Daily Tech Digest by Kannan Subbiah

Daily Tech Digest - July 15, 2021

Why Developers Should Learn Kubernetes

Along with DevOps and SRE adoption, there is also a lot of discussion about “shifting left” in the software development world. At its core, shifting left means focusing on moving problem detection and prevention earlier in the software development lifecycle (SDLC) to improve overall quality. More robust, automated continuous integration/continuous delivery (CI/CD) pipelines and testing practices are prime examples of how this works. Shifting left applies to operational best practices as well. Once upon a time, developers would code their applications and then hand them off to operations to deploy into production. Things have changed dramatically since that time, and old models don’t work the way they once did. Knowing about the platform that the application lives on is critical. Successful engineering organizations work hard to ensure development and operations teams avoid working in silos. Instead, they aim to collaborate earlier in the software development lifecycle so that coding, building, testing and deployments are all well understood by all teams involved in the process.

Top 5 Programming Languages for Automation Testing

JavaScript focuses strongly on test automation and performs well when it comes to rebranding the client-side expectations through front-end development. Unavoidably, there are many web applications like Instagram, Accenture, Slack, and Airbnb which support libraries written through JavaScript automation, such as instauto, ATOM (Accenture Test Automation Open source Modular Libraries), Botkit, and Mavericks. Besides, there are various testing frameworks like Zest, Jasmine, and Nightwatch JS which refine multiple processes of unit testing as well as end-to-end testing. The reason for using them is that programmers or developers may build strong web applications primarily focusing on the core logic of businesses and quickly resolving security-related issues that may occur anywhere and anytime. With such advantages, teams working for automation testing won’t feel pressured because the debugging time and other code glitches are reduced and the productivity is promisingly increased with the shift-left testing approach.

Trickbot Malware Rebounds with Virtual-Desktop Espionage Module

The latest version of the spy module makes use of virtual network computing (VNC): hence its name, vncDll. It essentially sets up a virtual desktop that mirrors the desktop of a victim machine and sets about using it to steal information. It’s been circulating since late May, researchers said. When first installed, vncDll uses a custom communications protocol to transmit information to and from one of the up to nine C2 servers that are defined in its configuration file. The module will use the first one to which it can connect. “The port used to communicate with the servers is 443, to avoid arousing the suspicion of anyone observing the traffic,” according to the Bitdefender analysis. “Although traffic on this port normally uses SSL or TLS, the data is sent unencrypted.” The first order of business is to announce to the C2 server that it’s been installed, and it then waits to receive a set of commands. The C2 connects to an attacker-controlled client, which is a software application that the attackers use to interact with the victims through the C2 servers.

Four common biases in boardroom culture

Boards can be effective only if they can come to a consensus. Let’s say a company is considering the launch of a significant new product, but five of the 12 directors have concerns going into a meeting on the topic. Some have discussed the issue among themselves before the meeting. Many are worried about how the full board discussion will go. In the meeting, one director starts to share his concerns, but the CEO quickly moves on. Over the course of the meeting, more and more heads start to nod along. No parts of the strategy for this new product have changed. But now the entire board appears supportive, including the director whose concerns were dismissed. Though consensus-building is important, boards may be too inclined to seek harmony or conformity. This can lead to groupthink, a much-written-about challenge facing companies in which dissenting views are not welcomed or even entertained. In fact, though most boards work to solicit a range of views and come to a consensus on key issues, the 2020 edition of PwC’s Annual Corporate Directors Survey found that 36% of directors have difficulty voicing a dissenting view on at least one topic in the boardroom.

Moving Data is Expensive

Data created at the edge must be accessed and processed by the applications in the datacenter. The necessity to move data to the application incurs a productivity penalty. Take media and entertainment: editors, colorists, and special effects artists in multiple locations may sit idle waiting for data to become accessible. A 30 minute delay across 200 animators may result in ~$400K unintended cost. Data may have to be moved multiple times, each time incurring the productivity penalty. Every time data is moved or copied, storage resources must be made available to store it. Whether it is persistent storage or a caching device, disk drives are deployed to catch data being sent. Moving 10TB requires 10TB of storage to be available in every location requiring data access. The cost of storage varies from $120/TB/yr for archiving tier to $720/TB/yr for high-performance tier. Every copy created incurs an added storage cost. These estimates are marginally accurate; procuring small amounts of storage may be even more costly since economies of scale kick in at over 40TB.

How to Best Assess Your Security Posture

Risk assessment can help an organization figure out what assets it has, the ownership of those assets and everything down to patch management. It involves figuring out what you want to measure risk around because there are a bunch of different frameworks out there [such as] NIST and the Cyber Security Maturity Model, (C2M2)" said Bill Lawrence, CISO at risk management platform provider SecurityGate.io. "Then, in an iterative fashion, you want to take that initial baseline or snapshot to figure out how well or how poorly they're measuring up to certain criteria so you can make incremental or sometimes large improvements to systems to reduce risk. ... Looking at your own scorecard is a good way to get started and thinking about assessments because ultimately you're going to be assigning the same types of weights and risk factors to your vendors," said Mike Wilkes, CISO at cybersecurity ratings company SecurityScorecard. "We need to get beyond thinking that you're going to send out an Excel spreadsheet [questionnaire] once a year to your core vendors.

Leveraging data: what retailers can learn from Netflix

For bricks and mortar retail, collecting data on customers is obviously more difficult – they don’t need to ‘login’ in order to enter a shop. Retailers, however, can track credit cards to group transactions back to a specific customer, and use this data to link both online and offline sales. AI, when used smartly in store, can also help retailers to get to know their customers better. Connected devices and IoT, along with Computer Vision technology (CV), allows businesses to collect data from sensors, cameras and mobile devices on consumer behaviours. This can include the items that are picked up or put back down, the directions visitors move in, whether the shoppers are regulars, or which areas of the store are most visited. Analysing the data gathered by this suite of technologies can, in turn, help drive brand loyalty with a tailored in-store experience. Loyalty programmes continue to have a key role to play in supporting retailers with data capture (such as behavioural and transactional information), and analytics are helping loyalty schemes to become more powerful in driving sales than ever before.

The real cost of MSSPs not implementing new tech

Taking on a complex cybersecurity landscape without the right tools can result in serious weaknesses that threaten an organization’s networks and data. Among the potential problem areas: The comprehension gap. - The lack of a translation layer between tactical and strategic stakeholders (i.e., those making reactive decisions and those who plan for the future) can result in separate tools and systems within an organization. This results in failures while making crucial, time-sensitive decisions, as well as in fully understanding the threat landscape and effectively allocating resources. A regulatory disconnect - Organizations need to balance collaborative cybersecurity efforts with compliance. Various regulations, such as the Federal Information Management Security Act, the General Data Protection Regulation (GDPR) or the California Privacy Rights Act (CPRA), tend to restrict the ability of security platforms to collect and share threat intelligence. Loss of time and momentum - Without the right tools, security teams can find themselves besieged by a steady onslaught of low-impact events and security control system alerts

Training NLP Engines Without All of the Answers

Natural Language Processing (NLP) or Natural Language Understanding (NLU) is a subset of Artificial Intelligence (AI). There are many benefits when using the technology, and I am surprised at the pushback from technical people when talking about deploying it. I guess there is a difference between learning about technology in academia and the complexity of actually deploying it. ... Another common over-promising statement is that it is easy to build the conversation and responses. In some cases, you build a simple decision matrix via the UI. After a while, you find out all of the variables in the conversation have created a mess. The other option is to create a machine learning (ML) model to look at data and provide observations and predictions. You might as well pull out your calculus textbooks and remember how all of this complex math works to build a ML algorithm. Building the ML is a specialized discipline in applied mathematics. Just because you can take a distance learning course does not mean you have the mathematics to build them. When asking a mathematician how long it will take to observe, hypothesize, and build an algorithm to try, they will tell you it takes time.

7 Key Insights of Product Management

There are inputs everywhere: feedback from customers, the team, leadership teams; quant data will tell us something and qual data will give us another insight. But are they all equal? Is the "customer always right?" Noooooooo, not necessarily. Using customers as an example: co-designing solutions can be dangerous, but they are good at helping you discover problems, so get them involved here. Good decisions come from proper weighting and attention to the inputs: the data, customer feedback, the market, your experience built from your track record, the team’s competence and so on. Again, it depends on what company, which product, what market. I’ve been a PM carrying almost everything from articulating and validating the initial idea through to writing FAQs and call scripts for the Customer Service Team. I’ve sometimes looked more like an Executive Producer, focused on the vision and strategy, galvanising multiple teams, suppliers and partners and engaging with a multitude of stakeholders. Perhaps you’re a Product Manager as well as a Product Marketer with your emphasis on positioning, pricing and Go-To-Market.

Quote for the day:

"Leaders think and talk about the solutions. Followers think and talk about the problems." -- Brian Tracy

Daily Tech Digest - July 14, 2021

Future of testing: Why CART is making penetration testing & attack simulation tools outdated

The inherent challenges with traditional security solutions make a strong case for Continuous Automated Red Teaming (CART) - an emerging new technology which discovers the attack surface and launches safe attacks continuously. It also helps to prioritise the vulnerabilities that are most likely to be attacked, which are typically the path of least resistance. To put it simply, CART automates red teaming and is designed to scale the process and make it more efficient allowing for continuous discovery of one's attack surface and continuous testing. This makes CART a game changing strategy in cybersecurity. In addition, CART, unlike penetration testing, finds the attack surface automatically without any inputs. It then launches multiple-stage attacks that range from networks to applications to humans. And, unlike BAS, CART, uses an outside-in approach to attack and does not require any hardware or software. Although hackers are sophisticated and have advanced detection and prevention capabilities, CART can help organisations stay ahead of the game by helping them think like a hacker.

Can Government Effectively Help Businesses Fight Cybercrime?

While companies need to better defend themselves, the government can help them by recommending cybersecurity measures and passing along threat information and by taking actions to dissuade attackers, whether it is sanctions against collaborating countries, indictments against individuals, or offensive attacks against the infrastructure used by criminals and their financial windfalls, says Mark Montgomery, senior director of the Center on Cyber and Technology Innovation at the Foundation for Defense of Democracies (FDD) and the executive director of the Cyberspace Solarium Commission. "No one of them can solve it alone—you have to do all three," he says. "We need to be working consistently across all three of those lines of effort." The Ransomware Task Force recommended five policies: Coordinated diplomacy and law enforcement efforts, an aggressive whole-of-government campaign by the United States to dissuade ransomware groups, the establishment of cyber response funds to help business, an international framework for responding to ransomware, and more regulation of cryptocurrency.

Using technology to keep control of your digital footprint in a post-COVID world

The concerns associated with handing over our data to travel companies do not stem from nowhere. Airlines have a notorious reputation for facing data breaches. For instance, British Airways was fined £20 million by the Information Commissioner’s Office (ICO) after the personal information of more than 400,000 staff and customers was leaked, including sensitive data related to banking and payments. More recently, Air India suffered a data breach that leaked the private data of no 4.5 million customers – including their contact information, credit card details, passport and ticket information, and more. Airlines are not the only alarming companies involved, as they’ve been handling high-risk information for years. When restaurants and local bars gain access to healthcare information, they are likely to not have adequate security measures in place and are therefore at great risk for vulnerabilities that put the customers’ privacy in danger. Does that mean we shouldn’t travel due to data privacy concerns? Absolutely not. The solution is to embrace data ownership as part of a value-based internet experience.

Unilever CIO: Digital literacy is the most important new capability to develop

Digital literacy, as Ventura defines it, is the ability of one employee—or an entire culture—to embrace technology-driven innovation in changing the way they work. To develop this capability, Ventura and his team created a Digital Literacy Curriculum, which they are facilitating at the top of the organization with CEO Fabian Garcia, and will expand to include leaders in sales and marketing next. The Curriculum involves Ventura, key members of his IT leadership team, and select business partners who meet three times a month for 45 minutes for a total of 14 sessions. Those sessions focus on cloud, platforms, data, and product, and are organized by experiences: customer, consumer, and employee. “We’ve always talked about ‘applications’ and ‘systems,’ but today we are using so many new terms, that we want to ground these terms in the experiences that matter to our CEO,” says Ventura. “We include our business partners, because Fabian does not want to know about the technical details of a capability; he wants to know how a practitioner will turn insights into action.”

8 Fintech Trends Changing Banking Forever

Not only has the speed of payments been impacted, but the speed of payments innovation is increasing. Solutions like Buy Now, Pay Later (BNPL) have gained popularity almost overnight, creating a unique form of real-time point-of-sale financing. This new innovation has forced traditional banks and even competing payment providers to play catch-up. While most solutions are for short-term deferred payments, new alternatives have been created for larger purchases with longer-term installments. As a result, BNPL has impacted not just debit issuers, but also credit card and personal loan providers. As has been seen in other financial product areas, new payment innovations often have emerged faster than the regulations to protect consumers. As regulators sort through the risks to consumers associated with new solutions, financial institutions have an opportunity to create competing solutions with improved transparency and better risk/reward models. Open Banking has become one of the most important global trends in the banking ecosystem. Originated in the U.K., the concept lowers barriers to entry for alternative financial services providers and enhances the potential for innovation by mandating traditional financial institutions to share financial data through APIs.

Rebuilding your security culture as employees return to the office

People need to move data to get their work done, and it can be a natural instinct for security teams to respond negatively to data exfiltration alerts. However, Code42 research shows that most data leaks happen unintentionally. One example of this could be when someone accidentally exfiltrates data when they connect a personal drive to their work device, unintentionally synching work files onto their personal cloud. Instead of leaping to the conclusion that employees are stealing data, investigate to find out more. Often, they are simply trying to get work done or collaborate with a colleague or partner. Use these moments as an opportunity to educate them on more secure ways to share data, always beginning the conversation with positive intent. For example, start with “We noticed this… did you see it, too” rather than starting the conversation with an accusatory tone. Doing so will position them as security allies instead of security enemies, and that’s a better way to encourage them to work together with your security team. Emphasize the importance of security and why it matters to all employees as they return to the office.

Three things essential to the future of edge computing

At its core, edge computing relies on geographically disparate pieces of equipment being able to seamlessly talk with one another. This could be compute or storage nodes talking with one another, or those nodes talking with sensors or machinery that collect or action an edge network’s data. Edge infrastructure depends on those technologies being able to reliably interact. Geographic separation has also led to a tendency towards a diversity in equipment. Whether due to supplier availability or adaptations to the local area, the most efficient edge infrastructure is one that can accommodate a variety of technologies. In practice, the marketplace pressures to accommodate this is often inevitable for many larger operators of edge networks, especially for those that wish to avoid lock-in with a particular vendor. To make a diverse and disparate edge network viable, organisations need to adopt open technologies. Creating standards around open source software and hardware to ensure that they can interact via open source solutions is ultimately the only way to guarantee that every component in a diverse and distributed edge network can interact with its counterparts.

Computer vision adoption expected to grow significantly in the near future

Manufacturers typically implement CV for quality control and process optimization, using systems to perform inspections with greater accuracy and at higher speeds than human workers, he said. "Beyond the production line, these systems have significant potential to augment or automate tedious, dangerous or expensive work, such as routine cycle counts and equipment inspections," Aigonkar said. CV is also useful for security in warehouse environments. In retail, CV is often applied for inventory optimization and to improve customer experience, ensuring that products are properly stocked and to monitor checkout lines, curbside pickups, and to keep an eye out for product spills, he said. "We see major successes with CV implementation across sectors–in utilities, transportation, manufacturing and production, retail and healthcare," Ajgaonkar said. In all of these verticals, the use of CV improves efficiency to free up employees to focus on more mission-critical tasks, he said. The increased adoption of AI and the internet of things proliferating across industries, is making CV something organizations should pay attention to now, he said.

6 IT talent retention strategies: Chicago CIO of the Year winners share

Without a doubt, the post-pandemic world has accelerated digitalization and the emerging hybrid work environment. To effectively compete and win in the marketplace, companies across all industries must execute strategies faster and pivot rapidly to seize new opportunities. Talent is central to success. My organization has implemented workforce initiatives to motivate and increase engagement among employees. We are ensuring that employee contributions are aligned to business priorities to provide a sense of purpose and meaning. We are providing schedule and location flexibility and investing in career growth. We have stepped up communication and involve a broad cross-section of employees in discussions to shape the future of the workplace. ... The new remote reality has indeed placed a brighter-than-ever spotlight on the importance of retaining top talent. I believe in investing in our people so they can learn new skills, which not only enrich and challenge them personally, but also enable them to contribute to our business success. Our mission is to deliver secure, reliable payments to the whole country. Knowing that the day-to-day work our team members do impacts every household and every business in the country is incredibly motivating and rewarding.

Global frameworks the way forward for AI and data privacy — Google CEO

Artificial intelligence (AI) has been quickly evolving, playing a gradually larger role in people’s lives. Looking forward to the next quarter of a century, given the evolution that the Internet has made in this time frame, Pichai expressed belief that while AI is still in its early stages, people will need to ensure that the technology develops in a way that benefits society. “I expect [AI] to play a foundational role across every aspect of our lives, be it healthcare, education, how we manufacture things, and how we consume information,” he said. “Today, it’s already changing our lives in simpler ways. In healthcare, when a radiologist is doing scans, [AI] may be acting as an assistant, flagging where [the radiologist] may want to give an extra look, or prioritise, because it looks worrisome. “Over time, we’ll be with more intelligent systems, and it can make humans more productive than we’ve ever imagined.” When asked whether society is unprepared for the rise in AI, Pichai said that while this may partly be true, human potential is always

Quote for the day:

"Without growth, organizations struggle to add talented people. Without talented people, organizations struggle to grow." -- Ray Attiyah

Daily Tech Digest - July 13, 2021

The biggest data science trends in banking

Another rising data science trend within banking is the use of traceable timing solutions. With timestamping regulations in financial services getting stricter, and data scientists looking to maintain integrity of assets, these solutions look to improve the accuracy of time sources. Richard Hoptroff, CTO and founder of Hoptroff, said: “Network derived and precise traceable timing solutions are an innovative aide which can be used to bolster data infrastructure of banks. They are a growing alternative to traditional, satellite dependant means of achieving time. Network derived time can be used to optimise trade lifecycle management, improve transaction reporting and inform strategic decisions. This enables the verification of transactions to become more efficient and reliable and also opens up the possibility to identify significant cost savings. “The implications of the Fourth Industrial Revolution mean that traceable timing solutions are becoming increasingly relevant outside of financial services – as posited by Brad Casemore, the vice-president of Datacenter Networks at IDC, ‘Time and time services are more ubiquitous and more valuable today than many business leaders realise’.”

5 things cybersecurity leaders need to know to make hybrid work safe

Companies need to buy into zero trust, or the philosophy that organizations should not trust anything inside or outside their network. Even the savviest internet users are targets for phishing scams and require constant education to sidestep hackers targeting vulnerabilities. Zero trust can manifest as a suite of programs to prevent phishing. Web users must keep up-to-date on common scams, such as suspicious links and misspelled email addresses, to avoid putting the workplace at risk. Companies can install software to block downloading external software and monitor how devices can be used. Cryptographic systems such as two-factor authentication (2FA) could be key to staying secure, Cerf and Rashid agreed. That could take the form of an app on a smartphone or a physical cryptographic device. Employers can also apply these principles to working in the office. There may come a time where the corporate network is compromised, and it is crucial that security teams assume their networks could be exposed. Cerf predicts 2021 will bring expanded internet coverage in rural areas and increased 5G speeds and capabilities.

Vulnerability in Schneider Electric PLCs allows for undetectable remote takeover

Once leaked, attackers can use the stolen hash to take over the secure connection that UMAS establishes between the PLC and its managing workstation, allowing the attacker to reconfigure the PLC without needing to know a password. Reconfiguration, in turn, allows the attacker to perform remote code execution attacks, including installation of malware and steps to obfuscate their presence. Schneider Electric said it applauds security researchers like Armis and has been working with the company to validate its claims and determine remediation steps. "Our mutual findings demonstrate that while the discovered vulnerabilities affect Schneider Electric offers, it is possible to mitigate the potential impacts by following standard guidance, specific instructions; and in some cases, the fixes provided by Schneider Electric to remove the vulnerability," Schneider said in a statement. Industrial control systems vulnerabilities have been a rising problem in recent years, but it's important to note that just because PLCs like Schneder's Modicon line are vulnerable doesn't mean an attacker will have an easy time taking control of them.

For The First Time, Scientists Have Connected a Superconductor to a Semiconductor

Ultrathin semiconductors like the one used here are currently a hot investigation topic for researchers: they can be stacked together to form entirely new synthetic materials known as van der Waals heterostructures. These structures have a lot of potentially innovative uses, such as being able to control electron magnetism with electric fields. However, a lot of this potential is still theoretical, because scientists just don't know what effects they're going to get yet and what devices they might be able to make. Which is why succeeding in creating this latest combination is so important. ... Getting this semiconductor-superconductor link together isn't easy – as you would expect, considering no one has done it before. The semiconductor is placed in a sandwich, with insulating layers above and below, while holes etched in the top of the insulating layer provide the electrical contact access. The superconducting material fills the gaps left by the holes, and the process is finished inside a nitrogen-filled glove box to protect the finished system from damage. Remote-controlled micromanipulators are used to complete the fabrication, under an optical microscope.

Financial services unchained: The ongoing rise of open financial data

Open financial data could put powerful non-bank companies in a stronger position to become financial-services players. With digital adoption leaping ahead by years in just several months,4 many ecommerce, tech, and social-media companies have accumulated a massive lead in customer attention. This opens the possibility for them to be the first port of call for new financial products and services to their user bases, similar to what Google now enables customers to do with its “Plex” product, connected to the Google Pay app. According to the Google web site, Plex is offered in partnership with 11 banks and credit unions and includes physical and virtual debit cards, peer-to-peer payments, and an associated checking account. In Singapore, the government recently issued banking licenses to five nonbanking players, including the consumer ecosystem Grab (200 million users in eight countries) and the consumer internet company Sea. The surge in online activity and digital behaviors has also opened up new avenues for companies to integrate financial services directly into customers’ daily activities, such as online shopping and the management of payments related to cars.

Dutch prosecutor ordered to give evidence on EncroChat hack

The decision is the first time an official has been required to explain the role of the Netherlands in the operation to hack EncroChat, which has led to arrests worldwide of hundreds of members of organised crime groups. The Dutch Public Prosecution Service’s public position is that it was not involved in the development or deployment of a “software implant” used by the French Gendarmerie to harvest 120 million messages from the phones, which were largely used by organised criminal groups. Dutch prosecutors argue that it is not up to the Dutch courts to assess the legality of the French police operation to intercept messages from EncroChat, which were subsequently shared with the Netherlands, the UK, Sweden and other countries. But the claim has been questioned by defence lawyers in the Netherlands, who point to evidence from the UK and elsewhere that suggests the Dutch and French Gendarmerie worked closely together on the operation. A court in Den Bosch ruled last week that a public prosecutor involved in the Dutch investigation into EncroChat, codenamed 26Lemont, should give evidence on the Dutch judiciary’s role in the operation with the French.

Moving away from ReactJs and VueJs on front-end using Clean Architecture

One of the biggest problems when it comes to evolving an application is the coupling to the UI framework. On the front-end little by little due to the responsibilities that applications of this type have been gained over time, it makes more and more sense to develop in a more structured way and the problems to be solved are very similar to those that exist on other fronts such as backend or mobile development. There are frameworks like ReactJs and VueJs that make life easier for us to take on these challenges on the front-end. A front-end application today is an independent application of the backend in many cases and therefore needs to have its own architecture. ... Using the UI framework for what is strictly necessary allows us to better adapt to changes in future versions of the framework. This is because the code that contains the application logic, which is the most important part, that changes less over time, and is the code potentially to be shared between two versions of the same app as in this example, it’s uncoupled without depending on the UI framework.

Data Scientists and ML Engineers Are Luxury Employees

First, machine learning and data science are fascinating fields. Mostly because they sit at the crossroad of computer science, mathematics, and business understanding. This means that there is way more room for personal growth. When switching from software engineering to machine learning engineering, my backyard suddenly tripled in size. I could continue to craft beautiful and complex systems with my hands (and become the great engineer I wanted to be) and at the same time satisfy (way more) my intellectual curiosity. Now every day, I get to learn and sit on the shoulder of giants! Apart from the interest in the field, another main reason is a bit more practical. I have spent so much time and energy learning the necessary topics (think probability, statistics, calculus, linear algebra, distributed computing, machine learning, deep learning…) that I want this knowledge to stick in. And we are all humans. Even if you are a genius, if you don’t practice what you learn, the knowledge goes away. So when your boss asks you (for the tenth time in a row) to create a piece of software or an analysis that has nothing to do with machine learning, what is that you think? Are you happy?

Blockchain 'Immutability' Dispute Sparked by Ethereum Request for Reorg Contract

Conversations and debates concerning blockchain immutability have been taking place for years, and a fresh new discussion has ignited over a tweet and smart contract published on Github by the developer Bunny Girl. On July 10, Bunny Girl explained that the smart contract aims to enhance systematic chain reorganizations. A blockchain reorganization is a contentious subject and basically occurs when a chain of recorded blocks is invalidated. Reorganizations have taken place on various blockchains when a mining entity or group of miners controls more than 51% of the hashrate. Blockchain reorganizations force miners (not participating in the reorg) back to a point where they have to start again from a specific block height. It’s akin to rolling back a recorded history of transactions and then re-recording them again, but of course, the new transactions would never be the same as the ones that were erased. ... The RFR thread was followed by an extremely mixed reception. “So we just ignoring immutability now?” asked one person in response to Bunny Girl’s tweetstorm.

IOTA - The Most Accessible DLT Network for NFTs

In recent months, NFTs have been a major talking point among tech heads, industry experts and the art world. Even traditional, non-industry media has covered the feverish debate surrounding the possibility of digitally representing assets on a distributed ledger and trading them as so-called NFTs on dedicated platforms. NFTs are cryptographic tokens that represent something unique (or ‘non-fungible’) in digitized form. Virtually anything can be digitized and represented as an NFT. You can represent and trade digital assets such as digital artworks, video clips, music or gaming items as NFTs, as well as physical assets such as real estate, paintings, or vintage cars. Thanks to the underlying DLT, ownership of an NFT is digitally certified and can only be changed (either by transferring it or destroying it) by the owner. Many new use cases are only possible by means of the digitized representation of digital asset ownership. .., NFTs maintain their uniqueness, which makes them an excellent solution for digitizing the collectibles market, where there is proof of ownership and protection from copyright infringement.

Quote for the day:

"The meeting of two personalities is like the contact of two chemical substances: if there is any reaction, both are transformed." -- Carl Jung

Daily Tech Digest - July 12, 2021

Red teaming – getting prepared for the inevitable

A red teaming exercise is undertaken with the aim of exploring areas that other assessments would overlook to determine the overall attack chain. Unlike a penetration testing exercise, which usually lasts for around a week or two, a red teaming engagement should be considerably longer. The total elapsed time of an engagement will be several months, or even up to a year, with the team carrying out a series of different exercises during that time and allowing time gaps in between. During the exercise, the team works to identify vulnerabilities and formulate plans on how criminals could exploit the identified weaknesses. These could lie within a business’ people, network, company inboxes, or even physical access to offices. There are several stages to a red teaming engagement, both on a technical and physical level. ... The red team will spend a significant portion of time mapping out the various physical and technical access points to an organisation before they attempt to breach. The preparation for a red teaming exercise takes significantly longer than other security assessments, as there is often a very specific set of targets in mind, rather than testing any and every area of the business.

Navigating Active Directory Security: Dangers and Defenses

Threat actors typically need initial access on a domain-joined system in an organization, says Natarajan, and they can achieve it in multiple ways, including spear-phishing emails with malicious attachments, drive-by download attacks, and exploiting a vulnerability in an Internet-facing system. Once a victim runs the malicious binaries, the attacker has a better chance of getting initial access over the system. They could exploit other system flaws to gain administrative privileged access, and AD reconnaissance tools can help them understand the directory structure and choose their targets. Various mis-configurations – which experts agree are plentiful in AD environments – can help them escalate their privileges to domain administrator. "To me, it's almost more attractive because there's not a patch for that," says Will Schroeder, technical architect at SpecterOps, of misconfigurations from an attacker's perspective. "There are ways that people can fix it, but over time this kind of debt and misconfiguration can build up." Because AD systems are so complex, little things can create large security holes over time.

Programming Evolution: How Coding Has Grown Easier in the Past Decade

In the past decade, APIs have played a huge role in the programming evolution. It's easy for developers to have a love-hate relationship with APIs. APIs create additional security risks that programmers need to manage. They often place limits on which functionality you can implement within an API-dependent app because you can only do whatever the API supports. And APIs can become single points of failure for applications that depend centrally on them. On the other hand, APIs make the lives of programmers easier in the sense that they make it fast and simple to integrate disparate services and data. Until about 10 years ago, if you wanted to import data from a third-party platform into your app, you probably would have had to resort to an "ugly" technique--such as scraping the data off of a web interface. Today, you can easily and systematically import the data using the platform's API ... Until about a decade ago, not only were there relatively few open standards that major vendors supported, but companies often went out of their way not to make their platforms compatible with those of external organizations.

Understanding and stopping 5 popular cybersecurity exploitation techniques

Criminals use stack pivoting to bypass protections like DEP by chaining ROP gadgets in a return-oriented programming attack. With stack pivoting, attacks can pivot from the real stack to a new fake stack, which can be an attacker-controlled buffer such as the heap. The future flow of program execution can be controlled from the heap. While Windows provides export address filtering (EAF), a next-gen cybersecurity solution can provide an access filter that prevents the reading of Windows executables (PE) headers and export/import tables by code, using a special protection flag to protect memory areas. An access filter should also support allowlist so heuristics can be tweaked as needed. ... Many advanced, next-gen cybersecurity solutions place hooks on sensitive API functions to intercept and perform checks, such as antivirus scanning, before allowing the kernel to service the request. Criminals can take advantage of the fact that only sensitive functions are monitored. By calling an unmonitored, non-sensitive function at an offset (to intentionally address an important kernel service instead), cybercriminals can often evade security software.

AI has become a design problem

All the best data, model, and development practices in the world cannot fully guarantee perfectly behaved AI. In the end, good user interface design has to appropriately present AI to end users. An effective user interface can, for instance, tell the user the provenance of its insight, recommendations, and decisions. ... Historically, UIs presented data as matter-of-fact. Common lists of data were not suspect; they were simply regurgitating what was stored. But increasingly, presentations of data are sourced, culled, and shaped by AI and therefore carry with them the suspect nature of the AI’s curation. UI design must introduce new mechanisms to allow users to inspect data provenance and reasoning and introduce visual cues to better share data confidence and bias to the user. As we navigate the intricacies of a technology already integrated into many of our systems, we must design these systems in a responsible manner, mindful of transparency, privacy, and fairness. Design can frame AI-driven user experiences to end users in a manner that engenders trust and helps the end user understand the scope, strengths, and weaknesses of a given system. In turn, fear and mistrust are alleviated around the mysterious black boxes.

4 Key Observability Metrics for Distributed Applications

Latency is the amount of time it takes between a user performing an action and its final result. For example, if a user adds an item to their shopping cart, the latency would measure the time between the item addition and the moment the user sees a response that indicates its successful addition. If the service responsible for fulfilling this action degraded, the latency would increase, and without an immediate response, the user might wonder whether the site was working at all. To properly track latency in an Impact Data context, it's necessary to follow a single event throughout its entire lifetime. ... Tracking error rates is rather straightforward. Any 5xx (or even 4xx) issued as an HTTP response by your server should be tagged and counted. Even situations that you've accounted for, such as caught exceptions, should be monitored because they still represent a non-ideal state. These issues can act as warnings for deeper problems stemming from defensive coding that doesn't address actual problems. Kuma can capture the error codes and messages thrown by your service, but this represents only a portion of actionable data.

How to avoid the network-as-a-service shell game

Our Rule One says that your project has to meet financial targets, meaning a target ROI. NaaS makes it easier to figure out whether a project meets CFO targets, but remember that anything sold as a service has to include a profit margin for the seller. The cloud has not replaced every data center, not because of CIO intransigence but because the cloud isn’t always cheaper. NaaS wouldn’t always be cheaper either, so a NaaS-based project is going to have to prove it’s a better strategy than capital purchasing would be. Your trip to the CFO’s office just got more complicated. Another issue with NaaS is cost control. With traditional networking, you pay a fixed amount for fixed capacity. Your cost is predictable. Any kind of consumption-based pricing risks generating some truly eye-popping bills if the usage is greater than expected, and most such systems really don’t make it easy to ensure that excess usage doesn’t happen. Serverless cloud computing customers are already whining over multi-hundred-percent cost overruns. It seems like you can either face your CFO during project approval or face your CFO when you blow your budget. The latter isn’t likely a great career move for you.

What You Need to Know About Ransomware Insurance

Ransomware insurance is like any other type of cyber insurance. "Cyber insurance is about assessing the cyber risk, determining the potential losses due to attacks, and then obtaining coverage," said Bhavani Thuraisingham, a professor at the University of Texas at Dallas, as well as the executive director of the university’s Cyber Security Research and Education Institute. The unique challenge with ransomware is that once an attacker gets into the system, they have access to everything within. "[They aren't] just stealing your data but crippling your system by encrypting all of the data and files so that you can't have access unless you pay them a ransom," she explained. "It's like someone breaking into your house and stealing your jewelry, but also kidnapping your child and demanding a ransom," Thuraisingham quipped. Ransomware insurance is generally sold along with, or in addition to, a general cyber insurance policy. The appropriate cyber liability insurance policy depends primarily on the applicant's industry and operations, observed Jack Dowd an account executive at insurance provider The Dowd Agencies.

Ensuring digital maturity in the boardroom

Becoming digitally mature allows organisations to future-proof their business. Something that became clear during the pandemic was that the ability to remain agile is paramount. Digital transformation enables this. Utilising cloud technologies gives enterprises the freedom and flexibility to work wherever and however it is necessary. From here, businesses can further foster a flexible culture, promoting a better work-life balance for employees. However, as society climbs back to normal, many within the boardroom will understand that there are more benefits to digital transformation than remote working. Scalability is an essential factor. Technology is not bound to physical restrictions, digital services and solutions can be increased, enhanced and altered at a moment’s notice. This not only helps to keep organisations agile, but also provides the foundations of future growth. These increased levels of scalability and agility combine to enable greater growth and profitability for businesses. Efficient and cost effective processes allow leaders to focus on wider business opportunities, and greater access to data produces better decision making, faster.

Ransomware Landscape: Notorious REvil Is Only One Operator

Many ransomware-wielding attackers will first attempt to contact victims directly and get them to pay a ransom, promising that if the organization does so quickly, then attackers will never leak their data or attempt to "name and shame" them. Hence the number of victims who simply pay remains unknown. Furthermore, the damage caused by a single attack from a more sophisticated ransomware operation, such as REvil, can be severe. Miami-based Kaseya's software is used by a number of managed service providers to manage clients' endpoints, and up to 60 MSPs and 1,500 of their clients were infected by REvil - aka Sodinokibi - ransomware just in that single attack. REvil has also been tied to the attack against meat-processing giant JBS - who paid attackers an $11 million ransom - and many other attacks. Another operation, called DarkSide, claimed credit for the May attack against Colonial Pipeline Co., which supplies 45% of the fuel used along the East Coast. Shortly after the attack, DarkSide claimed it would shut down its ransomware-as-a-service operation because of unwanted publicity and attention.

Quote for the day:

"It is the responsibility of leadership to provide opportunity, and the responsibility of individuals to contribute." -- William Pollard

Daily Tech Digest - July 11, 2021

4 Ways AI Should Be Playing a Role in Your DX Strategy

The real value of AI lies in the data that it is able to process and analyze. “The backbone of AI and ML is data and in order to get real business value out of AI and ML, you need deep and broad data that covers your entire digital experience ecosystem. Once that data is harnessed and correlated, AI and ML can be a game changer for the enterprise with deep, contextual, and automated insight into your digital experience. AI and ML can then be used to proactively identify investments that will provide the most ROI, accelerate time intensive efforts like root cause analysis, and reduce the workload on your IT team by automating repetitive tasks.” Daniel Fallmann, CEO at Mindbreeze, an insight engine provider, shared his thoughts on how AI is used to analyze data to drive business process transformation. “...you can learn if a customer really needs a specific product or service by using AI to review data from the past, such as published press releases, subscriptions, form information on your website, and more,” Fallmann said. Like Malloy, Fallmann reiterates the value of diving deep and consolidating disparate data in order to reap the benefits of holistic views.

Tech Has Advanced Rapidly—And Cybersecurity Needs To Catch Up

Data is any business’s most critical asset. Like the valuable and confidential items in your home, it’s not easily retrieved once it’s in the wrong hands. Ultimately, when it comes to cyberattacks, it will always be a case of not “if” but “when” an SME will suffer a breach or fall foul to an attack. SMEs must focus on understanding their risks, getting the basics right and creating a strong “human firewall” as the foundation of their cybersecurity strategy. Ask yourself: “Am I protecting my employees, my customers and my reputation? Am I protecting my data and assets?” Starting here will help SMEs understand the risks and focus on the basics that will have the biggest impact. This could consist of installing phishing protection and firewalls across all devices, investing in authentication methods or keeping software and anti-malware up to date. Invest in training to ensure all employees have a true understanding of the cybersecurity risks the business faces, including how to identify phishing scams and what the process is on reporting them. Finally, keep security top of mind, and don’t underestimate its importance.

Microsoft Office Users Warned on New Malware-Protection Bypass

“The malware arrives through a phishing email containing a Microsoft Word document as an attachment. When the document is opened and macros are enabled, the Word document, in turn, downloads and opens another password-protected Microsoft Excel document,” researchers wrote. Next, VBA-based instruction embedded in the Word document reads a specially crafted Excel spreadsheet cell to create a macro. That macro populates an additional cell in the same XLS document with an additional VBA macro, which disables Office defenses. “Once the macros are written and ready, the Word document sets the policy in the registry to ‘Disable Excel Macro Warning,’ and invokes the malicious macro function from the Excel file. The Excel file now downloads the Zloader payload. The Zloader payload is then executed using rundll32.exe,” researchers said. Because Microsoft Office automatically disables macros, the attackers attempt to trick recipients of the email to enable them with a message appearing inside the Word document. “This document created in previous version of Microsoft Office Word. To view or edit this document, please click ‘Enable editing’ button on the top bar, and then click ‘Enable content’,” the message reads.

How cybersecurity is getting AI wrong

Unknown unknowns are so prevalent in cyberspace that many service providers preach to their customers to build their security strategy on the assumption that they’ve already been breached. The challenge for AI models emanates from the fact that these unknown unknowns, or blind spots, are seamlessly incorporated into the models’ training datasets and therefore attain a stamp of approval and might not raise any alarms from AI-based security controls. For example, some security vendors combine a slate of user attributes to create a personalized baseline of a user’s behavior and determine the expected permissible deviations from this baseline. The premise is that these vendors can identify an existing norm that should serve as reference point for their security models. However, this assumption might not hold water. For example, an undiscovered malware may already reside in the customer’s system, existing security controls may suffer from coverage gaps, or unsuspecting users may already be suffering from an ongoing account takeover. Errors: It would not be brazen to assume that even staple security-related training datasets are probably laced with inaccuracies and misrepresentations.

What are the most common cybersecurity challenges SMEs face today?

The ENISA report provides advice for SMEs to successfully cope with cybersecurity challenges, particularly those resulting from the COVID-19 pandemic. With the current crisis, traditional businesses had to resort to technologies such as QR codes or contactless payments they had never used before. Although SMEs have turned to such new technologies to maintain their business, they often failed to increase their security in relation to these new systems. Research and real-life experience show that well prepared organizations deal with cyber incidents in a much more efficient way than those failing to plan or lacking the capabilities they need to address cyber threats correctly. Juhan Lepassaar, EU Agency for Cybersecurity Executive Director said: “SMEs cybersecurity and support is at the forefront of the EU’s cybersecurity strategy for the digital decade and the Agency is fully dedicated to support the SME community in improving their resilience to successfully transform digitally.” In addition to the report, ENISA also publishes the Cybersecurity Guide for SMEs: “12 steps to securing your business”.

Your dev team lead is not controlling enough

When I first got promoted to team lead I was highly controlling. I literally did most of my team's work for them. I worked seventeen hours a day six days a week to ensure every single task was completed to my exact specification. The people that worked for me were unhappy (some actively disliked me personally) but we got results that the CEO cared about so it went unnoticed. And I was good at managing up, so I actually got promoted for this behavior! I was in my early twenties and motivated by the wrong things (power, money, and, of course, control). I look back on the period with embarrassment and I've actually apologized to many of the people who worked for me back then. ... when I realized micro-management was wrong, I naturally swung the pendulum in the exact opposite direction. I told myself I was hiring smart people and I should leave them alone. I'm good at hiring so it kind of worked. But, again, the people who worked for me suffered -- this time in a way that they noticed much less. Good people actually want feedback! It's not good for their work to go unchallenged because then it's harder to improve.

Cyber security too often takes back seat in C-Suite

Chief information security officers are studying these threats daily and are in the best position to communicate what they’ve learned to decision makers. But too often, Hamilton said, CISOs have trouble translating their technical findings for board room audiences. While the top executives could often use with a little more training on the ins and outs of technological threats, information security executives also need to do a much better job of reading the room. CISOs must present their information in terms of risk to the bottom line. “Scary Russian cyber buffer overflow SQL injection ... nobody cares,” Hamilton said. ... “It’s more about being able to say something like, ‘we have 1 million records meeting the definition of personally-identifiable information, and we know that they’re worth about $200 apiece if you’ve got to clean up a data breach. That’s $200 million in potential liability. Can I have $50,000 for controls to reduce that risk in half?” While the knee-jerk reaction with cyber security may be to name an organization’s best technical expert the CISO, that can end up backfiring unless that person is willing to sharpen their understanding of the business they’re trying to protect.

The Rise of the ML Engineer

Just fifty years ago, machine learning was a new idea. Today it’s an integral part of society, helping people do everything from driving cars and finding jobs to getting loans and receiving novel medical treatments. When we think about what the next 50 years of ML will look like, it’s impossible to predict. New, unforeseen advancements in everything from chips and infrastructure to data sources and model observability have the power to change the trajectory of the industry almost overnight. That said, we know that the long run is just a collection of short runs, and in the current run, there is an emerging set of tools and capabilities that are becoming standards for nearly every ML initiative. We have written about the 3 most important ML tools: a feature Store, a model store, and an evaluation store. Click here for a deeper dive. Beyond the tools that power ML initiatives, the roles that shape data teams are also rapidly evolving. As we outline in our ML ecosystem whitepaper, the machine learning workflow can be broken into three stages — data preparation, model building, and production and at every step of the process, the skills and requirements are different:

Cloud computing's destiny: operating as a single global computer, enabled by serverless

For all the progress of what's happening on cloud, we have to "get to the point where we get the cloud to work as if it was a single infinitely powerful computer," says Nagpurkar. Right now, there are too many obstacles in the way, she adds. "Think about the simplicity of just working on your laptop. You have a common operating system tools you you're familiar with. And, most importantly, you're spending most of your time working on code. Developing on the cloud is far from that. You have to understand the nuances of all the cloud providers -- there's AWS, Azure, GCP, IBM, and private clouds. You have to provision cloud resources that might take a while to get online. And you have to worry about things like security, compliance, resiliency, scalability, and cost efficiency. It's just a lot of complexity." Proprietary software stacks from different vendors "not only add to all this complexity but they stifle innovation," she says. "Key software abstractions start with the operating system. Linux as the operating system for the data center era unleashed this proliferation of software, including virtualization technologies like containers. That ushered in the cloud era."

'Barely able to keep up': America's cyberwarriors are spread thin by attacks

Cybersecurity professionals can barely keep up despite significant industry growth in recent years — and plenty more money is pouring in. That money is chasing a limited talent pool, with almost a half-million cybersecurity jobs unfilled, according to CyberSeek, a project that tracks the industry and is sponsored by the federal National Institute of Standards and Technology. The government is also on a massive hiring spree, with the Department of Homeland Security racing to fill more than 2,000 cybersecurity jobs. Secretary Alejandro Mayorkas called it a victory last week that it had recently onboarded almost 300 new employees and offered jobs to 500 more. It’s a problem that some in the cybersecurity industry are hoping to address even in the years to come. The National Cryptologic Foundation, a nonprofit affiliate for the National Security Agency, offers free educational materials to middle schools. The Center for Infrastructure Assurance and Security at the University of Texas at San Antonio has produced free cybersecurity educational games for students in an effort to inspire young people to consider careers in the industry.

Quote for the day:

"The great leaders have always stage-managed their effects." -- Charles de Gaulle

Daily Tech Digest - July 10, 2021

IT leadership: 3 ways to enable continuous improvement

"If technical leadership has one job, it is to tend to that socio-technical system so that team members can spend as much time as possible on priorities that move the business forward, not on trying to navigate or fix internal systems. Pay really close attention to those feedback loops and make them tight. Invest in the work where it makes sense – not just trying to fix everything and make it perfect, but look for where you can get really big wins and not have to reinvent the wheel. “It turns out we have the benefit of knowing all the science that even just five to 10 years ago, we didn’t have. Read Accelerate, for example. There used to be a lot of ‘I think’ statements, and while it worked, it was very ‘cult-y’ and it was very based on osmosis. If you had been lucky enough to work with one of the best engineers in the world, then you kind of knew this stuff – it was all just contagious. Now, we have this freely available data, and we should be using it.” ... “If your job is to align people, motivate, and understand the friction points, you really have to walk a mile in their shoes, and you have to find the outcomes that fix those problems,” says GitHub’s Dana Lawson.

New SaaS Security Report Dives into the Concerns and Plans of CISOs in 2021

For years, security professionals have recognized the need to enhance SaaS security. However, the exponential adoption of Software-as-a-Service (SaaS) applications over 2020 turned slow-burning embers into a raging fire. Organizations manage anywhere from thirty-five to more than a hundred applications. From collaboration tools like Slack and Microsoft Teams to mission-critical applications like SAP and Salesforce, SaaS applications act as the foundation of the modern enterprise. 2020 created an urgent need for security solutions that mitigate SaaS misconfiguration risks. Recognizing the importance of SaaS security, Gartner named a new category, SaaS Security Posture Management (SSPM), to distinguish solutions that have the capabilities to offer a continuous assessment of security risks arising from a SaaS application's deployment. To understand how security teams are currently dealing with their SaaS security posture and what their main concerns are, Adaptive Shield, a leading SSPM solution, commissioned an independent survey of 300 InfoSecurity professionals from North America and Western Europe, in companies ranging from 500 to more than 10,000 employees.

How Enterprise Architects Can Evolve from Order Takers to Trusted Advisors

The value of strong interpersonal skills can’t be overstated when it comes to building trust with executives. Persuasive advisors are those that are confident and clever in how they communicate their ideas to others. That being said, there are also tools EAs can leverage to appeal to executives and secure buy-in for projects. Though they may propose and finance IT change projects, many executives are focused on other areas of business besides IT logistics. As such, EAs won’t get their ideas across by using heavily technical jargon or by presenting complex spaghetti models to them. Instead, they need to address executives’ personal priorities when detailing their proposed solutions: are they looking to cut costs? Make their data stores more compliant? These are the value points that EAs need to address when presenting their ideas. With a platform that enables EAs to manipulate their organizational data to support different viewpoints, EAs can speak to executives’ and stakeholders’ personal interests, instead of turning them away.

Java on Visual Studio Code Update – June 2021

Remote Development has always been a popular feature in Visual Studio Code and it allows developers to use a container for a full-feature development environment. For the upcoming quarters, we are working on supporting more Java versions as well as Spring framework in the containers so developers can access those technology in their remote development scenarios. We have just released support for Java 16 in the remote dev container which is shown in the later sections of this post. In addition, Gtihub Codespaces is a configurable online development environment that allows you to develop entirely in cloud. Visual Studio Code plays a critical role in Codespaces as it provides the essential code editing experience. In terms of Java, the team is working on providing the support for Java language extensions in Codespaces so Java developers can find all Java related tools they need. For details on how to request access for Codespaces, please follow the official Codespaces documentation here. In terms of testing, Visual Studio Code Java is targeting to adopt the new Testing APIs introduced recently.

OpsRamp’s Ciaran Byrne on managing multicloud and hybrid environments

The biggest challenge is dealing with the complexity. It’s not just a matter of cloud and on-premises; you have networks, servers, storage, virtual environments, containers, and applications that you have to discover and collect metrics on, and those are running in both cloud and on-premises environments. In most cases, you’ll be managing these mixed environments with multiple monitoring tools, leading to tool sprawl. You’ll have to make sense of large volumes of data coming from these mixed environments managed by a diverse toolset. The environments that are mixed will likely have inter-dependencies which may make it difficult to be aware of and troubleshoot issues. Troubleshooting may also be more complicated, as each of the environments will have their own nuances for investigating and resolving issues that require operators and admins to have a broad range of skills. Once you’ve “solved” the problem of monitoring these hybrid environments, you have to understand which parts of this hybrid infrastructure are supporting which application services.

How RPA-As-A-Service Can Power The Next Mid-Market Winner

Current RPAaaS offerings, including the solution we offer at AutomationEdge, are low on code and high on “drag and drop” functionality, making the intuitive user interfaces open to automation across the enterprise. With an RPAaaS solution that has plug-ins that connect to the common systems of record in the enterprise, RPA is no longer an island, but rather a means of intergalactic travel across the enterprise galaxy. ... Full-blown, on-premise RPA implementations come with mature governance models, which are unnecessary at the start of a company’s life. A check-the-box approach to governance that meets all mandatory legal, financial and accounting requirements is adequate for this stage of growth. Not all processes need to be run every day; many are run once a quarter or even annually. Employees can monitor these processes much easier. Another advantage of RPAaaS is having access to a robust RPAaaS community that can help developers keep in touch with the latest hacks, patches and previews that they can then bring into their craft.

Top 10 Chrome Flags you should consider enabling in July 2021

Chrome Flags are basically experimental features that Google is currently testing on either Chrome OS or the Chrome browser. It’s important to note some Flags are exclusive to Chrome OS, while others work on Chrome browsers across Android, iOS, macOS, and Windows. Eventually Flags will be removed as they become part of either a stable Chrome release, or get absorbed into Chrome developer tools. Once you enable a Flag, you need to restart your browser (or restart your machine if you’re on Chrome OS) for the change to take effect. You should realize that enabling Flags does carry some risk. Not all Flags are stable and may cause some unintended behavior with your browser or device. It’s also important to understand that browser-based Flags are not tested for online security protocols. This means you carry some security risk when conducting financial transactions online while using untested Chrome Flags. If you run different versions of Chrome OS or Chrome browser, you can find different Flags available.

Industrial cybersecurity: How to protect your assets in the digital transformation age

Industrial businesses that embrace transformation and have a holistic view of cybersecurity are benefitting from diverse technology ecosystem development, including connected devices, edge control, apps, analytics and cloud services, which are enhancing business performance at an unprecedented pace. It’s vital that your organization’s approach to security is part of the organizational culture – using components that meet recognized standards and include encryption by default. Security must be integral to the design of any process or operation and fundamentally baked into the services that support the operation of your systems and business objectives. The tsunami of risks focused on operating technology (OT) ranges from the exposure of intellectual property and lost production systems or data to serious fines and reputational loss. Cybersecurity is a multi-faceted discipline requiring a proactive approach across the business. For your business to be best prepared against threats, it’s important to consider the following elements:

5 Skill Sets A Blockchain Developer Must Have

Data Structure is the first essential skill that a Blockchain programmer should have. For the advancement and deployment of systems, blockchain engineers must engage with the data structures skill promptly. The entire Blockchain system is made up of data structures. Moreover, we can also say that a block is indeed a data structure. Because of their encapsulating data structure and the public ledger functioning as the Blockchain, blocks behave as groups of transaction activities associated with the open register. ... Cryptography is a methodology for designing procedures and algorithms to prevent a foreign entity from reading and learning content from personal messages throughout a communication session. Kryptos and Graphein are two old Greek concepts that mean “disguised” and “to record,” respectively, are also used in cryptography. ... The potential to view and collect information across many blockchain systems is known as interoperability. For instance, if someone sends data to some other blockchain, will the receiver read, understand, and respond to it with minimal effort?

5 elements of servant leadership

Setting expectations is quite simply clearly defining what is needed from each individual in the performance of their assigned role. It is all of the what’s and when’s of the position. In some roles and organizations, it may also articulate the how’s. Expectations define the goals, activities, and behaviors that drive the measurable results that the manager is charged with. For employees, it clarifies their contribution to the organization - both what it is and what it should be. It represents the outcomes to which they are being held accountable and enables them to check the objective behaviors or metrics to which they are held accountable. ... Mobilization is about skills and the effective application of those skills to drive the team’s mission. Managers have to ensure that their team is both equipped and deployed to most effectively contribute to the organization. This includes matching team members’ strengths with specific tasks or roles and constantly asking if there are other or alternative contributions that could be made. The most effective managers hold their directs responsible for skills development by setting a vision for what is needed, suggesting methods, and making opportunities available.

Quote for the day:

"Leadership is particularly necessary to ensure ready acceptance of the unfamiliar and that which is contrary to tradition." -- Cyril Falls