Daily Tech Digest - April 12, 2020

AI (Artificial Intelligence) Projects: Where To Start?

GUI (Graphical User Interface) concept.
You don’t want to spend time and money on a project and then realize there are legal or compliance restrictions. This could easily mean having to abandon the effort. “First, customer data should not be used without permission,” said Debu Chatterjee, who is the senior director of platform AI engineering at ServiceNow. “Secondly, bias from data should be mitigated. Any model which is a black box and cannot be tested through APIs for bias should be avoided. The risk of bias is present in nearly any AI model, even in an algorithmic decision, regardless of whether the algorithm was learned from data or written by humans.” In the early phases of an AI project, there should be lots of brainstorming. This should also involve a cross-section of people in the organization, which will help with buy-in. The goal is to identify a business problem to be solved. “For many companies, the problem is that they start with a need for technology, and not with an actual business need,” said Colin Priest, who is the VP of AI Strategy at DataRobot. “It reminds me of this famous quote from Steve Jobs, ‘You’ve got to start with the customer experience and work backwards to the technology. You can’t start with the technology and try to figure out where you’re going to sell it.’”


How to Reduce Remote Work Security Risks

istock 876819100
Employees should remain cautious of downloading random applications or software to avoid malware, viruses, or insecure protocols. If they’re unsure, they should check with IT support or their Security team. Also, remind remote workers to be careful when sharing confidential data. They should use company-issued apps for file sharing, storage of confidential documents, and communication. Let them know this is for their own safety, too, that the company has protective measures around these apps and can monitor for suspicious behavior. Consistently communicate with your employees. Ultimately, keeping everyone informed on how to secure their home technologies and practice security in their everyday lives trumps technologies. Maintain communication in a variety of communication channels, to keep them up-to-date on the latest security threats and how to reduce their risk to their personal, and company information. Make sure your security and IT experts are household names, available for questions and sharing red flags.


Automated Machine Learning Is The Future Of Data Science

Data Science
The objective of autoML is to abbreviate the pattern of trial and error and experimentation. It burns through an enormous number of models and the hyperparameters used to design those models to decide the best model available for the data introduced. This is a dull and tedious activity for any human data scientist, regardless of whether the individual in question is exceptionally talented. AutoML platforms can play out this dreary task all the more rapidly and thoroughly to arrive at a solution faster and effectively.A definitive estimation of the autoML tools isn’t to supplant data scientists however to offload their routine work and streamline their procedure to free them and their teams to concentrate their energy and consideration on different parts of the procedure that require a more significant level of reasoning and creativity. As their needs change, it is significant for data scientists to comprehend the full life cycle so they can move their energy to higher-value tasks and sharpen their abilities to additionally hoist their value to their companies.



How Hyperscale Storage Is Becoming More Accessible

It is a scale-out solution that enables you to scale compute and storage independently. And it's through software-defined storage. So you can pick any client, any server, any network, we can run on a quanta server, HP Dell, we can run with Intel CPU, on AMD, or even on arm. There are two main components that I want to touch on. The first one is the NVMe over TCP. This is basically a standard that we invented together with Facebook, Dell, Intel, and a few others. Today, the standard is already fully ratified. What we have here is a super optimized TCP stack userspace that combined together with the NVMe stack, and gives us the ability to support in a very large data center, thousands of connection thousands of containers in millimeter or virtual environment. The second very important layer is the global FTL. FTL is a flash translation layer. That's the layer you can find in every SSD. It's a very high level during the translation between the logical a transaction A to the storage system to the physical transaction to the flesh, what we have done in lightweights.


COVID-19 is accelerating CI/CD adoption

COVID-19 is accelerating CI/CD adoption
As it turns out, the stakes are much higher given the now pervasive work-from-home arrangements most organizations now embrace. Talking with Rose in a phone interview, he stressed that even after years of DevOps discussion, “You still have a lot of companies that are doing most of their software testing on-prem and behind the firewall. The big installed base remains Jenkins in a proprietary data center.” This wasn’t ideal but it was workable when developers and operations professionals worked in an office environment, within the firewall. In a remote-only situation, getting access to the application development workflow is “tricky,” he stresses, because, in part, there’s no guarantee that you’ll be able to VPN in. And so companies are moving much faster than planned from private data centers to public clouds, in an effort to move workloads to a place where modern CI/CD can happen. “All the timelines have shrunk,” Rose says. Over the last two years companies have realized they need to move faster, but perhaps still struggled to start moving. “Now every company is trying to get apps to be cloud-enabled or cloud-native,” he stresses.


Zoom Promises Geo-Fencing, Encryption Overhaul for Meetings


In response to Citizen Lab's report, Zoom immediately promised to implement geo-fencing to ensure that no keys get routed via China, except for China-based users. Yuan attributed the routing of keys via China to a development error as the company attempted to rapidly scale up to meet a surge of demand, starting in China, where the COVID-19 outbreak began, leading the company to allow much greater, free access to its tool, in part, to support medical professionals. (Free versions typically otherwise have a 40-minute time limit for meetings.) "In February, Zoom rapidly added capacity to our Chinese region to handle a massive increase in demand," Yuan says. "In our haste, we mistakenly added our two Chinese data centers to a lengthy whitelist of backup bridges, potentially enabling non-Chinese clients to - under extremely limited circumstances - connect to them (namely when the primary non-Chinese servers were unavailable). This configuration change was made in February." He says Zoom fixed this problem immediately after learning of it via Citizen Lab. "We have also been working on improving our encryption and will be working with experts to ensure we are following best practices," Yuan says.


DevOps proponent lays it on the line: stop the madness and start automating


The final three steps is where many development teams tend to stumble, Davis says. "The most blissful thing about writing code or doing a complex admin task and so forth is when you get everything in your head, and you can see how everything fits together, and the world disappears, and you know exactly how your org works, and anybody could ask for any change and you can fix things. Developers live for that blissful feeling -- to know everything and fix anything." The catch is, a particular project ends, distractions distract, new projects begin, and time passes, Davis continues. "That disappears out of your working memory right? There may be a day, or a week, or a month delay before you know that you broke something. By the time three weeks has elapsed, you forgot that you even built that thing. And if you remember that you built it, you forget how you built it, you forget exactly why you built it. You can make another change of course, but then it might take you another three weeks until you can get that back to your users." Multiply this by hundreds or even thousands of change requests within a large organization, and it's easy to see how things can go awry. DevOps brings order and flow to this potential madness, and Davis boils it down to a three-step process: development, innovation delivery, and operations.


New machine learning method could supercharge battery development for electric vehicles

New machine learning method could supercharge battery development for electric vehicles
"Computers are far better than us at figuring out when to explore—try new and different approaches—and when to exploit, or zero in, on the most promising ones." The team used this power to their advantage in two key ways. First, they used it to reduce the time per cycling experiment. In a previous study, the researchers found that instead of charging and recharging every battery until it failed—the usual way of testing a battery's lifetime -they could predict how long a battery would last after only its first 100 charging cycles. This is because the machine learning system, after being trained on a few batteries cycled to failure, could find patterns in the early data that presaged how long a battery would last. Second, machine learning reduced the number of methods they had to test. Instead of testing every possible charging method equally, or relying on intuition, the computer learned from its experiences to quickly find the best protocols to test. By testing fewer methods for fewer cycles, the study's authors quickly found an optimal ultra-fast-charging protocol for their battery.


How Big Data and IoT Are Connected


Sensors upon sensors will crop up in all sorts of technologies if they aren’t already. Gigabytes and terabytes of information will whizz between devices at a frightening speed and big data technologies will work even harder to store, process and take value from the collected yet often unstructured sensory information. End-points from numerous locations will knowingly unlock an almost unlimited amount of data, what happens to that data will be considered by those who work in the IoT and big data industries. The result of this interaction will create two likely winners. Firstly, the businesses that can profit from the information provided, and the end-user who has better information to act on. Ultimately, businesses that are seeking to implement IoT into their products are also seeking greater profits, more productivity, higher efficiency and reduced costs. The development of big data technologies works in favor of IoT companies, with both seeking to strategize the ways in which we see and utilize data sets. As for the customer or end-user, they will (if they aren’t already) benefit from the provision of greater useful information, as well as improved customer service and experiences.


Fotolia_131189299_S Sergey Tarasov
In a related twist, customers will, with no surprise, first call their ISPs whenever there is any connectivity problem. In order to provide service, that means a larger call staff. However, what if the problem is a specific device? Even more complex, what if it’s a specific application being run on the phone? An ISP which can quickly identify the root cause of the issue can either fix its own issues or point the customer towards the appropriate firm to provide service. Doing that efficiently will save enormous amounts of money. Identifying technical issues is a clear use case for AI. The question that needs to be answered is how close to the devices can an AI system run. On the ISP’s services, there’s a distance that can obscure some issues. It would be much better to run AI on an individual home’s modem or, even better, a router. The question becomes the footprint. Even runtime AI has not been known for highly efficient resource usage, and many companies have been working to address that for many IoT applications. One such company addressing the issue for the connected home is Veego. They claim to have AI inference that runs on home routers and modems in order to identify performance issues.



Quote for the day:


"As a leader, you set the tone for your entire team. If you have a positive attitude, your team will achieve much more." -- Colin Powell


Daily Tech Digest - April 11, 2020

Expressing The BIAN® Reference Model For The Banking Industry In The Archimate® Modeling Language


The expression of the BIAN model in ArchiMate has been a joint effort by BIAN and The Open Group, the stewards of the ArchiMate standard. The full details of this mapping can be found in the document “ArchiMate® Modeling Notation for the Financial Industry Reference Model: Banking Industry Architecture Network (BIAN)” published by The Open Group. To explain the use of BIAN in the ArchiMate language, The Open Group has published a case study whitepaper co-authored by one of us (Patrick), which uses the fictitious but realistic Archi Banking Group as an example. In this blog, we want to give you an impression of what this is about, picking and choosing some of the juiciest bits. For the full case study, please refer to the whitepaper. Archi Banking Group is the result of the acquisition of several banks in different countries, as most international banks are nowadays. This has come with the typical challenges of integration and cost control. In particular its fragmented information is becoming a compliance risk and the challenges of ‘open banking’ (e.g. PSD2) are difficult to meet. 



Development Versus QA: Ending the Battle Once and for All


The reason why minimizing blame is the number one priority for QA engineers is that in the QA realm, there is a general acceptance that bugs are always going to make it to production, no matter what. This is something we expect because a 100% guaranteed bug-free product would take years to ship rather than weeks, and would therefore be economically unviable. Since they know there will be problems to deal with no matter what they do, they want to show that they did everything in their power to prevent those problems. Naturally, they want to write as many tests as possible to minimize the risk of bugs that they should have caught. But since it’s impossible to write an infinite amount of tests, they have to prioritize what to test for. A QA team is given no data by which to prioritize what to test, so this prioritization is essentially a guessing game. It may be an educated guessing game based on experience and expertise, but it’s still predicting what users are most likely to do on an application without objective data as to what they really care about and how they really will use the application.



Microsoft Teams Promises Great Video Calls: No More Typing Or Dog Noises

In this photo illustration a Microsoft teams logo is seen...
As reported by Venture Beat, Microsoft has promised AI-enhanced innovations which will be able to suppress background noise – in real time – so your call can continue smoothly. Instead of merely reducing the impact that an air conditioning unit has on the call, Teams will aim to suppress other noises not normally covered, such as doors slamming, over-excited typing on a computer keyboard or my beloved pooch having an inconvenient moment. The keyboard is a case in point. If you’re taking notes during an interview, you ideally don’t want that clickety-clack noise to intrude on the conversation. It’s those noises which aren’t “stationary” as Microsoft says, that are hard to suppress without AI. It takes hundreds of hours of data to work out what’s desirable and what’s not, using audio books to represent voices and then other sources to create those pesky noises. All of which leads to the creation of neural network to start the AI working on the data to sort out what should be heard and what shouldn’t. The power of the cloud can be leveraged to help, providing fast, real-time analysis of what’s going on and deciding what should be heard by the person at the other end of the call and what shouldn’t.



Scientists develop AI that can turn brain activity into text

The system was not perfect. Among its mistakes, “Those musicians harmonise marvellously” was decoded as “The spinach was a famous singer”, and “A roll of wire lay near the wall” became “Will robin wear a yellow lily”. However, the team found the accuracy of the new system was far higher than previous approaches. While accuracy varied from person to person, for one participant just 3% of each sentence on average needed correcting – higher than the word error rate of 5% for professional human transcribers. But, the team stress, unlike the latter, the algorithm only handles a small number of sentences. “If you try to go outside the [50 sentences used] the decoding gets much worse,” said Makin, adding that the system is likely relying on a combination of learning particular sentences, identifying words from brain activity, and recognising general patterns in English. The team also found that training the algorithm on one participant’s data meant less training data was needed from the final user – something that could make training less onerous for patients.


IBM, Open Mainframe Project launch initiative to help train COBOL coders


Despite its age, COBOL is reliable and is still widely used -- there's an estimated 220 billion lines of COBOL still in use today. IBM, one of the founding organizations behind COBOL, continues to offer mainframes compatible with the language. The issue with COBOL now is that there are few programmers left with the skills to maintain legacy COBOL applications. Specifically, state agencies are struggling to find actively working COBOL engineers who can update their unemployment benefit systems to factor in new parameters for unemployment eligibility. To address this skills gap, IBM and Linux Foundation's Open Mainframe Project have launched a new program to help connect states with programmers who have COBOL language skills that are proving key in the push to manage the surging number of unemployment claims nationwide. ... "We've seen customers need to scale their systems to handle the increase in demand and IBM has been actively working with clients to manage those applications," said Meredith Stowell, VP of IBM Z Ecosystem. "There are also some states that are in need of additional programming skills to make changes to COBOL.


World Economic Forum explores blockchain interoperability

blockchain interoperability
Blockchain interoperability is often viewed as a technical challenge, but there’s a lot more to it than that. The WEF divides into the Business, the Platform, and the Infrastructure.  The business aspect encompasses the governance of the blockchain and trust between the two networks, as well as data standardization. To share data, it has to be standardized. But often this homogeneity is focused within a single network as opposed to across networks. Other business aspects include incentives and the legal framework, which can be a bigger challenge across jurisdictions. The platform refers to the blockchain protocol, consensus mechanism, smart contract languages, and how users are authorized and permissioned. And the infrastructure looks at the hosting of servers in hybrid clouds, managed blockchains, and whether there are potentially proprietary components that might hinder interoperability. Different projects that implement interoperability are explored, mostly for public blockchains, include the well-known projects Cosmos and Polkadot. For enterprise blockchain, the WEF referred to Hyperledger Quilt, the open source implementation of Ripple’s Interledger, as well as the Corda Settler.


Cybersecurity officials say state-backed hackers taking advantage of pandemic

Silhouettes of laptop users are seen next to a screen projection of binary code are seen in this picture illustration taken March 28, 2018.
“Bad actors are using these difficult times to exploit and take advantage of the public and business,” Bryan Ware, CISA’s assistant director for cybersecurity, said in a statement. The agencies warned that hackers were also exploiting growing demand for work-from-home solutions by passing off their malicious tools as remote collaboration software produced by Zoom and Microsoft. Hackers are also targeting the virtual private networks that are allowing an increasing number of employees to connect to their offices, the agencies said. ... “Crowdsourced security platforms are built to simultaneously enable a remote workforce and help organizations maximize their security resources while benefiting from the intelligence and insights of a ‘crowd’ of security researchers,” Bugcrowd CEO Ashish Gupta told VentureBeat. “In the current environment, a lot of companies don’t have the required resources to secure and test remote environments where the majority of business is now taking place.”


AIoT and Intelligence on the Edge


Edge intelligence allows a high level of data to be processed and analyzed, and for decisions to be made locally, without being sent to the cloud. Take for example a self-navigating drone, instead of relying on a service hosted on the cloud to tell the drone where to go next, the drone itself is now able to decide its own path in the field, even when connections to cloud hosted services are not reliable. ... For architects and program leads working on such initiatives within the company, it’s mainly a mindset change in regards to how the solution is designed, including capabilities of the devices on the edge and where the decision-making step in a process happens. Feasibility for scenarios such as the drone automatically calculating its own path instead of relying on a cloud-hosted service are now better than before, and a few demos or proof-of -concept attempts could now move many of these stories from the backlog and bring implementation dates forward. While AIoT in its re-imagined, converged form may be new, the two original fields (AI and IoT) that merged to create AIoT are both mature and well into mainstream adoption. 


What do CISOs want from cybersecurity vendors right now?

CISOs cybersecurity vendors
To companies providing cybersecurity solutions, the polled executives advised to avoid sales pitches that involve fear-mongering, to dial down cold calls and emails, and to concentrate on nurturing existing relationships. “Messaging ought to be geared towards impacting an enterprise’s bottom line or community, rather than attempting to fearmonger or stoke panic over a situation already causing CISOs enough anxiety,” YL Ventures explained. “Cybersecurity executives feel quite unanimously about the marketing frenzy and, according to our sources, are compiling a ‘black list’ of vendors guilty of using this tactic.” Companies should concentrate on discovering what they can do to help their existing customers and discussing their customers’ experiences. Not only will this improve customer relations, but also provide helpful information that can inform the vendor’s future plans. Last but not least, vendors should consider making goodwill gestures. “Profiteering off of a world-wide tragedy will do vendors little service in the eyes of prospective customers. 41% of the CISOs we consulted with praised technology companies using their services to help other businesses and advised entrepreneurs to follow in their lead instead,” YL Ventures noted.


Why architecting an enterprise should not be IT-centric


The first and most important reason that architecture should not be IT-centric is the same reason why more and more IT-functions are merged with ‘business functions’. A popular metaphor was (is?) that information should be like water coming out of a faucet. In that metaphor the IT department is responsible for developing IT to deliver the information need from the ‘business’. The business aks for ‘information provisioning’, the IT department delivers. This ‘what — how’ division has been the reason for non-functioning business / IT cooperation in lots of organisations in the past decades. An enterprise in general does not need ‘information’ as such, but it needs resources and technology to execute business processes. The type of technology is not very important from a business perspective. It could be humans doing the job, mechanic or digital technology and mostly it will be a mesh of all these types of technology. As a side remark. Yes, data as a source for doing data intelligence could be seen as a product delivered by an organisational department, but that is only a small part of the totality of digital technology.



Quote for the day:


"Conviction is worthless unless it is converted into conduct." -- Thomas Carlyle


Daily Tech Digest - April 10, 2020

WiFi for Enterprise IoT: Why You Shouldn’t Use It


It’s the job of the local IT team to make sure their enterprise’s IT infrastructure is secure and reliable. Connecting dozens, hundreds, or even thousands of devices to that IT infrastructure poses a high risk to both security and reliability while offering little upside to the IT team. It may be true that your IoT solution will generate immense value for the enterprise to which you’re deploying, but this value is often not to the IT team directly. The local IT team will have other internal requests on their plate, and providing you support so you can deploy your IoT solution will likely be low on their list of priorities. This means that the stakeholders who you need most, due to their understanding of and control over the local WiFi setup, are least incentivized to help you. Let me be clear, I’m not attacking IT teams generally, but I’m pointing out the inherent misalignment of incentives even with the most capable and well-meaning IT teams. ... The lack of end-to-end control means that the success or failure of your IoT solution doesn’t rest solely within your hands. Customers don’t care why their shiny new IoT solution isn’t working and that it’s not your fault, they just care that it isn’t working.



10 Ways to Spot a Security Fraud

The Latin phrase "caveat emptor" has become an English proverb, and for good reason. "Let the buyer beware" is an axiom that nearly all of us are familiar with. Most of us know the phrase in the context of retail purchases. We were taught, or have learned over time, to never take sellers at their word. We must always perform the appropriate research before making a purchase. In security, unfortunately, we must practice a different type of caveat emptor. In recent years, security has become a hot field. And sadly, where there is budget and focus, there are also frauds and deceivers. There is no shortage of people presenting themselves as security experts. Some of them truly are. The rest of them, however, are keen to take advantage of security professionals who haven't yet learned to filter the real security experts from the fakes. ... Honest, hard-working security professionals have no problem emailing or otherwise putting agreements into writing. It's very common for a meeting to result in a follow-on email with minutes and action items.


The CSI Effect Comes to Cybersecurity


The problem is that forensic science is often portrayed as providing definite and irrefutable evidence of proof when the truth is that, outside of DNA analysis, forensic science should only be used as supplementary weight to support an allegation. In reality, forensic science is used relatively sparingly, especially when eye-witness, circumstantial and alibi evidence is available. Its comparatively expensive, time-consuming and rarely the definitive evidence that TV suggests. When it comes to cybersecurity investigations, instead of swabs, fingerprints and fibers, a key source of evidence are system logs. Everything from applications to devices is capable of generating an audit trail, ‘logging’ activities and events. At its simplest, if we have a record of logons to a system, and we know when our breach happened, we have a cyber ‘smoking gun’. If we can use log data for a reconstruction post-attack, why can’t log events be used to pre-empt a breach, providing an early warning that suspicious activity is taking place? This is the promise of contemporary SIEM technology, an automated system to capture sufficient evidence to not just understand the timeline of a breach, but to detect the warning signs of an attack before it happens.


Security-by-Design Principles Are Vital in Crisis Mode

Cybersecurity
As organizations move to expand remote working and automation capabilities during the crisis, they are more likely to make mistakes. “You can’t let either the technology or the new business processes outpace the security behind it. You need to ensure that your internal security team is a part of every decision you make regarding new technology, processes or ways of working.” Experts recommend making security a consideration at the earliest possible stage when planning on technology deployments. “Make sure you bring in the stakeholders, the business as well as the operators into security discussions,” recommended Bob Martin, co-chair of the Software Trustworthiness Task Group at Industrial Internet Consortium. “You need to consider [security] as one of the primary aspects of any solution and, like the foundations of a house, everything else is built on top of that,” said Andrew Jamieson, director, security and technology at UL. Organizations that neglect to build a correct foundation risk rebuilding it or “at least spend a great deal of time and effort fixing something that could have been much more easily remedied earlier on,” Jamieson said.


CD Foundation Serves Up Tekton Pipelines Beta

CD Foundation
The beta release of Tekton Pipelines is significant because it signals that the project is now stable enough to be incorporated in DevOps platforms and from here on will follow the same deprecation policies as Kubernetes in terms of supporting previous releases. However, Wilson noted that Tekton Triggers, Tekton Dashboard, Tekton Pipelines CLI and other components are still alpha and as such may evolve from release to release in a way that is not necessarily backward-compatible just yet. In the meantime, the Tekton Pipeline team is encouraging all Tekton projects and users to migrate their integrations to the latest version of Custom Resource Definition (CRD), which is the application programming interface (API) supplied. The Tekton Pipeline team is also making available a migration guide. The Tekton Pipelines project is one of several initiatives being advanced under the guidance of the CD Foundation, which is an arm of The Linux Foundation. Other projects include Jenkins and Jenkins X, a pair of open source CI/CD projects developed originally by CloudBees and Spinnaker, a CD platform originally created by Netflix.


ARming a new industry: Manufacturing can fully realise the potential of AR


AR is a frontrunner to help minimise machine downtime and streamline the supply chain process. For instance, when engineers need to communicate with off-site experts to maintain machinery, on-screen 3D annotations can be used to direct less experienced technicians. This is a crucial aspect of AR as it can help to address any skill gap deficits being experienced. Being able to access the knowledge of an expert technician to support in-house or field technicians decreases the amount of time needed to repair machines and get them back up and running. The technology is also being used as an invaluable training tool, allowing manufacturers to assess and maintain more stringent levels of quality control, as well as developing talented engineers. Furthermore, AR can help in more recent developments such as the proactive maintenance process. Using advanced analytics, manufacturers can identify potential errors and use remote experts and AR annotated displays to guide on-the-ground workers to fix problems before they become a major threat to the manufacturing line.


Zoom, Netflix discuss remote network management challenges


Application performance problems are typically not network problems and deal more with UX. As more employees work from home, IT teams may assume UX issues stem from the organization's network rather than the user's application performance. These issues may also cause network engineers to doubt their skill sets in this unfamiliar territory, Viavi said. However, if a business aims to operate as usual -- even in an unusual time -- then network engineers should likewise go about network issues and remote network management as usual. This means conducting packet analysis and other standard troubleshooting techniques to determine whether an issue stems from the business network or from a user's application or network connection. Netflix's Temkin said his team faced occasional strain in last-mile connections, as did Dzmitry Markovich, senior director of engineering at Dropbox.


What is artificial narrow intelligence (ANI)?

artificial intelligence under construction
Narrow AI systems are good at performing a single task, or a limited range of tasks. In many cases, they even outperform humans in their specific domains. But as soon as they are presented with a situation that falls outside their problem space, they fail. They also can’t transfer their knowledge from one field to another. For instance, a bot developed by the Google-owned AI research lab DeepMind can play the popular real-time strategy game StarCraft 2 at championship level. But the same AI will not be able to play another RTS game such as Warcraft or Command & Conquer. While narrow AI fails at tasks that require human-level intelligence, it has proven its usefulness and found its way into many applications. Your Google Search queries are answered by narrow AI algorithms. A narrow AI system makes your video recommendations in YouTube and Netflix, and curates your Weekly Discovery playlist in Spotify. Alexa and Siri, which have become a staple of many people’s lives, are powered by narrow AI. In fact, in most cases that you hear about a company that “uses AI to solve problem X” or read about AI in the news, it’s about artificial narrow intelligence.


Identity as the New Perimeter


“The question becomes, what happens after the employee connects to your network? Do you have a way to trace the access that that employee is obtaining? Do you have a way to validate if those are legitimate access requests or if something malicious is taking off?  “What we see today is that many organizations rely only on perimeter security. What Siverfort does is enable you to extend your multi-factor authentication beyond the perimeter to any access, whether it’s on-premise or whether it’s in the cloud. No matter the application, whether it is a homegrown application or an IoT device.” So, why are too many sensitive systems still not using MFA? Traditional MFA solutions are difficult to deploy. They require software agents or proxies. They often require a custom integration with legacy systems. Our work environments and IT infrastructures have evolved. Our world is changing at breakneck speed. New ways of looking at security are needed.


What Is The Hiring Process Of Data Scientists At IBM?

IBM
The technical skills that IBM looks for in data science candidates encompasses ML Ops, which includes some of the newer skills, like debiasing and machine learning model runtime management.  “In addition to that, they need to possess adequate skills in the areas of Data ops, data wrangling and domain knowledge, which is essentially a cross section between industry knowledge and applicability of machine learning in those industries,” says Chahal. Although the company does not overemphasize candidates’ educational background, they need to have a good grasp of the relevant competencies mentioned above. With several platforms abound with machine learning certifications, Chahal feels that that may be a good approach for data science aspirants to upskill themselves. “These certifications can verify their awareness about various platforms, tools, libraries and packages that are being used across enterprises today, as well as the familiarity or the ability to work with open source or enterprise/vendor-specific tools.”



Quote for the day:


"Leadership is absolutely about inspiring action, but it is also about guarding against mis-action." -- Simon Sinek


Daily Tech Digest - Apr 09, 2020

Let’s make testing Agile, they said. Uh, what did they mean by that?

Let’s make testing Agile, they said. Uh, what did they mean by that?
Automated software testing is a fundamental part of Agile software development, even though it is not included in the manifesto. Automated testing helps in many ways, say Okken. But in general, a robust test suite helps ensure working software, increases a team’s ability to refactor and extend a software system, and respects individuals by automating the generally boring task of manual regression testing. “Automated tests also speed up development, further respecting the time of software developers, and allowing faster and more frequent deliveries to end users,” Okken says. “The development of automated tests during production code development helps developers understand the problem domain, the API, the problem at hand better, and help them in turn develop better software. Why would anyone want that learning to go to a separate team and not to the development team?” In adopting DevOps, you are discarding the traditional method of development, commonly called “waterfall,” for the more iterative process of building a small amount and testing rigorously we know as Agile.


Project Orleans and the distributed database future with Dr. Philip Bernstein

The set of mechanisms that we use to solve database problems, they don’t change very fast. Back in the early days, we were learning about certain base technologies for the first time, but now, there’s this repertoire of ingredients that you put into solving a database problem. I’m very sympathetic to graduate students who are trying to learn this stuff because, you know, I learned it slowly over a period of many years as it was unfolding, but people getting into the field, they learn it in a very compressed amount of time and they don’t necessarily have a deep understanding of why things are the way they are and so when they encounter a problem, they’re trying to solve it just based on an understanding of the problem and then trip over some approach that they think, oh, I’ll bet that would be helpful, but then they don’t realize this is actually a variation on something that has been applied in several other contexts before.


New botnet attack "puts other IoT botnets to shame"

malware in a computer system
A destructive new botnet that compromises vulnerable Internet of Things (IoT) devices and hijacks their resources to carry out devastating Distributed Denial of Service (DDoS) attacks is being reported by security research firm Bitdefender. The IoT botnet, which the company named "dark_nexus," has recently been found in the wild and is taking innovative and dangerous new approaches to successfully attacking IT infrastructure. "Our analysis has determined that, although dark_nexus reuses some Qbot and Mirai code, its core modules are mostly original," Bitdefender said in a 22-page white paper released April 8 about the attacks, "New dark_nexus IoT Botnet Puts Others to Shame." While some of its features may be shared with previously known IoT botnets, the way some of its modules have been developed makes dark_nexus significantly more potent and robust, the report said. ... "The victims won't even be aware that their devices are used as weapons against innocuous targets on the internet, even if the results might be catastrophic for victims or for the proper functioning of the internet," Botezatu said.


How Will The Cloud Impact Data Warehousing Technologies?


As data volumes continued to grow at rapid speeds, traditional relational databases and data warehouses were unable to handle the onslaught of this data. In order to circumvent this issue and ensure more efficient big data analytics systems, engineers from companies like Yahoo created Hadoop in 2006, as an Apache open source project, with a distributed processing framework which made the running of big data applications possible even on clustered platforms. Given the volume of data generated in the modern times and the advanced infrastructure required to handle it, decision support databases are facing considerable pressure to evolve, both technologically as well as architecturally. Alongside several new data warehousing architecture approaches, numerous technologies have also emerged as key contributors to modern business intelligence solutions, ranging from cloud services to data virtualization to automation and machine learning, among others. Cloud based solutions are the future of the data warehousing market. With numerous enterprises turning to the cloud to power and store their data warehousing solutions, internet companies like Amazon and Google and working tirelessly to develop and host innovative cloud-based data warehouses.


‘Unbreakable’ Smart Lock Draws FTC Ire for Deceptive Security Claims

tapplock unbreakable smart lock
“This vulnerability allowed the researchers to sniff data packets for the information necessary to authenticate their access to the lock,” the FTC explained. “With that information, researchers were able to continue accessing the lock even after their access had been revoked.” Adding insult to injury, the complaint also noted that it’s possible unlock the smart locks by simply unscrewing the back panel. In June 2018, Youtuber JerryRigEverything posted a video demonstrating how the lock could come apart using a screwdriver to loosen and pop off the back of the lock, and then open the shackle. The upshot of all of this, according to the FTC, is that Tapplock “did not take reasonable measures to secure its locks, or take reasonable precautions or follow industry best practices for protecting consumers’ personal information,” despite advertising that it did. “[Tapplock] advertised its smart locks to consumers as ‘Bold. Sturdy. Secure.,'” according to the complaint. “[Its] advertisements touted that its ‘secure’ smart locks were also…designed to be ‘unbreakable.'” The complaint added, “in fact, [Tapplock] did not have a security program prior to the discovery of the vulnerabilities.”


Keeping Vigilant for BEC Amid COVID-19 Chaos

In fact, FBI IC3 recently noted in its 2019 Internet Crime Report that BEC scams accounted for 40% of the losses for cybercrime last year. That number is likely to spike even further as criminals see BEC in the pandemic as low-lying fruit. The rapid distribution of employees to makeshift work-from-home situations, the use of unfamiliar devices, the distractions and anxiety created by illness and business disruption, have all combined to create an ideal BEC hunting ground for the bad guys. "Employees working from home are likely to be even more distracted than usual, with children, household chores, and coronavirus anxieties all competing for their attention," explains Seth Blank, vice president of standards and new technologies at Valimail. "That will make them even less attentive to the subtle clues that an email is a phishing attack. And, when working from home, they're also more likely to be using a small screen or even their cellphones to manage email, which can make some of these phish attempts — which used bogus sender identities — nearly impossible to detect." 


APT groups
The APT groups examined in this report are likely comprised of civilian contractors working in the interest of the Chinese government who readily share tools, techniques, infrastructure, and targeting information with one another and their government counterparts. The APT groups have traditionally pursued different objectives and focused on a wide array of targets; however, it was observed that there is a significant degree of coordination between these groups, particularly where targeting of Linux platforms is concerned. The research identifies two new examples of Android malware, continuing a trend seen in a previous report which examined how APT groups have been leveraging mobile malware in combination with traditional desktop malware in ongoing cross-platform surveillance and espionage campaigns. One of the Android malware samples very closely resembles the code in a commercially available penetration testing tool, yet the malware is shown to have been created nearly two years before the commercial tool was first made available for purchase.


Wanted urgently: People who know a half century-old computer language so states can process unemployment claims

Two men operating a mainframe computer, circa 1960.
On top of ventilators, face masks and health care workers, you can now add COBOL programmers to the list of what several states urgently need as they battle the coronavirus pandemic. In New Jersey, Gov. Phil Murphy has put out a call for volunteers who know how to code the decades-old computer programming language called COBOL because many of the state's systems still run on older mainframes. In Kansas, Gov. Laura Kelly said the state's Departments of Labor was in the process of modernizing from COBOL but then the virus interfered. "So they're operating on really old stuff," she said. Connecticut has also admitted that it's struggling to process the large volume of unemployment claims with its "40-year-old system comprised of a COBOL mainframe and four other separate systems." The state is working to develop a new benefits system with Maine, Rhode Island, Mississippi and Oklahoma. But the system won't be finished before next year. "Literally, we have systems that are 40-plus-years-old," New Jersey Gov. Murphy said over the weekend.


virtual data center servers
“VMware’s goal is to make NSX invaluable to the VMware installed base as those customers modernize their on-premises data-center network infrastructure and similarly seek to provide consistent network and security polices for modern applications running in public clouds," Casemore said. "As the data center becomes distributed in a multicloud world, the data-center network must become a multicloud data-center network. On the VeloCloud [VMware’s SD-WAN offering] side, the focus is on modernizing the WAN to accommodate delivery of these applications to the branch.” One new feature of NSX is the ability to control and synchronize multiple virtual networks as a single entity. Called NSX Federation, the feature lets customers set network configuration, management and policy setting across large environments. NSX Federation would let customers generate “fault tolerant zones” where they could contain network problems in a single zone, minimizing problems and preventing them from spreading, VMware stated.


Hearing test showing ear of young woman with sound waves simulation technology
The hard of hearing community has been contributing to the success of business globally in all kinds of industries. They’ve navigated the challenges of building connections even when dealing with the issues of fast paced conversations and multiple speakers in meeting settings. They’ve adapted by learning to read lips, pick up on speech patterns and build support networks with peers to help them keep pace with their fully hearing capable counterparts. Some of us may feel like this really has nothing to do with our own work experience. But based on the following items of note from the Disabled World Organization and the World Health Organization, you are bound to know, work with or even become someone who is hard of hearing. Approximately 432 million adults worldwide have a disabling hearing loss. It is estimated that by 2050, more than 900 million people will have a disabling hearing loss. There is a progressive loss of ability to hear high frequencies with increasing age known as presbycusis. 



Quote for the day:


"Great leaders go forward without stopping, remain firm without tiring and remain enthusiastic while growing" -- Reed Markham


Daily Tech Digest - April 08, 2020

‘Fake Fingerprints’ Bypass Scanners with 3D Printing

galaxy s10 fingerprint
The fake fingerprints achieved an 80 percent success rate on average, where the sensors were bypassed at least once. Researchers did not have success in defeating biometrics systems in place on Microsoft Windows 10 devices (though they said that this does not mean they are not necessarily safer; just that this particular approach did not work). However, the bigger takeaway is the sheer amount of time and budget that it still takes when creating threat models to bypass fingerprint sensors. At the end of the day, researchers said they had to create more than 50 molds and test them manually, which took months – and, they struggled to stay under a self-imposed budget of $2,000. These challenges point to the fact that a scalable, easy type of attack is not yet possible for bypassing biometrics. “Biometrics are not an Achilles heel,” Craig Williams, director of Cisco Talos Outreach, told Threatpost. “Biometrics are something that makes it very, very easy to use. You don’t have to remember a password. You don’t have to enter a password, which makes it very fast and easy. You don’t have to carry anything around with you. And so I think for most users, it’s still perfectly fine.”


Robotic Process Automation (RPA): 6 open source tools

RPA Robotic Process Automation lessons
Open source might sound intimidating to non-developers, but there’s good news on this front: While some open source projects are particularly developer-focused, multiple options stress ease of use and no- or low-code tools, like their commercial counterparts. One reason for this: RPA use cases abound across various business functions, from finance to sales to HR and more. Tool adoption will depend considerably on the ability of these departments to manage their RPA development and ongoing management themselves, ideally in a collaborative manner with IT but not wholly dependent on IT. ... TagUI is a command-line interface for RPA that can run on any of the major OSes. TagUI uses the term and associated concept of “flows” to represent running an automated computer-based process, which can be done on demand or on a fixed schedule. ... Robocorp might have our favorite name of the lot – it kind of conjures up some of the darker, Terminator-esque images of RPA – but that’s a bit beside the point. This is a relatively new entry into the field, and somewhat unique in that it’s a venture-backed startup promising to deliver cloud-based, open source RPA tools for developers.



Inverting a matrix is one of the most common tasks in data science and machine learning. In this article I explain why inverting a matrix is very difficult and present code that you can use as-is, or as a starting point for custom matrix inversion scenarios. Specifically, this article presents an implementation of matrix inversion using Crout's decomposition. There are many different techniques to invert a matrix. The Wikipedia article on matrix inversion lists 10 categories of techniques, and each category has many variations. The fact that there are so many different ways to invert a matrix is an indirect indication of how difficult the problem is. Briefly, relatively simple matrix inversion techniques such as using cofactors and adjugates only work well for small matrices (roughly 10 x 10 or smaller). For larger matrices you should write code that involves a complex technique called matrix decomposition. The code presented in this article will run as a .NET Core console application or as a .NET Framework application. Many of the newer Microsoft technologies, such as the ML.NET code library, specifically target .NET Core so it makes sense to develop most new C# machine learning code in that environment.



PMI offers free project management courses during COVID-19 quarantines

Professional project manager with icons about planning tasks and milestones on schedule, cost management, monitoring of progress, resource, risk, deliverables and contract, business concept
This is the first time that the group has offered these online training and consulting resources at no charge, said DePrisco. The Project Management for Beginners course introduces participants to the foundational knowledge necessary to join a project team and provides insights into taking steps on the path to a project management career. The Agile in the Project Management course walks participants through their role as a project management office director and introduces a series of scenarios designed to improve their project management office's performance using agile principles and processes. The Business Continuity course offers information and lessons on rethinking work processes, which may be particularly helpful today as companies and their leaders and workers seek ways to cope with continuing their operations during the pandemic. ... Project management skills can be extremely beneficial during times of emergency such as the pandemic, he said. "Project management initiatives play an important role in preparing for these types of disruptions. All work is accomplished through programs and projects, and project managers are used to changing methods and approaches."


These hackers have been quietly targeting Linux servers for years


Linux is not typically a user-facing technology, so security companies tend to focus on it less, he explained. As a result, these hacking groups have zeroed in on that gap in security and leveraged it for their strategic advantage to steal intellectual property from targeted sectors for years without anyone noticing, he said. "It's critical for these servers to be up all the time; so what better place to put a root kit or a pervasive active tool than on a machine that's going to be turned on all time?" said Cornelius. The attackers scan for Red Hat Enterprise, CentOS, and Ubuntu Linux environments across a wide range of industries, attempting to identify unpatched servers. From there it's simply a case of establishing persistence on the network with malware. Not only can this provide the attackers the access they need to sensitive information and data, but with the infection on the servers themselves, they can create a persistent back door into the network that provides them with a way back in whenever they like – so long as the compromise isn't uncovered. The attackers are careful to do as little damage as possible to the networks so as to avoid detection – and therefore keep campaigns up and running for as long as possible, which might be years.


Is It Possible To Become A Successful Self-Taught Data Scientist?

Data scientist
Although a university degree is a great accomplishment, self-taught aspirants can rejoice as this is not enough to land a good data science job. While a degree may lay down a foundation for a career in this field – and may get one a job interview – it is not a key qualifying factor when applying for tech positions. Even though you may be competing against applicants who have relevant degrees, you can garner a competitive advantage with upskilling using the world of resources available online. What is more, self-study also signals a candidate’s motivation to succeed. But you need to first narrow down what you need to learn to substitute for your lack of formal training. Data science is a broad discipline and comprises a wide collection of jobs – from statisticians to machine learning (ML) experts, to business analysts to data visualization experts. Since the skills required for each vary, it is important to first narrow down the skill sets you need to acquire, and then create a plan around it.


9 Security Podcasts Worth Tuning In To

(Image: Boyarkina Marina -- stock.adobe.com)
The cybersecurity industry changes every day, sometimes multiple times a day, and it can be overwhelming for professionals to keep up with the constant flow of breaking news, new threats, defensive strategies, reports, mergers, valuations, product releases, and trends. Podcasts can help you stay in the loop on security news by hearing the latest updates and analysis from experts across the industry. Some of the best security podcasts offer insight from practitioners, CISOs, analysts, and reporters who take a closer look at industry events and aim to educate their listeners with digestible information and discussions with other security pros. Many cybersecurity podcasts offer informative takes on recent incidents and shed light on how current events; for example, COVID-19, are affecting the IT security community. Others discuss specific parts of the industry, like the Dark Web or the relationship between CISOs and vendors. The handy thing about podcasts is they help you stay on top of cybersecurity news and trends, and learn from the pros, when you're not sitting in front of a screen or attending a conference.


How to Integrate Security Into Your Application Infrastructure


Cequence describes the threats they address, stating that the web, mobile, and API-based apps that power organizations are also targets for relentless cyberattacks. These include automated bot attacks focused on business logic abuse (such as credential stuffing, site scraping, fake account creation, and more), as well as targeted attacks designed to exploit both known and unknown application vulnerabilities. Cequence Security stops these attacks with an AI-powered, container-based software platform that can be easily deployed on-premises or in the cloud, wherever your apps need to be protected. Matt told us, “We look at our customer’s web or application traffic and use machine learning algorithms to look for patterns of automation to determine if it is malicious. While doing this, we mustn’t introduce additional friction to the user experience.  “We collect telemetry and look at the patterns within the traffic. We watch for underlying behavior characteristics that may indicate potentially malicious traffic.



Zero-day exploits increasingly commodified, say researchers


In new research published this week, FireEye said it had documented more zero-day exploitations in 2019 than in the previous three years, and although not every attack could be pinned on a known and tracked group, a wider range of tracked actors do seem to have gained access to these capabilities. The researchers said they had seen a significant uptick, over time, in the number of zero-days being leveraged by threat actors who they suspect of being “customers” of private companies that supply offensive cyber capabilities to governments or law enforcement agencies. “We surmise that access to zero-day capabilities is becoming increasingly commodified based on the proportion of zero-days exploited in the wild by suspected customers of private companies,” they said. “Private companies are likely to be creating and supplying a larger proportion of zero-days than they have in the past, resulting in a concentration of zero-day capabilities among highly resourced groups.


Chrome 81 released with initial support for the Web NFC standard

chrome-new-ui.png
Plans to remove the TLS 1.0 and TLS 1.1 encryption protocols from Chrome, also initially scheduled for Chrome 81, are now delayed to Chrome 84. The decision to delay removing these two protocols is related to the current COVID-19 outbreak, as removing the two protocols might have prevented some Chrome 81 users from accessing critical government healthcare sites that were still using TLS 1.0 and 1.1 to set up their HTTPS connections. Removing support would have prevented users from accessing those sites altogether, something that Google wanted to avoid. Today's Chrome 81 release marks the most turbulent release in Chrome's history. Because the browser maker had to shift features around from version to version, and because the three-week Chrome 81 delay also disrupted Google's regular six-week release schedule, Google has now taken a first-of-its-kind step to scrap a Chrome version. Google said the next version of Chrome is v83, and that work on v82 has been permanently abandoned.



Quote for the day:


"Every great leader can take you back to a defining moment when they decided to lead." -- John Paul Warren


Daily Tech Digest - April 07, 2020

Hybrid Instead of All-Flash

All-flash Array vendors claim that because of the continuing decline in flash pricing and because of deduplication, there is no longer a financial reason to choose hybrid instead of all-flash. They claim that the unpredictable performance concerns of hybrid arrays outweigh any remaining cost advantage. AFA vendors, though, ignore the fact that the price of hard disk drives is reducing in terms of cost per terabyte. They also ignore the new reality that hard disk isn’t the only option for the second tier of storage. Deduplication, while bringing down the cost per terabyte of flash, brings a set of “taxes” that make it less cost-efficient than customers are led to believe. First, in primary storage, deduplication is far less efficient than when IT uses the technology for backup storage. Second, there is a performance overhead associated with its use, and all-flash arrays that use deduplication have an inferior cost per IOPS rating. Finally, most all-flash vendors don’t pass the full savings of deduplication on to the customer. The customer receives some of the cost savings value, but not all of it.


How to stay motivated when you work from home

Apple, remote working, iOS, mobile, iPhone
Those conversations you have with friends and family in restaurants, bars, on the street don’t need to stop when you’re self-isolating, just contact your people on FaceTime. With these suggestions in mind I’ve identified a selection of iOS tools that may help you take control of working from home while also helping you make the best of the motivation you still have available to you. Don’t be too frustrated if you’re not as motivated as normal – it really isn’t your fault. Things are happening. They are quite frightening. You are already doing what you can to challenge them by staying at home. Cut yourself some slack first and then see if these (mostly free) tools help you feel a little more in control. Assuming you can find the ingredients, then FoodPlanner lets you find healthy recipes you like the sound of online, add them into the app and then generates nutritional data, create a shopping list (including inventory management features to help you track ingredients you already have) and create meal plans for the next week or more. Foodplanner doesn’t aim to pester you into exercise, it lets you choose the food you want and then gives you the information you need in order to make it.



Compromising a 2FA system is lot easier than it seems. One of the easiest methods, especially in America, is a sim-swap, where a malicious actor switches a target’s mobile phone number to a new phone. Any subsequent text messages, such as those for 2FA, are sent to this new phone, thereby giving the malicious actor access. Certain malware has also been found to compromise 2FA systems. Cerberus, a type of Android-based malware, was found to have stolen 2FA codes for Google Authenticator in February 2020. There is also the TrickBot malware, which bypasses 2FA solutions by intercepting the one-time codes used by banking apps, sent by SMS and push notifications. Social engineering is also used to bypass 2FA security. Malicious actors may pose as a target’s bank, calling the target to “confirm their identity” by quoting the secure code that has just been sent to them, in response to an attempt to access their banking profile. “A lot of this stuff doesn’t require any real technical skill, and that’s the really scary part,” says Harding.


ms-teams-commands.jpg
It might not be immediately obvious, but the Search box at the top of the Teams desktop app doubles as a command line. Click in that box and then tap the slash key (/) to display a list of all available commands. ... Pressing Ctrl+E takes you to the Search box, for example, just as it does in File Explorer and your web browser. You can use Ctrl+number to go to the corresponding node in the navigation pane on the left. In the default arrangement, Ctrl+1 goes to the Activity pane, Ctrl+2 takes you to Chat, and so on. Press Ctrl+Shift+X to toggle between the bare compose box and the full editor with all its formatting options. And just as in your web browser, you can hold down Ctrl as you tap the plus or minus keys to zoom in or out, then press Ctrl+0 to go back to normal (100%) magnification. ... When posting a new conversation/thread, it's a good idea to add a subject, as I've done in the opening post here. That makes it easier to spot a specific conversation by scrolling through a channel, and also makes it easier to use the search tools to find that conversation.


What is power over Ethernet (PoE)?

ethernet cable declantm flickr
Using PoE in wireless rollouts may be the technology’s primary application but many think it will find a home in the internet of things where wired IoT devices can receive power from their network connection. Versa technology wrote a blog about the use of PoE and IoT by the city of San Diego, Calif., which is using Ethernet cabling to deliver power to thousands of interconnected LED streetlights, which are integrated into the city’s IoT network. Power to the smart lamps can be turned up and down to optimize illumination for each space. Such lighting systems have low power requirements, making them cheaper to use. The PoE streetlights are integrated with the city’s IoT network, which makes it possible to monitor and control them remotely. The smart lamps are fitted with motion sensors to conserve energy by optimizing lighting based on the needs of each space. The system saves the city $250,000 or more per year, Versa stated. IP security cameras, which are often placed in difficult-to-access locations, are another key PoE application target.


IBM CEO Throws Down Hybrid-Cloud Challenge

IBM CEO Throws Down Hybrid-Cloud Challenge
In a LinkedIn message to IBM’s employees, Krishna said he wants the company to add a greater presence in the hybrid-cloud space to its already established positions in the mainframe, services, and middleware ecosystem. “The fundamentals are already in place,” Krishna wrote. “Our approach to hybrid cloud is the most flexible and the most cost effective for our clients in the long term. Coupled with our deep expertise, IBM has unique capabilities to help our clients realize the potential of a hybrid cloud business model.” Krishna stated that IBM would take advantage of its already established presence in cloud, artificial intelligence (AI), blockchain, and quantum computing. He noted that two “strategic battles” were taking place in the journeys to hybrid cloud and AI. “We all need to understand and leverage IBM’s sources of competitive advantage,” Krishna explained. “Namely, our open source and security leadership, our deep expertise and trust, and the fact that we enable clients to build mission-critical applications once and run them anywhere.”


Cybercriminals increasingly using SSL certificates to spread malware

Internet browser window showing lock icon during SSL connection
Recent studies have shown that cybercriminals building phishing sites now use SSL as well, complicating efforts by enterprises to keep their employees safe. The Menlo Security research revealed that while 96.7% of all user-initiated web visits are being served over https, only 57.7% of the URL links in emails turn out to be https, which means that web proxies or firewall will be oblivious to the threats unless enterprises turn on SSL inspection. "If you think the little green lock of https equals security, think again," the report said. "The bad news is that the bad guys use encryption, too. Many people mistakenly assume that as long as an SSL certificate is present, they're safe from attack, but that couldn't be further from the truth. From Reductor to Godlua and numerous other variants, it has become all too clear that new types of malware are being secreted behind a symbol that was once seen as secure." According to the report, enterprises have long relied on on-premises proxies and next-generation firewalls for visibility and control of web access. But when it comes to decrypting and inspecting SSL sessions, the report said, "many enterprises have held back partly driven out of privacy issues and partly around performance of these proxies with SSL decryption turned on.


What are the five main barriers to digital transformation and their solutions? 

What are the five main barriers to digital transformation and their solutions? image
One of the biggest barriers to digital transformation initiatives is when there is no clear direct return on investment. To overcome this barrier, White explains that “businesses should rectify this by defining a clear set of digital success criteria at the start, defined based on what you are trying to achieve — are you creating additional revenue streams or enhancing internal operations? Measures can be based on anything from metrics to softer statements such as ‘we will be able to provide customers with a way to engage 24/7 around the world’.” ... The most common barrier to digital transformation, according to Steve White, head of transformation accounts at Yotta, is data and department silos. He explains: “One common example is that the software applications being used by departments are very specific to those service areas, often require specialist knowledge to use effectively and are locked down via account profiles and permissions. They also incorporate different user interface designs (UI) and user experience designs (UX) which all make access by other departments or users within the organisation extremely difficult.


Data scientists: White House issues a call to arms

data-science.jpg
It's an opportunity for service for data scientists, a way to help healthcare workers and policymakers understand a growing dataset that holds the key to making informed decisions. At the moment, we lack the most basic knowledge about COVID-19, including an answer to the most fundamental question: how many people have been infected? Health experts agree that reliable data answering this question and other fundamental questions are needed to guide difficult decisions ahead. ... "The good news is we have lots of data," says McDonald. "The bad news is the organization and accessibility of that data is very spread out or difficult to access." Given the difficulties with the dataset, McDonald points to AI deep learning as a necessary tool. "Deep Learning is not a typical algorithm. A user literally "teaches" the platform with hundreds of examples of the various classifications or predictions. Once taught, then future classifications and predictions are in the hands of the deep learning platform." This can be applied to health data in general, which is a growing trend in data-driven medicine.


Cisco goes after wireless IoT with Fluidmesh acquisition

Industry 4.0 / Industrial IoT / Smart Factory
In January Cisco rolled out an overarching security architecture for industrial IoT (IIoT) environments that includes existing products but also new software called Cisco Cyber Vision, for the automated discovery of industrial assets attached to Cisco’s extensive IIoT networking portfolio. The new security rollout also included Cisco Edge Intelligence software to simplify the extraction of IoT data at the network edge. Together with the new software, IT and operational technology groups will be able to work together to provide advanced anomaly detection in IIoT environments, Cisco stated. Also in 2019, Cisco expanded its IoT security and management offerings by acquiring Sentryo, a company that offers anomaly detection and real-time threat detection for IIoT networks. Founded in 2014 Sentryo products include ICS CyberVision – an asset-inventory, network-monitoring and threat-intelligence platform – and CyberVision network-edge sensors, which analyze network flows. Last year Cisco rolled out a family of switches, including the Catalyst IE3x00 ruggedized edge switches, software, developer tools and blueprints to incorporate IoT and industrial networking into intent-based networking and classic IT security, monitoring and application-development support.



Quote for the day:


"When you expect the best from people, you will often see more in them than they see in themselves." -- Mark Miller