Daily Tech Digest - April 06, 2020

How DevOps is integral to a cloud-native strategy

Containerisation allows applications to be made environment-agnostic and eliminates application conflicts between developers and operations teams, in turn allowing greater collaboration between developers and testers. Breaking down monolithic applications into constituent microservices also increases agility and creates a common toolset, terminology, and set of processes between development and operations teams, which makes it easier for these teams to work with one another. This enables the advanced automation of processes and contributes to an organisation’s move towards agile software development (defined by the continuous delivery of software created in rapid iterations). It’s important to stress that these technologies will only be successfully implemented if that cultural shift happens too, which is where embracing DevOps becomes key. Going cloud-native is a gradual process and a learning experience. Most organisations have established IT environments that use on-premise applications.

Human rights groups warn governments of privacy laws when tracking COVID-19

"An increase in state digital surveillance powers, such as obtaining access to mobile phone location data, threatens privacy, freedom of expression, and freedom of association, in ways that could violate rights and degrade trust in public authorities -- undermining the effectiveness of any public health response. Such measures also pose a risk of discrimination and may disproportionately harm already marginalized communities," the joint statement said. "These are extraordinary times, but human rights law still applies. Indeed, the human rights framework is designed to ensure that different rights can be carefully balanced to protect individuals and wider societies. "States cannot simply disregard rights such as privacy and freedom of expression in the name of tackling a public health crisis. On the contrary, protecting human rights also promotes public health. Now more than ever, governments must rigorously ensure that any restrictions to these rights is in line with long-established human rights safeguards." As part of the statement, the signatories set out eight proposed conditions for all governments to adhere to if increased digital surveillance is used to respond to the COVID-19 pandemic.

6 Tech Books To Read While In Quarantine

Fog and Edge Computing: Principles and Paradigms provides a comprehensive overview of the state-of-the-art applications and architectures driving this dynamic field of computing while highlighting potential research directions and emerging technologies. Exploring topics such as developing scalable architectures, moving from closed systems to open systems, and ethical issues arising from data sensing, this timely book addresses both the challenges and opportunities that Fog and Edge computing presents. ... The Cloud Adoption Playbook helps business and technology leaders in enterprise organisations sort through the options and make the best choices for accelerating cloud adoption and digital transformation. Written by a team of IBM technical executives with a wealth of real-world client experience, this book cuts through the hype, answers your questions, and helps you tailor your cloud adoption and digital transformation journey to the needs of your organisation. ... The updated edition of this practical book shows developers and ops personnel how Kubernetes and container technology can help you achieve new levels of velocity, agility, reliability, and efficiency.

Applications: Combining the old with the new

There are a few reasons why mainframes applications cannot be migrated to public cloud infrastructure easily. Cresswell says mainframe applications will not run on the underlying cloud hardware without significant refactoring and recompilation. “They are typically compiled into mainframe-specific machine code and the mainframe instruction-set architecture is substantially different from the x86 platforms that underpin almost all cloud services,” he says. “Legacy mainframe applications rely on infrastructure software to manage batch and online activity, data access and many other legacy mainframe features. Like the applications themselves, this infrastructure software is also tied to the physical mainframe hardware and will not run in a conventional x86 cloud environment.” Another barrier to migrating mainframe systems is that the mainframe software development pipeline cannot support many of the rapid deployment features that cloud-native applications rely on, says Cresswell, and it is virtually impossible to spin up testing environments on mainframes without extensive planning.

7 Key Principles to Govern Digital Initiatives

An important starting point is to take an inventory of digital initiatives. This may sound like a straightforward task, but it is often quite challenging. People are reluctant to share information for fear they may lose control over their initiatives. Thus, it is helpful to stress that the inventory phase is about the centralization of information about digital initiatives, not control over them. Fred Herren, senior vice president, digital and innovation at SGS, the world’s largest provider of inspection, testing, and certification services, understood that applying a top-down approach to rules rarely works in decentralized cultures. He noted, “I think it’s necessary to walk the talk rather than give instructions. I’ve managed to get a lot of information because I’m not telling employees to stop [their activities]. I walk around and ask people what’s new and I always react positively.” ... Establishing appropriate key performance indicators (KPIs) is a critical exercise, particularly for digital initiatives that are highly dependent on strategic priorities related to the company’s future vision, success, and implementation objectives. However, when we asked leaders how they measure the performance of digital initiatives, most of them answered in one of two ways: either “we don’t” or “it depends.”

Emerging from AI utopia

Facial recognition is a good example of an AI-driven technology that is starting to have a dramatic human impact. When facial recognition is used to unlock a smartphone, the risk of harm is low, but the stakes are much higher when it is used for policing. In well over a dozen countries, law enforcement agencies have started using facial recognition to identify “suspects” by matching photos scraped from the social media accounts of 3 billion people around the world. Recently, the London Metropolitan Police used the technology to identify 104 suspects, 102 of whom turned out to be “false positives.” In a policing context, the human rights risk is highest because a person can be unlawfully arrested, detained, and ultimately subjected to wrongful prosecution. Moreover, facial recognition errors are not evenly distributed across the community. In Western countries, where there are more readily available data, the technology is far more accurate at identifying white men than any other group, in part because it tends to be trained on datasets of photos that are disproportionately made up of white men. Such uses of AI can cause old problems—like unlawful discrimination—to appear in new forms. Right now, some countries are using AI and mobile phone data to track people in self-quarantine because of the coronavirus disease 2019 pandemic. The privacy and other impacts of such measures might be justified by the scale of the current crisis, but even in an emergency, human rights must still be protected. Moreover, we will need to ensure that extreme measures do not become the new normal when the period of crisis passes.

Is Blockchain Necessary? An Unbiased Perspective

Bankers hate blockchain. It’s obvious why they would; the greatest advantage of blockchain is that it cuts down on costs, only requiring infrastructure costs. No transaction fees, no maintenance charges, nothing. Effectively, blockchain makes banking obsolete, and honestly, I feel it should. The banking industry has remained unchanged over millennia. It is an integral part of society whose mismanaged monetary transactions have incited myriad wars. Unfortunately, the banking industry is in a pathetic state. Bankers have too much power, control and streams of revenue. It needs to topple. It’s a legacy system, and the pain points of this system haven’t changed since the days of Venetian merchants. There is so much abuse of power involved, and the fact that it is legal paints a grim picture. For example, the man who invented the credit card never wanted interest rates to go over 8%. Today, banks on average charge from 12% to 18% not including transaction, processing and various other fees. Blockchain can destroy and recreate this system. However, this brings us to the greatest chink in blockchain’s armor: This transformative process is expensive and decentralized.

Remote Working: What It Means For RPA

RPA still has considerable risks with remote working. If anything, companies will need to engage in even more planning with their systems. “Enterprise grade security needs to be baked into any RPA platform from the start, which helps provide greater resilience and business continuity,” said Jason Kingdon, who is the Executive Chairman at Blue Prism. There will also need to be more attention paid to managing bot development and deployment. Otherwise there could be much more sprawl across an organization, lessening the benefits of the technology. This is why its important to have a Center-of-Excellence or COE (you can learn more about this from one of my recent Forbes.com posts). “You need to have a group of champions who control the system, and monitor what bots are being built and who is building them,” said Tabakman. “It’s best to provide regular training around bot design and consider an approval process, where your champions review bots before they’re deployed. You’ll want to ensure that a bot being created doesn’t create more problems than it solves, such as bots that go into infinite loops, resulting in more work for IT teams.

Overcoming flat data to unlock business insight and productivity

Artificial intelligence is eliminating entire swathes of manual intervention in the processing of documents, and, more importantly, adding context to them. It’s not enough to simply scan a document and store it along with a reference number: the technology must be able to add meaning to it and to create links with other related data, structured or unstructured. This type of technology falls into a category that we call Context Driven Productivity. At its core is the ability to extract information from flat data and transform it into semantic data, whereby links are created to other data sources, both internal and external, building relationships, connections and additional meaning. Semantic data allows humans or AI robots to gain contextual information automatically, rather than having to rely on a limited number of hard-wired connections. In practical terms, the possibilities are enormous. Not only will administrative workers be freed from the tedious task of manually processing incoming documents, but the resulting context-driven data will be infinitely more useful to any organisation.

How cloud computing is changing the laboratory ecosystem

Cloud computing allows labs to partake in immense computing processes without the cost and complexity of running onsite server rooms. Switching from an onsite solution to the cloud alleviates the costs of IT infrastructure, reducing the cost of entry into the industry, while also leveling the playing field for smaller laboratories. Moreover, cloud computing can allow data to be extracted from laboratory devices to be put in the cloud. Device integration between lab equipment and cloud services allows real-life data from experiments to be collated in a cloud system. One of the most popular products in the market is Cubuslab, a plug-and-play solution that serves as a laboratory execution system and collects instrument data in real time as well as managing devices remotely. This new collection of high amounts of data requires a centralised system that integrates the scientists protocols and experimental annotations. The electronic lab notebook, is starting to become a common tool in research by allowing users to organise all their different data inputs and retrieve this data at any point. This also allows for large R&D projects to effectively control data over their scalability potential.

---

Quote for the day:

"The art of communication is the language of leadership." -- James Humes

---

Daily Tech Digest - April 05, 2020

AI Transforming & Automating The Consumer Goods Industry

Utilizing AI algorithms, machines outfitted with intelligent automation can assess emerging production issues and are liable to mess quality up. At the point when they detect a potential issue, they can automatically notify manufacturing personnel and may even autonomously execute corrective actions. By improving the customer experience, retailers can release altogether new ways to deal with customer engagement and interaction. With intelligent automation, they can identify customers’ anticipated needs at exact times and catch the correct minute with the correct idea in the quest for competitive advantage. The automation of customer experience processes is seeing somewhat less footing compared to different parts of intelligent automation. Today, brands and retailers have started to use AI-fueled engines to automatically trigger email campaigns. A much progressively amazing utilization of this capability is to apply it to the order fulfillment process, empowering users to make purchases legitimately from within the campaign.

Corporate culture complicates Kubernetes and container collaboration

When it comes to navigating corporate culture, things get a bit difficult for Kubernetes and container proponents. For example, 40% of survey respondents cited a lack of internal alignment as a problem when selecting a Kubernetes distribution. Surprisingly, in some cases, business leaders want to get their hands in the process. Plus, there are many other hands involved in the decision -- 83% say more than one team is involved in choosing a Kubernetes distribution.  The primary decision-maker varies from organization to organization, depending in part on whether Kubernetes is running in development or production. Development teams are the primary decision makers 38% of the time when Kubernetes is deployed only for development, while infrastructure teams are the primary decision makers 23% of the time in production environments. It's notable that C-level executives are involved 18% of the time. "This involvement is occurring because enterprises are choosing their next-generation platform, and that earns executive attention," the survey's authors relate. The survey also finds a significant disconnect between the views of upper-level company executives and developers: 46% of executives think the biggest impediment to developers is integrating new technology into existing systems.

Accelerating data-driven discoveries

Matz says SciDB did 1 billion linear regressions in less than an hour in a recent benchmark, and that it can scale well beyond that, which could speed up discoveries and lower costs for researchers who have traditionally had to extract their data from files and then rely on less efficient cloud-computing-based methods to apply algorithms at scale. “If researchers can run complex analytics in minutes and that used to take days, that dramatically changes the number of hard questions you can ask and answer,” Matz says. “That is a force-multiplier that will transform research daily.” Beyond life sciences, Paradigm4’s system holds promise for any industry dealing with multifaceted data, including earth sciences, where Matz says a NASA climatologist is already using the system, and industrial IoT, where data scientists consider large amounts of diverse data to understand complex manufacturing systems. Matz says the company will focus more on those industries next year. In the life sciences, however, the founders believe they already have a revolutionary product that’s enabling a new world of discoveries.

Cyber Attack Disrupts COVID-19 Payouts: Hackers Take Down Italian Social Security Site

We've already seen supposed "elite hackers" attacking the World Health Organization, cyber criminals hitting a COVID-19 vaccine testing facility with ransomware and healthcare workers being targeted with Windows malware using coronavirus information as the lure. Now, it has been reported, hackers have forced the Italian social security website to shut down for a period, as the most vulnerable in society started their claims for a €600 ($655) crisis payout. The general director of Italian welfare agency INPS, Pasquale Tridico, told the state broadcaster RAI on April 1 that there had been several hacker attacks across the previous few days. "They continued today, and we had to close the website," Tridico said. This at the same time as the site was receiving 100 application requests per second, according to Tridico. Italian police have been informed of the ongoing cyberattacks, and the ruling Democratic Party has suggested that national security services could be put on the case of finding out who is responsible.

What is a design sprint? A 5-day plan for improving products and services

Design sprints start with a team of around four to seven people, which is the recommended team size according to GV. Teams include a facilitator, designer, decision maker, product manager, engineer and someone from a relevant business unit. The decision maker on the team is often the CEO, especially at smaller companies or startups. A design sprint is intended to move quickly, lasting just five days, and it’s designed to spur ideas and create learning opportunities without having to build and launch a completed product or service. With a design sprint, you can get fast feedback, improve products and services and find new opportunities throughout the five-day sprint by creating a testable prototype. The prototype will allow your team to get a better sense of how customers and clients will react to the finished product, what needs to be changed and what customers enjoyed about the product or service. Design sprints are broken out into five major phases that take place over the five-day sprint. These phases are intended to help you develop the best team to tackle a project and to guide your business through the design sprint.

Distributed disruption: Coronavirus multiplies the risk of severe cyberattacks

When it comes to remote work, VPN servers turn into bottlenecks. Keeping them secure and available is a number-one IT priority. Hackers can launch DDoS campaigns on VPN services and deplete their resources, knocking out the VPN server and limiting its availability. The implications are clear: Since the VPN server is the gateway to a company’s internal network, an outage can keep all employees working remotely from doing their job, effectively cutting off the entire organization from the outside world. During an unprecedented time of peak traffic, the risk of a DDoS attack is growing exponentially. If the utilization of the available bandwidth is very high, it does not take much to cause an outage. In fact, even a tiny attack can become the last nail in the coffin. For instance, a VPN server or firewall can be taken down by a TCP blend attack with an attack volume as low as 1 Mbps. SSL-based VPNs are just as vulnerable to an SSL flood attack, as are web servers. Making matters worse, many organizations either use in-house hardware appliances or rely on their Internet carrier to ward off incoming attacks.

How to Prepare for Your Next Cybersecurity Compliance Audit

Reading a list of cybersecurity compliance frameworks is like looking at alphabet soup: NIST CSF, PCI DSS, HIPAA, FISMA, GDPR…the list goes on. It’s easy to be overwhelmed, and not only because of the acronyms. Many frameworks do not tell you where to start or exactly how to become compliant. Cybersecurity best practices from the Center for Internet Security (CIS) provide prioritized, prescriptive guidance for a strong cybersecurity foundation. And, they support your efforts toward compliance with the aforementioned alphabet soup. CIS offers multiple resources to help organizations get started with a compliance plan that also improves cyber defenses. Each of these resources is developed through a community-driven, consensus-based process. Cybersecurity specialists and subject matter experts volunteer their time to ensure these resources are robust and secure. What they are: The CIS Controls approach cyber defense with prioritized and prescriptive security guidance. There are 20 top-level CIS Controls and 171 Sub-Controls, prioritized into three Implementation Groups (IGs). The CIS Controls IGs prioritize cybersecurity actions based on organizational maturity level and available resources.

‘Trustworthy AI’ is a framework to help manage unique risk

Trustworthy AI must be designed and trained to follow a fair, consistent process and make fair decisions. It must also include internal and external checks to reduce discriminatory bias. Bias is an ongoing challenge for humans and society, not just AI. However, the challenge is even greater for AI because it lacks a nuanced understanding of social standards—not to mention the extraordinary general intelligence required to achieve “common sense”— potentially leading to decisions that are technically correct but socially unacceptable. AI learns from the data sets used to train it, and if those data sets contain real-world bias then AI systems can learn, amplify, and propagate that bias at digital speed and scale. For example, an AI system that decides on-the-fly where to place online job ads might unfairly target ads for higher paying jobs at a website’s male visitors because the real-world data shows men typically earn more than women. Similarly, a financial services company that uses AI to screen mortgage applications might find its algorithm is unfairly discriminating against people based on factors that are not socially acceptable, such as race, gender, or age. In both cases, the company responsible for the AI could face significant consequences, including regulatory fines and reputation damage.

AI runs smack up against a big data problem in COVID-19 diagnosis

It's simple in theory to identify what a computer should look for. An X-ray or a CT scan will show formations in the lung that are associated with a number of respiratory conditions including pneumonia. The feature in an image most often linked to a COVID-19 case, although not exclusive to COVID-19, is what's called "ground-glass opacity," a kind of haze hovering in an area of the lung, caused by a build-up of fluid. Opacities and other anomalies can show up even in asymptomatic COVID-19 patients. What slows things down is that neural networks have to be tuned to pick out opacities in the pixels of a high-resolution image, and that takes data. It also takes time working with physicians who know what to look for in the data. Both data and expertise are in short supply at the outset of a pandemic.  The neural network programs that Xu and others are deploying have been refined by computer scientists to a high degree of sophistication over many years and they are providing ready tools with which to build new systems. The system that Xu and team built combines two deep learning neural networks, a "ResNet-50," the standard for many years for image recognition, and something called "UNet++" that was developed at Arizona State University in 2018 for the specific purpose of processing chest CT scans.

Code Search Now Available to Browse Google's Open-Source Projects

Code Search is used by Google developers to search through Google's huge internal codebase. Now, Google has made it accessible to everyone to explore and better understand Google's open source projects, including TensorFlow, Go, Angular, and many others. CodeSearch aims to make it easier for developers to move through a codebase, find functions and variables using a powerful search language, readily locate where those are used, and so on. Code Search provides a sophisticated UI that supports suggest-as-you-type help that includes information about the type of an object, the path of the file, and the repository to which it belongs. This kind of behaviour is supported through code-savvy textual searches that use a custom search language. For example, to search for a function foo in a Go file, you can use lang:go:function:foo. For repositories that include cross-reference information, Code Search is also able to display richer information, including a list of places from where a given symbol is referenced. Code Search repositories that provide cross-reference information include Angular, Bazel, Go, etc.

---

Quote for the day:

"Change your friends if they are holding you back - pick the new ones with caution and care." -- Tim Fargo

---

Daily Tech Digest - April 04, 2020

How AR is helping keep ventilators running during the coronavirus pandemic

"Unlike regular times when you could dispatch a technician to hospitals, or you could actually show the doctors how to operate equipment, fix it, and so on, they need to do it remotely," Churchill said. "So we combined them with video and AR." Once TechSee receives an inquiry, it is given to a technician and the technician sends a web link via SMS to a hospital staff member. This allows the hospital support person to use their smartphone camera or tablet camera to show the technician the issue, Churchill noted. The user shows the technician the problem, and then the technician diagnoses the issue and uses AR to visually guide the hospital employee to a resolution, he added. Churchill said that TechSee works with more than 100 enterprises in a variety of sectors, with Medtechnica being one of its biggest clients in healthcare. While TechSee's solution can be applied to any system--including X-rays, routers, smart thermostats, and more--the demand for ventilators is amplifying that use case. This solution is completely web-based, so the user isn't forced to download an app. The AI-powered platform can recognize devices and technical issues, as well as automate the support process, Churchill said.

Enterprise Risk Management- Challenges and Innovation

Very rarely, can risk be completely eliminated. However, inherent risk can be mitigated through a combination of risk mitigation strategies, risk shifting, and at the end of the day, acceptance of the residual risk. When addressing big data risks, in particular, two types of risks must be discussed: the risk of data breaches and the risk of data misuse. The former is addressed through data security, while the latter is most commonly addressed through data privacy and regulation. When it comes to data security, one of the most significant sources of risk is the overreliance on fairly immutable data elements for identification such as, for example, social security number, names, addresses, dates of birth, credit card numbers, and the like. When any long-lived data element is exposed and misused, the damage is usually broad and long-lasting because changing those data elements is difficult and costly. The mechanism that I’m referring to is known as public-key cryptography and digital signatures, which was invented in the ’80s. While this is widely spread as the method that web browsers use to identify websites (adding the “secure” or “SSL/TLS” labels to the URL bar), it has not had enough traction outside of that specific domain.

What is WireGuard? Secure, simple VPN now part of Linux

For one, the WireGuard protocol does away with cryptographic agility -- the concept of offering choices among different encryption, key exchange and hashing algorithms -- as this has resulted in insecure deployments with other technologies. Instead the protocol uses a selection of modern, thoroughly tested and peer-reviewed cryptographic primitives that result in strong default cryptographic choices that users cannot change or misconfigure. If any serious vulnerability is ever discovered in the used crypto primitives, a new version of the protocol is released and there’s a mechanism of negotiating protocol version between peers. WireGuard uses ChaCha20 for symmetric encryption with Poly1305 for message authentication, a combination that’s more performant than AES on embedded CPU architectures that don’t have cryptographic hardware acceleration; Curve25519 for elliptic-curve Diffie-Hellman (ECDH) key agreement; BLAKE2s for hashing, which is faster than SHA-3; and a 1.5 Round Trip Time (1.5-RTT) handshake that’s based on the Noise framework and provides forward secrecy. It also includes built-in protection against key impersonation, denial-of-service and replay attacks, as well as some post-quantum cryptographic resistance.

How to start your career in cyber security

Unlike many professions, you don’t need cyber security experience to get into the field, although many people entering the field will come from jobs that have similar skillsets, such as systems administration or information analysis. If you can demonstrate the relevance of your existing experience – what recruiters call ‘transferable skills’ – there’s no reason why you can’t get a foothold on the cyber security career ladder. There are also plenty of entry-level positions available. Account executives and junior penetration testers, for example, tend to have little work experience, and can learn while on the job. ... The best way to gain an advantage over other prospective cyber security professionals is to become qualified. The qualifications you need will depend on your career path. If you don’t have this mapped out yet, or you simply want a strong overall understanding of how to navigate security risks, you should seek out a course that covers general topics, such as our Certified Cyber Security Foundation Training Course. This one-day course explains the fundamentals of cyber security and shows you how to protect your organisation from a range of threats.

Is COVID-19 Driving a Surge in Unsafe Remote Connectivity?

As more organizations shift to a remote workforce, new working patterns and technology adoption - including shadow IT - may lead to corporate data suddenly being poorly secured or stored in a manner that violates regulatory requirements. And more systems may be spun up that fail to secure commonly used protocols, such as RDP. "Changes to the network perimeter can also create unanticipated threats, as a higher burden is placed on remote-access systems, and if not correctly implemented, may expose systems to the internet," says Matt Linney, a senior security consultant at 7 Elements. "Looking at this now could save substantial loss in the future." The problem may be exacerbated by COVID-19 driving many organizations to rapidly embrace the equivalent of bootstrap approaches to digital transformation and moving to cloud-based platforms and core services without having first carefully planned, tested, validated and secured their approach (see: Zoom Fixes Flaw That Could Allow Strangers Into Meetings).

Why Continuous Monitoring of Critical Data Is So Essential

To ensure business continuity, manufacturers in India that now have a 100 percent remote workforce because of the COVID-19 pandemic must be vigilant about ensuring critical data is protected through continuous monitoring, says Ravikiran S. Avvaru, head of IT and security at the Gurgaon-based manufacturing group Apollo Tyres Ltd. "As part of our business continuity plan, we identified critical applications for the business which are integrated with the dealers, customers and suppliers and discussed with our third-party vendors, such as Amazon and Microsoft, how to extend support in ensuring the applications are up and running and in secure fashion," Avvaru says in an interview with Information Security Media Group. In addition to enhancing security for business-critical applications accessible in the cloud, for accessing legacy applications housed at a data center, the company has deployed personal firewalls, a VPN along with remote desktop protocols and data leak prevention tools, he explains.

Microsoft: How one Emotet infection took out this organization's entire network

According to Microsoft, Fabrikam called in Microsoft's Cybersecurity Solutions Group's Detection and Response Team (DART) eight days after the employee had opened the phishing email, by which time its computers and critical systems were failing and its network bandwidth had been completely overrun by Emotet. The malware used the victim's compromised computers to launch a distributed denial of service (DDoS) and overwhelm its network. "The virus threatened all of Fabrikam's systems, even its 185-surveillance camera network. Its finance department couldn't complete any external banking transactions, and partner organizations couldn't access any databases controlled by Fabrikam. It was chaos," Microsoft's DART team writes. "They couldn't tell whether an external cyberattack from a hacker caused the shutdown or if they were dealing with an internal virus," it explains further. "It would have helped if they could have even accessed their network accounts. Emotet consumed the network's bandwidth until using it for anything became practically impossible. Even emails couldn't wriggle through."

CSO Pandemic Impact Survey

As of March 23rd, that number had climbed to 77.7%, an increase of 4.7-fold. Notable was high tech firms grew which grew from 31.9%, to 90.2%. While 81% expressed confidence that their existing security infrastructure could handle their employees working from home, 61% were more concerned about security risks targeting WFH employees today than they were three months ago. ... Despite the high levels of confidence that their security infrastructures are up to the task at hand, 22% of organizations have found themselves out shopping for new security solutions/services to address the new work dynamic. Businesses least likely to be investing in new technology or services came from the same industries that identified as most prepared: financial services (12%) and healthcare (14%). Only 7% of SMB organizations (fewer than 1,000 employees) indicated that they had to make security purchases in response to the current conditions, which may indicate either a lack of visibility into their risk environments, a lack of available budget to support new investments, or a combination of both.

Coronavirus prep could prompt better disaster recovery

If your company strongly encourages workers to stay home in response to the virus a significant portion of your company might be working from home for extended periods of time. From a data-protection standpoint; this significantly increases the chances that important intellectual property will be created outside of your data center. If your company currently relies on storing such data on file servers or similar systems, remote employees will probably not be able to use such systems easily. As a result, they will create and store important data directly on their laptops, leaving centralized company storage out of the picture. This means that you should probably examine your company's policy regarding data protection of laptops and mobile devices. Many companies don’t provide backup and recovery for mobile devices, despite the fact that most experts feel they should. Now might be a good time to do so. The main reason early attempts at laptop backup failed was users would kill the backup process because it slowed them down, and it cost too much. The good news is several providers can back up your laptops and mobile devices in such a way that users never realize backups are running.

Return On Artificial Intelligence: The Challenge And The Opportunity

One key driver of lack of return from AI is the simple failure to invest enough. Survey data suggest most companies don’t invest much yet, and I mentioned one above suggesting that investment levels have peaked in many large firms. And the issue is not just the level of investment, but also how the investments are being managed. Few companies are demanding ROI analysis both before and after implementation; they apparently view AI as experimental, even though the most common version of it (supervised machine learning) has been available for over fifty years. The same companies may not plan for increased investment at the deployment stage—typically one or two orders of magnitude more than a pilot—only focusing on pre-deployment AI applications. Of course, with any technology it can be difficult to attribute revenue or profit gains to the application. Smart companies seek intermediate measures of effectiveness, including user behavior changes, task performance, process changes, and so forth—that would precede improvements in financial outcomes. But it’s rare for these to be measured by companies either. Along with several other veterans of big data and AI, I am forming the Return on AI Institute, which will carry out programs of research and structured action, including surveys, case studies, workshops, methodologies, and guidelines for projects and programs.

---

Quote for the day:

"Leadership development is a lifetime journey, not a quick trip." -- John Maxwell

---

Daily Tech Digest - April 03, 2020

How to balance privacy concerns around facial recognition technology

Facial recognition without an individual’s consent has been at the center of controversy in recent news. It’s often associated with widespread surveillance and a breach of civilian privacy. Its use should be distinguished as a technology that removes control from the person whose likeness is being captured without consent — in some cases to catch bad actors or known terrorists, but in other cases, the intent is more malicious. For example, American billionaire John Catsimatidis was recently criticized for using the Clearview AI app to profile his daughter’s date. Catsimatidis simply captured a photo of the individual and uploaded it to the app to conduct a full-fledged background check. ... This use case can and should be considered an abuse of the technology and needs to be reinforced by regulatory bodies. Facial authentication, on the other hand, gives the individual full control by offering a choice as to whether they would like to allow the technology to identify them. Facial authentication is performed to protect logins and is permission-based — it offers a superior level of account protection compared to usernames and passwords, knowledge-based authentication or even SMS-based two factor authentication.

FCC wants to add a new swath of bandwidth to Wi-Fi 6

The driving factor, as ever, is the bottomless demand for spectrum caused by the increasing use of wireless just about everywhere, and the FCC’s announcement cites projections from Cisco that say about 60% of worldwide data traffic will move across Wi-Fi links within the next two years. Using the full 6GHz spectrum – all 1,200MHz of it – is part of the Wi-Fi 6 (802.11ax) standard that can’t be put into use until it is freed up by the FCC. With that spectrum extension in place the standard is known as Wi-Fi 6E, and devices with new silicon would be needed to implement it. “By doing this, we would effectively increase the amount of spectrum available for Wi-Fi almost by a factor of five,” said FCC chair Ajit Pai in a statement. “This would be a huge benefit to consumers and innovators across the nation.” But the incumbent licensed users of parts of the 6GHz spectrum – which are mostly businesses using microwave links for wireless backhaul and public safety services – aren’t pleased. The Utilities Technology Council is one of several groups that has been critical of earlier proposals to open the 6GHz band to broad-based unlicensed use, saying in response to Wednesday’s announcement that assurances that existing users would be protected from interference are unconvincing.

Cnvrg.io launches a free version of its data science platform

Ettun describes CORE as a ‘lightweight version’ of the original platform but still hews closely to the platform’s original mission. “As was our vision from the very start, cnvrg.io wants to help data scientists do what they do best – build high impact AI,” he said. “With the growing technical complexity of the AI field, the data science community has strayed from the core of what makes data science such a captivating profession — the algorithms. Today’s reality is that data scientists are spending 80 percent of their time on non-data science tasks, and 65 percent of models don’t make it to production. Cnvrg.io CORE is an opportunity to open its end-to-end solution to the community to help data scientists and engineers focus less on technical complexity and DevOps, and more on the core of data science — solving complex problems.” This has very much been the company’s direction from the outset and as Ettun noted in a blog post from a few days ago, many data scientists today try to build their own stack by using open-source tools. They want to remain agile and able to customize their tools to their needs, after all.

Australian Privacy Foundation labels CLOUD Act-readying Bill as 'deeply flawed'

"It enshrines an inappropriate level of discretion and weakens parliamentary oversight regarding interaction with governments that disrespect human rights. "It is a manifestation of a drip by drip erosion of privacy protection in the absence of a justiciable constitutionally-enshrined right to privacy in accord with international human rights frameworks." The remarks were made in the opening of APF's submission [PDF] to the Parliamentary Joint Committee on Intelligence and Security (PJCIS) and its review of the Telecommunications Legislation Amendment (International Production Orders) Bill 2020. The Bill is intended to amend the Telecommunications (Interception and Access) Act 1979 (TIA Act) to create a framework for Australian agencies to gain access to stored telecommunications data from foreign designated communication providers in countries that have an agreement with Australia, and vice versa, as well as remove the ability for nominated Administrative Appeals Tribunal members to issue certain warrants.

Windows 10 security: How the shadow stack will help to keep the hackers at bay

Microsoft and Intel worked together on a design called Control-flow Enforcement Technology (CET) several years ago, which adds the new Shadow Stack Pointer (SSP) register and modifies the standard CPU call and return instructions to store a copy of the return address and compare it to the one in memory -- so most programs won't need any changes for compatibility. If the two addresses don't match, which means the stack has been interfered with, the code will stop running. "The shadow page table is assigned in a place that most processes or even the kernel cannot access, and this is supported by a new page table attribute that is not even exposed right now and people can't query it either," Pulapaka said. "The idea is that you will not be able to see that it exists, and you will not be able to touch it -- and if you try to touch it, the kernel doesn't allow it to allow any arbitrary process to touch it." CET also includes some forward call protection: indirect branch tracking does a similar check to CFG but in hardware. The CET specification was first released in 2016 and for compatibility, silicon released since then has had a non-functional version of the instruction that marks indirect branch addresses as safe.

Cyber security matters more than ever

Networks can be accessed in multiple ways, remote offices are common, there is an abundance of bandwidth and cyber security harnesses the power of artificial intelligence and other advanced technologies to help make the mobile office a reality. With more and more people now able to work from home and an estimated 4.1 million people electing to do so, companies need to ensure their cyber security extends beyond the confines of the office walls. With the increasing escalation of the COVID-19 situation in Australia, organisations have closed their physical premises and are enforcing work from home policies to ensure the health, wellbeing, and safety of employees. With much of the workforce now tapping into their home networks to enable business and operational continuity, this raises serious cyber security issues. The State of Cybersecurity in Asia Pacific survey by Palo Alto Networks found that almost half of respondents stated their biggest cyber security challenge was their employees’ lack of cyber security awareness. Imagine if those employees are working from home and accessing devices used by the family for business purposes, this exposes the employee to potential exploitation by cyber criminals and puts the employer at risk.

Zoom Rushes Patches for Zero-Day Vulnerabilities

In recent days, Zoom has faced intense scrutiny over the platform's security and privacy. On Wednesday, researchers revealed that a Zoom feature that's designed to help individuals within an organization quickly connect to others through the desktop app can expose email addresses, full names and profile photos to other users who should not have access, according to Motherboard. Zoom also issued an apology this week for sharing large sets of user data by default with Facebook, blaming the social network's software development kit, which it has removed from its iOS app. Exposed users' data included IP addresses and device model. Zoom has now stopped that data sharing practice and updated its privacy guidelines (see: Zoom Stops Transferring Data by Default to Facebook). On Monday, the New York Times reported that New York Attorney General Letitia James sent a letter to Zoom asking about the company's privacy and security practices. The letter also sought information about vulnerabilities "that could enable malicious third parties to, among other things, gain surreptitious access to consumer webcams," according to the report.

Are you overengineering your cloud apps?

People building applications on public clouds have a multitude of cloud services that can be integrated into that application with little time and very little money. AI services, such as deep learning and machine learning, are often leveraged from applications just because of the ease of doing so. In many cases, the use of AI within a specific application is actually contraindicated. Other tempting services include containers and container orchestration systems. Although these are a great addition for a good many apps, I’m seeing them more and more force-fit these days. Developers are being lured by their hype. The trade-off here is that overengineered cloud apps are more costly to build, overly complex, and thus harder to operate over time. Indeed, they may double the cost of cloudops after deployment, as well as double the cloud bill you’ll get monthly. Cloud app designers and developers need to focus on the minimum viable features that the cloud applications need to solve the core problems. An inventory control application perhaps does not need a machine learning system bolted on, but a fraud detection system does.

Microsoft to hospitals: 11 tips on how to combat ransomware

Ransomware can be damaging to any business, as it holds critical data hostage; with most companies, the loss can be measured financially. But when a hospital is attacked with ransomware, the cost can be measured in human life, either through direct patient care or through research being done on vaccines and medicine. Further, hospitals are now so focused on the coronavirus that medical staff and employees may forget the usual security protocols when dealing with email and other content. All of this makes them potentially easy prey for ransomware. Though a range of criminal groups and campaigns are known to employ ransomware, Microsoft in its blog post focused on REvil, also known as Sodinokibi. This campaign exploits gateway and VPN flaws to gain entry into organizations. This type of strategy is especially rampant now as so many more people are working from home or remotely. If successful, these attackers can steal user credentials, elevate their privileges, and then move across compromised networks to install ransomware and other malware. Gangs like REvil use human-operated methods to target organizations most vulnerable to attack.

Is remote work the new normal?

As COVID-19 continues to spread, remote work is no longer an experiment, but a requirement in many nations. While it represents a huge change, the results of a research conducted by OnePoll and Citrix, reveal that a majority of employees around the world are adapting to working from home and believe it will become the new normal for the way work gets done. “Remote work is not business as usual. It represents a totally new way of thinking and operating and can be a difficult adjustment for employees and employers to make,” says Donna Kimmel, Chief People Officer, Citrix. “But business must go on, even in times of crisis. And as the research makes clear, companies that give their people the right tools can help them make the transition, empower them to be and perform at their best, and emerge stronger when conditions improve.” As Kimmel notes, remote work is a completely new concept for most employees. ... “You can have the best technology in the world. But if you don’t provide employees with resources to help them make the adjustment, they won’t use it and continue to engage and be productive,” Kimmel says.

---

Quote for the day:

"A good objective of leadership is to help those who are doing poorly to do well and to help those who are doing well to do even better." -- Jim Rohn

---

Daily Tech Digest - April 02, 2020

A crypto-mining botnet has been hijacking MSSQL servers for almost two years

The brute-force attacks that seek to guess the password of MSSQL servers have sprayed the entire internet. Guardicore says that since May 2018, they've more than 120 IP addresses used to launch attacks, with most IPs coming from China. "These are most likely compromised machines, repurposed to scan and infect new victims," Harpaz said. "While some of them were short-lived and responsible for only several incidents, a couple of source IPs were active for over three months." Harpaz said that the botnet has been in a constant churn, with the botnet losing servers and adding new ones daily. Per Guardicore, more than 60% of all hijacked MSSQL servers remain infected with the Vollgar crypto-mining malware only for short periods of up to two days. Harpaz said that almost 20% of all MSSQL systems, however, remain infected for more than a week, and even longer. Harpaz believes this is because either the Vollgar malware manages to disguise itself from the local security software, or the database isn't running one in the first place.

Thousands of potential phishing sites created to target Zoom users as usage soars

As well as targeting companies through Zoom, cybercriminals are trying different cyber scams to trick companies. These scams include impersonation on social media platforms or phishing emails. The scams are aimed at tricking employees into giving money away, provide the credentials to cloud-based applications, or pay fake invoices. This increase in online fraud is a significant threat that most companies are not prepared for. Yoav Keren, CEO, BrandShield, said: “With global businesses big and small become increasingly reliant on video conferencing facilities like Zoom, sadly, cybercriminals are trying to capitalise. Businesses need to educate their employees quickly about the risks they may face, and what to look out for. The cost of successful phishing attacks is bad for a company’s balance sheet in the best of times, but at the moment it could be fatal. “BrandShield protects some of the biggest corporations in the world and we takedown thousands of threats across websites and social media. 

Edge computing environments: what you need to know

Edge will evolve, from local deployments to regional, to the core; from regional to regional, or from regional to core. Increasingly, users won’t want to rely on public wide-are network (WAN) to relay data between datacentres or integrate data from different applications, especially since IoT apps mean a lot of integrated data. “Colocation provider VPNs and virtual interconnections are able to offer a kind of private routing,” Ascierto says. “You can track where the data is routed; it doesn’t go on the internet and a black hole appears at the core.” Edge computing startup Vapor IO signed a deal with network provider Cloudflare in January to roll out on the former’s Kinetic Edge integrated edge colocation, networking and exchange services platform. Nitin Rao, head of global infrastructure at Cloudflare, says the interconnection ecosystem includes small datacentres at wireless aggregation hubs, owned by investors. 

AI and big data won’t work miracles in the fight against coronavirus

It’s not that these applications of AI are bad, but rather that they belong to a set with few actionable outcomes. If your big data analysis of traffic supports or undercuts a proposed policy of limiting transportation options in such and such a way, that’s one thing. If your analysis produces dozens of possible courses of action, any of which might be a dead end or even detrimental to current efforts, it’s quite another. Because these companies are tech companies, and by necessity part ways with their solutions once they are proposed. Any given treatment lead requires a grueling battery of real-life tests even to be excluded as a possibility, let alone found to be effective. Even drugs already approved for other purposes would need to be re-tested for this new application before they could be responsibly deployed at scale. Furthermore, the novel substances that are often the result of this type of drug discovery process are not guaranteed to have a realistic path to manufacturing even at the scale of thousands of doses, to say nothing of billions. That’s a completely different problem!

How enterprise networking is changing with a work-at-home workforce

DNS vendor BlueCat says it has been tracking the use of DNS over HTTPS (DoH) – a method of encrypting queries to prevent visibility into DNS traffic patterns. Over the last week through March 27, the company said it has seen a massive increase in the use of DoH across its customer base wrote Ben Ball, director of strategy and content marketing at BlueCat in a blog about the trend. “In the course of a single weekend, the number of endpoints attempting to use DoH went from an average of 90 to about 1,400. That’s a 1,500% increase in the use of DoH. Around 45% of these queries are from Firefox (which now activates DoH by default). Aside from that, we’re seeing queries to eleven different DoH services from all kinds of applications. DoH usage is fairly uniform across our customer base as well – this isn’t one company or industry vertical; this is a broad trend. While we haven’t seen any clear indications that any of these queries are from DoH enabled malware, that is an emerging threat that we are tracking,” Ball stated.

Windows 10 bug that broke internet connectivity gets patched – here’s how to install the fix

Affected users are those running a VPN (or proxy) who might experience net connectivity issues with some applications (or the system may indicate there’s no internet connection, even if there actually is – a more minor glitch where connectivity isn’t actually disrupted). ... Note that Windows 10 users won’t get this new fix from Windows Update, as is commonly the case (at least not yet, at the time of writing). Rather, it is necessary to grab this one manually and install it that way. Luckily, this is a simple process which we’ll explain in full now. If you’re running Windows 10 November 2019 Update or May 2019 Update, head over to the Microsoft Update Catalog here and download the relevant version for your system. All you need to do to install the file is double-click on it once downloaded, and then follow the instructions. Version 1909 is the November 2019 Update and version 1903 is the May 2019 update (as you’ll see, there’s also a version for those running Windows Server). Almost all users will need to download the relevant patch for x64-based systems, if you’re running 64-bit Windows 10, which is highly likely.

The Future Of Data Science

As of today, most of the data science usage is centred on descriptive, diagnostic or predictive analytics. In the future, the new-age data science practice will allow the service provider to generate content that is profitable and enriching for the consumer. Let me elaborate on this further. In one household, there are different consumer needs for online content on platforms like Netflix or Amazon Prime. My content consumption as a business professional is very different from that of my teenage kids. Today, it is difficult to track the individual user preferences as the service provider might not understand the actual user who is holding the remote in his or her hand. However, once we move to use voice, it will be easy for the machine to understand if the consumer is an adult or a teenage kid. Within a single user ID, then, the content that will be pushed will be very different and more relevant for the consumer. Once, such interactions start between the human consumer and the machine that understands the human voice (tone to predict mood/emotions), there are limitless possibilities to personalise the content, and then charge a premium for it.

Microsoft directly warns hospitals, 'Fix your vulnerable VPN appliances'

"Through Microsoft's vast network of threat intelligence sources, we identified several dozens of hospitals with vulnerable gateway and VPN appliances in their infrastructure," the Microsoft Threat Protection Intelligence Team revealed in a new post. "To help these hospitals, many already inundated with patients, we sent out a first-of-its-kind targeted notification with important information about the vulnerabilities," it added. The alert contained information about how attackers can exploit the flaws, and a "strong" warning that the affected hospitals need to apply security updates that will protect them from exploits.  One group the Microsoft team has been tracking is the REvil, aka Sodinokibi, ransomware gang, which is known for making massive ransom demands on businesses and government agencies. In January it was caught targeting unpatched Pulse Secure VPNs, as well as flaws in enterprise Citrix servers. The ransomware gang hasn't developed new attack techniques but rather has repurposed tactics from state-sponsored attacks for new campaigns that exploit the heightened need for information in the current coronavirus crisis.

Is Kubernetes becoming the driving force of enterprise IT?

In a world where innovation and time to market is a top priority, Day One developers need to be able to efficiently provision infrastructure and get coding. Using a managed platform that provides ready access to everything needed to run containers and Kubernetes consistently across a hybrid environment (including support and security) means application and developer teams can spend more time solving business problems. Many organisations will want their hybrid environment to include multiple public clouds. This means they need to be aware of how much flexibility and freedom they’ll want for using the technologies of their choice—including emerging innovations like Quarkus, which lets you build cloud-native applications; or Operators, a way of packaging Kubernetes-native applications for easier management. Ultimately, this means understanding the difference between an open platform and a proprietary one.

Thousands of PCs break exaFLOP barrier

An exaFLOP is one quintillion (1018) floating-point operations per second, or 1,000 petaFLOPS. To match what a one exaFLOP computer system can do in just one second, you'd have to perform one calculation every second for 31,688,765,000 years. While the supercomputing stalwarts continue to build their systems, Folding@Home just crossed the exaFLOP barrier ahead of IBM, Intel, Nvidia, and the Department of Energy. Folding@home is a distributed computing project running for 20 years. It was administered first by the chemistry department at Stanford University and as of last year, by Washington University in St. Louis. Its software runs on individual PCs and remains idle as long as the computer is in use, then it kicks in when the PC is idle. The project simulates how proteins misfold and cause diseases such as cancer and Alzheimer's Disease. Proteins self-assemble in a process called folding. When a protein misfolds, disease can occur. By simulating protein misfolds, Folding@Home seeks to understand why they misfold and perhaps how to prevent it and undo the damage.

---

Quote for the day:

"Don't just hope to have a great day; do everything to make it a great day! Live Intentionally!" -- Bruce Van Horn

---