Daily Tech Digest - June 04, 2020

Machine learning will transform the banking sector

The unified approach that AI provides allows institutions to see the financial status of a customer across multiple accounts in an instant. This information combines with the previous products that got contracted, transaction histories, and individual interactions to ensure that personalized services are always available. This technology redefines the definition of customization. Instead of requiring a customer to complete a series of questionnaires or surveys to match up specific datapoints to potential products of interest, machine learning automates this process by looking at all of the activities of the consumer throughout that person’s history with the organization. It can even pull information from the news or social media posts to determine the viability of an offer before one gets requested. That makes the predictive mechanisms more accurate, speeding up the time it takes for someone to complete the processes needed to access something new. As improvements to data warehousing and information processing continue developing, the existing machine learning models will use specific financial profiles that the technology develops internally to create unique initiatives that encourage increases in customer interactions.


Survey: Security Concerns Slow Down IoT Deployments

Although security requirements may mean IoT projects will take longer, it also means that enterprises are cognizant of how a growing number of devices on networks introduces new attack vectors. "The risks with IoT potentially increase because of the diversity of deployments and technologies in IoT networks - general enterprise security is much more standardized and so easier to deploy and keep updated," says Alexandra Rehak, chief analyst with the London-based consultancy Omdia and head of its internet of things practice. The Omdia-Syniverse IoT Enterprise Survey polled 200 enterprises between January and March in North America and Europe that have deployed IoT devices. It was commissioned by Syniverse, which offers private networks for fleets of IoT devices. Of all enterprises polled, 86% reported that IoT projects were delayed or constrained by security. The survey covered companies in healthcare, financial services, manufacturing, retail and hospitality and transportation. Their concerns over security vary. For example, the manufacturing industry is most worried about unauthorized devices joining the network. Healthcare and finance rank regulatory and compliance concerns high.


Layoffs rock the IT services industry amid move to the cloud

So what are we to make of all this? The obvious culprit is the move to the cloud. Enterprises don’t need to hire as many consultants making six-figure salaries when AWS or Microsoft is handling half of your IT load. But DXC said it wasn’t the cloud, it was its own bloated hierarchy, which is quite an admission. “There is no doubt that these big consulting firms are having to pivot because of the cloud and its hitting them in the bottom line,” says Joshua Greenbaum, president of Enterprise Application Consulting, an independent consultancy. “The quarantine and emergency has accelerated plans to move to the cloud and put the brakes on projects that would have been lucrative. The combination of the two means a lot of stuff is put on hold.” Whether those jobs come back is questionable. Not helping matters is machine-learning software like the recently announced SAP Cloud ALM that automates a lot of the basic work of cloud lifecycle management. There’s no doubt the basic, low-level services of getting data centers up and running stuff doesn’t come back. There will be a shift. At the end of the day, complexity is king in enterprise software. What is made easy today is made more complex tomorrow and that will need more skills.


What are you tuning for?

Are you tuning to improve your SQL Server licensing footprint? You can tune for CPU reduction in repetitive queries. You can index and statistics tune to make certain queries faster and be more efficient, which in turn reduces the CPU, memory, and storage thrash while the commands are executing. You might even be able to use less of the things that SQL Server licensing is based on, namely CPUs. Are you tuning for end-user productivity? Can you quantify the pain points the users are ‘feeling’ each and every day? Can you pinpoint the database commands that are underneath those application features? Are they database-driven, or is it more application data handling that is slowing down the function? Maybe the volume of data that the business accesses daily is so high that all-flash storage is the biggest gain you can make. What if faster CPUs, and not just more cores, would get your users a larger bang for the buck? Are your repetitive queries optimal? Can you even access the commands to tune them, such as queries underneath third-party applications? What if tuning for end-user productivity meant increasing parallelism or adding to your licensing footprint? 


Constructing the future for engineering – finding the right model where one size does not fit all

If anything goes wrong or needs adjustment, there is no “back to the drawing board” any more. In fact, not for a long while. It’s all about accessing the right type of data at the right stage in the process, meaning that all of these stages have to be completely interlinked. Indeed, their success depends on constant collaboration and communication between the various people engaged in carrying out their individual activities, who may be located virtually anywhere in the world. Many of the modern world’s most famous engineering projects could only have been realised by bringing together talent from around the globe with a multitude of different departments and workflows in one extended, virtual team. And it’s not just engineering and design these days – collaboration has to extend to marketing and sales so that marketable and sellable concepts are what is ultimately built and put on sale. Crucially, this information also has to extend in a business-relatable form to boardrooms. Photorealistic rendering of finished products are not just pretty pictures – they are pretty essential. This has been the fundamental model of engineering for the past two decades.


Digital banking is now for everyone, how will you choose to compete?

There have been attempts for traditional banks to break free from their analogue worlds and colonise new digital planets. In 2019, the USA JPMorgan Chase’s neobank Finn, and in 2020, the UK Royal Bank of Scotland’s neobank Bó both failed to establish themselves, despite massive investment.3 Internal politics and competing technical platforms have been cited as potential root causes but these challenges are insignificant compared to the lack of any desirable, differentiated value proposition for customers. Without one, existing customers of the parent bank had no reason to try them, and were most likely internally discouraged to avoid cannibalisation. Potential new customers in underserved segments had no reason to select them. On the other hand, the established neos had unique propositions developed in collaboration with their customers, building trust and engagement, and scaling growth organically. Without a deliberate strategy around differentiation, it is not only traditional banks who will continue to fail at digital, but so will the explosion of independent neos and fintechs. When unattainable feature parity with competitors drives product roadmaps and turns product teams into ‘feature factories’, customers fail to see any 10X factor needed to tip them into using something new.


Tech Disruption In Retail Banking: Australia's Big Banks Hold Their Ground As Tech Takes Center Stage

Implementing technology is a key hurdle for Australia's major banks as they rely on legacy IT systems for their core operations. On the positive side, the underlying technology (such as fiber networks, the New Payments Platform, and 5G) required for innovation is already available in Australia, similar to countries where it is also widely implemented such as Sweden and China. Smaller regional and mutual banks face similar challenges, although the path will likely be easier for mutual banks that use cheaper off-the-shelf IT products and have generally stayed more up to date with core banking system upgrades than their major bank peers. Australia's network infrastructure is comprehensive and sufficient to meet the data needs of imminent technological developments; over 99% of Australia's population has mobile broadband access, including in remote areas. We believe cloud migration and adopting a microservices software architecture style will be key to banks' future operating performance in all banking systems, including Australia. Cloud-based systems significantly improve system stability and lower infrastructure costs. Flexible system architecture increases the rate at which banks can update their systems to meet changing consumer needs, while also facilitating connectivity between banks and fintechs through easier application program interface (API) integration.



Predicting the Future with Forecasting and Agile Metrics

There are three important factors that have a much higher impact on lead time than the story size, and that when left unmanaged make our teams unpredictable. First, do we have a high amount of work in progress (WIP)? When we work on too many things at the same time we are not able to focus on finishing the tasks that are already in progress. We waste time in context switching, the quality of our work decreases, and even stories that appear to be simple end up taking longer than expected. Second, how long does work spend in queues between activities? Very often in our processes there is some waiting time between one activity and another (for example, waiting for a developer to be free to start a story, waiting for the next release, etc). These queues are often invisible, they’re not represented on our boards, and it’s really common to ignore them when we estimate, as we only tend to consider the active time that we’re going to be working on something. When these queues are not managed they lead to a lot of work in progress put on hold, which in turn leads to high unpredictability.


Researchers Disclose 2 Critical Vulnerabilities in SAP ASE

The former vulnerability refers to the database software failing to perform the necessary validation checks for an authenticated user while executing "dump" or "load" commands that can be exploited by a malicious actor to allow arbitrary code execution or code Injection, according to the National Vulnerability Database description. "On the next backup server restart, the corruption of configuration file will be detected by the server and it will replace the configuration with the default one. And the default configuration allows anyone to connect to the backup server using the sa login and an empty password," Rakhmanov says. "The problem is that the password to log into the helper database is in a configuration file that is readable by everyone on Windows." CVE-2020-6252 affects only the Windows version of SAP ASE 16 with Cockpit. The problem here is the password to log into the helper database is in a configuration file that is readable by everyone on Windows. This means any valid Windows user can take the file and then recover the password. Then, they are able to log into the SQL Anywhere database as the special user "utility_db" and begin to issue commands and possibly execute code with local system privileges, Rakhmanov writes.


Serverless in the Enterprise: Building Stateful Applications

Cloud native applications allow enterprises to design, build, deploy and manage monolithic applications in more agile, nimble ways. These applications accelerate business value while driving greater operational efficiencies and cost savings through containers, a pay-as-you-go model, and a distributed runtime. However, current serverless implementations (namely, Function-as-a-Service, or FaaS for short) are unable to fully manage business logic and state in a distributed cloud native solution, which creates inefficiencies in hyperscale applications. What is required is a “stateful” approach to serverless application design. ... Unfortunately, a lot of enterprise use cases need to be stateful — such as long-running workflows, human approved processes, and e-commerce shopping cart applications. Workflows, in general, require some sort of state associated with them. Pure serverless functions can’t provide that, since they exist for short durations. Obtaining the application state is most commonly solved by either frequenting database access or saving the state at the client. But both are bad ideas from a security perspective, as well as from the perspective of scaling the database instances.



Quote for the day:

"If you can't embrace, absorb, and integrate new tools quickly, the industry will evolve and pass you by." - Brian Dawson

Daily Tech Digest - June 03, 2020

Top network skills to succeed in a post-coronavirus world

"Cloud security is a huge topic moving forward," says James Stanger, chief technology evangelist at CompTIA, a trade association for the global IT industry. "To cut costs and increase resiliency and be more flexible, folks are moving to the cloud. We're also seeing companies that aren't used to the cloud be increasingly surprised at the lack of control" and loss of asset visibility the cloud can bring. Companies are looking for individuals who know how to create cost-effective but capable alternative business platforms, Stanger says, in case a company's primary systems become unavailable or impacted by a stay-at-home order or other event. The rise of the remote worker has also led to greater demand for people with the skills to resolve network access issues and optimize network connections. "If you have remote workers, you need to make sure they have good bandwidth," Stanger says. "If you are moving to the cloud, you need good QoS [quality of service] and bandwidth control." For that matter, any skills that support the work-from-home model will be in demand, says Jim Johnson, senior vice president for staffing firm Robert Half Technology.


Ultimate guide to artificial intelligence in the enterprise

One of the biggest risks to the effective use of AI in the enterprise is worker mistrust. Many employees fear and distrust AI or remain unconvinced of its value in the workplace. Anxieties about job elimination are not unfounded, according to many studies. A report from the Brookings Institute, "Automation and Artificial Intelligence: How Machines Are Affecting People and Places," estimated that some 36 million jobs "face high exposure to automation" in the next decade. The jobs most vulnerable to elimination are in office administration, production, transportation and food preparation, but the study found that by 2030, virtually every occupation will be affected to some degree by AI-enabled automation. Of more immediate concern is the prevailing skepticism about AI's value in the workplace: 42% of IT and business executives surveyed do not "fully understand the AI benefits and use in the workplace," according to Gartner's 2019 CIO Agenda survey. Fear of the unknown accounts for some of this skepticism, the report stated, adding that business and IT leaders must take on the challenge of quantifying the benefits of AI to employees. 


Canadian major telcos effectively lock Huawei out of 5G build

Canadian carriers Bell and Telus announced on Tuesday that each of them would not be continuing the use of Huawei equipment in their respective 5G networks, having signed deals with the Chinese giant's rivals instead. For Bell, it announced Ericsson would be supplying its radio access network. It added that it was looking to launch 5G services as the Canadian economy exited lockdown. Bell, which in Febraury announced it had signed an agreement with Nokia, said it was maintaining the use of multiple vendors in its upcoming network, as it had for 4G. "Ericsson plays an important role in enabling Bell's award-winning LTE network and we're pleased to grow our partnership into 5G mobile and fixed wireless technology," said Bell chief technology officer Stephen Howe. Meanwhile, the British Columbia-based Telus also chose to go with a combination of Ericsson and Nokia. The company said it had spent CA$200 billion on its network since the turn of the century, and would part with a further CA$40 billion over the next three years to deploy its 5G network. Both Bell and Telus had previously used Huawei equipment in their networks. 


Cloud Based Development - From Dream to Reality

Thanks to the internet, software as a service solutions quickly brought a significant shift to a software team's daily routine. What used to be done manually and offline can now be performed more efficiently online, with real-time collaboration and quick, in-the-moment feedback loops. Nowadays, it is common for the requirements, design, test and maintenance stages of the SDLC to be performed in the cloud. Whether a business migrates to the cloud or is born in the cloud, a so-called cloud-native business, the trend is crystal clear: The cloud is here to stay and the SDLC too adopts this innovation. Except for the Implementation stage... Have you ever looked at a pull request, said to yourself "This looks good" and left a LGTM comment, without actually testing the code? Right, you have - we all have. Gitpod comes with a built-in code review feature that lets you review changes and leave comments inline. For even better productivity, you can configure Gitpod to add a PR comment with a link to a workspace that contains this exact pull request's code changes. Your workflow as a reviewer now is: Open PR; click link; review & test code.


Capital One ordered to disclose third-party analysis of 2019 breach

Capital One's security flaw was rooted in a misconfigured web application firewall, similar to the flaw compromised in Equifax's 2017 breach. The WAF misconfiguration led to criticism around the company's reliance on Amazon Web Services' security. ​The bank hired Mandiant in 2015 to perform "engagement activities, results and recommendations for remediation"​ in the event of a cyber incident, according to the court document. The bank updated their agreement in January 2019 to 285 hours of service. Capital One extended its services "out of the retainer already provided to Mandiant under the Jan. 7, 2019, [statement of work]," according to the court document. But when the retainer was "exhausted," Capital One paid Mandiant using its cyber organization's funds. By December, the bank's legal department took on Mandiant's payments, redesignating the service's costs as legal fees. While Capital One said Mandiant's report was confidential, the bank said it disclosed it to about 50 Capital One employees, four regulators and the accounting firm Ernst & Young. The bank does not state why, for business or legal purposes.


Internet pioneer Leonard Kleinrock on the great experiment we’re living through

Some mix of work at home will undoubtedly remain. And some jobs that used to be necessary are now being seen to be not necessary. Businesses are saying, "Gee, I didn't need that functionality anyway. We can get it either by AI or by some other automated way". And entertainment, you know, do I really want to go to the movie theater? Well… versus Netflix or whatever? We're never going to get back to where we were.  In engineering, there's a term called hysteresis. We're in such a situation now, where we've stretched the system in one direction. If we relax now, it's not going to come back to where it was. It's going to have memory of what went on. It certainly applies to medicine, to social interactions, etc. So, I find that very exciting. It is exploring things we couldn't have, and we're finding advantages of those things. Economically, it's a very serious issue here, what's happened and how we come back. Supply chains are being broken. How they get restructured is not clear. There are opportunities out there now for new products and services based on the fact that we are less in physical contact, more remote.


How to balance trust and technology in banking

The implementation of AI and machine learning to analyse and use data has helped financial services companies both internally – the ability to monitor account activity, complete multiple tasks at greater speed, and more effectively, combat fraudulent activities, and so on – and externally; and data is proving to be the framework for the provision of greater user experience and the managing of trust and relationships. A common perspective in this forward-looking narrative is that banks – incumbents or ‘traditional’ in particular – face a significant challenge when it comes to developing and implementing such technologies compared to those more innovative fintech market entrants or the tech giants. However, in a report published last year exploring what the next decade holds for incumbents in the age of digital banking, HSBC suggested that this is a “common myth”, highlighting the growing landscape for collaboration between banks and fintechs and suggesting that “we are already in an era of innovative cross business collaboration which many would have not imagined a few years ago”.


How are FinTech innovation and AI disrupting traditional banking models in the ME?

The surge in demand for online banking services during the pandemic has spiked the need for fintech firms to incorporate fresh, innovative technology to meet the changing needs of customers. To meet this demand, the key sources of fintech innovation in the coming months and years is likely to be blockchain, open banking, cloud-based systems and, most importantly, AI. With increased government support in the form of stimulus packages due to COVID-19 and start-up funding, alongside customer demand, these technological innovations are set to disrupt traditional banking models - completely transforming the way we manage our finances both during and after the pandemic. At the heart of fintech innovation lie consumers. The increasingly tech-savvy, digitally minded population in the gulf region has pushed fintech firms to provide consumers with a personalised and seamless online banking experience. To achieve this, fintech firms have focused on implementing technological innovations that promise faster, cheaper, customer-centric banking services.


14 tips for CIOs managing shadow IT activities

Considering how complex IT has become, particularly in the age of the internet, the ability to know about and effectively manage IT resources -- both internal and external -- has become increasingly important. Here, we examine situations to be aware of regarding shadow IT and offer guidance to ensure that CIOs can identify and mitigate rogue activities. The primary goal for most CIOs is a smooth-running IT organization that is compliant, secure and risk-free. On the issue of security, they pay attention to any situation that threatens the confidentiality, integrity and availability of information. Non-approved installation of systems, whether on site or via cloud technology, presents possible unauthorized access to internal systems. From a risk management perspective, shadow IT presents unique challenges to CIOs and their cybersecurity and operations teams and should be a key element in those activities. The growth of cloud-based systems using software as a service (SaaS), infrastructure as a service (IaaS) and platform as a service (PaaS) represents significant opportunities for shadow IT activities. 


AI adoption – Don’t leave data governance behind

Data is the driver for AI and digital transformation. Yet time and time again, we see instances where it is not leveraged in a way that reflects its value. Of course, it is never as easy as we want – data governance and conditioning take time and resources. However, it must be viewed in terms of the benefits it will bring: observability, reproducibility, efficiency and transparency. With AI now very much a part of business function and only set to increase in reach and take-up, the enterprise must react accordingly. In understanding the main challenges and obstacles to AI adoption, companies can proactively look to tackle them. Moreover, for companies yet to begin their AI journey, prior knowledge of challenges will allow them to prepare and plan. Addressing company culture and practices early on makes a big difference down the line. Many have had to learn the hard way, so businesses should take heed when they can. It is essential that data governance procedures are given the careful consideration they require and that – as much as possible – companies avoid viewing them as an addendum tacked on to digital transformation plans.



Quote for the day:

"Do not follow where the path may lead. Go instead where there is no path and leave a trail." -- Muriel Strode

Daily Tech Digest - June 02, 2020

Big GDPR Fines in UK and Ireland: What's the Holdup?

"Although the impact of COVID-19 may explain some of the current, continued delay, quite why what may end up being over a year to resolve these matters since the ICO announced its intentions to fine may leave some wondering whether GDPR enforcement is going as quickly as it should," he says. "In addition, what was also expected to be a showcase for the first significant fines under GDPR in the U.K. may now be a letdown." But Brian Honan, who heads Dublin-based cybersecurity consultancy BH Consulting, says that seeing an extended legal process isn't surprising, especially because GDPR enforcement norms have yet to be set. "The regulator, be that the ICO or any other regulator, has to ensure their case is a legally watertight as it can be before issuing a fine or a penalty. This is very important as organizations, particularly large ones with deep legal resources, will no doubt challenge any penalties imposed on them," he says. "The BA and Marriott cases are a prime example of this," says Honan, who's also a cybersecurity adviser to Europol, the EU's law enforcement intelligence agency. "We also have to take into account many of the regulators have limited resources, and their staff have to ensure they support the rights of all data subjects as best they can."


How to set up a chaos engineering game day

It isn't easy to run a chaos engineering game day. Nonetheless, it should be both fun and instructive. Manifold has hosted several styles of chaos engineering game days. Examples include 30-minute tabletop events as well as multi-hour active failure events that involve the full engineering team. A recent offsite Manifold event involved dice rolls, character classes and prizes for surviving the chaos incident. To maintain a chaos engineering program, employees must enjoy the challenge. "Uncontrolled chaos will happen to your system -- save your seriousness for that," said James Bowes, CTO of Manifold. Role-playing game days are a great way to keep it interesting. With each chaos engineering game day, the organization should build up its resistance to digital failure. "As you proceed, and if you are successful, it should become more difficult to find parts of the system to break," Bowes said. Let the participants know that the goal is to find problems; if they break something, consider that a success. But keep other teams and stakeholders informed.


It’s Time to Rethink Leadership Around Leading for Resilience

If you lead with the assumption that something somewhere and at some time will jump out and attack, you naturally prepare to defend yourself. This preparation doesn’t distract you from moving forward, but it does prove critical when you need to protect yourself. If your entire supply chain is dependent upon the ongoing support of unfriendly or at least unaligned actors and subject to pendulum swings in the political environment, you diversify the supply chain risk. By the same token, minimizing business model risk by diversifying channels is essential. Moving forward, expect every restaurant and food-service operator that is interested in surviving and thriving to develop robust online and takeout systems and internal processes. I’ve lost interest or empathy for the old-line retailers of my childhood now teetering on the brink of the abyss. They’ve had more than two decades to reset for resilience and diversify their business models, develop new channels, embrace technology, and make themselves relevant to consumers. A few have pulled this off and merit kudos. The rest will likely soon join the growing heap of old brands that will be lost to memory in a few short years.


Work in a COVID-19 world: Back to the office won’t mean back to normal

We’re now able to say, “Okay, what might be the new normal beyond this?” We recognize that there will be re-integration back into our worksites done in the current COVID-19 environment. But beyond COVID, post-vaccines, as we think about our business continuity going forward, I do think that we will be moving into, very purposefully, a more hybrid work arrangement. That means new, innovative, in-office opportunities because we still want people to be working face-to-face and have those in-person sort of collisions, as we call them. Those you can’t do at all or they are harder to do on videoconferencing. But there can be a new balance between in-office and remote work -- and fine-tuning our own practices – that will enable us to be as effective as possible in both environments. So, no doubt, we have already started to undertake that as a post-COVID approach. We are asking what it will look like for us, and then how do we then make sure from a philosophical and a strategy perspective that the right practices are put into place to enable it.


Cloud infrastructure operators should quickly patch VMware Cloud Director flaw

The reason the flaw has not been rated critical is likely because attackers technically need authenticated access to VMware Cloud Director to exploit it. However, according to Citadelo's Zatko, that's not hard to achieve in practice since most cloud providers offer trial accounts to potential customers that involve access to the Cloud Director interface. In most cases there is no real identity verification either for such accounts, so attackers can gain easy access without providing their real identities. This highlights a larger issue with assessing risk based only on vulnerability scores: Severity scores don't always reflect or take into account the real-world conditions in which vulnerable systems might typically exist. Certain configuration or deployment choices can make a vulnerability much easier or harder to exploit than the advisory or the CVSS score suggests. Zatko is concerned that VMware Cloud Director users did not take the issue too seriously based on the advisory alone. More than two weeks after the patches had already been out, his company tested another Fortune 500 organization that used the product and it was still vulnerable.


OpenAI Announces GPT-3 AI Language Model with 175 Billion Parameters

OpenAI made headlines last year with GPT-2 and their decision not to release the 1.5 billion parameter version of the trained model due to "concerns about malicious applications of the technology." GPT-2 is one of many large-scale NLP models based on the Transformer architecture. These models are pre-trained on large text corpora, such as the contents Wikipedia, using self-supervised learning. In this scenario, instead of using a dataset containing inputs paired with expected outputs, the model is given a sequence of text with words "masked" and it must learn to predict the masked words based on the surrounding context. After this pre-training, the models are then fine-tuned with a labelled benchmark dataset for a particular NLP task, such as question-answering. However, researchers have found that the pre-trained models perform fairly well even without fine-tuning, especially for large models pre-trained on large datasets. Earlier this year, OpenAI published a paper postulating several "laws of scaling" for Transformer models.


10 open source cloud security tools to know

PacBot, also known as Policy as Code Bot, is a compliance monitoring platform. You implement your compliance policies as code, and PacBot checks your resources and assets against those policies.You can use PacBot to automatically create compliance reports and resolve compliance violations with predefined fixes. Use the Asset Group feature to organize your resources within the PacBot UI dashboard, based on certain criteria. For example, you can group all your Amazon EC2 instances by state -- such as pending, running or shutting down -- and view them together. You can also limit the scope of a monitoring action to one asset group, for more targeted compliance. PacBot was created by T-Mobile, which continues to maintain it.It can be used with AWS and Azure. ... Pacu is a penetration testing toolkit for AWS environments. It provides a red team a series of attack modules that aim to compromise EC2 instances, test S3 bucket configurations, disrupt monitoring capabilities and more. The toolkit currently has 36 plugin modules and includes built-in attack auditing for documentation and test timeline purposes. Pacu is written in Python and maintained by Rhino Security Labs, a penetration testing provider.



NIS security regulations proving effective, but more work to do

The government said it now plans to make some technical changes to the regulatory regime to ensure it remains proportionate and targeted and will be considering a number of amendments to be taken up. These changes are likely to centre on cost recovery, to better enable competent authorities to conduct regulatory activity; the implantation of an improved appeals mechanism; more clarity around the wider enforcement regime; the introduction of support to manage risks to organisational supply chains; the introduction of best-practice sharing; and a number of measures to account for any changes that may be needed, or may become possible, after the end of the Brexit transition period. Kuan Hon, a director in the technical team at law firm Fieldfisher, said that based on the statistics presented in the report, there had clearly been very limited enforcement of the NIS regulations so far, with no fines having been levied, and fewer incidents reported to regulators than DCMS anticipated. However, she added, compliance and incident reporting costs had been much higher than first expected.


Cisco takes aim at supporting SASE

Reed stated that secure access and optimal performance are a must. “The rapid adoption of SD-WAN for connecting to multi-cloud applications provides enterprises with the opportunity to rethink how access and security are managed from campus to cloud to edge,” he stated. “With 60% of organizations expecting the majority of applications to be in the cloud by 2021 and over 50% of the workforce to be operating remotely, new networking and security models such SASE offer a new way to manage the new normal.” According to Reed, the goal of SASE is to provide secure access to applications and data from on-premises data centers or cloud platforms, with access determined by identities that are defined by combinations of characteristics including individuals, groups, locations, devices, and services. Service edge refers to global points of presence (PoP), IaaS, or colocation facilities where local traffic from branches and endpoints is secured and forwarded to the appropriate destination without first traveling through corporate data centers. By delivering security and networking services together from the cloud, organizations will be able to securely connect any user or device to any application and optimize user experience, Reed stated.


Causes of Memory Leaks in JavaScript and How to Avoid Them

The fastest way for a memory usage check is to take a look at the browser Task Managers (not to be confused with the operating system's Task Manager). They provide us with an overview of all tabs and processes currently running in the browser. Chrome's Task Manager can be accessed by pressing Shift+Esc on Linux and Windows, while the one built into Firefox by typing about:performance in the address bar. Among other things, they allow us to see the JavaScript memory footprint of each tab. If our site is just sitting there and doing nothing, but yet, the JavaScript memory usage is gradually increasing, there’s a good chance we have a memory leak going on. Developer Tools are providing more advanced memory management methods. By recording in Chrome's Performance tool, we can visually analyze the performance of a page as it's running. Some patterns are typical for memory leaks, like the pattern of increasing heap memory use shown below. Other than that, both Chrome and Firefox Developer Tools have excellent possibilities to further explore memory usage with the help of the Memory tool. 



Quote for the day:

"Leadership is a process of mutual stimulation which by the interplay of individual differences controls human energy in the pursuit of a common goal." -- P. Pigo

Daily Tech Digest - June 01, 2020

The Cybersecurity Implications of 5G Technology

Since one of the chief benefits envisioned for 5G is the ability to connect more and more devices to the IoT, this “also increases the threat vectors for hackers,” according to HackerNoon.com. Another potential “worst-case scenario” outlined by HackerNoon: “Faster networks can also mean faster ways for viruses and malware to spread. If more users are on the network, then you also have the potential for more infected devices and systems than ever before.” Commenting on the concern that a greatly expanded IoT multiplies the potential points of entry for cyberattacks in an article titled “5G Dangers: What are the Cybersecurity Implications?” Heimdal Security notes that, “5G technology could also lead to botnet attacks, which will spread at a much higher speed than the current networks allow it.” Of particular relevance to the cybersecurity community, the dawn of the 5G era demands that new and improved defenses and cybersecurity protocols be developed and put in place to counter the potential risks. This means the current and future work of many cybersecurity professionals will be inextricably connected to understanding and defending against the new security risks, both known and unknown, posed by this rapidly emerging technological breakthrough.


Quantum AI is still years from enterprise prime time

For quantum AI to mature into a robust enterprise technology, there will need to be a dominant framework for developing, training, and deploying these applications. Google’s TensorFlow Quantum is an odds-on favorite in that regard. Announced this past March, TensorFlow Quantum is a new software-only stack that extends the widely adopted TensorFlow open source AI library and modeling framework. TensorFlow Quantum brings support for a wide range of quantum computing platforms into one of the dominant modeling frameworks used by today’s AI professionals. Developed by Google’s X R&D unit, it enables data scientists to use Python code to develop quantum ML and DL models through standard Keras functions. It also provides a library of quantum circuit simulators and quantum computing primitives that are compatible with existing TensorFlow APIs. Developers can use TensorFlow Quantum for supervised learning on such AI use cases as quantum classification, quantum control, and quantum approximate optimization. They can execute advanced quantum learning tasks such as meta-learning, Hamiltonian learning, and sampling thermal states.


How managed threat hunting helps bust malicious insiders

Alicia first observed an employee apparently hacking their own laptop in order to obtain local admin credentials. This was done using a technique known as sticky keys, actually an accessibility feature built into Windows that can be launched with a specific key combination from the login screen. “Although the technique is referred to as sticky keys, it is actually referring to exploiting the way certain versions of Windows will execute applications designed for accessibility features,” said Lee. “In vulnerable versions of Windows, when these accessibility features are launched via a set of key combinations (shift five times for sticky keys, press ‘Windows+U’ for Windows Utility Manager, etc.), Windows will simply launch the associated application from a hardcoded path in a privileged state. “The adversary exploiting this feature can simply replace the application binary with one of their choosing. As long as the filepath and filename are the specified ones for the shortcut key combination, Windows will execute it. This technique is fairly well-known as a way to recover Windows passwords and has been used by adversaries in the past.”


What is edge computing? Here's why the edge matters and where it's headed

In a modern communications network designed for use at the edge — for example, a 5G wireless network — there are two possible strategies at work: Data streams, audio, and video may be received faster and with fewer pauses (preferably none at all) when servers are separated from their users by a minimum of intermediate routing points, or "hops." Content delivery networks (CDN) from providers such as Akamai, Cloudflare, and NTT Communications and are built around this strategy; and Applications may be expedited when their processors are stationed closer to where the data is collected. This is especially true for applications for logistics and large-scale manufacturing, as well as for the Internet of Things (IoT) where sensors or data collecting devices are numerous and highly distributed. Depending on the application, when either or both edge strategies are employed, these servers may actually end up on one end of the network or the other. Because the Internet isn't built like the old telephone network, "closer" in terms of routing expediency is not necessarily closer in geographical distance. 


Public speaking for technical pros: How to deliver a great in-person or virtual presentation

There's standing up at stand up, there's doing an all hands demo, then there's doing a small meetup, there is doing a small conference, multi-speaker small talk at a multi-track conference. There's doing a talk and a single track conference. There's this whole escalation and a lot of the levels above meetup are not a different skillset, but a skillset that you would need to focus on and work on. You have to learn to do a CFP, you have to learn to put together a slide deck. You have to learn to, there's a whole bunch of stuff around that. And so that's sort of a separate question, but I think to start out, the things that you need to understand are that everybody in the audience is on your side. A lot of people give this really old speaking advice about imagine your audience naked and then you don't respect them anymore. And I think that's terrible on several levels. Please don't imagine anybody naked. What I want you to do is imagine that they are sitting in this meeting because they want to hear from you. They want you to succeed and if you have a problem, they are empathizing with the problem.


10 Coding Principles Every Programmer Should Learn

There are two general ways to reuse the code you have already written, Inheritance and Composition; both have their own advantage and disadvantages, but, in general, you should always favor composition over inheritance, if possible. Composition allows changing the behavior of a class at run-time by setting property during run-time, and by using Interfaces to compose a class, we use polymorphism, which provides flexibility to replace with better implementation at any time. Even Joshua Bloch’s Effective Java advise favoring composition over inheritance. If you are still not convinced, then you can also read here to learn more about why your Composition is better than Inheritance for reusing code and functionality. And, if you keep forgetting this rule, here is an excellent cartoon to put in your desk :-) If you are interested in learning more about Object-Oriented Programming Concepts like Composition, Inheritance, Association, Aggregation, etc., you can also take a look at the Object-Oriented Programming in Java course on Coursera.



Extensible Effects in JavaScript for Fun and Profit

Extensible Effects, broadly speaking, is the idea that you can separate the 'what' and 'how' in your code. By representing effects as 'tokens' that hold no intrinsic implementation details, you can write programs that are completely unaware of how they'll eventually interact with their environment. Later on these effects can be 'interpreted' by converting each token into specific actions of your choice. These effects could be general, such as 'send network request', or domain specific, like 'log user out' - it's up to you. For those unfamiliar with monads, you can think of this technique as dependency injection for your software's API calls. You program to an interface, and can provide a different implementation depending on the situation. Extensible effects are implemented via a Freer monad. This is a nested data structure of an initial effect or value, and a sequence of functions that convert the results of a previous effect into the next. When applied to an interpreter function that converts effects into the target monad of your choice, it unwraps from the 'inside out' - the first effect is converted into the target monad, which is mapped into the next effect-containing Freer monad.


Microservices: A cheat sheet

Comparisons are frequently made between microservices and service-oriented architecture (SOA). While the two may seem similar at first glance, they're nearly completely different except in the most basic ways. Both SOA and microservices involve the creation of small components that communicate data to other services, but the scope, purpose, and how the communication occurs are completely different. For starters, SOA is an enterprise-wide architecture, whereas microservice architecture is a way to build a single application. The idea behind SOA is to create a common framework for communication that allows applications, data sources, and other network-connected elements to communicate in a platform-agnostic manner.  SOA wants communication between elements to happen fast, smooth, and without barriers; this is a radical difference from microservices, which want independent elements that aren't dependent on each other at all. SOA integrations are reused constantly—that's the goal of SOA, according to IBM. In the case of microservices, reuse is completely undesirable--if a component is being called in more than one place by its main application, agility and resilience will suffer.


The Four Data Management Mistakes Derailing Your BI Program

There are a number of ways this can happen to a company. When folks come to us looking for a reporting solution to meet their customers’ needs (such as a BI solution designed to be embedded into SaaS applications), they’re not setting up the database in the same step. They’ve already been collecting data for a long time — long before reporting was even a consideration, in most cases. Sometimes we discover that the person who initially set up the database doesn’t even work at the organization anymore and didn’t leave much in the way of documentation or tribal knowledge to help onboard a successor. Other times, responsibility for (and knowledge of) the data is distributed throughout the company. One group might have a deep understanding of the data’s semantics while another, such as IT, might have some insight into its maintenance and traffic capacity. A third group responsible for data analysis might be most familiar with its utility to stakeholders. Unfortunately, none of these groups have a grasp of the database’s structure or complete knowledge of the data itself.


DataOps: The Path to AI-Readiness

Every business has a unique vision or goal for AI, whether it’s improving predictions, automating mundane tasks, freeing up employees to do more fulfilling work, or optimizing processes. But in many cases, there’s no better purpose for AI than in understanding your environment, what your systems are saying through their data, and discovering issues before they snowball into full blown outages. Organizations use about $26.5 billion in revenue because of IT system outages. IBM’s Watson AIOps understands the systems, normal system behaviors, and acceptable ranges, and provides alerts when a problem arises. In effect, it’s a nervous system that allows CIOs to effectively manage all of their systems. Given that data scientists lament limited data access and the lack of a line of sight between data and all team members, a solution such as this becomes a facilitator for faster, proactive responsiveness. ... AI-enabled automation is integral to DataOps for more than just manual steps; for governance processes, data curation, metadata assignment, and ensuring data is available for self-service. This helps to operationalize consistent high quality data throughout the entire enterprise.



Quote for the day:

"The secret of a leader lies in the tests he has faced over the whole course of his life and the habit of action he develops in meeting those tests." -- Gail Sheehy

Daily Tech Digest - May 31, 2020

The Future Of Fintech: The New Normal After The Covid-19 Crisis

For banks, the new normal marks the end of fintech experimentation. Over the past few years, banks have been obsessed with fintech partnerships. It’s been a way of convincing themselves (and their boards) that they’re innovating and not getting left behind as the industry undergoes a digital transformation. Too many of these efforts, however, have had little impact on the strategic direction, organizational culture, and bottom line results of the institution. According to Louise Beaumont: “For banks, partnerships won’t generate the quantum leap they need to move beyond a product-centric mentality to deliver next-generation services. At best, they may gain a workable solution that squats awkwardly in the existing infrastructure. At worst, they’ll fail to deliver any noticeable difference.” Many so-called partnerships—many of which aren’t partnerships, but just vendor arrangements—are examples of what Jason Henrichs of Fintech Forge likes to call the “fintech petting zoo.” The luxury of experimenting with fintech is gone. Banks will need to accelerate their investments in fintech to achieve both the top line increases and expense reductions needed to maintain margins and profitability.


ACLU sues Clearview AI claiming the company's tech crosses ethical bounds

The ACLU alleges that by using face recognition technology, Clearview has captured more than 3 billion faceprints from images available online, all without the knowledge or consent of those pictured. "Clearview claims that, through this enormous database, it can instantaneously identify the subject of a photograph with unprecedented accuracy, enabling covert and remote surveillance of Americans on a massive scale," it said. "This technology is so dangerous, in fact, that this little-known startup 'might end privacy as we know it'." The ACLU said that Clearview has "created the nightmare scenario that we've long feared, and has crossed the ethical bounds that many companies have refused to even attempt" and accused the company of building a mass database of billions of faceprints without knowledge or consent. "Neither the United States government nor any American company is known to have ever compiled such a massive trove of biometrics," it wrote. "Adding fuel to the fire, Clearview sells access to a smartphone app that allows its customers -- and even those using the app on a trial basis -- to upload a photo of an unknown person and instantaneously receive a set of matching photos."


GoodData and Visa: A common data-driven future? 

One of the initiatives GoodData is taking to help organizations go from dashboards to data-driven application is the Accelerator Toolkit. The Accelerator Toolkit is a UI library to enable customized and faster data analytics, along with educational resources. Stanek mentioned that GoodData plans to launch a GoodData University initiative soon, to offer more resources to empower organizations. Another noteworthy development for GoodData is the evolution of its Semantic Layer data model. A new modeling tool by GoodData aims to improve collaboration between engineers and analysts to streamline the start process for enterprise data products. Stanek initially referred to this as an attempt to establish a single version of the truth. This, however, has always been an elusive goal. While improving collaboration between engineers and analysts is commendable, more pragmatically, organizations can aim to establish shared data models among user groups, rather than global ones. Stanek did not sound short of ambition, and our conversation touched upon a number of topics. If you want to listen to it in its entirety, make sure to subscribe to the Orchestrate all the Things podcast, where it will be released soon.


Building the foundation for a strong fintech ecosystem in Saudi Arabia

Prior to Co-VID 19 and its sudden need for global digitalisation, there was already potential for Saudi Arabia to have a strong fintech network. It is the largest economy in the region, where its stock market is worth around $549 billion USD, contributing to over half of the region’s total gross domestic product (GDP) in 2018, and is a member of the Group of Twenty (G20); this year it is actually Saudi Arabia that holds the G20 presidency. Also, Saudi has a very young population, where 70 percent of the population in 2017 was under 30 years old. It is also a very tech savvy nation, where it ranks, according to a report by EY, as having the third highest smartphone mobile usage globally and the seventh globally in terms of household internet access. This, coupled with the ongoing economic initiatives and investments as part of Saudi Vision 2030, has put Saudi’s fintech prospects and future growth at the forefront. ... Saudi Arabia has an opportunity to further solidify its position to one day be a leader in fintech. It has already, as part of Vision 2030, set the foundation to create an environment that not only is attracting foreign investment but also providing the tools and guidance to create its own talent and innovation as well.


Why Blockchain Needs Kubernetes

Kubernetes and Docker can, and have, abstracted away much of the knowledge required to get started. IBM and Corda have containerized their blockchain protocols and various Ethereum images exist - for added granularity, network component images exist as well, including the Solidity compiler, network stats dashboard, testnets, miner nodes, block explorers, etc. In time, I expect to see more and more component network parts containerized and made available. Deploying blockchains will be a matter of picking a protocol image and the additional components images, building YAML manifests, and deploying with helm install. While modularity is necessary for designing complex networks and is available for those that need it, the choice overload can and will deter adoption for those that do not have the expertise, time, patience, or resources to explore blockchain technology. By packaging up elements of blockchain networks into image files that can be deployed and managed, the requisite knowledge required to get started will be democratized to those that are familiar with Docker and Kubernetes.


COVID-19 is teaching investors a thing or two about how important an opportunity “edtech” is

In spite of the billions invested across the world in the latest and greatest innovations, technology hasn’t been able to stop or impact the spread of COVID-19 on any notable scale, something embarrassing to us all. As a result, investors broadly have decided to support the industries and tech where significantly less funding had been placed historically. As an example, we at Perlego have received five times more approaches from new venture capitalists (VCs) and angels since the lockdown. I believe this is for one of two reasons: they either want to help a future society or they’ve seen failures in the likes of medicine, education and ecotech at this time and see these as the new fintechs in the years to come. Regardless of the reason, what is essential is to place more focus on the sectors that were previously seen as poor relations to their shiny counterparts. Investment, growth and the opportunity to succeed must be further developed; such is the necessity for innovation on a global scale. It’s sad that it has taken a global crisis to trigger this thinking.


Optimizing MDM With Agile Data Governance

The embarrassing truth is that most organizations cannot answer these seemingly simple questions, at least without serious effort. In addition, many organizations have been reporting erroneous customer figures as different silos and lines of business fail to work cohesively to manage their master data assets. The annual cost and impact of data quality issues that are rooted in ungoverned data with little or no formal accountabilities around critical enterprise data have propelled the need for many organizations to fix their MDM problem. It’s evident that the need for ‘trusted data’ continues to appear in nearly all data initiatives. However, most organizations are still struggling with their MDM rollout simply because it’s addressed from a one lens angle. It’s one thing to fix the problem by mastering the formerly bad data; it’s another thing to make the solution sustainable by treating the root problem of disparate common data. The value of a ‘Stewardship culture‘ around data assets cannot be overemphasized. For MDM to be sustainable and rightfully implemented, it must be positioned in a governed environment where stewardship around the mastered data, and the associated culture of data governance are implemented.


Unify: Architecting the Missing Link in Data Management

No matter what label or acronym the industry attributes, it comes down to a simple truth that you need a dose of reality before tackling data management. “All recognize the fact that it is impossible for organizations to physically centralize all their data. Instead, data virtualization lets organizations provide one “virtual” place to go for data consumers to access data and IT to provide it,” says Eve.  Next, companies need to have a strategy to tool up for “next-generation data management.” “Gartner’s advice to consolidate with their data management tooling in vendor suites such as TIBCO Unify that combine metadata management, master data management, reference data management, data catalog, data governance, and data virtualization within one integrated solution,” says Eve. Data management should not be an IT problem alone. Businesses can chip in by increasing their citizen data engineering pool and offering business domain advice. “Work together to assess your needs and skills. Then be smart about maximizing the value each side can contribute, for example, IT using TIBCO Data Virtualization to provision hundreds of reusable data services that the business can quickly mix and match to address their changing needs,” says Eve.


ZLoader Banking Malware Resurfaces

Zloader has an element that downloads and runs the banking malware component from its command-and-control server, researchers at Proofpoint say. ZLoader spread in the wild from June 2016 to February 2018, with a group called TA511 - aka MAN1 or Moskalvzapoe - being one of the top threat actors spreading the malware, the report adds. The ZLoader malware uses webinjects to steal credentials, passwords and cookies stores in web browsers, and other sensitive information from customers of banks and financial institutions, according to Proofpoint. The malware then lets hackers connect to the infected system through a virtual network computing client, so they can make fraudulent transactions from the users device. The researchers note that the latest variant seemed to be missing some of the advanced features of the original ZLoader malware, such as code obfuscation and string encryption, among other features. "Hence, the new malware does not appear to be a continuation of the 2018 strain, but likely a fork of an earlier version," the researchers state.


Opening the doors to greater data value with data catalogue

If data isn’t consistent, comprehensive, and accurate, digital transformation efforts may fall short of objectives in a wide range of areas, such as: Laying the foundations for advanced analytics. Data scientists often spend 80% of their time searching for data, and just 20% on actual AI/ML and modeling. A data catalogue reverses the equation by providing quick data discoverability and access to relevant information. That lets data scientists and business analysts use trusted data to deliver the insights needed for data-driven decision-making. Developing a 360 degree customer experience. Because customer data exists in so many corners of the enterprise, it’s essential for organisations to have a holistic 360-degree view across all sources if they are to truly understand customers as individuals. By identifying all key sources of customer data, a data catalogue provides the foundation for more personalised engagement and improved customer experience. Supporting and accelerating smooth cloud data migration. 



Quote for the day:

"Develop success from failures. discouragement and failure are two of the surest stepping stones to success." -- Dale Carnegie

Daily Tech Digest - May 30, 2020

Tips on Digital Adoption and Transformation from Tesla

Pushback by people resistant to change regardless of the potential value of the ideas or technology can stall adoption, Davies said. The friction can come from a refusal to part ways with familiar, comfortable methods. Such reluctance may be reinforced by a lack of awareness of features and functionality, she said, found in the innovations being introduced. To get teams on board with change, Davies said it is essential to show them the new technology is better than what they already use. “This was Tesla’s strategy when introducing a huge transformation with electric cars,” she said. The same strategy used to get consumers to consider migrating from internal combustion engines to electric vehicles can be applied, Davies said. Common presumptions about electric cars painted them as slow, ugly, and limited on range. When Tesla unveiled the first Roadster, the company promoted its visual aesthetics and performance, she said, capable of accelerating from 0-60mph in 3.7 seconds and with an operational range of 245miles on a full charge, “This car was a critical step in the digital transformation to electric cars,” Davies said.


Please, Keep Artificial Intelligence From Becoming Another Out-Of-Touch Bureaucracy

AI inherently operates just like bureaucracies, he adds. “The essence of bureaucracy is to favor rules and procedures over human judgment. And if human judgment is not kept in the loop, AI will bring a terrifying form of new bureaucracy — I call it ‘algocracy,’ where AI will take more and more critical decisions by the rules outside of any human control.” The results of bureaucratic algocracy could be devastating — affecting university admissions, aircraft performance, or supply chain issues when a crisis hits. That’s why there needs to be humans providing input into AI decisions. It should be added that it takes humans to design forward-thinking processes and companies — tools such as AI are only that — tools that will help make things happen. As with many technology innovations, it often gets assumed that by dropping AI into a moribund, calcified organisation, insights and profitability will magically clear things up. AI should serve as “augmented” intelligence to support human decision-making — not the other way around.


Walmart Employees Are Out to Show Its Anti-Theft AI Doesn't Work

In an effort to refute the claims made in the Business Insider piece, the Concerned Home Office Associates created a video, which purports to show Everseen’s technology failing to flag items not being scanned in three different Walmart stores. Set to cheery elevator music, it begins with a person using self-checkout to buy two jumbo packages of Reese’s White Peanut Butter Cups. Because they’re stacked on top of each other, only one is scanned, but both are successfully placed in the bagging area without issue. The same person then grabs two gallons of milk by their handles, and moves them across the scanner with one hand. Only one is rung up, but both are put in the bagging area. They then put their own cell phone on top of the machine, and an alert pops up saying they need to wait for assistance—a false positive. “Everseen finally alerts! But does so mistakenly. Oops again,” a caption reads. The filmmaker repeats the same process at two more stores, where they fail to scan a heart-shaped Valentine’s Day chocolate box with a puppy on the front and a Philips Sonicare electric toothbrush. At the end, a caption explains that Everseen failed to stop more than $100 of would-be theft.


How AI is transforming recruitment and hiring

Traditionally the recruiter is the person who sources the resume from various sources. This is a time-consuming process, and is also prone to human errors. There are many tools available today that can match your job description to resumes on recruitment portals and help you build a database of the most relevant candidates. These AI-powered tools use pattern matching algorithms to make sure the resume is a close match to that of the job description. They typically use AI and pattern matching algorithms to match resumes to job descriptions.  For example, if the recruiter is looking for a marketing professional with 3-5 years of experience with a salary of Rs 12, 00,000 per annum who stays within 10 km of their office, the standard search may throw up 30 candidates. However, using AI, the software is capable of suggesting that if the experience desired is increased to 6 years and the salary to Rs 15, 00,000, there would be 50 candidates ideal for the profile. This data is useful to recruiters who need to understand where to get the maximum best-suited candidates from. This results in the elimination of manual efforts and a significant reduction in the number of unsuitable candidates, thus improving the process.


Singapore researchers tapping quantum cryptography to enhance network encryption

ST Engineering's president of cybersecurity systems group, Goh Eng Choon, said: "The threat landscape is evolving very rapidly and we must be prepared for challenges to come in the post-quantum computing era. While QKD technology can be used to secure digital communications, it can also be used to mitigate future quantum computers being used to exploit and maliciously target weak links and disrupt the global encryption ecosystem. "This research into quantum cryptography and the co-development of the industry's first solution will allow us to explore the potential of this technology, further strengthen our arsenal of advanced cybersecurity solutions, and gain a foothold in the QKD market," Goh said. NUS currently is working with nanoelectronics institute companies to jointly develop new chip-based quantum crypto devices, which can be applied to the new MDI-QKD technology and broader quantum cryptography technology due to their smaller device footprint and lower cost. NUS' assistant professor Charles Lim Ci Wen, who leads the joint project with ST Engineering, said: "As quantum computing becomes more prevalent worldwide, information security threats will also become more advanced.


Leaders discuss challenges, strategies for women in IT

"Things are only going to change over time, the more we continue to support and promote diversity, diverse teams and allowing different perspectives to prevail and not always sticking with the same old thing that works," Mayshar said. Constellation Research's Miller agreed, explaining that the push for women in the tech industry is not just to get them in there, but also to keep them in there and create visibility for the next generations. "I think that more girls are going to see women in leadership positions in technology companies -- they're going to see more women founders, they're going to see more women CEOs," Miller said. As for the new reality that is remote work in most businesses due to the COVID-19 pandemic, Ray-Pope said it could actually benefit women in IT. "There are ways I am also maximizing my time because of being home," she said. "I do think that we in corporate are in a unique position. I do think, in some ways, I have seen the playing field leveled … [working from home] is opening doors for women who choose to take advantage of it. There is no backroom networking." Juggling between home and work lifestyles isn't a new challenge for women, Miller said.


Why authentic informal leaders are key to an organization’s emotional health

AILs have excellent emotional sensing and energizing capabilities. They naturally detect feelings at play in any organizational challenge, capture and create positive emotions, and know how to influence and encourage people to engage in important behaviors. Management can mobilize them as a powerful resource to learn and identify how to respond in moments of crises. When appropriate, they can also counterbalance negative feelings. ... AILs can be engaged and activated in a variety of ways — many of them virtual. For example, emotionally intelligent AILs may be asked to launch an effort to understand and find ways to manage the organization’s fear and bolster individual confidence with respect to COVID-19. They can launch virtual small communities that meet regularly to discuss how they are motivating their teams. They can organize a Facebook group or another group to discuss topics informally. Rather than mandate that AILS act in a specific way, formal leaders should ask AILS how best to engage and activate them. 


Secure Together: is your organisation prepared for the end of lockdown?

Many have found the sudden shift to remote working so smooth that they are happy to make it a permanent move. A Gartner study revealed that 41% of employees want to continue working remotely some or all of the time after lockdown – up from 30% before the pandemic. However, while there are clearly benefits to remote working, things won’t be the same when offices reopen and there will be new challenges to address. For a start, working from home in a post-lockdown scenario might feel even more isolating, as you and your colleagues are no longer bound by being ‘in it together’. Those who return to the office are likely to resume normal work practices and may not be able to make the time to socialise with remote workers. Likewise, technical difficulties will probably take longer to resolve, as the IT team will once again be prioritising the systems and employees on the premises. These are issues that organisations and their employees should consider carefully as we ease our way out of lockdown.


Debunking The Myth That Greater Compliance Makes IT More Secure

Excelling at compliance doesn't protect any business from being hacked, yet pursuing a continuous risk management strategy helps. With a few exceptions (such as spearphishing), cyberattacks are, by nature, brutally opportunistic and random. They are driven to disrupt operations at best and steal funds, records, and privileged access credentials at worst. Conversely, the most important compliance event of all, audits, are planned for, often months in advance. Governance, Risk, and Compliance (GRC) teams go to Herculean efforts to meet and exceed audit prep timelines working evenings and weekends. ... The truth is organizations are attempting to rationalize the high costs of compliance by looking for how GRC spend can also improve cybersecurity. This is a dangerous assumption, as Marriott's third breach indicates. Marriott is an excellently managed business and sets standards in compliance. Unfortunately, that hasn't thwarted three breaches they've experienced. Why are organizations assuming GRC spending will improve cybersecurity? It's because both areas share a common series of pains that require different solutions


The Android hardware truth Google won't tell you

Plain and simple, buying an Android tablet is setting yourself up for disappointment — when it comes to both performance and capability and when it comes to the critical areas of privacy, security, and ongoing software upkeep. So when people ask me which Android tablet they should buy, you know what I tell 'em nowadays? They shouldn't buy one at all. If they want a Googley, Android-connected experience in a large-screen form, they should consider a decent convertible Chromebook instead. The exception — and Chrome OS's remaining weakness — is in the area of super-affordable, small-slate tablets. You can get a crappy Amazon-made Fire tablet for 50 bucks! And Chromebooks have yet to come around to address that demand. So if you're looking for a dirt cheap video screen or, say, something for a child to use, the low-end Android tablets might still be your only real option. When it comes to productivity and actual work-friendly devices, though — situations where the computing experience itself matters and where having an optimally secure, privacy-conscious, and performance-optimized environment is important — the common advice out there is increasingly misguided.



Quote for the day:

"It is the responsibility of leadership to provide opportunity, and the responsibility of individuals to contribute." -- William Pollard