Daily Tech Digest - July 13, 2020

How to choose a robot for your company

There are lots of reasons a company might entertain automating processes with robots. According to Kern, the main reason is a labor shortage. Prior to COVID-19-related slowdowns, a competitive labor landscape and rising costs of living in many countries around the globe made hiring tough for skilled and unskilled positions alike. Automation, which often promises ROI efficiencies over time, particularly when it comes to repeatable tasks, is an attractive solution. "Robots can save money over time, not just by directly eliminating human labor, but by cutting out worker training and turnover," according to the Lux report for which Kern served as lead. "Most companies turn to automation and robotic solutions to deal with labor shortages, which is common in industries with repetitive tasks that have a high employee turnover rate. Companies also frequently use robots to automate dangerous tasks, keeping their employees out of harm's way." Post-COVID-19, there are also considerations like sanitation and worker volatility. As I've written, the perception of automation is changing almost overnight. Where robots were once, very recently, associated primarily with lost jobs, there's been a new spin in the industry to tout automation solutions as commonsense in a world where workers are risking infection when they show up at physical locations.


How the cloud fractures application delivery infrastructure ops

The traditional infrastructure team still operates ADCs and load balancers in the data center, while preferring the vendors they have worked with in the past. DevOps and CloudOps have taken control in the public cloud, choosing to use software and cloud provider services that are more integrated with their DevOps toolchains. This fractured operations model is problematic. Companies with divided Layer 4-7 operations are less likely to be successful with this infrastructure. EMA research participants also revealed why they feel a need to close this operational gap. First, 43% of enterprises said this situation has introduced security risks. In most enterprises, application delivery infrastructure is an important component of overall security architecture. Companies need to take a unified approach to network security. Research participants identified compliance problems (36%) and operational efficiency (36%) as the top secondary challenges associated with fractured operations. And 30% said platform problems -- such as issues with scale, performance, functionality or stability -- are a major challenge.


The enormous opportunity in fintech

Technology providers to specific areas of finance have created significant businesses. Across the insurance ecosystem, Guidewire, Applied Systems, and Vertafore capture $10 billion of value. BlackKnight, the leading analytics provider to the mortgage industry, is an $11 billion business. Are you thinking about managing financial documents for your public company? You may turn to Broadridge, which makes a pretty penny in this business, boasting a $13 billion market cap. While these are massive markets, it is not easy to disrupt incumbents. A combination of regulatory hurdles, entrenched behavior, low risk-tolerance, and the benefits of larger balance sheets have kept upstarts at bay for decades. However, as venture capital supports the ecosystem, modern technology creeps into the sector (cloud, APIs), connectivity and data exchanges improve, and consumers grow tired of incumbents, the tide continues to shift. This shift and the challenge to the status quo by fintech upstarts will have lasting effects. Even when incumbents acquire their biggest disruptors, such as Visa’s acquisition of Plaid, innovations pioneered by those startups become integrated into the system and help move the industry forward.


Somehow, Microsoft is the best thing to happen to Chrome

What strange times we live in. Who’d have thought that I’d be writing an article on how Microsoft is the best thing to happen to Google Chrome? A few years ago the idea of Microsoft getting involved in an open source project would cause a mixture of laughter and dread. You know… Microsoft, the foe of open source who had a CEO that once said that Linux was “a cancer that attaches itself in an intellectual property sense to everything it touches.” The company that couldn’t make a decent web browser to save its life. But, believe it or not, I really do think that Microsoft’s involvement has made Chrome a much better browser. ... Basically, since dropping its opposition to open source, and not only embracing it, but putting its money where its mouth is, the thought of Microsoft being involved with an open source project is no longer the stuff of nightmares. It’s proved to be a valuable contributor to the open source community already. But how does this affect Google’s Chrome browser? Well, ever since Microsoft stopped using its own web engine, EdgeHTML, for its Edge web browser, and instead built a brand-new version that’s based on Chromium, it’s been contributing a steady stream of fixes and new features to Chromium – and those have not just been benefitting Edge, but Chrome as well.


IBM just changed the automation game. Hello Extreme Automation

The technology provides a low code, cloud-based authoring experience for the business user to create bot scripts with a desktop recorder, without the need of IT. These scripts are executed by digital robots to complete tasks. Digital robots can run on-demand by the end-user or by an automated scheduler. Arguably, WDG is on a par with Softomotive – acquired by Microsoft for considerably more money. What is clear is these RPA firms are offering pretty much the same functionality for the basic scripting and recording.  WDG is focused heavily on quality customer service ops and is great at integrating with chatbots, digital associates and other AI tools. Pre-Covid, most RPA was focused on low-risk back-office processes, especially in finance. Now customers are desperate to automate the customer-facing and revenue-generating processes and need tools proven to work in the environments. Noone has a huge advantage in the CX automation space so this provides a greenfield opportunity for IBM. The WDG automation software sits under IBM Cognitive and Cloud giving it a broader playing field to compete with the likes of MSFT, Pega, Appian, and even ServiceNow. Arguably, this is the real play that excites IBM’s top brass.


The Importance of Domain Experience in Data Science

Restated — domain knowledge is the learned skill to communicate fluently in a group’s data dialect. Its component parts are: general business acumen + vertical knowledge + data lineage understanding. For example, a data scientist in people analytics requires a foundational knowledge of the business + human resources + the inner-workings of their company’s HR tools and processes which create the data they work with. Those processes and other inputs to the dataset are crucial. A data scientist can’t create meaningful insights before they understand what the data is saying today. Is it telling a story? Is it, or subsets of it, too polluted to use today? Are some data points proxies for or inputs to others? The more complex your business processes and associated data lineage, the longer your data dialect will take to learn. For digital native companies whose data collection is automated with intuitive dialects (i.e. a “click” is a “click”), domain knowledge can be developed much more quickly than for large, longstanding companies which have undergone transformations, acquisitions and/or divestitures. If you hire a data scientist, how long will it take them to learn your data dialect? And can you provide air cover for them to do so before applying pressure to produce “insights?”


Hiring developers: While coding is important, there are other things to consider

A recruiter can learn a lot about the candidate in that half hour, including any side projects they might be involved in or games they've written. These "are often a window into a developer's willingness to take initiative," Volodarsky said. Learning what a developer does in their spare time can also provide great insight into their personality, he said. "Hiring great coders is important, but you also want to collaborate with interesting people, too." When it comes to hiring freelance developers it's important that they understand both the code and the nuances of the business they're contracting for, and this will come through in that conversation over a falafel, or the like, he said. In terms of motivating factors, not surprisingly, an overwhelming 70% said they were looking for better compensation, while 58.5% said they want to work with new technologies, and 57% said they were curious about other opportunities. Close to 70% of respondents said they learn about a company during a job hunt by turning to reviews on third-party sites such as Glassdoor and Blind. However, a large number also said they learned from viewing company-sponsored media, such as blogs and company culture videos.


Is Singapore ready to govern a digital population?

Singapore over the past several years has invested significant resources towards becoming a digital economy, rolling out an ambitious smart nation roadmap, driving the adoption of emerging technologies, and overhauling its own ICT infrastructure. With the global pandemic now adding new impetus to digital transformation, the government has made a concerted effort to drive digital adoption deeper into the business community and local population. It established a new office to work alongside the business community and local population to push the "national digitalisation movement". Initiatives would include the deployment of 1,000 "digital ambassadors" to help stallholders and seniors go digital and setting up of 50 digital community hubs across the island to offer one-to-one assistance on digital skills. A new ministerial committee will also coordinate the country's digitalisation efforts and focus on priorities such as assisting people in learning new skills and galvanising small businesses to go digital. More funds and resources have been further directed to facilitate digital transformation initiatives.


AIOps tools expand as users warm slowly to autoremediation

AIOps has generated industry hype since 2017, as advances in machine learning algorithms prompted IT monitoring vendors to envision a new method of automation for their products. At the same time, complex microservices infrastructures became impossible to manage entirely by human hands alone. Since then, AIOps tools have grown more sophisticated, adding automated remediation features to event correlation and automated root cause analysis, and AIOps vendors that began in specialized areas have also broadened the workloads their tools can support. Most recently, those vendors include Epsagon, which emerged in 2018 with AI-supported distributed tracing for serverless environments and expanded in 2019 to include container and cloud workloads. It now offers AIOps features it calls Applied Observability, which automate menial incident resolution tasks in response to metrics and logs in addition to traces. Last month, Epsagon launched a partnership with Microsoft centered on Kubernetes environments after previously inking a deal with AWS focused on its Lambda serverless compute service.


How Microfrontends Can Help to Focus on Business Needs

The concept of building sites from small web applications integrated via hyperlinks is (still) very common. There have also been a lot of concepts of rendering pages from smaller, independent building blocks in the past, such as Java Portlets. Even if the term microfrontend nowadays is used to refer to modern JavaScript apps, there are multiple possible approaches. So, when I use it in this article I refer to an application that: is basically a JavaScript Rich Client (for example a SPA or a Web Component) that runs isolated within an arbitrary DOM node and is as small and performant as possible; does not install global libraries, fonts, or styles; does not assume anything about the site it is embedded in; especially it does not assume any existing paths, so all the base paths to assets and APIs must be configurable; has a well-defined interface consisting of the startup configuration and some runtime messages (events); should be instantiable; ideally inherits the shared styles from the site and ships only styles absolutely necessary to define its layout.



Quote for the day:

"Leadership is familiar, but not well understood." -- Gerald Weinberg

Daily Tech Digest - July 12, 2020

Study Reveals a ‘Skills Gap’ That Jeopardizes Future of Banking Workforce

Over a period of only a couple months, entire workforces were required to familiarize themselves with digital tools which never were needed in a traditional work environment. At the same time, financial institutions were required to connect with customers using mobile apps, online tools and digital engagement capabilities that were foreign to many. The impact of these changes was felt most by the employees who had been with their financial institution the longest or were in areas of an organization that had not adjusted to recent marketplace realities. Many financial institutions responded to internal and external digital needs with mid-term solutions, understanding that significantly more is needed. The impact of COVID-19 has forced banks and credit unions to quickly assess the digital competency of their teams, while looking to internal training and the marketplace to provide longer term solutions. This comes at a time when every industry is looking to address a massive digital and technology skills gap. The research from the Digital Banking Report found that 72% of financial services executives believed there was either a moderate (37%) or significant (35%) skills gap. Less than three in ten thought there was only a minor or no threat.


Deployment and Productionization of Machine Learning Models

A machine infrastructure encompasses almost every stage of the machine learning workflow. To train, test, and deploy machine learning models you need services from data scientists, data engineers, software prog engineers, and DevOps engineers. The infrastructure allows people from all these domains to collaborate and empower them to associate for an end to end execution of the project. Some examples of tools and platforms are AWS(amazon web services, Google Cloud, Microsoft Azure machine learning studio, Kubeflow: Machine-Learning Toolkit for Kubernetes. Architecture deals with the arrangement of these components(things discussed above) and also takes care of how they must interact with them. Think of it as building a machine learning home where bricks, concrete, iron, are integral to the infrastructure, applications, etc. The architecture shapes our home by using these materials. Similarly, the architecture here provides that interaction among these components. ... In machine learning, for the given data different models are built and we keep track through version control tools like DVC and Git. Version control will keep track of changes made to the model at each stage and keep a repository.


Seamlessly Scaling AI for Distributed Big Data

Conventional approaches usually set up two separate clusters, one dedicated to Big Data processing, and the other dedicated to deep learning (e.g., a GPU cluster), with “connector” (or glue code) deployed in between. Unfortunately, this “connector approach” not only introduces a lot of overheads (e.g., data copy, extra cluster maintenance, fragmented workflow, etc.), but also suffers from impedance mismatches that arise from crossing boundaries between heterogeneous components (more on this in the next section). To address these challenges, we have developed open source technologies that directly support new AI algorithms on Big Data platforms. ... Before diving into the technical details of BigDL and Analytics Zoo, I shared a motivating example in the tutorial. JD is one of the largest online shopping websites in China; they have stored hundreds of millions of merchandise pictures in HBase, and built an end-to-end object feature extraction application to process these pictures (for image-similarity search, picture deduplication, etc.). While object detection and feature extraction are standard computer vision algorithms, this turns out to be a fairly complex data analysis pipeline when scaling to hundreds of millions pictures in production, as shown in the slide below.


‘Undeletable’ Malware Shows Up in Yet Another Android Device

While it was not immediately obvious that the trojan was present on the device, researchers were able to detect it given its similarity to another malware downloader. “Proof of infection is based on several similarities to other variants of Downloader Wotby,” Collier explained. “Although the infected Settings app is heavily obfuscated, we were able to find identical malicious code. Additionally, it shares the same receiver name: com.sek.y.ac; service name: com.sek.y.as; and activity names: com.sek.y.st, com.sek.y.st2, and com.sek.y.st3.” The app did not trigger any malicious activity when researchers analyzed the device, which they expected; however, the smartphone they examined also did not have a SIM card installed, which also could affect how the malware behaves, he said. “Nevertheless, there is enough evidence that this Settings app has the ability to download apps from a third-party app store,” he wrote. “This is not okay.” The other malware variant came preinstalled in the UL40’s Wireless Update app, which functions as the device’s main way of updating security patches, the operating system and other apps.


6 Coding Books Every Programmers and Software Developers should Read

Refactoring, Improving the design of existing code: This book is written in Java as it’s the principal language, but the concept and idea are applicable to any Object-oriented language, like C++ or C#. This book will teach you how to convert a mediocre code into a great code that can stand production load and real-world software development nightmare, the CHANGE. The great part is that Martin literally walks you the steps by taking a code you often see and then step by step converting into more flexible, more usable code. You will learn the true definition of clean code by going through his examples. ... The Art of Unit Testing: If there is one thing I would like to improve on projects, as well as programmers, are their ability to unit test. After so many years or recognition that Unit testing is must have practiced for a professional developer, you will hardly find developers who are a good verse of Unit testing and follows TDD. Though I am not hard on following TDD, at a bare minimum, you must write the Unit test for the code you wrote and also for the code you maintain. Projects are also not different, apart from open source projects, many commercial in-house enterprise projects suffer from the lack of Unit test.


How to become an effective software development manager and team leader

I learn by doing, and I learn from others. So first of all, I don't think anyone is born with these skills. I mean, some people are better communicators than other people, but a lot of the things that you actually have to learn like how to manage somebody, how to... the good news is it can be learned and the way I learned it is by doing and getting better every time I did it. But I was also fortunate that I was able to surround myself with really great people every step along the way, both in Drupal and at Acquia frankly. So surrounding yourself with experienced managers, or experienced leaders is very helpful and fast tracks that learning, right? ... I think about it almost everyday actually. But I prioritize it lower than a lot of other things that I do. Literally, when I wake up I try to think, "What should I do today that has the biggest impact on Drupal and Acquia?" It's almost never coding for me, unfortunately. I secretly hope it would be one day it's like, "Wow, go code. Go write this piece of code." But it usually involves unblocking other people or teams, or helping to fundraise for the Drupal Association right now. So the coding is often reserved for evenings and weekends. I like to dabble with code still.


Whiteapp ASP.NET Core using Onion Architecture 

It is Architecture pattern which is introduced by Jeffrey Palermo in 2008, which will solve problems in maintaining application. In traditional architecture, where we use to implement by Database centeric architecture. Onion Architecture is based on the inversion of control principle. It's composed of domain concentric architecture where layers interface with each other towards the Domain (Entities/Classes). Main benefit of Onion architecture is higher flexibility and de-coupling. In this approach, we can see that all the Layers are dependent only on the Domain layer (or sometimes, it called as Core layer). ... Testability: As it decoupled all layers, so it is easy to write test case for each Components; Adaptability/Enhance: Adding new way to interact with application is very easy;  Sustainability: We can keep all third party libraries in Infrastructure layer and hence maintainence will be easy; Database Independent: Since database is separated from data access, it is quite easy switch database providers; Clean code: As business logic is away from presentation layer, it is easy to implement UI;


In the age of disruption, comprehensive network visibility is key

In an age of dynamic disruption, IT is increasingly challenged to maintain optimal service delivery, while implementing remote working at an unprecedented scale. It’s not surprising, then, that nearly 60 percent of study respondents cite the need for greater visibility into remote user experiences. The top challenge for troubleshooting applications is the ability to understand end-user experience (nearly 47 percent). “As remote working becomes the new norm, IT teams are challenged to find and adapt technologies, such as flow-based reporting to manage bandwidth consumption, VPN oversubscription and troubleshooting applications. To guarantee the best performance and reduce cybersecurity threats, increasing network visibility is now a must for all businesses,” said Charles Thompson, Senior Director, Enterprise and Cloud, VIAVI. “By empowering NetOps, as well as application and security teams with network visibility, IT can mitigate the impact of disruptive migrations, incidents and new technologies like SD-WAN to achieve consistent operational excellence.”


Prepare for Artificial Intelligence to Produce Less Wizardry

“Deep neural networks are very computationally expensive,” says Song Han, an assistant professor at MIT who specializes in developing more efficient forms of deep learning and is not an author on Thompson’s paper. “This is a critical issue.” Han’s group has created more efficient versions of popular AI algorithms using novel neural network architectures and specialized chip architectures, among other things. But he says there is a “still a long way to go,” to make deep learning less compute-hungry. Other researchers have noted the soaring computational demands. The head of Facebook’s AI research lab, Jerome Pesenti, told WIRED last year that AI researchers were starting to feel the effects of this computation crunch. Thompson believes that, without clever new algorithms, the limits of deep learning could slow advances in multiple fields, affecting the rate at which computers replace human tasks. “The automation of jobs will probably happen more gradually than expected, since getting to human-level performance will be much more expensive than anticipated,” he says.


Ransomware Characteristics and Attack Chains – What you Need to Know about Recent Campaigns

Ransomware is a type of malware that prevents users from accessing their system or personal files and demands a “ransom payment” in order to regain access. There are two types of campaigns for ransomware “Human-operated” and “Auto-spreading”, this article focusing on the human-operated campaigns. Human-operated campaigns tend to have common attack patterns which include: Gaining initial access, credential theft, lateral movement and persistence. For many of the human-operated campaigns, typical access comes from RDP brute force, a vulnerable internet-facing system, or weak application settings. Once attackers have gained access they can deploy a plethora of tools to get user credentials. After gaining credentials lateral movement takes place with either deploying a widely known commercial penetration testing suite called Cobalt Strike, changing settings of the WMI (Windows Management Instrument) or abusing management tools with low-level privilege. Finally, attackers want to keep a connection and make it persistent; this is done by creating new accounts, making GPO (Group Policy Object) changes, creating scheduled tasks, manipulating service registration, or by deploying shadow tools.



Quote for the day:

"Nobody in your organization will be able to sustain a level of motivation higher than you have as their leader." -- Danny Cox

Daily Tech Digest - July 11, 2020

Software as a Service (SaaS): A cheat sheet

Beyond reliability, and depending on the nature of your business applications, it is also vitally important to evaluate the capacity provided by your chosen ISP. Querying large databases or moving large media files will require more bandwidth than is typical for less-intense applications like email; however, even extremely large bandwidth may not be enough, if there are also latency issues. There are similar reliability concerns when choosing the service provider for the SaaS applications themselves. Business organizations have to think about the longevity of their provider, their commitment to security, their willingness to customize applications, and their plans for feature upgrades. SaaS requires a business to relinquish some control in order to reap the benefits of the distribution system. Relinquishing control may also cause problems when the SaaS provider updates certain application features that the business does not want changed. Some feature upgrades will break existing use cases, especially if the business is using a customized version of the software. Some SaaS vendors have been known to eliminate aggregately under used features from their software, which causes problems for businesses that choose to adopt those features.


APT Group Targets Fintech Companies

Once the targeted victim clicks on the LNK file to view one of the documents, the malware begins to load in the background and infect their device, according to the report. Once the attackers successfully infect devices and a network, the malware steals sensitive corporate data, such as customer lists, credit card information and other personally identifiable data, along with the firm's investments and trading operations data, the ESET researchers report. In the next phase of the attack, the JavaScript components deploy other malware the Evilnum operators purchased from other hackers, including code written in C# from the malware-as-a-service provider Golden Chickens, the report notes. The attackers also use Python-based tools in their toolkits, the researchers add. While the JavaScript component acts as a backdoor and handles communications with the command-and-control server, the C# code takes on other tasks, including grabbing a screenshot whenever the mouse is moved over a certain length of time, sending system information back to the operators as well as stealing cookies and credentials. Eventually, this process will kill the malware when the campaign is complete, according to the report.


Why Segmentation is More Effective Than Firewalls For Securing Industrial IoT

As we’re so accustomed to using firewalls in our everyday lives (particularly on our own private computers, tablets, and smartphones) it might seem intuitive to use a firewall as a safeguard for IIoT-connected devices as well. However, the choice isn’t quite so straightforward as it might at first seem. Internal firewalls are expensive and complex to implement. It could be that for genuinely reliable protection, you need to install a firewall at every IIoT connection point. This could mean that hundreds (perhaps even thousands) of firewalls are required. We’ve already discussed how businesses’ technology security budgets are often overstretched. Taking this into account, security spend needs to be very carefully calculated and targeted. Segmentation, on the other hand, makes it possible to keep particular types of devices siloed off in a certain segment, thereby enhancing security. It also helps to enhance visibility and simplify classification of different device types. Organisations can then create risk profiles and relevant security policies for device groups.


How data and AI will shape the post-pandemic future

The general public are particularly becoming used to AI playing a huge role. The mystery around it is beginning to fade, and it is becoming far more accepted that AI is something that can be trusted. It does have its limitations. It's not going to turn into the Terminator and take over the world. The fact that we are seeing AI more in our day-to-day lives means people are beginning to depend on the results of AI, at least from the understanding of the pandemic, but that drives that exception. When you start looking at how it will enable people to get back to somewhat of a normal existence―to go to the store more often, to be able to start traveling again, and to be able to return to the office―there is that dependency that Arti mentioned around video analytics to ensure social distancing or temperatures of people using thermal detection. All of that will allow people to move on with their lives and so AI will become more accepted. I think AI softens the blow of what some people might see as a civil liberty being eroded. It softens the blow of that in ways and says, "This is the benefit already and this is as far as it goes." So it at least forms discussions whenever it was formed before.


IoT: device management and security are crucial

Operational challenges abound from the beginning of the IoT journey to its end. For example, how do you efficiently roll out hundreds of thousands or even a million devices in a timely manner? Once up and running, device firmware and IoT application software will need to be updated – possibly multiple times – during the course of the device’s life. Additionally, the device should be monitored against established baselines. This creates the environment for an early warning system that can highlight possible software bugs or security exploits. Devices also may experience an “upgrade” during their life cycles, as new capabilities may be activated and enabled over-the-air, based on needs and business cases. Ownership changes require re-assignment of control, and at the end, devices need to be decommissioned and brought to end-of-life in an efficient manner. These development and deployment challenges are prompting companies to re-examine how they allocate resources more efficiently. For example, only 15% of overall IoT systems development time is IoT application development. But a full 30% is device-management issues (provisioning, onboarding, and updating devices and systems), while 40% is taken up by developing the device stacks.


More pre-installed malware has been found in budget US smartphones

While the app does function as an over-the-air updater for security fixes and as an updater to the operating system itself, the software also installs four variants of HiddenAds, a Trojan family found on Android handsets. HiddenAds is a strain of adware that bombards users with adverts. In order to verify where the malware originated from, Malwarebytes disabled WirelessUpdate and then re-enabled the app. Within 24 hours, four adware strains were covertly installed. As the malware on the UMX and ANS differ, the team wanted to see if there were any ties linking the brands. A common thread was the use of a digital certificate used to sign the ANS Settings app under the name teleepoch. Upon further investigation, the certificate was traced back to TeleEpoch Ltd, which is registered as UMX in the United States. "We have a Settings app found on an ANS UL40 with a digital certificate signed by a company that is a registered brand of UMX," Collier says. "That's two different Settings apps with two different malware variants on two different phone manufactures & models that appear to all tie back to TeleEpoch Ltd. ..."


Increasing demand for RegTech to Meet Regulatory Burden

The demand has grown exponentially high since the Global Financial Crisis of 2008, businesses need to comply with regulatory reforms related to Anti-Money Laundering (AML) and due diligence (KYC) requirements. The cost to comply with regulations was staggering, but the non-compliance costs more due to hefty amounts of fines. Digitization of regulatory compliance assists businesses in meeting the needs of regulation, that too, by cutting the cost. According to the study, the cost of compliance across all banks from 2014 to 2016 averaged approximately 7.0% of their noninterest expenses. RegTech startups are experiencing growth and investment as firms are realizing the need to capitalize on compliance efficiency. Businesses can use it for a competitive edge in the industry. There is great potential for powering the future of financial regulation by integrating RegTech. It has major implications as it provides reduced regulatory costs and improved operational efficiency. The main target of RegTech was the finance industry.


Why businesses are adopting AI to improve operations

AI has improved productivity in an array of sectors. AI-powered contact center software has allowed companies to become incredibly efficient. In a shop, a digital SKU system is far more efficient at keeping tabs on stock levels than a manual one. It can record and analyze the demand for certain articles. More will automatically get ordered. A fashion store can see when a garment is selling like hot cakes and get more before the trend runs its course. This maximizes profit on the item. For teleconferencing solutions or other software providers, one of the biggest problems faced is customer churn. Retention schemes try to contact as many customers as possible whose contract is due to run out. Discounts and other enticements are offered to remain. But some of those customers would have stayed anyway. Others, who were more likely to leave, may not have been contacted. Customer services can't get in touch with every single person whose contract is due to be up. What the firm needs to understand are the factors influencing people to stay or go. An AI program is able to analyze the data from thousands of customers. It works out the risk factors and pulls out a list of people most likely to leave.


10 Ways AI Is Improving New Product Development

From startups to enterprises racing to get new products launched, AI and machine learning (ML) are making solid contributions to accelerating new product development. There are 15,400 job positions for DevOps and product development engineers with AI and machine learning today on Indeed, LinkedIn and Monster combined. Capgemini predicts the size of the connected products market will range between $519B to $685B this year with AI and ML-enabled services revenue models becoming commonplace. Rapid advances in AI-based apps, products and services will also force the consolidation of the IoT platform market. The IoT platform providers concentrating on business challenges in vertical markets stand the best chance of surviving the coming IoT platform shakeout. As AI and ML get more ingrained in new product development, the IoT platforms and ecosystems supporting smarter, more connected products need to make plans now how they're going to keep up. Relying on technology alone, like many IoT platforms are today, isn't going to be enough to keep up with the pace of change coming.


CDO Leadership Skills That Matter

Persistence is a key trait of successful leaders—they don’t get demotivated too easily. Whereas some people retreat back to their caves after failed attempts to collaborate with the organization, choosing to focus only on internal marketing or just a few pilots, I find that leaders who are persistent have a seat at the strategic table with their peers, have a strategy, and have a roadmap. They’re constantly thinking through how their capabilities could be used across the organization. They’re not easily defeated when something doesn’t go right. Persistence is important because the failure rate of data strategies and data governance teams is high; you’re building in a function that you’re not consolidating under one person, one business function. You’re often using a distributed leadership and organization model, which takes hard work to set the right expectations and have ongoing communications. On a regular basis, you have to give different people the WIIFM, the goals and objectives, that apply to their particular situation, and try to drive adoption and change in a way that fits with how each team works.



Quote for the day:

"Humility is a great quality of leadership which derives respect and not just fear or hatred." -- Yousef Munayyer

Daily Tech Digest - July 10, 2020

SWOT analysis: Why you should perform one, especially during times of uncertainty

If your company is going to develop a sustainable advantage, it will need to first know where its strengths, weaknesses, opportunities, and threats exist. Without conducting a SWOT analysis, your company is flying blind and could be wasting precious resources and time on activities that propel it in the wrong direction. Conducting a SWOT analysis is particularly important during times of crisis and uncertainty. Since the COVID-19 pandemic began, many companies and industries have had to revisit their SWOT analysis as a result of internal and external factors outside of their control. As a result of the pandemic impact, industries like travel and tourism, restaurants, entertainment, and many others have been forced to devise ways to address new risks and reevaluate new opportunities. Conducting a SWOT analysis helps your leadership team gain a clear view of what your company is doing well compared with its competitors and where it needs to pull up its socks. It also helps shine a light on areas where potential opportunities exist and where risks may reside. Having a solid understanding of all of these areas identifies your current state and increases your company's visibility into how to best allocate its budget, resources, time, and effort. 


When WAFs Go Wrong

"Organizations want more from their WAF providers — and the degree of negative feedback from vendor-supplied references warns that, unless vendors adapt quickly, the WAF market is ripe for disruption," according to Sandy Carielli, principal analyst at Forrester Research, who led the firm's most recent market research on the WAF market this spring. The Forrester report shows that organizations are particularly struggling as their current WAF deployments are unable to handle a broader range of application attacks, particularly client-side attacks, API-based attacks, and bot-driven attacks. On the API (application programming interface) front, for example, an increasing number of server-side request forgery (SSRF) are made possible due to how cloud architectures use metadata APIs and webhooks. "The WAF may not necessarily be deployed in-line to monitor the outbound HTTP requests made by the web application. Many SaaS companies offer some form of web hook product which makes an http request on behalf of the user and cannot be easily differentiated from an SSRF attack," explained Jayant Shukla, CTO and co-founder of K2 Cyber Security


Overcoming Data Security Challenges in a Hybrid, Multicloud World

With each step, from IaaS to PaaS to SaaS to DBaaS, organizations give up some level of control over the systems that store, manage, distribute and protect their sensitive data. This increase in trust placed in third parties also presents an increase in risk to data security. Cloud deployments work on a shared responsibility model between the cloud provider and the consumer. In the case of an IaaS model, the cloud consumer has room to implement data security measures much like what they would normally deploy on premises and exercise tighter controls. For SaaS services, cloud consumers have to rely on the visibility provided by the cloud provider which, in essence, limits their ability to exercise more granular controls. It’s important to note that regardless of the chosen architecture, it’s ultimately your organization’s responsibility to ensure appropriate data security measures are in place across environments. To learn more about how to adapt your data security, data privacy and compliance practices to the hybrid multicloud, read the “Overcoming Data Security Challenges In a Hybrid Multicloud.”


Are Today’s Banks Prepared To Deploy Tomorrow’s Technologies?

While it is impossible to determine what the “new normal” in banking will look like, it will undoubtedly be far different than the past. It is still unknown how the negative financial impact of the pandemic on consumers will impact future banking behavior. While we have seen a spike in digital transactions and in the amount of savings set aside by consumers, it is too early to develop reliable trend lines going forward. There is little doubt that the banking industry will face a stretch of economic pressure created by delayed loan payments, lower fees, narrow margins and increased risk from credit losses. While government stimulus packages may help, there will still be capital and liquidity challenges. These financial challenges create a very clear call to action for financial institutions used to doing business the way it has been done for decades. Banks and credit unions must reimagine legacy business models and the technology used to serve the marketplace. Speed of change will determine winners as much as the changes themselves. Being a “fast follower” will no longer be acceptable.


Career advice for a changing world

For those growing up as digital natives, the principle of owning your network and profile may seem obvious. Everything we do will be captured digitally somehow — in both the professional and the social milieus. What you choose to post and how you present yourself matters: It is the foundation on which to build your network. The changing nature of work, including the fact that people may switch jobs frequently or be employed under a variety of types of agreements, will require the ability to present a compelling profile of who you are, and communicate this to your peers and potential collaborators. Here’s where your platform will find its outward presentation — where you can bundle your various talents, skills, aptitudes, and interests to present to prospective employers, mentors, and others you’ll work with or for. People at all stages of their career will need to do this, and as they add new abilities through upskilling, they add to the richness of their profile. You also need to build your network both digitally and physically (when that again becomes possible). If you are looking to change jobs, you should start by looking for ways to situate yourself among people who are already doing what you aspire to do, and build your new contacts.


Microsoft Teams' new 'Together mode' aims to make video calls more engaging

On most video calls, eye contact – or the lack of – is an ongoing problem, with people often appearing to look in the wrong direction. Together mode mimics the geometry of reflection, meaning that every participant is looking at the whole group through a big virtual mirror. “Once direct eye contact errors become hard to detect, people intuitively position themselves to look as if they are reacting to one another appropriately,” Lanier explains. Microsoft said its research has shown that as a result people tend to feel happier and more engaged in meetings. Additionally, everyone in Together mode is in a fixed position. If one person happens to appear in the fourth seat of the bottom row on their own screen, that person would appear in the fourth seat of the bottom row on everyone else’s screen. Angela Ashenden, principle analyst for workplace transformation at CCS Insight ,said the combination of both features helps to make the video meetings feel more natural. She notes that if a meeting leader tells everyone to click a button on the right of the screen, you see everyone’s gaze looking in the same direction.


Open source license issues stymie enterprise contributions

"The No. 1 issue [in enterprise open source] is still licensing," said Kevin Fleming, who oversees research and development teams in the office of the CTO at Bloomberg, a global finance, media and tech company based in New York. "But it isn't the licensing discussion that everybody was having five to 10 years ago -- now, the licensing discussion is about really important projects that enterprises depend upon deciding to switch to non-open source licenses." The legal outlook for enterprises has also been further complicated by varied approaches among vendors and open source foundations to copyright agreements, and a general lack of legal precedents to guide corporate counsel on open source IP issues. While Bloomberg's Fleming, and many other enterprise open source contributors, believes new license types such as the server side public license (SSPL) and the Hippocratic License clearly fall outside the bounds of open source, in the wider community, those aren't entirely settled questions. "Open source is bigger than licenses," said Coraline Ada Ehmke, software architect at Stitch Fix, creator of the Hippocratic License and founder of the Ethical Source Working Group.


Agile Initiative Planning with Roadmaps

Plans are critical because they set expectations on the goals, the strategy and the resources you need. They justify the organisation's expenditure on the initiative. They allow you to consider the problems you are likely to incur along the way and develop ways to avoid them. Plans build a bridge between management and the development team. With a plan, you can prepare for different eventualities to improve your chance of success. With a plan, you can get the commitment and resources you need to achieve your objective. Without a plan, it's unlikely that people will give you the funds or resources you need to succeed. Over the last few years, I have developed and refined an Initiative Roadmap process that allows you to define, design and plan an initiative in weeks instead of months or years. In an Initiative Roadmap, you set your goal, strategy and direction in a high-level plan so that you can get the necessary funding and support you need to build a delivery team. When the development team starts, they evolve the plan with business stakeholders to deliver the maximum business value possible within the time and budget available.


Google open-sources Tsunami vulnerability scanner

Google said it designed Tsunami to adapt to these extremely diverse and extremely large networks on the get-go, without the need to run different scanners for each device type. Google said it did this by first splitting Tsunami into two main parts, and then adding an extendable plugin mechanism on top. The first Tsunami component is the scanner itself -- or the reconnaissance module. This component scans a company's network for open ports. It then tests each port and attempts to identify the exact protocols and services running on each, in an attempt to prevent mislabelling ports and test devices for the wrong vulnerabilities. Google said the port fingerprinting module is based on the industry-tested nmap network mapping engine but also uses some custom code. The second component is the one that's more complex. This one runs based on the results of the first. It takes each device and its exposed ports, selects a list of vulnerabilities to test, and runs benign exploits to check if the device is vulnerable to attacks. The vulnerability verification module is also how Tsunami can be extended through plugins -- the means through which security teams can add new attack vectors and vulnerabilities to check inside their networks.


Up Close with Evilnum, the APT Group Behind the Malware

Evilnum's primary goal is to spy on its targets and steal financial data from businesses and their customers. Its attackers have previously stolen spreadsheets and documents with customer lists, investments, and trading operations; internal presentations; software licenses and credentials for trading software and platforms; browser cookies and session data; email credentials; credit card information; and proof of address and identity documents. The group has also obtained access to VPN configurations and other IT-related information. Like many threat groups, Evilnum starts with a phishing email. Messages contain a link to a ZIP file hosted in Google Drive. This archive has multiple LNK files designed to extract and execute a malicious JavaScript component while displaying a fake document. These "shortcut" files have "double extensions" to trick victims into believing they are harmless and opening them. These LNK files all do the same thing: When opened, a file searches its contents for lines with a specific marker and writes them to a JavaScript file. This malicious file is executed and then writes and opens a decoy file with the same name as the LNK file.



Quote for the day:

"Challenges are what make life interesting and overcoming them is what makes life meaningful." -- Joshua J. Marine

Daily Tech Digest - July 09, 2020

Diversity in tech: 3 stories of perseverance and success

It is easy to fall into comfortable patterns. We train for sports by developing muscle memory using repetition to engrain patterns in our brains. It takes an average of 66 days for a behavior to become a habit, and it can require 10 times the effort. Simply stated, hard work and dedication are the foundations for learning, whether learning a new language, improving your golf swing, or rethinking workforce demographics. Organizations are especially resistant to change, requiring cross-organizational commitment and a compelling business imperative. An uncompromising focus on change must cascade throughout an organization and be measured, managed, and reinforced. This resistance to change may explain, at least in part, why the underrepresentation of people of color in technology companies has shown little improvement since 2014. Ideally, the representation of blacks in technology should reflect the overall population, but it does not. According to the Census Bureau, blacks make up 13.4% of the U.S. population but account for only 5% of the workforce at technology companies, with women of color representing even less at 1%.


Pen Testing ROI: How to Communicate the Value of Security Testing

Defining the ROI of pen testing has its nuances, as there are seemingly no tangible results that come directly from the investment. When implementing a pen-testing strategy, you're actively avoiding a breach that could cost your organization money. But the cost of a breach is the most obvious data point for measuring ROI, and those estimates vary widely. My advice? Work toward maturing your security program to a point where the engagement with pen testers is focused on ensuring the effectiveness of existing controls and security touchpoints in your development life cycle — not solely to check a compliance box or single-handedly prevent a breach. Leveraging pen testing throughout the development life cycle can help identify issues in development before deployment rather than the costly discovery of vulnerabilities at a later date. Second, identify metrics, not measurements: Business decisions are often made using measurements, instead of metrics. But in most cases, driving decisions based on measurements (or raw data) can be misleading and end up with business leaders focusing time, effort, and budget on the wrong activities.


How to build a data architecture to drive innovation—today and tomorrow

To scale applications, companies often need to push well beyond the boundaries of legacy data ecosystems from large solution vendors. Many are now moving toward a highly modular data architecture that uses best-of-breed and, frequently, open-source components that can be replaced with new technologies as needed without affecting other parts of the data architecture. The utility-services company mentioned earlier is transitioning to this approach to rapidly deliver new, data-heavy digital services to millions of customers and to connect cloud-based applications at scale. For example, it offers accurate daily views on customer energy consumption and real-time analytics insights comparing individual consumption with peer groups. The company set up an independent data layer that includes both commercial databases and open-source components. Data is synced with back-end systems via a proprietary enterprise service bus, and microservices hosted in containers run business logic on the data. ... Exposing data via APIs can ensure that direct access to view and modify data is limited and secure, while simultaneously offering faster, up-to-date access to common data sets. 


Software Techniques for Lemmings

The performance of a system with thousands of threads will be far from satisfying. Threads take time to create and schedule, and their stacks consume a lot of memory unless their sizes are engineered, which won't be the case in a system that spawns them mindlessly. We have a little job to do? Let's fork a thread, call join, and let it do the work. This was popular enough before the advent of <thread> in C++11, but <thread> did nothing to temper it. I don't see <thread> as being useful for anything other than toy systems, though it could be used as a base class to which many other capabilities would then be added. Even apart from these Thread Per Whatever designs, some systems overuse threads because it's their only encapsulation mechanism. They're not very object-oriented and lack anything that resembles an application framework. So each developer creates his own little world by writing a new thread to perform a new function. The main reason for writing a new thread should be to avoid complicating the thread loop of an existing thread. Thread loops should be easy to understand, and a thread shouldn't try to handle various types of work that force it to multitask and prioritize them, effectively acting as a scheduler itself.


Cloud Security Mistakes Which Everyone Should Avoid

Cloud can be accessed virtually, by anyone who is possessing proper credentials, makes it convenient and vulnerable at the same time. Unlike physical servers that limit a number of admin users, and have more strict access permissions, cloud servers can never provide that level of security. That’s why many small business owners around the world still choose web hosting services that operate on physical servers, especially since you’re able to have a whole server just for your website if you choose a dedicated hosting plan. But virtual servers are much easier to access because of their access permissions that could sometimes be misused. Controlling access to data kept on the cloud is a tricky balancing act between giving people access to the tools they require to get the job done and protecting their data from getting into the wrong hands. Efficiently managing the data requires a comprehensive policy that not only controls who can access what data and from where, but involves monitoring to determine who accesses data, when, and from where to detect potential breaches or any inappropriate access. Therefore, it is vital to educate on how to secure their cloud sessions, including avoiding public networks and effective password management.


The Modern Hybrid App Developer

One of the most frustrating parts about building apps is the massive headache of releasing and waiting for new updates in the app stores. Because hybrid app developers build a big chunk of their app using web technology, they are able to update their app’s logic and UI in realtime any time they want, in a way that is allowed by Apple and Google because it’s not making binary changes (as long those updates continue to follow other ToS guidelines). Using a service like Appflow, developers can set up their native Capacitor or Cordova apps to pull in realtime updates across a variety of deployment channels (or environments), and even further customize different versions of their app for different users. Teams use this to fix bugs in their production apps, run a/b tests, manage beta channels, and more. Some services, like Appflow, even support deploying directly to the Apple and Google Play store, so teams can automate both binary and web updates. This is a major super power that hybrid app developers have today that native developers do not!


HSBC customers targeted in new smishing scam

The text phishing, or smishing campaign begins with a text message purporting to come from HSBC, informing its target that “a new payment has been made” through the HSBC app on their smartphone device. Targets are informed that if they were not responsible for this payment, they should visit a website to validate their bank account. To the untrained eye, the website link – security.hsbc.confirm-systems.com – could conceivably be legitimate, but obviously should on no account be opened. Victims will then be directed to a fake landing page and asked to input their username and password, along with a series of verification steps, on a fraudulent website that uses HSBC branding. The site will also try to weed out specific account details and other personally identifiable financial information (PIFI) from its targets. Griffin Law, which works with a number of accountancy groups and financial support teams in the London area, said it had seen a clear spike in reports of the scam, with almost 50 of its customers telling it they had received the smish so far. A number of them said they did not have any HSBC apps installed on their devices, which suggests the scam is quite indiscriminate in its targeting.


Card Skimmer Found Hitting Vulnerable E-Commerce Sites

Despite the large pool of potential targets, Malwarebytes has only been able to identify a few victims. "We found over a dozen websites that range from sports organizations, health, and community associations to (oddly enough) a credit union. They have been compromised with malicious code injected into one of their existing JavaScript libraries," Segura says. Some historical evidence of other victims who have been hit in the past was uncovered as part of his research, he says, but they have since been remediated. The total number of targets number is not available. The skimmer steals payment card numbers and tries to also swipe passwords, although the latter activity is not correctly implemented and does not always work, according to Malwarebytes. Segura says the skimmer is not that different from others currently operating in how it collects and exfiltrates data. The novelty is that it was only found on ASP.NET websites. "The skimmer is embedded in an existing JavaScript library used by a victim site. There are variations on how the code is structured but overall, it performs the same action of contacting remote domains belonging to the threat actor," Segura says.


MongoDB is subject to continual attacks when exposed to the internet

After seeing how consistently database breaches were occurring, Intruder planted honeypots to find out how these attacks happen, where the threats are coming from, and how fast it takes place. Intruder set up a number of unsecured MongoDB honeypots across the web, each filled with fake data. The network traffic was monitored for malicious activity and if password hashes were exfiltrated and seen crossing the wire, this would indicate that a database was breached. The research shows that MongoDB is subject to continual attacks when exposed to the internet. Attacks are carried out automatically and indiscriminately and on average an unsecured database is compromised less than 24 hours after going online. ... Attacks originated from locations all over the globe, though attackers routinely hide their true location, so there’s often no way to tell where attacks are really coming from. The fastest breach came from an attacker from Russian ISP Skynet and over half of the breaches originated from IP addresses owned by a Romanian VPS provider.


How data is fundamental to manufacturing’s digital transformation

The key to creating and deploying an effective data strategy comes down to three factors: sponsorship, a standardised platform and robust governance. Sponsorship is vital, according to Greg Hanson, particularly in larger organisations where buy-in can be more difficult to achieve. “Additionally, the successful deployment of that strategy requires engagement with the organisation as a whole, and a cultural acceptance of responsibility regarding data given GDPR and privacy laws,” he added. Helping to drive this combination of board-level sponsorship and enterprise-wide engagement are Chief Data Officers, newly-created executive roles tasked with deploying and monitoring the effectiveness of data strategies and the adoption of modern, cloud-based architectures – the foundation of many industrial digital transformation initiatives. “There are so many technologies readily available in the cloud space now that companies face the risk of ‘cloud sprawl’ which degrades the impact of their digital transformation and data management,” Hanson continued.



Quote for the day:

''Leadership occurs any time you attempt to influence the thinking, development of beliefs of somebody else." -- Dr. Ken Blanchard

Daily Tech Digest - July 08, 2020

Why Are Real IT Cyber Security Improvements So Hard to Achieve?

It’s easy to point fingers in various directions to try to explain why we have done such a poor job of improving IT security over the years. Unfortunately, most of the places at which blame is typically directed bear limited, if any, responsibility for our lack of security. It’s hard to deny that software is more complex today than it was 10 or 20 years ago. The cloud, distributed infrastructure, microservices, containers and the like have led to software environments that change faster and involve more moving pieces. It’s reasonable to argue that this added complexity has made modern environments more difficult to secure. There may be some truth to this. But, on the flipside, you have to remember that the complexity brings new security benefits, too. In theory, distributed architectures, microservices and other modern models make it easier to isolate or segment workloads in ways that should mitigate the impact of a breach. Thus, I think it’s simplistic to say that the reason IT cyber security remains so poor is that software has grown more complex, and that security strategies and tools have not kept pace. You could argue just as plausibly that modern architectures should have improved security.


Facebook is recycling heat from its data centers to warm up these homes

The tech giant stressed that the heat distribution system it has developed uses exclusively renewable energy. The data center is entirely supplied by wind power, and Fjernvarme Fyn's facility only uses pumps and coils to transfer the heat. As a result, the project is expected to reduce Odense's demand for coal by up to 25%. Although Facebook is keen to use the heat recovery system in other locations, the company didn't reveal any plans to export the technology just yet. "Our ability to do heat recovery depends on a number of factors, so we will evaluate them first," said Edelman. For example, the proximity of the data center to the community it can provide heat for will be a key criteria to consider.  Improving data centers' green credentials has been a priority for technology companies as of late. Google recently showcased a new tool that can match the timing of some compute tasks in data centers to the availability of lower-carbon energy.  The platform can shift non-urgent workloads to times of the day when wind or solar sources of energy are more plentiful. The search giant is aiming for "24x7 carbon-free energy" in all of its data centers, which means constantly matching facilities with sources of carbon-free power.


Understanding When to Use a Test Tool vs. a Test System

A system is a group of parts that interact in concert to form a unified whole. A system has an identifiable purpose. For example, the purpose of a school system is to educate students. The purpose manufacturing system is to produce one or many end products. In turn, the purpose of a testing system is to ensure that features and functions within the scope of the software's entire domain operate to specified expectations. Typically a testing system is made of parts that test specific aspects of the software under consideration. However, unlike a testing tool, which is limited in scope, a testing system encompasses all the testing that takes place within the SDLC. Thus a testing system needs to support all aspects of software testing throughout the SDLC in terms of execution, data collection, and reporting. First and foremost, a testing system needs to be able to control testing workflows. This means that the system can execute tests according to a set of predefined events. For example, when new code is committed to a source control repository, or when a new or updated component is ready to be added to an existing application.


Wi-Fi 6E: When it’s coming and what it’s good for

There’s so much confusion around all the 666 numbers, it’ll scare you to death. You’ve got Wi-Fi 6, Wi-Fi 6E – and Wi-Fi 6 still has additional enhancements coming after that, with multi-user multiple input, multiple output (multi-user MIMO) functionalities. Then there’s the 6GHz spectrum, but that’s not where Wi-Fi 6 gets its name from: It’s the sixth generation of Wi-Fi. On top of all that, we are just getting a handle 5G and there already talking about 6G – seriously, look it up – it's going to get even more confusing. ... The last time we got a boost in UNII-2 and UNII-2 Extended was 15 years ago and smartphones hadn’t even taken off yet. Now being able to get 1.2GHz is enormous. With Wi-Fi 6E, we’re not doubling the amount of Wi-Fi space, we're actually quadrupling the amount of usable space. That’s three, four, or five times more spectrum, depending on where you are in the world. Plus you don't have to worry about DFS [dynamic frequency selection], especially indoors. Wi-Fi 6E is not going to be faster than Wi-Fi 6 and it’s not adding enhanced technology features. The neat thing is operating the 6GHz will require Wi-Fi 6 or above clients. So, we’re not going to have any slow clients and we’re not going to have a lot of noise.


AI Tracks Seizures In Real Time

In brain science, the current understanding of most seizures is that they occur when normal brain activity is interrupted by a strong, sudden hyper-synchronized firing of a cluster of neurons. During a seizure, if a person is hooked up to an electroencephalograph—a device known as an EEG that measures electrical output—the abnormal brain activity is presented as amplified spike-and-wave discharges. “But the seizure detection accuracy is not that good when temporal EEG signals are used,” Bomela says. The team developed a network inference technique to facilitate detection of a seizure and pinpoint its location with improved accuracy. During an EEG session, a person has electrodes attached to different spots on their head, each recording electrical activity around that spot. “We treated EEG electrodes as nodes of a network. Using the recordings (time-series data) from each node, we developed a data-driven approach to infer time-varying connections in the network or relationships between nodes,” Bomela says. Instead of looking solely at the EEG data—the peaks and strengths of individual signals—the network technique considers relationships.


How to Calculate ROI on Infrastructure Automation

The equation is simple. You have a long, manual process. You figure out a way to automate it. Ta-da! What once took two hours now takes two minutes. And you save sweet 118 minutes. If you run this lovely piece of automation very frequently, the value is multiplied. Saving 118 minutes 10 times a day is very significant. Like magic. ... Back to the value formula. In real life, there are more facets to this formula. One of the factors that affect the value you get from automation is how many people have access to it. You can automate something that can potentially run 2,000 times a day, every day; this could be a game-changer in terms of value. But if this is something that 2,000 different people need to do, there is also the question of how accessible your automation is. Getting your automation to run smoothly by other people is not always a piece of cake (“What’s your problem?! It’s in git! Yes, you just get it from there. I’ll send you the link. You don’t have a user? Get a user! You can’t run it? Of course, you can’t, you need a runtime. Just get the runtime. It’s all in the readme! Oh, wait, the version is not in the readme. Get 3.0, it only works with 3.0. Oh, and you edited the config file, right?”).


The most in-demand IT staff companies want to hire

Companies want people who are good communicators and who will be proactive--for example, quickly addressing a support ticket that comes in in the morning, so users don't have to wait, Wallenberg added. In terms of security hiring trends, "there have always been really brilliant people who can sell the need for security to the business,'' and that is needed now more than ever in IT, he said. "In a perfect world, it shouldn't have taken high-profile breaches of personal and identifiable information for companies to wake up and say we need to invest more money in it. So security leadership and, further down the pole, they have to sell their vision on steps they need to take to more systematically ensure systems are safe and companies are protected from threats." Because of the current climate, it is also critical that companies are prepared to handle remote onboarding of new tech team members, Wallenberg said. "Companies that adopted a cloud-first strategy years ago are in a much better position to onboard [new staff] than people who need an office network to connect,'' he said. 


An enterprise architect's guide to the data modeling process

Conceptual modeling in the process is normally based on the relationship between application components. The model assigns a set of properties for each component, which will then define the data relationships. These components can include things like organizations, people, facilities, products and application services. The definitions of these components should identify business relationships. For example, a product ships from a warehouse, and then to a retail store. An effective conceptual data model diligently traces the flow of these goods, orders and payments between the various software systems the company uses. Conceptual models are sometimes translated directly into physical database models. However, when data structures are complex, it's worth creating a logical model that sits in between. It populates the conceptual model with the specific parametric data that will, eventually, become the physical model. In the logical modeling step, create unique identifiers that define each component's property and the scope of the data fields.


Microsoft's ZeRO-2 Speeds up AI Training 10x

Recent trends in NLP research have seen improved accuracy from larger models trained on larger datasets. OpenAI have proposed a set of "scaling laws" showing that model accuracy has a power-law relation with model size, and recently tested this idea by creating the GPT-3 model which has 175 billion parameters. Because these models are simply too large to fit in the memory of a single GPU, training them requires a cluster of machines and model-parallel training techniques that distribute the parameters across the cluster. There are several open-source frameworks available that implement efficient model parallelism, including GPipe and NVIDIA's Megatron, but these have sub-linear speedup due to the overhead of communication between cluster nodes, and using the frameworks often requires model refactoring. ZeRO-2 reduces the memory needed for training using three strategies: reducing model state memory requirements, offloading layer activations to the CPU, and reducing memory fragmentation. 


The unexpected future of medicine

Along with robots, drones are being enlisted as a way of stopping the person-to-person spread of coronavirus. Deliveries made by drone rather than by truck, for example, remove the need for a human driver who may inadvertently spread the virus. A number of governments have already drafted drones in to help with distributing PPE to hospitals in need of kit: in the UK, a trial of drones taking equipment from Hampshire to the Isle of Wight was brought forward following the COVID-19 outbreak. In Ghana, drones have also been put to work collecting patients samples for coronavirus testing, bringing the tests from rural areas into hospitals in more populous regions for testing. Meanwhile, in several countries, drones are also being used to drop off medicine to people in remote communities or those who are sheltering in place. Drones have also been used to disinfect outdoor markets and other areas to slow the spread of the disease. And in South Korea, drones have been drafted in to celebrate healthcare workers and spread public health messages, such as reminding people to continue wearing masks and washing their hands.



Quote for the day:

"Leaders must encourage their organizations to dance to forms of music yet to be heard." -- Warren G. Bennis