and download the relevant version for your system. All you need to do to install the file is double-click on it once downloaded, and then follow the instructions. Version 1909 is the November 2019 Update and version 1903 is the May 2019 update (as you’ll see, there’s also a version for those running Windows Server). Almost all users will need to download the relevant patch for x64-based systems, if you’re running 64-bit Windows 10, which is highly likely.

The Future Of Data Science

As of today, most of the data science usage is centred on descriptive, diagnostic or predictive analytics. In the future, the new-age data science practice will allow the service provider to generate content that is profitable and enriching for the consumer. Let me elaborate on this further. In one household, there are different consumer needs for online content on platforms like Netflix or Amazon Prime. My content consumption as a business professional is very different from that of my teenage kids. Today, it is difficult to track the individual user preferences as the service provider might not understand the actual user who is holding the remote in his or her hand. However, once we move to use voice, it will be easy for the machine to understand if the consumer is an adult or a teenage kid. Within a single user ID, then, the content that will be pushed will be very different and more relevant for the consumer. Once, such interactions start between the human consumer and the machine that understands the human voice (tone to predict mood/emotions), there are limitless possibilities to personalise the content, and then charge a premium for it.

Microsoft directly warns hospitals, 'Fix your vulnerable VPN appliances'

"Through Microsoft's vast network of threat intelligence sources, we identified several dozens of hospitals with vulnerable gateway and VPN appliances in their infrastructure," the Microsoft Threat Protection Intelligence Team revealed in a new post. "To help these hospitals, many already inundated with patients, we sent out a first-of-its-kind targeted notification with important information about the vulnerabilities," it added. The alert contained information about how attackers can exploit the flaws, and a "strong" warning that the affected hospitals need to apply security updates that will protect them from exploits.  One group the Microsoft team has been tracking is the REvil, aka Sodinokibi, ransomware gang, which is known for making massive ransom demands on businesses and government agencies. In January it was caught targeting unpatched Pulse Secure VPNs, as well as flaws in enterprise Citrix servers. The ransomware gang hasn't developed new attack techniques but rather has repurposed tactics from state-sponsored attacks for new campaigns that exploit the heightened need for information in the current coronavirus crisis.

Is Kubernetes becoming the driving force of enterprise IT?

In a world where innovation and time to market is a top priority, Day One developers need to be able to efficiently provision infrastructure and get coding. Using a managed platform that provides ready access to everything needed to run containers and Kubernetes consistently across a hybrid environment (including support and security) means application and developer teams can spend more time solving business problems. Many organisations will want their hybrid environment to include multiple public clouds. This means they need to be aware of how much flexibility and freedom they’ll want for using the technologies of their choice—including emerging innovations like Quarkus, which lets you build cloud-native applications; or Operators, a way of packaging Kubernetes-native applications for easier management. Ultimately, this means understanding the difference between an open platform and a proprietary one.

Thousands of PCs break exaFLOP barrier

An exaFLOP is one quintillion (1018) floating-point operations per second, or 1,000 petaFLOPS. To match what a one exaFLOP computer system can do in just one second, you'd have to perform one calculation every second for 31,688,765,000 years. While the supercomputing stalwarts continue to build their systems, Folding@Home just crossed the exaFLOP barrier ahead of IBM, Intel, Nvidia, and the Department of Energy. Folding@home is a distributed computing project running for 20 years. It was administered first by the chemistry department at Stanford University and as of last year, by Washington University in St. Louis. Its software runs on individual PCs and remains idle as long as the computer is in use, then it kicks in when the PC is idle. The project simulates how proteins misfold and cause diseases such as cancer and Alzheimer's Disease. Proteins self-assemble in a process called folding. When a protein misfolds, disease can occur. By simulating protein misfolds, Folding@Home seeks to understand why they misfold and perhaps how to prevent it and undo the damage.

---

Quote for the day:

"Don't just hope to have a great day; do everything to make it a great day! Live Intentionally!" -- Bruce Van Horn

---

Daily Tech Digest - April 01, 2020

Providers address capacity, supply-chain challenges brought on by COVID-19

In terms of physical infrastructure, Netflix had to overcome some supply-chain obstacles. "We have had multiple fires at this point with our supply chain," Temkin said. For example, the primary server manufacturer for Netflix is located in Santa Clara County, Calif., where residents have been ordered to shelter in place. "We had 24 hours to figure out how to get as many of the boxes out of there as we possibly could," he said. Netflix has resolved those supply issues, for the most part, by sourcing elsewhere. "By and large, we've been able to use most of the infrastructure we have deployed. Partners like Equinix have been great about getting cross-connects provisioned quickly where we need them in order to get interconnects beefed up in certain markets," Temkin said. On the content-production side, there's not a lot happening – at Netflix or anywhere else – as studios halt film and TV production to avoid further fueling the outbreak. "One of the big challenges we are trying to figure out is: what parts of it can we restart?" Temkin said.

Key risk governance practices for optimal data security

From cyber security standards to policies around articulating data handling processes and providing transparent updates, the organization needs to clearly understand all of the compliance standards relevant to it. In addition, it needs to make sure its regulatory readiness processes extend to not just internal compliance and risk management but also to compliance with regulations like General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA). This is especially important for heavily regulated industries such as banking, financial services, technology, where many of the organizations’ business models are rooted in customer data To support the two elements above, the organization needs to undertake a sustained effort to seamlessly map out its data handling process across the stages of acquisition, storage, transformation, transport, archival, and even disposal. 

Lay the groundwork for a SecOps team structure

The overriding factor that separates IT and security teams is organizational misalignment; the two teams often report up through different management structures. The executives leading each faction -- the CIO and CISO, respectively -- typically have different goals, which are measured and rewarded by disparate key performance indicators (KPIs). In addition, the CIO is often perceived as being higher in the executive pecking order. To create a culture of shared security across the organization, give the CISO and other IT security leaders more status and authority. Include them in the strategy, planning and early development phases of new IT and application projects and treat them as a trusted partner. Shared authority at the executive level requires shared goals. IT operations and security teams will likely continue to have separate budgets and distinct projects, but hold managers in each organization accountable for common -- or at least comparable and tightly related -- objectives and KPIs.

COVID-19 puts new demands on e-health record systems

IT staffers are also required to update EHR systems as additional clinical workers are drafted for duty. “Some health providers have reported that they're being kept very busy with setting up processes for quickly onboarding new staff and changing their role within the system,” said Jones. “That requires a change in configuration of the EHR in terms of their role-based access, and in some cases it is creating new user accounts.” As workflows are updated to deal with the COVID-19 response, it is important that EHR systems don’t impede clinicians’ work, are straightforward and seamlessly integrate with existing care delivery processes. “The EHR workflow really needs to disappear into the background as providers ramp up to address COVID-19 capacity surges,” said Jones.  “At a fundamental level, all EHRs need to be working as intended — now more than ever,” said Bensinger. “And not only clinical workflows and features. You want to be sure that the registration and billing components are also collecting accurate and complete information.

Who’s responsible for protecting personal information?

Americans are split on who should be held most responsible for ensuring personal information and data privacy are protected. Just over a third believe companies are most responsible (36%), followed closely by the individuals providing their information (34%), with slightly fewer holding the government most responsible (29%). Half of Americans don’t give companies (49%) and government (51%) credit for doing enough when it comes to data privacy and protection. Notably, compared to the other countries surveyed, Americans are most likely to put the burden on individuals—in fact, it’s the only country where the individual consumer outranks government as most responsible. “Americans are outliers compared to other countries surveyed in that they are willing to accept a lot of the responsibility in protecting their own data and personal information,” says Paige Hanson, chief of cyber safety education, NortonLifeLock. “This could be the year Americans truly embrace their privacy independence, particularly with the help of new regulations like the California Consumer Privacy Act giving them control over how their data is used.”

Can cloud computing sustain the remote working surge?

Currently, cloud providers are still doing a good job in distributing resources among tenants, but at some point rationing measures may need to be implemented to respond to overwhelming demand. Not all cloud services are going to drown though. Matthew Prince, co-founder and CEO of Cloudflare, said that providers may have “individual challenges spurred by the pandemic” – their ability to cope with the shift in usage is highly dependent on their IT architecture. Major cloud providers such as Amazon have expressed confidence in meeting customer demand for capacity. By and large, public cloud providers seem to be coping well with the skyrocketing demand – there has yet to be any issues of major cloud crashes just yet. What providers should really be concerned about is the challenges that will come post-pandemic. By then, enterprises would have already recognized the unquestionable value of cloud, and will double down on cloud migrations. Cloud providers must make sure that their data infrastructure is prepared to support data at unprecedented scales. Warren Buffet once remarked: “you will only find out who is swimming naked when the tide goes out.”

Writing Microservices in Kotlin with Ktor—a Multiplatform Framework for Connected Systems

Ktor (pronounced Kay-tor) is a framework built from the ground up using Kotlin and coroutines. It gives us the ability to create client and server-side applications that can run and target multiple platforms. It is a great fit for applications that require HTTP and/or socket connectivity. These can be HTTP backends and RESTful systems, whether or not they’re architectured in a microservice approach. Ktor was born out of inspiration from other frameworks, such as Wasabi and Kara, in an aim to leverage to the maximum extent some of the language features that Kotlin offers, such as DSLs and coroutines. When it comes to creating connected systems, Ktor provides a performant, asynchronous, multi-platform solution. Currently, the Ktor client works on all platforms Kotlin targets, that is, JVM, JavaScript, and Native. Right now, Ktor server-side is restricted to the JVM. In this article, we’re going to take a look at using Ktor for server-side development. ... routing, get, and post are all higher-order functions. In this case, we’re talking about taking functions as parameters. Kotlin also has a convention that if the last parameter to a function is another function, we can place this outside of the brackets.

Get ready for the post-pandemic run on cloud

Business seems to change around pain. In the past weeks companies that had already migrated to public cloud had a strategic advantage over those still operating mostly in traditional data centers.  Traditional data centers are the responsibility of enterprise IT, and as such they are run by human employees who have to deal with mandatory lockdowns or even self-quarantine and may not be able to operate remotely. I have a CIO friend of mine who has a down physical storage system and a direct replacement sitting next to it, shrink-wrapped and ready to be installed. So far, he can’t get enough qualified staffers physically in the data center to make the swap. As a result, a major system is not operating, and they are losing millions a week. Those who have migrated to public clouds don’t have to deal with such things. The virtual and ubiquitous nature of cloud computing that scared so many IT pros during the past several years is actually one of the major reasons to move to public cloud. The weakness for enterprise IT recently has been the inability to support a physical set of systems that need physical fixes by humans.

Using Zoom while working from home? Here are the privacy risks to watch out for

Privacy experts have previously expressed concerns about Zoom: In 2019, the video-conferencing software experienced both a webcam hacking scandal, and a bug that allowed snooping users to potentially join video meetings they hadn't been invited to. This month, the Electronic Frontier Foundation cautioned users working from home about the software's onboard privacy features. Here are some of the privacy vulnerabilities in Zoom that you should watch out for while working remotely. ... Employers, managers and workers-from-home, beware. Zoom's tattle-tale attention-tracking feature can tell your meeting host if you aren't paying attention to their meticulously-composed visual aids. Whether you're using Zoom's desktop client or mobile app, a meeting host can enable a built-in option which alerts them if any attendees go more than 30 seconds without Zoom being in focus on their screen.  If you're anything like me, your Zoom meetings rarely consume your full screen. Jotting down notes in a separate text file, adding dates to calendars, glancing at reference documents or discreetly asking and answering clarifying questions in a separate chat -- these key parts of any normal meeting are all indicators of an engaged listener.

Neural computing should be based on insect brains, not human ones

Marshall is referring to a form of deep-learning computing for which developers are creating electronic architectures that mimic neurobiological architectures that could replace traditional computing. Deep-learning computing falls within artificial intelligence in which computers learn through rewards for recognizing patterns in data. A difference is that in deep learning neural processes are used. Variations include neuromorphic computing that I wrote about here that can analyze high- and low-level detail such as edges and shapes. Bees “are basically mini-robots,” says Marshall, quoted in the Daily Telegraph. “They’re really consistent visual navigators, they can navigate complex 3-D environments with minimal learning and using only a million neurons in a cubic millimeter of the brain.” That size element could grab the attention of developers who are working toward tiny robots that communicate with each other to self-organize and could be used, for example, to move objects in factories.

---

Quote for the day:

“When I look at...great experiences, it’s often more to do with the DNA than the MBA.” -- Shaun Smith

---

Daily Tech Digest - March 31, 2020

Nasscom seeks relief for technology startups for business continuity

Some of the important measures demanded from the government to help the startups include a rental subsidy for workspaces used by startups which are regulated/owned/managed by government agencies; blanket suspension of all deadlines including tax payment deadlines and filing deadlines until at least four weeks post lifting of all city lockdown. The industry body said that the pandemic has created a significant liquidity crunch for the sector and to ensure timely payment of salaries to employees, the banks may voluntarily provide for an overdraft facility or interest-free and equity convertible funding to startups. Nasscom has demanded a one-time provident fund opt-out option for employees. "The Government can consider providing an option to the employees for a onetime PF opt-out option for the next financial year 2020-21. In such a case, both the employee and employer's contributions towards the PF may be transferred directly to the employee. This will result in an increase in the take-home pay of the employees," said Nasscom in the representation made to the government.

Reference Architecture for Healthcare – Introduction and Principles

The good news is that information technology can solve problems of fragmentation, through smart process management, and the exchange of standardized information, to name a few. A Blueprint for the Healthcare Industry: The aim must be to help organizations provide health services with better outcomes, at lower cost, and improved patient and staff experience. We need a toolbox that is flexible, adaptable to individual needs, and that can serve a network of partners that team up to deliver care. The Patient Perspective: As a patient with a chronic disease, I monitor my health condition daily. I manage my medication with the help of my devices and adjust my lifestyle accordingly. My care providers should work with me to manage my disease. The Health Professional Perspective: As a Healthcare professional, I need to team up to coordinate delivery of care. I create, use, and share information with other care providers within a given episode of care, and across different treatment periods. The Architect and Planner Perspective: As a user of the reference architecture, I need an easy-to-use toolbox that is readily available and helps me in my daily work. It needs to align with the regulations of our industry.

2020 Challenge: Unlearn to Change Your Frame

Maybe the biggest challenge we face as a society is our ability to unlearn – to let go of – outdated concepts and beliefs in order to adopt new approaches. Our everyday lives are dominated by outdated concepts: change the oil every 3,000 miles, don’t wear white before Memorial Day, only senior management has the best ideas, don’t eat dessert until you’ve cleaned your plate, trade wars are easy to win, leeches work wonders on headaches, etc. Well, I’m going to throw down the gauntlet and challenge everyone to open their minds to the possibility of new ideas and new learning. That does not mean you should blindly believe, but instead, should invest the time to study, unlearn and learn new approaches and concepts. “You can’t climb a ladder if you’re not willing to let go of the rung below you.” As the new Chief Innovation Officer at Hitachi Vantara, leveraging ideation and innovation to derive and drive new sources of customer, product and operational value is more important than ever. So, Hitachi Vantara employees and customers, be prepared to change your frames; to challenge conventional thinking with respect to how we blend new concepts – AI / ML, Big Data, IOT – with tried and true ideas – Economics, Design Thinking – to create new sources of value.

How data governance and data management work together

Although data governance provides a framework of controls for effective data management, it is just one component of the overall practice. Dan Everett, VP of product and solution marketing at Informatica, accurately described the relationship between data management and governance in a blog post. He said data governance must be implemented to be effective, while data management facilitates policy enforcement. Business size often determines how the data governance and data management responsibilities are organized and assigned. But size shouldn't be a determining factor for treating data as an enterprise asset, establishing effective data governance policies and performing high-quality data management. ... The initial data governance policies and data management procedures will most likely have gaps that lead to data quality issues. In addition, ensuring enterprise data is correct and used properly throughout the organization is fluid by nature. In other words, "things change." Data usage is highly dynamic and data governance controls and data management procedures may not always provide the guidance and best practices needed to guarantee data quality across all data stores. 

Too late to protect online privacy, say Brits

“Growing awareness around data privacy issues has compelled consumers to seek more control over their data and take some action to protect their privacy online. However, with over half of Brits saying they don’t know how to safeguard their online privacy, there is still a clear need for education on how people can keep themselves, and their data, safe online.” The extensive study found that 86% claimed to have taken at least one step to protect themselves online, such as clearing or disabling cookies, limiting what they share on social media platforms, and not using public Wi-Fi. Almost exactly the same proportion said they could still do more to protect themselves. In terms of what keeps consumers awake at night, NortonLifeLock found that 65% of Brits believe facial recognition technology will be misused and abused, and 42% believe it will do more harm than good – even though the majority also seem to support its use, with over 70% supporting its use by law enforcement.

What are deepfakes – and how can you spot them?

Deepfake technology can create convincing but entirely fictional photos from scratch. A non-existent Bloomberg journalist, “Maisy Kinsley”, who had a profile on LinkedIn and Twitter, was probably a deepfake. Another LinkedIn fake, “Katie Jones”, claimed to work at the Center for Strategic and International Studies, but is thought to be a deepfake created for a foreign spying operation. Audio can be deepfaked too, to create “voice skins” or ”voice clones” of public figures. Last March, the chief of a UK subsidiary of a German energy firm paid nearly £200,000 into a Hungarian bank account after being phoned by a fraudster who mimicked the German CEO’s voice. The company’s insurers believe the voice was a deepfake, but the evidence is unclear. Similar scams have reportedly used recorded WhatsApp voice messages. ... Poor-quality deepfakes are easier to spot. The lip synching might be bad, or the skin tone patchy. There can be flickering around the edges of transposed faces. And fine details, such as hair, are particularly hard for deepfakes to render well, especially where strands are visible on the fringe.

Spike in Remote Work Leads to 40% Increase in RDP Exposure to Hackers

As Covid-19 continues to wreak havoc globally, companies are keeping their employees at home. To ensure compliance and stay atop security standards, teleworkers have to patch into their company’s infrastructure using remote desktop protocol (RDP) and virtual private networks (VPN). But not everyone uses these solutions securely. Research by the folks behind Shodan, the search engine for Internet-connected devices, reveals that IT departments globally are exposing their organizations to risk as more companies go remote due to COVID-19. “The Remote Desktop Protocol (RDP) is a common way for Windows users to remotely manage their workstation or server. However, it has a history of security issues and generally shouldn’t be publicly accessible without any other protections (ex. firewall whitelist, 2FA),” writes Shodan creator John Matherly. After pulling new data regarding devices exposed via RDP and VPN, Matherly found that the number of devices exposing RDP to the Internet on standard ports jumped more than 40 percent over the past month to 3,389. In an attempt to foil hackers, IT administrators sometimes put an insecure service on a non-standard port (aka security by obscurity), Matherly notes.

Google’s CameraX Android API will let third-party apps use the best features of the stock camera

The benefit of using CameraX as a wrapper for the Camera2 API is that, internally, it resolves any device-specific compatibility issues that may arise. This alone will be useful for camera app developers since it can reduce boilerplate code and time spent researching camera problems. That’s not all that CameraX can do, though. While that first part is mostly only interesting to developers, there’s another part that applies to both developers and end users: Vendor Extensions. This is Google’s answer to the camera feature fragmentation on Android. Device manufacturers can opt to ship extension libraries with their phones that allow CameraX (and developers and users) to leverage native camera features. For example, say you really like Samsung’s Portrait Mode effect, but you don’t like the camera app itself. If Samsung decides to implement a CameraX Portrait Mode extension in its phones, any third-party app using CameraX will be able to use Samsung’s Portrait Mode. Obviously, this isn’t just confined to that one feature. Manufacturers can theoretically open up any of their camera features to apps using CameraX.

Personal details for the entire country of Georgia published online

Personal information such as full names, home addresses, dates of birth, ID numbers, and mobile phone numbers were shared online in a 1.04 GB MDB (Microsoft Access database) file. The leaked data was spotted by the Under the Breach, a data breach monitoring and prevention service, and shared with ZDNet over the weekend. The database contained 4,934,863 records including details for millions of deceased citizens -- as can be seen from the screenshot below. Georgia's current population is estimated at 3.7 million, according to a 2019 census. It is unclear if the forum user who shared the data is the one who obtained it. The data's source also remains a mystery. On Sunday, ZDNet initially reported this leak over as coming from Georgia's Central Election Commission (CEC), but in a statement on Monday, the commission denied that the data originated from its servers, as it contained information that they don't usually collect.

AlphaFold Algorithm Predicts COVID-19 Protein Structures

AlphaFold is composed of three distinct layers of deep neural networks. The first layer is composed of a variational autoencoder stacked with an attention model, which generates realistic-looking fragments based on a single sequence’s amino acids. The second layer is split into two sublayers. The first sublayer optimizes inter-residue distances using a 1D CNN on a contact map, which is a 2D representation of amino acid residue distance by projecting the contact map onto a single dimension to input into the CNN. The second sublayer optimizes a scoring network, which is how much the generated substructures look like a protein using a 3D CNN. After regularizing, they add a third neural network layer that scores the generated protein against the actual model. The model conducted training on the Protein Data Bank, which is a freely accessible database that contains the three-dimensional structures for larger biological molecules such as proteins and nucleic acids.

---

Quote for the day:

"A leader knows what's best to do. A manager knows merely how best to do it." -- Ken Adelman

---