Daily Tech Digest by Kannan Subbiah

Daily Tech Digest - July 21, 2021

Two-for-Tuesday vulnerabilities send Windows and Linux users scrambling

The world woke up on Tuesday to two new vulnerabilities—one in Windows and the other in Linux—that allow hackers with a toehold in a vulnerable system to bypass OS security restrictions and access sensitive resources. As operating systems and applications become harder to hack, successful attacks typically require two or more vulnerabilities. One vulnerability allows the attacker access to low-privileged OS resources, where code can be executed or sensitive data can be read. A second vulnerability elevates that code execution or file access to OS resources reserved for password storage or other sensitive operations. The value of so-called local privilege escalation vulnerabilities, accordingly, has increased in recent years. The Windows vulnerability came to light by accident on Monday when a researcher observed what he believed was a coding regression in a beta version of the upcoming Windows 11. The researcher found that the contents of the security account manager—the database that stores user accounts and security descriptors for users on the local computer—could be read by users with limited system privileges.

Establishing the right analytics-based maintenance strategy

Although predictive maintenance is often held up as a prime example of the value that IoT and advanced analytics can generate, in fact, any predictions in the real world are imperfect. Our research shows that some organizations, even with highly qualified AA teams, are unlikely to realize the desired impact. The AA algorithm employed may fail to predict a breakdown, giving a false negative, and in other cases can predict an event that would not have happened, giving a false positive. Although much effort is often put into minimizing false negatives, it is often the false positives that make predictive maintenance less viable. Make no mistake, predictive maintenance can be very valuable. In situations with very high cost or safety issues associated with a breakdown, such as the midair failure of a jet turbine, operators need the closest estimate possible of when a breakdown might occur. In addition, in cases in which failures are highly predictable and well-understood—and the chance of a false positive is therefore minimal or very low-cost—predictive maintenance is well worth the expense.

Politicization and stigmatization won’t solve cyber security concerns: Chinese Mission to the EU and embassies

Slamming the EU and NATO's allegations, spokesperson of the Chinese Mission to the EU said that the statements were not based on facts, but speculation and groundless accusations. He added that China has always been a firm defender of cyber security and has cracked down on cyber attacks launched within China or using Chinese cyber facilities. "For years, certain countries in the West have abused their technological advantages for massive and indiscriminate eavesdropping across the world, even on its close allies. At the same time, they have boasted themselves as the guardians of cyber security. They push around their allies to form small circles and repeatedly smear and attack other countries on cyber security issues," the Mission said. Such practices fully expose the West's hypocrisy, it added. The Mission said it will follow closely NATO's attempts to break its geographical constraints under the guise of cyber security to make false accusations against China. Over the years, China has been a major victim of cyber attacks.

Old Agile vs New Agile

Agile 2 is new in that it aggregates the ideas of these new thinkers, and integrates these ideas into a cohesive system of thought, while adding missing pieces. Agile 2 interprets these many writings and translates them into a common and holistically integrated shared narrative. But what is that narrative? Agile 2 is complex because humans are complex. It is not a set of bumper sticker maxims asserted without supporting explanation and rationale. Agile 2 is nuanced and broad, and is published with the thought that went into it. But I will summarize it, to give you a sense. Agile 2 is defined by its Values and Principles. Most of those principles could be summarized as described here. Basically, Agile 2 says that extremes don’t usually work well, and that judgment is called for when applying any practice. It also emphasizes the critical importance of having the right kinds of leadership for each situation. Note that “kinds of leadership” is plural. Agile 2 favors emergent leadership and autonomy, but it views those as aspirations rather than assumptions, and includes the theory that senior leaders need to be intentional about the kinds of leadership needed within their organization ...

Google advances ‘invisible’ cloud security with intrusion detection, analytics and more

Google’s new Cloud IDS offering epitomizes that vision. Announced in preview today, Cloud IDS is said to be a cloud-native, managed intrusion detection system that enterprises can deploy in just a few clicks in order to protect themselves against malware, spyware, command-and-control attacks and other network-based threats, Potti said. Google worked closely with Palo Alto Networks Inc. to develop Cloud IDS. The system incorporates that company’s advanced threat detection technologies to detect malicious network activity with very low false positives. It’s essentially a managed version of Palo Alto’s threat detection services, available in Google Cloud, where scaling, availability and updates are all automated. Google Cloud IDS stands out for its flexibility, the company says. It can easily be integrated with third-party security information and event management and security orchestration, automation and response platforms, enabling users to both investigate and automatically respond to any alerts, Potti said.

Advanced Technology Outcomes: Humans Vs. Machine Or Human With Machine?

There is no doubt that we humans have always benefited from machines and also that we have the power to turn them off when required. But now the situation has turned around. The increasing issue is the vital role played by machines both as a single unit and collectively as infrastructures. This means humans no longer have the option to shut the machines off. In the health sector as well machines are evolving at a faster rate. Surgery is becoming robotized and medical diagnostics has become dependent on machines. Even there are automated machines that are manufacturing drugs. Therefore, pulling the plug off will result in terrible consequences for thousands of people worldwide. Besides all this, we are making use of machines as an extension of ourselves and applying them as stronger, faster, and cheaper hands. And, because of this, we still win over the machines but it is on us to make accurate decisions for the upcoming future. We are continuously getting engaged with machines. We use smartphones to show routes, to reach a destination, to look for recipes, even we use smartphones to check our health and the list is increasing rapidly.

Bringing Your Factory to the Edge in 2021

Is your factory living in the dark ages? Are you constantly checking manual reports to see your production scores? Do you wish that you could check your factory health on your smart device from anywhere in the world? If so, you could benefit from taking your factory to the edge. ... Reading information directly from our fieldbus-connected devices works great for a retrofit if you are an end user and not a programmable logic controller (PLC) programmer, or if you do not have access to the controller in the system because the integrator did not provide source codes. You can use a number of protocol converters and commercially available edge connection devices to take your machine-level data to an edge platform with some basic education online. For a large number of users, this option will get their factory “talking” to them for minimal human or equipment capital. It will require only protocol conversion and an edge connector (which we will discuss in a moment) and the cloud setup of choice, which can be outsourced.

MosaicLoader Malware Delivers Facebook Stealers, RATs

Once installed on a machine, the malware creates a complex chain of processes, according to Bitdefender. Its hallmark, researchers said, is a unique obfuscation technique that shuffles small code chunks around resulting in an intricate, mosaic-like structure – hence the name. The first stage of the execution flow is the installation of a dropper, which mimics legitimate software: Most of the first-stage droppers that researchers analyzed have icons and “version information” that mirror those used for legitimate applications. In some cases, the dropper pretends to be a NVIDIA process, for instance. The dropper makes contact with the C2 (the URL of the C2 is hardcoded as a string), then downloads a .ZIP file into the %TEMP% folder that contains two files required for the second stage: appsetup.exe, and prun.exe. These are extracted to an innocuous-sounding “PublicGaming,” folder in the C: directory, while the dropper also launches several instances of Powershell to add exclusions from Windows Defender for the folder and the specific file names.

The biggest remote communication challenges within organisations

Zooming back out to an organisational level, recent events have pushed leadership teams to fully embrace digital transformation. For many organisations, making remote work plausible meant pulling together capabilities from a range of technology providers into something of a patchwork of solutions, that didn’t necessarily behave well together but was necessary given the organisational shock felt initially. Recognising that remote working is going to be a significant and constant part of our working landscape, it is now time to think about how to make this tech stack work more effectively. In many cases, this will involve consolidation, ideally onto a single CRM platform, where the sharing of customer and prospect data between marketing, sales and customer service teams is seamless, and where the platform supports growth, instead of creating friction points. ... The effects of COVID-19 disrupted the working landscape profoundly last year, meaning that UK organisations have had to rethink their working strategies. It is vital that business leaders constantly keep in touch with their employees and support them when these changes are taking place.

Image encryption technique could keep photos safe on popular cloud photo services

Now researchers have created a way for mobile users to enjoy popular cloud photo services while protecting their photos. The system, dubbed Easy Secure Photos (ESP), encrypts photos uploaded to cloud services so that attackers – or the cloud services themselves – cannot decipher them. At the same time, users can visually browse and display these images as if they weren’t encrypted. “Even if your account is hacked, attackers can’t get your photos because they are encrypted,” said Jason Nieh, professor of computer science and co-director of the Software Systems Laboratory. ESP employs an image encryption algorithm whose resulting files can be compressed and still get recognized as images, albeit ones that look like black and white static to anyone except authorized users. In addition, ESP works for both lossy and lossless image formats such as JPEG and PNG, and is efficient enough for use on mobile devices. Encrypting each image results in three black-and-white files, each one encoding details about the original image’s red, green, or blue data.

Quote for the day:

"Leaders can choose to grow and change, but generally the most powerful predictor of future performance is past behavior. Evaluate them realistically." -- Lee Ellis

Daily Tech Digest - July 20, 2021

3 Ways To Make Conversational AI Work For Your Organization

AI systems possess features unlike any mechanisms we use in human-human conversation. Consequently, you can use them in powerful ways to create conversations and experiences that go beyond what’s possible with people alone. Unlike humans, AI can be available around the clock -- whether to answer a question in the middle of the night or to support an asynchronous conversation that stretches over many days. In addition, machines have an absence of emotion and moral judgment that provides a distinct advantage in some situations. When the subject of a conversation is sensitive, interactions with AI can afford a degree of anonymity that some customers welcome. And when it comes to detecting patterns, AI excels at detecting fraud or breaches of regulatory requirements. AI is vigilant about events about to happen and can proactively engage in anticipation, thereby creating superior experience. And finally, AI is moving to a point where it can literally read your mind. ... Another point of tension is the potential for manipulation. Persuasive computing can change people’s attitudes or behaviors, while practices like hyper nudging use data to influence people to certain decisions.

Making transformation stick

Leaders must model the behaviors that will be required to sustain change. This can be done with literal acts and symbolic acts that communicate to rank-and-file employees the leaders’ commitment to the transformation. A study by the National Institute for Health Research in the UK highlights the importance of role modeling. The institute reviewed transformation programs in clinical settings and found that out of a variety of factors affecting the longevity of the transformation, senior and clinical leader role modeling was the highest predictor of sustainable change. The study defined role modeling as leaders being seen promoting and investing in the change. The transformation experience of one of our clients bears out this finding. The company recently adopted customer relationship management software that features a tool for gathering insights from client meetings. But using the tool requires the company’s client-facing employees to write up meeting notes, something many find tedious. So, the CEO of the business regularly uses the tool and sends notifications of his written reports to his executive team and their direct reports. This is a powerful example of role modeling.

How smarter data analysis can transform financial planning

Reliance on legacy spreadsheets is inefficient and causes a tremendous amount of overhead and friction for analysts – the opposite of what you want in a process that should be essential for every business. Many of the solutions to these problems involve moving away from Excel entirely, which also isn’t practical in many cases. Smaller businesses, in particular, may not have the time or manpower to migrate their data and the deep logic they’ve built into their Excel sheets to a new platform. “While the rest of the business world moves to powerful, cloud-based SaaS solutions driven by AI and automation, finance departments remain entrenched in Excel,” says Gurfinkel. “While it’s a powerful tool, it lacks modern features that could help drive better forecasting. The ideal solution is one that builds on Excel to leverage its strengths while minimising its weaknesses, rather than trying (and failing) to replace it.” “Automation” has nearly reached buzzword status at this point, but that doesn’t mean the advantages it offers aren’t real. Automation has the potential to transform nearly every facet of work – including financial planning.

Banking is broken. This small FinTech startup plans to fix it

The sheer breadth of banking services Modularbank covers is one of the company's key strengths, says Vene, who points out that competitors have often had to partner with third-party firms to provide the same services. She also believes that the decades of technology and banking experience under Modularbank's belt mean it can tackle complex use cases and customer demands more comfortably than some of its competitors. "To build highly configurable modules, you have to know the product side of finance well. It's not enough to have great technology and great engineers in your team if you don't know what the customer needs to configure in your products," says Vene. Security is another area where experience plays a critical role, and arguably nowhere is this more important than in finance. "We have been working in this field for so many years with highly regulated organizations, so it was normal for us to focus on liability and security from day one," says Vene. For instance, GDPR compliance has been designed into Modularbank's products from the beginning, she says.

How We Tracked a Threat Group Running an Active Cryptojacking Campaign

After the attackers find and enter into a Linux device with inadequate SSH credentials, they deploy and execute the loader. In the current campaign, they use .93joshua, but they have a couple of others at their disposal; .purrple and .black. All of the loaders are obfuscated via shc. The loader gathers system information and relays it to the attacker using an HTTP POST to a Discord webhook. By using Discord, the threat actors circumvent the need to host their own command-and-control server, as webhooks are means to post data on Discord channel programmatically. The gathered data can also be conveniently viewed on a channel. Discord is increasingly popular among threat actors because of this functionality, as it involuntarily provides support for malware distribution (use of its CDN), command-and-control (webhooks) or creating communities centered around buying and selling malware source code and services (e.g. DDoS). The information gathered at this step lets the threat actor witness the effectiveness of their tools in infecting machines. The list of victims may also be collected to carry out potential post-exploitation steps.

New AI-Based Augmented Innovation Tool Promises to Transform Engineer Problem Solving

What will often happen is that as you work through both the “Functional Concepts” and “Inventive Principles” lists you begin to realize that you’ve omitted elements to your description, or that your description should go in a slightly different direction based on the results. While this represents a slightly iterative process, each iteration is just as fast as the first. In fact, it's faster because you no longer need to spend 10 minutes writing down your changes. All along the process, there's a workbook, similar to an electronic lab notebook, for you to jot down your ideas. As you jot down your ideas based on the recommendations from the AI, it will offer you the ability to run a concept evaluation, telling you whether the concept is “marginally acceptable” or “good”, for example. You can use this concept evaluation tool to understand whether you have written your problem and solution in a way that it's unique or novel, or whether you should consider going back to the drawing board to keep iterating on it.

Unconventional Superconductor May Unlock New Ways To Build Quantum Computers

Scientists on the hunt for an unconventional kind of superconductor have produced the most compelling evidence to date that they’ve found one. In a pair of papers, researchers at the University of Maryland’s (UMD) Quantum Materials Center (QMC) and colleagues have shown that uranium ditelluride (or UTe2 for short) displays many of the hallmarks of a topological superconductor — a material that may unlock new ways to build quantum computers and other futuristic devices. “Nature can be wicked,” says Johnpierre Paglione, a professor of physics at UMD, the director of QMC and senior author on one of the papers. “There could be other reasons we’re seeing all this wacky stuff, but honestly, in my career, I’ve never seen anything like it.” All superconductors carry electrical currents without any resistance. It’s kind of their thing. The wiring behind your walls can’t rival this feat, which is one of many reasons that large coils of superconducting wires and not normal copper wires have been used in MRI machines and other scientific equipment for decades.

Combating deepfakes: How we can future-proof our biometric identities

Deepfakes refer to manipulated videos or other digital representations produced by sophisticated artificial intelligence (AI), which yield fabricated images and sounds that appear to be real. While video deepfakes are arguably the most common, audio deepfakes are also growing in popularity. ... Firstly, we must think about how biometric authentication works. Take voice biometrics as an example: a good fake voice (even just a good impersonator) can be enough to fool a human. However, voice biometric software is much better at identifying differences that the human ear either doesn’t discern or chooses to ignore, which means that voice biometric ID can help prevent fraud if identity is checked against the voice. Even so-called deep fakes create a poor copy of someone’s voice when analyzed at the digital level; they make quite convincing cameos, especially when combined with video, but again these are poor imitations at a digital level. Outside of this, the ability for deepfakes to bypass biometrics-based solutions will ultimately be dependent on the type of liveness detection that is integrated into the solution.

Is EDR The Silver Bullet For Malware?

Absolute security isn’t possible, as we all know — our control framework is only as strong as our weakest link. In recent years, we’ve seen great strides in innovation surrounding virtualization tools. This new technology, while useful to organizations and users in general, has also given hackers more power to bypass traditional defenses. To prove this, I carried out a small exercise — I aimed to avoid an EDR solution using a virtualization tool. Virtualization technology has opened up many doors for businesses hoping to scale up, but security controls haven’t scaled fast enough to secure these virtualized environments. As such, we’re currently only focused on deploying EDR solutions on physical endpoints because many people assume that anything running on a physical host will be protected from malicious activities. When it comes to virtualization, these tools create an opaque layer on which they manage an environment. Because of this, any EDR solution running on the physical host won’t have visibility on the files and services running on that virtualized image. I used this concept to bypass an EDR solution running on a physical host to simulate an attack on the network.

Moving into "Modern Test Leadership"

Test leaders can ignite passion in testers by finding ways to engage them. Start a community of practice, share blogs, videos, podcasts or get external speakers to come and share their wisdom with the team. You may find from trying some of these, that some of the testers may start wanting to try new ways of testing, or start learning new skills. The next step would be to nurture that passion, point them in the right direction for their career and let them run with it. ... The role of a test leader needs to change; gone are the days of a test manager being the sole point of contact from a quality perspective and being responsible for handing out testing tasks to a team. With the world of agile/DevOps becoming a lot more prominent, the role needs to evolve to being more a test coach, advocating for good testing practices, helping to evolve the culture, raising awareness of what the testers can do and what good quality is. They need to be a servant leader and support their team to fulfil their potential. Being a test leader in the current world is a challenge, but you really can reap what you sow.

Quote for the day:

"Leadership should be born out of the understanding of the needs of those who would be affected by it. " -- Marian Anderson

Daily Tech Digest - July 19, 2021

IoT security: Development and defense

While IoT adoption continues to grow, the standards, compliance requirements and secure coding practices surrounding IoT have not advanced at the same rate. Recent high profile software supply chain attacks have brought the issue of secure coding into sharp focus, prompting the Biden administration to issue an executive order addressing new requirements for federal agencies to only purchase and deploy secure software. This pivotal shift will have an immediate impact on global software development processes and lifecycles, especially when you consider the vast reach of U.S. federal procurement. Virtually all device manufacturers and software companies will be impacted directly as the administration begins to increase obligations on the private sector and establish new security standards across the industry. Specific to IoT, the order directs the federal government to initiate pilot programs to educate the public of the security capabilities of IoT devices, and to identify IoT cybersecurity criteria and secure software development practices for a consumer-labeling program.

Efficient unit-testing with a containerised database

The real problem is mixing two languages in one body of code. The dbUtil handle is just a boilerplate reduction device here. The raw SQL is still there. We still can’t test the complex individual statements separate from the simple yet crucial control logic captured in the if-statements, which depend solely on the state of the person object, not on the database. Sure, we can test this control logic fine if we mock out the calls to the database. The mock for dbUtil returns a prepared list of person objects, and we can verify the correct invocation of it for the two different conditions. That unavoidably leaves the SQL untested. If we want to test the execution of these statements, we need to run the entire code inside the for loop, this time using a real database. That test needs to set up the conditions for all the three execution paths (condition 1, 1 and 2, or none), as well as verify what happened to the state after executing the void statement executions. It can be done, but we are of necessity testing both the Java and SQL realms here. That’s hardly the lean unit testing we’re looking for.

Ansible vs Docker: A Detailed Comparison Of DevOps Tools

Ansible is an open-source automation engine that helps in DevOps and comes to the rescue to improve your technological environment’s scalability, consistency, and reliability. It is mainly used for rigorous IT tasks such as configuration management, application deployment, intraservice orchestration, and provisioning. In recent times, Ansible has become the top choice for software automation in many organizations. Automation is one of the most crucial aspects of industries these days. Unfortunately, many IT environments are too complex and often require to be scaled too quickly for system administrators and developers to keep up, rather than manually. ... Docker is an open-source platform application for developing, shipping, and running applications. It enables developers to package applications into containers, a set of standardized and executable components that combine the application source code with the operating system libraries and dependencies required to run that code in an executable environment. Containers can even be created without Docker, but the platform and user interface make it easier, simpler, and safer to build, deploy and manage containers.

Delegation and Scale: How Remote Work Affected Various Industries

The basic goal of delegation of authority is to enable efficient organization. Just as no single individual in a company can do all of the tasks required to achieve a group's goals, it becomes arduous for the management to wield all decision-making authority as a business expands. This is because there is a limit to the number of people a manager can successfully monitor and make decisions. When this threshold is reached, the authority must be handed to subordinates. While centralization was still a possibility before the pandemic, this was no longer the case after back-to-back lockdowns and economic slowdowns. In such a situation, the delegation came as a boon that not only kept the workflow active but also helped in scaling the growth. ... Delegating gives your team greater confidence, makes them feel important, and allows them to demonstrate their abilities. This will result in mutual appreciation with colleagues motivating one another to work more, and staying devoted to attaining the goals.

Seeking a Competitive Edge vs. Chasing Savings in the Cloud

If companies do not make changes to their IT operations in response to a migration, finding savings can be more difficult, L’Horset says. “In the industry, there’s a lot of debate: Is cloud saving you money or not? Our research indicates that even at the basic level, yes it does,” he says. “The difference between the cost-savings, which you can get through cloud, and the value of innovation that you absolutely can and should get through cloud, is the fundamental reason you should go.” Roy Illsley, chief analyst with Omdia, the research arm of Informa Tech, says the cost benefits of cloud can be positive if the workload is variable in its resource requirements, its resource requirements match the cloud providers packaging of resources, or it requires high availability. "If the workload is stable in its resource requirements then on-premises is more cost effective," he says. Respondent companies to the Accenture survey that did not list cloud as a top priority still saw significant cost-savings, says Jim Wilson, managing director of information technology and business research at Accenture Research.

7 Ways AI and ML Are Helping and Hurting Cybersecurity

AI/MI is used in network traffic analysis, intrusion detection systems, intrusion prevention systems, secure access service edge, user and entity behavior analytics, and most technology domains described in Gartner's Impact Radar for Security. In fact, it's hard to imagine a modern security tool without some kind of AI/ML magic in it. ... Through social engineering and other techniques, ML is used for better victim profiling, and cybercriminals leverage this information to accelerate attacks. For example, in 2018, WordPress websites experienced massive ML-based botnet infections that granted hackers access to users' personal information; ... Ransomware is experiencing an unfortunate renaissance. Examples of criminal success stories are numerous; one of the nastiest incidents led to Colonial Pipeline's six-day shutdown and $4.4 million ransom payment; ... ML algorithms can create fake messages that look like real ones and aim to steal user credentials. In a Black Hat presentation, John Seymour and Philip Tully detailed how an ML algorithm produced viral tweets with fake phishing links that were four times more effective than a human-created phishing message.

Electronic signatures: please sign on the digital line

First, let’s look at the importance of content to a business. In simple terms, content is the inherent value of a company. It’s NASA’s designs for their new space station, AstraZeneca’s highly regulated pharmaceutical patents, and Oxfam’s humanitarian aid records. It’s the clinical trial results for the next breakthrough vaccine, or the blueprint for the innovative new approach to flooding solutions. Content is the entire work of an organisation and is completely unique for every company. Content is the database of its most valuable insights. But to effectively realise this value, organisations need to find a single place for their content. Separating content between different silos and applications creates friction, which can stand in the way of employees accessing and sharing information, inhibiting innovation and productivity. Applications in today’s content-driven world are often judged by their ease of integration with other technologies. As a result, businesses are turning to single platforms where content can be securely stored and managed, while all compliance requirements are met and all teams have the opportunity to collaborate on the content, both internally and externally.

Protect your smartphone from radio-based attacks

An IMSI catcher is equipment designed to mimic a real cell tower so that a targeted smartphone will connect to it instead of the real cell network. Various techniques may be employed to do it, such as masquerading as a neighboring cell tower or jamming the competing 5G/4G/3G frequencies with white noise. After capturing the targeted smartphone’s IMSI (the ID number linked to its SIM card), the IMSI catcher situates itself between the phone and its cellular network. From there, the IMSI catcher can be used to track the user’s location, extract certain types of data from the phone, and in some cases even deliver spyware to the device. Unfortunately, there’s no surefire way for the average smartphone user to notice/know that they’re connected to a fake cell tower, though there may be some clues: perhaps a noticeably slower connection or a change in band in the phone’s status bar (from LTE to 2G, for example). Thankfully, 5G in standalone mode promises to make IMSI catchers obsolete, since the Subscription Permanent Identifier (SUPI) – 5G’s IMSI equivalent – is never disclosed in the handshake between smartphone and cell tower.

The value of data — a new structural challenge for data scientists

Some companies with data scientists in place have difficulty operationalising their skills. If we look at the volumes of data processed by organisations, the different structures and architectures, it is not imperative to have a data scientist in its ranks of data experts. For companies managing an astronomical amount of data, on multiple channels and with a complex structure, the expertise of a data scientist will prove beneficial in modeling data, query it and make predictions. One of the first questions to ask is therefore related to data and business needs and to organise the structure according to an organisation’s structure and its data strategy. Companies have also realised that having a data scientist was not the answer to their data value problems. This is partly due to a lack of understanding in the environment surrounding data. A data scientist may understand the data, but not its purposes and environments or business applications. Let’s take the example of a marketing department working on implementing AI to accelerate its web ROI.

Interview With Prof B Ravindran, Head, Robert Bosch Centre For Data Science & AI

Interpretability of deep learning models is essential for widespread adoption of these techniques in the Medical image diagnosis community. Deep learning models have been phenomenally successful at beating state of the art in common medical image diagnosis tasks like segmentation and screening applications, e.g. classification of diabetic retinopathy and chest X-ray scans, among others. While these successes have created huge interest in adopting these techniques in clinical practice, a huge barrier in adoption is the lack of interpretability of these models. Convolutional Neural Networks with hundreds of layers is the workhorse for medical image diagnosis. While the initial layers are typically edge detectors and shape detectors, it is fairly impossible to explain or interpret the feature maps as one goes deeper into the network. In order for clinicians to trust the output from these networks, it is essential that a mechanism for explaining the output be present. In addition, black-box techniques will make it hard for clinicians to justify the diagnosis and follow up procedures.

Quote for the day:

"Honor bespeaks worth. Confidence begets trust. Service brings satisfaction. Cooperation proves the quality of leadership." -- James Cash Penney

Daily Tech Digest - July 18, 2021

How to answer the age-old question: Could this meeting have been an email?

Companies want their people to be productive and their processes and systems to be efficient. “From an efficiency perspective, meetings to discuss a challenging issue or to make a decision are a good investment of time,” says Christie. “It is a better use of the team’s time to get them in a room together for 30 minutes to debate an issue or make a decision, than it is to send multiple emails seeking input, to read all of the input, to synthesize the input, and then arrive at a decision which then needs to be disseminated.” ... Before you send out a calendar invite, consider that meetings are multiples of their attendees, says Burns. “If a bad six-minute meeting has 10 attendees, that’s an hour of wasted productivity,” he says. “Now imagine a bad 30-minute meeting with three people or more.” Meetings are requests for someone’s time, so carefully evaluate the its cost or benefit, says Janardan. ... Resist the urge to default to a meeting, says Janardan: “Remind yourself of all the things that got resolved when you had those casual run-ins at work and try to recreate them—whether you are in-person or not. Sometimes the fastest way to come to a solution is to just pick up the phone or physically seek out a colleague if you are spending more time in a physical office.”

Researchers Create New Approach to Detect Brand Impersonation

These attacks, in which adversaries craft content to mimic known brands and trick victims into sharing information, have grown harder to detect as technology and techniques improve, says Justin Grana, applied researcher at Microsoft. While business-related applications are most often spoofed in these types of attacks, criminals can forge brand logos for any organization. "Brand impersonation has increased in its fidelity, in the sense that, at least from a visual [perspective], something that is malicious brand impersonation can look identical to the actual, legitimate content," Grana explains. "There's no more copy-and-paste, or jagged logos." In today's attacks, visual components of brand impersonation almost exactly mimic true content. ... While too many types of content can present a detection challenge, too few can do the same. Many brands, such as regional banks and other small organizations, aren't often seen in brand impersonation, so there might only be a handful of training examples for a system to learn from.

The 10 temptations you should not fall into as a leader

The path of leadership is plagued with complex situations, which merit making unpleasant decisions. A layoff, sanctions of different kinds, tackling a tactic, abandoning a long-standing customer or an established supplier. In this sense, a frequent error of being observed happens because, due to lack of courage or fear of losing the admiration of collaborators, one avoids taking this type of action, with the naive idea of assuming that “everything happens”. On the contrary, each and every one of these situations that are not resolved tend to increase their emotional volume as the days go by and constantly acquire an increasingly bitter taste. ... Leaders who fall into this temptation have a clear component of insecurity, feeling that if they do not know everything that happens, they could be in danger. Then, people who use the logic of mistrust as a standard, will place a collaborator "of his kidney" whose main responsibility will be to tell him everything that his colleagues say, do or even think. The effects of this are lethal. The credibility of the leader is undermined and collective mistrust is strengthened, seriously affecting the transparency that the team culture requires as the oxygen for its operation.

Beginner’s Guide To Machine Learning With Apache Spark

Spark is known as a fast, easy to use and general engine for big data processing. A distributed computing engine is used to process and analyse large amounts of data, just like Hadoop MapReduce. It is quite faster than the other processing engines when it comes to data handling from various platforms. In the industry, there is a big demand for engines that can process tasks like the above. Today or later, your company or client will be asked to develop sophisticated models that would enable you to discover a new opportunity or risk associated with it, and this all can be done with Pyspark. It is not hard to learn Python and SQL; it is easy to start with it. Pyspark is a data analysis tool created by the Apache Spark community for using Python and Spark. It allows you to work with Resilient Distributed Dataset(RDD) and DataFrames in python. Pyspark has numerous features that make it easy, and an amazing framework for machine learning MLlib is there. When it comes to huge amounts of data, pyspark provides you with fast and real-time processing, flexibility, in-memory computation and various other features.

Facebook AI Releases ‘BlenderBot 2.0’: An Open Source Chatbot

BlenderBot 2.0 is better at conducting more extended, more knowledgeable, and factually consistent conversations over multiple sessions than the existing state-of-the-art chatbot. BlenderBot’s improved conversational abilities have made it a serious contender for artificial intelligence research. The AI model takes the information it gets from conversations and stores them in long-term memory. The knowledge is stored separately for each person they speak to, which ensures that new information learned in one conversation can’t be used against another. This model can read and respond in real-time, making it an excellent tool for keeping up with current events. It can scan the internet for new information to have a more up-to-date conversation. Facebook AI Research is releasing the complete model, code, and evaluation set up to help advance conversational AI research. The Facebook team combined human conversations with internet searches that have been bolstered for training purposes.

The Evolving Role of the CISO

In the era of the digital workplace, CISOs must not only focus on preventing threats, but create systems that work for the business and still keep everyone protected. Constant innovation, creation and implementation of unique strategies are already part of the CISOs job description. ... Decision-making that ties business strategy and security processes into a firm knot is the only way to stand straight amidst the faced-paced, ever-changing storm of digital services. The role of the CISO is evolving faster than ever, and becoming the jack of all security and business trades. On Monday, they’re the superheroes keeping the cybercriminals out. On Tuesday, they’re improving the organization’s security posture. By the end of the week they’re C-suite ambassadors and innovating the concept of security, all while delivering positive business value. As the role continues to evolve and the CISO’s depth and breadth of knowledge regarding the business, its underlying technology and its core risks, the role will continue to elevate outside of IT and be seen as a peer of the CIO.

Is DeFi the future of financial infrastructure and money?

DeFi apps could benefit by borrowing some of the legacy concepts, particularly in terms of compliance and consumer experience. For example, they could definitely make the front-end of these apps a much better customer experience for end users. The DeFi space also doesn’t really have a concept of customer relationship management nor typically collects any amount of consumer data. While great from a privacy perspective, there is great value in understanding the customer better. There are security audits DeFi products do, but they feature none of the security guarantees most consumers are accustomed to in the traditional financial world. Notifications or alerts also don’t really exist at all in the DeFi space. In terms of products, there are tools to measure blockchain activity, but not to measure engagement within DeFi applications. Most of the developers in the crypto space are building right on top of the layer one protocol itself. There aren’t any concepts of developer platforms or middleware yet. In traditional finance, if you make a mistake, a financial institution can initiate a rollback of the transaction – this doesn’t exist at all in DeFi yet.

How Blockchain and Cryptocurrency Can Revolutionize Businesses

Unlike traditional card payments, which can be reversed using the chargeback feature, Bitcoin and other cryptocurrency payments cannot be reversed. Because each transaction is securely recorded, there is a long-term audit trail that can be utilized to trace transactions and verify their authenticity. As a result, each transaction has greater audibility and accountability, dramatically reducing the likelihood of fraudulent transactions. This audibility feature can also be used to track other assets, allowing businesses to keep a database of various types of information about these assets up to date. Increased traceability of the supply chain The use of blockchain-based applications makes it easier to track products and goods as they move through different stages of the supply chain. The ability to monitor suppliers in real-time, eliminate human errors in data updating and use smart contracts for payments is expected to transform the global supply chain industry. With the supply chain becoming more efficient, organizations can shift their focus on cutting down other costs and more efficiently streamlining other processes, including production.

The lighthouse signals a digital disruption storm

In BFSI, with remote working/collaboration and digital transactions, cybersecurity has become one of the main focus points during the COVID-19 pandemic, adds Rajdeep Saha, Managing Director, Financial Services – Technology Consulting Practice, Protiviti India. “In this context, secure access service edge (SASE) and Zero Trust model can help create a single cloud-native security service, coupled with other enablers.” Tare recommends a host of measures underlining the new role that artificial intelligence (AI) and analytics would be playing ahead. “Cyberattack insurance is now available from several organisations. A bundle like this is a must for all financial institutions. Security analytics, machine learning, and artificial intelligence are some of the cutting-edge technologies that are helping strengthen the cyber defense mechanism. Before threats assault your infrastructure, the finest protection mechanisms detect and neutralise risks.” Implementation of PCI-DSS compliance, card payment security, and others have reduced the impact of cyber threats in financial institutions, he adds.

Is Cryptocurrency-Mining Malware Due for a Comeback?

Cryptocurrency mining refers to solving computationally intensive mathematical tasks. In the case of bitcoin, such tasks are used to verify the blockchain, or public ledger, of transactions. As an incentive, anyone who mines for cryptocurrency has a chance of getting some cryptocurrency back as a reward. But for bitcoin and some other types of cryptocurrency, the amount of reward decreases as more blocks get added. Mining can consume copious amounts of electricity - so much so, that some studies have found it would be cheaper to buy gold outright rather than obtain cryptocurrency via mining. Such calculations are always in flux, with the rise and fall in cryptocurrency value. But for attackers, the easiest approach is to have someone else pay for the power while they walk away with the cryptocurrency. ... The takeaway for security teams, as ever, is vigilance, because if attackers can sneak cryptominers onto an organization's systems - eating up processing power and racking up sky-high electricity bills - they might put something nastier there too.

Quote for the day:

"The level of morale is a good barometer of how each of your people is experiencing your leadership." -- Danny Cox

Daily Tech Digest - July 17, 2021

Preparing The Office For The AI Revolution

Continuous learning should already be a key part of your culture. Training and developing awareness of AI capabilities and benefits is simply another string to the bow. It helps your business stay competitive, but it also feeds into employee engagement, retention and attracting new talent. It may be that you organize on-site workshops or for those who want it or subsidize an advanced degree program. Every employee is different, so it’ll take some mixing and matching to tailor your efforts to their preferred learning environments, but harnessing this learning and applying these new skills within your business not only nurtures talent, but it also fosters forward-thinking, equipping your people with the skills and the mentality — resilience even — to evolve with the ever-changing world of work. Your people are your most important asset — we all know this. Finding the right people for your business can be the difference between success and failure. However, finding the right combination of people and technology can give you an even greater competitive advantage one that you never even considered.

5 years until enterprise quantum, but your prep begins now

Taking a longer view of the enterprise quantum computing journey will yield greater benefit and business value. That means defining the link between your organization’s quantum program and broader business strategies. Ideally, set up a feedback loop where business strategies help to prioritize quantum program outcomes and the quantum program informs new strategies. ... Navigating the rapidly evolving quantum ecosystem is difficult, with an increasing variety of vendors, academic institutions, startups, and cloud-based service providers. Selecting the right company requires identifying which ones can understand your specific business use case(s) and provide the type of quantum technology you need for your specific strategy. One challenge can be around making long-term commitments to quantum partners. Hardware and software providers have until recently been focused on finding a few high-value strategic collaborators, as reflected in their access contracts or licensing terms, lengthy subscription models, or research programs.

Ransomware attacks show we're getting clobbered on cybersecurity

The Colonial Pipeline and JBS attacks disrupt the traditional construct that makes IT attacks the playground of criminals and OT attacks the purview of hostile intelligence services. Criminals now have a taste of how lucrative an OT attack might be. Will we start to see criminals target OT infrastructure more often? That is certainly the concern of law enforcement and the intelligence community. Attacks on infrastructure by criminals who aren’t deterred by diplomatic niceties changes the game. This concern was reflected in announcements on Friday by the Department of Justice that ransomware extortions will immediately move up the priority stack to equal terrorism. FBI Director Christopher Wray followed up by likening the surge in ransomware hacks to 9/11. These are startling statements that wouldn’t have been issued without the Colonial Pipeline attack. Interesting what some gas station waiting lines will trigger. Lurking behind all this is a scenario that has our protectors reaching for antacids. Are enemy intelligence services making moves to leverage criminal organizations to attack OT infrastructure, with all its debilitating effects, in a kind of proxy cyber war?

Linux Variant of HelloKitty Ransomware Targets VMware ESXi Servers

The days when Linux, Unix and other Unix-like computer operating systems weren’t typically targeted by malware authors are long gone. It might well have been the case that attackers used to prefer bedeviling Windows systems, given that Windows instances are far more widespare than Linux instances. As well, Linux instances are generally well-protected against vulnerabilities, thanks to a tight-knit user base that delivers fast security updates. Andrew Barratt, managing principal of solutions and investigations at cybersecurity advisory firm Coalfire, told Theatpost on Friday that we said goodbye to the days when malware didn’t target Linux “a long time ago,” but that change was typically server-side and hence not particularly visible to the public. “With the rise of Mac OS on the desktop and its underlying infrastructure being based on BSD – everyone’s favourite ‘hard nix’ – there has been a correlation in *nix based malware as attackers target the Apple end user,” Barratt said in an email, *nix being shorthand for any Unix, Linux or other Unix-like systems.

Assessing the Feasibility of Research and Data Science Projects

Estimating the probability of technical success — designated as P(T) from now on — is an exercise in identifying the salient risk factors, then scoring each individually on a consistent scale before plugging the values into a mathematical function. Easy. But what exactly is “technical success”? The definition of P(T) is as follows: a likelihood that, given existing data, available technologies, required research, and development, the prototype will be completed and will perform the defined function in a curated laboratory or constrained production environment. P(T) is given as a percentage. The definition is important as it sets expectations for the deliverables. We limit the scope of P(T) to the prototype designed to test the technologies and convince a moderate sceptic that the approach works. The tests should run in a limited but representative case and use a vetted data set. Why the limitations? They decrease the time needed to develop the prototype without compromising the evaluation. They reduce the chance of misalignment with final goals by facilitating minor, continual adjustments.

Top 10 Low-Code App Development Best Practices to Follow

It’s a better idea to put an imperfect application in production than it is to release a fully-baked one. Succeeding with low-code means dividing your application into meaningful chunks and publishing them as often as you can. The idea is to constantly get immediate field feedback from users and make consistent small improvements. Conduct regular feedback sessions with your team members and see how the app operates and what it lacks. ... Low-code platforms provide prepared UI libraries with consistent components. They’re easy to use, and it’s a good practice to create a simple platform that borrows the best features from market leaders. It will take less time and money than creating a unique UI/UX and will allow you to release your app faster. In our experience, UX specialists bring value at the beginning of the project, but later their role decreases significantly, and on the off chance that UX and Visual Design support is needed later on, experts can contribute on an as-needed basis. ... To continue developing a good product, you should always communicate with the low-code community and your users.

The ICE Blockchain

The purpose of this new blockchain is the much-needed addition of EVM compatibility to our ecosystem. We believe EVM compatibility is paramount for the growth of the ICON Network (see Polygon’s recent success as a good indicator of its importance). It enables developers to iterate and innovate much faster using existing tooling and code from the Ethereum ecosystem and allows for increased growth prospects of ICON given easier portability of applications. Additionally, with this new chain, we are also adding eWASM support that puts us ahead of the game, preparing us for ETH 2.0 compatibility. ... The ICE blockchain will start as a Proof of Authority network, with trusted validators operating the chain. After the network is stabilized, it will migrate to NPoS, the consensus mechanism commonly used by other Substrate SDK networks. NPoS is a variation of DPoS (ICON Network’s current consensus mechanism), where token holders vote for validators to produce blocks and govern the network. Smart contracts on the ICE Network will be written in Solidity, Rust, and C++. Fees for smart contract interactions, smart contract deployments, and token transfers will be paid in ICE tokens.

Physical threats increase as employees return to the office

“As corporations advance the digital transformation of their physical security operations, it has never been more important to seize the opportunity to align their cybersecurity operations and infrastructure,” said Lukas Quanstrom, CEO of Ontic. “Bringing together all threat data and intelligence in an always-on, technology-driven approach to security is the most effective way to advance business continuity in today’s increasingly hyper-connected, hyper-violent environment.” ... Of the physical threats that resulted in harm or death at companies in 2021, 49% of respondents think most or almost all could have been avoided if cybersecurity and physical security intelligence were unified so threats could be shared and actioned by cross-functional teams. 55% of physical security and IT leaders say their CEO believes training employees so they are better prepared for potential workplace violence will create a culture of fear. 26% of those surveyed say their company has never addressed the potential for workplace violence and employees would not know what to do if an active shooter entered their facilities.

How To Increase Security, Save Money And Make Everyone Happy (Except Cybercriminals)

First, repeated coding vulnerabilities caught by the security team create frustration for both groups, causing dissension that can impede innovation. Further, the cycle of coding, testing, fixing and then retesting for vulnerabilities delays application releases and extends time to value. And when vulnerabilities lead to successful cyberattacks, everyone is frustrated. The legal and compliance teams face regulatory repercussions. Customers and partners lose trust in the organization. And the C-suite and board see the full scope of the ramifications: time and money wasted, privacy violations and fines, loss of intellectual property, customer and partner attrition, and lawsuits and brand damage. As a result, ensuring secure code from the very beginning of the software development life cycle cannot be ignored as an essential part of a comprehensive cybersecurity defense strategy. So how can you close this security gap, eliminate application vulnerabilities at the source and make everyone happy? First, recognize there are no bad guys on your defense team. This is a problem of process — that is, ensuring the right people have the right skills and access to the right information.

Decentralized Finance: The Next Big Threat for the Finance Sector

Decentralized finance, or DeFi, is a fast-growing segment of the financial markets. Based on a blockchain platform, DeFi provides software services that can cut out intermediaries in financial transactions, thereby allowing for financial services, such as mortgages and investment, to be delivered at lower costs. The question is: Will it take off, or will the financial sector push back? ... First of all, there are a host of technical risks and concerns about attacks and hacks that have been very significant in DeFi. There have been hundreds of millions of dollars lost because these systems are not sufficiently mature, robust and resilient. ... There are legal risks as well, where regulators appropriately have concerns about things like money laundering and fraud that are going on in the larger blockchain and cryptocurrency world and as well as in DeFi specifically. The value of these DeFi services is that they are decentralized, so there’s not one actor that is responsible for all of the transactional activity.

Quote for the day:

"It's not about how smart you are--it's about capturing minds." -- Richie Norton

Daily Tech Digest - July 16, 2021

Apps Built Better: Why DevSecOps is Your Security Team’s Silver Bullet

Security should never be an afterthought when developing software and applications. However, as technological advances continue to take hold, the security tools many rely on are changing in real-time, and combatting potential breaches or hacks of your wares before they arise now requires new strategies. To stay one step ahead of bad actors, it’s time to reimagine the application-development process from “DevOps” to “DevSecOps.” DevOps is an evolution of the agile development lifecycle for software that bridges the gap between development and operations teams. It breaks down silos and increases an organization’s ability to deliver applications and services faster than traditional software-development models. Previously, the traditional “waterfall method” required long cycles upfront and resulted in strenuous and tedious processes – and by the time these solutions were deemed ready for release, the market had likely changed. Today, agile software teams have release cycles that are a matter of days or hours, which increases the risk of making mistakes and introducing vulnerabilities.

Organizing Complexity

Suppose complex systems can be described as the sum of simpler components. In that case, the complexity of the simpler components affects the parent system exponentially. The parent system will be much more unpredictable if each individual part becomes less predictable. Remember that experts on a complex system can completely understand the simpler components which combine to create the larger system. This means that each individual piece, large or small, must reach a point where it can be thoroughly understood. In addition to managing the complexity of simpler components, these components must also be easily accessible by the system as a whole. Let's go back to our authentication system. Here, we have a perfectly isolated part that predictably handles a specific authentication format and flawlessly retrieves identity information from a single database. Our authentication system is of little use if it can't pass the data to the appropriate authorization system. Likewise, suppose it can give the data, but the authorization system cannot receive the information. In that case, it is also of little use.

You have a remote workforce – what now?

Unsurprisingly, enterprises may start to look at direct connectivity to the applications themselves. Establishing direct and private connections to your cloud provider can help alleviate some of the new demands on a corporate network caused by remote working. When struggling with maintenance challenges, one approach could be adopting a network model that is flexible and scalable. This is particularly beneficial in the face of unpredictability and potential disruption with connections and bandwidth that can be set up, flexed up, and torn down in near real-time. That’s again where a service that securely connects data centres, clouds, applications and business partners can play a role. By using technologies that interconnect networks and clouds in real-time, businesses can self-provision redundant network links – for a day, a week or even a month – that can be used to carry traffic during maintenance. Furthermore, it is critical to have transparency and visibility over the whole network, allowing IT managers to ensure that business applications are all up-to-date and that employees are running the most secure version. As more and more workers pick up these tools a harsher spotlight has been cast on their suitability.

How to Attract More Computer Science Grads to the Cybersecurity Field

Consider the freshly minted computer science degree holder who comes across a job posting for a cybersecurity "solutions architect" or "presales engineer." Their first reaction might be, "That's a sales position; it doesn't match the skills I've spent the last four (or more) years of my life acquiring." According to the ESG/ISA report, CISOs are doing little to debunk that misperception by only looking for candidates with narrow technical skill sets at the expense of other necessary qualifications. "This may reveal that few CISOs have the blend of business, leadership, communications, and technical skills necessary for success," wrote the report's authors. "CISOs are business, not technical, leaders." Consider the role of a solutions architect. It requires the right mix of social and interpersonal skills and technical strengths. I must be able to dive into the technical weeds with some people and also speak in non-technical terms to employees and their managers. ... So what's the path forward? For college students and midcareer professionals, explore opportunities fully rather than simply reading the title of a job description.

What is Network as a Service (NaaS)?

It's clear that enterprise customers' move to cloud services is the primary driver for NaaS. And while the networking industry is only now sorting out how the cloud world will be effectively networked, NaaS could play a big role in the future. Networking must be virtualized and automated to enable operations at cloud speed, Pluribus's Gill said. "The big question is what services and business models will prevail. With most applications staying in private cloud environments, private cloud NaaS may be the most important." Another key market opportunity will come from NaaS offerings that simplify use of multiple public clouds, so users do not have to be experts in each cloud's native networking stack to operate a multi-cloud environment, Gil said. "With more and more applications moving to Cloud/SaaS, traffic profiles are shifting dramatically," Anderson said. "We used to build campus networks with tremendous aggregation back to a core network – then to our private data center where our app workloads ran. In the future, if most traffic is headed to Cloud/SaaS, are core networks needed anymore?

Reducing the Computational Cost of Deep Reinforcement Learning Research

It is widely accepted that the enormous growth of deep reinforcement learning research, which combines traditional reinforcement learning with deep neural networks, began with the publication of the seminal DQN algorithm. This paper demonstrated the potential of this combination, showing that it could produce agents that could play a number of Atari 2600 games very effectively. Since then, there have been several approaches that have built on and improved the original DQN. The popular Rainbow algorithm combined a number of these recent advances to achieve state-of-the-art performance on the ALE benchmark. This advance, however, came at a very high computational cost, which has the unfortunate side effect of widening the gap between those with ample access to computational resources and those without. In “Revisiting Rainbow: Promoting more Insightful and Inclusive Deep Reinforcement Learning Research”, to be presented at ICML 2021, we revisit this algorithm on a set of small- and medium-sized tasks.

IBM shows quantum computers can solve these problems that classical computers find hard

Big Blue's scientists developed a new classification task and found that a quantum algorithm using the quantum kernel method is capable of finding relevant features in the data for accurate labeling, while for classical computers the dataset looked like random noise. "The quantum kernel estimation routine we use is a general method that can be in principle applied to a wide range of problems," Kristan Temme, researcher at IBM Quantum, tells ZDNet. "In our paper, we formally prove that this quantum kernel estimation routine can give rise to learning algorithms that for specific problems outperform any classical learner." To prove the advantage that the quantum method has over the classical approach, the researchers created a classification problem for which the data can be generated on a classical computer, and showed that no classical algorithm can do better than random guessing when attempting to solve the problem. When viewing the data in a quantum feature map, however, the quantum algorithm was able to predict the labels with high accuracy and at speed.

The rise of the Developer Experience Engineer, and why it matters

Engineering teams need a leader, a Developer Experience Engineer, who ensures developers have the right tools, processes, and environment to maximize productivity and create the greatest business value possible. The DXE is the foundation for engineering team success. They make it easy for developer teams to focus on their highest purpose and generate the highest value by solving, automating, and eliminating the daily toil developers encounter. They are a major unlocking force that boosts teams to new heights. A DX owner or function isn’t a new idea. Twitter formed an “engineering effectiveness” organization in 2014, and Google has a massive “engineering productivity” team. In many companies, however, the role emerges organically and is growing. DXEs implement a common set of principles, maintain the right tools, and create cohesive standards that clear the path to developer success. Without them, too many languages, frameworks, engineering styles, and processes can add drag. A drag on developers is a drag on the business.

Keeping a cohesive and engaged IT team during a pandemic

Like most things in the world of IT, ultimately it boils down to communication. No matter the awesome technology and tools we have, every problem comes down to being a people problem. I don’t mean more meetings - goodness no - but during the meetings we already have make sure to find some time for small talk about hobbies and interests, and absolutely ensure successes and victories and personal milestones are made known and celebrated among the team. The right tools also must come into play; Zoom, GoToMeeting, Google Meet, AWS Chime, and the rest are brilliant tools but video meeting after video meeting stifles productivity and drains people. Instead, consider the other array of tools at your disposal - casual chat applications, project management software, knowledge bases and documentation, task tracking systems, and the like. Harness these to keep your team connected. Consider also the creative options that build up your virtual culture with good-hearted fun that bonds people together. Some companies have brought in a weekly Netflix watch party, others a Tik Tok-style challenge, and some play Jackbox games.

Why Data Science Might Not Be The Right Career For You?

Most people go into data science for the adventure it offers. However, the reality is slightly different. “In most organisations, you’ll have to spread your time between doing technical work and the other, less exciting stuff, ” said Adam Sroka, head of machine learning engineering at Origami. So, if you are not keen on reporting, writing, documenting and delivering presentations, or repeatedly explaining the basics of your models or techniques, project management, administrative overhead, etc to the stakeholders, then the job might not be a right fit for you. Candidates coming from an education or research background often fall into the trap of infinite timescale and infinite budget mindset. “All too often, I have heard protests from data scientists saying they can not put a ‘timeline’ on when their work will be finished, and it will take as long as it takes. This simply is not true and won’t fit well with the culture at most organisations,” said Sroka. ... Communication is pivotal to forge a successful career in data science. For instance, if you are working closely with the company’s decision-makers, maintaining a solid relationship is essential.

Quote for the day:

"It is, after all, the responsibility of the expert to operate the familiar and that of the leader to transcend it." -- Henry A. Kissinger