Daily Tech Digest - October 11, 2020

Could Microsoft be en route to dumping Windows in favor of Linux?

Microsoft has been doing everything in its power to migrate users from the standard client-based software to cloud and other hosted solutions, and its software cash cow has become web-centric and subscription-based. All of those Linux users could still work with Microsoft 365 and any other Software as a Service (SaaS) solution it has to offer--all from the comfort and security of the Linux operating system. That's a win-win for Microsoft and consumers because Windows isn't as much of a headache to deal with (by way of bug hunting and security patching its proprietary solutions), and consumers get a more reliable solution without missing out on anything. If Microsoft plays its cards right, the company could re-theme KDE or just about any Linux desktop in such a way that it's not all that different from the Windows 10 interface. Lay this out right, and consumers might not even know the difference--a "Windows 11" would simply be the next evolution of the Microsoft desktop operating system. Speaking of winning, IT pros would spend less time dealing with viruses, malware, and operating system issues and more time on keeping the network running and secure.


Open sourcer Camunda buffs up RPA platform in an overcrowded market

Speaking to The Register, Camunda CEO and co-founder Jakob Freund said: “We have seen from Camunda customers such as Deutsche Telekom and National Westminster Bank that RPA is a great short-term solution, however it's a highly maintenance-intensive technology. RPA is essentially reading and automating the same user interface that a user would use.” A front-end UI might be in a spreadsheet, a scanned document or even a CRM or ERP system and any changes to it could break bots. “This makes RPA labour intensive,” he said. While Camunda solution may be a step in the right direction, the journey to bot nirvana is a long one. Craig Le Clair, Forrester Research veep, said: “There are many BPM vendors like Camunda that are acquiring or positioning in some way for the RPA or for what we call now Intelligent Automation market." He said Camunda approach was to see RPA thus far as a simple task automation without stronger rules management. It also usually failed to take account of a broader API and UI integration approach.


Google Search As a Vishing Tool: Big Cyber Security Challenge For Bank Customers

The article is based on the analysis of Google search and various cyber crimes cases registered in the cyber crime cells across Indian Territory and cases reported in various banks across India. Google search is the key focus area in this article. Cyber criminals update the name and mobile number in Google search by logging their Gmail account. When bank customer searches contact number of the concerned bank branches/merchants/payment intermediaries for enquiring or resolving the problem, he calls on the mentioned fake mobile number which has been updated by the fraudsters. Consequently, Cyber criminal gets the sensitive financial and secret information from the bank customers in fraudulent manner over phone line for resolving their problem and dupe the bank customers by debiting their bank account. Banks/merchants/payment intermediaries always provide genuine contact numbers at their respective website so that customers can easily access that numbers for establishing communication with banks /merchants/payment intermediaries in case of any related issue. But due to unawareness of phishing and vishing like scam, bank customers are easily duped by the cyber criminals.


How visualizing my Agile backlog improved productivity

One of the key lessons that I’ve had to learn as a UX Designer is how to work with the Agile backlog. Part of that is to understand how User Research and Business requirements can fit together. What I mean by that is that during the discovery phases of projects, you’re likely to also do User Interviews or other research while the Business is forming their backlog. You may have a lot of insights that help inform different backlog items, but these may be things that you find out on your research that no one else on the product team may have encountered. For example, there may be user workarounds to the official process that people don’t necessarily want to advertise, but it’s still useful user insight. So how do you combine these two groups? I initially tried to argue from the backlog standpoint, creating specific backlog items, but it was hard for members of the team to get on board with these things. Because even if they trust you that you did good research, it’s something that they’re not familiar with. And that’s exactly what was happening. People would view an isolated business requirement and change the wording or not realize what we were trying to say, without realizing how it might impact other items or the big picture.


Curiosity Artificial Intelligence: A Know-All Guide

If we take humans as an example, curiosity is what makes us learn things. Starting from a stage when humans get maturity, he/she becomes curious about the movements around them and learns from it. Then think about AI getting curious. AI is already known for its features that have reached the cliff by its technological improvements. AI has surpassed human abilities by making predictions and decisions in a split second by going through all the data. When we compare human curiosity with AI curiosity, AI emulates the behaviour in an algorithm that could enhance the potential for self-directed machine learning so that AI system would be driven to seek out or develop solutions to unfamiliar problems. In artificial intelligence, reinforcement learning (RL) is the process of motivating AI to perform desired behaviour and punishing it for undesired ones. RL seeks a feedback signal that assures that AI is making a step closer towards its goal. It learns observation and experience through the process. Training the AI in positive or negative feedback is up to the person who approaches.


TypeScript creator: How the programming language beat Microsoft's open-source fears

But as TypeScript matured and open source gained acceptance at Microsoft in its pivot from Windows to the cloud, the company would in 2014 shift TypeScript to a model of "open development" via a public repository on GitHub. Using GitHub allowed the community of TypeScript and JavaScript developers to influence its future. Because of that different approach, his team now has "zero distance" to its customers – the developers who use either JavaScript or TypeScript. "There's open source in the technical sense in that you give people your source code and give away your intellectual property rights, and technically that's open source," explains Hejlsberg. "But then there's open development, where you actually do your entire development process in the open, which we've been doing now since TypeScript moved to GitHub in 2014."  Today, GitHub, which Microsoft acquired in 2018 for $7.5bn, is where the TypeScript team of about 20 Microsoft engineers do all its daily work, allowing for a "closeness to our customers like nothing I've seen before".


The Disruption Era: The Future Of Coworking

Indeed, technology is unquestionably going to be a crucial point. A short report from CBInsights shows the “office of the future” will probably have voice tech systems to avoid touching, as well as autonomous cleaning solutions; air-improving systems to make us more productive; sensors to count people in rooms, along with a wellness check at the entry. One other important point is sustainability. Since workers spend most of their time indoors, it’s crucial to make that environment livable and sustainable. According to Accenture, just 11% of the employees are completely satisfied with their workspace. Also, many governmental initiatives plan to cut carbon footprints down by developing nearly zero-energy consumption buildings. Some companies also have come up with different solutions to reduce energy usage, such as solar panels, systems that use rain or water energy as well as some innovative solutions like converting workers’ footsteps into data and energy. According to the global coworking community GCUC, while the U.S. and Europe are expected to grow slowly, China is catching up fast and is expected to step over within the next few years, as the global number of coworking spaces increases by over one-third by 2022.


Visa Alert: POS Malware Attacks Persist

The three POS malware variants that targeted one hospitality company in June were identified as RtPOS, MMon and PwnPOS, according to the Visa report. "There is evidence to suggest that the actors employed various remote access tools and credential dumpers to gain initial access, move laterally and deploy the malware in the POS environment," according to the report. The malware variants are designed to scrape payment card data from Windows-based POS devices, but each performs its functions differently, according to the report. The RtPOS malware uses a specialized algorithm to check for payment card data before bundling the information into a file that the fraudsters later exfiltrates through a command-and-control server, the report notes. The MMon malware, on the other hand, deploys a command-line memory scraping technique that collected payment card data from a POS device's memory. The Visa report notes this malicious code, in use since 2010, frequently is customized. The PwnPOS malware creates persistence within POS devices and attempts to scrape payment card data from memory.


Quantum is years away, but business case can be made today

Working with D-Wave, Accenture ran a test using quantum annealing to demonstrate that there are benefits to using quantum techniques over traditional methods when hundreds of assets and/or factors are involved in the calculation. According to BBVA, the promising results have convinced the team to continue its investigation of this case with other technologies. Discussing the potential impact of quantum computing on financial services, Carlos Kuchkovky, global head of research and patents at BBVA, said:“Although this technology is still in an early stage of development, its potential to impact the sector is already a reality. Our research is helping us identify the areas where quantum computing could represent a greater competitive advantage, once the tools have matured sufficiently. We believe this will be, for certain concrete tasks, in the next two to five years.”  Alan Baratz, CEO of D-Wave, said: “Quantum computing is poised to fundamentally transform the way businesses – especially large-scale enterprises – solve critical problems. As enterprise leaders and decision-makers rethink business processes to become more agile and innovative, they need the tools and support to turn their ideas into quantum applications that have a real impact on their business.


Dr Lal Pathlabs data leak: Legal opinions on liabilities, punishments ...

The company now claims that the loophole has been patched but there is no explanation about the magnitude of information leaked online. With sensitive personal data leak happening every now and then, The420 team spoke to legal and cyber experts to find out legal liabilities and punishment in such cases. All the cyber experts unanimously said it is the companies’ responsibility to ensure the safety of their customers’ data. Patching the loophole is the bare minimum expected from them. Experts highlighted that private companies are not serious about data protection which can also be gauged by the amount they spend on its security. Explaining the legal action in such cases, Delhi based senior lawyer Karnika Seth said, “Section 43 A of the IT Act, 2000 requires companies to safeguard personal data and personally sensitive data. Health records are sensitive data. ISO 27001 certification is one of the standards required to comply with extant data protection measures.” Explaining other legal provisions in such cases, Mumbai based Dr Prashant Mali, Cyber & Privacy Expert Lawyer said, “Section 85 of the IT Act, 2000 deals with the offence by companies and Section 72A deals with a contractual data breach. The law is stringent implementation after 19 years of law in force is pathetic and no awareness.”



Quote for the day:

"Make sure you have finished speaking before your audience has finished listening." -- Dorothy Sarnoff

Daily Tech Digest - October 10, 2020

Internet of Things Applications

IoT applications can transform reactive medical-based systems into active wellness-based systems. Resources that are used in current medical research lack important real-world information. It uses controlled environments, leftover data, and volunteers for clinical trials. The Internet of Things improves the device's power, precision and availability. IoT focuses on building systems rather than just tools. Here's how the IoT-enabled care device works. ... Most of you have heard about the term smart city. Smart city uses technology to provide services. The smart city includes improving transportation and social services, promoting stability and giving voice to their citizens. The problems faced by Mumbai are very different from Delhi. Even global issues, such as clean drinking water, declining air quality, and increasing urban density, occur in varying intensity cities. Therefore, they affect every city. Governments and engineers use the Internet of Things to analyze the complex factors of town and each city. IoT applications help in the area of water management, waste control and emergencies. ... By the year 2050, the world's growing population is estimated to have reached about 10 billion. To feed such a large population, agriculture needs to marry technology and get the best results.


Learning from Bugs and Testers: Testing Boeing 777 Full Flight Simulators

Every failure is an opportunity to learn something. Finding and fixing a bug is great, but understanding why the bug is there is where you learn even more. It might be a requirement that wasn’t properly formulated, implemented, tested, or anything else. As a software tester, imagine that a bug you have reported was caused by an untrapped exception in a division by zero. If you saw that bug several times or if your software is mission-critical then it is worth asking every team to check if they have encapsulated all code where they perform a division with a “try catch” statement. The Ariane 5 Rocket blew up because of untrapped exceptions: There go half-a-billion dollars and a dent in reputation. The US Air Force almost lost an F-22 squadron (state-of-the-art fighter jets valued $350 million a pop) when they flew over the International Date Line (IDL) leaving the pilots with only flight controls (dedicated and separated computers). When you cross the IDL the “time” skips by one day depending on your direction of travel. A space probe crashed on Mars because the software testers forgot to test what would occur when sensors are sending erroneous data to the mission computer.


55 New Security Flaws Reported in Apple Software and Services

A team of five security researchers analyzed several Apple online services for three months and found as many as 55 vulnerabilities, 11 of which are critical in severity. The flaws — including 29 high severity, 13 medium severity, and 2 low severity vulnerabilities — could have allowed an attacker to "fully compromise both customer and employee applications, launch a worm capable of automatically taking over a victim's iCloud account, retrieve source code for internal Apple projects, fully compromise an industrial control warehouse software used by Apple, and take over the sessions of Apple employees with the capability of accessing management tools and sensitive resources." The flaws meant a bad actor could easily hijack a user's iCloud account and steal all the photos, calendar information, videos, and documents, in addition to forwarding the same exploit to all of their contacts. The findings were reported by Sam Curry along with Brett Buerhaus, Ben Sadeghipour, Samuel Erb, and Tanner Barnes over a three month period between July and September. After they were responsibly disclosed to Apple, the iPhone maker took steps to patch the flaws within 1-2 business days, with a few others fixed within a short span of 4-6 hours.


An introduction to Windows 10’s new PowerToys

Over the past few months, PowerToys has really cleaned up its installation and update capabilities. Versions 0.18.2 and earlier would require users to jump into Task Manager and terminate various processes and applications before its installation could complete. Via Twitter, one of team leader Clint Rutkas’ associates informed me this was because of the program’s inclusion of the Core .NET DLLs into PowerToys. But as of release v0.20.1, PowerToys handles all open applications without issue. Now, it simply asks for permission to restart the Windows Explorer (process name: explorer.exe) as it finishes up updating or installing itself. Speaking of updates, Rutkas and his programmers are working hard to push frequent updates to PowerToys. A look at the Releases page shows eight releases since early June, or about two per month. ... Pressing and holding the Windows key causes an overlay showing a list of Windows-key shortcuts to appear on the primary Windows display. Once shown, that menu — a.k.a. the Shortcut Guide — persists as long as the winkey remains depressed. These shortcuts, or key combos, require that the Windows key and the named key be depressed together.


3 ways criminals use artificial intelligence in cybersecurity attacks

Generative Adversarial Networks (GANs) are basically two AI systems pitted against each other—one that simulates original content and one that spots its mistakes. By competing against each other, they jointly create content convincing enough to pass for the original. Nvidia researchers trained a unique AI model to recreate PAC-MAN simply by observing hours of gameplay, without a game engine, as Stephanie Condon explained on ZDNet. Bandos said that attackers are using GANs to mimic normal traffic patterns, to divert attention away from attacks, and to find and exfiltrate sensitive data quickly. "They're in and out within 30-40 minutes thanks to these capabilities," he said. "Once attackers start to leverage artificial intelligence and machine learning, they can automate these tasks." GANs also can be used for password cracking, evading malware detection, and fooling facial recognition, as Thomas Klimek described in the paper, "Generative Adversarial Networks: What Are They and Why We Should Be Afraid." A PassGAN system built by machine learning researchers was trained on an industry standard password list and was eventually able to guess more passwords than several other tools trained on the same dataset.


Serverless Horror Stories

One of the well-known challenges of event-driven serverless architectures is the difficulty in tracing requests end-to-end, in order to investigate performance issues. A case in point is when the Segment company encountered a problem with a popular serverless service, DynamoDB. Segment was experiencing a serious performance issue with their DynamoDB instances that was slowing down their entire system. To mitigate this, the company had to increase the provisioned throughput of DB instances, but this in turn vastly increased their AWS bill. When Segment’s own troubleshooting efforts failed to uncover the problem, they asked AWS support for help. Using internal tools, AWS generated a partition heatmap of DynamoDB instances. Although the heatmap was not very readable, they were able to spot a single DB partition that was having performance issues, clearly indicating that their workload was not distributed evenly across partitions. It was still, however, not clear which records or keys were problematic. So Segment continued to investigate the issue and found a relatively trivial bug that was very hard to spot but which, when fixed, reduced their DynamoDB capacity by a factor of four and saved them $300,000 annually.


Travelex Cyber-attack Timeline

We have compiled a detailed timeline of the Travelex cyber-attack based on information that's available freely on the internet and in media reports. Our objective is to simply present this information in an easy-to-consume visual guide that can help cybersecurity practitioners and enthusiasts to get further clarity on what went wrong and how. ... The idea of us creating this timeline is not to vilify/defame any business or victims of a cyber-attack. However, from every cyber incident there is something all of us can learn about covering our bases when it comes to being truly cyber-resilient.  In this case, it appears that the cyber-criminals managed to attack Travelex thanks to the unpatched critical vulnerabilities in its Pulse Secure VPN servers. Hence, the lesson here would be to always ensure that your cybersecurity infrastructure is as updated and foolproof as possible. Regular review of the IT infrastructure is also imperative to ensure that your business is as secure as is possible. ... Amar insists that this initiative isn't aimed at attacking Travelex or any organisation. Our objective to create these attack timelines is purely for educational purposes. Amar has been in the thick of many cyber-attacks and he absolutely understands the pressure, the chaos and the collective desire to do the right thing when in the midst of a major crisis.


How to Build, Deploy, and Operationalize AI Assistants

Some of the issues with non-linear conversations, where the user introduces a new topic in the middle of the conversation or modifies a previous statement, remained. These types of multi-turn conversations are particularly challenging, and they also happen to be the way that most users actually talk. In an effort to resolve some of these issues, the team experimented with Rasa’s TED (Transformer Embedding Dialogue) policy. Using a transformer architecture, the TED policy can selectively pick which conversation turns to pay attention to, and which conversation turns to ignore. Additionally, and perhaps, distinctively in comparison to recurrent neural network architectures, transformers use a self-attention mechanism, by which they’re able to choose which elements in a conversation to pay attention to, in order to make an accurate prediction. In other words, transformers are uniquely equipped to handle non-linear conversations where a user might change topics, engage in chitchat in the middle of a conversation, because they’re less likely to become perplexed when a user does something unexpected. In addition, it provides hyperparameters that can be used to fine-tune the model.


The next frontier for risk tech should be in the cloud

Risk management technology moving to the cloud allows organizations to better incorporate their entire technology stack into their GRC processes. With more available integrations, data can be exchanged more securely and can result in more impactful business insights. And, when information moves seamlessly between applications and platforms, it’s also easier to incorporate more employees and managers into a company’s risk culture and processes. Investing in agile technology gives companies the opportunity to scale, and scale quickly. In a space like GRC and risk management, which relies on data and insights garnered through data, it’s important to not only invest in agile technology but also in software built on a graph database. Graph databases, compared to relational databases, are much more flexible and offer greater user-visibility. Information is more easily stored and the infrastructure allows it to generate relationships between data sets so solutions can unlock more insights and functionality. Now, a cloud-based risk management solution can align with and improve pre-existing processes. As a result, Gartner predicted 100% annual growth through 2022, when naming graph databases one of its biggest data trends.


Data localisation in emerging markets: The case of Turkey

Data localisation requirements under Turkish law have so far been sector-specific and, hence, limited in scope. Several sectors are already under obligation to keep primary and secondary data in Turkey: banking, e-sim technology companies, finance, healthcare and energy. When the social media law discussed above was formally enacted in July 2020, the Turkish ID number requirement for social media logins was dropped and the data localisation measure became a request to the outlets “to take the necessary measures towards hosting Turkey-based users’ data in Turkey” without enforcement. With no clear enforcement mechanism for the data localisation requirement in the Turkish social media law, Turkey diverged from the Russian approach of forced data localisation in social media and approximated to the social media regulation approaches of other G20 member emerging markets such as South Africa and India. Yet another blow towards forced data localization came from the “Personal Data Protection Board” in September 2020, rendering the Convention No. 108 of the Council of Europe (to which Turkey is a signatory) on cross-border transfers of personal data not applicable for Turkey.



Quote for the day:

"Leadership is intangible, and therefore no weapon ever designed can replace it." -- Omar N. Bradley

Daily Tech Digest - October 09, 2020

Elusive hacker-for-hire group Bahamut linked to historical attack campaigns

According to BlackBerry, Bahamut relies heavily on manipulating its victims through a constantly shifting web of fake social media accounts and personas and even fake news websites and applications that don't appear to be malicious and often generate original content. This is meant to exploit the victims' interests and earn their trust. "First encounters with Bahamut begin innocently," the researchers said. "One might start with a simple direct message on Twitter or LinkedIn from an attractive woman, but with no suspicious link to click. Another might occur when scrolling through Twitter or Facebook in the form of a tech news article. Maybe you’d be taking a break at work and checking out a fitness website. Or perhaps you’re a supporter of Sikh rights looking for news about their movement for independence. You’d click, and nothing bad would appear to happen. On the contrary, you’d experience a legitimate, yet fabricated reality." One example is a technology news website that was at some point focused on mobile device reviews. At some point it was taken over by the group and the tone and nature of the articles changed to include security research and geopolitical themes.


Why MSPs Are Hacker Targets, and What To Do About It

Cyber defense doesn't come for free, and this is a significant challenge for MSPs. There are really only two places where an MSP can look to increase security standards for their end customers: The first is convincing the SMB to spend more on security, which is often a difficult upsell given already tight IT budgets. The second is to eat into their thin margins while still maintaining the ability to update defenses as needed by the threat landscape. The vast majority of cybersecurity defense solutions are purpose-built for the enterprise, bringing in a plethora of technology bells and whistles often too overwhelming or unnecessary for the SMB. All too often, there's chatter around cybersecurity proselytizing the merits of artificial intelligence, machine learning, and behavioral analytics — all of which come with high costs. The truth is, MSPs need solutions that cater to their specific needs, not just from a technical point of view but also financial and operational perspectives in order to get to the coveted 80/20. Small businesses have gained operational agility with the rise of the cloud and software-as-a-service, and with that, attackers have evolved to go after the lowest-hanging fruit.


4 common C programming mistakes — and 5 tips to avoid them

Allocated memory (done using the malloc function) isn’t automatically disposed of in C. It’s the programmer’s job to dispose of that memory when it’s no longer used. Fail to free up repeated memory requests, and you will end up with a memory leak. Try to use a region of memory that’s already been freed, and your program will crash—or, worse, will limp along and become vulnerable to an attack using that mechanism. Note that a memory leak should only describe situations where memory is supposed to be freed, but isn’t. If a program keeps allocating memory because the memory is actually needed and used for work, then its use of memory may be inefficient, but strictly speaking it’s not leakage. ... So why is the burden of checking an array’s bounds left to the programmer? In the official C specification, reading or writing an array beyond its boundaries is “undefined behavior,” meaning the spec has no say in what is supposed to happen. The compiler isn’t even required to complain about it. C has long favored giving power to the programmer even at their own risk. An out-of-bounds read or write typically isn’t trapped by the compiler, unless you specifically enable compiler options to guard against it.


Securing mobile devices, apps, and users should be every CIO’s top priority

The current distributed remote work environment has also triggered a new threat landscape, with malicious actors increasingly targeting mobile devices with phishing attacks. These attacks range from basic to sophisticated and are likely to succeed, with many employees unaware of how to identify and avoid a phishing attack. The study revealed that 43% of global employees are not sure what a phishing attack is. “Mobile devices are everywhere and have access to practically everything, yet most employees have inadequate mobile security measures in place, enabling hackers to have a heyday,” said Brian Foster, SVP Product Management, MobileIron. “Hackers know that people are using their loosely secured mobile devices more than ever before to access corporate data, and increasingly targeting them with phishing attacks. Every company needs to implement a mobile-centric security strategy that prioritizes user experience and enables employees to maintain maximum productivity on any device, anywhere, without compromising personal privacy.” The study found that four distinct employee personas have emerged in the everywhere enterprise as a result of lockdown, and mobile devices play a more critical role than ever before in ensuring productivity.


Here Comes the Internet of Plastic Things, No Batteries or Electronics Required

The researchers, who have been steadily working on the technology since their original paper, have leveraged mechanical motion to provide the power for their objects. For instance, when someone opens a detergent bottle, the mechanical motion of unscrewing the top provides the power for it to communicate data. “We translate this mechanical motion into changes in antenna reflections to communicate data,” said Gollakota. “Say there is a Wi-Fi transmitter sending signals. These signals reflect off the plastic object; we can control the amount of reflections arriving from this plastic object by modulating it with the mechanical motion.” To ensure that the plastic objects can reflect Wi-Fi signals, the researchers employ composite plastic filament materials with conductive properties. These take the form of plastic with copper and graphene filings. “These allow us to use off-the-shelf 3D printers to print these objects but also ensure that when there is an ambient Wi-Fi signal in the environment, these plastic objects can reflect them by designing an appropriate antenna using these composite plastics,” said Gollakota.


Robotic Process Automation Is Coming: Here Are 5 Ways To Prepare For It

Typically, the most suitable tasks for RPA relate to “busy work” – meaning any work that involves a great number of repetitive actions, such as opening and searching records, transferring data between different digital locations, and repetitive mouse clicks. These sorts of tasks are prime candidates for automation. At the other end of the scale, jobs that involve creative thought and human decision making generally are not suitable for automation. ... Just because something can be automated doesn't mean it should be. Here, you'll need to identify which – of all the things it's possible to automate – are your key priorities. I recommend focusing on those tasks that help your organization achieve its overall aims, but currently consume a disproportionate amount of employees’ time. It’s usually a good idea to go for “quick wins” first, as these will help to establish the usefulness of RPA while winning over minds that may be resistant to the idea of reducing repetitive workloads or fearful of what it could mean for jobs and organizational culture. ... Having decided on the best ways to deploy RPA in your organization, you can begin researching the technologies that are available and the potential partners you may need to work with to create a successful deployment.


Bridging India’s cybersecurity gender gap

While India produces roughly 1.5 million engineer graduates each year, less than 30% of them are women and too many find it hard to get jobs. Many of them are the products of little-known colleges where they gain limited technical skills and graduate with certificates that few potential employers recognize. At the same time, India’s cybersecurity industry is growing fast. By 2025 it is forecast to be worth USD 35 billion as governments, companies, and startups seek to safeguard data. The demand for skilled cybersecurity workers has soared accordingly, but women still only make up around 11% of the sector’s workforce, both in India and globally. Dhasmana and Vedashree decided two years ago to help bridge that gender gap by setting up CyberShikshaa, which in Hindi means ‘cyber education.’ “As a tech industry organization, Microsoft felt it was our responsibility to create very strong career pathways, especially for young women to join the technology sector,” says Dhasmana. DSCI’s Vedashree says there was a need to evangelize cybersecurity as a career option for new female grads. “So, we aligned our charters for skills development in cyber fields and women in security and crafted this program together.”


Accelerating Digital Transformation with Data, People and Technologies

The first priority in embarking on digital transformation is to make information more accessible to everyone across the organisation. A report from Harvard Business Review shows that 55% of organisations agreed that data analytics for decision-making is extremely important today, and 92% confirmed the increasing importance of data and analytics through 2020 and 2021. Yet, despite the rise in the value of data analytics in the current era, many organisations are burdened with outdated processes. According to IDC, 70% of an analyst’s time is spent searching for data, and 44% of data workers’ time results in unsuccessful attempts. Together with the lack of talented professionals to harness the true power of data, these struggles further refrain business leaders from creating a modern analytic environment for their organisation. With siloed data residing all over the place, one of the key challenges faced by companies is the advent of a variety of tools and platforms, which are either too complicated or lack sufficient training. These tools, therefore, set them back for truly achieving a digital transformation.


Emotet 101: How the Ransomware Works -- and Why It's So Darn Effective

Emotet exists in several different versions and incorporates a modular design. This makes it more difficult to identify and block. It uses social engineering techniques to gain entry into systems, and it is good at avoiding detection. What's more, Emotet campaigns are constantly evolving. Some versions steal banking credentials and highly sensitive enterprise data, which cybercrooks may threaten to release publicly. "This may serve as additional leverage to pay the ransom," Shier explains. An initial e-mail may look like it originated from a trusted source, such as a manager or top company executive, or it may offer a link to what appears to be a legitimate site or service. It usually relies on file compression techniques, such as ZIP, that spread the infection through various file formats, including .doc, docx, and .exe. This hides the actual file name as it moves around within a network. These documents may contain phrases such as "payment details" or "please update your human resources file" to trick recipients into activating payloads. Some messages have recently revolved around COVID-19. They often arrive from a legitimate e-mail address within the company — and they can include both benign and infected files. 


Your next next digital transformation project should look very different

Almost three-quarters (70%) of CIOs agree or strongly agree that the pandemic has increased the collaboration between the technology team and the business; more than half (52%) say it has created a culture of inclusivity within their teams, too. Yet while absence has made the heart grow fonder during the extreme conditions of social distancing, CIOs will have to work hard to ensure the close virtual bonds that have been fostered during lockdown are able to flourish when we return to something like normal working conditions.  To that end, Haake says her firm's research with KPMG suggests the most important factor for CIOs in the post-COVID age is strong cultural leadership. "That's what a good digital leader is going to have to keep an eye on if they want to be successful," she says. Pioneering CIOs will lead a cultural transformation that hones the capabilities of the IT team and intertwines these talents with the demands of the business. Digital leaders who build that tight bond will be much more likely to deliver timely tech solutions that really do change the business for the better.



Quote for the day:

"The greatest good you can do for another is not just share your riches, but reveal to them their own." - Benjamin Disraeli

Daily Tech Digest - October 08, 2020

What is DevOps? A guide to common methods and misconceptions

DevOps has been defined in many ways: a set of practices that automate and integrate processes so teams can build, test, and release software faster and more reliably; a combination of culture and tools that enable organizations to ship software at a higher velocity; a culture, a movement, or a philosophy. None of these are wrong, and they are all important aspects of DevOps—but they don’t quite fully capture what’s at the heart of DevOps: the essential human element between Dev and Ops teams, when collaboration bridges the gap that allows teams to ship better software, faster. For organizations, DevOps provides value by increasing software quality and stability, and shortening lead times to production. For developers, DevOps focuses on both automation and culture—it’s about how the work is done. But most importantly, DevOps is about enabling people to collaborate across roles to deliver value to end users quickly, safely, and reliably. Altogether, it’s a combination of focus, means, and expected results. The focus of DevOps is people. The means of implementing DevOps is process and tooling. The result of DevOps is a better product, delivered faster and more reliably.


You Don’t Need To Be A Mathematician To Master Quantum Computing

Don’t get me wrong. Math is a great way to describe technical concepts. Math is a concise yet precise language. Our natural languages, such as English, by contrast, are lengthy and imprecise. It takes a whole book full of natural language to explain a small collection of mathematical formulae. But most of us are far better at understanding natural language than math. We learn our mother tongue as a young child and we practice it every single day. We even dream in our natural language. I couldn’t tell if some fellows dream in math, though. For most of us, math is, at best, a foreign language. When we’re about to learn something new, it is easier for us if we use our mother tongue. It is hard enough to grasp the meaning of the new concept. If we’re taught in a foreign language, it is even harder. If not impossible. Of course, math is the native language of quantum mechanics and quantum computing, if you will. But why should we teach quantum computing only in its own language? Shouldn’t we try to explain it in a way more accessible to the learner? I’d say “absolutely”!


From DevOps to DevApps

Perhaps an easier way to think about event-driven is to think in terms of application flows. For example, when a trouble ticket is created in Zendesk, that data can be automatically analyzed by Amazon Comprehend to determine what the customer’s sentiment is (angry, satisfied, or confused). Then purchasing history, warranty information, and other pertinent information stored in a data warehouse like Amazon Redshift can be used to give the customer service rep a complete picture of the customer, to more expediently resolve any issues. One approach to using event-driven architecture utilizes the JAMStack tools, a term coined by Netlify founding CEO, Matt Billman. While WordPress is a platform that is used by an overwhelmingly large number of users deploying websites, the JAMStack is a collection of tools used to deliver web content. JAMStack tools can be used to deploy websites on the edge of the network, by reducing the number of database calls and bringing content closer to the user via CDN. However, you can also extend that stack by adding additional cloud native services, such as AuthO for authentication. In a web app that collects user data, information could be stored in Airtable.


Digital transformation: The new rules for getting projects done

"Amidst all the misery, this has been a great opportunity to fast-forward a lot of changes that were on the stocks anyway," says Copinger-Symes. "So I wouldn't want to say it's been positive, because that would undercut the tragedies out there, but I think we've adjusted in stride and there are a lot of opportunities to look out for, too." Like other organisations, the UK military has to put its five-year plan for tech-led change on the back-burner while it deals with the priorities of the pandemic. However, this change in emphasis has helped the organisation to reprioritise – and Copinger-Symes hopes the move away from a slower planning cycle is permanent, particularly when it comes to tech. "That has to change, because increasingly our competitiveness is found through the software not the hardware. And if you adopt decade-long planning cycles with software, you're not going to be very competitive," he says. "I think we were being forced to be change our planning to a much shorter loop, so I think this pandemic has accelerated that process. And I'm not saying we're on top of it or we've got it all right, but I think that's just another acceleration of where we were moving anyway – to that software-based view of the world, rather than a hardware view of the world."


Why AWS Recently Open Sourced A GUI Library For IoT Developers

“Developers can model the location and sizes of nodes, edges, and panels, and Diagram Maker renders these as elements on the Diagram Maker canvas. The rendered UI is fully interactive and lets users move nodes around, create new edges, or delete nodes or edges,” says the AWS team. Diagram Maker also gives developers the ability to layout a given graph via an API interface automatically. With this feature, application developers can visualise the relationships by having the layout-related information connected to the resources, even if they are built outside the editor. In addition, application developers can use Diagram Maker’s capabilities for use cases that are outside of IoT. For example, with Diagram Maker, application developers can improve the experience for end customers by letting them to intuitively and visually design cloud resources needed by cloud services like Infrastructure as Code (AWS CloudFormation) or Workflow Engines (AWS Step Functions) so as to figure out the various relationships and hierarchies, according to AWS. Alternatively, IoT application developers can utilise the Diagram Maker’s plugin interface to author reusable plugins which can extend the Diagram Maker’s core features.


Setting Up for Success: Governing Self-Service BI

With an increased number of users given access to the data layer, more reports and dashboards are generated to support business decisions, especially in the early stages of self-service BI adoption. When multiple individuals utilize the same data source at different times, it can lead to discrepancies in the data reported and redundant reports and dashboards generated from the same data set. Different business users also create their own versions of data sets derived from huge and more complex data sets. These activities, when compounded, will eventually lead to inconsistent reporting, which can set back executives making time-sensitive, data-driven business decisions. ... It’s not surprising how often and soon organizations run into performance issues with their self-service BI tools. Redundant data sets and reports can increase the load on systems, leading to capacity issues. Though some of the most powerful BI tools available provide best practices to improve report development, load testing, and capacity management, it still boils down to how end users are handling the technology in the absence of effective governance. ... An overloaded system, with redundant data sets and reports, may still have recourse, but when a security breach happens, it is one of the hardest setbacks that CIOs and organizations endure. 


The Changing Role of Data & the Chief Data Officer

In the short term, we’ve seen organizations increasingly focus on their data strategy. Data management has become a lot more important because organizations have to truly understand and trust their data. And especially for things like contact tracing, you have the right contact data. In that context, as part of a data coalition of my fellow CEOs, I wrote directly to Congress about the need for valid, reliable data to help us fight the pandemic in a much more thoughtful, data-driven way. We also worked very closely with one of the hardest hit states in the early days of the pandemic. They struggled because they didn’t have the necessary technology. They needed to get the right data quality to analyze health issues and figure out where the virus was spreading. We helped them leverage our technology to understand how to bring the right equipment—PPE, ventilators—to the right hospitals to the right patients at the right time. And just as innovative enterprises around the globe have leveraged data to transform themselves to serve their customers better and improve their products and services, we recommended that the government do the same. The government is the biggest employer in the US.


What CIOs need to know about hardening IT infrastructure

The good news is that infrastructure hardening technologies are readily available and can be added to existing environments, often with minimal disruption to production activities. However, to be extra prudent, it's important to test hardening products in a test environment -- if available -- to protect the integrity of production systems. ... In addition to the hardware and software tools that act as active frontline defense methods to hardening IT infrastructures, CIOs should consider establishing policies and procedures for infrastructure hardening. It may be that hardening activities are part of day-to-day IT operations, but it also makes sense to document these activities, especially if an IT audit is being planned. IT general controls (ITGCs) include numerous controls and metrics examined by IT auditors. Activities and initiatives mentioned above are among the ITGCs being audited. Key ITGCs include organization and management, communications, logical access security, physical and environmental security, change management, risk management, monitoring of controls, system operations, system availability, backup and recovery, incident management, and policies and procedures.


How Redis Simplifies Microservices Design Patterns

Microservice architecture continues to grow in popularity, yet it is widely misunderstood. While most conceptually agree that microservices should be fine-grained and business-oriented, there is often a lack of awareness regarding the architecture’s tradeoffs and complexity. For example, it’s common for DevOps architects to associate microservices to Kubernetes, or an application developer to boil implementation down to using Spring Boot. While these technologies are relevant, neither containers nor development frameworks can overcome microservice architecture pitfalls on their own — specifically at the data tier. Martin Fowler, Chris Richardson, and fellow thought-leaders have long addressed the trade-offs associated with microservice architecture and defined characteristics that guide successful implementations. These include the tenets of isolation, empowerment of autonomous teams, embracing eventual consistency, and infrastructure automation. While keeping with these tenets can avoid the pains felt by early adopters and DIYers, the complexity of incorporating them into an architecture amplifies the need for best practices and design patterns — especially as implementations scale to hundreds of microservices.


The End of the Privacy Shield Agreement Could Lead to Disaster for Hyperscale Cloud Providers

Companies like Amazon Web Services (AWS), Google, and Microsoft were initially happy that SCCs weren’t annulled. But they soon realized how the Privacy Shield ruling could have more adverse consequences for them in the long run. Soon all the three big shots issued statements in a bid to assure the customers that their clouds were still open, with Microsoft assuring their commercial or public sector customers that they could continue using Microsoft service without breaking the European law. However, a few privacy advocates were quick to point out that only those companies who continue to use SCCs can continue providing assurances about data protection from third-party surveillance that are either at rest or in transit. So several of these statements were misleading. Google, for instance, is an electronic communication service provider, as a result of which it falls under both categories. The platform may very well be the largest search engine. Yet, the increasing awareness of data security and privacy might force users to look for other reliable options that assure the more secure sharing of private information online.



Quote for the day:

"Start at the end. You can't tell a story unless you know how it ends." -- Lewis

Daily Tech Digest - October 07, 2020

Tips To Strengthen API Security

Plugging these above holes is a good start. However, these are only defensive measures against known patterns; they aren’t helping you keep guard for nuanced attack types. Ideally, security systems should stop cyberattacks before they even get started. Yet, Eliyahu recognizes a big gap in how APIs are monitored. Organizations “don’t have proper tools to know who is looking for vulnerabilities,” he said. “Tools are typically not that advanced. They mainly look for injections and known patterns.” Imagine a hacker probing an API. They will likely do so by trial and error, testing undocumented endpoints, sending malformed requests and so on. “They need to probe for hours or days before they find something,” said Eliyahu. If an AI could detect these odd attempts in minutes or seconds, IT could significantly reduce risk. Security solutions should thus leverage big data and AI to create baselines of typical behavior, then deter malicious activity the millisecond any nefarious probing begins. Eliyahu said such a security AI must consider dozens of behaviors such as, How is the API being accessed? What parameters are being used? What are the relationships between parameters? What is the flow of API calls? What type of data can be exposed?


UK, French, Belgian blanket spying systems ruled illegal by Europe’s top court

In layman’s terms that means that a government can’t build a massive database of what everyone does and then query it later while investigating a case. Instead, they will need to carry out targeted surveillance and data retention - identifying specific people or accounts or phone numbers - and have a court review those requests to make sure they are not overly broad. The ruling is significant because it directly addresses the issue of national security - something that has been used for years to bypass existing personal data protection legislation - and states categorically that EU privacy laws still apply in such circumstances, almost always. The decision includes a specific carve-out when it comes to national security, noting that “in situations where a Member State is facing a serious threat to national security that proves to be genuine and present or foreseeable, that Member State may derogate from the obligation to ensure the confidentiality of data relating to electronic communications by requiring, by way of legislative measures, the general and indiscriminate retention of that data for a period that is limited in time to what is strictly necessary, but which may be extended if the threat persists.”


New Flaws in Top Antivirus Software Could Make Computers More Vulnerable

According to a report published by CyberArk researcher Eran Shimony today and shared with The Hacker News, the high privileges often associated with anti-malware products render them more vulnerable to exploitation via file manipulation attacks, resulting in a scenario where malware gains elevated permissions on the system. The bugs impact a wide range of antivirus solutions, including those from Kaspersky, McAfee, Symantec, Fortinet, Check Point, Trend Micro, Avira, and Microsoft Defender, each of which has been fixed by the respective vendor. Chief among the flaws is the ability to delete files from arbitrary locations, allowing the attacker to delete any file in the system, as well as a file corruption vulnerability that permits a bad actor to eliminate the content of any file in the system. Per CyberArk, the bugs result from default DACLs (short for Discretionary Access Control Lists) for the "C:\ProgramData" folder of Windows, which are by applications to store data for standard users without requiring additional permissions. Given that every user has both write and delete permission on the base level of the directory, it raises the likelihood of a privilege escalation when a non-privileged process creates a new folder in "ProgramData" that could be later accessed by a privileged process.


How organizations can maintain a third-party risk management program from day one

First and foremost, we really took our time to hire subject matter experts in our industry. We’ve got lots of practitioners that have years and years and years of governance risk and compliance expertise. They’ve run third-party risk programs for some of the largest banks and financial institutions in the world. They’ve run risk programs at heavily regulated industries. Our people, first and foremost, is a huge differentiator. Number two, our products. It’s incredibly configurable, incredibly easy to use. But that’s such a common thing that folks claim. I actually like to say it’s easy to administrate. Some of the platforms that, if you will, we compete with. You can do those things, but you need to pay IT developers or other developers or even the company that you purchase the system from, to configure it for you. From our perspective, we like to empower our clients to really run the programs and configure the applications on their own. And so, from that perspective, I like to say, ease of administration. It’s also easy to use. First and foremost, not just for our clients, but for the vendors. So, think about it, if you’re an important vendor in a vertical like financial services, you’re getting a million of these questionnaires.


Game Development with .NET

All the .NET tools you are used to also work when making games. Visual Studio is a great IDE that works with all .NET game engines on Windows and macOS. It provides word-class debugging, AI-assisted code completion, code refactoring, and cleanup. In addition, it provides real-time collaboration and productivity tools for remote work. GitHub also provides all your DevOps needs. Host and review code, manage projects, and build software alongside 50 million developers with GitHub. The .NET game development ecosystem is rich. Some of the .NET game engines depend on foundational work done by the open-source community to create managed graphics APIs like SharpDX, SharpVulkan, Vulkan.NET, and Veldrid. Xamarin also enables using platform native features on iOS and Android. Beyond the .NET community, each game engine also has their own community and user groups you can join and interact with. .NET is an open-source platform with over 60,000+ contributors. It’s free and a solid stable base for all your current and future game development needs. Head to our new Game Development with .NET site to get an overview of what .NET provides for you when making games. If you never used Unity, get started with our step-by-step Unity get-started tutorial and script with C# as quick as possible.


Suspected Chinese Hackers Unleash Malware That Can Survive OS Reinstalls

The company discovered the UEFI-based malware on machines belonging to two victims. It works to create a Trojan file called "IntelUpdate.exe" in the Startup Folder, which will reinstall itself even if the user finds it and deletes it. "Since this logic is executed from the SPI flash, there is no way to avoid this process other than eliminating the malicious firmware," Kaspersky Lab said. The malware's goal is to deliver other hacking tools on the victim’s computer, including a document stealer, which will fetch files from the “Recent Documents” directory before uploading them to the hacker’s command and control server. Kaspersky Lab refrained from naming the victims, but said the culprits have been going after computers belonging to “diplomatic entities and NGOs in Africa, Asia, and Europe.” All the victims have some connection to North Korea, be it through non-profit activities or an actual presence in the country. While looking over the malware’s computer code, Kaspersky Lab also noticed the processes can reach out to a command and control server previously tied to a suspected Chinese state-sponsored hacking group known as Winnti. In addition, the security firm found evidence the creators behind the malware used the Chinese language while programming the code.


Q&A on the Book Infinite Gamification

There are two types of gaming to consider here - either they are cheating or they have found a cheap way to score points, a loophole in our program design. For cheats, the best way to deal with this is to have a clear set of rules and principles you expect players to follow, then if you find someone cheating you can call them up and explain they are not acting according to the stated rules of the program. In most cases, the person will desist but sometimes you do need to enforce the ultimate sanction of kicking them off the program. The second type of gaming, finding cheap ways to score points, is for you to fix. The principle here is “don’t blame the gamer, blame the game”. There are lots of techniques you can do - making that activity less valuable, capping the number of points they can earn with that activity, and so on. The book lists these. In order to do this though you need to have framed your program as one that will iterate over time. Too many gamification programs are launched as if these are the final rules and nothing can change - this is a recipe for disaster; most programs aren’t right the first time around. Human nature being what it is, by leaving room to evolve the program, you give yourself the flexibility to get it right over time.


How to Survive a Crisis with AI-Driven Operations

As an enterprise turns to AI during a crisis -- whether for predictive sales modelling or automating customer-center operations -- leaders must prioritize developing employees’ core competencies around AI. Employees skilled in AI will be of course be needed to develop and operate the new automation advancements, but the benefit extends beyond this. AI-skilled employees can be tapped to create a roadmap on how to best leverage the technology to drive business value in times of crisis. Organizations should consider developing internal reskilling and upskilling programs or using third party learning platforms to help employees develop AI specializations. Employees can also be instrumental in galvanizing coworkers to readily adopt new AI technology, accelerating adoption rates as an organization looks to quickly scale up the technology across the business to adjust operations in response to a crisis. Enterprises need a clear data strategy around data governance in order to scale up AI quickly and successfully. Ensuring they have a clear set of repeatable protocols and methodologies in place to help them execute that strategy effectively is critical, so leaders don’t have to worry about compliance as they scale up AI in the face of a crisis.


5 blockchain use cases in finance that show value

Financial institutions traditionally work as intermediaries moving payments between different entities, which involves complex and time-consuming processes that add friction into transactions. Blockchain can streamline these processes -- notably reconciliation as well as clearing and settlement -- by removing the friction, thereby reducing the time and cost that financial institutions incur. For example, in April 2020 European financial technology company SIA launched a blockchain infrastructure to enable the Spunta Banca DLT, a private permissioned distributed ledger technology-based project for interbank reconciliation that is promoted by Italian Banking Association (ABI) and coordinated and implemented by ABI Lab, a banking research and innovation center. "The reconciliation process for interbank transactions in Italy -- formerly governed by the spunta process -- has been notoriously complex," said Charley Cooper, managing director at R3, an enterprise blockchain technology company. "With multiple parties involved, the task of identifying and addressing inconsistencies has historically been hampered by a lack of standardization, the use of piecemeal and fragmented communication methods and no single version of the truth," he added.


Cloud data management – the post-Covid future of data protection for MSPs

The dynamic changes in 2020 have emphasized just how much MSPs need to be on the front foot with innovative data management solutions. And those that are pivoting to cloud data management are seeing both a boost in their revenue, and an ability to Covid-proof operations. After all, customers with on-site solutions may not be able to get an engineer visit in person. Companies are shrinking, or growing, rapidly, and need to be able to scale up or down accordingly – without hitting the bottom line. And for remote users the expectation is that they can work wherever they need to, whenever they need to. The only way MSPs can help companies meet these challenges is with cloud data management. ... Unify complex data: With a one-stop, cloud-data management platform, MSPs can stream customers' backup, archive and DR data, while offering invaluable insight into entire data estates. This enables them to gain borderless visibility of all critical data, structured and unstructured - from a single control center in real time. Importantly this includes Microsoft 365 and G Suite data. Eliminate downtime: Modern solutions now instantly restore individual files or whole systems, using user-driven recovery methods. 



Quote for the day:

"Distinguished leaders impress, inspire and invest in other leaders." -- Anyaele Sam Chiyson

Daily Tech Digest - October 06, 2020

What is Blockchain as a Service (BaaS) in the Tech Industry?

Blockchain is becoming more and more popular not just in Cryptocurrency but in the financial transactions where security and transparency is a must. However, it is very expensive and technologically complicated to create, maintain, and operate a blockchain. That is why many smaller and mid-level companies are hesitant to invest fully in blockchain even though its advantages are obvious. However, Blockchain as a Service can easily resolve this problem. This is based on the Software as a Service (SaaS) model where a company specifically invests in creating, maintaining, and operating a blockchain. This company can then offer the advantages of blockchain to other companies as a service while charging a fee. They can offer blockchain on any of the available distributed ledgers like Ethereum, Bitcoin, R3 Corda, Hyperledger Fabric, Quorum, etc. along with the peripheral services such as system security, bandwidth management, resource optimization, etc. In this way, many smaller and mid-level companies who don’t want to build and maintain their own blockchain systems from scratch can still obtain the advantages of blockchain for a nominal fee. These companies can focus on their core business and obtain value addition from the blockchain without needing to become experts in the technology.


How companies can overcome the content processing drawbacks of RPA

While the need to enlist assistance from additional software is valid, organisations must be careful about overspending, and ensure that the tools they invest in are for a clear, specific purpose. ... “There’s a couple of different ways for customers to overcome these shortcomings. One is to buy a tailored point solution like an OCR tool, which can extract data from documents, or they could invest in a workflow tool to help them orchestrate robots and humans, or perhaps buy some machine learning from Google to try and extract insights from their complex documents. These tools are designed to solve a very narrow set of problems, within tight parameters. “However, each of these has its own technical challenges; when embarking on one of these projects, you face significant cost, plus you need the right skills and tech to support each initiative. Each use case needs to be treated as an individual project, because you’re effectively buying for that particular need, and if you have lots of different types of data in your organisation, lots of different processes that have this level of unstructured data, you need to start again each time and buy the right solution to fix each individual problem.


Red Hat Envisions Linux Operating System As More Than ‘Just A Commodity’

Enterprise Linux company Red Hat has wanted users to think more of their operating ‘engines’ for some time now, long before the company’s acquisition and integration into the IBM family back in 2018. The company released its Red Hat Enterprise Linux 7 software back in June 2014 and followed up with Red Hat Enterprise Linux 8 in May last year. Known affectionately among the developer cognoscenti as RHEL (pronounced ‘rel’, as in relate, relish or relax), Red Hat has been building its software to specifically align to cloud-native computing, containers (a way of breaking application functions into smaller discrete blocks) and all forms of automation and AI-fuelled autonomous computing. Underpinning all the individual functions that it puts into its enterprise operating system is a desire for departments, teams and individual users to consider the OS as a performance vehicle in and of itself i.e. something more than just a commodity engine. If that sounds like marketing spin, then it probably is… so can the company substantiate any of that gloss and explain how the engine in your computer system might actually change the way we work?


T2 security chip on Macs can be hacked to plant malware; cannot be patched

The attack requires combining two other exploits that were initially used for jailbreaking iOS devices — namely Checkm8 and Blackbird. This works because of some shared hardware and software features between T2 chips and iPhones and their underlying hardware. According to a post from Belgian security firm ironPeak, jailbreaking a T2 security chip involves connecting to a Mac/MacBook via USB-C and running version 0.11.0 of the Checkra1n jailbreaking software during the Mac’s boot-up process. Per ironPeak, this works because “Apple left a debugging interface open in the T2 security chip shipping to customers, allowing anyone to enter Device Firmware Update (DFU) mode without authentication.” “Using this method, it is possible to create an USB-C cable that can automatically exploit your macOS device on boot,” ironPeak said. This allows an attacker to get root access on the T2 chip and modify and take control of anything running on the targeted device, even recovering encrypted data […] The danger regarding this new jailbreaking technique is pretty obvious. Any Mac or MacBook left unattended can be hacked by someone who can connect a USB-C cable, reboot the device, and then run Checkra1n 0.11.0.


Classifying Your Third Parties: An Essential Third Party Due Diligence First Step

Of course, this brings us to ask when a company “knows” that a third party will make an improper payment. Under the FCPA, a person has the requisite knowledge to be liable when he or she is aware of the potential wrongdoing, cognizant of a high probability of the existence of such wrongdoing, or intentionally ignorant of the potential wrongdoing. In other words, Congress did not want to allow people to “sneak around” the FCPA by using a third party. As Congress made clear, it meant to impose liability not only on those with actual knowledge of wrongdoing, but also on those who purposefully avoid actual knowledge: [T]he so-called “head-in-the-sand” problem – variously described in the pertinent authorities as “conscious disregard,” “willful blindness” or “deliberate ignorance” – should be covered so that management officials could not take refuge from the Act’s prohibitions by their unwarranted obliviousness to any action (or inaction), language or other “signaling device” that should reasonably alert them of the “high probability” of an FCPA violation.”


People-focused digital transformation: What benefit does it have for your employees?

“Digitally mature” companies, where leadership teams are proactively jumping on and implementing digital trends, are increasingly becoming a must-have for job-seekers. From attracting to retaining talent, organizations that are pioneering a digital strategy for their processes, efficiently using technology and adapting in line with digital, will undoubtedly see more success than organizations that don’t. The focus is no longer just on what an employee can bring to a company but also on what the company can deliver to the employee to develop their skill sets in preparation for the next step of their career. And, with research revealing that the benefits of a digital-first company include improved operational efficiencies as well as having a faster time to market, it’s clear why a prospective employee would opt for a digitally transformed company over one that still runs with mostly manual processes. Factors such as remote working, the use of technology to improve productivity and developing skills away from an office-based environment can lead to people enjoying their jobs more.


New ransomware vaccine kills programs wiping Windows shadow volumes

This weekend, security researcher Florian Roth released the 'Raccine' ransomware vaccine that will monitor for the deletion of shadow volume copies using the vssadmin.exe command. "We see ransomware delete all shadow copies using vssadmin pretty often. What if we could just intercept that request and kill the invoking process? Let's try to create a simple vaccine," Raccine's GitHub page explains. Raccine works by registering the raccine.exe executable as a debugger for vssadmin.exe using the Image File Execution Options Windows registry key. Once raccine.exe is registered as a debugger, every time vssadmin.exe is executed, it will also launch Raccine, which will check to see if vssadmin is trying to delete shadow copies. If it detects a process is using 'vssadmin delete' or 'vssadmin resize shadowstorage' it will automatically terminate the process, which is usually done before ransomware begins encrypting files on a computer. It should also be noted that Raccine may terminate legitimate software that uses vssadmin.exe as part of their backup routines. Roth plans on adding the ability to allow certain programs to bypass Raccine in the future so that they are not mistakenly terminated.


The Abyss of Ignorable: A Route into Chaos Testing from Starling Bank

Imagine if every abstraction came with a divinely guaranteed SLA. (They don’t.) Every class and method call, every library and dependency. Pretend that the SLA is a simple percentage. (They never are.) There are some SLAs (100%, fifty nines) for which it would be wrong to even contemplate failure let alone handle it or test for it. The seconds you spent thinking about it would already be worth more than the expected loss from failure. In such a world you would still code on the assumption that there are no compiler bugs, JVM bugs, CPU instruction bugs - at least until such things were found. On the other hand there are SLAs (95%, 99.9%) for which, at reasonable workloads, failure is effectively guaranteed. So you handle them, test for them and your diligence is rewarded. We get our behaviour in these cases right. We rightly dismiss the absurd and handle the mundane. However, human judgement fails quite badly when it comes to unlikely events. And when the cost of handling unlikely events (in terms of complication) looks unpleasant, our intuition tends to reinforce our laziness. A system does not have to be turbulent or complex to expose this. 


Announcing third-party code scanning tools: static analysis & developer security training

Code scanning is a developer-first, GitHub-native approach to easily find security vulnerabilities before they reach production. Code scanning is powered by GitHub’s CodeQL static scanning engine and is extensible to include third-party security tools. Extensibility provides a lot of flexibility and customizability for teams while maintaining the same user experience for developers. This capability is especially helpful if you: Work at a large organization that’s grown through acquisitions and has teams running different code scanning tools; Need additional coverage for specific areas such as mobile, Salesforce development, or mainframe development; Need customized reporting or dashboarding services; Or simply want to use your preferred tools while benefiting from a single-user experience and single API. What makes this possible is GitHub code scanning’s API endpoint that can ingest scan results from third-party tools using the open standard Static Analysis Results Interchange Format (SARIF). Third-party code scanning tools are initiated with a GitHub Action or a GitHub App based on an event in GitHub, like a pull request. 


It's Not Magic, It's Elastic: Getting Digital Transformation Right

Covid-19 battered many sectors, and the restaurant industry was certainly near the top of the list. Yet while lockdowns and contagion fears cratered restaurant sales in the second quarter of 2020, fast-casual chain and PwC customer Chipotle’s revenue only fell a modest 4.8%. How did they pull that off? By growing digital sales by 216%. By July, the company’s sales were rising again. Digital sales still continued to rise, too. They provided nearly half of Chipotle’s July sales. This is elasticity — a quick pivot to digital sales, then keeping that online revenue growing even as in-person purchases pick up again. Another fast-casual chain, Panera, also pivoted fast during the epidemic’s peak. While on-site dining was shut down, Panera stores sold groceries and offered them for curbside pickup. Or consider lodging, another sector that the epidemic hit especially hard. Red Roof Inns seemed to realize that their “essential” offering was private space with WiFi — so they started offering day rates to people who wanted to work from anywhere but home. These companies were elastic because they built out their digital infrastructure.



Quote for the day:

"If you want people to to think, give them intent, not instruction." -- David Marquet