Daily Tech Digest - April 27, 2021

Engineering Bias Out of AI

Removing bias from AI is not easy because there’s no one cause for it. It can enter the machine-learning cycle at various points. But the logical and most promising starting point seems to be the data that goes into it, says Ebert. AI systems rely on deep neural networks that parse large training data sets to identify patterns. These deep-learning methods are roughly based on the brain’s structure, with many layers of code linked together like neurons, and weights given to the links changing as the network picks up patterns. The problem is, training data sets may lack enough data from minority groups, reflect historical inequities such as lower salaries for women, or inject societal bias, as in the case of Asian-Americans being labeled foreigners. Models that learn from biased training data will propagate the same biases. But collecting high-quality, inclusive, and balanced data is expensive. So Mostly AI is using AI to create synthetic data sets to train AI. Simply removing sensitive features like race or changing them—say, increasing female salaries to affect approved credit limits—does not work because it interferes with other correlations.


Five types of thinking for a high performing data scientist

System-as-cause thinking - a pattern of thinking that determines what to include within the boundaries of our system (I.e., extensive boundary) and the level of granularity of what is to be included (I.e., intensive boundary). The extensive and intensive boundaries depend on the context in which we are analyzing the system and what is under the control of the decision maker vs what is outside their control. Data scientists typically work with whatever data that has been provided to them. While it is a good starting point, we also need to understand the broader context around how a model will be used and what is it that the decision maker can control or influence. For example, when building a robo-advice tool we could include a number of different aspects ranging from macro-economic indicators, asset class performance, company investment strategies, individual risk appetite, life-stage of the individual, health condition of the investor etc. The breadth and depth of factors to be included depends on whether we are building a tool for an individual consumer, an advisor, a wealth management client, or even a policy maker in the government. 

A software bug let malware bypass macOS’ security defenses

“The malware we uncovered using this technique is an updated version of Shlayer, a family of malware that was first discovered in 2018. Shlayer is known to be one of the most abundant pieces of malware on macOS so we’ve developed a variety of detections for its many variants, and we closely track its evolution,” Bradley told TechCrunch. “One of our detections alerted us to this new variant, and upon closer inspection we discovered its use of this bypass to allow it to be installed without an end user prompt. Further analysis leads us to believe that the developers of the malware discovered the zero-day and adjusted their malware to use it, in early 2021.” Shlayer is an adware that intercepts encrypted web traffic — including HTTPS-enabled sites — and injects its own ads, making fraudulent ad money for the operators. “It’s often installed by tricking users into downloading fake application installers or updaters,” said Bradley. “The version of Shlayer that uses this technique does so to evade built-in malware scanning, and to launch without additional ‘Are you sure’ prompts to the user,” he said.


Top 3 Challenges for Data & Analytics Leaders

First and foremost, basic learning dictates that you can’t use data to drive every action until you give every decision maker access to data and the tools to act on it. In essence, you have to approach data strategically — in a way that makes it available across departments and business users. This will amp up the data literacy and embed fact-based decision making into organizational culture. Secondly, I’ve also been known to have TV screens installed that show the latest dashboards to encourage executive buy-in. Now, executives stand in the hallway to consult them daily; it publicizes how leadership makes decisions and sets an example for the entire enterprise. ... Hard benefits such as new revenue streams, improved operations, improved customer engagement, cost reduction and risk avoidance can be quantified. This can be achieved by using financial models that incorporate cost, benefits and risks to get to the ROI, net present value (NPV), and payback period. However, the causal link between D&A and soft benefits— like productivity gains or continued innovation across the organization from culture change — remains elusive for me.


My Favorite Microservice Design Patterns for Node.js

Getting a microservice-based architecture to work around asynchronous events can give you a lot of flexibility and performance improvements. It’s not easy, since the communication can get a little bit tricky and debugging problems around it even more so. Since now there is no clear data flow from Service 1 to Service 2. A great solution for that is to have an event ID created when the client sends its initial request, and then propagated to every event that stems from it. That way you can filter around the logs using that ID and understand every message generated from the original request. Also, note that my diagram above shows the client directly interacting with the message queue. This can be a great solution if you provide a simple interface or if your client is internal and managed by your dev team. However, if this is a public client that anybody can code, you might want to provide them with an SDK-like library they can use to communicate with you. Abstracting and simplifying the communication will help you secure the workflow and provide a much better developer experience for whoever is trying to use them.


Essential Rules For Autonomous Robots To Drive A Conventional Car

A driving robot could be more readily shared around and used on a widespread basis. A true self-driving car with built-in capabilities is merely one car. A driving robot could drive any conventional car. As such, the driving robot has greater utility, plus the cost of the driving robot can be spread amongst a multitude of users or owners in a more versatile way than could a singular self-driving car. A driving robot might provide additional uses. A true self-driving car has just one purpose, ostensibly it is a car that drives and that is all that it does (though, notably, this is a darned impressive act!). A driving robot might be able to perform other tasks, such as being able to get out of the car and carry a delivery package to the door of a house. Note that this is not a requirement per se and merely identifiable as potential added use that might be devised. There are also various disadvantages of using a driving robot versus aiming to utilize or craft a true self-driving car, which I won’t delineate those shortcomings here. I urge you to take a look at my earlier article on the topic to see the articulated list of downsides or drawbacks.


Reinforcement Learning for Production Scheduling

Given a set of heterogeneous machines and a set of heterogeneous production jobs, compute the processing schedule that minimizes specified metrics. Heterogeneous means that both, the machines and the jobs can have different properties, e.g. different throughput for the machines and different required processing time for the jobs, and many more in practice. Additionally, the real problem is complicated by a set of imposed constraints, e.g. jobs of class A cannot be processed on machines of class B, etc. Theoretically, this problem is a complicated instance of the “Job scheduling” problem which together with the “Capacitated vehicle routing” is considered to be a classic of Combinatorial Optimization (CO). Though this problem is NP-hard (no exact solution in polynomial time), it is rather well-studied by the CO community, which offers a handful of methods to solve its theoretical (simplified) version. However, the majority of the methods cannot cope with real-world problem sizes or additional constraints that I’ve mentioned above. That is why most of the time people in the industry resort to some form of stochastic search combined with domain-specific heuristics.


How to empower your chief information security officer (CISO)

The new remote working environments that have been ushered in as a result of the pandemic has expanded the attack surface, meaning a need for added visibility over the network for the CISO. According to Adam Palmer, chief cyber security strategist at Tenable, clear communication with the organisation’s board about possible risks can go a long way in empowering security leadership. “CISOs will need to be aware, and effectively list the vulnerabilities before they inform the board of directors of what is being done and how to reduce and address them,” said Palmer. “By using a risk-based approach CISOs can profile the distributed risk across the extended enterprise, and explain this in the boardroom in the same business terms other functions use so all can understand and evaluate any controls that need to be implemented to address that risk effectively and cost-efficiently. “It will be tempting for management to purchase additional tools to alleviate the overall risk levels, and it is important to remember that a magic bullet is not the only solution.


IT Meets Finance: How CFOs Drive Digital Success

CFOs are no longer bean counters with a fierce grip on the checkbook. Being a CFO today is about leadership -- understanding the growth levers that drive the business and the investments needed to get there. Right now, that growth driver is digital transformation. CFOs now must have a strong understanding of technology. CFOs are data-driven and are using predictive analytics and machine learning to ensure initiatives are driving real impact. CFOs should ask for data that indicates transformation efforts are maximizing ROI and driving tangible value across the business. They're looking to quantify the success of their digital transformation investments. ... CFOs are central to strategic decisions about transformation. They are focused on helping their companies not only survive the current climate but also come out stronger on the other side. While it can be hard for organizations to overhaul in the midst of uncertainty, it's the CFO's job to really advocate for and invest in projects that will push the business forward. CFOs can ensure investments impact every aspect of the business and drive more engagement and commitment from business leaders, ultimately ensuring better success.


Attackers can teach you to defend your organization against phishing

Should the attacker’s email manage to evade your mail gateway, the goal is to trick an employee into performing an action that executes a malicious payload. This payload is designed to exploit a vulnerability and provide the attacker with access to the environment. Ideally, you’ve got code execution policies in place so only certain types of files can be executed. You can prevent anything that’s delivered by email to be executed, to restrict things as much as you possibly can. The attacker knows this and is constantly trying to work around it, which is why you need to maintain an ability to detect the execution of malicious payloads from phishing emails on employee endpoints. But how? Design and frequently run test cases that simulate malicious payloads being executed on your employee endpoints. Monitor logs and alerts when performing code execution test cases to validate that you have both the necessary coverage and telemetry to recognize indicators of compromise. Where blind spots in telemetry are identified, develop and validate new detection use cases.



Quote for the day:

"Coaching is unlocking a person's potential to maximize their own performance. It is helping them to learn rather than teaching them." -- John Whitmore

Daily Tech Digest - April 26, 2021

Technology, Management or Data? How To Choose Your Career

Dr Sarkar stated, “Given the current job landscape, the methods of pursuing degrees and programs are evolving and getting digitised. Let’s take a look at a couple of examples, such as MTech Programs and MBA Programs. Classically, they are about depth in specific branches. Now, an MTech program or MBA program no longer includes only the core disciplines, rather, it has become a fusion of important disciplines required to solve real-time problems.” “Therefore, even if you are trying to think of yourself as going through the technology route, doing an MTech program, you will probably end up doing a fair amount of business applications using data, given the kinds of projects and courses. Similarly for an MBA program, you will go beyond the core disciplines and you will also use data and technology. The traditional programs are evolving to fit today’s workplace,”he added. At present, data holds a special place among organisations. This is one of the reasons why data is embedded within the current programs. The deployment of data is done through technology, for instance through cloud-based applications, he said.


Connected medical devices brought security loopholes mainstream

First, when it comes to firmware updates, it is advisable to initiate an orchestrated process that ensures only authorized administrators can make changes to the device and that the update is applied properly. An update failure should trigger an alert so the device can be otherwise secured or replaced by another device. Second, for patients, cybersecurity leaders must give clear instructions on how to install and configure the device as well as the home network. This will translate into proper operation and a secure connection to transmit encrypted data from patient to doctor. One potential solution is to tailor the device connection type. For example, peer-to-peer connections bypass the public cloud to deliver encrypted information between user and device. Third, for devices, strong authentication with public key schemes is a must. Similar to what is used by online banks, public key authentication uses cryptographic keys to identify and authenticate peers instead of a username and password. Using cryptographic keys for authentication has the advantage that they are practically impossible to brute-force crack and do not require the user to remember anything.


Clean Code for Data Scientist

The number one reason, from my experience, is the nature of our work being “high-risk”. Meaning, when we write the first line of code in the script, we usually don’t know what will happen with it — Will it work? Will it be in production? Will we use it ever again? Is it worth anything? We might end up spending much of our time on risky POCs or one-time data explorations. In those cases, writing the neatest time-consuming code might not be the right way to go. But then, this POC we wrote in a sketchy fashion turns into an actual project, it even gets to production, and its code is a mess! Sounds familiar? Used to happen to me all the time. ... What’s common to all code writers out there is the time aspect. Writing clean code costs more time in the first place since you need to think twice before writing any line of code. We’re always pushed or encouraged to get things done, fast, and it might come at the expense of our code. Just remember — getting things done fast, while in a hurry, can come to bite you later when you’re dealing with bugs on a daily basis. Your time spent writing clean code will for sure pay for itself in the time saved on bugs.


Stop using your work laptop or phone for personal stuff

In the age of remote work, it's easier than ever to blur the lines between our personal and professional tech. Maybe it's sending personal texts or emails from your work phone, editing personal documents or photos on your work laptop, or joining a virtual happy hour with friends from your work tablet. None of these actions may sound like a particularly risky activity, but as a former "IT guy" I'm asking, nay pleading, with you to stop doing them. At least the potentially more hazardous activities, such as storing personal data on your work machine or storing sensitive company data on your personal devices. Do it for the security of your employer. But more importantly, do it for the safety, privacy and wellbeing of yourself, your family and friends. Cybersecurity incidents can have serious negative consequences for both your employer and you. And even if an actual security breach or data leak doesn't occur, you could be reprimanded, demoted, fired, sued or even criminally prosecuted. Take the case of former CIA director John M. Deutch.


The cyber security mesh: how security paradigms are shifting

Without a doubt, the cyber security teams in your business are finding themselves in an increasingly complex situation. The adoption of the cyber security mesh has been effectively accelerated by several drivers, including digital initiatives and the opportunity to take advantage of IoT, AI, advanced analytics and the cloud. These drivers, along with the demand for increased flexibility, reliability and agility, have led more and more businesses to adopt a cyber security mesh. This distributed cyber security approach offers a much-needed chance for increased reliability, flexibility and scalability. ... Ultimately, the continued breakdown of the traditional technology stack with elevated virtualisation of services means the way organisations look to protect themselves is set for an upgrade. Effective cyber security is about being able to match and marry your protection to the circumstances in the world around it. As a society, as technology and even government policy begins to change, so will your points of exposure. Of course, the past year has seen an acceleration in these changes, and this has demonstrated that businesses should be as prepared for the unlikely as they are for the likely, which is exactly what a robust cyber security plan should look like.


Best practices  - code review & test automation.

Doing test automation is about writing code. Test automation code can be easily treated as “second-class citizens”. As it’s not delivered to customers, development is often less formalized and may lack the scrutiny and quality practices otherwise applied in the organization. Lately, I’ve been doing lots of code reviews. ...  All of the reviews exclusively cover end-to-end test automation: new tests, old fixes, config changes, and framework updates. I adamantly believe that test automation code should undergo the same scrutiny of review as the product code it tests because test automation is a product. Thus, all of the same best practices should be applied. Furthermore, I also look for problems that, anecdotally, seem to appear more frequently in test automation than in other software domains. Code review is a very important phenomenon in the SOFTWARE development process. Made popular by the open-source community, it is now the standard for any team of developers. If it is executed correctly, the benefit is not only in reducing the number of bugs and better code quality but also in the training effect for the programmer.


What You Might Not Realize About Your Multi-Cloud Model

It’s common knowledge in the tech world that the vast majority of organizations shifting to public cloud are adopting a mix of hybrid and multi-cloud operating models as part of their cloud strategy. In response, all three of the major cloud providers, including Amazon, Microsoft, and Google, are expanding their service offerings for this positioning. Correspondingly, the market is seeing an uptick in customers that are using these hybrid and multi-cloud environments. According to a recent Gartner research statistic, over 80% of enterprises characterize their strategy as multi-cloud. This can run the gamut from organizations deploying a combination of providers to create a multi-cloud network to firms implementing five or more unique public cloud environments. In reality, while these organizations think they are operating in a multi-cloud environment, they are simply operating “multiple clouds.” This is more than just semantics: Multiple cloud does not equal multi-cloud. And not understanding the nuances may leave a lot on the table when it comes to a CIO managing enterprise IT.


Shift Left: From Concept to Practice

Because developers work with code and in Git, it is logical to apply security controls in Git. Looking at secrets leaks, shifting left means automatically detecting secrets in the code and allowing the different members of the SDLC to collaborate. Remediating secrets leaked in Git repositories is a shared responsibility among developers, operations, and application security (if the secret is exposed in internal code repos) or threat response (if the secret is exposed externally). The processes depend on the organization's size, culture, and how it splits responsibilities among teams. They all need one another, but developers are on the front line. They often know what the leaked secret gives access to. However, they can't always revoke the secret alone because it might affect production systems or fellow developers using the same credentials. Also, it's not only about revoking; it's also about redistributing (rotating), which falls under operations' responsibilities. While remediating, it is also important to keep security professionals' eyes on the issue. They can guarantee that proper remediation steps are followed and guide and educate developers on the risks.


Agile management: How this new way of leading teams is delivering big results

Porter says BP's initial implementations of Agile have helped the company to embed its working processes into various areas of the business. He says the benefits of an Agile way of working are clear. "'It's really liberating' is what we're hearing from the various pilots and work that has started already," he says. "So we're seeing that play out in the broader BP and getting some really good indications back from where we have used Agile in the past and what's coming at us as we embed our design throughout the organisation." The introduction of Agile leadership isn't without its challenges. As managers empower their teams, so they stop being involved in the minutiae of decision-making processes. Get Agile management wrong and there's the possibility for chaos and anarchy. Good Agile managers don't use command-and-control approaches to manage their staff, but they do focus on fostering accountability. Porter says BP wants to avoid diluting the devolved decision-making processes that Agile encourages. Teams at the company are typically organised into small groups of between 10 and 20 people, depending on the organisational context.


How to Prioritize Your Product Backlog

Your product backlog should be a list of all the product-related tasks your team needs to complete, including the division of responsibility and the time frame. The problem is that the list is not intended to be conclusive. It needs to be flexible and will change according to the other things that are happening. For example, a hotshot product release by a competitor may mean you need to release a product update earlier than expected to compete, meaning everything else gets pushed back. Even events such as attending conferences (virtual or in-person) may mean that teams may prioritize sales and marketing visible tasks in an effort to connect with new customers. But the problem occurs when tasks keep getting pushed below the list, and the product manager struggles to maintain momentum to review and organize all the tasks in preference and priority. An effective product backlog list needs to be well structured, organized to be easily read and understood, and arranged to meet the company's strategic needs.



Quote for the day:

"Strong leaders encourage you to do things for your own benefit, not just theirs." -- Tim Tebow

Daily Tech Digest - April 25, 2021

Solving the security challenges of public cloud

Compounding matters is the lack of a unified framework for dealing with public cloud security. End users and cloud consumers are forced to deal with increased spend on security infrastructure such as SIEMs, SOAR, security data lakes, tools, maintenance and staff — if they can find them — to operate with an “adequate” security posture. Public cloud isn’t going away, and neither is the increase in data and security concerns. But enterprise leaders shouldn’t have to continue scrambling to solve these problems. We live in a highly standardized world. Standard operating processes exist for the simplest of tasks, such as elementary school student drop-offs and checking out a company car. But why isn’t there a standardized approach for dealing with security of the public cloud — something so fundamental now to the operation of our society? The ONUG Collaborative had the same question. Security leaders from organizations such as FedEx, Raytheon Technologies, Fidelity, Cigna, Goldman Sachs and others came together to establish the Cloud Security Notification Framework. The goal is to create consistency in how cloud providers report security events, alerts and alarms, so end users receive improved visibility and governance of their data.


Building A Global AI Brand With End-To-End Data Science & Engineering Solutions

At present, people think more from the model design perspective when speaking about data science and analytics than about data engineering. Going forward, model design will not matter much because most algorithms will be available as APIs. In fact, companies like Tredence are building algorithms that have a high degree of verticalization across industries and can be made available as APIs. AI as API is a good differentiation. It allows data scientists to spend less time building algorithms from scratch. Having said that, readily available algorithms can offer only up to 90% accuracy. The true test of a data scientist would be whether he/she can take the accuracy from 90 to 99%. It requires domain expertise, analytical thinking, and the ability to identify edge use cases. Working around biases and long-tail use cases of AI systems would also become very important. While designing algorithms, data scientists often assume that the end-user is AI and not human. There is a need for humanising these systems. Design thinking has seeped into how software is built, next up it should enter AI algorithms.


How to Keep an Innovative Mindset Present In Your Business

It’s essential that managers and executives take accountability and engage employees in more creative ways and foster innovative mindsets. You can do so in many ways, starting with rewarding innovative progress and changing company dynamics. First, you can offer bonuses or other incentives to employees who come up with new ideas for the company. These innovations don’t need to be fully formed or implemented right away. However, this kind of reward system encourages more of the same behavior. Employees will seek to create and flourish once they have the time, resources, and motivation. Then, you can change the way employees interact with the business itself. In traditional models, shareholders or executives own the business. In newer, more innovative dynamics, though, employees can now own parts of the company as well through shares that accrue over time. ... Technology is one of the best signs of innovation. It combines practicality, accessibility, and functionality, which helps it constantly evolve. Something like a smartphone builds on countless previous innovations and uses them to keep creating. The same concept applies to the workplace.


RBI to issue cybersecurity norms for payment services

While the standards for fintech-driven payment services providers will be similar to cyber hygiene norms issued recently for banks and non-banking finance companies, the RBI is quite clear that firms will have to do more than observe the minimum standards to ensure safety as digital transactions gain further traction. “On cyber frauds, Reserve Bank of India has issued very recently basic guidelines on cyber hygiene and cybersecurity for banks and certain NBFCs,” said RBI executive director T. Rabi Sankar. “We would follow that up with respect to other entities such as payments systems operators in the payments space. Those are getting finalised and will be issued soon,” he added. “Having said that, the minimum standards set by the regulator for the regulated entities are needed, but they would never be enough. As digitisation increases in any sphere, payments or otherwise, as people do more and more digital transactions, institutions themselves will have to do more than the minimum standards that regulators set, to deal with any cybersecurity threats,” he said, adding that individual users would also need to be alert as there is no alternative to being aware of the risks in undertaking digital transactions.


The differences between data analytics, machine learning and AI

So, we have three distinct areas of expertise we’ve outlined there. Each has its own applications, subsets, and specialisations, making them very different fields. However, as you may have noticed already, there are certainly some areas where they overlap. Below, we’ve outlined just some of the ways in which machine learning, data analytics, and AI overlap: Data-driven. Each of these areas relies on analysing huge amounts of data. The more information available, the more effective they are at producing results. It often takes a lot of computer processing power to manage such large data sets; Insights. Data analytics, AI, and machine learning can all be used to produce detailed insights in particular areas. By examining data, each can identify patterns, highlight trends, and provide valuable and actionable outcomes; Predictive models. These technologies can also help to create forecasts and predictions based on existing data. Again, this process can help organisations of all kinds plan for the future and make informed decisions. Of course, many other areas relate closely to those of AI, ML, and data analytics.


GoodData unveils analytics as a set of microservices in data-as-a-service platform

The ability to deploy GoodData.CN anywhere is crucial because multiple centers of data gravity will always exist in the enterprise, noted Stanek. It’s unlikely any major enterprise is ever going to be able to standardize on a single data warehouse or data lake, he said. The GoodData.CM platform provides all the metadata capabilities required to maintain a single source of truth across what are rapidly becoming highly federated environments, noted Stanek. A programmable API also makes it feasible to deploy a headless data-as-a-service platform for processing analytics that can be readily accessed and consumed as a service by multiple applications. Previously, individual developers had to take the time and effort to embed analytics capabilities directly within their application, noted Stanek. The GoodData.CM platform makes applications more efficient and, as a consequence, smaller. That is because more analytics processing is offloaded to the headless platform, added Stanek. Pressure to embed analytics in every application is mounting as end users seek to make faster and better fact-based decisions.


Why Technology is More Important Than Ever to Financial Services Organisations

Larger financial institutions have sometimes drawn criticism for their pace with digital innovation, with suggestions that a risk-averse culture impedes innovative new projects. But it is important to note that they are not out of the game. They can still rely on their great customer access, brand cachet and understanding of regulations to compete with nimble challengers. Additionally, data is at the heart of digital transformation, a resource that retail and private banking companies have in abundance. Blending deep, data-powered insight with their powerful human-centric brands gives these organisations an opportunity to create real differentiation when it comes to customer experience. If this is done correctly, they can become smarter, faster and more resilient, while retaining their brand identity. Attitudes are also changing. Some 79% of all organisations in our research now believe traditional business models are being radically disrupted, and that innovation is clearly underway. A further 92% believe that their business embraces change rather than tries to resist it.


The future of work is uniquely human

Re-architecting work is not about simply automating tasks and activities. At its core, it is about configuring work to capitalize on what humans can accomplish when work is based on their strengths. In the survey, executives identified two factors related to human potential as the most transformative for the workplace: building an organizational culture that celebrates growth, adaptability and resilience (45%), and building workforce capability through upskilling, reskilling, and mobility (41%). Leaders should find ways to create a shared sense of purpose that mobilizes people to pull strongly in the same direction as they face the organization’s current and future challenges, whether the mission is, like Delta’s, to keep people connected, or centered on goals such as inclusivity, diversity or transparency. They should trust people to work in ways that allow them to fulfill their potential, offering workers a degree of choice over the work they do to align their passions with organizational needs. And they should embrace the perspective that reimagining work is key to the ability to achieve new and better outcomes—in a world that is itself being constantly reimagined.


Why applied AI requires skills and knowledge beyond data science

“A business problem that can be solved by a model alone is very unusual. Most problems are multifaceted and require an assortment of skills—data pipelines, infrastructure, UX, business risk analysis,” Rochwerger and Pang write in Real World AI. “Put another way, machine learning is only useful when it’s incorporated into a business process, customer experience or product, and actually gets released.” Applied machine learning needs a cross-functional team that includes people from different disciplines and backgrounds. And not all of them are technical. Subject matter experts will need to verify the veracity of training data and the reliability of the model’s inferences. Product managers will need to establish the business objectives and desired outcomes for the machine learning strategy. User researchers will help to validate the model’s performance through interviews with and feedback from end-users of the system. And an ethics team will need to identify sensitive areas where the machine learning models might cause unwanted harm.


Machine learning, explained

Machine learning starts with data — numbers, photos, or text, like bank transactions, pictures of people or even bakery items, repair records, time series data from sensors, or sales reports. The data is gathered and prepared to be used as training data, or the information the machine learning model will be trained on. The more data, the better the program. From there, programmers choose a machine learning model to use, supply the data, and let the computer model train itself to find patterns or make predictions. Over time the human programmer can also tweak the model, including changing its parameters, to help push it toward more accurate results. (Research scientist Janelle Shane’s website AI Weirdness is an entertaining look at how machine learning algorithms learn and how they can get things wrong — as happened when an algorithm tried to generate recipes and created Chocolate Chicken Chicken Cake.) Some data is held out from the training data to be used as evaluation data, which tests how accurate the machine learning model is when it is shown new data. The result is a model that can be used in the future with different sets of data.



Quote for the day:

"You may be good. You may even be better than everyone esle. But without a coach you will never be as good as you could be." -- Andy Stanley

Daily Tech Digest - April 24, 2021

An Insight Into Global Payment Technologies With James Booth

With the e-commerce market set to reach a predicted market volume of £92 million by 2025, and the opportunity for cross-border expansion at an all-time high, the demand for more localised and innovative payment methods will only continue to grow. More and more customers are now online, looking for products or services that suit their very specific needs. A shopper might look across borders for what they want: better-quality products, payment methods accepted, stronger brand loyalty, and more. But they will quickly abandon the transaction page if their preferred payment method is not available. Ultimately, payment choice will play a major role in driving sales in the future, meaning merchants will need a diverse payment portfolio to ensure transactions are completed and customer loyalty retained. This will continue to spark increased innovation for payments, but also the proliferation of niche local payment options across the globe. However, as digital payments head towards a global tipping point, the need for greater regulation and security will also continue to grow.


Dealing With Stubbornness Of AI Autonomous Vehicles

Shifting gears, the future of cars entails self-driving cars. This stubbornness element in the flatbed truck tale brings up an interesting facet about self-driving cars and one that few are giving much attention to. First, be aware that true self-driving cars are driven by an AI-based driving system and not by a human driver. Thus, in the case of this flatbed truck scenario, if the car had been a self-driving car, the AI driving system would have been trying to get the car up that ramp and onto the flatbed. Secondly, there are going to be instances wherein a human wants a self-driving car to go someplace, but the AI driving system will “refuse” to do so. I want to clarify that the AI is not somehow sentient since the type of AI being devised today is not in any manner whatsoever approaching sentience. Perhaps far away in the future, we will achieve that kind of AI, but that’s not in the cards right now. This latter point is important because the AI driving system opting to “refuse” to drive someplace is not due to the AI being a sentient being, and instead is merely a programmatic indication that the AI has detected a situation in which it is not programmed to drive.


Rise of APIs brings new security threat vector -- and need for novel defenses

The speed is important. The pandemic has been even more of a challenge for a lot of companies. They had to move to more of a digital experience much faster than they imagined. So speed has become way more prominent. But that speed creates a challenge around safety, right? Speed creates two main things. One is that you have more opportunity to make mistakes. If you ask people to do something very fast because there’s so much business and consumer pressure, sometimes you cut corners and make mistakes. Not deliberately. It’s just as software engineers can never write completely bug-free code. But if you have more bugs in your code because you are moving very, very fast, it creates a greater challenge. So how do you create safety around it? By catching these security bugs and issues much earlier in your software development life cycle (SDLC). If a developer creates a new API and that API could be exploited by a hacker -- because there is a bug in that API around security authentication check -- you have to try to find it in your test cycle and your SDLC. The second way to gain security is by creating a safety net. Even if you find things earlier in your SDLC, it’s impossible to catch everything. 


Will you be heading back to the office? Should you?

The vast majority said it had worked out much better than they expected. They found people were more, rather than less, productive. It turns out folks welcomed not having to deal with long commutes, crowded open-plan offices, or Dilbert-like cubicle farms. Of course, not everyone is happy. Juggling kids and office work can mean misery. But in a recent Blind professional worker social network survey of 3,000 staffers 35% said they would quit their jobs if work from home ends. That's a lot. I'd hate to replace more than a third of my staff if I insisted everyone return to 1 Corporate Drive. If your people want to work from home, and they've shown they can deliver, why take a chance on losing them? Not everyone is on board with the change. As one Microsoft staffer on Blind put it, "I don’t think the 5-day work in the office will ever be relevant again. You will have Team A and Team B, working 2 days in the office and 3 days at home. Social interaction in person is needed." Notice, though, that even here, there's no assumption of a five-day work week.


4 reasons to learn machine learning with JavaScript

Fortunately, not all machine learning applications require expensive servers. Many models can be compressed to run on user devices. And mobile device manufacturers are equipping their devices with chips to support local deep learning inference. But the problem is that Python machine learning is not supported by default on many user devices. MacOS and most versions of Linux come with Python preinstalled, but you still have to install machine learning libraries separately. Windows users must install Python manually. And mobile operating systems have very poor support for Python interpreters. JavaScript, on the other hand, is natively supported by all modern mobile and desktop browsers. This means JavaScript machine learning applications are guaranteed to run on most desktop and mobile devices. Therefore, if your machine learning model runs on JavaScript code in the browser, you can rest assured that it will be accessible to nearly all users. There are already several JavaScript machine learning libraries. An example is TensorFlow.js, the JavaScript version of Google’s famous TensorFlow machine learning and deep learning library.


4 Software QA Metrics To Enhance Dev Quality and Speed

The caliber of code is fundamental to the quality of your product. Through frequent reviews you can assess the health of your software, thus detecting unreliable code and defects in the building blocks of your project. Identifying flaws is going to help you throughout the dev process and well into the future. Good quality code will allow you to reduce the risks of defects and avoid application and website crashes. Today, much of this process can be automated, avoiding human error and diverting resources toward other tasks. But, there are a number of code quality analytics you can focus on. ... Flagging issues in the working process can draw attention to inefficiencies, allowing the opportunity to implement project management solutions. Once flaws are established, there’s a whole host of management software for small businesses and large businesses alike to improve efficiency. Automation can also help you through the testing process. According to PractiTest, 78% of organizations currently use test automation for functional or regression tests. This automation will ultimately save time and money, eliminating human error and allowing resources to be redirected elsewhere in the dev process.


5 Fundamental But Effective IoT Device Security Controls

IoT devices introduce a host of vulnerabilities into organizations’ networks and are often difficult to patch. With more than 30 billion active IoT device connections estimated by 2025, it is imperative information-security professionals find an efficient framework to better monitor and protect IoT devices from being leveraged for distributed denial or service (DDoS), ransomware or even data exfiltration. When the convenience of a doorbell camera, robot vacuum cleaner or cellphone-activated thermostat could potentially wreak financial havoc or threaten physical harm, the security of these devices cannot be taken lightly. We must refocus our cyber-hygiene mindset to view these devices as potential threats to our sensitive data. There are too many examples of threat actors gaining access to a supposedly insignificant IoT device, like the HVAC control system for a global retail chain, only to pivot to other unsecured devices on the same network before reaching valuable sensitive information. While phishing remains the most popular attack vector, reinforcing the need for humans to be an integral part of strong security program, IoT devices now offer another avenue for cybercriminals to access accounts and networks to steal data, conduct reconnaissance and further deploy malware.


Improving model performance through human participation

In order to achieve high-quality human reviews, it is important to set up a well-defined training process for the human agents who will be responsible for reviewing items manually. A well-thought-out training plan and a regular feedback loop for the human agents will help maintain the high-quality bar of the manually reviewed items over time. This rigorous training and feedback loop help minimize human error in addition to helping maintain SLA requirements for per item decisions. Another strategy that is slightly more expensive is to use a best-of-3 approach for each item that is manually reviewed, i.e., use 3 agents to review the same item and take the majority vote from the 3 agents to decide the final outcome. In addition, log the disagreements between the agents so that the teams can retrospect on these disagreements to refine their judging policies. Best practices applicable to microservices apply here as well. This includes appropriate monitoring of the following: End-to-end latency of an item from the time it was received in the system to the time a decision was made on it; Overall health of the agent pool; Volume of items sent for human review; and Hourly statistics on the classification of items.


The challenges of applied machine learning

One of the key challenges of applied machine learning is gathering and organizing the data needed to train models. This is in contrast to scientific research where training data is usually available and the goal is to create the right machine learning model. “When creating AI in the real world, the data used to train the model is far more important than the model itself,” Rochwerger and Pang write in Real World AI. “This is a reversal of the typical paradigm represented by academia, where data science PhDs spend most of their focus and effort on creating new models. But the data used to train models in academia are only meant to prove the functionality of the model, not solve real problems. Out in the real world, high-quality and accurate data that can be used to train a working model is incredibly tricky to collect.” In many applied machine learning applications, public datasets are not useful for training models. You need to either gather your own data or buy them from a third party. Both options have their own set of challenges. For instance, in the herbicide surveillance scenario mentioned earlier, the organization will need to capture a lot of images of crops and weeds.


Window Snyder Launches Startup to Fill IoT Security Gaps

In the connected device market, she sees a large attack surface and small security investment. "There are so many devices out there that don't have any of these mechanisms in place," she explains. "Even for those that do have security mechanisms, not all of them are built to the kind of resilience that's appropriate for the threats they're up against." It's a big problem with multiple reasons. Some organizations have small engineering teams and few resources to build resilience into their products. Some have large teams but don't prioritize security because they're in a closed-system manufacturing operation, for example, and the machines don't have network access. Many connected devices are in the field for long periods of time and it's hard to deliver updates, so manufacturers don't ship them unless they have to. "There's this combination of both security need and then additionally this requirement for an update mechanism that is reliable," Snyder continues. Oftentimes manufacturers lack confidence in how updates are deployed and don't trust the mechanism will deliver medium- or high-severity security updates on a regular basis.



Quote for the day:

"Authority without wisdom is like a heavy ax without an edge -- fitter to bruise than polish." -- Anne Bradstreet

Daily Tech Digest - April 23, 2021

Advanced anomaly detection: how to defeat ransomware

With perimeter defenses increasingly becoming a thing of the past, attack surfaces increasing, and adversaries becoming more capable, a managed threat detection and response (MDR) model has piqued interest in major industries. A crucial difference between MDR and traditional ransomware defenses, is MDR’s proactive response to threats. MDR is a powerful managed security service that combines threat intelligence, threat hunting, security monitoring, incident analysis, and incident response. It leverages telemetry on endpoints, monitors user behaviors, and helps produce a data-driven baseline of a business’ ‘normal’ activities, whether on premises or in the cloud. Essentially, it couples the best detection technologies and security expertise to seek out and eliminate threats before catastrophic damage occurs. Ransomware protection has been critical for businesses, especially during the pandemic. COVID-19 has proven to be a nightmare for assessing what ‘normal’ behavior looks like for organizations. Most companies lacked contingencies for adapting to the pandemic. 


Low-code and no-code won't kill developer jobs, here's why

The fact is low-code and no-code has been a term for probably 15 years, if not more in one way or another. I think I remember trying to write my first website in a low-code front page application, but what did I do? The second I did that I had to jump into the code, the HTML code to actually make it work. But we are at a different time, I think in really a unique time where we have a broad base of the workforce, the majority of the workforce now is the millennial generation or lower. So we have a younger workforce that actually grew up with technology and they've used it day in and day out. We don't really think of it as, 'Oh, well, you had apps and phones,' but that familiarity with technology has given a technical or literacy that just comes with today's day and age. Now, if you accompany that with the fact that low-code platforms are much more powerful than they were before, you have a perfect union of people who just want to get stuff done and configure out technology if you give it to them, and technology that is powerful enough, yet simple enough to leverage to really innovate on. Now, there is something you mentioned Bill, that is really important, which is enterprises have to be bought into this.


Juniper: Managing the complexity of future networks

You’ll see more self-healing, self-configuring and provisioning. Day 2 operations will be seamless, and self-correcting work will be all done in software automatically. In many ways we have already achieved these capabilities with Mist and our Wi-Fi technology that has a self-correcting mechanism. In the data center, operations will be driven by automation to eliminate errors, and find and correct particular problems. Our focus on AI has been a real shot in the arm for the company and our customers. As we pull more and more telemetry from our routers and switches, automation and AI will drive a lot more functionality into our software. The data gathered by telemetry is king. You need that kind of data to gain insights into what’s going on, how devices are working and software. You find out how the network is operating with packet capturing and the state of the cloud network, and then look for deviations. In our case, [Juniper’s AI-powered virtual assistant] Marvis in 2019 learned of network problems and could solve 20% of them without intervention. Now that number is over 80% of problems solvable automatically, in part due to all of the intelligent telemetry it gathers.


What is Blockchain? We explain the technology of blockchains

The blockchain is a constantly growing list of information. That information is in blocks, and all these blocks are linked together. Each block matches the preceding and following, and the information that the middle block contains is encrypted by an algorithm using a cryptographic function called hash. This makes this information inviolable. It is a secure, open and public database. To illustrate how the blockchain works, the metaphor of a ledger distributed among many people is often used. It would be a great book where digital events are recorded. The fundamental thing here is that this book is "distributed", that is, shared between many different parts (nodes). It can only be updated from the consensus of the majority of the system participants and, once entered, the information can never be deleted. The Bitcoin blockchain , for example, contains an accurate and verifiable record of all the transactions that have been made in its history. In other words, the authenticity of the Blockchain is not verified by a third party, but by the consensus of the whole: it is the same network of users that participates in it.


Europe lays out plan for risk-based AI rules to boost trust and uptake

The planned law is intended to apply to any company selling an AI product or service into the EU, not just to EU-based companies and individuals — so, as with the EU’s data protection regime, it will be extraterritorial in scope. The overarching goal for EU lawmakers is to foster public trust in how AI is implemented to help boost uptake of the technology. Senior Commission officials talk about wanting to develop an “excellence ecosystem” that’s aligned with European values. “Today, we aim to make Europe world-class in the development of a secure, trustworthy and human-centered Artificial Intelligence, and the use of it,” said Commission EVP, Margrethe Vestager, announcing adoption of the proposal at a press conference. “On the one hand, our regulation addresses the human and societal risks associated with specific uses of AI. This is to create trust. On the other hand, our coordinated plan outlines the necessary steps that Member States should take to boost investments and innovation. To guarantee excellence. All this, to ensure that we strengthen the uptake of AI across Europe.”


Conversation about crossgen2

Crossgen2 is an exciting new platform addition and part of the .NET 6 release. It is a new tool that enables both generating and optimizing code in a new way. The crossgen2 project is a significant effort, and is the focus of multiple engineers. I thought it might be interesting to try a more conversational approach to exploring new features. ... Crossgen’s pedigree comes from the early .NET Framework days. Its implementation is tightly coupled with the runtime (it essentially is just the runtime and JIT attached to a PE file emitter). We are building a new version of Crossgen – Crossgen 2 – which starts with a new code base architected to be a compiler that can perform analysis and optimizations not possible with the previous version. ... As the .NET Core project became more mature and we saw usage grow across multiple application scenarios, we realized that crossgen’s limitation of only really being able to produce native code of one flavor with one set of characteristics was going to be a big problem. For example, we might want to generate code with different characteristics for Windows desktop on one hand and Linux containers on the other. The need for that level of code generation diversity is what motivated the project.


Machine Learning with ML.NET – NLP with BERT

Language is sequential data. Basically, you can observe it as a stream of words, where the meaning of each word is depending on the words that came before it and from the words that come after it. That is why computers have such a hard time understanding language because in order to understand one word you need a context. Also, sometimes as the output, you need to provide a sequence of data (words) as well. A good example to demonstrate this is the translation of English into Serbian. As an input to the algorithm, we use a sequence of words and for the output, we need to provide a sequence as well. ... During the training, process Encoder is supplied with word embeddings from the English language. Computers don’t understand words, they understand numbers and matrixes (set of numbers). That is why we convert words into some vector space, meaning we assign certain vectors (map them to some latent vector space) to each word in the language. These are word embeddings. There are many available word embeddings like Word2Vec. However, the position of the word in the sentence is also important for the context. 


How micro-segmentation creates an uphill battle for intruders

To determine just how effective micro-segmentation can be, Illumio conducted a red team exercise with Bishop Fox. The team was tasked with finding “crown jewel” assets in a test environment, and while they did not face a defensive blue team, they were pitted against increasingly tight micro-segmentation policies. The first and lowest level policy tested was environmental separation. This is a fairly course-grained approach where workloads in different environments, such as production, testing, or development, can only connect with others in the same environment. It quickly became clear that even this simple level of separation could cause attackers to take at least three times as long to reach their target. This 300-percent increase in difficulty for the intruder meant defensive tools and security personnel had much more time to detect and investigate signs of unusual activity. The next level of micro-segmentation, application ringfencing, proved to be even more effective, creating a 450-percent increase in difficulty for the attacker. At this stage, only workloads associated with specific applications could talk to each other.


Quantum: It's still not clear what it’s good for

The entire quantum industry is "still finding its way to what applications are really useful," he said. "You tend to see this list of potential applications, a heralded era of quantum computing, but I don't think we really know," he said. The Qatalyst software from QCI focuses on the kinds of problems that are of perennial interest, generally in the category of optimization, particularly constrained optimization, where a solution to a given loss function or objective function is made more complicated by having to narrow the solution to a bunch of variables that have a constraint of some sort enforced, such as bounded values. ... "They are described at a high level as the traveling salesman problem, where you have multi-variate sort of outcomes," said Liscouski. "But it's supply-chain logistics, it's inventory management, it's scheduling, it's things that businesses do today that quantum can really accelerate the outcomes in the very near future." Such problems are "a very important use case," said Moulds. Quantum computers are "potentially good at narrowing the field in problem spaces, searching through large potential combinations in a wide variety of optimization problems," he said.


Zuzana Šochová on Becoming an Agile Leader

Agile at the organizational level is changing the DNA of organizations; it brings higher autonomy of creative, innovative, and collaborative teams that are better designed to deal with complexity and the unpredictability of the VUCA challenges. It needs flexibility and quick responses to change. It breaks all fundamental beliefs that classical management was built on top of, and creates a strong need for changing leadership. Dynamic structures with no fixed design are hard to manage the traditional way, and growth of emergent leadership is inevitable. Agile leaders are catalyst and servant leaders; they are role models of a new way of working. They coach, mentor, and encourage others to become agile leaders as well. Being an agile leader is a journey, and agile leaders need to focus on helping other leaders around them grow to make agility as a whole sustainable. Having a critical mass of agile leadership is crucial for any agile environment; without it, we are only creating another process and adding terminology, and all we get is “fake agile,” not business results.



Quote for the day:

"Leaders need to strike a balance between action and patience." -- Doug Smith

Daily Tech Digest - April 22, 2021

CISA Orders Agencies to Mitigate Pulse Secure VPN Risks

CISA is ordering agencies to use the Pulse Connect Secure Integrity Tool to check the integrity of file systems and take further action as necessary. Ivanti developed the tool, which helps organizations determine if malicious activity is taking place. "CISA has determined that this exploitation of Pulse Connect Secure products poses an unacceptable risk to federal civilian executive branch agencies and requires emergency action," according to the emergency directive. "This determination is based on the current exploitation of these vulnerabilities by threat actors in external network environments, the likelihood of the vulnerabilities being exploited, the prevalence of the affected software in the federal enterprise, the high potential for a compromise of agency information systems, and the potential impact of a successful compromise." The Biden administration has been responding to a series of security incidents, including the SolarWinds supply chain attack, which led to follow-on attacks on nine government agencies and 100 companies and exploits of flaws in on-premises Microsoft Exchange email servers.


Why DevSecOps Should Strive for Effective Enforcement Measures

Applications today – especially in modern development environments – extensively use APIs to share and consume sensitive data, which are just as vulnerable and require dedicated surgical technology to make sure there is no token abuse, excessive utilization, or data theft using injections. Other than API security Many services rely on integrating or serving bots and need to make a clear distinction between the good bots and bots with malicious intent. For the sake of being accepted by AD&D, RASP is vulnerable to some attacks denial of service is just one example. From a DevOps point of view, applying security enforcement is risky. It can affect the user experience or maybe even break the flow, leading to runtime errors. The software development lifecycle (SDLC) has many blind spots in security, especially in today’s hybrid, multi-cloud architecture. For this very reason, many technologies provide alerts which is great. There is some fatigue from tools that only provide visibility. Automated security testing, vulnerability scanners of webservers, Operating Systems, and even container images come short on actual enforcement, making the developer take a few steps back and patch. When such alerts come in mass, it is much harder to prioritize and address them all.


The strange bedfellows of AI and ethics

There is a tendency to assume that computers cannot be biased – but that is not the case. AI-based systems learn from the data that they are fed. If we feed them the “wrong” data, we can inadvertently build in biases that we may not even notice. For example, historically, there have been more men than women in technology jobs. It is a very short step from that data to a position where a hiring algorithm learns that men are more likely to do a technology job, and then “decides” that men must be better than women in those jobs. The good news is that we can manage this. We can, and should, be aware of our own biases. However, we should also build diverse teams to work with AI, as a way of ensuring that we surface more of the inadvertent biases – the ones that we don’t even notice because they have become norms. It is not going to be enough to respond to developments in AI. We need to be proactive in setting up ethical safeguards to protect us all. A recent webcast from SAS Canada on AI and ethics recommends that organisations should develop a code of conduct around AI and foster AI literacy. They should also establish a diverse ethics committee to manage and oversee development and implementation processes.


REvil Ransomware Gang Threatens Stolen Apple Blueprint Leak

The extortion threat was unveiled Tuesday, hours before Apple was scheduled to make a series of major new product announcements. REvil published a number of alleged blueprints for Apple devices, which it claimed to have stolen from Taiwanese manufacturer Quanta Computer, which builds computing devices for a number of vendors. "In order not to wait for the upcoming Apple presentations, today we, the REvil group, will provide data on the upcoming releases of the company so beloved by many," the REvil gang says in a post to its data leak site. "Tim Cook can say thank you Quanta," it adds, referring to Apple's CEO. REvil claims that its previous ransom demands have been rebuffed by Quanta. "From our side, a lot of time has been devoted to solving this problem. Quanta has made it clear to us that it does not care about the data of its customers and employees, thereby allowing the publication and sale of all data we have," REvil says. Quanta and Apple didn't immediately respond to a request for comment. REvil's data-leak site further lists Cisco, Dell, HP, Siemens, Sony and Toshiba as being among the other manufacturers with which Quanta works.


Five Habits Of Highly Successful COOs

The best COOs are effective at building trust with their CEO. This trust allows them to be brutally honest with the leader of their company and gives the endless ideas created by the CEO a filter. This is not No. 1 by accident. The foundation of any great CEO and COO relationship is trust, and all the successful COO I’ve seen have a track record of building genuine trust with their CEOs and with prior teammates before climbing the ranks to second in command. This allows the CEO to confidently pass anything off of his/her plate to the COO so they can focus on the tasks that are the highest and best use of the CEO’s time. One of the most common key responsibilities of the COO is to attract, hire and retain high performers. The COO is basically the hub of the organization and it’s critical they have their finger on the talent pulse. The best-in-class COOs are always hiring. They understand that hiring top talent is one of the most important functions of the company. In addition to hiring high performers, they also spend significant time developing their highest performers. It can be so easy to focus your time and attention on only the lowest performers, but the most effective COOs take the time to continue developing the top 20% in addition to the rest of the team.


Advice for Aspiring Data Scientists

Some ideas for what to include in your portfolio: analyses, code gists, webapps, data documentation and blogs (+ README files!). You don’t need all of these by any means but if I had to choose two, I’d choose a webapp and accompanying blog post. A webapp is a great way to show your ability to link together different pieces of software and create something dynamic, hosted on the web. But why a blog? As I argued in my last post, communication is one of, if not the most important aspects of your job as a data scientist. Written communication is especially vital, and even more so if your job is remote. A well-written blog post (with linked code) allows the reader to get a sense of how you communicate, code, and think. If they get good signal from this, they will want to talk with you. This matters because getting your resume looked at is the hardest step in the job search process, so if you can increase your chances of conversion here, you’ll be in a great place. You may now be wondering how to get inspiration for your portfolio. What about starting with a cool dataset you see referenced on Twitter or Kaggle? Are there any data quality issues like leakage, truncation, missing data? How do they impact an analysis?


Cloud archiving: A perfect use case, but beware costs and egress issues

There are still issues that may inhibit the move to the cloud. While there are many examples of companies that want the move to boost operating expenditure and cut down on capital expenditure, there are instances of organisations that want to maintain the latter for accountancy reasons. And, says Betts, there are organisations that have pulled everything back from the cloud because it’s easier to control costs. Some companies have been reluctant to move to the cloud for off-site archiving because of a perceived lack of cloud skills – this may apply particularly to small and medium-sized enterprises (SMEs). But, as Betts points out, there’s still a need for skills if they’re going to implement an on-premise policy, so it’s not such a straightforward swap. SMEs may well lack some of these specialist skills too, and may find it particularly the case when adhering to GDPR compliance. It is clear there are plenty of advantages to archiving in the cloud. By freeing CIOs from the pain of choosing a hardware medium for long-term storage, moving to the cloud offers greater flexibility.


A Reference Architecture for Fine-Grained Access Management on the Cloud

The key insight underpinning this architecture is the delegation of user authentication to a single service (the Access Controller) rather than placing that responsibility with each service to which the user may need access. This kind of federation is commonplace in the world of SaaS applications. Having a single service be responsible for authentication simplifies user provisioning and de-provisioning for application owners and accelerates application development. The Access Controller itself will typically integrate with an identity provider, such as Auth0 or Okta, for the actual authentication sequence, thus providing a useful abstraction across a wide array of providers and protocols. Ultimately, the identity provider guarantees non-repudiation of the user’s identity in the form of a signed SAML assertion, a JWT token, or an ephemeral certificate. This obviates the need to rely on a trusted subnet as a proxy for the user’s identity. It also allows configuring access policies down to the granularity of a service unlike VPNs which permissively grant users access to all services on the network.


Why Big Data is Crucial for Agricultural Growth

Big data technologies have significantly increased the amount of information modern farmers possess for enhancing the efficiency of agricultural production. But what’s even more important than collecting and analyzing data is the ability to pull out the most important insights from it. The large number of variables affecting crop yield creates a wide range of possibilities for interpretation. This includes data on crop health, growth uniformity, stage of growth, etc. Having all of this data automatically collected and analyzed in one online tool enables farmers to make the most accurate predictions on crop yields. Such tools can use different algorithms for assessing the yield potential taking into account weather conditions, historical yield data, and other necessary information. Based on yield forecasts, farmers can timely perform field activities to impact it, plan its storage and sales. Ultimately, yield prediction enables growers to decide which crop to plant, where, and when, based on the accurate analysis of historical and current data. Environmental threats and global climate change have a huge impact on the agricultural sphere.


Building Confidence with Data Resilience

The first step in any digital transformation journey starts with the data and the development of a foundational storage layer. Resilience starts with data, too. It is the fuel that drives the company and it permeates every aspect of the technical infrastructure, from storage to AI, across the hybrid cloud, from the core data center to the edge. Lose data and you can lose your ability to function and, often, lose money. A recent study by KPMG found that cyber security risk will pose the greatest threat to a company’s growth over the next three years. The KPMG 2021 CEO Outlook Pulse Survey surveyed 500 CEOs in 11 markets around the world. Organizations like Pitney-Bowes, the University of California, San Francisco, and the many others are living proof of the risks. But breaches tell only part of the story. According to a recent report by Harvard Business Review, the mean time it took businesses in 2019 to discover a cyberattack was 196 days. Cloud migrations are only compounding the challenge and risk by 51%, according to the report. The point is, for most organizations, the problem is not only losing data and vital corporate information, but also not realizing it for six months.



Quote for the day:

"Always remember that you are absolutely unique. Just like everyone else." -- Margaret Mead